@heddleagent/execution-host-client 6.0.0-next.0

package/dist/node/http-service.js

@@ -0,0 +1,389 @@
+import { once } from 'node:events';
+import { z } from 'zod';
+import { ExecutionHostStreamEventSchema } from '../contracts/index.js';
+import { ExecutionHostInvocationCancelledError } from '../http-sse/index.js';
+export const DEFAULT_ADOPTER_JWKS_PATH = '/.well-known/jwks.json';
+export const DEFAULT_ADOPTER_CONVERSATION_TURNS_PATH = '/hosted-execution/conversation-turns';
+const DEFAULT_MAX_BODY_BYTES = 64 * 1_024;
+const DEFAULT_MAX_PROMPT_CHARACTERS = 20_000;
+const REDACTED_HEADER_VALUE = '[REDACTED]';
+const MAX_AUTHORIZATION_CHARACTERS = 8_192;
+const PathSchema = z.string().min(1).max(256).regex(/^\/(?:[^?#\s]*)$/, 'must be an absolute path without query, fragment, or whitespace');
+const PublicErrorSchema = z.object({
+    statusCode: z.number().int().min(400).max(599),
+    message: z.string().min(1).max(1_600),
+}).strict();
+class AdopterHttpRequestError extends Error {
+    statusCode;
+    constructor(statusCode) {
+        super('Invalid adopter HTTP request.');
+        this.statusCode = statusCode;
+    }
+}
+/**
+ * Standard Node HTTP edge for adopter-side JWKS and hosted conversations.
+ *
+ * The service owns bounded parsing, credential-header scrubbing, SSE framing,
+ * disconnect cancellation, safe failures, and graceful shutdown. Product
+ * authentication, authorization, identity selection, and persistence stay in
+ * adopter callbacks.
+ */
+export class NodeExecutionAdopterHttpService {
+    #authority;
+    #authenticator;
+    #conversations;
+    #projectError;
+    #reportFailure;
+    #paths;
+    #maxBodyBytes;
+    #maxPromptCharacters;
+    #jwksMaxAgeSeconds;
+    #activeConversations = new Set();
+    #closed = false;
+    #closePromise;
+    constructor(config) {
+        this.#authority = config.authority;
+        this.#authenticator = config.authenticator;
+        this.#conversations = config.conversations;
+        this.#projectError = config.projectError;
+        this.#reportFailure = config.reportFailure;
+        this.#paths = parsePaths(config.paths);
+        this.#maxBodyBytes = z.number().int().min(1).max(1_048_576).parse(config.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES);
+        this.#maxPromptCharacters = z.number().int().min(1).max(200_000).parse(config.maxPromptCharacters ?? DEFAULT_MAX_PROMPT_CHARACTERS);
+        this.#jwksMaxAgeSeconds = z.number().int().min(0).max(86_400).parse(config.jwksMaxAgeSeconds ?? 60);
+    }
+    handle(request, response) {
+        const pathname = readPathname(request.url);
+        if (pathname === this.#paths.jwks) {
+            this.handleJwks(request, response);
+            return true;
+        }
+        if (pathname === this.#paths.conversationTurns) {
+            this.handleConversationTurn(request, response);
+            return true;
+        }
+        return false;
+    }
+    handleJwks(request, response) {
+        request.resume();
+        if (this.#closed) {
+            writeJsonError(response, 503, 'Hosted execution is unavailable.');
+            return;
+        }
+        if (request.method !== 'GET') {
+            writeJsonError(response, 405, 'Method not allowed.');
+            return;
+        }
+        try {
+            writeJson(response, 200, this.#authority.publicJwks(), {
+                'Cache-Control': `public, max-age=${this.#jwksMaxAgeSeconds}`,
+            });
+        }
+        catch (error) {
+            this.#report({
+                phase: 'jwks',
+                errorType: errorType(error),
+                streamAccepted: false,
+            });
+            writeJsonError(response, 500, 'Verification keys are unavailable.');
+        }
+    }
+    handleConversationTurn(request, response) {
+        if (this.#closed) {
+            request.resume();
+            writeJsonError(response, 503, 'Hosted execution is unavailable.');
+            return;
+        }
+        const abortController = new AbortController();
+        const abort = () => abortController.abort(new Error('The owning adopter HTTP request closed.'));
+        request.once('aborted', abort);
+        response.once('close', abort);
+        const active = {
+            abortController,
+            request,
+            response,
+            pending: Promise.resolve(),
+        };
+        active.pending = this.#serveConversation(request, response, abortController.signal).catch((error) => {
+            this.#report({
+                phase: 'conversation',
+                errorType: errorType(error),
+                streamAccepted: response.headersSent,
+            });
+            if (!response.headersSent) {
+                writeJsonError(response, 500, 'Hosted execution request failed.');
+            }
+            else if (!response.destroyed && !response.writableEnded) {
+                response.end();
+            }
+        }).finally(() => {
+            request.removeListener('aborted', abort);
+            response.removeListener('close', abort);
+            this.#activeConversations.delete(active);
+        });
+        this.#activeConversations.add(active);
+    }
+    close() {
+        if (!this.#closePromise) {
+            this.#closed = true;
+            this.#closePromise = this.#closeActiveConversations();
+        }
+        return this.#closePromise;
+    }
+    async #closeActiveConversations() {
+        const active = [...this.#activeConversations];
+        active.forEach(({ abortController, request, response }) => {
+            abortController.abort(new Error('The adopter HTTP service is stopping.'));
+            request.destroy();
+            response.destroy();
+        });
+        await Promise.allSettled(active.map(({ pending }) => pending));
+    }
+    async #serveConversation(request, response, signal) {
+        let authorization;
+        try {
+            authorization = takeAuthorization(request);
+            if (request.method !== 'POST') {
+                request.resume();
+                writeJsonError(response, 405, 'Method not allowed.');
+                return;
+            }
+        }
+        catch (error) {
+            request.resume();
+            writeJsonError(response, error instanceof AdopterHttpRequestError ? error.statusCode : 400, 'Invalid conversation request.');
+            return;
+        }
+        let principal;
+        try {
+            principal = await this.#authenticator.authenticate({
+                authorization,
+                remoteAddress: request.socket.remoteAddress,
+                signal,
+            });
+        }
+        catch (error) {
+            this.#report({
+                phase: 'authentication',
+                errorType: errorType(error),
+                streamAccepted: false,
+            });
+            request.resume();
+            writeJsonError(response, 500, 'Authentication could not be completed.');
+            return;
+        }
+        if (!principal) {
+            request.resume();
+            writeJsonError(response, 401, 'Authentication is required.', {
+                'WWW-Authenticate': 'Bearer',
+            });
+            return;
+        }
+        let prompt;
+        try {
+            const body = await readJsonBody(request, this.#maxBodyBytes, signal);
+            prompt = z.object({
+                prompt: z.string().trim().min(1).max(this.#maxPromptCharacters),
+            }).strict().parse(body).prompt;
+        }
+        catch (error) {
+            const statusCode = error instanceof AdopterHttpRequestError
+                ? error.statusCode
+                : 400;
+            writeJsonError(response, statusCode, 'Invalid conversation request.');
+            return;
+        }
+        let streamed = false;
+        try {
+            for await (const rawEvent of this.#conversations.streamTurn({
+                principal,
+                prompt,
+                signal,
+            })) {
+                const event = ExecutionHostStreamEventSchema.parse(rawEvent);
+                if (!streamed) {
+                    writeEventStreamHeaders(response);
+                    streamed = true;
+                }
+                await writeSseEvent(response, event, signal);
+            }
+            if (!streamed) {
+                writeJsonError(response, 502, 'Execution Host returned no events.');
+                return;
+            }
+            response.end();
+        }
+        catch (error) {
+            const publicError = !streamed ? this.#project(error) : undefined;
+            if (publicError) {
+                writeJsonError(response, publicError.statusCode, publicError.message);
+                return;
+            }
+            if (error instanceof ExecutionHostInvocationCancelledError
+                || signal.aborted) {
+                if (!response.headersSent && !response.destroyed) {
+                    writeJsonError(response, 499, 'Hosted conversation was cancelled.');
+                }
+                return;
+            }
+            this.#report({
+                phase: 'conversation',
+                errorType: errorType(error),
+                streamAccepted: streamed,
+            });
+            if (!response.headersSent) {
+                writeJsonError(response, 502, 'Execution Host conversation failed.');
+            }
+            else if (!response.destroyed && !response.writableEnded) {
+                // A post-acceptance failure deliberately ends without a terminal event.
+                response.end();
+            }
+        }
+    }
+    #project(error) {
+        if (!this.#projectError) {
+            return undefined;
+        }
+        try {
+            const projected = this.#projectError(error);
+            return projected ? PublicErrorSchema.parse(projected) : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    #report(failure) {
+        try {
+            this.#reportFailure?.(Object.freeze({ ...failure }));
+        }
+        catch {
+            // Observability must not change request settlement.
+        }
+    }
+}
+function parsePaths(paths) {
+    const parsed = {
+        jwks: PathSchema.parse(paths?.jwks ?? DEFAULT_ADOPTER_JWKS_PATH),
+        conversationTurns: PathSchema.parse(paths?.conversationTurns ?? DEFAULT_ADOPTER_CONVERSATION_TURNS_PATH),
+    };
+    if (parsed.jwks === parsed.conversationTurns) {
+        throw new Error('Adopter HTTP paths must be distinct.');
+    }
+    return Object.freeze(parsed);
+}
+function readPathname(rawUrl) {
+    try {
+        return new URL(rawUrl ?? '/', 'http://localhost').pathname;
+    }
+    catch {
+        return undefined;
+    }
+}
+function takeAuthorization(request) {
+    const occurrences = request.rawHeaders.reduce((count, headerName, index) => count
+        + (index % 2 === 0 && headerName.toLowerCase() === 'authorization' ? 1 : 0), 0);
+    const raw = request.headers.authorization;
+    request.headers.authorization = raw === undefined
+        ? undefined
+        : REDACTED_HEADER_VALUE;
+    for (let index = 0; index < request.rawHeaders.length; index += 2) {
+        if (request.rawHeaders[index]?.toLowerCase() === 'authorization') {
+            request.rawHeaders[index + 1] = REDACTED_HEADER_VALUE;
+        }
+    }
+    if (occurrences > 1 || Array.isArray(raw)) {
+        throw new AdopterHttpRequestError(400);
+    }
+    if (raw && raw.length > MAX_AUTHORIZATION_CHARACTERS) {
+        throw new AdopterHttpRequestError(400);
+    }
+    return raw;
+}
+async function readJsonBody(request, maxBodyBytes, signal) {
+    const contentType = request.headers['content-type']
+        ?.split(';', 1)[0]
+        ?.trim()
+        .toLowerCase();
+    if (contentType !== 'application/json') {
+        request.resume();
+        throw new AdopterHttpRequestError(415);
+    }
+    const contentLength = request.headers['content-length'];
+    if (contentLength !== undefined) {
+        const declaredLength = Number(contentLength);
+        if (!Number.isSafeInteger(declaredLength) || declaredLength < 0) {
+            request.resume();
+            throw new AdopterHttpRequestError(400);
+        }
+        if (declaredLength > maxBodyBytes) {
+            request.resume();
+            throw new AdopterHttpRequestError(413);
+        }
+    }
+    const chunks = [];
+    let receivedBytes = 0;
+    for await (const chunk of request) {
+        signal.throwIfAborted();
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        receivedBytes += buffer.byteLength;
+        if (receivedBytes > maxBodyBytes) {
+            request.resume();
+            throw new AdopterHttpRequestError(413);
+        }
+        chunks.push(buffer);
+    }
+    if (!request.complete || receivedBytes === 0) {
+        throw new AdopterHttpRequestError(400);
+    }
+    try {
+        return JSON.parse(Buffer.concat(chunks, receivedBytes).toString('utf8'));
+    }
+    catch {
+        throw new AdopterHttpRequestError(400);
+    }
+}
+function writeEventStreamHeaders(response) {
+    response.writeHead(200, {
+        'Cache-Control': 'no-store',
+        'Content-Type': 'text/event-stream; charset=utf-8',
+        Connection: 'keep-alive',
+        'X-Accel-Buffering': 'no',
+        'X-Content-Type-Options': 'nosniff',
+    });
+}
+async function writeSseEvent(response, event, signal) {
+    const frame = [
+        `event: ${event.kind}`,
+        `id: ${event.sequence}`,
+        `data: ${JSON.stringify(event)}`,
+        '',
+        '',
+    ].join('\n');
+    if (!response.write(frame)) {
+        await once(response, 'drain', { signal });
+    }
+}
+function writeJsonError(response, statusCode, message, headers = {}) {
+    writeJson(response, statusCode, { error: { message } }, {
+        'Cache-Control': 'no-store',
+        ...headers,
+    });
+}
+function writeJson(response, statusCode, value, headers = {}) {
+    if (response.headersSent || response.destroyed) {
+        return;
+    }
+    const body = JSON.stringify(value);
+    response.writeHead(statusCode, {
+        'Cache-Control': 'no-store',
+        'Content-Length': Buffer.byteLength(body),
+        'Content-Type': 'application/json; charset=utf-8',
+        'X-Content-Type-Options': 'nosniff',
+        ...headers,
+    });
+    response.end(body);
+}
+function errorType(error) {
+    return error instanceof Error ? error.name : 'unknown';
+}
+//# sourceMappingURL=http-service.js.map

package/dist/node/http-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-service.js","sourceRoot":"","sources":["../../src/node/http-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAKnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,qCAAqC,EAAE,MAAM,sBAAsB,CAAC;AAS7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,wBAAwB,CAAC;AAClE,MAAM,CAAC,MAAM,uCAAuC,GAClD,sCAAsC,CAAC;AAEzC,MAAM,sBAAsB,GAAG,EAAE,GAAG,KAAK,CAAC;AAC1C,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAC7C,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAC3C,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAC3C,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CACjD,kBAAkB,EAClB,iEAAiE,CAClE,CAAC;AACF,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;CACtC,CAAC,CAAC,MAAM,EAAE,CAAC;AASZ,MAAM,uBAAwB,SAAQ,KAAK;IACpB;IAArB,YAAqB,UAA2B;QAC9C,KAAK,CAAC,+BAA+B,CAAC,CAAC;QADpB,eAAU,GAAV,UAAU,CAAiB;IAEhD,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,+BAA+B;IAEjC,UAAU,CAEjB;IACO,cAAc,CAErB;IACO,cAAc,CAEJ;IACV,aAAa,CAEpB;IACO,cAAc,CAErB;IACO,MAAM,CAA0C;IAChD,aAAa,CAAS;IACtB,oBAAoB,CAAS;IAC7B,kBAAkB,CAAS;IAC3B,oBAAoB,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC9D,OAAO,GAAG,KAAK,CAAC;IAChB,aAAa,CAA4B;IAEzC,YAAY,MAAwD;QAClE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,CAC/D,MAAM,CAAC,YAAY,IAAI,sBAAsB,CAC9C,CAAC;QACF,IAAI,CAAC,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CACpE,MAAM,CAAC,mBAAmB,IAAI,6BAA6B,CAC5D,CAAC;QACF,IAAI,CAAC,kBAAkB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CACjE,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAC/B,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,OAAwB,EAAE,QAAwB;QACvD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC/C,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,UAAU,CAAC,OAAwB,EAAE,QAAwB;QAC3D,OAAO,CAAC,MAAM,EAAE,CAAC;QACjB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,kCAAkC,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE;gBACrD,eAAe,EAAE,mBAAmB,IAAI,CAAC,kBAAkB,EAAE;aAC9D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC;gBACX,KAAK,EAAE,MAAM;gBACb,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;gBAC3B,cAAc,EAAE,KAAK;aACtB,CAAC,CAAC;YACH,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,oCAAoC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,sBAAsB,CACpB,OAAwB,EACxB,QAAwB;QAExB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,kCAAkC,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CACvC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CACrD,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAuB;YACjC,eAAe;YACf,OAAO;YACP,QAAQ;YACR,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;SAC3B,CAAC;QACF,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,kBAAkB,CACtC,OAAO,EACP,QAAQ,EACR,eAAe,CAAC,MAAM,CACvB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAChB,IAAI,CAAC,OAAO,CAAC;gBACX,KAAK,EAAE,cAAc;gBACrB,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;gBAC3B,cAAc,EAAE,QAAQ,CAAC,WAAW;aACrC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,kCAAkC,CAAC,CAAC;YACpE,CAAC;iBAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;gBAC1D,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,CAAC;QACH,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACzC,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,yBAAyB;QAC7B,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC9C,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE;YACxD,eAAe,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;YAC1E,OAAO,CAAC,OAAO,EAAE,CAAC;YAClB,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAwB,EACxB,QAAwB,EACxB,MAAmB;QAEnB,IAAI,aAAiC,CAAC;QACtC,IAAI,CAAC;YACH,aAAa,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,OAAO,CAAC,MAAM,EAAE,CAAC;gBACjB,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,cAAc,CACZ,QAAQ,EACR,KAAK,YAAY,uBAAuB,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EACjE,+BAA+B,CAChC,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,SAAgC,CAAC;QACrC,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC;gBACjD,aAAa;gBACb,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa;gBAC3C,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC;gBACX,KAAK,EAAE,gBAAgB;gBACvB,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;gBAC3B,cAAc,EAAE,KAAK;aACtB,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,wCAAwC,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,6BAA6B,EAAE;gBAC3D,kBAAkB,EAAE,QAAQ;aAC7B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;gBAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC;aAChE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,KAAK,YAAY,uBAAuB;gBACzD,CAAC,CAAC,KAAK,CAAC,UAAU;gBAClB,CAAC,CAAC,GAAG,CAAC;YACR,cAAc,CAAC,QAAQ,EAAE,UAAU,EAAE,+BAA+B,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,QAAQ,IAAI,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC;gBAC1D,SAAS;gBACT,MAAM;gBACN,MAAM;aACP,CAAC,EAAE,CAAC;gBACH,MAAM,KAAK,GAAG,8BAA8B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,uBAAuB,CAAC,QAAQ,CAAC,CAAC;oBAClC,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC;gBACD,MAAM,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,oCAAoC,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACjE,IAAI,WAAW,EAAE,CAAC;gBAChB,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,IACE,KAAK,YAAY,qCAAqC;mBACnD,MAAM,CAAC,OAAO,EACjB,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;oBACjD,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,oCAAoC,CAAC,CAAC;gBACtE,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,OAAO,CAAC;gBACX,KAAK,EAAE,cAAc;gBACrB,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;gBAC3B,cAAc,EAAE,QAAQ;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,qCAAqC,CAAC,CAAC;YACvE,CAAC;iBAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;gBAC1D,wEAAwE;gBACxE,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,KAAc;QACrB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC5C,OAAO,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,OAAoC;QAC1C,IAAI,CAAC;YACH,IAAI,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;IACH,CAAC;CACF;AAED,SAAS,UAAU,CACjB,KAAyD;IAEzD,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,IAAI,yBAAyB,CAAC;QAChE,iBAAiB,EAAE,UAAU,CAAC,KAAK,CACjC,KAAK,EAAE,iBAAiB,IAAI,uCAAuC,CACpE;KACF,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,MAA0B;IAC9C,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAwB;IACjD,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAC3C,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK;UAC/B,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAC7E,CAAC,CACF,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAC1C,OAAO,CAAC,OAAO,CAAC,aAAa,GAAG,GAAG,KAAK,SAAS;QAC/C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,qBAAqB,CAAC;IAC1B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAClE,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,KAAK,eAAe,EAAE,CAAC;YACjE,OAAO,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,qBAAqB,CAAC;QACxD,CAAC;IACH,CAAC;IACD,IAAI,WAAW,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,4BAA4B,EAAE,CAAC;QACrD,MAAM,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,OAAwB,EACxB,YAAoB,EACpB,MAAmB;IAEnB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;QACjD,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,EAAE,IAAI,EAAE;SACP,WAAW,EAAE,CAAC;IACjB,IAAI,WAAW,KAAK,kBAAkB,EAAE,CAAC;QACvC,OAAO,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACxD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;YAChE,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,cAAc,GAAG,YAAY,EAAE,CAAC;YAClC,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAClC,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,aAAa,IAAI,MAAM,CAAC,UAAU,CAAC;QACnC,IAAI,aAAa,GAAG,YAAY,EAAE,CAAC;YACjC,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CACf,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC3C,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAwB;IACvD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE;QACtB,eAAe,EAAE,UAAU;QAC3B,cAAc,EAAE,kCAAkC;QAClD,UAAU,EAAE,YAAY;QACxB,mBAAmB,EAAE,IAAI;QACzB,wBAAwB,EAAE,SAAS;KACpC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAwB,EACxB,KAAqD,EACrD,MAAmB;IAEnB,MAAM,KAAK,GAAG;QACZ,UAAU,KAAK,CAAC,IAAI,EAAE;QACtB,OAAO,KAAK,CAAC,QAAQ,EAAE;QACvB,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QAChC,EAAE;QACF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,QAAwB,EACxB,UAAkB,EAClB,OAAe,EACf,UAAkC,EAAE;IAEpC,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QACtD,eAAe,EAAE,UAAU;QAC3B,GAAG,OAAO;KACX,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAChB,QAAwB,EACxB,UAAkB,EAClB,KAAc,EACd,UAAkC,EAAE;IAEpC,IAAI,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE;QAC7B,eAAe,EAAE,UAAU;QAC3B,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;QACzC,cAAc,EAAE,iCAAiC;QACjD,wBAAwB,EAAE,SAAS;QACnC,GAAG,OAAO;KACX,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC","sourcesContent":["import { once } from 'node:events';\nimport type {\n  IncomingMessage,\n  ServerResponse,\n} from 'node:http';\nimport { z } from 'zod';\nimport { ExecutionHostStreamEventSchema } from '../contracts/index.js';\nimport { ExecutionHostInvocationCancelledError } from '../http-sse/index.js';\nimport type {\n  NodeExecutionAdopterFailure,\n  NodeExecutionAdopterHttpHandler,\n  NodeExecutionAdopterHttpPaths,\n  NodeExecutionAdopterHttpServiceConfig,\n  NodeExecutionAdopterPublicError,\n} from './types.js';\n\nexport const DEFAULT_ADOPTER_JWKS_PATH = '/.well-known/jwks.json';\nexport const DEFAULT_ADOPTER_CONVERSATION_TURNS_PATH =\n  '/hosted-execution/conversation-turns';\n\nconst DEFAULT_MAX_BODY_BYTES = 64 * 1_024;\nconst DEFAULT_MAX_PROMPT_CHARACTERS = 20_000;\nconst REDACTED_HEADER_VALUE = '[REDACTED]';\nconst MAX_AUTHORIZATION_CHARACTERS = 8_192;\nconst PathSchema = z.string().min(1).max(256).regex(\n  /^\\/(?:[^?#\\s]*)$/,\n  'must be an absolute path without query, fragment, or whitespace',\n);\nconst PublicErrorSchema = z.object({\n  statusCode: z.number().int().min(400).max(599),\n  message: z.string().min(1).max(1_600),\n}).strict();\n\ntype ActiveConversation = {\n  abortController: AbortController;\n  request: IncomingMessage;\n  response: ServerResponse;\n  pending: Promise<void>;\n};\n\nclass AdopterHttpRequestError extends Error {\n  constructor(readonly statusCode: 400 | 413 | 415) {\n    super('Invalid adopter HTTP request.');\n  }\n}\n\n/**\n * Standard Node HTTP edge for adopter-side JWKS and hosted conversations.\n *\n * The service owns bounded parsing, credential-header scrubbing, SSE framing,\n * disconnect cancellation, safe failures, and graceful shutdown. Product\n * authentication, authorization, identity selection, and persistence stay in\n * adopter callbacks.\n */\nexport class NodeExecutionAdopterHttpService<Principal>\nimplements NodeExecutionAdopterHttpHandler {\n  readonly #authority: NodeExecutionAdopterHttpServiceConfig<Principal>[\n    'authority'\n  ];\n  readonly #authenticator: NodeExecutionAdopterHttpServiceConfig<Principal>[\n    'authenticator'\n  ];\n  readonly #conversations: NodeExecutionAdopterHttpServiceConfig<\n    Principal\n  >['conversations'];\n  readonly #projectError: NodeExecutionAdopterHttpServiceConfig<Principal>[\n    'projectError'\n  ];\n  readonly #reportFailure: NodeExecutionAdopterHttpServiceConfig<Principal>[\n    'reportFailure'\n  ];\n  readonly #paths: Readonly<NodeExecutionAdopterHttpPaths>;\n  readonly #maxBodyBytes: number;\n  readonly #maxPromptCharacters: number;\n  readonly #jwksMaxAgeSeconds: number;\n  readonly #activeConversations = new Set<ActiveConversation>();\n  #closed = false;\n  #closePromise: Promise<void> | undefined;\n\n  constructor(config: NodeExecutionAdopterHttpServiceConfig<Principal>) {\n    this.#authority = config.authority;\n    this.#authenticator = config.authenticator;\n    this.#conversations = config.conversations;\n    this.#projectError = config.projectError;\n    this.#reportFailure = config.reportFailure;\n    this.#paths = parsePaths(config.paths);\n    this.#maxBodyBytes = z.number().int().min(1).max(1_048_576).parse(\n      config.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES,\n    );\n    this.#maxPromptCharacters = z.number().int().min(1).max(200_000).parse(\n      config.maxPromptCharacters ?? DEFAULT_MAX_PROMPT_CHARACTERS,\n    );\n    this.#jwksMaxAgeSeconds = z.number().int().min(0).max(86_400).parse(\n      config.jwksMaxAgeSeconds ?? 60,\n    );\n  }\n\n  handle(request: IncomingMessage, response: ServerResponse): boolean {\n    const pathname = readPathname(request.url);\n    if (pathname === this.#paths.jwks) {\n      this.handleJwks(request, response);\n      return true;\n    }\n    if (pathname === this.#paths.conversationTurns) {\n      this.handleConversationTurn(request, response);\n      return true;\n    }\n    return false;\n  }\n\n  handleJwks(request: IncomingMessage, response: ServerResponse): void {\n    request.resume();\n    if (this.#closed) {\n      writeJsonError(response, 503, 'Hosted execution is unavailable.');\n      return;\n    }\n    if (request.method !== 'GET') {\n      writeJsonError(response, 405, 'Method not allowed.');\n      return;\n    }\n    try {\n      writeJson(response, 200, this.#authority.publicJwks(), {\n        'Cache-Control': `public, max-age=${this.#jwksMaxAgeSeconds}`,\n      });\n    } catch (error) {\n      this.#report({\n        phase: 'jwks',\n        errorType: errorType(error),\n        streamAccepted: false,\n      });\n      writeJsonError(response, 500, 'Verification keys are unavailable.');\n    }\n  }\n\n  handleConversationTurn(\n    request: IncomingMessage,\n    response: ServerResponse,\n  ): void {\n    if (this.#closed) {\n      request.resume();\n      writeJsonError(response, 503, 'Hosted execution is unavailable.');\n      return;\n    }\n\n    const abortController = new AbortController();\n    const abort = () => abortController.abort(\n      new Error('The owning adopter HTTP request closed.'),\n    );\n    request.once('aborted', abort);\n    response.once('close', abort);\n    const active: ActiveConversation = {\n      abortController,\n      request,\n      response,\n      pending: Promise.resolve(),\n    };\n    active.pending = this.#serveConversation(\n      request,\n      response,\n      abortController.signal,\n    ).catch((error) => {\n      this.#report({\n        phase: 'conversation',\n        errorType: errorType(error),\n        streamAccepted: response.headersSent,\n      });\n      if (!response.headersSent) {\n        writeJsonError(response, 500, 'Hosted execution request failed.');\n      } else if (!response.destroyed && !response.writableEnded) {\n        response.end();\n      }\n    }).finally(() => {\n      request.removeListener('aborted', abort);\n      response.removeListener('close', abort);\n      this.#activeConversations.delete(active);\n    });\n    this.#activeConversations.add(active);\n  }\n\n  close(): Promise<void> {\n    if (!this.#closePromise) {\n      this.#closed = true;\n      this.#closePromise = this.#closeActiveConversations();\n    }\n    return this.#closePromise;\n  }\n\n  async #closeActiveConversations(): Promise<void> {\n    const active = [...this.#activeConversations];\n    active.forEach(({ abortController, request, response }) => {\n      abortController.abort(new Error('The adopter HTTP service is stopping.'));\n      request.destroy();\n      response.destroy();\n    });\n    await Promise.allSettled(active.map(({ pending }) => pending));\n  }\n\n  async #serveConversation(\n    request: IncomingMessage,\n    response: ServerResponse,\n    signal: AbortSignal,\n  ): Promise<void> {\n    let authorization: string | undefined;\n    try {\n      authorization = takeAuthorization(request);\n      if (request.method !== 'POST') {\n        request.resume();\n        writeJsonError(response, 405, 'Method not allowed.');\n        return;\n      }\n    } catch (error) {\n      request.resume();\n      writeJsonError(\n        response,\n        error instanceof AdopterHttpRequestError ? error.statusCode : 400,\n        'Invalid conversation request.',\n      );\n      return;\n    }\n\n    let principal: Principal | undefined;\n    try {\n      principal = await this.#authenticator.authenticate({\n        authorization,\n        remoteAddress: request.socket.remoteAddress,\n        signal,\n      });\n    } catch (error) {\n      this.#report({\n        phase: 'authentication',\n        errorType: errorType(error),\n        streamAccepted: false,\n      });\n      request.resume();\n      writeJsonError(response, 500, 'Authentication could not be completed.');\n      return;\n    }\n    if (!principal) {\n      request.resume();\n      writeJsonError(response, 401, 'Authentication is required.', {\n        'WWW-Authenticate': 'Bearer',\n      });\n      return;\n    }\n\n    let prompt: string;\n    try {\n      const body = await readJsonBody(request, this.#maxBodyBytes, signal);\n      prompt = z.object({\n        prompt: z.string().trim().min(1).max(this.#maxPromptCharacters),\n      }).strict().parse(body).prompt;\n    } catch (error) {\n      const statusCode = error instanceof AdopterHttpRequestError\n        ? error.statusCode\n        : 400;\n      writeJsonError(response, statusCode, 'Invalid conversation request.');\n      return;\n    }\n\n    let streamed = false;\n    try {\n      for await (const rawEvent of this.#conversations.streamTurn({\n        principal,\n        prompt,\n        signal,\n      })) {\n        const event = ExecutionHostStreamEventSchema.parse(rawEvent);\n        if (!streamed) {\n          writeEventStreamHeaders(response);\n          streamed = true;\n        }\n        await writeSseEvent(response, event, signal);\n      }\n      if (!streamed) {\n        writeJsonError(response, 502, 'Execution Host returned no events.');\n        return;\n      }\n      response.end();\n    } catch (error) {\n      const publicError = !streamed ? this.#project(error) : undefined;\n      if (publicError) {\n        writeJsonError(response, publicError.statusCode, publicError.message);\n        return;\n      }\n      if (\n        error instanceof ExecutionHostInvocationCancelledError\n        || signal.aborted\n      ) {\n        if (!response.headersSent && !response.destroyed) {\n          writeJsonError(response, 499, 'Hosted conversation was cancelled.');\n        }\n        return;\n      }\n      this.#report({\n        phase: 'conversation',\n        errorType: errorType(error),\n        streamAccepted: streamed,\n      });\n      if (!response.headersSent) {\n        writeJsonError(response, 502, 'Execution Host conversation failed.');\n      } else if (!response.destroyed && !response.writableEnded) {\n        // A post-acceptance failure deliberately ends without a terminal event.\n        response.end();\n      }\n    }\n  }\n\n  #project(error: unknown): NodeExecutionAdopterPublicError | undefined {\n    if (!this.#projectError) {\n      return undefined;\n    }\n    try {\n      const projected = this.#projectError(error);\n      return projected ? PublicErrorSchema.parse(projected) : undefined;\n    } catch {\n      return undefined;\n    }\n  }\n\n  #report(failure: NodeExecutionAdopterFailure): void {\n    try {\n      this.#reportFailure?.(Object.freeze({ ...failure }));\n    } catch {\n      // Observability must not change request settlement.\n    }\n  }\n}\n\nfunction parsePaths(\n  paths: Partial<NodeExecutionAdopterHttpPaths> | undefined,\n): Readonly<NodeExecutionAdopterHttpPaths> {\n  const parsed = {\n    jwks: PathSchema.parse(paths?.jwks ?? DEFAULT_ADOPTER_JWKS_PATH),\n    conversationTurns: PathSchema.parse(\n      paths?.conversationTurns ?? DEFAULT_ADOPTER_CONVERSATION_TURNS_PATH,\n    ),\n  };\n  if (parsed.jwks === parsed.conversationTurns) {\n    throw new Error('Adopter HTTP paths must be distinct.');\n  }\n  return Object.freeze(parsed);\n}\n\nfunction readPathname(rawUrl: string | undefined): string | undefined {\n  try {\n    return new URL(rawUrl ?? '/', 'http://localhost').pathname;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction takeAuthorization(request: IncomingMessage): string | undefined {\n  const occurrences = request.rawHeaders.reduce(\n    (count, headerName, index) => count\n      + (index % 2 === 0 && headerName.toLowerCase() === 'authorization' ? 1 : 0),\n    0,\n  );\n  const raw = request.headers.authorization;\n  request.headers.authorization = raw === undefined\n    ? undefined\n    : REDACTED_HEADER_VALUE;\n  for (let index = 0; index < request.rawHeaders.length; index += 2) {\n    if (request.rawHeaders[index]?.toLowerCase() === 'authorization') {\n      request.rawHeaders[index + 1] = REDACTED_HEADER_VALUE;\n    }\n  }\n  if (occurrences > 1 || Array.isArray(raw)) {\n    throw new AdopterHttpRequestError(400);\n  }\n  if (raw && raw.length > MAX_AUTHORIZATION_CHARACTERS) {\n    throw new AdopterHttpRequestError(400);\n  }\n  return raw;\n}\n\nasync function readJsonBody(\n  request: IncomingMessage,\n  maxBodyBytes: number,\n  signal: AbortSignal,\n): Promise<unknown> {\n  const contentType = request.headers['content-type']\n    ?.split(';', 1)[0]\n    ?.trim()\n    .toLowerCase();\n  if (contentType !== 'application/json') {\n    request.resume();\n    throw new AdopterHttpRequestError(415);\n  }\n  const contentLength = request.headers['content-length'];\n  if (contentLength !== undefined) {\n    const declaredLength = Number(contentLength);\n    if (!Number.isSafeInteger(declaredLength) || declaredLength < 0) {\n      request.resume();\n      throw new AdopterHttpRequestError(400);\n    }\n    if (declaredLength > maxBodyBytes) {\n      request.resume();\n      throw new AdopterHttpRequestError(413);\n    }\n  }\n\n  const chunks: Buffer[] = [];\n  let receivedBytes = 0;\n  for await (const chunk of request) {\n    signal.throwIfAborted();\n    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);\n    receivedBytes += buffer.byteLength;\n    if (receivedBytes > maxBodyBytes) {\n      request.resume();\n      throw new AdopterHttpRequestError(413);\n    }\n    chunks.push(buffer);\n  }\n  if (!request.complete || receivedBytes === 0) {\n    throw new AdopterHttpRequestError(400);\n  }\n  try {\n    return JSON.parse(\n      Buffer.concat(chunks, receivedBytes).toString('utf8'),\n    ) as unknown;\n  } catch {\n    throw new AdopterHttpRequestError(400);\n  }\n}\n\nfunction writeEventStreamHeaders(response: ServerResponse): void {\n  response.writeHead(200, {\n    'Cache-Control': 'no-store',\n    'Content-Type': 'text/event-stream; charset=utf-8',\n    Connection: 'keep-alive',\n    'X-Accel-Buffering': 'no',\n    'X-Content-Type-Options': 'nosniff',\n  });\n}\n\nasync function writeSseEvent(\n  response: ServerResponse,\n  event: z.infer<typeof ExecutionHostStreamEventSchema>,\n  signal: AbortSignal,\n): Promise<void> {\n  const frame = [\n    `event: ${event.kind}`,\n    `id: ${event.sequence}`,\n    `data: ${JSON.stringify(event)}`,\n    '',\n    '',\n  ].join('\\n');\n  if (!response.write(frame)) {\n    await once(response, 'drain', { signal });\n  }\n}\n\nfunction writeJsonError(\n  response: ServerResponse,\n  statusCode: number,\n  message: string,\n  headers: Record<string, string> = {},\n): void {\n  writeJson(response, statusCode, { error: { message } }, {\n    'Cache-Control': 'no-store',\n    ...headers,\n  });\n}\n\nfunction writeJson(\n  response: ServerResponse,\n  statusCode: number,\n  value: unknown,\n  headers: Record<string, string> = {},\n): void {\n  if (response.headersSent || response.destroyed) {\n    return;\n  }\n  const body = JSON.stringify(value);\n  response.writeHead(statusCode, {\n    'Cache-Control': 'no-store',\n    'Content-Length': Buffer.byteLength(body),\n    'Content-Type': 'application/json; charset=utf-8',\n    'X-Content-Type-Options': 'nosniff',\n    ...headers,\n  });\n  response.end(body);\n}\n\nfunction errorType(error: unknown): string {\n  return error instanceof Error ? error.name : 'unknown';\n}\n"]}

package/dist/node/index.d.ts

@@ -0,0 +1,6 @@
+export { ExecutionAuthorityKeyFileError, generateEphemeralExecutionAuthorityKeyPair, generateExecutionAuthorityKeyFile, loadExecutionAuthorityKeyPairFromFile, } from './authority-key.js';
+export { DirectExecutionHostCredentials } from './direct-credentials.js';
+export type { DirectExecutionHostCredentialEnvironmentNames, } from './direct-credentials.js';
+export { DEFAULT_ADOPTER_CONVERSATION_TURNS_PATH, DEFAULT_ADOPTER_JWKS_PATH, NodeExecutionAdopterHttpService, } from './http-service.js';
+export type { NodeExecutionAdopterAuthenticationInput, NodeExecutionAdopterAuthenticator, NodeExecutionAdopterConversationInput, NodeExecutionAdopterConversationService, NodeExecutionAdopterFailure, NodeExecutionAdopterHttpHandler, NodeExecutionAdopterHttpPaths, NodeExecutionAdopterHttpServiceConfig, NodeExecutionAdopterPublicError, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/node/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,0CAA0C,EAC1C,iCAAiC,EACjC,qCAAqC,GACtC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AACzE,YAAY,EACV,6CAA6C,GAC9C,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,uCAAuC,EACvC,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,uCAAuC,EACvC,iCAAiC,EACjC,qCAAqC,EACrC,uCAAuC,EACvC,2BAA2B,EAC3B,+BAA+B,EAC/B,6BAA6B,EAC7B,qCAAqC,EACrC,+BAA+B,GAChC,MAAM,YAAY,CAAC"}

package/dist/node/index.js

@@ -0,0 +1,4 @@
+export { ExecutionAuthorityKeyFileError, generateEphemeralExecutionAuthorityKeyPair, generateExecutionAuthorityKeyFile, loadExecutionAuthorityKeyPairFromFile, } from './authority-key.js';
+export { DirectExecutionHostCredentials } from './direct-credentials.js';
+export { DEFAULT_ADOPTER_CONVERSATION_TURNS_PATH, DEFAULT_ADOPTER_JWKS_PATH, NodeExecutionAdopterHttpService, } from './http-service.js';
+//# sourceMappingURL=index.js.map

package/dist/node/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,0CAA0C,EAC1C,iCAAiC,EACjC,qCAAqC,GACtC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AAIzE,OAAO,EACL,uCAAuC,EACvC,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC","sourcesContent":["export {\n  ExecutionAuthorityKeyFileError,\n  generateEphemeralExecutionAuthorityKeyPair,\n  generateExecutionAuthorityKeyFile,\n  loadExecutionAuthorityKeyPairFromFile,\n} from './authority-key.js';\nexport { DirectExecutionHostCredentials } from './direct-credentials.js';\nexport type {\n  DirectExecutionHostCredentialEnvironmentNames,\n} from './direct-credentials.js';\nexport {\n  DEFAULT_ADOPTER_CONVERSATION_TURNS_PATH,\n  DEFAULT_ADOPTER_JWKS_PATH,\n  NodeExecutionAdopterHttpService,\n} from './http-service.js';\nexport type {\n  NodeExecutionAdopterAuthenticationInput,\n  NodeExecutionAdopterAuthenticator,\n  NodeExecutionAdopterConversationInput,\n  NodeExecutionAdopterConversationService,\n  NodeExecutionAdopterFailure,\n  NodeExecutionAdopterHttpHandler,\n  NodeExecutionAdopterHttpPaths,\n  NodeExecutionAdopterHttpServiceConfig,\n  NodeExecutionAdopterPublicError,\n} from './types.js';\n"]}

package/dist/node/types.d.ts

@@ -0,0 +1,52 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { ExecutionAuthority } from '../authority/index.js';
+import type { ExecutionHostStreamEvent } from '../contracts/index.js';
+export type NodeExecutionAdopterAuthenticationInput = {
+    authorization?: string;
+    remoteAddress?: string;
+    signal: AbortSignal;
+};
+export type NodeExecutionAdopterConversationInput<Principal> = {
+    principal: Principal;
+    prompt: string;
+    signal: AbortSignal;
+};
+export interface NodeExecutionAdopterAuthenticator<Principal> {
+    authenticate(input: NodeExecutionAdopterAuthenticationInput): Principal | undefined | Promise<Principal | undefined>;
+}
+export interface NodeExecutionAdopterConversationService<Principal> {
+    streamTurn(input: NodeExecutionAdopterConversationInput<Principal>): AsyncIterable<ExecutionHostStreamEvent>;
+}
+export type NodeExecutionAdopterPublicError = {
+    statusCode: number;
+    message: string;
+};
+export type NodeExecutionAdopterFailure = {
+    phase: 'jwks' | 'authentication' | 'conversation';
+    errorType: string;
+    streamAccepted: boolean;
+};
+export type NodeExecutionAdopterHttpPaths = {
+    jwks: string;
+    conversationTurns: string;
+};
+export type NodeExecutionAdopterHttpServiceConfig<Principal> = {
+    authority: Pick<ExecutionAuthority, 'publicJwks'>;
+    authenticator: NodeExecutionAdopterAuthenticator<Principal>;
+    conversations: NodeExecutionAdopterConversationService<Principal>;
+    /** Maps adopter-domain failures to intentionally public HTTP errors. */
+    projectError?: (error: unknown) => NodeExecutionAdopterPublicError | undefined;
+    /** Receives credential-free operational metadata, never the raw error. */
+    reportFailure?: (failure: NodeExecutionAdopterFailure) => void;
+    paths?: Partial<NodeExecutionAdopterHttpPaths>;
+    maxBodyBytes?: number;
+    maxPromptCharacters?: number;
+    jwksMaxAgeSeconds?: number;
+};
+export interface NodeExecutionAdopterHttpHandler {
+    handle(request: IncomingMessage, response: ServerResponse): boolean;
+    handleJwks(request: IncomingMessage, response: ServerResponse): void;
+    handleConversationTurn(request: IncomingMessage, response: ServerResponse): void;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/node/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/node/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACf,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEtE,MAAM,MAAM,uCAAuC,GAAG;IACpD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,qCAAqC,CAAC,SAAS,IAAI;IAC7D,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,WAAW,iCAAiC,CAAC,SAAS;IAC1D,YAAY,CACV,KAAK,EAAE,uCAAuC,GAC7C,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,uCAAuC,CAAC,SAAS;IAChE,UAAU,CACR,KAAK,EAAE,qCAAqC,CAAC,SAAS,CAAC,GACtD,aAAa,CAAC,wBAAwB,CAAC,CAAC;CAC5C;AAED,MAAM,MAAM,+BAA+B,GAAG;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,KAAK,EAAE,MAAM,GAAG,gBAAgB,GAAG,cAAc,CAAC;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,qCAAqC,CAAC,SAAS,IAAI;IAC7D,SAAS,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;IAClD,aAAa,EAAE,iCAAiC,CAAC,SAAS,CAAC,CAAC;IAC5D,aAAa,EAAE,uCAAuC,CAAC,SAAS,CAAC,CAAC;IAClE,wEAAwE;IACxE,YAAY,CAAC,EAAE,CACb,KAAK,EAAE,OAAO,KACX,+BAA+B,GAAG,SAAS,CAAC;IACjD,0EAA0E;IAC1E,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,2BAA2B,KAAK,IAAI,CAAC;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC9C,MAAM,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC;IACpE,UAAU,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IACrE,sBAAsB,CACpB,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,cAAc,GACvB,IAAI,CAAC;IACR,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB"}

package/dist/node/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/node/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/node/types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  IncomingMessage,\n  ServerResponse,\n} from 'node:http';\nimport type { ExecutionAuthority } from '../authority/index.js';\nimport type { ExecutionHostStreamEvent } from '../contracts/index.js';\n\nexport type NodeExecutionAdopterAuthenticationInput = {\n  authorization?: string;\n  remoteAddress?: string;\n  signal: AbortSignal;\n};\n\nexport type NodeExecutionAdopterConversationInput<Principal> = {\n  principal: Principal;\n  prompt: string;\n  signal: AbortSignal;\n};\n\nexport interface NodeExecutionAdopterAuthenticator<Principal> {\n  authenticate(\n    input: NodeExecutionAdopterAuthenticationInput,\n  ): Principal | undefined | Promise<Principal | undefined>;\n}\n\nexport interface NodeExecutionAdopterConversationService<Principal> {\n  streamTurn(\n    input: NodeExecutionAdopterConversationInput<Principal>,\n  ): AsyncIterable<ExecutionHostStreamEvent>;\n}\n\nexport type NodeExecutionAdopterPublicError = {\n  statusCode: number;\n  message: string;\n};\n\nexport type NodeExecutionAdopterFailure = {\n  phase: 'jwks' | 'authentication' | 'conversation';\n  errorType: string;\n  streamAccepted: boolean;\n};\n\nexport type NodeExecutionAdopterHttpPaths = {\n  jwks: string;\n  conversationTurns: string;\n};\n\nexport type NodeExecutionAdopterHttpServiceConfig<Principal> = {\n  authority: Pick<ExecutionAuthority, 'publicJwks'>;\n  authenticator: NodeExecutionAdopterAuthenticator<Principal>;\n  conversations: NodeExecutionAdopterConversationService<Principal>;\n  /** Maps adopter-domain failures to intentionally public HTTP errors. */\n  projectError?: (\n    error: unknown,\n  ) => NodeExecutionAdopterPublicError | undefined;\n  /** Receives credential-free operational metadata, never the raw error. */\n  reportFailure?: (failure: NodeExecutionAdopterFailure) => void;\n  paths?: Partial<NodeExecutionAdopterHttpPaths>;\n  maxBodyBytes?: number;\n  maxPromptCharacters?: number;\n  jwksMaxAgeSeconds?: number;\n};\n\nexport interface NodeExecutionAdopterHttpHandler {\n  handle(request: IncomingMessage, response: ServerResponse): boolean;\n  handleJwks(request: IncomingMessage, response: ServerResponse): void;\n  handleConversationTurn(\n    request: IncomingMessage,\n    response: ServerResponse,\n  ): void;\n  close(): Promise<void>;\n}\n"]}

package/dist/testing/event-stream.d.ts

@@ -0,0 +1,17 @@
+import type { ServerResponse } from 'node:http';
+import type { LocalExecutionHostTerminal } from './types.js';
+export declare class LocalExecutionHostEventStream {
+    #private;
+    private constructor();
+    static open(input: {
+        response: ServerResponse;
+        signal: AbortSignal;
+        invocationId: string;
+        runId: string;
+        now: () => Date;
+    }): Promise<LocalExecutionHostEventStream>;
+    publishActivity(activity: unknown): Promise<void>;
+    settle(terminal: LocalExecutionHostTerminal): Promise<void>;
+}
+export declare function parseLocalExecutionHostTerminal(value: unknown): LocalExecutionHostTerminal;
+//# sourceMappingURL=event-stream.d.ts.map

package/dist/testing/event-stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-stream.d.ts","sourceRoot":"","sources":["../../src/testing/event-stream.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAQhD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AA2B7D,qBAAa,6BAA6B;;IAQxC,OAAO;WAcM,IAAI,CAAC,KAAK,EAAE;QACvB,QAAQ,EAAE,cAAc,CAAC;QACzB,MAAM,EAAE,WAAW,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,IAAI,CAAC;KACjB,GAAG,OAAO,CAAC,6BAA6B,CAAC;IAW1C,eAAe,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3C,MAAM,CAAC,QAAQ,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;CA8BlE;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,OAAO,GACb,0BAA0B,CAE5B"}

package/dist/testing/event-stream.js

@@ -0,0 +1,83 @@
+import { once } from 'node:events';
+import { z } from 'zod';
+import { EXECUTION_CONTRACT_VERSION, ExecutionHostStreamEventSchema, OpaqueIdSchema, RuntimePublicResultSchema, } from '../contracts/index.js';
+const ErrorCodeSchema = z.string().min(1).max(128).regex(/^[a-z0-9_]+$/);
+const TerminalSchema = z.discriminatedUnion('kind', [
+    z.object({
+        kind: z.literal('result'),
+        result: RuntimePublicResultSchema,
+    }).strict(),
+    z.object({
+        kind: z.literal('cancelled'),
+        reason: z.string().min(1).max(1_600),
+    }).strict(),
+    z.object({
+        kind: z.literal('error'),
+        error: z.object({
+            code: ErrorCodeSchema,
+            message: z.string().min(1).max(1_600),
+        }).strict(),
+    }).strict(),
+    z.object({ kind: z.literal('interrupted') }).strict(),
+]);
+export class LocalExecutionHostEventStream {
+    #response;
+    #signal;
+    #invocationId;
+    #runId;
+    #now;
+    #sequence = 0;
+    constructor(input) {
+        this.#response = input.response;
+        this.#signal = input.signal;
+        this.#invocationId = input.invocationId;
+        this.#runId = OpaqueIdSchema.parse(input.runId);
+        this.#now = input.now;
+    }
+    static async open(input) {
+        const stream = new LocalExecutionHostEventStream(input);
+        input.response.writeHead(200, {
+            'Cache-Control': 'no-store',
+            'Content-Type': 'text/event-stream; charset=utf-8',
+            'X-Content-Type-Options': 'nosniff',
+        });
+        await stream.#write({ kind: 'accepted' });
+        return stream;
+    }
+    publishActivity(activity) {
+        return this.#write({ kind: 'activity', activity });
+    }
+    async settle(terminal) {
+        this.#signal.throwIfAborted();
+        if (terminal.kind !== 'interrupted') {
+            await this.#write(terminal);
+        }
+        this.#response.end();
+    }
+    async #write(body) {
+        this.#signal.throwIfAborted();
+        const event = ExecutionHostStreamEventSchema.parse({
+            schemaVersion: EXECUTION_CONTRACT_VERSION,
+            invocationId: this.#invocationId,
+            runId: this.#runId,
+            sequence: this.#sequence,
+            timestamp: this.#now().toISOString(),
+            ...body,
+        });
+        this.#sequence += 1;
+        const frame = [
+            `id: ${event.sequence}`,
+            `event: ${event.kind}`,
+            `data: ${JSON.stringify(event)}`,
+            '',
+            '',
+        ].join('\n');
+        if (!this.#response.write(frame)) {
+            await once(this.#response, 'drain', { signal: this.#signal });
+        }
+    }
+}
+export function parseLocalExecutionHostTerminal(value) {
+    return TerminalSchema.parse(value);
+}
+//# sourceMappingURL=event-stream.js.map