@heddleagent/execution-host-client 6.4.0 → 6.6.0

package/dist/host/runtime-session/scope-binding.js

@@ -0,0 +1,37 @@
+import { createHash } from 'node:crypto';
+import { RuntimeScopeMismatchError } from './errors.js';
+/** Defense in depth if a host process is reused across execution scopes. */
+export class RuntimeScopeBindingService {
+    bound;
+    bind(input) {
+        const candidate = RuntimeScopeBindingService.toBoundScope(input);
+        if (!this.bound) {
+            this.bound = candidate;
+            return candidate;
+        }
+        if (this.bound.scopeKey !== candidate.scopeKey) {
+            throw new RuntimeScopeMismatchError('This runtime process is already bound to a different execution scope.');
+        }
+        return this.bound;
+    }
+    current() {
+        return this.bound;
+    }
+    static toBoundScope(binding) {
+        const scopeKey = createHash('sha256')
+            .update(JSON.stringify([
+            binding.runtimeSessionId,
+            binding.adopterId,
+            binding.tenantId,
+            binding.subjectId,
+            binding.productSessionId,
+        ]))
+            .digest('hex');
+        return {
+            binding: { ...binding },
+            scopeKey,
+            executionSessionId: `runtime-${scopeKey}`,
+        };
+    }
+}
+//# sourceMappingURL=scope-binding.js.map

package/dist/host/runtime-session/scope-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-binding.js","sourceRoot":"","sources":["../../../src/host/runtime-session/scope-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAYxD,4EAA4E;AAC5E,MAAM,OAAO,0BAA0B;IAC7B,KAAK,CAAqB;IAElC,IAAI,CAAC,KAA0B;QAC7B,MAAM,SAAS,GAAG,0BAA0B,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,EAAE,CAAC;YAC/C,MAAM,IAAI,yBAAyB,CACjC,uEAAuE,CACxE,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,OAA4B;QACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;aAClC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YACrB,OAAO,CAAC,gBAAgB;YACxB,OAAO,CAAC,SAAS;YACjB,OAAO,CAAC,QAAQ;YAChB,OAAO,CAAC,SAAS;YACjB,OAAO,CAAC,gBAAgB;SACzB,CAAC,CAAC;aACF,MAAM,CAAC,KAAK,CAAC,CAAC;QAEjB,OAAO;YACL,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE;YACvB,QAAQ;YACR,kBAAkB,EAAE,WAAW,QAAQ,EAAE;SAC1C,CAAC;IACJ,CAAC;CACF","sourcesContent":["import { createHash } from 'node:crypto';\nimport type { ExecutionScope } from '../../contracts/index.js';\nimport { RuntimeScopeMismatchError } from './errors.js';\n\nexport type RuntimeScopeBinding = ExecutionScope & {\n  runtimeSessionId: string;\n};\n\nexport type BoundRuntimeScope = {\n  binding: RuntimeScopeBinding;\n  scopeKey: string;\n  executionSessionId: string;\n};\n\n/** Defense in depth if a host process is reused across execution scopes. */\nexport class RuntimeScopeBindingService {\n  private bound?: BoundRuntimeScope;\n\n  bind(input: RuntimeScopeBinding): BoundRuntimeScope {\n    const candidate = RuntimeScopeBindingService.toBoundScope(input);\n    if (!this.bound) {\n      this.bound = candidate;\n      return candidate;\n    }\n\n    if (this.bound.scopeKey !== candidate.scopeKey) {\n      throw new RuntimeScopeMismatchError(\n        'This runtime process is already bound to a different execution scope.',\n      );\n    }\n\n    return this.bound;\n  }\n\n  current(): BoundRuntimeScope | undefined {\n    return this.bound;\n  }\n\n  private static toBoundScope(binding: RuntimeScopeBinding): BoundRuntimeScope {\n    const scopeKey = createHash('sha256')\n      .update(JSON.stringify([\n        binding.runtimeSessionId,\n        binding.adopterId,\n        binding.tenantId,\n        binding.subjectId,\n        binding.productSessionId,\n      ]))\n      .digest('hex');\n\n    return {\n      binding: { ...binding },\n      scopeKey,\n      executionSessionId: `runtime-${scopeKey}`,\n    };\n  }\n}\n"]}

package/dist/host/runtime-session/service.d.ts

@@ -0,0 +1,38 @@
+import type { VerifiedExecutionHostMcpCapability, VerifiedExecutionIdentity } from '../types.js';
+import { RuntimeScopeBindingService, type BoundRuntimeScope } from './scope-binding.js';
+import { RuntimeSessionStatusService, type RuntimeSessionStatusSnapshot } from './status.js';
+import type { RuntimeInvocationHandle, RuntimeInvocationRequest, RuntimeSessionConfig, RuntimeWorkflowExecutors } from './types.js';
+/** Coordinates one process-bound Runtime session without owning product data. */
+export declare class RuntimeSessionService {
+    private active?;
+    private starting?;
+    private readonly recentCompletedInvocationIds;
+    private readonly recentCompletedInvocationOrder;
+    private readonly config;
+    private readonly executors;
+    private readonly binding;
+    private readonly status;
+    private readonly now;
+    constructor(options: {
+        config: RuntimeSessionConfig;
+        executors: RuntimeWorkflowExecutors;
+        binding?: RuntimeScopeBindingService;
+        status?: RuntimeSessionStatusService;
+        now?: () => Date;
+    });
+    readStatus(): RuntimeSessionStatusSnapshot;
+    start(input: {
+        identity: VerifiedExecutionIdentity;
+        invocation: RuntimeInvocationRequest;
+        modelApiKey: string;
+        mcpCapability?: VerifiedExecutionHostMcpCapability;
+        callerSignal: AbortSignal;
+    }): Promise<RuntimeInvocationHandle>;
+    shutdown(): Promise<void>;
+    boundScope(): BoundRuntimeScope | undefined;
+    private resolveDeadline;
+    private settle;
+    private rememberCompletedInvocation;
+    private startExecution;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/host/runtime-session/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/host/runtime-session/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kCAAkC,EAClC,yBAAyB,EAC1B,MAAM,aAAa,CAAC;AAMrB,OAAO,EACL,0BAA0B,EAC1B,KAAK,iBAAiB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,2BAA2B,EAC3B,KAAK,4BAA4B,EAClC,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAGV,uBAAuB,EACvB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAiBpB,iFAAiF;AACjF,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAC,CAAmB;IAClC,OAAO,CAAC,QAAQ,CAAC,CAAqB;IACtC,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAqB;IAClE,OAAO,CAAC,QAAQ,CAAC,8BAA8B,CAAgB;IAC/D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2B;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IACrD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;gBAErB,OAAO,EAAE;QACnB,MAAM,EAAE,oBAAoB,CAAC;QAC7B,SAAS,EAAE,wBAAwB,CAAC;QACpC,OAAO,CAAC,EAAE,0BAA0B,CAAC;QACrC,MAAM,CAAC,EAAE,2BAA2B,CAAC;QACrC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;KAClB;IAcD,UAAU,IAAI,4BAA4B;IAIpC,KAAK,CAAC,KAAK,EAAE;QACjB,QAAQ,EAAE,yBAAyB,CAAC;QACpC,UAAU,EAAE,wBAAwB,CAAC;QACrC,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,kCAAkC,CAAC;QACnD,YAAY,EAAE,WAAW,CAAC;KAC3B,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAmG9B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB/B,UAAU,IAAI,iBAAiB,GAAG,SAAS;IAI3C,OAAO,CAAC,eAAe;IAgBvB,OAAO,CAAC,MAAM;IAWd,OAAO,CAAC,2BAA2B;IAYnC,OAAO,CAAC,cAAc;CAcvB"}

package/dist/host/runtime-session/service.js

@@ -0,0 +1,177 @@
+import { RuntimeBusyError, RuntimeDeadlineError, RuntimeDuplicateInvocationError, } from './errors.js';
+import { RuntimeScopeBindingService, } from './scope-binding.js';
+import { RuntimeSessionStatusService, } from './status.js';
+const RECENT_INVOCATION_LIMIT = 128;
+/** Coordinates one process-bound Runtime session without owning product data. */
+export class RuntimeSessionService {
+    active;
+    starting;
+    recentCompletedInvocationIds = new Set();
+    recentCompletedInvocationOrder = [];
+    config;
+    executors;
+    binding;
+    status;
+    now;
+    constructor(options) {
+        if (!Number.isSafeInteger(options.config.maxInvocationMs)
+            || options.config.maxInvocationMs <= 0) {
+            throw new Error('maxInvocationMs must be a positive safe integer.');
+        }
+        this.config = options.config;
+        this.executors = options.executors;
+        this.binding = options.binding ?? new RuntimeScopeBindingService();
+        this.now = options.now ?? (() => new Date());
+        this.status = options.status ?? new RuntimeSessionStatusService(this.now);
+    }
+    readStatus() {
+        return this.status.read();
+    }
+    async start(input) {
+        const deadline = this.resolveDeadline(input.invocation.deadlineAt);
+        const binding = this.binding.bind({
+            runtimeSessionId: input.identity.runtimeSessionId,
+            ...input.identity.scope,
+        });
+        if (this.active || this.starting) {
+            throw new RuntimeBusyError('This runtime session already has an active invocation.');
+        }
+        if (this.recentCompletedInvocationIds.has(input.identity.invocationId)) {
+            throw new RuntimeDuplicateInvocationError('This recent invocation identifier already completed in the current runtime process.');
+        }
+        const controller = new AbortController();
+        const abortFromCaller = () => controller.abort(input.callerSignal.reason);
+        input.callerSignal.addEventListener('abort', abortFromCaller, { once: true });
+        if (input.callerSignal.aborted) {
+            abortFromCaller();
+        }
+        const deadlineTimer = setTimeout(() => controller.abort(new RuntimeDeadlineError('The runtime invocation deadline elapsed.')), deadline.getTime() - this.now().getTime());
+        deadlineTimer.unref();
+        this.status.markExecuting();
+        const executionInput = {
+            scopeKey: binding.scopeKey,
+            executionSessionId: binding.executionSessionId,
+            request: input.invocation,
+            modelApiKey: input.modelApiKey,
+            mcpCapability: input.mcpCapability,
+            abortSignal: controller.signal,
+        };
+        const startPromise = Promise.resolve().then(() => this.startExecution(executionInput));
+        const starting = {
+            controller,
+            promise: startPromise,
+        };
+        this.starting = starting;
+        let run;
+        try {
+            run = await startPromise;
+        }
+        catch (error) {
+            clearTimeout(deadlineTimer);
+            input.callerSignal.removeEventListener('abort', abortFromCaller);
+            this.status.markIdle();
+            throw error;
+        }
+        finally {
+            if (this.starting === starting) {
+                this.starting = undefined;
+            }
+        }
+        const active = {
+            invocationId: input.identity.invocationId,
+            run,
+            controller,
+            deadlineTimer,
+            removeCallerAbortListener: () => input.callerSignal.removeEventListener('abort', abortFromCaller),
+        };
+        this.active = active;
+        controller.signal.addEventListener('abort', () => run.cancel(), {
+            once: true,
+        });
+        if (controller.signal.aborted) {
+            run.cancel();
+        }
+        const result = run.result.finally(() => this.settle(active));
+        result.catch(() => undefined);
+        return {
+            runId: run.runId,
+            acceptedAt: this.now().toISOString(),
+            // The execution signal cancels the agent, but the event subscription
+            // remains open for the executor's truthful cancelled terminal.
+            events: () => run.events(),
+            cancel: () => {
+                const wasActive = !controller.signal.aborted;
+                controller.abort();
+                return wasActive;
+            },
+            result,
+        };
+    }
+    async shutdown() {
+        const starting = this.starting;
+        if (starting) {
+            starting.controller.abort(new Error('Runtime is shutting down.'));
+            const run = await starting.promise.catch(() => undefined);
+            if (run) {
+                run.cancel();
+                await run.result.catch(() => undefined);
+            }
+        }
+        const active = this.active;
+        if (!active) {
+            return;
+        }
+        active.controller.abort(new Error('Runtime is shutting down.'));
+        active.run.cancel();
+        await active.run.result.catch(() => undefined);
+    }
+    boundScope() {
+        return this.binding.current();
+    }
+    resolveDeadline(deadlineAt) {
+        const now = this.now();
+        const maximum = new Date(now.getTime() + this.config.maxInvocationMs);
+        if (!deadlineAt) {
+            return maximum;
+        }
+        const requested = new Date(deadlineAt);
+        if (requested.getTime() <= now.getTime()) {
+            throw new RuntimeDeadlineError('The runtime invocation deadline has already elapsed.');
+        }
+        return requested.getTime() < maximum.getTime() ? requested : maximum;
+    }
+    settle(active) {
+        if (this.active !== active) {
+            return;
+        }
+        clearTimeout(active.deadlineTimer);
+        active.removeCallerAbortListener();
+        this.active = undefined;
+        this.rememberCompletedInvocation(active.invocationId);
+        this.status.markIdle();
+    }
+    rememberCompletedInvocation(invocationId) {
+        this.recentCompletedInvocationIds.add(invocationId);
+        this.recentCompletedInvocationOrder.push(invocationId);
+        if (this.recentCompletedInvocationOrder.length <= RECENT_INVOCATION_LIMIT) {
+            return;
+        }
+        const oldest = this.recentCompletedInvocationOrder.shift();
+        if (oldest) {
+            this.recentCompletedInvocationIds.delete(oldest);
+        }
+    }
+    startExecution(input) {
+        if (input.request.kind === 'conversation-turn') {
+            return this.executors.conversationTurn.start({
+                ...input,
+                request: input.request,
+            });
+        }
+        return this.executors.heartbeatTask.start({
+            ...input,
+            request: input.request,
+        });
+    }
+}
+//# sourceMappingURL=service.js.map

package/dist/host/runtime-session/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/host/runtime-session/service.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,+BAA+B,GAChC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,0BAA0B,GAE3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,2BAA2B,GAE5B,MAAM,aAAa,CAAC;AAUrB,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAepC,iFAAiF;AACjF,MAAM,OAAO,qBAAqB;IACxB,MAAM,CAAoB;IAC1B,QAAQ,CAAsB;IACrB,4BAA4B,GAAG,IAAI,GAAG,EAAU,CAAC;IACjD,8BAA8B,GAAa,EAAE,CAAC;IAC9C,MAAM,CAAuB;IAC7B,SAAS,CAA2B;IACpC,OAAO,CAA6B;IACpC,MAAM,CAA8B;IACpC,GAAG,CAAa;IAEjC,YAAY,OAMX;QACC,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;eAClD,OAAO,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,EACtC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,0BAA0B,EAAE,CAAC;QACnE,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAMX;QACC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAChC,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;YACjD,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK;SACxB,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,gBAAgB,CACxB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,+BAA+B,CACvC,qFAAqF,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1E,KAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,IAAI,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC/B,eAAe,EAAE,CAAC;QACpB,CAAC;QAED,MAAM,aAAa,GAAG,UAAU,CAC9B,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CACpB,IAAI,oBAAoB,CAAC,0CAA0C,CAAC,CACrE,EACD,QAAQ,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAC1C,CAAC;QACF,aAAa,CAAC,KAAK,EAAE,CAAC;QAEtB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC5B,MAAM,cAAc,GAAG;YACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,OAAO,EAAE,KAAK,CAAC,UAAU;YACzB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,WAAW,EAAE,UAAU,CAAC,MAAM;SACC,CAAC;QAClC,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CACzC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAC1C,CAAC;QACF,MAAM,QAAQ,GAAuB;YACnC,UAAU;YACV,OAAO,EAAE,YAAY;SACtB,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAEzB,IAAI,GAA2B,CAAC;QAChC,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,YAAY,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,CAAC,aAAa,CAAC,CAAC;YAC5B,KAAK,CAAC,YAAY,CAAC,mBAAmB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC/B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAqB;YAC/B,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;YACzC,GAAG;YACH,UAAU;YACV,aAAa;YACb,yBAAyB,EAAE,GAAG,EAAE,CAC9B,KAAK,CAAC,YAAY,CAAC,mBAAmB,CAAC,OAAO,EAAE,eAAe,CAAC;SACnE,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE;YAC9D,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAE9B,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YACpC,qEAAqE;YACrE,+DAA+D;YAC/D,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE;YAC1B,MAAM,EAAE,GAAG,EAAE;gBACX,MAAM,SAAS,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC7C,UAAU,CAAC,KAAK,EAAE,CAAC;gBACnB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM;SACP,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;YAClE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1D,IAAI,GAAG,EAAE,CAAC;gBACR,GAAG,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QACD,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAChC,CAAC;IAEO,eAAe,CAAC,UAAmB;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,oBAAoB,CAC5B,sDAAsD,CACvD,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IACvE,CAAC;IAEO,MAAM,CAAC,MAAwB;QACrC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QACD,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACnC,MAAM,CAAC,yBAAyB,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;IAEO,2BAA2B,CAAC,YAAoB;QACtD,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,8BAA8B,CAAC,MAAM,IAAI,uBAAuB,EAAE,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,8BAA8B,CAAC,KAAK,EAAE,CAAC;QAC3D,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAEO,cAAc,CACpB,KAA4B;QAE5B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC;gBAC3C,GAAG,KAAK;gBACR,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC;YACxC,GAAG,KAAK;YACR,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;CACF","sourcesContent":["import type {\n  VerifiedExecutionHostMcpCapability,\n  VerifiedExecutionIdentity,\n} from '../types.js';\nimport {\n  RuntimeBusyError,\n  RuntimeDeadlineError,\n  RuntimeDuplicateInvocationError,\n} from './errors.js';\nimport {\n  RuntimeScopeBindingService,\n  type BoundRuntimeScope,\n} from './scope-binding.js';\nimport {\n  RuntimeSessionStatusService,\n  type RuntimeSessionStatusSnapshot,\n} from './status.js';\nimport type {\n  RuntimeExecutionHandle,\n  RuntimeExecutionInput,\n  RuntimeInvocationHandle,\n  RuntimeInvocationRequest,\n  RuntimeSessionConfig,\n  RuntimeWorkflowExecutors,\n} from './types.js';\n\nconst RECENT_INVOCATION_LIMIT = 128;\n\ntype ActiveInvocation = {\n  invocationId: string;\n  run: RuntimeExecutionHandle;\n  controller: AbortController;\n  deadlineTimer: ReturnType<typeof setTimeout>;\n  removeCallerAbortListener: () => void;\n};\n\ntype StartingInvocation = {\n  controller: AbortController;\n  promise: Promise<RuntimeExecutionHandle>;\n};\n\n/** Coordinates one process-bound Runtime session without owning product data. */\nexport class RuntimeSessionService {\n  private active?: ActiveInvocation;\n  private starting?: StartingInvocation;\n  private readonly recentCompletedInvocationIds = new Set<string>();\n  private readonly recentCompletedInvocationOrder: string[] = [];\n  private readonly config: RuntimeSessionConfig;\n  private readonly executors: RuntimeWorkflowExecutors;\n  private readonly binding: RuntimeScopeBindingService;\n  private readonly status: RuntimeSessionStatusService;\n  private readonly now: () => Date;\n\n  constructor(options: {\n    config: RuntimeSessionConfig;\n    executors: RuntimeWorkflowExecutors;\n    binding?: RuntimeScopeBindingService;\n    status?: RuntimeSessionStatusService;\n    now?: () => Date;\n  }) {\n    if (\n      !Number.isSafeInteger(options.config.maxInvocationMs)\n      || options.config.maxInvocationMs <= 0\n    ) {\n      throw new Error('maxInvocationMs must be a positive safe integer.');\n    }\n    this.config = options.config;\n    this.executors = options.executors;\n    this.binding = options.binding ?? new RuntimeScopeBindingService();\n    this.now = options.now ?? (() => new Date());\n    this.status = options.status ?? new RuntimeSessionStatusService(this.now);\n  }\n\n  readStatus(): RuntimeSessionStatusSnapshot {\n    return this.status.read();\n  }\n\n  async start(input: {\n    identity: VerifiedExecutionIdentity;\n    invocation: RuntimeInvocationRequest;\n    modelApiKey: string;\n    mcpCapability?: VerifiedExecutionHostMcpCapability;\n    callerSignal: AbortSignal;\n  }): Promise<RuntimeInvocationHandle> {\n    const deadline = this.resolveDeadline(input.invocation.deadlineAt);\n    const binding = this.binding.bind({\n      runtimeSessionId: input.identity.runtimeSessionId,\n      ...input.identity.scope,\n    });\n\n    if (this.active || this.starting) {\n      throw new RuntimeBusyError(\n        'This runtime session already has an active invocation.',\n      );\n    }\n    if (this.recentCompletedInvocationIds.has(input.identity.invocationId)) {\n      throw new RuntimeDuplicateInvocationError(\n        'This recent invocation identifier already completed in the current runtime process.',\n      );\n    }\n\n    const controller = new AbortController();\n    const abortFromCaller = () => controller.abort(input.callerSignal.reason);\n    input.callerSignal.addEventListener('abort', abortFromCaller, { once: true });\n    if (input.callerSignal.aborted) {\n      abortFromCaller();\n    }\n\n    const deadlineTimer = setTimeout(\n      () => controller.abort(\n        new RuntimeDeadlineError('The runtime invocation deadline elapsed.'),\n      ),\n      deadline.getTime() - this.now().getTime(),\n    );\n    deadlineTimer.unref();\n\n    this.status.markExecuting();\n    const executionInput = {\n      scopeKey: binding.scopeKey,\n      executionSessionId: binding.executionSessionId,\n      request: input.invocation,\n      modelApiKey: input.modelApiKey,\n      mcpCapability: input.mcpCapability,\n      abortSignal: controller.signal,\n    } satisfies RuntimeExecutionInput;\n    const startPromise = Promise.resolve().then(\n      () => this.startExecution(executionInput),\n    );\n    const starting: StartingInvocation = {\n      controller,\n      promise: startPromise,\n    };\n    this.starting = starting;\n\n    let run: RuntimeExecutionHandle;\n    try {\n      run = await startPromise;\n    } catch (error) {\n      clearTimeout(deadlineTimer);\n      input.callerSignal.removeEventListener('abort', abortFromCaller);\n      this.status.markIdle();\n      throw error;\n    } finally {\n      if (this.starting === starting) {\n        this.starting = undefined;\n      }\n    }\n\n    const active: ActiveInvocation = {\n      invocationId: input.identity.invocationId,\n      run,\n      controller,\n      deadlineTimer,\n      removeCallerAbortListener: () =>\n        input.callerSignal.removeEventListener('abort', abortFromCaller),\n    };\n    this.active = active;\n    controller.signal.addEventListener('abort', () => run.cancel(), {\n      once: true,\n    });\n    if (controller.signal.aborted) {\n      run.cancel();\n    }\n\n    const result = run.result.finally(() => this.settle(active));\n    result.catch(() => undefined);\n\n    return {\n      runId: run.runId,\n      acceptedAt: this.now().toISOString(),\n      // The execution signal cancels the agent, but the event subscription\n      // remains open for the executor's truthful cancelled terminal.\n      events: () => run.events(),\n      cancel: () => {\n        const wasActive = !controller.signal.aborted;\n        controller.abort();\n        return wasActive;\n      },\n      result,\n    };\n  }\n\n  async shutdown(): Promise<void> {\n    const starting = this.starting;\n    if (starting) {\n      starting.controller.abort(new Error('Runtime is shutting down.'));\n      const run = await starting.promise.catch(() => undefined);\n      if (run) {\n        run.cancel();\n        await run.result.catch(() => undefined);\n      }\n    }\n\n    const active = this.active;\n    if (!active) {\n      return;\n    }\n    active.controller.abort(new Error('Runtime is shutting down.'));\n    active.run.cancel();\n    await active.run.result.catch(() => undefined);\n  }\n\n  boundScope(): BoundRuntimeScope | undefined {\n    return this.binding.current();\n  }\n\n  private resolveDeadline(deadlineAt?: string): Date {\n    const now = this.now();\n    const maximum = new Date(now.getTime() + this.config.maxInvocationMs);\n    if (!deadlineAt) {\n      return maximum;\n    }\n\n    const requested = new Date(deadlineAt);\n    if (requested.getTime() <= now.getTime()) {\n      throw new RuntimeDeadlineError(\n        'The runtime invocation deadline has already elapsed.',\n      );\n    }\n    return requested.getTime() < maximum.getTime() ? requested : maximum;\n  }\n\n  private settle(active: ActiveInvocation): void {\n    if (this.active !== active) {\n      return;\n    }\n    clearTimeout(active.deadlineTimer);\n    active.removeCallerAbortListener();\n    this.active = undefined;\n    this.rememberCompletedInvocation(active.invocationId);\n    this.status.markIdle();\n  }\n\n  private rememberCompletedInvocation(invocationId: string): void {\n    this.recentCompletedInvocationIds.add(invocationId);\n    this.recentCompletedInvocationOrder.push(invocationId);\n    if (this.recentCompletedInvocationOrder.length <= RECENT_INVOCATION_LIMIT) {\n      return;\n    }\n    const oldest = this.recentCompletedInvocationOrder.shift();\n    if (oldest) {\n      this.recentCompletedInvocationIds.delete(oldest);\n    }\n  }\n\n  private startExecution(\n    input: RuntimeExecutionInput,\n  ): Promise<RuntimeExecutionHandle> {\n    if (input.request.kind === 'conversation-turn') {\n      return this.executors.conversationTurn.start({\n        ...input,\n        request: input.request,\n      });\n    }\n    return this.executors.heartbeatTask.start({\n      ...input,\n      request: input.request,\n    });\n  }\n}\n"]}

package/dist/host/runtime-session/status.d.ts

@@ -0,0 +1,17 @@
+export type RuntimeSessionStatusSnapshot = {
+    state: 'idle' | 'executing';
+    changedAtUnixSeconds: number;
+};
+/** Tracks process-local execution status without provider-specific vocabulary. */
+export declare class RuntimeSessionStatusService {
+    private readonly now;
+    private state;
+    private changedAtUnixSeconds;
+    constructor(now?: () => Date);
+    markExecuting(): void;
+    markIdle(): void;
+    read(): RuntimeSessionStatusSnapshot;
+    private transition;
+    private currentUnixSeconds;
+}
+//# sourceMappingURL=status.d.ts.map

package/dist/host/runtime-session/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/host/runtime-session/status.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,4BAA4B,GAAG;IACzC,KAAK,EAAE,MAAM,GAAG,WAAW,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,kFAAkF;AAClF,qBAAa,2BAA2B;IAI1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHhC,OAAO,CAAC,KAAK,CAAiD;IAC9D,OAAO,CAAC,oBAAoB,CAAS;gBAER,GAAG,GAAE,MAAM,IAAuB;IAI/D,aAAa,IAAI,IAAI;IAIrB,QAAQ,IAAI,IAAI;IAIhB,IAAI,IAAI,4BAA4B;IAOpC,OAAO,CAAC,UAAU;IAQlB,OAAO,CAAC,kBAAkB;CAG3B"}

package/dist/host/runtime-session/status.js

@@ -0,0 +1,33 @@
+/** Tracks process-local execution status without provider-specific vocabulary. */
+export class RuntimeSessionStatusService {
+    now;
+    state = 'idle';
+    changedAtUnixSeconds;
+    constructor(now = () => new Date()) {
+        this.now = now;
+        this.changedAtUnixSeconds = this.currentUnixSeconds();
+    }
+    markExecuting() {
+        this.transition('executing');
+    }
+    markIdle() {
+        this.transition('idle');
+    }
+    read() {
+        return {
+            state: this.state,
+            changedAtUnixSeconds: this.changedAtUnixSeconds,
+        };
+    }
+    transition(next) {
+        if (this.state === next) {
+            return;
+        }
+        this.state = next;
+        this.changedAtUnixSeconds = this.currentUnixSeconds();
+    }
+    currentUnixSeconds() {
+        return Math.floor(this.now().getTime() / 1_000);
+    }
+}
+//# sourceMappingURL=status.js.map

package/dist/host/runtime-session/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/host/runtime-session/status.ts"],"names":[],"mappings":"AAKA,kFAAkF;AAClF,MAAM,OAAO,2BAA2B;IAIT;IAHrB,KAAK,GAA0C,MAAM,CAAC;IACtD,oBAAoB,CAAS;IAErC,YAA6B,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAAlC,QAAG,GAAH,GAAG,CAA+B;QAC7D,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;IACxD,CAAC;IAED,aAAa;QACX,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC;IAED,QAAQ;QACN,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI;QACF,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;SAChD,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,IAA2C;QAC5D,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;IACxD,CAAC;IAEO,kBAAkB;QACxB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC;IAClD,CAAC;CACF","sourcesContent":["export type RuntimeSessionStatusSnapshot = {\n  state: 'idle' | 'executing';\n  changedAtUnixSeconds: number;\n};\n\n/** Tracks process-local execution status without provider-specific vocabulary. */\nexport class RuntimeSessionStatusService {\n  private state: RuntimeSessionStatusSnapshot['state'] = 'idle';\n  private changedAtUnixSeconds: number;\n\n  constructor(private readonly now: () => Date = () => new Date()) {\n    this.changedAtUnixSeconds = this.currentUnixSeconds();\n  }\n\n  markExecuting(): void {\n    this.transition('executing');\n  }\n\n  markIdle(): void {\n    this.transition('idle');\n  }\n\n  read(): RuntimeSessionStatusSnapshot {\n    return {\n      state: this.state,\n      changedAtUnixSeconds: this.changedAtUnixSeconds,\n    };\n  }\n\n  private transition(next: RuntimeSessionStatusSnapshot['state']): void {\n    if (this.state === next) {\n      return;\n    }\n    this.state = next;\n    this.changedAtUnixSeconds = this.currentUnixSeconds();\n  }\n\n  private currentUnixSeconds(): number {\n    return Math.floor(this.now().getTime() / 1_000);\n  }\n}\n"]}

package/dist/host/runtime-session/types.d.ts

@@ -0,0 +1,61 @@
+import type { ExecutionHostConversationTurnRequest, ExecutionHostHeartbeatTaskRequest, RuntimePublicResult } from '../../contracts/index.js';
+import type { VerifiedExecutionHostMcpCapability } from '../types.js';
+type RuntimeExecutionStreamEnvelope = {
+    runId: string;
+    sequence: number;
+    timestamp: string;
+};
+/** Ordered execution events exposed by any workflow executor. */
+export type RuntimeExecutionStreamItem<Result = unknown> = (RuntimeExecutionStreamEnvelope & {
+    kind: 'activity';
+    activity: unknown;
+}) | (RuntimeExecutionStreamEnvelope & {
+    kind: 'result';
+    result: Result;
+}) | (RuntimeExecutionStreamEnvelope & {
+    kind: 'cancelled';
+    reason: string;
+}) | (RuntimeExecutionStreamEnvelope & {
+    kind: 'error';
+    error: {
+        code: string;
+        message: string;
+    };
+});
+export type RuntimeInvocationRequest = ExecutionHostConversationTurnRequest | ExecutionHostHeartbeatTaskRequest;
+export type RuntimeExecutionInput<Request extends RuntimeInvocationRequest = RuntimeInvocationRequest> = {
+    scopeKey: string;
+    executionSessionId: string;
+    request: Request;
+    modelApiKey: string;
+    mcpCapability?: VerifiedExecutionHostMcpCapability;
+    abortSignal: AbortSignal;
+};
+export type RuntimeExecutionHandle<Result = unknown> = {
+    runId: string;
+    result: Promise<Result>;
+    events(options?: {
+        signal?: AbortSignal;
+    }): AsyncIterable<RuntimeExecutionStreamItem<Result>>;
+    cancel(): boolean;
+};
+/** Outbound execution port for one provider-neutral workflow. */
+export type RuntimeWorkflowExecutor<Request extends RuntimeInvocationRequest, Result> = {
+    start(input: RuntimeExecutionInput<Request>): Promise<RuntimeExecutionHandle<Result>>;
+};
+export type RuntimeWorkflowExecutors<HeartbeatResult = unknown> = {
+    conversationTurn: RuntimeWorkflowExecutor<ExecutionHostConversationTurnRequest, RuntimePublicResult>;
+    heartbeatTask: RuntimeWorkflowExecutor<ExecutionHostHeartbeatTaskRequest, HeartbeatResult>;
+};
+export type RuntimeInvocationHandle<Result = unknown> = {
+    runId: string;
+    acceptedAt: string;
+    events(): AsyncIterable<RuntimeExecutionStreamItem<Result>>;
+    cancel(): boolean;
+    result: Promise<Result>;
+};
+export type RuntimeSessionConfig = {
+    maxInvocationMs: number;
+};
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/host/runtime-session/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/host/runtime-session/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oCAAoC,EACpC,iCAAiC,EACjC,mBAAmB,EACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,aAAa,CAAC;AAEtE,KAAK,8BAA8B,GAAG;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,iEAAiE;AACjE,MAAM,MAAM,0BAA0B,CAAC,MAAM,GAAG,OAAO,IACnD,CAAC,8BAA8B,GAAG;IAClC,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC,GACA,CAAC,8BAA8B,GAAG;IAClC,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,GACA,CAAC,8BAA8B,GAAG;IAClC,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,GACA,CAAC,8BAA8B,GAAG;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C,CAAC,CAAC;AAEL,MAAM,MAAM,wBAAwB,GAChC,oCAAoC,GACpC,iCAAiC,CAAC;AAEtC,MAAM,MAAM,qBAAqB,CAC/B,OAAO,SAAS,wBAAwB,GAAG,wBAAwB,IACjE;IACF,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,kCAAkC,CAAC;IACnD,WAAW,EAAE,WAAW,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,sBAAsB,CAAC,MAAM,GAAG,OAAO,IAAI;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,CAAC,OAAO,CAAC,EAAE;QACf,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB,GAAG,aAAa,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,MAAM,IAAI,OAAO,CAAC;CACnB,CAAC;AAEF,iEAAiE;AACjE,MAAM,MAAM,uBAAuB,CACjC,OAAO,SAAS,wBAAwB,EACxC,MAAM,IACJ;IACF,KAAK,CACH,KAAK,EAAE,qBAAqB,CAAC,OAAO,CAAC,GACpC,OAAO,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,wBAAwB,CAAC,eAAe,GAAG,OAAO,IAAI;IAChE,gBAAgB,EAAE,uBAAuB,CACvC,oCAAoC,EACpC,mBAAmB,CACpB,CAAC;IACF,aAAa,EAAE,uBAAuB,CACpC,iCAAiC,EACjC,eAAe,CAChB,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,uBAAuB,CAAC,MAAM,GAAG,OAAO,IAAI;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,IAAI,aAAa,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,MAAM,IAAI,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC"}

package/dist/host/runtime-session/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/host/runtime-session/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/host/runtime-session/types.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  ExecutionHostConversationTurnRequest,\n  ExecutionHostHeartbeatTaskRequest,\n  RuntimePublicResult,\n} from '../../contracts/index.js';\nimport type { VerifiedExecutionHostMcpCapability } from '../types.js';\n\ntype RuntimeExecutionStreamEnvelope = {\n  runId: string;\n  sequence: number;\n  timestamp: string;\n};\n\n/** Ordered execution events exposed by any workflow executor. */\nexport type RuntimeExecutionStreamItem<Result = unknown> =\n  | (RuntimeExecutionStreamEnvelope & {\n    kind: 'activity';\n    activity: unknown;\n  })\n  | (RuntimeExecutionStreamEnvelope & {\n    kind: 'result';\n    result: Result;\n  })\n  | (RuntimeExecutionStreamEnvelope & {\n    kind: 'cancelled';\n    reason: string;\n  })\n  | (RuntimeExecutionStreamEnvelope & {\n    kind: 'error';\n    error: { code: string; message: string };\n  });\n\nexport type RuntimeInvocationRequest =\n  | ExecutionHostConversationTurnRequest\n  | ExecutionHostHeartbeatTaskRequest;\n\nexport type RuntimeExecutionInput<\n  Request extends RuntimeInvocationRequest = RuntimeInvocationRequest,\n> = {\n  scopeKey: string;\n  executionSessionId: string;\n  request: Request;\n  modelApiKey: string;\n  mcpCapability?: VerifiedExecutionHostMcpCapability;\n  abortSignal: AbortSignal;\n};\n\nexport type RuntimeExecutionHandle<Result = unknown> = {\n  runId: string;\n  result: Promise<Result>;\n  events(options?: {\n    signal?: AbortSignal;\n  }): AsyncIterable<RuntimeExecutionStreamItem<Result>>;\n  cancel(): boolean;\n};\n\n/** Outbound execution port for one provider-neutral workflow. */\nexport type RuntimeWorkflowExecutor<\n  Request extends RuntimeInvocationRequest,\n  Result,\n> = {\n  start(\n    input: RuntimeExecutionInput<Request>,\n  ): Promise<RuntimeExecutionHandle<Result>>;\n};\n\nexport type RuntimeWorkflowExecutors<HeartbeatResult = unknown> = {\n  conversationTurn: RuntimeWorkflowExecutor<\n    ExecutionHostConversationTurnRequest,\n    RuntimePublicResult\n  >;\n  heartbeatTask: RuntimeWorkflowExecutor<\n    ExecutionHostHeartbeatTaskRequest,\n    HeartbeatResult\n  >;\n};\n\nexport type RuntimeInvocationHandle<Result = unknown> = {\n  runId: string;\n  acceptedAt: string;\n  events(): AsyncIterable<RuntimeExecutionStreamItem<Result>>;\n  cancel(): boolean;\n  result: Promise<Result>;\n};\n\nexport type RuntimeSessionConfig = {\n  maxInvocationMs: number;\n};\n"]}

package/dist/host/schemas.d.ts

@@ -0,0 +1,37 @@
+import { z } from 'zod';
+export declare const ExecutionHostJwtAlgorithmsSchema: z.ZodPipe<z.ZodArray<z.ZodEnum<{
+    ES256: "ES256";
+    RS256: "RS256";
+    PS256: "PS256";
+    EdDSA: "EdDSA";
+}>>, z.ZodTransform<readonly ("ES256" | "RS256" | "PS256" | "EdDSA")[], ("ES256" | "RS256" | "PS256" | "EdDSA")[]>>;
+export declare const JwtExecutionIdentityVerifierConfigSchema: z.ZodObject<{
+    executionIssuer: z.ZodURL;
+    executionAudience: z.ZodString;
+    executionJwksUrl: z.ZodCustom<URL, URL>;
+    executionJwtAlgorithms: z.ZodPipe<z.ZodArray<z.ZodEnum<{
+        ES256: "ES256";
+        RS256: "RS256";
+        PS256: "PS256";
+        EdDSA: "EdDSA";
+    }>>, z.ZodTransform<readonly ("ES256" | "RS256" | "PS256" | "EdDSA")[], ("ES256" | "RS256" | "PS256" | "EdDSA")[]>>;
+    trustedAdopterId: z.ZodString;
+    maxAssertionAgeSeconds: z.ZodNumber;
+    assertionClockToleranceSeconds: z.ZodNumber;
+}, z.core.$strict>;
+export declare const JwtExecutionHostMcpCapabilityVerifierConfigSchema: z.ZodObject<{
+    issuer: z.ZodURL;
+    audience: z.ZodString;
+    jwksUrl: z.ZodCustom<URL, URL>;
+    jwtAlgorithms: z.ZodPipe<z.ZodArray<z.ZodEnum<{
+        ES256: "ES256";
+        RS256: "RS256";
+        PS256: "PS256";
+        EdDSA: "EdDSA";
+    }>>, z.ZodTransform<readonly ("ES256" | "RS256" | "PS256" | "EdDSA")[], ("ES256" | "RS256" | "PS256" | "EdDSA")[]>>;
+    trustedAdopterId: z.ZodString;
+    serverId: z.ZodString;
+    maxCapabilityAgeSeconds: z.ZodNumber;
+    clockToleranceSeconds: z.ZodNumber;
+}, z.core.$strict>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/host/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/host/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,eAAO,MAAM,gCAAgC;;;;;mHAI5C,CAAC;AAEF,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;kBAW1C,CAAC;AAEZ,eAAO,MAAM,iDAAiD;;;;;;;;;;;;;;kBAYnD,CAAC"}

package/dist/host/schemas.js

@@ -0,0 +1,24 @@
+import { z } from 'zod';
+import { JwtAudienceSchema, JwtIssuerSchema, McpServerIdSchema, OpaqueIdSchema, isSafeWebUrl, } from '../contracts/index.js';
+import { EXECUTION_HOST_SUPPORTED_JWT_ALGORITHMS } from './types.js';
+export const ExecutionHostJwtAlgorithmsSchema = z.array(z.enum(EXECUTION_HOST_SUPPORTED_JWT_ALGORITHMS)).min(1).max(EXECUTION_HOST_SUPPORTED_JWT_ALGORITHMS.length).transform((algorithms) => Object.freeze([...new Set(algorithms)]));
+export const JwtExecutionIdentityVerifierConfigSchema = z.object({
+    executionIssuer: JwtIssuerSchema,
+    executionAudience: JwtAudienceSchema,
+    executionJwksUrl: z.instanceof(URL).refine(isSafeWebUrl, 'must use HTTPS or loopback HTTP and contain no credentials, query, or fragment'),
+    executionJwtAlgorithms: ExecutionHostJwtAlgorithmsSchema,
+    trustedAdopterId: OpaqueIdSchema,
+    maxAssertionAgeSeconds: z.number().int().min(1).max(15 * 60),
+    assertionClockToleranceSeconds: z.number().int().min(0).max(60),
+}).strict();
+export const JwtExecutionHostMcpCapabilityVerifierConfigSchema = z.object({
+    issuer: JwtIssuerSchema,
+    audience: JwtAudienceSchema,
+    jwksUrl: z.instanceof(URL).refine(isSafeWebUrl, 'must use HTTPS or loopback HTTP and contain no credentials, query, or fragment'),
+    jwtAlgorithms: ExecutionHostJwtAlgorithmsSchema,
+    trustedAdopterId: OpaqueIdSchema,
+    serverId: McpServerIdSchema,
+    maxCapabilityAgeSeconds: z.number().int().min(1).max(15 * 60),
+    clockToleranceSeconds: z.number().int().min(0).max(60),
+}).strict();
+//# sourceMappingURL=schemas.js.map

package/dist/host/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/host/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,YAAY,GACb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAErE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CACrD,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAChD,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,uCAAuC,CAAC,MAAM,CAAC,CAAC,SAAS,CACpE,CAAC,UAAU,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CACxD,CAAC;AAEF,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,eAAe,EAAE,eAAe;IAChC,iBAAiB,EAAE,iBAAiB;IACpC,gBAAgB,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,CACxC,YAAY,EACZ,gFAAgF,CACjF;IACD,sBAAsB,EAAE,gCAAgC;IACxD,gBAAgB,EAAE,cAAc;IAChC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;IAC5D,8BAA8B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAChE,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,MAAM,EAAE,eAAe;IACvB,QAAQ,EAAE,iBAAiB;IAC3B,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,CAC/B,YAAY,EACZ,gFAAgF,CACjF;IACD,aAAa,EAAE,gCAAgC;IAC/C,gBAAgB,EAAE,cAAc;IAChC,QAAQ,EAAE,iBAAiB;IAC3B,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;IAC7D,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACvD,CAAC,CAAC,MAAM,EAAE,CAAC","sourcesContent":["import { z } from 'zod';\nimport {\n  JwtAudienceSchema,\n  JwtIssuerSchema,\n  McpServerIdSchema,\n  OpaqueIdSchema,\n  isSafeWebUrl,\n} from '../contracts/index.js';\nimport { EXECUTION_HOST_SUPPORTED_JWT_ALGORITHMS } from './types.js';\n\nexport const ExecutionHostJwtAlgorithmsSchema = z.array(\n  z.enum(EXECUTION_HOST_SUPPORTED_JWT_ALGORITHMS),\n).min(1).max(EXECUTION_HOST_SUPPORTED_JWT_ALGORITHMS.length).transform(\n  (algorithms) => Object.freeze([...new Set(algorithms)]),\n);\n\nexport const JwtExecutionIdentityVerifierConfigSchema = z.object({\n  executionIssuer: JwtIssuerSchema,\n  executionAudience: JwtAudienceSchema,\n  executionJwksUrl: z.instanceof(URL).refine(\n    isSafeWebUrl,\n    'must use HTTPS or loopback HTTP and contain no credentials, query, or fragment',\n  ),\n  executionJwtAlgorithms: ExecutionHostJwtAlgorithmsSchema,\n  trustedAdopterId: OpaqueIdSchema,\n  maxAssertionAgeSeconds: z.number().int().min(1).max(15 * 60),\n  assertionClockToleranceSeconds: z.number().int().min(0).max(60),\n}).strict();\n\nexport const JwtExecutionHostMcpCapabilityVerifierConfigSchema = z.object({\n  issuer: JwtIssuerSchema,\n  audience: JwtAudienceSchema,\n  jwksUrl: z.instanceof(URL).refine(\n    isSafeWebUrl,\n    'must use HTTPS or loopback HTTP and contain no credentials, query, or fragment',\n  ),\n  jwtAlgorithms: ExecutionHostJwtAlgorithmsSchema,\n  trustedAdopterId: OpaqueIdSchema,\n  serverId: McpServerIdSchema,\n  maxCapabilityAgeSeconds: z.number().int().min(1).max(15 * 60),\n  clockToleranceSeconds: z.number().int().min(0).max(60),\n}).strict();\n"]}

package/dist/host/types.d.ts

@@ -0,0 +1,62 @@
+import type { JWTVerifyGetKey } from 'jose';
+import type { ExecutionScope, HostedExecutionWorkflow } from '../contracts/index.js';
+export declare const EXECUTION_HOST_SUPPORTED_JWT_ALGORITHMS: readonly ["RS256", "PS256", "ES256", "EdDSA"];
+export type ExecutionHostJwtAlgorithm = typeof EXECUTION_HOST_SUPPORTED_JWT_ALGORITHMS[number];
+/** Authority established from one signed assertion and its request binding. */
+export type VerifiedExecutionIdentity = Readonly<{
+    scope: Readonly<ExecutionScope>;
+    runtimeSessionId: string;
+    invocationId: string;
+    workflow: HostedExecutionWorkflow;
+    issuedAt: string;
+    expiresAt: string;
+}>;
+export type ExecutionIdentityVerificationRequest = Readonly<{
+    assertion: string;
+    runtimeSessionId: string;
+    invocationId: string;
+    workflow: HostedExecutionWorkflow;
+}>;
+export interface ExecutionIdentityVerifier {
+    verify(request: ExecutionIdentityVerificationRequest): Promise<VerifiedExecutionIdentity>;
+}
+export type JwtExecutionIdentityVerifierConfig = Readonly<{
+    executionIssuer: string;
+    executionAudience: string;
+    executionJwksUrl: URL;
+    executionJwtAlgorithms: readonly ExecutionHostJwtAlgorithm[];
+    trustedAdopterId: string;
+    maxAssertionAgeSeconds: number;
+    assertionClockToleranceSeconds: number;
+}>;
+/** Opaque MCP bearer whose claims match the independently verified execution. */
+export type VerifiedExecutionHostMcpCapability = Readonly<{
+    assertion: string;
+    capabilityId: string;
+    serverId: string;
+    allowedTools: readonly string[];
+    issuedAt: string;
+    expiresAt: string;
+}>;
+export type ExecutionHostMcpCapabilityVerificationRequest = Readonly<{
+    assertion: string;
+    identity: VerifiedExecutionIdentity;
+}>;
+export interface ExecutionHostMcpCapabilityVerifier {
+    verify(request: ExecutionHostMcpCapabilityVerificationRequest): Promise<VerifiedExecutionHostMcpCapability>;
+}
+export type JwtExecutionHostMcpCapabilityVerifierConfig = Readonly<{
+    issuer: string;
+    audience: string;
+    jwksUrl: URL;
+    jwtAlgorithms: readonly ExecutionHostJwtAlgorithm[];
+    trustedAdopterId: string;
+    serverId: string;
+    maxCapabilityAgeSeconds: number;
+    clockToleranceSeconds: number;
+}>;
+export type ExecutionHostJwtVerifierOptions = Readonly<{
+    keyResolver?: JWTVerifyGetKey;
+    now?: () => Date;
+}>;
+//# sourceMappingURL=types.d.ts.map

package/dist/host/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/host/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAC5C,OAAO,KAAK,EACV,cAAc,EACd,uBAAuB,EACxB,MAAM,uBAAuB,CAAC;AAE/B,eAAO,MAAM,uCAAuC,+CAK1C,CAAC;AAEX,MAAM,MAAM,yBAAyB,GACnC,OAAO,uCAAuC,CAAC,MAAM,CAAC,CAAC;AAEzD,+EAA+E;AAC/E,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAC/C,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,uBAAuB,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAAC;AAEH,MAAM,MAAM,oCAAoC,GAAG,QAAQ,CAAC;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,uBAAuB,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,WAAW,yBAAyB;IACxC,MAAM,CACJ,OAAO,EAAE,oCAAoC,GAC5C,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACvC;AAED,MAAM,MAAM,kCAAkC,GAAG,QAAQ,CAAC;IACxD,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,GAAG,CAAC;IACtB,sBAAsB,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAC7D,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,8BAA8B,EAAE,MAAM,CAAC;CACxC,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,MAAM,kCAAkC,GAAG,QAAQ,CAAC;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAAC;AAEH,MAAM,MAAM,6CAA6C,GAAG,QAAQ,CAAC;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,yBAAyB,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,WAAW,kCAAkC;IACjD,MAAM,CACJ,OAAO,EAAE,6CAA6C,GACrD,OAAO,CAAC,kCAAkC,CAAC,CAAC;CAChD;AAED,MAAM,MAAM,2CAA2C,GAAG,QAAQ,CAAC;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,GAAG,CAAC;IACb,aAAa,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACpD,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,uBAAuB,EAAE,MAAM,CAAC;IAChC,qBAAqB,EAAE,MAAM,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,MAAM,+BAA+B,GAAG,QAAQ,CAAC;IACrD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,CAAC,CAAC"}

package/dist/host/types.js

@@ -0,0 +1,7 @@
+export const EXECUTION_HOST_SUPPORTED_JWT_ALGORITHMS = [
+    'RS256',
+    'PS256',
+    'ES256',
+    'EdDSA',
+];
+//# sourceMappingURL=types.js.map

package/dist/host/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/host/types.ts"],"names":[],"mappings":"AAMA,MAAM,CAAC,MAAM,uCAAuC,GAAG;IACrD,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;CACC,CAAC","sourcesContent":["import type { JWTVerifyGetKey } from 'jose';\nimport type {\n  ExecutionScope,\n  HostedExecutionWorkflow,\n} from '../contracts/index.js';\n\nexport const EXECUTION_HOST_SUPPORTED_JWT_ALGORITHMS = [\n  'RS256',\n  'PS256',\n  'ES256',\n  'EdDSA',\n] as const;\n\nexport type ExecutionHostJwtAlgorithm =\n  typeof EXECUTION_HOST_SUPPORTED_JWT_ALGORITHMS[number];\n\n/** Authority established from one signed assertion and its request binding. */\nexport type VerifiedExecutionIdentity = Readonly<{\n  scope: Readonly<ExecutionScope>;\n  runtimeSessionId: string;\n  invocationId: string;\n  workflow: HostedExecutionWorkflow;\n  issuedAt: string;\n  expiresAt: string;\n}>;\n\nexport type ExecutionIdentityVerificationRequest = Readonly<{\n  assertion: string;\n  runtimeSessionId: string;\n  invocationId: string;\n  workflow: HostedExecutionWorkflow;\n}>;\n\nexport interface ExecutionIdentityVerifier {\n  verify(\n    request: ExecutionIdentityVerificationRequest,\n  ): Promise<VerifiedExecutionIdentity>;\n}\n\nexport type JwtExecutionIdentityVerifierConfig = Readonly<{\n  executionIssuer: string;\n  executionAudience: string;\n  executionJwksUrl: URL;\n  executionJwtAlgorithms: readonly ExecutionHostJwtAlgorithm[];\n  trustedAdopterId: string;\n  maxAssertionAgeSeconds: number;\n  assertionClockToleranceSeconds: number;\n}>;\n\n/** Opaque MCP bearer whose claims match the independently verified execution. */\nexport type VerifiedExecutionHostMcpCapability = Readonly<{\n  assertion: string;\n  capabilityId: string;\n  serverId: string;\n  allowedTools: readonly string[];\n  issuedAt: string;\n  expiresAt: string;\n}>;\n\nexport type ExecutionHostMcpCapabilityVerificationRequest = Readonly<{\n  assertion: string;\n  identity: VerifiedExecutionIdentity;\n}>;\n\nexport interface ExecutionHostMcpCapabilityVerifier {\n  verify(\n    request: ExecutionHostMcpCapabilityVerificationRequest,\n  ): Promise<VerifiedExecutionHostMcpCapability>;\n}\n\nexport type JwtExecutionHostMcpCapabilityVerifierConfig = Readonly<{\n  issuer: string;\n  audience: string;\n  jwksUrl: URL;\n  jwtAlgorithms: readonly ExecutionHostJwtAlgorithm[];\n  trustedAdopterId: string;\n  serverId: string;\n  maxCapabilityAgeSeconds: number;\n  clockToleranceSeconds: number;\n}>;\n\nexport type ExecutionHostJwtVerifierOptions = Readonly<{\n  keyResolver?: JWTVerifyGetKey;\n  now?: () => Date;\n}>;\n"]}

package/dist/http-sse/direct-http-execution-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"direct-http-execution-host.d.ts","sourceRoot":"","sources":["../../src/http-sse/direct-http-execution-host.ts"],"names":[],"mappings":"AAEA,OAAO,EAmBL,KAAK,iCAAiC,EACtC,KAAK,wBAAwB,EAC9B,MAAM,uBAAuB,CAAC;AAO/B,OAAO,KAAK,EACV,6BAA6B,EAC7B,aAAa,EACb,6BAA6B,EAC7B,0BAA0B,EAC1B,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAkCpB;;;GAGG;AACH,qBAAa,uBACb,YAAW,aAAa,EAAE,sBAAsB;;gBAKlC,MAAM,EAAE,6BAA6B;IAO1C,sBAAsB,CAC3B,QAAQ,EAAE,6BAA6B,GACtC,aAAa,CAAC,wBAAwB,CAAC;IAoBnC,mBAAmB,CACxB,QAAQ,EAAE,0BAA0B,GACnC,aAAa,CAAC,iCAAiC,CAAC;CAwJpD"}
+{"version":3,"file":"direct-http-execution-host.d.ts","sourceRoot":"","sources":["../../src/http-sse/direct-http-execution-host.ts"],"names":[],"mappings":"AACA,OAAO,EAmBL,KAAK,iCAAiC,EACtC,KAAK,wBAAwB,EAC9B,MAAM,uBAAuB,CAAC;AAK/B,OAAO,KAAK,EACV,6BAA6B,EAC7B,aAAa,EACb,6BAA6B,EAC7B,0BAA0B,EAC1B,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAqCpB;;;GAGG;AACH,qBAAa,uBACb,YAAW,aAAa,EAAE,sBAAsB;;gBAKlC,MAAM,EAAE,6BAA6B;IAO1C,sBAAsB,CAC3B,QAAQ,EAAE,6BAA6B,GACtC,aAAa,CAAC,wBAAwB,CAAC;IAoBnC,mBAAmB,CACxB,QAAQ,EAAE,0BAA0B,GACnC,aAAa,CAAC,iCAAiC,CAAC;CAmEpD"}