@heddleagent/execution-host-client 6.4.0 → 6.6.0

package/dist/internal/jwt-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-verification.js","sourceRoot":"","sources":["../../src/internal/jwt-verification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,MAAM,GAEP,MAAM,MAAM,CAAC;AAEd,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IACxC,WAAW,EAAE,EAAE,GAAG,MAAM;IACxB,gBAAgB,EAAE,MAAM;IACxB,eAAe,EAAE,KAAK;CACvB,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAA6C;IACtF,CAAC,kBAAkB,EAAE,eAAe,CAAC;IACrC,CAAC,iBAAiB,EAAE,eAAe,CAAC;IACpC,CAAC,kBAAkB,EAAE,eAAe,CAAC;IACrC,CAAC,iCAAiC,EAAE,eAAe,CAAC;IACpD,CAAC,kBAAkB,EAAE,cAAc,CAAC;CACrC,CAAC,CAAC;AAOH,MAAM,UAAU,oBAAoB,CAAC,OAAY;IAC/C,OAAO,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,yCAAyC,CACvD,KAAc;IAEd,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,YAAY,MAAM,CAAC,SAAS;QACtC,CAAC,CAAC,2BAA2B,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;QAC7C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC","sourcesContent":["import {\n  createRemoteJWKSet,\n  errors,\n  type JWTVerifyGetKey,\n} from 'jose';\n\nconst REMOTE_JWKS_OPTIONS = Object.freeze({\n  cacheMaxAge: 10 * 60_000,\n  cooldownDuration: 30_000,\n  timeoutDuration: 3_000,\n});\n\nconst UNAVAILABLE_JOSE_CATEGORIES = new Map<string, JwtVerificationUnavailableCategory>([\n  ['ERR_JOSE_GENERIC', 'jwks_response'],\n  ['ERR_JWK_INVALID', 'jwks_response'],\n  ['ERR_JWKS_INVALID', 'jwks_response'],\n  ['ERR_JWKS_MULTIPLE_MATCHING_KEYS', 'jwks_response'],\n  ['ERR_JWKS_TIMEOUT', 'jwks_timeout'],\n]);\n\nexport type JwtVerificationUnavailableCategory =\n  | 'network'\n  | 'jwks_response'\n  | 'jwks_timeout';\n\nexport function createJwtKeyResolver(jwksUrl: URL): JWTVerifyGetKey {\n  return createRemoteJWKSet(jwksUrl, REMOTE_JWKS_OPTIONS);\n}\n\nexport function resolveJwtVerificationUnavailableCategory(\n  error: unknown,\n): JwtVerificationUnavailableCategory | undefined {\n  if (error instanceof TypeError) {\n    return 'network';\n  }\n  return error instanceof errors.JOSEError\n    ? UNAVAILABLE_JOSE_CATEGORIES.get(error.code)\n    : undefined;\n}\n"]}

package/dist/mcp/jwt-capability-verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-capability-verifier.d.ts","sourceRoot":"","sources":["../../src/mcp/jwt-capability-verifier.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,8BAA8B,EAC9B,+BAA+B,EAC/B,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAqBpB;;;GAGG;AACH,qBAAa,wBAAwB,CAAC,SAAS,SAAS,MAAM,CAC9D,YAAW,qBAAqB,CAAC,SAAS,CAAC;;gBAOvC,MAAM,EAAE,8BAA8B,CAAC,SAAS,CAAC,EACjD,OAAO,GAAE,+BAAoC;IAoBzC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;CA8E3E;AAED,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,qBAAqB,EACjC,GAAG,OAAa,GACf,IAAI,CAKN"}
+{"version":3,"file":"jwt-capability-verifier.d.ts","sourceRoot":"","sources":["../../src/mcp/jwt-capability-verifier.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,8BAA8B,EAC9B,+BAA+B,EAC/B,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAqBpB;;;GAGG;AACH,qBAAa,wBAAwB,CAAC,SAAS,SAAS,MAAM,CAC9D,YAAW,qBAAqB,CAAC,SAAS,CAAC;;gBAOvC,MAAM,EAAE,8BAA8B,CAAC,SAAS,CAAC,EACjD,OAAO,GAAE,+BAAoC;IAczC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;CAkF3E;AAED,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,qBAAqB,EACjC,GAAG,OAAa,GACf,IAAI,CAKN"}

package/dist/mcp/jwt-capability-verifier.js

@@ -1,7 +1,8 @@
-import { createRemoteJWKSet, errors, jwtVerify, } from 'jose';
+import { jwtVerify } from 'jose';
 import { z } from 'zod';
 import { JwtAudienceSchema, JwtIssuerSchema, MCP_CAPABILITY_TYPE, McpAllowedToolsSchema, McpCapabilityClaimsSchema, McpServerIdSchema, OpaqueIdSchema, isSafeWebUrl, } from '../contracts/index.js';
 import { McpCapabilityUnavailableError, McpCapabilityVerificationError, } from './errors.js';
+import { createJwtKeyResolver, resolveJwtVerificationUnavailableCategory, } from '../internal/jwt-verification.js';
 const CapabilityAssertionSchema = z.string().min(32).max(4_096);
 const ConfigSchema = z.object({
     issuer: JwtIssuerSchema,
@@ -30,11 +31,8 @@ export class JwtMcpCapabilityVerifier {
             supportedTools: Object.freeze([...parsed.supportedTools]),
         });
         this.#supportedTools = new Set(this.#config.supportedTools);
-        this.#keyResolver = options.keyResolver ?? createRemoteJWKSet(this.#config.jwksUrl, {
-            cacheMaxAge: 10 * 60_000,
-            cooldownDuration: 30_000,
-            timeoutDuration: 3_000,
-        });
+        this.#keyResolver = options.keyResolver
+            ?? createJwtKeyResolver(this.#config.jwksUrl);
         this.#now = options.now ?? (() => new Date());
     }
     async verify(assertion) {
@@ -76,9 +74,9 @@ export class JwtMcpCapabilityVerifier {
                 || error instanceof McpCapabilityUnavailableError) {
                 throw error;
             }
-            const unavailableCategory = resolveUnavailableCategory(error);
+            const unavailableCategory = resolveJwtVerificationUnavailableCategory(error);
             if (unavailableCategory) {
-                throw new McpCapabilityUnavailableError(unavailableCategory);
+                throw new McpCapabilityUnavailableError(unavailableCategory === 'network' ? 'network' : 'jwks');
             }
             throw new McpCapabilityVerificationError();
         }
@@ -116,21 +114,4 @@ function freezeVerifiedCapability(capability) {
         scope: Object.freeze({ ...capability.scope }),
     });
 }
-const UNAVAILABLE_JOSE_CODES = new Set([
-    'ERR_JOSE_GENERIC',
-    'ERR_JWK_INVALID',
-    'ERR_JWKS_INVALID',
-    'ERR_JWKS_MULTIPLE_MATCHING_KEYS',
-    'ERR_JWKS_TIMEOUT',
-]);
-function resolveUnavailableCategory(error) {
-    if (error instanceof TypeError) {
-        return 'network';
-    }
-    if (error instanceof errors.JOSEError
-        && UNAVAILABLE_JOSE_CODES.has(error.code)) {
-        return 'jwks';
-    }
-    return undefined;
-}
 //# sourceMappingURL=jwt-capability-verifier.js.map

package/dist/mcp/jwt-capability-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-capability-verifier.js","sourceRoot":"","sources":["../../src/mcp/jwt-capability-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,MAAM,EACN,SAAS,GACV,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,EACzB,iBAAiB,EACjB,cAAc,EACd,YAAY,GACb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,aAAa,CAAC;AAQrB,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAChE,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,MAAM,EAAE,eAAe;IACvB,QAAQ,EAAE,iBAAiB;IAC3B,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,CAC/B,YAAY,EACZ,gFAAgF,CACjF;IACD,gBAAgB,EAAE,cAAc;IAChC,QAAQ,EAAE,iBAAiB;IAC3B,cAAc,EAAE,qBAAqB;IACrC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;IAC7D,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CAClE,CAAC,CAAC,MAAM,EAAE,CAAC;AAMZ;;;GAGG;AACH,MAAM,OAAO,wBAAwB;IAE1B,OAAO,CAAyB;IAChC,eAAe,CAAsB;IACrC,YAAY,CAA8D;IAC1E,IAAI,CAAa;IAE1B,YACE,MAAiD,EACjD,UAA2C,EAAE;QAE7C,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;YAC3B,GAAG,MAAM;YACT,OAAO,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;YAChC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;SAC1D,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAC3D,IAAI,CAAC,OAAO,CAAC,OAAO,EACpB;YACE,WAAW,EAAE,EAAE,GAAG,MAAM;YACxB,gBAAgB,EAAE,MAAM;YACxB,eAAe,EAAE,KAAK;SACvB,CACF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,yBAAyB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC9D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE;gBACjE,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAC/B,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB;gBAClD,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC3B,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,uBAAuB;gBACjD,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;gBAC5C,GAAG,EAAE,mBAAmB;aACzB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACxD,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAEhD,OAAO,wBAAwB,CAAC;gBAC9B,YAAY,EAAE,MAAM,CAAC,GAAG;gBACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,YAAY,EAAE,MAAM,CAAC,YAA2B;gBAChD,KAAK,EAAE;oBACL,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,SAAS,EAAE,MAAM,CAAC,GAAG;oBACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;oBACzC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;oBACzC,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B;gBACD,QAAQ,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;gBACpD,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,KAAK,YAAY,8BAA8B;mBAC5C,KAAK,YAAY,6BAA6B,EACjD,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;YAC9D,IAAI,mBAAmB,EAAE,CAAC;gBACxB,MAAM,IAAI,6BAA6B,CAAC,mBAAmB,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,IAAI,8BAA8B,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,wBAAwB,CACtB,MAAiD;QAEjD,IACE,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO,CAAC,gBAAgB;eAC/C,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ;eACzC,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,YAAY,EACrC,CAAC;YACD,MAAM,IAAI,8BAA8B,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,sBAAsB,CACpB,MAAiD;QAEjD,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QAChD,IACE,eAAe,IAAI,CAAC;eACjB,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,uBAAuB,EACzD,CAAC;YACD,MAAM,IAAI,8BAA8B,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,qBAAqB,CAAC,KAAwB;QAC5C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,8BAA8B,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,yBAAyB,CACvC,UAAiC,EACjC,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;QAC9D,MAAM,IAAI,8BAA8B,EAAE,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,UAA4C;IAE5C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,UAAU;QACb,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACzD,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC;KAC9C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,kBAAkB;IAClB,iBAAiB;IACjB,kBAAkB;IAClB,iCAAiC;IACjC,kBAAkB;CACnB,CAAC,CAAC;AAEH,SAAS,0BAA0B,CACjC,KAAc;IAEd,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,KAAK,YAAY,MAAM,CAAC,SAAS;WAC9B,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EACzC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["import {\n  createRemoteJWKSet,\n  errors,\n  jwtVerify,\n} from 'jose';\nimport { z } from 'zod';\nimport {\n  JwtAudienceSchema,\n  JwtIssuerSchema,\n  MCP_CAPABILITY_TYPE,\n  McpAllowedToolsSchema,\n  McpCapabilityClaimsSchema,\n  McpServerIdSchema,\n  OpaqueIdSchema,\n  isSafeWebUrl,\n} from '../contracts/index.js';\nimport {\n  McpCapabilityUnavailableError,\n  McpCapabilityVerificationError,\n} from './errors.js';\nimport type {\n  JwtMcpCapabilityVerifierConfig,\n  JwtMcpCapabilityVerifierOptions,\n  McpCapabilityVerifier,\n  VerifiedMcpCapability,\n} from './types.js';\n\nconst CapabilityAssertionSchema = z.string().min(32).max(4_096);\nconst ConfigSchema = z.object({\n  issuer: JwtIssuerSchema,\n  audience: JwtAudienceSchema,\n  jwksUrl: z.instanceof(URL).refine(\n    isSafeWebUrl,\n    'must use HTTPS or loopback HTTP and contain no credentials, query, or fragment',\n  ),\n  trustedAdopterId: OpaqueIdSchema,\n  serverId: McpServerIdSchema,\n  supportedTools: McpAllowedToolsSchema,\n  maxCapabilityAgeSeconds: z.number().int().min(1).max(15 * 60),\n  clockToleranceSeconds: z.number().int().min(0).max(60).default(5),\n}).strict();\n\ntype ParsedConfig = Omit<z.infer<typeof ConfigSchema>, 'supportedTools'> & {\n  supportedTools: readonly string[];\n};\n\n/**\n * Independently verifies an adopter-signed capability at the adopter's MCP\n * edge. Execution Host verification is defense in depth, not forwarded trust.\n */\nexport class JwtMcpCapabilityVerifier<TToolName extends string>\nimplements McpCapabilityVerifier<TToolName> {\n  readonly #config: Readonly<ParsedConfig>;\n  readonly #supportedTools: ReadonlySet<string>;\n  readonly #keyResolver: NonNullable<JwtMcpCapabilityVerifierOptions['keyResolver']>;\n  readonly #now: () => Date;\n\n  constructor(\n    config: JwtMcpCapabilityVerifierConfig<TToolName>,\n    options: JwtMcpCapabilityVerifierOptions = {},\n  ) {\n    const parsed = ConfigSchema.parse(config);\n    this.#config = Object.freeze({\n      ...parsed,\n      jwksUrl: new URL(parsed.jwksUrl),\n      supportedTools: Object.freeze([...parsed.supportedTools]),\n    });\n    this.#supportedTools = new Set(this.#config.supportedTools);\n    this.#keyResolver = options.keyResolver ?? createRemoteJWKSet(\n      this.#config.jwksUrl,\n      {\n        cacheMaxAge: 10 * 60_000,\n        cooldownDuration: 30_000,\n        timeoutDuration: 3_000,\n      },\n    );\n    this.#now = options.now ?? (() => new Date());\n  }\n\n  async verify(assertion: string): Promise<VerifiedMcpCapability<TToolName>> {\n    try {\n      const compactJwt = CapabilityAssertionSchema.parse(assertion);\n      const { payload } = await jwtVerify(compactJwt, this.#keyResolver, {\n        algorithms: ['ES256'],\n        audience: this.#config.audience,\n        clockTolerance: this.#config.clockToleranceSeconds,\n        currentDate: this.#now(),\n        issuer: this.#config.issuer,\n        maxTokenAge: this.#config.maxCapabilityAgeSeconds,\n        requiredClaims: ['exp', 'iat', 'jti', 'sub'],\n        typ: MCP_CAPABILITY_TYPE,\n      });\n      const claims = McpCapabilityClaimsSchema.parse(payload);\n      this.#assertDeploymentBinding(claims);\n      this.#assertBoundedLifetime(claims);\n      this.#assertSupportedTools(claims.allowedTools);\n\n      return freezeVerifiedCapability({\n        capabilityId: claims.jti,\n        serverId: claims.serverId,\n        allowedTools: claims.allowedTools as TToolName[],\n        scope: {\n          adopterId: claims.adopterId,\n          tenantId: claims.tenantId,\n          subjectId: claims.sub,\n          productSessionId: claims.productSessionId,\n          runtimeSessionId: claims.runtimeSessionId,\n          invocationId: claims.invocationId,\n          workflow: claims.workflow,\n        },\n        issuedAt: new Date(claims.iat * 1_000).toISOString(),\n        expiresAt: new Date(claims.exp * 1_000).toISOString(),\n      });\n    } catch (error) {\n      if (\n        error instanceof McpCapabilityVerificationError\n        || error instanceof McpCapabilityUnavailableError\n      ) {\n        throw error;\n      }\n      const unavailableCategory = resolveUnavailableCategory(error);\n      if (unavailableCategory) {\n        throw new McpCapabilityUnavailableError(unavailableCategory);\n      }\n      throw new McpCapabilityVerificationError();\n    }\n  }\n\n  #assertDeploymentBinding(\n    claims: z.infer<typeof McpCapabilityClaimsSchema>,\n  ): void {\n    if (\n      claims.adopterId !== this.#config.trustedAdopterId\n      || claims.serverId !== this.#config.serverId\n      || claims.jti === claims.invocationId\n    ) {\n      throw new McpCapabilityVerificationError();\n    }\n  }\n\n  #assertBoundedLifetime(\n    claims: z.infer<typeof McpCapabilityClaimsSchema>,\n  ): void {\n    const lifetimeSeconds = claims.exp - claims.iat;\n    if (\n      lifetimeSeconds <= 0\n      || lifetimeSeconds > this.#config.maxCapabilityAgeSeconds\n    ) {\n      throw new McpCapabilityVerificationError();\n    }\n  }\n\n  #assertSupportedTools(tools: readonly string[]): void {\n    if (!tools.every((tool) => this.#supportedTools.has(tool))) {\n      throw new McpCapabilityVerificationError();\n    }\n  }\n}\n\nexport function assertMcpCapabilityActive(\n  capability: VerifiedMcpCapability,\n  now = new Date(),\n): void {\n  const expiresAt = Date.parse(capability.expiresAt);\n  if (!Number.isFinite(expiresAt) || now.getTime() >= expiresAt) {\n    throw new McpCapabilityVerificationError();\n  }\n}\n\nfunction freezeVerifiedCapability<TToolName extends string>(\n  capability: VerifiedMcpCapability<TToolName>,\n): VerifiedMcpCapability<TToolName> {\n  return Object.freeze({\n    ...capability,\n    allowedTools: Object.freeze([...capability.allowedTools]),\n    scope: Object.freeze({ ...capability.scope }),\n  });\n}\n\nconst UNAVAILABLE_JOSE_CODES = new Set([\n  'ERR_JOSE_GENERIC',\n  'ERR_JWK_INVALID',\n  'ERR_JWKS_INVALID',\n  'ERR_JWKS_MULTIPLE_MATCHING_KEYS',\n  'ERR_JWKS_TIMEOUT',\n]);\n\nfunction resolveUnavailableCategory(\n  error: unknown,\n): 'network' | 'jwks' | undefined {\n  if (error instanceof TypeError) {\n    return 'network';\n  }\n  if (\n    error instanceof errors.JOSEError\n    && UNAVAILABLE_JOSE_CODES.has(error.code)\n  ) {\n    return 'jwks';\n  }\n  return undefined;\n}\n"]}
+{"version":3,"file":"jwt-capability-verifier.js","sourceRoot":"","sources":["../../src/mcp/jwt-capability-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,EACzB,iBAAiB,EACjB,cAAc,EACd,YAAY,GACb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oBAAoB,EACpB,yCAAyC,GAC1C,MAAM,iCAAiC,CAAC;AAQzC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAChE,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,MAAM,EAAE,eAAe;IACvB,QAAQ,EAAE,iBAAiB;IAC3B,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,CAC/B,YAAY,EACZ,gFAAgF,CACjF;IACD,gBAAgB,EAAE,cAAc;IAChC,QAAQ,EAAE,iBAAiB;IAC3B,cAAc,EAAE,qBAAqB;IACrC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;IAC7D,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CAClE,CAAC,CAAC,MAAM,EAAE,CAAC;AAMZ;;;GAGG;AACH,MAAM,OAAO,wBAAwB;IAE1B,OAAO,CAAyB;IAChC,eAAe,CAAsB;IACrC,YAAY,CAA8D;IAC1E,IAAI,CAAa;IAE1B,YACE,MAAiD,EACjD,UAA2C,EAAE;QAE7C,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;YAC3B,GAAG,MAAM;YACT,OAAO,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;YAChC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;SAC1D,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW;eAClC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,yBAAyB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC9D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE;gBACjE,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAC/B,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB;gBAClD,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC3B,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,uBAAuB;gBACjD,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;gBAC5C,GAAG,EAAE,mBAAmB;aACzB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACxD,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAEhD,OAAO,wBAAwB,CAAC;gBAC9B,YAAY,EAAE,MAAM,CAAC,GAAG;gBACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,YAAY,EAAE,MAAM,CAAC,YAA2B;gBAChD,KAAK,EAAE;oBACL,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,SAAS,EAAE,MAAM,CAAC,GAAG;oBACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;oBACzC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;oBACzC,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B;gBACD,QAAQ,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;gBACpD,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,KAAK,YAAY,8BAA8B;mBAC5C,KAAK,YAAY,6BAA6B,EACjD,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,mBAAmB,GAAG,yCAAyC,CACnE,KAAK,CACN,CAAC;YACF,IAAI,mBAAmB,EAAE,CAAC;gBACxB,MAAM,IAAI,6BAA6B,CACrC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CACvD,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,8BAA8B,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,wBAAwB,CACtB,MAAiD;QAEjD,IACE,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO,CAAC,gBAAgB;eAC/C,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ;eACzC,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,YAAY,EACrC,CAAC;YACD,MAAM,IAAI,8BAA8B,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,sBAAsB,CACpB,MAAiD;QAEjD,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QAChD,IACE,eAAe,IAAI,CAAC;eACjB,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,uBAAuB,EACzD,CAAC;YACD,MAAM,IAAI,8BAA8B,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,qBAAqB,CAAC,KAAwB;QAC5C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,8BAA8B,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,yBAAyB,CACvC,UAAiC,EACjC,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;QAC9D,MAAM,IAAI,8BAA8B,EAAE,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,UAA4C;IAE5C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,UAAU;QACb,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACzD,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC;KAC9C,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { jwtVerify } from 'jose';\nimport { z } from 'zod';\nimport {\n  JwtAudienceSchema,\n  JwtIssuerSchema,\n  MCP_CAPABILITY_TYPE,\n  McpAllowedToolsSchema,\n  McpCapabilityClaimsSchema,\n  McpServerIdSchema,\n  OpaqueIdSchema,\n  isSafeWebUrl,\n} from '../contracts/index.js';\nimport {\n  McpCapabilityUnavailableError,\n  McpCapabilityVerificationError,\n} from './errors.js';\nimport {\n  createJwtKeyResolver,\n  resolveJwtVerificationUnavailableCategory,\n} from '../internal/jwt-verification.js';\nimport type {\n  JwtMcpCapabilityVerifierConfig,\n  JwtMcpCapabilityVerifierOptions,\n  McpCapabilityVerifier,\n  VerifiedMcpCapability,\n} from './types.js';\n\nconst CapabilityAssertionSchema = z.string().min(32).max(4_096);\nconst ConfigSchema = z.object({\n  issuer: JwtIssuerSchema,\n  audience: JwtAudienceSchema,\n  jwksUrl: z.instanceof(URL).refine(\n    isSafeWebUrl,\n    'must use HTTPS or loopback HTTP and contain no credentials, query, or fragment',\n  ),\n  trustedAdopterId: OpaqueIdSchema,\n  serverId: McpServerIdSchema,\n  supportedTools: McpAllowedToolsSchema,\n  maxCapabilityAgeSeconds: z.number().int().min(1).max(15 * 60),\n  clockToleranceSeconds: z.number().int().min(0).max(60).default(5),\n}).strict();\n\ntype ParsedConfig = Omit<z.infer<typeof ConfigSchema>, 'supportedTools'> & {\n  supportedTools: readonly string[];\n};\n\n/**\n * Independently verifies an adopter-signed capability at the adopter's MCP\n * edge. Execution Host verification is defense in depth, not forwarded trust.\n */\nexport class JwtMcpCapabilityVerifier<TToolName extends string>\nimplements McpCapabilityVerifier<TToolName> {\n  readonly #config: Readonly<ParsedConfig>;\n  readonly #supportedTools: ReadonlySet<string>;\n  readonly #keyResolver: NonNullable<JwtMcpCapabilityVerifierOptions['keyResolver']>;\n  readonly #now: () => Date;\n\n  constructor(\n    config: JwtMcpCapabilityVerifierConfig<TToolName>,\n    options: JwtMcpCapabilityVerifierOptions = {},\n  ) {\n    const parsed = ConfigSchema.parse(config);\n    this.#config = Object.freeze({\n      ...parsed,\n      jwksUrl: new URL(parsed.jwksUrl),\n      supportedTools: Object.freeze([...parsed.supportedTools]),\n    });\n    this.#supportedTools = new Set(this.#config.supportedTools);\n    this.#keyResolver = options.keyResolver\n      ?? createJwtKeyResolver(this.#config.jwksUrl);\n    this.#now = options.now ?? (() => new Date());\n  }\n\n  async verify(assertion: string): Promise<VerifiedMcpCapability<TToolName>> {\n    try {\n      const compactJwt = CapabilityAssertionSchema.parse(assertion);\n      const { payload } = await jwtVerify(compactJwt, this.#keyResolver, {\n        algorithms: ['ES256'],\n        audience: this.#config.audience,\n        clockTolerance: this.#config.clockToleranceSeconds,\n        currentDate: this.#now(),\n        issuer: this.#config.issuer,\n        maxTokenAge: this.#config.maxCapabilityAgeSeconds,\n        requiredClaims: ['exp', 'iat', 'jti', 'sub'],\n        typ: MCP_CAPABILITY_TYPE,\n      });\n      const claims = McpCapabilityClaimsSchema.parse(payload);\n      this.#assertDeploymentBinding(claims);\n      this.#assertBoundedLifetime(claims);\n      this.#assertSupportedTools(claims.allowedTools);\n\n      return freezeVerifiedCapability({\n        capabilityId: claims.jti,\n        serverId: claims.serverId,\n        allowedTools: claims.allowedTools as TToolName[],\n        scope: {\n          adopterId: claims.adopterId,\n          tenantId: claims.tenantId,\n          subjectId: claims.sub,\n          productSessionId: claims.productSessionId,\n          runtimeSessionId: claims.runtimeSessionId,\n          invocationId: claims.invocationId,\n          workflow: claims.workflow,\n        },\n        issuedAt: new Date(claims.iat * 1_000).toISOString(),\n        expiresAt: new Date(claims.exp * 1_000).toISOString(),\n      });\n    } catch (error) {\n      if (\n        error instanceof McpCapabilityVerificationError\n        || error instanceof McpCapabilityUnavailableError\n      ) {\n        throw error;\n      }\n      const unavailableCategory = resolveJwtVerificationUnavailableCategory(\n        error,\n      );\n      if (unavailableCategory) {\n        throw new McpCapabilityUnavailableError(\n          unavailableCategory === 'network' ? 'network' : 'jwks',\n        );\n      }\n      throw new McpCapabilityVerificationError();\n    }\n  }\n\n  #assertDeploymentBinding(\n    claims: z.infer<typeof McpCapabilityClaimsSchema>,\n  ): void {\n    if (\n      claims.adopterId !== this.#config.trustedAdopterId\n      || claims.serverId !== this.#config.serverId\n      || claims.jti === claims.invocationId\n    ) {\n      throw new McpCapabilityVerificationError();\n    }\n  }\n\n  #assertBoundedLifetime(\n    claims: z.infer<typeof McpCapabilityClaimsSchema>,\n  ): void {\n    const lifetimeSeconds = claims.exp - claims.iat;\n    if (\n      lifetimeSeconds <= 0\n      || lifetimeSeconds > this.#config.maxCapabilityAgeSeconds\n    ) {\n      throw new McpCapabilityVerificationError();\n    }\n  }\n\n  #assertSupportedTools(tools: readonly string[]): void {\n    if (!tools.every((tool) => this.#supportedTools.has(tool))) {\n      throw new McpCapabilityVerificationError();\n    }\n  }\n}\n\nexport function assertMcpCapabilityActive(\n  capability: VerifiedMcpCapability,\n  now = new Date(),\n): void {\n  const expiresAt = Date.parse(capability.expiresAt);\n  if (!Number.isFinite(expiresAt) || now.getTime() >= expiresAt) {\n    throw new McpCapabilityVerificationError();\n  }\n}\n\nfunction freezeVerifiedCapability<TToolName extends string>(\n  capability: VerifiedMcpCapability<TToolName>,\n): VerifiedMcpCapability<TToolName> {\n  return Object.freeze({\n    ...capability,\n    allowedTools: Object.freeze([...capability.allowedTools]),\n    scope: Object.freeze({ ...capability.scope }),\n  });\n}\n"]}

package/dist/node/http-service.d.ts

@@ -1,7 +1,5 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { NodeExecutionAdopterHttpHandler, NodeExecutionAdopterHttpServiceConfig } from './types.js';
-export declare const DEFAULT_ADOPTER_JWKS_PATH = "/.well-known/jwks.json";
-export declare const DEFAULT_ADOPTER_CONVERSATION_TURNS_PATH = "/hosted-execution/conversation-turns";
 /**
  * Standard Node HTTP edge for adopter-side JWKS and hosted conversations.
  *

package/dist/node/http-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-service.d.ts","sourceRoot":"","sources":["../../src/node/http-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACf,MAAM,WAAW,CAAC;AAcnB,OAAO,KAAK,EAEV,+BAA+B,EAE/B,qCAAqC,EAEtC,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,yBAAyB,2BAA2B,CAAC;AAClE,eAAO,MAAM,uCAAuC,yCACZ,CAAC;AAgBzC;;;;;;;GAOG;AACH,qBAAa,+BAA+B,CAAC,SAAS,CACtD,YAAW,+BAA+B;;gBAwB5B,MAAM,EAAE,qCAAqC,CAAC,SAAS,CAAC;IAkBpE,MAAM,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO;IAanE,UAAU,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI;IAwBpE,sBAAsB,CACpB,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,cAAc,GACvB,IAAI;IA0CP,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAmJvB"}
+{"version":3,"file":"http-service.d.ts","sourceRoot":"","sources":["../../src/node/http-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACf,MAAM,WAAW,CAAC;AAkBnB,OAAO,KAAK,EAEV,+BAA+B,EAE/B,qCAAqC,EAEtC,MAAM,YAAY,CAAC;AAgBpB;;;;;;;GAOG;AACH,qBAAa,+BAA+B,CAAC,SAAS,CACtD,YAAW,+BAA+B;;gBAwB5B,MAAM,EAAE,qCAAqC,CAAC,SAAS,CAAC;IAkBpE,MAAM,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO;IAanE,UAAU,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI;IAwBpE,sBAAsB,CACpB,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,cAAc,GACvB,IAAI;IA0CP,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAmJvB"}

package/dist/node/http-service.js

@@ -1,10 +1,9 @@
 import { once } from 'node:events';
 import { z } from 'zod';
+import { DEFAULT_ADOPTER_CONVERSATION_TURNS_PATH, DEFAULT_ADOPTER_JWKS_PATH, } from '../adopter/index.js';
 import { ExecutionHostStreamEventSchema } from '../contracts/index.js';
 import { ExecutionHostInvocationCancelledError } from '../http-sse/index.js';
 import { NodeHttpPathSchema, NodeHttpRequestError, errorType, readJsonBody, readPathname, takeAuthorization, writeJson, writeJsonError, } from './http-utils.js';
-export const DEFAULT_ADOPTER_JWKS_PATH = '/.well-known/jwks.json';
-export const DEFAULT_ADOPTER_CONVERSATION_TURNS_PATH = '/hosted-execution/conversation-turns';
 const DEFAULT_MAX_BODY_BYTES = 64 * 1_024;
 const DEFAULT_MAX_PROMPT_CHARACTERS = 20_000;
 const PublicErrorSchema = z.object({

package/dist/node/http-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-service.js","sourceRoot":"","sources":["../../src/node/http-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAKnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,qCAAqC,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,cAAc,GACf,MAAM,iBAAiB,CAAC;AASzB,MAAM,CAAC,MAAM,yBAAyB,GAAG,wBAAwB,CAAC;AAClE,MAAM,CAAC,MAAM,uCAAuC,GAClD,sCAAsC,CAAC;AAEzC,MAAM,sBAAsB,GAAG,EAAE,GAAG,KAAK,CAAC;AAC1C,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAC7C,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;CACtC,CAAC,CAAC,MAAM,EAAE,CAAC;AASZ;;;;;;;GAOG;AACH,MAAM,OAAO,+BAA+B;IAEjC,UAAU,CAEjB;IACO,cAAc,CAErB;IACO,cAAc,CAEJ;IACV,aAAa,CAEpB;IACO,cAAc,CAErB;IACO,MAAM,CAA0C;IAChD,aAAa,CAAS;IACtB,oBAAoB,CAAS;IAC7B,kBAAkB,CAAS;IAC3B,oBAAoB,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC9D,OAAO,GAAG,KAAK,CAAC;IAChB,aAAa,CAA4B;IAEzC,YAAY,MAAwD;QAClE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,CAC/D,MAAM,CAAC,YAAY,IAAI,sBAAsB,CAC9C,CAAC;QACF,IAAI,CAAC,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CACpE,MAAM,CAAC,mBAAmB,IAAI,6BAA6B,CAC5D,CAAC;QACF,IAAI,CAAC,kBAAkB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CACjE,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAC/B,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,OAAwB,EAAE,QAAwB;QACvD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC/C,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,UAAU,CAAC,OAAwB,EAAE,QAAwB;QAC3D,OAAO,CAAC,MAAM,EAAE,CAAC;QACjB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,kCAAkC,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE;gBACrD,eAAe,EAAE,mBAAmB,IAAI,CAAC,kBAAkB,EAAE;aAC9D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC;gBACX,KAAK,EAAE,MAAM;gBACb,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;gBAC3B,cAAc,EAAE,KAAK;aACtB,CAAC,CAAC;YACH,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,oCAAoC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,sBAAsB,CACpB,OAAwB,EACxB,QAAwB;QAExB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,kCAAkC,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CACvC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CACrD,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAuB;YACjC,eAAe;YACf,OAAO;YACP,QAAQ;YACR,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;SAC3B,CAAC;QACF,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,kBAAkB,CACtC,OAAO,EACP,QAAQ,EACR,eAAe,CAAC,MAAM,CACvB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAChB,IAAI,CAAC,OAAO,CAAC;gBACX,KAAK,EAAE,cAAc;gBACrB,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;gBAC3B,cAAc,EAAE,QAAQ,CAAC,WAAW;aACrC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,kCAAkC,CAAC,CAAC;YACpE,CAAC;iBAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;gBAC1D,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,CAAC;QACH,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACzC,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,yBAAyB;QAC7B,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC9C,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE;YACxD,eAAe,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;YAC1E,OAAO,CAAC,OAAO,EAAE,CAAC;YAClB,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAwB,EACxB,QAAwB,EACxB,MAAmB;QAEnB,IAAI,aAAiC,CAAC;QACtC,IAAI,CAAC;YACH,aAAa,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,OAAO,CAAC,MAAM,EAAE,CAAC;gBACjB,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,cAAc,CACZ,QAAQ,EACR,KAAK,YAAY,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAC9D,+BAA+B,CAChC,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,SAAgC,CAAC;QACrC,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC;gBACjD,aAAa;gBACb,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa;gBAC3C,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC;gBACX,KAAK,EAAE,gBAAgB;gBACvB,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;gBAC3B,cAAc,EAAE,KAAK;aACtB,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,wCAAwC,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,6BAA6B,EAAE;gBAC3D,kBAAkB,EAAE,QAAQ;aAC7B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;gBAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC;aAChE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,KAAK,YAAY,oBAAoB;gBACtD,CAAC,CAAC,KAAK,CAAC,UAAU;gBAClB,CAAC,CAAC,GAAG,CAAC;YACR,cAAc,CAAC,QAAQ,EAAE,UAAU,EAAE,+BAA+B,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,QAAQ,IAAI,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC;gBAC1D,SAAS;gBACT,MAAM;gBACN,MAAM;aACP,CAAC,EAAE,CAAC;gBACH,MAAM,KAAK,GAAG,8BAA8B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,uBAAuB,CAAC,QAAQ,CAAC,CAAC;oBAClC,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC;gBACD,MAAM,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,oCAAoC,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACjE,IAAI,WAAW,EAAE,CAAC;gBAChB,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,IACE,KAAK,YAAY,qCAAqC;mBACnD,MAAM,CAAC,OAAO,EACjB,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;oBACjD,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,oCAAoC,CAAC,CAAC;gBACtE,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,OAAO,CAAC;gBACX,KAAK,EAAE,cAAc;gBACrB,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;gBAC3B,cAAc,EAAE,QAAQ;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,qCAAqC,CAAC,CAAC;YACvE,CAAC;iBAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;gBAC1D,wEAAwE;gBACxE,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,KAAc;QACrB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC5C,OAAO,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,OAAoC;QAC1C,IAAI,CAAC;YACH,IAAI,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;IACH,CAAC;CACF;AAED,SAAS,UAAU,CACjB,KAAyD;IAEzD,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,IAAI,yBAAyB,CAAC;QACxE,iBAAiB,EAAE,kBAAkB,CAAC,KAAK,CACzC,KAAK,EAAE,iBAAiB,IAAI,uCAAuC,CACpE;KACF,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAwB;IACvD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE;QACtB,eAAe,EAAE,UAAU;QAC3B,cAAc,EAAE,kCAAkC;QAClD,UAAU,EAAE,YAAY;QACxB,mBAAmB,EAAE,IAAI;QACzB,wBAAwB,EAAE,SAAS;KACpC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAwB,EACxB,KAAqD,EACrD,MAAmB;IAEnB,MAAM,KAAK,GAAG;QACZ,UAAU,KAAK,CAAC,IAAI,EAAE;QACtB,OAAO,KAAK,CAAC,QAAQ,EAAE;QACvB,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QAChC,EAAE;QACF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC","sourcesContent":["import { once } from 'node:events';\nimport type {\n  IncomingMessage,\n  ServerResponse,\n} from 'node:http';\nimport { z } from 'zod';\nimport { ExecutionHostStreamEventSchema } from '../contracts/index.js';\nimport { ExecutionHostInvocationCancelledError } from '../http-sse/index.js';\nimport {\n  NodeHttpPathSchema,\n  NodeHttpRequestError,\n  errorType,\n  readJsonBody,\n  readPathname,\n  takeAuthorization,\n  writeJson,\n  writeJsonError,\n} from './http-utils.js';\nimport type {\n  NodeExecutionAdopterFailure,\n  NodeExecutionAdopterHttpHandler,\n  NodeExecutionAdopterHttpPaths,\n  NodeExecutionAdopterHttpServiceConfig,\n  NodeExecutionAdopterPublicError,\n} from './types.js';\n\nexport const DEFAULT_ADOPTER_JWKS_PATH = '/.well-known/jwks.json';\nexport const DEFAULT_ADOPTER_CONVERSATION_TURNS_PATH =\n  '/hosted-execution/conversation-turns';\n\nconst DEFAULT_MAX_BODY_BYTES = 64 * 1_024;\nconst DEFAULT_MAX_PROMPT_CHARACTERS = 20_000;\nconst PublicErrorSchema = z.object({\n  statusCode: z.number().int().min(400).max(599),\n  message: z.string().min(1).max(1_600),\n}).strict();\n\ntype ActiveConversation = {\n  abortController: AbortController;\n  request: IncomingMessage;\n  response: ServerResponse;\n  pending: Promise<void>;\n};\n\n/**\n * Standard Node HTTP edge for adopter-side JWKS and hosted conversations.\n *\n * The service owns bounded parsing, credential-header scrubbing, SSE framing,\n * disconnect cancellation, safe failures, and graceful shutdown. Product\n * authentication, authorization, identity selection, and persistence stay in\n * adopter callbacks.\n */\nexport class NodeExecutionAdopterHttpService<Principal>\nimplements NodeExecutionAdopterHttpHandler {\n  readonly #authority: NodeExecutionAdopterHttpServiceConfig<Principal>[\n    'authority'\n  ];\n  readonly #authenticator: NodeExecutionAdopterHttpServiceConfig<Principal>[\n    'authenticator'\n  ];\n  readonly #conversations: NodeExecutionAdopterHttpServiceConfig<\n    Principal\n  >['conversations'];\n  readonly #projectError: NodeExecutionAdopterHttpServiceConfig<Principal>[\n    'projectError'\n  ];\n  readonly #reportFailure: NodeExecutionAdopterHttpServiceConfig<Principal>[\n    'reportFailure'\n  ];\n  readonly #paths: Readonly<NodeExecutionAdopterHttpPaths>;\n  readonly #maxBodyBytes: number;\n  readonly #maxPromptCharacters: number;\n  readonly #jwksMaxAgeSeconds: number;\n  readonly #activeConversations = new Set<ActiveConversation>();\n  #closed = false;\n  #closePromise: Promise<void> | undefined;\n\n  constructor(config: NodeExecutionAdopterHttpServiceConfig<Principal>) {\n    this.#authority = config.authority;\n    this.#authenticator = config.authenticator;\n    this.#conversations = config.conversations;\n    this.#projectError = config.projectError;\n    this.#reportFailure = config.reportFailure;\n    this.#paths = parsePaths(config.paths);\n    this.#maxBodyBytes = z.number().int().min(1).max(1_048_576).parse(\n      config.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES,\n    );\n    this.#maxPromptCharacters = z.number().int().min(1).max(200_000).parse(\n      config.maxPromptCharacters ?? DEFAULT_MAX_PROMPT_CHARACTERS,\n    );\n    this.#jwksMaxAgeSeconds = z.number().int().min(0).max(86_400).parse(\n      config.jwksMaxAgeSeconds ?? 60,\n    );\n  }\n\n  handle(request: IncomingMessage, response: ServerResponse): boolean {\n    const pathname = readPathname(request.url);\n    if (pathname === this.#paths.jwks) {\n      this.handleJwks(request, response);\n      return true;\n    }\n    if (pathname === this.#paths.conversationTurns) {\n      this.handleConversationTurn(request, response);\n      return true;\n    }\n    return false;\n  }\n\n  handleJwks(request: IncomingMessage, response: ServerResponse): void {\n    request.resume();\n    if (this.#closed) {\n      writeJsonError(response, 503, 'Hosted execution is unavailable.');\n      return;\n    }\n    if (request.method !== 'GET') {\n      writeJsonError(response, 405, 'Method not allowed.');\n      return;\n    }\n    try {\n      writeJson(response, 200, this.#authority.publicJwks(), {\n        'Cache-Control': `public, max-age=${this.#jwksMaxAgeSeconds}`,\n      });\n    } catch (error) {\n      this.#report({\n        phase: 'jwks',\n        errorType: errorType(error),\n        streamAccepted: false,\n      });\n      writeJsonError(response, 500, 'Verification keys are unavailable.');\n    }\n  }\n\n  handleConversationTurn(\n    request: IncomingMessage,\n    response: ServerResponse,\n  ): void {\n    if (this.#closed) {\n      request.resume();\n      writeJsonError(response, 503, 'Hosted execution is unavailable.');\n      return;\n    }\n\n    const abortController = new AbortController();\n    const abort = () => abortController.abort(\n      new Error('The owning adopter HTTP request closed.'),\n    );\n    request.once('aborted', abort);\n    response.once('close', abort);\n    const active: ActiveConversation = {\n      abortController,\n      request,\n      response,\n      pending: Promise.resolve(),\n    };\n    active.pending = this.#serveConversation(\n      request,\n      response,\n      abortController.signal,\n    ).catch((error) => {\n      this.#report({\n        phase: 'conversation',\n        errorType: errorType(error),\n        streamAccepted: response.headersSent,\n      });\n      if (!response.headersSent) {\n        writeJsonError(response, 500, 'Hosted execution request failed.');\n      } else if (!response.destroyed && !response.writableEnded) {\n        response.end();\n      }\n    }).finally(() => {\n      request.removeListener('aborted', abort);\n      response.removeListener('close', abort);\n      this.#activeConversations.delete(active);\n    });\n    this.#activeConversations.add(active);\n  }\n\n  close(): Promise<void> {\n    if (!this.#closePromise) {\n      this.#closed = true;\n      this.#closePromise = this.#closeActiveConversations();\n    }\n    return this.#closePromise;\n  }\n\n  async #closeActiveConversations(): Promise<void> {\n    const active = [...this.#activeConversations];\n    active.forEach(({ abortController, request, response }) => {\n      abortController.abort(new Error('The adopter HTTP service is stopping.'));\n      request.destroy();\n      response.destroy();\n    });\n    await Promise.allSettled(active.map(({ pending }) => pending));\n  }\n\n  async #serveConversation(\n    request: IncomingMessage,\n    response: ServerResponse,\n    signal: AbortSignal,\n  ): Promise<void> {\n    let authorization: string | undefined;\n    try {\n      authorization = takeAuthorization(request);\n      if (request.method !== 'POST') {\n        request.resume();\n        writeJsonError(response, 405, 'Method not allowed.');\n        return;\n      }\n    } catch (error) {\n      request.resume();\n      writeJsonError(\n        response,\n        error instanceof NodeHttpRequestError ? error.statusCode : 400,\n        'Invalid conversation request.',\n      );\n      return;\n    }\n\n    let principal: Principal | undefined;\n    try {\n      principal = await this.#authenticator.authenticate({\n        authorization,\n        remoteAddress: request.socket.remoteAddress,\n        signal,\n      });\n    } catch (error) {\n      this.#report({\n        phase: 'authentication',\n        errorType: errorType(error),\n        streamAccepted: false,\n      });\n      request.resume();\n      writeJsonError(response, 500, 'Authentication could not be completed.');\n      return;\n    }\n    if (!principal) {\n      request.resume();\n      writeJsonError(response, 401, 'Authentication is required.', {\n        'WWW-Authenticate': 'Bearer',\n      });\n      return;\n    }\n\n    let prompt: string;\n    try {\n      const body = await readJsonBody(request, this.#maxBodyBytes, signal);\n      prompt = z.object({\n        prompt: z.string().trim().min(1).max(this.#maxPromptCharacters),\n      }).strict().parse(body).prompt;\n    } catch (error) {\n      const statusCode = error instanceof NodeHttpRequestError\n        ? error.statusCode\n        : 400;\n      writeJsonError(response, statusCode, 'Invalid conversation request.');\n      return;\n    }\n\n    let streamed = false;\n    try {\n      for await (const rawEvent of this.#conversations.streamTurn({\n        principal,\n        prompt,\n        signal,\n      })) {\n        const event = ExecutionHostStreamEventSchema.parse(rawEvent);\n        if (!streamed) {\n          writeEventStreamHeaders(response);\n          streamed = true;\n        }\n        await writeSseEvent(response, event, signal);\n      }\n      if (!streamed) {\n        writeJsonError(response, 502, 'Execution Host returned no events.');\n        return;\n      }\n      response.end();\n    } catch (error) {\n      const publicError = !streamed ? this.#project(error) : undefined;\n      if (publicError) {\n        writeJsonError(response, publicError.statusCode, publicError.message);\n        return;\n      }\n      if (\n        error instanceof ExecutionHostInvocationCancelledError\n        || signal.aborted\n      ) {\n        if (!response.headersSent && !response.destroyed) {\n          writeJsonError(response, 499, 'Hosted conversation was cancelled.');\n        }\n        return;\n      }\n      this.#report({\n        phase: 'conversation',\n        errorType: errorType(error),\n        streamAccepted: streamed,\n      });\n      if (!response.headersSent) {\n        writeJsonError(response, 502, 'Execution Host conversation failed.');\n      } else if (!response.destroyed && !response.writableEnded) {\n        // A post-acceptance failure deliberately ends without a terminal event.\n        response.end();\n      }\n    }\n  }\n\n  #project(error: unknown): NodeExecutionAdopterPublicError | undefined {\n    if (!this.#projectError) {\n      return undefined;\n    }\n    try {\n      const projected = this.#projectError(error);\n      return projected ? PublicErrorSchema.parse(projected) : undefined;\n    } catch {\n      return undefined;\n    }\n  }\n\n  #report(failure: NodeExecutionAdopterFailure): void {\n    try {\n      this.#reportFailure?.(Object.freeze({ ...failure }));\n    } catch {\n      // Observability must not change request settlement.\n    }\n  }\n}\n\nfunction parsePaths(\n  paths: Partial<NodeExecutionAdopterHttpPaths> | undefined,\n): Readonly<NodeExecutionAdopterHttpPaths> {\n  const parsed = {\n    jwks: NodeHttpPathSchema.parse(paths?.jwks ?? DEFAULT_ADOPTER_JWKS_PATH),\n    conversationTurns: NodeHttpPathSchema.parse(\n      paths?.conversationTurns ?? DEFAULT_ADOPTER_CONVERSATION_TURNS_PATH,\n    ),\n  };\n  if (parsed.jwks === parsed.conversationTurns) {\n    throw new Error('Adopter HTTP paths must be distinct.');\n  }\n  return Object.freeze(parsed);\n}\n\nfunction writeEventStreamHeaders(response: ServerResponse): void {\n  response.writeHead(200, {\n    'Cache-Control': 'no-store',\n    'Content-Type': 'text/event-stream; charset=utf-8',\n    Connection: 'keep-alive',\n    'X-Accel-Buffering': 'no',\n    'X-Content-Type-Options': 'nosniff',\n  });\n}\n\nasync function writeSseEvent(\n  response: ServerResponse,\n  event: z.infer<typeof ExecutionHostStreamEventSchema>,\n  signal: AbortSignal,\n): Promise<void> {\n  const frame = [\n    `event: ${event.kind}`,\n    `id: ${event.sequence}`,\n    `data: ${JSON.stringify(event)}`,\n    '',\n    '',\n  ].join('\\n');\n  if (!response.write(frame)) {\n    await once(response, 'drain', { signal });\n  }\n}\n"]}
+{"version":3,"file":"http-service.js","sourceRoot":"","sources":["../../src/node/http-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAKnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,uCAAuC,EACvC,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,qCAAqC,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,cAAc,GACf,MAAM,iBAAiB,CAAC;AASzB,MAAM,sBAAsB,GAAG,EAAE,GAAG,KAAK,CAAC;AAC1C,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAC7C,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;CACtC,CAAC,CAAC,MAAM,EAAE,CAAC;AASZ;;;;;;;GAOG;AACH,MAAM,OAAO,+BAA+B;IAEjC,UAAU,CAEjB;IACO,cAAc,CAErB;IACO,cAAc,CAEJ;IACV,aAAa,CAEpB;IACO,cAAc,CAErB;IACO,MAAM,CAA0C;IAChD,aAAa,CAAS;IACtB,oBAAoB,CAAS;IAC7B,kBAAkB,CAAS;IAC3B,oBAAoB,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC9D,OAAO,GAAG,KAAK,CAAC;IAChB,aAAa,CAA4B;IAEzC,YAAY,MAAwD;QAClE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,CAC/D,MAAM,CAAC,YAAY,IAAI,sBAAsB,CAC9C,CAAC;QACF,IAAI,CAAC,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CACpE,MAAM,CAAC,mBAAmB,IAAI,6BAA6B,CAC5D,CAAC;QACF,IAAI,CAAC,kBAAkB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CACjE,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAC/B,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,OAAwB,EAAE,QAAwB;QACvD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC/C,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,UAAU,CAAC,OAAwB,EAAE,QAAwB;QAC3D,OAAO,CAAC,MAAM,EAAE,CAAC;QACjB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,kCAAkC,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE;gBACrD,eAAe,EAAE,mBAAmB,IAAI,CAAC,kBAAkB,EAAE;aAC9D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC;gBACX,KAAK,EAAE,MAAM;gBACb,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;gBAC3B,cAAc,EAAE,KAAK;aACtB,CAAC,CAAC;YACH,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,oCAAoC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,sBAAsB,CACpB,OAAwB,EACxB,QAAwB;QAExB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,kCAAkC,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CACvC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CACrD,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAuB;YACjC,eAAe;YACf,OAAO;YACP,QAAQ;YACR,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;SAC3B,CAAC;QACF,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,kBAAkB,CACtC,OAAO,EACP,QAAQ,EACR,eAAe,CAAC,MAAM,CACvB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAChB,IAAI,CAAC,OAAO,CAAC;gBACX,KAAK,EAAE,cAAc;gBACrB,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;gBAC3B,cAAc,EAAE,QAAQ,CAAC,WAAW;aACrC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,kCAAkC,CAAC,CAAC;YACpE,CAAC;iBAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;gBAC1D,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,CAAC;QACH,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACzC,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,yBAAyB;QAC7B,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC9C,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE;YACxD,eAAe,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;YAC1E,OAAO,CAAC,OAAO,EAAE,CAAC;YAClB,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAwB,EACxB,QAAwB,EACxB,MAAmB;QAEnB,IAAI,aAAiC,CAAC;QACtC,IAAI,CAAC;YACH,aAAa,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,OAAO,CAAC,MAAM,EAAE,CAAC;gBACjB,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,cAAc,CACZ,QAAQ,EACR,KAAK,YAAY,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAC9D,+BAA+B,CAChC,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,SAAgC,CAAC;QACrC,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC;gBACjD,aAAa;gBACb,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa;gBAC3C,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC;gBACX,KAAK,EAAE,gBAAgB;gBACvB,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;gBAC3B,cAAc,EAAE,KAAK;aACtB,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,wCAAwC,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,6BAA6B,EAAE;gBAC3D,kBAAkB,EAAE,QAAQ;aAC7B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;gBAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC;aAChE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,KAAK,YAAY,oBAAoB;gBACtD,CAAC,CAAC,KAAK,CAAC,UAAU;gBAClB,CAAC,CAAC,GAAG,CAAC;YACR,cAAc,CAAC,QAAQ,EAAE,UAAU,EAAE,+BAA+B,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,QAAQ,IAAI,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC;gBAC1D,SAAS;gBACT,MAAM;gBACN,MAAM;aACP,CAAC,EAAE,CAAC;gBACH,MAAM,KAAK,GAAG,8BAA8B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,uBAAuB,CAAC,QAAQ,CAAC,CAAC;oBAClC,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC;gBACD,MAAM,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,oCAAoC,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACjE,IAAI,WAAW,EAAE,CAAC;gBAChB,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,UAAU,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,IACE,KAAK,YAAY,qCAAqC;mBACnD,MAAM,CAAC,OAAO,EACjB,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;oBACjD,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,oCAAoC,CAAC,CAAC;gBACtE,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,OAAO,CAAC;gBACX,KAAK,EAAE,cAAc;gBACrB,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC;gBAC3B,cAAc,EAAE,QAAQ;aACzB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,cAAc,CAAC,QAAQ,EAAE,GAAG,EAAE,qCAAqC,CAAC,CAAC;YACvE,CAAC;iBAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;gBAC1D,wEAAwE;gBACxE,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,KAAc;QACrB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC5C,OAAO,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,OAAoC;QAC1C,IAAI,CAAC;YACH,IAAI,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;IACH,CAAC;CACF;AAED,SAAS,UAAU,CACjB,KAAyD;IAEzD,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,IAAI,yBAAyB,CAAC;QACxE,iBAAiB,EAAE,kBAAkB,CAAC,KAAK,CACzC,KAAK,EAAE,iBAAiB,IAAI,uCAAuC,CACpE;KACF,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAwB;IACvD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE;QACtB,eAAe,EAAE,UAAU;QAC3B,cAAc,EAAE,kCAAkC;QAClD,UAAU,EAAE,YAAY;QACxB,mBAAmB,EAAE,IAAI;QACzB,wBAAwB,EAAE,SAAS;KACpC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAwB,EACxB,KAAqD,EACrD,MAAmB;IAEnB,MAAM,KAAK,GAAG;QACZ,UAAU,KAAK,CAAC,IAAI,EAAE;QACtB,OAAO,KAAK,CAAC,QAAQ,EAAE;QACvB,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QAChC,EAAE;QACF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC","sourcesContent":["import { once } from 'node:events';\nimport type {\n  IncomingMessage,\n  ServerResponse,\n} from 'node:http';\nimport { z } from 'zod';\nimport {\n  DEFAULT_ADOPTER_CONVERSATION_TURNS_PATH,\n  DEFAULT_ADOPTER_JWKS_PATH,\n} from '../adopter/index.js';\nimport { ExecutionHostStreamEventSchema } from '../contracts/index.js';\nimport { ExecutionHostInvocationCancelledError } from '../http-sse/index.js';\nimport {\n  NodeHttpPathSchema,\n  NodeHttpRequestError,\n  errorType,\n  readJsonBody,\n  readPathname,\n  takeAuthorization,\n  writeJson,\n  writeJsonError,\n} from './http-utils.js';\nimport type {\n  NodeExecutionAdopterFailure,\n  NodeExecutionAdopterHttpHandler,\n  NodeExecutionAdopterHttpPaths,\n  NodeExecutionAdopterHttpServiceConfig,\n  NodeExecutionAdopterPublicError,\n} from './types.js';\n\nconst DEFAULT_MAX_BODY_BYTES = 64 * 1_024;\nconst DEFAULT_MAX_PROMPT_CHARACTERS = 20_000;\nconst PublicErrorSchema = z.object({\n  statusCode: z.number().int().min(400).max(599),\n  message: z.string().min(1).max(1_600),\n}).strict();\n\ntype ActiveConversation = {\n  abortController: AbortController;\n  request: IncomingMessage;\n  response: ServerResponse;\n  pending: Promise<void>;\n};\n\n/**\n * Standard Node HTTP edge for adopter-side JWKS and hosted conversations.\n *\n * The service owns bounded parsing, credential-header scrubbing, SSE framing,\n * disconnect cancellation, safe failures, and graceful shutdown. Product\n * authentication, authorization, identity selection, and persistence stay in\n * adopter callbacks.\n */\nexport class NodeExecutionAdopterHttpService<Principal>\nimplements NodeExecutionAdopterHttpHandler {\n  readonly #authority: NodeExecutionAdopterHttpServiceConfig<Principal>[\n    'authority'\n  ];\n  readonly #authenticator: NodeExecutionAdopterHttpServiceConfig<Principal>[\n    'authenticator'\n  ];\n  readonly #conversations: NodeExecutionAdopterHttpServiceConfig<\n    Principal\n  >['conversations'];\n  readonly #projectError: NodeExecutionAdopterHttpServiceConfig<Principal>[\n    'projectError'\n  ];\n  readonly #reportFailure: NodeExecutionAdopterHttpServiceConfig<Principal>[\n    'reportFailure'\n  ];\n  readonly #paths: Readonly<NodeExecutionAdopterHttpPaths>;\n  readonly #maxBodyBytes: number;\n  readonly #maxPromptCharacters: number;\n  readonly #jwksMaxAgeSeconds: number;\n  readonly #activeConversations = new Set<ActiveConversation>();\n  #closed = false;\n  #closePromise: Promise<void> | undefined;\n\n  constructor(config: NodeExecutionAdopterHttpServiceConfig<Principal>) {\n    this.#authority = config.authority;\n    this.#authenticator = config.authenticator;\n    this.#conversations = config.conversations;\n    this.#projectError = config.projectError;\n    this.#reportFailure = config.reportFailure;\n    this.#paths = parsePaths(config.paths);\n    this.#maxBodyBytes = z.number().int().min(1).max(1_048_576).parse(\n      config.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES,\n    );\n    this.#maxPromptCharacters = z.number().int().min(1).max(200_000).parse(\n      config.maxPromptCharacters ?? DEFAULT_MAX_PROMPT_CHARACTERS,\n    );\n    this.#jwksMaxAgeSeconds = z.number().int().min(0).max(86_400).parse(\n      config.jwksMaxAgeSeconds ?? 60,\n    );\n  }\n\n  handle(request: IncomingMessage, response: ServerResponse): boolean {\n    const pathname = readPathname(request.url);\n    if (pathname === this.#paths.jwks) {\n      this.handleJwks(request, response);\n      return true;\n    }\n    if (pathname === this.#paths.conversationTurns) {\n      this.handleConversationTurn(request, response);\n      return true;\n    }\n    return false;\n  }\n\n  handleJwks(request: IncomingMessage, response: ServerResponse): void {\n    request.resume();\n    if (this.#closed) {\n      writeJsonError(response, 503, 'Hosted execution is unavailable.');\n      return;\n    }\n    if (request.method !== 'GET') {\n      writeJsonError(response, 405, 'Method not allowed.');\n      return;\n    }\n    try {\n      writeJson(response, 200, this.#authority.publicJwks(), {\n        'Cache-Control': `public, max-age=${this.#jwksMaxAgeSeconds}`,\n      });\n    } catch (error) {\n      this.#report({\n        phase: 'jwks',\n        errorType: errorType(error),\n        streamAccepted: false,\n      });\n      writeJsonError(response, 500, 'Verification keys are unavailable.');\n    }\n  }\n\n  handleConversationTurn(\n    request: IncomingMessage,\n    response: ServerResponse,\n  ): void {\n    if (this.#closed) {\n      request.resume();\n      writeJsonError(response, 503, 'Hosted execution is unavailable.');\n      return;\n    }\n\n    const abortController = new AbortController();\n    const abort = () => abortController.abort(\n      new Error('The owning adopter HTTP request closed.'),\n    );\n    request.once('aborted', abort);\n    response.once('close', abort);\n    const active: ActiveConversation = {\n      abortController,\n      request,\n      response,\n      pending: Promise.resolve(),\n    };\n    active.pending = this.#serveConversation(\n      request,\n      response,\n      abortController.signal,\n    ).catch((error) => {\n      this.#report({\n        phase: 'conversation',\n        errorType: errorType(error),\n        streamAccepted: response.headersSent,\n      });\n      if (!response.headersSent) {\n        writeJsonError(response, 500, 'Hosted execution request failed.');\n      } else if (!response.destroyed && !response.writableEnded) {\n        response.end();\n      }\n    }).finally(() => {\n      request.removeListener('aborted', abort);\n      response.removeListener('close', abort);\n      this.#activeConversations.delete(active);\n    });\n    this.#activeConversations.add(active);\n  }\n\n  close(): Promise<void> {\n    if (!this.#closePromise) {\n      this.#closed = true;\n      this.#closePromise = this.#closeActiveConversations();\n    }\n    return this.#closePromise;\n  }\n\n  async #closeActiveConversations(): Promise<void> {\n    const active = [...this.#activeConversations];\n    active.forEach(({ abortController, request, response }) => {\n      abortController.abort(new Error('The adopter HTTP service is stopping.'));\n      request.destroy();\n      response.destroy();\n    });\n    await Promise.allSettled(active.map(({ pending }) => pending));\n  }\n\n  async #serveConversation(\n    request: IncomingMessage,\n    response: ServerResponse,\n    signal: AbortSignal,\n  ): Promise<void> {\n    let authorization: string | undefined;\n    try {\n      authorization = takeAuthorization(request);\n      if (request.method !== 'POST') {\n        request.resume();\n        writeJsonError(response, 405, 'Method not allowed.');\n        return;\n      }\n    } catch (error) {\n      request.resume();\n      writeJsonError(\n        response,\n        error instanceof NodeHttpRequestError ? error.statusCode : 400,\n        'Invalid conversation request.',\n      );\n      return;\n    }\n\n    let principal: Principal | undefined;\n    try {\n      principal = await this.#authenticator.authenticate({\n        authorization,\n        remoteAddress: request.socket.remoteAddress,\n        signal,\n      });\n    } catch (error) {\n      this.#report({\n        phase: 'authentication',\n        errorType: errorType(error),\n        streamAccepted: false,\n      });\n      request.resume();\n      writeJsonError(response, 500, 'Authentication could not be completed.');\n      return;\n    }\n    if (!principal) {\n      request.resume();\n      writeJsonError(response, 401, 'Authentication is required.', {\n        'WWW-Authenticate': 'Bearer',\n      });\n      return;\n    }\n\n    let prompt: string;\n    try {\n      const body = await readJsonBody(request, this.#maxBodyBytes, signal);\n      prompt = z.object({\n        prompt: z.string().trim().min(1).max(this.#maxPromptCharacters),\n      }).strict().parse(body).prompt;\n    } catch (error) {\n      const statusCode = error instanceof NodeHttpRequestError\n        ? error.statusCode\n        : 400;\n      writeJsonError(response, statusCode, 'Invalid conversation request.');\n      return;\n    }\n\n    let streamed = false;\n    try {\n      for await (const rawEvent of this.#conversations.streamTurn({\n        principal,\n        prompt,\n        signal,\n      })) {\n        const event = ExecutionHostStreamEventSchema.parse(rawEvent);\n        if (!streamed) {\n          writeEventStreamHeaders(response);\n          streamed = true;\n        }\n        await writeSseEvent(response, event, signal);\n      }\n      if (!streamed) {\n        writeJsonError(response, 502, 'Execution Host returned no events.');\n        return;\n      }\n      response.end();\n    } catch (error) {\n      const publicError = !streamed ? this.#project(error) : undefined;\n      if (publicError) {\n        writeJsonError(response, publicError.statusCode, publicError.message);\n        return;\n      }\n      if (\n        error instanceof ExecutionHostInvocationCancelledError\n        || signal.aborted\n      ) {\n        if (!response.headersSent && !response.destroyed) {\n          writeJsonError(response, 499, 'Hosted conversation was cancelled.');\n        }\n        return;\n      }\n      this.#report({\n        phase: 'conversation',\n        errorType: errorType(error),\n        streamAccepted: streamed,\n      });\n      if (!response.headersSent) {\n        writeJsonError(response, 502, 'Execution Host conversation failed.');\n      } else if (!response.destroyed && !response.writableEnded) {\n        // A post-acceptance failure deliberately ends without a terminal event.\n        response.end();\n      }\n    }\n  }\n\n  #project(error: unknown): NodeExecutionAdopterPublicError | undefined {\n    if (!this.#projectError) {\n      return undefined;\n    }\n    try {\n      const projected = this.#projectError(error);\n      return projected ? PublicErrorSchema.parse(projected) : undefined;\n    } catch {\n      return undefined;\n    }\n  }\n\n  #report(failure: NodeExecutionAdopterFailure): void {\n    try {\n      this.#reportFailure?.(Object.freeze({ ...failure }));\n    } catch {\n      // Observability must not change request settlement.\n    }\n  }\n}\n\nfunction parsePaths(\n  paths: Partial<NodeExecutionAdopterHttpPaths> | undefined,\n): Readonly<NodeExecutionAdopterHttpPaths> {\n  const parsed = {\n    jwks: NodeHttpPathSchema.parse(paths?.jwks ?? DEFAULT_ADOPTER_JWKS_PATH),\n    conversationTurns: NodeHttpPathSchema.parse(\n      paths?.conversationTurns ?? DEFAULT_ADOPTER_CONVERSATION_TURNS_PATH,\n    ),\n  };\n  if (parsed.jwks === parsed.conversationTurns) {\n    throw new Error('Adopter HTTP paths must be distinct.');\n  }\n  return Object.freeze(parsed);\n}\n\nfunction writeEventStreamHeaders(response: ServerResponse): void {\n  response.writeHead(200, {\n    'Cache-Control': 'no-store',\n    'Content-Type': 'text/event-stream; charset=utf-8',\n    Connection: 'keep-alive',\n    'X-Accel-Buffering': 'no',\n    'X-Content-Type-Options': 'nosniff',\n  });\n}\n\nasync function writeSseEvent(\n  response: ServerResponse,\n  event: z.infer<typeof ExecutionHostStreamEventSchema>,\n  signal: AbortSignal,\n): Promise<void> {\n  const frame = [\n    `event: ${event.kind}`,\n    `id: ${event.sequence}`,\n    `data: ${JSON.stringify(event)}`,\n    '',\n    '',\n  ].join('\\n');\n  if (!response.write(frame)) {\n    await once(response, 'drain', { signal });\n  }\n}\n"]}

package/dist/node/index.d.ts

@@ -1,6 +1,7 @@
 export { ExecutionAuthorityKeyFileError, generateEphemeralExecutionAuthorityKeyPair, generateExecutionAuthorityKeyFile, loadExecutionAuthorityKeyPairFromFile, } from './authority-key.js';
 export { DirectExecutionHostCredentials } from './direct-credentials.js';
 export type { DirectExecutionHostCredentialEnvironmentNames, } from './direct-credentials.js';
-export { DEFAULT_ADOPTER_CONVERSATION_TURNS_PATH, DEFAULT_ADOPTER_JWKS_PATH, NodeExecutionAdopterHttpService, } from './http-service.js';
+export { DEFAULT_ADOPTER_CONVERSATION_TURNS_PATH, DEFAULT_ADOPTER_JWKS_PATH, } from '../adopter/index.js';
+export { NodeExecutionAdopterHttpService, } from './http-service.js';
 export type { NodeExecutionAdopterAuthenticationInput, NodeExecutionAdopterAuthenticator, NodeExecutionAdopterConversationInput, NodeExecutionAdopterConversationService, NodeExecutionAdopterFailure, NodeExecutionAdopterHttpHandler, NodeExecutionAdopterHttpPaths, NodeExecutionAdopterHttpServiceConfig, NodeExecutionAdopterPublicError, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/node/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,0CAA0C,EAC1C,iCAAiC,EACjC,qCAAqC,GACtC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AACzE,YAAY,EACV,6CAA6C,GAC9C,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,uCAAuC,EACvC,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,uCAAuC,EACvC,iCAAiC,EACjC,qCAAqC,EACrC,uCAAuC,EACvC,2BAA2B,EAC3B,+BAA+B,EAC/B,6BAA6B,EAC7B,qCAAqC,EACrC,+BAA+B,GAChC,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,0CAA0C,EAC1C,iCAAiC,EACjC,qCAAqC,GACtC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AACzE,YAAY,EACV,6CAA6C,GAC9C,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,uCAAuC,EACvC,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,+BAA+B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,uCAAuC,EACvC,iCAAiC,EACjC,qCAAqC,EACrC,uCAAuC,EACvC,2BAA2B,EAC3B,+BAA+B,EAC/B,6BAA6B,EAC7B,qCAAqC,EACrC,+BAA+B,GAChC,MAAM,YAAY,CAAC"}

package/dist/node/index.js

@@ -1,4 +1,5 @@
 export { ExecutionAuthorityKeyFileError, generateEphemeralExecutionAuthorityKeyPair, generateExecutionAuthorityKeyFile, loadExecutionAuthorityKeyPairFromFile, } from './authority-key.js';
 export { DirectExecutionHostCredentials } from './direct-credentials.js';
-export { DEFAULT_ADOPTER_CONVERSATION_TURNS_PATH, DEFAULT_ADOPTER_JWKS_PATH, NodeExecutionAdopterHttpService, } from './http-service.js';
+export { DEFAULT_ADOPTER_CONVERSATION_TURNS_PATH, DEFAULT_ADOPTER_JWKS_PATH, } from '../adopter/index.js';
+export { NodeExecutionAdopterHttpService, } from './http-service.js';
 //# sourceMappingURL=index.js.map

package/dist/node/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,0CAA0C,EAC1C,iCAAiC,EACjC,qCAAqC,GACtC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AAIzE,OAAO,EACL,uCAAuC,EACvC,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC","sourcesContent":["export {\n  ExecutionAuthorityKeyFileError,\n  generateEphemeralExecutionAuthorityKeyPair,\n  generateExecutionAuthorityKeyFile,\n  loadExecutionAuthorityKeyPairFromFile,\n} from './authority-key.js';\nexport { DirectExecutionHostCredentials } from './direct-credentials.js';\nexport type {\n  DirectExecutionHostCredentialEnvironmentNames,\n} from './direct-credentials.js';\nexport {\n  DEFAULT_ADOPTER_CONVERSATION_TURNS_PATH,\n  DEFAULT_ADOPTER_JWKS_PATH,\n  NodeExecutionAdopterHttpService,\n} from './http-service.js';\nexport type {\n  NodeExecutionAdopterAuthenticationInput,\n  NodeExecutionAdopterAuthenticator,\n  NodeExecutionAdopterConversationInput,\n  NodeExecutionAdopterConversationService,\n  NodeExecutionAdopterFailure,\n  NodeExecutionAdopterHttpHandler,\n  NodeExecutionAdopterHttpPaths,\n  NodeExecutionAdopterHttpServiceConfig,\n  NodeExecutionAdopterPublicError,\n} from './types.js';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,0CAA0C,EAC1C,iCAAiC,EACjC,qCAAqC,GACtC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AAIzE,OAAO,EACL,uCAAuC,EACvC,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,+BAA+B,GAChC,MAAM,mBAAmB,CAAC","sourcesContent":["export {\n  ExecutionAuthorityKeyFileError,\n  generateEphemeralExecutionAuthorityKeyPair,\n  generateExecutionAuthorityKeyFile,\n  loadExecutionAuthorityKeyPairFromFile,\n} from './authority-key.js';\nexport { DirectExecutionHostCredentials } from './direct-credentials.js';\nexport type {\n  DirectExecutionHostCredentialEnvironmentNames,\n} from './direct-credentials.js';\nexport {\n  DEFAULT_ADOPTER_CONVERSATION_TURNS_PATH,\n  DEFAULT_ADOPTER_JWKS_PATH,\n} from '../adopter/index.js';\nexport {\n  NodeExecutionAdopterHttpService,\n} from './http-service.js';\nexport type {\n  NodeExecutionAdopterAuthenticationInput,\n  NodeExecutionAdopterAuthenticator,\n  NodeExecutionAdopterConversationInput,\n  NodeExecutionAdopterConversationService,\n  NodeExecutionAdopterFailure,\n  NodeExecutionAdopterHttpHandler,\n  NodeExecutionAdopterHttpPaths,\n  NodeExecutionAdopterHttpServiceConfig,\n  NodeExecutionAdopterPublicError,\n} from './types.js';\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@heddleagent/execution-host-client",
-  "version": "6.4.0",
-  "description": "Backend contracts, execution authority, lifecycle services, and clients for compatible Heddle Execution Hosts",
+  "version": "6.6.0",
+  "description": "Contracts, execution authority, lifecycle services, and adopter clients for compatible Heddle Execution Hosts",
   "author": "Jay / Fienna Liang <roackb2@gmail.com>",
   "license": "MIT",
   "type": "module",
@@ -38,6 +38,10 @@
       "types": "./dist/authority/index.d.ts",
       "import": "./dist/authority/index.js"
     },
+    "./adopter": {
+      "types": "./dist/adopter/index.d.ts",
+      "import": "./dist/adopter/index.js"
+    },
     "./conversation": {
       "types": "./dist/conversation/index.d.ts",
       "import": "./dist/conversation/index.js"
@@ -70,6 +74,10 @@
       "types": "./dist/agentcore/index.d.ts",
       "import": "./dist/agentcore/index.js"
     },
+    "./host": {
+      "types": "./dist/host/index.d.ts",
+      "import": "./dist/host/index.js"
+    },
     "./testing": {
       "types": "./dist/testing/index.d.ts",
       "import": "./dist/testing/index.js"