@heddleagent/execution-host-client 7.0.0 → 8.0.0

package/README.md

@@ -5,8 +5,8 @@ invoke a separately deployed Heddle Execution Host. It lets an
 adopter keep its own language stack, authentication, database, product policy,
 MCP tools, and UI while reusing the security-sensitive v1 contract machinery.
 
-> **Current availability:** `6.7.0` is the current package version as of
-> 2026-08-27. The former
+> **Current availability:** package availability is published through the
+> repository release process. The former
 > `@roackb2/heddle-adopter@5.13.0` coordinate is deprecated and remains
 > installable only for existing consumers. The compatible Execution Host source
 > is maintained in this private-first repository; Heddle does not yet offer a
@@ -39,7 +39,7 @@ modular AWS SDK for its AgentCore transport and the official MCP SDK, plus
 | `@heddleagent/execution-host-client/authority` | ES256 execution assertion and optional MCP capability issuance plus public JWKS projection |
 | `@heddleagent/execution-host-client/conversation` | Turn orchestration across authority, model credentials, optional MCP policy, an `ExecutionHost`, and an optional adopter-implemented durable lifecycle store |
 | `@heddleagent/execution-host-client/heartbeat` | Remote heartbeat orchestration that keeps durable task authority in a coordinator while a compatible Execution Host runs the agent cycle |
-| `@heddleagent/execution-host-client/coordinator` | Authenticated task publication, pause-first desired-state reconciliation, product delegation, and delegated heartbeat execution |
+| `@heddleagent/execution-host-client/coordinator` | Authenticated task publication, pause-first desired-state reconciliation, product-work preparation and settlement, and delegated heartbeat execution |
 | `@heddleagent/execution-host-client/coordinator/node` | Standard authenticated Node HTTP edge for product-owned heartbeat authorization |
 | `@heddleagent/execution-host-client/mcp` | Independent capability verification at the adopter's MCP edge |
 | `@heddleagent/execution-host-client/mcp/node` | Stateless official-SDK Streamable HTTP lifecycle around adopter-defined toolsets |
@@ -47,7 +47,7 @@ modular AWS SDK for its AgentCore transport and the official MCP SDK, plus
 | `@heddleagent/execution-host-client/agentcore` | Canonical AgentCore deployment-target validation plus the official AWS AgentCore/SigV4 implementation of the conversation and heartbeat ports |
 | `@heddleagent/execution-host-client/host` | Invocation-bound authority verification plus provider-neutral Runtime-session scope binding, admission, deadlines, cancellation, status, and workflow dispatch shared by compatible Execution Host implementations |
 | `@heddleagent/execution-host-client/testing` | Node-only loopback v1 fixture plus durable-turn store conformance for real adapters |
-| `@heddleagent/execution-host-client/node` | Optional Node JWKS/conversation HTTP edge plus safe local signing-key helpers |
+| `@heddleagent/execution-host-client/node` | Optional Node JWKS/conversation HTTP edge, conventional `NAME_FILE` loading, safe local signing-key helpers, and the local credential-bundle initializer used by `heddle-hostctl` |
 
 Non-TypeScript adopters can consume the versioned
 [`spec/v1`](spec/v1/README.md) OpenAPI 3.1.1 document, JSON Schema bundle, and
@@ -176,6 +176,17 @@ owner-only JWK without overwriting an existing file. The loader imports its
 private key as non-exportable. Production KMS/HSM or secret-manager storage,
 rotation, revocation, and Windows ACL policy still belong to deployment.
 
+For a complete local hosted-service composition, install the package's narrow
+operator CLI and initialize one generic credential bundle:
+
+```bash
+heddle-hostctl credentials init --output .local/heddle-credentials
+```
+
+The command owns only credential generation and bundle validation. The adopter
+deployment owns Compose or Helm, ports, URLs, database and model inputs,
+migration ordering, service lifecycle, and secret-file mounting.
+
 ## Verify product authority again at MCP
 
 The adopter MCP service must independently verify the bearer. Do not trust
@@ -347,18 +358,19 @@ terminal event until clean EOF. It never retries an ambiguous invocation.
 
 ## Connect a product to the heartbeat coordinator
 
-The product publishes only its desired task state and authorizes individual
-runs. Heddle owns the coordinator protocol, safe reconciliation order, Runtime
-session derivation, short-lived authority bundle, and execution composition.
+The product publishes desired task state and owns a durable product-work
+lifecycle around each Coordinator execution. Heddle owns the coordinator
+protocol, safe reconciliation order, Runtime-session derivation, short-lived
+authority bundle, and execution composition.
 
 ```ts
 import {
   HostedHeartbeatCoordinatorClient,
-  HostedHeartbeatDelegationService,
+  HostedHeartbeatExecutionService,
   HostedHeartbeatTaskReconciler,
 } from '@heddleagent/execution-host-client/coordinator'
 import {
-  NodeHostedHeartbeatDelegationHttpService,
+  NodeHostedHeartbeatExecutionHttpService,
 } from '@heddleagent/execution-host-client/coordinator/node'
 
 const coordinator = new HostedHeartbeatCoordinatorClient({
@@ -370,30 +382,31 @@ await new HostedHeartbeatTaskReconciler({ coordinator }).reconcile({
   resume: backgroundChecksEnabled,
 })
 
-const delegations = new HostedHeartbeatDelegationService({
+const executions = new HostedHeartbeatExecutionService({
   authority,
   runtimeSessionNamespace: 'example-product',
   maxExecutionMs: 300_000,
-  authorizer: {
-    authorize: ({ taskId, signal }) =>
-      authorizeProductHeartbeat({ taskId, signal }),
+  lifecycle: {
+    prepare: ({ taskId, executionId, signal }) =>
+      productWork.claim({ taskId, executionId, signal }),
+    settle: (result) => productWork.settle(result),
   },
 })
-const delegationHttp = new NodeHostedHeartbeatDelegationHttpService({
-  delegations,
-  apiToken: coordinatorDelegationToken,
+const executionHttp = new NodeHostedHeartbeatExecutionHttpService({
+  executions,
+  apiToken: coordinatorProductExecutionToken,
 })
 ```
 
 `projectDesiredHeartbeatTasks` remains product-owned because it translates
-product records into desired Heddle tasks. `authorizeProductHeartbeat` remains
-product-owned because it decides whether the task may run and returns only the
-authorized tenant/subject/product-session scope and exact MCP tool set. Product
-code does not construct coordinator requests, Runtime-session IDs, deadlines,
-JWTs, or delegation response objects.
+product records into desired Heddle tasks. The product lifecycle remains
+product-owned because it claims a fixed work horizon, returns only the
+authorized tenant/subject/product-session scope and exact MCP tool set, and
+validates durable effects before accepting completion. Product code does not
+construct coordinator requests, Runtime-session IDs, deadlines, or JWTs.
 
 The Node handler can be mounted before an existing router through
-`delegationHttp.handle(request, response)`. See the
+`executionHttp.handle(request, response)`. See the
 [coordinator boundary](src/coordinator/README.md) for the corresponding
 coordinator-side client and execution transport.
 
@@ -402,29 +415,30 @@ coordinator-side client and execution transport.
 For autonomous work, keep the durable task store and scheduler in one
 long-running coordinator. Inject the hosted transport only at the point where
 the scheduler would otherwise run the local heartbeat agent. The coordinator
-uses the product delegation endpoint rather than receiving product signing
-keys or reimplementing its authority shape:
+uses the product execution-lifecycle endpoint rather than receiving product
+signing keys or reimplementing its authority shape:
 
 ```ts
 import { HeartbeatSchedulerService } from '@heddleagent/runtime/advanced'
 import {
-  HostedHeartbeatDelegatedExecutionTransport,
-  HostedHeartbeatDelegationClient,
+  HostedHeartbeatDelegatedExecution,
+  HostedHeartbeatExecutionClient,
 } from '@heddleagent/execution-host-client/coordinator'
 
-const delegations = new HostedHeartbeatDelegationClient({
+const executions = new HostedHeartbeatExecutionClient({
   baseUrl: productBackendUrl,
-  apiToken: productDelegationToken,
+  apiToken: productExecutionToken,
 })
-const agentExecutionTransport = new HostedHeartbeatDelegatedExecutionTransport({
-  delegations,
+const delegatedExecution = new HostedHeartbeatDelegatedExecution({
+  executions,
   executionHost: agentCoreExecutionHost,
   modelCredentials,
 })
 
 const scheduler = HeartbeatSchedulerService.start({
   store: heddleHeartbeatStore,
-  agentExecutionTransport,
+  handler: (context) => delegatedExecution.handle(context),
+  agentExecutionTransport: delegatedExecution,
 })
 ```
 
@@ -432,9 +446,9 @@ The coordinator still owns task lookup, claims, checkpoint loading,
 cancellation, claim-fenced settlement, history, and recovery. The Runtime
 receives a bounded task/checkpoint request plus invocation-scoped authority and
 model credentials; it receives no Heddle database credential. Omitting
-`agentExecutionTransport` preserves the existing in-process runner. The lower
-level `/heartbeat` composition remains available for deployments whose
-coordinator and product authority live in the same process.
+the hosted execution composition preserves the existing in-process runner.
+The lower-level `/heartbeat` composition remains available for deployments
+whose Coordinator and product authority live in the same process.
 
 ## Verify an adopter integration locally
 

package/dist/cli/hostctl.d.ts

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+export type HostctlIo = {
+    stdout: {
+        write(value: string): unknown;
+    };
+    stderr: {
+        write(value: string): unknown;
+    };
+};
+export declare function runHostctl(args: readonly string[], io?: HostctlIo): Promise<number>;
+//# sourceMappingURL=hostctl.d.ts.map

package/dist/cli/hostctl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostctl.d.ts","sourceRoot":"","sources":["../../src/cli/hostctl.ts"],"names":[],"mappings":";AAMA,MAAM,MAAM,SAAS,GAAG;IACtB,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC1C,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;CAC3C,CAAC;AAEF,wBAAsB,UAAU,CAC9B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,GAAE,SAAmB,GACtB,OAAO,CAAC,MAAM,CAAC,CAajB"}

package/dist/cli/hostctl.js

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Command, CommanderError } from 'commander';
+import { initializeLocalCredentialBundle } from '../node/local-credential-bundle.js';
+export async function runHostctl(args, io = process) {
+    const program = createHostctl(io);
+    try {
+        await program.parseAsync([...args], { from: 'user' });
+        return 0;
+    }
+    catch (error) {
+        if (error instanceof CommanderError) {
+            return error.exitCode;
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        io.stderr.write(`heddle-hostctl: ${message}\n`);
+        return 1;
+    }
+}
+function createHostctl(io) {
+    const program = new Command()
+        .name('heddle-hostctl')
+        .description('Operate a self-hosted Heddle Execution Host.')
+        .configureOutput({
+        writeOut: (value) => { io.stdout.write(value); },
+        writeErr: (value) => { io.stderr.write(value); },
+    })
+        .exitOverride()
+        .showHelpAfterError()
+        .allowExcessArguments(false);
+    program.command('credentials')
+        .description('Manage generic local host credentials.')
+        .command('init')
+        .description('Create or validate an owner-only credential bundle.')
+        .requiredOption('-o, --output <directory>', 'credential bundle directory')
+        .action(async ({ output }) => {
+        const initialized = await initializeLocalCredentialBundle(output);
+        io.stdout.write(`${initialized.created ? 'Initialized' : 'Validated'} Heddle local hosted credentials.\n`);
+        io.stdout.write(`Directory: ${initialized.paths.directory}\n`);
+        io.stdout.write(`Manifest: ${initialized.paths.manifest}\n`);
+    });
+    return program;
+}
+if (process.argv[1]
+    && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+    process.exitCode = await runHostctl(process.argv.slice(2));
+}
+//# sourceMappingURL=hostctl.js.map

package/dist/cli/hostctl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostctl.js","sourceRoot":"","sources":["../../src/cli/hostctl.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,+BAA+B,EAAE,MAAM,oCAAoC,CAAC;AAOrF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAuB,EACvB,KAAgB,OAAO;IAEvB,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,QAAQ,CAAC;QACxB,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,OAAO,IAAI,CAAC,CAAC;QAChD,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,EAAa;IAClC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE;SAC1B,IAAI,CAAC,gBAAgB,CAAC;SACtB,WAAW,CAAC,8CAA8C,CAAC;SAC3D,eAAe,CAAC;QACf,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChD,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;KACjD,CAAC;SACD,YAAY,EAAE;SACd,kBAAkB,EAAE;SACpB,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAE/B,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;SAC3B,WAAW,CAAC,wCAAwC,CAAC;SACrD,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,qDAAqD,CAAC;SAClE,cAAc,CAAC,0BAA0B,EAAE,6BAA6B,CAAC;SACzE,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAsB,EAAE,EAAE;QAC/C,MAAM,WAAW,GAAG,MAAM,+BAA+B,CAAC,MAAM,CAAC,CAAC;QAClE,EAAE,CAAC,MAAM,CAAC,KAAK,CACb,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,qCAAqC,CAC1F,CAAC;QACF,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,WAAW,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC;QAC/D,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,WAAW,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEL,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,IACE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;OACZ,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAC9D,CAAC;IACD,OAAO,CAAC,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC","sourcesContent":["#!/usr/bin/env node\nimport { resolve } from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport { Command, CommanderError } from 'commander';\nimport { initializeLocalCredentialBundle } from '../node/local-credential-bundle.js';\n\nexport type HostctlIo = {\n  stdout: { write(value: string): unknown };\n  stderr: { write(value: string): unknown };\n};\n\nexport async function runHostctl(\n  args: readonly string[],\n  io: HostctlIo = process,\n): Promise<number> {\n  const program = createHostctl(io);\n  try {\n    await program.parseAsync([...args], { from: 'user' });\n    return 0;\n  } catch (error) {\n    if (error instanceof CommanderError) {\n      return error.exitCode;\n    }\n    const message = error instanceof Error ? error.message : String(error);\n    io.stderr.write(`heddle-hostctl: ${message}\\n`);\n    return 1;\n  }\n}\n\nfunction createHostctl(io: HostctlIo): Command {\n  const program = new Command()\n    .name('heddle-hostctl')\n    .description('Operate a self-hosted Heddle Execution Host.')\n    .configureOutput({\n      writeOut: (value) => { io.stdout.write(value); },\n      writeErr: (value) => { io.stderr.write(value); },\n    })\n    .exitOverride()\n    .showHelpAfterError()\n    .allowExcessArguments(false);\n\n  program.command('credentials')\n    .description('Manage generic local host credentials.')\n    .command('init')\n    .description('Create or validate an owner-only credential bundle.')\n    .requiredOption('-o, --output <directory>', 'credential bundle directory')\n    .action(async ({ output }: { output: string }) => {\n      const initialized = await initializeLocalCredentialBundle(output);\n      io.stdout.write(\n        `${initialized.created ? 'Initialized' : 'Validated'} Heddle local hosted credentials.\\n`,\n      );\n      io.stdout.write(`Directory: ${initialized.paths.directory}\\n`);\n      io.stdout.write(`Manifest: ${initialized.paths.manifest}\\n`);\n    });\n\n  return program;\n}\n\nif (\n  process.argv[1]\n  && resolve(process.argv[1]) === fileURLToPath(import.meta.url)\n) {\n  process.exitCode = await runHostctl(process.argv.slice(2));\n}\n"]}

package/dist/contracts/index.d.ts

@@ -278,4 +278,6 @@ export type HostedExecutionWorkflow = z.infer<typeof HostedExecutionWorkflowSche
 export declare function isExecutionHostTerminalEvent(event: ExecutionHostStreamEvent): event is ExecutionHostTerminalEvent;
 export declare function isExecutionHostHeartbeatTerminalEvent(event: ExecutionHostHeartbeatStreamEvent): event is ExecutionHostHeartbeatTerminalEvent;
 export declare function isSafeWebUrl(url: URL): boolean;
+/** Explicit Docker Desktop bridge exception for isolated local composition. */
+export declare function isDockerLocalWebUrl(url: URL): boolean;
 //# sourceMappingURL=index.d.ts.map

package/dist/contracts/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/contracts/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,0BAA0B,EAAG,CAAU,CAAC;AACrD,eAAO,MAAM,0BAA0B,EAAG,mBAA4B,CAAC;AACvE,eAAO,MAAM,uBAAuB,EAAG,gBAAyB,CAAC;AACjE,eAAO,MAAM,wBAAwB,EAAG,sBAA+B,CAAC;AACxE,eAAO,MAAM,mBAAmB,EAAG,2BAAoC,CAAC;AAExE,eAAO,MAAM,gCAAgC,EAC3C,6CAAsD,CAAC;AACzD,eAAO,MAAM,iCAAiC,EAC5C,qCAA8C,CAAC;AACjD,eAAO,MAAM,0BAA0B,EACrC,mCAA4C,CAAC;AAC/C,eAAO,MAAM,qBAAqB,EAChC,wCAAiD,CAAC;AACpD,eAAO,MAAM,uBAAuB,EAClC,0CAAmD,CAAC;AAEtD,eAAO,MAAM,cAAc,aAOxB,CAAC;AAEJ,eAAO,MAAM,eAAe,UAG3B,CAAC;AAEF,eAAO,MAAM,iBAAiB,aAA6B,CAAC;AAE5D,eAAO,MAAM,sBAAsB,aAI8C,CAAC;AAElF,eAAO,MAAM,eAAe,kBAAmC,CAAC;AAIhE;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;4BAe9C,CAAC;AAEF,eAAO,MAAM,iBAAiB,aAO3B,CAAC;AAEJ,eAAO,MAAM,iBAAiB,aAO3B,CAAC;AAEJ,eAAO,MAAM,qBAAqB,yBAa/B,CAAC;AAEJ,eAAO,MAAM,oBAAoB;;;;;kBAKtB,CAAC;AAEZ,eAAO,MAAM,0CAA0C;;;;;;kBAM5C,CAAC;AAEZ,eAAO,MAAM,yBAAyB;;;;;;;;;;kBAO3B,CAAC;AAEZ,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAqBzC,CAAC;AAEZ,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;kBAiB3B,CAAC;AAUZ,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAwBzC,CAAC;AAEH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BA2BnD,CAAC;AAEF,eAAO,MAAM,6BAA6B;;;EAGxC,CAAC;AAEH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;iBAa3B,CAAC;AAEjB,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;iBAgBtB,CAAC;AAEjB,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CACxD,OAAO,0CAA0C,CAClD,CAAC;AACF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,OAAO,CAC9C,wBAAwB,EACxB;IAAE,IAAI,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAA;CAAE,CAC3C,CAAC;AACF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AACF,MAAM,MAAM,mCAAmC,GAAG,OAAO,CACvD,iCAAiC,EACjC;IAAE,IAAI,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAA;CAAE,CAC3C,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AAEF,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,wBAAwB,GAC9B,KAAK,IAAI,0BAA0B,CAIrC;AAED,wBAAgB,qCAAqC,CACnD,KAAK,EAAE,iCAAiC,GACvC,KAAK,IAAI,mCAAmC,CAI9C;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAO9C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/contracts/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,0BAA0B,EAAG,CAAU,CAAC;AACrD,eAAO,MAAM,0BAA0B,EAAG,mBAA4B,CAAC;AACvE,eAAO,MAAM,uBAAuB,EAAG,gBAAyB,CAAC;AACjE,eAAO,MAAM,wBAAwB,EAAG,sBAA+B,CAAC;AACxE,eAAO,MAAM,mBAAmB,EAAG,2BAAoC,CAAC;AAExE,eAAO,MAAM,gCAAgC,EAC3C,6CAAsD,CAAC;AACzD,eAAO,MAAM,iCAAiC,EAC5C,qCAA8C,CAAC;AACjD,eAAO,MAAM,0BAA0B,EACrC,mCAA4C,CAAC;AAC/C,eAAO,MAAM,qBAAqB,EAChC,wCAAiD,CAAC;AACpD,eAAO,MAAM,uBAAuB,EAClC,0CAAmD,CAAC;AAEtD,eAAO,MAAM,cAAc,aAOxB,CAAC;AAEJ,eAAO,MAAM,eAAe,UAG3B,CAAC;AAEF,eAAO,MAAM,iBAAiB,aAA6B,CAAC;AAE5D,eAAO,MAAM,sBAAsB,aAI8C,CAAC;AAElF,eAAO,MAAM,eAAe,kBAAmC,CAAC;AAIhE;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;4BAe9C,CAAC;AAEF,eAAO,MAAM,iBAAiB,aAO3B,CAAC;AAEJ,eAAO,MAAM,iBAAiB,aAO3B,CAAC;AAEJ,eAAO,MAAM,qBAAqB,yBAa/B,CAAC;AAEJ,eAAO,MAAM,oBAAoB;;;;;kBAKtB,CAAC;AAEZ,eAAO,MAAM,0CAA0C;;;;;;kBAM5C,CAAC;AAEZ,eAAO,MAAM,yBAAyB;;;;;;;;;;kBAO3B,CAAC;AAEZ,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAqBzC,CAAC;AAEZ,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;kBAiB3B,CAAC;AAUZ,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAwBzC,CAAC;AAEH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BA2BnD,CAAC;AAEF,eAAO,MAAM,6BAA6B;;;EAGxC,CAAC;AAEH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;iBAa3B,CAAC;AAEjB,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;iBAgBtB,CAAC;AAEjB,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CACxD,OAAO,0CAA0C,CAClD,CAAC;AACF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,OAAO,CAC9C,wBAAwB,EACxB;IAAE,IAAI,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAA;CAAE,CAC3C,CAAC;AACF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AACF,MAAM,MAAM,mCAAmC,GAAG,OAAO,CACvD,iCAAiC,EACjC;IAAE,IAAI,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAA;CAAE,CAC3C,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AAEF,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,wBAAwB,GAC9B,KAAK,IAAI,0BAA0B,CAIrC;AAED,wBAAgB,qCAAqC,CACnD,KAAK,EAAE,iCAAiC,GACvC,KAAK,IAAI,mCAAmC,CAI9C;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAO9C;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAOrD"}

package/dist/contracts/index.js

@@ -229,4 +229,13 @@ export function isSafeWebUrl(url) {
         && !url.search
         && !url.hash;
 }
+/** Explicit Docker Desktop bridge exception for isolated local composition. */
+export function isDockerLocalWebUrl(url) {
+    return url.protocol === 'http:'
+        && url.hostname === 'host.docker.internal'
+        && !url.username
+        && !url.password
+        && !url.search
+        && !url.hash;
+}
 //# sourceMappingURL=index.js.map

package/dist/contracts/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/contracts/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAU,CAAC;AACrD,MAAM,CAAC,MAAM,0BAA0B,GAAG,mBAA4B,CAAC;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAyB,CAAC;AACjE,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAA+B,CAAC;AACxE,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAAoC,CAAC;AAExE,MAAM,CAAC,MAAM,gCAAgC,GAC3C,6CAAsD,CAAC;AACzD,MAAM,CAAC,MAAM,iCAAiC,GAC5C,qCAA8C,CAAC;AACjD,MAAM,CAAC,MAAM,0BAA0B,GACrC,mCAA4C,CAAC;AAC/C,MAAM,CAAC,MAAM,qBAAqB,GAChC,wCAAiD,CAAC;AACpD,MAAM,CAAC,MAAM,uBAAuB,GAClC,0CAAmD,CAAC;AAEtD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CACJ,gCAAgC,EAChC,yCAAyC,CAC1C,CAAC;AAEJ,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAC3C,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EACvC,gFAAgF,CACjF,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE5D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,EAAE;KACR,GAAG,CAAC,EAAE,CAAC;KACP,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE,mCAAmC,CAAC,CAAC;AAElF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAEhE,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAE9D;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,kBAAkB,CACpE,MAAM,EACN;IACE,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,MAAM,EAAE,iBAAiB;KAC1B,CAAC,CAAC,MAAM,EAAE;IACX,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACrC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC7B,WAAW,EAAE,iBAAiB;QAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;KACxD,CAAC,CAAC,MAAM,EAAE;CACZ,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CACJ,kBAAkB,EAClB,mDAAmD,CACpD,CAAC;AAEJ,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CACJ,yBAAyB,EACzB,wCAAwC,CACzC,CAAC;AAEJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,KAAK,CAAC,iBAAiB,CAAC;KACxB,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE;IACvD,OAAO,EAAE,oCAAoC;CAC9C,CAAC;KACD,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CACrB,CAAC,cAAc,EAAE,QAAQ,EAAE,EAAE,CAAC,cAAc,GAAG,QAAQ,CAAC,MAAM,EAC9D,CAAC,CACF,IAAI,GAAG,EACR,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAChE,CAAC;AAEJ,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,cAAc;IACzB,QAAQ,EAAE,cAAc;IACxB,SAAS,EAAE,cAAc;IACzB,gBAAgB,EAAE,cAAc;CACjC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IAC3C,YAAY,EAAE,cAAc;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC7C,UAAU,EAAE,eAAe,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,eAAe,EAAE,eAAe;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC;IACpE,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1D,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,eAAe,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,cAAc,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;IACxC,YAAY,EAAE,cAAc;IAC5B,MAAM,EAAE,cAAc;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,UAAU,EAAE,yBAAyB;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACnD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC;QACtB,MAAM;QACN,KAAK;QACL,QAAQ;QACR,MAAM;QACN,WAAW;QACX,KAAK;KACN,CAAC,CAAC,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;IAC5D,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IAC7E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;IACjD,UAAU,EAAE,eAAe,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;YACX,gBAAgB;YAChB,YAAY;YACZ,OAAO;YACP,YAAY;YACZ,gBAAgB;YAChB,SAAS;YACT,WAAW;YACX,gBAAgB;YAChB,SAAS;SACV,CAAC;KACH,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvB,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACpD,YAAY,EAAE,cAAc;IAC5B,KAAK,EAAE,cAAc;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACzE,oBAAoB,CAAC,MAAM,CAAC;QAC1B,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;KAC5B,CAAC,CAAC,MAAM,EAAE;IACX,oBAAoB,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;KACtB,CAAC,CAAC,MAAM,EAAE;IACX,oBAAoB,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,MAAM,EAAE,yBAAyB;KAClC,CAAC,CAAC,MAAM,EAAE;IACX,oBAAoB,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC,CAAC,MAAM,EAAE;IACX,oBAAoB,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;YACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;YACtD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;SACtC,CAAC,CAAC,MAAM,EAAE;KACZ,CAAC,CAAC,MAAM,EAAE;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,kBAAkB,CACzE,MAAM,EACN;IACE,oBAAoB,CAAC,MAAM,CAAC;QAC1B,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;KAC5B,CAAC,CAAC,MAAM,EAAE;IACX,oBAAoB,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE;KACnB,CAAC,CAAC,MAAM,EAAE;IACX,oBAAoB,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;KACvC,CAAC,CAAC,MAAM,EAAE;IACX,oBAAoB,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC,CAAC,MAAM,EAAE;IACX,oBAAoB,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;YACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;YACtD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;SACtC,CAAC,CAAC,MAAM,EAAE;KACZ,CAAC,CAAC,MAAM,EAAE;CACZ,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,IAAI,CAAC;IAClD,0BAA0B;IAC1B,uBAAuB;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,GAAG,EAAE,eAAe;IACpB,GAAG,EAAE,iBAAiB;IACtB,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACtD,SAAS,EAAE,cAAc;IACzB,QAAQ,EAAE,cAAc;IACxB,gBAAgB,EAAE,cAAc;IAChC,gBAAgB,EAAE,sBAAsB;IACxC,QAAQ,EAAE,6BAA6B;IACvC,GAAG,EAAE,cAAc;IACnB,GAAG,EAAE,cAAc;IACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,GAAG,EAAE,eAAe;IACpB,GAAG,EAAE,iBAAiB;IACtB,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACtD,SAAS,EAAE,cAAc;IACzB,QAAQ,EAAE,cAAc;IACxB,gBAAgB,EAAE,cAAc;IAChC,gBAAgB,EAAE,sBAAsB;IACxC,YAAY,EAAE,cAAc;IAC5B,QAAQ,EAAE,6BAA6B;IACvC,QAAQ,EAAE,iBAAiB;IAC3B,YAAY,EAAE,qBAAqB;IACnC,GAAG,EAAE,cAAc;IACnB,GAAG,EAAE,cAAc;IACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC,WAAW,EAAE,CAAC;AAmCjB,MAAM,UAAU,4BAA4B,CAC1C,KAA+B;IAE/B,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;WACzB,KAAK,CAAC,IAAI,KAAK,WAAW;WAC1B,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,KAAwC;IAExC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;WACzB,KAAK,CAAC,IAAI,KAAK,WAAW;WAC1B,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAQ;IACnC,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,CAAC;WACvE,CAAC,GAAG,CAAC,QAAQ;WACb,CAAC,GAAG,CAAC,QAAQ;WACb,CAAC,GAAG,CAAC,MAAM;WACX,CAAC,GAAG,CAAC,IAAI,CAAC;AACjB,CAAC","sourcesContent":["import { z } from 'zod';\n\nexport const EXECUTION_CONTRACT_VERSION = 1 as const;\nexport const CONVERSATION_TURN_WORKFLOW = 'conversation-turn' as const;\nexport const HEARTBEAT_TASK_WORKFLOW = 'heartbeat-task' as const;\nexport const EXECUTION_ASSERTION_TYPE = 'heddle-execution+jwt' as const;\nexport const MCP_CAPABILITY_TYPE = 'heddle-mcp-capability+jwt' as const;\n\nexport const AGENTCORE_RUNTIME_SESSION_HEADER =\n  'x-amzn-bedrock-agentcore-runtime-session-id' as const;\nexport const EXECUTION_HOST_LOCAL_TOKEN_HEADER =\n  'x-heddle-execution-host-local-token' as const;\nexport const EXECUTION_ASSERTION_HEADER =\n  'x-heddle-execution-host-assertion' as const;\nexport const MCP_CAPABILITY_HEADER =\n  'x-heddle-execution-host-mcp-capability' as const;\nexport const MODEL_CREDENTIAL_HEADER =\n  'x-heddle-execution-host-model-credential' as const;\n\nexport const OpaqueIdSchema = z\n  .string()\n  .min(1)\n  .max(128)\n  .regex(\n    /^[A-Za-z0-9][A-Za-z0-9._:@-]*$/,\n    'must be an opaque, path-free identifier',\n  );\n\nexport const JwtIssuerSchema = z.url().refine(\n  (value) => isSafeWebUrl(new URL(value)),\n  'must use HTTPS or loopback HTTP and contain no credentials, query, or fragment',\n);\n\nexport const JwtAudienceSchema = z.string().min(1).max(512);\n\nexport const RuntimeSessionIdSchema = z\n  .string()\n  .min(33)\n  .max(256)\n  .refine((value) => value === value.trim(), 'must not contain outer whitespace');\n\nexport const TimestampSchema = z.iso.datetime({ offset: true });\n\nconst ModelSecretSchema = z.string().trim().min(8).max(4_096);\n\n/**\n * One invocation-scoped model credential. OAuth refresh material is\n * deliberately absent from the wire contract.\n */\nexport const ExecutionHostModelCredentialSchema = z.discriminatedUnion(\n  'type',\n  [\n    z.object({\n      type: z.literal('api-key'),\n      apiKey: ModelSecretSchema,\n    }).strict(),\n    z.object({\n      type: z.literal('oauth-access-token'),\n      provider: z.literal('openai'),\n      accessToken: ModelSecretSchema,\n      expiresAt: z.number().int().positive(),\n      accountId: z.string().trim().min(1).max(512).optional(),\n    }).strict(),\n  ],\n);\n\nexport const McpServerIdSchema = z\n  .string()\n  .min(1)\n  .max(64)\n  .regex(\n    /^[A-Za-z0-9_-]+$/,\n    'must be a Heddle-compatible MCP server identifier',\n  );\n\nexport const McpToolNameSchema = z\n  .string()\n  .min(1)\n  .max(64)\n  .regex(\n    /^[A-Za-z][A-Za-z0-9_]*$/,\n    'must be a collision-free MCP tool name',\n  );\n\nexport const McpAllowedToolsSchema = z\n  .array(McpToolNameSchema)\n  .min(1)\n  .max(16)\n  .refine((tools) => new Set(tools).size === tools.length, {\n    message: 'must contain unique MCP tool names',\n  })\n  .refine(\n    (tools) => tools.reduce(\n      (characterCount, toolName) => characterCount + toolName.length,\n      0,\n    ) <= 512,\n    { message: 'contains too many aggregate tool-name characters' },\n  );\n\nexport const ExecutionScopeSchema = z.object({\n  adopterId: OpaqueIdSchema,\n  tenantId: OpaqueIdSchema,\n  subjectId: OpaqueIdSchema,\n  productSessionId: OpaqueIdSchema,\n}).strict();\n\nexport const ExecutionHostConversationTurnRequestSchema = z.object({\n  schemaVersion: z.literal(EXECUTION_CONTRACT_VERSION),\n  kind: z.literal(CONVERSATION_TURN_WORKFLOW),\n  invocationId: OpaqueIdSchema,\n  prompt: z.string().trim().min(1).max(200_000),\n  deadlineAt: TimestampSchema.optional(),\n}).strict();\n\nexport const HeartbeatRunContextSchema = z.object({\n  currentDateTime: TimestampSchema,\n  intervalMs: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),\n  continuationMode: z.enum(['operator', 'agent']).optional(),\n  nextRunAt: TimestampSchema.optional(),\n  previousRunAt: TimestampSchema.optional(),\n  previousRunId: OpaqueIdSchema.optional(),\n}).strict();\n\nexport const ExecutionHostHeartbeatTaskRequestSchema = z.object({\n  schemaVersion: z.literal(EXECUTION_CONTRACT_VERSION),\n  kind: z.literal(HEARTBEAT_TASK_WORKFLOW),\n  invocationId: OpaqueIdSchema,\n  taskId: OpaqueIdSchema,\n  task: z.string().trim().min(1).max(200_000),\n  checkpoint: z.record(z.string(), z.json()).optional(),\n  runContext: HeartbeatRunContextSchema,\n  model: z.string().trim().min(1).max(512).optional(),\n  reasoningEffort: z.enum([\n    'none',\n    'low',\n    'medium',\n    'high',\n    'ultrahigh',\n    'max',\n  ]).optional(),\n  maxSteps: z.number().int().positive().max(10_000).optional(),\n  searchIgnoreDirs: z.array(z.string().min(1).max(1_024)).max(1_000).optional(),\n  systemContext: z.string().max(200_000).optional(),\n  deadlineAt: TimestampSchema.optional(),\n}).strict();\n\nexport const RuntimePublicResultSchema = z.object({\n  outcome: z.enum(['done', 'max_steps', 'error', 'interrupted']),\n  summary: z.string().optional(),\n  failure: z.object({\n    source: z.literal('model'),\n    code: z.enum([\n      'authentication',\n      'permission',\n      'quota',\n      'rate_limit',\n      'context_window',\n      'request',\n      'transport',\n      'empty_response',\n      'unknown',\n    ]),\n  }).strict().optional(),\n}).strict();\n\nconst StreamEnvelopeSchema = z.object({\n  schemaVersion: z.literal(EXECUTION_CONTRACT_VERSION),\n  invocationId: OpaqueIdSchema,\n  runId: OpaqueIdSchema,\n  sequence: z.number().int().nonnegative(),\n  timestamp: TimestampSchema,\n});\n\nexport const ExecutionHostStreamEventSchema = z.discriminatedUnion('kind', [\n  StreamEnvelopeSchema.extend({\n    sequence: z.literal(0),\n    kind: z.literal('accepted'),\n  }).strict(),\n  StreamEnvelopeSchema.extend({\n    kind: z.literal('activity'),\n    activity: z.unknown(),\n  }).strict(),\n  StreamEnvelopeSchema.extend({\n    kind: z.literal('result'),\n    result: RuntimePublicResultSchema,\n  }).strict(),\n  StreamEnvelopeSchema.extend({\n    kind: z.literal('cancelled'),\n    reason: z.string(),\n  }).strict(),\n  StreamEnvelopeSchema.extend({\n    kind: z.literal('error'),\n    error: z.object({\n      code: z.string().min(1).max(128).regex(/^[a-z0-9_]+$/),\n      message: z.string().min(1).max(1_600),\n    }).strict(),\n  }).strict(),\n]);\n\nexport const ExecutionHostHeartbeatStreamEventSchema = z.discriminatedUnion(\n  'kind',\n  [\n    StreamEnvelopeSchema.extend({\n      sequence: z.literal(0),\n      kind: z.literal('accepted'),\n    }).strict(),\n    StreamEnvelopeSchema.extend({\n      kind: z.literal('activity'),\n      activity: z.json(),\n    }).strict(),\n    StreamEnvelopeSchema.extend({\n      kind: z.literal('result'),\n      result: z.record(z.string(), z.json()),\n    }).strict(),\n    StreamEnvelopeSchema.extend({\n      kind: z.literal('cancelled'),\n      reason: z.string(),\n    }).strict(),\n    StreamEnvelopeSchema.extend({\n      kind: z.literal('error'),\n      error: z.object({\n        code: z.string().min(1).max(128).regex(/^[a-z0-9_]+$/),\n        message: z.string().min(1).max(1_600),\n      }).strict(),\n    }).strict(),\n  ],\n);\n\nexport const HostedExecutionWorkflowSchema = z.enum([\n  CONVERSATION_TURN_WORKFLOW,\n  HEARTBEAT_TASK_WORKFLOW,\n]);\n\nexport const ExecutionAssertionClaimsSchema = z.object({\n  iss: JwtIssuerSchema,\n  aud: JwtAudienceSchema,\n  contractVersion: z.literal(EXECUTION_CONTRACT_VERSION),\n  adopterId: OpaqueIdSchema,\n  tenantId: OpaqueIdSchema,\n  productSessionId: OpaqueIdSchema,\n  runtimeSessionId: RuntimeSessionIdSchema,\n  workflow: HostedExecutionWorkflowSchema,\n  sub: OpaqueIdSchema,\n  jti: OpaqueIdSchema,\n  iat: z.number().int().nonnegative(),\n  exp: z.number().int().positive(),\n}).passthrough();\n\nexport const McpCapabilityClaimsSchema = z.object({\n  iss: JwtIssuerSchema,\n  aud: JwtAudienceSchema,\n  contractVersion: z.literal(EXECUTION_CONTRACT_VERSION),\n  adopterId: OpaqueIdSchema,\n  tenantId: OpaqueIdSchema,\n  productSessionId: OpaqueIdSchema,\n  runtimeSessionId: RuntimeSessionIdSchema,\n  invocationId: OpaqueIdSchema,\n  workflow: HostedExecutionWorkflowSchema,\n  serverId: McpServerIdSchema,\n  allowedTools: McpAllowedToolsSchema,\n  sub: OpaqueIdSchema,\n  jti: OpaqueIdSchema,\n  iat: z.number().int().nonnegative(),\n  exp: z.number().int().positive(),\n}).passthrough();\n\nexport type ExecutionScope = z.infer<typeof ExecutionScopeSchema>;\nexport type ExecutionHostModelCredential = z.infer<\n  typeof ExecutionHostModelCredentialSchema\n>;\nexport type ExecutionHostConversationTurnRequest = z.infer<\n  typeof ExecutionHostConversationTurnRequestSchema\n>;\nexport type ExecutionHostHeartbeatTaskRequest = z.infer<\n  typeof ExecutionHostHeartbeatTaskRequestSchema\n>;\nexport type RuntimePublicResult = z.infer<typeof RuntimePublicResultSchema>;\nexport type ExecutionHostStreamEvent = z.infer<\n  typeof ExecutionHostStreamEventSchema\n>;\nexport type ExecutionHostTerminalEvent = Extract<\n  ExecutionHostStreamEvent,\n  { kind: 'result' | 'cancelled' | 'error' }\n>;\nexport type ExecutionHostHeartbeatStreamEvent = z.infer<\n  typeof ExecutionHostHeartbeatStreamEventSchema\n>;\nexport type ExecutionHostHeartbeatTerminalEvent = Extract<\n  ExecutionHostHeartbeatStreamEvent,\n  { kind: 'result' | 'cancelled' | 'error' }\n>;\nexport type ExecutionAssertionClaims = z.infer<\n  typeof ExecutionAssertionClaimsSchema\n>;\nexport type McpCapabilityClaims = z.infer<typeof McpCapabilityClaimsSchema>;\nexport type HostedExecutionWorkflow = z.infer<\n  typeof HostedExecutionWorkflowSchema\n>;\n\nexport function isExecutionHostTerminalEvent(\n  event: ExecutionHostStreamEvent,\n): event is ExecutionHostTerminalEvent {\n  return event.kind === 'result'\n    || event.kind === 'cancelled'\n    || event.kind === 'error';\n}\n\nexport function isExecutionHostHeartbeatTerminalEvent(\n  event: ExecutionHostHeartbeatStreamEvent,\n): event is ExecutionHostHeartbeatTerminalEvent {\n  return event.kind === 'result'\n    || event.kind === 'cancelled'\n    || event.kind === 'error';\n}\n\nexport function isSafeWebUrl(url: URL): boolean {\n  const loopback = ['127.0.0.1', '[::1]', 'localhost'].includes(url.hostname);\n  return (url.protocol === 'https:' || (url.protocol === 'http:' && loopback))\n    && !url.username\n    && !url.password\n    && !url.search\n    && !url.hash;\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/contracts/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAU,CAAC;AACrD,MAAM,CAAC,MAAM,0BAA0B,GAAG,mBAA4B,CAAC;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAyB,CAAC;AACjE,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAA+B,CAAC;AACxE,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAAoC,CAAC;AAExE,MAAM,CAAC,MAAM,gCAAgC,GAC3C,6CAAsD,CAAC;AACzD,MAAM,CAAC,MAAM,iCAAiC,GAC5C,qCAA8C,CAAC;AACjD,MAAM,CAAC,MAAM,0BAA0B,GACrC,mCAA4C,CAAC;AAC/C,MAAM,CAAC,MAAM,qBAAqB,GAChC,wCAAiD,CAAC;AACpD,MAAM,CAAC,MAAM,uBAAuB,GAClC,0CAAmD,CAAC;AAEtD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CACJ,gCAAgC,EAChC,yCAAyC,CAC1C,CAAC;AAEJ,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAC3C,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EACvC,gFAAgF,CACjF,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE5D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,EAAE;KACR,GAAG,CAAC,EAAE,CAAC;KACP,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE,mCAAmC,CAAC,CAAC;AAElF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAEhE,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAE9D;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,kBAAkB,CACpE,MAAM,EACN;IACE,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,MAAM,EAAE,iBAAiB;KAC1B,CAAC,CAAC,MAAM,EAAE;IACX,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACrC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC7B,WAAW,EAAE,iBAAiB;QAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;KACxD,CAAC,CAAC,MAAM,EAAE;CACZ,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CACJ,kBAAkB,EAClB,mDAAmD,CACpD,CAAC;AAEJ,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CACJ,yBAAyB,EACzB,wCAAwC,CACzC,CAAC;AAEJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,KAAK,CAAC,iBAAiB,CAAC;KACxB,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE;IACvD,OAAO,EAAE,oCAAoC;CAC9C,CAAC;KACD,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CACrB,CAAC,cAAc,EAAE,QAAQ,EAAE,EAAE,CAAC,cAAc,GAAG,QAAQ,CAAC,MAAM,EAC9D,CAAC,CACF,IAAI,GAAG,EACR,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAChE,CAAC;AAEJ,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,cAAc;IACzB,QAAQ,EAAE,cAAc;IACxB,SAAS,EAAE,cAAc;IACzB,gBAAgB,EAAE,cAAc;CACjC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IAC3C,YAAY,EAAE,cAAc;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC7C,UAAU,EAAE,eAAe,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,eAAe,EAAE,eAAe;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC;IACpE,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1D,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,eAAe,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,cAAc,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;IACxC,YAAY,EAAE,cAAc;IAC5B,MAAM,EAAE,cAAc;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,UAAU,EAAE,yBAAyB;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACnD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC;QACtB,MAAM;QACN,KAAK;QACL,QAAQ;QACR,MAAM;QACN,WAAW;QACX,KAAK;KACN,CAAC,CAAC,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;IAC5D,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IAC7E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;IACjD,UAAU,EAAE,eAAe,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;YACX,gBAAgB;YAChB,YAAY;YACZ,OAAO;YACP,YAAY;YACZ,gBAAgB;YAChB,SAAS;YACT,WAAW;YACX,gBAAgB;YAChB,SAAS;SACV,CAAC;KACH,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvB,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACpD,YAAY,EAAE,cAAc;IAC5B,KAAK,EAAE,cAAc;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,SAAS,EAAE,eAAe;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACzE,oBAAoB,CAAC,MAAM,CAAC;QAC1B,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;KAC5B,CAAC,CAAC,MAAM,EAAE;IACX,oBAAoB,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;KACtB,CAAC,CAAC,MAAM,EAAE;IACX,oBAAoB,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,MAAM,EAAE,yBAAyB;KAClC,CAAC,CAAC,MAAM,EAAE;IACX,oBAAoB,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC,CAAC,MAAM,EAAE;IACX,oBAAoB,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;YACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;YACtD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;SACtC,CAAC,CAAC,MAAM,EAAE;KACZ,CAAC,CAAC,MAAM,EAAE;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,kBAAkB,CACzE,MAAM,EACN;IACE,oBAAoB,CAAC,MAAM,CAAC;QAC1B,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;KAC5B,CAAC,CAAC,MAAM,EAAE;IACX,oBAAoB,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE;KACnB,CAAC,CAAC,MAAM,EAAE;IACX,oBAAoB,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;KACvC,CAAC,CAAC,MAAM,EAAE;IACX,oBAAoB,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC,CAAC,MAAM,EAAE;IACX,oBAAoB,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;YACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;YACtD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;SACtC,CAAC,CAAC,MAAM,EAAE;KACZ,CAAC,CAAC,MAAM,EAAE;CACZ,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,IAAI,CAAC;IAClD,0BAA0B;IAC1B,uBAAuB;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,GAAG,EAAE,eAAe;IACpB,GAAG,EAAE,iBAAiB;IACtB,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACtD,SAAS,EAAE,cAAc;IACzB,QAAQ,EAAE,cAAc;IACxB,gBAAgB,EAAE,cAAc;IAChC,gBAAgB,EAAE,sBAAsB;IACxC,QAAQ,EAAE,6BAA6B;IACvC,GAAG,EAAE,cAAc;IACnB,GAAG,EAAE,cAAc;IACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,GAAG,EAAE,eAAe;IACpB,GAAG,EAAE,iBAAiB;IACtB,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACtD,SAAS,EAAE,cAAc;IACzB,QAAQ,EAAE,cAAc;IACxB,gBAAgB,EAAE,cAAc;IAChC,gBAAgB,EAAE,sBAAsB;IACxC,YAAY,EAAE,cAAc;IAC5B,QAAQ,EAAE,6BAA6B;IACvC,QAAQ,EAAE,iBAAiB;IAC3B,YAAY,EAAE,qBAAqB;IACnC,GAAG,EAAE,cAAc;IACnB,GAAG,EAAE,cAAc;IACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC,WAAW,EAAE,CAAC;AAmCjB,MAAM,UAAU,4BAA4B,CAC1C,KAA+B;IAE/B,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;WACzB,KAAK,CAAC,IAAI,KAAK,WAAW;WAC1B,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,KAAwC;IAExC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;WACzB,KAAK,CAAC,IAAI,KAAK,WAAW;WAC1B,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAQ;IACnC,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,CAAC;WACvE,CAAC,GAAG,CAAC,QAAQ;WACb,CAAC,GAAG,CAAC,QAAQ;WACb,CAAC,GAAG,CAAC,MAAM;WACX,CAAC,GAAG,CAAC,IAAI,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB,CAAC,GAAQ;IAC1C,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO;WAC1B,GAAG,CAAC,QAAQ,KAAK,sBAAsB;WACvC,CAAC,GAAG,CAAC,QAAQ;WACb,CAAC,GAAG,CAAC,QAAQ;WACb,CAAC,GAAG,CAAC,MAAM;WACX,CAAC,GAAG,CAAC,IAAI,CAAC;AACjB,CAAC","sourcesContent":["import { z } from 'zod';\n\nexport const EXECUTION_CONTRACT_VERSION = 1 as const;\nexport const CONVERSATION_TURN_WORKFLOW = 'conversation-turn' as const;\nexport const HEARTBEAT_TASK_WORKFLOW = 'heartbeat-task' as const;\nexport const EXECUTION_ASSERTION_TYPE = 'heddle-execution+jwt' as const;\nexport const MCP_CAPABILITY_TYPE = 'heddle-mcp-capability+jwt' as const;\n\nexport const AGENTCORE_RUNTIME_SESSION_HEADER =\n  'x-amzn-bedrock-agentcore-runtime-session-id' as const;\nexport const EXECUTION_HOST_LOCAL_TOKEN_HEADER =\n  'x-heddle-execution-host-local-token' as const;\nexport const EXECUTION_ASSERTION_HEADER =\n  'x-heddle-execution-host-assertion' as const;\nexport const MCP_CAPABILITY_HEADER =\n  'x-heddle-execution-host-mcp-capability' as const;\nexport const MODEL_CREDENTIAL_HEADER =\n  'x-heddle-execution-host-model-credential' as const;\n\nexport const OpaqueIdSchema = z\n  .string()\n  .min(1)\n  .max(128)\n  .regex(\n    /^[A-Za-z0-9][A-Za-z0-9._:@-]*$/,\n    'must be an opaque, path-free identifier',\n  );\n\nexport const JwtIssuerSchema = z.url().refine(\n  (value) => isSafeWebUrl(new URL(value)),\n  'must use HTTPS or loopback HTTP and contain no credentials, query, or fragment',\n);\n\nexport const JwtAudienceSchema = z.string().min(1).max(512);\n\nexport const RuntimeSessionIdSchema = z\n  .string()\n  .min(33)\n  .max(256)\n  .refine((value) => value === value.trim(), 'must not contain outer whitespace');\n\nexport const TimestampSchema = z.iso.datetime({ offset: true });\n\nconst ModelSecretSchema = z.string().trim().min(8).max(4_096);\n\n/**\n * One invocation-scoped model credential. OAuth refresh material is\n * deliberately absent from the wire contract.\n */\nexport const ExecutionHostModelCredentialSchema = z.discriminatedUnion(\n  'type',\n  [\n    z.object({\n      type: z.literal('api-key'),\n      apiKey: ModelSecretSchema,\n    }).strict(),\n    z.object({\n      type: z.literal('oauth-access-token'),\n      provider: z.literal('openai'),\n      accessToken: ModelSecretSchema,\n      expiresAt: z.number().int().positive(),\n      accountId: z.string().trim().min(1).max(512).optional(),\n    }).strict(),\n  ],\n);\n\nexport const McpServerIdSchema = z\n  .string()\n  .min(1)\n  .max(64)\n  .regex(\n    /^[A-Za-z0-9_-]+$/,\n    'must be a Heddle-compatible MCP server identifier',\n  );\n\nexport const McpToolNameSchema = z\n  .string()\n  .min(1)\n  .max(64)\n  .regex(\n    /^[A-Za-z][A-Za-z0-9_]*$/,\n    'must be a collision-free MCP tool name',\n  );\n\nexport const McpAllowedToolsSchema = z\n  .array(McpToolNameSchema)\n  .min(1)\n  .max(16)\n  .refine((tools) => new Set(tools).size === tools.length, {\n    message: 'must contain unique MCP tool names',\n  })\n  .refine(\n    (tools) => tools.reduce(\n      (characterCount, toolName) => characterCount + toolName.length,\n      0,\n    ) <= 512,\n    { message: 'contains too many aggregate tool-name characters' },\n  );\n\nexport const ExecutionScopeSchema = z.object({\n  adopterId: OpaqueIdSchema,\n  tenantId: OpaqueIdSchema,\n  subjectId: OpaqueIdSchema,\n  productSessionId: OpaqueIdSchema,\n}).strict();\n\nexport const ExecutionHostConversationTurnRequestSchema = z.object({\n  schemaVersion: z.literal(EXECUTION_CONTRACT_VERSION),\n  kind: z.literal(CONVERSATION_TURN_WORKFLOW),\n  invocationId: OpaqueIdSchema,\n  prompt: z.string().trim().min(1).max(200_000),\n  deadlineAt: TimestampSchema.optional(),\n}).strict();\n\nexport const HeartbeatRunContextSchema = z.object({\n  currentDateTime: TimestampSchema,\n  intervalMs: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),\n  continuationMode: z.enum(['operator', 'agent']).optional(),\n  nextRunAt: TimestampSchema.optional(),\n  previousRunAt: TimestampSchema.optional(),\n  previousRunId: OpaqueIdSchema.optional(),\n}).strict();\n\nexport const ExecutionHostHeartbeatTaskRequestSchema = z.object({\n  schemaVersion: z.literal(EXECUTION_CONTRACT_VERSION),\n  kind: z.literal(HEARTBEAT_TASK_WORKFLOW),\n  invocationId: OpaqueIdSchema,\n  taskId: OpaqueIdSchema,\n  task: z.string().trim().min(1).max(200_000),\n  checkpoint: z.record(z.string(), z.json()).optional(),\n  runContext: HeartbeatRunContextSchema,\n  model: z.string().trim().min(1).max(512).optional(),\n  reasoningEffort: z.enum([\n    'none',\n    'low',\n    'medium',\n    'high',\n    'ultrahigh',\n    'max',\n  ]).optional(),\n  maxSteps: z.number().int().positive().max(10_000).optional(),\n  searchIgnoreDirs: z.array(z.string().min(1).max(1_024)).max(1_000).optional(),\n  systemContext: z.string().max(200_000).optional(),\n  deadlineAt: TimestampSchema.optional(),\n}).strict();\n\nexport const RuntimePublicResultSchema = z.object({\n  outcome: z.enum(['done', 'max_steps', 'error', 'interrupted']),\n  summary: z.string().optional(),\n  failure: z.object({\n    source: z.literal('model'),\n    code: z.enum([\n      'authentication',\n      'permission',\n      'quota',\n      'rate_limit',\n      'context_window',\n      'request',\n      'transport',\n      'empty_response',\n      'unknown',\n    ]),\n  }).strict().optional(),\n}).strict();\n\nconst StreamEnvelopeSchema = z.object({\n  schemaVersion: z.literal(EXECUTION_CONTRACT_VERSION),\n  invocationId: OpaqueIdSchema,\n  runId: OpaqueIdSchema,\n  sequence: z.number().int().nonnegative(),\n  timestamp: TimestampSchema,\n});\n\nexport const ExecutionHostStreamEventSchema = z.discriminatedUnion('kind', [\n  StreamEnvelopeSchema.extend({\n    sequence: z.literal(0),\n    kind: z.literal('accepted'),\n  }).strict(),\n  StreamEnvelopeSchema.extend({\n    kind: z.literal('activity'),\n    activity: z.unknown(),\n  }).strict(),\n  StreamEnvelopeSchema.extend({\n    kind: z.literal('result'),\n    result: RuntimePublicResultSchema,\n  }).strict(),\n  StreamEnvelopeSchema.extend({\n    kind: z.literal('cancelled'),\n    reason: z.string(),\n  }).strict(),\n  StreamEnvelopeSchema.extend({\n    kind: z.literal('error'),\n    error: z.object({\n      code: z.string().min(1).max(128).regex(/^[a-z0-9_]+$/),\n      message: z.string().min(1).max(1_600),\n    }).strict(),\n  }).strict(),\n]);\n\nexport const ExecutionHostHeartbeatStreamEventSchema = z.discriminatedUnion(\n  'kind',\n  [\n    StreamEnvelopeSchema.extend({\n      sequence: z.literal(0),\n      kind: z.literal('accepted'),\n    }).strict(),\n    StreamEnvelopeSchema.extend({\n      kind: z.literal('activity'),\n      activity: z.json(),\n    }).strict(),\n    StreamEnvelopeSchema.extend({\n      kind: z.literal('result'),\n      result: z.record(z.string(), z.json()),\n    }).strict(),\n    StreamEnvelopeSchema.extend({\n      kind: z.literal('cancelled'),\n      reason: z.string(),\n    }).strict(),\n    StreamEnvelopeSchema.extend({\n      kind: z.literal('error'),\n      error: z.object({\n        code: z.string().min(1).max(128).regex(/^[a-z0-9_]+$/),\n        message: z.string().min(1).max(1_600),\n      }).strict(),\n    }).strict(),\n  ],\n);\n\nexport const HostedExecutionWorkflowSchema = z.enum([\n  CONVERSATION_TURN_WORKFLOW,\n  HEARTBEAT_TASK_WORKFLOW,\n]);\n\nexport const ExecutionAssertionClaimsSchema = z.object({\n  iss: JwtIssuerSchema,\n  aud: JwtAudienceSchema,\n  contractVersion: z.literal(EXECUTION_CONTRACT_VERSION),\n  adopterId: OpaqueIdSchema,\n  tenantId: OpaqueIdSchema,\n  productSessionId: OpaqueIdSchema,\n  runtimeSessionId: RuntimeSessionIdSchema,\n  workflow: HostedExecutionWorkflowSchema,\n  sub: OpaqueIdSchema,\n  jti: OpaqueIdSchema,\n  iat: z.number().int().nonnegative(),\n  exp: z.number().int().positive(),\n}).passthrough();\n\nexport const McpCapabilityClaimsSchema = z.object({\n  iss: JwtIssuerSchema,\n  aud: JwtAudienceSchema,\n  contractVersion: z.literal(EXECUTION_CONTRACT_VERSION),\n  adopterId: OpaqueIdSchema,\n  tenantId: OpaqueIdSchema,\n  productSessionId: OpaqueIdSchema,\n  runtimeSessionId: RuntimeSessionIdSchema,\n  invocationId: OpaqueIdSchema,\n  workflow: HostedExecutionWorkflowSchema,\n  serverId: McpServerIdSchema,\n  allowedTools: McpAllowedToolsSchema,\n  sub: OpaqueIdSchema,\n  jti: OpaqueIdSchema,\n  iat: z.number().int().nonnegative(),\n  exp: z.number().int().positive(),\n}).passthrough();\n\nexport type ExecutionScope = z.infer<typeof ExecutionScopeSchema>;\nexport type ExecutionHostModelCredential = z.infer<\n  typeof ExecutionHostModelCredentialSchema\n>;\nexport type ExecutionHostConversationTurnRequest = z.infer<\n  typeof ExecutionHostConversationTurnRequestSchema\n>;\nexport type ExecutionHostHeartbeatTaskRequest = z.infer<\n  typeof ExecutionHostHeartbeatTaskRequestSchema\n>;\nexport type RuntimePublicResult = z.infer<typeof RuntimePublicResultSchema>;\nexport type ExecutionHostStreamEvent = z.infer<\n  typeof ExecutionHostStreamEventSchema\n>;\nexport type ExecutionHostTerminalEvent = Extract<\n  ExecutionHostStreamEvent,\n  { kind: 'result' | 'cancelled' | 'error' }\n>;\nexport type ExecutionHostHeartbeatStreamEvent = z.infer<\n  typeof ExecutionHostHeartbeatStreamEventSchema\n>;\nexport type ExecutionHostHeartbeatTerminalEvent = Extract<\n  ExecutionHostHeartbeatStreamEvent,\n  { kind: 'result' | 'cancelled' | 'error' }\n>;\nexport type ExecutionAssertionClaims = z.infer<\n  typeof ExecutionAssertionClaimsSchema\n>;\nexport type McpCapabilityClaims = z.infer<typeof McpCapabilityClaimsSchema>;\nexport type HostedExecutionWorkflow = z.infer<\n  typeof HostedExecutionWorkflowSchema\n>;\n\nexport function isExecutionHostTerminalEvent(\n  event: ExecutionHostStreamEvent,\n): event is ExecutionHostTerminalEvent {\n  return event.kind === 'result'\n    || event.kind === 'cancelled'\n    || event.kind === 'error';\n}\n\nexport function isExecutionHostHeartbeatTerminalEvent(\n  event: ExecutionHostHeartbeatStreamEvent,\n): event is ExecutionHostHeartbeatTerminalEvent {\n  return event.kind === 'result'\n    || event.kind === 'cancelled'\n    || event.kind === 'error';\n}\n\nexport function isSafeWebUrl(url: URL): boolean {\n  const loopback = ['127.0.0.1', '[::1]', 'localhost'].includes(url.hostname);\n  return (url.protocol === 'https:' || (url.protocol === 'http:' && loopback))\n    && !url.username\n    && !url.password\n    && !url.search\n    && !url.hash;\n}\n\n/** Explicit Docker Desktop bridge exception for isolated local composition. */\nexport function isDockerLocalWebUrl(url: URL): boolean {\n  return url.protocol === 'http:'\n    && url.hostname === 'host.docker.internal'\n    && !url.username\n    && !url.password\n    && !url.search\n    && !url.hash;\n}\n"]}

package/dist/coordinator/contracts.d.ts

@@ -6,7 +6,10 @@ export declare const HOSTED_HEARTBEAT_COORDINATOR_PATHS: Readonly<{
     resume: "/v1/control/resume";
     drain: "/v1/control/drain";
 }>;
-export declare const HOSTED_HEARTBEAT_DELEGATIONS_PATH = "/hosted-execution/internal/heartbeat-delegations";
+export declare const HOSTED_HEARTBEAT_EXECUTION_PATHS: Readonly<{
+    prepare: "/hosted-execution/internal/heartbeat-executions/prepare";
+    settle: "/hosted-execution/internal/heartbeat-executions/settle";
+}>;
 export declare const HostedHeartbeatCoordinatorTaskInputSchema: z.ZodObject<{
     workspaceId: z.ZodOptional<z.ZodString>;
     name: z.ZodOptional<z.ZodString>;
@@ -434,10 +437,11 @@ export declare const HostedHeartbeatDesiredTaskCatalogSchema: z.ZodObject<{
     }, z.core.$strict>>;
     resume: z.ZodBoolean;
 }, z.core.$strict>;
-export declare const HostedHeartbeatDelegationRequestSchema: z.ZodObject<{
+export declare const HostedHeartbeatExecutionPreparationRequestSchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<1>;
     taskId: z.ZodString;
     executionId: z.ZodString;
+    interruptedExecutionId: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export declare const HostedHeartbeatDelegationSchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<1>;
@@ -474,7 +478,7 @@ export declare const HostedHeartbeatDelegationSchema: z.ZodObject<{
         mcpCapability: z.ZodString;
     }, z.core.$strict>;
 }, z.core.$strict>;
-export declare const HostedHeartbeatDelegationAuthorizationSchema: z.ZodObject<{
+export declare const HostedHeartbeatExecutionAuthorizationSchema: z.ZodObject<{
     scope: z.ZodObject<{
         tenantId: z.ZodString;
         subjectId: z.ZodString;
@@ -482,6 +486,139 @@ export declare const HostedHeartbeatDelegationAuthorizationSchema: z.ZodObject<{
     }, z.core.$strict>;
     allowedTools: z.ZodArray<z.ZodString>;
 }, z.core.$strict>;
+export declare const HostedHeartbeatExecutionPreparationDecisionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"execute">;
+    authorization: z.ZodObject<{
+        scope: z.ZodObject<{
+            tenantId: z.ZodString;
+            subjectId: z.ZodString;
+            productSessionId: z.ZodString;
+        }, z.core.$strict>;
+        allowedTools: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"skip">;
+    summary: z.ZodString;
+}, z.core.$strict>], "kind">;
+export declare const HostedHeartbeatExecutionPreparationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"execute">;
+    delegation: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        taskId: z.ZodString;
+        executionId: z.ZodString;
+        scope: z.ZodObject<{
+            tenantId: z.ZodString;
+            subjectId: z.ZodString;
+            productSessionId: z.ZodString;
+        }, z.core.$strict>;
+        runtimeSessionId: z.ZodString;
+        deadlineAt: z.ZodISODateTime;
+        authority: z.ZodObject<{
+            metadata: z.ZodObject<{
+                scope: z.ZodObject<{
+                    adopterId: z.ZodString;
+                    tenantId: z.ZodString;
+                    subjectId: z.ZodString;
+                    productSessionId: z.ZodString;
+                }, z.core.$strict>;
+                runtimeSessionId: z.ZodString;
+                invocationId: z.ZodString;
+                workflow: z.ZodLiteral<"heartbeat-task">;
+                issuedAt: z.ZodISODateTime;
+                executionExpiresAt: z.ZodISODateTime;
+                mcp: z.ZodObject<{
+                    capabilityId: z.ZodString;
+                    serverId: z.ZodString;
+                    allowedTools: z.ZodArray<z.ZodString>;
+                    expiresAt: z.ZodISODateTime;
+                }, z.core.$strict>;
+            }, z.core.$strict>;
+            executionAssertion: z.ZodString;
+            mcpCapability: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"skip">;
+    taskId: z.ZodString;
+    executionId: z.ZodString;
+    summary: z.ZodString;
+}, z.core.$strict>], "kind">;
+export declare const HostedHeartbeatExecutionResultSchema: z.ZodObject<{
+    decision: z.ZodEnum<{
+        continue: "continue";
+        pause: "pause";
+        complete: "complete";
+        escalate: "escalate";
+    }>;
+    summary: z.ZodString;
+    runId: z.ZodString;
+    outcome: z.ZodEnum<{
+        error: "error";
+        done: "done";
+        max_steps: "max_steps";
+        interrupted: "interrupted";
+    }>;
+}, z.core.$strict>;
+export declare const HostedHeartbeatExecutionSettlementRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    taskId: z.ZodString;
+    executionId: z.ZodString;
+    kind: z.ZodLiteral<"completed">;
+    result: z.ZodObject<{
+        decision: z.ZodEnum<{
+            continue: "continue";
+            pause: "pause";
+            complete: "complete";
+            escalate: "escalate";
+        }>;
+        summary: z.ZodString;
+        runId: z.ZodString;
+        outcome: z.ZodEnum<{
+            error: "error";
+            done: "done";
+            max_steps: "max_steps";
+            interrupted: "interrupted";
+        }>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    taskId: z.ZodString;
+    executionId: z.ZodString;
+    kind: z.ZodLiteral<"failed">;
+    errorType: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    taskId: z.ZodString;
+    executionId: z.ZodString;
+    kind: z.ZodLiteral<"interrupted">;
+}, z.core.$strict>], "kind">;
+export declare const HostedHeartbeatExecutionDispositionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"accepted">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"retry">;
+    summary: z.ZodString;
+    delayMs: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"blocked">;
+    summary: z.ZodString;
+}, z.core.$strict>], "kind">;
+export declare const HostedHeartbeatExecutionSettlementSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    taskId: z.ZodString;
+    executionId: z.ZodString;
+    disposition: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"accepted">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"retry">;
+        summary: z.ZodString;
+        delayMs: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"blocked">;
+        summary: z.ZodString;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>;
 export type HostedHeartbeatCoordinatorTaskInput = z.infer<typeof HostedHeartbeatCoordinatorTaskInputSchema>;
 export type HostedHeartbeatCoordinatorState = z.infer<typeof HostedHeartbeatCoordinatorStateSchema>;
 export type HostedHeartbeatCoordinatorTaskView = z.infer<typeof HostedHeartbeatCoordinatorTaskViewSchema>;
@@ -489,7 +626,13 @@ export type HostedHeartbeatCoordinatorRunView = z.infer<typeof HostedHeartbeatCo
 export type HostedHeartbeatCoordinatorTaskDetail = z.infer<typeof HostedHeartbeatCoordinatorTaskDetailSchema>;
 export type HostedHeartbeatDesiredTask = z.infer<typeof HostedHeartbeatDesiredTaskSchema>;
 export type HostedHeartbeatDesiredTaskCatalog = z.infer<typeof HostedHeartbeatDesiredTaskCatalogSchema>;
-export type HostedHeartbeatDelegationRequest = z.infer<typeof HostedHeartbeatDelegationRequestSchema>;
+export type HostedHeartbeatExecutionPreparationRequest = z.infer<typeof HostedHeartbeatExecutionPreparationRequestSchema>;
 export type HostedHeartbeatDelegation = z.infer<typeof HostedHeartbeatDelegationSchema>;
-export type HostedHeartbeatDelegationAuthorization = z.infer<typeof HostedHeartbeatDelegationAuthorizationSchema>;
+export type HostedHeartbeatExecutionAuthorization = z.infer<typeof HostedHeartbeatExecutionAuthorizationSchema>;
+export type HostedHeartbeatExecutionPreparationDecision = z.infer<typeof HostedHeartbeatExecutionPreparationDecisionSchema>;
+export type HostedHeartbeatExecutionPreparation = z.infer<typeof HostedHeartbeatExecutionPreparationSchema>;
+export type HostedHeartbeatExecutionResult = z.infer<typeof HostedHeartbeatExecutionResultSchema>;
+export type HostedHeartbeatExecutionSettlementRequest = z.infer<typeof HostedHeartbeatExecutionSettlementRequestSchema>;
+export type HostedHeartbeatExecutionDisposition = z.infer<typeof HostedHeartbeatExecutionDispositionSchema>;
+export type HostedHeartbeatExecutionSettlement = z.infer<typeof HostedHeartbeatExecutionSettlementSchema>;
 //# sourceMappingURL=contracts.d.ts.map

package/dist/coordinator/contracts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../src/coordinator/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB,eAAO,MAAM,kCAAkC;;;;;;EAM7C,CAAC;AAEH,eAAO,MAAM,iCAAiC,qDACM,CAAC;AAErD,eAAO,MAAM,yCAAyC;;;;;;;;;;;;;;;kBAc3C,CAAC;AAEZ,eAAO,MAAM,qCAAqC;;;;;EAKhD,CAAC;AAEH,eAAO,MAAM,6CAA6C;;;;;;;kBAE/C,CAAC;AAEZ,eAAO,MAAM,0CAA0C;;;;;;;EAOrD,CAAC;AAEH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;iBAcvC,CAAC;AAEjB,0EAA0E;AAC1E,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuBrC,CAAC;AAEjB,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAE1C,CAAC;AAEZ,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAUpC,CAAC;AAEjB,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG5C,CAAC;AAEZ,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;kBAGlC,CAAC;AAEZ,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;kBAelD,CAAC;AAEH,eAAO,MAAM,sCAAsC;;;;kBAIxC,CAAC;AAiBZ,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA6B1C,CAAC;AAEH,eAAO,MAAM,4CAA4C;;;;;;;kBAG9C,CAAC;AAEZ,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CACvD,OAAO,yCAAyC,CACjD,CAAC;AACF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CACnD,OAAO,qCAAqC,CAC7C,CAAC;AACF,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CACtD,OAAO,wCAAwC,CAChD,CAAC;AACF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CACxD,OAAO,0CAA0C,CAClD,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AACF,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CACpD,OAAO,sCAAsC,CAC9C,CAAC;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AACF,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,4CAA4C,CACpD,CAAC"}
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../src/coordinator/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB,eAAO,MAAM,kCAAkC;;;;;;EAM7C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;;EAG3C,CAAC;AAEH,eAAO,MAAM,yCAAyC;;;;;;;;;;;;;;;kBAc3C,CAAC;AAEZ,eAAO,MAAM,qCAAqC;;;;;EAKhD,CAAC;AAEH,eAAO,MAAM,6CAA6C;;;;;;;kBAE/C,CAAC;AAEZ,eAAO,MAAM,0CAA0C;;;;;;;EAOrD,CAAC;AAEH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;iBAcvC,CAAC;AAEjB,0EAA0E;AAC1E,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuBrC,CAAC;AAEjB,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAE1C,CAAC;AAEZ,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAUpC,CAAC;AAEjB,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG5C,CAAC;AAEZ,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;kBAGlC,CAAC;AAEZ,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;kBAelD,CAAC;AAEH,eAAO,MAAM,gDAAgD;;;;;kBAKlD,CAAC;AAiBZ,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA6B1C,CAAC;AAEH,eAAO,MAAM,2CAA2C;;;;;;;kBAG7C,CAAC;AAEZ,eAAO,MAAM,iDAAiD;;;;;;;;;;;;;4BAU1D,CAAC;AAEL,eAAO,MAAM,yCAAyC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAgBrD,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;kBAKtC,CAAC;AAQZ,eAAO,MAAM,+CAA+C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAaxD,CAAC;AAEL,eAAO,MAAM,yCAAyC;;;;;;;;;4BAerD,CAAC;AAEF,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;kBAK1C,CAAC;AAEZ,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CACvD,OAAO,yCAAyC,CACjD,CAAC;AACF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CACnD,OAAO,qCAAqC,CAC7C,CAAC;AACF,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CACtD,OAAO,wCAAwC,CAChD,CAAC;AACF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CACxD,OAAO,0CAA0C,CAClD,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AACF,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAC9D,OAAO,gDAAgD,CACxD,CAAC;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AACF,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CACzD,OAAO,2CAA2C,CACnD,CAAC;AACF,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAC/D,OAAO,iDAAiD,CACzD,CAAC;AACF,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CACvD,OAAO,yCAAyC,CACjD,CAAC;AACF,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAClD,OAAO,oCAAoC,CAC5C,CAAC;AACF,MAAM,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAC7D,OAAO,+CAA+C,CACvD,CAAC;AACF,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CACvD,OAAO,yCAAyC,CACjD,CAAC;AACF,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CACtD,OAAO,wCAAwC,CAChD,CAAC"}