@intx/hub-sessions 0.2.2 → 0.3.0

package/dist/ws/sidecar-token-authenticator.d.ts

@@ -1,4 +1,5 @@
 import type { DB } from "@intx/db";
+import type { SidecarCredentialResolver } from "../sidecar-allocation/contracts.js";
 import type { SidecarAuthenticator } from "./sidecar-handler.js";
 export type CreateSidecarTokenAuthenticatorDeps = {
     db: DB["db"];
@@ -12,4 +13,5 @@ export type CreateSidecarTokenAuthenticatorDeps = {
  * `sidecarId` on the frame is ignored: identity is derived from the
  * token alone.
  */
-export declare function createSidecarTokenAuthenticator({ db, }: CreateSidecarTokenAuthenticatorDeps): SidecarAuthenticator;
+export declare function createSidecarCredentialResolver({ db, }: CreateSidecarTokenAuthenticatorDeps): SidecarCredentialResolver;
+export declare function createSidecarTokenAuthenticator(deps: CreateSidecarTokenAuthenticatorDeps): SidecarAuthenticator;

package/dist/ws/sidecar-token-authenticator.js

@@ -1,6 +1,6 @@
-import { eq } from "drizzle-orm";
+import { and, eq, inArray } from "drizzle-orm";
 import { sha256 } from "@intx/crypto";
-import { sidecar } from "@intx/db/schema";
+import { sidecar, sidecarAllocation, workflowRun } from "@intx/db/schema";
 /**
  * Builds an authenticator that verifies a sidecar's presented token
  * against the per-sidecar hash stored on the `sidecar` table. The token
@@ -10,15 +10,72 @@ import { sidecar } from "@intx/db/schema";
  * `sidecarId` on the frame is ignored: identity is derived from the
  * token alone.
  */
-export function createSidecarTokenAuthenticator({ db, }) {
-    return async ({ token }) => {
+export function createSidecarCredentialResolver({ db, }) {
+    async function resolve(token) {
         const tokenHash = await sha256(token);
         const row = await db.query.sidecar.findFirst({
             where: eq(sidecar.tokenHashSha256, tokenHash),
         });
-        if (row === undefined) {
+        if (row === undefined)
             return null;
+        if (row.credentialScope === "shared") {
+            return { kind: "shared", sidecarId: row.id };
         }
-        return { kind: "sidecar", sidecarId: row.id };
-    };
+        const allocation = await db.query.sidecarAllocation.findFirst({
+            where: eq(sidecarAllocation.sidecarId, row.id),
+        });
+        if (allocation === undefined)
+            return null;
+        if (allocation.status !== "provisioning" &&
+            allocation.status !== "allocated") {
+            return null;
+        }
+        const anchor = await db.query.workflowRun.findFirst({
+            columns: { address: true },
+            where: eq(workflowRun.id, allocation.anchorRunId),
+        });
+        if (anchor?.address === null || anchor?.address === undefined)
+            return null;
+        return {
+            kind: "allocated",
+            sidecarId: row.id,
+            allocationId: allocation.id,
+            tenantId: allocation.tenantId,
+            anchorRunId: allocation.anchorRunId,
+            workflowRunAddress: anchor.address,
+            generation: allocation.generation,
+        };
+    }
+    async function isCurrent(identity, use) {
+        if (identity.kind === "shared") {
+            const allocation = await db.query.sidecarAllocation.findFirst({
+                columns: { id: true },
+                where: eq(sidecarAllocation.sidecarId, identity.sidecarId),
+            });
+            return allocation === undefined;
+        }
+        const statuses = use === "registration"
+            ? ["provisioning", "allocated"]
+            : ["allocated"];
+        const allocation = await db.query.sidecarAllocation.findFirst({
+            where: and(eq(sidecarAllocation.id, identity.allocationId), eq(sidecarAllocation.sidecarId, identity.sidecarId), eq(sidecarAllocation.tenantId, identity.tenantId), eq(sidecarAllocation.anchorRunId, identity.anchorRunId), eq(sidecarAllocation.generation, identity.generation), inArray(sidecarAllocation.status, statuses)),
+        });
+        if (allocation === undefined)
+            return false;
+        if (use === "registration")
+            return true;
+        if (allocation.ensureAcceptedGeneration !== identity.generation) {
+            return false;
+        }
+        const anchor = await db.query.workflowRun.findFirst({
+            columns: { address: true },
+            where: eq(workflowRun.id, identity.anchorRunId),
+        });
+        return anchor?.address === identity.workflowRunAddress;
+    }
+    return { resolve, isCurrent };
+}
+export function createSidecarTokenAuthenticator(deps) {
+    const resolver = createSidecarCredentialResolver(deps);
+    return async ({ token }) => resolver.resolve(token);
 }

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@intx/hub-sessions",
-  "version": "0.2.2",
+  "description": "Session-orchestration substrate for the hub: sidecar router, session, and asset services",
+  "version": "0.3.0",
   "license": "LGPL-2.1-only",
   "type": "module",
   "exports": {
@@ -16,18 +17,18 @@
     }
   },
   "dependencies": {
-    "@intx/agent": "0.2.2",
-    "@intx/crypto": "0.2.2",
-    "@intx/db": "0.2.2",
-    "@intx/hub-common": "0.2.2",
-    "@intx/log": "0.2.2",
-    "@intx/mime": "0.2.2",
-    "@intx/pack-transport": "0.2.2",
-    "@intx/storage-isogit": "0.2.2",
-    "@intx/tool-packaging": "0.2.2",
-    "@intx/types": "0.2.2",
-    "@intx/workflow": "0.2.2",
-    "@intx/workflow-deploy": "0.2.2",
+    "@intx/agent": "0.3.0",
+    "@intx/crypto": "0.3.0",
+    "@intx/db": "0.3.0",
+    "@intx/hub-common": "0.3.0",
+    "@intx/log": "0.3.0",
+    "@intx/mime": "0.3.0",
+    "@intx/pack-transport": "0.3.0",
+    "@intx/storage-isogit": "0.3.0",
+    "@intx/tool-packaging": "0.3.0",
+    "@intx/types": "0.3.0",
+    "@intx/workflow": "0.3.0",
+    "@intx/workflow-deploy": "0.3.0",
     "arktype": "^2.1.29",
     "drizzle-orm": "^0.45.1",
     "isomorphic-git": "^1.27.2",

package/dist/available-skills-stanza.d.ts

@@ -1,21 +0,0 @@
-export type AvailableSkillEntry = {
-    /** Qualified skill identifier in the form `<asset.name>/<skill-name>`. */
-    qualifiedName: string;
-    /** SKILL.md frontmatter description, verbatim. */
-    description: string;
-    /** Workspace-relative path the agent's `read_file` should target,
-     * shaped like `workspace/<mountPath>/<skill-name>/`. */
-    workspacePath: string;
-};
-/**
- * Render the `<available_skills>` stanza appended to the agent's
- * system prompt. Returns the empty string when `entries` is empty —
- * an empty `<available_skills></available_skills>` wrapper would be
- * misleading noise for agents with no skills attached.
- *
- * Values are XML-escaped at the boundary. The skill kind handler
- * already rejects descriptions containing literal `<` or `>` so the
- * `&` escape is the practical case in production; the others are
- * defensive.
- */
-export declare function buildAvailableSkillsStanza(entries: AvailableSkillEntry[]): string;

package/dist/available-skills-stanza.js

@@ -1,32 +0,0 @@
-/**
- * Render the `<available_skills>` stanza appended to the agent's
- * system prompt. Returns the empty string when `entries` is empty —
- * an empty `<available_skills></available_skills>` wrapper would be
- * misleading noise for agents with no skills attached.
- *
- * Values are XML-escaped at the boundary. The skill kind handler
- * already rejects descriptions containing literal `<` or `>` so the
- * `&` escape is the practical case in production; the others are
- * defensive.
- */
-export function buildAvailableSkillsStanza(entries) {
-    if (entries.length === 0) {
-        return "";
-    }
-    const lines = ["<available_skills>"];
-    for (const entry of entries) {
-        lines.push("  <skill>");
-        lines.push(`    <name>${escapeXml(entry.qualifiedName)}</name>`);
-        lines.push(`    <description>${escapeXml(entry.description)}</description>`);
-        lines.push(`    <path>${escapeXml(entry.workspacePath)}</path>`);
-        lines.push("  </skill>");
-    }
-    lines.push("</available_skills>");
-    return lines.join("\n");
-}
-function escapeXml(value) {
-    return value
-        .replaceAll("&", "&amp;")
-        .replaceAll("<", "&lt;")
-        .replaceAll(">", "&gt;");
-}