@intx/workflow-host 0.2.2

package/dist/ipc/event-channel.js

@@ -0,0 +1,278 @@
+// Event channel: UNIX socketpair, HMAC-SHA256 authenticated.
+//
+// The workflow-process child sends InferenceEvents (high rate, plus
+// the per-message `message.run.started` / `message.run.ended`
+// brackets) to the supervisor. The supervisor verifies each frame's
+// MAC and forwards into the hub via the existing `agent.event`
+// session-channel path. The shared 32-byte HMAC key is minted by the
+// supervisor at spawn time and passed to the child in spawn-time env.
+// Both sides authenticate every frame: a malformed or tampered frame
+// is a crash signal, not a recoverable error.
+//
+// Backpressure: the supervisor keeps a bounded userspace ring (default
+// 1024 frames). On overrun the supervisor logs the saturation, fires
+// the caller-supplied crash callback, and the workflow-process kills
+// itself on the next signal cycle. Observability lost equals
+// invariant violated equals crash; the audit chain cannot tolerate a
+// silent drop, and a blocking writer would deadlock against the
+// reactor's emit path.
+//
+// Mixing failure mode: the payload union here covers InferenceEvent
+// shapes only. A "control message" structurally shaped as `drain` or
+// `recycle` will not satisfy this union and the receiver will crash.
+// The discriminated arktype validators in `control-channel.ts` and
+// here are disjoint by construction.
+import { type } from "arktype";
+import { hexDecode, hexEncode } from "@intx/types";
+import { InferenceEvent } from "@intx/types/runtime";
+import { decodeEnvelope, encodeEnvelope, FrameEnvelope, MacedEnvelope, } from "./envelope.js";
+import { signHmac, verifyHmac } from "./crypto.js";
+/**
+ * The event channel additionally carries the two bracket events the
+ * reactor emits per message run. They are part of the InferenceEvent
+ * union upstream; re-exporting the union directly keeps this channel
+ * structurally identical to what the hub's `agent.event` frame
+ * carries today.
+ */
+export const EventPayload = InferenceEvent;
+/**
+ * Construct the child-side event-channel sender. The shared HMAC
+ * key lives in closure. The child mints monotonic seq values per
+ * channelId; the receiver enforces strict monotonicity.
+ */
+export function createEventChannelSender(opts) {
+    let seq = 0;
+    // Serialize sends. `signHmac` is async, so without a lock two
+    // concurrent callers could each assign seq, suspend on the signer, and
+    // resume in HMAC-resolution order — writing frames out of seq order,
+    // which the receiver rejects as a gap and crashes the channel. The
+    // production caller fires events without awaiting (`void send(event)`),
+    // so this is the live case. The promise chain makes each send await the
+    // previous send's completion before it assigns seq, signs, and writes,
+    // keeping that critical section atomic. Mirrors the control channel's
+    // sender, whose Ed25519 signing has the same shape.
+    let tail = Promise.resolve();
+    return {
+        get seq() {
+            return seq;
+        },
+        send(payload) {
+            const previous = tail;
+            let release = () => undefined;
+            tail = new Promise((resolve) => {
+                release = resolve;
+            });
+            return (async () => {
+                await previous;
+                try {
+                    seq += 1;
+                    const envelope = {
+                        seq,
+                        channelId: opts.channelId,
+                        payload,
+                    };
+                    const envelopeBytes = encodeEnvelope(envelope);
+                    const tag = await signHmac(envelopeBytes, opts.hmacKey);
+                    const maced = {
+                        envelope,
+                        mac: hexEncode(tag),
+                    };
+                    // Newline-delimit each frame. The channel rides a byte-stream
+                    // pipe (fd3) where the kernel may coalesce successive writes into
+                    // one read or split one write across reads -- the one-write-equals-
+                    // one-frame assumption does not hold under the burst of events a
+                    // real step emits. `JSON.stringify` never emits a literal newline
+                    // (newlines inside strings are escaped as `\n`), so `\n` is an
+                    // unambiguous frame terminator the receiver splits on, mirroring
+                    // the control channel's NDJSON discipline.
+                    await opts.writer.write(new TextEncoder().encode(`${JSON.stringify(maced)}\n`));
+                }
+                finally {
+                    release();
+                }
+            })();
+        },
+    };
+}
+/**
+ * Construct the supervisor-side event-channel receiver. Yields one
+ * verified, in-order `EventPayload` per call. Any frame that fails
+ * HMAC verification, carries a non-current channelId, arrives out
+ * of order, or arrives faster than the consumer drains -- triggers
+ * `onCrash` and ends the iterator.
+ */
+export async function* receiveEventChannel(opts) {
+    const limit = opts.bufferLimit ?? DEFAULT_EVENT_BUFFER_LIMIT;
+    let highestSeq = 0;
+    const buffer = [];
+    let crashed = false;
+    let producerDone = false;
+    let waiter = null;
+    function wake() {
+        const w = waiter;
+        waiter = null;
+        if (w)
+            w();
+    }
+    const pump = (async () => {
+        // The channel rides a byte-stream pipe: the kernel can coalesce
+        // several sender writes into one read chunk or split one write
+        // across chunks, so a chunk boundary is not a frame boundary. The
+        // sender newline-delimits every frame; this decoder accumulates raw
+        // bytes and splits on `\n` so each complete line is exactly one
+        // envelope, mirroring the control channel's NDJSON reader. A partial
+        // trailing line stays buffered until its terminator arrives.
+        const decoder = new TextDecoder("utf-8");
+        let pending = "";
+        try {
+            for await (const chunk of opts.reader.read()) {
+                if (crashed)
+                    return;
+                pending += decoder.decode(chunk, { stream: true });
+                let nl = pending.indexOf("\n");
+                while (nl >= 0) {
+                    const line = pending.slice(0, nl).replace(/\r$/, "");
+                    pending = pending.slice(nl + 1);
+                    nl = pending.indexOf("\n");
+                    if (line.length === 0)
+                        continue;
+                    if (crashed)
+                        return;
+                    let raw;
+                    try {
+                        raw = JSON.parse(line);
+                    }
+                    catch (cause) {
+                        crashed = true;
+                        opts.onCrash(`event channel received non-JSON frame: ${errorMessage(cause)}`);
+                        wake();
+                        return;
+                    }
+                    const crashedOnLine = await processLine(raw);
+                    if (crashedOnLine)
+                        return;
+                }
+            }
+            // A non-empty trailing buffer at EOF is a truncated final frame:
+            // the sender always terminates a frame with `\n`, so unterminated
+            // bytes mean the writer died mid-frame. Surface it as a crash
+            // rather than silently dropping a partial envelope.
+            if (pending.length > 0) {
+                crashed = true;
+                opts.onCrash(`event channel received truncated frame at EOF (${String(pending.length)} bytes, no terminator)`);
+                wake();
+                return;
+            }
+        }
+        finally {
+            producerDone = true;
+            wake();
+        }
+        // Process one decoded frame through the verify/order/validate
+        // pipeline. Returns `true` when the frame tripped a crash (the
+        // caller must stop pumping), `false` on a clean buffered push.
+        async function processLine(raw) {
+            const maced = MacedEnvelope(raw);
+            if (maced instanceof type.errors) {
+                crashed = true;
+                opts.onCrash(`event channel envelope failed validation: ${maced.summary}`);
+                wake();
+                return true;
+            }
+            let envelopeBytes;
+            try {
+                envelopeBytes = encodeEnvelope(maced.envelope);
+            }
+            catch (cause) {
+                crashed = true;
+                opts.onCrash(`event channel envelope re-encode failed: ${errorMessage(cause)}`);
+                wake();
+                return true;
+            }
+            let macBytes;
+            try {
+                macBytes = hexDecode(maced.mac);
+            }
+            catch (cause) {
+                crashed = true;
+                opts.onCrash(`event channel MAC decode failed: ${errorMessage(cause)}`);
+                wake();
+                return true;
+            }
+            const ok = await verifyHmac(envelopeBytes, macBytes, opts.hmacKey);
+            if (!ok) {
+                crashed = true;
+                opts.onCrash(`event channel HMAC did not verify (seq=${String(maced.envelope.seq)}, channelId=${maced.envelope.channelId})`);
+                wake();
+                return true;
+            }
+            if (maced.envelope.channelId !== opts.channelId) {
+                crashed = true;
+                opts.onCrash(`event channel channelId mismatch: expected ${opts.channelId}, got ${maced.envelope.channelId} at seq=${String(maced.envelope.seq)}`);
+                wake();
+                return true;
+            }
+            if (maced.envelope.seq <= highestSeq) {
+                crashed = true;
+                opts.onCrash(`event channel out-of-order seq: expected > ${String(highestSeq)}, got ${String(maced.envelope.seq)}`);
+                wake();
+                return true;
+            }
+            if (maced.envelope.seq !== highestSeq + 1) {
+                crashed = true;
+                opts.onCrash(`event channel seq gap: expected ${String(highestSeq + 1)}, got ${String(maced.envelope.seq)}`);
+                wake();
+                return true;
+            }
+            highestSeq = maced.envelope.seq;
+            const payload = EventPayload(maced.envelope.payload);
+            if (payload instanceof type.errors) {
+                crashed = true;
+                opts.onCrash(`event channel payload failed validation: ${payload.summary}`);
+                wake();
+                return true;
+            }
+            if (buffer.length >= limit) {
+                crashed = true;
+                opts.onCrash(`event channel buffer overrun: ${String(buffer.length)} frames pending, limit ${String(limit)}`);
+                wake();
+                return true;
+            }
+            buffer.push(payload);
+            wake();
+            return false;
+        }
+    })();
+    try {
+        while (true) {
+            if (buffer.length > 0) {
+                const next = buffer.shift();
+                if (next === undefined) {
+                    throw new Error("event channel receiver invariant: shift returned undefined despite non-empty buffer");
+                }
+                yield next;
+                continue;
+            }
+            if (crashed || producerDone) {
+                return;
+            }
+            await new Promise((resolve) => {
+                waiter = resolve;
+            });
+        }
+    }
+    finally {
+        await pump;
+    }
+}
+function errorMessage(cause) {
+    if (cause instanceof Error)
+        return cause.message;
+    return String(cause);
+}
+export const DEFAULT_EVENT_BUFFER_LIMIT = 1024;
+/**
+ * Re-export the envelope decoder for callers that need raw access
+ * to a frame's envelope outside the receiver iterator.
+ */
+export { decodeEnvelope };

package/dist/ipc/index.d.ts

@@ -0,0 +1,4 @@
+export { ControlPayload, OutboundAttachmentPayload, OutboundMessagePayload, SourcesUpdatedData, createControlChannelSender, receiveControlChannel, type ControlChannelSender, type ControlChannelSenderOpts, type ControlChannelReceiverOpts, type NdjsonReader, type NdjsonWriter, } from "./control-channel.js";
+export { DEFAULT_EVENT_BUFFER_LIMIT, EventPayload, createEventChannelSender, receiveEventChannel, type EventChannelSender, type EventChannelSenderOpts, type EventChannelReceiverOpts, type FrameReader, type FrameWriter, } from "./event-channel.js";
+export { FrameEnvelope, MacedEnvelope, SignedEnvelope, decodeEnvelope, encodeEnvelope, } from "./envelope.js";
+export { IPC_CRYPTO, generateChannelId, generateHmacKey, signEd25519, signHmac, verifyEd25519, verifyHmac, } from "./crypto.js";

package/dist/ipc/index.js

@@ -0,0 +1,143 @@
+// =============================================================
+// THREAT MODEL -- workflow-process supervisor/child IPC
+// =============================================================
+//
+// The workflow-process is a Bun child the supervisor spawns per
+// active deployment. That child runs user-supplied workflow code:
+// tools the operator deployed, director prompts the operator wrote,
+// agent harnesses operating against external APIs. The supervisor
+// lives in-sidecar, owns the mail-bus identity for the deployment's
+// addresses, and holds the Ed25519 signing key used to commit
+// authoritative records (`CancelRequested`, drain signatures, audit
+// frames) on the deployment's behalf.
+//
+// The IPC channels between the supervisor and the child are the
+// airlock between an authoritative-but-trusted process and a
+// potentially-compromised one. Per-frame crypto is what makes the
+// airlock seal: any frame the child receives whose signature does
+// not verify under the supervisor's Ed25519 public key is dropped
+// (and the receiver crashes); any frame the supervisor receives
+// whose HMAC does not verify is dropped (and the receiver crashes).
+//
+// Design pieces, with the failure mode each one defends against:
+//
+// 1. Asymmetric crypto on the control channel, two keypairs per spawn.
+//    Both directions of the control channel carry Ed25519-signed
+//    frames; each direction uses its own keypair so neither end
+//    holds the private half of the keypair its peer signs with.
+//
+//    Supervisor's keypair (downstream: supervisor -> child).
+//    The supervisor mints the keypair at spawn time, signs every
+//    downstream control frame (trigger.fire, signal.deliver, drain,
+//    recycle, shutdown, grants-updated, sources-updated) with the
+//    private half, and passes the corresponding 32-byte public half
+//    to the child in spawn-time env (`HOST_PUBKEY`). The
+//    SUPERVISOR'S PRIVATE KEY NEVER LEAVES THE SUPERVISOR'S ADDRESS
+//    SPACE. The spawn-time env carries pubkey + HMAC key + channelId
+//    and NEVER the supervisor's private key. A leak via fork() memory
+//    copy is impossible because the supervisor uses `spawn` with an
+//    explicitly constructed `env` object -- there is no inheritance
+//    of the supervisor's process env into the child by reference.
+//    A leak via accidental `process.env` propagation is prevented by
+//    constructing the child env as a fresh object containing only
+//    the documented variables (no `...process.env` spread). A leak
+//    via serialization is prevented by the supervisor never placing
+//    the private key in any IPC payload, log line, or audit-log
+//    frame -- it lives only as a 32-byte Uint8Array held in closure
+//    by the signing-key callback.
+//
+//    Child's keypair (upstream: child -> supervisor).
+//    The child mints its own Ed25519 keypair at startup, signs every
+//    upstream control frame with the private half, and publishes the
+//    matching public half in the payload of the upstream `ready`
+//    frame as `childPublicKey` (hex-encoded). The supervisor's
+//    upstream receiver opens in bootstrap mode: it parses the first
+//    frame's envelope structurally, extracts `childPublicKey`,
+//    verifies the `ready` frame's signature against it, and uses the
+//    same key to verify every subsequent upstream frame. The CHILD'S
+//    PRIVATE KEY NEVER LEAVES THE CHILD'S ADDRESS SPACE. A
+//    compromised child cannot forge a frame the supervisor accepts
+//    under a different key: the bootstrap pins the verification key
+//    to the value the first `ready` frame published, and a frame
+//    that claims a different sender is one whose signature the
+//    receiver cannot verify.
+//
+// 2. HMAC-SHA256 on the event channel.
+//    Symmetric authentication is correct for the high-rate path
+//    (InferenceEvents stream at the reactor's emit cadence, including
+//    `message.run.started` / `message.run.ended` brackets). Both
+//    sides hold the same 32-byte key; both sides authenticate every
+//    frame. HMAC is roughly two orders of magnitude cheaper per byte
+//    than Ed25519, which is what makes per-frame authentication
+//    affordable at high rate. The cost saving holds across the full
+//    InferenceEvent volume profile (delta events at token rate).
+//
+// 3. ChannelId rotation on every spawn AND every recycle.
+//    The channelId is 16 bytes from `crypto.getRandomValues`, hex-encoded
+//    (interface-decisions Bonus 2). The supervisor mints it at every
+//    spawn, places it in spawn-time env (`IPC_CHANNEL_ID`), and mints
+//    a fresh one at every recycle. Receivers track the current
+//    channelId; any frame carrying a non-current channelId is a
+//    signal that the wire is still attached to a predecessor
+//    workflow-process (a recycled child's leftover state in some
+//    socket the supervisor failed to fully close, or an attacker who
+//    captured a frame from a previous spawn and is replaying it
+//    against the current one). The receiver crashes loudly rather
+//    than processing the stale frame. Crash-on-mismatch is the only
+//    honest response: a "stale frame" is by construction either a
+//    replay or a programming bug, and silently dropping it would
+//    paper over both.
+//
+// 4. Monotonic seq per channelId, crash on out-of-order.
+//    Every frame within a channelId's lifetime carries a strictly-
+//    increasing seq. The sender maintains a counter; the receiver
+//    tracks the highest seq seen and requires the next frame's seq
+//    to equal `highestSeq + 1` exactly (gap = drop, repeat = replay,
+//    decrease = replay). Any seq violation crashes the receiver.
+//    The combination of channelId rotation and monotonic seq
+//    prevents an attacker who captured a previous channelId's frame
+//    stream from replaying it against the current channel: the
+//    captured frames carry the wrong channelId. Within the current
+//    channelId, the monotonic-seq check prevents replay of an
+//    earlier frame in the same channel.
+//
+// 5. Crash-on-overrun on the event channel.
+//    The supervisor buffers in userspace with a bound (default 1024
+//    frames). On overrun, the supervisor logs the saturation and the
+//    workflow-process kills itself. The audit chain is built from
+//    forwarded InferenceEvents; a silent drop of a single event
+//    breaks the chain in a way no downstream consumer can detect.
+//    The choice is between two unrecoverable states: (a) corrupt
+//    audit chain that pretends to be correct, or (b) crash that
+//    advertises itself. Crash wins.
+//
+// 6. Clean control-vs-event boundary.
+//    The control channel carries `credentialsSnapshot` updates,
+//    drain, recycle, grants-updated, ready, shutdown -- shapes whose
+//    authority is the supervisor's identity and whose rate is low.
+//    The event channel carries InferenceEvents and the bracket
+//    events -- shapes whose authority is the deployment's identity
+//    (which the supervisor and child share via the HMAC key) and
+//    whose rate is high. The two channels' typed payload unions are
+//    DISJOINT BY CONSTRUCTION (the discriminated `ControlPayload`
+//    union in `control-channel.ts` does not overlap the
+//    `EventPayload` union in `event-channel.ts`). A control payload
+//    that included an inference-event shape would defeat the split;
+//    an inference-event payload that included a `drain` or `recycle`
+//    discriminator would let a compromised child issue control-plane
+//    commands the supervisor honors. Neither is possible at the
+//    type level.
+//
+// 7. Supervisor-minted channelId.
+//    The supervisor is the single source of truth for channelId.
+//    The child does NOT generate its own and never proposes a value.
+//    A protocol that let the child propose a channelId would let a
+//    compromised child negotiate a channelId an attacker had
+//    pre-captured frames for. The supervisor mints, the child reads
+//    from env, the supervisor enforces.
+//
+// =============================================================
+export { ControlPayload, OutboundAttachmentPayload, OutboundMessagePayload, SourcesUpdatedData, createControlChannelSender, receiveControlChannel, } from "./control-channel.js";
+export { DEFAULT_EVENT_BUFFER_LIMIT, EventPayload, createEventChannelSender, receiveEventChannel, } from "./event-channel.js";
+export { FrameEnvelope, MacedEnvelope, SignedEnvelope, decodeEnvelope, encodeEnvelope, } from "./envelope.js";
+export { IPC_CRYPTO, generateChannelId, generateHmacKey, signEd25519, signHmac, verifyEd25519, verifyHmac, } from "./crypto.js";

package/dist/mail-bus/hub-transport-adapter.d.ts

@@ -0,0 +1,30 @@
+import type { HubTransport } from "@intx/mail-memory";
+import type { MailBusBindings } from "../supervisor/types.js";
+/**
+ * Returned shape: the `MailBusBindings` surface the supervisor
+ * consumes, plus a `routeInbound` method the host calls to deliver
+ * an inbound message to every handler subscribed at the named
+ * address. The split keeps the supervisor's subscription contract
+ * narrow while letting the host drive delivery through its existing
+ * transport plumbing.
+ */
+export interface HubTransportMailBusAdapter extends MailBusBindings {
+    /**
+     * Fan a delivered message out to every handler subscribed at
+     * `address`. Returns immediately if no handler is registered --
+     * the supervisor's lifecycle (`subscribeMailForAddress` returns a
+     * disposer the supervisor calls on teardown) is the authoritative
+     * source of which addresses are live; addresses without an active
+     * subscriber drop the message silently.
+     */
+    routeInbound(address: string, message: Uint8Array): void;
+}
+/**
+ * Wrap an existing `HubTransport` instance as the supervisor-facing
+ * `MailBusBindings` shape. The `transport` argument is held only as
+ * a sink-side reference the adapter does not actively reach into
+ * today -- the sidecar's deploy router registers the head's address
+ * on the transport, and the adapter delivers inbound bytes through
+ * `routeInbound` directly into the per-address subscriber map below.
+ */
+export declare function wrapHubTransportAsMailBus(transport: HubTransport): HubTransportMailBusAdapter;

package/dist/mail-bus/hub-transport-adapter.js

@@ -0,0 +1,76 @@
+// Adapter that surfaces an existing `HubTransport` instance as the
+// supervisor-facing `MailBusBindings` shape. Hosts that already own
+// a hub-mail transport (the sidecar, the integration test harness,
+// any future alternative-sidecar implementation) wire the supervisor
+// through this adapter instead of standing up a second bus.
+//
+// Per-address subscriber maps live inside the adapter: the
+// supervisor's `subscribeMailForAddress` registers a handler here;
+// the host's transport delivers messages via `routeInbound` and the
+// adapter fans the bytes out to every subscribed handler. The
+// transport itself is treated as a sink the host already owns -- the
+// adapter does not register addresses on the transport on the
+// supervisor's behalf (production sidecars register the head's address
+// through the deploy router before the supervisor spawns) and does not
+// double-deliver messages the transport itself routes.
+/**
+ * Wrap an existing `HubTransport` instance as the supervisor-facing
+ * `MailBusBindings` shape. The `transport` argument is held only as
+ * a sink-side reference the adapter does not actively reach into
+ * today -- the sidecar's deploy router registers the head's address
+ * on the transport, and the adapter delivers inbound bytes through
+ * `routeInbound` directly into the per-address subscriber map below.
+ */
+export function wrapHubTransportAsMailBus(transport) {
+    const subscribers = new Map();
+    return {
+        registerAddress(address) {
+            // The supervisor's address registration is the seam where the
+            // workflow-process child owns its own mailbox; production
+            // sidecars register the head's address through the deploy router
+            // before the supervisor spawns, so this method is intentionally
+            // inert. The `transport` reference is retained so a future
+            // routing change that wants the bus to own registration has
+            // the handle in scope.
+            void address;
+            void transport;
+        },
+        unregisterAddress(address) {
+            subscribers.delete(address);
+        },
+        subscribeMailForAddress(address, handler) {
+            let set = subscribers.get(address);
+            if (set === undefined) {
+                set = new Set();
+                subscribers.set(address, set);
+            }
+            set.add(handler);
+            return () => {
+                const current = subscribers.get(address);
+                current?.delete(handler);
+            };
+        },
+        routeInbound(address, message) {
+            const set = subscribers.get(address);
+            if (set === undefined)
+                return;
+            for (const handler of set)
+                handler(message);
+        },
+        async sendOutbound(senderAddress, message) {
+            // OUTBOUND half of mailbox ownership (§3a): route the agent's
+            // reply / mail-tool send through the host transport's signed-send
+            // path. `getTransportFor(senderAddress).send(message)` is the
+            // exact path the in-process agent uses today -- it signs with the
+            // `CryptoProvider` the host registered for `senderAddress` via
+            // `register(address, crypto)`, so the outbound mail carries the
+            // AGENT's signature and fires the same `addMessageSentHandler`
+            // audit hook the in-process path relies on. The supervisor never
+            // holds the agent's key; the host transport does. An unregistered
+            // sender throws inside `getTransportFor` rather than emitting
+            // unsigned mail.
+            const scoped = transport.getTransportFor(senderAddress);
+            return scoped.send(message);
+        },
+    };
+}

package/dist/mail-bus/index.d.ts

@@ -0,0 +1 @@
+export { wrapHubTransportAsMailBus, type HubTransportMailBusAdapter, } from "./hub-transport-adapter.js";

package/dist/mail-bus/index.js

@@ -0,0 +1 @@
+export { wrapHubTransportAsMailBus, } from "./hub-transport-adapter.js";

package/dist/seams/index.d.ts

@@ -0,0 +1,3 @@
+export { createWorkflowHostScheduler, type SchedulerHandle, type SchedulerOpts, } from "./scheduler.js";
+export { adaptHostScheduler } from "./scheduler-adapter.js";
+export { SignalReceivedEnvelope, createWorkflowHostSignalChannel, type SignalChannelHandle, type SignalChannelOpts, } from "./signal-channel.js";

package/dist/seams/index.js

@@ -0,0 +1,3 @@
+export { createWorkflowHostScheduler, } from "./scheduler.js";
+export { adaptHostScheduler } from "./scheduler-adapter.js";
+export { SignalReceivedEnvelope, createWorkflowHostSignalChannel, } from "./signal-channel.js";

package/dist/seams/scheduler-adapter.d.ts

@@ -0,0 +1,3 @@
+import type { Scheduler } from "@intx/workflow";
+import type { SchedulerHandle } from "./scheduler.js";
+export declare function adaptHostScheduler(handle: SchedulerHandle): Scheduler;

package/dist/seams/scheduler-adapter.js

@@ -0,0 +1,24 @@
+// Adapter from the host-singleton `SchedulerHandle` to the runtime's
+// per-call `Scheduler` interface.
+//
+// The host's `SchedulerHandle` (from `seams/scheduler.ts`) tails
+// `TimerSet` commits via `subscribeKind` and commits `TimerFired` at
+// the wall-clock deadline. The runtime body (`@intx/workflow`'s
+// `runtimeRun`) expects a `Scheduler.scheduleIn(runId, timerId,
+// fireAt) => dispose` whose dispose cancels any pending `TimerFired`.
+//
+// The adapter routes `scheduleIn` through to the host scheduler's
+// live ingest by relying on the supervisor's commit-then-subscribe
+// ordering: by the time the runtime body has committed `TimerSet`
+// and called `scheduleIn`, the host scheduler's `subscribeKind` tail
+// will queue the timer. The returned disposer asks the host scheduler
+// to drop the queued entry for `(runId, timerId)`.
+export function adaptHostScheduler(handle) {
+    return {
+        scheduleIn(runId, timerId, _fireAt) {
+            return () => {
+                handle.cancelQueued(runId, timerId);
+            };
+        },
+    };
+}