@ixo/oracle-runtime 0.0.1

package/dist/modules/ucan/ucan.service.js

@@ -0,0 +1,582 @@
+/**
+ * @fileoverview UCAN service for Oracle
+ *
+ * Handles:
+ * 1. UCAN validation for MCP tool invocations (client → oracle)
+ * 2. UCAN invocation creation for downstream services (oracle → sandbox, etc.)
+ * 3. Ed25519 signing key management (stored in memory at startup)
+ * 4. Service DID resolution via did:web (/.well-known/did.json)
+ * 5. User delegation caching (keyed by user DID)
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var UcanService_1;
+import { CACHE_MANAGER } from '@nestjs/cache-manager';
+import { Inject, Injectable, Logger, } from '@nestjs/common';
+// `ConfigService` must be a VALUE import — Nest needs the constructor in
+// the compiled `design:paramtypes` metadata to resolve the DI graph.
+// A `type` import erases it to `Function` and DI fails at boot.
+import { ConfigService } from '@nestjs/config';
+import { buildRequiredCapability, createMCPUCANConfig, loadUCANConfigFromEnv, requiresUCANAuth, } from './ucan.config.js';
+import { signerFromMnemonic, parseDelegation, createInvocation, serializeInvocation, } from '@ixo/ucan';
+class InMemoryInvocationStore {
+    store = new Map();
+    cleanupInterval = null;
+    defaultTtlMs;
+    constructor(options = {}) {
+        this.defaultTtlMs = options.defaultTtlMs ?? 24 * 60 * 60 * 1000;
+        const cleanupIntervalMs = options.cleanupIntervalMs ?? 60 * 60 * 1000;
+        this.cleanupInterval = setInterval(() => {
+            void this.cleanup();
+        }, cleanupIntervalMs);
+        if (this.cleanupInterval.unref) {
+            this.cleanupInterval.unref();
+        }
+    }
+    async has(cid) {
+        const expiry = this.store.get(cid);
+        if (!expiry)
+            return false;
+        if (Date.now() > expiry) {
+            this.store.delete(cid);
+            return false;
+        }
+        return true;
+    }
+    async add(cid, ttlMs) {
+        const ttl = ttlMs ?? this.defaultTtlMs;
+        this.store.set(cid, Date.now() + ttl);
+    }
+    async cleanup() {
+        const now = Date.now();
+        for (const [cid, expiry] of this.store.entries()) {
+            if (now > expiry) {
+                this.store.delete(cid);
+            }
+        }
+    }
+    destroy() {
+        if (this.cleanupInterval) {
+            clearInterval(this.cleanupInterval);
+            this.cleanupInterval = null;
+        }
+        this.store.clear();
+    }
+}
+function createIxoDIDResolver(config) {
+    const DID_DOCUMENT_QUERY = `
+    query GetDIDDocument($id: String!) {
+      iids(filter: { id: { equalTo: $id } }) {
+        nodes {
+          id
+          verificationMethod
+        }
+      }
+    }
+  `;
+    return async (did) => {
+        if (!did.startsWith('did:ixo:')) {
+            return {
+                error: {
+                    name: 'DIDKeyResolutionError',
+                    did,
+                    message: `Cannot resolve ${did}: not a did:ixo identifier`,
+                },
+            };
+        }
+        try {
+            const response = await fetch(config.indexerUrl, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    query: DID_DOCUMENT_QUERY,
+                    variables: { id: did },
+                }),
+            });
+            if (!response.ok) {
+                return {
+                    error: {
+                        name: 'DIDKeyResolutionError',
+                        did,
+                        message: `Failed to fetch DID document: HTTP ${response.status}`,
+                    },
+                };
+            }
+            const data = (await response.json());
+            if (data.errors && data.errors.length > 0) {
+                return {
+                    error: {
+                        name: 'DIDKeyResolutionError',
+                        did,
+                        message: `GraphQL error: ${data.errors[0]?.message ?? 'Unknown error'}`,
+                    },
+                };
+            }
+            const didDoc = data.data?.iids?.nodes?.[0];
+            if (!didDoc) {
+                return {
+                    error: {
+                        name: 'DIDKeyResolutionError',
+                        did,
+                        message: `DID document not found for ${did}`,
+                    },
+                };
+            }
+            const keys = [];
+            for (const vm of didDoc.verificationMethod || []) {
+                if (vm.type.includes('Ed25519') &&
+                    vm.publicKeyMultibase?.startsWith('z')) {
+                    keys.push(`did:key:${vm.publicKeyMultibase}`);
+                }
+            }
+            if (keys.length === 0) {
+                return {
+                    error: {
+                        name: 'DIDKeyResolutionError',
+                        did,
+                        message: `No valid Ed25519 verification methods found for ${did}`,
+                    },
+                };
+            }
+            return { ok: keys };
+        }
+        catch (error) {
+            return {
+                error: {
+                    name: 'DIDKeyResolutionError',
+                    did,
+                    message: `Failed to resolve ${did}: ${error instanceof Error ? error.message : 'Unknown error'}`,
+                },
+            };
+        }
+    };
+}
+function createCompositeDIDResolver(resolvers) {
+    return async (did) => {
+        for (const resolver of resolvers) {
+            const result = await resolver(did);
+            if ('ok' in result) {
+                return result;
+            }
+            if (result.error.message.includes('not a did:')) {
+                continue;
+            }
+            return result;
+        }
+        return {
+            error: {
+                name: 'DIDKeyResolutionError',
+                did,
+                message: `No resolver could handle ${did}`,
+            },
+        };
+    };
+}
+function createMCPResourceURI(oracleDid, serverName, toolName) {
+    return `ixo:oracle:${oracleDid}:mcp/${serverName}/${toolName}`;
+}
+// ============================================================================
+// Constants
+// ============================================================================
+const DELEGATION_CACHE_PREFIX = 'ucan_delegation_';
+const INVOCATION_CACHE_PREFIX = 'ucan_invocation_';
+const MAX_INVOCATION_TTL_SECONDS = 3600; // 1 hour max
+let UcanService = UcanService_1 = class UcanService {
+    configService;
+    cacheManager;
+    logger = new Logger(UcanService_1.name);
+    config;
+    invocationStore;
+    didResolver;
+    signingMnemonic = null;
+    oracleDid = null;
+    serviceDidCache = new Map();
+    constructor(configService, cacheManager) {
+        this.configService = configService;
+        this.cacheManager = cacheManager;
+        this.config = this.loadConfig();
+        this.invocationStore = new InMemoryInvocationStore({
+            defaultTtlMs: 24 * 60 * 60 * 1000,
+            cleanupIntervalMs: 60 * 60 * 1000,
+        });
+        const indexerUrl = this.configService.get('BLOCKSYNC_GRAPHQL_URL');
+        this.didResolver = this.createDIDResolver(indexerUrl);
+        this.logger.log('UCAN service initialized');
+        this.logger.log(`Oracle DID: ${this.config.oracleDid}`);
+        this.logger.log(`Root issuers: ${this.config.rootIssuers.join(', ')}`);
+        this.logger.log(`Protected MCP servers: ${Object.keys(this.config.requirements).join(', ') || 'none'}`);
+    }
+    onModuleDestroy() {
+        if (this.invocationStore instanceof InMemoryInvocationStore) {
+            this.invocationStore.destroy();
+        }
+    }
+    loadConfig() {
+        const envConfig = loadUCANConfigFromEnv();
+        const oracleDid = this.configService.get('ORACLE_ENTITY_DID') ||
+            envConfig.oracleDid;
+        const rootIssuers = envConfig.rootIssuers.length > 0 ? envConfig.rootIssuers : [oracleDid];
+        return createMCPUCANConfig(oracleDid, rootIssuers, {});
+    }
+    createDIDResolver(indexerUrl) {
+        const resolvers = [];
+        if (indexerUrl) {
+            resolvers.push(createIxoDIDResolver({ indexerUrl }));
+        }
+        const didKeyResolver = async (did) => {
+            if (did.startsWith('did:key:')) {
+                return { ok: [did] };
+            }
+            return {
+                error: {
+                    name: 'DIDKeyResolutionError',
+                    did,
+                    message: 'Not a did:key',
+                },
+            };
+        };
+        resolvers.push(didKeyResolver);
+        return createCompositeDIDResolver(resolvers);
+    }
+    // ============================================================================
+    // Signing key management
+    // ============================================================================
+    /**
+     * Store the Ed25519 signing mnemonic in memory (called once at startup).
+     * Uses the same mnemonic from setupClaimSigningMnemonics.
+     */
+    setSigningMnemonic(mnemonic, did) {
+        this.signingMnemonic = mnemonic;
+        this.oracleDid = did;
+        this.logger.log(`[UCAN] Signing mnemonic stored for ${did}`);
+    }
+    hasSigningKey() {
+        return this.signingMnemonic !== null;
+    }
+    /**
+     * Read the in-memory signing mnemonic. Other runtime consumers (e.g. the
+     * credits plugin's claim-signing path) call this to avoid re-fetching and
+     * re-decrypting it from the oracle's Matrix account room on every claim.
+     * Returns `null` when boot hasn't populated it yet.
+     */
+    getSigningMnemonic() {
+        return this.signingMnemonic;
+    }
+    // ============================================================================
+    // User delegation caching
+    // ============================================================================
+    /**
+     * Cache a raw UCAN delegation string for a user.
+     * Called by auth-header.middleware after successful validation.
+     */
+    async cacheDelegation(userDid, rawDelegation, expirationUnix) {
+        const ttlMs = expirationUnix
+            ? expirationUnix * 1000 - Date.now()
+            : 7 * 24 * 60 * 60 * 1000; // 7 days default
+        if (ttlMs <= 0) {
+            this.logger.warn(`[UCAN] Delegation for ${userDid} already expired`);
+            return;
+        }
+        await this.cacheManager.set(`${DELEGATION_CACHE_PREFIX}${userDid}`, rawDelegation, ttlMs);
+        this.logger.debug(`[UCAN] Cached delegation for ${userDid} (TTL: ${Math.round(ttlMs / 1000)}s)`);
+    }
+    async getCachedDelegation(userDid) {
+        const cached = await this.cacheManager.get(`${DELEGATION_CACHE_PREFIX}${userDid}`);
+        return cached ?? null;
+    }
+    // ============================================================================
+    // Service DID resolution (did:web via /.well-known/did.json)
+    // ============================================================================
+    /**
+     * Resolve a service URL to its did:web DID.
+     * Fetches /.well-known/did.json from the service's domain and caches the result.
+     */
+    async resolveServiceDid(serviceUrl) {
+        try {
+            const url = new URL(serviceUrl);
+            const origin = url.origin;
+            const cached = this.serviceDidCache.get(origin);
+            if (cached)
+                return cached;
+            const didDocUrl = `${origin}/.well-known/did.json`;
+            const response = await fetch(didDocUrl);
+            if (!response.ok) {
+                this.logger.warn(`[UCAN] Failed to fetch DID document from ${didDocUrl}: HTTP ${response.status}`);
+                return null;
+            }
+            const doc = (await response.json());
+            if (!doc.id) {
+                this.logger.warn(`[UCAN] DID document at ${didDocUrl} has no id field`);
+                return null;
+            }
+            this.serviceDidCache.set(origin, doc.id);
+            this.logger.log(`[UCAN] Resolved service DID for ${origin}: ${doc.id}`);
+            return doc.id;
+        }
+        catch (error) {
+            this.logger.warn(`[UCAN] Failed to resolve service DID for ${serviceUrl}: ${error instanceof Error ? error.message : String(error)}`);
+            return null;
+        }
+    }
+    // ============================================================================
+    // Service invocation creation (oracle → downstream service)
+    // ============================================================================
+    /**
+     * Create a serialized UCAN invocation for calling a downstream service.
+     * The invocation embeds the user's delegation as proof, forming:
+     *   user (delegation.iss) → oracle (invocation.iss) → service (invocation.aud)
+     *
+     * @param serviceUrl - URL of the downstream service (used to resolve did:web)
+     * @param userDid - The user's DID (used to look up cached delegation)
+     * @param resource - The capability resource URI (e.g., 'ixo:sandbox')
+     * @returns Base64-encoded invocation CAR, or null if unavailable
+     */
+    async createServiceInvocation(serviceUrl, userDid, resource = 'ixo:sandbox') {
+        const serviceDid = await this.resolveServiceDid(serviceUrl);
+        if (!serviceDid) {
+            this.logger.debug(`[UCAN] Could not resolve service DID for ${serviceUrl}`);
+            return null;
+        }
+        return this.mintInvocationForServiceDid(userDid, serviceDid, resource);
+    }
+    /**
+     * Mint a UCAN invocation when the downstream service DID is already known
+     * (e.g. a plugin called `resolveServiceDid` separately and now wants to
+     * mint with the resolved DID directly). Same semantics as
+     * `createServiceInvocation` minus the URL → DID lookup.
+     *
+     * `opts.skipCache` — bypass the invocation cache. Required for downstream
+     * services that enforce single-use replay protection per invocation CID
+     * (e.g. composio-worker). Without this flag a cached CID would be reused
+     * across requests and rejected as a replay.
+     */
+    async mintInvocationForServiceDid(userDid, serviceDid, resource = 'ixo:sandbox', opts = {}) {
+        if (!this.signingMnemonic || !this.oracleDid) {
+            this.logger.debug('[UCAN] No signing key available, skipping invocation');
+            return null;
+        }
+        const rawDelegation = await this.getCachedDelegation(userDid);
+        if (!rawDelegation) {
+            this.logger.debug(`[UCAN] No cached delegation for ${userDid}, skipping invocation`);
+            return null;
+        }
+        // Check invocation cache (skipped for replay-protected services)
+        const cacheKey = `${INVOCATION_CACHE_PREFIX}${userDid}:${serviceDid}`;
+        if (!opts.skipCache) {
+            const cached = await this.cacheManager.get(cacheKey);
+            if (cached && cached.expiresAt > Date.now() / 1000) {
+                this.logger.debug(`[UCAN] Using cached invocation for ${userDid} → ${serviceDid}`);
+                return cached.invocation;
+            }
+        }
+        try {
+            const { signer } = await signerFromMnemonic(this.signingMnemonic, this.oracleDid);
+            const delegation = await parseDelegation(rawDelegation);
+            // Invocation TTL = min(1 hour, delegation expiration), whichever comes first
+            const nowSeconds = Math.floor(Date.now() / 1000);
+            const delegationExp = typeof delegation.expiration === 'number' &&
+                isFinite(delegation.expiration)
+                ? delegation.expiration
+                : null;
+            const maxExp = nowSeconds + MAX_INVOCATION_TTL_SECONDS;
+            const expirationSeconds = delegationExp
+                ? Math.min(maxExp, delegationExp)
+                : maxExp;
+            const invocation = await createInvocation({
+                issuer: signer,
+                audience: serviceDid,
+                capability: { can: '*', with: resource },
+                proofs: [delegation],
+                expiration: expirationSeconds,
+            });
+            const serialized = await serializeInvocation(invocation);
+            // Cache the invocation for its full lifetime (unless caller opted out)
+            const ttlMs = (expirationSeconds - nowSeconds) * 1000;
+            if (!opts.skipCache && ttlMs > 0) {
+                await this.cacheManager.set(cacheKey, { invocation: serialized, expiresAt: expirationSeconds }, ttlMs);
+                this.logger.debug(`[UCAN] Cached invocation for ${userDid} → ${serviceDid} (TTL: ${expirationSeconds - nowSeconds}s)`);
+            }
+            this.logger.debug(`[UCAN] Created invocation: iss=${this.oracleDid} aud=${serviceDid} user=${userDid}`);
+            return serialized;
+        }
+        catch (error) {
+            this.logger.warn(`[UCAN] Failed to create service invocation: ${error instanceof Error ? error.message : String(error)}`);
+            return null;
+        }
+    }
+    /**
+     * Mint a UCAN invocation from a directly-supplied delegation CAR (rather
+     * than the per-user cached one used by {@link createServiceInvocation}).
+     *
+     * Use this when the caller already holds the user's signed delegation in
+     * hand — typically because they read it from a flow's Y.Doc by CID — and
+     * wants to mint a freshly-targeted invocation against a specific service
+     * route. The delegation MUST already name this oracle as its audience; the
+     * call fails loudly if it doesn't, since a delegation pointing at someone
+     * else can't legitimately be re-used by us.
+     *
+     * Each protected service call should use a freshly minted invocation —
+     * services typically track invocation CIDs to enforce single-use replay
+     * protection. Re-call this method before every protected request.
+     *
+     * @param delegationCar Base64-encoded delegation CAR (the user → oracle
+     *   delegation signed in the editor)
+     * @param serviceUrl URL of the target service — used to resolve the did:web
+     *   audience by fetching `<serviceUrl>/.well-known/did.json`
+     * @param capability The exact capability the service requires for this
+     *   route, e.g. `{ can: 'service/action', with: 'ixo:service' }`. Defined
+     *   by the target service; must match what its requireAuth middleware
+     *   expects.
+     * @param options.maxTtlSeconds Max invocation lifetime; clamped to the
+     *   delegation's own expiration. Default 60s — invocations are typically
+     *   single-use so a long TTL is unnecessary and just widens the replay
+     *   window.
+     *
+     * @returns Base64-encoded invocation CAR, or `{ error }` describing why it
+     *   failed (so the caller can surface a useful message to the agent).
+     */
+    async createInvocationFromDelegation(delegationCar, serviceUrl, capability, options = {}) {
+        if (!this.signingMnemonic || !this.oracleDid) {
+            return {
+                error: 'Oracle has no signing key configured — set SERVICE_ED25519_MNEMONIC',
+            };
+        }
+        if (!delegationCar || typeof delegationCar !== 'string') {
+            return { error: 'delegationCar (base64 CAR) is required' };
+        }
+        if (!capability ||
+            typeof capability.can !== 'string' ||
+            typeof capability.with !== 'string') {
+            return { error: 'capability { can, with } is required' };
+        }
+        const serviceDid = await this.resolveServiceDid(serviceUrl);
+        if (!serviceDid) {
+            return {
+                error: `Could not resolve worker DID via ${serviceUrl}/.well-known/did.json`,
+            };
+        }
+        try {
+            const { signer } = await signerFromMnemonic(this.signingMnemonic, this.oracleDid);
+            let delegation;
+            try {
+                delegation = await parseDelegation(delegationCar);
+            }
+            catch (err) {
+                return {
+                    error: `Could not parse delegation CAR: ${err instanceof Error ? err.message : String(err)}`,
+                };
+            }
+            // Validate the delegation actually targets this oracle. If the user
+            // delegated to someone else, this oracle is not the intended issuer of
+            // invocations on top of it — fail loudly rather than mint a useless
+            // invocation that the worker would reject.
+            const delegationAudience = delegation.audience?.did?.();
+            if (delegationAudience && delegationAudience !== this.oracleDid) {
+                return {
+                    error: `Delegation audience (${delegationAudience}) does not match this oracle DID (${this.oracleDid})`,
+                };
+            }
+            // Clamp TTL: never longer than the delegation's own expiration, and
+            // capped at maxTtlSeconds (default 60s — single-use replay protection
+            // means we don't gain anything from a longer window).
+            const nowSeconds = Math.floor(Date.now() / 1000);
+            const requestedTtl = options.maxTtlSeconds ?? 60;
+            const delegationExp = typeof delegation.expiration === 'number' &&
+                isFinite(delegation.expiration)
+                ? delegation.expiration
+                : null;
+            let expirationSeconds = nowSeconds + requestedTtl;
+            if (delegationExp !== null) {
+                if (delegationExp <= nowSeconds) {
+                    return {
+                        error: `Delegation expired at ${new Date(delegationExp * 1000).toISOString()}`,
+                    };
+                }
+                expirationSeconds = Math.min(expirationSeconds, delegationExp);
+            }
+            const invocation = await createInvocation({
+                issuer: signer,
+                audience: serviceDid,
+                capability: {
+                    can: capability.can,
+                    with: capability.with,
+                },
+                proofs: [delegation],
+                expiration: expirationSeconds,
+            });
+            const serialized = await serializeInvocation(invocation);
+            this.logger.debug(`[UCAN] Minted invocation iss=${this.oracleDid} aud=${serviceDid} can=${capability.can} ttl=${expirationSeconds - nowSeconds}s`);
+            return { invocation: serialized };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            this.logger.warn(`[UCAN] mint failed: ${message}`);
+            return { error: `Failed to mint invocation: ${message}` };
+        }
+    }
+    // ============================================================================
+    // MCP tool validation (existing)
+    // ============================================================================
+    requiresAuth(serverName, toolName) {
+        return requiresUCANAuth(this.config, serverName, toolName);
+    }
+    async validateMCPInvocation(serverName, toolName, invocationData) {
+        try {
+            const invocationBytes = typeof invocationData === 'string'
+                ? Buffer.from(invocationData, 'base64')
+                : invocationData;
+            if (invocationBytes.length === 0) {
+                return { valid: false, error: 'Empty invocation data' };
+            }
+            const crypto = await import('node:crypto');
+            const hash = crypto
+                .createHash('sha256')
+                .update(invocationBytes)
+                .digest('hex');
+            const pseudoCid = `bafy${hash.slice(0, 52)}`;
+            if (await this.invocationStore.has(pseudoCid)) {
+                return {
+                    valid: false,
+                    error: 'Invocation has already been used (replay attack prevented)',
+                };
+            }
+            const requiredCapability = buildRequiredCapability(this.config, serverName, toolName);
+            this.logger.log(`UCAN validation for ${serverName}/${toolName} - Required capability: ${requiredCapability.can} on ${requiredCapability.with}`);
+            this.logger.warn(`UCAN validation is in placeholder mode. Full ucanto validation will be enabled once @ixo/ucan is built.`);
+            await this.invocationStore.add(pseudoCid);
+            return { valid: true, invokerDid: 'placeholder:invoker' };
+        }
+        catch (error) {
+            this.logger.error(`UCAN validation error: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            return {
+                valid: false,
+                error: `Validation error: ${error instanceof Error ? error.message : 'Unknown error'}`,
+            };
+        }
+    }
+    getRequiredCapabilityURI(serverName, toolName) {
+        return createMCPResourceURI(this.config.oracleDid, serverName, toolName);
+    }
+    getOracleDid() {
+        return this.config.oracleDid;
+    }
+    getRootIssuers() {
+        return this.config.rootIssuers;
+    }
+};
+UcanService = UcanService_1 = __decorate([
+    Injectable(),
+    __param(1, Inject(CACHE_MANAGER)),
+    __metadata("design:paramtypes", [ConfigService, Function])
+], UcanService);
+export { UcanService };

package/dist/modules/ws/emitter.d.ts

@@ -0,0 +1,12 @@
+import { type AllEvents } from '@ixo/oracles-events';
+import { EventEmitter } from 'node:events';
+export declare const WS_SERVICE_EVENT_NAME = "wsService";
+/**
+ * Cross-module event channel: graph nodes call `wsEmitter.emit(sessionId, event)`,
+ * the WS service listens for `WS_SERVICE_EVENT_NAME` and fans out to sockets.
+ */
+export declare class Emitter extends EventEmitter {
+    emit(_sessionId: string, event: AllEvents): boolean;
+}
+export declare const wsEmitter: Emitter;
+//# sourceMappingURL=emitter.d.ts.map

package/dist/modules/ws/emitter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emitter.d.ts","sourceRoot":"","sources":["../../../src/modules/ws/emitter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAEjD;;;GAGG;AACH,qBAAa,OAAQ,SAAQ,YAAY;IAC9B,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO;CAG7D;AAED,eAAO,MAAM,SAAS,SAAgB,CAAC"}

package/dist/modules/ws/emitter.js

@@ -0,0 +1,12 @@
+import { EventEmitter } from 'node:events';
+export const WS_SERVICE_EVENT_NAME = 'wsService';
+/**
+ * Cross-module event channel: graph nodes call `wsEmitter.emit(sessionId, event)`,
+ * the WS service listens for `WS_SERVICE_EVENT_NAME` and fans out to sockets.
+ */
+export class Emitter extends EventEmitter {
+    emit(_sessionId, event) {
+        return super.emit(WS_SERVICE_EVENT_NAME, event);
+    }
+}
+export const wsEmitter = new Emitter();

package/dist/modules/ws/ws.gateway.d.ts

@@ -0,0 +1,34 @@
+import { ConfigService } from '@nestjs/config';
+import { type OnGatewayConnection, type OnGatewayDisconnect, type OnGatewayInit } from '@nestjs/websockets';
+import { Server, Socket } from 'socket.io';
+import { UcanService } from '../ucan/ucan.service.js';
+import { WsService } from './ws.service.js';
+export declare class WsGateway implements OnGatewayConnection, OnGatewayDisconnect, OnGatewayInit {
+    private readonly wsService;
+    private readonly configService;
+    private readonly ucanService?;
+    server: Server;
+    private readonly logger;
+    constructor(wsService: WsService, configService: ConfigService, ucanService?: UcanService | undefined);
+    afterInit(): void;
+    handleConnection(client: Socket): Promise<void>;
+    handleDisconnect(client: Socket): void;
+    handlePing(client: Socket): void;
+    handleStatus(client: Socket): void;
+    /**
+     * Forward a tool/action result back to LangGraph via the root event emitter.
+     */
+    private handleFrontendToolResult;
+    handleToolResult(client: Socket, data: {
+        toolCallId: string;
+        result: unknown;
+        error?: string;
+    }): void;
+    handleActionCallResult(client: Socket, data: {
+        sessionId: string;
+        toolCallId: string;
+        result: unknown;
+    }): void;
+    handleListEvents(client: Socket): void;
+}
+//# sourceMappingURL=ws.gateway.d.ts.map

package/dist/modules/ws/ws.gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws.gateway.d.ts","sourceRoot":"","sources":["../../../src/modules/ws/ws.gateway.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAML,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,qBAMa,SACX,YAAW,mBAAmB,EAAE,mBAAmB,EAAE,aAAa;IAQhE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAClB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAP3C,MAAM,EAAG,MAAM,CAAC;IAEhB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;gBAGlC,SAAS,EAAE,SAAS,EACpB,aAAa,EAAE,aAAa,EAChB,WAAW,CAAC,EAAE,WAAW,YAAA;IAGxD,SAAS,IAAI,IAAI;IAKX,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmFrD,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAgBtC,UAAU,CAAoB,MAAM,EAAE,MAAM,GAAG,IAAI;IAQnD,YAAY,CAAoB,MAAM,EAAE,MAAM,GAAG,IAAI;IAUrD;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAkChC,gBAAgB,CACK,MAAM,EAAE,MAAM,EAEjC,IAAI,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5D,IAAI;IAcP,sBAAsB,CACD,MAAM,EAAE,MAAM,EAEjC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAC/D,IAAI;IAaP,gBAAgB,CAAoB,MAAM,EAAE,MAAM,GAAG,IAAI;CA4B1D"}