@jasonews/agent-squad-gateway 1.0.0

package/dist/control-plane/credentials.js

@@ -0,0 +1,134 @@
+import { randomBytes, randomUUID } from 'node:crypto';
+import { constantTimeDigestMatch, decryptValue, digest, encryptValue } from '../security/crypto.js';
+const API_KEY = /^asqsk_([a-f0-9]{18})_([A-Za-z0-9_-]{43})$/;
+function toCredentialRecord(row) {
+    return {
+        id: row.id,
+        clientId: row.client_id,
+        name: row.name,
+        prefix: row.prefix,
+        createdAt: row.created_at,
+        expiresAt: row.expires_at,
+        revokedAt: row.revoked_at,
+        lastUsedAt: row.last_used_at,
+        rotatedFrom: row.rotated_from,
+    };
+}
+export class CredentialService {
+    db;
+    masterKey;
+    constructor(db, masterKey) {
+        this.db = db;
+        this.masterKey = masterKey;
+    }
+    create(clientId, name, expiresAt = null) {
+        return this.createCredential(clientId, name, null, expiresAt);
+    }
+    list(clientId) {
+        const rows = clientId === undefined
+            ? this.db.prepare(`
+          SELECT id, client_id, name, prefix, created_at, expires_at, revoked_at, last_used_at, rotated_from
+          FROM credentials
+          ORDER BY created_at DESC, rowid DESC
+        `).all()
+            : this.db.prepare(`
+          SELECT id, client_id, name, prefix, created_at, expires_at, revoked_at, last_used_at, rotated_from
+          FROM credentials
+          WHERE client_id = ?
+          ORDER BY created_at DESC, rowid DESC
+        `).all(clientId);
+        return rows.map(toCredentialRecord);
+    }
+    authenticate(apiKey) {
+        const parsed = API_KEY.exec(apiKey);
+        if (!parsed)
+            return null;
+        const keyId = parsed[1];
+        if (!keyId)
+            return null;
+        const credential = this.db.prepare(`
+      SELECT credentials.id, credentials.client_id, credentials.prefix, credentials.digest,
+             credentials.expires_at, credentials.revoked_at, clients.status AS client_status
+      FROM credentials
+      JOIN clients ON clients.id = credentials.client_id
+      WHERE credentials.key_id = ?
+    `).get(keyId);
+        if (!credential || !constantTimeDigestMatch(apiKey, credential.digest))
+            return null;
+        const now = new Date().toISOString();
+        if (credential.client_status !== 'active'
+            || credential.revoked_at !== null
+            || (credential.expires_at !== null && credential.expires_at <= now)) {
+            return null;
+        }
+        const result = this.db.prepare(`
+      UPDATE credentials
+      SET last_used_at = ?
+      WHERE id = ?
+        AND revoked_at IS NULL
+        AND (expires_at IS NULL OR expires_at > ?)
+        AND EXISTS (SELECT 1 FROM clients WHERE id = credentials.client_id AND status = 'active')
+    `).run(now, credential.id, now);
+        if (result.changes !== 1)
+            return null;
+        return {
+            credentialId: credential.id,
+            clientId: credential.client_id,
+            prefix: credential.prefix,
+        };
+    }
+    reveal(id) {
+        const credential = this.db.prepare(`
+      SELECT ciphertext, nonce, auth_tag FROM credentials WHERE id = ?
+    `).get(id);
+        if (!credential)
+            throw new Error('credential_not_found');
+        return decryptValue({
+            ciphertext: credential.ciphertext,
+            nonce: credential.nonce,
+            authTag: credential.auth_tag,
+        }, this.masterKey);
+    }
+    revoke(id) {
+        const result = this.db.prepare(`
+      UPDATE credentials SET revoked_at = ? WHERE id = ? AND revoked_at IS NULL
+    `).run(new Date().toISOString(), id);
+        if (result.changes === 0)
+            throw new Error('credential_not_found');
+    }
+    rotate(id, name, expiresAt = null) {
+        const createReplacement = this.db.transaction(() => {
+            const original = this.db.prepare('SELECT client_id FROM credentials WHERE id = ? AND revoked_at IS NULL').get(id);
+            if (!original)
+                throw new Error('credential_not_found');
+            const replacement = this.createCredential(original.client_id, name, id, expiresAt);
+            const revoked = this.db.prepare(`
+        UPDATE credentials SET revoked_at = ? WHERE id = ? AND revoked_at IS NULL
+      `).run(new Date().toISOString(), id);
+            if (revoked.changes !== 1)
+                throw new Error('credential_not_found');
+            return replacement;
+        });
+        return createReplacement();
+    }
+    createCredential(clientId, name, rotatedFrom, expiresAt) {
+        const keyId = randomBytes(9).toString('hex');
+        const secret = randomBytes(32).toString('base64url');
+        const apiKey = `asqsk_${keyId}_${secret}`;
+        const envelope = encryptValue(apiKey, this.masterKey);
+        const created = {
+            id: `credential_${randomUUID()}`,
+            clientId,
+            prefix: `asqsk_${keyId}`,
+            apiKey,
+        };
+        this.db.prepare(`
+      INSERT INTO credentials (
+        id, key_id, client_id, name, prefix, digest, ciphertext, nonce, auth_tag,
+        created_at, expires_at, rotated_from
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(created.id, keyId, clientId, name, created.prefix, digest(apiKey), envelope.ciphertext, envelope.nonce, envelope.authTag, new Date().toISOString(), expiresAt, rotatedFrom);
+        return created;
+    }
+}
+//# sourceMappingURL=credentials.js.map

package/dist/control-plane/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/control-plane/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGpG,MAAM,OAAO,GAAG,4CAA4C,CAAC;AAgC7D,SAAS,kBAAkB,CAAC,GAAkB;IAC5C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,YAAY;QAC5B,WAAW,EAAE,GAAG,CAAC,YAAY;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,iBAAiB;IACC;IAAgC;IAA7D,YAA6B,EAAa,EAAmB,SAAiB;QAAjD,OAAE,GAAF,EAAE,CAAW;QAAmB,cAAS,GAAT,SAAS,CAAQ;IAAG,CAAC;IAElF,MAAM,CAAC,QAAgB,EAAE,IAAY,EAAE,YAA2B,IAAI;QACpE,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,QAAiB;QACpB,MAAM,IAAI,GAAG,QAAQ,KAAK,SAAS;YACjC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAoB;;;;SAIlC,CAAC,CAAC,GAAG,EAAE;YACV,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAA0B;;;;;SAKxC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAErB,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACtC,CAAC;IAED,YAAY,CAAC,MAAc;QACzB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAA0B;;;;;;KAM3D,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACd,IAAI,CAAC,UAAU,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,aAAa,KAAK,QAAQ;eACpC,UAAU,CAAC,UAAU,KAAK,IAAI;eAC9B,CAAC,UAAU,CAAC,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;;;KAO9B,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEtC,OAAO;YACL,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,QAAQ,EAAE,UAAU,CAAC,SAAS;YAC9B,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,EAAU;QACf,MAAM,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAA0B;;KAE3D,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACX,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAEzD,OAAO,YAAY,CAAC;YAClB,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,OAAO,EAAE,UAAU,CAAC,QAAQ;SAC7B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,EAAU;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;KAE9B,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,CAAC,EAAU,EAAE,IAAY,EAAE,YAA2B,IAAI;QAC9D,MAAM,iBAAiB,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC9B,uEAAuE,CACxE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACV,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAEvD,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YACnF,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;OAE/B,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YACrC,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAEnE,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,OAAO,iBAAiB,EAAE,CAAC;IAC7B,CAAC;IAEO,gBAAgB,CACtB,QAAgB,EAChB,IAAY,EACZ,WAA0B,EAC1B,SAAwB;QAExB,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,SAAS,KAAK,IAAI,MAAM,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,OAAO,GAAsB;YACjC,EAAE,EAAE,cAAc,UAAU,EAAE,EAAE;YAChC,QAAQ;YACR,MAAM,EAAE,SAAS,KAAK,EAAE;YACxB,MAAM;SACP,CAAC;QAEF,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;KAKf,CAAC,CAAC,GAAG,CACJ,OAAO,CAAC,EAAE,EACV,KAAK,EACL,QAAQ,EACR,IAAI,EACJ,OAAO,CAAC,MAAM,EACd,MAAM,CAAC,MAAM,CAAC,EACd,QAAQ,CAAC,UAAU,EACnB,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,OAAO,EAChB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACxB,SAAS,EACT,WAAW,CACZ,CAAC;QAEF,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/control-plane/db.js

@@ -0,0 +1,33 @@
+import Database from 'better-sqlite3';
+import { mkdirSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { MIGRATION_V1, TARGET_VERSION } from './migrations.js';
+export class GatewayDb {
+    raw;
+    constructor(raw) {
+        this.raw = raw;
+    }
+    prepare(sql) {
+        return this.raw.prepare(sql);
+    }
+    transaction(fn) {
+        return this.raw.transaction(fn);
+    }
+    close() {
+        this.raw.close();
+    }
+}
+export function openGatewayDb(path) {
+    if (path !== ':memory:')
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const sqlite = new Database(path);
+    sqlite.pragma('foreign_keys = ON');
+    if (path !== ':memory:')
+        sqlite.pragma('journal_mode = WAL');
+    const current = sqlite.pragma('user_version', { simple: true });
+    if (current < 1)
+        sqlite.transaction(() => sqlite.exec(MIGRATION_V1))();
+    sqlite.pragma(`user_version = ${TARGET_VERSION}`);
+    return new GatewayDb(sqlite);
+}
+//# sourceMappingURL=db.js.map

package/dist/control-plane/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/control-plane/db.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAEtC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAE/D,MAAM,OAAO,SAAS;IACC;IAArB,YAAqB,GAAmB;QAAnB,QAAG,GAAH,GAAG,CAAgB;IAAG,CAAC;IAE5C,OAAO,CAAoD,GAAW;QACpE,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAoB,CAAC;IAClD,CAAC;IAED,WAAW,CAA0C,EAAK;QACxD,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAiB,CAAC;IAClD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,IAAI,KAAK,UAAU;QAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACnC,IAAI,IAAI,KAAK,UAAU;QAAE,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAW,CAAC;IAC1E,IAAI,OAAO,GAAG,CAAC;QAAE,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,CAAC,MAAM,CAAC,kBAAkB,cAAc,EAAE,CAAC,CAAC;IAClD,OAAO,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC"}

package/dist/control-plane/extensions.js

@@ -0,0 +1,59 @@
+function toExtensionRecord(row) {
+    return {
+        id: row.id,
+        version: row.version,
+        enabled: row.enabled === 1,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+    };
+}
+export class ExtensionRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    upsert(id, version, enabled) {
+        if (typeof id !== 'string' || id.trim().length === 0)
+            throw new Error('invalid_extension_id');
+        if (typeof version !== 'string' || version.trim().length === 0)
+            throw new Error('invalid_extension_version');
+        if (typeof enabled !== 'boolean')
+            throw new Error('invalid_extension_enabled');
+        const now = new Date().toISOString();
+        this.db.prepare(`
+      INSERT INTO extensions (id, version, enabled, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        version = excluded.version,
+        enabled = excluded.enabled,
+        updated_at = excluded.updated_at
+    `).run(id, version, enabled ? 1 : 0, now, now);
+        return this.getRequired(id);
+    }
+    setEnabled(id, enabled) {
+        if (typeof enabled !== 'boolean')
+            throw new Error('invalid_extension_enabled');
+        const result = this.db.prepare(`
+      UPDATE extensions SET enabled = ?, updated_at = ? WHERE id = ?
+    `).run(enabled ? 1 : 0, new Date().toISOString(), id);
+        if (result.changes !== 1)
+            throw new Error('extension_not_found');
+    }
+    list() {
+        return this.db.prepare(`
+      SELECT id, version, enabled, created_at, updated_at
+      FROM extensions
+      ORDER BY created_at DESC, rowid DESC
+    `).all().map(toExtensionRecord);
+    }
+    getRequired(id) {
+        const row = this.db.prepare(`
+      SELECT id, version, enabled, created_at, updated_at
+      FROM extensions WHERE id = ?
+    `).get(id);
+        if (!row)
+            throw new Error('extension_not_found');
+        return toExtensionRecord(row);
+    }
+}
+//# sourceMappingURL=extensions.js.map

package/dist/control-plane/extensions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extensions.js","sourceRoot":"","sources":["../../src/control-plane/extensions.ts"],"names":[],"mappings":"AAWA,SAAS,iBAAiB,CAAC,GAAiB;IAC1C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,CAAC;QAC1B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,mBAAmB;IACD;IAA7B,YAA6B,EAAa;QAAb,OAAE,GAAF,EAAE,CAAW;IAAG,CAAC;IAE9C,MAAM,CAAC,EAAU,EAAE,OAAe,EAAE,OAAgB;QAClD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9F,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC7G,IAAI,OAAO,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAE/E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;;;KAOf,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAE/C,OAAO,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,UAAU,CAAC,EAAU,EAAE,OAAgB;QACrC,IAAI,OAAO,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;KAE9B,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACnE,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CAAmB;;;;KAIxC,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAClC,CAAC;IAEO,WAAW,CAAC,EAAU;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAyB;;;KAGnD,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACX,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACjD,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/control-plane/grants.js

@@ -0,0 +1,107 @@
+import { hasCurrentCompatibleCapability, toInvocationTarget, } from './targets.js';
+function toGrantRecord(row) {
+    return {
+        clientId: row.client_id,
+        extensionId: row.extension_id,
+        targetId: row.target_id,
+        createdAt: row.created_at,
+    };
+}
+export class GrantRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    grant(clientId, extensionId, targetId) {
+        const target = this.findTarget(targetId);
+        if (!target)
+            throw new Error('target_not_found');
+        this.requireClient(clientId);
+        this.requireExtension(extensionId);
+        this.db.prepare(`
+      INSERT INTO grants (client_id, extension_id, target_id, created_at)
+      VALUES (?, ?, ?, ?)
+      ON CONFLICT(client_id, extension_id, target_id) DO NOTHING
+    `).run(clientId, extensionId, target.id, new Date().toISOString());
+    }
+    revoke(clientId, extensionId, targetId) {
+        const target = this.findTarget(targetId);
+        if (!target)
+            throw new Error('target_not_found');
+        this.db.prepare(`
+      DELETE FROM grants WHERE client_id = ? AND extension_id = ? AND target_id = ?
+    `).run(clientId, extensionId, target.id);
+    }
+    listForClient(clientId) {
+        return this.db.prepare(`
+      SELECT client_id, extension_id, target_id, created_at
+      FROM grants
+      WHERE client_id = ?
+      ORDER BY created_at DESC, rowid DESC
+    `).all(clientId).map(toGrantRecord);
+    }
+    authorize(clientId, extensionId, modelId) {
+        const row = this.db.prepare(`
+      SELECT
+        t.id, t.aliases_json, t.cli, t.native_model, t.reasoning_effort, t.enabled,
+        t.isolation_level, t.streaming_mode, t.tool_bridge, t.max_concurrency, t.max_queue,
+        t.queue_timeout_ms, t.run_timeout_ms, t.fixed_workspace, t.capability_version,
+        t.capability_verified_at, t.capability_json, t.capability_error, t.created_at, t.updated_at,
+        c.status AS client_status, e.enabled AS extension_enabled
+      FROM grants AS g
+      JOIN clients AS c ON c.id = g.client_id
+      JOIN extensions AS e ON e.id = g.extension_id
+      JOIN invocation_targets AS t ON t.id = g.target_id
+      WHERE g.client_id = ?
+        AND g.extension_id = ?
+        AND (
+          t.id = ?
+          OR EXISTS (
+            SELECT 1
+            FROM json_each(CASE WHEN json_valid(t.aliases_json) THEN t.aliases_json ELSE '[]' END)
+            WHERE value = ?
+          )
+        )
+      LIMIT 1
+    `).get(clientId, extensionId, modelId, modelId);
+        if (!row)
+            throw new Error('authorization_denied');
+        const target = toInvocationTarget(row);
+        if (row.client_status !== 'active'
+            || row.extension_enabled !== 1
+            || !target.enabled
+            || !hasCurrentCompatibleCapability(target)) {
+            throw new Error('authorization_denied');
+        }
+        return target;
+    }
+    findTarget(idOrAlias) {
+        const row = this.db.prepare(`
+      SELECT
+        id, aliases_json, cli, native_model, reasoning_effort, enabled,
+        isolation_level, streaming_mode, tool_bridge, max_concurrency, max_queue,
+        queue_timeout_ms, run_timeout_ms, fixed_workspace, capability_version,
+        capability_verified_at, capability_json, capability_error, created_at, updated_at
+      FROM invocation_targets
+      WHERE id = ?
+         OR EXISTS (
+           SELECT 1
+           FROM json_each(CASE WHEN json_valid(aliases_json) THEN aliases_json ELSE '[]' END)
+           WHERE value = ?
+         )
+      LIMIT 1
+    `).get(idOrAlias, idOrAlias);
+        return row ? toInvocationTarget(row) : null;
+    }
+    requireClient(id) {
+        const row = this.db.prepare('SELECT id FROM clients WHERE id = ?').get(id);
+        if (!row)
+            throw new Error('client_not_found');
+    }
+    requireExtension(id) {
+        const row = this.db.prepare('SELECT id FROM extensions WHERE id = ?').get(id);
+        if (!row)
+            throw new Error('extension_not_found');
+    }
+}
+//# sourceMappingURL=grants.js.map

package/dist/control-plane/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/control-plane/grants.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,GAEnB,MAAM,cAAc,CAAC;AActB,SAAS,aAAa,CAAC,GAAa;IAClC,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,EAAa;QAAb,OAAE,GAAF,EAAE,CAAW;IAAG,CAAC;IAE9C,KAAK,CAAC,QAAgB,EAAE,WAAmB,EAAE,QAAgB;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACjD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC7B,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACnC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;KAIf,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,CAAC,QAAgB,EAAE,WAAmB,EAAE,QAAgB;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACjD,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;KAEf,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,aAAa,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CAAqB;;;;;KAK1C,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACtC,CAAC;IAED,SAAS,CAAC,QAAgB,EAAE,WAAmB,EAAE,OAAe;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAwD;;;;;;;;;;;;;;;;;;;;;;KAsBlF,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAEhD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,GAAG,CAAC,aAAa,KAAK,QAAQ;eAC7B,GAAG,CAAC,iBAAiB,KAAK,CAAC;eAC3B,CAAC,MAAM,CAAC,OAAO;eACf,CAAC,8BAA8B,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,UAAU,CAAC,SAAiB;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAwC;;;;;;;;;;;;;;KAclE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7B,OAAO,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAEO,aAAa,CAAC,EAAU;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAA2B,qCAAqC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAChD,CAAC;IAEO,gBAAgB,CAAC,EAAU;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAA2B,wCAAwC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxG,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACnD,CAAC;CACF"}

package/dist/control-plane/idempotency.js

@@ -0,0 +1,132 @@
+import { createHash } from 'node:crypto';
+const METADATA_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+export class IdempotencyConflictError extends Error {
+    constructor() {
+        super('idempotency_conflict');
+    }
+}
+function sha256(value) {
+    return createHash('sha256').update(value, 'utf8').digest('hex');
+}
+function serializeCanonicalJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value)) {
+        return `[${value.map(serializeCanonicalJson).join(',')}]`;
+    }
+    const entries = Object.entries(value)
+        .sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)
+        .map(([key, child]) => `${JSON.stringify(key)}:${serializeCanonicalJson(child)}`);
+    return `{${entries.join(',')}}`;
+}
+export function canonicalizeRequest(value) {
+    const json = JSON.stringify(value);
+    if (json === undefined)
+        return 'null';
+    return serializeCanonicalJson(JSON.parse(json));
+}
+export class IdempotencyService {
+    db;
+    runs;
+    replay;
+    now;
+    metadataTtlMs;
+    constructor(db, runs, replay, options = {}) {
+        this.db = db;
+        this.runs = runs;
+        this.replay = replay;
+        this.now = options.now ?? Date.now;
+        this.metadataTtlMs = options.metadataTtlMs ?? METADATA_TTL_MS;
+    }
+    begin(input) {
+        const keyDigest = sha256(`${input.clientId}\0${input.endpoint}\0${input.key}`);
+        const requestHash = sha256(`${input.endpoint}\0${canonicalizeRequest(input.request)}`);
+        const decide = this.db.transaction(() => {
+            const existing = this.get(input.clientId, keyDigest);
+            if (existing && Date.parse(existing.expires_at) <= this.now()) {
+                this.db.prepare('DELETE FROM idempotency_keys WHERE client_id = ? AND key_digest = ?')
+                    .run(input.clientId, keyDigest);
+            }
+            else if (existing) {
+                if (existing.request_hash !== requestHash)
+                    throw new IdempotencyConflictError();
+                const base = this.decisionBase(existing);
+                if (!this.replay.available(existing.run_id)) {
+                    return { ...base, type: 'unavailable' };
+                }
+                return {
+                    ...base,
+                    type: existing.status === 'active' ? 'active_duplicate' : 'completed_replay',
+                };
+            }
+            this.runs.create(input.run, input.runId);
+            this.db.prepare(`
+        INSERT INTO idempotency_keys (
+          client_id, key_digest, request_hash, run_id, response_id, status, expires_at
+        ) VALUES (?, ?, ?, ?, ?, 'active', ?)
+      `).run(input.clientId, keyDigest, requestHash, input.runId, input.responseId ?? null, new Date(this.now() + this.metadataTtlMs).toISOString());
+            this.replay.open(input.runId);
+            return {
+                type: 'owner',
+                runId: input.runId,
+                responseId: input.responseId ?? null,
+                clientId: input.clientId,
+                keyDigest,
+            };
+        });
+        return decide();
+    }
+    async attach(decision) {
+        if (decision.type === 'owner' || decision.type === 'unavailable') {
+            throw new Error(decision.type === 'unavailable' ? 'idempotency_replay_unavailable' : 'idempotency_owner_cannot_attach');
+        }
+        const chunks = [];
+        for await (const chunk of this.replay.subscribe(decision.runId))
+            chunks.push(chunk);
+        return chunks;
+    }
+    complete(decision, serialized) {
+        this.settle(decision, 'completed', serialized);
+    }
+    fail(decision, serialized) {
+        this.settle(decision, 'failed', serialized);
+        const run = this.runs.get(decision.runId);
+        if (run?.status === 'queued') {
+            this.runs.markQueuedFinished(decision.runId, 'failed', 'idempotency_owner_failed');
+        }
+    }
+    settle(decision, status, serialized) {
+        if (decision.type !== 'owner')
+            throw new Error('idempotency_not_owner');
+        const result = this.db.prepare(`
+      UPDATE idempotency_keys SET status = ?
+      WHERE client_id = ? AND key_digest = ? AND run_id = ? AND status = 'active'
+    `).run(status, decision.clientId, decision.keyDigest, decision.runId);
+        if (result.changes !== 1)
+            throw new Error('invalid_idempotency_transition');
+        if (this.replay.available(decision.runId)) {
+            try {
+                this.replay.publish(decision.runId, serialized);
+                this.replay.complete(decision.runId);
+            }
+            catch {
+                this.replay.evict(decision.runId);
+            }
+        }
+    }
+    get(clientId, keyDigest) {
+        return this.db.prepare(`
+      SELECT client_id, key_digest, request_hash, run_id, response_id, status, expires_at
+      FROM idempotency_keys WHERE client_id = ? AND key_digest = ?
+    `).get(clientId, keyDigest);
+    }
+    decisionBase(row) {
+        return {
+            runId: row.run_id,
+            responseId: row.response_id,
+            clientId: row.client_id,
+            keyDigest: row.key_digest,
+        };
+    }
+}
+//# sourceMappingURL=idempotency.js.map

package/dist/control-plane/idempotency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../../src/control-plane/idempotency.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAMzC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAiCjD,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD;QACE,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAChC,CAAC;CACF;AAOD,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC5D,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7D,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACnE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACtC,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,OAAO,kBAAkB;IAKV;IACA;IACA;IANF,GAAG,CAAe;IAClB,aAAa,CAAS;IAEvC,YACmB,EAAa,EACb,IAAkE,EAClE,MAAoB,EACrC,UAAqC,EAAE;QAHtB,OAAE,GAAF,EAAE,CAAW;QACb,SAAI,GAAJ,IAAI,CAA8D;QAClE,WAAM,GAAN,MAAM,CAAc;QAGrC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,KAA4B;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,KAAK,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAwB,EAAE;YAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACrD,IAAI,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC9D,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,qEAAqE,CAAC;qBACnF,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACpC,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,IAAI,QAAQ,CAAC,YAAY,KAAK,WAAW;oBAAE,MAAM,IAAI,wBAAwB,EAAE,CAAC;gBAChF,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACzC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5C,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;gBAC1C,CAAC;gBACD,OAAO;oBACL,GAAG,IAAI;oBACP,IAAI,EAAE,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB;iBAC7E,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;OAIf,CAAC,CAAC,GAAG,CACJ,KAAK,CAAC,QAAQ,EACd,SAAS,EACT,WAAW,EACX,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,UAAU,IAAI,IAAI,EACxB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CACxD,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;gBACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS;aACV,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,EAAE,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAA6B;QACxC,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC;QAC1H,CAAC;QACD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,QAAQ,CAAC,QAA6B,EAAE,UAAkB;QACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,CAAC,QAA6B,EAAE,UAAkB;QACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,GAAG,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,0BAA0B,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,QAA6B,EAAE,MAA8B,EAAE,UAAkB;QAC9F,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;KAG9B,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;gBAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,GAAG,CAAC,QAAgB,EAAE,SAAiB;QAC7C,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CAAmC;;;KAGxD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC9B,CAAC;IAEO,YAAY,CAAC,GAAmB;QACtC,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,MAAM;YACjB,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,SAAS,EAAE,GAAG,CAAC,UAAU;SAC1B,CAAC;IACJ,CAAC;CACF"}

package/dist/control-plane/migrations.js

@@ -0,0 +1,133 @@
+export const MIGRATION_V1 = `
+CREATE TABLE core_connection (
+  singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+  base_url TEXT NOT NULL,
+  last_status TEXT,
+  last_version TEXT,
+  last_checked_at TEXT
+);
+
+CREATE TABLE extensions (
+  id TEXT PRIMARY KEY,
+  version TEXT NOT NULL,
+  enabled INTEGER NOT NULL DEFAULT 0,
+  config_json TEXT NOT NULL DEFAULT '{}',
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE TABLE invocation_targets (
+  id TEXT PRIMARY KEY,
+  aliases_json TEXT NOT NULL DEFAULT '[]',
+  cli TEXT NOT NULL,
+  native_model TEXT NOT NULL,
+  reasoning_effort TEXT,
+  enabled INTEGER NOT NULL DEFAULT 0,
+  isolation_level TEXT NOT NULL CHECK (isolation_level IN ('strict','best_effort')),
+  streaming_mode TEXT NOT NULL CHECK (streaming_mode IN ('native','none')),
+  tool_bridge TEXT NOT NULL CHECK (tool_bridge IN ('structured_output','none')),
+  max_concurrency INTEGER NOT NULL DEFAULT 1 CHECK (max_concurrency > 0),
+  max_queue INTEGER NOT NULL DEFAULT 8 CHECK (max_queue >= 0),
+  queue_timeout_ms INTEGER NOT NULL DEFAULT 300000 CHECK (queue_timeout_ms > 0),
+  run_timeout_ms INTEGER CHECK (run_timeout_ms IS NULL OR run_timeout_ms > 0),
+  fixed_workspace TEXT,
+  capability_version TEXT,
+  capability_verified_at TEXT,
+  capability_json TEXT,
+  capability_error TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE TABLE clients (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL UNIQUE,
+  status TEXT NOT NULL CHECK (status IN ('active','disabled')),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE TABLE credentials (
+  id TEXT PRIMARY KEY,
+  key_id TEXT NOT NULL UNIQUE,
+  client_id TEXT NOT NULL REFERENCES clients(id) ON DELETE CASCADE,
+  name TEXT NOT NULL,
+  prefix TEXT NOT NULL,
+  digest TEXT NOT NULL,
+  ciphertext TEXT NOT NULL,
+  nonce TEXT NOT NULL,
+  auth_tag TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  expires_at TEXT,
+  revoked_at TEXT,
+  last_used_at TEXT,
+  rotated_from TEXT REFERENCES credentials(id)
+);
+
+CREATE TABLE grants (
+  client_id TEXT NOT NULL REFERENCES clients(id) ON DELETE CASCADE,
+  extension_id TEXT NOT NULL REFERENCES extensions(id) ON DELETE CASCADE,
+  target_id TEXT NOT NULL REFERENCES invocation_targets(id) ON DELETE CASCADE,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (client_id, extension_id, target_id)
+);
+
+CREATE TABLE runs (
+  id TEXT PRIMARY KEY,
+  client_id TEXT REFERENCES clients(id),
+  extension_id TEXT NOT NULL,
+  target_id TEXT NOT NULL,
+  endpoint TEXT NOT NULL,
+  status TEXT NOT NULL,
+  response_id TEXT,
+  native_session_id TEXT,
+  error_code TEXT,
+  queued_at TEXT NOT NULL,
+  started_at TEXT,
+  completed_at TEXT,
+  latency_ms INTEGER
+);
+
+CREATE TABLE response_sessions (
+  response_id TEXT PRIMARY KEY,
+  chain_id TEXT NOT NULL,
+  target_id TEXT NOT NULL,
+  native_session_id TEXT,
+  parent_response_id TEXT REFERENCES response_sessions(response_id),
+  child_response_id TEXT REFERENCES response_sessions(response_id),
+  workspace_path TEXT,
+  stored INTEGER NOT NULL,
+  state TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE TABLE idempotency_keys (
+  client_id TEXT NOT NULL REFERENCES clients(id) ON DELETE CASCADE,
+  key_digest TEXT NOT NULL,
+  request_hash TEXT NOT NULL,
+  run_id TEXT NOT NULL REFERENCES runs(id),
+  response_id TEXT,
+  status TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  PRIMARY KEY (client_id, key_digest)
+);
+
+CREATE TABLE admin_sessions (
+  token_hash TEXT PRIMARY KEY,
+  csrf_hash TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+
+CREATE INDEX idx_credentials_client ON credentials(client_id);
+CREATE INDEX idx_runs_created ON runs(queued_at DESC);
+CREATE INDEX idx_response_expiry ON response_sessions(expires_at);
+CREATE INDEX idx_response_chain ON response_sessions(chain_id);
+CREATE INDEX idx_idempotency_expiry ON idempotency_keys(expires_at);
+
+INSERT INTO core_connection(singleton, base_url) VALUES (1, 'http://127.0.0.1:28771');
+`;
+export const TARGET_VERSION = 1;
+//# sourceMappingURL=migrations.js.map

package/dist/control-plane/migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/control-plane/migrations.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkI3B,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC"}