@reefclaw/connect 0.1.0

package/assets/bridge/bridge.d.ts

@@ -0,0 +1,96 @@
+import type { OpenClawProvider } from './provider.js';
+import type { ConnectorConfig } from './types.js';
+export declare class Bridge {
+    private readonly provider;
+    private connector;
+    private readonly seqs;
+    private throttleBuffer;
+    private throttleTimer;
+    /**
+     * Bounded ring buffer of every frame this bridge has emitted to the relay.
+     * On a `reconcile` request the bridge populates `snapshot.gapFill` with
+     * everything the browser hasn't seen yet (per-channel `seq > lastSeq`).
+     * Defaults: 500 events × 4 channels × 5 min age cap. See
+     * event-replay-buffer.ts for the rationale.
+     */
+    private readonly replayBuffer;
+    /** Current local SKILL.md version (from frontmatter) */
+    private currentSkillVersion;
+    /** Last trading mode observed from either a tradingMode event or a
+     *  successful set_trading_mode outcome. Used by the skill-side ladder
+     *  check so the dashboard can be rejected quickly without a plugin
+     *  round-trip. `null` means "unknown yet" — the plugin is the authority. */
+    private lastKnownTradingMode;
+    private readonly listeners;
+    constructor(provider: OpenClawProvider, connectorConfig: ConnectorConfig);
+    /** Start the bridge: connect to relay + start provider */
+    start(): void;
+    /** Stop the bridge: disconnect + stop provider */
+    stop(): void;
+    private wireProviderEvents;
+    private addListener;
+    private unwireProviderEvents;
+    private emit;
+    /** Send a frame to the relay AND record it in the replay buffer.
+     *
+     *  Both writes happen unconditionally:
+     *    - replayBuffer.record() is the canonical wire-history; gapFill draws
+     *      from it on the next reconcile, even if this frame's wire send was
+     *      a no-op because the connector was disconnected.
+     *    - connector.sendEvent() internally checks readyState and silently
+     *      no-ops when the socket is closed (connector.ts:164), so calling it
+     *      during a disconnect is safe and we don't have to mirror the gate
+     *      here. */
+    private sendFrame;
+    /** Flush all buffered low-priority events (latest value per type).
+     *
+     *  Drains through sendFrame regardless of connector state — the replay
+     *  buffer is the authoritative record and must capture coalesced events
+     *  even when the link is down. The wire send inside sendFrame is a no-op
+     *  until the connector reconnects, at which point new events flow live and
+     *  the offline coalesced ones are available via gapFill on reconcile. */
+    private flushThrottleBuffer;
+    private startThrottleTimer;
+    private stopThrottleTimer;
+    private handleRequest;
+    private handleStateChange;
+    /** Today every authenticated session carries operator.write via the
+     *  relay-level Clerk token. This method exists as the enforcement seam —
+     *  a future PR can drop per-session roles in here without restructuring
+     *  the dispatcher. Returning true keeps current behavior identical. */
+    private hasOperatorWriteScope;
+    /** Handle a set_trading_mode request. Returns 'responded' if the handler
+     *  already wrote the response frame (e.g. on validation failure), otherwise
+     *  returns the structured outcome for the caller to wrap in a success
+     *  frame. Ladder validation runs here for fast dashboard feedback and
+     *  again in the plugin (defense in depth). */
+    private handleSetTradingMode;
+    /** Handle a set_exchange_credentials request. The secret value passes
+     *  through once and is never cached or logged; only a redacted fingerprint
+     *  appears in the audit trail. */
+    private handleSetExchangeCredentials;
+    /** Handle a test_exchange_credentials request — transient read-only
+     *  verification, nothing persisted. Same input validation + secret
+     *  redaction rules as set_exchange_credentials. */
+    private handleTestExchangeCredentials;
+    /** Handle a clear_exchange_credentials request. No input — the method
+     *  itself is the "yes I want this" signal; the webapp is expected to
+     *  gate this behind a confirmation dialog before calling. */
+    private handleClearExchangeCredentials;
+    /** Apply a SKILL.md update: verify signature (C1), write to workspace +
+     *  installed skill dir, clear session cache, notify agent. */
+    private applySkillUpdate;
+    /**
+     * Fetch the stored SKILL.md envelope from the relay's Durable-Object store
+     * and apply it. The DO store is writable exclusively through the
+     * ADMIN_SECRET-gated HTTP push (party.ts handleSkillPush) — pulling makes
+     * the STORE, not any WS frame, the trust anchor for OTA content. Refuses to
+     * downgrade below the local version (a stale relay copy must never clobber
+     * a newer local SKILL.md — prod incident 2026-05-13); an equal version
+     * re-applies (idempotent repair for a re-push). Returns null when the relay
+     * has nothing stored; throws on transport error.
+     */
+    private pullAndApplySkillUpdate;
+    /** Check relay's latest SKILL.md version against local and auto-update if stale */
+    private handleConnectAck;
+}