@sift-wiki/conductor 0.0.0 → 0.2.0-beta.1

package/dist/localApi/contracts.js

@@ -0,0 +1,173 @@
+import { z } from "zod";
+import { CONDUCTOR_VERSION, PROTOCOL_VERSION } from "../version.js";
+import { userAuthorizationStatusSchema } from "../userAuth/types.js";
+export const localPairingStatusSchema = z.discriminatedUnion("paired", [
+    z.object({ paired: z.literal(false) }).strict(),
+    z.object({
+        paired: z.literal(true),
+        apiBaseUrl: z.url(),
+        conductorId: z.string().min(1).optional(),
+        displayName: z.string().min(1),
+        protocolVersion: z.string().min(1),
+    }).strict(),
+]);
+export const localHealthSchema = z.object({
+    ok: z.literal(true),
+    version: z.string().min(1),
+    protocolVersion: z.string().min(1),
+}).strict();
+export const runtimeServiceStatusSchema = z.object({
+    state: z.enum(["stopped", "starting", "running", "stopping", "failed"]),
+    startedAt: z.string().optional(),
+    stoppedAt: z.string().optional(),
+    lastResult: z.discriminatedUnion("status", [
+        z.object({ status: z.literal("idle") }).strict(),
+        z.object({ status: z.literal("completed"), runId: z.string() }).strict(),
+        z.object({ status: z.literal("cancelled"), runId: z.string() }).strict(),
+        z.object({ status: z.literal("failed"), runId: z.string() }).strict(),
+    ]).optional(),
+    lastErrorMessage: z.string().optional(),
+}).strict();
+export const providerAgentViewSchema = z.object({
+    localKey: z.string().min(1),
+    displayName: z.string().min(1),
+    provider: z.enum(["codex", "claude-code"]),
+    workspaceName: z.string().min(1),
+    accessProfile: z.enum(["inspect", "workspace"]),
+    enabled: z.boolean(),
+    status: z.enum(["ready", "error"]),
+    message: z.string(),
+    hint: z.string().optional(),
+    remediation: z.enum(["install", "login", "upgrade", "select-folder", "resume", "retry"]).optional(),
+    providerVersion: z.string().optional(),
+}).strict();
+export const selectedFolderSchema = z.object({
+    token: z.string().min(1),
+    name: z.string().min(1),
+}).strict();
+export const providerDraftStatusSchema = z.object({
+    status: z.enum(["ready", "error"]),
+    message: z.string(),
+    hint: z.string().optional(),
+    remediation: z.enum(["install", "login", "upgrade", "select-folder", "resume", "retry"]).optional(),
+    providerVersion: z.string().optional(),
+}).strict();
+export const providerInstallPlanSchema = z.object({
+    provider: z.enum(["codex", "claude-code"]),
+    title: z.string(),
+    source: z.string(),
+    command: z.string().optional(),
+    officialUrl: z.url(),
+}).strict();
+export const providerLoginResultSchema = z.object({
+    ok: z.boolean(),
+    message: z.string(),
+}).strict();
+export const localSessionStatusSchema = z.object({
+    authenticated: z.literal(true),
+    csrfToken: z.string().min(1),
+    expiresAt: z.iso.datetime(),
+}).strict();
+export const localPairRequestSchema = z.object({
+    apiBaseUrl: z.url(),
+    code: z.string().min(1).max(500),
+    displayName: z.string().trim().min(1).max(100),
+}).strict();
+export const localAuthorizedPairRequestSchema = z.object({
+    displayName: z.string().trim().min(1).max(100),
+}).strict();
+export const localUserAuthorizationBeginSchema = z.object({
+    apiBaseUrl: z.url().optional(),
+    deviceLabel: z.string().trim().min(1).max(100).optional(),
+}).strict();
+export const localProviderDraftSchema = z.object({
+    provider: z.enum(["codex", "claude-code"]),
+    displayName: z.string().trim().min(1).max(100),
+    folderToken: z.string().min(1).max(500),
+    accessProfile: z.enum(["inspect", "workspace"]),
+    model: z.string().trim().min(1).max(200).optional(),
+}).strict();
+export const localAgentUpdateSchema = z.object({
+    localKey: z.string().min(1).max(500),
+    displayName: z.string().trim().min(1).max(100),
+    accessProfile: z.enum(["inspect", "workspace"]),
+    folderToken: z.string().min(1).max(500).optional(),
+}).strict();
+export const localAgentPauseSchema = z.object({
+    localKey: z.string().min(1).max(500),
+    paused: z.boolean(),
+}).strict();
+export const localAgentKeySchema = z.object({
+    localKey: z.string().min(1).max(500),
+}).strict();
+export const localProviderSchema = z.object({
+    provider: z.enum(["codex", "claude-code"]),
+}).strict();
+export function localHealth() {
+    return { ok: true, version: CONDUCTOR_VERSION, protocolVersion: PROTOCOL_VERSION };
+}
+export function createLocalControllerApi(controller, userAuthorization = unavailableUserAuthorization, work = unavailableWorkConsole, authorizedPairing = unavailableAuthorizedPairing, localDiagnostics = unavailableLocalDiagnostics) {
+    return {
+        health: () => Promise.resolve(localHealth()),
+        pairedStatus: async () => localStatusFromDesktop(await controller.pairedStatus()),
+        pair: async (input) => localStatusFromDesktop(await controller.pair(input)),
+        pairAuthorized: async (displayName) => localStatusFromDesktop(await authorizedPairing.pair(displayName)),
+        logout: async () => localStatusFromDesktop(await controller.logout()),
+        listAgents: () => controller.listAgents(),
+        selectFolder: () => controller.selectFolder(),
+        inspectDraft: (input) => controller.inspectDraft(input),
+        login: (input) => controller.login(input),
+        verifyAndAdd: (input) => controller.verifyAndAdd(input),
+        updateAgent: (input) => controller.updateAgent(input),
+        pauseAgent: (localKey, paused) => controller.pauseAgent(localKey, paused),
+        removeAgent: (localKey) => controller.removeAgent(localKey),
+        installPlan: (provider) => controller.installPlan(provider),
+        openOfficialProviderPage: (provider) => controller.openOfficialProviderPage(provider),
+        runtimeStatus: () => controller.runtimeStatus(),
+        startRuntime: () => controller.startRuntime(),
+        stopRuntime: () => controller.stopRuntime(),
+        clearLocalDiagnostics: async () => { await localDiagnostics.clear(); },
+        userAuthorizationStatus: async () => userAuthorizationStatusSchema.parse(await userAuthorization.status()),
+        beginUserAuthorization: async (input) => userAuthorizationStatusSchema.parse(await userAuthorization.begin(input)),
+        signOutUser: async () => userAuthorizationStatusSchema.parse(await userAuthorization.signOut()),
+        workSnapshot: (input) => work.snapshot(input),
+        createTask: (input) => work.createTask(input),
+        updateTask: (input) => work.updateTask(input),
+        commentTask: (input) => work.comment(input),
+        dispatchTask: (input) => work.dispatch(input),
+        decideApproval: (input) => work.decideApproval(input),
+        cancelRun: (runId) => work.cancelRun(runId),
+    };
+}
+const unavailableUserAuthorization = {
+    status: () => Promise.resolve({ state: "signed_out", storageKind: "memory" }),
+    begin: () => Promise.reject(new Error("Sift user authorization is unavailable.")),
+    signOut: () => Promise.resolve({ state: "signed_out", storageKind: "memory" }),
+};
+const unavailableWorkConsole = {
+    snapshot: () => Promise.resolve({ state: "unauthorized", message: "Sign in to Sift to manage shared work.", refreshedAt: new Date().toISOString(), projects: [], agents: [], queue: [], activity: [] }),
+    createTask: () => Promise.reject(new Error("Sign in to Sift to manage shared work.")),
+    updateTask: () => Promise.reject(new Error("Sign in to Sift to manage shared work.")),
+    comment: () => Promise.reject(new Error("Sign in to Sift to manage shared work.")),
+    dispatch: () => Promise.reject(new Error("Sign in to Sift to manage shared work.")),
+    decideApproval: () => Promise.reject(new Error("Sign in to Sift to manage shared work.")),
+    cancelRun: () => Promise.reject(new Error("Sign in to Sift to manage shared work.")),
+};
+const unavailableAuthorizedPairing = {
+    pair: () => Promise.reject(new Error("Sign in to Sift before connecting this computer automatically.")),
+};
+const unavailableLocalDiagnostics = {
+    clear: () => undefined,
+};
+function localStatusFromDesktop(status) {
+    if (!status.paired)
+        return { paired: false };
+    return localPairingStatusSchema.parse({
+        paired: true,
+        apiBaseUrl: status.apiBaseUrl,
+        ...(status.conductorId === undefined ? {} : { conductorId: status.conductorId }),
+        displayName: status.displayName,
+        protocolVersion: status.protocolVersion,
+    });
+}
+//# sourceMappingURL=contracts.js.map

package/dist/localApi/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../src/localApi/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAgC,MAAM,sBAAsB,CAAC;AAqEnG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACrE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/C,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACvB,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE;QACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACzC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACnC,CAAC,CAAC,MAAM,EAAE;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACnC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;QACzC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QAChD,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACxE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACxE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;KACtE,CAAC,CAAC,QAAQ,EAAE;IACb,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnG,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnG,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;CACrB,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;IACf,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAC/C,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAC/C,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9C,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACrC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;CAC3C,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,UAAU,WAAW;IACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,UAA+B,EAC/B,oBAII,4BAA4B,EAChC,OAAwB,sBAAsB,EAC9C,oBAA2C,4BAA4B,EACvE,mBAAyC,2BAA2B;IAEpE,OAAO;QACL,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC5C,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,sBAAsB,CAAC,MAAM,UAAU,CAAC,YAAY,EAAE,CAAC;QACjF,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3E,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC,sBAAsB,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxG,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,sBAAsB,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC;QACrE,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE;QACzC,YAAY,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE;QAC7C,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC;QACvD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;QACzC,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC;QACvD,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC;QACrD,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;QACzE,WAAW,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC;QAC3D,WAAW,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC;QAC3D,wBAAwB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,wBAAwB,CAAC,QAAQ,CAAC;QACrF,aAAa,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE;QAC/C,YAAY,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE;QAC7C,WAAW,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE;QAC3C,qBAAqB,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACtE,uBAAuB,EAAE,KAAK,IAAI,EAAE,CAAC,6BAA6B,CAAC,KAAK,CAAC,MAAM,iBAAiB,CAAC,MAAM,EAAE,CAAC;QAC1G,sBAAsB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,6BAA6B,CAAC,KAAK,CAAC,MAAM,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClH,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,6BAA6B,CAAC,KAAK,CAAC,MAAM,iBAAiB,CAAC,OAAO,EAAE,CAAC;QAC/F,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC7C,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAC7C,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAC7C,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3C,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC7C,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;QACrD,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;KAC5C,CAAC;AACJ,CAAC;AAoBD,MAAM,4BAA4B,GAAG;IACnC,MAAM,EAAE,GAAqC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;IAC/G,KAAK,EAAE,GAAqC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACnH,OAAO,EAAE,GAAqC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;CACjH,CAAC;AAEF,MAAM,sBAAsB,GAAoB;IAC9C,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,wCAAwC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACvM,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACrF,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACrF,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAClF,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACnF,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACzF,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;CACrF,CAAC;AAEF,MAAM,4BAA4B,GAA0B;IAC1D,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;CACxG,CAAC;AAEF,MAAM,2BAA2B,GAAyB;IACxD,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;CACvB,CAAC;AAEF,SAAS,sBAAsB,CAAC,MAAgE;IAC9F,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC7C,OAAO,wBAAwB,CAAC,KAAK,CAAC;QACpC,MAAM,EAAE,IAAI;QACZ,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QAChF,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;KACxC,CAAC,CAAC;AACL,CAAC"}

package/dist/localApi/server.d.ts

@@ -0,0 +1,20 @@
+import type { ConductorLocalApi } from "./contracts.js";
+export type LocalWebServerOptions = {
+    api: ConductorLocalApi;
+    staticDirectory: string;
+    host?: "127.0.0.1" | "::1" | undefined;
+    preferredPort?: number | undefined;
+    bootstrapToken?: string | undefined;
+    now?: (() => number) | undefined;
+    sessionTtlMs?: number | undefined;
+    bootstrapTtlMs?: number | undefined;
+    maxBodyBytes?: number | undefined;
+};
+export type LocalWebServer = {
+    origin: string;
+    browserUrl: string;
+    port: number;
+    close(): Promise<void>;
+};
+export declare function startLocalWebServer(options: LocalWebServerOptions): Promise<LocalWebServer>;
+export declare function assertStaticAssets(staticDirectory: string): Promise<void>;

package/dist/localApi/server.js

@@ -0,0 +1,412 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { readFile, stat } from "node:fs/promises";
+import { createServer } from "node:http";
+import path from "node:path";
+import { z } from "zod";
+import { redactSecrets } from "../redaction.js";
+import { localAgentKeySchema, localAgentPauseSchema, localAgentUpdateSchema, localAuthorizedPairRequestSchema, localPairRequestSchema, localProviderDraftSchema, localProviderSchema, localUserAuthorizationBeginSchema, } from "./contracts.js";
+import { approvalDecisionRequestSchema, cancelRunRequestSchema, commentTaskRequestSchema, createTaskRequestSchema, dispatchTaskRequestSchema, updateTaskRequestSchema, } from "./workContracts.js";
+const DEFAULT_PORT = 32145;
+const MAX_PORT_ATTEMPTS = 20;
+const DEFAULT_MAX_BODY_BYTES = 64 * 1024;
+const DEFAULT_SESSION_TTL_MS = 8 * 60 * 60_000;
+const DEFAULT_BOOTSTRAP_TTL_MS = 2 * 60_000;
+const SESSION_COOKIE = "sift_conductor_session";
+const CSRF_HEADER = "x-sift-csrf";
+const HASHED_ASSET_PATTERN = /[.-][a-zA-Z0-9_-]{8,}\.(?:css|js|map|png|jpe?g|webp|woff2?)$/u;
+export async function startLocalWebServer(options) {
+    const host = options.host ?? "127.0.0.1";
+    const preferredPort = options.preferredPort ?? DEFAULT_PORT;
+    const sessions = new Map();
+    const now = options.now ?? Date.now;
+    const bootstrap = {
+        token: options.bootstrapToken ?? randomToken(),
+        expiresAt: now() + (options.bootstrapTtlMs ?? DEFAULT_BOOTSTRAP_TTL_MS),
+        consumed: false,
+    };
+    const server = createServer((request, response) => {
+        void handleRequest({
+            ...options,
+            request,
+            response,
+            sessions,
+            bootstrap,
+            now,
+        }).catch((error) => {
+            if (response.headersSent) {
+                response.destroy();
+                return;
+            }
+            writeError(response, 500, "internal_error", safeErrorMessage(error));
+        });
+    });
+    const port = await listenWithFallback(server, host, preferredPort);
+    const hostLabel = host === "::1" ? "[::1]" : host;
+    const origin = `http://${hostLabel}:${String(port)}`;
+    return {
+        origin,
+        browserUrl: `${origin}/#bootstrap=${encodeURIComponent(bootstrap.token)}`,
+        port,
+        close: () => closeServer(server),
+    };
+}
+async function handleRequest(input) {
+    const { request, response } = input;
+    applySecurityHeaders(response);
+    if (!isLoopbackAddress(request.socket.remoteAddress)) {
+        writeError(response, 403, "loopback_required", "Local Conductor accepts loopback requests only.");
+        return;
+    }
+    const host = request.headers.host;
+    if (host === undefined || !isAllowedHost(host, input.host ?? "127.0.0.1")) {
+        writeError(response, 403, "invalid_host", "Local Conductor rejected the Host header.");
+        return;
+    }
+    const origin = `http://${host}`;
+    const url = new URL(request.url ?? "/", origin);
+    const context = { request, response, url, origin };
+    if (url.pathname === "/local-api/health" && request.method === "GET") {
+        writeJson(response, 200, await input.api.health());
+        return;
+    }
+    if (url.pathname === "/local-api/session" && request.method === "POST") {
+        await exchangeBootstrap(context, input);
+        return;
+    }
+    if (url.pathname.startsWith("/local-api/")) {
+        const session = requireSession(context, input.sessions, input.now, input.sessionTtlMs);
+        if (session === undefined)
+            return;
+        if (request.method === "GET" && url.pathname === "/local-api/session") {
+            renewSession(response, session, input.now, input.sessionTtlMs);
+            writeJson(response, 200, sessionStatus(session));
+            return;
+        }
+        if (request.method !== "GET" && !validMutationHeaders(context, session))
+            return;
+        renewSession(response, session, input.now, input.sessionTtlMs);
+        await dispatchLocalApi(context, input.api, input.maxBodyBytes);
+        return;
+    }
+    await serveStatic(context, input.staticDirectory);
+}
+async function exchangeBootstrap(context, input) {
+    if (!validOrigin(context))
+        return;
+    const body = await readJson(context, z.object({ bootstrapToken: z.string().min(1).max(500) }).strict(), input.maxBodyBytes);
+    if (body === undefined)
+        return;
+    const tokenMatches = safeTokenEquals(body.bootstrapToken, input.bootstrap.token);
+    if (input.bootstrap.consumed || input.bootstrap.expiresAt <= input.now() || !tokenMatches) {
+        writeError(context.response, 401, "invalid_bootstrap", "The local browser bootstrap is invalid or expired.");
+        return;
+    }
+    input.bootstrap.consumed = true;
+    const session = {
+        id: randomToken(),
+        csrfToken: randomToken(),
+        expiresAt: input.now() + (input.sessionTtlMs ?? DEFAULT_SESSION_TTL_MS),
+    };
+    input.sessions.set(session.id, session);
+    setSessionCookie(context.response, session);
+    writeJson(context.response, 201, sessionStatus(session));
+}
+async function dispatchLocalApi(context, api, maxBodyBytes) {
+    const route = `${context.request.method ?? "GET"} ${context.url.pathname}`;
+    switch (route) {
+        case "GET /local-api/status": return writeJson(context.response, 200, await api.pairedStatus());
+        case "GET /local-api/agents": return writeJson(context.response, 200, await api.listAgents());
+        case "GET /local-api/runtime": return writeJson(context.response, 200, await api.runtimeStatus());
+        case "GET /local-api/user-authorization": return writeJson(context.response, 200, await api.userAuthorizationStatus());
+        case "GET /local-api/work": return writeJson(context.response, 200, await api.workSnapshot({
+            projectId: context.url.searchParams.get("projectId") ?? undefined,
+            taskId: context.url.searchParams.get("taskId") ?? undefined,
+        }));
+        case "POST /local-api/pair": return withBody(context, localPairRequestSchema, maxBodyBytes, async (body) => api.pair(body));
+        case "POST /local-api/pair/authorized": return withBody(context, localAuthorizedPairRequestSchema, maxBodyBytes, async (body) => api.pairAuthorized(body.displayName));
+        case "POST /local-api/logout": return withEmptyBody(context, maxBodyBytes, async () => api.logout());
+        case "POST /local-api/folders/select": return withEmptyBody(context, maxBodyBytes, async () => api.selectFolder());
+        case "POST /local-api/providers/inspect": return withBody(context, localProviderDraftSchema, maxBodyBytes, async (body) => api.inspectDraft(body));
+        case "POST /local-api/providers/login": return withBody(context, localProviderDraftSchema, maxBodyBytes, async (body) => api.login(body));
+        case "POST /local-api/agents": return withBody(context, localProviderDraftSchema, maxBodyBytes, async (body) => api.verifyAndAdd(body));
+        case "POST /local-api/agents/update": return withBody(context, localAgentUpdateSchema, maxBodyBytes, async (body) => api.updateAgent(body));
+        case "POST /local-api/agents/pause": return withBody(context, localAgentPauseSchema, maxBodyBytes, async (body) => api.pauseAgent(body.localKey, body.paused));
+        case "POST /local-api/agents/remove": return withBody(context, localAgentKeySchema, maxBodyBytes, async (body) => api.removeAgent(body.localKey));
+        case "POST /local-api/providers/install-plan": return withBody(context, localProviderSchema, maxBodyBytes, async (body) => api.installPlan(body.provider));
+        case "POST /local-api/providers/open-official": return withBody(context, localProviderSchema, maxBodyBytes, async (body) => api.openOfficialProviderPage(body.provider));
+        case "POST /local-api/runtime/start": return withEmptyBody(context, maxBodyBytes, async () => api.startRuntime());
+        case "POST /local-api/runtime/stop": return withEmptyBody(context, maxBodyBytes, async () => api.stopRuntime());
+        case "POST /local-api/diagnostics/clear": return withEmptyBody(context, maxBodyBytes, async () => api.clearLocalDiagnostics());
+        case "POST /local-api/user-authorization/begin": return withBody(context, localUserAuthorizationBeginSchema, maxBodyBytes, async (body) => api.beginUserAuthorization(body));
+        case "POST /local-api/user-authorization/sign-out": return withEmptyBody(context, maxBodyBytes, async () => api.signOutUser());
+        case "POST /local-api/work/tasks": return withBody(context, createTaskRequestSchema, maxBodyBytes, async (body) => api.createTask(body));
+        case "POST /local-api/work/tasks/update": return withBody(context, updateTaskRequestSchema, maxBodyBytes, async (body) => api.updateTask(body));
+        case "POST /local-api/work/tasks/comment": return withBody(context, commentTaskRequestSchema, maxBodyBytes, async (body) => api.commentTask(body));
+        case "POST /local-api/work/tasks/dispatch": return withBody(context, dispatchTaskRequestSchema, maxBodyBytes, async (body) => api.dispatchTask(body));
+        case "POST /local-api/work/approvals/decision": return withBody(context, approvalDecisionRequestSchema, maxBodyBytes, async (body) => api.decideApproval(body));
+        case "POST /local-api/work/runs/cancel": return withBody(context, cancelRunRequestSchema, maxBodyBytes, async (body) => api.cancelRun(body.runId));
+        default:
+            writeError(context.response, 404, "not_found", "Local API route was not found.");
+    }
+}
+async function withBody(context, schema, maxBodyBytes, operation) {
+    const body = await readJson(context, schema, maxBodyBytes);
+    if (body === undefined)
+        return;
+    writeJson(context.response, 200, await operation(body));
+}
+async function withEmptyBody(context, maxBodyBytes, operation) {
+    const body = await readJson(context, z.object({}).strict(), maxBodyBytes);
+    if (body === undefined)
+        return;
+    writeJson(context.response, 200, await operation());
+}
+async function readJson(context, schema, maxBodyBytes = DEFAULT_MAX_BODY_BYTES) {
+    const contentType = context.request.headers["content-type"]?.split(";", 1)[0]?.trim().toLowerCase();
+    if (contentType !== "application/json") {
+        writeError(context.response, 415, "unsupported_content_type", "Local API requests require application/json.");
+        return undefined;
+    }
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of context.request) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        size += buffer.byteLength;
+        if (size > maxBodyBytes) {
+            writeError(context.response, 413, "request_too_large", "Local API request body is too large.");
+            return undefined;
+        }
+        chunks.push(buffer);
+    }
+    try {
+        return schema.parse(JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}"));
+    }
+    catch (error) {
+        const code = error instanceof SyntaxError ? "invalid_json" : "invalid_request";
+        writeError(context.response, 400, code, "Local API request body is invalid.");
+        return undefined;
+    }
+}
+function requireSession(context, sessions, now, sessionTtlMs = DEFAULT_SESSION_TTL_MS) {
+    const sessionId = parseCookies(context.request.headers.cookie)[SESSION_COOKIE];
+    const session = sessionId === undefined ? undefined : sessions.get(sessionId);
+    if (session === undefined || session.expiresAt <= now()) {
+        if (session !== undefined)
+            sessions.delete(session.id);
+        clearSessionCookie(context.response);
+        writeError(context.response, 401, "session_required", "Open Conductor from its current local startup URL.");
+        return undefined;
+    }
+    session.expiresAt = now() + sessionTtlMs;
+    return session;
+}
+function validMutationHeaders(context, session) {
+    if (!validOrigin(context))
+        return false;
+    const csrf = context.request.headers[CSRF_HEADER];
+    if (typeof csrf !== "string" || !safeTokenEquals(csrf, session.csrfToken)) {
+        writeError(context.response, 403, "csrf_required", "Local API mutation requires a valid CSRF token.");
+        return false;
+    }
+    return true;
+}
+function validOrigin(context) {
+    if (context.request.headers.origin !== context.origin) {
+        writeError(context.response, 403, "invalid_origin", "Local Conductor rejected the request origin.");
+        return false;
+    }
+    return true;
+}
+async function serveStatic(context, staticDirectory) {
+    if (context.request.method !== "GET" && context.request.method !== "HEAD") {
+        writeError(context.response, 405, "method_not_allowed", "This local resource is read-only.");
+        return;
+    }
+    const requested = decodeURIComponent(context.url.pathname);
+    const relative = requested === "/" ? "index.html" : requested.replace(/^\/+/, "");
+    const candidate = safeStaticPath(staticDirectory, relative);
+    const existing = candidate === undefined ? undefined : await regularFile(candidate);
+    if (existing !== undefined) {
+        streamFile(context, existing);
+        return;
+    }
+    if (relative.startsWith("assets/")) {
+        writeError(context.response, 404, "asset_not_found", "Static asset was not found.");
+        return;
+    }
+    const indexPath = path.join(staticDirectory, "index.html");
+    if (await regularFile(indexPath) === undefined) {
+        writeError(context.response, 503, "ui_unavailable", "Conductor web assets are not installed.");
+        return;
+    }
+    streamFile(context, indexPath);
+}
+function streamFile(context, filePath) {
+    context.response.statusCode = 200;
+    context.response.setHeader("content-type", contentType(filePath));
+    context.response.setHeader("cache-control", HASHED_ASSET_PATTERN.test(path.basename(filePath))
+        ? "public, max-age=31536000, immutable"
+        : "no-cache");
+    if (context.request.method === "HEAD") {
+        context.response.end();
+        return;
+    }
+    createReadStream(filePath).pipe(context.response);
+}
+async function regularFile(filePath) {
+    try {
+        return (await stat(filePath)).isFile() ? filePath : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function safeStaticPath(root, relative) {
+    const resolvedRoot = path.resolve(root);
+    const resolved = path.resolve(resolvedRoot, relative);
+    return resolved === resolvedRoot || resolved.startsWith(`${resolvedRoot}${path.sep}`) ? resolved : undefined;
+}
+function applySecurityHeaders(response) {
+    response.setHeader("content-security-policy", "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'");
+    response.setHeader("x-content-type-options", "nosniff");
+    response.setHeader("x-frame-options", "DENY");
+    response.setHeader("referrer-policy", "no-referrer");
+    response.setHeader("permissions-policy", "camera=(), microphone=(), geolocation=()");
+    response.setHeader("cross-origin-opener-policy", "same-origin");
+    response.setHeader("cross-origin-resource-policy", "same-origin");
+}
+function writeJson(response, status, body) {
+    response.statusCode = status;
+    response.setHeader("content-type", "application/json; charset=utf-8");
+    response.setHeader("cache-control", "no-store");
+    response.end(`${JSON.stringify(safeBrowserPayload(body ?? null))}\n`);
+}
+function writeError(response, status, code, message) {
+    writeJson(response, status, { error: { code, message: redactSecrets(message) } });
+}
+function sessionStatus(session) {
+    return { authenticated: true, csrfToken: session.csrfToken, expiresAt: new Date(session.expiresAt).toISOString() };
+}
+function renewSession(response, session, now, ttlMs = DEFAULT_SESSION_TTL_MS) {
+    session.expiresAt = now() + ttlMs;
+    setSessionCookie(response, session);
+}
+function setSessionCookie(response, session) {
+    response.setHeader("set-cookie", `${SESSION_COOKIE}=${session.id}; Path=/; HttpOnly; SameSite=Strict`);
+}
+function clearSessionCookie(response) {
+    response.setHeader("set-cookie", `${SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0`);
+}
+function parseCookies(value) {
+    if (value === undefined)
+        return {};
+    return Object.fromEntries(value.split(";").map((part) => part.trim().split("=", 2)).filter((pair) => pair.length === 2));
+}
+function isAllowedHost(value, boundHost) {
+    const normalized = value.toLowerCase();
+    if (boundHost === "::1")
+        return /^\[::1\]:\d+$/u.test(normalized);
+    return /^(?:127\.0\.0\.1|localhost):\d+$/u.test(normalized);
+}
+function isLoopbackAddress(value) {
+    return value === "127.0.0.1" || value === "::1" || value === "::ffff:127.0.0.1";
+}
+function safeTokenEquals(left, right) {
+    const leftBuffer = Buffer.from(left);
+    const rightBuffer = Buffer.from(right);
+    return leftBuffer.byteLength === rightBuffer.byteLength && timingSafeEqual(leftBuffer, rightBuffer);
+}
+function randomToken() {
+    return randomBytes(32).toString("base64url");
+}
+function contentType(filePath) {
+    switch (path.extname(filePath).toLowerCase()) {
+        case ".html": return "text/html; charset=utf-8";
+        case ".js": return "text/javascript; charset=utf-8";
+        case ".css": return "text/css; charset=utf-8";
+        case ".json": return "application/json; charset=utf-8";
+        case ".svg": return "image/svg+xml";
+        case ".png": return "image/png";
+        case ".jpg":
+        case ".jpeg": return "image/jpeg";
+        case ".webp": return "image/webp";
+        case ".woff2": return "font/woff2";
+        default: return "application/octet-stream";
+    }
+}
+function safeErrorMessage(error) {
+    return error instanceof Error ? redactSecrets(error.message) : "Local Conductor request failed.";
+}
+const OMITTED_BROWSER_KEYS = new Set([
+    "credential",
+    "usercredential",
+    "machinecredential",
+    "accesstoken",
+    "refreshtoken",
+    "apikey",
+    "environment",
+    "env",
+    "rawprompt",
+    "prompt",
+    "workspacepath",
+    "pairingcode",
+]);
+function safeBrowserPayload(value) {
+    if (typeof value === "string")
+        return redactSecrets(value);
+    if (Array.isArray(value))
+        return value.map((entry) => safeBrowserPayload(entry));
+    if (typeof value !== "object" || value === null)
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .filter(([key]) => !OMITTED_BROWSER_KEYS.has(key.replace(/[_-]/gu, "").toLowerCase()))
+        .map(([key, entry]) => [key, safeBrowserPayload(entry)]));
+}
+async function listenWithFallback(server, host, preferredPort) {
+    for (let offset = 0; offset < MAX_PORT_ATTEMPTS; offset += 1) {
+        const port = preferredPort === 0 ? 0 : preferredPort + offset;
+        try {
+            return await listen(server, host, port);
+        }
+        catch (error) {
+            if (!isAddressInUse(error) || preferredPort === 0 || offset === MAX_PORT_ATTEMPTS - 1)
+                throw error;
+        }
+    }
+    throw new Error("No loopback port is available for Sift Conductor.");
+}
+function listen(server, host, port) {
+    return new Promise((resolve, reject) => {
+        const onError = (error) => {
+            server.off("listening", onListening);
+            reject(error);
+        };
+        const onListening = () => {
+            server.off("error", onError);
+            const address = server.address();
+            if (address === null || typeof address === "string") {
+                reject(new Error("Local Conductor did not receive a TCP port."));
+                return;
+            }
+            resolve(address.port);
+        };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        server.listen(port, host);
+    });
+}
+function closeServer(server) {
+    return new Promise((resolve, reject) => server.close((error) => error === undefined ? resolve() : reject(error)));
+}
+function isAddressInUse(error) {
+    return error instanceof Error && "code" in error && error.code === "EADDRINUSE";
+}
+export async function assertStaticAssets(staticDirectory) {
+    const indexPath = path.join(staticDirectory, "index.html");
+    const contents = await readFile(indexPath, "utf8");
+    if (!contents.includes("<div id=\"root\"></div>")) {
+        throw new Error("Conductor web entrypoint is missing its root element.");
+    }
+}
+//# sourceMappingURL=server.js.map