@sift-wiki/conductor 0.0.0 → 0.2.0-beta.1

package/dist/bridge/localBridge.d.ts

@@ -0,0 +1,49 @@
+import type { JsonObject } from "../types.js";
+export type LocalBridgeMethod = "GET" | "POST";
+export type LocalBridgeScope = "run:read" | "run:event:write" | "task:checkout" | "task:child:write" | "task:comment:write" | "artifact:write" | "approval:write" | "usage:write" | "task:disposition:write";
+export type LocalBridgeRouteContract = {
+    method: LocalBridgeMethod;
+    path: string;
+    scope: LocalBridgeScope;
+    durableMutation: boolean;
+    siftApiDependency: string;
+    description: string;
+};
+export type RunScopedBridgeSession = {
+    runId: string;
+    runToken: string;
+    scopes: LocalBridgeScope[];
+    taskId?: string | undefined;
+    expiresAt: string;
+};
+export type LocalBridgeRequest = {
+    method: LocalBridgeMethod;
+    path: string;
+    authorization?: string | undefined;
+    runId?: string | undefined;
+    taskId?: string | undefined;
+    payload?: JsonObject | undefined;
+};
+export type LocalBridgeDiagnostic = {
+    code: "unauthorized" | "expired" | "route_not_found" | "out_of_scope";
+    message: string;
+    route?: string | undefined;
+    requiredScope?: LocalBridgeScope | undefined;
+};
+export type LocalBridgeAuthorizationResult = {
+    ok: true;
+    route: LocalBridgeRouteContract;
+    context: {
+        runId: string;
+        taskId?: string | undefined;
+    };
+} | {
+    ok: false;
+    diagnostic: LocalBridgeDiagnostic;
+};
+export declare const LOCAL_BRIDGE_ROUTE_CONTRACTS: LocalBridgeRouteContract[];
+export declare function authorizeLocalBridgeRequest(input: {
+    session: RunScopedBridgeSession;
+    request: LocalBridgeRequest;
+    nowMs?: number | undefined;
+}): LocalBridgeAuthorizationResult;

package/dist/bridge/localBridge.js

@@ -0,0 +1,157 @@
+import { redactLocalLogMessage } from "../runtime/localLogSpool.js";
+export const LOCAL_BRIDGE_ROUTE_CONTRACTS = [
+    {
+        method: "GET",
+        path: "/v1/run/context",
+        scope: "run:read",
+        durableMutation: false,
+        siftApiDependency: "Sift wake envelope or run-detail read endpoint",
+        description: "Read the current run context assembled by Sift.",
+    },
+    {
+        method: "POST",
+        path: "/v1/task/checkout",
+        scope: "task:checkout",
+        durableMutation: true,
+        siftApiDependency: "POST /conductor/work/runs/:runId/tasks/:taskId/checkout",
+        description: "Atomically check out the current assigned task.",
+    },
+    {
+        method: "POST",
+        path: "/v1/task/children",
+        scope: "task:child:write",
+        durableMutation: true,
+        siftApiDependency: "POST /conductor/work/runs/:runId/tasks/:taskId/children",
+        description: "Create bounded child tasks under the current manager task.",
+    },
+    {
+        method: "POST",
+        path: "/v1/run/events",
+        scope: "run:event:write",
+        durableMutation: true,
+        siftApiDependency: "POST /conductor/runs/:runId/events",
+        description: "Append a bounded health, progress, log, artifact, or approval event.",
+    },
+    {
+        method: "POST",
+        path: "/v1/task/comments",
+        scope: "task:comment:write",
+        durableMutation: true,
+        siftApiDependency: "POST /conductor/work/runs/:runId/tasks/:taskId/comments",
+        description: "Append a task comment through Sift, scoped to the current task.",
+    },
+    {
+        method: "POST",
+        path: "/v1/artifacts",
+        scope: "artifact:write",
+        durableMutation: true,
+        siftApiDependency: "POST /conductor/work/runs/:runId/tasks/:taskId/artifacts",
+        description: "Register or upload a user-inspectable work product through Sift.",
+    },
+    {
+        method: "POST",
+        path: "/v1/approvals",
+        scope: "approval:write",
+        durableMutation: true,
+        siftApiDependency: "POST /conductor/work/runs/:runId/tasks/:taskId/approvals",
+        description: "Request a Sift review or approval for the current task.",
+    },
+    {
+        method: "POST",
+        path: "/v1/usage",
+        scope: "usage:write",
+        durableMutation: true,
+        siftApiDependency: "POST /conductor/work/runs/:runId/tasks/:taskId/usage",
+        description: "Report idempotent time and cost usage and receive policy state.",
+    },
+    {
+        method: "POST",
+        path: "/v1/task/disposition",
+        scope: "task:disposition:write",
+        durableMutation: true,
+        siftApiDependency: "POST /conductor/work/runs/:runId/tasks/:taskId/disposition",
+        description: "Set the explicit terminal disposition for the current task and run.",
+    },
+];
+export function authorizeLocalBridgeRequest(input) {
+    const route = findBridgeRoute(input.request);
+    if (route === undefined) {
+        return reject({
+            code: "route_not_found",
+            message: "Local bridge route is not enabled.",
+            route: `${input.request.method} ${input.request.path}`,
+        });
+    }
+    if (bearerToken(input.request.authorization) !== input.session.runToken) {
+        return reject({
+            code: "unauthorized",
+            message: "Local bridge request is missing a valid run-scoped token.",
+            route: routeLabel(route),
+        });
+    }
+    if (input.nowMs !== undefined && Date.parse(input.session.expiresAt) <= input.nowMs) {
+        return reject({
+            code: "expired",
+            message: "Local bridge run token has expired.",
+            route: routeLabel(route),
+        });
+    }
+    if (!input.session.scopes.includes(route.scope)) {
+        return reject({
+            code: "out_of_scope",
+            message: "Local bridge request is outside the run token scope.",
+            route: routeLabel(route),
+            requiredScope: route.scope,
+        });
+    }
+    if (input.request.runId !== undefined && input.request.runId !== input.session.runId) {
+        return reject({
+            code: "out_of_scope",
+            message: "Local bridge request targets a different run.",
+            route: routeLabel(route),
+            requiredScope: route.scope,
+        });
+    }
+    if (input.request.taskId !== undefined && input.request.taskId !== input.session.taskId) {
+        return reject({
+            code: "out_of_scope",
+            message: "Local bridge request targets a different task.",
+            route: routeLabel(route),
+            requiredScope: route.scope,
+        });
+    }
+    return {
+        ok: true,
+        route,
+        context: {
+            runId: input.session.runId,
+            taskId: input.session.taskId,
+        },
+    };
+}
+function findBridgeRoute(request) {
+    return LOCAL_BRIDGE_ROUTE_CONTRACTS.find((route) => route.method === request.method && route.path === request.path);
+}
+function bearerToken(authorization) {
+    if (authorization === undefined) {
+        return undefined;
+    }
+    const trimmed = authorization.trim();
+    if (!trimmed.startsWith("Bearer ")) {
+        return undefined;
+    }
+    return trimmed.slice("Bearer ".length);
+}
+function reject(diagnostic) {
+    return {
+        ok: false,
+        diagnostic: {
+            ...diagnostic,
+            message: redactLocalLogMessage(diagnostic.message).message,
+        },
+    };
+}
+function routeLabel(route) {
+    return `${route.method} ${route.path}`;
+}
+//# sourceMappingURL=localBridge.js.map

package/dist/bridge/localBridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localBridge.js","sourceRoot":"","sources":["../../src/bridge/localBridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AA+DpE,MAAM,CAAC,MAAM,4BAA4B,GAA+B;IACtE;QACE,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,UAAU;QACjB,eAAe,EAAE,KAAK;QACtB,iBAAiB,EAAE,gDAAgD;QACnE,WAAW,EAAE,iDAAiD;KAC/D;IACD;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,eAAe;QACtB,eAAe,EAAE,IAAI;QACrB,iBAAiB,EAAE,yDAAyD;QAC5E,WAAW,EAAE,iDAAiD;KAC/D;IACD;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,kBAAkB;QACzB,eAAe,EAAE,IAAI;QACrB,iBAAiB,EAAE,yDAAyD;QAC5E,WAAW,EAAE,4DAA4D;KAC1E;IACD;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,iBAAiB;QACxB,eAAe,EAAE,IAAI;QACrB,iBAAiB,EAAE,oCAAoC;QACvD,WAAW,EAAE,sEAAsE;KACpF;IACD;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,oBAAoB;QAC3B,eAAe,EAAE,IAAI;QACrB,iBAAiB,EAAE,yDAAyD;QAC5E,WAAW,EAAE,iEAAiE;KAC/E;IACD;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,gBAAgB;QACvB,eAAe,EAAE,IAAI;QACrB,iBAAiB,EAAE,0DAA0D;QAC7E,WAAW,EAAE,kEAAkE;KAChF;IACD;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,gBAAgB;QACvB,eAAe,EAAE,IAAI;QACrB,iBAAiB,EAAE,0DAA0D;QAC7E,WAAW,EAAE,yDAAyD;KACvE;IACD;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,aAAa;QACpB,eAAe,EAAE,IAAI;QACrB,iBAAiB,EAAE,sDAAsD;QACzE,WAAW,EAAE,iEAAiE;KAC/E;IACD;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,wBAAwB;QAC/B,eAAe,EAAE,IAAI;QACrB,iBAAiB,EAAE,4DAA4D;QAC/E,WAAW,EAAE,qEAAqE;KACnF;CACO,CAAC;AAEX,MAAM,UAAU,2BAA2B,CAAC,KAI3C;IACC,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,oCAAoC;YAC7C,KAAK,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;SACvD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACxE,OAAO,MAAM,CAAC;YACZ,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,2DAA2D;YACpE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC;SACzB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QACpF,OAAO,MAAM,CAAC;YACZ,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,qCAAqC;YAC9C,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC;SACzB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC;YACZ,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,sDAAsD;YAC/D,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC;YACxB,aAAa,EAAE,KAAK,CAAC,KAAK;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrF,OAAO,MAAM,CAAC;YACZ,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,+CAA+C;YACxD,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC;YACxB,aAAa,EAAE,KAAK,CAAC,KAAK;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACxF,OAAO,MAAM,CAAC;YACZ,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,gDAAgD;YACzD,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC;YACxB,aAAa,EAAE,KAAK,CAAC,KAAK;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK;QACL,OAAO,EAAE;YACP,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK;YAC1B,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;SAC7B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAA2B;IAClD,OAAO,4BAA4B,CAAC,IAAI,CACtC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,aAAiC;IACpD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,MAAM,CAAC,UAAiC;IAC/C,OAAO;QACL,EAAE,EAAE,KAAK;QACT,UAAU,EAAE;YACV,GAAG,UAAU;YACb,OAAO,EAAE,qBAAqB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO;SAC3D;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAA+B;IACjD,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;AACzC,CAAC"}

package/dist/bridge/server.d.ts

@@ -0,0 +1,11 @@
+import type { LocalBridgeRequest } from "./localBridge.js";
+import type { LocalBridgeResponse } from "./handler.js";
+export type LocalBridgeServer = {
+    baseUrl: string;
+    close(): Promise<void>;
+};
+export declare function startLocalBridgeServer(input: {
+    handle(request: LocalBridgeRequest): Promise<LocalBridgeResponse>;
+    host?: string | undefined;
+    port?: number | undefined;
+}): Promise<LocalBridgeServer>;

package/dist/bridge/server.js

@@ -0,0 +1,86 @@
+import { createServer } from "node:http";
+const MAX_REQUEST_BYTES = 64 * 1024;
+export async function startLocalBridgeServer(input) {
+    const host = input.host ?? "127.0.0.1";
+    const server = createServer((request, response) => {
+        void handleHttpRequest((bridgeRequest) => input.handle(bridgeRequest), request, response);
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(input.port ?? 0, host, () => {
+            server.off("error", reject);
+            resolve();
+        });
+    });
+    const address = server.address();
+    if (address === null || typeof address === "string") {
+        server.close();
+        throw new Error("Local bridge did not bind a TCP address.");
+    }
+    return {
+        baseUrl: `http://${host}:${String(address.port)}`,
+        close: () => new Promise((resolve, reject) => {
+            server.close((error) => error === undefined ? resolve() : reject(error));
+        }),
+    };
+}
+async function handleHttpRequest(handler, request, response) {
+    try {
+        const method = request.method;
+        if (method !== "GET" && method !== "POST") {
+            send(response, 405, { error: { code: "method_not_allowed", message: "Method not allowed." } });
+            return;
+        }
+        const body = method === "POST" ? await readJsonBody(request) : undefined;
+        const result = await handler({
+            method,
+            path: new URL(request.url ?? "/", "http://127.0.0.1").pathname,
+            authorization: request.headers.authorization,
+            runId: headerValue(request, "x-sift-run-id"),
+            taskId: headerValue(request, "x-sift-task-id"),
+            payload: body,
+        });
+        send(response, result.status, result.body);
+    }
+    catch {
+        send(response, 400, { error: { code: "invalid_request", message: "Invalid bridge request." } });
+    }
+}
+function readJsonBody(request) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        request.on("data", (chunk) => {
+            size += chunk.length;
+            if (size > MAX_REQUEST_BYTES) {
+                reject(new Error("Bridge request is too large."));
+                request.destroy();
+                return;
+            }
+            chunks.push(chunk);
+        });
+        request.on("end", () => {
+            try {
+                const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+                if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+                    reject(new Error("Expected JSON object."));
+                    return;
+                }
+                resolve(parsed);
+            }
+            catch (error) {
+                reject(error instanceof Error ? error : new Error("Invalid JSON."));
+            }
+        });
+        request.on("error", reject);
+    });
+}
+function headerValue(request, name) {
+    const value = request.headers[name];
+    return typeof value === "string" ? value : value?.[0];
+}
+function send(response, status, body) {
+    response.writeHead(status, { "content-type": "application/json" });
+    response.end(JSON.stringify(body));
+}
+//# sourceMappingURL=server.js.map

package/dist/bridge/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/bridge/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AAKpF,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC;AAOpC,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAI5C;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,WAAW,CAAC;IACvC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAChD,KAAK,iBAAiB,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;YACxC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO;QACL,OAAO,EAAE,UAAU,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QACjD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACjD,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,OAAsE,EACtE,OAAwB,EACxB,QAAwB;IAExB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAC;YAC/F,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;YAC3B,MAAM;YACN,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ;YAC9D,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa;YAC5C,KAAK,EAAE,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC;YAC5C,MAAM,EAAE,WAAW,CAAC,OAAO,EAAE,gBAAgB,CAAC;YAC9C,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,OAAwB;IAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACnC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,iBAAiB,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;gBAClD,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClB,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACrB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC3E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC3E,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;oBAC3C,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,MAAiC,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,OAAwB,EAAE,IAAY;IACzD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,IAAI,CAAC,QAAwB,EAAE,MAAc,EAAE,IAAa;IACnE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACnE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC"}

package/dist/bridge/sessionRegistry.d.ts

@@ -0,0 +1,23 @@
+import type { LocalBridgeScope, RunScopedBridgeSession } from "./localBridge.js";
+export declare class LocalBridgeSessionRegistry {
+    private readonly input;
+    private readonly sessions;
+    constructor(input?: {
+        now?: () => Date;
+        nextToken?: () => string;
+        defaultTtlMs?: number;
+    });
+    create(request: {
+        runId: string;
+        taskId: string;
+        scopes: LocalBridgeScope[];
+        ttlMs?: number | undefined;
+    }): RunScopedBridgeSession;
+    readByToken(token: string): RunScopedBridgeSession | undefined;
+    readRun(runId: string): RunScopedBridgeSession | undefined;
+    revoke(runId: string): boolean;
+    clear(): void;
+    private pruneExpired;
+    private now;
+}
+export declare function bearerToken(authorization: string | undefined): string | undefined;

package/dist/bridge/sessionRegistry.js

@@ -0,0 +1,65 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+const DEFAULT_SESSION_TTL_MS = 60 * 60 * 1000;
+export class LocalBridgeSessionRegistry {
+    input;
+    sessions = new Map();
+    constructor(input = {}) {
+        this.input = input;
+    }
+    create(request) {
+        this.pruneExpired();
+        const now = this.now();
+        const token = this.input.nextToken?.() ?? randomBytes(32).toString("base64url");
+        const session = {
+            runId: request.runId,
+            taskId: request.taskId,
+            runToken: token,
+            scopes: [...new Set(request.scopes)],
+            expiresAt: new Date(now.getTime() + (request.ttlMs ?? this.input.defaultTtlMs ?? DEFAULT_SESSION_TTL_MS)).toISOString(),
+        };
+        this.sessions.set(request.runId, session);
+        return cloneSession(session);
+    }
+    readByToken(token) {
+        this.pruneExpired();
+        for (const session of this.sessions.values()) {
+            if (tokensEqual(session.runToken, token))
+                return cloneSession(session);
+        }
+        return undefined;
+    }
+    readRun(runId) {
+        this.pruneExpired();
+        const session = this.sessions.get(runId);
+        return session === undefined ? undefined : cloneSession(session);
+    }
+    revoke(runId) {
+        return this.sessions.delete(runId);
+    }
+    clear() {
+        this.sessions.clear();
+    }
+    pruneExpired() {
+        const nowMs = this.now().getTime();
+        for (const [runId, session] of this.sessions) {
+            if (Date.parse(session.expiresAt) <= nowMs)
+                this.sessions.delete(runId);
+        }
+    }
+    now() {
+        return this.input.now?.() ?? new Date();
+    }
+}
+export function bearerToken(authorization) {
+    const value = authorization?.trim();
+    return value?.startsWith("Bearer ") === true ? value.slice("Bearer ".length) : undefined;
+}
+function tokensEqual(left, right) {
+    const leftBytes = Buffer.from(left);
+    const rightBytes = Buffer.from(right);
+    return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
+}
+function cloneSession(session) {
+    return { ...session, scopes: [...session.scopes] };
+}
+//# sourceMappingURL=sessionRegistry.js.map

package/dist/bridge/sessionRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionRegistry.js","sourceRoot":"","sources":["../../src/bridge/sessionRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAI3D,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C,MAAM,OAAO,0BAA0B;IAGR;IAFZ,QAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;IAEtE,YAA6B,QAIzB,EAAE;QAJuB,UAAK,GAAL,KAAK,CAI5B;IAAG,CAAC;IAEV,MAAM,CAAC,OAKN;QACC,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAChF,MAAM,OAAO,GAA2B;YACtC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,SAAS,EAAE,IAAI,IAAI,CACjB,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,sBAAsB,CAAC,CACrF,CAAC,WAAW,EAAE;SAChB,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAEO,YAAY;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7C,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAEO,GAAG;QACT,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,UAAU,WAAW,CAAC,aAAiC;IAC3D,MAAM,KAAK,GAAG,aAAa,EAAE,IAAI,EAAE,CAAC;IACpC,OAAO,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3F,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,YAAY,CAAC,OAA+B;IACnD,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;AACrD,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+import { type AdapterFactoryDeps } from "./adapters/config.js";
+import type { Sleep } from "./adapters/types.js";
+import { type LocalAppHandle } from "./localApp/service.js";
+import type { TaskExecutionClient } from "./runtime/taskExecution.js";
+import type { ConfigStore, ConductorClient } from "./types.js";
+export type CliDeps = {
+    stdout(line: string): void;
+    stderr(line: string): void;
+    createStore(configPath?: string): ConfigStore;
+    createClient(apiBaseUrl: string): ConductorClient;
+    createWorkClient?(apiBaseUrl: string): TaskExecutionClient;
+    defaultDisplayName(): string;
+    sleep?: Sleep;
+    adapterFactoryDeps?: AdapterFactoryDeps;
+    startLocalApp?: ((input: {
+        configPath?: string | undefined;
+        preferredPort?: number | undefined;
+        openBrowser?: boolean | undefined;
+    }) => Promise<LocalAppHandle>) | undefined;
+};
+export declare function runCli(args?: string[], deps?: CliDeps): Promise<number>;
+export declare function isMainModule(moduleUrl: string, entryPath: string | undefined): boolean;