witnora 0.13.2 → 0.13.4

package/dist/internal/control-client/collector-gateway.js

@@ -0,0 +1,392 @@
+import { createHash, createPublicKey, sign, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { mkdir, readdir, readFile, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { canonicalJson } from "./canonical.js";
+import { DurableRemoteCollectorQueue, RemoteCollectorApiError, } from "./remote-collector.js";
+export async function startCustomerOwnedCollectorGateway(options) {
+    if (options.gatewayToken.length < 24)
+        throw new Error("gatewayToken must contain at least 24 characters.");
+    const storageDirectory = resolve(options.storageDirectory);
+    await mkdir(storageDirectory, { recursive: true });
+    const signer = options.keyRing.activeSigner();
+    let sourceKeyRegistered = false;
+    const journals = new Map();
+    const activeCollector = {
+        id: options.keyRing.collectorId,
+        version: options.collectorVersion ?? "0.2.0",
+        environment: options.environment ?? "customer-owned",
+        keyId: signer.keyId,
+        publicKeySha256: publicKeyFingerprint(signer.publicKeyPem),
+    };
+    let lastRemoteSuccessAt;
+    let lastRemoteError;
+    const ensureSourceKeyRegistered = async () => {
+        if (sourceKeyRegistered)
+            return;
+        await options.client.registerSourceKey(options.keyRing.registration());
+        sourceKeyRegistered = true;
+    };
+    const journalFor = async (runId) => {
+        identifier(runId, "runId");
+        const existing = journals.get(runId);
+        if (existing)
+            return existing;
+        const queue = new DurableRemoteCollectorQueue(storageDirectory, runId);
+        const first = (await queue.all())[0];
+        const runSigner = first ? options.keyRing.signerFor(first.collector.keyId) : signer;
+        const journal = await GatewayRunJournal.open(storageDirectory, runId, first?.collector ?? activeCollector, runSigner);
+        journals.set(runId, journal);
+        return journal;
+    };
+    const flush = async () => {
+        let delivered = 0;
+        let reconciled = 0;
+        let pending = 0;
+        try {
+            await ensureSourceKeyRegistered();
+        }
+        catch (error) {
+            lastRemoteError = message(error);
+        }
+        for (const journal of journals.values()) {
+            try {
+                if (!sourceKeyRegistered)
+                    throw new Error(lastRemoteError ?? "Collector source key is not registered.");
+                delivered += (await journal.queue.replay(options.client)).delivered;
+                if (await journal.reconcileIfReady(options.client))
+                    reconciled += 1;
+                lastRemoteSuccessAt = new Date().toISOString();
+                lastRemoteError = undefined;
+            }
+            catch (error) {
+                lastRemoteError = message(error);
+            }
+            pending += (await journal.queue.pending()).length;
+        }
+        return { delivered, reconciled, pending };
+    };
+    const status = async () => {
+        let pendingRecordCount = 0;
+        let lastAckSequence;
+        for (const journal of journals.values()) {
+            pendingRecordCount += (await journal.queue.pending()).length;
+            const ack = await journal.queue.currentAck();
+            if (ack.sequence >= 0)
+                lastAckSequence = Math.max(lastAckSequence ?? -1, ack.sequence);
+        }
+        return {
+            schemaVersion: "agentcert.customer_collector_gateway_status.v0.2",
+            collectorId: activeCollector.id,
+            sourceKeyId: activeCollector.keyId,
+            runCount: journals.size,
+            pendingRecordCount,
+            lastAckSequence,
+            lastRemoteSuccessAt,
+            lastRemoteError,
+            ...(options.actionWorker ? { actionWorker: await options.actionWorker.status() } : {}),
+        };
+    };
+    const server = createServer(async (request, response) => {
+        try {
+            const url = new URL(request.url ?? "/", "http://127.0.0.1");
+            if (request.method === "GET" && url.pathname === "/healthz")
+                return json(response, 200, await status());
+            authenticate(request, options.gatewayToken);
+            if (request.method === "POST" && url.pathname === "/v1/flush")
+                return json(response, 200, await flush());
+            if (request.method === "POST" && url.pathname === "/v1/actions") {
+                const body = await readJson(request, options.maxBodyBytes ?? 1_048_576);
+                const proposal = object(body.proposal);
+                const action = await options.client.proposeAction(proposal, identifier(body.idempotencyKey, "idempotencyKey"));
+                if (options.actionWorker)
+                    await options.actionWorker.track({ actionId: identifier(action.id, "actionId"), proposal });
+                return json(response, 202, action);
+            }
+            const actionRoute = url.pathname.match(/^\/v1\/actions\/([A-Za-z0-9._:-]+)$/);
+            if (request.method === "GET" && actionRoute) {
+                return json(response, 200, await options.client.getAction(identifier(actionRoute[1], "actionId")));
+            }
+            const grantRoute = url.pathname.match(/^\/v1\/actions\/([A-Za-z0-9._:-]+)\/execution-grant$/);
+            if (request.method === "POST" && grantRoute) {
+                const actionId = identifier(grantRoute[1], "actionId");
+                const action = await options.client.getAction(actionId);
+                if (action.status !== "APPROVED" && action.status !== "ALLOWED") {
+                    throw new GatewayRequestError(409, `Action ${actionId} is not approved for execution.`);
+                }
+                const body = await readJson(request, options.maxBodyBytes ?? 1_048_576);
+                return json(response, 201, await options.client.issueExecutionGrant(actionId, object(body.grant), identifier(body.idempotencyKey, "idempotencyKey")));
+            }
+            const route = url.pathname.match(/^\/v1\/runs\/([A-Za-z0-9._:-]+)\/(start|events|drops|complete)$/);
+            if (!route)
+                return json(response, 404, { error: "not found" });
+            const runId = route[1];
+            const operation = route[2];
+            const body = await readJson(request, options.maxBodyBytes ?? 1_048_576);
+            const journal = await journalFor(runId);
+            let record;
+            if (operation === "start") {
+                record = await journal.append("RUN_STARTED", object(body.payload), String(body.idempotencyKey ?? "run-start"));
+            }
+            else if (operation === "events") {
+                record = await journal.append(identifier(body.type, "type"), object(body.payload), identifier(body.idempotencyKey, "idempotencyKey"));
+            }
+            else if (operation === "drops") {
+                const count = positiveInteger(body.count, "count");
+                record = await journal.append("EVENTS_DROPPED", { count, reason: required(body.reason, "reason") }, identifier(body.idempotencyKey, "idempotencyKey"), count);
+            }
+            else {
+                const input = body;
+                record = await journal.append("RUN_COMPLETED", object(input.payload), String(input.idempotencyKey ?? "run-complete"));
+                await journal.writeReceipt({
+                    mandateDigests: strings(input.mandateDigests),
+                    actionIds: strings(input.actionIds),
+                    evidenceStrength: object(input.evidenceStrength),
+                });
+            }
+            const remote = await flush();
+            return json(response, 202, { durable: true, record, remote });
+        }
+        catch (error) {
+            if (error instanceof RemoteCollectorApiError) {
+                const status = Number.isInteger(error.status) && error.status >= 400 && error.status <= 599 ? error.status : 502;
+                return json(response, status, status === error.status ? {
+                    error: error.message,
+                    code: error.code,
+                    ...(error.recovery ? { recovery: error.recovery } : {}),
+                } : { error: "Hosted API returned an invalid error response.", code: "remote_collector_invalid_status" });
+            }
+            const statusCode = error instanceof GatewayRequestError ? error.status : 500;
+            return json(response, statusCode, { error: message(error) });
+        }
+    });
+    await listen(server, options.port ?? 0, options.host ?? "127.0.0.1");
+    const address = server.address();
+    if (!address || typeof address === "string")
+        throw new Error("Collector gateway did not bind a TCP port.");
+    const flushTimer = setInterval(() => void flush(), options.flushIntervalMs ?? 5_000);
+    const heartbeatTimer = setInterval(async () => {
+        const current = await status();
+        try {
+            await ensureSourceKeyRegistered();
+            await options.client.heartbeat({
+                collectorId: activeCollector.id,
+                signer,
+                pendingRecordCount: current.pendingRecordCount,
+                lastAckSequence: current.lastAckSequence,
+            });
+            lastRemoteSuccessAt = new Date().toISOString();
+            lastRemoteError = undefined;
+        }
+        catch (error) {
+            lastRemoteError = message(error);
+        }
+    }, options.heartbeatIntervalMs ?? 30_000);
+    flushTimer.unref();
+    heartbeatTimer.unref();
+    for (const runId of await discoverRunIds(storageDirectory))
+        await journalFor(runId);
+    await flush();
+    return {
+        baseUrl: `http://${options.host ?? "127.0.0.1"}:${address.port}`,
+        close: async () => {
+            clearInterval(flushTimer);
+            clearInterval(heartbeatTimer);
+            await options.actionWorker?.close?.();
+            await flush();
+            await close(server);
+        },
+        flush,
+        status,
+    };
+}
+class GatewayRunJournal {
+    runId;
+    collector;
+    signer;
+    queue;
+    records;
+    chain = Promise.resolve();
+    receiptPath;
+    reconciliationPath;
+    constructor(directory, runId, collector, signer, records) {
+        this.runId = runId;
+        this.collector = collector;
+        this.signer = signer;
+        this.queue = new DurableRemoteCollectorQueue(directory, runId);
+        this.records = records;
+        const base = safeFileName(runId);
+        this.receiptPath = join(resolve(directory), `${base}.receipt.json`);
+        this.reconciliationPath = join(resolve(directory), `${base}.reconciled.json`);
+    }
+    static async open(directory, runId, collector, signer) {
+        const queue = new DurableRemoteCollectorQueue(directory, runId);
+        const records = await queue.all();
+        for (let index = 0; index < records.length; index += 1) {
+            const record = records[index];
+            if (record.runId !== runId || canonicalJson(record.collector) !== canonicalJson(collector))
+                throw new Error(`Stored gateway journal for ${runId} has a different collector identity.`);
+            if (index > 0 && record.previousEventHash !== records[index - 1].eventHash)
+                throw new Error(`Stored gateway journal for ${runId} has a broken hash chain.`);
+        }
+        return new GatewayRunJournal(directory, runId, collector, signer, records);
+    }
+    async append(type, payload, idempotencyKey, skippedSequences = 0) {
+        identifier(idempotencyKey, "idempotencyKey");
+        let result;
+        const operation = this.chain.then(async () => {
+            const recordId = sha256(`${this.runId}:${idempotencyKey}`);
+            const replay = this.records.find((record) => record.recordId === recordId);
+            if (replay) {
+                if (replay.type !== type || canonicalJson(replay.payload) !== canonicalJson(payload))
+                    throw new GatewayRequestError(409, `idempotencyKey ${idempotencyKey} was already used with different content.`);
+                result = replay;
+                return;
+            }
+            if (this.records.at(-1)?.type === "RUN_COMPLETED")
+                throw new GatewayRequestError(409, `Run ${this.runId} is already complete.`);
+            if (this.records.length === 0 && type !== "RUN_STARTED")
+                throw new GatewayRequestError(409, `Run ${this.runId} must start before appending records.`);
+            const previous = this.records.at(-1);
+            const occurredAt = new Date().toISOString();
+            const payloadSha256 = sha256(canonicalJson(payload));
+            const unsigned = {
+                schemaVersion: "agentcert.trusted_action_record.v0.1",
+                recordId,
+                runId: this.runId,
+                sequence: (previous?.sequence ?? -1) + 1 + skippedSequences,
+                occurredAt,
+                type,
+                collector: this.collector,
+                previousEventHash: previous?.eventHash,
+                payload,
+                payloadSha256,
+            };
+            const eventHash = sha256(canonicalJson(unsigned));
+            result = { ...unsigned, eventHash, sourceSignature: signDigest(eventHash, this.signer) };
+            await this.queue.enqueue(result);
+            this.records.push(result);
+        });
+        this.chain = operation.catch(() => undefined);
+        await operation;
+        return structuredClone(result);
+    }
+    async writeReceipt(input) {
+        const first = this.records[0];
+        const last = this.records.at(-1);
+        if (!first || last?.type !== "RUN_COMPLETED")
+            throw new Error("A completed run is required before writing a receipt.");
+        const droppedEventCount = this.records.filter((record) => record.type === "EVENTS_DROPPED")
+            .reduce((total, record) => total + Number(record.payload.count ?? 0), 0);
+        const payload = {
+            schemaVersion: "agentcert.trusted_run_receipt.v0.1",
+            runId: this.runId,
+            collector: this.collector,
+            startedAt: first.occurredAt,
+            completedAt: last.occurredAt,
+            eventCount: this.records.length,
+            droppedEventCount,
+            firstEventHash: first.eventHash,
+            lastEventHash: last.eventHash,
+            mandateDigests: [...new Set(input.mandateDigests)].sort(),
+            actionIds: [...new Set(input.actionIds)].sort(),
+            journal: { valid: true, complete: true, sourceSigned: true, gaps: [], duplicateSequences: [], duplicateRecordIds: [], hashMismatches: [], signatureFailures: [], droppedEventCount, recoveredTailBytes: 0, errors: [] },
+            evidenceStrength: input.evidenceStrength,
+            sourcePublicKeyPem: this.signer.publicKeyPem,
+        };
+        const receiptSha256 = sha256(canonicalJson(payload));
+        await writeFile(this.receiptPath, `${JSON.stringify({ ...payload, receiptSha256, sourceSignature: signDigest(receiptSha256, this.signer) }, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    }
+    async reconcileIfReady(client) {
+        if ((await this.queue.pending()).length > 0)
+            return false;
+        try {
+            await readFile(this.reconciliationPath, "utf8");
+            return false;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        let receipt;
+        try {
+            receipt = JSON.parse(await readFile(this.receiptPath, "utf8"));
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return false;
+            throw error;
+        }
+        const reconciliation = await client.reconcile(this.runId, receipt);
+        await writeFile(this.reconciliationPath, `${JSON.stringify(reconciliation)}\n`, { encoding: "utf8", mode: 0o600 });
+        return true;
+    }
+}
+class GatewayRequestError extends Error {
+    status;
+    constructor(status, messageText) {
+        super(messageText);
+        this.status = status;
+    }
+}
+function authenticate(request, expected) {
+    const actual = request.headers.authorization?.replace(/^Bearer\s+/i, "") ?? "";
+    const left = Buffer.from(actual);
+    const right = Buffer.from(expected);
+    if (left.length !== right.length || !timingSafeEqual(left, right))
+        throw new GatewayRequestError(401, "Gateway authentication failed.");
+}
+async function readJson(request, maxBytes) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of request) {
+        const value = Buffer.from(chunk);
+        size += value.length;
+        if (size > maxBytes)
+            throw new GatewayRequestError(413, `Request body exceeds ${maxBytes} bytes.`);
+        chunks.push(value);
+    }
+    try {
+        return JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
+    }
+    catch {
+        throw new GatewayRequestError(400, "Request body must be valid JSON.");
+    }
+}
+function listen(server, port, host) {
+    return new Promise((resolvePromise, reject) => server.once("error", reject).listen(port, host, resolvePromise));
+}
+function close(server) { return new Promise((resolvePromise, reject) => server.close((error) => error ? reject(error) : resolvePromise())); }
+function json(response, status, body) { response.statusCode = status; response.setHeader("content-type", "application/json"); response.end(JSON.stringify(body)); }
+function sha256(value) { return createHash("sha256").update(value).digest("hex"); }
+function publicKeyFingerprint(publicKeyPem) { return sha256(createPublicKey(publicKeyPem).export({ type: "spki", format: "der" })); }
+function signDigest(digest, signer) {
+    return { algorithm: "Ed25519", keyId: signer.keyId, signature: sign(null, Buffer.from(digest, "hex"), signer.privateKeyPem).toString("base64url") };
+}
+function identifier(value, field) { const parsed = required(value, field); if (parsed.length > 160 || !/^[A-Za-z0-9._:-]+$/.test(parsed))
+    throw new GatewayRequestError(400, `${field} must use URL-safe identifier characters.`); return parsed; }
+function required(value, field) { if (typeof value !== "string" || !value.trim())
+    throw new GatewayRequestError(400, `${field} is required.`); return value; }
+function object(value) { if (value === undefined)
+    return {}; if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new GatewayRequestError(400, "Expected a JSON object."); return value; }
+function strings(value) { if (value === undefined)
+    return []; if (!Array.isArray(value) || value.some((item) => typeof item !== "string"))
+    throw new GatewayRequestError(400, "Expected an array of strings."); return value; }
+function positiveInteger(value, field) { if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0)
+    throw new GatewayRequestError(400, `${field} must be a positive integer.`); return value; }
+function safeFileName(value) { return value.replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 160); }
+function message(error) { return error instanceof Error ? error.message : String(error); }
+async function discoverRunIds(directory) {
+    const runIds = new Set();
+    for (const entry of await readdir(directory, { withFileTypes: true })) {
+        if (!entry.isFile() || !entry.name.endsWith(".remote.jsonl"))
+            continue;
+        const firstLine = (await readFile(join(directory, entry.name), "utf8")).split(/\r?\n/, 1)[0];
+        if (!firstLine)
+            continue;
+        const record = JSON.parse(firstLine);
+        runIds.add(identifier(record.runId, "stored runId"));
+    }
+    return [...runIds];
+}

package/dist/internal/control-client/durable-action-worker.d.ts

@@ -0,0 +1,194 @@
+export type DurableActionPhase = "TRACKED" | "WAITING_APPROVAL" | "DENIED" | "EXPIRED" | "BLOCKED" | "GRANT_ISSUED" | "EXECUTION_STARTED" | "UNKNOWN_RESULT" | "EXECUTED" | "PROBED" | "COMPLETED";
+export interface DurableWorkerProposal {
+    externalId: string;
+    actionType: string;
+    targetSystem: string;
+    expectedState?: Record<string, unknown>;
+    executionIntent: {
+        adapterId: string;
+        adapterVersionConstraint: string;
+        allowedOrigins: string[];
+        allowedOperation: string;
+        allowedResource: string;
+        approvedParameters: Record<string, unknown>;
+        outcomePredicate: Record<string, unknown>;
+        agentBuildId: string;
+        agentBuildDigest: string;
+    };
+    [key: string]: unknown;
+}
+export interface DurableWorkerAction {
+    id: string;
+    externalId: string;
+    status: "PENDING_APPROVAL" | "APPROVED" | "ALLOWED" | "REJECTED" | "DENIED" | "APPROVAL_EXPIRED" | "GRANT_EXPIRED" | "VERIFIED" | string;
+    actionType: string;
+    targetSystem: string;
+    expectedState?: Record<string, unknown>;
+    approvalExpiresAt?: string;
+    assuranceContext?: {
+        executionIntent?: {
+            adapterId: string;
+            adapterVersionConstraint: string;
+            allowedOrigins: string[];
+            allowedOperation: string;
+            allowedResource: string;
+            approvedParametersDigest: string;
+            outcomePredicateDigest: string;
+            agentBuildId: string;
+            agentBuildDigest: string;
+        };
+    };
+    [key: string]: unknown;
+}
+export interface DurableWorkerGrant {
+    id: string;
+    status: string;
+    grant: {
+        payload?: Record<string, unknown>;
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+}
+export interface DurableWorkerExecutionResult {
+    executionSessionId: string;
+    [key: string]: unknown;
+}
+export interface DurableWorkerHostedReservation {
+    executionSessionId: string;
+    claim: Record<string, unknown>;
+}
+export interface DurableWorkerObservation {
+    observedState: Record<string, unknown>;
+    observationMethod: "TARGET_API" | "TARGET_UI" | "TARGET_AUDIT_LOG" | "WEBHOOK" | "DATABASE_QUERY" | "THIRD_PARTY_CONFIRMATION";
+    observationSource: string;
+    evidenceReferences?: string[];
+    confidence?: number;
+}
+export interface DurableActionCheckpoint {
+    schemaVersion: "witnora.durable_action_checkpoint.v0.1";
+    actionId: string;
+    phase: DurableActionPhase;
+    proposal: DurableWorkerProposal;
+    proposalSha256: string;
+    grant?: DurableWorkerGrant;
+    execution?: DurableWorkerExecutionResult;
+    observation?: DurableWorkerObservation;
+    receiptId?: string;
+    executionClaimId?: string;
+    hostedReservation?: DurableWorkerHostedReservation;
+    limitation?: string;
+    updatedAt: string;
+}
+export interface ActionCheckpointStore {
+    load(actionId: string): Promise<DurableActionCheckpoint | undefined>;
+    save(checkpoint: DurableActionCheckpoint): Promise<void>;
+    list(): Promise<DurableActionCheckpoint[]>;
+    claimExecution(actionId: string, ownerId: string, claimedAt: string): Promise<{
+        acquired: boolean;
+        claimId: string;
+    }>;
+}
+export declare class FileActionCheckpointStore implements ActionCheckpointStore {
+    private readonly directory;
+    constructor(directory: string);
+    load(actionId: string): Promise<DurableActionCheckpoint | undefined>;
+    save(checkpoint: DurableActionCheckpoint): Promise<void>;
+    list(): Promise<DurableActionCheckpoint[]>;
+    claimExecution(actionId: string, ownerId: string, claimedAt: string): Promise<{
+        acquired: boolean;
+        claimId: string;
+    }>;
+    private path;
+    private claimPath;
+}
+export interface DurableApprovedActionWorkerOptions {
+    config: {
+        adapterId: string;
+        adapterVersion: string;
+        probeId: string;
+        probeCredentialHandle: string;
+        runtimeIdentityId: string;
+        grantTtlSeconds?: number;
+        pollIntervalMs?: number;
+    };
+    store: ActionCheckpointStore;
+    hosted: {
+        getAction(actionId: string): Promise<DurableWorkerAction>;
+        issueExecutionGrant(actionId: string, input: Record<string, unknown>, idempotencyKey: string): Promise<DurableWorkerGrant>;
+        verifyAction(actionId: string, input: Record<string, unknown>, idempotencyKey: string): Promise<{
+            status: string;
+            verificationSuccess?: boolean;
+        }>;
+        listActionReceipts(actionId: string): Promise<Array<{
+            id: string;
+            receipt?: {
+                signatureSet?: unknown[];
+            };
+        }>>;
+        claimExecutionGrant(executionGrantId: string, claim: Record<string, unknown>, idempotencyKey: string): Promise<{
+            acquired: boolean;
+        }>;
+    };
+    runtime: {
+        reconcileReadOnly: true;
+        prepareClaim(input: {
+            action: DurableWorkerAction;
+            proposal: DurableWorkerProposal;
+            grant: DurableWorkerGrant;
+        }): Promise<DurableWorkerHostedReservation>;
+        execute(input: {
+            action: DurableWorkerAction;
+            proposal: DurableWorkerProposal;
+            grant: DurableWorkerGrant;
+            hostedReservation: DurableWorkerHostedReservation;
+        }): Promise<DurableWorkerExecutionResult>;
+        reconcile(input: {
+            action: DurableWorkerAction;
+            proposal: DurableWorkerProposal;
+            grant: DurableWorkerGrant;
+        }): Promise<DurableWorkerExecutionResult | undefined>;
+    };
+    probe: {
+        id: string;
+        credentialHandle: string;
+        readOnly: true;
+        observe(input: {
+            action: DurableWorkerAction;
+            proposal: DurableWorkerProposal;
+            grant: DurableWorkerGrant;
+            execution: DurableWorkerExecutionResult;
+        }): Promise<DurableWorkerObservation>;
+    };
+    now?: () => Date;
+}
+export interface DurableActionWorkerStatus {
+    schemaVersion: "witnora.durable_action_worker_status.v0.1";
+    ready: boolean;
+    trackedActionCount: number;
+    pendingActionCount: number;
+    unknownResultCount: number;
+    lastHeartbeatAt: string;
+    lastError?: string;
+}
+export declare class DurableApprovedActionWorker {
+    private readonly options;
+    private readonly now;
+    private readonly chains;
+    private timer?;
+    private lastHeartbeatAt;
+    private lastError?;
+    private readonly workerId;
+    constructor(options: DurableApprovedActionWorkerOptions);
+    track(input: {
+        actionId: string;
+        proposal: DurableWorkerProposal;
+    }): Promise<DurableActionCheckpoint>;
+    tick(actionId: string): Promise<DurableActionCheckpoint>;
+    start(): void;
+    stop(): void;
+    status(): Promise<DurableActionWorkerStatus>;
+    private tickOnce;
+    private persist;
+}
+export declare function runtimeAdapterVersionSatisfies(version: string, constraint: string): boolean;
+//# sourceMappingURL=durable-action-worker.d.ts.map

package/dist/internal/control-client/durable-action-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"durable-action-worker.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/durable-action-worker.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,kBAAkB,GAClB,QAAQ,GACR,SAAS,GACT,SAAS,GACT,cAAc,GACd,mBAAmB,GACnB,gBAAgB,GAChB,UAAU,GACV,QAAQ,GACR,WAAW,CAAC;AAEhB,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,eAAe,EAAE;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,wBAAwB,EAAE,MAAM,CAAC;QACjC,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,gBAAgB,EAAE,MAAM,CAAC;QACzB,eAAe,EAAE,MAAM,CAAC;QACxB,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1C,YAAY,EAAE,MAAM,CAAC;QACrB,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,kBAAkB,GAAG,eAAe,GAAG,UAAU,GAAG,MAAM,CAAC;IACzI,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE;YACrC,SAAS,EAAE,MAAM,CAAC;YAClB,wBAAwB,EAAE,MAAM,CAAC;YACjC,cAAc,EAAE,MAAM,EAAE,CAAC;YACzB,gBAAgB,EAAE,MAAM,CAAC;YACzB,eAAe,EAAE,MAAM,CAAC;YACxB,wBAAwB,EAAE,MAAM,CAAC;YACjC,sBAAsB,EAAE,MAAM,CAAC;YAC/B,YAAY,EAAE,MAAM,CAAC;YACrB,gBAAgB,EAAE,MAAM,CAAC;SAC1B,CAAA;KAAE,CAAC;IACJ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACrE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,4BAA4B;IAC3C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,8BAA8B;IAC7C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,iBAAiB,EAAE,YAAY,GAAG,WAAW,GAAG,kBAAkB,GAAG,SAAS,GAAG,gBAAgB,GAAG,0BAA0B,CAAC;IAC/H,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,wCAAwC,CAAC;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,SAAS,CAAC,EAAE,4BAA4B,CAAC;IACzC,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,8BAA8B,CAAC;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAAC;IACrE,IAAI,CAAC,UAAU,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IAC3C,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACvH;AAED,qBAAa,yBAA0B,YAAW,qBAAqB;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,SAAS,EAAE,MAAM;IAEvB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC;IAQpE,IAAI,CAAC,UAAU,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAYxD,IAAI,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAQ1C,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAmB3H,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,SAAS;CAIlB;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,qBAAqB,EAAE,MAAM,CAAC;QAC9B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,KAAK,EAAE,qBAAqB,CAAC;IAC7B,MAAM,EAAE;QACN,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC1D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC3H,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QACnJ,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE;gBAAE,YAAY,CAAC,EAAE,OAAO,EAAE,CAAA;aAAE,CAAA;SAAE,CAAC,CAAC,CAAC;QAC7G,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;YAAE,QAAQ,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;KACvI,CAAC;IACF,OAAO,EAAE;QACP,iBAAiB,EAAE,IAAI,CAAC;QACxB,YAAY,CAAC,KAAK,EAAE;YAAE,MAAM,EAAE,mBAAmB,CAAC;YAAC,QAAQ,EAAE,qBAAqB,CAAC;YAAC,KAAK,EAAE,kBAAkB,CAAA;SAAE,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;QAC1J,OAAO,CAAC,KAAK,EAAE;YAAE,MAAM,EAAE,mBAAmB,CAAC;YAAC,QAAQ,EAAE,qBAAqB,CAAC;YAAC,KAAK,EAAE,kBAAkB,CAAC;YAAC,iBAAiB,EAAE,8BAA8B,CAAA;SAAE,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;QACtM,SAAS,CAAC,KAAK,EAAE;YAAE,MAAM,EAAE,mBAAmB,CAAC;YAAC,QAAQ,EAAE,qBAAqB,CAAC;YAAC,KAAK,EAAE,kBAAkB,CAAA;SAAE,GAAG,OAAO,CAAC,4BAA4B,GAAG,SAAS,CAAC,CAAC;KAClK,CAAC;IACF,KAAK,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,IAAI,CAAC;QACf,OAAO,CAAC,KAAK,EAAE;YAAE,MAAM,EAAE,mBAAmB,CAAC;YAAC,QAAQ,EAAE,qBAAqB,CAAC;YAAC,KAAK,EAAE,kBAAkB,CAAC;YAAC,SAAS,EAAE,4BAA4B,CAAA;SAAE,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;KACzL,CAAC;IACF,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,2CAA2C,CAAC;IAC3D,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,2BAA2B;IAQ1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAPpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuD;IAC9E,OAAO,CAAC,KAAK,CAAC,CAAiC;IAC/C,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;gBAEZ,OAAO,EAAE,kCAAkC;IAUlE,KAAK,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,qBAAqB,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAgB3G,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAOxD,KAAK,IAAI,IAAI;IAcb,IAAI,IAAI,IAAI;IAEN,MAAM,IAAI,OAAO,CAAC,yBAAyB,CAAC;YAapC,QAAQ;YA8GR,OAAO;CAMtB;AA2DD,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAY3F"}