openclaw/dist/cron-creator-authority-context-CkDgGats.js

Multi-channel AI gateway with extensible messaging integrations

import { l as normalizeOptionalString } from "./string-coerce-CIXf7egm.js";
import { t as isPromiseLike } from "./promise-like-D7-l5Fsp.js";
import { T as validateAgentRunDelegatedAuthority } from "./agent-run-registry-CKYKdfNd.js";
import { r as getGatewayToolCallerIdentity } from "./gateway-caller-context-BxVUFvkR.js";
import { a as mintCronCreatorAuthorityGrant, o as revokeCronCreatorAuthorityRunScope, r as createCronCreatorAuthorityRunScope, t as CRON_MANAGEMENT_METHODS } from "./cron-creator-authority-grant-CDgrJQRP.js";
import { AsyncLocalStorage } from "node:async_hooks";
//#region src/agents/cron-creator-authority-context.ts
function createCronCreatorAuthorityCapability(runId, callerOrigin = { kind: "unknown" }, controlUiAdmin) {
	const normalizedRunId = runId.trim();
	return normalizedRunId ? createCronCreatorAuthorityRunScope(normalizedRunId, callerOrigin, controlUiAdmin) : void 0;
}
const activeCronCreatorAuthority = new AsyncLocalStorage();
const activeCronCreatorAuthorityResolver = new AsyncLocalStorage();
/** Bind at tool construction, never rediscover authority from model arguments or routes. */
function bindCronManagementGrant(runId) {
	const scope = activeCronCreatorAuthority.getStore();
	const authority = getGatewayToolCallerIdentity()?.approvalAuthority;
	if (!scope?.controlUiAdmin || !scope.active || scope.signal.aborted || scope.runId !== runId || !authority || authority.operationalRunInstance.runId !== runId || !validateAgentRunDelegatedAuthority(authority)) return;
	const managementOnly = scope.callerOrigin.kind === "unknown";
	return {
		managementOnly,
		mint: (method, signal) => {
			if (!CRON_MANAGEMENT_METHODS.some((allowed) => allowed === method)) {
				if (managementOnly) throw new Error("This Control UI turn can only list, get, update, run, or remove automations. Use the Automations page for other actions.");
				return;
			}
			return mintCronCreatorAuthorityGrant(scope, signal, void 0, {
				method,
				authority
			});
		}
	};
}
function shouldAdmitFreshChannelOwnerCronAuthority(params) {
	return params.senderIsOwner && Boolean(params.messageProvider) && Boolean(normalizeOptionalString(params.senderId)) && !params.isHeartbeat && !params.isRoomEvent && params.inputProvenance === void 0 && params.spawnedBy === void 0 && params.suppressNextUserMessagePersistence !== true;
}
/** Owns one explicitly transported creator-authority capability until run settlement. */
function runWithCronCreatorAuthorityCapability(scope, run, signal) {
	const revoke = () => revokeCronCreatorAuthorityRunScope(scope);
	signal?.addEventListener("abort", revoke, { once: true });
	if (signal?.aborted) revoke();
	try {
		const result = activeCronCreatorAuthority.run(scope, run);
		if (isPromiseLike(result)) return Promise.resolve(result).finally(() => {
			signal?.removeEventListener("abort", revoke);
			revoke();
		});
		signal?.removeEventListener("abort", revoke);
		revoke();
		return result;
	} catch (error) {
		signal?.removeEventListener("abort", revoke);
		revoke();
		throw error;
	}
}
/** Combines an admitted capability with a late exact-thread tool-surface resolver. */
function bindCronCreatorAuthorityResolver(params) {
	const normalizedRunId = params.runId?.trim();
	const authority = params.capability;
	if (!normalizedRunId || authority?.active !== true || authority.runId !== normalizedRunId || authority.controlUiAdmin && authority.callerOrigin.kind === "unknown") return;
	return async (options) => {
		const operationSignal = options?.signal;
		authority.signal.throwIfAborted();
		operationSignal?.throwIfAborted();
		const signal = operationSignal ? AbortSignal.any([authority.signal, operationSignal]) : authority.signal;
		const snapshot = await params.resolve({ signal });
		authority.signal.throwIfAborted();
		operationSignal?.throwIfAborted();
		if (!authority.active) authority.signal.throwIfAborted();
		return Object.freeze({
			tools: snapshot.tools,
			provenance: snapshot.provenance,
			grant: mintCronCreatorAuthorityGrant(authority, operationSignal, snapshot.runtimeAuthority)
		});
	};
}
/** Installs an explicitly transported capability only for synchronous tool construction. */
function runWithCronCreatorAuthorityCapabilityResolver(params) {
	const normalizedRunId = params.runId?.trim();
	const authority = params.capability;
	if (!normalizedRunId || authority?.active !== true || authority.runId !== normalizedRunId) return params.run();
	return activeCronCreatorAuthority.run(authority, () => activeCronCreatorAuthorityResolver.run({
		runId: normalizedRunId,
		resolve: params.resolve
	}, params.run));
}
/** Carries a bundled-Codex resolver through synchronous core tool construction. */
function runWithCronCreatorAuthorityResolver(params) {
	return activeCronCreatorAuthorityResolver.run({
		runId: params.runId.trim(),
		resolve: params.resolve
	}, params.run);
}
/** Binds the resolver to the exact active run and revokes retained callbacks at settlement. */
function bindActiveCronCreatorAuthorityResolver(runId) {
	const authority = activeCronCreatorAuthority.getStore();
	const resolver = activeCronCreatorAuthorityResolver.getStore();
	const normalizedRunId = runId?.trim();
	if (!normalizedRunId || resolver?.runId !== normalizedRunId) return;
	return bindCronCreatorAuthorityResolver({
		capability: authority,
		runId: normalizedRunId,
		resolve: resolver.resolve
	});
}
/** Retains the exact admitted owner turn only while its run scope remains live. */
function bindActiveOperatorTurnAuthority(runId) {
	const authority = activeCronCreatorAuthority.getStore();
	const normalizedRunId = runId?.trim();
	if (!normalizedRunId || authority?.active !== true || authority.runId !== normalizedRunId || authority.callerOrigin.kind === "unknown") return;
	return {
		source: authority.callerOrigin.kind === "local" ? "local" : "channel-owner",
		assertActive: () => {
			authority.signal.throwIfAborted();
			if (!authority.active || authority.runId !== normalizedRunId) {
				authority.signal.throwIfAborted();
				throw new Error("operator turn authority is no longer active");
			}
		}
	};
}
//#endregion
export { runWithCronCreatorAuthorityCapability as a, shouldAdmitFreshChannelOwnerCronAuthority as c, createCronCreatorAuthorityCapability as i, bindActiveOperatorTurnAuthority as n, runWithCronCreatorAuthorityCapabilityResolver as o, bindCronManagementGrant as r, runWithCronCreatorAuthorityResolver as s, bindActiveCronCreatorAuthorityResolver as t };