openclaw/dist/cron-creator-authority-context-C3oD224u.mjs

Multi-channel AI gateway with extensible messaging integrations

import { l as normalizeOptionalString } from "./string-coerce-6kR-86XC.mjs";
import { t as isPromiseLike } from "./promise-like-D7-l5Fsp.mjs";
import { A as validateAgentRunDelegatedAuthority, l as getAgentRunContext } from "./agent-run-registry-RDoBEeyg.mjs";
import { i as getGatewayToolCallerIdentity } from "./gateway-caller-context-BeMzkOlX.mjs";
import { f as revokeCronCreatorAuthorityRunScope, r as createCronCreatorAuthorityRunScope, s as hasCronChannelRequester, t as CRON_MANAGEMENT_METHODS, u as mintCronCreatorAuthorityGrant } from "./cron-creator-authority-grant-B_BJgMnC.mjs";
import { AsyncLocalStorage } from "node:async_hooks";
//#region src/agents/cron-creator-authority-context.ts
function createCronCreatorAuthorityCapability(runId, callerOrigin = { kind: "unknown" }, managementEntitlement, isCurrent, channelRequester, requesterOwner, callerScopedCreation) {
	const normalizedRunId = runId.trim();
	return normalizedRunId ? createCronCreatorAuthorityRunScope(normalizedRunId, callerOrigin, managementEntitlement, isCurrent, channelRequester, requesterOwner, callerScopedCreation) : void 0;
}
const activeCronCreatorAuthority = new AsyncLocalStorage();
const activeCronCreatorAuthorityResolver = new AsyncLocalStorage();
/** Retain the Cron-only fence when tools materialize outside their creator scope. */
function bindActiveCronAuthorityCurrentness(runId) {
	const scope = activeCronCreatorAuthority.getStore();
	return scope?.active && scope.runId === runId?.trim() ? scope.isCurrent : void 0;
}
/** Retain the exact scope for callbacks invoked outside their creation context. */
function bindRequesterYieldCronAuthority(runId) {
	const scope = activeCronCreatorAuthority.getStore();
	const authority = getGatewayToolCallerIdentity()?.approvalAuthority;
	if (!scope?.managementEntitlement || scope.runId !== runId || !authority || authority.operationalRunInstance.runId !== runId) return;
	return (run) => {
		const caller = getGatewayToolCallerIdentity()?.approvalAuthority;
		if (!scope.active || scope.signal.aborted || caller?.operationalRunInstance.instanceId !== authority.operationalRunInstance.instanceId || !validateAgentRunDelegatedAuthority(authority)) return activeCronCreatorAuthority.exit(run);
		return activeCronCreatorAuthority.run(scope, run);
	};
}
/** Capture live management and separately admitted owner identity before the requester yields. */
function captureActiveCronManagementAuthority(params) {
	const scope = activeCronCreatorAuthority.getStore();
	const caller = getGatewayToolCallerIdentity();
	const authority = caller?.approvalAuthority;
	const context = getAgentRunContext(params.runId);
	const sessionId = context?.sessionId;
	if (!scope?.managementEntitlement || scope.runId !== params.runId || caller?.sessionKey !== params.sessionKey || caller.agentId !== params.agentId || context?.sessionKey !== params.sessionKey || context.agentId !== params.agentId || !sessionId || !authority || authority.operationalRunInstance.runId !== params.runId) return;
	const isActive = () => {
		try {
			return scope.active && !scope.signal.aborted && scope.isCurrent?.() !== false && (scope.managementEntitlement?.source !== "channel-owner" || scope.managementEntitlement.isCurrent()) && !caller.approvalSignals?.some((signal) => signal.aborted) && caller.approvalAuthorityCheck?.() !== false && getAgentRunContext(params.runId) === context && validateAgentRunDelegatedAuthority(authority);
		} catch {
			return false;
		}
	};
	return isActive() ? {
		sessionId,
		lifecycleGeneration: authority.lifecycleGeneration,
		managementEntitlement: scope.managementEntitlement,
		requesterOwner: scope.requesterOwner,
		isActive
	} : void 0;
}
/** Bind only the separately captured owner identity of an admitted requester continuation. */
function bindRequesterOwnerIdentity(params) {
	const scope = activeCronCreatorAuthority.getStore();
	const owner = scope?.requesterOwner;
	const caller = getGatewayToolCallerIdentity();
	const authority = caller?.approvalAuthority;
	const context = params.runId ? getAgentRunContext(params.runId) : void 0;
	if (!scope || !owner || scope.callerOrigin.kind !== "unknown" || !scope.isCurrent || !params.runId || scope.runId !== params.runId || !params.sessionKey || !params.sessionId || !params.agentId || caller?.sessionKey !== params.sessionKey || caller.agentId !== params.agentId || context?.sessionKey !== params.sessionKey || context.sessionId !== params.sessionId || context.agentId !== params.agentId || !authority || authority.operationalRunInstance.runId !== params.runId) return;
	const runId = params.runId;
	const isCurrent = () => {
		try {
			return scope.active && !scope.signal.aborted && scope.isCurrent?.() === true && owner.isCurrent() && !caller.approvalSignals?.some((signal) => signal.aborted) && caller.approvalAuthorityCheck?.() !== false && getAgentRunContext(runId) === context && validateAgentRunDelegatedAuthority(authority);
		} catch {
			return false;
		}
	};
	return {
		isCurrent,
		senderId: owner.senderId,
		channel: owner.channel,
		accountId: owner.accountId,
		assertCurrent: () => {
			if (!isCurrent()) throw new Error("Requester owner identity is no longer active for this continuation");
		}
	};
}
/** Bind at tool construction, never rediscover authority from model arguments or routes. */
function bindCronManagementGrant(runId) {
	const scope = activeCronCreatorAuthority.getStore();
	const authority = getGatewayToolCallerIdentity()?.approvalAuthority;
	if (!scope?.managementEntitlement || !scope.active || scope.signal.aborted || scope.isCurrent?.() === false || scope.managementEntitlement.source === "channel-owner" && !scope.managementEntitlement.isCurrent() || scope.runId !== runId || !authority || authority.operationalRunInstance.runId !== runId || !validateAgentRunDelegatedAuthority(authority)) return;
	const managementOnly = scope.callerOrigin.kind === "unknown" && !scope.callerScopedCreation;
	return {
		managementOnly,
		mint: (method, signal) => {
			if (!CRON_MANAGEMENT_METHODS.some((allowed) => allowed === method)) {
				if (managementOnly) throw new Error("This management-only turn can only list, get, update, run, or remove automations. Use the Automations page for other actions.");
				return;
			}
			return mintCronCreatorAuthorityGrant(scope, signal, void 0, {
				method,
				authority
			});
		}
	};
}
/** Retains authenticated provenance before late CLI admission without execution authority. */
function captureCronRequesterGrantIssuer(runId) {
	const scope = activeCronCreatorAuthority.getStore();
	if (!scope || scope.callerOrigin.kind !== "local" && !hasCronChannelRequester(scope) && !scope.callerScopedCreation || scope.runId !== runId) return;
	return (authority, signal, sourceIsCurrent) => {
		const isCurrent = () => authority.operationalRunInstance.runId === scope.runId && validateAgentRunDelegatedAuthority(authority) && sourceIsCurrent?.() !== false;
		return mintCronCreatorAuthorityGrant(scope, signal, void 0, void 0, "requester", isCurrent);
	};
}
/** Captures authenticated requester facts independently of full tool-surface materialization. */
function bindCronRequesterGrant(runId) {
	const issue = captureCronRequesterGrantIssuer(runId);
	const authority = getGatewayToolCallerIdentity()?.approvalAuthority;
	return issue && authority && authority.operationalRunInstance.runId === runId && validateAgentRunDelegatedAuthority(authority) ? (signal) => issue(authority, signal) : void 0;
}
function isFreshChannelCronAuthorityTurn(params) {
	return Boolean(params.messageProvider) && Boolean(normalizeOptionalString(params.senderId)) && !params.isHeartbeat && !params.isRoomEvent && params.inputProvenance === void 0 && params.spawnedBy === void 0 && params.suppressNextUserMessagePersistence !== true;
}
/** Owns one explicitly transported creator-authority capability until run settlement. */
function runWithCronCreatorAuthorityCapability(scope, run, signal) {
	const revoke = () => revokeCronCreatorAuthorityRunScope(scope);
	signal?.addEventListener("abort", revoke, { once: true });
	if (signal?.aborted) revoke();
	try {
		const result = activeCronCreatorAuthority.run(scope, run);
		if (isPromiseLike(result)) return Promise.resolve(result).finally(() => {
			signal?.removeEventListener("abort", revoke);
			revoke();
		});
		signal?.removeEventListener("abort", revoke);
		revoke();
		return result;
	} catch (error) {
		signal?.removeEventListener("abort", revoke);
		revoke();
		throw error;
	}
}
/** Combines an admitted capability with a late exact-thread tool-surface resolver. */
function bindCronCreatorAuthorityResolver(params) {
	const normalizedRunId = params.runId?.trim();
	const authority = params.capability;
	if (!normalizedRunId || authority?.active !== true || authority.runId !== normalizedRunId || authority.managementEntitlement && authority.callerOrigin.kind === "unknown") return;
	return async (options) => {
		const operationSignal = options?.signal;
		authority.signal.throwIfAborted();
		operationSignal?.throwIfAborted();
		if (authority.isCurrent?.() === false) throw new Error("Automation caller authority is no longer active.");
		const signal = operationSignal ? AbortSignal.any([authority.signal, operationSignal]) : authority.signal;
		const snapshot = await params.resolve({ signal });
		authority.signal.throwIfAborted();
		operationSignal?.throwIfAborted();
		if (!authority.active) authority.signal.throwIfAborted();
		return Object.freeze({
			tools: snapshot.tools,
			provenance: snapshot.provenance,
			grant: mintCronCreatorAuthorityGrant(authority, operationSignal, snapshot.runtimeAuthority)
		});
	};
}
/** Installs an explicitly transported capability only for synchronous tool construction. */
function runWithCronCreatorAuthorityCapabilityResolver(params) {
	const normalizedRunId = params.runId?.trim();
	const authority = params.capability;
	if (!normalizedRunId || authority?.active !== true || authority.runId !== normalizedRunId) return params.run();
	return activeCronCreatorAuthority.run(authority, () => activeCronCreatorAuthorityResolver.run({
		runId: normalizedRunId,
		resolve: params.resolve
	}, params.run));
}
/** Carries a bundled-Codex resolver through synchronous core tool construction. */
function runWithCronCreatorAuthorityResolver(params) {
	return activeCronCreatorAuthorityResolver.run({
		runId: params.runId.trim(),
		resolve: params.resolve
	}, params.run);
}
/** Binds the resolver to the exact active run and revokes retained callbacks at settlement. */
function bindActiveCronCreatorAuthorityResolver(runId) {
	const authority = activeCronCreatorAuthority.getStore();
	const resolver = activeCronCreatorAuthorityResolver.getStore();
	const normalizedRunId = runId?.trim();
	if (!normalizedRunId || resolver?.runId !== normalizedRunId) return;
	return bindCronCreatorAuthorityResolver({
		capability: authority,
		runId: normalizedRunId,
		resolve: resolver.resolve
	});
}
/** Retains the exact admitted owner turn only while its run scope remains live. */
function bindActiveOperatorTurnAuthority(runId) {
	const authority = activeCronCreatorAuthority.getStore();
	const normalizedRunId = runId?.trim();
	if (!normalizedRunId || authority?.active !== true || authority.runId !== normalizedRunId || authority.callerOrigin.kind === "unknown") return;
	return {
		source: authority.callerOrigin.kind === "local" ? "local" : "channel-owner",
		assertActive: () => {
			authority.signal.throwIfAborted();
			if (!authority.active || authority.runId !== normalizedRunId || authority.isCurrent?.() === false || authority.managementEntitlement?.source === "channel-owner" && !authority.managementEntitlement.isCurrent()) {
				authority.signal.throwIfAborted();
				throw new Error("operator turn authority is no longer active");
			}
		}
	};
}
//#endregion
export { bindCronRequesterGrant as a, captureActiveCronManagementAuthority as c, isFreshChannelCronAuthorityTurn as d, runWithCronCreatorAuthorityCapability as f, bindCronManagementGrant as i, captureCronRequesterGrantIssuer as l, runWithCronCreatorAuthorityResolver as m, bindActiveCronCreatorAuthorityResolver as n, bindRequesterOwnerIdentity as o, runWithCronCreatorAuthorityCapabilityResolver as p, bindActiveOperatorTurnAuthority as r, bindRequesterYieldCronAuthority as s, bindActiveCronAuthorityCurrentness as t, createCronCreatorAuthorityCapability as u };