// ---------------------------------------------------------------------------// @executor-js/sdk/host-internal — host-composition seams that live in the SDK// only because the SDK's own internals share their implementation.//// This entry is NOT part of the plugin-author contract (the root barrel). It// exists so the host layer (`@executor-js/api/server`) can reach SDK-resident// host machinery without that machinery polluting the plugin-author surface://// - `makeHostedHttpClientLayer` / `makeHostedFetch` /// `HostedOutboundRequestBlocked`: the hosted HTTP client builder plus the// guarded Fetch API adapter for libraries that require fetch. The shared// outbound URL guard is consumed by `createExecutor`'s built-in `fetch` tool// (the SSRF guard), which is why the module stays in the SDK rather than// moving wholesale to the host.// - `createExecutorFumaDb` + its types: the pure, driver-agnostic FumaDB// assembly. It stays in the SDK because the SDK's own sqlite test backend// builds its handle with it; the host layer re-exports it (and pairs it// with the `DbProvider` Effect seam) from `@executor-js/api/server`.// - `assertSupportedOAuthEndpointUrl` / `OAUTH2_DEFAULT_TIMEOUT_MS`: the OAuth// endpoint SSRF guard + default fetch timeout. The SDK's own OAuth flow uses// them; the host's connection-identity handler reuses the same guard/timeout// when fetching OIDC userinfo, so they surface here (not the plugin barrel).// - `touchSubject`: the sole writer of the `subject` table. The SDK writes a// sighting at connection-create; the host layer writes one per request in// `makeScopedExecutor`. Not a plugin-author concern.// `resetSubjectTouchCache` comes with it: `touchSubject` keeps a// process-local memory of who it already filed, so a test that seeds the// same principal against a fresh database has to clear it or the second// seed is skipped as a repeat sighting.// ---------------------------------------------------------------------------export { HostedOutboundRequestBlocked, makeHostedFetch, makeHostedHttpClientLayer, type HostedHttpClientOptions,} from "./hosted-http-client";export { OAUTH2_DEFAULT_TIMEOUT_MS, assertSupportedOAuthEndpointUrl } from "./oauth-helpers";export { DEFAULT_SUBJECT_LAST_SEEN_THROTTLE_MS, resetSubjectTouchCache, touchSubject, type TouchSubjectInput,} from "./subject-registry";export { createExecutorFumaDb, type CreateExecutorFumaDbOptions, type ExecutorDbHandle, type ExecutorDbProvider, type ExecutorFumaDb, type ExecutorFumaSchema,} from "./executor-fuma-db";
// ---------------------------------------------------------------------------
// @executor-js/sdk/host-internal — host-composition seams that live in the SDK
// only because the SDK's own internals share their implementation.
//
// This entry is NOT part of the plugin-author contract (the root barrel). It
// exists so the host layer (`@executor-js/api/server`) can reach SDK-resident
// host machinery without that machinery polluting the plugin-author surface:
//
// - `makeHostedHttpClientLayer` / `makeHostedFetch` /
// `HostedOutboundRequestBlocked`: the hosted HTTP client builder plus the
// guarded Fetch API adapter for libraries that require fetch. The shared
// outbound URL guard is consumed by `createExecutor`'s built-in `fetch` tool
// (the SSRF guard), which is why the module stays in the SDK rather than
// moving wholesale to the host.
// - `createExecutorFumaDb` + its types: the pure, driver-agnostic FumaDB
// assembly. It stays in the SDK because the SDK's own sqlite test backend
// builds its handle with it; the host layer re-exports it (and pairs it
// with the `DbProvider` Effect seam) from `@executor-js/api/server`.
// - `assertSupportedOAuthEndpointUrl` / `OAUTH2_DEFAULT_TIMEOUT_MS`: the OAuth
// endpoint SSRF guard + default fetch timeout. The SDK's own OAuth flow uses
// them; the host's connection-identity handler reuses the same guard/timeout
// when fetching OIDC userinfo, so they surface here (not the plugin barrel).
// - `touchSubject`: the sole writer of the `subject` table. The SDK writes a
// sighting at connection-create; the host layer writes one per request in
// `makeScopedExecutor`. Not a plugin-author concern.
// `resetSubjectTouchCache` comes with it: `touchSubject` keeps a
// process-local memory of who it already filed, so a test that seeds the
// same principal against a fresh database has to clear it or the second
// seed is skipped as a repeat sighting.
// ---------------------------------------------------------------------------
export {
HostedOutboundRequestBlocked,
makeHostedFetch,
makeHostedHttpClientLayer,
type HostedHttpClientOptions,
} from "./hosted-http-client";
export { OAUTH2_DEFAULT_TIMEOUT_MS, assertSupportedOAuthEndpointUrl } from "./oauth-helpers";
export {
DEFAULT_SUBJECT_LAST_SEEN_THROTTLE_MS,
resetSubjectTouchCache,
touchSubject,
type TouchSubjectInput,
} from "./subject-registry";
export {
createExecutorFumaDb,
type CreateExecutorFumaDbOptions,
type ExecutorDbHandle,
type ExecutorDbProvider,
type ExecutorFumaDb,
type ExecutorFumaSchema,
} from "./executor-fuma-db";