@agentuity/runtime 2.0.11 → 3.0.0-alpha.1

package/src/bootstrap.ts

@@ -1,321 +0,0 @@
-/**
- * Server lifecycle helpers.
- *
- * These functions are called by createApp() to set up routes, middleware,
- * and the Bun HTTP server. They're kept separate to keep createApp() focused
- * on orchestration while these handle the details.
- */
-
-import type { Context } from 'hono';
-import { websocket, serveStatic } from 'hono/bun';
-import { readFileSync, existsSync } from 'node:fs';
-import { join } from 'node:path';
-import { mimeTypes } from '@agentuity/server';
-
-import { runShutdown } from './app';
-import type { AnalyticsOptions, WorkbenchOptions } from './app';
-import { createRouter } from './router';
-import { createWebSessionMiddleware } from './middleware';
-import { enableProcessExitProtection } from './_process-protection';
-import { hasWaitUntilPending } from './_waituntil';
-import { getOrganizationId, getProjectId, isDevMode as runtimeIsDevMode } from './_config';
-import { BEACON_SCRIPT } from '@agentuity/frontend';
-
-// ============================================================================
-// Mode detection
-// ============================================================================
-
-/**
- * Runtime mode detection.
- * Dynamic string concatenation prevents Bun.build from inlining NODE_ENV.
- * @see https://github.com/oven-sh/bun/issues/20183
- */
-const getEnv = (key: string) => process.env[key];
-/**
- * Check if running in development mode.
- *
- * The CLI dev server explicitly sets NODE_ENV='development'. In production
- * (cloud deployment, CI integration test running a built app.js), NODE_ENV
- * may be 'production' or unset entirely. When unset, we assume production
- * — the dev server always sets it, so absence means production.
- */
-export const isDevelopment = () => getEnv('NODE' + '_' + 'ENV') === 'development';
-
-// ============================================================================
-// Analytics helpers
-// ============================================================================
-
-/** Resolve analytics config with defaults */
-export function resolveAnalyticsConfig(
-	analytics: boolean | AnalyticsOptions | undefined
-): AnalyticsOptions & { enabled: boolean } {
-	if (analytics === false) {
-		return { enabled: false };
-	}
-	const opts = typeof analytics === 'object' ? analytics : {};
-	return {
-		enabled: opts.enabled !== false,
-		requireConsent: opts.requireConsent ?? false,
-		trackClicks: opts.trackClicks ?? true,
-		trackScroll: opts.trackScroll ?? true,
-		trackOutboundLinks: opts.trackOutboundLinks ?? true,
-		trackForms: opts.trackForms ?? false,
-		trackWebVitals: opts.trackWebVitals ?? true,
-		trackErrors: opts.trackErrors ?? true,
-		trackSPANavigation: opts.trackSPANavigation ?? true,
-		sampleRate: opts.sampleRate ?? 1,
-		excludePatterns: opts.excludePatterns ?? [],
-		globalProperties: opts.globalProperties ?? {},
-	};
-}
-
-/** Resolve workbench config */
-export function resolveWorkbenchConfig(
-	workbench: boolean | string | WorkbenchOptions | undefined
-): { enabled: boolean; route: string; headers: Record<string, string> } {
-	if (!workbench) {
-		return { enabled: false, route: '/workbench', headers: {} };
-	}
-	if (workbench === true) {
-		return { enabled: true, route: '/workbench', headers: {} };
-	}
-	if (typeof workbench === 'string') {
-		return { enabled: true, route: workbench, headers: {} };
-	}
-	return {
-		enabled: true,
-		route: workbench.route ?? '/workbench',
-		headers: workbench.headers ?? {},
-	};
-}
-
-/** Inject analytics scripts into HTML */
-function injectAnalytics(
-	html: string,
-	analyticsConfig: AnalyticsOptions & { enabled: boolean }
-): string {
-	if (!analyticsConfig.enabled) return html;
-
-	const orgId = getOrganizationId() || '';
-	const projectId = getProjectId() || '';
-	const isDevmode = runtimeIsDevMode();
-
-	const pageConfig = {
-		...analyticsConfig,
-		orgId,
-		projectId,
-		isDevmode,
-	};
-
-	const configScript = `<script>window.__AGENTUITY_ANALYTICS__=${JSON.stringify(pageConfig)};</script>`;
-	const sessionScript = '<script src="/_agentuity/webanalytics/session.js" async></script>';
-
-	// In production, the beacon is already in HTML as a CDN asset (data-agentuity-beacon marker)
-	const beaconMarker = '<script data-agentuity-beacon';
-	if (html.includes(beaconMarker)) {
-		const injection = configScript + sessionScript;
-		return html.replace(beaconMarker, injection + beaconMarker);
-	}
-
-	// Development: beacon served from local route
-	const beaconScript = '<script src="/_agentuity/webanalytics/analytics.js"></script>';
-	const injection = configScript + sessionScript + beaconScript;
-
-	if (html.includes('</head>')) {
-		return html.replace('</head>', injection + '</head>');
-	}
-	if (html.includes('<body')) {
-		return html.replace(/<body([^>]*)>/, `<body$1>${injection}`);
-	}
-	return injection + html;
-}
-
-/** Register analytics routes on the app */
-export function registerAnalyticsRoutes(
-	app: ReturnType<typeof createRouter>,
-	_analyticsConfig: AnalyticsOptions & { enabled: boolean }
-): void {
-	app.get(
-		'/_agentuity/webanalytics/session.js',
-		createWebSessionMiddleware(),
-		async (c: Context) => {
-			const threadId = c.get('_webThreadId') || '';
-			const sessionData = JSON.stringify({ threadId });
-			const sessionScript = `window.__AGENTUITY_SESSION__=${sessionData};`;
-			return new Response(sessionScript, {
-				headers: {
-					'Content-Type': 'application/javascript; charset=utf-8',
-					'Cache-Control': 'no-store, no-cache, must-revalidate',
-				},
-			});
-		}
-	);
-
-	if (isDevelopment()) {
-		app.get('/_agentuity/webanalytics/analytics.js', async () => {
-			return new Response(BEACON_SCRIPT, {
-				headers: {
-					'Content-Type': 'application/javascript; charset=utf-8',
-					'Cache-Control': 'no-store, no-cache, must-revalidate',
-				},
-			});
-		});
-	}
-}
-
-// ============================================================================
-// Health routes
-// ============================================================================
-
-export function registerHealthRoutes(app: ReturnType<typeof createRouter>): void {
-	if (!isDevelopment()) {
-		const healthHandler = (c: Context) => {
-			return c.text('OK', 200, { 'Content-Type': 'text/plain; charset=utf-8' });
-		};
-		const idleHandler = (c: Context) => {
-			const server = globalThis.__AGENTUITY_SERVER__;
-			if (!server) return c.text('NO', 200, { 'Content-Type': 'text/plain; charset=utf-8' });
-			if (hasWaitUntilPending())
-				return c.text('NO', 200, { 'Content-Type': 'text/plain; charset=utf-8' });
-			if (server.pendingRequests > 1)
-				return c.text('NO', 200, { 'Content-Type': 'text/plain; charset=utf-8' });
-			if (server.pendingWebSockets > 0)
-				return c.text('NO', 200, { 'Content-Type': 'text/plain; charset=utf-8' });
-			return c.text('OK', 200, { 'Content-Type': 'text/plain; charset=utf-8' });
-		};
-		app.get('/_agentuity/health', healthHandler);
-		app.get('/_health', healthHandler);
-		app.get('/_agentuity/idle', idleHandler);
-		app.get('/_idle', idleHandler);
-	}
-
-	if (isDevelopment()) {
-		app.get('/_agentuity/ready', (c: Context) => {
-			return c.text('OK', 200, { 'Content-Type': 'text/plain; charset=utf-8' });
-		});
-	}
-}
-
-// ============================================================================
-// Web routes (production static serving)
-// ============================================================================
-
-export function registerWebRoutes(
-	app: ReturnType<typeof createRouter>,
-	analyticsConfig: AnalyticsOptions & { enabled: boolean }
-): void {
-	if (isDevelopment()) return;
-
-	// Resolve client dir relative to the built app.js location (import.meta.dir)
-	// The app runs from .agentuity/ and the client output is at .agentuity/client/
-	const appDir = typeof import.meta.dir === 'string' ? import.meta.dir : process.cwd();
-	const clientDir = join(appDir, 'client');
-
-	// Vite may output index.html at either:
-	// 1. client/index.html (when input is just index.html at root)
-	// 2. client/src/web/index.html (when input is src/web/index.html with root='.')
-	// Check both locations to support different vite.config.ts setups
-	let indexHtmlPath = join(clientDir, 'index.html');
-	if (!existsSync(indexHtmlPath)) {
-		indexHtmlPath = join(clientDir, 'src', 'web', 'index.html');
-	}
-
-	const baseIndexHtml = existsSync(indexHtmlPath) ? readFileSync(indexHtmlPath, 'utf-8') : '';
-
-	if (!baseIndexHtml) return;
-
-	const prodHtmlHandler = (c: Context) => {
-		if (analyticsConfig.enabled) {
-			const html = injectAnalytics(baseIndexHtml, analyticsConfig);
-			return c.html(html);
-		}
-		return c.html(baseIndexHtml);
-	};
-
-	app.get('/', prodHtmlHandler);
-	app.use('/assets/*', serveStatic({ root: clientDir, mimes: mimeTypes }));
-	app.use(
-		'/*',
-		serveStatic({
-			root: clientDir,
-			rewriteRequestPath: (path: string) => path,
-			mimes: mimeTypes,
-		})
-	);
-
-	app.all('/_agentuity/*', (c: Context) => c.notFound());
-	app.all('/api/*', (c: Context) => c.notFound());
-
-	app.get('*', (c: Context) => {
-		const path = c.req.path;
-		if (/\.[a-zA-Z0-9]+$/.test(path)) {
-			return c.notFound();
-		}
-		return prodHtmlHandler(c);
-	});
-}
-
-// ============================================================================
-// Workbench UI route (dev only)
-// ============================================================================
-
-export function registerWorkbenchUI(
-	app: ReturnType<typeof createRouter>,
-	workbenchConfig: { enabled: boolean; route: string }
-): void {
-	if (!workbenchConfig.enabled || !isDevelopment()) return;
-
-	const workbenchSrcDir = join(process.cwd(), '.agentuity', 'workbench-src');
-	const workbenchIndexPath = join(workbenchSrcDir, 'index.html');
-
-	app.get(workbenchConfig.route, async (c: Context) => {
-		const html = await Bun.file(workbenchIndexPath).text();
-		const withVite = html
-			.replace('src="./main.tsx"', `src="/@fs${workbenchSrcDir}/main.tsx"`)
-			.replace('href="./styles.css"', `href="/@fs${workbenchSrcDir}/styles.css"`);
-		return c.html(withVite);
-	});
-}
-
-// ============================================================================
-// Server startup
-// ============================================================================
-
-export function startServer(
-	app: ReturnType<typeof createRouter>,
-	options?: { requestTimeout?: number }
-): void {
-	if (typeof Bun === 'undefined') return;
-
-	enableProcessExitProtection();
-
-	const port = parseInt(process.env.PORT || '3500', 10);
-	const requestTimeout = options?.requestTimeout ?? 0;
-
-	const server = Bun.serve({
-		fetch: (req, server) => {
-			server.timeout(req, requestTimeout);
-			return app.fetch(req, server);
-		},
-		websocket,
-		port,
-		hostname: '127.0.0.1',
-		development: isDevelopment(),
-	});
-
-	globalThis.__AGENTUITY_SERVER__ = server;
-
-	if (!isDevelopment()) {
-		const handleShutdown = async (_signal: string) => {
-			try {
-				await runShutdown();
-			} catch {
-				// Ignore shutdown errors
-			}
-			process.exit(0);
-		};
-
-		process.once('SIGTERM', () => handleShutdown('SIGTERM'));
-		process.once('SIGINT', () => handleShutdown('SIGINT'));
-	}
-}

package/src/bun-s3-patch.ts

@@ -1,224 +0,0 @@
-/**
- * Bun S3 monkey-patch for Agentuity storage endpoints
- *
- * Agentuity storage uses virtual-hosted-style URLs (e.g., ag-{id}.t3.storageapi.dev).
- * Bun's default s3 export uses path-style addressing, causing bucket path mismatch.
- *
- * This module patches Bun.S3Client.prototype methods to automatically set
- * virtualHostedStyle: true when S3_ENDPOINT matches *.storage.dev
- *
- * Patched methods:
- * - file(path, options?) - S3Options
- * - presign(path, options?) - S3FilePresignOptions
- * - write(path, data, options?) - S3Options
- * - delete(path, options?) - S3Options
- * - exists(path, options?) - S3Options
- * - stat(path, options?) - S3Options
- * - size(path, options?) - S3Options
- * - unlink(path, options?) - S3Options
- * - list(input?, options?) - options type doesn't include virtualHostedStyle but we inject it anyway
- */
-
-const PATCHED_SYMBOL = Symbol.for('agentuity.s3.patched');
-
-/**
- * Check if an endpoint is an Agentuity storage endpoint (*.storage.dev or *.storageapi.dev)
- */
-export function isAgentuityStorageEndpoint(raw: string): boolean {
-	let host = raw.trim();
-	if (!host) return false;
-
-	try {
-		const url = new URL(host.includes('://') ? host : `https://${host}`);
-		host = url.hostname;
-	} catch {
-		// raw value wasn't a URL string; treat it as host already
-	}
-
-	return (
-		host === 'storage.dev' ||
-		host.endsWith('.storage.dev') ||
-		host === 'storageapi.dev' ||
-		host.endsWith('.storageapi.dev')
-	);
-}
-
-/**
- * Helper to inject virtualHostedStyle into options if not already set
- */
-function injectVirtualHostedStyle(options?: Record<string, unknown>): Record<string, unknown> {
-	if (!options || typeof options.virtualHostedStyle === 'undefined') {
-		return { ...options, virtualHostedStyle: true };
-	}
-	return options;
-}
-
-/**
- * Patch Bun's S3Client to automatically use virtualHostedStyle for storage.dev endpoints
- *
- * This function:
- * 1. Checks if we're running in Bun with S3 support
- * 2. Checks if S3_ENDPOINT (or AWS_ENDPOINT) points to *.storage.dev
- * 3. Patches S3Client.prototype methods to inject virtualHostedStyle: true
- *
- * Safe to call in non-Bun environments (will no-op).
- * Idempotent (safe to call multiple times).
- */
-export function patchBunS3ForStorageDev(): void {
-	const bun = (globalThis as Record<string, unknown>).Bun as
-		| {
-				s3?: unknown;
-				S3Client?: {
-					prototype: {
-						file?: (path: string, options?: Record<string, unknown>) => unknown;
-						presign?: (path: string, options?: Record<string, unknown>) => unknown;
-						write?: (
-							path: string,
-							data: unknown,
-							options?: Record<string, unknown>
-						) => unknown;
-						delete?: (path: string, options?: Record<string, unknown>) => unknown;
-						exists?: (path: string, options?: Record<string, unknown>) => unknown;
-						stat?: (path: string, options?: Record<string, unknown>) => unknown;
-						size?: (path: string, options?: Record<string, unknown>) => unknown;
-						unlink?: (path: string, options?: Record<string, unknown>) => unknown;
-						list?: (
-							input?: Record<string, unknown> | null,
-							options?: Record<string, unknown>
-						) => unknown;
-						[PATCHED_SYMBOL]?: boolean;
-					};
-				};
-		  }
-		| undefined;
-
-	if (!bun?.s3 || !bun.S3Client?.prototype?.file) {
-		return;
-	}
-
-	const endpointEnv = process.env.S3_ENDPOINT ?? process.env.AWS_ENDPOINT;
-	if (!endpointEnv) {
-		return;
-	}
-
-	if (!isAgentuityStorageEndpoint(endpointEnv)) {
-		return;
-	}
-
-	const S3ClientProto = bun.S3Client.prototype;
-
-	if (S3ClientProto[PATCHED_SYMBOL]) {
-		return;
-	}
-
-	// Patch file(path, options?)
-	const originalFile = S3ClientProto.file!;
-	S3ClientProto.file = function patchedFile(
-		this: unknown,
-		path: string,
-		options?: Record<string, unknown>
-	): unknown {
-		return originalFile.call(this, path, injectVirtualHostedStyle(options));
-	};
-
-	// Patch presign(path, options?)
-	if (S3ClientProto.presign) {
-		const originalPresign = S3ClientProto.presign;
-		S3ClientProto.presign = function patchedPresign(
-			this: unknown,
-			path: string,
-			options?: Record<string, unknown>
-		): unknown {
-			return originalPresign.call(this, path, injectVirtualHostedStyle(options));
-		};
-	}
-
-	// Patch write(path, data, options?)
-	if (S3ClientProto.write) {
-		const originalWrite = S3ClientProto.write;
-		S3ClientProto.write = function patchedWrite(
-			this: unknown,
-			path: string,
-			data: unknown,
-			options?: Record<string, unknown>
-		): unknown {
-			return originalWrite.call(this, path, data, injectVirtualHostedStyle(options));
-		};
-	}
-
-	// Patch delete(path, options?)
-	if (S3ClientProto.delete) {
-		const originalDelete = S3ClientProto.delete;
-		S3ClientProto.delete = function patchedDelete(
-			this: unknown,
-			path: string,
-			options?: Record<string, unknown>
-		): unknown {
-			return originalDelete.call(this, path, injectVirtualHostedStyle(options));
-		};
-	}
-
-	// Patch exists(path, options?)
-	if (S3ClientProto.exists) {
-		const originalExists = S3ClientProto.exists;
-		S3ClientProto.exists = function patchedExists(
-			this: unknown,
-			path: string,
-			options?: Record<string, unknown>
-		): unknown {
-			return originalExists.call(this, path, injectVirtualHostedStyle(options));
-		};
-	}
-
-	// Patch stat(path, options?)
-	if (S3ClientProto.stat) {
-		const originalStat = S3ClientProto.stat;
-		S3ClientProto.stat = function patchedStat(
-			this: unknown,
-			path: string,
-			options?: Record<string, unknown>
-		): unknown {
-			return originalStat.call(this, path, injectVirtualHostedStyle(options));
-		};
-	}
-
-	// Patch size(path, options?)
-	if (S3ClientProto.size) {
-		const originalSize = S3ClientProto.size;
-		S3ClientProto.size = function patchedSize(
-			this: unknown,
-			path: string,
-			options?: Record<string, unknown>
-		): unknown {
-			return originalSize.call(this, path, injectVirtualHostedStyle(options));
-		};
-	}
-
-	// Patch unlink(path, options?)
-	if (S3ClientProto.unlink) {
-		const originalUnlink = S3ClientProto.unlink;
-		S3ClientProto.unlink = function patchedUnlink(
-			this: unknown,
-			path: string,
-			options?: Record<string, unknown>
-		): unknown {
-			return originalUnlink.call(this, path, injectVirtualHostedStyle(options));
-		};
-	}
-
-	// Patch list(input?, options?)
-	// Note: The TypeScript type for list's options doesn't include virtualHostedStyle,
-	// but we inject it anyway as the underlying implementation may still use it
-	if (S3ClientProto.list) {
-		const originalList = S3ClientProto.list;
-		S3ClientProto.list = function patchedList(
-			this: unknown,
-			input?: Record<string, unknown> | null,
-			options?: Record<string, unknown>
-		): unknown {
-			return originalList.call(this, input, injectVirtualHostedStyle(options));
-		};
-	}
-
-	S3ClientProto[PATCHED_SYMBOL] = true;
-}

package/src/cors.ts

@@ -1,137 +0,0 @@
-/**
- * CORS trusted origin helpers for same-origin configuration.
- *
- * Provides the same trusted-origin logic as @agentuity/auth,
- * allowing CORS to be restricted to platform-trusted domains.
- */
-
-import type { Context } from 'hono';
-
-/**
- * Safely extract origin from a URL string.
- * Returns undefined if the URL is invalid.
- */
-function safeOrigin(url: string | undefined): string | undefined {
-	if (!url) return undefined;
-	try {
-		return new URL(url).origin;
-	} catch {
-		return undefined;
-	}
-}
-
-/**
- * Parse an origin-like value (URL or bare domain) into a normalized origin.
- *
- * - Full URLs (http://... or https://...) are parsed as-is
- * - Bare domains (example.com) are treated as https://
- * - Invalid values return undefined
- */
-function parseOriginLike(value: string): string | undefined {
-	const trimmed = value.trim();
-	if (!trimmed) return undefined;
-
-	// If it looks like a URL (has a scheme), parse directly
-	if (/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(trimmed)) {
-		return safeOrigin(trimmed);
-	}
-
-	// Otherwise, treat as host[:port] and assume https
-	return safeOrigin(`https://${trimmed}`);
-}
-
-/**
- * Build the static trusted origins set from environment variables.
- *
- * Reads from:
- * - AGENTUITY_BASE_URL - The base URL for the deployment
- * - AGENTUITY_CLOUD_DOMAINS - Platform-set domains (comma-separated)
- * - AUTH_TRUSTED_DOMAINS - Developer-set additional domains (comma-separated)
- */
-function buildEnvTrustedOrigins(): Set<string> {
-	const agentuityURL = process.env.AGENTUITY_BASE_URL;
-	const cloudDomains = process.env.AGENTUITY_CLOUD_DOMAINS;
-	const devTrustedDomains = process.env.AUTH_TRUSTED_DOMAINS;
-
-	const origins = new Set<string>();
-
-	const agentuityOrigin = safeOrigin(agentuityURL);
-	if (agentuityOrigin) origins.add(agentuityOrigin);
-
-	// Platform-set cloud domains (deployment, project, PR, custom domains, tunnels)
-	if (cloudDomains) {
-		for (const raw of cloudDomains.split(',')) {
-			const origin = parseOriginLike(raw);
-			if (origin) origins.add(origin);
-		}
-	}
-
-	// Developer-set additional trusted domains
-	if (devTrustedDomains) {
-		for (const raw of devTrustedDomains.split(',')) {
-			const origin = parseOriginLike(raw);
-			if (origin) origins.add(origin);
-		}
-	}
-
-	return origins;
-}
-
-/**
- * Options for createTrustedCorsOrigin.
- */
-export interface TrustedCorsOriginOptions {
-	/**
-	 * Additional origins to allow on top of environment-derived ones.
-	 * Can be full URLs (https://example.com) or bare domains (example.com).
-	 */
-	allowedOrigins?: string[];
-}
-
-/**
- * Create a Hono CORS origin callback that only allows trusted origins.
- *
- * Trusted origins are derived from:
- * - AGENTUITY_BASE_URL environment variable
- * - AGENTUITY_CLOUD_DOMAINS environment variable (comma-separated)
- * - AUTH_TRUSTED_DOMAINS environment variable (comma-separated)
- * - The same-origin of the incoming request URL
- * - Any additional origins specified in allowedOrigins option
- *
- * @example
- * ```typescript
- * import { createApp, createTrustedCorsOrigin } from '@agentuity/runtime';
- *
- * await createApp({
- *   cors: {
- *     origin: createTrustedCorsOrigin({
- *       allowedOrigins: ['https://admin.myapp.com'],
- *     }),
- *   },
- * });
- * ```
- */
-export function createTrustedCorsOrigin(
-	options?: TrustedCorsOriginOptions
-): (origin: string, c: Context) => string | undefined {
-	// Build static origins from env vars at creation time
-	const baseOrigins = buildEnvTrustedOrigins();
-
-	// Add any extra origins from options
-	if (options?.allowedOrigins) {
-		for (const raw of options.allowedOrigins) {
-			const origin = parseOriginLike(raw);
-			if (origin) baseOrigins.add(origin);
-		}
-	}
-
-	return (origin: string, c: Context): string | undefined => {
-		// Build allowed set per-request to include same-origin of the server
-		const allowed = new Set(baseOrigins);
-		const requestOrigin = safeOrigin(c.req.url);
-		if (requestOrigin) allowed.add(requestOrigin);
-
-		// Only echo back if trusted; otherwise return undefined (no CORS header)
-		return allowed.has(origin) ? origin : undefined;
-	};
-}