@axiom-lattice/gateway 8.1.1 → 8.3.0

package/dist/index.mjs

@@ -3112,6 +3112,29 @@ async function listAllRuns(ledger, tenantId, threadId) {
     if (page.length < ACTIVE_RUN_PAGE_SIZE) return runs;
   }
 }
+var INPUT_PREVIEW_MAX = 200;
+function contentToPreview(content) {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return "";
+  return content.map((part) => {
+    if (typeof part === "string") return part;
+    return isRecord(part) && typeof part.text === "string" ? part.text : "";
+  }).join("");
+}
+function inputPreview(input) {
+  if (!isRecord(input)) return null;
+  if (typeof input.message === "string") {
+    return input.message.trim().slice(0, INPUT_PREVIEW_MAX) || null;
+  }
+  const messages = Array.isArray(input.messages) ? input.messages : [];
+  for (const message of messages) {
+    if (!isRecord(message)) continue;
+    if (message.role !== void 0 && message.role !== "human") continue;
+    const text = contentToPreview(message.content).trim();
+    if (text) return text.slice(0, INPUT_PREVIEW_MAX);
+  }
+  return null;
+}
 function toSafeRun(run2) {
   return {
     runId: run2.runId,
@@ -3123,7 +3146,9 @@ function toSafeRun(run2) {
     createdAt: run2.createdAt,
     updatedAt: run2.updatedAt,
     startedAt: run2.startedAt,
-    finishedAt: run2.finishedAt
+    finishedAt: run2.finishedAt,
+    messageId: run2.inputMessageIds[0] ?? null,
+    inputPreview: inputPreview(run2.input)
   };
 }
 function isTerminal(run2) {
@@ -3253,6 +3278,35 @@ function createRunLifecycleHandlers(deps = {}) {
   const pollIntervalMs = deps.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
   const now = deps.now ?? Date.now;
   const sleep = deps.sleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
+  const withRunCreateLock = async (request, reply, tenantId, assistantId, threadId, operation) => {
+    const key = runCreateScopeKey(tenantId, assistantId, threadId);
+    return serializeRunCreate(key, async () => {
+      const leaseStore = resolveLeaseStore();
+      if (!leaseStore) return operation();
+      try {
+        return await withLease(
+          leaseStore,
+          key,
+          getReplicaId2(),
+          operation,
+          RUN_CREATE_LEASE
+        );
+      } catch (error) {
+        if (error instanceof LeaseAcquisitionTimeoutError) {
+          request.log.warn(
+            { err: error, leaseKey: key },
+            "Run create lease acquisition timed out"
+          );
+          return unavailable(
+            reply,
+            RUN_CREATE_LOCK_TIMEOUT,
+            "Could not serialize run creation for this thread; retry shortly"
+          );
+        }
+        throw error;
+      }
+    });
+  };
   const waitForTerminal = async (tenantId, params, initial) => {
     let current3 = initial;
     const deadline = now() + waitTimeoutMs;
@@ -3482,35 +3536,6 @@ function createRunLifecycleHandlers(deps = {}) {
       const outcome = await createPending();
       return outcome.ok ? respondCreated(outcome.run) : outcome.response;
     };
-    const withRunCreateLock = async (operation) => {
-      const key = runCreateScopeKey(tenantId, assistantId, threadId);
-      return serializeRunCreate(key, async () => {
-        const leaseStore = resolveLeaseStore();
-        if (!leaseStore) return operation();
-        try {
-          return await withLease(
-            leaseStore,
-            key,
-            getReplicaId2(),
-            operation,
-            RUN_CREATE_LEASE
-          );
-        } catch (error) {
-          if (error instanceof LeaseAcquisitionTimeoutError) {
-            request.log.warn(
-              { err: error, leaseKey: key },
-              "Run create lease acquisition timed out"
-            );
-            return unavailable(
-              reply,
-              RUN_CREATE_LOCK_TIMEOUT,
-              "Could not serialize run creation for this thread; retry shortly"
-            );
-          }
-          throw error;
-        }
-      });
-    };
     const scopedRunApiRuns = (runs) => runs.filter(
       (run2) => run2.tenantId === tenantId && run2.threadId === threadId && run2.assistantId === assistantId && run2.source === "run_api"
     );
@@ -3530,7 +3555,7 @@ function createRunLifecycleHandlers(deps = {}) {
       }
     };
     if (strategy === "reject") {
-      return withRunCreateLock(async () => {
+      return withRunCreateLock(request, reply, tenantId, assistantId, threadId, async () => {
         const read = await readThreadRuns();
         if (!read.ok) return read.response;
         const active2 = scopedRunApiRuns(read.runs).filter(isActiveRun);
@@ -3546,7 +3571,7 @@ function createRunLifecycleHandlers(deps = {}) {
       });
     }
     if (strategy === "interrupt") {
-      return withRunCreateLock(async () => {
+      return withRunCreateLock(request, reply, tenantId, assistantId, threadId, async () => {
         const read = await readThreadRuns();
         if (!read.ok) return read.response;
         const scoped = scopedRunApiRuns(read.runs);
@@ -3609,8 +3634,8 @@ function createRunLifecycleHandlers(deps = {}) {
         return createAndRespond();
       });
     }
-    if (strategy !== "rollback") return withRunCreateLock(createAndRespond);
-    return withRunCreateLock(async () => {
+    if (strategy !== "rollback") return withRunCreateLock(request, reply, tenantId, assistantId, threadId, createAndRespond);
+    return withRunCreateLock(request, reply, tenantId, assistantId, threadId, async () => {
       const active2 = (await listAllRuns(ledger, tenantId, threadId)).filter(
         (run2) => run2.tenantId === tenantId && run2.threadId === threadId && run2.assistantId === assistantId && run2.source !== "legacy" && (run2.status === "pending" || run2.status === "running")
       );
@@ -3745,6 +3770,76 @@ function createRunLifecycleHandlers(deps = {}) {
       return createAndRespond();
     });
   };
+  const cancelActive = async (request, reply) => {
+    if (!ledger) {
+      return unavailable(reply, RUN_LEDGER_UNAVAILABLE, "Run ledger is not available");
+    }
+    const tenantId = getTenantId4(request);
+    const { assistantId, threadId } = request.params;
+    if (!await ownsThread(tenantId, assistantId, threadId)) {
+      return notFound2(reply, THREAD_NOT_FOUND2, "Thread not found");
+    }
+    const router = resolveRouter();
+    return withRunCreateLock(request, reply, tenantId, assistantId, threadId, async () => {
+      let runs;
+      try {
+        runs = await listAllRuns(ledger, tenantId, threadId);
+      } catch (error) {
+        request.log.error({ err: error }, "Active run read failed");
+        return unavailable(reply, RUN_CREATE_UNAVAILABLE2, "Run queue is not available");
+      }
+      const active2 = runs.filter(
+        (run2) => run2.tenantId === tenantId && run2.assistantId === assistantId && run2.threadId === threadId && run2.source === "run_api" && isActiveRun(run2)
+      );
+      const cancelled = [];
+      const requested = [];
+      const failed = [];
+      for (const run2 of active2) {
+        try {
+          if (run2.status === "pending") {
+            const status2 = await ledger.requestCancel(tenantId, run2.runId);
+            if (status2 === "cancelled") {
+              const latest = await ledger.getRun(tenantId, run2.runId);
+              if (latest) cancelled.push(toSafeRun(latest));
+            } else if (status2 === "requested") {
+              requested.push(toSafeRun(run2));
+            }
+            continue;
+          }
+          if (router) {
+            const status2 = await router.requestCancelById({
+              tenantId,
+              assistantId,
+              threadId,
+              runId: run2.runId,
+              reason: "abort"
+            });
+            if (status2 === "requested" || status2 === "cancelled") {
+              requested.push(toSafeRun(run2));
+            }
+            continue;
+          }
+          const status = await ledger.requestCancel(tenantId, run2.runId);
+          if (status === "requested" || status === "cancelled") {
+            requested.push(toSafeRun(run2));
+          }
+        } catch (error) {
+          failed.push({
+            runId: run2.runId,
+            code: "RUN_CANCEL_FAILED",
+            message: error instanceof Error ? error.message : String(error)
+          });
+        }
+      }
+      return reply.status(200).send({
+        success: true,
+        accepted: failed.length === 0,
+        cancelled,
+        requested,
+        failed
+      });
+    });
+  };
   const list = async (request, reply) => {
     if (!ledger) {
       return unavailable(reply, RUN_LEDGER_UNAVAILABLE, "Run ledger is not available");
@@ -3754,12 +3849,14 @@ function createRunLifecycleHandlers(deps = {}) {
     if (!await ownsThread(tenantId, assistantId, threadId)) {
       return notFound2(reply, THREAD_NOT_FOUND2, "Thread not found");
     }
-    const runs = (await ledger.listRuns(tenantId, threadId)).filter(
-      (run2) => run2.tenantId === tenantId && run2.threadId === threadId && run2.assistantId === assistantId
+    const activeOnly = request.query.active === "true" || request.query.active === "1";
+    const source = request.query.source;
+    const scoped = (activeOnly ? await listAllRuns(ledger, tenantId, threadId) : await ledger.listRuns(tenantId, threadId)).filter(
+      (run2) => run2.tenantId === tenantId && run2.threadId === threadId && run2.assistantId === assistantId && (!activeOnly || isActiveRun(run2)) && (source === void 0 || run2.source === source)
     );
     return reply.status(200).send({
       success: true,
-      data: { runs: runs.map(toSafeRun) }
+      data: { runs: scoped.map(toSafeRun) }
     });
   };
   const get = async (request, reply) => {
@@ -4115,7 +4212,7 @@ function createRunLifecycleHandlers(deps = {}) {
       run: toSafeRun(outcome.run)
     });
   };
-  return { create, list, get, join: join4, cancel };
+  return { create, list, get, join: join4, cancel, cancelActive };
 }
 function registerRunLifecycleRoutes(app2, deps = {}) {
   const handlers = createRunLifecycleHandlers(deps);
@@ -4127,6 +4224,10 @@ function registerRunLifecycleRoutes(app2, deps = {}) {
     "/api/assistants/:assistantId/threads/:threadId/runs",
     handlers.list
   );
+  app2.post(
+    "/api/assistants/:assistantId/threads/:threadId/runs/cancel-active",
+    handlers.cancelActive
+  );
   app2.get(
     "/api/assistants/:assistantId/threads/:threadId/runs/:runId",
     handlers.get
@@ -11917,15 +12018,25 @@ var ProjectAccessService = class {
       input.projectId,
       input.userId
     );
-    if (membership?.status === "active") {
+    if (project.kind === "personal") {
+      if (!this.isActiveMembership(membership, input)) this.accessDenied();
       this.requireCapability(membership, input.capability);
       return { project, membership };
     }
+    if (this.isActiveMembership(membership, input) && this.hasCapability(membership, input.capability)) {
+      return { project, membership };
+    }
+    const tenantAdmin = await this.tenantAdminMembership(project, input);
+    if (this.isActiveMembership(membership, input)) {
+      if (tenantAdmin) return { project, membership: tenantAdmin };
+      this.requireCapability(membership, input.capability);
+    }
     const memberships = await this.deps.membershipStore.list(input.tenantId, input.projectId);
-    if (memberships.length !== 0) this.accessDenied();
-    if (project.kind === "personal") this.accessDenied();
-    const tenantLink = await this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId);
-    if (tenantLink?.role !== "owner" && tenantLink?.role !== "admin") this.accessDenied();
+    if (memberships.length !== 0) {
+      if (tenantAdmin) return { project, membership: tenantAdmin };
+      this.accessDenied();
+    }
+    if (!tenantAdmin) this.accessDenied();
     let claim;
     try {
       claim = await this.deps.membershipStore.createInitialOwner({
@@ -11968,9 +12079,19 @@ var ProjectAccessService = class {
       input.projectId,
       input.userId
     );
-    if (!membership || membership.tenantId !== input.tenantId || membership.projectId !== input.projectId || membership.userId !== input.userId || membership.status !== "active") this.accessDenied();
-    this.requireCapability(membership, input.capability);
-    return { project, membership };
+    const activeMembership = this.isActiveMembership(membership, input) ? membership : void 0;
+    if (project.kind === "personal") {
+      if (!activeMembership) this.accessDenied();
+      this.requireCapability(activeMembership, input.capability);
+      return { project, membership: activeMembership };
+    }
+    if (activeMembership && this.hasCapability(activeMembership, input.capability)) {
+      return { project, membership: activeMembership };
+    }
+    const tenantAdmin = await this.tenantAdminMembership(project, input);
+    if (tenantAdmin) return { project, membership: tenantAdmin };
+    if (activeMembership) this.requireCapability(activeMembership, input.capability);
+    this.accessDenied();
   }
   /**
    * Authorizes roster visibility for any active participant (owner/admin/member/viewer).
@@ -11992,6 +12113,9 @@ var ProjectAccessService = class {
       input.userId
     );
     if (membership?.status === "active") {
+      if (this.hasCapability(membership, input.capability)) return { project, membership };
+      const tenantAdmin = await this.tenantAdminMembership(project, input);
+      if (tenantAdmin) return { project, membership: tenantAdmin };
       this.requireCapability(membership, input.capability);
       return { project, membership };
     }
@@ -12006,6 +12130,9 @@ var ProjectAccessService = class {
       input.userId
     );
     if (membership?.status === "active") {
+      if (this.hasCapability(membership, input.capability)) return { project, membership };
+      const tenantAdmin = await this.tenantAdminMembership(project, input);
+      if (tenantAdmin) return { project, membership: tenantAdmin };
       this.requireCapability(membership, input.capability);
       return { project, membership };
     }
@@ -12057,8 +12184,29 @@ var ProjectAccessService = class {
       throw error;
     }
   }
+  hasCapability(membership, capability2) {
+    return allowedRoles[capability2].has(membership.role);
+  }
   requireCapability(membership, capability2) {
-    if (!allowedRoles[capability2].has(membership.role)) this.accessDenied();
+    if (!this.hasCapability(membership, capability2)) this.accessDenied();
+  }
+  async tenantAdminMembership(project, input) {
+    if (project.kind === "personal") return void 0;
+    const tenantLink = await this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId);
+    if (tenantLink?.role !== "owner" && tenantLink?.role !== "admin") return void 0;
+    return {
+      id: `tenant-admin:${input.userId}`,
+      tenantId: input.tenantId,
+      projectId: project.id,
+      userId: input.userId,
+      role: "admin",
+      status: "active",
+      joinedAt: project.createdAt,
+      updatedAt: project.updatedAt
+    };
+  }
+  isActiveMembership(membership, input) {
+    return membership != null && membership.tenantId === input.tenantId && membership.projectId === input.projectId && membership.userId === input.userId && membership.status === "active";
   }
   accessDenied() {
     throw new ProjectCollaborationError("PROJECT_ACCESS_DENIED", 403, "Project access denied");
@@ -21023,6 +21171,15 @@ function registerAgentWebAppRuntimeRoutes(app2, deps) {
           return normalizeError2(reply, error);
         }
       });
+      routes.post(`${prefix}/assistants/:assistantId/threads/:threadId/runs/cancel-active`, async (request, reply) => {
+        try {
+          const params = mirrorThreadParams.parse(request.params);
+          const { proxy } = await authorizeRunMirror(request, params);
+          return await runLifecycle.cancelActive(proxy, reply);
+        } catch (error) {
+          return normalizeError2(reply, error);
+        }
+      });
       routes.post(`${prefix}/assistants/:assistantId/threads/:threadId/runs/:runId/cancel`, async (request, reply) => {
         try {
           const params = mirrorRunParams.parse(request.params);
@@ -23339,8 +23496,6 @@ var ProjectMembershipService = class {
   }
   async list(actor3) {
     await this.deps.accessService.requireRosterAccess(actor3);
-    const membership = await this.deps.membershipStore.findByUser(actor3.tenantId, actor3.projectId, actor3.userId);
-    if (!membership || membership.status !== "active") this.accessDenied();
     return this.deps.membershipStore.list(actor3.tenantId, actor3.projectId);
   }
   async add(actor3, input) {
@@ -23398,10 +23553,8 @@ var ProjectMembershipService = class {
     });
   }
   async authorize(actor3) {
-    await this.deps.accessService.requireProjectAccess({ ...actor3, capability: "manage" });
-    const membership = await this.deps.membershipStore.findByUser(actor3.tenantId, actor3.projectId, actor3.userId);
-    if (!membership || membership.status !== "active") this.accessDenied();
-    return membership;
+    const access = await this.deps.accessService.requireProjectAccess({ ...actor3, capability: "manage" });
+    return access.membership;
   }
   async target(actor3, id3) {
     const target = (await this.deps.membershipStore.list(actor3.tenantId, actor3.projectId)).find((item) => item.id === id3);