@byollm/relay 0.1.0-alpha.24 → 0.1.0-alpha.26

package/dist/index.js

@@ -1,3 +1,9 @@
+import {
+  AWAITING_PAYLOAD_MS,
+  RelayState,
+  routeKey
+} from "./chunk-ZH2GB6FY.js";
+
 // src/daemon-plane.ts
 import {
   ClaimRequest,
@@ -84,17 +90,10 @@ var DaemonPlane = class {
     if (!verifyPublicIdentity(parsed.data.device)) {
       return fail(400, "bad-request", "the device identity is not consistent");
     }
-    const consent = this.#deps.projection.consentFor(
-      parsed.data.owner,
-      this.#deps.siteId
-    );
-    if (!consent) {
+    const sites = this.#deps.projection.sitesFor(parsed.data.owner);
+    if (sites.length === 0) {
       return fail(403, "forbidden", "no consent record for this user");
     }
-    const site = this.#deps.projection.siteFor(this.#deps.siteId);
-    if (!site) {
-      return fail(403, "forbidden", "this site is not registered");
-    }
     const approved = this.#deps.projection.deviceByFingerprint(
       parsed.data.device.identity
     );
@@ -117,8 +116,17 @@ var DaemonPlane = class {
     return ok({
       protocolVersion: PROTOCOL_VERSION,
       runnerId,
-      /** The *site's* key. See the note above — this is load-bearing. */
-      site: site.site
+      /**
+       * The *sites'* keys. See the note above — this is load-bearing.
+       *
+       * The set this owner has consented to, keyed by each site's identity
+       * key id (cloud_009 §5). Paused sites are here: a paused consent keeps
+       * its pin so re-consenting never costs a re-pair, and what it does not
+       * do is route.
+       */
+      sites: Object.fromEntries(
+        sites.map((record) => [keyId(record.site.identity), record.site])
+      )
     });
   }
   /** Every authenticated call: signature first, then consent, then work. */
@@ -140,7 +148,7 @@ var DaemonPlane = class {
     });
     if (failure === "stale") return this.#clockSkew();
     if (failure) return fail(401, "unauthorized", "signature check failed");
-    const revoked = this.#deps.projection.consentFor(known.owner, this.#deps.siteId) === null;
+    const revoked = this.#deps.projection.sitesFor(known.owner).length === 0;
     if (revoked && options.allowRevoked !== true) {
       return fail(403, "revoked", "routing for this runner has been revoked");
     }
@@ -176,19 +184,16 @@ var DaemonPlane = class {
         runnerId: device.runnerId,
         owner: device.owner,
         device: device.device,
-        siteId: this.#deps.siteId,
         kinds: new Set(request.capabilities.map((c) => c.kind)),
         // The projection, collapsed to data the store can match on — a
-        // predicate does not travel.
+        // predicate does not travel, and a set of (site, owner) pairs is
+        // what a route is (cloud_009 §3).
         //
-        // `routableOwners`, not `ownersRunnableBy`: the roster says whose
-        // work *may* land here and consent says whether it moves at all. A
-        // paused consent (cloud_008 finding 48) leaves this set empty rather
-        // than refusing the call, which is the whole difference between "we
-        // are waiting for you to read something" and "a human cut you off".
-        owners: new Set(
-          this.#deps.projection.routableOwners(device.owner, this.#deps.siteId)
-        ),
+        // A paused consent (cloud_008 finding 48) drops its routes and
+        // leaves the rest, which is the whole difference between "we are
+        // waiting for you to read something about one site" and "a human cut
+        // you off from everything".
+        routes: this.#deps.projection.routesFor(device.owner),
         max: request.max,
         leaseMs: this.#deps.leaseMs
       });
@@ -246,14 +251,17 @@ var DaemonPlane = class {
       async (request, device) => {
         const now = this.#deps.now();
         await this.#deps.state.sweep();
-        const consent = this.#deps.projection.consentFor(
-          device.owner,
-          this.#deps.siteId
+        const pinned = this.#deps.projection.sitesFor(device.owner);
+        const sites = Object.fromEntries(
+          pinned.map((record) => [keyId(record.site.identity), record.site])
         );
-        const revoked = consent === null;
-        if (revoked) {
+        const awaitingConsent = pinned.filter(
+          (record) => !this.#deps.projection.mayRouteFor(device.owner, record.siteId)
+        ).map((record) => keyId(record.site.identity));
+        if (pinned.length === 0) {
           return ok({
-            revoked,
+            sites,
+            awaitingConsent,
             cancel: [],
             lost: request.activeLeases.map((lease) => lease.jobId),
             serverTime: now
@@ -266,7 +274,8 @@ var DaemonPlane = class {
           leaseMs: this.#deps.leaseMs
         });
         return ok({
-          revoked,
+          sites,
+          awaitingConsent,
           cancel,
           lost,
           serverTime: now
@@ -510,6 +519,35 @@ var Projection = class {
       (c) => c.owner === owner && c.siteId === siteId
     ) ?? null;
   }
+  /**
+   * Every site this owner may route with — cloud_009 §3.
+   *
+   * The set a pairing covers, and the set a claim will filter on. Consent
+   * decides it, which is the sentence the whole design rests on: a site
+   * appears here because a human clicked, never because a site asked to be
+   * here and never because a daemon named it.
+   *
+   * **Paused sites are here, and that is deliberate** — cloud_008 finding 48
+   * as ratified. A paused consent routes nothing and keeps its pin: the
+   * relationship stands, the key the daemon compared a fingerprint of stays
+   * pinned, and re-consenting never costs a re-pair. Written the other way
+   * round first, and three of the paused tests failed by refusing to pair at
+   * all — which is the trap the finding is about, arriving through the door
+   * marked "be stricter".
+   *
+   * So this is the *pairing* set and `mayRouteFor` is the *routing* set. Two
+   * questions with different answers, kept apart for the same reason
+   * `consentFor` and `mayRouteFor` are: one method answering both is how a
+   * paused user quietly starts routing again, or quietly loses their machine.
+   *
+   * Sorted by site id so two calls with the same projection produce the same
+   * answer: this ends up in a pairings file and in a fingerprint list a human
+   * compares by eye, and an order that drifts between polls is a diff nobody
+   * can read.
+   */
+  sitesFor(owner) {
+    return this.#fixture.sites.filter((site) => this.consentFor(owner, site.siteId) !== null).sort((a, b) => a.siteId < b.siteId ? -1 : 1);
+  }
   /**
    * May this owner's work move for this site, right now?
    *
@@ -526,29 +564,38 @@ var Projection = class {
     return this.consentFor(owner, siteId)?.paused === true;
   }
   /**
-   * Whose work this device may run for this site — the set a claim carries.
+   * Every (site, owner) route this device may run — cloud_009 §3.
+   *
+   * The claim filter, collapsed to data a store can match on. `routableOwners`
+   * was this for one site; the hub needs it for the set, and the shape had to
+   * change rather than repeat, because **a set of sites and a set of owners
+   * multiply**. A device whose owner consented to site A, serving a roster
+   * member who consented to site B, appears in both sets and has no consented
+   * route between them. Pairs cannot express a route nobody agreed to.
    *
-   * {@link Projection.ownersRunnableBy} collapsed and then filtered by
-   * consent, which is two things this relay was doing in one place and one
-   * place respectively:
+   * Both halves of the rule are here, and neither was enforced before finding
+   * 48's work:
    *
-   * - **The device's own owner is checked first**, and an unroutable one
-   *   empties the whole set. A machine whose owner has not agreed to this
-   *   site's current terms runs nothing for it, including a roster member's
-   *   work: the roster says whose jobs may land here, and consent says
-   *   whether this machine is available to the site at all.
-   * - **Every job owner is checked too.** That check did not exist. Consent
-   *   was enforced by the daemon plane's blanket revoked guard, which asks
-   *   only about the *claiming* device's owner — so a roster member who never
-   *   consented to a site could have their work claimed by their admin's
-   *   machine, which is `CONSENT_BEFORE_ROUTE` read the other way round. The
-   *   site plane does not check consent at enqueue either, so nothing did.
+   * - **This machine's owner** must have a live consent for the site, or
+   *   nothing of that site's runs here at all — including a roster member's
+   *   work. The roster says whose jobs may land on this machine; consent says
+   *   whether this machine is available to that site.
+   * - **Each job's owner** must have one too. That check did not exist:
+   *   consent was enforced by the daemon plane's blanket revoked guard, which
+   *   asks only about the claiming device's owner, so a roster member who
+   *   never consented to a site could have their work claimed by their admin's
+   *   machine — `CONSENT_BEFORE_ROUTE` read the other way round.
    */
-  routableOwners(deviceOwner, siteId) {
-    if (!this.mayRouteFor(deviceOwner, siteId)) return [];
-    return this.ownersRunnableBy(deviceOwner).filter(
-      (owner) => this.mayRouteFor(owner, siteId)
-    );
+  routesFor(deviceOwner) {
+    const routes = /* @__PURE__ */ new Set();
+    for (const site of this.#fixture.sites) {
+      if (!this.mayRouteFor(deviceOwner, site.siteId)) continue;
+      for (const owner of this.ownersRunnableBy(deviceOwner)) {
+        if (!this.mayRouteFor(owner, site.siteId)) continue;
+        routes.add(routeKey(site.siteId, owner));
+      }
+    }
+    return routes;
   }
   /**
    * Every owner whose work this device's owner may run, as a list.
@@ -676,7 +723,7 @@ var SitePlane = class {
     if (siteIdOf(parsed.data) !== siteId) {
       return fail2(403, "forbidden", "that is not your site");
     }
-    if (siteId !== this.#deps.routesFor) {
+    if (this.#deps.projection.siteFor(siteId) === null) {
       return fail2(403, "forbidden", "this relay does not route for you");
     }
     return run(parsed.data, siteId);
@@ -702,7 +749,7 @@ var SitePlane = class {
           stub: request.stub
         });
         if ("refused" in job) {
-          return fail2(403, "forbidden", "that job id belongs to another site");
+          return fail2(400, "bad-request", "that stub was not accepted");
         }
         return ok2({ jobId: job.id, state: job.state });
       }
@@ -835,296 +882,6 @@ var SitePlane = class {
   }
 };
 
-// src/state.ts
-import { randomUUID } from "crypto";
-var AWAITING_PAYLOAD_MS = 1e4;
-var RelayState = class {
-  #jobs = /* @__PURE__ */ new Map();
-  #presence = /* @__PURE__ */ new Map();
-  #now;
-  constructor(options = {}) {
-    this.#now = options.now ?? Date.now;
-  }
-  /** The one clock every deadline in this store is stamped from. */
-  async now() {
-    return this.#now();
-  }
-  /**
-   * Take a stub for routing. The payload is not here and will not be.
-   *
-   * **Idempotent by job id, and that is a security property rather than a
-   * convenience.** Site-plane calls are authenticated by signature, and
-   * byollm_009 §4.2's argument for signing the request instead of a
-   * server-issued nonce rests entirely on every write being idempotent per the
-   * instance it names. This one was not: re-enqueueing a known id built a
-   * fresh `queued` job over the top of the old one, discarding a live claim,
-   * its lease and any payload the site had already sealed to a device. A
-   * replayed enqueue inside the two-minute freshness window was therefore a
-   * way to yank a job back from the machine running it — the `release` bug of
-   * §4.2, rediscovered on the other plane.
-   *
-   * So a known id returns what is already routing, unchanged. A site that
-   * restarts and republishes its queue is the normal case, and it must not
-   * disturb work in flight.
-   */
-  enqueue(input) {
-    const existing = this.#jobs.get(input.id);
-    if (existing) {
-      return Promise.resolve(
-        existing.siteId === input.siteId ? existing : { refused: "id-taken" }
-      );
-    }
-    const job = {
-      id: input.id,
-      siteId: input.siteId,
-      stub: input.stub,
-      state: "queued",
-      refusedBy: []
-    };
-    this.#jobs.set(job.id, job);
-    return Promise.resolve(job);
-  }
-  job(jobId) {
-    return Promise.resolve(this.#jobs.get(jobId));
-  }
-  jobs() {
-    return Promise.resolve([...this.#jobs.values()]);
-  }
-  /** Jobs a site must seal for, right now. */
-  async awaiting(siteId) {
-    return (await this.jobs()).filter(
-      (j) => j.siteId === siteId && j.state === "awaiting-payload"
-    );
-  }
-  /** Sealed results waiting to go home. */
-  async finished(siteId) {
-    return (await this.jobs()).filter(
-      (j) => j.siteId === siteId && j.state === "done" && j.result !== void 0
-    );
-  }
-  /**
-   * Claim work — one operation, because it has to be.
-   *
-   * Moved here wholesale from `DaemonPlane`, where it was a scan followed by
-   * per-job mutation. Nothing about the *decision* changed; what changed is
-   * that a store can now implement it, because the filter and the write are
-   * one call rather than a loop the caller drives.
-   *
-   * The order of the guards is worth preserving as-is when this becomes a Lua
-   * script: cheapest first, and `owners` last because it is the only one that
-   * needed the projection.
-   */
-  async claim(input) {
-    const now = await this.now();
-    await this.sweep();
-    const granted = [];
-    for (const job of this.#jobs.values()) {
-      if (granted.length >= input.max) break;
-      if (job.state !== "queued") continue;
-      if (job.siteId !== input.siteId) continue;
-      if (!input.kinds.has(job.stub.kind)) continue;
-      if (job.refusedBy.includes(input.runnerId)) continue;
-      if (job.cancelled) continue;
-      if (!input.owners.has(job.stub.owner)) continue;
-      if (job.stub.audience === "self" && job.stub.owner !== input.owner) {
-        continue;
-      }
-      const leaseId = randomUUID();
-      job.state = "awaiting-payload";
-      job.claimedBy = {
-        runnerId: input.runnerId,
-        owner: input.owner,
-        device: input.device,
-        leaseId,
-        leaseExpiresAt: now + input.leaseMs
-      };
-      job.awaitingUntil = now + AWAITING_PAYLOAD_MS;
-      granted.push({
-        ...job.stub,
-        lease: {
-          id: leaseId,
-          runnerId: input.runnerId,
-          expiresAt: job.claimedBy.leaseExpiresAt
-        }
-      });
-    }
-    return granted;
-  }
-  /**
-   * Hand over the sealed payload to the device that holds the lease.
-   *
-   * The read and the state transition are one operation for the same reason
-   * `claim` is: `running` must be set by whoever was told the envelope, or two
-   * replicas can both hand out the same work and both believe they were first.
-   */
-  takePayload(input) {
-    const job = this.#jobs.get(input.jobId);
-    if (!job) return Promise.resolve({ refused: "not-found" });
-    if (job.claimedBy?.runnerId !== input.runnerId) {
-      return Promise.resolve({ refused: "not-holder" });
-    }
-    if (job.claimedBy.leaseId !== input.leaseId) {
-      return Promise.resolve({ refused: "stale-lease" });
-    }
-    if (!job.payload) return Promise.resolve({ refused: "not-ready" });
-    job.state = "running";
-    return Promise.resolve({ envelope: job.payload });
-  }
-  /**
-   * Record a finished job.
-   *
-   * `RESULT_IDEMPOTENT` lives here rather than in the caller: a replayed
-   * result must be a no-op decided by the same operation that would have
-   * written it, or two replicas can both decide they were the first.
-   */
-  complete(input) {
-    const job = this.#jobs.get(input.jobId);
-    if (!job) return Promise.resolve({ refused: "not-found" });
-    if (job.claimedBy?.runnerId !== input.runnerId) {
-      return Promise.resolve({ refused: "not-holder" });
-    }
-    if (job.state === "done") {
-      const sameGrant = job.claimedBy.leaseId === input.leaseId;
-      return Promise.resolve(
-        sameGrant ? { accepted: false, duplicate: true, state: job.state } : { refused: "stale-lease" }
-      );
-    }
-    if (job.claimedBy.leaseId !== input.leaseId) {
-      return Promise.resolve({ refused: "stale-lease" });
-    }
-    job.result = input.envelope;
-    job.disposition = input.disposition;
-    job.state = "done";
-    return Promise.resolve({ accepted: true, state: job.state });
-  }
-  /** Give back leases this runner holds, naming each grant it means. */
-  releaseLeases(input) {
-    const released = [];
-    for (const { jobId, leaseId } of input.leases) {
-      const job = this.#jobs.get(jobId);
-      if (!job || job.claimedBy?.runnerId !== input.runnerId) continue;
-      if (job.claimedBy.leaseId !== leaseId) continue;
-      if (input.reason === "refused" && !job.refusedBy.includes(input.runnerId)) {
-        job.refusedBy.push(input.runnerId);
-      }
-      this.#requeue(job);
-      released.push(jobId);
-    }
-    return Promise.resolve(released);
-  }
-  /**
-   * Take a site's sealed payload for a claimed job.
-   *
-   * Refuses anything not `awaiting-payload`, which is what makes the timeout
-   * mean something: a late seal must not land on a claim that has moved.
-   */
-  seal(input) {
-    const job = this.#jobs.get(input.jobId);
-    if (job?.siteId !== input.siteId) {
-      return Promise.resolve({ refused: "not-found" });
-    }
-    if (job.state !== "awaiting-payload") {
-      return Promise.resolve({ refused: "too-late", was: job.state });
-    }
-    job.payload = input.envelope;
-    job.state = "ready";
-    delete job.awaitingUntil;
-    return Promise.resolve({ state: job.state });
-  }
-  /** {@link RoutingStore.cancel} — the site withdraws a job. */
-  cancel(input) {
-    const job = this.#jobs.get(input.jobId);
-    if (job?.siteId !== input.siteId) return Promise.resolve(false);
-    job.cancelled = true;
-    return Promise.resolve(true);
-  }
-  /** {@link RoutingStore.cancelRequests} — cancelled jobs this runner holds. */
-  cancelRequests(runnerId) {
-    return Promise.resolve(
-      [...this.#jobs.values()].filter(
-        (job) => job.cancelled === true && job.claimedBy?.runnerId === runnerId
-      ).map((job) => job.id)
-    );
-  }
-  /** {@link RoutingStore.renewLeases} — extend what is still held, name what is not. */
-  async renewLeases(input) {
-    const now = await this.now();
-    const renewed = [];
-    const lost = [];
-    for (const { jobId, leaseId } of input.leases) {
-      const job = this.#jobs.get(jobId);
-      const held = job?.claimedBy;
-      if (!job || held?.leaseId !== leaseId || held.runnerId !== input.runnerId) {
-        lost.push(jobId);
-        continue;
-      }
-      const expiresAt = now + input.leaseMs;
-      job.claimedBy = { ...held, leaseExpiresAt: expiresAt };
-      renewed.push({ jobId, expiresAt });
-    }
-    return { renewed, lost };
-  }
-  async seen(presence) {
-    const lastSeenAt = await this.now();
-    const existing = this.#presence.get(presence.runnerId);
-    if (existing) {
-      existing.lastSeenAt = lastSeenAt;
-      return existing;
-    }
-    const fresh = { ...presence, lastSeenAt };
-    this.#presence.set(presence.runnerId, fresh);
-    return fresh;
-  }
-  presence(runnerId) {
-    return Promise.resolve(this.#presence.get(runnerId));
-  }
-  everyone() {
-    return Promise.resolve([...this.#presence.values()]);
-  }
-  /**
-   * Return a job to the queue, forgetting the claim.
-   *
-   * The stub survives; nothing is lost. That is `LEASE_RECLAIMABLE` and it is
-   * why the awaiting-payload timeout is cheap to fire: the worst case is that
-   * a device did nothing for ten seconds and another one gets a turn.
-   */
-  #requeue(job) {
-    job.state = "queued";
-    delete job.claimedBy;
-    delete job.awaitingUntil;
-    delete job.payload;
-  }
-  /**
-   * Fire whatever the clock says is due, and report it.
-   *
-   * Returns the jobs it requeued so a caller can log or surface them — a
-   * timeout that fires invisibly is indistinguishable from a job that was
-   * never claimed, and those want very different debugging.
-   */
-  async sweep() {
-    const now = await this.now();
-    const requeued = [];
-    const expired = [];
-    for (const job of this.#jobs.values()) {
-      if (job.stub.deadlineAt <= now) {
-        this.#jobs.delete(job.id);
-        expired.push(job);
-        continue;
-      }
-      if (job.state === "awaiting-payload" && (job.awaitingUntil ?? 0) <= now) {
-        this.#requeue(job);
-        requeued.push(job);
-      }
-      const lease = job.claimedBy;
-      if (lease && (job.state === "ready" || job.state === "running") && lease.leaseExpiresAt <= now) {
-        this.#requeue(job);
-        requeued.push(job);
-      }
-    }
-    return [...requeued, ...expired];
-  }
-};
-
 // src/index.ts
 var Relay = class {
   state;
@@ -1133,25 +890,23 @@ var Relay = class {
   #site;
   #now;
   #basePath;
-  #siteId;
+  #debug;
   constructor(options) {
     this.state = options.store ?? new RelayState({ now: options.now ?? Date.now });
     this.projection = new Projection(options.fixture);
     this.#now = options.now ?? Date.now;
     this.#basePath = (options.basePath ?? "/byollm").replace(/\/+$/, "");
-    this.#siteId = options.siteId;
+    this.#debug = options.debug ?? false;
     this.#daemon = new DaemonPlane({
       state: this.state,
       projection: this.projection,
       now: this.#now,
-      leaseMs: options.leaseMs ?? 6e4,
-      siteId: options.siteId
+      leaseMs: options.leaseMs ?? 6e4
     });
     this.#site = new SitePlane({
       state: this.state,
       projection: this.projection,
-      now: this.#now,
-      routesFor: options.siteId
+      now: this.#now
     });
   }
   /** Replace the projection — a control-plane push, or a fixture edit. */
@@ -1176,10 +931,23 @@ var Relay = class {
     const url = new URL(request.url);
     const path = url.pathname;
     if (path === "/debug" || path === `${this.#basePath}/debug`) {
+      const siteId = url.searchParams.get("site");
+      if (!this.#debug) {
+        return new Response(JSON.stringify({ error: "not-found" }), {
+          status: 404,
+          headers: { "content-type": "application/json" }
+        });
+      }
+      if (siteId === null || this.projection.siteFor(siteId) === null) {
+        return new Response(JSON.stringify({ error: "bad-request" }), {
+          status: 400,
+          headers: { "content-type": "application/json" }
+        });
+      }
       return new Response(
         await debugPage(this.state, this.#now(), {
-          siteId: this.#siteId,
-          consents: (owner) => this.projection.consentFor(owner, this.#siteId) !== null
+          siteId,
+          consents: (owner) => this.projection.consentFor(owner, siteId) !== null
         }),
         { headers: { "content-type": "text/html; charset=utf-8" } }
       );
@@ -1275,6 +1043,7 @@ export {
   RevocationRecord,
   RosterRecord,
   SiteRecord,
-  debugPage
+  debugPage,
+  routeKey
 };
 //# sourceMappingURL=index.js.map