@byollm/server 0.1.0-alpha.3 → 0.1.0-alpha.31

package/supabase/migrations/20260819000000_drop_runner_token.sql

@@ -0,0 +1,87 @@
+-- The bearer token nobody used — cloud_008 §2.4, finding 37.
+--
+-- `byollm_runners.token_hash` held the SHA-256 of a token minted at pairing,
+-- returned to the daemon, written to its pairings file, and then **never
+-- sent, never looked up and never compared**. The only reader was
+-- `getRunnerByTokenHash`, which both store adapters implemented and nothing
+-- called except a test asserting it returns null.
+--
+-- That is not dead wire in the ordinary sense. It was a *secret*: minted,
+-- transmitted once, and written to two disks at rest for no purpose. A
+-- credential with no consumer cannot be used correctly and can still leak,
+-- which makes it strictly a liability.
+--
+-- `REQUESTS_SIGNED_NOT_BEARER` was the rule the whole time and was enforced
+-- the whole time: every authenticated call is signed by the device's pinned
+-- identity key, and `C016` proves an endpoint refuses a bearer token. This
+-- drops the thing the MUST is named after.
+--
+-- `byollm_pairings.runner_token_once` stays and now carries a marker rather
+-- than a secret. It is the deliver-once flag — a replayed device code must
+-- get nothing — a real property that was riding on the token's nullability.
+-- Renaming a column and changing the code that reads it in one step is how a
+-- rollback strands rows, so the rename waits for a later release.
+
+alter table byollm_runners drop column if exists token_hash;
+
+-- The browser-facing approval path takes one fewer argument. Replaced with
+-- the old signature dropped rather than left beside it: two functions with
+-- one name is how a caller ends up invoking the one nobody maintains.
+--
+-- Everything else is unchanged from the original, deliberately — the owner
+-- still comes from `auth.uid()` because a daemon can never assert who it is,
+-- which is the whole reason pairing is interactive.
+drop function if exists byollm_approve_pairing(text, text);
+
+create or replace function byollm_approve_pairing(
+  p_user_code text
+)
+returns byollm_runners
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  v_pairing byollm_pairings;
+  v_runner  byollm_runners;
+  v_owner   uuid := (select auth.uid());
+begin
+  if v_owner is null then
+    raise exception 'approving a pairing requires an authenticated user';
+  end if;
+
+  select * into v_pairing from byollm_pairings
+   where user_code = p_user_code for update;
+
+  if v_pairing is null then
+    raise exception 'unknown pairing code';
+  end if;
+  if v_pairing.expires_at <= now() then
+    raise exception 'pairing code has expired';
+  end if;
+  if v_pairing.state <> 'pending' then
+    raise exception 'pairing is already %', v_pairing.state;
+  end if;
+
+  insert into byollm_runners (owner, label, platform,
+                              daemon_version, capabilities, device)
+  values (v_owner, v_pairing.label, v_pairing.platform,
+          v_pairing.daemon_version, v_pairing.capabilities, v_pairing.device)
+  returning * into v_runner;
+
+  -- The marker, not a token: this is what makes a replayed device code get
+  -- nothing. The service-role path in `supabase/index.ts` writes the same
+  -- value, and the two approval doors have to agree — a field set by one and
+  -- not the other produces a runner that is correct through one and broken
+  -- through the other.
+  update byollm_pairings
+     set state = 'approved',
+         owner = v_owner,
+         runner_id = v_runner.id,
+         runner_token_once = 'pending-collection'
+   where device_code_hash = v_pairing.device_code_hash;
+
+  return v_runner;
+end;
+$$;
+

package/supabase/migrations/20260819010000_completed_by_lease_id.sql

@@ -0,0 +1,25 @@
+-- Which grant recorded a result — cloud_008 §3.6.
+--
+-- `complete` now checks terminal state **before** the holder, so
+-- `RESULT_IDEMPOTENT` is enforced by the branch named after it rather than as
+-- a side effect of the lease being nulled on success. Answering a replay
+-- correctly means knowing which grant recorded the result, and `lease_id` is
+-- cleared at completion by design: "who holds this" and "who finished this"
+-- are different questions with different lifetimes.
+--
+-- ## Why this is its own file
+--
+-- It was first appended to `20260819000000_drop_runner_token.sql`, which had
+-- already shipped in alpha.19. An applied migration is immutable — that is the
+-- whole reason a migrations folder can be trusted — and the fact that this one
+-- is only days old and probably applied nowhere does not make editing it a
+-- different act. The rule is worth more than the tidiness.
+--
+-- ## Nullable, and not backfilled
+--
+-- Rows completed before this migration have no recorded grant, so a replay of
+-- one of them is answered as a plain refusal rather than as a duplicate. That
+-- is the safe direction: it withholds a reassurance rather than inventing one,
+-- and the daemons that produced those rows stopped retrying long ago.
+alter table byollm_jobs
+  add column if not exists completed_by_lease_id text;

package/supabase/migrations/20260821000000_rename_collected.sql

@@ -0,0 +1,91 @@
+-- The deliver-once flag stops pretending to be a token — cloud_008 §2.4a.
+--
+-- `20260819000000_drop_runner_token` removed the bearer credential and left
+-- `byollm_pairings.runner_token_once` carrying a marker string, with the
+-- reason written down: *"Renaming a column and changing the code that reads
+-- it in one step is how a rollback strands rows, so the rename waits for a
+-- later release."*
+--
+-- This is that release. The rename lands with the code that reads it, in one
+-- step, because the transitional shape exists to protect a party who has not
+-- agreed to change — and pre-1.0, with one deployment and one operator, that
+-- party is us. Carrying a column named after a secret it no longer holds is
+-- a comment that has to be re-read by everybody who meets it.
+--
+-- The property is unchanged and is the reason the column survives at all: a
+-- replayed device code must get nothing, or a code left in a shell history is
+-- a second pairing. That was riding on a token's nullability, which was one
+-- field doing two jobs — and only one of them load-bearing.
+
+alter table byollm_pairings
+  rename column runner_token_once to collected_at;
+
+-- A timestamp rather than a marker string. `'pending-collection'` was the
+-- shape a nulled token left behind; what the flag actually records is *when*
+-- the approval was handed over, which is worth having when somebody asks why
+-- a pairing did not complete.
+alter table byollm_pairings
+  alter column collected_at type timestamptz
+  using case when collected_at is null then now() else null end;
+
+comment on column byollm_pairings.collected_at is
+  'When the approval was collected. Null until then — a replayed device code '
+  'gets nothing. cloud_008 §2.4a; this was runner_token_once.';
+
+-- The approval function moves with the column it writes. Recreated whole
+-- rather than patched, because two functions with one name is how a caller
+-- ends up invoking the one nobody maintains — the argument the migration
+-- before this one made when it replaced the old signature.
+
+create or replace function byollm_approve_pairing(
+  p_user_code text
+)
+returns byollm_runners
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  v_pairing byollm_pairings;
+  v_runner  byollm_runners;
+  v_owner   uuid := (select auth.uid());
+begin
+  if v_owner is null then
+    raise exception 'approving a pairing requires an authenticated user';
+  end if;
+
+  select * into v_pairing from byollm_pairings
+   where user_code = p_user_code for update;
+
+  if v_pairing is null then
+    raise exception 'unknown pairing code';
+  end if;
+  if v_pairing.expires_at <= now() then
+    raise exception 'pairing code has expired';
+  end if;
+  if v_pairing.state <> 'pending' then
+    raise exception 'pairing is already %', v_pairing.state;
+  end if;
+
+  insert into byollm_runners (owner, label, platform,
+                              daemon_version, capabilities, device)
+  values (v_owner, v_pairing.label, v_pairing.platform,
+          v_pairing.daemon_version, v_pairing.capabilities, v_pairing.device)
+  returning * into v_runner;
+
+  -- The marker, not a token: this is what makes a replayed device code get
+  -- nothing. The service-role path in `supabase/index.ts` writes the same
+  -- value, and the two approval doors have to agree — a field set by one and
+  -- not the other produces a runner that is correct through one and broken
+  -- through the other.
+  update byollm_pairings
+     set state = 'approved',
+         owner = v_owner,
+         runner_id = v_runner.id,
+         collected_at = null
+   where device_code_hash = v_pairing.device_code_hash;
+
+  return v_runner;
+end;
+$$;
+

package/dist/chunk-HL6EYHQ7.js

@@ -1,422 +0,0 @@
-// src/ids.ts
-import {
-  createHash,
-  randomBytes,
-  randomUUID,
-  timingSafeEqual
-} from "crypto";
-var USER_CODE_ALPHABET = "ABCDEFGHJKMNPQRTWXYZ2346789";
-function generateDeviceCode() {
-  return randomBytes(32).toString("base64url");
-}
-function generateRunnerToken() {
-  return randomBytes(32).toString("base64url");
-}
-function generateRunnerId() {
-  return `runner_${randomUUID()}`;
-}
-function generateJobId() {
-  return `job_${randomUUID()}`;
-}
-function generateUserCode() {
-  const chars = [];
-  while (chars.length < 8) {
-    for (const byte of randomBytes(16)) {
-      const limit = 256 - 256 % USER_CODE_ALPHABET.length;
-      if (byte >= limit) continue;
-      const symbol = USER_CODE_ALPHABET[byte % USER_CODE_ALPHABET.length];
-      if (symbol === void 0) continue;
-      chars.push(symbol);
-      if (chars.length === 8) break;
-    }
-  }
-  return `${chars.slice(0, 4).join("")}-${chars.slice(4).join("")}`;
-}
-function hashSecret(secret) {
-  return createHash("sha256").update(secret, "utf8").digest("hex");
-}
-function secretsMatch(aHex, bHex) {
-  if (aHex.length !== bHex.length) return false;
-  return timingSafeEqual(Buffer.from(aHex, "hex"), Buffer.from(bHex, "hex"));
-}
-
-// src/handlers.ts
-import {
-  ClaimRequest,
-  ERROR_STATUS,
-  HeartbeatRequest,
-  PairRequest,
-  PROTOCOL_VERSION,
-  ReleaseRequest,
-  ResultRequest,
-  provenanceFor
-} from "@byollm/protocol";
-var DEFAULTS = {
-  leaseMs: 6e4,
-  pairingTtlMs: 10 * 6e4,
-  pollIntervalMs: 2e3
-};
-function fail(error, message, retryAfterSeconds) {
-  return {
-    status: ERROR_STATUS[error],
-    body: {
-      error,
-      message,
-      ...retryAfterSeconds === void 0 ? {} : { retryAfter: retryAfterSeconds }
-    },
-    ...retryAfterSeconds === void 0 ? {} : { retryAfterSeconds }
-  };
-}
-function ok(body) {
-  return { status: 200, body };
-}
-var ByollmHandlers = class {
-  #store;
-  #verificationUrl;
-  #leaseMs;
-  #pairingTtlMs;
-  #pollIntervalMs;
-  #now;
-  constructor(config) {
-    this.#store = config.store;
-    this.#verificationUrl = config.verificationUrl;
-    this.#leaseMs = config.leaseMs ?? DEFAULTS.leaseMs;
-    this.#pairingTtlMs = config.pairingTtlMs ?? DEFAULTS.pairingTtlMs;
-    this.#pollIntervalMs = config.pollIntervalMs ?? DEFAULTS.pollIntervalMs;
-    this.#now = config.now ?? Date.now;
-  }
-  /**
-   * Dispatch one protocol call.
-   *
-   * @param endpoint - which of the five, already routed from the path
-   * @param body - the parsed JSON request body, untrusted
-   * @param bearer - the `Authorization: Bearer` value, if any
-   */
-  async handle(endpoint, body, bearer) {
-    switch (endpoint) {
-      case "pair":
-        return this.#pair(body);
-      case "claim":
-        return this.#authed(bearer, body, ClaimRequest, this.#claim.bind(this));
-      case "heartbeat":
-        return this.#authed(
-          bearer,
-          body,
-          HeartbeatRequest,
-          this.#heartbeat.bind(this),
-          { allowRevoked: true }
-        );
-      case "result":
-        return this.#authed(
-          bearer,
-          body,
-          ResultRequest,
-          this.#result.bind(this)
-        );
-      case "release":
-        return this.#authed(
-          bearer,
-          body,
-          ReleaseRequest,
-          this.#release.bind(this)
-        );
-    }
-  }
-  /**
-   * Shared preamble for the four authenticated endpoints: resolve the bearer
-   * token to a runner, reject a revoked one, and parse the body.
-   *
-   * The token→runner lookup happens before schema validation so a stranger
-   * probing the endpoint learns nothing about the wire format.
-   */
-  async #authed(bearer, body, schema, run, options = {}) {
-    if (bearer === void 0 || bearer.length === 0) {
-      return fail("unauthorized", "a runner token is required");
-    }
-    const runner = await this.#store.getRunnerByTokenHash(hashSecret(bearer));
-    if (!runner) {
-      return fail("unauthorized", "this runner token is not recognised");
-    }
-    if (runner.revokedAt !== null && options.allowRevoked !== true) {
-      return fail("revoked", "this runner has been revoked by its owner");
-    }
-    const parsed = schema.safeParse(body);
-    if (!parsed.success || parsed.data === void 0) {
-      return fail("bad-request", "request body failed schema validation");
-    }
-    return run(parsed.data, runner);
-  }
-  // -- 1. pair --------------------------------------------------------------
-  async #pair(body) {
-    const parsed = PairRequest.safeParse(body);
-    if (!parsed.success) {
-      return fail("bad-request", "pair request failed schema validation");
-    }
-    const request = parsed.data;
-    const now = this.#now();
-    if (request.action === "start") {
-      const deviceCode = generateDeviceCode();
-      const userCode = generateUserCode();
-      const expiresAt = now + this.#pairingTtlMs;
-      await this.#store.createPairing({
-        deviceCodeHash: hashSecret(deviceCode),
-        userCode,
-        state: "pending",
-        owner: null,
-        runnerId: null,
-        runnerTokenOnce: null,
-        label: request.daemon.label,
-        platform: request.daemon.platform,
-        daemonVersion: request.daemon.version,
-        capabilities: request.capabilities,
-        expiresAt,
-        createdAt: now
-      });
-      const response = {
-        deviceCode,
-        userCode,
-        verificationUrl: this.#verificationUrl,
-        expiresAt,
-        pollIntervalMs: this.#pollIntervalMs
-      };
-      return ok(response);
-    }
-    const pairing = await this.#store.getPairingByDeviceCodeHash(
-      hashSecret(request.deviceCode)
-    );
-    if (!pairing) {
-      return fail("not-found", "unknown device code");
-    }
-    if (pairing.state === "denied") {
-      return ok({ status: "denied" });
-    }
-    if (pairing.expiresAt <= now && pairing.state === "pending") {
-      return ok({ status: "expired" });
-    }
-    if (pairing.state === "approved" && pairing.runnerTokenOnce !== null && pairing.runnerId !== null && pairing.owner !== null) {
-      const response = {
-        status: "approved",
-        runnerToken: pairing.runnerTokenOnce,
-        runnerId: pairing.runnerId,
-        owner: pairing.owner
-      };
-      await this.#store.consumePairingToken(pairing.deviceCodeHash);
-      return ok(response);
-    }
-    if (pairing.state === "approved") {
-      return fail("not-found", "this pairing has already been collected");
-    }
-    return ok({ status: "pending" });
-  }
-  // -- 2. claim -------------------------------------------------------------
-  async #claim(request, runner) {
-    if (request.runnerId !== runner.id) {
-      return fail("unauthorized", "runner id does not match the bearer token");
-    }
-    const now = this.#now();
-    const jobs = await this.#store.claim({
-      runnerId: runner.id,
-      runnerOwner: runner.owner,
-      capabilities: request.capabilities,
-      max: request.max,
-      leaseMs: this.#leaseMs,
-      now
-    });
-    const response = {
-      jobs: jobs.map((job) => ({
-        id: job.id,
-        kind: job.kind,
-        payload: job.payload,
-        audience: job.audience,
-        owner: job.owner,
-        ...job.audienceAllow === void 0 ? {} : { audienceAllow: [...job.audienceAllow] },
-        lease: job.lease ?? {
-          runnerId: runner.id,
-          expiresAt: now + this.#leaseMs
-        }
-      })),
-      leaseMs: this.#leaseMs
-    };
-    return ok(response);
-  }
-  // -- 3. heartbeat ---------------------------------------------------------
-  async #heartbeat(request, runner) {
-    if (request.runnerId !== runner.id) {
-      return fail("unauthorized", "runner id does not match the bearer token");
-    }
-    const now = this.#now();
-    const revoked = runner.revokedAt !== null;
-    if (revoked) {
-      const held = await this.#store.listClaimedBy(runner.id);
-      const response2 = {
-        revoked: true,
-        cancel: [],
-        leases: [],
-        lost: held.map((job) => job.id),
-        serverTime: now
-      };
-      return ok(response2);
-    }
-    await this.#store.touchRunner({
-      runnerId: runner.id,
-      capabilities: request.capabilities,
-      daemonVersion: request.daemonVersion,
-      paused: request.paused,
-      now
-    });
-    const { renewed, lost } = await this.#store.renewLeases({
-      runnerId: runner.id,
-      jobIds: request.activeJobIds,
-      leaseMs: this.#leaseMs,
-      now
-    });
-    const cancel = await this.#store.listCancelRequests(runner.id);
-    const response = {
-      revoked: false,
-      cancel,
-      leases: renewed.map((r) => ({ jobId: r.jobId, expiresAt: r.expiresAt })),
-      lost: [...lost],
-      serverTime: now
-    };
-    return ok(response);
-  }
-  // -- 4. result ------------------------------------------------------------
-  async #result(request, runner) {
-    if (request.runnerId !== runner.id) {
-      return fail("unauthorized", "runner id does not match the bearer token");
-    }
-    const now = this.#now();
-    const job = await this.#store.get(request.jobId);
-    if (!job) return fail("not-found", "unknown job");
-    const provenance = provenanceFor({
-      audience: job.audience,
-      runnerId: runner.id,
-      runnerOwner: runner.owner,
-      backendClass: request.backendClass,
-      model: request.model
-    });
-    const { accepted, job: updated } = await this.#store.complete({
-      jobId: request.jobId,
-      runnerId: runner.id,
-      outcome: request.outcome,
-      provenance,
-      now
-    });
-    const response = {
-      accepted,
-      state: updated?.state ?? job.state
-    };
-    return ok(response);
-  }
-  // -- 5. release -----------------------------------------------------------
-  async #release(request, runner) {
-    if (request.runnerId !== runner.id) {
-      return fail("unauthorized", "runner id does not match the bearer token");
-    }
-    const released = await this.#store.release({
-      runnerId: runner.id,
-      jobIds: request.jobIds,
-      reason: request.reason,
-      now: this.#now()
-    });
-    const response = { released };
-    return ok(response);
-  }
-};
-var SERVED_PROTOCOL_VERSION = PROTOCOL_VERSION;
-
-// src/http.ts
-import { ENDPOINTS, PROTOCOL_PREFIX } from "@byollm/protocol";
-var MAX_BODY_BYTES = 8 * 1024 * 1024;
-function routeEndpoint(pathname) {
-  const index = pathname.lastIndexOf("/");
-  const last = index === -1 ? pathname : pathname.slice(index + 1);
-  return ENDPOINTS.includes(last) ? last : null;
-}
-function bearerFrom(header) {
-  if (!header) return void 0;
-  const match = /^Bearer[ ]+(.+)$/i.exec(header.trim());
-  return match?.[1];
-}
-function createFetchHandler(config) {
-  const handlers = new ByollmHandlers(config);
-  return async function handle(request) {
-    if (request.method !== "POST") {
-      return json(405, {
-        error: "bad-request",
-        message: "protocol endpoints accept POST only"
-      });
-    }
-    const endpoint = routeEndpoint(new URL(request.url).pathname);
-    if (endpoint === null) {
-      return json(404, {
-        error: "not-found",
-        message: `not a ${PROTOCOL_PREFIX} endpoint`
-      });
-    }
-    const declared = request.headers.get("content-length");
-    if (declared !== null && Number(declared) > MAX_BODY_BYTES) {
-      return json(400, {
-        error: "bad-request",
-        message: "request body too large"
-      });
-    }
-    let body;
-    try {
-      const text = await request.text();
-      if (text.length > MAX_BODY_BYTES) {
-        return json(400, {
-          error: "bad-request",
-          message: "request body too large"
-        });
-      }
-      body = JSON.parse(text);
-    } catch {
-      return json(400, {
-        error: "bad-request",
-        message: "request body is not valid JSON"
-      });
-    }
-    const result = await handlers.handle(
-      endpoint,
-      body,
-      bearerFrom(request.headers.get("authorization"))
-    );
-    const headers = {
-      "content-type": "application/json",
-      "cache-control": "no-store"
-    };
-    if (result.retryAfterSeconds !== void 0) {
-      headers["retry-after"] = String(result.retryAfterSeconds);
-    }
-    return new Response(JSON.stringify(result.body), {
-      status: result.status,
-      headers
-    });
-  };
-}
-function json(status, body) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: {
-      "content-type": "application/json",
-      "cache-control": "no-store"
-    }
-  });
-}
-
-export {
-  generateDeviceCode,
-  generateRunnerToken,
-  generateRunnerId,
-  generateJobId,
-  generateUserCode,
-  hashSecret,
-  secretsMatch,
-  ByollmHandlers,
-  SERVED_PROTOCOL_VERSION,
-  routeEndpoint,
-  bearerFrom,
-  createFetchHandler
-};
-//# sourceMappingURL=chunk-HL6EYHQ7.js.map