@crouton-kit/crouter 0.3.33 → 0.3.35

package/dist/hearth/wake-proxy/home.js

@@ -1,297 +0,0 @@
-import { setTimeout as delay } from 'node:timers/promises';
-import { general } from '../../core/errors.js';
-import { getHomeBackend } from '../../core/hearth/provider.js';
-import { getHome, updateHome } from '../../core/hearth/registry.js';
-import { beginActivity, clearTenantIdleTimer, endActivity, getTenantActivitySnapshot, setTenantIdleTimer, touchTenantPause, touchTenantWake, updateTenantState, withTenantLock, } from './state.js';
-let runtime = null;
-export function configureWakeProxyRuntime(next) {
-    runtime = next;
-    // A new runtime invalidates any cached warm verdict/in-flight wake (different homes/registry).
-    // In production this runs once at startup; in tests it gives each case a clean cache.
-    resetWakeProxyMemory();
-}
-function getRuntime() {
-    if (runtime === null) {
-        throw general('wake proxy runtime has not been configured');
-    }
-    return runtime;
-}
-const READY_PROBE_TIMEOUT_MS = 1_500;
-// The fast-path "trust the serving relay" probe must tolerate a SLOW FIRST CONNECTION: after a
-// proxy restart/redeploy the Fly machine's outbound pool is cold (DNS + TLS), and a just-resumed
-// guest route can take a beat to begin serving. A single 1.5s shot aborts on that first hit and
-// wrongly drops into the slow restore path even though the guest is serving in a fraction of a
-// second. Retry the cheap probe across this short window before waking; a genuinely-serving route
-// is confirmed within a couple attempts (warm pool), and a genuinely-cold one only adds this
-// window ahead of the already-slow wake.
-const SERVING_PROBE_WINDOW_MS = 8_000;
-async function probeRelayReady(routeUrl, relayToken) {
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(new Error('ready probe timeout')), Math.max(250, Math.min(READY_PROBE_TIMEOUT_MS, getRuntime().proxy.readyTimeoutMs)));
-    try {
-        const response = await fetch(new URL('/', routeUrl), {
-            method: 'GET',
-            headers: { authorization: `Bearer ${relayToken}` },
-            signal: controller.signal,
-        });
-        const contentType = response.headers.get('content-type') ?? '';
-        return response.status === 200 && /text\/html/i.test(contentType);
-    }
-    catch {
-        return false;
-    }
-    finally {
-        clearTimeout(timeout);
-    }
-}
-/**
- * Retry the cheap single-shot relay probe until it confirms the route is serving or `windowMs`
- * elapses, returning a boolean. Always runs at least one attempt. This is the reliable answer to
- * "is the relay serving right now?" — a single shot mistakes a slow first connection for a dead
- * route. Both the fast-path short-circuit and `waitForRelayReady` build on it.
- */
-async function probeRelayServing(routeUrl, relayToken, windowMs) {
-    const deadline = Date.now() + Math.max(0, windowMs);
-    for (;;) {
-        if (await wakeProxyInternals.probeRelayReady(routeUrl, relayToken))
-            return true;
-        const remaining = deadline - Date.now();
-        if (remaining <= 0)
-            return false;
-        await delay(Math.min(500, remaining));
-    }
-}
-async function waitForRelayReady(routeUrl, relayToken) {
-    const { readyTimeoutMs } = getRuntime().proxy;
-    if (await wakeProxyInternals.probeRelayServing(routeUrl, relayToken, readyTimeoutMs))
-        return;
-    throw general('guest web relay did not become ready before timeout', { routeUrl: routeUrl.replace(/\?.*$/, '') });
-}
-function captureAwakeHome(tenantId) {
-    const home = getHome(getRuntime().m0.registryPath, tenantId);
-    if (home === null) {
-        throw general(`no home for tenant ${tenantId} — run the existing provision/bootstrap flow`, { tenantId });
-    }
-    if (typeof home.nodeId !== 'string' || home.nodeId.trim() === '') {
-        throw general(`home ${tenantId} is missing nodeId — run the existing provision/bootstrap flow`, { tenantId });
-    }
-    if (typeof home.relayToken !== 'string' || home.relayToken.trim() === '') {
-        throw general(`home ${tenantId} is missing relayToken — run the existing provision/bootstrap flow`, { tenantId });
-    }
-    const routeUrl = home.webRoute?.concreteUrl ?? home.webRoute?.url ?? null;
-    if (routeUrl === null || routeUrl.trim() === '') {
-        throw general(`home ${tenantId} is missing webRoute — run the existing relay flow`, { tenantId });
-    }
-    return {
-        tenantId,
-        nodeId: home.nodeId,
-        routeUrl,
-        relayToken: home.relayToken,
-        machineId: home.machineId,
-        webPort: getRuntime().m0.webPort,
-    };
-}
-/**
- * Cheap, non-throwing route selection for the HTTP fast path: return the persisted home as an
- * `AwakenedHome` ONLY when it is recorded `running` with a usable webRoute + relayToken. Does NO
- * probe, takes NO lock, and never wakes — the actual upstream forward is the liveness check.
- * Returns null when the home is missing, not running, or missing a route/token, so the caller
- * falls back to the deliberate `ensureAwake` wake/restore path. This is the one authoritative
- * place that turns "a known-running home" into a forwardable route without the heavy gate.
- */
-export function resolveRunningHome(tenantId) {
-    const home = getHome(getRuntime().m0.registryPath, tenantId);
-    if (home === null)
-        return null;
-    if (home.state !== 'running')
-        return null;
-    if (typeof home.nodeId !== 'string' || home.nodeId.trim() === '')
-        return null;
-    if (typeof home.relayToken !== 'string' || home.relayToken.trim() === '')
-        return null;
-    const routeUrl = home.webRoute?.concreteUrl ?? home.webRoute?.url ?? null;
-    if (routeUrl === null || routeUrl.trim() === '')
-        return null;
-    return {
-        tenantId,
-        nodeId: home.nodeId,
-        routeUrl,
-        relayToken: home.relayToken,
-        machineId: home.machineId,
-        webPort: getRuntime().m0.webPort,
-    };
-}
-/**
- * Wake the tenant's home through the configured backend seam. The backend owns the restore-vs-
- * recreate decision and persists the refreshed `webRoute`/`relayToken` to the registry. Until the
- * Blaxel backend is wired, `getHomeBackend` throws a 503 "no provider
- * configured" — so a cold home cannot be woken, while an already-serving home still forwards via
- * the fast path above (which never calls this).
- */
-async function wakeHome(tenantId) {
-    await getHomeBackend(getRuntime().m0).wake(tenantId);
-}
-export const wakeProxyInternals = {
-    probeRelayReady,
-    probeRelayServing,
-    waitForRelayReady,
-    captureAwakeHome,
-    resolveRunningHome,
-    wakeHome,
-    touchTenantWake,
-    now: () => Date.now(),
-};
-// How long a confirmed-serving verdict is trusted before the warm fast path re-probes. Kept short
-// so a home that genuinely dies is re-checked within seconds, but long enough that a reconnect/SSE/
-// asset burst rides the same verdict instead of each request re-entering the serial wake lock.
-const WARM_VERDICT_TTL_MS = 10_000;
-const warmVerdicts = new Map();
-const inflightWakes = new Map();
-/**
- * Drop the cached warm verdict for a tenant so the next `ensureAwake` re-probes (or wakes) instead
- * of trusting a stale "serving" answer. The proxy calls this when an upstream forward fails, so a
- * home that died mid-TTL is re-checked on the next request rather than serving 502s for the rest of
- * the window.
- */
-export function invalidateWarmVerdict(tenantId) {
-    warmVerdicts.delete(tenantId);
-}
-/** Clear all warm verdicts and in-flight wake coalescing. Used on runtime (re)configuration. */
-export function resetWakeProxyMemory() {
-    warmVerdicts.clear();
-    inflightWakes.clear();
-}
-export function acquireActivity(tenantId, kind = 'wake') {
-    const cfg = getRuntime().proxy;
-    return beginActivity(cfg, tenantId, kind);
-}
-export function releaseActivity(handle) {
-    const snapshot = endActivity(handle);
-    if (snapshot.total === 0) {
-        scheduleIdlePause(handle.tenantId);
-    }
-    return snapshot;
-}
-export function scheduleIdlePause(tenantId) {
-    const cfg = getRuntime().proxy;
-    const snapshot = getTenantActivitySnapshot(tenantId);
-    clearTenantIdleTimer(tenantId);
-    if (snapshot.total !== 0)
-        return;
-    const tenant = updateTenantState(cfg, tenantId, (home) => home);
-    const idleAfterMs = tenant.idleAfterMs ?? cfg.idlePauseMs;
-    if (idleAfterMs <= 0)
-        return;
-    const deadlineAt = new Date(Date.now() + idleAfterMs).toISOString();
-    const timer = setTimeout(() => {
-        void pauseNow(tenantId).catch((error) => {
-            const message = error instanceof Error ? error.message : String(error);
-            process.stderr.write(`[hearth wake-proxy] idle pause failed for ${tenantId}: ${message}\n`);
-        });
-    }, idleAfterMs);
-    timer.unref();
-    setTenantIdleTimer(tenantId, deadlineAt, timer);
-}
-/**
- * Pause the tenant's home through the backend seam. We never drive a sandbox SDK directly here —
- * the backend owns the registry write and state transition. Serialized under the per-tenant
- * in-process lock; the single-process deployment invariant (one wake-proxy machine per tenant)
- * makes this lock authoritative.
- */
-export async function pauseNow(tenantId) {
-    const m0 = getRuntime().m0;
-    const cfg = getRuntime().proxy;
-    await withTenantLock(tenantId, async () => {
-        const snapshot = getTenantActivitySnapshot(tenantId);
-        if (snapshot.total !== 0)
-            return;
-        const home = getHome(m0.registryPath, tenantId);
-        if (home === null)
-            return;
-        if (typeof home.machineId !== 'string' || home.machineId.trim() === '') {
-            throw general(`home ${tenantId} is missing machineId — run the existing provision/bootstrap flow`, { tenantId });
-        }
-        if (home.state !== 'running')
-            return;
-        await getHomeBackend(m0).suspend(tenantId);
-        touchTenantPause(cfg, tenantId);
-        clearTenantIdleTimer(tenantId);
-    });
-}
-/**
- * Ensure the tenant's home is awake. First probe an already-serving relay; when that succeeds,
- * reconcile the registry state if needed, touch wake, and return the existing route. Otherwise,
- * wake the guest through the backend seam, wait for readiness, touch wake, and return an
- * `AwakenedHome` the proxy can forward to. Serialized under the per-tenant in-process lock.
- */
-export async function ensureAwake(tenantId) {
-    // Warm fast path: a recently-confirmed-serving home is returned WITHOUT entering the per-tenant
-    // serial wake lock, so reconnect/SSE/asset bursts never queue behind each other. Diagnosed live —
-    // every HTTP forward and WS connect funneling through `withTenantLock` stalled ALL proxied traffic
-    // up to the wake timeout while the home was directly healthy (<0.4s). The slow lock is now
-    // reserved for an actual wake/cold boot.
-    const warm = warmVerdicts.get(tenantId);
-    if (warm !== undefined && wakeProxyInternals.now() - warm.confirmedAt < WARM_VERDICT_TTL_MS) {
-        return warm.home;
-    }
-    // No fresh verdict: coalesce concurrent callers onto ONE in-flight wake instead of letting N
-    // requests thundering-herd serialize through the lock. The first caller runs the (possibly slow)
-    // wake under the lock; everyone else awaits the same promise and shares its verdict.
-    const inflight = inflightWakes.get(tenantId);
-    if (inflight !== undefined)
-        return inflight;
-    const promise = withTenantLock(tenantId, () => runEnsureAwake(tenantId))
-        .then((home) => {
-        warmVerdicts.set(tenantId, { home, confirmedAt: wakeProxyInternals.now() });
-        return home;
-    })
-        .finally(() => {
-        if (inflightWakes.get(tenantId) === promise)
-            inflightWakes.delete(tenantId);
-    });
-    inflightWakes.set(tenantId, promise);
-    return promise;
-}
-async function runEnsureAwake(tenantId) {
-    const runtime = getRuntime();
-    const { m0 } = runtime;
-    const home = getHome(m0.registryPath, tenantId);
-    if (home === null) {
-        throw general(`no home for tenant ${tenantId} — run the existing provision/bootstrap flow`, { tenantId, registryPath: m0.registryPath });
-    }
-    if (typeof home.machineId !== 'string' || home.machineId.trim() === '') {
-        throw general(`home ${tenantId} is missing machineId — run the existing provision/bootstrap flow`, { tenantId, registryPath: m0.registryPath });
-    }
-    if (typeof home.nodeId !== 'string' || home.nodeId.trim() === '') {
-        throw general(`home ${tenantId} is missing nodeId — run the existing provision/bootstrap flow`, { tenantId, registryPath: m0.registryPath });
-    }
-    const routeUrl = home.webRoute?.concreteUrl ?? home.webRoute?.url ?? '';
-    const relayToken = home.relayToken ?? '';
-    if (routeUrl.trim() !== '' && relayToken.trim() !== '') {
-        if (await wakeProxyInternals.probeRelayServing(routeUrl, relayToken, SERVING_PROBE_WINDOW_MS)) {
-            if (home.state !== 'running') {
-                updateHome(m0.registryPath, tenantId, (draft) => {
-                    draft.state = 'running';
-                    draft.updatedAt = new Date().toISOString();
-                });
-            }
-            wakeProxyInternals.touchTenantWake(runtime.proxy, tenantId);
-            return wakeProxyInternals.captureAwakeHome(tenantId);
-        }
-    }
-    // Not serving: drive the backend seam to bring the home up and refresh its route. The backend
-    // owns the warm-resume-vs-recreate decision and persists webRoute/relayToken to the registry.
-    await wakeProxyInternals.wakeHome(tenantId);
-    const refreshed = getHome(m0.registryPath, tenantId);
-    const relayUrl = refreshed?.webRoute?.concreteUrl ?? refreshed?.webRoute?.url ?? null;
-    if (relayUrl === null || relayUrl.trim() === '') {
-        throw general(`wake for tenant ${tenantId} did not yield a usable route URL`, { tenantId });
-    }
-    const refreshedToken = refreshed?.relayToken ?? null;
-    if (typeof refreshedToken !== 'string' || refreshedToken.trim() === '') {
-        throw general(`home ${tenantId} is missing relayToken — run the existing provision/bootstrap flow`, { tenantId });
-    }
-    await wakeProxyInternals.waitForRelayReady(relayUrl, refreshedToken);
-    wakeProxyInternals.touchTenantWake(runtime.proxy, tenantId);
-    return wakeProxyInternals.captureAwakeHome(tenantId);
-}

package/dist/hearth/wake-proxy/main.js

@@ -1,134 +0,0 @@
-import { loadM0Config } from '../../core/hearth/config.js';
-import { general } from '../../core/errors.js';
-import { ownerAuthRedactedMessage } from './auth.js';
-import { loadHearthProxyConfig } from './config.js';
-import { configureWakeProxyRuntime } from './home.js';
-import { clearTenantIdleTimer, ensureProxyState, ensureSeededM0Registry, loadProxyState, readTenantHome } from './state.js';
-import { createWakeProxyServer } from './server.js';
-function redact(text) {
-    return ownerAuthRedactedMessage(text).replace(/\bsha256:[0-9a-f]{64}\b/gi, 'sha256:[redacted]');
-}
-function log(level, message, details = {}) {
-    process.stderr.write(`${JSON.stringify({ level, message, details })}\n`);
-}
-function ensureStartableHome(config) {
-    const home = readTenantHome(config, config.defaultTenantId);
-    if (home === null) {
-        throw general(`hearth wake proxy registry is empty for tenant ${config.defaultTenantId} — run the existing M0 provision/bootstrap/relay flow first`, {
-            tenantId: config.defaultTenantId,
-            registryPath: config.m0RegistryPath,
-        });
-    }
-    const missing = [];
-    if (typeof home.machineId !== 'string' || home.machineId.trim() === '')
-        missing.push('machineId');
-    if (typeof home.homeStorage?.volumeId !== 'string' || home.homeStorage.volumeId.trim() === '')
-        missing.push('homeStorage.volumeId');
-    if (home.state === undefined || home.state === null || String(home.state).trim() === '')
-        missing.push('state');
-    if (typeof home.nodeId !== 'string' || home.nodeId.trim() === '')
-        missing.push('nodeId');
-    if (typeof home.relayToken !== 'string' || home.relayToken.trim() === '')
-        missing.push('relayToken');
-    if (missing.length > 0) {
-        throw general(`hearth wake proxy registry entry for tenant ${home.tenantId} is incomplete (${missing.join(', ')}) — run the existing M0 provision/bootstrap/relay flow first`, {
-            tenantId: home.tenantId,
-            registryPath: config.m0RegistryPath,
-            missing,
-        });
-    }
-}
-function installIngressHygiene(server) {
-    const stripReferrerHeaders = (req) => {
-        delete req.headers.referer;
-        delete req.headers.referrer;
-    };
-    server.prependListener('request', (req, res) => {
-        stripReferrerHeaders(req);
-        const pathname = new URL(req.url ?? '/', 'http://127.0.0.1').pathname;
-        if (pathname === '/') {
-            res.setHeader('Referrer-Policy', 'no-referrer');
-        }
-    });
-    server.prependListener('upgrade', (req) => {
-        stripReferrerHeaders(req);
-    });
-}
-async function shutdown(server, signal, statePath) {
-    log('info', 'hearth wake proxy shutting down', { signal });
-    const state = loadProxyState(statePath);
-    if (state !== null) {
-        for (const tenantId of Object.keys(state.tenants)) {
-            clearTenantIdleTimer(tenantId);
-        }
-    }
-    server.closeIdleConnections?.();
-    server.closeAllConnections?.();
-    await new Promise((resolve) => {
-        server.close(() => resolve());
-    });
-    process.exit(0);
-}
-async function main() {
-    const proxyConfig = loadHearthProxyConfig();
-    const m0Config = loadM0Config();
-    const runtime = { proxy: proxyConfig, m0: m0Config };
-    ensureProxyState(proxyConfig);
-    try {
-        ensureSeededM0Registry(proxyConfig, m0Config);
-    }
-    catch (error) {
-        throw general(`hearth wake proxy could not seed or load the M0 registry at ${proxyConfig.m0RegistryPath} — run the existing M0 provision/bootstrap/relay flow first`, {
-            registryPath: proxyConfig.m0RegistryPath,
-            tenantId: proxyConfig.defaultTenantId,
-            error: error instanceof Error ? error.message : String(error),
-        });
-    }
-    ensureStartableHome(proxyConfig);
-    configureWakeProxyRuntime(runtime);
-    const server = createWakeProxyServer(runtime);
-    installIngressHygiene(server);
-    let shuttingDown = false;
-    const beginShutdown = (signal) => {
-        if (shuttingDown)
-            return;
-        shuttingDown = true;
-        void shutdown(server, signal, proxyConfig.statePath).catch((error) => {
-            const message = error instanceof Error ? error.stack ?? error.message : String(error);
-            log('error', 'hearth wake proxy shutdown failed', { error: redact(message) });
-            process.exit(1);
-        });
-    };
-    process.on('SIGINT', () => beginShutdown('SIGINT'));
-    process.on('SIGTERM', () => beginShutdown('SIGTERM'));
-    process.on('uncaughtException', (error) => {
-        log('error', 'hearth wake proxy uncaught exception', { error: redact(error instanceof Error ? error.stack ?? error.message : String(error)) });
-        process.exit(1);
-    });
-    process.on('unhandledRejection', (reason) => {
-        log('error', 'hearth wake proxy unhandled rejection', { error: redact(reason instanceof Error ? reason.stack ?? reason.message : String(reason)) });
-        process.exit(1);
-    });
-    await new Promise((resolve, reject) => {
-        server.once('error', reject);
-        server.listen(proxyConfig.port, proxyConfig.host, () => {
-            log('info', 'hearth wake proxy listening', {
-                host: proxyConfig.host,
-                port: proxyConfig.port,
-                publicOrigin: proxyConfig.publicOrigin,
-                statePath: proxyConfig.statePath,
-                registryPath: proxyConfig.m0RegistryPath,
-                idlePauseMs: proxyConfig.idlePauseMs,
-                wakeTimeoutMs: proxyConfig.wakeTimeoutMs,
-                readyTimeoutMs: proxyConfig.readyTimeoutMs,
-                cookieSecure: proxyConfig.cookieSecure,
-            });
-            resolve();
-        });
-    });
-}
-void main().catch((error) => {
-    const message = error instanceof Error ? error.stack ?? error.message : String(error);
-    log('error', 'hearth wake proxy failed to start', { error: redact(message) });
-    process.exit(1);
-});

package/dist/hearth/wake-proxy/model-auth.d.ts

@@ -1,13 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import type { HearthWakeProxyRuntime } from './types.js';
-import { finishAnthropicOAuthSession, startAnthropicOAuthSession } from './anthropic-oauth.js';
-import { runGuestSource } from './guest-source.js';
-export declare const AUTH_STORAGE_STATUS_SCRIPT = "import { AuthStorage } from '@earendil-works/pi-coding-agent';\n\nconst storage = AuthStorage.create();\nconst credential = storage.get('anthropic');\nconst firstErrors = storage.drainErrors();\nif (firstErrors.length > 0) {\n  throw new Error(firstErrors.map((error) => error.message).join('; '));\n}\nconst adapterConfigured = storage.getOAuthProviders().some((provider) => provider.id === 'anthropic');\nconst storedOauth = credential?.type === 'oauth';\nconst expiresAt = storedOauth ? credential.expires : null;\nconsole.log(JSON.stringify({ storedOauth, expiresAt, adapterConfigured }));\n";
-export declare const AUTH_STORAGE_WRITE_SCRIPT = "import { AuthStorage } from '@earendil-works/pi-coding-agent';\n\nconst input = JSON.parse(await new Promise((resolve, reject) => {\n  let value = '';\n  process.stdin.setEncoding('utf8');\n  process.stdin.on('data', (chunk) => { value += chunk; });\n  process.stdin.on('end', () => resolve(value));\n  process.stdin.on('error', reject);\n}));\nif (!input || typeof input !== 'object') throw new Error('expected stdin JSON object');\nif (input.provider !== 'anthropic') throw new Error('expected anthropic provider');\nconst credential = input.credential;\nif (!credential || typeof credential !== 'object' || credential.type !== 'oauth') throw new Error('expected oauth credential');\nif (typeof credential.refresh !== 'string' || typeof credential.access !== 'string' || typeof credential.expires !== 'number') throw new Error('expected oauth credential fields');\nconst storage = AuthStorage.create();\nstorage.set('anthropic', credential);\nconst firstErrors = storage.drainErrors();\nif (firstErrors.length > 0) {\n  throw new Error(firstErrors.map((error) => error.message).join('; '));\n}\nconst reread = AuthStorage.create();\nconst stored = reread.get('anthropic');\nconst rereadErrors = reread.drainErrors();\nif (rereadErrors.length > 0) {\n  throw new Error(rereadErrors.map((error) => error.message).join('; '));\n}\nif (!stored || stored.type !== 'oauth' || stored.refresh !== credential.refresh || stored.access !== credential.access || stored.expires !== credential.expires) {\n  throw new Error('stored anthropic oauth credential did not round-trip');\n}\nconsole.log(JSON.stringify({ ok: true, provider: 'anthropic', storedOauth: true, expiresAt: stored.expires }));\n";
-export interface ModelAuthRouteDeps {
-    now?: () => number;
-    guestSource?: typeof runGuestSource;
-    startSession?: typeof startAnthropicOAuthSession;
-    finishSession?: typeof finishAnthropicOAuthSession;
-}
-export declare function handleModelAuthRequest(req: IncomingMessage, res: ServerResponse, runtime: HearthWakeProxyRuntime, deps?: ModelAuthRouteDeps): Promise<boolean>;