@danceiny/gotry 0.2.0-rc.32 → 0.2.0-rc.33

package/dist/src/booking-surface/tenancy.js

@@ -0,0 +1,188 @@
+/**
+ * Multi-tenant seam of the Booking Copilot surface (AaaS A2, docs/rfc/aaas-rfc.md §4.4; threats S-1 to S-4, S-10, S-13, S-14).
+ *
+ * One request becomes one `TurnScope` here and nowhere else:
+ *
+ *   authenticate -> deriveSeamTenant -> quotas.admitTurn -> router.openTenant -> a runtime over the tenant's guarded ledger
+ *
+ * The tenant comes from the authenticated caller only. The body, the headers, the tool arguments and the model's output
+ * are never inputs to it, and the scope carries no method that takes a tenant. Everything the surface keeps between
+ * requests (planner sessions, single-flight decisions) is keyed by the scope, so two tenants whose task handles and
+ * request keys collide still never meet. The shared, single-ledger form of the surface (today's deployment) does not
+ * use this module and behaves exactly as before.
+ */
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { assertSeamTenant, deriveSeamTenant, InvalidPrincipalError, SeamError, seamTenantKey, UnknownOrganizationError } from '../tenant-seam/seam.js';
+import { QuotaExceededError } from '../tenant-seam/quotas.js';
+import { InvalidTenantIdError, ReplicaAtCapacityError, RouterClosedError, TenantDrainingError, TenantStateError } from '../tenant-state/errors.js';
+import { derivePromptCachePartition } from '../tenant-state/ids.js';
+import { BookingCopilotTaskRuntime } from './runtime.js';
+/** One planner shared by every tenant. Sessions are still keyed by tenant here, but the planner's own files are shared: for fixtures. */
+export function sharedPlannerProvider(factory) {
+    return { forTenant: async () => factory, close: async () => undefined };
+}
+/** The handle and the ledger it exposes disagree with the tenant the seam derived: a wiring bug that must never serve a request. */
+export class TenantBindingError extends SeamError {
+    constructor() {
+        super('GOTRY_SEAM_TENANT_MISMATCH', 'the opened ledger does not belong to the derived tenant');
+    }
+}
+const invocations = new AsyncLocalStorage();
+function ledgerBytes(handle) {
+    return handle.run((ledger) => {
+        const pages = ledger.db.pragma('page_count', { simple: true });
+        const size = ledger.db.pragma('page_size', { simple: true });
+        return pages * size;
+    });
+}
+export class BookingTenancy {
+    ingressMode;
+    options;
+    planners = new Map();
+    constructor(options) {
+        if (typeof options.authenticator?.authenticate !== 'function')
+            throw new Error('booking_copilot_tenancy_authenticator_required');
+        if (typeof options.keyring?.keyFor !== 'function')
+            throw new Error('booking_copilot_tenancy_keyring_required');
+        if (!options.router || !options.quotas || !options.planners)
+            throw new Error('booking_copilot_tenancy_incomplete');
+        if (options.ingressBinding !== undefined && typeof options.ingressBinding.bind !== 'function')
+            throw new Error('booking_copilot_ingress_binding_invalid');
+        this.options = options;
+        this.ingressMode = options.ingressBinding ? 'bff-ingress-binding' : 'bff-bound-turn-only';
+    }
+    /** The authenticated caller of a request, or `null`. The only place a credential is read. */
+    async authenticate(request) {
+        return this.options.authenticator.authenticate(request);
+    }
+    /**
+     * Derives the tenant, admits the turn, and opens the tenant's guarded ledger.
+     *
+     * @throws QuotaExceededError before any lease or file is touched, when the turn is over a limit
+     * @throws InvalidTenantIdError | InvalidPrincipalError | UnknownOrganizationError for a caller the seam cannot place
+     * @throws TenantStateError subclasses when the tenant cannot be served here now (owned elsewhere, draining, store down)
+     */
+    async beginTurn(caller) {
+        const { quotas, router } = this.options;
+        const tenant = deriveSeamTenant(caller, this.options.keyring);
+        const permit = quotas.admitTurn(tenant);
+        try {
+            const handle = await router.openTenant(tenant.organization, tenant.ledgerTenant);
+            // Defense in depth: the handle, and the ledger inside it, must be exactly the tenant the seam derived.
+            if (handle.organization !== tenant.organization || handle.ledgerTenant !== tenant.ledgerTenant || handle.ledger.tenant !== tenant.ledgerTenant)
+                throw new TenantBindingError();
+            quotas.observeLedgerBytes(tenant, ledgerBytes(handle));
+            const plannerFactory = await this.plannerFor(tenant);
+            const key = seamTenantKey(tenant);
+            const runtime = new BookingCopilotTaskRuntime(handle.ledger, this.options.runtime);
+            const binding = this.options.ingressBinding;
+            return {
+                key,
+                runtime,
+                plannerFactory,
+                ingress: binding ? { binding, principal: { subject: caller.subject, scope: caller.scope } } : null,
+                sessionKey: (taskId) => `${key}\u0000${taskId}`,
+                flightKey: (parts) => JSON.stringify([key, ...parts]),
+                runDecision: (work) => handle.runAsync(work),
+                isTenantFault: (error) => error instanceof TenantStateError,
+                release: () => permit.release(),
+            };
+        }
+        catch (error) {
+            permit.release();
+            throw error;
+        }
+    }
+    /**
+     * Hands every tenant back and stops the planners. The tenancy owns the router and the planner provider it was given:
+     * a graceful handoff per tenant (drain, final snapshot, release), then the planners. Resolves when done; a tenant whose
+     * final snapshot could not be flushed is reported, because its last writes are then only as durable as the last snapshot.
+     */
+    async close() {
+        const failures = [];
+        try {
+            await this.options.planners.close();
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        const unflushed = await this.options.router.close().catch((error) => { failures.push(error); return []; });
+        if (unflushed.length > 0)
+            failures.push(new Error(`booking_copilot_tenant_handoff_unflushed:${unflushed.length}`));
+        if (failures.length === 1)
+            throw failures[0];
+        if (failures.length > 1)
+            throw new AggregateError(failures, 'booking_copilot_tenancy_close_failed');
+    }
+    plannerFor(tenant) {
+        const seam = assertSeamTenant(tenant);
+        const key = seamTenantKey(seam);
+        let planner = this.planners.get(key);
+        if (!planner) {
+            const { quotas, planners, router } = this.options;
+            const organizationKey = this.options.keyring.keyFor(seam.organization);
+            if (organizationKey === null)
+                throw new UnknownOrganizationError();
+            planner = planners.forTenant({
+                tenantRoot: router.tenantRootOf(seam.organization, seam.ledgerTenant),
+                cachePartition: derivePromptCachePartition(organizationKey, seam.ledgerTenant),
+                reportUsage: (model, usage) => {
+                    const meter = invocations.getStore();
+                    if (!meter || meter.tenantKey !== key)
+                        return;
+                    try {
+                        quotas.recordLlmUsage(seam, model, usage);
+                        meter.reported = true;
+                    }
+                    catch {
+                        // An unpriced model or malformed counts leave the invocation unproven: it is charged the worst case below.
+                    }
+                },
+            }).then((inner) => (task) => this.metered(inner(task), seam, key));
+            planner.catch(() => this.planners.delete(key));
+            this.planners.set(key, planner);
+        }
+        return planner;
+    }
+    /** Wraps a planner session so that every invocation is charged: what it reported, or the worst case if it reported nothing. */
+    metered(session, tenant, key) {
+        const { quotas } = this.options;
+        return {
+            next: async (input) => {
+                const meter = { tenantKey: key, reported: false };
+                try {
+                    return await invocations.run(meter, () => session.next(input));
+                }
+                finally {
+                    if (!meter.reported)
+                        quotas.chargeUnprovenInvocation(tenant);
+                }
+            },
+            ...(session.close ? { close: () => session.close() } : {}),
+        };
+    }
+}
+/** The typed HTTP answer for a failure raised before the response stream starts. Bodies carry codes, scopes and hints only. */
+export function tenantRejection(error) {
+    if (error instanceof QuotaExceededError) {
+        return {
+            status: 429,
+            body: { error: { code: 'quota_exceeded', scope: error.scope, dimension: error.dimension, retryAfterSeconds: error.retryAfterSeconds } },
+            retryAfterSeconds: error.retryAfterSeconds,
+        };
+    }
+    if (error instanceof InvalidTenantIdError || error instanceof InvalidPrincipalError)
+        return { status: 403, body: { error: { code: 'invalid_principal' } } };
+    if (error instanceof UnknownOrganizationError)
+        return { status: 403, body: { error: { code: 'organization_not_served' } } };
+    if (error instanceof RouterClosedError)
+        return { status: 503, body: { error: { code: 'booking_copilot_shutting_down' } } };
+    if (error instanceof TenantDrainingError)
+        return { status: 503, body: { error: { code: 'tenant_draining' } }, retryAfterSeconds: 1 };
+    // A full replica frees a slot only when some tenant is handed off, so retrying it soon is not a useful hint; the request belongs on another replica.
+    if (error instanceof ReplicaAtCapacityError)
+        return { status: 503, body: { error: { code: 'tenant_unavailable' } } };
+    if (error instanceof TenantStateError && !(error instanceof SeamError))
+        return { status: 503, body: { error: { code: 'tenant_unavailable' } }, retryAfterSeconds: 1 };
+    return { status: 500, body: { error: { code: 'tenant_seam_failure' } } };
+}

package/dist/src/index.js

@@ -1766,7 +1766,9 @@ export function apply(ctx, config, seams = {}) {
             fromStationTelecode: { type: 'string', description: '出发站三位电报码,仅 kind=train;城市码表外时填(kyfw 查询页 URL 里)' },
             toStationTelecode: { type: 'string', description: '到达站三位电报码,仅 kind=train,同上' },
             backDate: { type: 'string', description: '回程日期 YYYY-MM-DD,仅 kind=flight;存在即往返检索——须 ui=gui(GUI 车道站点表单原生往返;bridge 车道不知往返 URL 形状,不猜)' },
-            ui: { type: 'string', enum: ['bridge', 'gui'], description: 'kind=flight|hotel:bridge(默认,用户登录态被动嗅探)|gui(gotry 隔离匿名窗口驱动 PC 表单——flight 往返/任意城市原生+低价日历;hotel 任意目的地原生(cityId 码表不在主链路);匿名公开价)' },
+            ui: { type: 'string', enum: ['bridge', 'gui'], description: 'kind=flight|hotel:bridge(默认,用户登录态被动嗅探)|gui(gotry 隔离匿名窗口驱动 PC 表单——flight 往返/多程/任意城市原生+低价日历;hotel 任意目的地原生;匿名公开价)' },
+            legs: { type: 'string', description: '多程段 JSON 数组,仅 kind=flight+ui=gui:[{"from":"香港","to":"迪拜","date":"2026-12-06"},{"from":"迪拜","to":"上海","date":"2026-12-10"}](2–3 段)' },
+            interactiveLogin: { type: 'boolean', description: '仅 ui=gui:登录墙命中时窗口停在携程官方登录页,等用户本人在窗口内完成登录(最多 6 分钟)后自动重查,拿登录态真实数据(行程明细/酒店真实价)。gotry 永不经手密码/验证码/cookie 值' },
         },
         output: { schema: { type: 'json' }, render: (_a, v) => [{ type: 'text', text: String(v.summary ?? JSON.stringify(v).slice(0, 600)) }] },
         async execute(args, _exec) {
@@ -1849,6 +1851,7 @@ export function apply(ctx, config, seams = {}) {
                     effect: q.ui === 'gui' ? 'SESSION_HOTEL_GUI_SEARCH' : 'SESSION_HOTEL_SEARCH',
                     params: {
                         to: q.to, country: q.country, cityId: q.cityId, checkIn: q.checkIn, checkOut: q.checkOut, adults: q.adults,
+                        ...(q.ui === 'gui' && q.interactiveLogin ? { interactiveLoginMs: 360_000 } : {}),
                         auditPath: join(config.stateRoot ?? '.', 'gotry-state', 'session-incidents.jsonl'),
                     },
                 });
@@ -1883,11 +1886,38 @@ export function apply(ctx, config, seams = {}) {
             if (q.ui !== undefined && q.ui !== 'bridge' && q.ui !== 'gui') {
                 return { ok: false, summary: 'kind=flight 的 ui 只接受 bridge(默认,登录态被动嗅探)|gui(隔离匿名窗口驱动表单)' };
             }
+            // 多程段(仅 gui;严格形状闸——2–3 段、城市非空、日期 YMD、段内日期递增)
+            let legs;
+            if (q.legs !== undefined) {
+                if (q.ui !== 'gui')
+                    return { ok: false, summary: 'legs(多程)仅支持 ui=gui(GUI 车道驱动多程表单)' };
+                try {
+                    const parsed = JSON.parse(q.legs);
+                    if (!Array.isArray(parsed) || parsed.length < 2 || parsed.length > 3)
+                        throw new Error('段数须 2–3');
+                    legs = parsed.map((raw) => {
+                        const leg = raw;
+                        if (typeof leg.from !== 'string' || !leg.from.trim() || typeof leg.to !== 'string' || !leg.to.trim() || typeof leg.date !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(leg.date)) {
+                            throw new Error('每段须 {from,to,date(YYYY-MM-DD)}');
+                        }
+                        return { from: leg.from.trim(), to: leg.to.trim(), date: leg.date };
+                    });
+                    for (let i = 1; i < legs.length; i += 1) {
+                        if (legs[i].date <= legs[i - 1].date)
+                            throw new Error('段日期须递增');
+                    }
+                }
+                catch (e) {
+                    return { ok: false, summary: `legs 形状非法:${e.message}` };
+                }
+            }
             const itp = await runSessionEffect({
                 effect: q.ui === 'gui' ? 'SESSION_FLIGHT_GUI_SEARCH' : 'SESSION_FLIGHT_SEARCH',
                 params: {
                     from: q.from, to: q.to, date: q.date, fromCityCode: q.fromCityCode, toCityCode: q.toCityCode,
                     ...(q.backDate ? { backDate: q.backDate } : {}),
+                    ...(legs ? { legs } : {}),
+                    ...(q.ui === 'gui' && q.interactiveLogin ? { interactiveLoginMs: 360_000 } : {}),
                     // ADR-15 收尾:ReadGuard 审计在生产工具路径同样落盘(此前仅测试传隔离 stateRoot 才有 JSONL)
                     auditPath: join(config.stateRoot ?? '.', 'gotry-state', 'session-incidents.jsonl'),
                 },

package/dist/src/llm-price-table.js

@@ -0,0 +1,148 @@
+/**
+ * The frozen LLM price table (ADR-20) and the one function that turns measured usage into dollars.
+ *
+ * Moved verbatim from `scripts/nightly-evidence.ts`, which re-exports it, so the nightly evidence producer, the
+ * persona simulation and the AaaS quota meter all price through the same code. Prices live in
+ * `data/llm-price-table.json` and change only by PR (never auto-applied). Pricing is a peak-conservative upper bound,
+ * an unknown model has no price, and usage a provider omitted is unprovable: both fail closed and never guess.
+ *
+ * Schema evolution (issue #49): `gotry_llm_price_table_v1` is DeepSeek only, with flat fields under `prices.<model>`;
+ * `gotry_llm_price_table_v2` is `providers.<id>.models.<model>`, provider-aware, and lets a provider without an
+ * off-peak column fill it with the peak price. `loadPriceTable` reads both.
+ */
+import { readFileSync } from 'node:fs';
+function round6(value) {
+    return Number(value.toFixed(6));
+}
+function assertPriceEntry(label, value) {
+    const entry = typeof value === 'object' && value !== null ? value : null;
+    if (!entry)
+        throw new Error(`${label} must be an object`);
+    for (const field of ['input_cache_miss_usd_per_1m_peak', 'input_cache_hit_usd_per_1m_peak', 'output_usd_per_1m_peak']) {
+        const num = entry[field];
+        if (typeof num !== 'number' || !Number.isFinite(num) || num < 0) {
+            throw new Error(`${label}.${field} must be a non-negative finite number`);
+        }
+    }
+    return value;
+}
+export function loadPriceTable(path) {
+    const raw = JSON.parse(readFileSync(path, 'utf8'));
+    const schemaVersion = raw['schema_version'];
+    if (schemaVersion === 'gotry_llm_price_table_v2') {
+        return loadPriceTableV2(raw);
+    }
+    if (schemaVersion === 'gotry_llm_price_table_v1') {
+        return loadPriceTableV1(raw);
+    }
+    throw new Error(`price table schema_version must be gotry_llm_price_table_v1 or _v2, got: ${String(schemaVersion)}`);
+}
+function loadPriceTableV1(raw) {
+    const aliases = typeof raw['aliases'] === 'object' && raw['aliases'] !== null ? raw['aliases'] : {};
+    for (const [from, to] of Object.entries(aliases)) {
+        if (typeof to !== 'string')
+            throw new Error(`price table alias ${from} must map to a model name`);
+    }
+    const prices = {};
+    for (const [name, entry] of Object.entries(typeof raw['prices'] === 'object' && raw['prices'] !== null ? raw['prices'] : {})) {
+        prices[name] = assertPriceEntry(`price table entry ${name}`, entry);
+    }
+    return { schema_version: 'gotry_llm_price_table_v1', aliases, prices };
+}
+/** v2 reader: providers.<id>.models.<model> flattened into one aliases/prices pair, so the exposed API does not change.
+ *  Lookup for a model name:
+ *    1. an alias jumps to its target (qualified `providerId:model`);
+ *    2. otherwise the qualified `providerId:model` key is looked up in prices;
+ *    3. otherwise the bare `model` key (transparent with one provider, e.g. MiniMax-M3 is unique under minimax:models);
+ *    4. still not found: fail closed. */
+function loadPriceTableV2(raw) {
+    const providersObj = typeof raw['providers'] === 'object' && raw['providers'] !== null ? raw['providers'] : null;
+    if (!providersObj)
+        throw new Error('price table v2 requires providers object');
+    const aliases = {};
+    const prices = {};
+    for (const [providerId, rawProvider] of Object.entries(providersObj)) {
+        const provider = assertProviderEntry(`price table provider ${providerId}`, rawProvider);
+        for (const [aliasName, target] of Object.entries(provider.aliases)) {
+            if (typeof target !== 'string')
+                throw new Error(`provider ${providerId} alias ${aliasName} must map to a model name`);
+            if (!provider.models[target]) {
+                throw new Error(`provider ${providerId} alias ${aliasName} -> ${target} has no entry; update data/llm-price-table.json via PR`);
+            }
+            aliases[aliasName] = target;
+        }
+        for (const [modelName, entry] of Object.entries(provider.models)) {
+            const qualified = `${providerId}:${modelName}`;
+            const validated = assertPriceEntry(`price table provider ${providerId} model ${modelName}`, entry);
+            if (prices[qualified])
+                throw new Error(`duplicate price table key ${qualified}`);
+            prices[qualified] = validated;
+            if (prices[modelName])
+                throw new Error(`duplicate price table key ${modelName} (across providers, disambiguate via aliases or qualified lookup)`);
+            prices[modelName] = validated;
+        }
+    }
+    return { schema_version: 'gotry_llm_price_table_v2', aliases, prices };
+}
+function assertProviderEntry(label, value) {
+    const entry = typeof value === 'object' && value !== null ? value : null;
+    if (!entry)
+        throw new Error(`${label} must be an object`);
+    const family = entry['family'];
+    if (typeof family !== 'string' || family.length === 0)
+        throw new Error(`${label}.family must be a non-empty string`);
+    const strategy = entry['price_strategy'];
+    if (strategy !== 'tiered_peak_offpeak' && strategy !== 'flat_no_offpeak') {
+        throw new Error(`${label}.price_strategy must be 'tiered_peak_offpeak' or 'flat_no_offpeak', got: ${String(strategy)}`);
+    }
+    const aliases = typeof entry['aliases'] === 'object' && entry['aliases'] !== null ? entry['aliases'] : {};
+    const models = typeof entry['models'] === 'object' && entry['models'] !== null ? entry['models'] : {};
+    return {
+        family,
+        price_strategy: strategy,
+        api_base: typeof entry['api_base'] === 'string' ? entry['api_base'] : undefined,
+        source_url: typeof entry['source_url'] === 'string' ? entry['source_url'] : undefined,
+        aliases,
+        models,
+    };
+}
+/** Dollars for one run's measured usage (peak-conservative upper bound: the table's peak columns, never a guess). */
+export function priceRunCost(model, usage, table) {
+    if (usage.responsesMissingUsage > 0) {
+        throw new Error(`usage provider omitted usage on ${usage.responsesMissingUsage} response(s) — cost unprovable, refusing to price (fail-closed)`);
+    }
+    const alias = table.aliases[model];
+    if (alias && !table.prices[alias])
+        throw new Error(`price table alias ${model} -> ${alias} has no entry; update data/llm-price-table.json via PR`);
+    const entry = table.prices[alias ?? model];
+    if (!entry)
+        throw new Error(`price table has no entry for model ${model}; update data/llm-price-table.json via PR (fail-closed, no guessed price)`);
+    const cost = (usage.inputCacheMissTokens * entry.input_cache_miss_usd_per_1m_peak
+        + usage.inputCacheHitTokens * entry.input_cache_hit_usd_per_1m_peak
+        + usage.outputTokens * entry.output_usd_per_1m_peak) / 1_000_000;
+    return round6(cost);
+}
+function nonNegativeInteger(name, value) {
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0)
+        throw new RangeError(`${name} must be a non-negative integer`);
+    return value;
+}
+/** `priceRunCost` for one measured usage report. Malformed counts are rejected rather than priced. */
+export function priceMeasuredUsage(model, usage, table) {
+    const inputTokens = nonNegativeInteger('inputTokens', usage.inputTokens);
+    const outputTokens = nonNegativeInteger('outputTokens', usage.outputTokens);
+    const cacheReadTokens = nonNegativeInteger('cacheReadTokens', usage.cacheReadTokens ?? 0);
+    const costUsd = priceRunCost(model, {
+        calls: 1,
+        inputTokens: inputTokens + cacheReadTokens,
+        outputTokens,
+        inputCacheHitTokens: cacheReadTokens,
+        inputCacheMissTokens: inputTokens,
+        responsesMissingUsage: 0,
+    }, table);
+    return { tokens: inputTokens + cacheReadTokens + outputTokens, costUsd };
+}
+/** Throws unless the table prices `model`. Used at composition time so an unpriced model stops the service before any spend. */
+export function assertModelPriced(model, table) {
+    priceRunCost(model, { calls: 0, inputTokens: 0, outputTokens: 0, inputCacheHitTokens: 0, inputCacheMissTokens: 0, responsesMissingUsage: 0 }, table);
+}

package/dist/src/tenant-seam/index.js

@@ -0,0 +1,8 @@
+/**
+ * The trusted seam of the AaaS line (docs/rfc/aaas-rfc.md §4.4): tenant derivation from the authenticated caller, and
+ * the quotas and metering that keep one tenant or organization from moving another's latency budget. Outside the kernel.
+ */
+export * from './quotas.js';
+export * from './seam.js';
+export * from './llm-broker.js';
+export * from './process-governor.js';