@datalayer/agent-runtimes 1.5.44 → 1.5.46

package/lib/portable/hosts/deliveries.js

@@ -0,0 +1,147 @@
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+import { DELIVERY_HEADER, SIGNATURE_HEADER, TIMESTAMP_HEADER, verifyDelivery, } from './contracts';
+/** Where Datalayer pushes an installation's deliveries, under the service's public address. */
+export const DELIVERY_PATH = '/datalayer/deliveries';
+export const DELIVERY_ROUTE = `${DELIVERY_PATH}/:hostUid`;
+const DELIVERY_BODY_LIMIT = 64 * 1024;
+/**
+ * Handle one delivery of an installation once (claimed by its uid), then
+ * acknowledge it at Datalayer. A removed installation's delivery is dropped;
+ * a handling that fails releases its claim, so the queue tries again.
+ */
+export async function receiveDelivery(job, input) {
+    const hostKey = await input.sink.hostKeyOf(job.hostUid);
+    if (!hostKey) {
+        return;
+    }
+    const claim = `delivery:${job.hostUid}:${job.delivery.delivery}`;
+    if (await input.claims.claimEvent(claim)) {
+        try {
+            await input.handle(job.delivery);
+        }
+        catch (error) {
+            await input.claims.releaseEvent(claim);
+            throw error;
+        }
+    }
+    await input.client.acknowledge(hostKey, job.delivery.delivery);
+}
+async function rawBodyOf(request) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of request) {
+        size += chunk.length;
+        if (size > DELIVERY_BODY_LIMIT) {
+            throw new Error('The delivery is too large.');
+        }
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks);
+}
+/**
+ * The signed webhook Datalayer pushes to (`POST /datalayer/deliveries/{host}`,
+ * registered with `PUT …/self/delivery`): verified with that installation's
+ * secret — HMAC over `<timestamp>.<body>`, five minutes at most — then queued
+ * and acknowledged with 2xx at once; the work runs from the queue.
+ */
+export function deliveryRoute(sink, enqueue, nowSeconds) {
+    return async (request, response) => {
+        const answer = (status, body) => {
+            response.writeHead(status, { 'content-type': 'application/json' });
+            response.end(JSON.stringify(body));
+        };
+        try {
+            const named = request.params?.hostUid;
+            const hostUid = typeof named === 'string' ? named : '';
+            const secret = hostUid ? await sink.deliverySecretOf(hostUid) : undefined;
+            if (!secret) {
+                return answer(404, { ok: false, error: 'unknown installation' });
+            }
+            const header = (name) => {
+                const value = request.headers[name.toLowerCase()];
+                return Array.isArray(value) ? value[0] : value;
+            };
+            const rawBody = await rawBodyOf(request);
+            let delivery;
+            try {
+                delivery = verifyDelivery({
+                    nowSeconds: nowSeconds?.(),
+                    rawBody,
+                    secret,
+                    signature: header(SIGNATURE_HEADER),
+                    timestamp: header(TIMESTAMP_HEADER),
+                });
+            }
+            catch {
+                return answer(401, { ok: false, error: 'not verified' });
+            }
+            if (header(DELIVERY_HEADER) &&
+                header(DELIVERY_HEADER) !== delivery.delivery) {
+                return answer(400, { ok: false, error: 'delivery mismatch' });
+            }
+            await enqueue({ delivery, hostUid });
+            return answer(200, { ok: true });
+        }
+        catch {
+            return answer(500, { ok: false });
+        }
+    };
+}
+/**
+ * The outbox, read when a push was missed or no address is registered
+ * (`GET …/self/deliveries`): each delivery of every bound installation
+ * queued, handled once, then acknowledged.
+ */
+export class DeliveryPoller {
+    sink;
+    client;
+    enqueue;
+    logger;
+    #timer;
+    #running = false;
+    constructor(sink, client, enqueue, logger = console) {
+        this.sink = sink;
+        this.client = client;
+        this.enqueue = enqueue;
+        this.logger = logger;
+    }
+    async pollOnce() {
+        let queued = 0;
+        for (const { hostKey, hostUid } of await this.sink.boundHosts()) {
+            try {
+                for (const delivery of await this.client.outbox(hostKey)) {
+                    await this.enqueue({ delivery, hostUid });
+                    queued += 1;
+                }
+            }
+            catch (error) {
+                this.logger.warn(`The outbox of one installation was not read: ${error.message}`);
+            }
+        }
+        return queued;
+    }
+    start(intervalSeconds) {
+        if (intervalSeconds <= 0 || this.#timer) {
+            return;
+        }
+        this.#timer = setInterval(() => {
+            if (this.#running) {
+                return;
+            }
+            this.#running = true;
+            void this.pollOnce().finally(() => {
+                this.#running = false;
+            });
+        }, intervalSeconds * 1000);
+        this.#timer.unref?.();
+    }
+    stop() {
+        if (this.#timer) {
+            clearInterval(this.#timer);
+        }
+        this.#timer = undefined;
+    }
+}

package/lib/portable/hosts/forbiddenGraph.d.ts

@@ -0,0 +1,77 @@
+/**
+ * What may never reach a host service's production code (SLACK §4.2, S-005;
+ * DISCORD §4.2): Jupyter, JupyterLab, Lumino, Datalayer's Jupyter packages,
+ * React, Primer, Reactor and the other host services. Checked over the
+ * service's source imports, its esbuild bundle's module graph
+ * (`forbiddenInBundle`, over the metafile) and the installed graph of the
+ * bundle's externals (`npm ls --omit=dev --omit=peer --all`). Pure functions:
+ * each service reads its files and runs them. Moved from the Slack service
+ * (plans/DISCORD.md DC-004).
+ *
+ * @module portable/hosts/forbiddenGraph
+ */
+export declare const FORBIDDEN: readonly RegExp[];
+/** A package reached, with the chain of dependencies that reached it. */
+export type Reached = Readonly<{
+    chain: string[];
+    name: string;
+}>;
+type LockPackage = {
+    dependencies?: Record<string, string>;
+    optionalDependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+    peerDependenciesMeta?: Record<string, {
+        optional?: boolean;
+    }>;
+};
+/** A lockfile, v2 or v3: its `packages`. */
+export type Lockfile = {
+    packages?: Record<string, LockPackage>;
+};
+/** What `npm ls --json` answers: each package and its own dependencies. */
+export type InstalledTree = {
+    dependencies?: Record<string, InstalledTree | undefined>;
+};
+export declare const isForbidden: (name: string) => boolean;
+/** The package name an import specifier names: `@scope/name/deep` → `@scope/name`. */
+export declare function packageOf(specifier: string): string | undefined;
+/** Every bare import of one source file. */
+export declare function importsOf(source: string): string[];
+/**
+ * The production graph of a lockfile (v2/v3 `packages`): from the root's
+ * `dependencies` and `optionalDependencies` (never `devDependencies`), each
+ * package's own dependencies resolved the way Node resolves them — the
+ * nearest `node_modules` up from the dependent. Answers each package reached
+ * with the chain that reached it.
+ */
+export declare function productionGraph(lock: Lockfile): Reached[];
+/**
+ * The production graph as `npm ls --omit=dev --all --json` answers it, from
+ * what is installed: what the service runs with, whether a lockfile is kept
+ * or not (the monorepo keeps none). Each package with the chain reaching it.
+ */
+export declare function installedGraph(tree: InstalledTree): Reached[];
+/** The forbidden packages an installed graph reaches, each with its chain. */
+export declare function forbiddenInInstalled(tree: InstalledTree): string[];
+/** The forbidden packages a lockfile's production graph reaches, each with its chain. */
+export declare function forbiddenInGraph(lock: Lockfile): string[];
+/** The parts of an esbuild metafile the bundle gate reads. */
+export type BundleMetafile = {
+    inputs: Record<string, unknown>;
+    outputs: Record<string, {
+        imports?: ReadonlyArray<{
+            path: string;
+            external?: boolean;
+        }>;
+    }>;
+};
+/**
+ * What a service's esbuild bundle may hold (DISCORD §4.2): its own sources,
+ * and agent-runtimes' `lib/portable` (by its real path: the monorepo's
+ * workspace link resolves to `ai/agent-runtimes/lib/portable/…`). Every
+ * other module is a package's, and refused; every external is a `node:`
+ * builtin or a name in the service's `dependencies`; nothing matches
+ * `FORBIDDEN`. Answers each violation in words.
+ */
+export declare function forbiddenInBundle(metafile: BundleMetafile, dependencies: readonly string[]): string[];
+export {};

package/lib/portable/hosts/forbiddenGraph.js

@@ -0,0 +1,174 @@
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * What may never reach a host service's production code (SLACK §4.2, S-005;
+ * DISCORD §4.2): Jupyter, JupyterLab, Lumino, Datalayer's Jupyter packages,
+ * React, Primer, Reactor and the other host services. Checked over the
+ * service's source imports, its esbuild bundle's module graph
+ * (`forbiddenInBundle`, over the metafile) and the installed graph of the
+ * bundle's externals (`npm ls --omit=dev --omit=peer --all`). Pure functions:
+ * each service reads its files and runs them. Moved from the Slack service
+ * (plans/DISCORD.md DC-004).
+ *
+ * @module portable/hosts/forbiddenGraph
+ */
+export const FORBIDDEN = [
+    /^@jupyter\//,
+    /^@jupyterlab\//,
+    /^@jupyter-widgets\//,
+    /^@lumino\//,
+    /^@datalayer\/jupyter-/,
+    /^react-dom$/,
+    /^react$/,
+    /^@primer\//,
+    /^@datalayer\/reactor$/,
+    /^@datalayer\/slack$/,
+    /^@datalayer\/discord$/,
+];
+export const isForbidden = (name) => FORBIDDEN.some(pattern => pattern.test(name));
+/** The package name an import specifier names: `@scope/name/deep` → `@scope/name`. */
+export function packageOf(specifier) {
+    if (specifier.startsWith('.') || specifier.startsWith('node:'))
+        return undefined;
+    const parts = specifier.split('/');
+    return specifier.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0];
+}
+/** Every bare import of one source file. */
+export function importsOf(source) {
+    const found = new Set();
+    const patterns = [
+        /\bimport\s+(?:type\s+)?(?:[^'"]*?\sfrom\s+)?["']([^"']+)["']/g,
+        /\bexport\s+(?:type\s+)?[^'"]*?\sfrom\s+["']([^"']+)["']/g,
+        /\bimport\(\s*["']([^"']+)["']\s*\)/g,
+        /\brequire\(\s*["']([^"']+)["']\s*\)/g,
+    ];
+    for (const pattern of patterns)
+        for (const match of source.matchAll(pattern)) {
+            const name = packageOf(match[1] ?? '');
+            if (name)
+                found.add(name);
+        }
+    return [...found];
+}
+/**
+ * The production graph of a lockfile (v2/v3 `packages`): from the root's
+ * `dependencies` and `optionalDependencies` (never `devDependencies`), each
+ * package's own dependencies resolved the way Node resolves them — the
+ * nearest `node_modules` up from the dependent. Answers each package reached
+ * with the chain that reached it.
+ */
+export function productionGraph(lock) {
+    const packages = lock.packages ?? {};
+    const root = packages[''] ?? {};
+    const resolve = (from, name) => {
+        let base = from;
+        while (true) {
+            const candidate = `${base ? `${base}/` : ''}node_modules/${name}`;
+            if (packages[candidate])
+                return candidate;
+            if (!base)
+                return undefined;
+            const index = base.lastIndexOf('/node_modules/');
+            base = index >= 0 ? base.slice(0, index) : '';
+        }
+    };
+    const reached = new Map();
+    const queue = [];
+    for (const name of Object.keys({
+        ...root.dependencies,
+        ...root.optionalDependencies,
+    }))
+        queue.push({ chain: [name], from: '', name });
+    while (queue.length > 0) {
+        const { chain, from, name } = queue.shift();
+        const path = resolve(from, name);
+        if (!path || reached.has(path))
+            continue;
+        reached.set(path, { chain, name });
+        const meta = packages[path] ?? {};
+        for (const next of Object.keys({
+            ...meta.dependencies,
+            ...meta.optionalDependencies,
+            ...meta.peerDependencies,
+        }))
+            if (!(meta.peerDependenciesMeta?.[next]?.optional && !resolve(path, next)))
+                queue.push({ chain: [...chain, next], from: path, name: next });
+    }
+    return [...reached.values()];
+}
+/**
+ * The production graph as `npm ls --omit=dev --all --json` answers it, from
+ * what is installed: what the service runs with, whether a lockfile is kept
+ * or not (the monorepo keeps none). Each package with the chain reaching it.
+ */
+export function installedGraph(tree) {
+    const reached = [];
+    const seen = new Set();
+    const walk = (dependencies, chain) => {
+        for (const [name, node] of Object.entries(dependencies ?? {})) {
+            const id = `${chain.join('>')}>${name}`;
+            if (seen.has(id) || chain.includes(name))
+                continue;
+            seen.add(id);
+            reached.push({ chain: [...chain, name], name });
+            walk(node?.dependencies, [...chain, name]);
+        }
+    };
+    walk(tree.dependencies, []);
+    return reached;
+}
+/** The forbidden packages an installed graph reaches, each with its chain. */
+export function forbiddenInInstalled(tree) {
+    return installedGraph(tree)
+        .filter(one => isForbidden(one.name))
+        .map(one => one.chain.join(' → '));
+}
+/** The forbidden packages a lockfile's production graph reaches, each with its chain. */
+export function forbiddenInGraph(lock) {
+    return productionGraph(lock)
+        .filter(one => isForbidden(one.name))
+        .map(one => one.chain.join(' → '));
+}
+/** Where agent-runtimes' portable code lies, by the real path esbuild reads it from. */
+const PORTABLE = /(^|\/)agent-runtimes\/lib\/portable\//;
+/**
+ * What a service's esbuild bundle may hold (DISCORD §4.2): its own sources,
+ * and agent-runtimes' `lib/portable` (by its real path: the monorepo's
+ * workspace link resolves to `ai/agent-runtimes/lib/portable/…`). Every
+ * other module is a package's, and refused; every external is a `node:`
+ * builtin or a name in the service's `dependencies`; nothing matches
+ * `FORBIDDEN`. Answers each violation in words.
+ */
+export function forbiddenInBundle(metafile, dependencies) {
+    const violations = [];
+    for (const input of Object.keys(metafile.inputs)) {
+        const portable = PORTABLE.test(input);
+        const modules = input.lastIndexOf('node_modules/');
+        const name = modules >= 0
+            ? packageOf(input.slice(modules + 'node_modules/'.length))
+            : undefined;
+        if (name && isForbidden(name))
+            violations.push(`${input}: ${name} is forbidden`);
+        else if (!portable && (modules >= 0 || input.startsWith('../')))
+            violations.push(`${input}: bundled from outside the service and agent-runtimes' lib/portable`);
+    }
+    const externals = new Set();
+    for (const output of Object.values(metafile.outputs))
+        for (const one of output.imports ?? [])
+            if (one.external)
+                externals.add(one.path);
+    for (const path of externals) {
+        if (path.startsWith('node:'))
+            continue;
+        const name = packageOf(path);
+        if (!name)
+            violations.push(`${path}: a relative external`);
+        else if (isForbidden(name))
+            violations.push(`${path}: ${name} is forbidden`);
+        else if (!dependencies.includes(name))
+            violations.push(`${path}: external, but ${name} is not one of the service's dependencies`);
+    }
+    return violations;
+}

package/lib/portable/hosts/health.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Liveness and readiness (SLACK §10, S-101; DISCORD §10): `/healthz` says the
+ * process answers; `/readyz` says it can take durable work now — its store
+ * and its queue answer — and never asks the host or Datalayer, so a
+ * transient outage of either does not take the pods out of service: accepted
+ * work waits in the queue instead. And the window a signed host request's
+ * timestamp must fall in. Moved from the Slack service (plans/DISCORD.md
+ * DC-004).
+ *
+ * @module portable/hosts/health
+ */
+import { type IncomingMessage, type Server, type ServerResponse } from 'node:http';
+export type ReadinessChecks = Readonly<Record<string, () => Promise<boolean>>>;
+/** Each check, at most `timeoutMs`: a check that throws or is late is not ready. */
+export declare function readiness(checks: ReadinessChecks, timeoutMs?: number): Promise<{
+    ready: boolean;
+    checks: Record<string, boolean>;
+}>;
+/** The health paths, and what each answers. */
+export declare const HEALTH_PATHS: readonly ["/healthz", "/readyz"];
+/**
+ * Answer `GET /healthz` or `GET /readyz`; `false` for any other request,
+ * which the caller answers.
+ */
+export declare function answerHealth(checks: ReadinessChecks, request: IncomingMessage, response: ServerResponse): boolean;
+/** A worker's own server: its health and readiness only (no host route). */
+export declare function healthServer(checks: ReadinessChecks): Server;
+/** How far a signed host request's timestamp may be from now, either way (SLACK §7.1, 1; DISCORD §7.1, 1). */
+export declare const REQUEST_WINDOW_SECONDS: number;
+/**
+ * Whether a request's timestamp header (Slack's `X-Slack-Request-Timestamp`,
+ * Discord's `X-Signature-Timestamp`) is within five minutes of now, in the
+ * past or the future: a replay with a skewed clock is refused too.
+ */
+export declare function timestampWithinWindow(header: string | string[] | undefined, nowSeconds?: number): boolean;

package/lib/portable/hosts/health.js

@@ -0,0 +1,92 @@
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * Liveness and readiness (SLACK §10, S-101; DISCORD §10): `/healthz` says the
+ * process answers; `/readyz` says it can take durable work now — its store
+ * and its queue answer — and never asks the host or Datalayer, so a
+ * transient outage of either does not take the pods out of service: accepted
+ * work waits in the queue instead. And the window a signed host request's
+ * timestamp must fall in. Moved from the Slack service (plans/DISCORD.md
+ * DC-004).
+ *
+ * @module portable/hosts/health
+ */
+import { createServer, } from 'node:http';
+/** Each check, at most `timeoutMs`: a check that throws or is late is not ready. */
+export async function readiness(checks, timeoutMs = 2_000) {
+    const results = {};
+    await Promise.all(Object.entries(checks).map(async ([name, check]) => {
+        let timer;
+        try {
+            results[name] = await Promise.race([
+                check(),
+                new Promise(resolve => {
+                    timer = setTimeout(() => resolve(false), timeoutMs);
+                }),
+            ]);
+        }
+        catch {
+            results[name] = false;
+        }
+        finally {
+            if (timer) {
+                clearTimeout(timer);
+            }
+        }
+    }));
+    return {
+        checks: results,
+        ready: Object.values(results).every(Boolean),
+    };
+}
+function json(response, status, body) {
+    response.writeHead(status, {
+        'cache-control': 'no-store',
+        'content-type': 'application/json',
+    });
+    response.end(JSON.stringify(body));
+}
+/** The health paths, and what each answers. */
+export const HEALTH_PATHS = ['/healthz', '/readyz'];
+/**
+ * Answer `GET /healthz` or `GET /readyz`; `false` for any other request,
+ * which the caller answers.
+ */
+export function answerHealth(checks, request, response) {
+    const path = (request.url ?? '').split('?')[0];
+    if (request.method !== 'GET') {
+        return false;
+    }
+    if (path === '/healthz') {
+        json(response, 200, { status: 'ok' });
+        return true;
+    }
+    if (path === '/readyz') {
+        void readiness(checks).then(answer => json(response, answer.ready ? 200 : 503, answer));
+        return true;
+    }
+    return false;
+}
+/** A worker's own server: its health and readiness only (no host route). */
+export function healthServer(checks) {
+    return createServer((request, response) => {
+        if (!answerHealth(checks, request, response)) {
+            response.writeHead(404);
+            response.end();
+        }
+    });
+}
+/** How far a signed host request's timestamp may be from now, either way (SLACK §7.1, 1; DISCORD §7.1, 1). */
+export const REQUEST_WINDOW_SECONDS = 5 * 60;
+/**
+ * Whether a request's timestamp header (Slack's `X-Slack-Request-Timestamp`,
+ * Discord's `X-Signature-Timestamp`) is within five minutes of now, in the
+ * past or the future: a replay with a skewed clock is refused too.
+ */
+export function timestampWithinWindow(header, nowSeconds = Math.floor(Date.now() / 1000)) {
+    const value = Number(Array.isArray(header) ? header[0] : header);
+    return (Number.isInteger(value) &&
+        Math.abs(nowSeconds - value) <= REQUEST_WINDOW_SECONDS);
+}

package/lib/portable/hosts/index.d.ts

@@ -0,0 +1,40 @@
+/**
+ * What a chat host service (Slack, Discord) shares, on Node: the ai-agents
+ * host contracts and client, the agent client over the session API, the
+ * semantic events a turn is reduced to, approval renderers, deliveries, the
+ * turn's state, application resolution, the durable queue, quotas, secrets
+ * at rest, observability, dead letters, health, the shared schema and the
+ * forbidden-graph gate (plans/DISCORD.md §4.2, DC-004, DC-005).
+ *
+ * Imported as `@datalayer/agent-runtimes/lib/portable/hosts`, and only by a
+ * Node service, which bundles it with esbuild. It reaches `src/portable/` and
+ * this folder only, and the packages `zod`, `node:crypto` and `node:http`;
+ * never React, DOM, Jupyter, Lumino, Primer, Reactor, `pg` or another folder
+ * of Agent Runtimes (`src/__tests__/portable.unit.test.ts` holds it to that).
+ * It imports its siblings by name, never `'../index'`, whose types reach
+ * Reactor; so a service never imports `@datalayer/agent-runtimes/lib/portable`
+ * itself: what it needs of it is re-exported here.
+ *
+ * @module portable/hosts
+ */
+export { AgUiFrames, readRunStream, type AgUiEvent } from '../agui';
+export * from '../semantic';
+export { askQuestionOf, semanticOf, turnOf, type TurnInfo, } from '../semanticOfAgUi';
+export * from './contracts';
+export { DatalayerHostClient, HostRefusedError, type BoundHost, type HostSelf, } from './client';
+export { agUiEventsOf, assertTrustedStreamUrl, DevelopmentCredentials, HostKeyCredentials, hostSessionOf, HostStarters, HttpAgentClient, InstallationCredentials, lastAnswer, type AgentClient, type HostCredentials, type HostKeyLookup, type HostSession, type HostShape, type HostTurnRequest, type Place, type Starter, type StarterSource, type TurnStream, } from './agentClient';
+export { hostSessionUid } from './sessionUid';
+export { DATALAYER_ONLY, RENDERERS, renderApproval, type RenderedAction, type RenderedField, } from './approvalRenderers';
+export { DELIVERY_PATH, DELIVERY_ROUTE, DeliveryPoller, deliveryRoute, receiveDelivery, type BoundHostKey, type DeliveryClaimStore, type DeliveryJob, type DeliverySink, } from './deliveries';
+export { TurnState, type TurnEnding, type TurnFile, type TurnTool, } from './turnState';
+export { resolveApplication, usableAllowances, type AllowanceView, type ApplicationRefusal, type ApplicationResolution, type ChannelRule, } from './resolution';
+export { MemoryWorkQueue, tablePrefixOf, type ConnectionPool, type Queryable, type QueryAnswer, type WorkQueue, } from './queue';
+export { PostgresWorkQueue } from './postgresQueue';
+export { DEFAULT_QUOTAS, MemoryQuotaStore, PostgresQuotaStore, quotaEntries, quotaWords, resetOf, userQuotaKey, windowOf, type QuotaEntry, type QuotaLimits, type QuotaScope, type QuotaStore, type QuotaTake, type QuotaTaken, } from './quotas';
+export { SecretCipher, type EncryptedSecret } from './secretCipher';
+export { Logger, LogTracer, noTracer, pseudonym, redact, redactCredentials, REDACTED, TOKEN_PATTERNS, type LogSink, type Tracer, } from './observability';
+export { DEAD_LETTERS_USAGE, DeadLetters, deadLetters, payloadHash, runDeadLettersCli, type CliOutput, type DeadLetter, } from './deadLetters';
+export { answerHealth, HEALTH_PATHS, healthServer, readiness, REQUEST_WINDOW_SECONDS, timestampWithinWindow, type ReadinessChecks, } from './health';
+export { systemClock, type Clock } from './rateLimit';
+export { applyHostSchema, hostSchemaSql, hostTables } from './schema';
+export { FORBIDDEN, forbiddenInBundle, forbiddenInGraph, forbiddenInInstalled, importsOf, installedGraph, isForbidden, packageOf, productionGraph, type BundleMetafile, type InstalledTree, type Lockfile, type Reached, } from './forbiddenGraph';

package/lib/portable/hosts/index.js

@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * What a chat host service (Slack, Discord) shares, on Node: the ai-agents
+ * host contracts and client, the agent client over the session API, the
+ * semantic events a turn is reduced to, approval renderers, deliveries, the
+ * turn's state, application resolution, the durable queue, quotas, secrets
+ * at rest, observability, dead letters, health, the shared schema and the
+ * forbidden-graph gate (plans/DISCORD.md §4.2, DC-004, DC-005).
+ *
+ * Imported as `@datalayer/agent-runtimes/lib/portable/hosts`, and only by a
+ * Node service, which bundles it with esbuild. It reaches `src/portable/` and
+ * this folder only, and the packages `zod`, `node:crypto` and `node:http`;
+ * never React, DOM, Jupyter, Lumino, Primer, Reactor, `pg` or another folder
+ * of Agent Runtimes (`src/__tests__/portable.unit.test.ts` holds it to that).
+ * It imports its siblings by name, never `'../index'`, whose types reach
+ * Reactor; so a service never imports `@datalayer/agent-runtimes/lib/portable`
+ * itself: what it needs of it is re-exported here.
+ *
+ * @module portable/hosts
+ */
+// The run stream and its reduction, from the portable entry's own modules.
+export { AgUiFrames, readRunStream } from '../agui';
+export * from '../semantic';
+export { askQuestionOf, semanticOf, turnOf, } from '../semanticOfAgUi';
+export * from './contracts';
+export { DatalayerHostClient, HostRefusedError, } from './client';
+export { agUiEventsOf, assertTrustedStreamUrl, DevelopmentCredentials, HostKeyCredentials, hostSessionOf, HostStarters, HttpAgentClient, InstallationCredentials, lastAnswer, } from './agentClient';
+export { hostSessionUid } from './sessionUid';
+export { DATALAYER_ONLY, RENDERERS, renderApproval, } from './approvalRenderers';
+export { DELIVERY_PATH, DELIVERY_ROUTE, DeliveryPoller, deliveryRoute, receiveDelivery, } from './deliveries';
+export { TurnState, } from './turnState';
+export { resolveApplication, usableAllowances, } from './resolution';
+export { MemoryWorkQueue, tablePrefixOf, } from './queue';
+export { PostgresWorkQueue } from './postgresQueue';
+export { DEFAULT_QUOTAS, MemoryQuotaStore, PostgresQuotaStore, quotaEntries, quotaWords, resetOf, userQuotaKey, windowOf, } from './quotas';
+export { SecretCipher } from './secretCipher';
+export { Logger, LogTracer, noTracer, pseudonym, redact, redactCredentials, REDACTED, TOKEN_PATTERNS, } from './observability';
+export { DEAD_LETTERS_USAGE, DeadLetters, deadLetters, payloadHash, runDeadLettersCli, } from './deadLetters';
+export { answerHealth, HEALTH_PATHS, healthServer, readiness, REQUEST_WINDOW_SECONDS, timestampWithinWindow, } from './health';
+export { systemClock } from './rateLimit';
+export { applyHostSchema, hostSchemaSql, hostTables } from './schema';
+export { FORBIDDEN, forbiddenInBundle, forbiddenInGraph, forbiddenInInstalled, importsOf, installedGraph, isForbidden, packageOf, productionGraph, } from './forbiddenGraph';