@intx/hub-sessions 0.2.2 → 0.4.0

package/dist/ws/sidecar-handler.test-helpers.d.ts

@@ -0,0 +1,38 @@
+import type { HarnessConfig } from "@intx/types/runtime";
+import { createSidecarRouter, type AllocatedSidecarTarget, type SidecarAuthIdentity, type SidecarRouterConfig, type WsHandle } from "./sidecar-handler.js";
+export declare const TEST_IDENTITY: Extract<SidecarAuthIdentity, {
+    kind: "allocated";
+}>;
+export declare const TEST_TARGET: AllocatedSidecarTarget;
+export declare const TEST_CONFIG: HarnessConfig;
+export declare function createMockWs(): WsHandle & {
+    sent: string[];
+    closed: boolean;
+    /**
+     * Resolve once `predicate` holds over the frames sent so far, re-checking
+     * on each send.
+     *
+     * Several of the router's paths write to the socket from a fire-and-forget
+     * continuation -- the mail redelivery retry is one -- so a test that
+     * triggers one has no return value to await. The send is the event.
+     */
+    awaitSent(predicate: (sent: readonly string[]) => boolean): Promise<void>;
+};
+export declare function createAllocatedRouter(config?: Partial<SidecarRouterConfig>): import("./sidecar-handler.js").SidecarRouter & import("./sidecar-handler.js").SidecarAllocationRouter;
+export declare function connectAllocated(router: ReturnType<typeof createSidecarRouter>, agentAddresses?: string[], frameType?: "register" | "reconnect"): Promise<WsHandle & {
+    sent: string[];
+    closed: boolean;
+    /**
+     * Resolve once `predicate` holds over the frames sent so far, re-checking
+     * on each send.
+     *
+     * Several of the router's paths write to the socket from a fire-and-forget
+     * continuation -- the mail redelivery retry is one -- so a test that
+     * triggers one has no return value to await. The send is the event.
+     */
+    awaitSent(predicate: (sent: readonly string[]) => boolean): Promise<void>;
+}>;
+export declare function parsedFrames(ws: {
+    sent: string[];
+}): unknown[];
+export declare function tick(): Promise<void>;

package/dist/ws/sidecar-handler.test-helpers.js

@@ -0,0 +1,95 @@
+import { createSidecarRouter, } from "./sidecar-handler.js";
+export const TEST_IDENTITY = {
+    kind: "allocated",
+    sidecarId: "sc-allocated",
+    allocationId: "alloc-1",
+    tenantId: "tenant-1",
+    anchorRunId: "run_anchor",
+    workflowRunAddress: "run_anchor@tenant.example",
+    generation: 1,
+};
+export const TEST_TARGET = {
+    allocationId: TEST_IDENTITY.allocationId,
+    generation: TEST_IDENTITY.generation,
+};
+export const TEST_CONFIG = {
+    sessionId: "ses-router-test",
+    agentId: "workflow",
+    tenantId: TEST_IDENTITY.tenantId,
+    principalId: "principal-1",
+    agentAddress: TEST_IDENTITY.workflowRunAddress,
+    systemPrompt: "test",
+    tools: [],
+    grants: [],
+    sources: [
+        {
+            id: "test-source",
+            provider: "test",
+            baseURL: "https://api.example.test",
+            credentialId: "test-credential",
+            model: "test",
+        },
+    ],
+    defaultSource: "test-source",
+};
+export function createMockWs() {
+    let waiters = [];
+    return {
+        sent: [],
+        closed: false,
+        send(data) {
+            this.sent.push(data);
+            const waking = waiters;
+            waiters = [];
+            for (const wake of waking)
+                wake();
+        },
+        close() {
+            this.closed = true;
+        },
+        async awaitSent(predicate) {
+            for (;;) {
+                // Re-checked on every pass, so a frame sent before this call resolves
+                // it rather than leaving it waiting for another send.
+                const sent = new Promise((resolve) => {
+                    waiters.push(resolve);
+                });
+                if (predicate(this.sent))
+                    return;
+                await sent;
+            }
+        },
+    };
+}
+export function createAllocatedRouter(config = {}) {
+    const router = createSidecarRouter({
+        authenticateSidecar: async () => TEST_IDENTITY,
+        validateSidecarIdentity: async () => true,
+        hubPublicKey: "a".repeat(64),
+        requestTimeoutMs: 500,
+        ...config,
+    });
+    router.fenceAllocation(TEST_TARGET.allocationId, TEST_TARGET.generation);
+    return router;
+}
+export async function connectAllocated(router, agentAddresses = [], frameType = "register") {
+    const ws = createMockWs();
+    router.handleOpen(ws);
+    router.handleMessage(ws, JSON.stringify({
+        type: frameType,
+        sidecarId: TEST_IDENTITY.sidecarId,
+        token: "token",
+        agentAddresses,
+    }));
+    await tick();
+    return ws;
+}
+export function parsedFrames(ws) {
+    return ws.sent.map((raw) => {
+        const parsed = JSON.parse(raw);
+        return parsed;
+    });
+}
+export function tick() {
+    return new Promise((resolve) => setTimeout(resolve, 0));
+}

package/dist/ws/sidecar-token-authenticator.d.ts

@@ -1,4 +1,5 @@
 import type { DB } from "@intx/db";
+import type { SidecarCredentialResolver } from "../sidecar-allocation/contracts.js";
 import type { SidecarAuthenticator } from "./sidecar-handler.js";
 export type CreateSidecarTokenAuthenticatorDeps = {
     db: DB["db"];
@@ -12,4 +13,5 @@ export type CreateSidecarTokenAuthenticatorDeps = {
  * `sidecarId` on the frame is ignored: identity is derived from the
  * token alone.
  */
-export declare function createSidecarTokenAuthenticator({ db, }: CreateSidecarTokenAuthenticatorDeps): SidecarAuthenticator;
+export declare function createSidecarCredentialResolver({ db, }: CreateSidecarTokenAuthenticatorDeps): SidecarCredentialResolver;
+export declare function createSidecarTokenAuthenticator(deps: CreateSidecarTokenAuthenticatorDeps): SidecarAuthenticator;

package/dist/ws/sidecar-token-authenticator.js

@@ -1,6 +1,6 @@
-import { eq } from "drizzle-orm";
+import { and, eq, inArray } from "drizzle-orm";
 import { sha256 } from "@intx/crypto";
-import { sidecar } from "@intx/db/schema";
+import { sidecar, sidecarAllocation, workflowProbe, workflowRun, } from "@intx/db/schema";
 /**
  * Builds an authenticator that verifies a sidecar's presented token
  * against the per-sidecar hash stored on the `sidecar` table. The token
@@ -10,15 +10,86 @@ import { sidecar } from "@intx/db/schema";
  * `sidecarId` on the frame is ignored: identity is derived from the
  * token alone.
  */
-export function createSidecarTokenAuthenticator({ db, }) {
-    return async ({ token }) => {
+export function createSidecarCredentialResolver({ db, }) {
+    async function resolve(token) {
         const tokenHash = await sha256(token);
         const row = await db.query.sidecar.findFirst({
             where: eq(sidecar.tokenHashSha256, tokenHash),
         });
-        if (row === undefined) {
+        if (row === undefined)
             return null;
+        const allocation = await db.query.sidecarAllocation.findFirst({
+            where: eq(sidecarAllocation.sidecarId, row.id),
+        });
+        if (allocation !== undefined) {
+            if (allocation.status !== "provisioning" &&
+                allocation.status !== "allocated") {
+                return null;
+            }
+            const anchor = await db.query.workflowRun.findFirst({
+                columns: { address: true },
+                where: eq(workflowRun.id, allocation.anchorRunId),
+            });
+            if (anchor?.address === null || anchor?.address === undefined)
+                return null;
+            return {
+                kind: "allocated",
+                sidecarId: row.id,
+                allocationId: allocation.id,
+                tenantId: allocation.tenantId,
+                anchorRunId: allocation.anchorRunId,
+                workflowRunAddress: anchor.address,
+                generation: allocation.generation,
+            };
+        }
+        const probe = await db.query.workflowProbe.findFirst({
+            where: eq(workflowProbe.sidecarId, row.id),
+        });
+        if (probe === undefined ||
+            (probe.status !== "provisioning" && probe.status !== "probing")) {
+            return null;
+        }
+        return {
+            kind: "probe",
+            sidecarId: row.id,
+            allocationId: probe.id,
+            tenantId: probe.tenantId,
+            generation: probe.generation,
+        };
+    }
+    async function isCurrent(identity, use) {
+        if (identity.kind === "probe") {
+            const statuses = use === "registration"
+                ? ["provisioning", "probing"]
+                : ["probing"];
+            const probe = await db.query.workflowProbe.findFirst({
+                columns: { id: true },
+                where: and(eq(workflowProbe.id, identity.allocationId), eq(workflowProbe.sidecarId, identity.sidecarId), eq(workflowProbe.tenantId, identity.tenantId), eq(workflowProbe.generation, identity.generation), inArray(workflowProbe.status, statuses)),
+            });
+            return probe !== undefined;
         }
-        return { kind: "sidecar", sidecarId: row.id };
-    };
+        const statuses = use === "registration"
+            ? ["provisioning", "allocated"]
+            : ["allocated"];
+        const allocation = await db.query.sidecarAllocation.findFirst({
+            where: and(eq(sidecarAllocation.id, identity.allocationId), eq(sidecarAllocation.sidecarId, identity.sidecarId), eq(sidecarAllocation.tenantId, identity.tenantId), eq(sidecarAllocation.anchorRunId, identity.anchorRunId), eq(sidecarAllocation.generation, identity.generation), inArray(sidecarAllocation.status, statuses)),
+        });
+        if (allocation === undefined)
+            return false;
+        if (use === "registration")
+            return true;
+        if (allocation.ensureAcceptedGeneration !== identity.generation) {
+            return false;
+        }
+        const anchor = await db.query.workflowRun.findFirst({
+            columns: { address: true },
+            where: eq(workflowRun.id, identity.anchorRunId),
+        });
+        return anchor?.address === identity.workflowRunAddress;
+    }
+    return { resolve, isCurrent };
+}
+export function createSidecarTokenAuthenticator(deps) {
+    const resolver = createSidecarCredentialResolver(deps);
+    return async ({ token }) => resolver.resolve(token);
 }

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@intx/hub-sessions",
-  "version": "0.2.2",
+  "description": "Session-orchestration substrate for the hub: sidecar router, session, and asset services",
+  "version": "0.4.0",
   "license": "LGPL-2.1-only",
   "type": "module",
   "exports": {
@@ -16,18 +17,18 @@
     }
   },
   "dependencies": {
-    "@intx/agent": "0.2.2",
-    "@intx/crypto": "0.2.2",
-    "@intx/db": "0.2.2",
-    "@intx/hub-common": "0.2.2",
-    "@intx/log": "0.2.2",
-    "@intx/mime": "0.2.2",
-    "@intx/pack-transport": "0.2.2",
-    "@intx/storage-isogit": "0.2.2",
-    "@intx/tool-packaging": "0.2.2",
-    "@intx/types": "0.2.2",
-    "@intx/workflow": "0.2.2",
-    "@intx/workflow-deploy": "0.2.2",
+    "@intx/agent": "0.4.0",
+    "@intx/crypto": "0.4.0",
+    "@intx/db": "0.4.0",
+    "@intx/hub-common": "0.4.0",
+    "@intx/log": "0.4.0",
+    "@intx/mime": "0.4.0",
+    "@intx/pack-transport": "0.4.0",
+    "@intx/storage-isogit": "0.4.0",
+    "@intx/tool-packaging": "0.4.0",
+    "@intx/types": "0.4.0",
+    "@intx/workflow": "0.4.0",
+    "@intx/workflow-deploy": "0.4.0",
     "arktype": "^2.1.29",
     "drizzle-orm": "^0.45.1",
     "isomorphic-git": "^1.27.2",

package/dist/available-skills-stanza.d.ts

@@ -1,21 +0,0 @@
-export type AvailableSkillEntry = {
-    /** Qualified skill identifier in the form `<asset.name>/<skill-name>`. */
-    qualifiedName: string;
-    /** SKILL.md frontmatter description, verbatim. */
-    description: string;
-    /** Workspace-relative path the agent's `read_file` should target,
-     * shaped like `workspace/<mountPath>/<skill-name>/`. */
-    workspacePath: string;
-};
-/**
- * Render the `<available_skills>` stanza appended to the agent's
- * system prompt. Returns the empty string when `entries` is empty —
- * an empty `<available_skills></available_skills>` wrapper would be
- * misleading noise for agents with no skills attached.
- *
- * Values are XML-escaped at the boundary. The skill kind handler
- * already rejects descriptions containing literal `<` or `>` so the
- * `&` escape is the practical case in production; the others are
- * defensive.
- */
-export declare function buildAvailableSkillsStanza(entries: AvailableSkillEntry[]): string;

package/dist/available-skills-stanza.js

@@ -1,32 +0,0 @@
-/**
- * Render the `<available_skills>` stanza appended to the agent's
- * system prompt. Returns the empty string when `entries` is empty —
- * an empty `<available_skills></available_skills>` wrapper would be
- * misleading noise for agents with no skills attached.
- *
- * Values are XML-escaped at the boundary. The skill kind handler
- * already rejects descriptions containing literal `<` or `>` so the
- * `&` escape is the practical case in production; the others are
- * defensive.
- */
-export function buildAvailableSkillsStanza(entries) {
-    if (entries.length === 0) {
-        return "";
-    }
-    const lines = ["<available_skills>"];
-    for (const entry of entries) {
-        lines.push("  <skill>");
-        lines.push(`    <name>${escapeXml(entry.qualifiedName)}</name>`);
-        lines.push(`    <description>${escapeXml(entry.description)}</description>`);
-        lines.push(`    <path>${escapeXml(entry.workspacePath)}</path>`);
-        lines.push("  </skill>");
-    }
-    lines.push("</available_skills>");
-    return lines.join("\n");
-}
-function escapeXml(value) {
-    return value
-        .replaceAll("&", "&amp;")
-        .replaceAll("<", "&lt;")
-        .replaceAll(">", "&gt;");
-}