@ixo/oracle-runtime-workers 0.17.0 → 0.18.0

package/src/core/domain-context/resolver.ts

@@ -29,6 +29,8 @@ import { briefBody, record } from './document';
 import { boundFindings } from './findings';
 import { decode, INDEX_MAX_BYTES, verifyBytes } from './integrity';
 import { LruMap } from './lru';
+import type { Logger } from '../../plugin-api/types';
+import { NOOP_LOGGER } from '../utils';
 import type {
   DocumentRequest,
   DomainAnchor,
@@ -189,8 +191,11 @@ export class DomainContextResolver {
     weigh: parsedWeight,
   });
 
-  constructor(opts: { now?: () => number } = {}) {
+  private readonly logger: Logger;
+
+  constructor(opts: { now?: () => number; logger?: Logger } = {}) {
     this.now = opts.now ?? Date.now;
+    this.logger = opts.logger ?? NOOP_LOGGER;
   }
 
   /**
@@ -374,6 +379,13 @@ export class DomainContextResolver {
 
   private failed(snapshot: DomainSnapshot, error: unknown): DomainSnapshot {
     const code = errorCode(error, 'resolution-failed');
+    // A failure outside the finding vocabulary is a runtime fault (a thrown
+    // TypeError, a provider's message), not a property of the domain: the
+    // provenance only carries the fallback code, so the cause goes to the log.
+    if (errorCode(error, '') === '')
+      this.logger.warn(
+        `[domain-context] resolution of ${snapshot.did} failed: ${error instanceof Error ? error.message : String(error)}`,
+      );
     const failed: DomainSnapshot = {
       ...snapshot,
       status: INVALID_PATTERN.test(code) ? 'invalid' : 'unavailable',

package/src/core/domain-context/transport.ts

@@ -2,8 +2,10 @@
  * The network edge of domain context: the IID anchor lookup on Blocksync and
  * document reads. Reads go only to https origins on an allowlist (configured
  * origins, the VFS, the Matrix homeserver, the IPFS gateway), never follow
- * redirects, never carry URL credentials and never buffer more than the
- * request's byte bound. Private documents are read through the user's VFS
+ * redirects (a 3xx answer is refused: workerd has no `redirect: 'error'`, so
+ * every request is made with `redirect: 'manual'` and the status checked),
+ * never carry URL credentials and never buffer more than the request's byte
+ * bound. Private documents are read through the user's VFS
  * UCAN bearer or the host's `readPrivateDocument` adapter.
  */
 import { CID } from 'multiformats/cid';
@@ -21,6 +23,32 @@ import type {
   DomainTransport,
 } from './types';
 
+/** What `createDomainTransport` needs beyond the runtime context; tests inject a fetch. */
+export interface DomainTransportDeps {
+  /** Default: the global `fetch`, looked up per call. */
+  fetch?: typeof fetch;
+}
+
+/**
+ * A request that never follows a redirect. `redirect: 'error'` does not
+ * exist on workerd (it throws a TypeError before any network call), so the
+ * request is made with `redirect: 'manual'`, which hands back the 3xx
+ * answer itself, and any 3xx is refused with `code`, its body cancelled.
+ */
+export async function fetchWithoutRedirects(
+  fetcher: typeof fetch,
+  input: string | URL,
+  init: RequestInit,
+  code: string,
+): Promise<Response> {
+  const response = await fetcher(input, { ...init, redirect: 'manual' });
+  if (response.status >= 300 && response.status < 400) {
+    await response.body?.cancel().catch(() => undefined);
+    throw new Error(code);
+  }
+  return response;
+}
+
 /** Bound of one document read when the caller's signal does not end it sooner. */
 export const DOCUMENT_READ_TIMEOUT_MS = 10_000;
 
@@ -136,7 +164,12 @@ function positiveNumber(value: unknown, fallback: number): number {
 export function createDomainTransport(
   options: DomainContextOptions,
   ctx: RuntimeContext,
+  deps: DomainTransportDeps = {},
 ): DomainTransport {
+  // Never keep the bare global: workerd rejects `fetch` invoked with a
+  // foreign `this`, and a test may stub the global after this is built.
+  const fetcher: typeof fetch =
+    deps.fetch ?? ((input, init) => globalThis.fetch(input, init));
   const blocksync =
     typeof ctx.config.BLOCKSYNC_GRAPHQL_URL === 'string'
       ? ctx.config.BLOCKSYNC_GRAPHQL_URL
@@ -222,13 +255,17 @@ export function createDomainTransport(
 
     async resolve(did, signal) {
       if (!blocksync) throw new Error('iid-unavailable');
-      const response = await fetch(blocksync, {
-        method: 'POST',
-        redirect: 'error',
-        signal,
-        headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ query: IID_QUERY, variables: { id: did } }),
-      });
+      const response = await fetchWithoutRedirects(
+        fetcher,
+        blocksync,
+        {
+          method: 'POST',
+          signal,
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({ query: IID_QUERY, variables: { id: did } }),
+        },
+        'iid-unavailable',
+      );
       const body = iidResponse.safeParse(
         JSON.parse(
           new TextDecoder().decode(
@@ -332,7 +369,12 @@ export function createDomainTransport(
         headers.Authorization = `Bearer ${credentials.accessToken}`;
       }
       return boundedBytes(
-        await fetch(url, { headers, redirect: 'error', signal }),
+        await fetchWithoutRedirects(
+          fetcher,
+          url,
+          { headers, signal },
+          'document-redirect-refused',
+        ),
         request.maxBytes,
       );
     },

package/src/core/index.ts

@@ -488,11 +488,27 @@ export function createRuntimeCore(opts: RuntimeCoreOptions): RuntimeCore {
     registries.manifests.register(plugin, manifestOverrides[plugin.name]);
   }
   const manifestErrors: string[] = [];
+  const lintVerbose = opts.env['BOOT_LINT_VERBOSE'] === 'true';
+  const lintCounts = new Map<string, number>();
   for (const { pluginName, manifest } of registries.manifests.collect()) {
     const result = validateManifest(manifest, pluginName);
-    for (const warning of result.warnings) logger.warn(`[boot] ${warning}`);
+    if (lintVerbose)
+      for (const warning of result.warnings) logger.warn(`[boot] ${warning}`);
+    else if (result.warnings.length > 0)
+      lintCounts.set(pluginName, result.warnings.length);
     if (!result.valid) manifestErrors.push(...result.errors);
   }
+  // The soft-rule warnings are the same on every boot of an isolate (one
+  // core per isolate): one summary line, the full list with
+  // BOOT_LINT_VERBOSE=true.
+  if (lintCounts.size > 0)
+    logger.warn(
+      `[boot] manifest lint: ${[...lintCounts.values()].reduce((a, b) => a + b, 0)} soft warning(s) (${[
+        ...lintCounts,
+      ]
+        .map(([plugin, count]) => `${plugin}=${count}`)
+        .join(', ')}); set BOOT_LINT_VERBOSE=true to list them`,
+    );
   const guides = registries.manifests.operatingGuides();
   if (guides.length > 0) {
     logger.log(
@@ -707,9 +723,26 @@ export function createRuntimeCore(opts: RuntimeCoreOptions): RuntimeCore {
           registries.tools,
           registries.subAgents,
         );
-        for (const issue of cross.errors) {
+        if (lintVerbose) {
+          for (const issue of cross.errors) {
+            logger.warn(
+              `[boot] ${issue} (boot-time tools only — ignore if the tool comes from getRequestTools)`,
+            );
+          }
+        } else if (cross.errors.length > 0) {
+          const perPlugin = new Map<string, number>();
+          for (const issue of cross.errors) {
+            const plugin = /^\[([^\]]+)\]/.exec(issue)?.[1] ?? 'unknown';
+            perPlugin.set(plugin, (perPlugin.get(plugin) ?? 0) + 1);
+          }
           logger.warn(
-            `[boot] ${issue} (boot-time tools only — ignore if the tool comes from getRequestTools)`,
+            `[boot] manifest examples: ${cross.errors.length} reference(s) to tools not registered at boot (${[
+              ...perPlugin,
+            ]
+              .map(([plugin, count]) => `${plugin}=${count}`)
+              .join(
+                ', ',
+              )}; ignore those from getRequestTools); set BOOT_LINT_VERBOSE=true to list them`,
           );
         }
       } catch (err) {

package/src/do/contracts.ts

@@ -660,6 +660,16 @@ export interface UserOracleObject extends Rpc.DurableObjectBranded {
     input: ChannelTurnInput,
     requestHash: string,
   ): Promise<ChannelTurnOutcome>;
+  /**
+   * A poll of a channel request whose run exists, answered by a warm
+   * object; `null` = admit it through `channelTurn` (after the binding
+   * check).
+   */
+  channelPoll(
+    identity: TurnIdentity,
+    input: ChannelTurnInput,
+    requestHash: string,
+  ): Promise<ChannelTurnOutcome | null>;
   /** Run a turn and return the final text (used by the Matrix gateway). */
   runTurn(req: TurnRequest): Promise<TurnResult>;
   /**

package/src/do/room-mirror.ts

@@ -97,8 +97,10 @@ export class RoomMirror {
   /**
    * Queue one mirror behind the session's previous ones. `prepare` runs when
    * the session's earlier mirrors have settled and resolves what to send
-   * (`null` = nothing to mirror, e.g. no room). Never rejects: a mirror that
-   * cannot be posted is logged and the chain moves on.
+   * (`null` = nothing to mirror, e.g. no room). A mirror that cannot be
+   * posted is logged and the chain moves on; a `required` one (a channel
+   * request's, whose receipt records the delivery) rejects its caller
+   * instead, and the chain still moves on.
    */
   enqueue(
     sessionId: string,
@@ -107,7 +109,10 @@ export class RoomMirror {
     required = false,
   ): Promise<void> {
     const previous = this.chains.get(sessionId) ?? Promise.resolve();
+    // Starts once the previous mirror settled either way: a required mirror
+    // that failed (and rejected its own caller) must not skip this one.
     const tracked: Promise<void> = previous
+      .catch(() => undefined)
       .then(() => prepare())
       .then((send) => (send ? this.send(send, label) : undefined))
       .catch((err: unknown) => {

package/src/do/run-store-test-do.ts

@@ -412,8 +412,8 @@ async function legacyPrune(db: DoSqliteDatabase, now: number): Promise<void> {
     await db.transaction(async () => {
       if (row.client === 'channel')
         await db.run(
-          'INSERT OR IGNORE INTO channel_run_tombstones (run_id, status) VALUES (?, ?)',
-          [row.run_id, row.status],
+          'INSERT OR IGNORE INTO channel_run_tombstones (run_id, status, pruned_at) VALUES (?, ?, ?)',
+          [row.run_id, row.status, now],
         );
       for (const table of [
         'turn_tool_marks',

package/src/do/run-store.ts

@@ -486,8 +486,26 @@ export class RunStore {
         state TEXT NOT NULL DEFAULT 'pending'
       ) WITHOUT ROWID`);
     await this.db.run(`CREATE TABLE IF NOT EXISTS channel_run_tombstones (
-      run_id TEXT PRIMARY KEY, status TEXT NOT NULL
+      run_id TEXT PRIMARY KEY, status TEXT NOT NULL, pruned_at INTEGER
     ) WITHOUT ROWID`);
+    // When the run was pruned (epoch ms): tombstones are removed a while
+    // later (`pruneChannelTombstones`). Rows from before the column count
+    // from its migration.
+    const tombstoneColumns = await this.db.exec<{ name: string }>(
+      'PRAGMA table_info(channel_run_tombstones)',
+    );
+    if (!tombstoneColumns.some((c) => c.name === 'pruned_at')) {
+      await this.db.run(
+        'ALTER TABLE channel_run_tombstones ADD COLUMN pruned_at INTEGER',
+      );
+      await this.db.run(
+        'UPDATE channel_run_tombstones SET pruned_at = ? WHERE pruned_at IS NULL',
+        [this.now()],
+      );
+    }
+    await this.db.run(
+      'CREATE INDEX IF NOT EXISTS idx_channel_run_tombstones_pruned ON channel_run_tombstones(pruned_at)',
+    );
     // The Reply Plan a finished chat-surface run delivers (chat delivery).
     await this.db.run(`CREATE TABLE IF NOT EXISTS turn_run_plans (
       run_id TEXT PRIMARY KEY, plan TEXT NOT NULL
@@ -519,9 +537,9 @@ export class RunStore {
     if (await this.db.get(`${stale} LIMIT 1`, [cutoff]))
       await this.db.transaction(async () => {
         await this.db.run(
-          `INSERT OR IGNORE INTO channel_run_tombstones (run_id, status)
-           SELECT run_id, status FROM turn_runs WHERE client = 'channel' AND ${STALE_RUN_FILTER}`,
-          [cutoff],
+          `INSERT OR IGNORE INTO channel_run_tombstones (run_id, status, pruned_at)
+           SELECT run_id, status, ? FROM turn_runs WHERE client = 'channel' AND ${STALE_RUN_FILTER}`,
+          [this.now(), cutoff],
         );
         for (const table of [
           'turn_tool_marks',
@@ -537,8 +555,9 @@ export class RunStore {
       });
     // Every receipt whose run is tombstoned, this boot or an earlier one
     // that stopped before getting here. Driven by the receipts (at most the
-    // retention window of them), one key lookup each into the tombstones,
-    // which are never pruned and never scanned. The table exists once the
+    // retention window of them), one key lookup each into the tombstones
+    // (pruned separately, by age, from the housekeeping alarm through
+    // `pruneChannelTombstones`, never scanned here). The table exists once the
     // object has served a channel turn.
     const receipts = await this.db.get<{ name: string }>(
       `SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'channel_requests'`,
@@ -569,6 +588,22 @@ export class RunStore {
     return row?.plan ?? null;
   }
 
+  /**
+   * Remove up to `limit` tombstones of channel runs pruned before `before`
+   * (epoch ms); returns how many went. A request id reused after its
+   * tombstone is gone is a new request and runs again.
+   */
+  async pruneChannelTombstones(before: number, limit: number): Promise<number> {
+    await this.setup();
+    const pruned = await this.db.run(
+      `DELETE FROM channel_run_tombstones WHERE run_id IN (
+         SELECT run_id FROM channel_run_tombstones WHERE pruned_at < ? LIMIT ?
+       )`,
+      [before, limit],
+    );
+    return pruned.changes;
+  }
+
   async wasChannelRunPruned(runId: string): Promise<boolean> {
     await this.setup();
     return !!(await this.db.get<{ run_id: string }>(