@jskit-ai/assistant-runtime 0.2.39 → 0.2.40

package/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## Unreleased
 
+- Each conversation request authenticates once: the route's access check and the action's request context share one sign-in lookup instead of each asking again.
+- **Breaking.** Conversation list items no longer carry `metadata`: the conversations repository's `listForActorScope` reads only the fields a list shows, as `assistantContract`'s `conversationsList` now answers them. Upgrading: code that read `metadata` from a list item reads the conversation instead, with `findByIdForActorScope` or the conversation's messages read, which still answer it.
+- A chat turn ends by reading the turn it waited on (`handle.wait({ turnId })`) instead of reading and cloning every turn of the conversation to keep one.
 - The conversations and messages repositories hand their handle calls only the caller's transaction, with their own context and settings: a caller's other settings (a format, `missing`, `returning`, `fields`) no longer ride into every read and write they make. They take `passedOn` from `@jskit-ai/resource-core/shared/callOptions`, so `@jskit-ai/assistant-runtime/server` still loads on file storage, where `@jskit-ai/resource-runtime` (an optional peer) is not installed.
 - Its table resources declare the foreign keys their migrations always create (`foreignKeys`), so json-rest-api 3.1.0 can skip the visibility query a system-context read makes for a record such a key guarantees exists. `jskit test --databases` checks each against an app's test database: assistant_conversations.created_by_user_id and assistant_turn_requests.actor_user_id to users, and assistant_messages.conversation_id to assistant_conversations and actor_user_id to users. The workspace_id keys exist only where the application has a workspaces table, so none declares them. `usersForeignKeysMigration.test.js` proves the declarations match the migrations.
 - A database error in an assistant turn reaches the client only as the kernel's generic answer (`hideDatabaseError`: 409 `kernel.database.concurrentWrite` when the database refused the transaction for a concurrent one, else 500). A failure after the stream started was sent with its own message, which for a database error is the statement and its values, and the same message was saved with the turn and replayed, as an `AppError`, to a client that sent the message again; the chat route's error before the stream and a conversation subscription's acknowledgement carried the driver's code. Each now sends and saves the stand-in and logs the whole error; `createChatService` takes the runtime's `logger`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/assistant-runtime",
-  "version": "0.2.39",
+  "version": "0.2.40",
   "type": "module",
   "scripts": {
     "test": "jskit test"
@@ -15,21 +15,21 @@
     "./locales/en.json": "./locales/en.json"
   },
   "dependencies": {
-    "@jskit-ai/assistant-core": "0.2.37",
+    "@jskit-ai/assistant-core": "0.2.38",
     "@jskit-ai/resource-core": "0.1.209",
     "json-rest-schema": "^1.0.20"
   },
   "peerDependencies": {
     "@jskit-ai/http-runtime": "0.2.18",
-    "@jskit-ai/http-web": "0.2.27",
+    "@jskit-ai/http-web": "0.2.28",
     "@jskit-ai/kernel": "0.2.18",
-    "@jskit-ai/realtime": "0.2.25",
-    "@jskit-ai/shell-web": "0.2.22",
+    "@jskit-ai/realtime": "0.2.26",
+    "@jskit-ai/shell-web": "0.2.23",
     "@tanstack/vue-query": "^5.90.5",
     "vue": "^3.5.13",
     "vuetify": "^4.0.0",
     "@jskit-ai/database-runtime": "0.1.267",
-    "@jskit-ai/resource-runtime": "0.2.20"
+    "@jskit-ai/resource-runtime": "0.2.21"
   },
   "description": "Capability-based assistant runtime with per-surface chat, transcripts, settings, and action tools.",
   "jskit": {
@@ -139,6 +139,6 @@
   },
   "devDependencies": {
     "@jskit-ai/material-web": "0.1.5",
-    "@jskit-ai/resource-runtime": "0.2.20"
+    "@jskit-ai/resource-runtime": "0.2.21"
   }
 }

package/src/server/registerFastifyConversations.js

@@ -29,13 +29,20 @@ async function registerFastifyConversations(app, {
       !config || typeof config !== "object" || Array.isArray(config)) {
     throw new TypeError("Fastify conversations require runtime, config and authenticate(request).");
   }
-  async function requestContext(request) {
+  async function authenticateRequest(request) {
     const context = await authenticate(request);
     if (!context || typeof context !== "object" || Array.isArray(context)) {
       throw new AppError(401, "Authentication required.", { code: "assistant.runtime.authenticationRequired" });
     }
     return context;
   }
+  // One authentication per request: the route's check and the action's context share its answer.
+  const authenticated = new WeakMap();
+  function requestContext(request) {
+    if (!request || typeof request !== "object") return authenticateRequest(request);
+    if (!authenticated.has(request)) authenticated.set(request, authenticateRequest(request));
+    return authenticated.get(request);
+  }
   const AccessProvider = defineProvider({
     id: "assistant.fastify.access",
     requires: {

package/src/server/repositories/conversationsRepository.js

@@ -20,6 +20,16 @@ function normalizeRequiredSurfaceId(value) {
   return normalizedSurfaceId;
 }
 
+// What a list shows of a conversation: never its runtime metadata (the system prompt, every tool's schema and
+// a note per message ever written), which grows with the conversation and only a read of it needs.
+const LIST_FIELDS = Object.freeze(["workspaceId", "userId", "title", "status", "provider", "model", "surfaceId", "messageCount",
+  "startedAt", "endedAt", "createdAt", "updatedAt"]);
+
+function mapConversationSummary(record = {}) {
+  const { metadata: _metadata, ...summary } = mapConversationRecord(record);
+  return summary;
+}
+
 function mapConversationRecord(record = {}) {
   return {
     id: normalizeRecordId(record.id, { fallback: "" }),
@@ -260,10 +270,11 @@ function createRepository({ conversations, systemContext }) {
         ...(cursor ? { beforeId: cursor } : {})
       },
       sort: ["-id"],
+      fields: LIST_FIELDS,
       page: { size: limit }
     }, { ...passedOn(options), context: conversationContext.forUser(normalizedActorUserId) });
 
-    const items = records.map(mapConversationRecord);
+    const items = records.map(mapConversationSummary);
     const nextCursor = page.hasMore && items.length > 0 ? items[items.length - 1].id : null;
 
     return {

package/src/server/services/chatService.js

@@ -401,7 +401,8 @@ function createChatService({
           const receipt = await handle.send({ messageId: source.messageId, text: source.input,
             ...(source.attachmentIds !== undefined ? { attachmentIds: source.attachmentIds } : {}) });
           turnId = receipt.turnId;
-          const snapshot = await handle.wait();
+          // The finished turn alone: waiting never reads the rest of the conversation.
+          const snapshot = await handle.wait({ turnId });
           const turn = snapshot.conversationLog.find(entry => entry.turnId === turnId);
           const status = turn?.metadata?.runtime?.status;
           if (status !== "complete") {

package/test/registerFastifyConversations.test.js

@@ -138,6 +138,8 @@ test("Fastify conversations await trusted authentication across HTTP and shared
     assert.equal(context.applicationId, trusted.applicationId);
   }
   assert.ok(authenticated.some(request => request.method === "POST"));
+  assert.equal(authenticated.filter(request => request.method === "POST").length, ids.length,
+    "each send authenticates once: the route's check and the action's context share it");
   assert.ok(authenticated.some(request => request.method === undefined), "socket requests also use the async authenticator");
 
   sessions.delete("owner-session");

package/test/repositories.mysql.test.js

@@ -219,7 +219,8 @@ test("listForActorScope pages newest first by id, within one actor, surface and
   assert.deepEqual(Object.keys(all).sort(), ["items", "nextCursor"]);
   assert.deepEqual(all.items.map((item) => item.id), [archived.id, mine[2].id, mine[1].id, mine[0].id], "newest id first, global scope only");
   assert.equal(all.nextCursor, null);
-  assert.deepEqual(all.items[1], mine[2], "items are whole conversation records");
+  const { metadata: _metadata, ...summary } = mine[2];
+  assert.deepEqual(all.items[1], summary, "items are conversation records without their runtime metadata, which only a read needs");
 
   const page = await conversations.listForActorScope({ ...scope, pagination: { limit: 2 } });
   assert.deepEqual(page.items.map((item) => item.id), [archived.id, mine[2].id]);