@larkup/workspace-server 0.0.0-stage → 0.2.0

package/src/lib/media/video-intelligence-connection.ts

@@ -0,0 +1,151 @@
+import { randomUUID } from 'node:crypto';
+import { readConfig, writeConfig } from '@larkup/core/config-store';
+import { withGlobalVisionGatewayConfig } from '../marketplace/tool-runtime-config';
+
+type ProvisioningClient = {
+  getUsage?: () => Promise<unknown>;
+  provisionDeviceAccess?: (installationId: string) => Promise<{
+    apiKey: string;
+    entitlement: {
+      plan: string;
+      sourceMinutesPerMonth: number | null;
+      maxConcurrentJobs: number;
+    };
+  }>;
+};
+
+type VideoExtension = {
+  createClient(context: {
+    config: Record<string, unknown>;
+    fetch?: typeof globalThis.fetch;
+  }): ProvisioningClient;
+};
+
+/**
+ * Creates a per-installation cloud credential once, then keeps it in this
+ * project's local config. The cloud stores hashes of both identifiers only.
+ */
+export async function resolveVideoIntelligenceConnection(
+  extension: VideoExtension,
+  installedConfig: Record<string, unknown>,
+): Promise<{
+  config: Record<string, unknown>;
+  provisioned: boolean;
+  entitlement?: {
+    plan: string;
+    sourceMinutesPerMonth: number | null;
+    maxConcurrentJobs: number;
+  };
+}> {
+  const globalConfig = await readConfig();
+  const current = withGlobalVisionGatewayConfig(
+    {
+      ...installedConfig,
+      ...(globalConfig.toolConfigs?.['video-intelligence'] ?? {}),
+    },
+    globalConfig,
+  );
+  const forceProvision = current.forceProvisionManagedCloud === true;
+  const { forceProvisionManagedCloud: _forceProvisionManagedCloud, ...connectionConfig } = current;
+  if (connectionConfig.runtimeMode && connectionConfig.runtimeMode !== 'managed-cloud') {
+    return { config: connectionConfig, provisioned: false };
+  }
+  if (
+    !forceProvision &&
+    typeof connectionConfig.cloudAccessKey === 'string' &&
+    connectionConfig.cloudAccessKey.trim()
+  ) {
+    const existingClient = extension.createClient({
+      config: connectionConfig,
+      fetch: globalThis.fetch,
+    });
+    if (typeof existingClient.getUsage !== 'function') {
+      return { config: connectionConfig, provisioned: false };
+    }
+    try {
+      await existingClient.getUsage();
+      return { config: connectionConfig, provisioned: false };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (!/invalid api key|unauthorized|unauthorised/i.test(message)) throw error;
+      // A managed deployment can move while an installation still has a key
+      // issued by the previous control plane. Re-provision the same opaque
+      // installation ID once instead of letting every later job fail at submit.
+    }
+  }
+
+  const installationId =
+    typeof connectionConfig.cloudInstallationId === 'string' &&
+    connectionConfig.cloudInstallationId.length >= 32
+      ? connectionConfig.cloudInstallationId
+      : randomUUID();
+  const client = extension.createClient({
+    config: { ...connectionConfig, cloudInstallationId: installationId },
+    fetch: globalThis.fetch,
+  });
+  if (typeof client.provisionDeviceAccess !== 'function') {
+    // An already-installed pre-managed version can still be cached in the
+    // Marketplace manifest. Provision through the current first-party client
+    // so a normal re-index self-heals the connection instead of asking the
+    // user to reinstall a tool or reveal an endpoint/key.
+    const endpoint =
+      process.env.LARKUP_VIDEO_INTELLIGENCE_CLOUD_ENDPOINT ??
+      'https://7w1bab08jf.execute-api.eu-central-1.amazonaws.com';
+    const response = await globalThis.fetch(`${endpoint}/v1/device-keys`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ installationId }),
+    });
+    const provisioned = (await response.json().catch(() => ({}))) as {
+      apiKey?: string;
+      entitlement?: {
+        plan: string;
+        sourceMinutesPerMonth: number | null;
+        maxConcurrentJobs: number;
+      };
+      error?: string;
+    };
+    if (!response.ok || !provisioned.apiKey || !provisioned.entitlement) {
+      throw new Error(
+        provisioned.error || 'Could not create the managed Video Intelligence connection.',
+      );
+    }
+    return persistManagedConnection(globalConfig, connectionConfig, installationId, {
+      apiKey: provisioned.apiKey,
+      entitlement: provisioned.entitlement,
+    });
+  }
+  const provisioned = await client.provisionDeviceAccess(installationId);
+  return persistManagedConnection(globalConfig, connectionConfig, installationId, provisioned);
+}
+
+async function persistManagedConnection(
+  globalConfig: Awaited<ReturnType<typeof readConfig>>,
+  current: Record<string, unknown>,
+  installationId: string,
+  provisioned: {
+    apiKey: string;
+    entitlement: {
+      plan: string;
+      sourceMinutesPerMonth: number | null;
+      maxConcurrentJobs: number;
+    };
+  },
+) {
+  const { forceProvisionManagedCloud: _forceProvisionManagedCloud, ...existingToolConfig } =
+    globalConfig.toolConfigs?.['video-intelligence'] ?? {};
+  const toolConfigs = {
+    ...(globalConfig.toolConfigs ?? {}),
+    'video-intelligence': {
+      ...existingToolConfig,
+      cloudInstallationId: installationId,
+      cloudAccessKey: provisioned.apiKey,
+    },
+  };
+  await writeConfig({ ...globalConfig, toolConfigs });
+  return {
+    config: { ...current, ...toolConfigs['video-intelligence'] },
+    provisioned: true,
+    entitlement: provisioned.entitlement,
+  };
+}

package/src/lib/remote-files.ts

@@ -0,0 +1,182 @@
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+
+export const MAX_REMOTE_FILE_BYTES = 50 * 1024 * 1024;
+
+const SUPPORTED_EXTENSIONS = new Set([
+  'txt',
+  'md',
+  'markdown',
+  'toml',
+  'json',
+  'csv',
+  'html',
+  'htm',
+  'log',
+  'xlsx',
+  'xls',
+  'pdf',
+  'doc',
+  'docx',
+]);
+
+const EXTENSION_BY_MIME: Record<string, string> = {
+  'application/pdf': 'pdf',
+  'application/json': 'json',
+  'text/csv': 'csv',
+  'text/markdown': 'md',
+  'text/plain': 'txt',
+  'text/html': 'html',
+  'application/vnd.ms-excel': 'xls',
+  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet': 'xlsx',
+  'application/msword': 'doc',
+  'application/vnd.openxmlformats-officedocument.wordprocessingml.document': 'docx',
+};
+
+export interface RemoteFileDownload {
+  bytes: Buffer;
+  contentType: string;
+  fileName: string;
+  sourceUrl: string;
+}
+
+export function normalizeRemoteFileUrl(value: string): URL {
+  const url = new URL(value.trim());
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    throw new Error('Only public http(s) file URLs are supported.');
+  }
+
+  // Make share links work without asking people to find a provider-specific
+  // "raw" download URL themselves.
+  if (url.hostname === 'github.com') {
+    const parts = url.pathname.split('/').filter(Boolean);
+    if (parts.length >= 5 && parts[2] === 'blob') {
+      url.hostname = 'raw.githubusercontent.com';
+      url.pathname = `/${parts[0]}/${parts[1]}/${parts.slice(3).join('/')}`;
+      url.search = '';
+    }
+  }
+  if (url.hostname === 'huggingface.co' && url.pathname.includes('/blob/')) {
+    url.pathname = url.pathname.replace('/blob/', '/resolve/');
+  }
+
+  return url;
+}
+
+export function isPrivateAddress(address: string) {
+  const normalized = address.toLowerCase();
+  if (
+    normalized === '::1' ||
+    normalized === '::' ||
+    normalized.startsWith('fe80:') ||
+    normalized.startsWith('fc') ||
+    normalized.startsWith('fd')
+  ) {
+    return true;
+  }
+  const parts = (normalized.startsWith('::ffff:') ? normalized.slice(7) : normalized)
+    .split('.')
+    .map(Number);
+  if (parts.length !== 4 || parts.some(Number.isNaN)) return false;
+  const [a, b] = parts;
+  return (
+    a === 0 ||
+    a === 10 ||
+    a === 127 ||
+    (a === 169 && b === 254) ||
+    (a === 172 && b >= 16 && b <= 31) ||
+    (a === 192 && b === 168) ||
+    a >= 224
+  );
+}
+
+async function assertPublicHost(hostname: string) {
+  const addresses = isIP(hostname)
+    ? [{ address: hostname }]
+    : await lookup(hostname, { all: true, verbatim: true });
+  if (!addresses.length || addresses.some(({ address }) => isPrivateAddress(address))) {
+    throw new Error('Private or local file URLs are not supported.');
+  }
+}
+
+export function getRemoteFileName(response: Response, sourceUrl: URL, contentType: string) {
+  const disposition = response.headers.get('content-disposition') ?? '';
+  const encodedMatch = disposition.match(/filename\*=UTF-8''([^;]+)/i)?.[1];
+  const plainMatch = disposition.match(/filename\s*=\s*"?([^";]+)"?/i)?.[1];
+  let name = encodedMatch ? decodeURIComponent(encodedMatch) : plainMatch;
+
+  if (!name) {
+    name = decodeURIComponent(sourceUrl.pathname.split('/').filter(Boolean).pop() || 'remote-file');
+  }
+  name = name.replace(/[\\/\0\r\n]/g, '-').trim() || 'remote-file';
+
+  const extension = name.split('.').pop()?.toLowerCase();
+  // GitHub and similar providers return source files as text/plain. Retain an
+  // unfamiliar extension (for example .py) instead of relabeling it as .txt.
+  if (extension && (SUPPORTED_EXTENSIONS.has(extension) || contentType.startsWith('text/'))) {
+    return name;
+  }
+
+  const inferredExtension = EXTENSION_BY_MIME[contentType];
+  if (inferredExtension) return `${name.replace(/\.[^.]+$/, '')}.${inferredExtension}`;
+  throw new Error(
+    'This URL does not point to a supported document. Use PDF, Word, CSV, JSON, Excel, or text.',
+  );
+}
+
+async function readBoundedBody(response: Response) {
+  const declaredSize = Number(response.headers.get('content-length'));
+  if (Number.isFinite(declaredSize) && declaredSize > MAX_REMOTE_FILE_BYTES) {
+    throw new Error('Remote files must be 50 MB or smaller.');
+  }
+
+  if (!response.body) return Buffer.from(await response.arrayBuffer());
+  const reader = response.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > MAX_REMOTE_FILE_BYTES) {
+        await reader.cancel();
+        throw new Error('Remote files must be 50 MB or smaller.');
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks);
+}
+
+export async function downloadRemoteFile(value: string): Promise<RemoteFileDownload> {
+  let current = normalizeRemoteFileUrl(value);
+  for (let redirects = 0; redirects <= 5; redirects++) {
+    await assertPublicHost(current.hostname);
+    const response = await fetch(current, {
+      redirect: 'manual',
+      headers: { Accept: 'application/pdf,text/*,application/json,application/octet-stream,*/*' },
+    });
+    if ([301, 302, 303, 307, 308].includes(response.status)) {
+      const location = response.headers.get('location');
+      if (!location) throw new Error('The file URL redirected without a destination.');
+      current = normalizeRemoteFileUrl(new URL(location, current).toString());
+      continue;
+    }
+    if (!response.ok) throw new Error(`Could not download the file (HTTP ${response.status}).`);
+
+    const contentType = (response.headers.get('content-type') ?? 'application/octet-stream')
+      .split(';')[0]
+      .trim()
+      .toLowerCase();
+    return {
+      bytes: await readBoundedBody(response),
+      contentType,
+      fileName: getRemoteFileName(response, current, contentType),
+      sourceUrl: current.toString(),
+    };
+  }
+  throw new Error('The file URL redirected too many times.');
+}

package/src/lib/search/provider-verification.ts

@@ -0,0 +1,95 @@
+export const SEARCH_VERIFICATION_PROVIDERS = [
+  'serper',
+  'google',
+  'tavily',
+  'brave',
+  'bing',
+  'exa',
+  'firecrawl',
+] as const;
+
+export type SearchVerificationProvider = (typeof SEARCH_VERIFICATION_PROVIDERS)[number];
+
+export function isSearchVerificationProvider(
+  provider: string,
+): provider is SearchVerificationProvider {
+  return SEARCH_VERIFICATION_PROVIDERS.includes(provider as SearchVerificationProvider);
+}
+
+export async function verifySearchProvider(
+  provider: SearchVerificationProvider,
+  apiKey: string,
+  fetcher: typeof fetch = fetch,
+): Promise<void> {
+  if (provider === 'serper' || provider === 'google') {
+    const res = await fetcher('https://google.serper.dev/search', {
+      method: 'POST',
+      headers: {
+        'X-API-KEY': apiKey,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ q: 'test', num: 1 }),
+    });
+    if (!res.ok) throw new Error('Invalid Serper API Key');
+    return;
+  }
+
+  if (provider === 'tavily') {
+    const res = await fetcher('https://api.tavily.com/search', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ api_key: apiKey, query: 'test', search_depth: 'basic' }),
+    });
+    if (!res.ok) throw new Error('Invalid Tavily API Key');
+    return;
+  }
+
+  if (provider === 'brave') {
+    const res = await fetcher('https://api.search.brave.com/res/v1/web/search?q=test&count=1', {
+      headers: {
+        Accept: 'application/json',
+        'Accept-Encoding': 'gzip',
+        'X-Subscription-Token': apiKey,
+      },
+    });
+    if (!res.ok) throw new Error('Invalid Brave API Key');
+    return;
+  }
+
+  if (provider === 'bing') {
+    const url = new URL('https://serpapi.com/search.json');
+    url.searchParams.set('engine', 'bing');
+    url.searchParams.set('q', 'test');
+    url.searchParams.set('api_key', apiKey);
+
+    const res = await fetcher(url);
+    if (!res.ok) throw new Error('Invalid SerpApi Key for Bing');
+    return;
+  }
+
+  if (provider === 'exa') {
+    const res = await fetcher('https://api.exa.ai/search', {
+      method: 'POST',
+      headers: {
+        accept: 'application/json',
+        'content-type': 'application/json',
+        'x-api-key': apiKey,
+      },
+      body: JSON.stringify({ query: 'test', numResults: 1 }),
+    });
+    if (!res.ok) throw new Error('Invalid Exa API Key');
+    return;
+  }
+
+  const res = await fetcher('https://api.firecrawl.dev/v1/scrape', {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify({ url: 'https://example.com', formats: ['markdown'] }),
+  });
+  if (res.status === 401) throw new Error('Invalid Firecrawl API Key');
+}

package/src/runtime-host.ts

@@ -0,0 +1,31 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { SandboxManager } from '@larkup/sandbox';
+import type { SandboxConfig } from '@larkup/sandbox/types';
+export interface WorkspaceRuntimeHost {
+  readBinary?: (source: { id: string; url?: string }) => Promise<Uint8Array>;
+  apiUrl?: (path: string) => string;
+  fetch?: typeof globalThis.fetch;
+  sandbox: Pick<SandboxManager, 'execute' | 'healthCheck'>;
+}
+const runtime = new AsyncLocalStorage<WorkspaceRuntimeHost>();
+export function runWithWorkspaceRuntime<T>(host: WorkspaceRuntimeHost, operation: () => T): T {
+  return runtime.run(host, operation);
+}
+export function workspaceSandbox(
+  config: SandboxConfig,
+): Pick<SandboxManager, 'execute' | 'healthCheck'> {
+  return runtime.getStore()?.sandbox ?? new SandboxManager(config);
+}
+
+export function workspaceServerUrl(path: string): string {
+  return runtime.getStore()?.apiUrl?.(path) ?? path;
+}
+export const workspaceServerFetch: typeof globalThis.fetch = (input, init) =>
+  (runtime.getStore()?.fetch ?? globalThis.fetch)(input, init);
+
+export function workspaceReadBinary(source: {
+  id: string;
+  url?: string;
+}): Promise<Uint8Array> | undefined {
+  return runtime.getStore()?.readBinary?.(source);
+}