@manta-eu/horns-server 0.1.0

package/dist/env.d.ts

@@ -0,0 +1,11 @@
+import type { HornRoutesEnv } from "./horn-routes.ts";
+import type { StudioRoutesEnv } from "./studio-routes.ts";
+import type { StudioModelEnv } from "./llm.ts";
+/** Everything the assembled worker reads. A host mounting only some routes needs only those routes' env. */
+export type Env = HornRoutesEnv & StudioRoutesEnv & StudioModelEnv & {
+    SITE_PASSWORD?: string;
+    SENTRY_DSN?: string;
+    CF_VERSION_METADATA?: {
+        id: string;
+    };
+};

package/dist/env.js

@@ -0,0 +1 @@
+export {};

package/dist/horn-routes.d.ts

@@ -0,0 +1,22 @@
+import { Hono } from "hono";
+import { type RevisionLookup } from "@manta-eu/horns";
+import type { DevSessionEnv } from "./dev-session.ts";
+export declare const maxScreenshotBytes: number;
+type AssetFetcher = {
+    fetch: (request: Request) => Response | Promise<Response>;
+};
+export type HornRoutesEnv = DevSessionEnv & {
+    ASSETS: AssetFetcher;
+    MANTA_AGENTS_URL?: string;
+    VITE_KEYCLOAK_REALM?: string;
+    SPARQL_UPDATE_PSK?: string;
+};
+export type HornRoutesDeps = {
+    /** The realm library's revisions, for checking a Horn's pins. Absent until the library is readable. */
+    libraryLookup?: RevisionLookup;
+    now?: () => Date;
+};
+export declare function hornRoutes<Env extends HornRoutesEnv>(deps?: HornRoutesDeps): Hono<{
+    Bindings: Env;
+}, import("hono/types").BlankSchema, "/">;
+export {};

package/dist/horn-routes.js

@@ -0,0 +1,344 @@
+import { Hono } from "hono";
+import { z } from "zod";
+import { isPresent } from "@manta-eu/lib/present";
+import { contentHash, deskolemize, hornBySlugQuery, hornsInDatastoreQuery, itemLookup, libraryItemsQuery, readItemRevisions, hornFromTriples, hornSchema, isRealm, hornRevisionIri, hornToTriples, legacyRevisionTriples, iri, mintHornIri, revisionReadQuery, revisionSaveUpdate, screenshotSaveUpdate, skolemize, verifyLock, sourceOf, triplesOfResults, } from "@manta-eu/horns";
+import { buildHornSnapshot, HornSnapshotError, unreviewedMessage, unreviewedWrittenViews, } from "@manta-eu/horns/render";
+import { describeLockProblem } from "@manta-eu/horns/studio";
+import { agentsSparqlUpdate, WriteRefusedError } from "./sparql-update.js";
+import { uploadPng } from "./manta-upload.js";
+import { hornTemplatePath, renderHornDocument } from "./render-document.js";
+import { agentsSparqlSelect } from "./sparql-select.js";
+import { authorize, parseBody, refuse } from "./authorize.js";
+// A picture of a Horn at the capture width is tens of kilobytes; past this it is not a Horn's picture.
+export const maxScreenshotBytes = 4 * 1024 * 1024;
+const hornRequestSchema = z.object({
+    horn: hornSchema,
+    variables: z.record(z.string(), z.json()).optional(),
+    viewIds: z.array(z.string()).min(1).max(24).optional(),
+});
+const saveRequestSchema = z.object({
+    horn: hornSchema,
+    /** The revision the editor was looking at. Absent only for a Horn's first save. */
+    baseRevision: z.url().optional(),
+});
+/**
+ * The realm library, read from the realm's root datastore — the one whose id is the realm name. A datastore
+ * installs from it, so a pin resolves there and not here; a library that cannot be read answers no revisions,
+ * which refuses a Horn that pins and leaves one that pins nothing alone.
+ */
+async function realmLibraryLookup(args) {
+    try {
+        const results = await agentsSparqlSelect({
+            requestUrl: args.requestUrl,
+            agentsUrl: args.env.MANTA_AGENTS_URL,
+            session: args.session,
+            datastoreId: args.realm,
+        })(libraryItemsQuery(args.realm), undefined);
+        return itemLookup(readItemRevisions(results));
+    }
+    catch {
+        return () => undefined;
+    }
+    void args.datastoreId;
+}
+function hornMismatch(horn, datastoreId, env) {
+    if (horn.datastoreId !== datastoreId)
+        return refuse(400, `This Horn belongs to the "${horn.datastoreId}" datastore.`);
+    const realm = env.VITE_KEYCLOAK_REALM;
+    if (isPresent(realm) && horn.realm !== realm) {
+        return refuse(400, `This Horn is for the ${horn.realm} realm; this deployment serves ${realm}.`);
+    }
+    return undefined;
+}
+async function hornTemplate(env, requestUrl) {
+    const response = await env.ASSETS.fetch(new Request(new URL(hornTemplatePath, requestUrl)));
+    if (!response.ok)
+        throw new Error(`${hornTemplatePath} could not be loaded (${response.status}).`);
+    return response.text();
+}
+const noStore = { "cache-control": "no-store" };
+// Horn snapshots, rendered on the server: as a page that hydrates, as JSON for hosts that render the kit
+// themselves (manta/agents), and as PNGs. The Horn arrives in the body until Horns are stored in the
+// datastore, and its bindings only ever run as the caller.
+export function hornRoutes(deps = {}) {
+    const routes = new Hono();
+    const accept = async (request, env, datastoreId, schema) => {
+        const authorized = await authorize(request, env, datastoreId);
+        if (!authorized.ok)
+            return authorized;
+        const body = await parseBody(request, schema);
+        if (!body.ok)
+            return body;
+        const mismatch = hornMismatch(body.data.horn, datastoreId, env);
+        if (mismatch)
+            return mismatch;
+        return { ok: true, session: authorized.session, body: body.data };
+    };
+    const snapshotFor = async (args) => {
+        try {
+            const snapshot = await buildHornSnapshot({
+                horn: args.body.horn,
+                select: agentsSparqlSelect({
+                    requestUrl: args.request.url,
+                    agentsUrl: args.env.MANTA_AGENTS_URL,
+                    session: args.session,
+                    datastoreId: args.datastoreId,
+                }),
+                ...(args.body.variables ? { variables: args.body.variables } : {}),
+                ...(args.body.viewIds ? { viewIds: args.body.viewIds } : {}),
+                ...(deps.now ? { now: deps.now } : {}),
+            });
+            return { ok: true, snapshot };
+        }
+        catch (caught) {
+            if (caught instanceof HornSnapshotError)
+                return refuse(400, caught.message);
+            throw caught;
+        }
+    };
+    // What this datastore holds. Without it nothing can show a Horn without already knowing its slug.
+    routes.get("/api/d/:datastoreId/horns", async (c) => {
+        const datastoreId = c.req.param("datastoreId");
+        const authorized = await authorize(c.req.raw, c.env, datastoreId);
+        if (!authorized.ok)
+            return authorized.response;
+        const realm = c.env.VITE_KEYCLOAK_REALM;
+        if (!isPresent(realm) || !isRealm(realm))
+            return refuse(500, "This deployment has no realm configured.").response;
+        try {
+            const found = await agentsSparqlSelect({
+                requestUrl: c.req.raw.url,
+                agentsUrl: c.env.MANTA_AGENTS_URL,
+                session: authorized.session,
+                datastoreId,
+            })(hornsInDatastoreQuery(realm), undefined);
+            const horns = found.results.bindings.flatMap((row) => {
+                const slug = row["slug"]?.value;
+                const iri = row["horn"]?.value;
+                if (!isPresent(slug) || !isPresent(iri))
+                    return [];
+                // A Horn nobody has pictured yet simply has no picture, rather than an empty one.
+                const screenshot = row["screenshot"]?.value;
+                const capturedAt = row["capturedAt"]?.value;
+                return [
+                    {
+                        slug,
+                        iri,
+                        title: row["title"]?.value ?? slug,
+                        revision: row["revision"]?.value ?? "",
+                        number: Number(row["number"]?.value) || 1,
+                        ...(isPresent(screenshot) ? { screenshot } : {}),
+                        ...(isPresent(capturedAt) ? { capturedAt } : {}),
+                    },
+                ];
+            });
+            return Response.json({ horns }, { headers: noStore });
+        }
+        catch (caught) {
+            return refuse(502, caught instanceof Error ? caught.message : String(caught)).response;
+        }
+    });
+    // A saved Horn, by the slug a URL can carry: the IRI is opaque.
+    routes.get("/api/d/:datastoreId/horns/:slug", async (c) => {
+        const datastoreId = c.req.param("datastoreId");
+        const authorized = await authorize(c.req.raw, c.env, datastoreId);
+        if (!authorized.ok)
+            return authorized.response;
+        const realm = c.env.VITE_KEYCLOAK_REALM;
+        if (!isPresent(realm) || !isRealm(realm))
+            return refuse(500, "This deployment has no realm configured.").response;
+        const select = agentsSparqlSelect({
+            requestUrl: c.req.raw.url,
+            agentsUrl: c.env.MANTA_AGENTS_URL,
+            session: authorized.session,
+            datastoreId,
+        });
+        const slug = c.req.param("slug");
+        try {
+            const found = await select(hornBySlugQuery(realm, slug), undefined);
+            const row = found.results.bindings[0];
+            const revision = row?.["revision"]?.value;
+            const hornIri = row?.["horn"]?.value;
+            if (!isPresent(revision) || !isPresent(hornIri))
+                return refuse(404, `No Horn here is called "${slug}".`).response;
+            const answer = await select(revisionReadQuery(realm, revision), undefined);
+            const stored = triplesOfResults(answer.results.bindings);
+            // A revision is rooted at itself. One saved before that was rooted at the Horn, which its other revisions
+            // share, so what that root says about other revisions is set aside before it is read.
+            const number = Number(row?.["number"]?.value);
+            const horn = hornFromTriples(sourceOf(deskolemize(stored, revision)), iri(revision), hornIri) ??
+                hornFromTriples(sourceOf(deskolemize(legacyRevisionTriples(stored, { root: hornIri, revision, number }), revision)), iri(hornIri));
+            // A revision that holds no Horn is a bug in whatever wrote it, not a missing Horn.
+            if (!isPresent(horn))
+                return refuse(500, `Revision ${revision} of "${slug}" is not a Horn.`).response;
+            return Response.json({ horn, revision, contentHash: await contentHash(stored) }, { headers: noStore });
+        }
+        catch (caught) {
+            return refuse(502, caught instanceof Error ? caught.message : String(caught)).response;
+        }
+    });
+    // Save a Horn under a slug. The route owns the IRI and the revision number: the store's bookkeeping is not
+    // something a client gets to choose, and a revision that already exists must not be written into twice.
+    routes.put("/api/d/:datastoreId/horns/:slug", async (c) => {
+        const datastoreId = c.req.param("datastoreId");
+        const authorized = await authorize(c.req.raw, c.env, datastoreId);
+        if (!authorized.ok)
+            return authorized.response;
+        const realm = c.env.VITE_KEYCLOAK_REALM;
+        if (!isPresent(realm) || !isRealm(realm))
+            return refuse(500, "This deployment has no realm configured.").response;
+        const body = await parseBody(c.req.raw, saveRequestSchema);
+        if (!body.ok)
+            return body.response;
+        const slug = c.req.param("slug");
+        const select = agentsSparqlSelect({
+            requestUrl: c.req.raw.url,
+            agentsUrl: c.env.MANTA_AGENTS_URL,
+            session: authorized.session,
+            datastoreId,
+        });
+        const update = agentsSparqlUpdate({
+            agentsUrl: c.env.MANTA_AGENTS_URL,
+            datastoreId,
+            updateKey: c.env.SPARQL_UPDATE_PSK,
+            purpose: { kind: "horn-save", realm },
+        });
+        try {
+            const found = await select(hornBySlugQuery(realm, slug), undefined);
+            const current = found.results.bindings[0];
+            const currentRevision = current?.["revision"]?.value;
+            const currentNumber = Number(current?.["number"]?.value);
+            if (currentRevision !== undefined && body.data.baseRevision !== currentRevision) {
+                return refuse(409, `"${slug}" has moved on since you opened it; reload before saving.`).response;
+            }
+            if (currentRevision === undefined && body.data.baseRevision !== undefined) {
+                return refuse(409, `There is no Horn called "${slug}" to have revised.`).response;
+            }
+            // A Horn that exists but whose revision carries no number is a stored revision something else wrote; the
+            // next number cannot be guessed from it without risking a revision IRI that already exists.
+            if (currentRevision !== undefined && !Number.isFinite(currentNumber)) {
+                return refuse(500, `Revision ${currentRevision} of "${slug}" has no number to count on.`).response;
+            }
+            const hornIri = current?.["horn"]?.value ?? mintHornIri();
+            // Every pin is an exact revision and hash. A Horn whose lock does not match what its dependencies
+            // resolve to must not reach a store: nothing downstream can tell afterwards that it was never true. The
+            // resolved IRI is the root, not whatever the body claimed, because the route owns the IRI.
+            const locked = verifyLock(hornIri, body.data.horn.dependencies, body.data.horn.lock, deps.libraryLookup ??
+                (await realmLibraryLookup({
+                    requestUrl: c.req.raw.url,
+                    env: c.env,
+                    session: authorized.session,
+                    datastoreId,
+                    realm,
+                })));
+            if (!locked.ok) {
+                return refuse(400, `The lock does not hold:\n${locked.problems.map((problem) => `- ${describeLockProblem(problem)}`).join("\n")}`).response;
+            }
+            // Model-written code reaches a store only after a person has read it. The gate refuses source that
+            // reaches off the surface, but only a reader can say whether the code does what someone wanted — so
+            // this is the boundary, and it is checked here rather than at the proposal gate because a draft is
+            // allowed to hold unread code: previewing it is how a person reads it.
+            const unreviewed = await unreviewedWrittenViews(body.data.horn);
+            if (isPresent(unreviewed))
+                return refuse(400, unreviewedMessage(unreviewed)).response;
+            const number = Number.isFinite(currentNumber) ? currentNumber + 1 : 1;
+            const revision = hornRevisionIri(hornIri, number);
+            // The route owns both, so a document that disagrees is replaced rather than refused: a client editing a
+            // Horn it did not create has no business renaming it.
+            const document = { ...body.data.horn, iri: hornIri, slug, revision: number };
+            // The hash is of the document as written about the Horn, so the same document hashes the same in every
+            // revision. What is stored is rooted at the revision, so no two revisions share a node.
+            const triples = [];
+            hornToTriples(document, iri(hornIri), (triple) => triples.push(triple));
+            const rooted = [];
+            hornToTriples(document, iri(revision), (triple) => rooted.push(triple));
+            const stored = skolemize(rooted, revision);
+            await update(revisionSaveUpdate(realm, { hornIri, slug, revision, number, baseRevision: currentRevision, triples: stored }));
+            return Response.json({ iri: hornIri, slug, revision, contentHash: await contentHash(triples) }, { headers: noStore });
+        }
+        catch (caught) {
+            if (caught instanceof WriteRefusedError)
+                return refuse(403, caught.message).response;
+            return refuse(502, caught instanceof Error ? caught.message : String(caught)).response;
+        }
+    });
+    routes.post("/d/:datastoreId/horns/render", async (c) => {
+        const datastoreId = c.req.param("datastoreId");
+        const accepted = await accept(c.req.raw, c.env, datastoreId, hornRequestSchema);
+        if (!accepted.ok)
+            return accepted.response;
+        const built = await snapshotFor({ request: c.req.raw, env: c.env, datastoreId, ...accepted });
+        if (!built.ok)
+            return built.response;
+        const mode = c.req.query("mode");
+        const html = renderHornDocument({
+            template: await hornTemplate(c.env, c.req.url),
+            snapshot: built.snapshot,
+            mode: mode === "embed" ? "embed" : "page",
+        });
+        return c.html(html, 200, { ...noStore, "referrer-policy": "no-referrer", "x-content-type-options": "nosniff" });
+    });
+    routes.post("/api/d/:datastoreId/horns/snapshot", async (c) => {
+        const datastoreId = c.req.param("datastoreId");
+        const accepted = await accept(c.req.raw, c.env, datastoreId, hornRequestSchema);
+        if (!accepted.ok)
+            return accepted.response;
+        const built = await snapshotFor({ request: c.req.raw, env: c.env, datastoreId, ...accepted });
+        if (!built.ok)
+            return built.response;
+        return c.json({ snapshot: built.snapshot }, 200, noStore);
+    });
+    /**
+     * The picture a browser took of a Horn. The bytes come through the worker because the browser has no GraphQL
+     * route, and the upload runs as the viewer because a stored file is attributed to a person — the write key
+     * cannot stand in for one. Nothing is captured here: the page that already drew the Horn drew this too.
+     */
+    routes.post("/api/d/:datastoreId/horns/:slug/screenshot", async (c) => {
+        const datastoreId = c.req.param("datastoreId");
+        const authorized = await authorize(c.req.raw, c.env, datastoreId);
+        if (!authorized.ok)
+            return authorized.response;
+        const realm = c.env.VITE_KEYCLOAK_REALM;
+        if (!isPresent(realm) || !isRealm(realm))
+            return refuse(500, "This deployment has no realm configured.").response;
+        const bytes = new Uint8Array(await c.req.arrayBuffer());
+        if (bytes.byteLength === 0)
+            return refuse(400, "That request carried no picture.").response;
+        if (bytes.byteLength > maxScreenshotBytes) {
+            return refuse(413, `A Horn's picture may be at most ${maxScreenshotBytes / (1024 * 1024)} MB.`).response;
+        }
+        const slug = c.req.param("slug");
+        const select = agentsSparqlSelect({
+            requestUrl: c.req.raw.url,
+            agentsUrl: c.env.MANTA_AGENTS_URL,
+            session: authorized.session,
+            datastoreId,
+        });
+        try {
+            // The revision is the store's to say, not the caller's: a picture labels what the datastore currently shows.
+            const found = await select(hornBySlugQuery(realm, slug), undefined);
+            const current = found.results.bindings[0];
+            const revision = current?.["revision"]?.value;
+            if (!isPresent(revision))
+                return refuse(404, `There is no Horn called "${slug}" here.`).response;
+            const number = Number(current?.["number"]?.value) || 1;
+            const uploaded = await uploadPng({ agentsUrl: c.env.MANTA_AGENTS_URL, session: authorized.session, datastoreId }, { fileName: `horn-${slug}-r${number}.png`, bytes });
+            if (!uploaded.ok)
+                return refuse(uploaded.status, uploaded.error).response;
+            const capturedAt = (deps.now?.() ?? new Date()).toISOString();
+            await agentsSparqlUpdate({
+                agentsUrl: c.env.MANTA_AGENTS_URL,
+                datastoreId,
+                updateKey: c.env.SPARQL_UPDATE_PSK,
+                purpose: { kind: "horn-save", realm },
+            })(screenshotSaveUpdate(realm, { revision, fileIri: uploaded.fileIri, capturedAt }));
+            return Response.json({ screenshot: uploaded.fileIri, capturedAt }, { headers: noStore });
+        }
+        catch (caught) {
+            if (caught instanceof WriteRefusedError)
+                return refuse(403, caught.message).response;
+            return refuse(502, caught instanceof Error ? caught.message : String(caught)).response;
+        }
+    });
+    return routes;
+}

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+export type { Env } from "./env.ts";
+export { ndjsonResponse } from "./ndjson.ts";
+export { readNdjson } from "./ndjson-reader.ts";
+export { hornRoutes, maxScreenshotBytes, type HornRoutesDeps, type HornRoutesEnv } from "./horn-routes.ts";
+export { studioRoutes, maxHistoryTurns, type StudioRoutesDeps, type StudioRoutesEnv } from "./studio-routes.ts";
+export { actionPlanRoutes } from "./action-plan-routes.ts";
+export { authUnavailableResponse, callbackPath, localSignOutResponse, loginPath, loginRequestWithMarker, logoutPath, logoutResponseReturningTo, } from "./auth-routes.ts";
+export { signedInParam } from "./auth-params.ts";
+export { proxyToMantaAgents, sameOriginDeniedResponse, signedOutMessage } from "./agents-proxy.ts";
+export { datastoreAccessFor, datastoreAccessUnavailableMessage, datastoreNotGrantedMessage, forgetDatastoreAccess, grantsDatastore, resetDatastoreAccessCache, } from "./datastore-access.ts";
+export { agentsSparqlSelect } from "./sparql-select.ts";
+export { agentsSparqlUpdate, WriteRefusedError } from "./sparql-update.ts";
+export { criticModelFromEnv, studioModelFromEnv, type StudioModelEnv, type StudioModelResult } from "./llm.ts";
+export { isSignedIn, sessionSetCookies, type MantaSessionState } from "./session.ts";
+export { requestSession, type DevSessionEnv } from "./dev-session.ts";
+export { hornTemplatePath, renderHornDocument } from "./render-document.ts";
+export { sentryOptionsForDeploy } from "./sentry.ts";
+export { withoutPiiErrorEvent } from "./pii.ts";
+export { asJsonRequest, followedLink, noPageToOpen, signInFirst } from "./entity-links.ts";

package/dist/index.js

@@ -0,0 +1,20 @@
+export { ndjsonResponse } from "./ndjson.js";
+export { readNdjson } from "./ndjson-reader.js";
+export { hornRoutes, maxScreenshotBytes } from "./horn-routes.js";
+export { studioRoutes, maxHistoryTurns } from "./studio-routes.js";
+export { actionPlanRoutes } from "./action-plan-routes.js";
+export { authUnavailableResponse, callbackPath, localSignOutResponse, loginPath, loginRequestWithMarker, logoutPath, logoutResponseReturningTo, } from "./auth-routes.js";
+export { signedInParam } from "./auth-params.js";
+export { proxyToMantaAgents, sameOriginDeniedResponse, signedOutMessage } from "./agents-proxy.js";
+export { datastoreAccessFor, datastoreAccessUnavailableMessage, datastoreNotGrantedMessage, forgetDatastoreAccess, grantsDatastore, resetDatastoreAccessCache, } from "./datastore-access.js";
+export { agentsSparqlSelect } from "./sparql-select.js";
+export { agentsSparqlUpdate, WriteRefusedError } from "./sparql-update.js";
+// Also its own entry, `@manta-eu/horns-server/llm`: building a model client must not drag in the render
+// path, which is JSX and which a Node script cannot load.
+export { criticModelFromEnv, studioModelFromEnv } from "./llm.js";
+export { isSignedIn, sessionSetCookies } from "./session.js";
+export { requestSession } from "./dev-session.js";
+export { hornTemplatePath, renderHornDocument } from "./render-document.js";
+export { sentryOptionsForDeploy } from "./sentry.js";
+export { withoutPiiErrorEvent } from "./pii.js";
+export { asJsonRequest, followedLink, noPageToOpen, signInFirst } from "./entity-links.js";

package/dist/llm.d.ts

@@ -0,0 +1,45 @@
+import { type StudioModel } from "@manta-eu/horns/studio";
+export type StudioModelEnv = {
+    HORNS_LLM_BASE_URL?: string;
+    HORNS_LLM_MODEL?: string;
+    /**
+     * `vllm` (the default) for the self-hosted Qwen, `openai` for anything else behind the gateway's
+     * OpenAI-compatible route — Anthropic, OpenAI. It decides whether `chat_template_kwargs` is sent and
+     * whether we carry a key of our own, because on any route but vLLM's the gateway holds the provider key.
+     */
+    HORNS_LLM_DIALECT?: string;
+    HORNS_LLM_MAX_TOKENS?: string;
+    VLLM_PRIMARY_AUTH_TOKEN?: string;
+    CLOUDFLARE_AI_GATEWAY_TOKEN?: string;
+    CLOUDFLARE_ENV?: string;
+    /** The critic, on its own gateway route: a model that can look at a picture of what the Studio drew. */
+    HORNS_CRITIC_BASE_URL?: string;
+    HORNS_CRITIC_MODEL?: string;
+    HORNS_CRITIC_DIALECT?: string;
+};
+export declare const aiGatewayHost = "gateway.ai.cloudflare.com";
+export declare const defaultMaxTokens = 6000;
+export type StudioModelResult = {
+    ok: true;
+    model: StudioModel;
+    monitored: boolean;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function studioModelFromEnv(env: StudioModelEnv, context: {
+    feature: string;
+    datastoreId?: string;
+}, fetcher?: typeof fetch): StudioModelResult;
+/**
+ * The critic's model, which is not the Studio's: it reads a picture of what the Studio drew, so it has to be a
+ * model with image input. It goes through the same gateway for the same reason — every call is logged — but it
+ * carries no key of ours. The gateway holds the provider key and injects it; sending one of ours would
+ * override the stored key with something the provider never issued.
+ *
+ * Unconfigured is not an error: the caller falls back to the Studio's own model, which reads the card as text.
+ */
+export declare function criticModelFromEnv(env: StudioModelEnv, context: {
+    feature: string;
+    datastoreId?: string;
+}, fetcher?: typeof fetch): StudioModelResult;

package/dist/llm.js

@@ -0,0 +1,126 @@
+import { isPresent } from "@manta-eu/lib/present";
+import { createOpenAICompatibleModel } from "@manta-eu/horns/studio";
+/** Anything but an explicit `openai` is vLLM, so a deployment that says nothing keeps the Qwen it had. */
+function dialectOf(configured) {
+    return configured?.trim().toLowerCase() === "openai" ? "openai" : "vllm";
+}
+export const aiGatewayHost = "gateway.ai.cloudflare.com";
+// A round that runs past the gateway's ~100 s limit comes back as a timeout instead of an answer. Studio
+// rounds need around 3000 tokens, so this bounds a runaway thinking chain without cutting a real answer.
+export const defaultMaxTokens = 6000;
+const loopbackHosts = new Set(["localhost", "127.0.0.1", "[::1]"]);
+function maxTokensOf(configured) {
+    const parsed = Number(configured);
+    return Number.isInteger(parsed) && parsed > 0 ? parsed : defaultMaxTokens;
+}
+// Every Qwen call goes through agents' AI Gateway route (`custom-vllm-manta`), so it is logged and metered
+// beside agents' own traffic and tagged as Horns'. The one exception is a loopback LLM stub in tests.
+export function studioModelFromEnv(env, context, fetcher) {
+    const baseURL = env.HORNS_LLM_BASE_URL;
+    const model = env.HORNS_LLM_MODEL;
+    if (!isPresent(baseURL) || !isPresent(model)) {
+        return { ok: false, reason: "HORNS_LLM_BASE_URL and HORNS_LLM_MODEL must both be set." };
+    }
+    if (!URL.canParse(baseURL))
+        return { ok: false, reason: "HORNS_LLM_BASE_URL is not a URL." };
+    const { hostname, protocol } = new URL(baseURL);
+    const dialect = dialectOf(env.HORNS_LLM_DIALECT);
+    const withFetch = fetcher ? { fetch: fetcher } : {};
+    if (loopbackHosts.has(hostname)) {
+        return {
+            ok: true,
+            monitored: false,
+            model: createOpenAICompatibleModel({ baseURL, model, dialect, ...withFetch }),
+        };
+    }
+    if (protocol !== "https:" || hostname !== aiGatewayHost) {
+        return {
+            ok: false,
+            reason: `HORNS_LLM_BASE_URL must be the AI Gateway (${aiGatewayHost}) so model calls are logged, not ${hostname}.`,
+        };
+    }
+    if (!isPresent(env.CLOUDFLARE_AI_GATEWAY_TOKEN)) {
+        return { ok: false, reason: "CLOUDFLARE_AI_GATEWAY_TOKEN must be set to call the AI Gateway." };
+    }
+    // Only vLLM's route takes a key of ours. On any other the gateway holds the provider key, and sending one
+    // would override the stored key with something the provider never issued.
+    if (dialect === "vllm" && !isPresent(env.VLLM_PRIMARY_AUTH_TOKEN)) {
+        return { ok: false, reason: "VLLM_PRIMARY_AUTH_TOKEN must be set for the gateway's vLLM route." };
+    }
+    return {
+        ok: true,
+        monitored: true,
+        model: createOpenAICompatibleModel({
+            baseURL,
+            model,
+            dialect,
+            ...(dialect === "vllm" && isPresent(env.VLLM_PRIMARY_AUTH_TOKEN)
+                ? { apiKey: env.VLLM_PRIMARY_AUTH_TOKEN }
+                : {}),
+            gatewayToken: env.CLOUDFLARE_AI_GATEWAY_TOKEN,
+            maxTokens: maxTokensOf(env.HORNS_LLM_MAX_TOKENS),
+            // No user identifiers: the gateway log is shared with agents.
+            metadata: {
+                app: "manta-horns",
+                environment: env.CLOUDFLARE_ENV ?? "local",
+                feature: context.feature,
+                ...(isPresent(context.datastoreId) ? { datastore: context.datastoreId } : {}),
+            },
+            ...withFetch,
+        }),
+    };
+}
+/**
+ * The critic's model, which is not the Studio's: it reads a picture of what the Studio drew, so it has to be a
+ * model with image input. It goes through the same gateway for the same reason — every call is logged — but it
+ * carries no key of ours. The gateway holds the provider key and injects it; sending one of ours would
+ * override the stored key with something the provider never issued.
+ *
+ * Unconfigured is not an error: the caller falls back to the Studio's own model, which reads the card as text.
+ */
+export function criticModelFromEnv(env, context, fetcher) {
+    const baseURL = env.HORNS_CRITIC_BASE_URL;
+    const model = env.HORNS_CRITIC_MODEL;
+    if (!isPresent(baseURL) || !isPresent(model)) {
+        return { ok: false, reason: "HORNS_CRITIC_BASE_URL and HORNS_CRITIC_MODEL must both be set." };
+    }
+    if (!URL.canParse(baseURL))
+        return { ok: false, reason: "HORNS_CRITIC_BASE_URL is not a URL." };
+    const { hostname, protocol } = new URL(baseURL);
+    const dialect = dialectOf(env.HORNS_CRITIC_DIALECT);
+    const withFetch = fetcher ? { fetch: fetcher } : {};
+    if (loopbackHosts.has(hostname)) {
+        return {
+            ok: true,
+            monitored: false,
+            model: createOpenAICompatibleModel({ baseURL, model, dialect, ...withFetch }),
+        };
+    }
+    if (protocol !== "https:" || hostname !== aiGatewayHost) {
+        return {
+            ok: false,
+            reason: `HORNS_CRITIC_BASE_URL must be the AI Gateway (${aiGatewayHost}) so critic calls are logged, not ${hostname}.`,
+        };
+    }
+    if (!isPresent(env.CLOUDFLARE_AI_GATEWAY_TOKEN)) {
+        return { ok: false, reason: "CLOUDFLARE_AI_GATEWAY_TOKEN must be set to call the AI Gateway." };
+    }
+    return {
+        ok: true,
+        monitored: true,
+        model: createOpenAICompatibleModel({
+            baseURL,
+            model,
+            dialect,
+            gatewayToken: env.CLOUDFLARE_AI_GATEWAY_TOKEN,
+            maxTokens: maxTokensOf(env.HORNS_LLM_MAX_TOKENS),
+            metadata: {
+                app: "manta-horns",
+                environment: env.CLOUDFLARE_ENV ?? "local",
+                feature: context.feature,
+                ...(isPresent(context.datastoreId) ? { datastore: context.datastoreId } : {}),
+            },
+            ...withFetch,
+        }),
+    };
+}

package/dist/manta/agents-url.d.ts

@@ -0,0 +1,2 @@
+export declare const HIREMANTA_AGENTS_STAGING_URL = "https://staging-app.hiremanta.com";
+export declare const JOURNEY_AGENTS_STAGING_URL = "https://staging-chat.manta.journey.travel";

package/dist/manta/agents-url.js

@@ -0,0 +1,2 @@
+export const HIREMANTA_AGENTS_STAGING_URL = "https://staging-app.hiremanta.com";
+export const JOURNEY_AGENTS_STAGING_URL = "https://staging-chat.manta.journey.travel";

package/dist/manta-proxy-policy.d.ts

@@ -0,0 +1,47 @@
+export declare const crossOriginBlockedMessage = "Cross-origin requests to the Horns proxy are blocked.";
+export declare const proxyPathBlockedMessage = "This proxy only forwards the Manta paths Horns uses.";
+export declare const proxyMethodBlockedMessage = "This proxy does not allow that method on this path.";
+export declare const sparqlEmptyMessage = "SPARQL query is empty.";
+export declare const sparqlParseFailedMessage = "SPARQL query could not be parsed as a single query.";
+export declare const sparqlWriteBlockedMessage = "This proxy only forwards read-only SPARQL.";
+export declare const sparqlFederationBlockedMessage = "This proxy does not forward SERVICE, FROM or FROM NAMED.";
+export type ProxyPolicyDecision = {
+    allow: true;
+    bodyText?: string;
+} | {
+    allow: false;
+    status: number;
+    error: string;
+};
+export declare function isAuthProxyPath(pathname: string): boolean;
+export declare function originAllowsRequest({ request }: {
+    request: Request;
+}): boolean;
+export declare function sameOriginDeniedResponse(request: Request): Response | undefined;
+type ProxyRoute = {
+    path: string;
+    methods: readonly string[];
+    params?: Record<string, (value: string) => boolean>;
+    body?: "sparql";
+};
+export declare const isDatastoreId: (value: string) => boolean;
+export declare function matchProxyRoute(pathname: string): ProxyRoute | undefined;
+export declare function isAllowedProxyPath(args: {
+    method: string;
+    pathname: string;
+    isWebSocket: boolean;
+}): {
+    allowed: boolean;
+    methodAllowed: boolean;
+};
+export type SparqlVerdict = {
+    ok: true;
+} | {
+    ok: false;
+    status: 400 | 403;
+    error: string;
+};
+export declare function checkReadOnlySparql(text: string): SparqlVerdict;
+export declare function isReadOnlySparql(text: string): boolean;
+export declare function evaluateProxyPolicy(request: Request): Promise<ProxyPolicyDecision>;
+export {};