@minionry/minion 0.7.36

package/dist/server/engines/credentials/model-profiles.js

@@ -0,0 +1,249 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { dirname } from 'node:path';
+import { machineFile } from '../../../bin/machine-layout.js';
+import { withFileLock } from '../../utils/file-store.js';
+import { isEngineId, parseProfileModelValue } from '../EngineEvent.js';
+import { credentialFileFs, credentialLockPath, getApiKey, } from './provider-credentials.js';
+export { parseProfileModelValue, profileModelValue } from '../EngineEvent.js';
+const PROFILE_FILE_VERSION = 2;
+export const APP_PROFILE_ID_PATTERN = /^app-[a-z0-9][a-z0-9-]*-[a-z0-9][a-z0-9-]{0,31}$/;
+export const APP_PROFILE_ID_PREFIX = 'app-';
+const APP_PROFILE_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{0,31}$/;
+const ISO_DATE_TIME_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2}(?:\.\d{1,9})?)?(?:Z|[+-]\d{2}:\d{2})$/;
+const MAX_FIELD_LENGTH = 512;
+const MAX_BASE_URL_LENGTH = 2048;
+export class ModelProfileError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'ModelProfileError';
+        this.code = code;
+    }
+}
+const defaultFs = credentialFileFs;
+export function defaultProfileFilePath() {
+    return machineFile('modelProfiles');
+}
+export function profileCredentialId(profileId) {
+    return `profile:${profileId}`;
+}
+function normalizeField(value, maxLength = MAX_FIELD_LENGTH) {
+    if (typeof value !== 'string')
+        return undefined;
+    const trimmed = value.trim();
+    if (!trimmed)
+        return undefined;
+    return trimmed.slice(0, maxLength);
+}
+function slugify(label) {
+    const slug = label
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 48);
+    return slug || 'profile';
+}
+function userSlug(label) {
+    const slug = slugify(label);
+    return slug === 'app' || slug.startsWith(APP_PROFILE_ID_PREFIX) ? `profile-${slug}` : slug;
+}
+function isNonBlankString(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
+function isOwner(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const owner = value;
+    return isNonBlankString(owner.appId) && isNonBlankString(owner.spaceKey);
+}
+function isContextLength(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value > 0;
+}
+export function parseProfileExpiry(value) {
+    if (typeof value !== 'string' || !ISO_DATE_TIME_PATTERN.test(value))
+        return undefined;
+    const ms = Date.parse(value);
+    return Number.isFinite(ms) ? ms : undefined;
+}
+function isAppProfileIdFor(id, appId) {
+    const prefix = `${APP_PROFILE_ID_PREFIX}${appId}-`;
+    return (APP_PROFILE_ID_PATTERN.test(id) &&
+        id.startsWith(prefix) &&
+        APP_PROFILE_SLUG_PATTERN.test(id.slice(prefix.length)));
+}
+function readStoredProfile(value) {
+    if (!value || typeof value !== 'object')
+        return undefined;
+    const row = value;
+    if (!(typeof row.id === 'string' &&
+        row.id.length > 0 &&
+        typeof row.label === 'string' &&
+        isEngineId(row.engine) &&
+        typeof row.model === 'string')) {
+        return undefined;
+    }
+    if (row.owner !== undefined) {
+        if (!isOwner(row.owner))
+            return undefined;
+        if (!isAppProfileIdFor(row.id, row.owner.appId))
+            return undefined;
+        if (parseProfileExpiry(row.expiresAt) === undefined)
+            return undefined;
+    }
+    if (row.contextLength !== undefined && !isContextLength(row.contextLength)) {
+        const { contextLength: _dropped, ...rest } = row;
+        return rest;
+    }
+    return row;
+}
+function sameOwner(a, b) {
+    if (!a || !b)
+        return a === b;
+    return a.appId === b.appId && a.spaceKey === b.spaceKey;
+}
+function validateOwnership(input, requestedId) {
+    if (input.contextLength !== undefined && !isContextLength(input.contextLength)) {
+        throw new ModelProfileError('INVALID_PROFILE', 'Context length must be a positive whole number');
+    }
+    const contextLength = input.contextLength;
+    if (input.owner === undefined) {
+        if (input.expiresAt !== undefined) {
+            throw new ModelProfileError('INVALID_PROFILE', 'Only an app-registered model can expire');
+        }
+        if (requestedId?.startsWith(APP_PROFILE_ID_PREFIX)) {
+            throw new ModelProfileError('RESERVED_ID', 'Ids starting with "app-" are reserved for app-registered models');
+        }
+        return contextLength !== undefined ? { contextLength } : {};
+    }
+    if (!isOwner(input.owner)) {
+        throw new ModelProfileError('INVALID_PROFILE', 'An app-registered model needs an app id and a Space');
+    }
+    if (!requestedId || !isAppProfileIdFor(requestedId, input.owner.appId)) {
+        throw new ModelProfileError('RESERVED_ID', "An app-registered model needs an id inside its app's namespace");
+    }
+    const expiresMs = parseProfileExpiry(input.expiresAt);
+    if (expiresMs === undefined) {
+        throw new ModelProfileError('INVALID_PROFILE', 'An app-registered model needs an ISO 8601 expiry');
+    }
+    return {
+        owner: { appId: input.owner.appId, spaceKey: input.owner.spaceKey },
+        expiresAt: new Date(expiresMs).toISOString(),
+        ...(contextLength !== undefined ? { contextLength } : {}),
+    };
+}
+export class ModelProfileStore {
+    profileFilePath;
+    lockPath;
+    fs;
+    constructor(options = {}) {
+        this.profileFilePath = options.profileFilePath ?? defaultProfileFilePath();
+        this.lockPath = credentialLockPath(options.profileFilePath, 'model-profiles');
+        this.fs = options.fs ?? defaultFs;
+    }
+    list() {
+        if (!this.fs.existsSync(this.profileFilePath))
+            return [];
+        try {
+            const parsed = JSON.parse(this.fs.readFileSync(this.profileFilePath, 'utf8'));
+            if (!parsed || typeof parsed !== 'object')
+                return [];
+            const rows = parsed.profiles;
+            if (!Array.isArray(rows))
+                return [];
+            return rows
+                .map(readStoredProfile)
+                .filter((profile) => profile !== undefined)
+                .sort((a, b) => a.createdAt - b.createdAt);
+        }
+        catch {
+            return [];
+        }
+    }
+    get(profileId) {
+        const id = profileId.trim();
+        if (!id)
+            return undefined;
+        return this.list().find((profile) => profile.id === id);
+    }
+    save(input) {
+        const label = normalizeField(input.label);
+        const model = normalizeField(input.model);
+        if (!label)
+            throw new ModelProfileError('INVALID_PROFILE', 'A name is required');
+        if (!isEngineId(input.engine)) {
+            throw new ModelProfileError('INVALID_PROFILE', 'A valid engine is required');
+        }
+        if (!model)
+            throw new ModelProfileError('INVALID_PROFILE', 'A model name is required');
+        const requestedId = normalizeField(input.id);
+        const ownership = validateOwnership(input, requestedId);
+        const baseUrl = normalizeField(input.baseUrl, MAX_BASE_URL_LENGTH);
+        return withFileLock(this.lockPath, () => {
+            const profiles = this.list();
+            const existing = requestedId ? profiles.find((p) => p.id === requestedId) : undefined;
+            if (existing && !sameOwner(existing.owner, ownership.owner)) {
+                throw new ModelProfileError('OWNER_CONFLICT', 'That id already belongs to a different owner');
+            }
+            const now = Date.now();
+            const id = requestedId ?? uniqueId(userSlug(label), profiles);
+            const saved = {
+                id,
+                label,
+                engine: input.engine,
+                model,
+                ...(baseUrl ? { baseUrl } : {}),
+                ...(input.wireApi === 'responses' || input.wireApi === 'chat'
+                    ? { wireApi: input.wireApi }
+                    : {}),
+                ...ownership,
+                createdAt: existing?.createdAt ?? now,
+                updatedAt: now,
+            };
+            const next = existing
+                ? profiles.map((p) => (p.id === id ? saved : p))
+                : [...profiles, saved];
+            this.write(next);
+            return saved;
+        });
+    }
+    remove(profileId) {
+        const id = profileId.trim();
+        if (!id)
+            throw new ModelProfileError('INVALID_PROFILE', 'A profile id is required');
+        withFileLock(this.lockPath, () => {
+            const profiles = this.list();
+            if (!profiles.some((profile) => profile.id === id))
+                return;
+            this.write(profiles.filter((profile) => profile.id !== id));
+        });
+    }
+    write(profiles) {
+        this.fs.mkdirSync(dirname(this.profileFilePath), { recursive: true });
+        const document = { version: PROFILE_FILE_VERSION, profiles };
+        this.fs.writeFileSync(this.profileFilePath, `${JSON.stringify(document, null, 2)}\n`);
+    }
+}
+export function resolveModelProfile(modelValue, deps = {}) {
+    if (!modelValue)
+        return undefined;
+    const parsed = parseProfileModelValue(modelValue);
+    if (!parsed)
+        return undefined;
+    const profile = (deps.profiles ?? new ModelProfileStore()).get(parsed.profileId);
+    if (!profile || profile.engine !== parsed.engine)
+        return undefined;
+    const readKey = deps.readKey ?? ((id) => getApiKey(id));
+    const apiKey = readKey(profileCredentialId(profile.id));
+    return apiKey ? { profile, apiKey } : { profile };
+}
+function uniqueId(base, existing) {
+    const taken = new Set(existing.map((profile) => profile.id));
+    if (!taken.has(base))
+        return base;
+    for (let suffix = 2;; suffix += 1) {
+        const candidate = `${base}-${suffix}`;
+        if (!taken.has(candidate))
+            return candidate;
+    }
+}

package/dist/server/engines/credentials/provider-credentials.js

@@ -0,0 +1,146 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { machineFile, machineLockPath } from '../../../bin/machine-layout.js';
+import { withFileLock, writeFileAtomic } from '../../utils/file-store.js';
+export const credentialFileFs = {
+    existsSync,
+    readFileSync: (p, enc) => readFileSync(p, enc),
+    writeFileSync: (p, data) => writeFileAtomic(p, data, { mode: 0o600 }),
+    mkdirSync: (p, opts) => {
+        mkdirSync(p, { ...opts, mode: 0o700 });
+    },
+};
+const defaultFs = credentialFileFs;
+export function credentialLockPath(filePath, name) {
+    return filePath ? `${filePath}.lock` : machineLockPath(name);
+}
+export const CODEX_PROVIDER_ID = 'codex';
+export const ANTHROPIC_PROVIDER_ID = 'anthropic';
+export function defaultAuthFilePath() {
+    return machineFile('engineCredentials');
+}
+export function hasStoredCredential(providerId, options = {}) {
+    const id = providerId.trim();
+    if (!id)
+        return false;
+    const fs = options.fs ?? defaultFs;
+    const path = options.authFilePath ?? defaultAuthFilePath();
+    if (!fs.existsSync(path))
+        return false;
+    try {
+        const parsed = JSON.parse(fs.readFileSync(path, 'utf8'));
+        return Object.hasOwn(parsed, id);
+    }
+    catch {
+        return false;
+    }
+}
+export function getApiKey(providerId, options = {}) {
+    const id = providerId.trim();
+    if (!id)
+        return undefined;
+    const fs = options.fs ?? defaultFs;
+    const path = options.authFilePath ?? defaultAuthFilePath();
+    if (!fs.existsSync(path))
+        return undefined;
+    try {
+        const parsed = JSON.parse(fs.readFileSync(path, 'utf8'));
+        if (!Object.hasOwn(parsed, id))
+            return undefined;
+        const entry = parsed[id];
+        if (entry && typeof entry === 'object' && entry.type === 'api') {
+            const key = entry.key;
+            if (typeof key === 'string' && key.trim())
+                return key.trim();
+        }
+    }
+    catch {
+        return undefined;
+    }
+    return undefined;
+}
+export class ProviderCredentialStore {
+    authFilePath;
+    lockPath;
+    fs;
+    constructor(options = {}) {
+        this.authFilePath = options.authFilePath ?? defaultAuthFilePath();
+        this.lockPath = credentialLockPath(options.authFilePath, 'engine-credentials');
+        this.fs = options.fs ?? defaultFs;
+    }
+    read() {
+        if (!this.fs.existsSync(this.authFilePath))
+            return {};
+        try {
+            const parsed = JSON.parse(this.fs.readFileSync(this.authFilePath, 'utf8'));
+            if (parsed && typeof parsed === 'object')
+                return parsed;
+        }
+        catch {
+        }
+        return {};
+    }
+    write(data) {
+        this.fs.mkdirSync(dirname(this.authFilePath), { recursive: true });
+        this.fs.writeFileSync(this.authFilePath, `${JSON.stringify(data, null, 2)}\n`);
+    }
+    list() {
+        const parsed = this.read();
+        return Object.keys(parsed)
+            .filter((id) => Object.hasOwn(parsed, id))
+            .sort((a, b) => a.localeCompare(b))
+            .map((id) => ({ id, configured: true }));
+    }
+    getApiKey(providerId) {
+        const id = providerId.trim();
+        if (!id)
+            return undefined;
+        const parsed = this.read();
+        if (!Object.hasOwn(parsed, id))
+            return undefined;
+        const record = parsed[id];
+        if (record &&
+            typeof record === 'object' &&
+            record.type === 'api' &&
+            typeof record.key === 'string') {
+            const key = record.key;
+            return key.length > 0 ? key : undefined;
+        }
+        return undefined;
+    }
+    setApiKey(providerId, apiKey) {
+        const id = providerId.trim();
+        const key = apiKey.trim();
+        if (!id)
+            throw new Error('Provider id is required');
+        if (!key)
+            throw new Error('API key is required');
+        withFileLock(this.lockPath, () => {
+            const parsed = this.read();
+            parsed[id] = { type: 'api', key };
+            this.write(parsed);
+        });
+    }
+    remove(providerId) {
+        const id = providerId.trim();
+        if (!id)
+            throw new Error('Provider id is required');
+        withFileLock(this.lockPath, () => {
+            if (!this.fs.existsSync(this.authFilePath))
+                return;
+            let parsed;
+            try {
+                parsed = JSON.parse(this.fs.readFileSync(this.authFilePath, 'utf8'));
+            }
+            catch {
+                return;
+            }
+            if (!Object.hasOwn(parsed, id))
+                return;
+            delete parsed[id];
+            this.write(parsed);
+        });
+    }
+}

package/dist/server/engines/engine-event-stream.js

@@ -0,0 +1,52 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+export class EngineEventStream {
+    iteratorDone = false;
+    queue = [];
+    pending = [];
+    emit(event) {
+        if (this.iteratorDone)
+            return;
+        const resolver = this.pending.shift();
+        if (resolver) {
+            resolver({ value: event, done: false });
+        }
+        else {
+            this.queue.push(event);
+        }
+        if (event.kind === 'engine.error' && event.fatal) {
+            this.closeIterator();
+        }
+    }
+    closeIterator() {
+        if (this.iteratorDone)
+            return;
+        this.iteratorDone = true;
+        const waiting = this.pending.splice(0);
+        for (const resolve of waiting) {
+            resolve({ value: undefined, done: true });
+        }
+    }
+    [Symbol.asyncIterator]() {
+        return {
+            next: () => {
+                if (this.queue.length > 0) {
+                    return Promise.resolve({
+                        value: this.queue.shift(),
+                        done: false,
+                    });
+                }
+                if (this.iteratorDone) {
+                    return Promise.resolve({ value: undefined, done: true });
+                }
+                return new Promise((resolve) => {
+                    this.pending.push(resolve);
+                });
+            },
+            return: () => {
+                this.closeIterator();
+                return Promise.resolve({ value: undefined, done: true });
+            },
+        };
+    }
+}