@moldesk/core 0.0.4 → 0.0.6

package/dist/cloud/accounts.d.ts

@@ -0,0 +1,69 @@
+import { CredentialStore, type CloudProvider, type CredentialSource, type MoldeskPaths } from "@moldesk/runtime";
+import { type CloudJobRecord, type CloudResourceRecord, type ProviderResourceView, type ReconciliationReport } from "./state.js";
+/** Builds a provider that resolves its key per request via `getApiKey`. Injected for tests. */
+export type CloudProviderFactory = (provider: string, getApiKey: () => Promise<string>) => CloudProvider;
+export interface CloudAccountDeps {
+    paths?: MoldeskPaths;
+    store?: CredentialStore;
+    createProvider?: CloudProviderFactory;
+}
+export declare const defaultProviderFactory: CloudProviderFactory;
+export interface ConnectResult {
+    provider: string;
+    /** Where future runs will read the key from. An environment variable overrides the keyring. */
+    storedIn: "keyring";
+    /** Present when an environment key will still take precedence over the stored one. */
+    overriddenBy?: CredentialSource;
+    checkedAt: string;
+}
+/**
+ * Validates the candidate key with a minimal read-only call and only then stores it. A key that
+ * fails validation is never written anywhere.
+ */
+export declare function connectCloudProvider(provider: string, key: string, deps?: CloudAccountDeps): Promise<ConnectResult>;
+export declare function disconnectCloudProvider(provider: string, deps?: CloudAccountDeps): Promise<{
+    removed: boolean;
+}>;
+export interface CloudStatus {
+    provider: string;
+    credential: {
+        source: CredentialSource | "none";
+    };
+    /** Result of a live read-only check; absent when no credential exists. */
+    connection?: {
+        ok: true;
+        checkedAt: string;
+    } | {
+        ok: false;
+        code: string;
+        message: string;
+    };
+    /** Non-secret credential identifier usable as an account scope. */
+    accountScope?: string;
+    journal: {
+        openJobs: CloudJobRecord[];
+        unresolvedResources: CloudResourceRecord[];
+    };
+}
+export declare function getCloudStatus(provider: string, deps?: CloudAccountDeps): Promise<CloudStatus>;
+export interface CloudResourceListing {
+    provider: string;
+    /** Provider pods/volumes the journal owns, with their current provider state. */
+    owned: Array<{
+        record: CloudResourceRecord;
+        kind: "pod" | "volume";
+        status?: string;
+        costUsdPerHour?: number | null;
+        sizeGb?: number;
+    }>;
+    /** Names that claim this client but have no journal owner. Report only; never auto-deleted. */
+    orphaned: ProviderResourceView[];
+    /** Deletion is still owed (pending, or past deadline). */
+    cleanupOwed: CloudResourceRecord[];
+    /** Everything else on the account, counted but not listed. */
+    unmanagedCount: number;
+    /** Journal changes made while reconciling. */
+    reconciliation: Pick<ReconciliationReport, "adopted" | "abandoned" | "vanished">;
+}
+/** Lists what this installation owns on the provider and reconciles the journal. Read-only toward the provider. */
+export declare function listCloudResources(provider: string, deps?: CloudAccountDeps): Promise<CloudResourceListing>;

package/dist/cloud/accounts.js

@@ -0,0 +1,113 @@
+import { CredentialStore, RunpodProvider, credentialFingerprint, getMoldeskPaths, } from "@moldesk/runtime";
+import { MoldeskError } from "../errors.js";
+import { CloudJournal } from "./state.js";
+export const defaultProviderFactory = (provider, getApiKey) => {
+    if (provider !== "runpod") {
+        throw new MoldeskError({ code: "CREDENTIAL_UNSUPPORTED_PROVIDER", message: `Unknown cloud provider "${provider}".`, remediation: "Use a supported provider, e.g. runpod." });
+    }
+    return new RunpodProvider({ getApiKey });
+};
+function resolveDeps(deps) {
+    return {
+        paths: deps.paths ?? getMoldeskPaths(),
+        store: deps.store ?? new CredentialStore(),
+        createProvider: deps.createProvider ?? defaultProviderFactory,
+    };
+}
+/**
+ * Validates the candidate key with a minimal read-only call and only then stores it. A key that
+ * fails validation is never written anywhere.
+ */
+export async function connectCloudProvider(provider, key, deps = {}) {
+    const { store, createProvider } = resolveDeps(deps);
+    // Shape-check first so obviously broken pastes never leave the machine.
+    await store.validate(provider, key);
+    const check = await createProvider(provider, async () => key).validateCredentials();
+    await store.set(provider, key);
+    const active = await store.resolve(provider);
+    return {
+        provider,
+        storedIn: "keyring",
+        ...(active && active.source !== "keyring" ? { overriddenBy: active.source } : {}),
+        checkedAt: check.checkedAt,
+    };
+}
+export async function disconnectCloudProvider(provider, deps = {}) {
+    const { store } = resolveDeps(deps);
+    return { removed: await store.delete(provider) };
+}
+export async function getCloudStatus(provider, deps = {}) {
+    const { paths, store, createProvider } = resolveDeps(deps);
+    const journal = CloudJournal.open(paths);
+    try {
+        const resolved = await store.resolve(provider);
+        const status = {
+            provider,
+            credential: { source: resolved?.source ?? "none" },
+            journal: {
+                openJobs: journal.listOpenJobs(),
+                unresolvedResources: journal.listResources({ states: ["create_pending", "active", "delete_pending"] }),
+            },
+        };
+        if (resolved) {
+            status.accountScope = credentialFingerprint(resolved.key, journal.clientId);
+            try {
+                status.connection = await createProvider(provider, async () => resolved.key).validateCredentials();
+            }
+            catch (error) {
+                status.connection = {
+                    ok: false,
+                    code: error instanceof MoldeskError ? error.code : "CLOUD_UNAVAILABLE",
+                    message: error instanceof Error ? error.message : String(error),
+                };
+            }
+        }
+        return status;
+    }
+    finally {
+        journal.close();
+    }
+}
+function toView(resource, kind) {
+    const match = /-(cpu|gpu|volume)$/.exec(resource.name);
+    return { providerId: resource.id, name: resource.name, role: match?.[1] ?? (kind === "volume" ? "volume" : "gpu") };
+}
+/** Lists what this installation owns on the provider and reconciles the journal. Read-only toward the provider. */
+export async function listCloudResources(provider, deps = {}) {
+    const { paths, store, createProvider } = resolveDeps(deps);
+    const credential = await store.require(provider);
+    const api = createProvider(provider, async () => credential.key);
+    const [pods, volumes] = await Promise.all([api.listPods(), api.listVolumes()]);
+    const live = pods.filter((pod) => pod.status !== "TERMINATED");
+    const journal = CloudJournal.open(paths);
+    try {
+        const report = journal.reconcile([...live.map((pod) => toView(pod, "pod")), ...volumes.map((volume) => toView(volume, "volume"))]);
+        const podById = new Map(live.map((pod) => [pod.id, pod]));
+        const volumeById = new Map(volumes.map((volume) => [volume.id, volume]));
+        const owned = [];
+        for (const record of journal.listResources({ states: ["active", "delete_pending"] })) {
+            if (!record.providerId)
+                continue;
+            const pod = podById.get(record.providerId);
+            const volume = volumeById.get(record.providerId);
+            if (pod)
+                owned.push({ record, kind: "pod", status: pod.status, costUsdPerHour: pod.costUsdPerHour });
+            else if (volume)
+                owned.push({ record, kind: "volume", sizeGb: volume.sizeGb });
+        }
+        const ownedIds = new Set(owned.map((entry) => entry.record.providerId));
+        const orphanedIds = new Set(report.orphaned.map((entry) => entry.providerId));
+        const unmanagedCount = [...live, ...volumes].filter((resource) => !ownedIds.has(resource.id) && !orphanedIds.has(resource.id)).length;
+        return {
+            provider,
+            owned,
+            orphaned: report.orphaned,
+            cleanupOwed: report.cleanupOwed,
+            unmanagedCount,
+            reconciliation: { adopted: report.adopted, abandoned: report.abandoned, vanished: report.vanished },
+        };
+    }
+    finally {
+        journal.close();
+    }
+}

package/dist/cloud/accounts.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cloud/accounts.test.js

@@ -0,0 +1,188 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { CredentialStore, getMoldeskPaths, } from "@moldesk/runtime";
+import { MoldeskError } from "../errors.js";
+import { connectCloudProvider, disconnectCloudProvider, getCloudStatus, listCloudResources } from "./accounts.js";
+import { CloudJournal } from "./state.js";
+const KEY = "rpa_TESTKEY0123456789";
+const RUN = "2026-10-13T11-55-45-123Z-0a1b2c3d-1111-2222-3333-444455556666";
+const dirs = [];
+function sandbox() {
+    const home = fs.mkdtempSync(path.join(os.tmpdir(), "moldesk cloud accounts "));
+    dirs.push(home);
+    const data = new Map();
+    const backend = {
+        async get(service, account) {
+            return data.get(`${service}/${account}`) ?? null;
+        },
+        async set(service, account, secret) {
+            data.set(`${service}/${account}`, secret);
+        },
+        async delete(service, account) {
+            return data.delete(`${service}/${account}`);
+        },
+    };
+    const paths = getMoldeskPaths({ MOLDESK_HOME: home });
+    const store = (env = {}) => new CredentialStore({ backend, env });
+    return { paths, data, store };
+}
+afterEach(() => {
+    for (const dir of dirs.splice(0))
+        fs.rmSync(dir, { recursive: true, force: true });
+});
+function fakeProvider(options = {}) {
+    const seenKeys = [];
+    const factory = (_name, getApiKey) => ({
+        name: "fake",
+        async validateCredentials() {
+            seenKeys.push(await getApiKey());
+            return options.validate ? options.validate() : { ok: true, checkedAt: "2026-10-13T12:00:00.000Z" };
+        },
+        async getCatalog() {
+            throw new Error("unused");
+        },
+        async createPod() {
+            throw new Error("must not create");
+        },
+        async getPod() {
+            return null;
+        },
+        async listPods() {
+            return options.pods ?? [];
+        },
+        async terminatePod() {
+            throw new Error("must not terminate");
+        },
+        async createVolume() {
+            throw new Error("must not create");
+        },
+        async getVolume() {
+            return null;
+        },
+        async listVolumes() {
+            return options.volumes ?? [];
+        },
+        async deleteVolume() {
+            throw new Error("must not delete");
+        },
+    });
+    return { factory, seenKeys };
+}
+const pod = (id, name, status = "RUNNING") => ({
+    id,
+    name,
+    status,
+    dataCenterId: "EU-RO-1",
+    costUsdPerHour: 0.57,
+    createdAt: null,
+});
+describe("connectCloudProvider", () => {
+    it("validates the candidate key before storing it", async () => {
+        const box = sandbox();
+        const { factory, seenKeys } = fakeProvider();
+        const result = await connectCloudProvider("runpod", KEY, { paths: box.paths, store: box.store(), createProvider: factory });
+        expect(result).toEqual({ provider: "runpod", storedIn: "keyring", checkedAt: "2026-10-13T12:00:00.000Z" });
+        expect(seenKeys).toEqual([KEY]);
+        expect([...box.data.values()]).toEqual([KEY]);
+    });
+    it("stores nothing when the provider rejects the key or the key is malformed", async () => {
+        const box = sandbox();
+        const rejecting = fakeProvider({
+            validate: async () => {
+                throw new MoldeskError({ code: "CLOUD_AUTH_FAILED", message: "Runpod rejected the API key.", remediation: "x" });
+            },
+        });
+        await expect(connectCloudProvider("runpod", KEY, { paths: box.paths, store: box.store(), createProvider: rejecting.factory })).rejects.toMatchObject({ code: "CLOUD_AUTH_FAILED" });
+        expect(box.data.size).toBe(0);
+        const unused = fakeProvider();
+        await expect(connectCloudProvider("runpod", "bad key", { paths: box.paths, store: box.store(), createProvider: unused.factory })).rejects.toMatchObject({ code: "CREDENTIAL_INVALID" });
+        expect(unused.seenKeys).toHaveLength(0);
+        expect(box.data.size).toBe(0);
+    });
+    it("warns when an environment key will override the stored one", async () => {
+        const box = sandbox();
+        const { factory } = fakeProvider();
+        const result = await connectCloudProvider("runpod", KEY, { paths: box.paths, store: box.store({ RUNPOD_API_KEY: `${KEY}-env` }), createProvider: factory });
+        expect(result.overriddenBy).toBe("env");
+    });
+    it("disconnect removes only the stored key", async () => {
+        const box = sandbox();
+        const { factory } = fakeProvider();
+        await connectCloudProvider("runpod", KEY, { paths: box.paths, store: box.store(), createProvider: factory });
+        expect(await disconnectCloudProvider("runpod", { paths: box.paths, store: box.store() })).toEqual({ removed: true });
+        expect(await disconnectCloudProvider("runpod", { paths: box.paths, store: box.store() })).toEqual({ removed: false });
+    });
+});
+describe("getCloudStatus", () => {
+    it("reports no credential without calling the provider", async () => {
+        const box = sandbox();
+        const { factory, seenKeys } = fakeProvider();
+        const status = await getCloudStatus("runpod", { paths: box.paths, store: box.store(), createProvider: factory });
+        expect(status.credential).toEqual({ source: "none" });
+        expect(status.connection).toBeUndefined();
+        expect(seenKeys).toHaveLength(0);
+    });
+    it("reports a live connection, a non-secret scope and open journal work", async () => {
+        const box = sandbox();
+        const journal = CloudJournal.open(box.paths);
+        journal.createJob({ runId: RUN, accountScope: "s", quoteDigest: "q", cachePolicy: "ephemeral", deadlineAt: "2026-10-13T13:00:00.000Z", manifestDigest: "m" });
+        journal.recordResourceIntent({ runId: RUN, role: "gpu" });
+        journal.close();
+        const { factory } = fakeProvider();
+        const status = await getCloudStatus("runpod", { paths: box.paths, store: box.store({ RUNPOD_API_KEY: KEY }), createProvider: factory });
+        expect(status.credential.source).toBe("env");
+        expect(status.connection).toMatchObject({ ok: true });
+        expect(status.accountScope).toMatch(/^[0-9a-f]{32}$/);
+        expect(JSON.stringify(status)).not.toContain(KEY);
+        expect(status.journal.openJobs.map((job) => job.runId)).toEqual([RUN]);
+        expect(status.journal.unresolvedResources).toHaveLength(1);
+    });
+    it("reports an auth failure as a result instead of throwing", async () => {
+        const box = sandbox();
+        const { factory } = fakeProvider({
+            validate: async () => {
+                throw new MoldeskError({ code: "CLOUD_AUTH_FAILED", message: "Runpod rejected the API key.", remediation: "x" });
+            },
+        });
+        const status = await getCloudStatus("runpod", { paths: box.paths, store: box.store({ RUNPOD_API_KEY: KEY }), createProvider: factory });
+        expect(status.connection).toEqual({ ok: false, code: "CLOUD_AUTH_FAILED", message: "Runpod rejected the API key." });
+    });
+});
+describe("listCloudResources", () => {
+    it("requires a configured credential", async () => {
+        const box = sandbox();
+        const { factory } = fakeProvider();
+        await expect(listCloudResources("runpod", { paths: box.paths, store: box.store(), createProvider: factory })).rejects.toMatchObject({ code: "CREDENTIAL_MISSING" });
+    });
+    it("separates owned, orphaned and unmanaged resources and reconciles the journal", async () => {
+        const box = sandbox();
+        const journal = CloudJournal.open(box.paths);
+        const prefix = journal.clientId.replace(/-/g, "").slice(0, 8);
+        const ownedIntent = journal.recordResourceIntent({ runId: RUN, role: "gpu" });
+        journal.recordResourceCreated(ownedIntent.intentId, "podOwned");
+        const volumeIntent = journal.recordResourceIntent({ role: "volume" });
+        journal.recordResourceCreated(volumeIntent.intentId, "volOwned");
+        const abandoned = journal.recordResourceIntent({ runId: RUN, role: "cpu" });
+        journal.close();
+        const { factory } = fakeProvider({
+            pods: [
+                pod("podOwned", ownedIntent.name),
+                pod("podOrphan", `moldesk-${prefix}-deadbeef-gpu`),
+                pod("podMine", "my-own-experiment"),
+                pod("podGone", "moldesk-old", "TERMINATED"),
+            ],
+            volumes: [{ id: "volOwned", name: volumeIntent.name, sizeGb: 10, dataCenterId: "EU-RO-1", type: "STANDARD" }],
+        });
+        const listing = await listCloudResources("runpod", { paths: box.paths, store: box.store({ RUNPOD_API_KEY: KEY }), createProvider: factory });
+        expect(listing.owned.map((entry) => [entry.record.providerId, entry.kind, entry.status ?? entry.sizeGb])).toEqual([
+            ["podOwned", "pod", "RUNNING"],
+            ["volOwned", "volume", 10],
+        ]);
+        expect(listing.orphaned.map((entry) => entry.providerId)).toEqual(["podOrphan"]);
+        expect(listing.unmanagedCount).toBe(1);
+        expect(listing.reconciliation.abandoned.map((entry) => entry.intentId)).toEqual([abandoned.intentId]);
+        expect(JSON.stringify(listing)).not.toContain(KEY);
+    });
+});

package/dist/cloud/backend.test.d.ts

@@ -0,0 +1 @@
+export {};