@moldesk/core 0.0.5 → 0.0.6

package/dist/cloud/worker/server.test.js

@@ -0,0 +1,391 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { afterEach, describe, expect, it } from "vitest";
+import { WorkerClient, validateInventory } from "@moldesk/runtime";
+import { createWorkerServer } from "./server.js";
+const TOKEN = "job-token-0123456789abcdef";
+const RUN = "run-1";
+const dirs = [];
+const workers = [];
+function tmp() {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "moldesk worker "));
+    dirs.push(dir);
+    return dir;
+}
+afterEach(async () => {
+    for (const worker of workers.splice(0))
+        await worker.close();
+    for (const dir of dirs.splice(0))
+        fs.rmSync(dir, { recursive: true, force: true });
+});
+const sha = (text) => createHash("sha256").update(text).digest("hex");
+async function boot(pipeline, token = TOKEN, maxLogBytes) {
+    const rootDir = tmp();
+    const worker = createWorkerServer({ token, rootDir, pipeline, ...(maxLogBytes ? { maxLogBytes } : {}) });
+    workers.push(worker);
+    const port = await worker.listen(0, "127.0.0.1");
+    const endpoint = `http://127.0.0.1:${port}`;
+    const client = (overrides = {}) => new WorkerClient({ endpoint, token: TOKEN, allowInsecureLoopback: true, sleep: async () => undefined, ...overrides });
+    return { worker, rootDir, endpoint, client };
+}
+function inputFile(content = "job-bytes") {
+    const dir = tmp();
+    const sourcePath = path.join(dir, "in.txt");
+    fs.writeFileSync(sourcePath, content);
+    return { role: "job", relativePath: "in.txt", sha256: sha(content), sizeBytes: Buffer.byteLength(content), sourcePath };
+}
+function wire(input, runId = RUN) {
+    const { sourcePath: _s, ...rest } = input;
+    return {
+        version: 1,
+        runId,
+        model: "m",
+        modelVersion: "1",
+        manifestDigest: "d",
+        cachePolicy: "ephemeral",
+        gpuId: "g",
+        datacenterId: "dc",
+        images: { gpu: "g", cpu: "c" },
+        containerDiskGb: 10,
+        volumeGb: 10,
+        assetLayoutRevision: "1",
+        cpuAssetPreparation: true,
+        params: {},
+        inputs: [rest],
+        deadlineAt: "2099-01-01T00:00:00.000Z",
+        cacheKey: "k".repeat(64),
+        mode: "execute",
+    };
+}
+const writes = (files, exitCode = 0) => async ({ outputDir, log, setStage }) => {
+    setStage("running");
+    log("stdout", `token is ${TOKEN}\n`);
+    for (const [name, text] of Object.entries(files)) {
+        fs.mkdirSync(path.dirname(path.join(outputDir, name)), { recursive: true });
+        fs.writeFileSync(path.join(outputDir, name), text);
+    }
+    return { exitCode, runtime: { dependencyFreeze: ["x==1"], pythonVersion: "3.11" } };
+};
+async function untilDone(client, runId = RUN) {
+    for (let i = 0; i < 200; i += 1) {
+        const snapshot = await client.status(runId);
+        if (snapshot.state !== "running")
+            return snapshot;
+        await new Promise((resolve) => setTimeout(resolve, 5));
+    }
+    throw new Error("job did not finish");
+}
+describe("worker server + client", () => {
+    it("requires the job token on every route and refuses plaintext non-loopback endpoints", async () => {
+        const { client, endpoint } = await boot(writes({}));
+        await expect(client({ token: "wrong-token-wrong-token" }).health()).rejects.toMatchObject({ code: "CLOUD_WORKER_AUTH_FAILED" });
+        await expect(client().health()).resolves.toMatchObject({ contract: 1 });
+        expect(() => new WorkerClient({ endpoint: "http://example.com", token: TOKEN })).toThrow(/HTTPS/);
+        expect(() => new WorkerClient({ endpoint: endpoint, token: TOKEN })).toThrow(/HTTPS/); // loopback http only when explicitly allowed
+    });
+    it("runs the full flow: verified upload, status with log cursor, inventory and verified collection", async () => {
+        const { client } = await boot(writes({ "boltz_results_in/predictions/a/a_model_0.cif": "CIF-DATA", "conf.json": "{}" }));
+        const c = client();
+        const input = inputFile();
+        await c.uploadInput(RUN, input);
+        await c.start(wire(input));
+        const done = await untilDone(c);
+        expect(done).toMatchObject({ state: "succeeded", exitCode: 0, runtime: { pythonVersion: "3.11" } });
+        expect(done.logs.stdout).not.toContain(TOKEN);
+        expect(done.logs.stdout).toContain("[REDACTED]");
+        expect((await c.status(RUN, done.logs.cursor)).logs.stdout).toBe("");
+        const out = tmp();
+        const inventory = await c.collect(RUN, out);
+        expect(inventory.files.map((file) => file.path)).toEqual(["boltz_results_in/predictions/a/a_model_0.cif", "conf.json"]);
+        expect(fs.readFileSync(path.join(out, "boltz_results_in/predictions/a/a_model_0.cif"), "utf8")).toBe("CIF-DATA");
+        expect(fs.readdirSync(out).filter((name) => name.startsWith(".moldesk-staging"))).toEqual([]);
+    });
+    it("rejects an upload whose bytes do not match the declared SHA-256 and a start with missing inputs", async () => {
+        const { client } = await boot(writes({}));
+        const c = client();
+        const input = inputFile();
+        await expect(c.uploadInput(RUN, { ...input, sha256: sha("something else") })).rejects.toMatchObject({ code: "CLOUD_WORKER_ERROR" });
+        await expect(c.start(wire(input))).rejects.toThrow(/was not uploaded/);
+    });
+    it("serves one job per worker", async () => {
+        const { client } = await boot(writes({ "o.txt": "x" }));
+        const c = client();
+        const input = inputFile();
+        await c.uploadInput(RUN, input);
+        await c.start(wire(input));
+        await expect(c.start(wire(input))).rejects.toThrow(/already started/);
+        await expect(c.status("other-run")).rejects.toThrow(/different job/);
+    });
+    it("reports a failing pipeline with its error and nonzero exit", async () => {
+        const { client } = await boot(async () => {
+            throw Object.assign(new Error(`boom ${TOKEN}`), { code: "INSTALL_VERIFICATION_FAILED" });
+        });
+        const c = client();
+        const input = inputFile();
+        await c.uploadInput(RUN, input);
+        await c.start(wire(input));
+        const done = await untilDone(c);
+        expect(done.state).toBe("failed");
+        expect(done.error?.code).toBe("INSTALL_VERIFICATION_FAILED");
+        expect(done.error?.message).not.toContain(TOKEN);
+    });
+    it("cancels a running job", async () => {
+        const { client } = await boot(({ signal }) => new Promise((_resolve, reject) => signal.addEventListener("abort", () => reject(new Error("aborted")))));
+        const c = client();
+        const input = inputFile();
+        await c.uploadInput(RUN, input);
+        await c.start(wire(input));
+        await c.cancel(RUN);
+        expect((await untilDone(c)).state).toBe("cancelled");
+    });
+    it("withholds results until the job finishes", async () => {
+        const { client } = await boot(({ signal }) => new Promise((_resolve, reject) => signal.addEventListener("abort", () => reject(new Error("x")))));
+        const c = client();
+        const input = inputFile();
+        await c.uploadInput(RUN, input);
+        await c.start(wire(input));
+        await expect(c.inventory(RUN)).rejects.toThrow(/has not finished/);
+    });
+    it("does not follow symlinks out of the output directory", async () => {
+        const secret = path.join(tmp(), "secret.txt");
+        fs.writeFileSync(secret, "TOP SECRET");
+        const { client, endpoint } = await boot(async ({ outputDir }) => {
+            fs.writeFileSync(path.join(outputDir, "ok.txt"), "fine");
+            fs.symlinkSync(secret, path.join(outputDir, "leak.txt"));
+            return { exitCode: 0 };
+        });
+        const c = client();
+        const input = inputFile();
+        await c.uploadInput(RUN, input);
+        await c.start(wire(input));
+        await untilDone(c);
+        expect((await c.inventory(RUN)).files.map((file) => file.path)).toEqual(["ok.txt"]);
+        for (const route of ["leak.txt", "..%2F..%2Fetc%2Fpasswd"]) {
+            const response = await fetch(`${endpoint}/v1/jobs/${RUN}/files/${route}`, { headers: { Authorization: `Bearer ${TOKEN}` } });
+            expect([400, 404]).toContain(response.status);
+            expect(await response.text()).not.toContain("TOP SECRET");
+        }
+    });
+    it("rejects corrupted downloads instead of accepting them, and promotes nothing", async () => {
+        const { client } = await boot(writes({ "a.txt": "AAAA", "b.txt": "BBBB" }));
+        const corrupting = async (input, init) => {
+            const response = await fetch(input, init);
+            if (String(input).includes("/files/b.txt"))
+                return new Response("XXXX", { status: 200, headers: { "Content-Length": "4" } });
+            return response;
+        };
+        const c = client({ fetch: corrupting });
+        const input = inputFile();
+        await c.uploadInput(RUN, input);
+        await c.start(wire(input));
+        await untilDone(c);
+        const out = tmp();
+        await expect(c.collect(RUN, out)).rejects.toMatchObject({ code: "CLOUD_TRANSFER_CORRUPT" });
+        expect(fs.readdirSync(out)).toEqual([]);
+    });
+    it("resumes an interrupted download by byte range and re-verifies the whole file", async () => {
+        const payload = "0123456789".repeat(50);
+        const { client } = await boot(writes({ "big.bin": payload }));
+        let interrupted = false;
+        let sentFirst = false;
+        const ranges = [];
+        const flaky = async (input, init) => {
+            const headers = new Headers(init?.headers);
+            if (String(input).includes("/files/big.bin"))
+                ranges.push(headers.get("range"));
+            const response = await fetch(input, init);
+            if (String(input).includes("/files/big.bin") && !interrupted) {
+                interrupted = true;
+                const bytes = Buffer.from(await response.arrayBuffer());
+                return new Response(new ReadableStream({
+                    async pull(controller) {
+                        if (!sentFirst) {
+                            sentFirst = true;
+                            controller.enqueue(bytes.subarray(0, 100));
+                        }
+                        else {
+                            await new Promise((resolve) => setTimeout(resolve, 30)); // let the reader consume the first chunk
+                            controller.error(new Error("connection reset"));
+                        }
+                    },
+                }), { status: 200 });
+            }
+            return response;
+        };
+        const c = client({ fetch: flaky });
+        const input = inputFile();
+        await c.uploadInput(RUN, input);
+        await c.start(wire(input));
+        await untilDone(c);
+        const out = tmp();
+        await c.collect(RUN, out);
+        expect(fs.readFileSync(path.join(out, "big.bin"), "utf8")).toBe(payload);
+        expect(ranges).toEqual([null, "bytes=100-"]);
+    });
+    it("refuses to overwrite an existing local output", async () => {
+        const { client } = await boot(writes({ "a.txt": "A" }));
+        const c = client();
+        const input = inputFile();
+        await c.uploadInput(RUN, input);
+        await c.start(wire(input));
+        await untilDone(c);
+        const out = tmp();
+        fs.writeFileSync(path.join(out, "a.txt"), "existing");
+        await expect(c.collect(RUN, out)).rejects.toMatchObject({ code: "CLOUD_OUTPUT_COLLISION" });
+        expect(fs.readFileSync(path.join(out, "a.txt"), "utf8")).toBe("existing");
+    });
+});
+/** A body that yields `first` and then never delivers or ends (a stalled connection); like real fetch, aborting the request errors it. */
+function stalledBody(first, signal) {
+    let sent = false;
+    return new ReadableStream({
+        start(controller) {
+            signal?.addEventListener("abort", () => controller.error(new DOMException("aborted", "AbortError")), { once: true });
+        },
+        pull(controller) {
+            if (!sent) {
+                sent = true;
+                controller.enqueue(first);
+                return undefined;
+            }
+            return new Promise(() => undefined); // never resolves
+        },
+    });
+}
+describe("timeouts and cancellation while streaming", () => {
+    const payload = "0123456789".repeat(50);
+    async function finishedJob(overrides, wrap) {
+        const { client } = await boot(writes({ "big.bin": payload }));
+        const setup = client();
+        const input = inputFile();
+        await setup.uploadInput(RUN, input);
+        await setup.start(wire(input));
+        await untilDone(setup);
+        const real = fetch;
+        return client({ ...overrides, ...(wrap ? { fetch: wrap(real) } : {}) });
+    }
+    it("recovers from a stalled download by resuming from the bytes already received", async () => {
+        const ranges = [];
+        let stalled = false;
+        const c = await finishedJob({ idleTimeoutMs: 400 }, (real) => async (input, init) => {
+            if (String(input).includes("/files/big.bin"))
+                ranges.push(new Headers(init?.headers).get("range"));
+            const response = await real(input, init);
+            if (String(input).includes("/files/big.bin") && !stalled) {
+                stalled = true;
+                const bytes = new Uint8Array(await response.arrayBuffer());
+                return new Response(stalledBody(bytes.subarray(0, 100), init?.signal), { status: 200 });
+            }
+            return response;
+        });
+        const out = tmp();
+        await c.collect(RUN, out);
+        expect(fs.readFileSync(path.join(out, "big.bin"), "utf8")).toBe(payload);
+        expect(ranges).toEqual([null, "bytes=100-"]);
+    });
+    it("gives up on a download that keeps stalling instead of hanging, and promotes nothing", async () => {
+        const c = await finishedJob({ idleTimeoutMs: 40 }, (real) => async (input, init) => {
+            const response = await real(input, init);
+            if (!String(input).includes("/files/big.bin"))
+                return response;
+            return new Response(stalledBody(new Uint8Array(await response.arrayBuffer()).subarray(0, 10), init?.signal), { status: 200 });
+        });
+        const out = tmp();
+        const started = Date.now();
+        await expect(c.collect(RUN, out)).rejects.toMatchObject({ code: "CLOUD_TRANSFER_FAILED", message: expect.stringMatching(/stalled/) });
+        expect(Date.now() - started).toBeLessThan(3000);
+        expect(fs.readdirSync(out)).toEqual([]);
+    });
+    it("cancellation interrupts a stalled body immediately, not after the idle timeout", async () => {
+        const controller = new AbortController();
+        const c = await finishedJob({ idleTimeoutMs: 60_000 }, (real) => async (input, init) => {
+            const response = await real(input, init);
+            if (!String(input).includes("/files/big.bin"))
+                return response;
+            return new Response(stalledBody(new Uint8Array(await response.arrayBuffer()).subarray(0, 10), init?.signal), { status: 200 });
+        });
+        const out = tmp();
+        setTimeout(() => controller.abort(), 30);
+        const started = Date.now();
+        await expect(c.collect(RUN, out, { signal: controller.signal })).rejects.toMatchObject({ code: "RUN_CANCELLED" });
+        expect(Date.now() - started).toBeLessThan(2000);
+        expect(fs.readdirSync(out)).toEqual([]);
+    });
+    it("times out a JSON response whose body never finishes", async () => {
+        const { client } = await boot(writes({}));
+        const c = client({
+            requestTimeoutMs: 50,
+            fetch: async (_input, init) => new Response(stalledBody(new TextEncoder().encode('{"stage":'), init?.signal), { status: 200 }),
+        });
+        await expect(c.status(RUN)).rejects.toMatchObject({ code: "CLOUD_WORKER_TIMEOUT" });
+    });
+    it("a client-level signal cancels in-flight JSON requests too", async () => {
+        const controller = new AbortController();
+        const { client } = await boot(writes({}));
+        const c = client({ signal: controller.signal, requestTimeoutMs: 60_000, fetch: async (_input, init) => new Response(stalledBody(new TextEncoder().encode("{"), init?.signal), { status: 200 }) });
+        setTimeout(() => controller.abort(), 20);
+        await expect(c.status(RUN)).rejects.toMatchObject({ code: "RUN_CANCELLED" });
+    });
+});
+describe("bounded log tail", () => {
+    const chatty = async ({ log }) => {
+        for (let i = 1; i <= 20; i += 1)
+            log("stdout", `line-${String(i).padStart(2, "0")}-${"x".repeat(90)}\n`); // ~100 bytes each
+        return { exitCode: 0 };
+    };
+    it("reports exactly how many chunks a late reader missed, and keeps the newest", async () => {
+        const { client } = await boot(chatty, TOKEN, 450);
+        const c = client();
+        const input = inputFile();
+        await c.uploadInput(RUN, input);
+        await c.start(wire(input));
+        await untilDone(c);
+        const all = await c.status(RUN, 0);
+        const retained = all.logs.stdout.split("\n").filter(Boolean);
+        expect(retained.length).toBeGreaterThan(0);
+        expect(retained.length).toBeLessThan(20);
+        expect(retained.at(-1)).toContain("line-20");
+        expect(all.logs.lostEntries).toBe(20 - retained.length);
+        expect(all.logs.evictedBytes).toBeGreaterThanOrEqual((20 - retained.length) * 99);
+        expect(all.logs.cursor).toBe(20);
+    });
+    it("reports nothing lost to a reader that kept up, or one that is partly behind", async () => {
+        const { client } = await boot(chatty, TOKEN, 450);
+        const c = client();
+        const input = inputFile();
+        await c.uploadInput(RUN, input);
+        await c.start(wire(input));
+        await untilDone(c);
+        const retainedCount = (await c.status(RUN, 0)).logs.stdout.split("\n").filter(Boolean).length;
+        expect((await c.status(RUN, 20)).logs.lostEntries).toBeUndefined();
+        // A reader positioned exactly at the oldest retained chunk lost nothing.
+        expect((await c.status(RUN, 20 - retainedCount)).logs.lostEntries).toBeUndefined();
+        // One chunk earlier and exactly one chunk was missed.
+        expect((await c.status(RUN, 20 - retainedCount - 1)).logs.lostEntries).toBe(1);
+    });
+    it("never reports loss when the buffer was not exceeded", async () => {
+        const { client } = await boot(chatty, TOKEN, 1_000_000);
+        const c = client();
+        const input = inputFile();
+        await c.uploadInput(RUN, input);
+        await c.start(wire(input));
+        await untilDone(c);
+        const all = await c.status(RUN, 0);
+        expect(all.logs.lostEntries).toBeUndefined();
+        expect(all.logs.stdout.split("\n").filter(Boolean)).toHaveLength(20);
+    });
+});
+describe("validateInventory", () => {
+    const entry = (p) => ({ path: p, sizeBytes: 1, sha256: "a".repeat(64) });
+    it("rejects traversal, absolute, backslash, duplicate and malformed entries", () => {
+        for (const bad of ["../x", "/abs", "a\\b", "a//b", "./a", ""]) {
+            expect(() => validateInventory({ version: 1, files: [entry(bad)] })).toThrow(/unsafe or malformed/);
+        }
+        expect(() => validateInventory({ version: 1, files: [entry("A.txt"), entry("a.TXT")] })).toThrow(/more than once/);
+        expect(() => validateInventory({ version: 1, files: [{ path: "a", sizeBytes: -1, sha256: "a".repeat(64) }] })).toThrow();
+        expect(() => validateInventory({ version: 2, files: [] })).toThrow(/invalid inventory/);
+        expect(() => validateInventory({ version: 1, files: [entry("ok/a.txt"), entry("b")] })).not.toThrow();
+    });
+});

package/dist/cloud/worker/watchdog.d.ts

@@ -0,0 +1,27 @@
+/**
+ * In-Pod deadline watchdog. It terminates the Pod it runs in at the approved deadline using the
+ * Pod-scoped key Runpod injects (RUNPOD_API_KEY / RUNPOD_POD_ID), which was observed to terminate
+ * only its own Pod. Best effort only: it cannot help when the container never boots or the key is
+ * not injected, and its expiry behavior is unverified (docs/runpod-spike-findings.md). The user is
+ * told, before approving, that automatic shutdown is not guaranteed.
+ */
+export interface WatchdogOptions {
+    deadlineAt: string;
+    podId: string;
+    /** Pod-scoped key; never the account key and never logged. */
+    apiKey: string;
+    baseUrl?: string;
+    fetch?: typeof fetch;
+    now?: () => number;
+    setTimer?: (callback: () => void, ms: number) => {
+        unref?: () => void;
+    } | unknown;
+    retryMs?: number;
+    log?: (message: string) => void;
+}
+export interface Watchdog {
+    /** Resolves after a termination request was accepted (2xx or 404). */
+    done: Promise<void>;
+    stop(): void;
+}
+export declare function startDeadlineWatchdog(options: WatchdogOptions): Watchdog;

package/dist/cloud/worker/watchdog.js

@@ -0,0 +1,46 @@
+export function startDeadlineWatchdog(options) {
+    const fetchFn = options.fetch ?? fetch;
+    const now = options.now ?? Date.now;
+    const base = options.baseUrl ?? "https://api.runpod.io/v2";
+    const retryMs = options.retryMs ?? 30_000;
+    const setTimer = options.setTimer ?? ((callback, ms) => setTimeout(callback, ms));
+    const log = options.log ?? (() => undefined);
+    let stopped = false;
+    let resolveDone;
+    const done = new Promise((resolve) => {
+        resolveDone = resolve;
+    });
+    const attempt = async () => {
+        if (stopped)
+            return;
+        try {
+            const response = await fetchFn(`${base}/pods/${encodeURIComponent(options.podId)}/action`, {
+                method: "POST",
+                headers: { Authorization: `Bearer ${options.apiKey}`, "Content-Type": "application/json", "User-Agent": "moldesk-watchdog/1" },
+                body: JSON.stringify({ action: "terminate" }),
+            });
+            if (response.ok || response.status === 404) {
+                log(`deadline reached; termination requested (status ${response.status})`);
+                return resolveDone();
+            }
+            log(`termination attempt failed with status ${response.status}`);
+        }
+        catch {
+            log("termination attempt failed (network)");
+        }
+        schedule(retryMs);
+    };
+    function schedule(ms) {
+        const timer = setTimer(() => void attempt(), ms);
+        // Must keep the process alive until it fires; never unref.
+        void timer;
+    }
+    const remaining = Date.parse(options.deadlineAt) - now();
+    schedule(Math.max(0, remaining));
+    return {
+        done,
+        stop: () => {
+            stopped = true;
+        },
+    };
+}

package/dist/cloud/worker-release.d.ts

@@ -0,0 +1,12 @@
+import type { WorkerBundle } from "@moldesk/runtime";
+/**
+ * The published, checksummed worker bundle matching this release. Intentionally unset until a
+ * release bundle has been built, published and validated on a clean machine; cloud runs refuse to
+ * start without one. See packages/core/scripts/build-worker.mjs.
+ */
+export declare const RELEASED_WORKER_BUNDLE: WorkerBundle | undefined;
+/**
+ * Environment override for development and self-hosting: both values are required, the URL must be
+ * HTTPS and the checksum a full SHA-256, so a bundle is never fetched without verification.
+ */
+export declare function resolveWorkerBundle(env?: NodeJS.ProcessEnv): WorkerBundle | undefined;

package/dist/cloud/worker-release.js

@@ -0,0 +1,25 @@
+import { MoldeskError } from "../errors.js";
+/**
+ * The published, checksummed worker bundle matching this release. Intentionally unset until a
+ * release bundle has been built, published and validated on a clean machine; cloud runs refuse to
+ * start without one. See packages/core/scripts/build-worker.mjs.
+ */
+export const RELEASED_WORKER_BUNDLE = undefined;
+/**
+ * Environment override for development and self-hosting: both values are required, the URL must be
+ * HTTPS and the checksum a full SHA-256, so a bundle is never fetched without verification.
+ */
+export function resolveWorkerBundle(env = process.env) {
+    const url = env.MOLDESK_WORKER_BUNDLE_URL;
+    const sha256 = env.MOLDESK_WORKER_BUNDLE_SHA256;
+    if (url === undefined && sha256 === undefined)
+        return RELEASED_WORKER_BUNDLE;
+    if (!url || !sha256 || !/^https:\/\//.test(url) || !/^[0-9a-f]{64}$/i.test(sha256)) {
+        throw new MoldeskError({
+            code: "CLOUD_WORKER_BUNDLE_INVALID",
+            message: "MOLDESK_WORKER_BUNDLE_URL and MOLDESK_WORKER_BUNDLE_SHA256 must both be set, with an https URL and a 64-character SHA-256.",
+            remediation: "Set both variables, or unset them to use the bundle published with this release.",
+        });
+    }
+    return { url, sha256: sha256.toLowerCase() };
+}

package/dist/cloud/worker-release.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cloud/worker-release.test.js

@@ -0,0 +1,21 @@
+import { describe, expect, it } from "vitest";
+import { RELEASED_WORKER_BUNDLE, resolveWorkerBundle } from "./worker-release.js";
+describe("resolveWorkerBundle", () => {
+    it("has no released bundle yet, so cloud runs refuse by default", () => {
+        expect(RELEASED_WORKER_BUNDLE).toBeUndefined();
+        expect(resolveWorkerBundle({})).toBeUndefined();
+    });
+    it("accepts an https URL with a SHA-256 override and normalizes case", () => {
+        expect(resolveWorkerBundle({ MOLDESK_WORKER_BUNDLE_URL: "https://example.com/w.tgz", MOLDESK_WORKER_BUNDLE_SHA256: "A".repeat(64) })).toEqual({ url: "https://example.com/w.tgz", sha256: "a".repeat(64) });
+    });
+    it("rejects partial, non-https or unverifiable overrides", () => {
+        for (const env of [
+            { MOLDESK_WORKER_BUNDLE_URL: "https://example.com/w.tgz" },
+            { MOLDESK_WORKER_BUNDLE_SHA256: "a".repeat(64) },
+            { MOLDESK_WORKER_BUNDLE_URL: "http://example.com/w.tgz", MOLDESK_WORKER_BUNDLE_SHA256: "a".repeat(64) },
+            { MOLDESK_WORKER_BUNDLE_URL: "https://example.com/w.tgz", MOLDESK_WORKER_BUNDLE_SHA256: "short" },
+        ]) {
+            expect(() => resolveWorkerBundle(env)).toThrow(expect.objectContaining({ code: "CLOUD_WORKER_BUNDLE_INVALID" }));
+        }
+    });
+});

package/dist/index.d.ts

@@ -1,6 +1,7 @@
-export { collectSystemReport, getSystemReport, isImageCachedLocally, pullDockerImage, probeDockerGpuAccess, } from "@moldesk/runtime";
+export { collectSystemReport, getSystemReport, isImageCachedLocally, pullDockerImage, probeDockerGpuAccess, CredentialStore, getMoldeskPaths, } from "@moldesk/runtime";
+export type { CloudPod, CloudProvider, CloudVolume, SecretBackend } from "@moldesk/runtime";
 export type { DiskInfo, DockerCapability, NvidiaCapability, NvidiaGpu, SystemReport, SystemReportDeps, ToolCapability, } from "@moldesk/runtime";
-export { listAvailableModels } from "@moldesk/registry";
+export { listAvailableModels, parseManifest } from "@moldesk/registry";
 export type { AssetSpec, CommandSpec, HardwareRequirements, InputSpec, ModelManifestV1, ModelStatus, OutputSpec, PlatformId, PostInstallHook, PythonRequirement, PythonRuntimeSpec, RuntimeKind, RuntimeSpec, SourceSpec, } from "@moldesk/registry";
 export { detectHostPlatformId, selectPythonRuntime } from "@moldesk/registry";
 export { MoldeskError } from "./errors.js";
@@ -11,8 +12,21 @@ export { listInstalledModels, } from "./install-state.js";
 export type { InstalledModel, InstalledPostInstallResult } from "./install-state.js";
 export { createInstallationPlan, installModel, INSTALL_CONFIRMATION_DISK_BYTES, INSTALL_CONFIRMATION_DOWNLOAD_BYTES, requiresInstallConfirmation, runtimeFingerprint, uninstallModel, } from "./installation.js";
 export type { InstallationPlanResult, InstallCostEstimate, InstallModelOptions, InstallModelResult, UninstallModelOptions, } from "./installation.js";
+export { CloudJournal, cloudResourceName } from "./cloud/state.js";
+export type { CloudCacheRecord, CloudCacheState, CloudCachePolicy, CloudJobRecord, CloudJobStage, CloudJobStatus, CloudResourceRecord, CloudResourceRole, CloudResourceState, NewCloudJob, ProviderResourceView, ReconciliationReport, } from "./cloud/state.js";
+export { connectCloudProvider, defaultProviderFactory, disconnectCloudProvider, getCloudStatus, listCloudResources, } from "./cloud/accounts.js";
+export type { CloudAccountDeps, CloudProviderFactory, CloudResourceListing, CloudStatus, ConnectResult, } from "./cloud/accounts.js";
+export { planCloudRun, runCloudModel, confirmRunResourcesGone } from "./cloud/run.js";
+export type { CleanupOutcome, CloudPlan, CloudQuoteOptions, CloudRunDeps, CloudRunModelOptions, CloudRunOptions, ResolvedModel, } from "./cloud/run.js";
+export { assertApprovalValid, buildQuote, APPROVAL_MAX_AGE_MS, DEFAULT_MAX_LIFETIME_SECONDS, LIFETIME_RISK_WARNING, STORAGE_CHARGES_WARNING } from "./cloud/quote.js";
+export type { CloudAcknowledgment, CloudApproval, CloudQuote, QuoteInputs, QuoteRange, QuoteWarning } from "./cloud/quote.js";
+export { executeCloudCacheDeletion, listCloudCaches, planCloudCacheDeletion, recoverCloudRun } from "./cloud/manage.js";
+export type { CacheDeletionPlan, CacheDeletionResult, CloudCacheListing, RecoverDeps, RecoverResult } from "./cloud/manage.js";
+export { createRunpodCloudDeps } from "./cloud/deps.js";
+export type { RunpodDepsOptions } from "./cloud/deps.js";
+export { resolveWorkerBundle } from "./cloud/worker-release.js";
 export { runModel } from "./run.js";
-export type { RunArtifact, RunModelOptions, RunModelResult, RunRecord, RunWarning } from "./run.js";
+export type { RunArtifact, RunCompute, RunModelOptions, RunModelResult, RunRecord, RunWarning } from "./run.js";
 export { openInBrowser } from "@moldesk/runtime";
 export type { OpenResult } from "@moldesk/runtime";
 export { applyReportUpdate, asMoldeskError, createStandaloneReport, prepareReportUpdate } from "./visualization.js";

package/dist/index.js

@@ -1,10 +1,17 @@
-export { collectSystemReport, getSystemReport, isImageCachedLocally, pullDockerImage, probeDockerGpuAccess, } from "@moldesk/runtime";
-export { listAvailableModels } from "@moldesk/registry";
+export { collectSystemReport, getSystemReport, isImageCachedLocally, pullDockerImage, probeDockerGpuAccess, CredentialStore, getMoldeskPaths, } from "@moldesk/runtime";
+export { listAvailableModels, parseManifest } from "@moldesk/registry";
 export { detectHostPlatformId, selectPythonRuntime } from "@moldesk/registry";
 export { MoldeskError } from "./errors.js";
 export { evaluateCompatibility, shortReason } from "./compatibility.js";
 export { listInstalledModels, } from "./install-state.js";
 export { createInstallationPlan, installModel, INSTALL_CONFIRMATION_DISK_BYTES, INSTALL_CONFIRMATION_DOWNLOAD_BYTES, requiresInstallConfirmation, runtimeFingerprint, uninstallModel, } from "./installation.js";
+export { CloudJournal, cloudResourceName } from "./cloud/state.js";
+export { connectCloudProvider, defaultProviderFactory, disconnectCloudProvider, getCloudStatus, listCloudResources, } from "./cloud/accounts.js";
+export { planCloudRun, runCloudModel, confirmRunResourcesGone } from "./cloud/run.js";
+export { assertApprovalValid, buildQuote, APPROVAL_MAX_AGE_MS, DEFAULT_MAX_LIFETIME_SECONDS, LIFETIME_RISK_WARNING, STORAGE_CHARGES_WARNING } from "./cloud/quote.js";
+export { executeCloudCacheDeletion, listCloudCaches, planCloudCacheDeletion, recoverCloudRun } from "./cloud/manage.js";
+export { createRunpodCloudDeps } from "./cloud/deps.js";
+export { resolveWorkerBundle } from "./cloud/worker-release.js";
 export { runModel } from "./run.js";
 export { openInBrowser } from "@moldesk/runtime";
 export { applyReportUpdate, asMoldeskError, createStandaloneReport, prepareReportUpdate } from "./visualization.js";

package/dist/run-lifecycle.d.ts

@@ -0,0 +1,74 @@
+import { type ModelAdapterDefinition, type ResolveParamDefaultsContext, type RunContext } from "@moldesk/adapters";
+import type { ModelManifestV1, RuntimeKind } from "@moldesk/registry";
+import { type MoldeskPaths } from "@moldesk/runtime";
+import type { RunModelResult, RunRecord } from "./run.js";
+export declare function toErrorInfo(error: unknown, fallbackCode: string): {
+    code: string;
+    message: string;
+};
+export declare function writeRunRecord(runDirPath: string, record: RunRecord): void;
+export interface PreparedRunParams {
+    suppliedParams: Record<string, string>;
+    effectiveParams: Record<string, unknown>;
+}
+/**
+ * Step 3 shared by local and cloud runs: applies platform-dependent adapter defaults (an explicit
+ * `--param` always wins), then validates. Rejects with INVALID_RUN_PARAMS before any run directory exists.
+ */
+export declare function prepareRunParams(adapter: ModelAdapterDefinition, manifestName: string, installed: ResolveParamDefaultsContext["installed"], params: Record<string, string> | undefined): PreparedRunParams;
+export interface RunDirectories {
+    runId: string;
+    runDirPath: string;
+    inputDir: string;
+    outputDir: string;
+}
+/** Allocates the run ID and its `input/` and `output/` directories. */
+export declare function allocateRunDirectory(paths: MoldeskPaths): RunDirectories;
+export interface CreateRunSnapshotParams {
+    dirs: RunDirectories;
+    manifest: ModelManifestV1;
+    adapter: ModelAdapterDefinition;
+    runtime: RuntimeKind;
+    installationFingerprint: string;
+    resolvedInputPath: string;
+    suppliedParams: Record<string, unknown>;
+    effectiveParams: Record<string, unknown>;
+    signal?: AbortSignal;
+}
+export type RunSnapshot = {
+    ok: true;
+    record: RunRecord;
+    startedAt: string;
+    storedInputPath: string;
+    companionInputs: Array<{
+        id: string;
+        path: string;
+    }>;
+}
+/** Snapshotting failed after the run directory was allocated; `record` is already finalized on disk. */
+ | {
+    ok: false;
+    record: RunRecord;
+};
+/**
+ * Copies and hashes the job input (and declared companion inputs), captures hardware, and writes
+ * the initial `preparing` record. A failure here finalizes `run.json` as failed/cancelled instead
+ * of rejecting, since the run directory already exists.
+ */
+export declare function createRunSnapshot(params: CreateRunSnapshotParams): Promise<RunSnapshot>;
+/** Checksums and sizes the adapter's collected outputs (spec step 12). */
+export declare function collectRunOutputs(adapter: ModelAdapterDefinition, context: RunContext): Promise<RunRecord["outputs"]>;
+export interface FinalizeRunParams {
+    adapter: ModelAdapterDefinition;
+    context: RunContext;
+    runDirPath: string;
+    record: RunRecord;
+    startedAt: string;
+    signal?: AbortSignal;
+    /** Create the offline report for a succeeded run. Default true. */
+    visualize?: boolean;
+    /** Copy outputs here after a succeeded run; never changes the run's own status. */
+    outputDir?: string;
+}
+/** Derived report, final atomic `run.json` write, and the post-finalization `--output` copy. */
+export declare function finalizeRun(params: FinalizeRunParams): Promise<RunModelResult>;