@nodetool-ai/websocket 0.7.0-rc.22 → 0.8.1

package/dist/lib/app-deployment-service.js

@@ -0,0 +1,282 @@
+/**
+ * Serving a mini app from a hidden URL, with no login.
+ *
+ * Two audiences, kept apart on purpose. The **owner** deploys and withdraws
+ * the link through their authenticated session, and is the only one who ever
+ * sees the token. The **visitor** presents the token and gets exactly two
+ * things: the app's released snapshot, and a short-lived session token that
+ * may run that release and nothing else.
+ *
+ * Every failure a visitor can reach answers the same way — 404, "This app is
+ * not available" — whether the token was never minted, was revoked, names an
+ * app that has since been deleted, or names one that has published nothing.
+ * Distinguishing them would turn the hidden URL into an oracle for guessing
+ * the rest of them.
+ *
+ * The whole surface is production-only (`isAppDeploymentEnabled`). A local
+ * install already answers loopback as user "1" without credentials, so there
+ * a "no login needed" link is a second door onto an open house; production is
+ * where auth is enforced, where asset bytes come back as signed URLs a
+ * logged-out browser can load, and where the app's spend budget is what
+ * stands between a shared link and the owner's provider bill.
+ */
+import { operationTarget } from "@nodetool-ai/app-runtime";
+import { Application, ApplicationDeployment, getApplicationBudget, hasFiniteBudgetLimit, releasedApplicationRelease } from "@nodetool-ai/models";
+import { APP_DEPLOYMENT_SESSION_TTL_SECONDS, isAppDeploymentEnabled } from "@nodetool-ai/protocol";
+import { applicationDeployment, applicationReleaseResponse, publicApplication, publicApplicationSession } from "@nodetool-ai/protocol/api-schemas/applications.js";
+import { mintAppSessionToken } from "@nodetool-ai/auth";
+import { ZodError } from "zod";
+import { ApiErrorCode } from "../error-codes.js";
+import { throwApiError } from "../trpc/error-formatter.js";
+import { loadOwnedApplication } from "./applications-service.js";
+import { resolvePublicAppStaticAssetLocators } from "./public-app-assets.js";
+/** Whether this server offers public app deployments at all. */
+export function appDeploymentsEnabled(env = process.env) {
+    return isAppDeploymentEnabled(env["NODETOOL_ENV"]);
+}
+/** The one answer a visitor gets for every way a link can fail. */
+function notAvailable() {
+    throwApiError(ApiErrorCode.NOT_FOUND, "This app is not available");
+}
+/** A corrupt release is unavailable to a visitor, not a validation oracle. */
+function parsePublicRelease(release) {
+    try {
+        return applicationReleaseResponse.parse(release);
+    }
+    catch (error) {
+        if (error instanceof ZodError)
+            notAvailable();
+        throw error;
+    }
+}
+/**
+ * Refuse the whole surface outside production, for the owner as well as the
+ * visitor. A deploy that silently succeeded locally would hand the owner a URL
+ * that stops working the moment it matters.
+ */
+function requireEnabled() {
+    if (!appDeploymentsEnabled()) {
+        throwApiError(ApiErrorCode.FORBIDDEN, "Deploying an app to a public URL is only available on nodetool.ai");
+    }
+}
+const PUBLIC_BUDGET_REQUIRED = "Public app runs require a finite invocation or USD budget. Configure one before deploying.";
+/**
+ * Why a release cannot be served over a public link, or null when it can.
+ *
+ * A public visitor reaches exactly two things: the release payload and the
+ * websocket. Everything else — the tRPC library, the script store, the asset
+ * routes — is refused at the door, on purpose. A workflow operation is fine:
+ * the release carries its pinned graph, so nothing has to be fetched. A script
+ * operation is not: its body lives behind an authenticated call the visitor
+ * cannot make, and a run that silently did nothing would be worse than a
+ * refusal.
+ */
+export function releaseBlockedReason(release) {
+    const documentBlocked = publicReleaseDocumentBlockedReason(release.document);
+    if (documentBlocked)
+        return documentBlocked;
+    const unpinned = release.document.operations.filter((operation) => {
+        const pinned = release.workflows.find((entry) => entry.workflowId === operation.workflowId);
+        return !pinned?.graph;
+    });
+    if (unpinned.length > 0) {
+        // A snapshot published before releases pinned graphs. A draft run falls
+        // back to the live workflow; a public run must not, because "the live
+        // workflow" is the owner's editable graph and nobody chose to publish it.
+        return "This released version predates pinned graphs. Publish it again to deploy it.";
+    }
+    return null;
+}
+/** Document-level restrictions shared by draft publish and released rollback. */
+export function publicReleaseDocumentBlockedReason(document) {
+    const scripted = document.operations.filter((operation) => operationTarget(operation).kind === "script");
+    if (scripted.length > 0) {
+        return (`A public link cannot run a script operation (${scripted
+            .map((operation) => operation.name || operation.id)
+            .join(", ")}). Move the step into a workflow and publish again.`);
+    }
+    if (document.resources.length > 0) {
+        // A resource binding reads the owner's own library — their assets,
+        // timelines, storyboards, sketches. Serving that to whoever has the link
+        // is not what deploying an app means, and the session cannot make the
+        // call anyway, so the widget would sit empty.
+        return ("A public link cannot open your asset library. Remove the resource " +
+            "bindings and publish again.");
+    }
+    return null;
+}
+/** Return the reason a candidate cannot replace a live public release. */
+export async function publicReleasePreflight(applicationId, candidate) {
+    const blocked = "workflows" in candidate
+        ? releaseBlockedReason(candidate)
+        : publicReleaseDocumentBlockedReason(candidate.document);
+    if (blocked) {
+        if (blocked.includes("script operation")) {
+            return "This app has a live public link. Script operations cannot be published to that audience.";
+        }
+        if (blocked.includes("asset library")) {
+            return "This app has a live public link. Resource bindings cannot be published to that audience.";
+        }
+        return blocked;
+    }
+    return hasFiniteBudgetLimit(await getApplicationBudget(applicationId))
+        ? null
+        : "This app has a live public link. Configure a finite budget before publishing again.";
+}
+const toResponse = (deployment, blockedReason) => applicationDeployment.parse({
+    applicationId: deployment.application_id,
+    token: deployment.token,
+    createdAt: deployment.created_at,
+    revokedAt: deployment.revoked_at,
+    blockedReason
+});
+/** What the app's link would serve right now, and why it might serve nothing. */
+async function currentBlockedReason(applicationId, userId) {
+    const release = await releasedApplicationRelease(applicationId, userId);
+    if (!release)
+        return "This app has no released version to serve.";
+    const releaseBlocked = releaseBlockedReason(applicationReleaseResponse.parse(release));
+    if (releaseBlocked)
+        return releaseBlocked;
+    return hasFiniteBudgetLimit(await getApplicationBudget(applicationId))
+        ? null
+        : PUBLIC_BUDGET_REQUIRED;
+}
+/** The app's live deployment, or null when it has none. Owner only. */
+export async function getApplicationDeployment(userId, applicationId) {
+    requireEnabled();
+    await loadOwnedApplication(userId, applicationId);
+    const deployment = await ApplicationDeployment.findLive(applicationId);
+    if (!deployment)
+        return null;
+    return toResponse(deployment, await currentBlockedReason(applicationId, userId));
+}
+/**
+ * Deploy the app, returning the link — the one already out there when it has
+ * one, so re-deploying never invalidates a URL somebody pasted somewhere.
+ *
+ * An app with nothing released is refused rather than deployed dark: the
+ * public page serves the release, so a deployment without one is a link that
+ * resolves to nothing, and the owner should hear that now instead of from
+ * whoever they sent it to.
+ */
+export async function deployApplication(userId, applicationId) {
+    requireEnabled();
+    const app = await loadOwnedApplication(userId, applicationId);
+    const release = await releasedApplicationRelease(applicationId, userId);
+    if (!release) {
+        throwApiError(ApiErrorCode.INVALID_INPUT, "Publish a version of this app before deploying it");
+    }
+    // A release the public runtime cannot execute is refused now rather than
+    // deployed dark: the owner is here, and whoever they would have sent the
+    // link to is not.
+    const blocked = releaseBlockedReason(applicationReleaseResponse.parse(release));
+    if (blocked)
+        throwApiError(ApiErrorCode.INVALID_INPUT, blocked);
+    if (!hasFiniteBudgetLimit(await getApplicationBudget(applicationId))) {
+        throwApiError(ApiErrorCode.INVALID_INPUT, PUBLIC_BUDGET_REQUIRED);
+    }
+    const deployment = await ApplicationDeployment.ensure({
+        applicationId: app.id,
+        userId
+    });
+    return toResponse(deployment, null);
+}
+/**
+ * Withdraw the link. Sessions already minted keep running until they expire —
+ * they are signed, not stored — so this stops new visitors rather than
+ * interrupting one mid-run.
+ */
+export async function undeployApplication(userId, applicationId) {
+    requireEnabled();
+    await loadOwnedApplication(userId, applicationId);
+    await ApplicationDeployment.revokeAllLive(applicationId);
+    return { ok: true };
+}
+/**
+ * The deployment behind a token, with its app and current release, or the
+ * single 404 every failure shares.
+ *
+ * The release is read fresh on every request rather than pinned to the
+ * deployment: publishing a new version is how an owner updates a deployed app,
+ * and a link that kept serving the version that was current when it was minted
+ * would make publish a no-op for exactly the audience it was published for.
+ */
+async function resolveDeployment(token) {
+    // The visitor gets the same 404 for a server that does not offer
+    // deployments as for a token that was never minted. `requireEnabled`'s
+    // explanation is for the owner, who is asking about their own app; telling
+    // a stranger which servers have the surface turned off tells them where to
+    // go looking for links.
+    if (!appDeploymentsEnabled())
+        notAvailable();
+    const deployment = await ApplicationDeployment.findLiveByToken(token);
+    if (!deployment)
+        notAvailable();
+    const application = await Application.findById(deployment.application_id);
+    // The deployment cascades with its app, so a missing app here means a
+    // database that lost the cascade rather than a normal state — either way the
+    // link serves nothing.
+    if (!application || application.user_id !== deployment.user_id) {
+        notAvailable();
+    }
+    const release = await releasedApplicationRelease(deployment.application_id, deployment.user_id);
+    if (!release)
+        notAvailable();
+    // A version published after the link was minted can be one the public
+    // runtime cannot execute. The link stops serving rather than serving
+    // something that half-works; the owner sees why in `blockedReason`, and the
+    // visitor gets the same 404 every other failure gives them.
+    if (releaseBlockedReason(parsePublicRelease(release)) ||
+        !hasFiniteBudgetLimit(await getApplicationBudget(deployment.application_id))) {
+        notAvailable();
+    }
+    return { deployment, application, release };
+}
+/** What the public page renders: the app's identity and the release to run. */
+export async function getPublicApplication(token) {
+    const { application, release } = await resolveDeployment(token);
+    try {
+        const publicRelease = parsePublicRelease(release);
+        const document = {
+            ...publicRelease.document,
+            ui: await resolvePublicAppStaticAssetLocators(publicRelease.document.ui, application.user_id),
+            variables: await resolvePublicAppStaticAssetLocators(publicRelease.document.variables, application.user_id)
+        };
+        return publicApplication.parse({
+            id: application.id,
+            name: application.name,
+            description: application.description,
+            release: { ...publicRelease, document }
+        });
+    }
+    catch (error) {
+        if (error instanceof ZodError)
+            notAvailable();
+        throw error;
+    }
+}
+/**
+ * Mint the credential the public page runs on.
+ *
+ * It authenticates as the app's owner — their graphs, their keys, their
+ * budget — and carries the application id, which is what every consumer
+ * narrows on. Nothing about the visitor is recorded: a session is derived
+ * from the deployment and the clock, so it needs no row and revoking the
+ * deployment is the only state there is to change.
+ */
+export async function createPublicApplicationSession(token, signingKey) {
+    const { deployment, release } = await resolveDeployment(token);
+    const minted = mintAppSessionToken(signingKey, {
+        userId: deployment.user_id,
+        applicationId: deployment.application_id,
+        version: release.version
+    }, APP_DEPLOYMENT_SESSION_TTL_SECONDS);
+    return publicApplicationSession.parse({
+        token: minted.token,
+        expiresAt: minted.expiresAt,
+        applicationId: deployment.application_id,
+        version: release.version
+    });
+}
+//# sourceMappingURL=app-deployment-service.js.map

package/dist/lib/app-deployment-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-deployment-service.js","sourceRoot":"","sources":["../../src/lib/app-deployment-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,eAAe,EAEhB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kCAAkC,EAClC,sBAAsB,EACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,iBAAiB,EACjB,wBAAwB,EAKzB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAE/B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAE7E,gEAAgE;AAChE,MAAM,UAAU,qBAAqB,CACnC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,mEAAmE;AACnE,SAAS,YAAY;IACnB,aAAa,CAAC,YAAY,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;AACrE,CAAC;AAED,8EAA8E;AAC9E,SAAS,kBAAkB,CACzB,OAA4E;IAE5E,IAAI,CAAC;QACH,OAAO,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ;YAAE,YAAY,EAAE,CAAC;QAC9C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc;IACrB,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,aAAa,CACX,YAAY,CAAC,SAAS,EACtB,mEAAmE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,sBAAsB,GAC1B,4FAA4F,CAAC;AAS/F;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAmC;IAEnC,MAAM,eAAe,GAAG,kCAAkC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7E,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE;QAChE,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CACnC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU,CACrD,CAAC;QACF,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,wEAAwE;QACxE,sEAAsE;QACtE,0EAA0E;QAC1E,OAAO,8EAA8E,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kCAAkC,CAChD,QAA+B;IAE/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CACzC,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,QAAQ,CAC5D,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CACL,gDAAgD,QAAQ;aACrD,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,CAAC;aAClD,IAAI,CAAC,IAAI,CAAC,qDAAqD,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,mEAAmE;QACnE,yEAAyE;QACzE,sEAAsE;QACtE,8CAA8C;QAC9C,OAAO,CACL,oEAAoE;YACpE,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,aAAqB,EACrB,SAEuC;IAEvC,MAAM,OAAO,GACX,WAAW,IAAI,SAAS;QACtB,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC;QACjC,CAAC,CAAC,kCAAkC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzC,OAAO,0FAA0F,CAAC;QACpG,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACtC,OAAO,0FAA0F,CAAC;QACpG,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,oBAAoB,CAAC,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;QACpE,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,qFAAqF,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,GAAG,CACjB,UAAiC,EACjC,aAA4B,EACC,EAAE,CAC/B,qBAAqB,CAAC,KAAK,CAAC;IAC1B,aAAa,EAAE,UAAU,CAAC,cAAc;IACxC,KAAK,EAAE,UAAU,CAAC,KAAK;IACvB,SAAS,EAAE,UAAU,CAAC,UAAU;IAChC,SAAS,EAAE,UAAU,CAAC,UAAU;IAChC,aAAa;CACd,CAAC,CAAC;AAEL,iFAAiF;AACjF,KAAK,UAAU,oBAAoB,CACjC,aAAqB,EACrB,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC,OAAO;QAAE,OAAO,4CAA4C,CAAC;IAClE,MAAM,cAAc,GAAG,oBAAoB,CACzC,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,CAC1C,CAAC;IACF,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAC1C,OAAO,oBAAoB,CAAC,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;QACpE,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,sBAAsB,CAAC;AAC7B,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,aAAqB;IAErB,cAAc,EAAE,CAAC;IACjB,MAAM,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACvE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,UAAU,CACf,UAAU,EACV,MAAM,oBAAoB,CAAC,aAAa,EAAE,MAAM,CAAC,CAClD,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,aAAqB;IAErB,cAAc,EAAE,CAAC;IACjB,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,aAAa,CACX,YAAY,CAAC,aAAa,EAC1B,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,yEAAyE;IACzE,kBAAkB;IAClB,MAAM,OAAO,GAAG,oBAAoB,CAClC,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,CAC1C,CAAC;IACF,IAAI,OAAO;QAAE,aAAa,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,oBAAoB,CAAC,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QACrE,aAAa,CAAC,YAAY,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC;QACpD,aAAa,EAAE,GAAG,CAAC,EAAE;QACrB,MAAM;KACP,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,aAAqB;IAErB,cAAc,EAAE,CAAC;IACjB,MAAM,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAClD,MAAM,qBAAqB,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;IACzD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,iBAAiB,CAAC,KAAa;IAK5C,iEAAiE;IACjE,uEAAuE;IACvE,2EAA2E;IAC3E,2EAA2E;IAC3E,wBAAwB;IACxB,IAAI,CAAC,qBAAqB,EAAE;QAAE,YAAY,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,CAAC,UAAU;QAAE,YAAY,EAAE,CAAC;IAChC,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IAC1E,sEAAsE;IACtE,6EAA6E;IAC7E,uBAAuB;IACvB,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;QAC/D,YAAY,EAAE,CAAC;IACjB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAC9C,UAAU,CAAC,cAAc,EACzB,UAAU,CAAC,OAAO,CACnB,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,YAAY,EAAE,CAAC;IAC7B,sEAAsE;IACtE,qEAAqE;IACrE,4EAA4E;IAC5E,4DAA4D;IAC5D,IACE,oBAAoB,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC,oBAAoB,CACnB,MAAM,oBAAoB,CAAC,UAAU,CAAC,cAAc,CAAC,CACtD,EACD,CAAC;QACD,YAAY,EAAE,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa;IAEb,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG;YACf,GAAG,aAAa,CAAC,QAAQ;YACzB,EAAE,EAAE,MAAM,mCAAmC,CAC3C,aAAa,CAAC,QAAQ,CAAC,EAAE,EACzB,WAAW,CAAC,OAAO,CACpB;YACD,SAAS,EAAE,MAAM,mCAAmC,CAClD,aAAa,CAAC,QAAQ,CAAC,SAAS,EAChC,WAAW,CAAC,OAAO,CACpB;SACF,CAAC;QACF,OAAO,iBAAiB,CAAC,KAAK,CAAC;YAC7B,EAAE,EAAE,WAAW,CAAC,EAAE;YAClB,IAAI,EAAE,WAAW,CAAC,IAAI;YACtB,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,OAAO,EAAE,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE;SACxC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ;YAAE,YAAY,EAAE,CAAC;QAC9C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAa,EACb,UAA2B;IAE3B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,mBAAmB,CAChC,UAAU,EACV;QACE,MAAM,EAAE,UAAU,CAAC,OAAO;QAC1B,aAAa,EAAE,UAAU,CAAC,cAAc;QACxC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,EACD,kCAAkC,CACnC,CAAC;IACF,OAAO,wBAAwB,CAAC,KAAK,CAAC;QACpC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa,EAAE,UAAU,CAAC,cAAc;QACxC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/app-run-server.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The kernel runner every server-side app simulation uses. It moved to
+ * `@nodetool-ai/execution/service`; this module is the server's import site.
+ */
+export { createAppServerRunner } from "@nodetool-ai/execution/service";
+export type { AppServerRunnerOptions } from "@nodetool-ai/execution/service";
+//# sourceMappingURL=app-run-server.d.ts.map

package/dist/lib/app-run-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-run-server.d.ts","sourceRoot":"","sources":["../../src/lib/app-run-server.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,YAAY,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/lib/app-run-server.js

@@ -0,0 +1,6 @@
+/**
+ * The kernel runner every server-side app simulation uses. It moved to
+ * `@nodetool-ai/execution/service`; this module is the server's import site.
+ */
+export { createAppServerRunner } from "@nodetool-ai/execution/service";
+//# sourceMappingURL=app-run-server.js.map

package/dist/lib/app-run-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-run-server.js","sourceRoot":"","sources":["../../src/lib/app-run-server.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/lib/app-session-scope.d.ts

@@ -0,0 +1,91 @@
+/**
+ * What a websocket connection opened by a deployed app's visitor may do.
+ *
+ * The connection authenticates as the app's owner (see the `nda_` token in
+ * `@nodetool-ai/auth`), so on the wire it looks like any other session. It is
+ * not one: the person holding it was given a link to one app, and the account
+ * behind it is a stranger's. Everything below is written as an allowlist for
+ * that reason — a command added to the runner later is refused here until
+ * someone decides it belongs, rather than reaching a stranger's account
+ * because nobody remembered this file.
+ *
+ * Two rules, and they are separate on purpose. Which *commands* are allowed is
+ * a fixed set. Which *graph* a run executes is not a matter of trust at all:
+ * the client's graph is discarded and the release's pinned graph is
+ * substituted, so a visitor who edits the payload runs the same thing as one
+ * who does not.
+ */
+import type { RunJobRequest } from "../websocket-client-session.js";
+/** The app this connection may act on, and the release it loaded. */
+export interface AppSessionScope {
+    applicationId: string;
+    version: number;
+}
+/**
+ * Just enough of a release to decide what a visitor may run: which version
+ * they are running, and the graph each of its workflows was frozen to. Named
+ * here rather than imported so this module depends on the two fields it
+ * actually reads — a stored graph arrives as JSON either way.
+ */
+export interface RunnableRelease {
+    version: number;
+    document: {
+        operations: ReadonlyArray<{
+            id: string;
+            name: string;
+            workflowId: string;
+            target?: {
+                kind: "workflow" | "script";
+            };
+        }>;
+    };
+    workflows: ReadonlyArray<{
+        workflowId: string;
+        graph: {
+            nodes: Array<Record<string, unknown>>;
+            edges: Array<Record<string, unknown>>;
+        } | null;
+    }>;
+}
+/**
+ * The commands a deployed app needs: start a run, feed it, stop it, and see
+ * where it got to. Everything else the runner answers — chat, inference,
+ * asset and workflow listings, node metadata writes, model management — reads
+ * or spends the owner's account beyond the one app, so none of it is here.
+ *
+ * `reconnect_job` is included because a reload mid-run is ordinary use, and it
+ * only replays a job this connection's user owns.
+ */
+export declare const APP_SESSION_COMMANDS: ReadonlySet<string>;
+export declare function isAppSessionCommandAllowed(command: string): boolean;
+/** A run this connection may not make, and the reason to send back. */
+export interface AppSessionRunRefusal {
+    refused: string;
+}
+export declare function isRunRefusal(result: RunJobRequest | AppSessionRunRefusal): result is AppSessionRunRefusal;
+/**
+ * Rewrite a visitor's run request into the only run it is allowed to make.
+ *
+ * Built field by field rather than by spreading the request, for the same
+ * reason the command set is an allowlist: a field added to `RunJobRequest`
+ * later must not reach a stranger's account because nobody remembered this
+ * file. What a visitor gets to say is what an app *is* — which operation to
+ * run, and what to run it on:
+ *
+ *   `params`        the inputs. Supplying them is the whole point.
+ *   `operation_id`  which published workflow operation to run.
+ *
+ * Everything else the wire carries is the server's. `job_id` names the run so
+ * the client can follow it, and the runner refuses one that is already taken.
+ * `workflow_id`, `job_name`, and `application_id` come
+ * from the signed session and `application_version` from the release, so a
+ * visitor cannot bill a run to another app or file it under a version that
+ * never shipped. `graph` comes from the release, so what runs is what the
+ * owner published — a client that sends a wider graph, or one with an
+ * exfiltrating node in it, gets the published graph instead. `supervise` is
+ * dropped because it puts a second model on the owner's bill;
+ * `execution_options`, `concurrent`, `auth_token` and `user_id` are dropped
+ * because none of them is a visitor's to set.
+ */
+export declare function confineRunRequest(req: RunJobRequest, scope: AppSessionScope, release: RunnableRelease): RunJobRequest | AppSessionRunRefusal;
+//# sourceMappingURL=app-session-scope.d.ts.map

package/dist/lib/app-session-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-session-scope.d.ts","sourceRoot":"","sources":["../../src/lib/app-session-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAEpE,qEAAqE;AACrE,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE;QACR,UAAU,EAAE,aAAa,CAAC;YACxB,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,UAAU,EAAE,MAAM,CAAC;YACnB,MAAM,CAAC,EAAE;gBAAE,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAA;aAAE,CAAC;SAC1C,CAAC,CAAC;KACJ,CAAC;IACF,SAAS,EAAE,aAAa,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE;YACL,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YACtC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;SACvC,GAAG,IAAI,CAAC;KACV,CAAC,CAAC;CACJ;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAOnD,CAAC;AAEH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEnE;AAED,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,aAAa,GAAG,oBAAoB,GAC3C,MAAM,IAAI,oBAAoB,CAEhC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,aAAa,EAClB,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,eAAe,GACvB,aAAa,GAAG,oBAAoB,CA6BtC"}

package/dist/lib/app-session-scope.js

@@ -0,0 +1,91 @@
+/**
+ * What a websocket connection opened by a deployed app's visitor may do.
+ *
+ * The connection authenticates as the app's owner (see the `nda_` token in
+ * `@nodetool-ai/auth`), so on the wire it looks like any other session. It is
+ * not one: the person holding it was given a link to one app, and the account
+ * behind it is a stranger's. Everything below is written as an allowlist for
+ * that reason — a command added to the runner later is refused here until
+ * someone decides it belongs, rather than reaching a stranger's account
+ * because nobody remembered this file.
+ *
+ * Two rules, and they are separate on purpose. Which *commands* are allowed is
+ * a fixed set. Which *graph* a run executes is not a matter of trust at all:
+ * the client's graph is discarded and the release's pinned graph is
+ * substituted, so a visitor who edits the payload runs the same thing as one
+ * who does not.
+ */
+/**
+ * The commands a deployed app needs: start a run, feed it, stop it, and see
+ * where it got to. Everything else the runner answers — chat, inference,
+ * asset and workflow listings, node metadata writes, model management — reads
+ * or spends the owner's account beyond the one app, so none of it is here.
+ *
+ * `reconnect_job` is included because a reload mid-run is ordinary use, and it
+ * only replays a job this connection's user owns.
+ */
+export const APP_SESSION_COMMANDS = new Set([
+    "run_job",
+    "reconnect_job",
+    "cancel_job",
+    "stream_input",
+    "end_input_stream",
+    "get_status"
+]);
+export function isAppSessionCommandAllowed(command) {
+    return APP_SESSION_COMMANDS.has(command);
+}
+export function isRunRefusal(result) {
+    return "refused" in result;
+}
+/**
+ * Rewrite a visitor's run request into the only run it is allowed to make.
+ *
+ * Built field by field rather than by spreading the request, for the same
+ * reason the command set is an allowlist: a field added to `RunJobRequest`
+ * later must not reach a stranger's account because nobody remembered this
+ * file. What a visitor gets to say is what an app *is* — which operation to
+ * run, and what to run it on:
+ *
+ *   `params`        the inputs. Supplying them is the whole point.
+ *   `operation_id`  which published workflow operation to run.
+ *
+ * Everything else the wire carries is the server's. `job_id` names the run so
+ * the client can follow it, and the runner refuses one that is already taken.
+ * `workflow_id`, `job_name`, and `application_id` come
+ * from the signed session and `application_version` from the release, so a
+ * visitor cannot bill a run to another app or file it under a version that
+ * never shipped. `graph` comes from the release, so what runs is what the
+ * owner published — a client that sends a wider graph, or one with an
+ * exfiltrating node in it, gets the published graph instead. `supervise` is
+ * dropped because it puts a second model on the owner's bill;
+ * `execution_options`, `concurrent`, `auth_token` and `user_id` are dropped
+ * because none of them is a visitor's to set.
+ */
+export function confineRunRequest(req, scope, release) {
+    const operationId = req.operation_id;
+    if (!operationId) {
+        return { refused: "This app run did not name an operation" };
+    }
+    const operation = release.document.operations.find((entry) => entry.id === operationId);
+    if (!operation) {
+        return { refused: "This app does not publish that operation" };
+    }
+    if (operation.target?.kind === "script" || !operation.workflowId) {
+        return { refused: "This app operation is not a workflow" };
+    }
+    const pinned = release.workflows.find((entry) => entry.workflowId === operation.workflowId);
+    if (!pinned?.graph) {
+        return { refused: "This app does not publish that workflow" };
+    }
+    return {
+        workflow_id: operation.workflowId,
+        job_name: operation.name,
+        params: req.params,
+        operation_id: operation.id,
+        application_id: scope.applicationId,
+        application_version: release.version,
+        graph: pinned.graph
+    };
+}
+//# sourceMappingURL=app-session-scope.js.map

package/dist/lib/app-session-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-session-scope.js","sourceRoot":"","sources":["../../src/lib/app-session-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAuCH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IAC/D,SAAS;IACT,eAAe;IACf,YAAY;IACZ,cAAc;IACd,kBAAkB;IAClB,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,OAAO,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAOD,MAAM,UAAU,YAAY,CAC1B,MAA4C;IAE5C,OAAO,SAAS,IAAI,MAAM,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAkB,EAClB,KAAsB,EACtB,OAAwB;IAExB,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC;IACrC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAChD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,WAAW,CACpC,CAAC;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IAC7D,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CACnC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU,CACrD,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IAChE,CAAC;IACD,OAAO;QACL,WAAW,EAAE,SAAS,CAAC,UAAU;QACjC,QAAQ,EAAE,SAAS,CAAC,IAAI;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,YAAY,EAAE,SAAS,CAAC,EAAE;QAC1B,cAAc,EAAE,KAAK,CAAC,aAAa;QACnC,mBAAmB,EAAE,OAAO,CAAC,OAAO;QACpC,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC"}