@nodetool-ai/websocket 0.7.0-rc.22 → 0.8.1

package/dist/chat-turn-registry.js

@@ -0,0 +1,326 @@
+/**
+ * Detachable chat/agent turns.
+ *
+ * The WebSocket runner is per-connection, so before this module existed a
+ * dropped socket aborted the in-flight chat turn (`disconnect()` →
+ * `cancelChatTurn()`): a laptop lid-close killed the agent mid-work and the
+ * client had nothing to reattach to. A {@link ChatTurnSession} decouples the
+ * turn from the socket: every frame the turn emits is stamped with a
+ * monotonically increasing `chat_seq` and appended to a bounded buffer, and
+ * delivery goes to whichever connection is currently attached — or nowhere,
+ * while the client is away. On reconnect the client sends
+ * `{command: "resume_chat", data: {thread_id, last_seq}}` and gets the missed
+ * tail replayed, followed by live frames if the turn is still running.
+ *
+ * Sessions are keyed by user+thread in a process-wide registry (one turn per
+ * thread; a new turn supersedes and aborts the previous one, matching the
+ * single-turn semantics `beginChatTurn` already enforces per connection).
+ * A running turn uses its execution budget even while detached. An optional
+ * `NODETOOL_CHAT_DETACH_GRACE_MS` can impose an additional disconnect limit
+ * (disabled by default). Finished sessions use a retention timer:
+ *   - retention: a finished session is kept for
+ *     `NODETOOL_CHAT_REPLAY_RETENTION_MS` (default 5 min) so a client that
+ *     reconnects just after the turn ended still gets the tail, then dropped.
+ *
+ * Assistant/tool messages are persisted to the DB independently of this
+ * buffer, so an expired or truncated replay degrades to the client refetching
+ * thread history over REST — nothing is lost except unpersisted stream chunks.
+ */
+import { createLogger } from "@nodetool-ai/config";
+const log = createLogger("nodetool.websocket.chat-turn-registry");
+function envInt(name, fallback) {
+    const raw = process.env[name];
+    if (!raw)
+        return fallback;
+    const parsed = Number.parseInt(raw, 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+const MAX_BUFFERED_EVENTS = () => envInt("NODETOOL_CHAT_REPLAY_BUFFER_EVENTS", 2000);
+const DETACH_GRACE_MS = () => envInt("NODETOOL_CHAT_DETACH_GRACE_MS", 0);
+const RETENTION_MS = () => envInt("NODETOOL_CHAT_REPLAY_RETENTION_MS", 5 * 60 * 1000);
+export class ChatTurnSession {
+    controller;
+    hooks;
+    onDrop;
+    onFinish;
+    userId;
+    threadId;
+    status = "running";
+    seq;
+    buffer = [];
+    /** Highest seq evicted from the bounded buffer (0 = nothing evicted). */
+    evictedThroughSeq;
+    target = null;
+    /**
+     * Serializes delivery: replayed frames enqueue before any live frame that
+     * arrives after attach, so the client always sees seq order.
+     */
+    deliveryChain = Promise.resolve();
+    detachTimer = null;
+    retentionTimer = null;
+    constructor(userId, threadId, controller, hooks, onDrop, startSeq, 
+    /** Told when the turn settles, so the registry can answer `drained`. */
+    onFinish = () => { }) {
+        this.controller = controller;
+        this.hooks = hooks;
+        this.onDrop = onDrop;
+        this.onFinish = onFinish;
+        this.userId = userId;
+        this.threadId = threadId;
+        this.seq = startSeq;
+        this.evictedThroughSeq = startSeq;
+    }
+    get lastSeq() {
+        return this.seq;
+    }
+    /**
+     * Where a client with no frame state (a freshly reloaded page) should
+     * start its replay: after the turn's last `message` frame. Everything up
+     * to and including that frame is persisted to the DB and reachable over
+     * REST; what follows — stream chunks of the in-progress reply, status
+     * updates, pending tool/approval requests — exists only in this buffer.
+     * With no `message` frame buffered yet, replay starts at the oldest
+     * frame still held.
+     */
+    freshAttachSeq() {
+        for (let i = this.buffer.length - 1; i >= 0; i--) {
+            const entry = this.buffer[i];
+            if (entry.message.type === "message") {
+                return entry.seq;
+            }
+        }
+        return this.evictedThroughSeq;
+    }
+    /**
+     * Stamp, buffer, and (when a connection is attached) deliver one frame.
+     * Returns the stamped copy.
+     */
+    emit(message) {
+        this.seq += 1;
+        const stamped = { ...message, chat_seq: this.seq };
+        this.buffer.push({ seq: this.seq, message: stamped });
+        const max = MAX_BUFFERED_EVENTS();
+        while (this.buffer.length > max) {
+            const evicted = this.buffer.shift();
+            if (evicted)
+                this.evictedThroughSeq = evicted.seq;
+        }
+        const target = this.target;
+        if (target) {
+            this.enqueueDelivery(() => target.deliver(stamped));
+        }
+        return stamped;
+    }
+    /**
+     * Attach a connection and hand back the frames it missed. Live frames
+     * emitted after this call are delivered to the new target, strictly after
+     * the returned replay is delivered (both ride {@link deliveryChain} when
+     * sent via {@link deliverReplay}).
+     */
+    attach(target, lastSeq) {
+        this.clearDetachTimer();
+        this.target = target;
+        const replay = this.buffer
+            .filter((e) => e.seq > lastSeq)
+            .map((e) => e.message);
+        return { replay, incomplete: lastSeq < this.evictedThroughSeq };
+    }
+    /** Deliver frames on the session's ordered delivery chain. */
+    deliverReplay(target, frames) {
+        for (const frame of frames) {
+            this.enqueueDelivery(() => target.deliver(frame));
+        }
+        return this.deliveryChain;
+    }
+    /**
+     * The attached connection went away. A running turn keeps executing and
+     * buffering under its existing execution budget. Operators may configure
+     * an additional detach timeout.
+     */
+    detach(target) {
+        if (target && this.target !== target)
+            return;
+        this.target = null;
+        if (this.status !== "running")
+            return;
+        this.clearDetachTimer();
+        const graceMs = DETACH_GRACE_MS();
+        if (graceMs === 0)
+            return;
+        this.detachTimer = setTimeout(() => {
+            log.info("Detached chat turn expired, aborting", {
+                threadId: this.threadId
+            });
+            this.abort("stop");
+        }, graceMs);
+        this.detachTimer.unref?.();
+    }
+    /**
+     * Abort the turn. The reason reaches the handler as `signal.reason`: only
+     * `"shutdown"` is something the user did not do and does not already know
+     * about, so only that one is written into the transcript.
+     */
+    abort(reason) {
+        this.controller.abort(reason);
+        this.hooks.cancelPendingCalls(this.threadId);
+    }
+    /**
+     * The turn's promise settled. The session sticks around (still replayable)
+     * for the retention window, then drops out of the registry.
+     */
+    finish() {
+        if (this.status === "finished")
+            return;
+        this.status = "finished";
+        this.clearDetachTimer();
+        this.retentionTimer = setTimeout(() => this.onDrop(this), RETENTION_MS());
+        this.retentionTimer.unref?.();
+        this.onFinish();
+    }
+    /** Release timers when the registry drops the session. */
+    dispose() {
+        this.clearDetachTimer();
+        if (this.retentionTimer) {
+            clearTimeout(this.retentionTimer);
+            this.retentionTimer = null;
+        }
+    }
+    clearDetachTimer() {
+        if (this.detachTimer) {
+            clearTimeout(this.detachTimer);
+            this.detachTimer = null;
+        }
+    }
+    enqueueDelivery(fn) {
+        this.deliveryChain = this.deliveryChain.then(fn).catch((err) => {
+            log.warn("Chat turn delivery failed", {
+                threadId: this.threadId,
+                error: err instanceof Error ? err.message : String(err)
+            });
+        });
+    }
+}
+export class ChatTurnRegistry {
+    sessions = new Map();
+    /**
+     * Per-thread seq high-water marks, so a new turn continues numbering where
+     * the previous one left off and a client's `last_seq` from an older turn
+     * can never accidentally skip a newer turn's frames. Bounded: oldest
+     * entries are evicted past {@link MAX_SEQ_ENTRIES}.
+     */
+    lastSeqByThread = new Map();
+    static MAX_SEQ_ENTRIES = 10_000;
+    /** Resolvers waiting for {@link runningCount} to reach zero. */
+    drainWaiters = new Set();
+    key(userId, threadId) {
+        return `${userId}\u0000${threadId}`;
+    }
+    /**
+     * Open a session for a new turn. An existing session for the same thread is
+     * superseded: aborted (if still running) and dropped, exactly as a new
+     * `chat_message` on a live connection cancels the previous turn.
+     */
+    open(userId, threadId, controller, hooks) {
+        const key = this.key(userId, threadId);
+        const existing = this.sessions.get(key);
+        if (existing) {
+            if (existing.status === "running")
+                existing.abort("superseded");
+            this.drop(existing);
+        }
+        const session = new ChatTurnSession(userId, threadId, controller, hooks, (s) => this.drop(s), this.lastSeqByThread.get(key) ?? 0, () => this.notifyDrainWaiters());
+        this.sessions.set(key, session);
+        return session;
+    }
+    get(userId, threadId) {
+        return this.sessions.get(this.key(userId, threadId)) ?? null;
+    }
+    /** Sessions still running for a user — what a fresh client can reattach to. */
+    listRunningForUser(userId) {
+        return [...this.sessions.values()].filter((s) => s.userId === userId && s.status === "running");
+    }
+    /** Turns this process is still executing. What a drain waits on. */
+    runningCount() {
+        let count = 0;
+        for (const session of this.sessions.values()) {
+            if (session.status === "running")
+                count += 1;
+        }
+        return count;
+    }
+    /** Abort every running turn with one reason. Returns how many were aborted. */
+    abortAll(reason) {
+        let count = 0;
+        for (const session of this.sessions.values()) {
+            if (session.status !== "running")
+                continue;
+            session.abort(reason);
+            count += 1;
+        }
+        return count;
+    }
+    /** Abort local turns whose conversation is being deleted with its project. */
+    abortThreads(userId, threadIds) {
+        let count = 0;
+        for (const session of this.sessions.values()) {
+            if (session.userId !== userId ||
+                session.status !== "running" ||
+                !threadIds.has(session.threadId))
+                continue;
+            session.abort("stop");
+            count += 1;
+        }
+        return count;
+    }
+    /**
+     * Resolve true once no turn is running, false when `timeoutMs` elapses
+     * first. A turn is running until its handler has settled, which is what
+     * writes the stand-in tool-result rows — so a shutdown that waits on this
+     * leaves a well-formed transcript behind.
+     */
+    drained(timeoutMs) {
+        if (this.runningCount() === 0)
+            return Promise.resolve(true);
+        return new Promise((resolve) => {
+            const waiter = () => {
+                if (this.runningCount() > 0)
+                    return;
+                clearTimeout(timer);
+                this.drainWaiters.delete(waiter);
+                resolve(true);
+            };
+            const timer = setTimeout(() => {
+                this.drainWaiters.delete(waiter);
+                resolve(false);
+            }, timeoutMs);
+            timer.unref?.();
+            this.drainWaiters.add(waiter);
+        });
+    }
+    notifyDrainWaiters() {
+        for (const waiter of [...this.drainWaiters])
+            waiter();
+    }
+    drop(session) {
+        const key = this.key(session.userId, session.threadId);
+        if (this.sessions.get(key) === session) {
+            this.sessions.delete(key);
+        }
+        // max(): a superseded session's late retention-drop must not lower the
+        // high-water mark below what its successor already emitted.
+        this.lastSeqByThread.set(key, Math.max(this.lastSeqByThread.get(key) ?? 0, session.lastSeq));
+        while (this.lastSeqByThread.size > ChatTurnRegistry.MAX_SEQ_ENTRIES) {
+            const oldest = this.lastSeqByThread.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.lastSeqByThread.delete(oldest);
+        }
+        session.dispose();
+        // A superseded turn leaves the map while still marked running, so the
+        // count can reach zero here as well as in `finish`.
+        this.notifyDrainWaiters();
+    }
+}
+/** Process-wide registry: sessions survive their originating connection. */
+export const chatTurnRegistry = new ChatTurnRegistry();
+//# sourceMappingURL=chat-turn-registry.js.map

package/dist/chat-turn-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-turn-registry.js","sourceRoot":"","sources":["../src/chat-turn-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,GAAG,GAAG,YAAY,CAAC,uCAAuC,CAAC,CAAC;AAElE,SAAS,MAAM,CAAC,IAAY,EAAE,QAAgB;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED,MAAM,mBAAmB,GAAG,GAAG,EAAE,CAC/B,MAAM,CAAC,oCAAoC,EAAE,IAAI,CAAC,CAAC;AACrD,MAAM,eAAe,GAAG,GAAG,EAAE,CAC3B,MAAM,CAAC,+BAA+B,EAAE,CAAC,CAAC,CAAC;AAC7C,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,MAAM,CAAC,mCAAmC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAqC7D,MAAM,OAAO,eAAe;IAqBP,UAAU;IAClB,KAAK;IACG,MAAM;IAGN,QAAQ;IAzBlB,MAAM,CAAS;IACf,QAAQ,CAAS;IAC1B,MAAM,GAA2B,SAAS,CAAC;IAEnC,GAAG,CAAS;IACZ,MAAM,GAAoB,EAAE,CAAC;IACrC,yEAAyE;IACjE,iBAAiB,CAAS;IAC1B,MAAM,GAAkC,IAAI,CAAC;IACrD;;;OAGG;IACK,aAAa,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IACjD,WAAW,GAA0B,IAAI,CAAC;IAC1C,cAAc,GAA0B,IAAI,CAAC;IAErD,YACE,MAAc,EACd,QAAgB,EACC,UAA2B,EACnC,KAA6B,EACrB,MAA0C,EAC3D,QAAgB;IAChB,wEAAwE;IACvD,QAAQ,GAAe,GAAG,EAAE,GAAE,CAAC;0BAL/B,UAAU;qBAClB,KAAK;sBACG,MAAM;wBAGN,QAAQ;QAEzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,GAAG,GAAG,QAAQ,CAAC;QACpB,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC;IACpC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED;;;;;;;;OAQG;IACH,cAAc;QACZ,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,KAAK,CAAC,GAAG,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,IAAI,CAAC,OAAgC;QACnC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACd,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpC,IAAI,OAAO;gBAAE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC;QACpD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,MAA8B,EAAE,OAAe;QACpD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM;aACvB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,OAAO,CAAC;aAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAClE,CAAC;IAED,8DAA8D;IAC9D,aAAa,CACX,MAA8B,EAC9B,MAAsC;QAEtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAA+B;QACpC,IAAI,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO;QAC7C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO;QACtC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;QAClC,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO;QAC1B,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,GAAG,EAAE;YACjC,GAAG,CAAC,IAAI,CAAC,sCAAsC,EAAE;gBAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAA2B;QAC/B,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO;QACvC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;QACzB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClB,CAAC;IAED,0DAA0D;IAC1D,OAAO;QACL,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAClC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;IACH,CAAC;IAEO,gBAAgB;QACtB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC/B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,EAAuB;QAC7C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC7D,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE;gBACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,gBAAgB;IACnB,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IACtD;;;;;OAKG;IACK,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,CAAU,eAAe,GAAG,MAAM,CAAC;IACjD,gEAAgE;IACxD,YAAY,GAAG,IAAI,GAAG,EAAc,CAAC;IAErC,GAAG,CAAC,MAAc,EAAE,QAAgB;QAC1C,OAAO,GAAG,MAAM,SAAS,QAAQ,EAAE,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACH,IAAI,CACF,MAAc,EACd,QAAgB,EAChB,UAA2B,EAC3B,KAA6B;QAE7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;gBAAE,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,eAAe,CACjC,MAAM,EACN,QAAQ,EACR,UAAU,EACV,KAAK,EACL,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EACnB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAClC,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAChC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,GAAG,CAAC,MAAc,EAAE,QAAgB;QAClC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IAC/D,CAAC;IAED,+EAA+E;IAC/E,kBAAkB,CAAC,MAAc;QAC/B,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CACrD,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,YAAY;QACV,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;gBAAE,KAAK,IAAI,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+EAA+E;IAC/E,QAAQ,CAAC,MAA2B;QAClC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAS;YAC3C,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACtB,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8EAA8E;IAC9E,YAAY,CAAC,MAAc,EAAE,SAA8B;QACzD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IACE,OAAO,CAAC,MAAM,KAAK,MAAM;gBACzB,OAAO,CAAC,MAAM,KAAK,SAAS;gBAC5B,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAChC,SAAS;YACX,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACtB,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,SAAiB;QACvB,IAAI,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;YACtC,MAAM,MAAM,GAAG,GAAG,EAAE;gBAClB,IAAI,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC;oBAAE,OAAO;gBACpC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC;YACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACjC,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,kBAAkB;QACxB,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;YAAE,MAAM,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,OAAwB;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,uEAAuE;QACvE,4DAA4D;QAC5D,IAAI,CAAC,eAAe,CAAC,GAAG,CACtB,GAAG,EACH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAC9D,CAAC;QACF,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,gBAAgB,CAAC,eAAe,EAAE,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACxD,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,OAAO,EAAE,CAAC;QAClB,sEAAsE;QACtE,oDAAoD;QACpD,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,EAAE,CAAC"}

package/dist/collection-api.d.ts

@@ -5,10 +5,10 @@
  * not handle `multipart/form-data` bodies. All CRUD + query endpoints have
  * moved to the tRPC `collections` router.
  */
-import type { HttpApiOptions } from "./http-api.js";
+import { type HttpApiOptions } from "./http-api.js";
 /**
  * Handle POST /api/collections/:name/index (multipart/form-data file upload).
  * Returns `null` for any non-matching path so callers can fall through.
  */
-export declare function handleCollectionRequest(request: Request, pathname: string, _options: HttpApiOptions): Promise<Response | null>;
+export declare function handleCollectionRequest(request: Request, pathname: string, options: HttpApiOptions): Promise<Response | null>;
 //# sourceMappingURL=collection-api.d.ts.map

package/dist/collection-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collection-api.d.ts","sourceRoot":"","sources":["../src/collection-api.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAoBpD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAoD1B"}
+{"version":3,"file":"collection-api.d.ts","sourceRoot":"","sources":["../src/collection-api.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,EAAa,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAwB/D;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA0F1B"}

package/dist/collection-api.js

@@ -5,7 +5,13 @@
  * not handle `multipart/form-data` bodies. All CRUD + query endpoints have
  * moved to the tRPC `collections` router.
  */
-import { getVecStore, VecNotFoundError, splitDocument } from "@nodetool-ai/vectorstore";
+import { createLogger } from "@nodetool-ai/config";
+import { getMaxUploadBytes } from "@nodetool-ai/storage";
+import { getDefaultVectorProvider, CollectionNotFoundError, splitDocument } from "@nodetool-ai/vectorstore";
+import { getUserId } from "./http-api.js";
+import { notifyResourceChange } from "./resource-events.js";
+import { canAccessCollection } from "@nodetool-ai/vectorstore";
+const log = createLogger("nodetool.websocket.collection-api");
 function jsonResponse(data, status = 200) {
     return new Response(JSON.stringify(data), {
         status,
@@ -25,7 +31,7 @@ function normalizePath(pathname) {
  * Handle POST /api/collections/:name/index (multipart/form-data file upload).
  * Returns `null` for any non-matching path so callers can fall through.
  */
-export async function handleCollectionRequest(request, pathname, _options) {
+export async function handleCollectionRequest(request, pathname, options) {
     pathname = normalizePath(pathname);
     const indexMatch = pathname.match(/^\/api\/collections\/([^/]+)\/index$/);
     if (!indexMatch)
@@ -37,25 +43,45 @@ export async function handleCollectionRequest(request, pathname, _options) {
     if (!contentType.includes("multipart/form-data")) {
         return errorResponse(400, "Expected multipart/form-data");
     }
+    const collectionName = decodeURIComponent(indexMatch[1]);
+    const userId = getUserId(request, options.userIdHeader ?? "x-user-id");
     try {
-        const store = await getVecStore();
-        const collectionName = decodeURIComponent(indexMatch[1]);
-        const collection = await store.getCollection({ name: collectionName });
+        const provider = getDefaultVectorProvider();
+        const collection = await provider.getCollection({ name: collectionName });
+        // Same ownership rule the tRPC router enforces, and the same 404-not-403
+        // response for someone else's collection so this endpoint can't be used to
+        // probe for names. See @nodetool-ai/vectorstore collection-access.ts.
+        if (!canAccessCollection(collection.metadata, userId)) {
+            return errorResponse(404, "Collection not found");
+        }
         const formData = await request.formData();
         const file = formData.get("file");
         if (!file || !(file instanceof File)) {
             return errorResponse(400, "No file provided");
         }
+        // The whole file is read into a string and chunked in memory, so cap it at
+        // the same limit storage uploads use rather than relying on Fastify's
+        // 100 MB body limit.
+        const max = getMaxUploadBytes();
+        if (file.size > max) {
+            return errorResponse(413, `Upload exceeds maximum size: ${file.size} > ${max} bytes ` +
+                `(set NODETOOL_MAX_UPLOAD_BYTES to raise the limit)`);
+        }
         const text = await file.text();
         const chunks = splitDocument(text, file.name);
         if (chunks.length > 0) {
-            await collection.add({
-                ids: chunks.map((_, i) => `${file.name}#${i}`),
-                documents: chunks.map((c) => c.text),
-                metadatas: chunks.map((c) => ({
+            await collection.upsert(chunks.map((c, i) => ({
+                id: `${file.name}#${i}`,
+                document: c.text,
+                metadata: {
                     source: c.source_id,
                     start_index: String(c.start_index)
-                }))
+                }
+            })));
+            notifyResourceChange({
+                event: "updated",
+                resource_type: "collection",
+                resource: { id: collectionName }
             });
         }
         return jsonResponse({
@@ -65,11 +91,16 @@ export async function handleCollectionRequest(request, pathname, _options) {
         });
     }
     catch (err) {
-        if (err instanceof VecNotFoundError) {
+        if (err instanceof CollectionNotFoundError) {
             return errorResponse(404, "Collection not found");
         }
-        const msg = err instanceof Error ? err.message : String(err);
-        return errorResponse(500, `Vector store error: ${msg}`);
+        // Log the detail, return a generic message: provider errors carry SQL
+        // text, file paths, and upstream URLs that shouldn't reach the client.
+        log.error("Collection index failed", {
+            collection: collectionName,
+            error: err instanceof Error ? err.message : String(err)
+        });
+        return errorResponse(500, "Vector store error");
     }
 }
 //# sourceMappingURL=collection-api.js.map

package/dist/collection-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"collection-api.js","sourceRoot":"","sources":["../src/collection-api.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,aAAa,EACd,MAAM,0BAA0B,CAAC;AAGlC,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,MAAc;IACnD,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,QAAgB,EAChB,QAAwB;IAExB,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAEnC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1E,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,aAAa,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACjD,OAAO,aAAa,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;QAClC,MAAM,cAAc,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAEvE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAE9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,UAAU,CAAC,GAAG,CAAC;gBACnB,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;gBAC9C,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACpC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC5B,MAAM,EAAE,CAAC,CAAC,SAAS;oBACnB,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;iBACnC,CAAC,CAAC;aACJ,CAAC,CAAC;QACL,CAAC;QAED,OAAO,YAAY,CAAC;YAClB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;YACpC,OAAO,aAAa,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,aAAa,CAAC,GAAG,EAAE,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC"}
+{"version":3,"file":"collection-api.js","sourceRoot":"","sources":["../src/collection-api.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,aAAa,EACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,SAAS,EAAuB,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,MAAM,GAAG,GAAG,YAAY,CAAC,mCAAmC,CAAC,CAAC;AAE9D,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,MAAc;IACnD,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,QAAgB,EAChB,OAAuB;IAEvB,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAEnC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1E,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,aAAa,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACjD,OAAO,aAAa,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,IAAI,WAAW,CAAC,CAAC;IAEvE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAE1E,yEAAyE;QACzE,2EAA2E;QAC3E,sEAAsE;QACtE,IACE,CAAC,mBAAmB,CAClB,UAAU,CAAC,QAAqD,EAChE,MAAM,CACP,EACD,CAAC;YACD,OAAO,aAAa,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAChD,CAAC;QAED,2EAA2E;QAC3E,sEAAsE;QACtE,qBAAqB;QACrB,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;YACpB,OAAO,aAAa,CAClB,GAAG,EACH,gCAAgC,IAAI,CAAC,IAAI,MAAM,GAAG,SAAS;gBACzD,oDAAoD,CACvD,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAE9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,UAAU,CAAC,MAAM,CACrB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBACpB,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE;gBACvB,QAAQ,EAAE,CAAC,CAAC,IAAI;gBAChB,QAAQ,EAAE;oBACR,MAAM,EAAE,CAAC,CAAC,SAAS;oBACnB,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;iBACnC;aACF,CAAC,CAAC,CACJ,CAAC;YACF,oBAAoB,CAAC;gBACnB,KAAK,EAAE,SAAS;gBAChB,aAAa,EAAE,YAAY;gBAC3B,QAAQ,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE;aACjC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,YAAY,CAAC;YAClB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;YAC3C,OAAO,aAAa,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;QACpD,CAAC;QACD,sEAAsE;QACtE,uEAAuE;QACvE,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE;YACnC,UAAU,EAAE,cAAc;YAC1B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,aAAa,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAClD,CAAC;AACH,CAAC"}

package/dist/configured-providers.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The set of providers a user holds credentials for, cached per user for the
+ * chat agent's toolbelt (`find_model`, media generation).
+ *
+ * Building it costs one credential resolution per registered provider, so a
+ * cache is worth having — but a cache that never expires is worse than none:
+ * a provider connected after the first chat turn stays invisible until the
+ * process restarts, which on a dev machine is every file save and on the
+ * production server is never. That is how a Codex sign-in could complete and
+ * leave the agent with no Codex.
+ *
+ * So an entry is good for {@link DEFAULT_TTL_MS} and no longer, and
+ * {@link clearProviderCache} from `@nodetool-ai/runtime` drops it immediately —
+ * credential writes call that, so a sign-in takes effect on the next turn
+ * rather than a minute later.
+ *
+ * The TTL is not belt-and-braces on top of that signal. A cached provider is
+ * built around the bearer it was handed, and the Codex bearer is a
+ * short-lived OAuth access token: the credential row is refreshed in place
+ * with no write this process sees, so only expiry rebuilds the instance.
+ */
+import type { BaseProvider } from "@nodetool-ai/runtime";
+/** How long a built provider set is reused. Bounds a stale OAuth bearer. */
+export declare const DEFAULT_TTL_MS = 60000;
+export type ProviderSet = Record<string, BaseProvider>;
+/**
+ * Build the provider set for one user: every registered provider the user
+ * holds credentials for, keyed by id.
+ *
+ * A provider whose construction throws is absent from the result rather than
+ * fatal — one broken credential must not cost the caller every other provider.
+ */
+export declare function loadConfiguredProviders(userId: string): Promise<ProviderSet>;
+export interface ConfiguredProviderCacheOptions {
+    /** Builds the provider set for a user. Injected so tests need no registry. */
+    load?: (userId: string) => Promise<ProviderSet>;
+    ttlMs?: number;
+    now?: () => number;
+    /** Credential-version reader. Injected only by tests. */
+    version?: () => number;
+}
+export declare class ConfiguredProviderCache {
+    private readonly entries;
+    private readonly load;
+    private readonly ttlMs;
+    private readonly now;
+    private readonly version;
+    constructor(options: ConfiguredProviderCacheOptions);
+    get(userId: string): Promise<ProviderSet>;
+    private isFresh;
+}
+//# sourceMappingURL=configured-providers.d.ts.map

package/dist/configured-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configured-providers.d.ts","sourceRoot":"","sources":["../src/configured-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAKzD,4EAA4E;AAC5E,eAAO,MAAM,cAAc,QAAS,CAAC;AAErC,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AASvD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,WAAW,CAAC,CAqBtB;AAED,MAAM,WAAW,8BAA8B;IAC7C,8EAA8E;IAC9E,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;CACxB;AAED,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IACzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA2C;IAChE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IAEvC,YAAY,OAAO,EAAE,8BAA8B,EAKlD;IAEK,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAY9C;IAED,OAAO,CAAC,OAAO;CAIhB"}

package/dist/configured-providers.js

@@ -0,0 +1,85 @@
+/**
+ * The set of providers a user holds credentials for, cached per user for the
+ * chat agent's toolbelt (`find_model`, media generation).
+ *
+ * Building it costs one credential resolution per registered provider, so a
+ * cache is worth having — but a cache that never expires is worse than none:
+ * a provider connected after the first chat turn stays invisible until the
+ * process restarts, which on a dev machine is every file save and on the
+ * production server is never. That is how a Codex sign-in could complete and
+ * leave the agent with no Codex.
+ *
+ * So an entry is good for {@link DEFAULT_TTL_MS} and no longer, and
+ * {@link clearProviderCache} from `@nodetool-ai/runtime` drops it immediately —
+ * credential writes call that, so a sign-in takes effect on the next turn
+ * rather than a minute later.
+ *
+ * The TTL is not belt-and-braces on top of that signal. A cached provider is
+ * built around the bearer it was handed, and the Codex bearer is a
+ * short-lived OAuth access token: the credential row is refreshed in place
+ * with no write this process sees, so only expiry rebuilds the instance.
+ */
+import { getProviderCacheVersion } from "@nodetool-ai/runtime";
+import { createLogger } from "@nodetool-ai/config";
+const log = createLogger("nodetool.websocket.configured-providers");
+/** How long a built provider set is reused. Bounds a stale OAuth bearer. */
+export const DEFAULT_TTL_MS = 60_000;
+/**
+ * Build the provider set for one user: every registered provider the user
+ * holds credentials for, keyed by id.
+ *
+ * A provider whose construction throws is absent from the result rather than
+ * fatal — one broken credential must not cost the caller every other provider.
+ */
+export async function loadConfiguredProviders(userId) {
+    const providersMod = await import("@nodetool-ai/runtime");
+    const { getSecret } = await import("@nodetool-ai/models");
+    const getSecretFor = (key) => getSecret(key, userId).then((v) => v ?? undefined);
+    const providers = {};
+    await Promise.all(providersMod.listRegisteredProviderIds().map(async (id) => {
+        try {
+            if (await providersMod.isProviderConfigured(id, getSecretFor)) {
+                providers[id] = await providersMod.getProvider(id, getSecretFor);
+            }
+        }
+        catch (err) {
+            log.debug("Skipping provider without usable credentials", {
+                provider: id,
+                error: err instanceof Error ? err.message : String(err)
+            });
+        }
+    }));
+    return providers;
+}
+export class ConfiguredProviderCache {
+    entries = new Map();
+    load;
+    ttlMs;
+    now;
+    version;
+    constructor(options) {
+        this.load = options.load ?? loadConfiguredProviders;
+        this.ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+        this.now = options.now ?? Date.now;
+        this.version = options.version ?? getProviderCacheVersion;
+    }
+    async get(userId) {
+        const cached = this.entries.get(userId);
+        if (cached && this.isFresh(cached)) {
+            return cached.providers;
+        }
+        const providers = await this.load(userId);
+        this.entries.set(userId, {
+            providers,
+            version: this.version(),
+            builtAt: this.now()
+        });
+        return providers;
+    }
+    isFresh(entry) {
+        if (entry.version !== this.version())
+            return false;
+        return this.now() - entry.builtAt < this.ttlMs;
+    }
+}
+//# sourceMappingURL=configured-providers.js.map

package/dist/configured-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configured-providers.js","sourceRoot":"","sources":["../src/configured-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,GAAG,GAAG,YAAY,CAAC,yCAAyC,CAAC,CAAC;AAEpE,4EAA4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAWrC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc;IAEd,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAC1D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,EAAE,CACnC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;IACrD,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,MAAM,OAAO,CAAC,GAAG,CACf,YAAY,CAAC,yBAAyB,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,IAAI,MAAM,YAAY,CAAC,oBAAoB,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC;gBAC9D,SAAS,CAAC,EAAE,CAAC,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,8CAA8C,EAAE;gBACxD,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC;AAWD,MAAM,OAAO,uBAAuB;IACjB,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IACxC,IAAI,CAA2C;IAC/C,KAAK,CAAS;IACd,GAAG,CAAe;IAClB,OAAO,CAAe;IAEvC,YAAY,OAAuC;QACjD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,uBAAuB,CAAC;QACpD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC;QAC7C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,uBAAuB,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC,SAAS,CAAC;QAC1B,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;YACvB,SAAS;YACT,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YACvB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;SACpB,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,OAAO,CAAC,KAAiB;QAC/B,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE;YAAE,OAAO,KAAK,CAAC;QACnD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;IACjD,CAAC;CACF"}

package/dist/cors.d.ts

@@ -0,0 +1,22 @@
+/** Reset cached config — for tests that mutate `NODETOOL_ALLOWED_ORIGINS`. */
+export declare function resetCorsConfig(): void;
+/**
+ * Whether a request `Origin` is permitted. A missing origin (non-browser
+ * clients, same-origin navigations) is allowed — there is no browser
+ * enforcing CORS in that case, so nothing to gate.
+ */
+export declare function isOriginAllowed(origin: string | undefined | null): boolean;
+/**
+ * Resolve the `Access-Control-Allow-Origin` value for a request `Origin`.
+ * Returns the origin to reflect when it is allowed, or `null` to omit the
+ * header entirely (a disallowed origin gets no ACAO, so the browser blocks
+ * the cross-origin read).
+ */
+export declare function resolveAllowedOrigin(origin: string | undefined | null): string | null;
+/**
+ * `@fastify/cors` origin delegate. Permits allow-listed origins (the plugin
+ * reflects them) and rejects everything else, replacing the previous
+ * `origin: true` (reflect-any) configuration.
+ */
+export declare function corsOriginDelegate(origin: string | undefined, cb: (err: Error | null, allow: boolean) => void): void;
+//# sourceMappingURL=cors.d.ts.map

package/dist/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AA4DA,8EAA8E;AAC9E,wBAAgB,eAAe,IAAI,IAAI,CAEtC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAM1E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAChC,MAAM,GAAG,IAAI,CAGf;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,GAC9C,IAAI,CAEN"}