@nodetool-ai/websocket 0.7.0-rc.23 → 0.8.2

package/dist/lib/extension-dist.js

@@ -0,0 +1,67 @@
+/**
+ * Locate (and zip) the built Chrome extension so the UI can help users install
+ * it into their own Chrome.
+ *
+ * Resolution order:
+ *   1. `NODETOOL_EXTENSION_DIST` — set by the Electron main process to the
+ *      bundled resource path in packaged builds.
+ *   2. Walk up from this module and from cwd looking for
+ *      `chrome-extension/dist/manifest.json` (the dev/monorepo layout).
+ */
+import { existsSync, readdirSync, statSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { zipSync } from "fflate";
+function isBuild(dir) {
+    return existsSync(path.join(dir, "manifest.json"));
+}
+function findUp(start) {
+    let dir = start;
+    for (let i = 0; i < 10; i++) {
+        const candidate = path.join(dir, "chrome-extension", "dist");
+        if (isBuild(candidate))
+            return candidate;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}
+export function resolveExtensionDist() {
+    const env = process.env.NODETOOL_EXTENSION_DIST;
+    if (env && isBuild(env))
+        return { path: env, exists: true };
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    const found = findUp(here) ?? findUp(process.cwd());
+    if (found)
+        return { path: found, exists: true };
+    return { path: env ?? "", exists: false };
+}
+/** Recursively collect a directory's files into a flat path → bytes map. */
+function addDir(files, dir, rel) {
+    for (const entry of readdirSync(dir)) {
+        const full = path.join(dir, entry);
+        const relPath = rel ? `${rel}/${entry}` : entry;
+        if (statSync(full).isDirectory()) {
+            addDir(files, full, relPath);
+        }
+        else {
+            files[relPath] = new Uint8Array(readFileSync(full));
+        }
+    }
+}
+/**
+ * Zip the extension build into an in-memory buffer (the build is tiny — a few
+ * small JS/HTML/PNG files). Throws if no build is found.
+ */
+export async function zipExtensionDist() {
+    const dist = resolveExtensionDist();
+    if (!dist.exists) {
+        throw new Error("Extension build not found");
+    }
+    const files = {};
+    addDir(files, dist.path, "");
+    return Buffer.from(zipSync(files, { level: 6 }));
+}
+//# sourceMappingURL=extension-dist.js.map

package/dist/lib/extension-dist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-dist.js","sourceRoot":"","sources":["../../src/lib/extension-dist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AASjC,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAChD,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAE5D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAEhD,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,4EAA4E;AAC5E,SAAS,MAAM,CAAC,KAAiC,EAAE,GAAW,EAAE,GAAW;IACzE,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAChD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACjC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;IACpC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,KAAK,GAA+B,EAAE,CAAC;IAC7C,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACnD,CAAC"}

package/dist/lib/external-asset-lookup.d.ts

@@ -0,0 +1,30 @@
+/** The row fields that describe an in-place file. */
+export interface ExternalAssetFields {
+    external_path: string | null;
+    metadata: Record<string, unknown> | null;
+}
+/** The metadata keys that fingerprint an external file. Server-owned. */
+export declare const EXTERNAL_FINGERPRINT_KEYS: readonly ["external_size", "external_mtime"];
+/** The recorded mtime of an external asset, or null for a managed one. */
+export declare function externalAssetMtime(asset: ExternalAssetFields): number | null;
+/**
+ * The external file behind `asset` when it is present and unchanged, else
+ * null. mtimes compare at millisecond granularity. A row with no recorded
+ * size or mtime is checked for presence only.
+ */
+export declare function verifiedExternalPath(asset: ExternalAssetFields): Promise<string | null>;
+/**
+ * Whether an external asset's file is missing or changed. Always false for a
+ * managed asset. One `stat`, so it is cheap enough for every asset response.
+ */
+export declare function isExternalAssetOffline(asset: ExternalAssetFields): Promise<boolean>;
+/**
+ * The external path behind `<owner>/<assetId>.<ext>` (or `<owner>/<assetId>`),
+ * or null. Only full asset ids resolve, only for the owner the key names, and
+ * only when the extension matches the one the row's content type maps to.
+ * Legacy flat keys and runtime scratch keys never resolve: external rows are
+ * always created under the owner-prefixed layout. An offline file resolves to
+ * null.
+ */
+export declare function lookupExternalAssetPath(key: string): Promise<string | null>;
+//# sourceMappingURL=external-asset-lookup.d.ts.map

package/dist/lib/external-asset-lookup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-asset-lookup.d.ts","sourceRoot":"","sources":["../../src/lib/external-asset-lookup.ts"],"names":[],"mappings":"AAqBA,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC1C;AAED,yEAAyE;AACzE,eAAO,MAAM,yBAAyB,YACpC,eAAe,EACf,gBAAgB,CACR,CAAC;AAUX,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAG5E;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiBxB;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,OAAO,CAAC,CAGlB;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAcxB"}

package/dist/lib/external-asset-lookup.js

@@ -0,0 +1,99 @@
+/**
+ * Resolve an asset storage key to the file an external asset references in
+ * place (see `Asset.external_path`), and decide whether that file is offline.
+ *
+ * The local `FileStorageAdapter` and the `/api/storage` stream call the lookup
+ * after a key misses under the storage root. Every key-based reader then finds
+ * an external asset's bytes without knowing about asset rows.
+ *
+ * A file that is missing, no longer a regular file, or whose size or mtime
+ * differs from what import or relink recorded is offline. The lookup answers
+ * null for an offline file, so every reader (adapter reads, `localPath`, the
+ * `/api/storage` stream) reports it as missing instead of serving bytes the
+ * asset never pointed at. Relink records the new file and brings it back.
+ */
+import { stat } from "node:fs/promises";
+import { Asset } from "@nodetool-ai/models";
+import { assetKeyOwner, normalizeStorageKey } from "@nodetool-ai/storage";
+import { getAssetFileName } from "./asset-paths.js";
+import { isRuntimeScratchKey } from "./storage-access.js";
+import { isFiniteNumber } from "./wire-values.js";
+/** The metadata keys that fingerprint an external file. Server-owned. */
+export const EXTERNAL_FINGERPRINT_KEYS = [
+    "external_size",
+    "external_mtime"
+];
+function recordedNumber(metadata, key) {
+    const value = metadata?.[key];
+    return isFiniteNumber(value) ? value : null;
+}
+/** The recorded mtime of an external asset, or null for a managed one. */
+export function externalAssetMtime(asset) {
+    if (!asset.external_path)
+        return null;
+    return recordedNumber(asset.metadata, "external_mtime");
+}
+/**
+ * The external file behind `asset` when it is present and unchanged, else
+ * null. mtimes compare at millisecond granularity. A row with no recorded
+ * size or mtime is checked for presence only.
+ */
+export async function verifiedExternalPath(asset) {
+    const path = asset.external_path;
+    if (!path)
+        return null;
+    let info;
+    try {
+        info = await stat(path);
+    }
+    catch {
+        return null;
+    }
+    if (!info.isFile())
+        return null;
+    const size = recordedNumber(asset.metadata, "external_size");
+    if (size !== null && size !== info.size)
+        return null;
+    const mtime = recordedNumber(asset.metadata, "external_mtime");
+    if (mtime !== null && Math.trunc(mtime) !== Math.trunc(info.mtimeMs)) {
+        return null;
+    }
+    return path;
+}
+/**
+ * Whether an external asset's file is missing or changed. Always false for a
+ * managed asset. One `stat`, so it is cheap enough for every asset response.
+ */
+export async function isExternalAssetOffline(asset) {
+    if (!asset.external_path)
+        return false;
+    return (await verifiedExternalPath(asset)) === null;
+}
+/**
+ * The external path behind `<owner>/<assetId>.<ext>` (or `<owner>/<assetId>`),
+ * or null. Only full asset ids resolve, only for the owner the key names, and
+ * only when the extension matches the one the row's content type maps to.
+ * Legacy flat keys and runtime scratch keys never resolve: external rows are
+ * always created under the owner-prefixed layout. An offline file resolves to
+ * null.
+ */
+export async function lookupExternalAssetPath(key) {
+    if (isRuntimeScratchKey(key))
+        return null;
+    const owner = assetKeyOwner(key);
+    if (!owner)
+        return null;
+    const fileName = normalizeStorageKey(key).slice(owner.length + 1);
+    if (!fileName || fileName.includes("/"))
+        return null;
+    const dot = fileName.lastIndexOf(".");
+    const assetId = dot > 0 ? fileName.slice(0, dot) : fileName;
+    const asset = await Asset.find(owner, assetId);
+    if (!asset?.external_path || asset.id !== assetId)
+        return null;
+    if (dot > 0 && fileName !== getAssetFileName(asset.id, asset.content_type)) {
+        return null;
+    }
+    return verifiedExternalPath(asset);
+}
+//# sourceMappingURL=external-asset-lookup.js.map

package/dist/lib/external-asset-lookup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-asset-lookup.js","sourceRoot":"","sources":["../../src/lib/external-asset-lookup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAQlD,yEAAyE;AACzE,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,eAAe;IACf,gBAAgB;CACR,CAAC;AAEX,SAAS,cAAc,CACrB,QAAwC,EACxC,GAA+C;IAE/C,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,KAA0B;IAC3D,IAAI,CAAC,KAAK,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAA0B;IAE1B,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC7D,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC/D,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA0B;IAE1B,IAAI,CAAC,KAAK,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,CAAC,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAW;IAEX,IAAI,mBAAmB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC5D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,EAAE,aAAa,IAAI,KAAK,CAAC,EAAE,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,GAAG,GAAG,CAAC,IAAI,QAAQ,KAAK,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;AACrC,CAAC"}

package/dist/lib/external-assets.d.ts

@@ -0,0 +1,13 @@
+/** Setting (and env var) holding the size, in bytes, at which imports stay in place. */
+export declare const EXTERNAL_ASSET_THRESHOLD_SETTING = "NODETOOL_EXTERNAL_ASSET_THRESHOLD_BYTES";
+/** Default threshold: 1 GiB. */
+export declare const DEFAULT_EXTERNAL_ASSET_THRESHOLD_BYTES: number;
+/** Whether this server may create external asset references. */
+export declare function externalAssetsAvailable(): boolean;
+/**
+ * The import size at or above which the desktop app references a file in
+ * place. Read from the settings table, then the environment. A missing,
+ * non-numeric, or non-positive value falls back to the default.
+ */
+export declare function getExternalAssetThresholdBytes(): Promise<number>;
+//# sourceMappingURL=external-assets.d.ts.map

package/dist/lib/external-assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-assets.d.ts","sourceRoot":"","sources":["../../src/lib/external-assets.ts"],"names":[],"mappings":"AAaA,wFAAwF;AACxF,eAAO,MAAM,gCAAgC,4CACF,CAAC;AAE5C,gCAAgC;AAChC,eAAO,MAAM,sCAAsC,QAAqB,CAAC;AAEzE,gEAAgE;AAChE,wBAAgB,uBAAuB,IAAI,OAAO,CAIjD;AAED;;;;GAIG;AACH,wBAAsB,8BAA8B,IAAI,OAAO,CAAC,MAAM,CAAC,CActE"}

package/dist/lib/external-assets.js

@@ -0,0 +1,46 @@
+/**
+ * When an import references a local file in place instead of copying it.
+ *
+ * Only the local desktop/dev server does this: the asset store must be the
+ * local file backend, and `NODETOOL_ENV=production` refuses it the same way
+ * it refuses the local file browser. A stored path is a read capability on
+ * the host, so it is never offered where the host is shared.
+ */
+import { loadAssetStorageConfig } from "@nodetool-ai/config";
+import { FileStorageAdapter } from "@nodetool-ai/storage";
+import { getSetting } from "../settings-registry.js";
+import { getAssetAdapter } from "./storage.js";
+/** Setting (and env var) holding the size, in bytes, at which imports stay in place. */
+export const EXTERNAL_ASSET_THRESHOLD_SETTING = "NODETOOL_EXTERNAL_ASSET_THRESHOLD_BYTES";
+/** Default threshold: 1 GiB. */
+export const DEFAULT_EXTERNAL_ASSET_THRESHOLD_BYTES = 1024 * 1024 * 1024;
+/** Whether this server may create external asset references. */
+export function externalAssetsAvailable() {
+    if (process.env["NODETOOL_ENV"] === "production")
+        return false;
+    if (loadAssetStorageConfig().kind !== "file")
+        return false;
+    return getAssetAdapter() instanceof FileStorageAdapter;
+}
+/**
+ * The import size at or above which the desktop app references a file in
+ * place. Read from the settings table, then the environment. A missing,
+ * non-numeric, or non-positive value falls back to the default.
+ */
+export async function getExternalAssetThresholdBytes() {
+    let raw;
+    try {
+        raw = await getSetting(EXTERNAL_ASSET_THRESHOLD_SETTING);
+    }
+    catch {
+        raw = process.env[EXTERNAL_ASSET_THRESHOLD_SETTING] ?? null;
+    }
+    if (raw === null || raw.trim() === "") {
+        return DEFAULT_EXTERNAL_ASSET_THRESHOLD_BYTES;
+    }
+    const parsed = Number(raw);
+    return Number.isFinite(parsed) && parsed > 0
+        ? Math.floor(parsed)
+        : DEFAULT_EXTERNAL_ASSET_THRESHOLD_BYTES;
+}
+//# sourceMappingURL=external-assets.js.map

package/dist/lib/external-assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-assets.js","sourceRoot":"","sources":["../../src/lib/external-assets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,wFAAwF;AACxF,MAAM,CAAC,MAAM,gCAAgC,GAC3C,yCAAyC,CAAC;AAE5C,gCAAgC;AAChC,MAAM,CAAC,MAAM,sCAAsC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAEzE,gEAAgE;AAChE,MAAM,UAAU,uBAAuB;IACrC,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,sBAAsB,EAAE,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,eAAe,EAAE,YAAY,kBAAkB,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B;IAClD,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,UAAU,CAAC,gCAAgC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,IAAI,IAAI,CAAC;IAC9D,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtC,OAAO,sCAAsC,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;QAC1C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QACpB,CAAC,CAAC,sCAAsC,CAAC;AAC7C,CAAC"}

package/dist/lib/fly-replay.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Route a resuming WebSocket handshake to the machine running the job.
+ *
+ * A workflow run lives in one process: its `JobRunSession` — replay buffer,
+ * cancel/stream hooks — is process-wide, not shared. With more than one
+ * instance behind the Fly proxy a reconnecting client is balanced onto an
+ * arbitrary machine, where `reconnect_job` finds no session and degrades to the
+ * persisted row: the run continues, but the client sees no frames and its Stop
+ * reaches nothing.
+ *
+ * Fly's proxy answers this with `fly-replay`. A response carrying
+ * `fly-replay: instance=<machine>` makes the proxy re-issue the *whole*
+ * request — an upgrade included, before any WebSocket frame exists — at the
+ * named machine. So the client hints which run it wants to resume
+ * (`?resume_job=<jobId>`), and the handshake is replayed at the instance the
+ * job row says owns it. Everything else upgrades normally.
+ *
+ * Bounded to one hop: the proxy stamps `fly-replay-src` on a request it
+ * replayed, and a request carrying that header is never replayed again. A
+ * machine that is gone fails the replay and the client's own reconnect retries
+ * — the run's row is still the fallback either way.
+ */
+import type { FastifyReply, FastifyRequest } from "fastify";
+/**
+ * Answer the handshake with a replay instruction, if it belongs elsewhere.
+ * Returns true when the request has been answered and must not be upgraded.
+ *
+ * Every failure — no hint, unknown job, another user's job, a DB that cannot
+ * be reached — falls through to a normal upgrade. Routing is an optimization;
+ * refusing connections when it cannot be computed would be strictly worse than
+ * the single-machine behavior it replaces.
+ */
+export declare function replayUpgradeToOwner(req: FastifyRequest, reply: FastifyReply): Promise<boolean>;
+//# sourceMappingURL=fly-replay.d.ts.map

package/dist/lib/fly-replay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fly-replay.d.ts","sourceRoot":"","sources":["../../src/lib/fly-replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAoB5D;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,OAAO,CAAC,CAiElB"}

package/dist/lib/fly-replay.js

@@ -0,0 +1,111 @@
+/**
+ * Route a resuming WebSocket handshake to the machine running the job.
+ *
+ * A workflow run lives in one process: its `JobRunSession` — replay buffer,
+ * cancel/stream hooks — is process-wide, not shared. With more than one
+ * instance behind the Fly proxy a reconnecting client is balanced onto an
+ * arbitrary machine, where `reconnect_job` finds no session and degrades to the
+ * persisted row: the run continues, but the client sees no frames and its Stop
+ * reaches nothing.
+ *
+ * Fly's proxy answers this with `fly-replay`. A response carrying
+ * `fly-replay: instance=<machine>` makes the proxy re-issue the *whole*
+ * request — an upgrade included, before any WebSocket frame exists — at the
+ * named machine. So the client hints which run it wants to resume
+ * (`?resume_job=<jobId>`), and the handshake is replayed at the instance the
+ * job row says owns it. Everything else upgrades normally.
+ *
+ * Bounded to one hop: the proxy stamps `fly-replay-src` on a request it
+ * replayed, and a request carrying that header is never replayed again. A
+ * machine that is gone fails the replay and the client's own reconnect retries
+ * — the run's row is still the fallback either way.
+ */
+import { createLogger } from "@nodetool-ai/config";
+import { Job } from "@nodetool-ai/models";
+import { getInstanceId, isValidInstanceId } from "./instance-id.js";
+import { isWebSocketUpgrade } from "./ws-upgrade.js";
+const log = createLogger("nodetool.websocket.fly-replay");
+/** A run in one of these states has no session left to route to. */
+const TERMINAL_STATUSES = new Set(["completed", "failed", "cancelled"]);
+/**
+ * Grace for the proxy to read the replay response before the socket is torn
+ * down. `end()` alone waits for the peer's FIN, which a hostile or wedged
+ * client never sends — the CLOSE_WAIT fd leak `ws-upgrade.ts` documents.
+ */
+const REPLAY_SOCKET_LINGER_MS = 5000;
+/**
+ * Answer the handshake with a replay instruction, if it belongs elsewhere.
+ * Returns true when the request has been answered and must not be upgraded.
+ *
+ * Every failure — no hint, unknown job, another user's job, a DB that cannot
+ * be reached — falls through to a normal upgrade. Routing is an optimization;
+ * refusing connections when it cannot be computed would be strictly worse than
+ * the single-machine behavior it replaces.
+ */
+export async function replayUpgradeToOwner(req, reply) {
+    if (!isWebSocketUpgrade(req))
+        return false;
+    // Already replayed once — accept it here rather than bounce it again.
+    if (req.headers["fly-replay-src"])
+        return false;
+    const instanceId = getInstanceId();
+    if (!instanceId)
+        return false;
+    const jobId = new URLSearchParams(req.url.split("?")[1] ?? "").get("resume_job");
+    if (!jobId)
+        return false;
+    const userId = req.userId;
+    if (!userId)
+        return false;
+    let owner = null;
+    try {
+        const job = await Job.find(userId, jobId);
+        if (!job || TERMINAL_STATUSES.has(job.status))
+            return false;
+        owner = job.runner_instance;
+    }
+    catch (err) {
+        log.warn("Could not resolve the owner of a resuming job", {
+            jobId,
+            error: err instanceof Error ? err.message : String(err)
+        });
+        return false;
+    }
+    if (!owner || owner === instanceId)
+        return false;
+    // The owner goes into a response header verbatim. A stored value that is not
+    // header-safe means someone's `NODETOOL_INSTANCE_ID` was malformed when the
+    // row was stamped; refuse to echo it rather than let a CRLF split the
+    // response we hand the proxy.
+    if (!isValidInstanceId(owner)) {
+        log.warn("Refusing to replay to a malformed instance id", { jobId, owner });
+        return false;
+    }
+    log.info("Replaying a resuming WebSocket upgrade to its owner", {
+        jobId,
+        owner
+    });
+    // An upgrade cannot be answered through `reply.send()` — see the doc comment
+    // on `denyUnauthorized`. Unlike a refusal this socket is *ended*, not
+    // destroyed: the proxy has to read the response to act on the header, and a
+    // destroyed socket may drop it.
+    reply.hijack();
+    const socket = req.raw.socket;
+    if (!socket || socket.destroyed)
+        return true;
+    socket.write("HTTP/1.1 409 Conflict\r\n" +
+        `fly-replay: instance=${owner}\r\n` +
+        "Connection: close\r\n" +
+        "Content-Length: 0\r\n" +
+        "\r\n");
+    socket.end();
+    // …but do not wait forever for the other side to finish closing.
+    const linger = setTimeout(() => {
+        if (!socket.destroyed)
+            socket.destroy();
+    }, REPLAY_SOCKET_LINGER_MS);
+    linger.unref?.();
+    socket.once("close", () => clearTimeout(linger));
+    return true;
+}
+//# sourceMappingURL=fly-replay.js.map

package/dist/lib/fly-replay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fly-replay.js","sourceRoot":"","sources":["../../src/lib/fly-replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAE1C,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,GAAG,GAAG,YAAY,CAAC,+BAA+B,CAAC,CAAC;AAE1D,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAExE;;;;GAIG;AACH,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAmB,EACnB,KAAmB;IAEnB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,sEAAsE;IACtE,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAAE,OAAO,KAAK,CAAC;IAEhD,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9B,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAChE,YAAY,CACb,CAAC;IACF,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEzB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5D,KAAK,GAAG,GAAG,CAAC,eAAe,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,+CAA+C,EAAE;YACxD,KAAK;YACL,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IACjD,6EAA6E;IAC7E,4EAA4E;IAC5E,sEAAsE;IACtE,8BAA8B;IAC9B,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,qDAAqD,EAAE;QAC9D,KAAK;QACL,KAAK;KACN,CAAC,CAAC;IAEH,6EAA6E;IAC7E,sEAAsE;IACtE,4EAA4E;IAC5E,gCAAgC;IAChC,KAAK,CAAC,MAAM,EAAE,CAAC;IACf,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,CAAC,KAAK,CACV,2BAA2B;QACzB,wBAAwB,KAAK,MAAM;QACnC,uBAAuB;QACvB,uBAAuB;QACvB,MAAM,CACT,CAAC;IACF,MAAM,CAAC,GAAG,EAAE,CAAC;IACb,iEAAiE;IACjE,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE;QAC7B,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC1C,CAAC,EAAE,uBAAuB,CAAC,CAAC;IAC5B,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;IACjB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/http-rate-limit.d.ts

@@ -0,0 +1,32 @@
+interface HttpRateLimitConfig {
+    enabled: boolean;
+    max: number;
+    /** Window length in milliseconds. */
+    timeWindow: number;
+    /**
+     * When true, derive the client key from req.ip (X-Forwarded-For aware). Only
+     * safe behind a trusted proxy — otherwise clients can spoof the header to mint
+     * unlimited fresh buckets.
+     */
+    trustProxy: boolean;
+}
+export declare function getHttpRateLimitConfig(): HttpRateLimitConfig;
+interface KeyableRequest {
+    ip?: string;
+    socket?: {
+        remoteAddress?: string;
+    };
+}
+/**
+ * Derive the rate-limit bucket key for a request.
+ *
+ * Defaults to the raw socket address rather than req.ip: with `trustProxy` on at
+ * the Fastify level, req.ip reflects the (spoofable) X-Forwarded-For header, so a
+ * client could mint unlimited fresh buckets and bypass the limit entirely. Set
+ * `trustProxy` only when a trusted reverse proxy populates the header.
+ */
+export declare function rateLimitKey(req: KeyableRequest, trustProxy: boolean): string;
+/** Localhost is never rate limited (mirrors the auth hook's localhost bypass). */
+export declare function isRateLimitExempt(key: string): boolean;
+export {};
+//# sourceMappingURL=http-rate-limit.d.ts.map

package/dist/lib/http-rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-rate-limit.d.ts","sourceRoot":"","sources":["../../src/lib/http-rate-limit.ts"],"names":[],"mappings":"AAkBA,UAAU,mBAAmB;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,sBAAsB,IAAI,mBAAmB,CAO5D;AAED,UAAU,cAAc;IACtB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,CAK7E;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOtD"}

package/dist/lib/http-rate-limit.js

@@ -0,0 +1,47 @@
+/**
+ * Per-IP HTTP request rate limiting configuration for the Fastify server.
+ *
+ * Backs `@fastify/rate-limit` to blunt brute-force (e.g. repeated auth attempts)
+ * and crude HTTP flooding. Tunable via environment variables:
+ *
+ *   NODETOOL_RATE_LIMIT_DISABLED      Set truthy to turn the limiter off.
+ *   NODETOOL_RATE_LIMIT_MAX           Max requests per window per IP (default 1000).
+ *   NODETOOL_RATE_LIMIT_WINDOW_MS     Window length in ms (default 60000).
+ *   NODETOOL_RATE_LIMIT_TRUST_PROXY   Key by X-Forwarded-For (req.ip) instead of
+ *                                     the socket address. Only enable behind a
+ *                                     trusted proxy that sets the header.
+ *
+ * Localhost is always exempt so local/Electron usage is never throttled — the
+ * same posture the auth hook takes.
+ */
+import { parseIntEnv, parseBoolEnv } from "./env-config.js";
+export function getHttpRateLimitConfig() {
+    return {
+        enabled: !parseBoolEnv("NODETOOL_RATE_LIMIT_DISABLED"),
+        max: parseIntEnv("NODETOOL_RATE_LIMIT_MAX", 1000),
+        timeWindow: parseIntEnv("NODETOOL_RATE_LIMIT_WINDOW_MS", 60_000),
+        trustProxy: parseBoolEnv("NODETOOL_RATE_LIMIT_TRUST_PROXY")
+    };
+}
+/**
+ * Derive the rate-limit bucket key for a request.
+ *
+ * Defaults to the raw socket address rather than req.ip: with `trustProxy` on at
+ * the Fastify level, req.ip reflects the (spoofable) X-Forwarded-For header, so a
+ * client could mint unlimited fresh buckets and bypass the limit entirely. Set
+ * `trustProxy` only when a trusted reverse proxy populates the header.
+ */
+export function rateLimitKey(req, trustProxy) {
+    if (trustProxy) {
+        return req.ip ?? req.socket?.remoteAddress ?? "unknown";
+    }
+    return req.socket?.remoteAddress ?? req.ip ?? "unknown";
+}
+/** Localhost is never rate limited (mirrors the auth hook's localhost bypass). */
+export function isRateLimitExempt(key) {
+    return (key === "127.0.0.1" ||
+        key === "::1" ||
+        key === "::ffff:127.0.0.1" ||
+        key === "localhost");
+}
+//# sourceMappingURL=http-rate-limit.js.map

package/dist/lib/http-rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-rate-limit.js","sourceRoot":"","sources":["../../src/lib/http-rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAe5D,MAAM,UAAU,sBAAsB;IACpC,OAAO;QACL,OAAO,EAAE,CAAC,YAAY,CAAC,8BAA8B,CAAC;QACtD,GAAG,EAAE,WAAW,CAAC,yBAAyB,EAAE,IAAI,CAAC;QACjD,UAAU,EAAE,WAAW,CAAC,+BAA+B,EAAE,MAAM,CAAC;QAChE,UAAU,EAAE,YAAY,CAAC,iCAAiC,CAAC;KAC5D,CAAC;AACJ,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,GAAmB,EAAE,UAAmB;IACnE,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,SAAS,CAAC;IAC1D,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;AAC1D,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO,CACL,GAAG,KAAK,WAAW;QACnB,GAAG,KAAK,KAAK;QACb,GAAG,KAAK,kBAAkB;QAC1B,GAAG,KAAK,WAAW,CACpB,CAAC;AACJ,CAAC"}

package/dist/lib/http-tracing.d.ts

@@ -0,0 +1,12 @@
+/** Owner-validated incoming ancestry is reserved for durable run roots.
+ * HTTP request spans remain independent of run traces.
+ */
+import { type SpanContext } from "@opentelemetry/api";
+import type { FastifyInstance, FastifyRequest } from "fastify";
+export declare function acceptedRunTraceParent(request: FastifyRequest): SpanContext | undefined;
+export interface HttpTracingOptions {
+    readonly authorizeTraceParent?: (request: FastifyRequest, parent: SpanContext) => Promise<boolean>;
+}
+/** Called after authentication. A visitor session cannot join its owner's trace. */
+export declare function registerHttpTracing(app: FastifyInstance, options?: HttpTracingOptions): void;
+//# sourceMappingURL=http-tracing.d.ts.map

package/dist/lib/http-tracing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-tracing.d.ts","sourceRoot":"","sources":["../../src/lib/http-tracing.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAML,KAAK,WAAW,EAIjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAQ/D,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,cAAc,GAAG,WAAW,GAAG,SAAS,CAEvF;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACpG;AAED,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,GAAE,kBAAuB,GAAG,IAAI,CA2EhG"}

package/dist/lib/http-tracing.js

@@ -0,0 +1,81 @@
+/** Owner-validated incoming ancestry is reserved for durable run roots.
+ * HTTP request spans remain independent of run traces.
+ */
+import { context, propagation, SpanKind, ROOT_CONTEXT, isSpanContextValid, SpanStatusCode, trace } from "@opentelemetry/api";
+import { getTracer } from "@nodetool-ai/runtime";
+/** Probes a load balancer polls; a trace per poll is noise. */
+const UNTRACED_PATHS = new Set(["/health", "/ready"]);
+const acceptedParents = new WeakMap();
+export function acceptedRunTraceParent(request) {
+    return acceptedParents.get(request);
+}
+/** Called after authentication. A visitor session cannot join its owner's trace. */
+export function registerHttpTracing(app, options = {}) {
+    const spans = new WeakMap();
+    app.addHook("onRequest", (request, _reply, done) => {
+        const tracer = getTracer();
+        const path = request.url.split("?")[0] ?? "/";
+        // A WebSocket upgrade holds its socket for the whole session. A span
+        // around it would stay open and parent every job the socket runs.
+        if (!tracer ||
+            request.headers.upgrade !== undefined ||
+            UNTRACED_PATHS.has(path)) {
+            done();
+            return;
+        }
+        const extracted = propagation.extract(ROOT_CONTEXT, request.headers);
+        const incoming = trace.getSpanContext(extracted);
+        const authorize = incoming && isSpanContextValid(incoming) && options.authorizeTraceParent
+            ? options.authorizeTraceParent(request, incoming)
+            : Promise.resolve(false);
+        void authorize.then((allowed) => {
+            if (allowed && incoming) {
+                acceptedParents.set(request, incoming);
+            }
+            // Run roots consume the validated parent directly. Request spans remain unrelated.
+            const parent = ROOT_CONTEXT;
+            const span = tracer.startSpan(request.method, {
+                kind: SpanKind.SERVER,
+                attributes: {
+                    "http.request.method": request.method,
+                    "url.path": path,
+                    "url.scheme": request.protocol
+                }
+            }, parent);
+            spans.set(request, span);
+            context.with(trace.setSpan(parent, span), done);
+        }).catch(done);
+    });
+    app.addHook("onError", (request, _reply, error, done) => {
+        spans.get(request)?.recordException(error);
+        done();
+    });
+    app.addHook("onResponse", (request, reply, done) => {
+        const span = spans.get(request);
+        if (span) {
+            spans.delete(request);
+            const route = request.routeOptions.url;
+            if (route !== undefined) {
+                span.setAttribute("http.route", route);
+                span.updateName(`${request.method} ${route}`);
+            }
+            span.setAttribute("http.response.status_code", reply.statusCode);
+            if (reply.statusCode >= 500) {
+                span.setAttribute("error.type", String(reply.statusCode));
+                span.setStatus({ code: SpanStatusCode.ERROR });
+            }
+            span.end();
+        }
+        done();
+    });
+    app.addHook("onRequestAbort", (request, done) => {
+        const span = spans.get(request);
+        if (span) {
+            spans.delete(request);
+            span.setStatus({ code: SpanStatusCode.ERROR, message: "aborted" });
+            span.end();
+        }
+        done();
+    });
+}
+//# sourceMappingURL=http-tracing.js.map

package/dist/lib/http-tracing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-tracing.js","sourceRoot":"","sources":["../../src/lib/http-tracing.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EACL,OAAO,EACP,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,kBAAkB,EAElB,cAAc,EACd,KAAK,EAEN,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,+DAA+D;AAC/D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEtD,MAAM,eAAe,GAAG,IAAI,OAAO,EAA+B,CAAC;AAEnE,MAAM,UAAU,sBAAsB,CAAC,OAAuB;IAC5D,OAAO,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAMD,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,GAAoB,EAAE,OAAO,GAAuB,EAAE;IACxF,MAAM,KAAK,GAAG,IAAI,OAAO,EAAwB,CAAC;IAElD,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QAC9C,qEAAqE;QACrE,kEAAkE;QAClE,IACE,CAAC,MAAM;YACP,OAAO,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS;YACrC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EACxB,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,QAAQ,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,oBAAoB;YACxF,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC;YACjD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3B,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAC9B,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAAC,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAAC,CAAC;YACpE,mFAAmF;YACnF,MAAM,MAAM,GAAG,YAAY,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAC3B,OAAO,CAAC,MAAM,EACd;gBACE,IAAI,EAAE,QAAQ,CAAC,MAAM;gBACrB,UAAU,EAAE;oBACV,qBAAqB,EAAE,OAAO,CAAC,MAAM;oBACrC,UAAU,EAAE,IAAI;oBAChB,YAAY,EAAE,OAAO,CAAC,QAAQ;iBAC/B;aACF,EACD,MAAM,CACP,CAAC;YACF,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtD,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC;YACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACvC,IAAI,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YACjE,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;gBAC5B,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC1D,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC"}