@north-light/cli 0.3.560 → 0.3.562

package/dist/core/feed/messages.js

@@ -1,8 +1,8 @@
-var _=Object.defineProperty;var o=(r,e)=>_(r,"name",{value:e,configurable:!0});import{existsSync as N,mkdirSync as E,renameSync as I,writeFileSync as b}from"node:fs";import{randomBytes as v,randomUUID as k}from"node:crypto";import{join as h}from"node:path";import{cancelCronsOnWake as R}from"../canvas/crons.js";import{withCanvasWrite as l,openDb as S}from"../canvas/db.js";import{getRow as D}from"../canvas/canvas.js";import{messagesDir as T}from"../canvas/paths.js";import{syncDirectory as A,syncFile as O}from"../fs-utils.js";import{settleDeadControllerWait as x,settleMatchingControllerWait as L}from"../canvas/waits.js";import{generateOperationId as C,operationIdContext as J,validateOperationId as M}from"../events/operation-id.js";import{clipBody as U}from"../../shared/inbox-entry-body.js";function u(){let r;do r=v(16).toString("hex");while(r==="00000000000000000000000000000000");return r}o(u,"newId");function W(r,e){const t=JSON.stringify(r);if(t===void 0)throw new TypeError(`${e} must be JSON-serializable`);return t}o(W,"stringify");async function q(r,e){return e!=="normal"&&e!=="deferred"?e:(await D(r))?.lifecycle==="terminal"?"urgent":e}o(q,"effectiveTier");function $(r,e,t){const n=T(r);N(n)||E(n,{recursive:!0});const a=e.replace(/[^0-9]/g,""),d=h(n,`${a}-${k().slice(0,6)}.md`),i=`${d}.tmp`;return b(i,t,"utf8"),O(i),I(i,d),A(n),d}o($,"writeMessageBody");function F(r){if(typeof r!="object"||r===null)return"";const e=r.body;return typeof e=="string"?e.trim():""}o(F,"inlineBody");async function y(r,e){const t=e.messageId??u(),n=Number((await r.prepare("UPDATE message_sequence SET seq = seq + 1 WHERE id = 1 RETURNING seq").get()).seq);return await r.prepare(`INSERT INTO messages
+var p=Object.defineProperty;var o=(r,e)=>p(r,"name",{value:e,configurable:!0});import{randomBytes as N,randomUUID as E}from"node:crypto";import{join as I}from"node:path";import{cancelCronsOnWake as b}from"../canvas/crons.js";import{withCanvasWrite as c,openDb as v}from"../canvas/db.js";import{getRow as k}from"../canvas/canvas.js";import{messagesDir as h}from"../canvas/paths.js";import{settleDeadControllerWait as R,settleMatchingControllerWait as D}from"../canvas/waits.js";import{generateOperationId as S,operationIdContext as T,validateOperationId as A}from"../events/operation-id.js";import{clipBody as O}from"../../shared/inbox-entry-body.js";function u(){let r;do r=N(16).toString("hex");while(r==="00000000000000000000000000000000");return r}o(u,"newId");function x(r,e){const n=JSON.stringify(r);if(n===void 0)throw new TypeError(`${e} must be JSON-serializable`);return n}o(x,"stringify");async function L(r,e){return e!=="normal"&&e!=="deferred"?e:(await k(r))?.lifecycle==="terminal"?"urgent":e}o(L,"effectiveTier");function C(r,e){return I(h(r),`${e.replace(/[^0-9]/g,"")}-${E().slice(0,6)}.md`)}o(C,"overflowBodyPath");function J(r){if(typeof r!="object"||r===null)return"";const e=r.body;return typeof e=="string"?e.trim():""}o(J,"inlineBody");async function y(r,e){const n=e.messageId??u(),t=Number((await r.prepare("UPDATE message_sequence SET seq = seq + 1 WHERE id = 1 RETURNING seq").get()).seq);return await r.prepare(`INSERT INTO messages
        (message_id, seq, operation_id, created_at, sender_node_id, sender_name, kind, label, body_ref, body_json, disposition,
         event, object_id, level, actor_id, cause_message_id, depth)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(t,n,e.operationId,e.createdAt,e.senderNodeId,e.senderName,e.kind,e.label,e.bodyRef,e.bodyJson===void 0?null:W(e.bodyJson,"message body"),e.disposition,e.event?.event??null,e.event?.objectId??null,e.event?.level??null,e.event?.actorId??null,e.causeMessageId??null,e.depth??0),t}o(y,"insertMessage");async function m(r,e,t,n,a,d,i){const s=u();return await r.prepare(`INSERT INTO deliveries
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(n,t,e.operationId,e.createdAt,e.senderNodeId,e.senderName,e.kind,e.label,e.bodyRef,e.bodyJson===void 0?null:x(e.bodyJson,"message body"),e.disposition,e.event?.event??null,e.event?.objectId??null,e.event?.level??null,e.event?.actorId??null,e.causeMessageId??null,e.depth??0),n}o(y,"insertMessage");async function f(r,e,n,t,a,d,s){const i=u();return await r.prepare(`INSERT INTO deliveries
        (delivery_id, message_id, destination_id, urgency, wake, state, idempotency_key, created_at, updated_at)
-     VALUES (?, ?, ?, ?, ?, 'pending', ?, ?, ?)`).run(s,e,t,n,a,i??null,d,d),s}o(m,"insertNodeDelivery");function f(r,e){const t=new Date().toISOString(),n=r.operationId===void 0?J.current()??C():M(r.operationId);let a=r.bodyRef??null,d=r.bodyJson;if(a===null&&e!==null&&r.senderNodeId!=="human"){const i=F(d),s=U(i);s.clipped&&(a=$(e,t,i),d={...d,body:s.text})}return{createdAt:t,operationId:n,bodyRef:a,bodyJson:d}}o(f,"finalizeNodeMail");async function j(r,e){const t=f(e,r);return await l(async n=>{const a=await n.prepare("SELECT run_id FROM nodes WHERE node_id = ?").get(r);if(a?.run_id&&(await n.prepare("SELECT deleting_at FROM nodes WHERE node_id = ?").get(a.run_id))?.deleting_at)throw new Error("run is deleting");if(e.idempotencyKey!==void 0){const c=await n.prepare(`SELECT d.delivery_id, d.message_id, d.urgency, m.created_at
-        FROM deliveries d JOIN messages m ON m.message_id = d.message_id WHERE d.idempotency_key = ?`).get(e.idempotencyKey);if(c!==void 0)return{messageId:c.message_id,deliveryId:c.delivery_id,urgency:c.urgency,createdAt:c.created_at}}const d=Date.now(),i=await q(r,e.urgency),s=await y(n,{messageId:e.messageId,operationId:t.operationId,createdAt:t.createdAt,senderNodeId:e.senderNodeId??null,senderName:e.senderName??null,kind:e.kind,label:e.label,bodyRef:t.bodyRef,bodyJson:t.bodyJson,disposition:e.disposition??null}),p=await m(n,s,r,i,e.wake,d,e.idempotencyKey);return await L(r,e.senderNodeId??null,d,n),await e.withinEnqueue?.(n,s),e.wake===1&&i!=="deferred"&&await g(r),{messageId:s,deliveryId:p,urgency:i,createdAt:t.createdAt}})}o(j,"enqueueNodeMail");function re(r){switch(r){case"interrupt":return{urgency:"critical",wake:1};case"steer":return{urgency:"urgent",wake:1};case"after-turn":return{urgency:"normal",wake:1};case"next-turn":return{urgency:"deferred",wake:0}}}o(re,"listenDeliveryTier");async function w(r,e,t){const n={kind:"update",label:t.label??"notice",bodyJson:{body:t.body},urgency:t.tier,wake:t.wake},a=f(n,e),d=Date.now(),i=await y(r,{operationId:a.operationId,createdAt:a.createdAt,senderNodeId:null,senderName:null,kind:n.kind,label:n.label,bodyRef:a.bodyRef,bodyJson:a.bodyJson,disposition:null}),s=await m(r,i,e,t.tier,t.wake,d);return{messageId:i,deliveryId:s,urgency:t.tier,createdAt:a.createdAt}}o(w,"insertNodeNotice");async function g(r){await l(async e=>{for(const t of await R(r))await w(e,r,{body:`Your cron ${t.name}, next scheduled for ${t.fire_at}, was canceled by this wake. Re-create it if you still need it.`,label:"cron canceled",tier:"normal",wake:1})})}o(g,"consumeDeadlineOnWake");async function te(r,e,t){const n=await w(r,e,t);return t.wake===1&&t.tier!=="deferred"&&await g(e),n}o(te,"queueNodeNotice");async function ne(r,e=Date.now()){return Number((await(await S()).prepare("UPDATE deliveries SET canceled_at = ?, updated_at = ? WHERE delivery_id = ? AND canceled_at IS NULL").run(e,e,r)).changes)===1}o(ne,"cancelDelivery");async function ae(r,e={}){return await l(async t=>{const n=["d.destination_id = ?","d.canceled_at IS NULL","d.state IN ('pending', 'handed_off')"],a=[r];e.senderNodeId!==void 0&&(n.push("m.sender_node_id IS NOT DISTINCT FROM ?"),a.push(e.senderNodeId)),e.kind!==void 0&&(n.push("m.kind = ?"),a.push(e.kind));const d=await t.prepareUncached(`SELECT d.delivery_id FROM deliveries d JOIN messages m ON m.message_id = d.message_id WHERE ${n.join(" AND ")}`).all(...a);if(d.length===0)return[];const i=Date.now();return await t.prepareUncached(`UPDATE deliveries SET canceled_at = ?, updated_at = ? WHERE delivery_id IN (${d.map(()=>"?").join(",")})`).run(i,i,...d.map(s=>s.delivery_id)),d.map(s=>s.delivery_id)})}o(ae,"cancelPendingNodeMail");async function de(r,e){return await l(async t=>{const n=Date.now(),a=await t.prepare(`SELECT target.status AS controller_status FROM waits w LEFT JOIN nodes target ON target.node_id = w.target_id
-        WHERE w.node_id = ? AND w.kind = 'controller' AND w.target_id = ? AND w.satisfied_at IS NULL`).get(r,e);if(a===void 0||a.controller_status==="active"||a.controller_status==="idle")return null;const d=await j(r,{kind:"urgent",label:"declared controller is no longer live",bodyJson:{body:`Controller ${e} is no longer live; the declared message wait was cleared.`},urgency:"urgent",wake:1});if(!await x(r,e,n,t))throw new Error(`controller wait changed while notifying ${r}`);return d})}o(de,"enqueueControllerDeathNotice");export{ne as cancelDelivery,ae as cancelPendingNodeMail,g as consumeDeadlineOnWake,q as effectiveTier,de as enqueueControllerDeathNotice,j as enqueueNodeMail,f as finalizeNodeMail,y as insertMessage,re as listenDeliveryTier,u as newId,te as queueNodeNotice};
+     VALUES (?, ?, ?, ?, ?, 'pending', ?, ?, ?)`).run(i,e,n,t,a,s??null,d,d),i}o(f,"insertNodeDelivery");function w(r,e){const n=new Date().toISOString(),t=r.operationId===void 0?T.current()??S():A(r.operationId);let a=r.bodyRef??null,d=r.bodyJson;if(a===null&&e!==null&&r.senderNodeId!=="human"){const s=J(d),i=O(s);i.clipped&&(a=C(e,n),d={...d,body:i.text,body_full:s})}return{createdAt:n,operationId:t,bodyRef:a,bodyJson:d}}o(w,"finalizeNodeMail");async function U(r,e){const n=w(e,r);return await c(async t=>{const a=await t.prepare("SELECT run_id FROM nodes WHERE node_id = ?").get(r);if(a?.run_id&&(await t.prepare("SELECT deleting_at FROM nodes WHERE node_id = ?").get(a.run_id))?.deleting_at)throw new Error("run is deleting");if(e.idempotencyKey!==void 0){const l=await t.prepare(`SELECT d.delivery_id, d.message_id, d.urgency, m.created_at
+        FROM deliveries d JOIN messages m ON m.message_id = d.message_id WHERE d.idempotency_key = ?`).get(e.idempotencyKey);if(l!==void 0)return{messageId:l.message_id,deliveryId:l.delivery_id,urgency:l.urgency,createdAt:l.created_at}}const d=Date.now(),s=await L(r,e.urgency),i=await y(t,{messageId:e.messageId,operationId:n.operationId,createdAt:n.createdAt,senderNodeId:e.senderNodeId??null,senderName:e.senderName??null,kind:e.kind,label:e.label,bodyRef:n.bodyRef,bodyJson:n.bodyJson,disposition:e.disposition??null}),_=await f(t,i,r,s,e.wake,d,e.idempotencyKey);return await D(r,e.senderNodeId??null,d,t),await e.withinEnqueue?.(t,i),e.wake===1&&s!=="deferred"&&await g(r),{messageId:i,deliveryId:_,urgency:s,createdAt:n.createdAt}})}o(U,"enqueueNodeMail");function z(r){switch(r){case"interrupt":return{urgency:"critical",wake:1};case"steer":return{urgency:"urgent",wake:1};case"after-turn":return{urgency:"normal",wake:1};case"next-turn":return{urgency:"deferred",wake:0}}}o(z,"listenDeliveryTier");async function m(r,e,n){const t={kind:"update",label:n.label??"notice",bodyJson:{body:n.body},urgency:n.tier,wake:n.wake},a=w(t,e),d=Date.now(),s=await y(r,{operationId:a.operationId,createdAt:a.createdAt,senderNodeId:null,senderName:null,kind:t.kind,label:t.label,bodyRef:a.bodyRef,bodyJson:a.bodyJson,disposition:null}),i=await f(r,s,e,n.tier,n.wake,d);return{messageId:s,deliveryId:i,urgency:n.tier,createdAt:a.createdAt}}o(m,"insertNodeNotice");async function g(r){await c(async e=>{for(const n of await b(r))await m(e,r,{body:`Your cron ${n.name}, next scheduled for ${n.fire_at}, was canceled by this wake. Re-create it if you still need it.`,label:"cron canceled",tier:"normal",wake:1})})}o(g,"consumeDeadlineOnWake");async function V(r,e,n){const t=await m(r,e,n);return n.wake===1&&n.tier!=="deferred"&&await g(e),t}o(V,"queueNodeNotice");async function G(r,e=Date.now()){return Number((await(await v()).prepare("UPDATE deliveries SET canceled_at = ?, updated_at = ? WHERE delivery_id = ? AND canceled_at IS NULL").run(e,e,r)).changes)===1}o(G,"cancelDelivery");async function Y(r,e={}){return await c(async n=>{const t=["d.destination_id = ?","d.canceled_at IS NULL","d.state IN ('pending', 'handed_off')"],a=[r];e.senderNodeId!==void 0&&(t.push("m.sender_node_id IS NOT DISTINCT FROM ?"),a.push(e.senderNodeId)),e.kind!==void 0&&(t.push("m.kind = ?"),a.push(e.kind));const d=await n.prepareUncached(`SELECT d.delivery_id FROM deliveries d JOIN messages m ON m.message_id = d.message_id WHERE ${t.join(" AND ")}`).all(...a);if(d.length===0)return[];const s=Date.now();return await n.prepareUncached(`UPDATE deliveries SET canceled_at = ?, updated_at = ? WHERE delivery_id IN (${d.map(()=>"?").join(",")})`).run(s,s,...d.map(i=>i.delivery_id)),d.map(i=>i.delivery_id)})}o(Y,"cancelPendingNodeMail");async function Q(r,e){return await c(async n=>{const t=Date.now(),a=await n.prepare(`SELECT target.status AS controller_status FROM waits w LEFT JOIN nodes target ON target.node_id = w.target_id
+        WHERE w.node_id = ? AND w.kind = 'controller' AND w.target_id = ? AND w.satisfied_at IS NULL`).get(r,e);if(a===void 0||a.controller_status==="active"||a.controller_status==="idle")return null;const d=await U(r,{kind:"urgent",label:"declared controller is no longer live",bodyJson:{body:`Controller ${e} is no longer live; the declared message wait was cleared.`},urgency:"urgent",wake:1});if(!await R(r,e,t,n))throw new Error(`controller wait changed while notifying ${r}`);return d})}o(Q,"enqueueControllerDeathNotice");export{G as cancelDelivery,Y as cancelPendingNodeMail,g as consumeDeadlineOnWake,L as effectiveTier,Q as enqueueControllerDeathNotice,U as enqueueNodeMail,w as finalizeNodeMail,y as insertMessage,z as listenDeliveryTier,u as newId,V as queueNodeNotice};

package/dist/core/grants/mirror.d.ts

@@ -78,6 +78,21 @@ export declare function grantSyncState(grantId: string): Promise<GrantSyncState
 export declare function grantSyncStateFor(grantee: string, sub: string): Promise<GrantSyncState | null>;
 /** The mirrored grant `grantId`, whatever its status, or null when the mirror lacks it or the row is unparsable. */
 export declare function grantRecord(grantId: string): Promise<GrantRecord | null>;
+/** How a grant stands for the effects of a change (`grant-effects`): `inactive` is a missing, revoked, removed or expired grant;
+ *  `lagging` is an active grant whose computed columns do not yet match its revision (it reads as no grant for requests but
+ *  stops nothing, because the directory's second write completes it). `sub`, `grantee` and `removal_done_at` come from the row
+ *  even when its computed columns lag; all are null when the row is gone. */
+export interface GrantStanding {
+    standing: 'active' | 'inactive' | 'lagging';
+    sub: string | null;
+    grantee: string | null;
+    status: GrantRecord['status'] | null;
+    removal_done_at: string | null;
+    record: GrantRecord | null;
+}
+export declare function grantStanding(grantId: string): Promise<GrantStanding>;
+/** Ids of the grants in `status` (this runtime's), for a catch-up pass. */
+export declare function grantIdsWhere(where: string): Promise<string[]>;
 /** Who a grant's model calls are charged to: `app` only for a mirrored grant the directory marked app-paid, else the person. */
 export declare function payerOfGrant(grantId: string | null | undefined): Promise<'user' | 'app'>;
 export declare function activeGrant(grantId: string): Promise<ActiveGrant | null>;

package/dist/core/grants/mirror.js

@@ -1,4 +1,16 @@
-var m=Object.defineProperty;var t=(e,r)=>m(e,"name",{value:r,configurable:!0});import{createHash as S}from"node:crypto";import{parseScope as T}from"@north-light/identity";import{openDb as c,withCanvasWrite as O}from"../canvas/db.js";import{isUnsandboxedMachine as v}from"../runtime/unsandboxed.js";import{replaceWrittenBy as w,userSubject as x}from"../permissions/facts.js";import{GROUP_TYPE as R}from"../permissions/builtin.js";const A=["not_started","pending","ready","failed","unavailable"],N=["ultra","strong","medium","light"];function p(e){if(!Array.isArray(e))throw new TypeError("grant scopes must be a list");return e.map(r=>{if(!r||typeof r!="object"||typeof r.scope!="string"||!["always","ask"].includes(r.mode))throw new TypeError("invalid grant scope entry");return{scope:r.scope,mode:r.mode}})}t(p,"entries");function h(e){if(!e||typeof e!="object"||Array.isArray(e))return null;const{state:r,message:n,next:i,step:o}=e;return typeof r!="string"||!A.includes(r)||n!==void 0&&typeof n!="string"||o!==void 0&&typeof o!="string"||typeof i!="string"||!i?null:{state:r,...n===void 0?{}:{message:n},next:i,...o===void 0?{}:{step:o}}}t(h,"dependencyOf");function y(e){if(!e||typeof e!="object"||Array.isArray(e))return{};const r={};for(const[n,i]of Object.entries(e)){const o=h(i);o&&(r[n]=o)}return r}t(y,"dependenciesOf");function b(e){if(!e||typeof e!="object"||Array.isArray(e))return null;const{base_url:r,rungs:n}=e;if(typeof r!="string"||!r||!n||typeof n!="object"||Array.isArray(n))return null;const i={};for(const o of N){const a=n[o];typeof a=="string"&&a&&(i[o]=a)}return Object.keys(i).length?{base_url:r.replace(/\/+$/,""),rungs:i}:null}t(b,"inferenceEndpointOf");function f(e){return{id:e.id,runtime:e.runtime,sub:e.sub,grantee:e.grantee,rev:e.rev,scopes:p(JSON.parse(e.scopes_json)),resolved_scopes:p(JSON.parse(e.resolved_scopes_json)),spend_cap:e.spend_cap,expires_at:e.expires_at,status:e.status,revoked_at:e.revoked_at,approved_at:e.approved_at,payer:e.payer,dependencies:y(JSON.parse(e.dependencies_json)),run_notice_url:e.run_notice_url??null,inference_endpoint:e.inference_endpoint_json?b(JSON.parse(e.inference_endpoint_json)):null,synced_at:e.synced_at}}t(f,"record");function u(e){if(!e||e.status!=="active")return null;try{return F(f(e))}catch(r){if(r instanceof TypeError||r instanceof SyntaxError)return null;throw r}}t(u,"active");function l(e){return e.grantee!=="app:terminal"&&v()}t(l,"mirrorOnly");async function I(){return(await L()).filter(e=>!l(e))}t(I,"localGrants");async function L(){return(await(await c()).prepare("SELECT * FROM grants").all()).flatMap(e=>{try{return[f(e)]}catch(r){if(r instanceof TypeError||r instanceof SyntaxError)return[];throw r}})}t(L,"allGrants");function j(e){return e.expires_at!==null&&!(Date.parse(e.expires_at)>Date.now())}t(j,"grantExpired");function F(e){if(e.status!=="active"||j(e))return null;try{const r=e.resolved_scopes.map(({scope:n})=>T(n));return{...e,resolved:e.resolved_scopes.flatMap(({mode:n},i)=>n==="always"?[r[i]]:[])}}catch(r){if(r instanceof TypeError||r instanceof SyntaxError)return null;throw r}}t(F,"activeRecord");function d(e){return Array.isArray(e)?`[${e.map(d).join(",")}]`:e&&typeof e=="object"?`{${Object.keys(e).sort().filter(r=>e[r]!==void 0).map(r=>`${JSON.stringify(r)}:${d(e[r])}`).join(",")}}`:JSON.stringify(e)??"null"}t(d,"canonicalJson");function U(e){const r={rev:e.rev,resolved_scopes:e.resolved_scopes,spend_cap:e.spend_cap,payer:e.payer,dependencies:e.dependencies??{},...e.inference_endpoint?{inference_endpoint:e.inference_endpoint}:{}};return S("sha256").update(d(r)).digest("base64url").slice(0,22)}t(U,"grantVersion");async function $(e){return!!await(await c()).prepare("SELECT 1 FROM grants WHERE id = ?").get(e)}t($,"hasGrant");async function P(e){return await(await c()).prepare("SELECT rev, status FROM grants WHERE id = ?").get(e)??null}t(P,"grantSyncState");async function V(e,r){return await(await c()).prepare("SELECT rev, status FROM grants WHERE grantee = ? AND sub = ?").get(e,r)??null}t(V,"grantSyncStateFor");async function M(e){const r=await(await c()).prepare("SELECT * FROM grants WHERE id = ?").get(e);if(!r)return null;try{return f(r)}catch(n){if(n instanceof TypeError||n instanceof SyntaxError)return null;throw n}}t(M,"grantRecord");async function B(e){return(e?(await M(e))?.payer:null)??"user"}t(B,"payerOfGrant");async function X(e){return u(await(await c()).prepare("SELECT * FROM grants WHERE id = ?").get(e))}t(X,"activeGrant");async function Y(e,r){return u(await(await c()).prepare("SELECT * FROM grants WHERE grantee = ? AND sub = ?").get(e,r))}t(Y,"grantFor");async function q(e){if(l({grantee:e}))return null;const r=await(await c()).prepare("SELECT * FROM grants WHERE grantee = ? AND status = 'active'").all(e);if(r.length>1)throw new Error(`multiple active grants for ${e}`);return u(r[0])}t(q,"activeGrantForApp");async function z(e){const r=await(await c()).prepare("SELECT run_notice_url AS url, sub, grantee FROM grants WHERE id = ? AND status = 'active'").get(e);return r&&r.url&&!l(r)?{url:r.url,sub:r.sub,grantee:r.grantee}:null}t(z,"runNoticeTarget");async function K(){const e=await(await c()).prepare("SELECT * FROM grants WHERE grantee = 'app:terminal' AND status = 'active'").all();if(e.length>1)throw new Error("multiple active terminal grants");return u(e[0])}t(K,"terminalGrant");async function Q(){return(await(await c()).prepare("SELECT value FROM runtime_state WHERE key = 'grants_source'").get())?.value??null}t(Q,"grantsSource");async function Z(e){return(await(await c()).prepare("SELECT value FROM runtime_state WHERE key = 'grants_source'").get())?.value===e}t(Z,"hasSyncedGrants");async function ee(e){return(await e.prepare("SELECT value FROM runtime_state WHERE key = 'grants_source'").get())?.value!=="local"?0:(await e.prepare("DELETE FROM runtime_state WHERE key = 'grants_source'").run(),Number((await e.prepare("DELETE FROM grants").run()).changes))}t(ee,"dropLocalGrantMirror");function re(e){if(e===void 0)return[];if(!Array.isArray(e))throw new TypeError("invalid grant sync response");return e.map(r=>{const{team:n,members:i}=r??{};if(typeof n!="string"||!/^team:\S+$/.test(n)||!Array.isArray(i)||i.some(o=>typeof o!="string"||!/^user:[^\s*]+$/.test(o)))throw new TypeError("invalid grant sync response");return{team:n,members:i}})}t(re,"teamsOf");async function te(e,r,n,i=[]){const o=new Set;for(const a of e){if(o.has(a.id)||!a.id||!a.runtime||!a.sub||!a.grantee||!Number.isInteger(a.rev)||!["active","revoked","removed"].includes(a.status))throw new TypeError("invalid grant sync response");o.add(a.id),p(a.scopes),p(a.resolved_scopes)}await O(async a=>{await a.exec("DELETE FROM grants");const E=a.prepare(`INSERT INTO grants
+var T=Object.defineProperty;var r=(e,n)=>T(e,"name",{value:n,configurable:!0});import{createHash as N}from"node:crypto";import{parseScope as O}from"@north-light/identity";import{openDb as d,withCanvasWrite as j}from"../canvas/db.js";import{isUnsandboxedMachine as w}from"../runtime/unsandboxed.js";import{replaceWrittenBy as h,userSubject as A}from"../permissions/facts.js";import{GROUP_TYPE as b}from"../permissions/builtin.js";const R=["not_started","pending","ready","failed","unavailable"],k=["ultra","strong","medium","light"];function D(){const e=process.env.CRTR_RUNTIME;return e?{sql:" AND runtime = ?",args:[e]}:{sql:"",args:[]}}r(D,"runtimeScope");async function u(e,n,t=[]){const s=D();return await(await d()).prepare(`SELECT ${e} FROM grants WHERE ${n}${s.sql}`).all(...t,...s.args)}r(u,"grantRows");async function c(e,n,t=[]){return(await u(e,n,t))[0]}r(c,"grantRow");function l(e){if(!Array.isArray(e))throw new TypeError("grant scopes must be a list");return e.map(n=>{if(!n||typeof n!="object"||typeof n.scope!="string"||!["always","ask"].includes(n.mode))throw new TypeError("invalid grant scope entry");return{scope:n.scope,mode:n.mode}})}r(l,"entries");function C(e){if(!e||typeof e!="object"||Array.isArray(e))return null;const{state:n,message:t,next:s,step:i}=e;return typeof n!="string"||!R.includes(n)||t!==void 0&&typeof t!="string"||i!==void 0&&typeof i!="string"||typeof s!="string"||!s?null:{state:n,...t===void 0?{}:{message:t},next:s,...i===void 0?{}:{step:i}}}r(C,"dependencyOf");function m(e){if(!e||typeof e!="object"||Array.isArray(e))return{};const n={};for(const[t,s]of Object.entries(e)){const i=C(s);i&&(n[t]=i)}return n}r(m,"dependenciesOf");function I(e){if(!e||typeof e!="object"||Array.isArray(e))return null;const{base_url:n,rungs:t}=e;if(typeof n!="string"||!n||!t||typeof t!="object"||Array.isArray(t))return null;const s={};for(const i of k){const a=t[i];typeof a=="string"&&a&&(s[i]=a)}return Object.keys(s).length?{base_url:n.replace(/\/+$/,""),rungs:s}:null}r(I,"inferenceEndpointOf");function y(e){if(e.computed_rev!==e.rev||e.scopes_json===null||e.resolved_scopes_json===null)throw new TypeError("grant columns are not computed for this revision");return{id:e.id,runtime:e.runtime,sub:e.sub,grantee:e.grantee,rev:e.rev,scopes:l(JSON.parse(e.scopes_json)),resolved_scopes:l(JSON.parse(e.resolved_scopes_json)),spend_cap:e.spend_cap,expires_at:e.expires_at,status:e.status,revoked_at:e.revoked_at,approved_at:e.approved_at,payer:e.payer,dependencies:m(JSON.parse(e.dependencies_json??"{}")),run_notice_url:e.run_notice_url??null,inference_endpoint:e.inference_endpoint_json?I(JSON.parse(e.inference_endpoint_json)):null,synced_at:e.synced_at??""}}r(y,"record");function p(e){if(!e||e.status!=="active")return null;try{return M(y(e))}catch(n){if(n instanceof TypeError||n instanceof SyntaxError)return null;throw n}}r(p,"active");function g(e){return e.grantee!=="app:terminal"&&w()}r(g,"mirrorOnly");async function B(){return(await F()).filter(e=>!g(e))}r(B,"localGrants");async function F(){return(await u("*","true")).flatMap(e=>{try{return[y(e)]}catch(n){if(n instanceof TypeError||n instanceof SyntaxError)return[];throw n}})}r(F,"allGrants");function L(e){return e.expires_at!==null&&!(Date.parse(e.expires_at)>Date.now())}r(L,"grantExpired");function M(e){if(e.status!=="active"||L(e))return null;try{const n=e.resolved_scopes.map(({scope:t})=>O(t));return{...e,resolved:e.resolved_scopes.flatMap(({mode:t},s)=>t==="always"?[n[s]]:[])}}catch(n){if(n instanceof TypeError||n instanceof SyntaxError)return null;throw n}}r(M,"activeRecord");function v(e){return Array.isArray(e)?`[${e.map(v).join(",")}]`:e&&typeof e=="object"?`{${Object.keys(e).sort().filter(n=>e[n]!==void 0).map(n=>`${JSON.stringify(n)}:${v(e[n])}`).join(",")}}`:JSON.stringify(e)??"null"}r(v,"canonicalJson");function X(e){const n={rev:e.rev,resolved_scopes:e.resolved_scopes,spend_cap:e.spend_cap,payer:e.payer,dependencies:e.dependencies??{},...e.inference_endpoint?{inference_endpoint:e.inference_endpoint}:{}};return N("sha256").update(v(n)).digest("base64url").slice(0,22)}r(X,"grantVersion");async function Y(e){return!!await c("1","id = ?",[e])}r(Y,"hasGrant");async function z(e){return await c("rev, status","id = ?",[e])??null}r(z,"grantSyncState");async function K(e,n){return await c("rev, status","grantee = ? AND sub = ?",[e,n])??null}r(K,"grantSyncStateFor");async function G(e){const n=await c("*","id = ?",[e]);if(!n)return null;try{return y(n)}catch(t){if(t instanceof TypeError||t instanceof SyntaxError)return null;throw t}}r(G,"grantRecord");async function Q(e){const n=await c("*","id = ?",[e]);if(!n)return{standing:"inactive",sub:null,grantee:null,status:null,removal_done_at:null,record:null};const t={sub:n.sub,grantee:n.grantee,status:n.status,removal_done_at:n.removal_done_at??null};if(n.status!=="active")return{...t,standing:"inactive",record:null};if(n.computed_rev!==n.rev)return{...t,standing:"lagging",record:null};const s=p(n);return s===null?{...t,standing:"inactive",record:null}:{...t,standing:"active",record:s}}r(Q,"grantStanding");async function Z(e){return(await u("id",e)).map(n=>n.id)}r(Z,"grantIdsWhere");async function ee(e){return(e?(await G(e))?.payer:null)??"user"}r(ee,"payerOfGrant");async function H(e){return p(await c("*","id = ?",[e]))}r(H,"activeGrant");async function ne(e,n){return p(await c("*","grantee = ? AND sub = ?",[e,n]))}r(ne,"grantFor");async function re(e){if(g({grantee:e}))return null;const n=await u("*","grantee = ? AND status = 'active'",[e]);if(n.length>1)throw new Error(`multiple active grants for ${e}`);return p(n[0])}r(re,"activeGrantForApp");async function te(e){const n=await H(e);return n&&n.run_notice_url&&!g(n)?{url:n.run_notice_url,sub:n.sub,grantee:n.grantee}:null}r(te,"runNoticeTarget");async function se(){const e=await u("*","grantee = 'app:terminal' AND status = 'active'");if(e.length>1)throw new Error("multiple active terminal grants");return p(e[0])}r(se,"terminalGrant");async function ae(){return(await(await d()).prepare("SELECT value FROM runtime_state WHERE key = 'grants_source'").get())?.value??null}r(ae,"grantsSource");async function oe(e){return(await(await d()).prepare("SELECT value FROM runtime_state WHERE key = 'grants_source'").get())?.value===e}r(oe,"hasSyncedGrants");async function ie(e){return(await e.prepare("SELECT value FROM runtime_state WHERE key = 'grants_source'").get())?.value!=="local"?0:(await e.prepare("DELETE FROM runtime_state WHERE key = 'grants_source'").run(),Number((await e.prepare("DELETE FROM grants").run()).changes))}r(ie,"dropLocalGrantMirror");function ce(e){if(e===void 0)return[];if(!Array.isArray(e))throw new TypeError("invalid grant sync response");return e.map(n=>{const{team:t,members:s}=n??{};if(typeof t!="string"||!/^team:\S+$/.test(t)||!Array.isArray(s)||s.some(i=>typeof i!="string"||!/^user:[^\s*]+$/.test(i)))throw new TypeError("invalid grant sync response");return{team:t,members:s}})}r(ce,"teamsOf");async function ue(e,n,t,s=[]){const i=new Set;for(const a of e){if(i.has(a.id)||!a.id||!a.runtime||!a.sub||!a.grantee||!Number.isInteger(a.rev)||!["active","revoked","removed"].includes(a.status))throw new TypeError("invalid grant sync response");i.add(a.id),l(a.scopes),l(a.resolved_scopes)}await j(async a=>{let _=0;const f=[...i];_+=Number((await(f.length?a.prepareUncached(`DELETE FROM grants WHERE id NOT IN (${f.map(()=>"?").join(",")})`).run(...f):a.prepareUncached("DELETE FROM grants").run())).changes);const E=a.prepare(`INSERT INTO grants
       (id, runtime, sub, grantee, rev, scopes_json, resolved_scopes_json, spend_cap, expires_at,
-       status, revoked_at, approved_at, payer, dependencies_json, run_notice_url, inference_endpoint_json, synced_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`);for(const s of e)await E.run(s.id,s.runtime,s.sub,s.grantee,s.rev,JSON.stringify(s.scopes),JSON.stringify(s.resolved_scopes),s.spend_cap,s.expires_at,s.status,s.revoked_at,s.approved_at,s.payer,JSON.stringify(y(s.dependencies)),s.run_notice_url??null,s.inference_endpoint?JSON.stringify(s.inference_endpoint):null,s.synced_at);await w(a,"directory",R,"member",i.flatMap(({team:s,members:_})=>_.map(g=>({resourceId:s,subject:x(g)})))),await a.prepare("INSERT INTO runtime_state (key, value) VALUES ('grants_source', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(n),await a.prepare("INSERT INTO runtime_state (key, value) VALUES ('grants_generation', '1') ON CONFLICT(key) DO UPDATE SET value = CAST(CAST(runtime_state.value AS INTEGER) + 1 AS TEXT)").run()})}t(te,"replaceGrants");async function ne(){const e=await(await c()).prepare("SELECT value FROM runtime_state WHERE key = 'grants_generation'").get();return e?Number(e.value):0}t(ne,"grantsGeneration");export{X as activeGrant,q as activeGrantForApp,F as activeRecord,L as allGrants,y as dependenciesOf,ee as dropLocalGrantMirror,j as grantExpired,Y as grantFor,M as grantRecord,P as grantSyncState,V as grantSyncStateFor,U as grantVersion,ne as grantsGeneration,Q as grantsSource,$ as hasGrant,Z as hasSyncedGrants,b as inferenceEndpointOf,I as localGrants,l as mirrorOnly,B as payerOfGrant,te as replaceGrants,z as runNoticeTarget,re as teamsOf,K as terminalGrant};
+       status, revoked_at, approved_at, payer, dependencies_json, run_notice_url, inference_endpoint_json, synced_at, computed_rev)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (id) DO UPDATE SET runtime = excluded.runtime, sub = excluded.sub, grantee = excluded.grantee, rev = excluded.rev,
+        scopes_json = excluded.scopes_json, resolved_scopes_json = excluded.resolved_scopes_json, spend_cap = excluded.spend_cap,
+        expires_at = excluded.expires_at, status = excluded.status, revoked_at = excluded.revoked_at, approved_at = excluded.approved_at,
+        removal_done_at = CASE WHEN excluded.status = 'removed' AND grants.status = 'removed' THEN grants.removal_done_at END,
+        payer = excluded.payer, dependencies_json = excluded.dependencies_json, run_notice_url = excluded.run_notice_url,
+        inference_endpoint_json = excluded.inference_endpoint_json, synced_at = excluded.synced_at, computed_rev = excluded.computed_rev
+      WHERE (grants.runtime, grants.sub, grants.grantee, grants.rev, grants.scopes_json, grants.resolved_scopes_json, grants.spend_cap,
+             grants.expires_at, grants.status, grants.revoked_at, grants.approved_at, grants.payer, grants.dependencies_json,
+             grants.run_notice_url, grants.inference_endpoint_json, grants.computed_rev)
+        IS DISTINCT FROM (excluded.runtime, excluded.sub, excluded.grantee, excluded.rev, excluded.scopes_json, excluded.resolved_scopes_json,
+             excluded.spend_cap, excluded.expires_at, excluded.status, excluded.revoked_at, excluded.approved_at, excluded.payer,
+             excluded.dependencies_json, excluded.run_notice_url, excluded.inference_endpoint_json, excluded.computed_rev)`);for(const o of e)_+=Number((await E.run(o.id,o.runtime,o.sub,o.grantee,o.rev,JSON.stringify(o.scopes),JSON.stringify(o.resolved_scopes),o.spend_cap,o.expires_at,o.status,o.revoked_at,o.approved_at,o.payer,JSON.stringify(m(o.dependencies)),o.run_notice_url??null,o.inference_endpoint?JSON.stringify(o.inference_endpoint):null,o.synced_at,o.rev)).changes);await h(a,"directory",b,"member",s.flatMap(({team:o,members:x})=>x.map(S=>({resourceId:o,subject:A(S)})))),await a.prepare("INSERT INTO runtime_state (key, value) VALUES ('grants_source', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(t),_>0&&await a.prepare("INSERT INTO runtime_state (key, value) VALUES ('grants_generation', '1') ON CONFLICT(key) DO UPDATE SET value = CAST(CAST(runtime_state.value AS INTEGER) + 1 AS TEXT)").run()})}r(ue,"replaceGrants");async function pe(){const e=await(await d()).prepare("SELECT value FROM runtime_state WHERE key = 'grants_generation'").get();return e?Number(e.value):0}r(pe,"grantsGeneration");export{H as activeGrant,re as activeGrantForApp,M as activeRecord,F as allGrants,m as dependenciesOf,ie as dropLocalGrantMirror,L as grantExpired,ne as grantFor,Z as grantIdsWhere,G as grantRecord,Q as grantStanding,z as grantSyncState,K as grantSyncStateFor,X as grantVersion,pe as grantsGeneration,ae as grantsSource,Y as hasGrant,oe as hasSyncedGrants,I as inferenceEndpointOf,B as localGrants,g as mirrorOnly,ee as payerOfGrant,ue as replaceGrants,te as runNoticeTarget,ce as teamsOf,se as terminalGrant};

package/dist/core/grants/on-sync.d.ts

@@ -1,5 +1,4 @@
 import type { SandboxRecord } from '../../launcher/spec.js';
-import { type GrantRecord } from './mirror.js';
 /** Work that outlives the sync that started it; the daemon keeps ownership of it during shutdown. */
 export type Detach = (work: Promise<void>) => void;
 /** Why a sandbox must stop under the current mirror, or null when every
@@ -8,6 +7,10 @@ export declare function exceeds(sandbox: Pick<SandboxRecord, 'uid' | 'nodeId' |
     app: string;
     status: string;
 }>): Promise<string | null>;
+/** After a confirmed revocation stop: the node waits for its next message,
+ *  whose broker gets the current mounts (runtime spec §15), and its run reads
+ *  idle rather than running. */
+export declare function afterRevocationStop(nodeId: string): Promise<void>;
 /** R26 from current state (runtime spec §15 "Ending revoked file access"):
  *  compare every live launcher sandbox's launched mounts with what the current
  *  mirror grants, and stop each one that holds more. Runs after every sync and
@@ -16,7 +19,8 @@ export declare function exceeds(sandbox: Pick<SandboxRecord, 'uid' | 'nodeId' |
 export declare function sweepSandboxes(): Promise<{
     completion: Promise<void>;
 }>;
-/** R26 and R27 after a sync replaced the grant mirror (runtime spec §15).
- *  Resolves once streams are closed and the sweep's stops have started; stop
- *  completion and removal cascades continue as detached work. */
-export declare function onGrantSync(before: readonly GrantRecord[], detach?: Detach): Promise<void>;
+/** R26 after a sync replaced the grant mirror (runtime spec §15): stop the launcher sandboxes that now hold more than the mirror
+ *  grants. Everything else a grant change causes (waking `grant.get` holds, closing streams, discarding tokens, stopping the
+ *  grant's nodes, the removal cascade, provider bundles) is done by the `grant:<id>` handlers of `daemon/reconcilers/grant-effects.ts`,
+ *  which the sync's row writes fire. Resolves once the stops have started; their completion continues as detached work. */
+export declare function onGrantSync(detach?: Detach): Promise<void>;

package/dist/core/grants/on-sync.js

@@ -1 +1 @@
-var _=Object.defineProperty;var c=(n,r)=>_(n,"name",{value:r,configurable:!0});import{relative as y,sep as w}from"node:path";import{activeBackgroundBashJobs as h,readJobPgid as b}from"../bash-jobs.js";import{appSpace as x}from"../layout.js";import{getNode as l,recordSettledTurn as S}from"../canvas/index.js";import{transition as k}from"../runtime/lifecycle.js";import{openDb as v}from"../canvas/db.js";import{contextDir as E}from"../canvas/node-agent-paths.js";import{emitEvent as p}from"../events/emit.js";import{closeGrantStreams as R}from"../runs/events.js";import{grantedMounts as C,isGrantedSource as I,mountAllowed as G}from"../spaces/mounts.js";import{permissionsForRun as m}from"../spaces/permissions.js";import{stopNodeSandboxes as P}from"../spaces/stop.js";import{discardChangedGrantTokens as O}from"../providers/token-cache.js";import{activeGrantForApp as T,allGrants as A,mirrorOnly as F}from"./mirror.js";import{runRemovalCascades as M}from"./remove.js";import{notifyGrantChanges as D}from"./watch.js";import{launcherPresent as N,listSandboxes as W,stopSandboxPid as j}from"./sandboxes.js";import{checkCronFire as B}from"../../daemon/cron/authority.js";import{cronExecutionFor as J}from"../../daemon/cron/live-runs.js";import{cronExecutionsReady as L}from"../../daemon/cron/run-socket.js";import{flatMapAsync as U}from"../async-array.js";import{personId as $}from"../canvas/person.js";async function g(){return new Map((await(await v()).prepare("SELECT uid, app, status FROM app_users").all()).map(n=>[n.uid,{app:n.app,status:n.status}]))}c(g,"appUserOwners");async function H(n,r){r??=await g();const t=r.get(n.uid),i=n.nodeId.startsWith("cron-"),e=i?J(n.nodeId.slice(5)):void 0;if(i&&(e===void 0||!t))return"permission_revoked";if(e!==void 0&&t.status==="active"){const a=await B({grantee:e.grantee,sub:e.sub,grant_id:e.grantId,scopes:e.scopes});if(!a.allowed)return e.refusal??={reason:a.reason,message:a.message},"permission_revoked"}if(!t||t.app==="app:terminal")return null;if(t.status!=="active")return"app_removed";const o=await l(n.nodeId);try{let a;if(e!==void 0)a=await m(e.grantee,e.sub,e.grantId,e.scopes);else if(o&&o.grantee===t.app)a=await m(t.app,o.sub??$(),o.grant_id??null,o.scopes??null);else{const d=await T(t.app);if(!d)return"permission_revoked";a=await m(t.app,d.sub,d.id,null)}const u=C(a),f=x(t.app).root;return n.mounts.every(d=>{const s=y(f,d.source);return s===""||s!==".."&&!s.startsWith(`..${w}`)&&!s.startsWith(w)||!I(t.app,d.source)||G(d,u)})?null:"permission_revoked"}catch{return"permission_revoked"}}c(H,"exceeds");async function q(n){const r=await l(n);if(!r)return;(r.status==="active"||r.status==="idle")&&await k(n,"release");const t=new Date().toISOString();await S(n,t),r.run_id&&r.run_id!==n&&await(await v()).prepare("UPDATE nodes SET last_settled_at = COALESCE(last_settled_at, ?) WHERE node_id = ?").run(t,r.run_id)}c(q,"afterRevocationStop");async function z(n){const r=new Set,t=await l(n);t?.pi_pid!=null&&r.add(t.pi_pid);try{const i=await E(n,t?.grantee);for(const e of h(i,!0)){const o=b(i,e.jobId);o!==void 0&&r.add(o)}}catch{}return r}c(z,"nodePids");async function K(){if(!N())return{completion:Promise.resolve()};await L();const n=await W(),r=await g(),t=await U(n,async o=>{const a=await H(o,r);return a?[{sandbox:o,reason:a}]:[]}),i=[],e=new Map;for(const o of t){p({level:"info",event:"daemon.grants.sandbox_stop",fields:{sandbox_node:o.sandbox.nodeId,pid:o.sandbox.pid,grantee:r.get(o.sandbox.uid).app,reason:o.reason}});const a=e.get(o.sandbox.nodeId)??[];a.push(o),e.set(o.sandbox.nodeId,a)}for(const[o,a]of e){const u=await l(o),f=u?await z(o):new Set,d=u!==null&&a.some(({sandbox:s})=>f.has(s.pid));i.push((async()=>{if(d){const s=await P(o,"permission_revoked",{holdRecovery:!0,after:c(()=>q(o),"after")});if(!s.confirmed)throw s.error??new Error(`stop of ${o} was not confirmed`)}for(const{sandbox:s}of a)(!d||!f.has(s.pid))&&await j(s.pid)})().catch(s=>{p({level:"error",event:"daemon.grants.sandbox_stop_failed",...u?{node_id:o}:{fields:{sandbox_node:o}},error:s})}))}return{completion:Promise.all(i).then(()=>{})}}c(K,"sweepSandboxes");function Q(n,r){try{const{pairs:t,providers:i,tokens:e}=O(n,r);(t||i)&&p({level:"info",event:"daemon.grants.outbound_tokens_discarded",fields:{grants:t,providers:i,tokens:e}})}catch(t){p({level:"error",event:"daemon.grants.outbound_tokens_discard_failed",error:t})}}c(Q,"discardOutboundTokens");async function he(n,r=t=>{}){const t=await A();try{D(n,t)}catch(e){p({level:"error",event:"daemon.grants.notify_failed",error:e})}Q(n,t);for(const e of n){if(e.status!=="active"||t.find(u=>u.id===e.id)?.status==="active")continue;const a=R(e.id);a&&p({level:"info",event:"daemon.grants.streams_closed",fields:{grant:e.id,grantee:e.grantee,streams:a}})}try{const{completion:e}=await K();r(e)}catch(e){p({level:"error",event:"daemon.grants.sweep_failed",error:e})}const i=new Set(t.filter(e=>!F(e)&&e.status==="removed"&&n.find(o=>o.id===e.id)?.status!=="removed").map(e=>e.grantee));r(M(i).catch(()=>{})),r(import("../providers/bundles.js").then(({syncProviderBundles:e})=>e()).catch(e=>{p({level:"error",event:"daemon.providers.bundle_sync_failed",error:e})}))}c(he,"onGrantSync");export{H as exceeds,he as onGrantSync,K as sweepSandboxes};
+var v=Object.defineProperty;var d=(o,e)=>v(o,"name",{value:e,configurable:!0});import{relative as b,sep as g}from"node:path";import{runningJobs as x}from"../graph/jobs.js";import{appSpace as y}from"../layout.js";import{getNode as f,recordSettledTurn as h}from"../canvas/index.js";import{transition as S}from"../runtime/lifecycle.js";import{openDb as l}from"../canvas/db.js";import{emitEvent as m}from"../events/emit.js";import{grantedMounts as E,isGrantedSource as R,mountAllowed as k}from"../spaces/mounts.js";import{permissionsForRun as w}from"../spaces/permissions.js";import{stopNodeSandboxes as I}from"../spaces/stop.js";import{activeGrantForApp as P}from"./mirror.js";import{launcherPresent as A,listSandboxes as C,stopSandboxPid as F}from"./sandboxes.js";import{checkCronFire as M}from"../../daemon/cron/authority.js";import{cronExecutionFor as N}from"../../daemon/cron/live-runs.js";import{cronExecutionsReady as O}from"../../daemon/cron/run-socket.js";import{flatMapAsync as T}from"../async-array.js";import{personId as W}from"../canvas/person.js";async function _(){return new Map((await(await l()).prepare("SELECT uid, app, status FROM app_users").all()).map(o=>[o.uid,{app:o.app,status:o.status}]))}d(_,"appUserOwners");async function D(o,e){e??=await _();const n=e.get(o.uid),p=o.nodeId.startsWith("cron-"),a=p?N(o.nodeId.slice(5)):void 0;if(p&&(a===void 0||!n))return"permission_revoked";if(a!==void 0&&n.status==="active"){const r=await M({grantee:a.grantee,sub:a.sub,grant_id:a.grantId,scopes:a.scopes});if(!r.allowed)return a.refusal??={reason:r.reason,message:r.message},"permission_revoked"}if(!n||n.app==="app:terminal")return null;if(n.status!=="active")return"app_removed";const t=await f(o.nodeId);try{let r;if(a!==void 0)r=await w(a.grantee,a.sub,a.grantId,a.scopes);else if(t&&t.grantee===n.app)r=await w(n.app,t.sub??W(),t.grant_id??null,t.scopes??null);else{const i=await P(n.app);if(!i)return"permission_revoked";r=await w(n.app,i.sub,i.id,null)}const c=E(r),u=y(n.app).root;return o.mounts.every(i=>{const s=b(u,i.source);return s===""||s!==".."&&!s.startsWith(`..${g}`)&&!s.startsWith(g)||!R(n.app,i.source)||k(i,c)})?null:"permission_revoked"}catch{return"permission_revoked"}}d(D,"exceeds");async function G(o){const e=await f(o);if(!e)return;(e.status==="active"||e.status==="idle")&&await S(o,"release");const n=new Date().toISOString();await h(o,n),e.run_id&&e.run_id!==o&&await(await l()).prepare("UPDATE nodes SET last_settled_at = COALESCE(last_settled_at, ?) WHERE node_id = ?").run(n,e.run_id)}d(G,"afterRevocationStop");async function L(o){const e=new Set,n=await f(o);n?.pi_pid!=null&&e.add(n.pi_pid);for(const p of await x(await l(),o))p.pgid!==null&&e.add(p.pgid);return e}d(L,"nodePids");async function U(){if(!A())return{completion:Promise.resolve()};await O();const o=await C(),e=await _(),n=await T(o,async t=>{const r=await D(t,e);return r?[{sandbox:t,reason:r}]:[]}),p=[],a=new Map;for(const t of n){m({level:"info",event:"daemon.grants.sandbox_stop",fields:{sandbox_node:t.sandbox.nodeId,pid:t.sandbox.pid,grantee:e.get(t.sandbox.uid).app,reason:t.reason}});const r=a.get(t.sandbox.nodeId)??[];r.push(t),a.set(t.sandbox.nodeId,r)}for(const[t,r]of a){const c=await f(t),u=c?await L(t):new Set,i=c!==null&&r.some(({sandbox:s})=>u.has(s.pid));p.push((async()=>{if(i){const s=await I(t,"permission_revoked",{holdRecovery:!0,after:d(()=>G(t),"after")});if(!s.confirmed)throw s.error??new Error(`stop of ${t} was not confirmed`)}for(const{sandbox:s}of r)(!i||!u.has(s.pid))&&await F(s.pid)})().catch(s=>{m({level:"error",event:"daemon.grants.sandbox_stop_failed",...c?{node_id:t}:{fields:{sandbox_node:t}},error:s})}))}return{completion:Promise.all(p).then(()=>{})}}d(U,"sweepSandboxes");async function se(o=e=>{}){try{const{completion:e}=await U();o(e)}catch(e){m({level:"error",event:"daemon.grants.sweep_failed",error:e})}}d(se,"onGrantSync");export{G as afterRevocationStop,D as exceeds,se as onGrantSync,U as sweepSandboxes};

package/dist/core/grants/remove.d.ts

@@ -1,7 +1,2 @@
-/** Run the removal cascade for every `removed` grant whose app still has an
- *  active OS-user row, and once for each app in `transitions` (its grant became
- *  `removed` at this sync) even with no row. Serialized; each cascade is
- *  idempotent and marks the row `removed` last, so an interrupted one resumes. */
-export declare function runRemovalCascades(transitions?: ReadonlySet<string>): Promise<void>;
 /** Runtime spec §15 "On removal" (design flow 10). Audit and usage rows stay. */
-export declare function removeApp(app: string): Promise<void>;
+export declare function removeApp(app: string, sub?: string): Promise<void>;

package/dist/core/grants/remove.js

@@ -1 +1 @@
-var R=Object.defineProperty;var d=(r,n)=>R(r,"name",{value:n,configurable:!0});import{rmSync as _}from"node:fs";import{join as h}from"node:path";import{deleteNodes as S}from"../canvas/canvas.js";import{withCanvasWrite as c,openDb as f}from"../canvas/db.js";import{cancelCron as O}from"../canvas/crons.js";import{emitEvent as m}from"../events/emit.js";import{appSpace as T,appsRoot as E,secretsDir as C}from"../layout.js";import{notifyRunDeleted as D}from"../runs/events.js";import{cancelOpenQuestions as L}from"../runs/questions.js";import{removeTreeBeneath as W}from"../spaces/open-beneath.js";import{markGranteeUploadsDeletePending as y,releaseRunUploads as F,turnSharesOffFor as H}from"../storage/tables.js";import{stopNodeSandboxes as N}from"../spaces/stop.js";import{activeAppUser as p,markAppUserRemoved as M}from"../spaces/users.js";import{launcherRequest as U}from"../../launcher/client.js";import{LaunchRefused as b}from"../../launcher/spec.js";import{localGrants as A}from"./mirror.js";import{launcherPresent as u,listSandboxes as I,stopSandboxPid as P}from"./sandboxes.js";import{filterAsync as $}from"../async-array.js";let w=Promise.resolve();function ie(r=new Set){const n=w.then(async()=>{const o=await A(),t=new Set(o.filter(a=>a.status==="removed").map(a=>a.grantee));for(const a of t)if(!o.some(i=>i.grantee===a&&i.status==="active")&&!(await p(a)===null&&!r.has(a)))try{await x(a)}catch(i){m({level:"error",event:"daemon.grants.removal_failed",error:i,fields:{grantee:a}})}});return w=n.catch(()=>{}),n}d(ie,"runRemovalCascades");async function x(r){if(r==="app:terminal")throw new Error("app:terminal cannot be removed");const n=T(r),o=await p(r);m({level:"info",event:"daemon.grants.removal_started",fields:{grantee:r,uid:o?.uid??null}}),await L({grantee:r},"the app was removed");const t=await c(async e=>(await e.prepare("UPDATE nodes SET deleting_at = COALESCE(deleting_at, ?) WHERE node_id IN (SELECT node_id FROM node_rows WHERE grantee = ?)").run(new Date().toISOString(),r),(await e.prepare("SELECT node_id FROM node_rows WHERE grantee = ? ORDER BY created DESC").all(r)).map(s=>s.node_id)));for(const{cron_id:e}of await(await f()).prepare("SELECT cron_id FROM crons WHERE grantee = ?").all(r))await O(e);const i=(await Promise.all(t.map(e=>N(e,"app_removed",{deleting:!0})))).filter(e=>!e.confirmed);if(i.length)throw new Error(`sandbox teardown could not be confirmed for ${i.length} node(s) of ${r}`);if(o&&u())for(const e of await I())e.uid===o.uid&&await P(e.pid);const g=await $(t,async e=>(await(await f()).prepare("SELECT run_id FROM nodes WHERE node_id = ?").get(e))?.run_id===e);await c(async e=>{if(await H(r,e),await F(t,e),await y(r,e),!t.length)return;const s=t.map(()=>"?").join(","),v=await e.prepareUncached(`SELECT message_id FROM messages WHERE sender_node_id IN (${s}) UNION SELECT message_id FROM deliveries WHERE destination_id IN (${s})`).all(...t,...t);await e.prepareUncached(`DELETE FROM deliveries WHERE destination_id IN (${s})`).run(...t);for(const{message_id:l}of v)await e.prepare("DELETE FROM messages WHERE message_id = ? AND NOT EXISTS (SELECT 1 FROM deliveries WHERE message_id = ?)").run(l,l)}),await S(t);for(const e of g)D(e);if(_(h(C(),"env",n.root.slice(E().length+1)),{recursive:!0,force:!0}),W(E(),n.root),o&&u())try{await U({operation:"user.delete",uid:o.uid})}catch(e){if(!(e instanceof b&&e.refusal==="invalid_uid"))throw e}o&&await M(o.uid),m({level:"info",event:"daemon.grants.removal_completed",fields:{grantee:r,uid:o?.uid??null,nodes:t.length}})}d(x,"removeApp");export{x as removeApp,ie as runRemovalCascades};
+var _=Object.defineProperty;var E=(r,o)=>_(r,"name",{value:o,configurable:!0});import{rmSync as v}from"node:fs";import{join as S}from"node:path";import{deleteNodes as h}from"../canvas/canvas.js";import{withCanvasWrite as c,openDb as d}from"../canvas/db.js";import{cancelCron as O}from"../canvas/crons.js";import{emitEvent as p}from"../events/emit.js";import{appSpace as T,appsRoot as w,secretsDir as C}from"../layout.js";import{notifyRunDeleted as D}from"../runs/events.js";import{cancelOpenQuestions as L}from"../runs/questions.js";import{removeTreeBeneath as W}from"../spaces/open-beneath.js";import{markGranteeUploadsDeletePending as F,releaseRunUploads as H,turnSharesOffFor as N}from"../storage/tables.js";import{stopNodeSandboxes as M}from"../spaces/stop.js";import{activeAppUser as $,markAppUserRemoved as y}from"../spaces/users.js";import{launcherRequest as A}from"../../launcher/client.js";import{LaunchRefused as U}from"../../launcher/spec.js";import{localGrants as q}from"./mirror.js";import{launcherPresent as u,listSandboxes as I,stopSandboxPid as P}from"./sandboxes.js";import{filterAsync as B}from"../async-array.js";async function se(r,o){if(r==="app:terminal")throw new Error("app:terminal cannot be removed");const m=T(r),s=o===void 0||!(await q()).some(e=>e.grantee===r&&e.sub!==o&&e.status!=="removed"),i=s?await $(r):null;p({level:"info",event:"daemon.grants.removal_started",fields:{grantee:r,...o===void 0?{}:{sub:o},uid:i?.uid??null}});const t=o===void 0?{sql:"grantee = ?",args:[r]}:{sql:"grantee = ? AND sub = ?",args:[r,o]};for(const{node_id:e}of await(await d()).prepare(`SELECT node_id FROM node_rows WHERE ${t.sql} ORDER BY created DESC`).all(...t.args))await L({node_id:e},"the app was removed");const a=await c(async e=>(await e.prepare(`UPDATE nodes SET deleting_at = COALESCE(deleting_at, ?) WHERE node_id IN (SELECT node_id FROM node_rows WHERE ${t.sql})`).run(new Date().toISOString(),...t.args),(await e.prepare(`SELECT node_id FROM node_rows WHERE ${t.sql} ORDER BY created DESC`).all(...t.args)).map(n=>n.node_id)));for(const{cron_id:e}of await(await d()).prepare(`SELECT cron_id FROM crons WHERE ${t.sql}`).all(...t.args))await O(e);const l=(await Promise.all(a.map(e=>M(e,"app_removed",{deleting:!0})))).filter(e=>!e.confirmed);if(l.length)throw new Error(`sandbox teardown could not be confirmed for ${l.length} node(s) of ${r}`);if(i&&u())for(const e of await I())e.uid===i.uid&&await P(e.pid);const R=await B(a,async e=>(await(await d()).prepare("SELECT run_id FROM nodes WHERE node_id = ?").get(e))?.run_id===e);await c(async e=>{if(s&&await N(r,e),await H(a,e),s&&await F(r,e),!a.length)return;const n=a.map(()=>"?").join(","),g=await e.prepareUncached(`SELECT message_id FROM messages WHERE sender_node_id IN (${n}) UNION SELECT message_id FROM deliveries WHERE destination_id IN (${n})`).all(...a,...a);await e.prepareUncached(`DELETE FROM deliveries WHERE destination_id IN (${n})`).run(...a);for(const{message_id:f}of g)await e.prepare("DELETE FROM messages WHERE message_id = ? AND NOT EXISTS (SELECT 1 FROM deliveries WHERE message_id = ?)").run(f,f)}),await h(a);for(const e of R)D(e);if(s&&(v(S(C(),"env",m.root.slice(w().length+1)),{recursive:!0,force:!0}),W(w(),m.root)),i&&u())try{await A({operation:"user.delete",uid:i.uid})}catch(e){if(!(e instanceof U&&e.refusal==="invalid_uid"))throw e}i&&await y(i.uid),p({level:"info",event:"daemon.grants.removal_completed",fields:{grantee:r,...o===void 0?{}:{sub:o},uid:i?.uid??null,nodes:a.length}})}E(se,"removeApp");export{se as removeApp};

package/dist/core/grants/sync.js

@@ -1 +1 @@
-var S=Object.defineProperty;var r=(e,n)=>S(e,"name",{value:n,configurable:!0});import{createPrivateKey as E,randomUUID as j,sign as x}from"node:crypto";import{readFileSync as $}from"node:fs";import{join as T}from"node:path";import{crtrHome as A}from"../canvas/paths.js";import{isUnsandboxedMachine as g}from"../runtime/unsandboxed.js";import{emitEvent as p}from"../events/emit.js";import{describeOutboundFailure as O,outboundFetch as v,outboundJson as h,outboundRefusal as k}from"../events/outbound.js";import{allGrants as N,dependenciesOf as P,inferenceEndpointOf as R,replaceGrants as G,teamsOf as J}from"./mirror.js";import{onGrantSync as B}from"./on-sync.js";import{PersonUnresolvedError as D,personId as F,resolvePerson as M,retireLocalPerson as U,setPersonId as C}from"../canvas/person.js";const se=300;function I(e,n){const t=Math.floor(Date.now()/1e3),o=Buffer.from(JSON.stringify({alg:"ES256",typ:"JWT",kid:e.kid})).toString("base64url"),d=Buffer.from(JSON.stringify({iss:e.client_id,sub:e.client_id,aud:n,iat:t,exp:t+300,jti:j()})).toString("base64url"),i=`${o}.${d}`,s=x("sha256",Buffer.from(i),{key:E({key:e.jwk,format:"jwk"}),dsaEncoding:"ieee-p1363"});return`${i}.${s.toString("base64url")}`}r(I,"assertion");function y(){const e=JSON.parse($(T(A(),"secrets","runtime-client.json"),"utf8"));if(!e.jwk||e.alg!=="ES256"||!e.kid||!e.client_id||!e.runtime||e.jwk.kid!==e.kid||e.jwk.kty!=="EC"||e.jwk.crv!=="P-256"||!e.jwk.d)throw new TypeError("invalid runtime client key");return e}r(y,"runtimeClient");function ae(e=y()){return e.runtime.startsWith("runtime:")?e.runtime.slice(8):e.runtime}r(ae,"runtimeId");function L(e){return`This machine was removed from your Northlight account. To use it again, create a join token at ${e.replace(/\/$/,"")}/account/machines, and run \`crtr sys join\` from a plain terminal.`}r(L,"machineRevokedMessage");class w extends Error{static{r(this,"MachineRevokedError")}constructor(n){super(L(n)),this.name="MachineRevokedError"}}async function W(e,n){const t=y(),o=`${e.replace(/\/$/,"")}/token`,d=new URLSearchParams({grant_type:"client_credentials",client_id:t.client_id,client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",client_assertion:I(t,o),...n===void 0?{}:{audience:n}}),i=await v("directory_token",o,{method:"POST",body:d,signal:AbortSignal.timeout(1e4)});if(!i.ok)throw i.status===401&&g()&&await q(i)?new w(e):k("directory_token",o,`directory token request failed: ${i.status}`);const s=await h("directory_token",o,i);if(typeof s.access_token!="string")throw new TypeError("directory token response has no access_token");return{access_token:s.access_token,expires_at:z(s.access_token,s.expires_in)}}r(W,"mintDirectoryToken");async function q(e){try{return(await e.json()).error==="invalid_client"}catch{return!1}}r(q,"isInvalidClient");function z(e,n){if(typeof n=="number"&&Number.isFinite(n)&&n>0)return Date.now()+n*1e3;try{const t=JSON.parse(Buffer.from(e.split(".")[1]??"","base64url").toString("utf8"));if(typeof t.exp=="number")return t.exp*1e3}catch{}return Date.now()+3e5}r(z,"tokenExpiry");function H(e,n){if(!e||typeof e!="object")throw new TypeError("invalid grant sync response");const t=e,o=n.runtime.startsWith("runtime:")?n.runtime:`runtime:${n.runtime}`;if(!(t.runtime===o||g()&&typeof t.runtime=="string"&&t.runtime.startsWith("runtime:")&&t.grantee!=="app:terminal")||typeof t.id!="string"||typeof t.sub!="string"||typeof t.grantee!="string"||!Number.isInteger(t.rev)||!Array.isArray(t.scopes)||!Array.isArray(t.resolved_scopes)||!["active","revoked","removed"].includes(t.status??"")||typeof t.synced_at!="string")throw new TypeError("invalid grant sync response");const s=e.revisions?.find(a=>a.rev===t.rev)?.approved_at;if(typeof s!="string")throw new TypeError("grant revision has no approval time");const l=t.payer==="app"?"app":"user";return{...t,spend_cap:t.spend_cap??null,expires_at:t.expires_at??null,revoked_at:t.revoked_at??null,approved_at:s,payer:l,dependencies:P(t.dependencies),inference_endpoint:l==="app"?R(t.inference_endpoint):null,run_notice_url:typeof t.run_notice_url=="string"&&t.run_notice_url!==""?t.run_notice_url:null}}r(H,"responseGrant");async function K(){try{F();return}catch(t){if(!(t instanceof D))throw t}const e=await M();if(e===null)return;C(e.id);const n=await U();p({level:"info",event:"daemon.person.resolved",fields:{person_id:e.id,source:e.source}}),p({level:"info",event:"daemon.person.retired",fields:{person_id:n.person,retired:n.retired,columns:n.columns}})}r(K,"resolveLatePerson");let _;function ce(e){return _?_(e):Promise.resolve()}r(ce,"requestGrantSync");function ue(e,n=t=>{}){let t;const o=e.replace(/\/$/,""),d=r(async()=>{const a=y(),c=await W(o),f=await v("grant_sync",`${o}/v1/runtime/grants`,{headers:{Authorization:`Bearer ${c.access_token}`},signal:AbortSignal.timeout(1e4)});if(!f.ok)throw k("grant_sync",`${o}/v1/runtime/grants`,`directory grant sync failed: ${f.status}`);const u=await h("grant_sync",`${o}/v1/runtime/grants`,f);if(!Array.isArray(u.grants)||typeof u.synced_at!="string")throw new TypeError("invalid grant sync response");const b=await N();await G(u.grants.map(m=>H(m,a)),u.synced_at,o,J(u.teams)),p({level:"info",event:"daemon.grants.synced",fields:{grants:u.grants.length,synced_at:u.synced_at}}),await K();try{await B(b,n)}catch(m){p({level:"error",event:"daemon.grants.on_sync_failed",error:m})}},"run");let i;const s=r(()=>{const a=d().catch(c=>{throw c instanceof w?p({level:"error",event:"daemon.grants.machine_revoked",error:c}):p({level:"error",event:"daemon.grants.sync_failed",error:c,fields:O(c)}),c}).finally(()=>{t===a&&(t=void 0)});return t=a,a},"start"),l=r((a={})=>t?a.fresh?(i??=t.catch(()=>{}).then(()=>(i=void 0,t??s())),i):t:s(),"sync");return _=l,l}r(ue,"createGrantSync");export{se as GRANT_SYNC_INTERVAL_S,w as MachineRevokedError,I as assertion,ue as createGrantSync,L as machineRevokedMessage,W as mintDirectoryToken,ce as requestGrantSync,y as runtimeClient,ae as runtimeId};
+var b=Object.defineProperty;var n=(e,r)=>b(e,"name",{value:r,configurable:!0});import{createPrivateKey as E,randomUUID as S,sign as j}from"node:crypto";import{readFileSync as x}from"node:fs";import{join as $}from"node:path";import{crtrHome as T}from"../canvas/paths.js";import{isUnsandboxedMachine as g}from"../runtime/unsandboxed.js";import{emitEvent as p}from"../events/emit.js";import{describeOutboundFailure as A,outboundFetch as v,outboundJson as h,outboundRefusal as k}from"../events/outbound.js";import{dependenciesOf as O,inferenceEndpointOf as P,replaceGrants as N,teamsOf as R}from"./mirror.js";import{onGrantSync as G}from"./on-sync.js";import{adoptInstallPerson as J}from"../scoped-state/migrate.js";import{PersonOutsideRequestError as B,PersonUnresolvedError as D,personId as F,resolvePerson as I,retireLocalPerson as M,setPersonId as U}from"../canvas/person.js";const ae=300;function q(e,r){const t=Math.floor(Date.now()/1e3),o=Buffer.from(JSON.stringify({alg:"ES256",typ:"JWT",kid:e.kid})).toString("base64url"),d=Buffer.from(JSON.stringify({iss:e.client_id,sub:e.client_id,aud:r,iat:t,exp:t+300,jti:S()})).toString("base64url"),i=`${o}.${d}`,s=j("sha256",Buffer.from(i),{key:E({key:e.jwk,format:"jwk"}),dsaEncoding:"ieee-p1363"});return`${i}.${s.toString("base64url")}`}n(q,"assertion");function y(){const e=JSON.parse(x($(T(),"secrets","runtime-client.json"),"utf8"));if(!e.jwk||e.alg!=="ES256"||!e.kid||!e.client_id||!e.runtime||e.jwk.kid!==e.kid||e.jwk.kty!=="EC"||e.jwk.crv!=="P-256"||!e.jwk.d)throw new TypeError("invalid runtime client key");return e}n(y,"runtimeClient");function ce(e=y()){return e.runtime.startsWith("runtime:")?e.runtime.slice(8):e.runtime}n(ce,"runtimeId");function C(e){return`This machine was removed from your Northlight account. To use it again, create a join token at ${e.replace(/\/$/,"")}/account/machines, and run \`crtr sys join\` from a plain terminal.`}n(C,"machineRevokedMessage");class w extends Error{static{n(this,"MachineRevokedError")}constructor(r){super(C(r)),this.name="MachineRevokedError"}}async function L(e,r){const t=y(),o=`${e.replace(/\/$/,"")}/token`,d=new URLSearchParams({grant_type:"client_credentials",client_id:t.client_id,client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",client_assertion:q(t,o),...r===void 0?{}:{audience:r}}),i=await v("directory_token",o,{method:"POST",body:d,signal:AbortSignal.timeout(1e4)});if(!i.ok)throw i.status===401&&g()&&await W(i)?new w(e):k("directory_token",o,`directory token request failed: ${i.status}`);const s=await h("directory_token",o,i);if(typeof s.access_token!="string")throw new TypeError("directory token response has no access_token");return{access_token:s.access_token,expires_at:z(s.access_token,s.expires_in)}}n(L,"mintDirectoryToken");async function W(e){try{return(await e.json()).error==="invalid_client"}catch{return!1}}n(W,"isInvalidClient");function z(e,r){if(typeof r=="number"&&Number.isFinite(r)&&r>0)return Date.now()+r*1e3;try{const t=JSON.parse(Buffer.from(e.split(".")[1]??"","base64url").toString("utf8"));if(typeof t.exp=="number")return t.exp*1e3}catch{}return Date.now()+3e5}n(z,"tokenExpiry");function H(e,r){if(!e||typeof e!="object")throw new TypeError("invalid grant sync response");const t=e,o=r.runtime.startsWith("runtime:")?r.runtime:`runtime:${r.runtime}`;if(!(t.runtime===o||g()&&typeof t.runtime=="string"&&t.runtime.startsWith("runtime:")&&t.grantee!=="app:terminal")||typeof t.id!="string"||typeof t.sub!="string"||typeof t.grantee!="string"||!Number.isInteger(t.rev)||!Array.isArray(t.scopes)||!Array.isArray(t.resolved_scopes)||!["active","revoked","removed"].includes(t.status??"")||typeof t.synced_at!="string")throw new TypeError("invalid grant sync response");const s=e.revisions?.find(a=>a.rev===t.rev)?.approved_at;if(typeof s!="string")throw new TypeError("grant revision has no approval time");const l=t.payer==="app"?"app":"user";return{...t,spend_cap:t.spend_cap??null,expires_at:t.expires_at??null,revoked_at:t.revoked_at??null,approved_at:s,payer:l,dependencies:O(t.dependencies),inference_endpoint:l==="app"?P(t.inference_endpoint):null,run_notice_url:typeof t.run_notice_url=="string"&&t.run_notice_url!==""?t.run_notice_url:null}}n(H,"responseGrant");async function K(){try{F();return}catch(t){if(t instanceof B)return;if(!(t instanceof D))throw t}const e=await I();if(e===null)return;U(e.id),await J(e.id);const r=await M();p({level:"info",event:"daemon.person.resolved",fields:{person_id:e.id,source:e.source}}),p({level:"info",event:"daemon.person.retired",fields:{person_id:r.person,retired:r.retired,columns:r.columns}})}n(K,"resolveLatePerson");let _;function ue(e){return _?_(e):Promise.resolve()}n(ue,"requestGrantSync");function de(e,r=t=>{}){let t;const o=e.replace(/\/$/,""),d=n(async()=>{const a=y(),c=await L(o),f=await v("grant_sync",`${o}/v1/runtime/grants`,{headers:{Authorization:`Bearer ${c.access_token}`},signal:AbortSignal.timeout(1e4)});if(!f.ok)throw k("grant_sync",`${o}/v1/runtime/grants`,`directory grant sync failed: ${f.status}`);const u=await h("grant_sync",`${o}/v1/runtime/grants`,f);if(!Array.isArray(u.grants)||typeof u.synced_at!="string")throw new TypeError("invalid grant sync response");await N(u.grants.map(m=>H(m,a)),u.synced_at,o,R(u.teams)),p({level:"info",event:"daemon.grants.synced",fields:{grants:u.grants.length,synced_at:u.synced_at}}),await K();try{await G(r)}catch(m){p({level:"error",event:"daemon.grants.on_sync_failed",error:m})}},"run");let i;const s=n(()=>{const a=d().catch(c=>{throw c instanceof w?p({level:"error",event:"daemon.grants.machine_revoked",error:c}):p({level:"error",event:"daemon.grants.sync_failed",error:c,fields:A(c)}),c}).finally(()=>{t===a&&(t=void 0)});return t=a,a},"start"),l=n((a={})=>t?a.fresh?(i??=t.catch(()=>{}).then(()=>(i=void 0,t??s())),i):t:s(),"sync");return _=l,l}n(de,"createGrantSync");export{ae as GRANT_SYNC_INTERVAL_S,w as MachineRevokedError,q as assertion,de as createGrantSync,C as machineRevokedMessage,L as mintDirectoryToken,ue as requestGrantSync,y as runtimeClient,ce as runtimeId};

package/dist/core/grants/watch.d.ts

@@ -1,12 +1,18 @@
-import { type GrantRecord } from './mirror.js';
-/** Resolve when grant `grantId` is notified, or after `seconds`. Register it in the
- *  same synchronous block that read the mirror, so no notify falls between the read
- *  and the registration. The timer is unref'd: a held request never keeps the
- *  process alive. */
-export declare function waitGrantChange(grantId: string, seconds: number): Promise<void>;
-/** Wake the long-polls of every grant whose `grant.get` answer this sync changed:
- *  it left (or reached) `active`, or its version differs. Never triggers a sync. */
-export declare function notifyGrantChanges(before: readonly GrantRecord[], after: readonly GrantRecord[]): void;
+/** A `grant.get` hold on one grant. It is registered before the caller reads the mirror and stays registered until `release`, so a
+ *  wake that lands at any moment of the hold (including while a mirror read is outstanding) is remembered: the next `changed()`
+ *  answers at once. */
+export interface GrantHold {
+    /** Resolve when the grant was notified since the last `changed()` returned, or after `seconds`. */
+    changed(seconds: number): Promise<void>;
+    release(): void;
+}
+/** Register a hold on grant `grantId`. The timer of a pending `changed()` is unref'd: a held request never keeps the process alive. */
+export declare function holdGrant(grantId: string): GrantHold;
+/** Wake the long-polls held on grant `grantId`: its row changed. Each woken `grant.get` re-reads the grant and waits again unless
+ *  its version moved, so a change that leaves the version alone never ends a hold early. Never triggers a sync. */
+export declare function wakeGrantWaiters(grantId: string): void;
+/** Wake every held long-poll (the listen connection restarted: changes may have gone unheard). */
+export declare function wakeAllGrantWaiters(): void;
 /** The app listener is closing: drop every held long-poll and its timer. Its
  *  socket is being destroyed, so nothing is answered. */
 export declare function releaseGrantWaiters(): void;

package/dist/core/grants/watch.js

@@ -1 +1 @@
-var u=Object.defineProperty;var s=(e,t)=>u(e,"name",{value:t,configurable:!0});import{grantVersion as c}from"./mirror.js";const o=new Map;function f(e,t){const i=o.get(e);i&&(i.delete(t),i.size||o.delete(e))}s(f,"release");function m(e,t){return new Promise(i=>{const r={wake:s(()=>{clearTimeout(n),f(e,r),i()},"wake"),cancel:s(()=>{clearTimeout(n),f(e,r)},"cancel")},n=setTimeout(r.wake,t*1e3);n.unref();let a=o.get(e);a||o.set(e,a=new Set),a.add(r)})}s(m,"waitGrantChange");function l(e,t){const i=e?.status==="active",r=t?.status==="active";return i!==r?!0:r?c(e)!==c(t):!1}s(l,"changed");function v(e,t){if(!o.size)return;const i=new Map(e.map(n=>[n.id,n])),r=new Map(t.map(n=>[n.id,n]));for(const n of[...o.keys()])if(l(i.get(n),r.get(n)))for(const a of[...o.get(n)??[]])a.wake()}s(v,"notifyGrantChanges");function d(){for(const e of[...o.values()])for(const t of[...e])t.cancel();o.clear()}s(d,"releaseGrantWaiters");function g(){let e=0;for(const t of o.values())e+=t.size;return e}s(g,"grantWaiterCount");export{g as grantWaiterCount,v as notifyGrantChanges,d as releaseGrantWaiters,m as waitGrantChange};
+var u=Object.defineProperty;var n=(e,t)=>u(e,"name",{value:t,configurable:!0});const o=new Map;function w(e,t){const r=o.get(e);r&&(r.delete(t),r.size||o.delete(e))}n(w,"release");function k(e){let t=!1,r,s;const a=n(()=>{clearTimeout(s);const f=r;r=void 0,f?.()},"settle"),c={wake:n(()=>{t=!0,a()},"wake"),cancel:n(()=>{clearTimeout(s)},"cancel")};let i=o.get(e);return i||o.set(e,i=new Set),i.add(c),{changed:n(f=>new Promise(l=>{if(t){t=!1,l();return}r=n(()=>{t=!1,l()},"resolveWait"),s=setTimeout(a,f*1e3),s.unref()}),"changed"),release:n(()=>{w(e,c),a()},"release")}}n(k,"holdGrant");function d(e){for(const t of[...o.get(e)??[]])t.wake()}n(d,"wakeGrantWaiters");function m(){for(const e of[...o.keys()])d(e)}n(m,"wakeAllGrantWaiters");function x(){for(const e of[...o.values()])for(const t of[...e])t.cancel();o.clear()}n(x,"releaseGrantWaiters");function W(){let e=0;for(const t of o.values())e+=t.size;return e}n(W,"grantWaiterCount");export{W as grantWaiterCount,k as holdGrant,x as releaseGrantWaiters,m as wakeAllGrantWaiters,d as wakeGrantWaiters};

package/dist/core/graph/custom.js

@@ -1,12 +1,12 @@
-var C=Object.defineProperty;var l=(e,t)=>C(e,"name",{value:t,configurable:!0});import{createHash as x,randomBytes as P,timingSafeEqual as $}from"node:crypto";import{CrtrError as j,usage as f}from"../errors.js";import{ExitCode as S}from"../../types.js";import{createObject as J,liveDocumentNamed as q}from"./objects.js";import{invalidateCustomKind as A}from"./kinds/registry.js";import{publish as O,HOP_LIMIT as F,HopLimitError as M}from"./events.js";import{checkoutsForCwd as N}from"./repo-sync/repos.js";import{onQueueSignal as B,signalQueue as b}from"./receivers.js";import{receiverEndpoint as K,isPublicReceiverAddress as V}from"./receiver-url.js";import{isIP as G}from"node:net";import{KIND as k,LOCAL as D,MAX_KIND_EVENTS as Q,RESERVED_KIND_ROOTS as Y,eventCatalogReasons as z}from"../plugin-objects-manifest.js";import{check as L}from"../permissions/evaluator.js";import{userOf as X}from"../permissions/evaluator.js";import{nodePlace as Z}from"../permissions/ceiling.js";import{PermissionError as ee}from"../permissions/errors.js";import{writeActsFor as te}from"../permissions/facts.js";async function ne(e,t,i){return t.class!=="person"&&t.app.id===i.id?!0:await L(e,t,"edit",i.id)}l(ne,"mayActAs");async function ie(e,t,i){return await L(e,t,"read",i.id)}l(ie,"customReachable");const se=["public","private"];function h(e,t){throw new j(e,t,S.GENERAL)}l(h,"conflict");function R(e){return x("sha256").update(e).digest("hex")}l(R,"hash");function H(){return`crtr_pub_${P(32).toString("base64url")}`}l(H,"issueToken");function ae(e){if(e==null)return null;if(e==="queue")return JSON.stringify(e);if(typeof e!="object"||Array.isArray(e))throw f("invalid custom receiver; expected queue, an https url, or argv and absolute cwd");if("url"in e&&typeof e.url=="string")try{const i=K(e.url).hostname.replace(/^\[|\]$/g,"");if(G(i)&&!V(i))throw new Error("non-public IP address");return JSON.stringify({url:e.url})}catch(t){throw f(`invalid custom receiver: ${String(t)}`)}if("argv"in e&&Array.isArray(e.argv)&&e.argv.length>0&&e.argv.every(t=>typeof t=="string")&&typeof e.cwd=="string"&&e.cwd.startsWith("/"))return JSON.stringify(e);throw f("invalid custom receiver; url must be https and argv requires a command and absolute cwd")}l(ae,"receiverJson");async function re(e,t){return t.class==="node"?(await Z(e,t.node.id))?.isolated===!0:t.class==="app"||t.class==="object"?t.place?.isolated===!0:!1}l(re,"inIsolatedRun");async function Ne(e,t,i){const{kind:n,name:a,owner:s,description:o,events:u,receiver:c,rotateToken:w,privacy:p}=i;if(p!==void 0&&!se.includes(p))throw f(`invalid privacy ${JSON.stringify(p)}`);if(await ne(e,t,s)||h("forbidden",`cannot act as ${s.id}`),await re(e,t))throw new ee(403,"isolated_run","a custom object cannot be registered from an isolated run");if(!k.test(n)||Y.includes(n.split(".")[0]))throw f(`invalid or reserved kind ${n}`);if(!a.trim()||a!==a.trim()||a.includes("\0"))throw f(`invalid object name ${JSON.stringify(a)}`);const m=ae(c);if(c!=="queue"&&c!==null&&c!==void 0&&"argv"in c&&t.class!=="person"&&t.class!=="node"&&h("argv_forbidden","argv receiver requires a person or node principal"),u===void 0){const d=await e.prepare("SELECT source FROM object_kinds WHERE name = ?").get(n);if(d?.source!=="manifest"&&d?.source!=="peer")throw f("events is required unless the kind is declared by an installed plugin")}else if(Object.keys(u).length>Q||Object.entries(u).some(([d,_])=>!D.test(d)||!Number.isInteger(_?.level)||_.level<1||_.level>10||_.supersedes!==void 0&&typeof _.supersedes!="boolean"||_.ends_wait!==void 0&&typeof _.ends_wait!="boolean"))throw f("invalid custom event catalog");const r=await q(e,s.id,a);if(r&&!await ie(e,t,r)&&h("forbidden",`cannot act as ${s.id}`),r&&t.class!=="person"&&t.class!=="node"){const d=(await e.prepare("SELECT receiver_json FROM custom_objects WHERE object = ?").get(r.id))?.receiver_json;d&&typeof JSON.parse(d)=="object"&&"argv"in JSON.parse(d)&&h("argv_forbidden","argv receiver requires a person or node principal")}r&&r.type!==n&&h("name_taken",`${s.name}/${a} is already held by ${r.id}`);const g=u===void 0?null:await oe(e,{name:n,owner:s,description:o,events:u,read:null,source:"register"});if(!r){const d=await J(e,{type:n,kind:null,owner:s.id,privacy:p??"public",name:a,preview:""});s.type==="app"&&await te(e,d.id,await X(e,t));const _=H();return await e.prepare(`INSERT INTO custom_objects (object, description, receiver_json, token_hash)
-      VALUES (?, ?, ?, ?)`).run(d.id,o,m,R(_)),t.class==="node"&&await e.prepare("UPDATE custom_objects SET registered_by = ? WHERE object = ?").run(t.node.id,d.id),m!==null&&await e.prepare("UPDATE objects SET reception = 2 WHERE id = ?").run(d.id),await O(e,{event:"created",object:d,actor:t.class==="object"?t.object:t.class==="person"?t.person:t.class==="app"?t.app:t.node,attrs:{}},async U=>await N(e,U)),{object:d,token:_,created:!0,changed:[]}}const y=await e.prepare("SELECT description, receiver_json FROM custom_objects WHERE object = ?").get(r.id);y||h("name_taken",`${s.name}/${a} is not a custom object`);const E=[];if(y.description!==o&&E.push("description"),y.receiver_json!==m&&E.push("receiver"),g?.changed.includes("events")&&E.push("events"),g?.changed.includes("description")&&!E.includes("description")&&E.push("description"),p!==void 0&&r.privacy!==p&&E.push("privacy"),w&&E.push("token"),E.length===0)return{object:r,created:!1,changed:E};const v=w?H():void 0,T=E.includes("privacy")?{...r,privacy:p}:r;if(T!==r&&await e.prepare("UPDATE objects SET privacy = ? WHERE id = ?").run(p,r.id),await e.prepare("UPDATE custom_objects SET description = ?, receiver_json = ?, token_hash = COALESCE(?, token_hash) WHERE object = ?").run(o,m,v===void 0?null:R(v),r.id),await e.prepare("UPDATE objects SET reception = ? WHERE id = ?").run(m===null?0:2,r.id),y.receiver_json!==m){const d=Date.now();if(m===null){const _=await e.prepare(`UPDATE deliveries SET canceled_at = ?, updated_at = ?
+var x=Object.defineProperty;var l=(e,t)=>x(e,"name",{value:t,configurable:!0});import{createHash as C,randomBytes as $,timingSafeEqual as P}from"node:crypto";import{CrtrError as j,usage as f}from"../errors.js";import{ExitCode as S}from"../../types.js";import{createObject as J,liveDocumentNamed as q}from"./objects.js";import{invalidateCustomKind as A}from"./kinds/registry.js";import{publish as O,HOP_LIMIT as F,HopLimitError as M}from"./events.js";import{checkoutsForCwd as N}from"./repo-sync/repos.js";import{onQueueSignal as B,signalQueue as R}from"./receivers.js";import{receiverEndpoint as K,isPublicReceiverAddress as V}from"./receiver-url.js";import{isIP as G}from"node:net";import{KIND as k,LOCAL as D,MAX_KIND_EVENTS as Q,RESERVED_KIND_ROOTS as Y,eventCatalogReasons as z}from"../plugin-objects-manifest.js";import{check as L}from"../permissions/evaluator.js";import{userOf as X}from"../permissions/evaluator.js";import{nodePlace as Z}from"../permissions/ceiling.js";import{PermissionError as ee}from"../permissions/errors.js";import{writeActsFor as te}from"../permissions/facts.js";async function ne(e,t,n){return t.class!=="person"&&t.app.id===n.id?!0:await L(e,t,"edit",n.id)}l(ne,"mayActAs");async function ie(e,t,n){return await L(e,t,"read",n.id)}l(ie,"customReachable");const se=["public","private"];function h(e,t){throw new j(e,t,S.GENERAL)}l(h,"conflict");function b(e){return C("sha256").update(e).digest("hex")}l(b,"hash");function H(){return`crtr_pub_${$(32).toString("base64url")}`}l(H,"issueToken");function ae(e){if(e==null)return null;if(e==="queue")return JSON.stringify(e);if(typeof e!="object"||Array.isArray(e))throw f("invalid custom receiver; expected queue, an https url, or argv and absolute cwd");if("url"in e&&typeof e.url=="string")try{const n=K(e.url).hostname.replace(/^\[|\]$/g,"");if(G(n)&&!V(n))throw new Error("non-public IP address");return JSON.stringify({url:e.url})}catch(t){throw f(`invalid custom receiver: ${String(t)}`)}if("argv"in e&&Array.isArray(e.argv)&&e.argv.length>0&&e.argv.every(t=>typeof t=="string")&&typeof e.cwd=="string"&&e.cwd.startsWith("/"))return JSON.stringify(e);throw f("invalid custom receiver; url must be https and argv requires a command and absolute cwd")}l(ae,"receiverJson");async function re(e,t){return t.class==="node"?(await Z(e,t.node.id))?.isolated===!0:t.class==="app"||t.class==="object"?t.place?.isolated===!0:!1}l(re,"inIsolatedRun");async function Ne(e,t,n){const{kind:i,name:a,owner:s,description:o,events:u,receiver:c,rotateToken:w,privacy:p}=n;if(p!==void 0&&!se.includes(p))throw f(`invalid privacy ${JSON.stringify(p)}`);if(await ne(e,t,s)||h("forbidden",`cannot act as ${s.id}`),await re(e,t))throw new ee(403,"isolated_run","a custom object cannot be registered from an isolated run");if(!k.test(i)||Y.includes(i.split(".")[0]))throw f(`invalid or reserved kind ${i}`);if(!a.trim()||a!==a.trim()||a.includes("\0"))throw f(`invalid object name ${JSON.stringify(a)}`);const m=ae(c);if(c!=="queue"&&c!==null&&c!==void 0&&"argv"in c&&t.class!=="person"&&t.class!=="node"&&h("argv_forbidden","argv receiver requires a person or node principal"),u===void 0){const d=await e.prepare("SELECT source FROM object_kinds WHERE name = ?").get(i);if(d?.source!=="manifest"&&d?.source!=="peer")throw f("events is required unless the kind is declared by an installed plugin")}else if(Object.keys(u).length>Q||Object.entries(u).some(([d,_])=>!D.test(d)||!Number.isInteger(_?.level)||_.level<1||_.level>10||_.supersedes!==void 0&&typeof _.supersedes!="boolean"||_.ends_wait!==void 0&&typeof _.ends_wait!="boolean"))throw f("invalid custom event catalog");const r=await q(e,s.id,a);if(r&&!await ie(e,t,r)&&h("forbidden",`cannot act as ${s.id}`),r&&t.class!=="person"&&t.class!=="node"){const d=(await e.prepare("SELECT receiver_json FROM custom_objects WHERE object = ?").get(r.id))?.receiver_json;d&&typeof JSON.parse(d)=="object"&&"argv"in JSON.parse(d)&&h("argv_forbidden","argv receiver requires a person or node principal")}r&&r.type!==i&&h("name_taken",`${s.name}/${a} is already held by ${r.id}`);const g=u===void 0?null:await oe(e,{name:i,owner:s,description:o,events:u,read:null,source:"register"});if(!r){const d=await J(e,{type:i,kind:null,owner:s.id,privacy:p??"public",name:a,preview:""});s.type==="app"&&await te(e,d.id,await X(e,t));const _=H();return await e.prepare(`INSERT INTO custom_objects (object, description, receiver_json, token_hash)
+      VALUES (?, ?, ?, ?)`).run(d.id,o,m,b(_)),t.class==="node"&&await e.prepare("UPDATE custom_objects SET registered_by = ? WHERE object = ?").run(t.node.id,d.id),m!==null&&await e.prepare("UPDATE objects SET reception = 2 WHERE id = ?").run(d.id),await O(e,{event:"created",object:d,actor:t.class==="object"?t.object:t.class==="person"?t.person:t.class==="app"?t.app:t.node,attrs:{}},async U=>await N(e,U)),{object:d,token:_,created:!0,changed:[]}}const y=await e.prepare("SELECT description, receiver_json FROM custom_objects WHERE object = ?").get(r.id);y||h("name_taken",`${s.name}/${a} is not a custom object`);const E=[];if(y.description!==o&&E.push("description"),y.receiver_json!==m&&E.push("receiver"),g?.changed.includes("events")&&E.push("events"),g?.changed.includes("description")&&!E.includes("description")&&E.push("description"),p!==void 0&&r.privacy!==p&&E.push("privacy"),w&&E.push("token"),E.length===0)return{object:r,created:!1,changed:E};const v=w?H():void 0,T=E.includes("privacy")?{...r,privacy:p}:r;if(T!==r&&await e.prepare("UPDATE objects SET privacy = ? WHERE id = ?").run(p,r.id),await e.prepare("UPDATE custom_objects SET description = ?, receiver_json = ?, token_hash = COALESCE(?, token_hash) WHERE object = ?").run(o,m,v===void 0?null:b(v),r.id),await e.prepare("UPDATE objects SET reception = ? WHERE id = ?").run(m===null?0:2,r.id),y.receiver_json!==m){const d=Date.now();if(m===null){const _=await e.prepare(`UPDATE deliveries SET canceled_at = ?, updated_at = ?
         WHERE destination_id = ? AND state = 'pending' AND canceled_at IS NULL`).run(d,d,r.id);await e.prepare("UPDATE custom_objects SET dropped = dropped + ? WHERE object = ?").run(_.changes,r.id)}else await e.prepare(`UPDATE deliveries SET next_attempt_at = ?, updated_at = ?
-        WHERE destination_id = ? AND state = 'pending' AND canceled_at IS NULL`).run(m==='"queue"'?null:d,d,r.id);b(r.id)}return w&&b(r.id),await O(e,{event:"configured",object:T,actor:t.class==="object"?t.object:t.class==="person"?t.person:t.class==="app"?t.app:t.node,attrs:{changed:E.join(",")}},async d=>await N(e,d)),{object:T,...v===void 0?{}:{token:v},created:!1,changed:E}}l(Ne,"registerCustomObject");async function oe(e,t){const{name:i,owner:n,description:a,events:s,read:o,source:u}=t;if(!k.test(i))throw f(`invalid kind ${i}`);if(z(s,i).length>0)throw f("invalid custom event catalog");const c=await e.prepare("SELECT owner, description, events_json, read_json, source, declared FROM object_kinds WHERE name = ?").get(i),w=I(s),p=u==="manifest"&&o!==null?JSON.stringify({command:o.command}):null,m=new Date().toISOString();if(!c)return await e.prepare(`INSERT INTO object_kinds (name, owner, description, events_json, created_at, updated_at, read_json, source, declared)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, 1)`).run(i,n.id,a,w,m,m,p,u),A(e,i),{outcome:"inserted",changed:[]};const r=c.owner===n.id;if(u==="peer"){if(c.source!=="peer")return{outcome:"skipped",changed:[]}}else if(c.source!=="peer"&&(r||h("kind_owned",`${i} belongs to another owner`),u==="register"&&c.source==="manifest"))return{outcome:"skipped",changed:[]};const g=[];return I(JSON.parse(c.events_json))!==w&&g.push("events"),c.description!==a&&g.push("description"),(c.read_json??null)!==p&&g.push("read"),g.length===0&&r&&c.source===u&&c.declared===1?{outcome:"unchanged",changed:g}:(await e.prepare("UPDATE object_kinds SET owner = ?, description = ?, events_json = ?, read_json = ?, source = ?, declared = 1, updated_at = ? WHERE name = ?").run(n.id,a,w,p,u,m,i),A(e,i),{outcome:"updated",changed:g})}l(oe,"upsertKind");async function Te(e,t,i,n){const a=await e.prepare("SELECT events_json FROM object_kinds WHERE name = ?").get(t.type);if(!a||t.deleted_at!==null)throw f(`${t.id} is not a live custom object`);const s=JSON.parse(a.events_json);if(!D.test(n.event)||!Object.hasOwn(s,n.event))throw new j("unknown_event",`${t.type} declares ${Object.keys(s).join(", ")}, not ${n.event}`,S.USAGE,{declared:Object.keys(s),event:n.event});if(typeof n.summary!="string")throw f("summary must be text");const o=n.state===void 0?null:JSON.stringify(n.state);if(n.state!==void 0&&o===void 0)throw f("state must be JSON-serializable");if(Buffer.byteLength(JSON.stringify({summary:n.summary,...n.state===void 0?{}:{state:n.state}}))>64*1024)throw new j("body_too_large","custom event summary and state exceed 64 KiB",S.USAGE);if(o!==null&&Buffer.byteLength(o)>64*1024)throw f("state exceeds 64 KiB");const u=n.cause??null,c=u===null?null:await e.prepare(`SELECT depth FROM messages WHERE message_id = ?
-    UNION ALL SELECT depth FROM message_causes WHERE message_id = ? LIMIT 1`).get(u,u);if(u!==null&&c===void 0)throw new j("unknown_cause",`no message ${u}`,S.USAGE);if(c&&c.depth>=F)throw new M(c.depth+1);const w=new Date().toISOString();return await e.prepare("UPDATE custom_objects SET summary = ?, state_json = ?, published_at = ? WHERE object = ?").run(n.summary,o,w,t.id),await e.prepare("UPDATE objects SET preview = ? WHERE id = ?").run(n.summary.split(`
-`)[0],t.id),await O(e,{event:`${t.type}.${n.event}`,object:t,actor:i,attrs:{},messageBody:{summary:n.summary,...n.state===void 0?{}:{state:n.state}},...n.cause===void 0?{}:{cause:n.cause}},async p=>await N(e,p))}l(Te,"publishCustom");async function be(e,t,i){if(t.deleted_at!==null)return;await O(e,{event:"deleted",object:t,actor:i,attrs:{}},async a=>await N(e,a));const n=new Date().toISOString();await e.prepare("UPDATE objects SET deleted_at = ?, reception = 0 WHERE id = ?").run(n,t.id),await e.prepare("UPDATE deliveries SET canceled_at = ?, updated_at = ? WHERE destination_id = ? AND state = 'pending' AND canceled_at IS NULL").run(Date.now(),Date.now(),t.id),b(t.id)}l(be,"unregisterCustomObject");function I(e){return JSON.stringify(Object.fromEntries(Object.entries(e).sort(([t],[i])=>t.localeCompare(i)).map(([t,i])=>[t,{level:i.level,...i.supersedes===void 0?{}:{supersedes:i.supersedes},...i.ends_wait===void 0?{}:{ends_wait:i.ends_wait}}])))}l(I,"canonicalEvents");async function Re(e,t,i=0){return await W(e,t.id,i,"pending")}l(Re,"pendingFor");async function Ae(e,t){const i=await e.prepare("SELECT destination_id FROM deliveries WHERE delivery_id = ?").get(t);return i?(await W(e,i.destination_id,-1,"handed_off")).find(n=>n.delivery_id===t)??null:null}l(Ae,"pushLineFor");async function W(e,t,i,n){return(await e.prepare(`SELECT d.delivery_id, m.message_id, m.seq, m.event, m.level, m.object_id, m.actor_id, m.body_json, m.body_ref, m.depth, m.created_at,
+        WHERE destination_id = ? AND state = 'pending' AND canceled_at IS NULL`).run(m==='"queue"'?null:d,d,r.id);R(r.id)}return w&&R(r.id),await O(e,{event:"configured",object:T,actor:t.class==="object"?t.object:t.class==="person"?t.person:t.class==="app"?t.app:t.node,attrs:{changed:E.join(",")}},async d=>await N(e,d)),{object:T,...v===void 0?{}:{token:v},created:!1,changed:E}}l(Ne,"registerCustomObject");async function oe(e,t){const{name:n,owner:i,description:a,events:s,read:o,source:u}=t;if(!k.test(n))throw f(`invalid kind ${n}`);if(z(s,n).length>0)throw f("invalid custom event catalog");await e.prepare("SELECT pg_advisory_xact_lock(hashtext(?))").get(`kind:${n}`);const c=await e.prepare("SELECT owner, description, events_json, read_json, source, declared FROM object_kinds WHERE name = ?").get(n),w=I(s),p=u==="manifest"&&o!==null?JSON.stringify({command:o.command}):null,m=new Date().toISOString();if(!c)return await e.prepare(`INSERT INTO object_kinds (name, owner, description, events_json, created_at, updated_at, read_json, source, declared)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, 1)`).run(n,i.id,a,w,m,m,p,u),A(e,n),{outcome:"inserted",changed:[]};const r=c.owner===i.id;if(u==="peer"){if(c.source!=="peer")return{outcome:"skipped",changed:[]}}else if(c.source!=="peer"&&(r||h("kind_owned",`${n} belongs to another owner`),u==="register"&&c.source==="manifest"))return{outcome:"skipped",changed:[]};const g=[];return I(JSON.parse(c.events_json))!==w&&g.push("events"),c.description!==a&&g.push("description"),(c.read_json??null)!==p&&g.push("read"),g.length===0&&r&&c.source===u&&c.declared===1?{outcome:"unchanged",changed:g}:(await e.prepare("UPDATE object_kinds SET owner = ?, description = ?, events_json = ?, read_json = ?, source = ?, declared = 1, updated_at = ? WHERE name = ?").run(i.id,a,w,p,u,m,n),A(e,n),{outcome:"updated",changed:g})}l(oe,"upsertKind");async function Te(e,t,n,i){const a=await e.prepare("SELECT events_json FROM object_kinds WHERE name = ?").get(t.type);if(!a||t.deleted_at!==null)throw f(`${t.id} is not a live custom object`);const s=JSON.parse(a.events_json);if(!D.test(i.event)||!Object.hasOwn(s,i.event))throw new j("unknown_event",`${t.type} declares ${Object.keys(s).join(", ")}, not ${i.event}`,S.USAGE,{declared:Object.keys(s),event:i.event});if(typeof i.summary!="string")throw f("summary must be text");const o=i.state===void 0?null:JSON.stringify(i.state);if(i.state!==void 0&&o===void 0)throw f("state must be JSON-serializable");if(Buffer.byteLength(JSON.stringify({summary:i.summary,...i.state===void 0?{}:{state:i.state}}))>64*1024)throw new j("body_too_large","custom event summary and state exceed 64 KiB",S.USAGE);if(o!==null&&Buffer.byteLength(o)>64*1024)throw f("state exceeds 64 KiB");const u=i.cause??null,c=u===null?null:await e.prepare(`SELECT depth FROM messages WHERE message_id = ?
+    UNION ALL SELECT depth FROM message_causes WHERE message_id = ? LIMIT 1`).get(u,u);if(u!==null&&c===void 0)throw new j("unknown_cause",`no message ${u}`,S.USAGE);if(c&&c.depth>=F)throw new M(c.depth+1);const w=new Date().toISOString();return await e.prepare("UPDATE custom_objects SET summary = ?, state_json = ?, published_at = ? WHERE object = ?").run(i.summary,o,w,t.id),await e.prepare("UPDATE objects SET preview = ? WHERE id = ?").run(i.summary.split(`
+`)[0],t.id),await O(e,{event:`${t.type}.${i.event}`,object:t,actor:n,attrs:{},messageBody:{summary:i.summary,...i.state===void 0?{}:{state:i.state}},...i.cause===void 0?{}:{cause:i.cause}},async p=>await N(e,p))}l(Te,"publishCustom");async function Re(e,t,n){if(t.deleted_at!==null)return;await O(e,{event:"deleted",object:t,actor:n,attrs:{}},async a=>await N(e,a));const i=new Date().toISOString();await e.prepare("UPDATE objects SET deleted_at = ?, reception = 0 WHERE id = ?").run(i,t.id),await e.prepare("UPDATE deliveries SET canceled_at = ?, updated_at = ? WHERE destination_id = ? AND state = 'pending' AND canceled_at IS NULL").run(Date.now(),Date.now(),t.id),R(t.id)}l(Re,"unregisterCustomObject");function I(e){return JSON.stringify(Object.fromEntries(Object.entries(e).sort(([t],[n])=>t.localeCompare(n)).map(([t,n])=>[t,{level:n.level,...n.supersedes===void 0?{}:{supersedes:n.supersedes},...n.ends_wait===void 0?{}:{ends_wait:n.ends_wait}}])))}l(I,"canonicalEvents");async function be(e,t,n=0){return await W(e,t.id,n,"pending")}l(be,"pendingFor");async function Ae(e,t){const n=await e.prepare("SELECT destination_id FROM deliveries WHERE delivery_id = ?").get(t);return n?(await W(e,n.destination_id,-1,"handed_off")).find(i=>i.delivery_id===t)??null:null}l(Ae,"pushLineFor");async function W(e,t,n,i){return(await e.prepare(`SELECT d.delivery_id, m.message_id, m.seq, m.event, m.level, m.object_id, m.actor_id, m.body_json, m.body_ref, m.depth, m.created_at,
     o.type, o.name, owner.id AS owner_id
     FROM deliveries d JOIN messages m ON m.message_id = d.message_id JOIN objects o ON o.id = m.object_id
     LEFT JOIN objects owner ON owner.id = o.owner
-    WHERE d.destination_id = ? AND d.state = ? AND d.canceled_at IS NULL AND m.seq > ? ORDER BY m.seq`).all(t,n,i)).map(s=>{const o=s.body_json?JSON.parse(s.body_json):{};return{delivery_id:s.delivery_id,message_id:s.message_id,seq:s.seq,event:s.event,level:s.level,object:{id:s.object_id,type:s.type,name:s.name,owner:s.owner_id},actor:s.actor_id,attrs:o.push?.attrs??{},...o.summary===void 0?{}:{summary:o.summary},...o.state===void 0?{}:{state:o.state},...o.push?.pointer===void 0?{}:{pointer:o.push.pointer},depth:s.depth,created_at:s.created_at}})}l(W,"queueLines");async function ke(e,t,i){const n=Date.now(),a=[];let s=0;for(const o of i){const u=await e.prepare(`UPDATE deliveries SET state = 'acknowledged', acknowledged_at = ?, updated_at = ?
-      WHERE delivery_id = ? AND destination_id = ? AND state = 'pending' AND canceled_at IS NULL`).run(n,n,o,t.id);Number(u.changes)?s++:a.push(o)}return{acknowledged:s,...a.length?{unknown:a}:{}}}l(ke,"acknowledge");async function De(e,t,i){const n=await e.prepare("SELECT token_hash FROM custom_objects WHERE object = ?").get(t.id),a=Buffer.from(n?.token_hash??"".padEnd(64,"0"),"hex"),s=Buffer.from(R(i),"hex");return i.startsWith("crtr_pub_")&&t.deleted_at===null&&a.length===s.length&&$(a,s)&&n?.token_hash!=null}l(De,"verifyPublishToken");export{ke as acknowledge,ie as customReachable,ne as mayActAs,B as onQueueSignal,Re as pendingFor,Te as publishCustom,Ae as pushLineFor,Ne as registerCustomObject,be as unregisterCustomObject,oe as upsertKind,De as verifyPublishToken};
+    WHERE d.destination_id = ? AND d.state = ? AND d.canceled_at IS NULL AND m.seq > ? ORDER BY m.seq`).all(t,i,n)).map(s=>{const o=s.body_json?JSON.parse(s.body_json):{};return{delivery_id:s.delivery_id,message_id:s.message_id,seq:s.seq,event:s.event,level:s.level,object:{id:s.object_id,type:s.type,name:s.name,owner:s.owner_id},actor:s.actor_id,attrs:o.push?.attrs??{},...o.summary===void 0?{}:{summary:o.summary},...o.state===void 0?{}:{state:o.state},...o.push?.pointer===void 0?{}:{pointer:o.push.pointer},depth:s.depth,created_at:s.created_at}})}l(W,"queueLines");async function ke(e,t,n){const i=Date.now(),a=[];let s=0;for(const o of n){const u=await e.prepare(`UPDATE deliveries SET state = 'acknowledged', acknowledged_at = ?, updated_at = ?
+      WHERE delivery_id = ? AND destination_id = ? AND state = 'pending' AND canceled_at IS NULL`).run(i,i,o,t.id);Number(u.changes)?s++:a.push(o)}return{acknowledged:s,...a.length?{unknown:a}:{}}}l(ke,"acknowledge");async function De(e,t,n){const i=await e.prepare("SELECT token_hash FROM custom_objects WHERE object = ?").get(t.id),a=Buffer.from(i?.token_hash??"".padEnd(64,"0"),"hex"),s=Buffer.from(b(n),"hex");return n.startsWith("crtr_pub_")&&t.deleted_at===null&&a.length===s.length&&P(a,s)&&i?.token_hash!=null}l(De,"verifyPublishToken");export{ke as acknowledge,ie as customReachable,ne as mayActAs,B as onQueueSignal,be as pendingFor,Te as publishCustom,Ae as pushLineFor,Ne as registerCustomObject,Re as unregisterCustomObject,oe as upsertKind,De as verifyPublishToken};

package/dist/core/graph/jobs.d.ts

@@ -6,8 +6,55 @@ export interface JobRow {
     command: string;
     status: JobStatus;
     exit_code: number | null;
-    job_dir: string;
-    log_path: string;
+    /** Blob key of the job's output (`jobs/<node>/<job>/output/<seq>`). */
+    output_key: string;
+    /** ISO time the node must claim the job by, or null for a job that runs to completion. */
+    deadline_at: string | null;
+    purpose: string | null;
+    quiet_ok: boolean;
+    pgid: number | null;
+    pgid_identity: string | null;
+    activity_last_ms: number | null;
+    activity_sampled_ms: number | null;
+    activity_files: string | null;
+    silence_activity_ms: number | null;
+    silence_threshold_ms: number | null;
+    exit_reported_at: string | null;
+}
+/** A live job as the node, the roster and the stop guard see it. */
+export interface RunningJob {
+    jobId: string;
+    command: string;
+    purpose: string | null;
+    startedAtMs: number;
+    outputKey: string;
+    deadlineAtMs: number | null;
+    pgid: number | null;
+    pgidIdentity: string | null;
+    quietOk: boolean;
+    activity: {
+        lastActivityMs: number;
+        sampledAtMs: number;
+        files: string[];
+    } | null;
+    silence: {
+        lastActivityMs: number;
+        thresholdMs: number;
+    } | null;
+}
+/** The blob prefix a job's output chunks are written under, one object per chunk (`<prefix>/<seq, 8 digits>`). */
+export declare function jobOutputKey(nodeId: string, jobId: string): string;
+/** What the broker's valve reports about a job it runs: any subset, applied together. */
+export interface JobReport {
+    pgid?: number;
+    pgidIdentity?: string;
+    exitCode?: number;
+    vanished?: boolean;
+    activity?: {
+        lastActivityMs: number;
+        sampledAtMs: number;
+        files: string[];
+    };
 }
 export declare function jobRow(db: CanvasDb, job: ObjectRow): Promise<JobRow | null>;
 /** Create the job object (`id` keeps the job id the runner already uses), its `running` row,
@@ -15,15 +62,46 @@ export declare function jobRow(db: CanvasDb, job: ObjectRow): Promise<JobRow | n
 export declare function startJob(db: CanvasDb, node: ObjectRow, spec: {
     id?: string;
     command: string;
-    jobDir: string;
-    logPath: string;
+    purpose?: string | null;
+    deadlineAtMs?: number | null;
 }): Promise<ObjectRow>;
 /** End a running job: `exited` with its exit code, or `killed` with the killer as actor (null
  *  when the runtime killed it, e.g. at its deadline; `reason` then names why). The event carries
- *  the exit code and log path, never output. A job already ended is left as is. */
+ *  the exit code and output key, never output. A job already ended is left as is. */
 export declare function finishJob(db: CanvasDb, job: ObjectRow, end: {
     exitCode: number;
 } | {
     killedBy: ObjectRow | null;
     reason?: string;
 }): Promise<ObjectRow>;
+/** Arm (epoch ms) or drop (null) a running job's cancel deadline. */
+export declare function setJobDeadline(db: CanvasDb, jobId: string, deadlineAtMs: number | null): Promise<void>;
+/** Declare a running job an expected wait: it gets no silence messages. */
+export declare function markJobQuietOk(db: CanvasDb, jobId: string): Promise<void>;
+/** Record the silence message last sent for a job. */
+export declare function recordJobSilence(db: CanvasDb, jobId: string, lastActivityMs: number, thresholdMs: number): Promise<void>;
+/** Apply a broker report to a running job's row: the process identity, the activity sample, and the exit
+ *  (`exit_reported_at` set; the reconciler's next pass ends the job through `finishJob`). */
+export declare function applyJobReport(db: CanvasDb, jobId: string, report: JobReport): Promise<void>;
+/** Every `running` job a node owns, oldest first. */
+export declare function runningJobs(db: CanvasDb, nodeId: string): Promise<RunningJob[]>;
+/** Every `running` job in the canvas, with its owner. */
+export declare function allRunningJobs(db: CanvasDb): Promise<Array<RunningJob & {
+    owner: string;
+}>>;
+/** Every `running` job in the canvas whose cancel deadline has passed, with its owner. */
+export declare function expiredJobs(db: CanvasDb, nowMs: number): Promise<Array<RunningJob & {
+    owner: string;
+}>>;
+/** Credit every armed deadline of a node's running jobs for an interval the node was not permitted to run. */
+export declare function shiftJobDeadlines(db: CanvasDb, nodeId: string, byMs: number): Promise<number>;
+/** End every running job whose exit the broker reported: `exited` with its code, or `killed` when the process
+ *  vanished without one. Returns how many ended. */
+export declare function endReportedJobs(db: CanvasDb): Promise<number>;
+/** True when the node's newest execution runs on a runner other than the process runner (a sandbox): its jobs run
+ *  there, so their pids, supervisor files and output are not on this host and only the broker's reports describe them. */
+export declare function ownerRunsRemotely(db: CanvasDb, nodeId: string): Promise<boolean>;
+/** End, as killed, every running job whose owner's newest execution is a sandbox execution that has exited: the
+ *  sandbox the job ran in is gone with its broker, so nothing is left to report an exit. Run after `endReportedJobs`,
+ *  so an exit the broker did report wins. Returns how many ended. */
+export declare function endJobsOfExitedSandboxes(db: CanvasDb): Promise<number>;

package/dist/core/graph/jobs.js

@@ -1,2 +1,11 @@
-var m=Object.defineProperty;var e=(t,i)=>m(t,"name",{value:i,configurable:!0});import{recordActedOn as s}from"./edges.js";import{publish as u}from"./events.js";import{createObject as f,getById as E}from"./objects.js";import{recordWatch as h}from"./watches.js";function d(t){return t.split(`
-`,1)[0].trim()}e(d,"firstLine");function p(t,i){return`${d(t)} (${i})`}e(p,"previewOf");async function b(t,i){return await t.prepare("SELECT * FROM jobs WHERE object = ?").get(i.id)??null}e(b,"jobRow");async function T(t,i,r){if(i.type!=="node")throw new Error(`startJob: ${i.id} is a ${i.type}, not a node`);const a=await f(t,{...r.id===void 0?{}:{id:r.id},type:"job",kind:"bash",owner:i.id,privacy:"public",name:d(r.command)||"bash",preview:p(r.command,"running")});return await t.prepare("INSERT INTO jobs (object, command, status, exit_code, job_dir, log_path) VALUES (?, ?, 'running', NULL, ?, ?)").run(a.id,r.command,r.jobDir,r.logPath),await s(t,i,a),await h(t,i,a,"job-start"),await u(t,{event:"created",object:a,actor:i,attrs:{}}),a}e(T,"startJob");async function v(t,i,r){const a=await b(t,i);if(a===null)throw new Error(`finishJob: ${i.id} has no jobs row`);if(a.status!=="running")return i;const o="killedBy"in r,c=o?"killed":"exited",n=o?null:r.exitCode;await t.prepare("UPDATE jobs SET status = ?, exit_code = ? WHERE object = ?").run(c,n,i.id);const w=o?"killed":`exited ${n}`;await t.prepare("UPDATE objects SET preview = ? WHERE id = ?").run(p(a.command,w),i.id);const l=await E(t,i.id);return o&&r.killedBy!==null&&await s(t,r.killedBy,l),await u(t,{event:c,object:l,actor:o?r.killedBy:null,attrs:o?{"log-path":a.log_path,...r.reason===void 0?{}:{reason:r.reason}}:{"exit-code":n,"log-path":a.log_path}}),l}e(v,"finishJob");export{v as finishJob,b as jobRow,T as startJob};
+var y=Object.defineProperty;var o=(t,e)=>y(t,"name",{value:e,configurable:!0});import{recordActedOn as d}from"./edges.js";import{publish as p}from"./events.js";import{createObject as b,getById as u}from"./objects.js";import{recordWatch as m}from"./watches.js";function w(t,e){return`jobs/${t}/${e}/output`}o(w,"jobOutputKey");function j(t){return t.split(`
+`,1)[0].trim()}o(j,"firstLine");function E(t,e){return`${j(t)} (${e})`}o(E,"previewOf");async function h(t,e){return await t.prepare("SELECT * FROM jobs WHERE object = ?").get(e.id)??null}o(h,"jobRow");async function I(t,e,n){if(e.type!=="node")throw new Error(`startJob: ${e.id} is a ${e.type}, not a node`);const i=await b(t,{...n.id===void 0?{}:{id:n.id},type:"job",kind:"bash",owner:e.id,privacy:"public",name:j(n.command)||"bash",preview:E(n.command,"running")});return await t.prepare(`INSERT INTO jobs (object, command, status, exit_code, output_key, deadline_at, purpose)
+    VALUES (?, ?, 'running', NULL, ?, ?, ?)`).run(i.id,n.command,w(e.id,i.id),n.deadlineAtMs==null?null:new Date(n.deadlineAtMs).toISOString(),n.purpose??null),await d(t,e,i),await m(t,e,i,"job-start"),await p(t,{event:"created",object:i,actor:e,attrs:{}}),i}o(I,"startJob");async function f(t,e,n){const i=await h(t,e);if(i===null)throw new Error(`finishJob: ${e.id} has no jobs row`);if(i.status!=="running")return e;const a="killedBy"in n,l=a?"killed":"exited",s=a?null:n.exitCode;await t.prepare("UPDATE jobs SET status = ?, exit_code = ? WHERE object = ?").run(l,s,e.id);const _=a?"killed":`exited ${s}`;await t.prepare("UPDATE objects SET preview = ? WHERE id = ?").run(E(i.command,_),e.id);const r=await u(t,e.id);return a&&n.killedBy!==null&&await d(t,n.killedBy,r),await p(t,{event:l,object:r,actor:a?n.killedBy:null,attrs:a?{"output-key":i.output_key,...n.reason===void 0?{}:{reason:n.reason}}:{"exit-code":s,"output-key":i.output_key}}),r}o(f,"finishJob");async function x(t,e,n){await t.prepare("UPDATE jobs SET deadline_at = ? WHERE object = ? AND status = 'running'").run(n===null?null:new Date(n).toISOString(),e)}o(x,"setJobDeadline");async function L(t,e){await t.prepare("UPDATE jobs SET quiet_ok = true WHERE object = ?").run(e)}o(L,"markJobQuietOk");async function M(t,e,n,i){await t.prepare("UPDATE jobs SET silence_activity_ms = ?, silence_threshold_ms = ? WHERE object = ?").run(Math.trunc(n),Math.trunc(i),e)}o(M,"recordJobSilence");async function v(t,e,n){const i=[],a=[];n.pgid!==void 0&&(i.push("pgid = ?"),a.push(n.pgid)),n.pgidIdentity!==void 0&&(i.push("pgid_identity = ?"),a.push(n.pgidIdentity)),n.activity!==void 0&&(i.push("activity_last_ms = ?","activity_sampled_ms = ?","activity_files = ?"),a.push(Math.trunc(n.activity.lastActivityMs),Math.trunc(n.activity.sampledAtMs),n.activity.files.join(`
+`))),n.exitCode!==void 0?(i.push("exit_code = ?","exit_reported_at = ?"),a.push(n.exitCode,new Date().toISOString())):n.vanished===!0&&(i.push("exit_reported_at = ?"),a.push(new Date().toISOString())),i.length!==0&&await t.prepare(`UPDATE jobs SET ${i.join(", ")} WHERE object = ? AND status = 'running'`).run(...a,e)}o(v,"applyJobReport");function S(t){const e=Number(t.slice(0,Math.max(0,t.indexOf("-"))));return Number.isFinite(e)&&e>0?e:0}o(S,"startedAtMs");function c(t){return{jobId:t.object,command:t.command,purpose:t.purpose,startedAtMs:S(t.object),outputKey:t.output_key,deadlineAtMs:t.deadline_at===null?null:Date.parse(t.deadline_at),pgid:t.pgid,pgidIdentity:t.pgid_identity,quietOk:t.quiet_ok,activity:t.activity_last_ms===null||t.activity_sampled_ms===null?null:{lastActivityMs:t.activity_last_ms,sampledAtMs:t.activity_sampled_ms,files:(t.activity_files??"").split(`
+`).filter(e=>e!=="")},silence:t.silence_activity_ms===null||t.silence_threshold_ms===null?null:{lastActivityMs:t.silence_activity_ms,thresholdMs:t.silence_threshold_ms}}}o(c,"toRunning");async function N(t,e){return(await t.prepare(`SELECT j.* FROM jobs j JOIN objects o ON o.id = j.object
+    WHERE o.owner = ? AND o.deleted_at IS NULL AND j.status = 'running'`).all(e)).map(c).sort((i,a)=>i.startedAtMs-a.startedAtMs)}o(N,"runningJobs");async function T(t){return(await t.prepare(`SELECT j.*, o.owner AS owner FROM jobs j JOIN objects o ON o.id = j.object
+    WHERE o.deleted_at IS NULL AND j.status = 'running'`).all()).map(n=>({...c(n),owner:n.owner}))}o(T,"allRunningJobs");async function k(t,e){return(await t.prepare(`SELECT j.*, o.owner AS owner FROM jobs j JOIN objects o ON o.id = j.object
+    WHERE o.deleted_at IS NULL AND j.status = 'running' AND j.deadline_at IS NOT NULL AND j.deadline_at <= ?`).all(new Date(e).toISOString())).map(i=>({...c(i),owner:i.owner}))}o(k,"expiredJobs");async function J(t,e,n){if(!Number.isFinite(n)||n<=0)return 0;let i=0;for(const a of await N(t,e))a.deadlineAtMs!==null&&(await x(t,a.jobId,a.deadlineAtMs+n),i+=1);return i}o(J,"shiftJobDeadlines");async function C(t){const e=await t.prepare(`SELECT j.object, j.exit_code FROM jobs j JOIN objects o ON o.id = j.object
+    WHERE o.deleted_at IS NULL AND j.status = 'running' AND j.exit_reported_at IS NOT NULL`).all();for(const{object:n,exit_code:i}of e){const a=await u(t,n);await f(t,a,i===null?{killedBy:null,reason:"process disappeared without an exit record"}:{exitCode:i})}return e.length}o(C,"endReportedJobs");async function U(t,e){const n=await t.prepare("SELECT runner FROM executions WHERE node_id = ? ORDER BY started_at DESC, attempt DESC LIMIT 1").get(e);return n!==void 0&&n.runner!=="process"}o(U,"ownerRunsRemotely");async function W(t){const e=await t.prepare(`SELECT j.object FROM jobs j JOIN objects o ON o.id = j.object
+    WHERE o.deleted_at IS NULL AND j.status = 'running'
+      AND (SELECT e.runner || ':' || e.state FROM executions e WHERE e.node_id = o.owner ORDER BY e.started_at DESC, e.attempt DESC LIMIT 1) IN ('blaxel:exited')`).all();for(const{object:n}of e)await f(t,await u(t,n),{killedBy:null,reason:"the sandbox running the job ended with its broker"});return e.length}o(W,"endJobsOfExitedSandboxes");export{T as allRunningJobs,v as applyJobReport,W as endJobsOfExitedSandboxes,C as endReportedJobs,k as expiredJobs,f as finishJob,w as jobOutputKey,h as jobRow,L as markJobQuietOk,U as ownerRunsRemotely,M as recordJobSilence,N as runningJobs,x as setJobDeadline,J as shiftJobDeadlines,I as startJob};