@north-light/cli 0.3.565 → 0.3.567

package/dist/core/storage/client.js

@@ -1,3 +1,3 @@
-var S=Object.defineProperty;var s=(r,l)=>S(r,"name",{value:l,configurable:!0});import{createReadStream as v,read as $,statSync as T}from"node:fs";import{Readable as w}from"node:stream";import{promisify as E}from"node:util";import{readConfig as m}from"../config.js";import{RunError as k}from"../runs/operations.js";import{mintDirectoryToken as C,runtimeId as O}from"../grants/sync.js";const N=104857600;class b extends Error{static{s(this,"StorageRefused")}status;code;constructor(l,u,d){super(d),this.status=l,this.code=u}}const P=E($);async function*U(r,l){let u=0;for(;u<l;){const d=Buffer.allocUnsafe(Math.min(1048576,l-u)),{bytesRead:f}=await P(r,d,0,d.length,u);if(f===0)throw new Error("file shrank while it was being copied");u+=f,yield d.subarray(0,f)}}s(U,"fdChunks");const i=s(r=>new k(503,"storage_unavailable",r,void 0,void 0,void 0,!0),"unavailable");function j(){const r=m("user").runtime?.storage;return!r?.service_url||!r.base_url?null:{service_url:r.service_url.replace(/\/$/,""),base_url:r.base_url.replace(/\/$/,"")}}s(j,"storageConfig");let _;function W(){const r=j(),l=m("user").runtime?.issuer;if(!r||!l)throw i("file storage is not configured on this runtime");const u=`${l}
+var x=Object.defineProperty;var s=(r,l)=>x(r,"name",{value:l,configurable:!0});import{createReadStream as S,read as v,statSync as $}from"node:fs";import{Readable as w}from"node:stream";import{promisify as T}from"node:util";import{readConfig as E}from"../config.js";import{directoryIssuer as C}from"../directory/issuer.js";import{RunError as m}from"../runs/operations.js";import{mintDirectoryToken as O,runtimeId as P}from"../grants/sync.js";const F=104857600;class b extends Error{static{s(this,"StorageRefused")}status;code;constructor(l,u,d){super(d),this.status=l,this.code=u}}const U=T(v);async function*j(r,l){let u=0;for(;u<l;){const d=Buffer.allocUnsafe(Math.min(1048576,l-u)),{bytesRead:f}=await U(r,d,0,d.length,u);if(f===0)throw new Error("file shrank while it was being copied");u+=f,yield d.subarray(0,f)}}s(j,"fdChunks");const i=s(r=>new m(503,"storage_unavailable",r,void 0,void 0,void 0,!0),"unavailable");function A(){const r=E("user").runtime?.storage;return!r?.service_url||!r.base_url?null:{service_url:r.service_url.replace(/\/$/,""),base_url:r.base_url.replace(/\/$/,"")}}s(A,"storageConfig");let _;function G(){const r=A(),l=C();if(!r||!l)throw i("file storage is not configured on this runtime");const u=`${l}
 ${r.service_url}
-${r.base_url}`;return _?.key!==u&&(_={key:u,client:A(r,()=>C(l,r.service_url),O())}),_.client}s(W,"storageClient");function F(){_=void 0}s(F,"resetStorageClient");function A(r,l,u){let d,f;const x=s(async()=>{if(d&&d.expires_at-6e4>Date.now())return d.access_token;f??=l().finally(()=>{f=void 0});try{d=await f}catch(t){throw i(`storage token could not be minted: ${t instanceof Error?t.message:String(t)}`)}return d.access_token},"bearer"),c=s(async(t,e,n={})=>{const p=[AbortSignal.timeout(n.timeoutMs??1e4),...n.signal?[n.signal]:[]];let a;try{a=await fetch(`${r.service_url}${e}`,{method:t,signal:AbortSignal.any(p),headers:{Authorization:`Bearer ${await x()}`,...n.body===void 0?{}:{"Content-Type":"application/json"}},...n.body===void 0?{}:{body:JSON.stringify(n.body)}})}catch(o){throw o instanceof k?o:i(`storage could not be reached: ${o instanceof Error?o.message:String(o)}`)}if(a.status===401&&(d=void 0),a.status===404||a.status===409){const o=await a.json().catch(()=>({})),g=o.error?.code??o.code??(a.status===404?"not_found":"not_uploaded");throw new b(a.status,g,o.error?.message??o.message??`storage answered ${a.status}`)}if(!a.ok)throw await a.body?.cancel().catch(()=>{}),i(`storage answered ${a.status} to ${t} ${e.split("?")[0]}`);return a},"call"),y=s(async t=>{try{return await t.json()}catch{throw i("storage answered with an invalid body")}},"json"),h=s(t=>encodeURIComponent(t),"id");return{config:r,runtimeId:u,async createUpload(t){const e=await y(await c("POST","/v1/uploads",{body:t}));if(typeof e.upload_id!="string"||typeof e.url!="string"||typeof e.upload_link!="string"||typeof e.expires_at!="string")throw i("storage answered with an invalid upload");return{upload_id:e.upload_id,url:e.url,upload_link:e.upload_link,expires_at:e.expires_at}},async fetchUpload(t,e){const n=await c("GET",`/v1/uploads/${h(t)}/content`,{...e?{signal:e}:{},timeoutMs:11e4});if(!n.body)throw i("storage answered with no body");const p=n.headers.get("content-length");return{body:w.fromWeb(n.body),size:p===null?null:Number(p),media_type:n.headers.get("content-type")}},async signDownload(t){const e=await y(await c("POST",`/v1/uploads/${h(t)}/download-link`));if(typeof e.url!="string"||typeof e.expires_at!="string")throw i("storage answered with an invalid link");return{url:e.url,expires_at:e.expires_at}},async deleteUpload(t){try{await c("DELETE",`/v1/uploads/${h(t)}`)}catch(e){if(!(e instanceof b&&e.status===404))throw e}},async createShare(t){const e=await y(await c("POST","/v1/shares",{body:t}));if(typeof e.share_id!="string"||typeof e.url!="string"||typeof e.upload_link!="string")throw i("storage answered with an invalid share");return{share_id:e.share_id,url:e.url,upload_link:e.upload_link,expires_at:e.expires_at??null}},async putShareBytes(t,e,n,p){if(T(e).size!==n)throw new Error("shared file changed size while it was being copied");let a;try{a=await fetch(t,{method:"PUT",signal:AbortSignal.timeout(11e4),headers:{"Content-Type":p,"Content-Length":String(n)},body:w.toWeb(v(e)),duplex:"half"})}catch(o){throw i(`storage could not be reached: ${o instanceof Error?o.message:String(o)}`)}if(await a.body?.cancel().catch(()=>{}),!a.ok)throw i(`storage answered ${a.status} to the share upload`)},async deleteShare(t){try{await c("DELETE",`/v1/shares/${h(t)}`)}catch(e){if(!(e instanceof b&&e.status===404))throw e}},async createResultUpload(t){const e=await y(await c("POST","/v1/uploads",{body:{name:t.name,media_type:t.media_type,max_size:t.max_size}}));if(typeof e.upload_id!="string"||typeof e.url!="string"||typeof e.upload_link!="string"||typeof e.expires_at!="string")throw i("storage answered with an invalid upload");return{upload_id:e.upload_id,url:e.url,upload_link:e.upload_link,expires_at:e.expires_at}},async signUploadLink(t){const e=await y(await c("POST",`/v1/uploads/${h(t)}/upload-link`));if(typeof e.upload_link!="string"||typeof e.expires_at!="string")throw i("storage answered with an invalid upload link");return{upload_link:e.upload_link,expires_at:e.expires_at}},async createOutbound(t){const e=await y(await c("POST","/v1/outbound",{body:t}));if(typeof e.object_id!="string"||typeof e.upload_link!="string"||typeof e.url!="string"||typeof e.expires_at!="string")throw i("storage answered with an invalid outbound object");return{object_id:e.object_id,upload_link:e.upload_link,url:e.url,link_expires_at:e.link_expires_at,expires_at:e.expires_at}},async signOutbound(t){const e=await y(await c("POST",`/v1/outbound/${h(t)}/link`));if(typeof e.url!="string"||typeof e.expires_at!="string")throw i("storage answered with an invalid link");return{url:e.url,link_expires_at:e.link_expires_at,expires_at:e.expires_at}},async putFileBytes(t,e,n,p){const a=w.from(U(e,n));let o;try{o=await fetch(t,{method:"PUT",signal:AbortSignal.timeout(11e4),headers:{"Content-Type":p,"Content-Length":String(n)},body:w.toWeb(a),duplex:"half"})}catch(g){throw i(`storage could not be reached: ${g instanceof Error?g.message:String(g)}`)}finally{a.destroy()}if(await o.body?.cancel().catch(()=>{}),!o.ok)throw i(`storage answered ${o.status} to the upload`)}}}s(A,"createStorageClient");function G(r){return!r||Buffer.byteLength(r,"utf8")>255?"name must be 1-255 bytes":r==="."||r===".."?"name must not be . or ..":/[/\\\u0000-\u001f\u007f]/.test(r)?"name must not contain /, \\, or control characters":null}s(G,"invalidStorageName");export{b as StorageRefused,N as UPLOAD_MAX_BYTES,A as createStorageClient,G as invalidStorageName,F as resetStorageClient,W as storageClient,j as storageConfig};
+${r.base_url}`;return _?.key!==u&&(_={key:u,client:L(r,()=>O(l,r.service_url),P())}),_.client}s(G,"storageClient");function J(){_=void 0}s(J,"resetStorageClient");function L(r,l,u){let d,f;const k=s(async()=>{if(d&&d.expires_at-6e4>Date.now())return d.access_token;f??=l().finally(()=>{f=void 0});try{d=await f}catch(t){throw i(`storage token could not be minted: ${t instanceof Error?t.message:String(t)}`)}return d.access_token},"bearer"),c=s(async(t,e,n={})=>{const p=[AbortSignal.timeout(n.timeoutMs??1e4),...n.signal?[n.signal]:[]];let a;try{a=await fetch(`${r.service_url}${e}`,{method:t,signal:AbortSignal.any(p),headers:{Authorization:`Bearer ${await k()}`,...n.body===void 0?{}:{"Content-Type":"application/json"}},...n.body===void 0?{}:{body:JSON.stringify(n.body)}})}catch(o){throw o instanceof m?o:i(`storage could not be reached: ${o instanceof Error?o.message:String(o)}`)}if(a.status===401&&(d=void 0),a.status===404||a.status===409){const o=await a.json().catch(()=>({})),g=o.error?.code??o.code??(a.status===404?"not_found":"not_uploaded");throw new b(a.status,g,o.error?.message??o.message??`storage answered ${a.status}`)}if(!a.ok)throw await a.body?.cancel().catch(()=>{}),i(`storage answered ${a.status} to ${t} ${e.split("?")[0]}`);return a},"call"),y=s(async t=>{try{return await t.json()}catch{throw i("storage answered with an invalid body")}},"json"),h=s(t=>encodeURIComponent(t),"id");return{config:r,runtimeId:u,async createUpload(t){const e=await y(await c("POST","/v1/uploads",{body:t}));if(typeof e.upload_id!="string"||typeof e.url!="string"||typeof e.upload_link!="string"||typeof e.expires_at!="string")throw i("storage answered with an invalid upload");return{upload_id:e.upload_id,url:e.url,upload_link:e.upload_link,expires_at:e.expires_at}},async fetchUpload(t,e){const n=await c("GET",`/v1/uploads/${h(t)}/content`,{...e?{signal:e}:{},timeoutMs:11e4});if(!n.body)throw i("storage answered with no body");const p=n.headers.get("content-length");return{body:w.fromWeb(n.body),size:p===null?null:Number(p),media_type:n.headers.get("content-type")}},async signDownload(t){const e=await y(await c("POST",`/v1/uploads/${h(t)}/download-link`));if(typeof e.url!="string"||typeof e.expires_at!="string")throw i("storage answered with an invalid link");return{url:e.url,expires_at:e.expires_at}},async deleteUpload(t){try{await c("DELETE",`/v1/uploads/${h(t)}`)}catch(e){if(!(e instanceof b&&e.status===404))throw e}},async createShare(t){const e=await y(await c("POST","/v1/shares",{body:t}));if(typeof e.share_id!="string"||typeof e.url!="string"||typeof e.upload_link!="string")throw i("storage answered with an invalid share");return{share_id:e.share_id,url:e.url,upload_link:e.upload_link,expires_at:e.expires_at??null}},async putShareBytes(t,e,n,p){if($(e).size!==n)throw new Error("shared file changed size while it was being copied");let a;try{a=await fetch(t,{method:"PUT",signal:AbortSignal.timeout(11e4),headers:{"Content-Type":p,"Content-Length":String(n)},body:w.toWeb(S(e)),duplex:"half"})}catch(o){throw i(`storage could not be reached: ${o instanceof Error?o.message:String(o)}`)}if(await a.body?.cancel().catch(()=>{}),!a.ok)throw i(`storage answered ${a.status} to the share upload`)},async deleteShare(t){try{await c("DELETE",`/v1/shares/${h(t)}`)}catch(e){if(!(e instanceof b&&e.status===404))throw e}},async createResultUpload(t){const e=await y(await c("POST","/v1/uploads",{body:{name:t.name,media_type:t.media_type,max_size:t.max_size}}));if(typeof e.upload_id!="string"||typeof e.url!="string"||typeof e.upload_link!="string"||typeof e.expires_at!="string")throw i("storage answered with an invalid upload");return{upload_id:e.upload_id,url:e.url,upload_link:e.upload_link,expires_at:e.expires_at}},async signUploadLink(t){const e=await y(await c("POST",`/v1/uploads/${h(t)}/upload-link`));if(typeof e.upload_link!="string"||typeof e.expires_at!="string")throw i("storage answered with an invalid upload link");return{upload_link:e.upload_link,expires_at:e.expires_at}},async createOutbound(t){const e=await y(await c("POST","/v1/outbound",{body:t}));if(typeof e.object_id!="string"||typeof e.upload_link!="string"||typeof e.url!="string"||typeof e.expires_at!="string")throw i("storage answered with an invalid outbound object");return{object_id:e.object_id,upload_link:e.upload_link,url:e.url,link_expires_at:e.link_expires_at,expires_at:e.expires_at}},async signOutbound(t){const e=await y(await c("POST",`/v1/outbound/${h(t)}/link`));if(typeof e.url!="string"||typeof e.expires_at!="string")throw i("storage answered with an invalid link");return{url:e.url,link_expires_at:e.link_expires_at,expires_at:e.expires_at}},async putFileBytes(t,e,n,p){const a=w.from(j(e,n));let o;try{o=await fetch(t,{method:"PUT",signal:AbortSignal.timeout(11e4),headers:{"Content-Type":p,"Content-Length":String(n)},body:w.toWeb(a),duplex:"half"})}catch(g){throw i(`storage could not be reached: ${g instanceof Error?g.message:String(g)}`)}finally{a.destroy()}if(await o.body?.cancel().catch(()=>{}),!o.ok)throw i(`storage answered ${o.status} to the upload`)}}}s(L,"createStorageClient");function X(r){return!r||Buffer.byteLength(r,"utf8")>255?"name must be 1-255 bytes":r==="."||r===".."?"name must not be . or ..":/[/\\\u0000-\u001f\u007f]/.test(r)?"name must not contain /, \\, or control characters":null}s(X,"invalidStorageName");export{b as StorageRefused,F as UPLOAD_MAX_BYTES,L as createStorageClient,X as invalidStorageName,J as resetStorageClient,G as storageClient,A as storageConfig};

package/dist/core/user-settings.d.ts

@@ -377,10 +377,6 @@ export declare const CONFIG_SETTINGS_COVERAGE: {
         surface: "specialized";
         owner: string;
     };
-    ledger: {
-        surface: "specialized";
-        owner: string;
-    };
     store: {
         surface: "specialized";
         owner: string;

package/dist/core/user-settings.js

@@ -1 +1 @@
-var v=Object.defineProperty;var n=(e,t)=>v(e,"name",{value:t,configurable:!0});import{CONDENSED_HISTORY_MODES as u,MOUSE_MODE_DEFAULTS as p,WHIP_MESSAGE_MODES as d}from"../types.js";function i(e,t,o){const s=e.indexOf(t),a=s>=0?s:0;return e[(a+o+e.length)%e.length]}n(i,"cycleChoice");function c(e,t,o){const s=e.indexOf(t);return s>=0?e[(s+o+e.length)%e.length]:o>=0?e.find(a=>a>t)??e[0]:[...e].reverse().find(a=>a<t)??e[e.length-1]}n(c,"cycleNumber");function r(e,t){return e==="true"?!0:e==="false"?!1:`${t} must be true or false`}n(r,"booleanFromString");function f(e,t){if(!/^\d+$/.test(e))return`${t} must be an integer >= 0`;const o=Number(e);return Number.isSafeInteger(o)?o:`${t} must be an integer >= 0`}n(f,"nonNegativeIntegerFromString");function _(e,t){const o=f(e,t);return typeof o=="string"||o<1?`${t} must be an integer >= 1`:o}n(_,"positiveIntegerFromString");const m=[!1,"notify","apply"],w=[0,1,6,12,24,48,72,168],b=[1,2,3,4,5,6,8,10,12],l="openai-codex";function g(e,t){const o=e.providerOptions[t];if(o!==void 0)return o;const s={};return e.providerOptions[t]=s,s}n(g,"providerOptionsFor");const x=[1,2,3,4,5,6],h={schema_version:{surface:"specialized",owner:"internal schema migration"},marketplaces:{surface:"specialized",owner:"Plugins and pkg market commands"},plugins:{surface:"specialized",owner:"Plugins tab and pkg plugin commands"},auto_update:{surface:"settings",settings:{crtr:{key:"auto_update.crtr",label:"crouter updates",description:"Notify about crouter releases, install them automatically, or turn checks off.",valueConstraint:"true|false|notify|apply; true stores notify",applies:"Applies on the next crouter command.",group:"updates",order:70,format:n(e=>e.auto_update.crtr===!1?"off":e.auto_update.crtr,"format"),cycle:n((e,t)=>{e.auto_update.crtr=i(m,e.auto_update.crtr,t)},"cycle"),setFromString:n((e,t)=>{const o=t==="true"?"notify":t;return o!=="notify"&&o!=="apply"&&o!=="false"?"auto_update.crtr must be notify, apply, or false":(e.auto_update.crtr=o==="false"?!1:o,null)},"setFromString")},content:{key:"auto_update.content",label:"Content updates",description:"Notify about plugin and marketplace updates, apply them automatically, or turn checks off.",valueConstraint:"false|notify|apply",applies:"Applies on the next crouter command.",group:"updates",order:80,format:n(e=>e.auto_update.content===!1?"off":e.auto_update.content,"format"),cycle:n((e,t)=>{e.auto_update.content=i(m,e.auto_update.content,t)},"cycle"),setFromString:n((e,t)=>t!=="notify"&&t!=="apply"&&t!=="false"?"auto_update.content must be notify, apply, or false":(e.auto_update.content=t==="false"?!1:t,null),"setFromString")},interval_hours:{key:"auto_update.interval_hours",label:"Update interval",description:"Minimum hours between automatic update checks. Zero checks on every command.",valueConstraint:"integer >= 0",applies:"Applies on the next crouter command.",group:"updates",order:90,format:n(e=>`${e.auto_update.interval_hours}h`,"format"),cycle:n((e,t)=>{e.auto_update.interval_hours=c(w,e.auto_update.interval_hours,t)},"cycle"),setFromString:n((e,t)=>{const o=f(t,"auto_update.interval_hours");return typeof o=="string"?o:(e.auto_update.interval_hours=o,null)},"setFromString")}}},max_panes_per_window:{surface:"settings",setting:{key:"max_panes_per_window",label:"Maximum panes",description:"Maximum human-review panes placed in one tmux window before using another window.",valueConstraint:"integer >= 1",applies:"Applies to the next pane placement.",group:"panes",order:20,format:n(e=>String(e.max_panes_per_window),"format"),cycle:n((e,t)=>{e.max_panes_per_window=c(b,e.max_panes_per_window,t)},"cycle"),setFromString:n((e,t)=>{const o=_(t,"max_panes_per_window");return typeof o=="string"?o:(e.max_panes_per_window=o,null)},"setFromString")}},auto_open_child_viewers:{surface:"settings",setting:{key:"auto_open_child_viewers",label:"Open child panes",description:"Open each managed child beside its watched parent. Off keeps new children running in the background.",valueConstraint:"true|false",applies:"Applies to the next managed child created; independent roots still open their attended viewer.",group:"panes",order:10,format:n(e=>e.auto_open_child_viewers?"on":"off","format"),cycle:n(e=>{e.auto_open_child_viewers=!e.auto_open_child_viewers},"cycle"),setFromString:n((e,t)=>{const o=r(t,"auto_open_child_viewers");return typeof o=="string"?o:(e.auto_open_child_viewers=o,null)},"setFromString")}},brokerThresholds:{surface:"specialized",owner:"Broker limits tab"},lifecycle:{surface:"specialized",owner:"sys config set lifecycle.unattendedParkMs"},completion_bell:{surface:"settings",setting:{key:"completion_bell",label:"Completion bell",description:"Ring a short sound when the node in an attached viewer finishes a turn.",valueConstraint:"true|false",applies:"Applies on the next turn end.",group:"display",order:41,format:n(e=>e.completion_bell?"on":"off","format"),cycle:n(e=>{e.completion_bell=!e.completion_bell},"cycle"),setFromString:n((e,t)=>{const o=r(t,"completion_bell");return typeof o=="string"?o:(e.completion_bell=o,null)},"setFromString")}},working_gerunds:{surface:"specialized",owner:"sys config set working_gerunds"},whip_mode:{surface:"settings",setting:{key:"whip_mode",label:"Whip mode",description:"Play the whip animation when you send a prompt and when a viewer opens for an agent with an initial prompt.",valueConstraint:"true|false",applies:"Applies on the next attach.",group:"display",order:39,format:n(e=>e.whip_mode?"on":"off","format"),cycle:n(e=>{e.whip_mode=!e.whip_mode},"cycle"),setFromString:n((e,t)=>{const o=r(t,"whip_mode");return typeof o=="string"?o:(e.whip_mode=o,null)},"setFromString")}},page_surface:{surface:"settings",setting:{key:"page_surface",label:"Page human surface",description:"This host reads pages in a browser rather than a terminal. Agents are told the page module runs as written, HTML pages are offered, and document review and live display leave the command tree.",valueConstraint:"true|false",applies:"Applies when human command help is assembled.",group:"display",order:37,format:n(e=>e.page_surface?"on":"off","format"),cycle:n(e=>{e.page_surface=!e.page_surface},"cycle"),setFromString:n((e,t)=>{const o=r(t,"page_surface");return typeof o=="string"?o:(e.page_surface=o,null)},"setFromString")}},whip_messages:{surface:"specialized",owner:"sys config set whip_messages"},whip_message_mode:{surface:"settings",setting:{key:"whip_message_mode",label:"Whip message",description:"What the whip action sends: a random line from whip_messages, or the fixed \u201CGo faster\u201D.",valueConstraint:d.join("|"),applies:"Applies on the next attach.",group:"display",order:40,format:n(e=>e.whip_message_mode==="go-faster"?"go faster":"random","format"),cycle:n((e,t)=>{e.whip_message_mode=i(d,e.whip_message_mode,t)},"cycle"),setFromString:n((e,t)=>d.includes(t)?(e.whip_message_mode=t,null):`whip_message_mode must be one of: ${d.join("|")}`,"setFromString")}},mouse_mode_default:{surface:"settings",setting:{key:"mouse_mode_default",label:"Default mouse mode",description:"Initial mouse wheel scrolling for each attached viewer.",valueConstraint:p.join("|"),applies:"Applies on the next attach.",group:"display",order:38,format:n(e=>e.mouse_mode_default==="tmux"?"follow tmux":e.mouse_mode_default,"format"),cycle:n((e,t)=>{e.mouse_mode_default=i(p,e.mouse_mode_default,t)},"cycle"),setFromString:n((e,t)=>p.includes(t)?(e.mouse_mode_default=t,null):`mouse_mode_default must be one of: ${p.join("|")}`,"setFromString")}},live_cycles:{surface:"settings",setting:{key:"live_cycles",label:"Live cycles",description:"Trailing refresh cycles rendered at full fidelity; older cycles condense to text.",valueConstraint:"integer >= 1",applies:"Applies on the next attach.",group:"display",order:50,format:n(e=>String(e.live_cycles),"format"),cycle:n((e,t)=>{e.live_cycles=c(x,e.live_cycles,t)},"cycle"),setFromString:n((e,t)=>{const o=_(t,"live_cycles");return typeof o=="string"?o:(e.live_cycles=o,null)},"setFromString")}},condensed_history:{surface:"settings",setting:{key:"condensed_history",label:"Condensed history",description:"Messages retained from condensed cycles. Tool calls are never kept.",valueConstraint:u.join("|"),applies:"Applies on the next attach.",group:"display",order:60,format:n(e=>e.condensed_history,"format"),cycle:n((e,t)=>{e.condensed_history=i(u,e.condensed_history,t)},"cycle"),setFromString:n((e,t)=>u.includes(t)?(e.condensed_history=t,null):`condensed_history must be one of: ${u.join("|")}`,"setFromString")}},bash_tool_purpose:{surface:"settings",setting:{key:"bash_tool_purpose",label:"Bash purpose field",description:"Expose the optional purpose label to agents in the bash tool schema. Off removes the field without disabling the bash valve.",valueConstraint:"true|false",applies:"Applies on the next node session.",group:"display",order:25,format:n(e=>e.bash_tool_purpose?"on":"off","format"),cycle:n(e=>{e.bash_tool_purpose=!e.bash_tool_purpose},"cycle"),setFromString:n((e,t)=>{const o=r(t,"bash_tool_purpose");return typeof o=="string"?o:(e.bash_tool_purpose=o,null)},"setFromString")}},fold_finished_tools:{surface:"settings",setting:{key:"fold_finished_tools",label:"Fold finished tools",description:"Fold every settled tool call to its call line. Toggle live with /fold-tools.",valueConstraint:"true|false",applies:"Applies on the next attach.",group:"display",order:30,format:n(e=>e.fold_finished_tools?"on":"off","format"),cycle:n(e=>{e.fold_finished_tools=!e.fold_finished_tools},"cycle"),setFromString:n((e,t)=>{const o=r(t,"fold_finished_tools");return typeof o=="string"?o:(e.fold_finished_tools=o,null)},"setFromString")}},summarize_tool_calls:{surface:"settings",setting:{key:"summarize_tool_calls",label:"Summarize tool calls",description:"Replace completed folded tool-call groups with a one-line broker summary when available.",valueConstraint:"true|false",applies:"Applies when the next visible message closes a tool-call group.",group:"display",order:35,format:n(e=>e.summarize_tool_calls?"on":"off","format"),cycle:n(e=>{e.summarize_tool_calls=!e.summarize_tool_calls},"cycle"),setFromString:n((e,t)=>{const o=r(t,"summarize_tool_calls");return typeof o=="string"?o:(e.summarize_tool_calls=o,null)},"setFromString")}},document_port:{surface:"settings",setting:{key:"document_port",label:"Document browser port",description:"Fixed localhost port where crtrd serves editable document pages.",valueConstraint:"1-65535",applies:"Applies after daemon handover and on the next attach.",group:"display",order:37.5,format:n(e=>String(e.document_port),"format"),cycle:n((e,t)=>{e.document_port=Math.max(1,Math.min(65535,e.document_port+t))},"cycle"),setFromString:n((e,t)=>{const o=Number(t);return!/^\d+$/.test(t)||!Number.isInteger(o)||o<1||o>65535?"document_port must be an integer from 1 to 65535":(e.document_port=o,null)},"setFromString")}},detailed_tool_recaps:{surface:"settings",setting:{key:"detailed_tool_recaps",label:"Detailed tool recaps",description:"Show each document read and edited file in folded tool recaps. Off shows a compact count line instead.",valueConstraint:"true|false",applies:"Applies on the next attach.",group:"display",order:36,format:n(e=>e.detailed_tool_recaps?"on":"off","format"),cycle:n(e=>{e.detailed_tool_recaps=!e.detailed_tool_recaps},"cycle"),setFromString:n((e,t)=>{const o=r(t,"detailed_tool_recaps");return typeof o=="string"?o:(e.detailed_tool_recaps=o,null)},"setFromString")}},consolidate_replies:{surface:"settings",setting:{key:"consolidate_replies",label:"Consolidate replies",description:"Experiment: show one rewritten agent reply per message you type, with the working folded behind it (/show-working).",valueConstraint:"true|false",applies:"Applies on the next attach; the broker reads it per turn.",group:"display",order:36.5,format:n(e=>e.consolidate_replies?"on":"off","format"),cycle:n(e=>{e.consolidate_replies=!e.consolidate_replies},"cycle"),setFromString:n((e,t)=>{const o=r(t,"consolidate_replies");return typeof o=="string"?o:(e.consolidate_replies=o,null)},"setFromString")}},keybindings:{surface:"specialized",owner:"Keybindings tab"},tmux_passthrough:{surface:"specialized",owner:"Keybindings tab"},providerOptions:{surface:"settings",settings:{"openai-codex.fastMode":{key:`providerOptions.${l}.fastMode`,label:"Codex fast mode",description:"Serve Codex turns at the ChatGPT priority tier: about 1.5x faster generation for about 2x the credits. Displayed cost does not reflect the premium.",valueConstraint:"true|false",applies:"Applies on each node's next turn.",group:"providers",order:40,format:n(e=>e.providerOptions[l]?.fastMode?"on":"off","format"),cycle:n(e=>{const t=g(e,l);t.fastMode=!t.fastMode},"cycle"),setFromString:n((e,t)=>{const o=r(t,`providerOptions.${l}.fastMode`);return typeof o=="string"?o:(g(e,l).fastMode=o,null)},"setFromString")}}},modelLadders:{surface:"specialized",owner:"Models tab"},modelRoutes:{surface:"specialized",owner:"Models route declarations"},modelRouting:{surface:"specialized",owner:"Models route declarations"},kinds:{surface:"specialized",owner:"Models tab and kind registry"},page_components:{surface:"specialized",owner:"Page component catalog: product-registered page component kinds"},remoteCanvas:{surface:"specialized",owner:"canvas config commands"},api:{surface:"specialized",owner:"sys connect"},paths:{surface:"specialized",owner:"runtime layout"},ledger:{surface:"specialized",owner:"money ledger (take_pct, sandbox rates)"},store:{surface:"specialized",owner:"daemon conversation store"},runtime:{surface:"specialized",owner:"app-facing listener"},spawnEnv:{surface:"specialized",owner:"spawn environment allow-list"},bin:{surface:"specialized",owner:"bare-binary contributions on every node PATH"},humanActions:{surface:"specialized",owner:"scope-configured human completion actions"}},O=Object.keys(h);function S(){const e=[];for(const t of Object.values(h))t.surface==="settings"&&("setting"in t?e.push(t.setting):e.push(...Object.values(t.settings)));return e.sort((t,o)=>t.order-o.order)}n(S,"collectUserSettings");const y=S();function A(e){return y.find(t=>t.key===e)}n(A,"findUserSetting");function z(e){return y.filter(t=>t.group===e)}n(z,"userSettingsInGroup");export{h as CONFIG_SETTINGS_COVERAGE,O as SCOPE_CONFIG_KEYS,y as USER_SETTINGS,A as findUserSetting,z as userSettingsInGroup};
+var v=Object.defineProperty;var n=(e,t)=>v(e,"name",{value:t,configurable:!0});import{CONDENSED_HISTORY_MODES as u,MOUSE_MODE_DEFAULTS as p,WHIP_MESSAGE_MODES as d}from"../types.js";function i(e,t,o){const s=e.indexOf(t),a=s>=0?s:0;return e[(a+o+e.length)%e.length]}n(i,"cycleChoice");function c(e,t,o){const s=e.indexOf(t);return s>=0?e[(s+o+e.length)%e.length]:o>=0?e.find(a=>a>t)??e[0]:[...e].reverse().find(a=>a<t)??e[e.length-1]}n(c,"cycleNumber");function r(e,t){return e==="true"?!0:e==="false"?!1:`${t} must be true or false`}n(r,"booleanFromString");function f(e,t){if(!/^\d+$/.test(e))return`${t} must be an integer >= 0`;const o=Number(e);return Number.isSafeInteger(o)?o:`${t} must be an integer >= 0`}n(f,"nonNegativeIntegerFromString");function _(e,t){const o=f(e,t);return typeof o=="string"||o<1?`${t} must be an integer >= 1`:o}n(_,"positiveIntegerFromString");const m=[!1,"notify","apply"],w=[0,1,6,12,24,48,72,168],b=[1,2,3,4,5,6,8,10,12],l="openai-codex";function g(e,t){const o=e.providerOptions[t];if(o!==void 0)return o;const s={};return e.providerOptions[t]=s,s}n(g,"providerOptionsFor");const x=[1,2,3,4,5,6],h={schema_version:{surface:"specialized",owner:"internal schema migration"},marketplaces:{surface:"specialized",owner:"Plugins and pkg market commands"},plugins:{surface:"specialized",owner:"Plugins tab and pkg plugin commands"},auto_update:{surface:"settings",settings:{crtr:{key:"auto_update.crtr",label:"crouter updates",description:"Notify about crouter releases, install them automatically, or turn checks off.",valueConstraint:"true|false|notify|apply; true stores notify",applies:"Applies on the next crouter command.",group:"updates",order:70,format:n(e=>e.auto_update.crtr===!1?"off":e.auto_update.crtr,"format"),cycle:n((e,t)=>{e.auto_update.crtr=i(m,e.auto_update.crtr,t)},"cycle"),setFromString:n((e,t)=>{const o=t==="true"?"notify":t;return o!=="notify"&&o!=="apply"&&o!=="false"?"auto_update.crtr must be notify, apply, or false":(e.auto_update.crtr=o==="false"?!1:o,null)},"setFromString")},content:{key:"auto_update.content",label:"Content updates",description:"Notify about plugin and marketplace updates, apply them automatically, or turn checks off.",valueConstraint:"false|notify|apply",applies:"Applies on the next crouter command.",group:"updates",order:80,format:n(e=>e.auto_update.content===!1?"off":e.auto_update.content,"format"),cycle:n((e,t)=>{e.auto_update.content=i(m,e.auto_update.content,t)},"cycle"),setFromString:n((e,t)=>t!=="notify"&&t!=="apply"&&t!=="false"?"auto_update.content must be notify, apply, or false":(e.auto_update.content=t==="false"?!1:t,null),"setFromString")},interval_hours:{key:"auto_update.interval_hours",label:"Update interval",description:"Minimum hours between automatic update checks. Zero checks on every command.",valueConstraint:"integer >= 0",applies:"Applies on the next crouter command.",group:"updates",order:90,format:n(e=>`${e.auto_update.interval_hours}h`,"format"),cycle:n((e,t)=>{e.auto_update.interval_hours=c(w,e.auto_update.interval_hours,t)},"cycle"),setFromString:n((e,t)=>{const o=f(t,"auto_update.interval_hours");return typeof o=="string"?o:(e.auto_update.interval_hours=o,null)},"setFromString")}}},max_panes_per_window:{surface:"settings",setting:{key:"max_panes_per_window",label:"Maximum panes",description:"Maximum human-review panes placed in one tmux window before using another window.",valueConstraint:"integer >= 1",applies:"Applies to the next pane placement.",group:"panes",order:20,format:n(e=>String(e.max_panes_per_window),"format"),cycle:n((e,t)=>{e.max_panes_per_window=c(b,e.max_panes_per_window,t)},"cycle"),setFromString:n((e,t)=>{const o=_(t,"max_panes_per_window");return typeof o=="string"?o:(e.max_panes_per_window=o,null)},"setFromString")}},auto_open_child_viewers:{surface:"settings",setting:{key:"auto_open_child_viewers",label:"Open child panes",description:"Open each managed child beside its watched parent. Off keeps new children running in the background.",valueConstraint:"true|false",applies:"Applies to the next managed child created; independent roots still open their attended viewer.",group:"panes",order:10,format:n(e=>e.auto_open_child_viewers?"on":"off","format"),cycle:n(e=>{e.auto_open_child_viewers=!e.auto_open_child_viewers},"cycle"),setFromString:n((e,t)=>{const o=r(t,"auto_open_child_viewers");return typeof o=="string"?o:(e.auto_open_child_viewers=o,null)},"setFromString")}},brokerThresholds:{surface:"specialized",owner:"Broker limits tab"},lifecycle:{surface:"specialized",owner:"sys config set lifecycle.unattendedParkMs"},completion_bell:{surface:"settings",setting:{key:"completion_bell",label:"Completion bell",description:"Ring a short sound when the node in an attached viewer finishes a turn.",valueConstraint:"true|false",applies:"Applies on the next turn end.",group:"display",order:41,format:n(e=>e.completion_bell?"on":"off","format"),cycle:n(e=>{e.completion_bell=!e.completion_bell},"cycle"),setFromString:n((e,t)=>{const o=r(t,"completion_bell");return typeof o=="string"?o:(e.completion_bell=o,null)},"setFromString")}},working_gerunds:{surface:"specialized",owner:"sys config set working_gerunds"},whip_mode:{surface:"settings",setting:{key:"whip_mode",label:"Whip mode",description:"Play the whip animation when you send a prompt and when a viewer opens for an agent with an initial prompt.",valueConstraint:"true|false",applies:"Applies on the next attach.",group:"display",order:39,format:n(e=>e.whip_mode?"on":"off","format"),cycle:n(e=>{e.whip_mode=!e.whip_mode},"cycle"),setFromString:n((e,t)=>{const o=r(t,"whip_mode");return typeof o=="string"?o:(e.whip_mode=o,null)},"setFromString")}},page_surface:{surface:"settings",setting:{key:"page_surface",label:"Page human surface",description:"This host reads pages in a browser rather than a terminal. Agents are told the page module runs as written, HTML pages are offered, and document review and live display leave the command tree.",valueConstraint:"true|false",applies:"Applies when human command help is assembled.",group:"display",order:37,format:n(e=>e.page_surface?"on":"off","format"),cycle:n(e=>{e.page_surface=!e.page_surface},"cycle"),setFromString:n((e,t)=>{const o=r(t,"page_surface");return typeof o=="string"?o:(e.page_surface=o,null)},"setFromString")}},whip_messages:{surface:"specialized",owner:"sys config set whip_messages"},whip_message_mode:{surface:"settings",setting:{key:"whip_message_mode",label:"Whip message",description:"What the whip action sends: a random line from whip_messages, or the fixed \u201CGo faster\u201D.",valueConstraint:d.join("|"),applies:"Applies on the next attach.",group:"display",order:40,format:n(e=>e.whip_message_mode==="go-faster"?"go faster":"random","format"),cycle:n((e,t)=>{e.whip_message_mode=i(d,e.whip_message_mode,t)},"cycle"),setFromString:n((e,t)=>d.includes(t)?(e.whip_message_mode=t,null):`whip_message_mode must be one of: ${d.join("|")}`,"setFromString")}},mouse_mode_default:{surface:"settings",setting:{key:"mouse_mode_default",label:"Default mouse mode",description:"Initial mouse wheel scrolling for each attached viewer.",valueConstraint:p.join("|"),applies:"Applies on the next attach.",group:"display",order:38,format:n(e=>e.mouse_mode_default==="tmux"?"follow tmux":e.mouse_mode_default,"format"),cycle:n((e,t)=>{e.mouse_mode_default=i(p,e.mouse_mode_default,t)},"cycle"),setFromString:n((e,t)=>p.includes(t)?(e.mouse_mode_default=t,null):`mouse_mode_default must be one of: ${p.join("|")}`,"setFromString")}},live_cycles:{surface:"settings",setting:{key:"live_cycles",label:"Live cycles",description:"Trailing refresh cycles rendered at full fidelity; older cycles condense to text.",valueConstraint:"integer >= 1",applies:"Applies on the next attach.",group:"display",order:50,format:n(e=>String(e.live_cycles),"format"),cycle:n((e,t)=>{e.live_cycles=c(x,e.live_cycles,t)},"cycle"),setFromString:n((e,t)=>{const o=_(t,"live_cycles");return typeof o=="string"?o:(e.live_cycles=o,null)},"setFromString")}},condensed_history:{surface:"settings",setting:{key:"condensed_history",label:"Condensed history",description:"Messages retained from condensed cycles. Tool calls are never kept.",valueConstraint:u.join("|"),applies:"Applies on the next attach.",group:"display",order:60,format:n(e=>e.condensed_history,"format"),cycle:n((e,t)=>{e.condensed_history=i(u,e.condensed_history,t)},"cycle"),setFromString:n((e,t)=>u.includes(t)?(e.condensed_history=t,null):`condensed_history must be one of: ${u.join("|")}`,"setFromString")}},bash_tool_purpose:{surface:"settings",setting:{key:"bash_tool_purpose",label:"Bash purpose field",description:"Expose the optional purpose label to agents in the bash tool schema. Off removes the field without disabling the bash valve.",valueConstraint:"true|false",applies:"Applies on the next node session.",group:"display",order:25,format:n(e=>e.bash_tool_purpose?"on":"off","format"),cycle:n(e=>{e.bash_tool_purpose=!e.bash_tool_purpose},"cycle"),setFromString:n((e,t)=>{const o=r(t,"bash_tool_purpose");return typeof o=="string"?o:(e.bash_tool_purpose=o,null)},"setFromString")}},fold_finished_tools:{surface:"settings",setting:{key:"fold_finished_tools",label:"Fold finished tools",description:"Fold every settled tool call to its call line. Toggle live with /fold-tools.",valueConstraint:"true|false",applies:"Applies on the next attach.",group:"display",order:30,format:n(e=>e.fold_finished_tools?"on":"off","format"),cycle:n(e=>{e.fold_finished_tools=!e.fold_finished_tools},"cycle"),setFromString:n((e,t)=>{const o=r(t,"fold_finished_tools");return typeof o=="string"?o:(e.fold_finished_tools=o,null)},"setFromString")}},summarize_tool_calls:{surface:"settings",setting:{key:"summarize_tool_calls",label:"Summarize tool calls",description:"Replace completed folded tool-call groups with a one-line broker summary when available.",valueConstraint:"true|false",applies:"Applies when the next visible message closes a tool-call group.",group:"display",order:35,format:n(e=>e.summarize_tool_calls?"on":"off","format"),cycle:n(e=>{e.summarize_tool_calls=!e.summarize_tool_calls},"cycle"),setFromString:n((e,t)=>{const o=r(t,"summarize_tool_calls");return typeof o=="string"?o:(e.summarize_tool_calls=o,null)},"setFromString")}},document_port:{surface:"settings",setting:{key:"document_port",label:"Document browser port",description:"Fixed localhost port where crtrd serves editable document pages.",valueConstraint:"1-65535",applies:"Applies after daemon handover and on the next attach.",group:"display",order:37.5,format:n(e=>String(e.document_port),"format"),cycle:n((e,t)=>{e.document_port=Math.max(1,Math.min(65535,e.document_port+t))},"cycle"),setFromString:n((e,t)=>{const o=Number(t);return!/^\d+$/.test(t)||!Number.isInteger(o)||o<1||o>65535?"document_port must be an integer from 1 to 65535":(e.document_port=o,null)},"setFromString")}},detailed_tool_recaps:{surface:"settings",setting:{key:"detailed_tool_recaps",label:"Detailed tool recaps",description:"Show each document read and edited file in folded tool recaps. Off shows a compact count line instead.",valueConstraint:"true|false",applies:"Applies on the next attach.",group:"display",order:36,format:n(e=>e.detailed_tool_recaps?"on":"off","format"),cycle:n(e=>{e.detailed_tool_recaps=!e.detailed_tool_recaps},"cycle"),setFromString:n((e,t)=>{const o=r(t,"detailed_tool_recaps");return typeof o=="string"?o:(e.detailed_tool_recaps=o,null)},"setFromString")}},consolidate_replies:{surface:"settings",setting:{key:"consolidate_replies",label:"Consolidate replies",description:"Experiment: show one rewritten agent reply per message you type, with the working folded behind it (/show-working).",valueConstraint:"true|false",applies:"Applies on the next attach; the broker reads it per turn.",group:"display",order:36.5,format:n(e=>e.consolidate_replies?"on":"off","format"),cycle:n(e=>{e.consolidate_replies=!e.consolidate_replies},"cycle"),setFromString:n((e,t)=>{const o=r(t,"consolidate_replies");return typeof o=="string"?o:(e.consolidate_replies=o,null)},"setFromString")}},keybindings:{surface:"specialized",owner:"Keybindings tab"},tmux_passthrough:{surface:"specialized",owner:"Keybindings tab"},providerOptions:{surface:"settings",settings:{"openai-codex.fastMode":{key:`providerOptions.${l}.fastMode`,label:"Codex fast mode",description:"Serve Codex turns at the ChatGPT priority tier: about 1.5x faster generation for about 2x the credits. Displayed cost does not reflect the premium.",valueConstraint:"true|false",applies:"Applies on each node's next turn.",group:"providers",order:40,format:n(e=>e.providerOptions[l]?.fastMode?"on":"off","format"),cycle:n(e=>{const t=g(e,l);t.fastMode=!t.fastMode},"cycle"),setFromString:n((e,t)=>{const o=r(t,`providerOptions.${l}.fastMode`);return typeof o=="string"?o:(g(e,l).fastMode=o,null)},"setFromString")}}},modelLadders:{surface:"specialized",owner:"Models tab"},modelRoutes:{surface:"specialized",owner:"Models route declarations"},modelRouting:{surface:"specialized",owner:"Models route declarations"},kinds:{surface:"specialized",owner:"Models tab and kind registry"},page_components:{surface:"specialized",owner:"Page component catalog: product-registered page component kinds"},remoteCanvas:{surface:"specialized",owner:"canvas config commands"},api:{surface:"specialized",owner:"sys connect"},paths:{surface:"specialized",owner:"runtime layout"},store:{surface:"specialized",owner:"daemon conversation store"},runtime:{surface:"specialized",owner:"app-facing listener"},spawnEnv:{surface:"specialized",owner:"spawn environment allow-list"},bin:{surface:"specialized",owner:"bare-binary contributions on every node PATH"},humanActions:{surface:"specialized",owner:"scope-configured human completion actions"}},O=Object.keys(h);function S(){const e=[];for(const t of Object.values(h))t.surface==="settings"&&("setting"in t?e.push(t.setting):e.push(...Object.values(t.settings)));return e.sort((t,o)=>t.order-o.order)}n(S,"collectUserSettings");const y=S();function A(e){return y.find(t=>t.key===e)}n(A,"findUserSetting");function z(e){return y.filter(t=>t.group===e)}n(z,"userSettingsInGroup");export{h as CONFIG_SETTINGS_COVERAGE,O as SCOPE_CONFIG_KEYS,y as USER_SETTINGS,A as findUserSetting,z as userSettingsInGroup};

package/dist/daemon/api/app-listener.d.ts

@@ -1,7 +1,9 @@
 import { type IncomingMessage, type ServerResponse } from 'node:http';
+import { AppPrincipalResolver } from './principal.js';
 import { type RequestPrincipal } from './router.js';
 import { type DeferHeadOptions } from './deferred-head.js';
 import type { AppPrincipal } from './principal.js';
+import type { CallToken } from '@north-light/identity';
 import type { ScopeConfig } from '../../types.js';
 import type { GrantSync } from '../../core/grants/sync.js';
 export declare function cursor(req: IncomingMessage, query: URLSearchParams): number;
@@ -13,6 +15,12 @@ export interface RunStreamOptions {
     isRunning?: (runId: string) => Promise<boolean>;
 }
 export declare function streamRunEvents(req: IncomingMessage, res: ServerResponse, id: string, principal: AppPrincipal | RequestPrincipal, after: number, requestId: string, framing: 'sse' | 'ndjson', options?: RunStreamOptions, traceId?: string): Promise<void>;
+/** The app call path as one request handler: version gates, call-token verification (or a `verified` token the caller already checked),
+ *  the peer ingress, and every `/v1` operation an app may call. The app listener and a cloud role's TCP listener both serve through it. */
+export declare function createAppRequestHandler(principal: AppPrincipalResolver, grantsReady: () => Promise<boolean>, syncGrants: GrantSync, listenerOptions?: {
+    deferHead?: DeferHeadOptions;
+    stream?: RunStreamOptions;
+}): (req: IncomingMessage, res: ServerResponse, verified?: CallToken) => Promise<void>;
 export declare function createAppListener(config: NonNullable<ScopeConfig['runtime']>, grantsReady: () => Promise<boolean>, syncGrants: GrantSync, listenerOptions?: {
     deferHead?: DeferHeadOptions;
     stream?: RunStreamOptions;

package/dist/daemon/api/app-listener.js

@@ -1,24 +1,24 @@
-var Q=Object.defineProperty;var s=(e,n)=>Q(e,"name",{value:n,configurable:!0});import{AsyncResource as W}from"node:async_hooks";import{randomUUID as q}from"node:crypto";import{createServer as K}from"node:http";import{Router as V,causedByOf as Z}from"./router.js";import{toErrorBody as ee}from"./map.js";import{objectRoutes as te}from"./handlers/objects.js";import{customObjectRoutes as re}from"./handlers/custom-objects.js";import{checkRoutes as ne}from"./handlers/check.js";import{chargeRoutes as ae}from"./handlers/charges.js";import{docRoutes as oe}from"./handlers/docs.js";import{relationRoutes as ie}from"./handlers/relations.js";import{schemaRoutes as se}from"./handlers/schemas.js";import{OPERATIONS as ue}from"./operations.js";import{runtimeReadiness as ce}from"../readiness.js";import{errorCodes as X}from"../../api/error-codes.js";import{MINIMUM_RUNTIME_VERSION_HEADER as de,RUNTIME_VERSION_HEADER as le,minimumRuntimeRefusal as me}from"../../api/runtime-version.js";import{CONTRACT_HEADER as fe,CONTRACT_LEVEL as $,REQUIRED_CONTRACT_HEADER as pe,contractRefusal as he}from"../../api/contract.js";import{crtrVersion as J}from"../../shared/crtr-version.js";import{newTraceId as we,parseTraceparent as ye}from"../../shared/traceparent.js";import{AppPrincipalResolver as _e}from"./principal.js";import{isDaemonRoute as ve,runtimeOwner as ge,servePeer as z}from"../peer/ingress.js";import{applySyncNotice as Re}from"./sync-notice.js";import{ownMachineId as Oe}from"../../core/peer/directory.js";import{handleRunOperation as Ee,integer as be}from"./handlers/runs.js";import{llmCallerOf as Ae,parseLlmRequest as Te,runLlm as Se}from"../../core/llm/run.js";import{parseUsageMonth as Ne,usageFor as Ce}from"../../core/ledger/index.js";import{capFields as Ie}from"./handlers/llm.js";import{CONTROL_BODY_MAX_BYTES as Pe,MODEL_CONTEXT_BODY_MAX_BYTES as ke}from"../../core/llm/body-limits.js";import{RunError as m,runIsRunning as Me}from"../../core/runs/operations.js";import{requireRun as L}from"./router.js";import{deferHead as De}from"./deferred-head.js";import{readRunEvents as G,registerGrantStream as He,subscribeRunEvents as xe}from"../../core/runs/events.js";import{activeGrant as Y,payerOfGrant as Be}from"../../core/grants/mirror.js";async function je(e){if(await Be(e)==="app")throw new m(401,"grant_revoked","this app-paid grant is no longer active");return null}s(je,"appPaidGone");import{releaseGrantWaiters as Je}from"../../core/grants/watch.js";import{emitEvent as Le}from"../../core/events/emit.js";import{runNotices as Ue}from"../run-notices.js";import{handleVendorSignIn as Ve,isVendorSignInPath as Xe}from"./vendor-signin.js";import{listAppProfiles as $e}from"./handlers/app-profiles.js";import{handleTransferDownload as ze,handleTransferOperation as Ge,TRANSFER_OPERATIONS as Ye}from"./handlers/transfer.js";import{handleQuestionOperation as Fe,QUESTION_OPERATIONS as Qe}from"./handlers/questions.js";import{removeVendorAccount as We,vendorStatus as qe}from"./handlers/vendor-status.js";import{handleMemoryOperation as Ke,MEMORY_OPERATIONS as Ze}from"./handlers/memory.js";import{EXEC_BODY_MAX_BYTES as et,handleExec as tt}from"./handlers/exec.js";import{abortOnClose as F,callerFromApp as rt,handleProviderOperation as nt,PROVIDER_OPERATIONS as at,providerFailure as ot}from"./handlers/providers.js";function it(e){return Object.prototype.hasOwnProperty.call(X,e)?X[e]:void 0}s(it,"fixedRow");function st(e){const n=it(e);return n?n.type:e==="stream_gap"||e==="provider_error"||e==="runtime_version_unsupported"?"invalid_request_error":"server_error"}s(st,"errorType");function ut(e){if(!e||typeof e!="object"||Array.isArray(e)||!("rate_limit"in e))return e;const{rate_limit:n,...o}=e;return o}s(ut,"appDetails");function j(e,n,o){const p=ut(e.details);return{error:{code:e.code,message:e.message,...p===void 0?{}:{details:p},type:st(e.code),...e.param?{param:e.param}:{},origin:"runtime",retryable:e.retryable||e.code==="stream_dropped",request_id:n,...o?{run_id:o}:{},...e.scope?{scope:e.scope}:{},...e.code==="unauthorized"?{user_action:"reconnect"}:{},...Ie(e),...e.code==="all_routes_exhausted"?{retry_after_s:e.details.retry_after_s}:{}}}}s(j,"envelope");function ct(e,n,o,p,f){const d=n instanceof m?n:new m(500,"server_failure","runtime request failed");if(n instanceof m||console.error("[app-listener]",`trace_id=${p}`,n),e.headersSent&&!String(e.getHeader("Content-Type")??"").startsWith("text/event-stream")){e.destroy();return}if(e.headersSent){e.end(`event: error
-data: ${JSON.stringify(j(d,o,f))}
+var Q=Object.defineProperty;var i=(e,n)=>Q(e,"name",{value:n,configurable:!0});import{AsyncResource as W}from"node:async_hooks";import{randomUUID as q}from"node:crypto";import{createServer as K}from"node:http";import{Router as V,causedByOf as Z}from"./router.js";import{toErrorBody as ee}from"./map.js";import{objectRoutes as te}from"./handlers/objects.js";import{customObjectRoutes as ne}from"./handlers/custom-objects.js";import{checkRoutes as re}from"./handlers/check.js";import{chargeRoutes as ae}from"./handlers/charges.js";import{docRoutes as oe}from"./handlers/docs.js";import{relationRoutes as ie}from"./handlers/relations.js";import{schemaRoutes as se}from"./handlers/schemas.js";import{OPERATIONS as ue}from"./operations.js";import{runtimeReadiness as de}from"../readiness.js";import{errorCodes as X}from"../../api/error-codes.js";import{MINIMUM_RUNTIME_VERSION_HEADER as ce,RUNTIME_VERSION_HEADER as le,minimumRuntimeRefusal as me}from"../../api/runtime-version.js";import{CONTRACT_HEADER as fe,CONTRACT_LEVEL as $,REQUIRED_CONTRACT_HEADER as pe,contractRefusal as he}from"../../api/contract.js";import{crtrVersion as j}from"../../shared/crtr-version.js";import{newTraceId as we,parseTraceparent as ye}from"../../shared/traceparent.js";import{AppPrincipalResolver as _e}from"./principal.js";import{isDaemonRoute as ge,runtimeOwner as ve,servePeer as z}from"../peer/ingress.js";import{applySyncNotice as Re}from"./sync-notice.js";import{ownMachineId as Oe}from"../../core/peer/directory.js";import{handleRunOperation as be,integer as Ee}from"./handlers/runs.js";import{llmCallerOf as Ae,parseLlmRequest as Se,runLlm as Te}from"../../core/llm/run.js";import{parseUsageMonth as Ne,usageFor as Ce}from"../../core/ledger/index.js";import{capFields as Ie}from"./handlers/llm.js";import{CONTROL_BODY_MAX_BYTES as Pe,MODEL_CONTEXT_BODY_MAX_BYTES as ke}from"../../core/llm/body-limits.js";import{RunError as m,cloudPersonScope as He,runIsRunning as Me}from"../../core/runs/operations.js";import{requireRun as J}from"./router.js";import{deferHead as De}from"./deferred-head.js";import{readRunEvents as G,registerGrantStream as xe,subscribeRunEvents as Be}from"../../core/runs/events.js";import{activeGrant as Y,payerOfGrant as je}from"../../core/grants/mirror.js";async function Je(e){if(await je(e)==="app")throw new m(401,"grant_revoked","this app-paid grant is no longer active");return null}i(Je,"appPaidGone");import{releaseGrantWaiters as Le}from"../../core/grants/watch.js";import{emitEvent as Ue}from"../../core/events/emit.js";import{runNotices as Ve}from"../run-notices.js";import{handleVendorSignIn as Xe,isVendorSignInPath as $e}from"./vendor-signin.js";import{listAppProfiles as ze}from"./handlers/app-profiles.js";import{handleTransferDownload as Ge,handleTransferOperation as Ye,TRANSFER_OPERATIONS as Fe}from"./handlers/transfer.js";import{handleQuestionOperation as Qe,QUESTION_OPERATIONS as We}from"./handlers/questions.js";import{removeVendorAccount as qe,vendorStatus as Ke}from"./handlers/vendor-status.js";import{handleMemoryOperation as Ze,MEMORY_OPERATIONS as et}from"./handlers/memory.js";import{EXEC_BODY_MAX_BYTES as tt,handleExec as nt}from"./handlers/exec.js";import{abortOnClose as F,callerFromApp as rt,handleProviderOperation as at,PROVIDER_OPERATIONS as ot,providerFailure as it}from"./handlers/providers.js";function st(e){return Object.prototype.hasOwnProperty.call(X,e)?X[e]:void 0}i(st,"fixedRow");function ut(e){const n=st(e);return n?n.type:e==="stream_gap"||e==="provider_error"||e==="runtime_version_unsupported"?"invalid_request_error":"server_error"}i(ut,"errorType");function dt(e){if(!e||typeof e!="object"||Array.isArray(e)||!("rate_limit"in e))return e;const{rate_limit:n,...o}=e;return o}i(dt,"appDetails");function B(e,n,o){const l=dt(e.details);return{error:{code:e.code,message:e.message,...l===void 0?{}:{details:l},type:ut(e.code),...e.param?{param:e.param}:{},origin:"runtime",retryable:e.retryable||e.code==="stream_dropped",request_id:n,...o?{run_id:o}:{},...e.scope?{scope:e.scope}:{},...e.code==="unauthorized"?{user_action:"reconnect"}:{},...Ie(e),...e.code==="all_routes_exhausted"?{retry_after_s:e.details.retry_after_s}:{}}}}i(B,"envelope");function ct(e,n,o,l,d){const w=n instanceof m?n:new m(500,"server_failure","runtime request failed");if(n instanceof m||console.error("[app-listener]",`trace_id=${l}`,n),e.headersSent&&!String(e.getHeader("Content-Type")??"").startsWith("text/event-stream")){e.destroy();return}if(e.headersSent){e.end(`event: error
+data: ${JSON.stringify(B(w,o,d))}
 
-`);return}e.writeHead(d.status,{"Content-Type":"application/json; charset=utf-8","Request-Id":o,"X-Content-Type-Options":"nosniff",...d.code==="all_routes_exhausted"?{"Retry-After":String(d.details.retry_after_s)}:{}}),e.end(JSON.stringify(j(d,o,f)))}s(ct,"fail");function U(e){return Array.isArray(e)?e[0]:e}s(U,"headerValue");function g(e,n,o){e.writeHead(n,{"Content-Type":"application/json; charset=utf-8"}),e.end(JSON.stringify(o))}s(g,"json");async function C(e,n=Pe){const o=[];let p=0;for await(const f of e){if(p+=f.length,p>n)throw new m(400,"invalid_request","request body too large");o.push(f)}if(p)try{return JSON.parse(Buffer.concat(o).toString("utf8"))}catch{throw new m(400,"invalid_request","invalid JSON body")}}s(C,"bodyOf");function dt(e,n){const o=e.headers["last-event-id"]??n.get("after");if(Array.isArray(o))throw new m(400,"invalid_request","invalid cursor","after");return be(o??null,"after",0,Number.MAX_SAFE_INTEGER,0)}s(dt,"cursor");function lt(e){return`id: ${e.sequence_number}
+`);return}e.writeHead(w.status,{"Content-Type":"application/json; charset=utf-8","Request-Id":o,"X-Content-Type-Options":"nosniff",...w.code==="all_routes_exhausted"?{"Retry-After":String(w.details.retry_after_s)}:{}}),e.end(JSON.stringify(B(w,o,d)))}i(ct,"fail");function L(e){return Array.isArray(e)?e[0]:e}i(L,"headerValue");function g(e,n,o){e.writeHead(n,{"Content-Type":"application/json; charset=utf-8"}),e.end(JSON.stringify(o))}i(g,"json");async function I(e,n=Pe){const o=[];let l=0;for await(const d of e){if(l+=d.length,l>n)throw new m(400,"invalid_request","request body too large");o.push(d)}if(l)try{return JSON.parse(Buffer.concat(o).toString("utf8"))}catch{throw new m(400,"invalid_request","invalid JSON body")}}i(I,"bodyOf");function lt(e,n){const o=e.headers["last-event-id"]??n.get("after");if(Array.isArray(o))throw new m(400,"invalid_request","invalid cursor","after");return Ee(o??null,"after",0,Number.MAX_SAFE_INTEGER,0)}i(lt,"cursor");function mt(e){return`id: ${e.sequence_number}
 event: ${e.type}
 data: ${JSON.stringify(e)}
 
-`}s(lt,"frame");const mt=6e4;async function ft(e,n,o,p,f,d,b,I={},D){await L(p,o);let w=await G(o,f);if(f>w.latest_sequence)throw new m(400,"invalid_request","cursor is beyond the run","after");if(f<w.latest_sequence&&(w.earliest_sequence===null||f<w.earliest_sequence-1))throw new m(409,"stream_gap","events have expired",void 0,{earliest_sequence:w.earliest_sequence,latest_sequence:w.latest_sequence});if(n.destroyed)return n.destroy(),Promise.resolve();n.writeHead(200,{"Content-Type":b==="sse"?"text/event-stream":"application/x-ndjson","Cache-Control":"no-cache","X-Accel-Buffering":"no"}),b==="sse"?n.write(`: connected
+`}i(mt,"frame");const ft=6e4;async function pt(e,n,o,l,d,w,A,S={},r){await J(l,o);let t=await G(o,d);if(d>t.latest_sequence)throw new m(400,"invalid_request","cursor is beyond the run","after");if(d<t.latest_sequence&&(t.earliest_sequence===null||d<t.earliest_sequence-1))throw new m(409,"stream_gap","events have expired",void 0,{earliest_sequence:t.earliest_sequence,latest_sequence:t.latest_sequence});if(n.destroyed)return n.destroy(),Promise.resolve();n.writeHead(200,{"Content-Type":A==="sse"?"text/event-stream":"application/x-ndjson","Cache-Control":"no-cache","X-Accel-Buffering":"no"}),A==="sse"?n.write(`: connected
 
-`):n.flushHeaders();let T=f;const r=await Ue().streamOpened(o);let t=!1,y=!1,E=!1,A;const P=new Promise(c=>{A=c}),v=s(()=>{t||(t=!0,r(T).catch(c=>console.error("[app-listener]",...D===void 0?[]:[`trace_id=${D}`],c)),clearInterval(N),clearInterval(O),M(),x(),n.off("close",v),n.off("drain",h),n.end(),A())},"end"),h=s(()=>{E=!1,a()},"onDrain"),R=s(c=>{t||n.write(b==="sse"?`event: error
-data: ${JSON.stringify(j(c,d,o))}
+`):n.flushHeaders();let p=d;const y=await Ve().streamOpened(o);let v=!1,T=!1,N=!1,O;const h=new Promise(f=>{O=f}),R=i(()=>{v||(v=!0,y(p).catch(f=>console.error("[app-listener]",...r===void 0?[]:[`trace_id=${r}`],f)),clearInterval(x),clearInterval(H),C(),u(),n.off("close",R),n.off("drain",a),n.end(),O())},"end"),a=i(()=>{N=!1,b()},"onDrain"),M=i(f=>{v||n.write(A==="sse"?`event: error
+data: ${JSON.stringify(B(f,w,o))}
 
-`:`${JSON.stringify({type:"error",...j(c,d,o)})}
-`),v()},"error"),a=s(async()=>{if(!(t||y)){y=!0;try{if(!await S()){H();return}if(await L(p,o),w=await G(o,T),w.backlog_count>1e3||w.backlog_bytes>32*1024*1024){R(new m(503,"stream_dropped","stream reader fell behind",void 0,{last_sequence:T}));return}for(const c of w.events){if(E)break;E=!n.write(b==="sse"?lt(c):`${JSON.stringify(c)}
-`),T=c.sequence_number}}catch(c){R(c instanceof m?c:new m(500,"server_failure","stream failed"))}finally{y=!1}}},"flush"),H=s(()=>R(new m(401,"grant_revoked","grant is not active")),"revoked"),S=s(async()=>"class"in p||await Y(p.grant)!==null,"grantActive"),M=await xe(o,W.bind(a)),x="class"in p?()=>{}:He(p.grant,H),N=setInterval(()=>{!t&&!E&&b==="sse"&&n.write(`: keepalive
+`:`${JSON.stringify({type:"error",...B(f,w,o)})}
+`),R()},"error"),b=i(async()=>{if(!(v||T)){T=!0;try{if(!await D()){P();return}if(await J(l,o),t=await G(o,p),t.backlog_count>1e3||t.backlog_bytes>32*1024*1024){M(new m(503,"stream_dropped","stream reader fell behind",void 0,{last_sequence:p}));return}for(const f of t.events){if(N)break;N=!n.write(A==="sse"?mt(f):`${JSON.stringify(f)}
+`),p=f.sequence_number}}catch(f){M(f instanceof m?f:new m(500,"server_failure","stream failed"))}finally{T=!1}}},"flush"),P=i(()=>M(new m(401,"grant_revoked","grant is not active")),"revoked"),D=i(async()=>"class"in l||await Y(l.grant)!==null,"grantActive"),C=await Be(o,W.bind(b)),u="class"in l?()=>{}:xe(l.grant,P),x=setInterval(()=>{!v&&!N&&A==="sse"&&n.write(`: keepalive
 
-`)},15e3),u=I.idleMs??mt,B=I.isRunning??Me;let i=Date.now(),_=T;const l=s(async()=>{if(t||b!=="sse")return;const c=Date.now();let k=!0;try{k=await B(o)}catch{}if(!t){if(k||T!==_){i=c,_=T;return}c-i<u||E||(n.write(`event: idle
+`)},15e3),s=S.idleMs??ft,_=S.isRunning??Me;let c=Date.now(),E=p;const k=i(async()=>{if(v||A!=="sse")return;const f=Date.now();let U=!0;try{U=await _(o)}catch{}if(!v){if(U||p!==E){c=f,E=p;return}f-c<s||N||(n.write(`event: idle
 data: {}
 
-`),v())}},"checkIdle"),O=setInterval(()=>{l().catch(c=>Le({level:"error",event:"api.run_stream.idle_check_failed",error:c}))},I.idleCheckMs??1e3);return O.unref(),n.on("drain",h),n.on("close",v),await a(),P}s(ft,"streamRunEvents");async function or(e,n,o,p={}){const f=e.listener;if(!e.issuer||!e.audience||!f?.address||!Number.isInteger(f.port)||f.port<1||f.port>65535)throw new Error("runtime issuer, audience and listener address/port are required");if(["0.0.0.0","::","[::]"].includes(f.address))throw new Error("runtime listener must bind a specific address");const d=new _e(e.issuer,e.audience,o,e.jwksUrl),b=new V,I=new Map;for(const r of ue.filter(t=>t.stage!==void 0)){const t=s(()=>({status:500}),"handler");b.register({method:r.method,pattern:r.path,handler:t}),I.set(t,r)}const D=new V().registerAll(te).registerAll(re).registerAll(oe).registerAll(se).registerAll(ie).registerAll(ne).registerAll(ae),w=K((r,t)=>{(async()=>{De(r,t,p.deferHead);const y=q();t.setHeader("Request-Id",y);const E=ye(U(r.headers.traceparent))??we();t.setHeader(le,J()),t.setHeader(fe,$);let A;try{const P=U(r.headers[de.toLowerCase()]),v=me(P,J())??he(U(r.headers[pe.toLowerCase()]),$,{legacyMinimum:P,runtimeVersion:J()});if(v!==null)throw v.status===400?new m(400,v.code,v.message,v.param):new m(426,v.code,v.message,void 0,v.details);const h=new URL(r.url??"/","http://runtime.local");if(Xe(h.pathname)){await Ve(r,t,h,d);return}const R=b.match(r.method??"GET",h.pathname),a=R?I.get(R.handler):void 0,H=a?.name==="runtime.sync-notice"||a?.name==="runtime.vendor-status"||a?.name==="runtime.vendor-account-remove";let S,M;if(!H&&r.headers.authorization!==void 0)try{S=await d.verifyCall(r.headers.authorization)}catch(i){M=i}const x={issuer:e.issuer,jwks:d.jwks,audience:s(async()=>e.audience,"audience"),owner:ge,self:Oe,syncGrants:o,ready:s(async()=>d.isReady()&&await n(),"ready")};if(S?.chain[0]?.sub.startsWith("runtime:")){await z(r,t,x,S);return}if(S===void 0&&a===void 0&&await ve(r.method??"GET",h.pathname)){await z(r,t,x,{status:401,code:"unauthorized",message:M===void 0?"a machine token is required":"invalid machine token"});return}if(a?.name==="ready"){const i=await n(),_=await ce({jwksReady:d.isReady(),grantsReady:s(()=>i,"grantsReady")});g(t,_.ready?200:503,_);return}if((r.method!=="GET"||h.pathname!=="/v1/health")&&(!d.isReady()||!await n()))throw new m(503,"runtime_starting","runtime_starting");if(!R||!a)throw new m(404,"not_found","unknown operation");A=R.params.run_id;const N=Z(r.headers);if(a.name==="health"){g(t,200,{status:"ok",api_version:"2026-09-23"});return}if(a.name==="runtime.sync-notice"){await Re(await d.verifySyncNotice(r.headers.authorization),o,y),t.writeHead(204),t.end();return}if(a.name==="runtime.vendor-status"){await d.verifyDirectoryRead(r.headers.authorization,"vendor_status"),g(t,200,await qe());return}if(a.name==="runtime.vendor-account-remove"){await d.verifyDirectoryRead(r.headers.authorization,"vendor_account_remove"),g(t,200,await We(await C(r)));return}if(S===void 0)throw M??new m(401,"unauthorized","a directory access token is required");const u=await d.resolveVerified(S,a.scope);if(t.setHeader("Request-Id",y),A&&await L(u,A,["run.message","run.interrupt","run.cancel","run.rename","run.delete"].includes(a.name),a.name==="run.delete"),a.stage==="objects"){const i=D.match(a.method,h.pathname);if(!i)throw new m(404,"not_found","unknown operation");const _={...N===void 0?{}:{causedBy:N},method:a.method,path:h.pathname,params:i.params,query:h.searchParams,body:await C(r,i.maxBodyBytes),ceiling:u.resolved,principal:{class:"app",app:u.grantee,scopes:u.resolved,sub:u.sub},req:r,res:t};let l;try{l=await i.handler(_)}catch(O){const{status:c,body:k}=ee(O);throw c>=500&&console.error("[app-listener]",`trace_id=${E}`,O),new m(c,k.error.code,k.error.message,void 0,k.error.details)}if(t.headersSent)return;if(l.rawBody!==void 0||l.status===204||l.body===void 0){t.writeHead(l.status,l.headers??{}),t.end(l.rawBody);return}t.writeHead(l.status,{"Content-Type":"application/json; charset=utf-8",...l.headers??{}}),t.end(JSON.stringify(l.body));return}if(a.stream==="bytes"){await ze(r,t,u,h.searchParams);return}if(a.stream){await ft(r,t,A,u,dt(r,h.searchParams),y,"sse",p.stream,E);return}if(a.name==="llm"){const i=Te(await C(r,ke)),_=new AbortController,l=s(()=>_.abort(),"abort");t.on("close",l);try{const O=await Se(i,_.signal,i.stream?c=>{t.headersSent||t.writeHead(200,{"Content-Type":"text/event-stream","Cache-Control":"no-cache","X-Accel-Buffering":"no"}),t.write(`data: ${JSON.stringify(c)}
+`),R())}},"checkIdle"),H=setInterval(()=>{k().catch(f=>Ue({level:"error",event:"api.run_stream.idle_check_failed",error:f}))},S.idleCheckMs??1e3);return H.unref(),n.on("drain",a),n.on("close",R),await b(),h}i(pt,"streamRunEvents");function ht(e,n,o,l={}){const d=new V,w=new Map;for(const r of ue.filter(t=>t.stage!==void 0)){const t=i(()=>({status:500}),"handler");d.register({method:r.method,pattern:r.path,handler:t}),w.set(t,r)}const A=new V().registerAll(te).registerAll(ne).registerAll(oe).registerAll(se).registerAll(ie).registerAll(re).registerAll(ae);return i((r,t,p)=>(async()=>{De(r,t,l.deferHead);const y=q();t.setHeader("Request-Id",y);const v=ye(L(r.headers.traceparent))??we();t.setHeader(le,j()),t.setHeader(fe,$);let T;try{const N=L(r.headers[ce.toLowerCase()]),O=me(N,j())??he(L(r.headers[pe.toLowerCase()]),$,{legacyMinimum:N,runtimeVersion:j()});if(O!==null)throw O.status===400?new m(400,O.code,O.message,O.param):new m(426,O.code,O.message,void 0,O.details);const h=new URL(r.url??"/","http://runtime.local");if($e(h.pathname)){await Xe(r,t,h,e);return}const R=d.match(r.method??"GET",h.pathname),a=R?w.get(R.handler):void 0,M=a?.name==="runtime.sync-notice"||a?.name==="runtime.vendor-status"||a?.name==="runtime.vendor-account-remove";let b,P;if(p!==void 0)b=p;else if(!M&&r.headers.authorization!==void 0)try{b=await e.verifyCall(r.headers.authorization)}catch(s){P=s}const D={issuer:e.issuer,jwks:e.jwks,audience:i(async()=>e.audience,"audience"),owner:ve,self:Oe,syncGrants:o,ready:i(async()=>e.isReady()&&await n(),"ready")};if(b?.chain[0]?.sub.startsWith("runtime:")){await z(r,t,D,b);return}if(b===void 0&&a===void 0&&await ge(r.method??"GET",h.pathname)){await z(r,t,D,{status:401,code:"unauthorized",message:P===void 0?"a machine token is required":"invalid machine token"});return}if(a?.name==="ready"){const s=await n(),_=await de({jwksReady:e.isReady(),grantsReady:i(()=>s,"grantsReady")});g(t,_.ready?200:503,_);return}if((r.method!=="GET"||h.pathname!=="/v1/health")&&(!e.isReady()||!await n()))throw new m(503,"runtime_starting","runtime_starting");if(!R||!a)throw new m(404,"not_found","unknown operation");T=R.params.run_id;const C=Z(r.headers);if(a.name==="health"){g(t,200,{status:"ok",api_version:"2026-09-23"});return}if(a.name==="runtime.sync-notice"){await Re(await e.verifySyncNotice(r.headers.authorization),o,y),t.writeHead(204),t.end();return}if(a.name==="runtime.vendor-status"){await e.verifyDirectoryRead(r.headers.authorization,"vendor_status"),g(t,200,await Ke());return}if(a.name==="runtime.vendor-account-remove"){await e.verifyDirectoryRead(r.headers.authorization,"vendor_account_remove"),g(t,200,await qe(await I(r)));return}if(b===void 0)throw P??new m(401,"unauthorized","a directory access token is required");const u=await e.resolveVerified(b,a.scope);if(t.setHeader("Request-Id",y),T&&await J(u,T,["run.message","run.interrupt","run.cancel","run.rename","run.delete"].includes(a.name),a.name==="run.delete"),a.stage==="objects"){const s=A.match(a.method,h.pathname);if(!s)throw new m(404,"not_found","unknown operation");const _={...C===void 0?{}:{causedBy:C},method:a.method,path:h.pathname,params:s.params,query:h.searchParams,body:await I(r,s.maxBodyBytes),ceiling:u.resolved,principal:{class:"app",app:u.grantee,scopes:u.resolved,sub:u.sub},req:r,res:t};let c;try{c=await s.handler(_)}catch(E){const{status:k,body:H}=ee(E);throw k>=500&&console.error("[app-listener]",`trace_id=${v}`,E),new m(k,H.error.code,H.error.message,void 0,H.error.details)}if(t.headersSent)return;if(c.rawBody!==void 0||c.status===204||c.body===void 0){t.writeHead(c.status,c.headers??{}),t.end(c.rawBody);return}t.writeHead(c.status,{"Content-Type":"application/json; charset=utf-8",...c.headers??{}}),t.end(JSON.stringify(c.body));return}if(a.stream==="bytes"){await Ge(r,t,u,h.searchParams);return}if(a.stream){await pt(r,t,T,u,lt(r,h.searchParams),y,"sse",l.stream,v);return}if(a.name==="llm"){const s=Se(await I(r,ke)),_=new AbortController,c=i(()=>_.abort(),"abort");t.on("close",c);try{const E=await Te(s,_.signal,s.stream?k=>{t.headersSent||t.writeHead(200,{"Content-Type":"text/event-stream","Cache-Control":"no-cache","X-Accel-Buffering":"no"}),t.write(`data: ${JSON.stringify(k)}
 
-`)}:void 0,void 0,{grantee:u.grantee,sub:u.sub,spend_cap:u.spend_cap,request:y},Ae(await Y(u.grant)??await je(u.grant)),N);i.stream?(t.headersSent||t.writeHead(200,{"Content-Type":"text/event-stream","Cache-Control":"no-cache","X-Accel-Buffering":"no"}),t.end(`data: [DONE]
+`)}:void 0,void 0,{grantee:u.grantee,sub:u.sub,spend_cap:u.spend_cap,request:y},Ae(await Y(u.grant)??await Je(u.grant)),C);s.stream?(t.headersSent||t.writeHead(200,{"Content-Type":"text/event-stream","Cache-Control":"no-cache","X-Accel-Buffering":"no"}),t.end(`data: [DONE]
 
-`)):g(t,200,O.completion)}finally{t.off("close",l)}return}if(a.name==="exec"){const{signal:i,release:_}=F(t);try{g(t,200,await tt(u,await C(r,et),i))}finally{_()}return}if(a.name==="usage.get"){g(t,200,await Ce(u.grantee,Ne(h.searchParams.get("month"))));return}if(a.name==="profile.list"){g(t,200,await $e(u));return}if(Qe.has(a.name)){const i=await Fe(a.name,u,R.params.question_id,a.method==="POST"?await C(r):void 0);g(t,i.status,i.body);return}if(at.has(a.name)){const{signal:i,release:_}=F(t);try{const l=await nt(a.name,rt(u),{params:R.params,body:a.method==="POST"?await C(r):void 0,query:h.searchParams},{requestId:y,traceId:E,signal:i,...N===void 0?{}:{causedBy:N}});g(t,l.status,l.body)}catch(l){const O=ot(l,y,!0);t.writeHead(O.status,{"Content-Type":"application/json; charset=utf-8","X-Content-Type-Options":"nosniff",...O.headers}),t.end(JSON.stringify(O.body))}finally{_()}return}if(Ze.has(a.name)){const i=await Ke(a.name,{class:"app",app:u.grantee,scopes:u.resolved},h.searchParams);g(t,i.status,i.body);return}if(Ye.has(a.name)){const i=await Ge(a,u,R.params,h.searchParams,await C(r));g(t,i.status,i.body);return}const B=await Ee(a,u,A,h.searchParams,await C(r),r.headers["idempotency-key"],N);g(t,B.status,B.body)}catch(P){ct(t,P,y,E,A)}})()});return{ready:new Promise((r,t)=>{w.once("error",t),w.listen(f.port,f.address,()=>{w.off("error",t),r()})}),close:s(async()=>{d.close(),Je(),w.closeAllConnections(),await new Promise((r,t)=>w.close(y=>y?t(y):r()))},"close")}}s(or,"createAppListener");export{mt as RUN_STREAM_IDLE_MS,or as createAppListener,dt as cursor,ft as streamRunEvents};
+`)):g(t,200,E.completion)}finally{t.off("close",c)}return}if(a.name==="exec"){const{signal:s,release:_}=F(t);try{g(t,200,await nt(u,await I(r,tt),s))}finally{_()}return}if(a.name==="usage.get"){g(t,200,await Ce(u.grantee,Ne(h.searchParams.get("month")),He(u.sub)));return}if(a.name==="profile.list"){g(t,200,await ze(u));return}if(We.has(a.name)){const s=await Qe(a.name,u,R.params.question_id,a.method==="POST"?await I(r):void 0);g(t,s.status,s.body);return}if(ot.has(a.name)){const{signal:s,release:_}=F(t);try{const c=await at(a.name,rt(u),{params:R.params,body:a.method==="POST"?await I(r):void 0,query:h.searchParams},{requestId:y,traceId:v,signal:s,...C===void 0?{}:{causedBy:C}});g(t,c.status,c.body)}catch(c){const E=it(c,y,!0);t.writeHead(E.status,{"Content-Type":"application/json; charset=utf-8","X-Content-Type-Options":"nosniff",...E.headers}),t.end(JSON.stringify(E.body))}finally{_()}return}if(et.has(a.name)){const s=await Ze(a.name,{class:"app",app:u.grantee,scopes:u.resolved},h.searchParams);g(t,s.status,s.body);return}if(Fe.has(a.name)){const s=await Ye(a,u,R.params,h.searchParams,await I(r));g(t,s.status,s.body);return}const x=await be(a,u,T,h.searchParams,await I(r),r.headers["idempotency-key"],C);g(t,x.status,x.body)}catch(N){ct(t,N,y,v,T)}})(),"handle")}i(ht,"createAppRequestHandler");async function un(e,n,o,l={}){const d=e.listener;if(!e.issuer||!e.audience||!d?.address||!Number.isInteger(d.port)||d.port<1||d.port>65535)throw new Error("runtime issuer, audience and listener address/port are required");if(["0.0.0.0","::","[::]"].includes(d.address))throw new Error("runtime listener must bind a specific address");const w=new _e(e.issuer,e.audience,o,e.jwksUrl),A=ht(w,n,o,l),S=K((t,p)=>{A(t,p)});return{ready:new Promise((t,p)=>{S.once("error",p),S.listen(d.port,d.address,()=>{S.off("error",p),t()})}),close:i(async()=>{w.close(),Le(),S.closeAllConnections(),await new Promise((t,p)=>S.close(y=>y?p(y):t()))},"close")}}i(un,"createAppListener");export{ft as RUN_STREAM_IDLE_MS,un as createAppListener,ht as createAppRequestHandler,lt as cursor,pt as streamRunEvents};

package/dist/daemon/api/handlers/charges.js

@@ -1 +1 @@
-var _=Object.defineProperty;var s=(n,e)=>_(n,"name",{value:e,configurable:!0});import{ApiError as p}from"../../../api/errors.js";import{personIdAsync as $}from"../../../core/canvas/person.js";import{assertReference as q,deleteLimit as R,listCharges as E,listLimits as w,monthTotals as L,parseUsageMonth as O,upsertLimit as T}from"../../../core/ledger/index.js";import{payersOf as b}from"../../../core/ledger/read.js";import{integer as N}from"./runs.js";import{invalidRequest as W,objectBody as k}from"./validate.js";function F(n){const{principal:e}=n;if(e.class==="app"||e.class==="broker")return{app:e.app};if(e.class==="person")return e.sub===void 0?void 0:{person:e.sub};throw new p(403,"owner_only","charges are read by the person, a node or an app")}s(F,"readerOf");async function G(n){const e=F(n),r=n.query.get("under"),t=n.query.get("after"),o=n.query.get("month"),i=r===null||o!==null?O(o):void 0,{charges:a,next:d}=await E({...i===void 0?{}:{month:i},...e===void 0?{}:{reader:e},...r===null?{}:{under:q(r)},...t===null?{}:{after:t},limit:N(n.query.get("limit"),"limit",1,1e4,1e3)}),f=r!==null||e!==void 0&&!("person"in e)?void 0:await L(i,e===void 0?void 0:e.person);return{...i===void 0?{}:{month:i},charges:a,next:d,...f===void 0?{}:{totals:f}}}s(G,"listRoute");const g=["bill","subscription","key","endpoint","take","legacy"],l="person:";function m(n){const{principal:e}=n;if(e.class!=="person")throw new p(403,"owner_only","spend limits are set by a person");return e.sub===void 0?void 0:e.sub.startsWith("user:")?e.sub:`user:${e.sub}`}s(m,"limitOwner");function v(n,e){const r=n.params.id??"";if(!r.startsWith(l)||r.length===l.length||r.length>128)throw new p(400,"invalid_request",`a person limit id starts with \`${l}\`; received ${r}`,{violations:[{field:"id",problem:`must start with ${l}`,received:r}]});if(e===void 0)return r;const t=r.slice(l.length);if(t.includes("/"))throw new p(400,"invalid_request","a person limit name has no `/`",{violations:[{field:"id",problem:"must not contain /",received:r}]});return`${l}${e.slice(5)}/${t}`}s(v,"idOf");function c(n,e,r){const t=n[e];if(t==null)return t;if(typeof t!="string"||t===""){r.push({field:e,problem:"must be a non-empty string or null",received:t});return}return t}s(c,"nullableString");async function I(n){const e=m(n),r=v(n,e),t=[],o=k(n.body,["payer","usd_per_month","funding","grantee","provider","sub"],t),i=o.payer;(typeof i!="string"||!/^(user|app):.+/.test(i))&&t.push({field:"payer",problem:"must be user:<id> or app:<id>",...i===void 0?{}:{received:i}});const a=o.usd_per_month;(typeof a!="number"||!Number.isFinite(a)||a<0)&&t.push({field:"usd_per_month",problem:"must be a number of at least 0",...a===void 0?{}:{received:a}});const d=c(o,"funding",t);typeof d=="string"&&!g.includes(d)&&t.push({field:"funding",problem:`must be one of ${g.join(", ")}`,received:d});const f=c(o,"grantee",t),y=c(o,"provider",t),h=c(o,"sub",t);t.length>0&&W("spend limit request",t);const u=o;if(e===void 0){if(u.payer.startsWith("user:")&&u.payer!==await $())throw new p(403,"owner_only","a person sets limits only on their own payer or on an app",{payer:u.payer})}else if(!(await b(e)).includes(u.payer))throw new p(403,"owner_only","a person sets limits only on their own payer or on an app they hold",{payer:u.payer});return await T({id:r,payer:u.payer,usd_per_month:u.usd_per_month,source:"person",...d===void 0?{}:{funding:d},...f===void 0?{}:{grantee:f},...y===void 0?{}:{provider:y},...h===void 0?{}:{sub:h}})}s(I,"setRoute");async function P(n){const e=m(n),r=await w();if(e===void 0)return{limits:r};const t=new Set(await b(e)),o=`${l}${e.slice(5)}/`;return{limits:r.filter(i=>i.id.startsWith(o)||i.payer!==null&&t.has(i.payer)||i.account===e)}}s(P,"listLimitsRoute");async function S(n){const e=v(n,m(n));if((await w({source:"person"})).find(t=>t.id===e)===void 0||!await R(e))throw new p(404,"not_found",`no person limit ${e}`);return{id:e,removed:!0}}s(S,"removeRoute");const X=[{method:"GET",pattern:"/v1/charges",handler:s(async n=>({status:200,body:await G(n)}),"handler")}],z=[{method:"GET",pattern:"/v1/spend-limits",handler:s(async n=>({status:200,body:await P(n)}),"handler")},{method:"PUT",pattern:"/v1/spend-limits/:id",handler:s(async n=>({status:200,body:await I(n)}),"handler")},{method:"DELETE",pattern:"/v1/spend-limits/:id",handler:s(async n=>({status:200,body:await S(n)}),"handler")}];export{X as chargeRoutes,z as spendLimitRoutes};
+var _=Object.defineProperty;var s=(n,e)=>_(n,"name",{value:e,configurable:!0});import{ApiError as p}from"../../../api/errors.js";import{personIdAsync as $}from"../../../core/canvas/person.js";import{assertReference as q,deleteLimit as R,listCharges as E,listLimits as w,monthTotals as L,parseUsageMonth as O,upsertLimit as T}from"../../../core/ledger/index.js";import{payersOf as b}from"../../../core/ledger/read.js";import{integer as N}from"./runs.js";import{cloudPersonScope as P}from"../../../core/runs/operations.js";import{invalidRequest as S,objectBody as W}from"./validate.js";function k(n){const{principal:e}=n;if(e.class==="app"||e.class==="broker"){const r=P(e.sub);return r===void 0?{app:e.app}:{app:e.app,sub:r}}if(e.class==="person")return e.sub===void 0?void 0:{person:e.sub};throw new p(403,"owner_only","charges are read by the person, a node or an app")}s(k,"readerOf");async function F(n){const e=k(n),r=n.query.get("under"),t=n.query.get("after"),o=n.query.get("month"),i=r===null||o!==null?O(o):void 0,{charges:a,next:d}=await E({...i===void 0?{}:{month:i},...e===void 0?{}:{reader:e},...r===null?{}:{under:q(r)},...t===null?{}:{after:t},limit:N(n.query.get("limit"),"limit",1,1e4,1e3)}),f=r!==null||e!==void 0&&!("person"in e)?void 0:await L(i,e===void 0?void 0:e.person);return{...i===void 0?{}:{month:i},charges:a,next:d,...f===void 0?{}:{totals:f}}}s(F,"listRoute");const g=["bill","subscription","key","endpoint","take","legacy"],l="person:";function m(n){const{principal:e}=n;if(e.class!=="person")throw new p(403,"owner_only","spend limits are set by a person");return e.sub===void 0?void 0:e.sub.startsWith("user:")?e.sub:`user:${e.sub}`}s(m,"limitOwner");function v(n,e){const r=n.params.id??"";if(!r.startsWith(l)||r.length===l.length||r.length>128)throw new p(400,"invalid_request",`a person limit id starts with \`${l}\`; received ${r}`,{violations:[{field:"id",problem:`must start with ${l}`,received:r}]});if(e===void 0)return r;const t=r.slice(l.length);if(t.includes("/"))throw new p(400,"invalid_request","a person limit name has no `/`",{violations:[{field:"id",problem:"must not contain /",received:r}]});return`${l}${e.slice(5)}/${t}`}s(v,"idOf");function c(n,e,r){const t=n[e];if(t==null)return t;if(typeof t!="string"||t===""){r.push({field:e,problem:"must be a non-empty string or null",received:t});return}return t}s(c,"nullableString");async function G(n){const e=m(n),r=v(n,e),t=[],o=W(n.body,["payer","usd_per_month","funding","grantee","provider","sub"],t),i=o.payer;(typeof i!="string"||!/^(user|app):.+/.test(i))&&t.push({field:"payer",problem:"must be user:<id> or app:<id>",...i===void 0?{}:{received:i}});const a=o.usd_per_month;(typeof a!="number"||!Number.isFinite(a)||a<0)&&t.push({field:"usd_per_month",problem:"must be a number of at least 0",...a===void 0?{}:{received:a}});const d=c(o,"funding",t);typeof d=="string"&&!g.includes(d)&&t.push({field:"funding",problem:`must be one of ${g.join(", ")}`,received:d});const f=c(o,"grantee",t),y=c(o,"provider",t),h=c(o,"sub",t);t.length>0&&S("spend limit request",t);const u=o;if(e===void 0){if(u.payer.startsWith("user:")&&u.payer!==await $())throw new p(403,"owner_only","a person sets limits only on their own payer or on an app",{payer:u.payer})}else if(!(await b(e)).includes(u.payer))throw new p(403,"owner_only","a person sets limits only on their own payer or on an app they hold",{payer:u.payer});return await T({id:r,payer:u.payer,usd_per_month:u.usd_per_month,source:"person",...d===void 0?{}:{funding:d},...f===void 0?{}:{grantee:f},...y===void 0?{}:{provider:y},...h===void 0?{}:{sub:h}})}s(G,"setRoute");async function I(n){const e=m(n),r=await w();if(e===void 0)return{limits:r};const t=new Set(await b(e)),o=`${l}${e.slice(5)}/`;return{limits:r.filter(i=>i.id.startsWith(o)||i.payer!==null&&t.has(i.payer)||i.account===e)}}s(I,"listLimitsRoute");async function U(n){const e=v(n,m(n));if((await w({source:"person"})).find(t=>t.id===e)===void 0||!await R(e))throw new p(404,"not_found",`no person limit ${e}`);return{id:e,removed:!0}}s(U,"removeRoute");const H=[{method:"GET",pattern:"/v1/charges",handler:s(async n=>({status:200,body:await F(n)}),"handler")}],J=[{method:"GET",pattern:"/v1/spend-limits",handler:s(async n=>({status:200,body:await I(n)}),"handler")},{method:"PUT",pattern:"/v1/spend-limits/:id",handler:s(async n=>({status:200,body:await G(n)}),"handler")},{method:"DELETE",pattern:"/v1/spend-limits/:id",handler:s(async n=>({status:200,body:await U(n)}),"handler")}];export{H as chargeRoutes,J as spendLimitRoutes};

package/dist/daemon/api/handlers/plugin-app-token.js

@@ -1 +1 @@
-var h=Object.defineProperty;var o=(e,n)=>h(e,"name",{value:n,configurable:!0});import{ApiError as l}from"../../../api/errors.js";import{getNode as g}from"../../../core/canvas/canvas.js";import{formatCrtrCaller as y}from"../../../core/command-plugins/caller-header.js";import{isLoopbackHostname as w}from"../../../core/command-plugins/endpoint.js";import{crtrSignature as _}from"../../../core/command-plugins/transport/sign.js";import{directoryIssuer as k,ownMachineId as b}from"../../../core/peer/directory.js";import{pluginAppCredential as c}from"../../../core/plugin-app.js";import{findPluginByName as v}from"../../../core/resolver.js";import{isRecord as C}from"./validate.js";const m=/^[0-9a-f]{64}$/,p=o(e=>{throw new l(404,"not_found",`plugin "${e}" is not installed, enabled and valid`)},"notFound");function A(e){const{principal:n}=e;if(n.class==="broker"&&n.uid!==process.getuid?.())throw new l(403,"forbidden","this node may not read a plugin app token");const r=e.params.name,t=c(r);return t===null?p(r):{status:200,body:{token:t.token,socket:t.socket}}}o(A,"appToken");function R(e){const n=o(i=>{throw new l(400,"invalid_request",`invalid ${i}`)},"bad");if(!C(e))return n("call-headers request");const{method:r,url:t,body_sha256:s,header_names:d,headers_sha256:a}=e;return(typeof r!="string"||r==="")&&n("method"),typeof t!="string"&&n("url"),(typeof s!="string"||!m.test(s))&&n("body_sha256"),(!Array.isArray(d)||d.some(i=>typeof i!="string"))&&n("header_names"),(typeof a!="string"||!m.test(a))&&n("headers_sha256"),e}o(R,"parseRequest");async function E(e){if(e.class==="forwarded"){const r=e.actor.kind==="app"?e.actor:null;return{node:r?.node??void 0,run:r?.place.run,machine:e.via}}const n=e.class==="broker"?e.node:void 0;return{...n===void 0?{}:{node:n,run:e.class==="broker"?e.run??void 0:void 0,profile:(await g(n))?.profile_id??void 0},machine:k()!==null?b():void 0}}o(E,"callerFields");async function H(e,n,r){const t=v(e);if(t===null||!t.enabled||t.manifest.provider!==void 0)return p(e);const s=y(await E(n)),d={};s!==""&&(d["Crtr-Caller"]=s);const a=c(e);if(a!==null&&a.endpoint!==null){let i;try{i=new URL(r.url)}catch{throw new l(400,"invalid_request","invalid url")}const u=new URL(a.endpoint);if(i.origin===u.origin&&w(u.hostname))try{d["Crtr-Signature"]=_({token:a.token,method:r.method,url:i,body_sha256:r.body_sha256,caller:s,header_names:r.header_names,headers_sha256:r.headers_sha256,now:Date.now()})}catch(f){throw new l(400,"invalid_request",f instanceof Error?f.message:"invalid signed header list")}}return{headers:d}}o(H,"signCallHeaders");async function L(e){return{status:200,body:await H(e.params.name,e.principal,R(e.body))}}o(L,"callHeaders");const D=[{method:"GET",pattern:"/v1/plugins/:name/app-token",handler:A},{method:"POST",pattern:"/v1/plugins/:name/call-headers",handler:L}];export{D as pluginAppRoutes,H as signCallHeaders};
+var h=Object.defineProperty;var o=(e,n)=>h(e,"name",{value:n,configurable:!0});import{ApiError as l}from"../../../api/errors.js";import{getNode as g}from"../../../core/canvas/canvas.js";import{formatCrtrCaller as y}from"../../../core/command-plugins/caller-header.js";import{isLoopbackHostname as w}from"../../../core/command-plugins/endpoint.js";import{crtrSignature as _}from"../../../core/command-plugins/transport/sign.js";import{ownMachineId as k}from"../../../core/peer/directory.js";import{directoryIssuer as b}from"../../../core/directory/issuer.js";import{pluginAppCredential as m}from"../../../core/plugin-app.js";import{findPluginByName as v}from"../../../core/resolver.js";import{isRecord as C}from"./validate.js";const c=/^[0-9a-f]{64}$/,p=o(e=>{throw new l(404,"not_found",`plugin "${e}" is not installed, enabled and valid`)},"notFound");function A(e){const{principal:n}=e;if(n.class==="broker"&&n.uid!==process.getuid?.())throw new l(403,"forbidden","this node may not read a plugin app token");const r=e.params.name,t=m(r);return t===null?p(r):{status:200,body:{token:t.token,socket:t.socket}}}o(A,"appToken");function R(e){const n=o(i=>{throw new l(400,"invalid_request",`invalid ${i}`)},"bad");if(!C(e))return n("call-headers request");const{method:r,url:t,body_sha256:s,header_names:d,headers_sha256:a}=e;return(typeof r!="string"||r==="")&&n("method"),typeof t!="string"&&n("url"),(typeof s!="string"||!c.test(s))&&n("body_sha256"),(!Array.isArray(d)||d.some(i=>typeof i!="string"))&&n("header_names"),(typeof a!="string"||!c.test(a))&&n("headers_sha256"),e}o(R,"parseRequest");async function E(e){if(e.class==="forwarded"){const r=e.actor.kind==="app"?e.actor:null;return{node:r?.node??void 0,run:r?.place.run,machine:e.via}}const n=e.class==="broker"?e.node:void 0;return{...n===void 0?{}:{node:n,run:e.class==="broker"?e.run??void 0:void 0,profile:(await g(n))?.profile_id??void 0},machine:b()!==null?k():void 0}}o(E,"callerFields");async function H(e,n,r){const t=v(e);if(t===null||!t.enabled||t.manifest.provider!==void 0)return p(e);const s=y(await E(n)),d={};s!==""&&(d["Crtr-Caller"]=s);const a=m(e);if(a!==null&&a.endpoint!==null){let i;try{i=new URL(r.url)}catch{throw new l(400,"invalid_request","invalid url")}const u=new URL(a.endpoint);if(i.origin===u.origin&&w(u.hostname))try{d["Crtr-Signature"]=_({token:a.token,method:r.method,url:i,body_sha256:r.body_sha256,caller:s,header_names:r.header_names,headers_sha256:r.headers_sha256,now:Date.now()})}catch(f){throw new l(400,"invalid_request",f instanceof Error?f.message:"invalid signed header list")}}return{headers:d}}o(H,"signCallHeaders");async function L(e){return{status:200,body:await H(e.params.name,e.principal,R(e.body))}}o(L,"callHeaders");const G=[{method:"GET",pattern:"/v1/plugins/:name/app-token",handler:A},{method:"POST",pattern:"/v1/plugins/:name/call-headers",handler:L}];export{G as pluginAppRoutes,H as signCallHeaders};

package/dist/daemon/api/handlers/providers.js

@@ -1 +1 @@
-var R=Object.defineProperty;var i=(e,r)=>R(e,"name",{value:r,configurable:!0});import{randomUUID as I}from"node:crypto";import{readConfig as $}from"../../../core/config.js";import{activeGrantForApp as O,grantFor as q,localGrants as w}from"../../../core/grants/mirror.js";import{getNode as G}from"../../../core/canvas/canvas.js";import{scopeAllowed as N}from"../../../core/scopes.js";import{ProviderError as u,providerErrorBody as T,scopeMissing as F}from"../../../core/providers/errors.js";import{callProvider as x,providerTools as C}from"../../../core/providers/call.js";import{providerIdsFromGrants as j,providerInstallState as k}from"../../../core/providers/bundles.js";import{providerRootClaims as B,resolveProviderRef as D}from"../../../core/providers/roots.js";import{listInstalledPlugins as M}from"../../../core/resolver.js";import{listAudit as U,writeProviderAudit as z}from"../../../core/providers/audit.js";import{emitEvent as b}from"../../../core/events/emit.js";import{resolvedScopes as _}from"../router.js";const we=new Set(["provider.tools","provider.call","audit.list"]);async function L(e){if(e.class==="forwarded"){if(e.actor.kind==="person")return{class:"person",sub:null,grantee:null,client_id:null,resolved:null,nodeScopes:null,run_id:null,node_id:null,origin:{node:null,run:null,machine:e.via}};const r=await q(e.actor.app,e.sub);if(!r)throw new u("grant_revoked",`app ${e.actor.app} has no active grant`);return{class:"app",sub:e.sub,grantee:e.actor.app,client_id:null,resolved:r.resolved,nodeScopes:e.actor.node_scopes,run_id:null,node_id:null,origin:{node:e.actor.node,run:e.actor.place?.run??null,machine:e.via}}}if(e.class==="machine")throw new u("permission_error","this operation is not available to the caller");if(e.class==="person"&&e.sub!==void 0)throw new u("permission_error","provider calls are made by the install's person, a node or an app");if(e.class==="person")return{class:"person",sub:null,grantee:null,client_id:null,resolved:null,nodeScopes:null,run_id:null,node_id:null};if(e.class==="app"){const r=await O(e.app);if(!r)throw new u("grant_revoked",`app ${e.app} has no active grant`);return{class:"app",sub:r.sub,grantee:e.app,client_id:null,resolved:r.resolved,nodeScopes:e.scopes,run_id:null,node_id:null}}return e.class==="cron"?{class:"app",sub:e.sub,grantee:e.app,client_id:null,resolved:await _(e),nodeScopes:e.scopes,run_id:e.origin_run,node_id:null}:{class:"broker",sub:e.sub,grantee:e.app,client_id:e.client_id,resolved:await _(e),nodeScopes:e.scopes,run_id:e.run??(await G(e.node))?.run_id??null,node_id:e.node}}i(L,"callerFromRequest");function be(e){return{class:"app",sub:e.sub,grantee:e.grantee,client_id:e.client_id,resolved:e.resolved,nodeScopes:null,run_id:null,node_id:null}}i(be,"callerFromApp");const V=/^([A-Za-z0-9_-]{1,64}):([A-Za-z0-9_-]{1,64})$/;function Z(e){const r=V.exec(e);return r!==null&&r[1]!=="crtr"}i(Z,"isProviderScope");const g=new WeakMap;function W(e){let r=g.get(e);return r===void 0&&(r=new Set(e),g.set(e,r)),r}i(W,"heldSet");function y(e,r){return e===null?!0:Z(r)?W(e).has(r):N(e,r)}i(y,"holds");function S(e,r){return e.class==="person"?!0:y(e.resolved??[],r)&&y(e.nodeScopes,r)}i(S,"callerAllows");function _e(e,r,t){const o=`${r}:${t}`;if(!S(e,o))throw F(o)}i(_e,"requireGroup");function J(){return!!$("user").runtime?.issuer}i(J,"providerOperationsEnabled");const X=/^[A-Za-z0-9_-]{1,64}$/;function m(e,r){return new u("invalid_request",e,{param:r})}i(m,"invalid");function A(e){if(typeof e!="string"||!X.test(e)||e==="crtr")throw m("provider must be a provider id","provider");return e}i(A,"parseProvider");function H(e){if(!e||typeof e!="object"||Array.isArray(e))throw new u("invalid_request","a JSON object is required");const r=e,t=A(r.provider),o=r.tool;if(typeof o!="string"||!o.trim())throw m("tool must be a non-empty string","tool");const a=r.arguments??{};if(!a||typeof a!="object"||Array.isArray(a))throw m("arguments must be an object","arguments");const d=r.version;if(d!==void 0&&(typeof d!="number"||!Number.isInteger(d)||d<1))throw m("version must be an integer >= 1","version");const n=r.approval;if(n!==void 0&&(typeof n!="string"||!n))throw m("approval must be a question id","approval");const l=r.machine;if(l!==void 0&&(typeof l!="string"||!l.trim()))throw m("machine must be a machine id","machine");return{provider:t,tool:o.trim(),arguments:a,...d===void 0?{}:{version:d},...n===void 0?{}:{approval:n},...l===void 0?{}:{machine:l.trim()}}}i(H,"parseCallInput");async function K(e,r=new URLSearchParams){const t=i((n,l,p)=>{const f=r.get(n);if(f===null)return l;if(!/^\d+$/.test(f)||Number(f)>p||Number(f)<1)throw m(`invalid ${n}`,n);return Number(f)},"numeric"),o=r.has("after")?t("after",0,Number.MAX_SAFE_INTEGER):void 0,a=t("limit",100,1e3),d=Object.fromEntries(["operation","outcome","run_id","since","until"].filter(n=>r.has(n)).map(n=>[n,r.get(n)]));return{status:200,body:await U(e.class==="person"?null:e.grantee,{after:o,limit:a,...d})}}i(K,"auditList");async function Q(e,r,t){let o=r;const a=performance.now(),d=M("user"),{skipped:n}=B(d),l=new Set(d.filter(s=>s.enabled&&s.manifest.provider?.id===s.name&&!n.has(s.name)).map(s=>s.name)),p=j(await w()).filter(s=>!n.has(s)),f=[...new Set([...l,...p])].sort();if(o!==void 0){const s=D(o);if(s===null)throw new u("not_found",`provider "${o}" is not available`);o=s}if(o!==void 0&&!f.includes(o))throw new u("not_found",`provider "${o}" is not available`);const E=o===void 0?f:[o],P=e.class==="person"?(await w()).flatMap(s=>s.status==="active"?s.resolved_scopes.map(({scope:c})=>c):[]):e.resolved??[],v=await Promise.all(E.map(async s=>{if(l.has(s))return C(e,s);if(!P.some(h=>h.startsWith(`${s}:`)&&S(e,h)))return null;const c=k(s);return{provider:s,display_name:s,status:c.status,...c.error?{error:c.error}:{},groups:[],commands:[]}})).then(s=>s.filter(c=>c!==null));if(b({level:"debug",event:"api.provider.tools",duration_ms:performance.now()-a,fields:{caller:e.class,provider:o??null,providers:v.length}}),o!==void 0){if(v.length===0)throw new u("not_found",`provider "${o}" is not available`);return{status:200,body:v[0]}}return{status:200,body:{providers:v}}}i(Q,"providerTools");async function Y(e,r,t){return x(e,r,t)}i(Y,"providerCall");async function ee(e,r,t,o){if(!J())throw new u("not_found","provider operations need a directory-connected runtime");if(e==="audit.list")return await K(r,t.query);if(e==="provider.tools")return Q(r,t.params.provider===void 0?void 0:A(t.params.provider),o);if(e==="provider.call"){let a;try{a=H(t.body)}catch(d){const n=t.body&&typeof t.body=="object"&&!Array.isArray(t.body)?t.body:{};throw await z({request_id:o.requestId,caller:r,provider:typeof n.provider=="string"?n.provider:"",tool:typeof n.tool=="string"?n.tool:"",outcome:`refused:${d instanceof u?d.code:"invalid_request"}`}),d}return Y(r,a,o)}throw new u("not_found","unknown operation")}i(ee,"handleProviderOperation");function re(e){const r=new AbortController,t=i(()=>{e.writableFinished||r.abort()},"abort");return e.on("close",t),{signal:r.signal,release:i(()=>e.off("close",t),"release")}}i(re,"abortOnClose");function oe(e,r,t,o){const a=T(e,r,t,o??void 0);return a.status>=500&&!(e instanceof u)&&b({event:"api.provider.failed",level:"error",error:e instanceof Error?e:new Error(String(e)),fields:{request_id:r}}),a}i(oe,"providerFailure");const ge=[{method:"GET",pattern:"/v1/audit",name:"audit.list"},{method:"GET",pattern:"/v1/providers/tools",name:"provider.tools"},{method:"GET",pattern:"/v1/providers/:provider/tools",name:"provider.tools"},{method:"POST",pattern:"/v1/provider/call",name:"provider.call"}].map(({method:e,pattern:r,name:t})=>({method:e,pattern:r,handler:i(async o=>{const a=I(),{signal:d,release:n}=re(o.res);let l=null;try{return l=await L(o.principal),{...await ee(t,l,{params:o.params,body:o.body,query:new URL(o.req.url??"/","http://runtime.local").searchParams},{requestId:a,signal:d,...o.causedBy===void 0?{}:{causedBy:o.causedBy}}),headers:{"Request-Id":a}}}catch(p){return oe(p,a,!1,l?.run_id)}finally{n()}},"handler")}));export{we as PROVIDER_OPERATIONS,re as abortOnClose,S as callerAllows,be as callerFromApp,L as callerFromRequest,ee as handleProviderOperation,H as parseCallInput,A as parseProvider,oe as providerFailure,J as providerOperationsEnabled,ge as providerRoutes,_e as requireGroup};
+var I=Object.defineProperty;var s=(e,r)=>I(e,"name",{value:r,configurable:!0});import{randomUUID as R}from"node:crypto";import{cloudPersonScope as $}from"../../../core/runs/operations.js";import{directoryIssuer as O}from"../../../core/directory/issuer.js";import{activeGrantForApp as q,grantFor as G,localGrants as _}from"../../../core/grants/mirror.js";import{getNode as N}from"../../../core/canvas/canvas.js";import{scopeAllowed as T}from"../../../core/scopes.js";import{ProviderError as f,providerErrorBody as F,scopeMissing as x}from"../../../core/providers/errors.js";import{callProvider as j,providerTools as k}from"../../../core/providers/call.js";import{providerIdsFromGrants as C,providerInstallState as B}from"../../../core/providers/bundles.js";import{providerRootClaims as D,resolveProviderRef as M}from"../../../core/providers/roots.js";import{listInstalledPlugins as U}from"../../../core/resolver.js";import{listAudit as z,writeProviderAudit as L}from"../../../core/providers/audit.js";import{emitEvent as g}from"../../../core/events/emit.js";import{resolvedScopes as y}from"../router.js";const _e=new Set(["provider.tools","provider.call","audit.list"]);async function V(e){if(e.class==="forwarded"){if(e.actor.kind==="person")return{class:"person",sub:null,grantee:null,client_id:null,resolved:null,nodeScopes:null,run_id:null,node_id:null,origin:{node:null,run:null,machine:e.via}};const r=await G(e.actor.app,e.sub);if(!r)throw new f("grant_revoked",`app ${e.actor.app} has no active grant`);return{class:"app",sub:e.sub,grantee:e.actor.app,client_id:null,resolved:r.resolved,nodeScopes:e.actor.node_scopes,run_id:null,node_id:null,origin:{node:e.actor.node,run:e.actor.place?.run??null,machine:e.via}}}if(e.class==="machine")throw new f("permission_error","this operation is not available to the caller");if(e.class==="person"&&e.sub!==void 0)throw new f("permission_error","provider calls are made by the install's person, a node or an app");if(e.class==="person")return{class:"person",sub:null,grantee:null,client_id:null,resolved:null,nodeScopes:null,run_id:null,node_id:null};if(e.class==="app"){const r=await q(e.app);if(!r)throw new f("grant_revoked",`app ${e.app} has no active grant`);return{class:"app",sub:r.sub,grantee:e.app,client_id:null,resolved:r.resolved,nodeScopes:e.scopes,run_id:null,node_id:null}}return e.class==="cron"?{class:"app",sub:e.sub,grantee:e.app,client_id:null,resolved:await y(e),nodeScopes:e.scopes,run_id:e.origin_run,node_id:null}:{class:"broker",sub:e.sub,grantee:e.app,client_id:e.client_id,resolved:await y(e),nodeScopes:e.scopes,run_id:e.run??(await N(e.node))?.run_id??null,node_id:e.node}}s(V,"callerFromRequest");function ge(e){return{class:"app",sub:e.sub,grantee:e.grantee,client_id:e.client_id,resolved:e.resolved,nodeScopes:null,run_id:null,node_id:null}}s(ge,"callerFromApp");const Z=/^([A-Za-z0-9_-]{1,64}):([A-Za-z0-9_-]{1,64})$/;function W(e){const r=Z.exec(e);return r!==null&&r[1]!=="crtr"}s(W,"isProviderScope");const S=new WeakMap;function J(e){let r=S.get(e);return r===void 0&&(r=new Set(e),S.set(e,r)),r}s(J,"heldSet");function A(e,r){return e===null?!0:W(r)?J(e).has(r):T(e,r)}s(A,"holds");function P(e,r){return e.class==="person"?!0:A(e.resolved??[],r)&&A(e.nodeScopes,r)}s(P,"callerAllows");function ye(e,r,t){const o=`${r}:${t}`;if(!P(e,o))throw x(o)}s(ye,"requireGroup");function X(){return!!O()}s(X,"providerOperationsEnabled");const H=/^[A-Za-z0-9_-]{1,64}$/;function m(e,r){return new f("invalid_request",e,{param:r})}s(m,"invalid");function E(e){if(typeof e!="string"||!H.test(e)||e==="crtr")throw m("provider must be a provider id","provider");return e}s(E,"parseProvider");function K(e){if(!e||typeof e!="object"||Array.isArray(e))throw new f("invalid_request","a JSON object is required");const r=e,t=E(r.provider),o=r.tool;if(typeof o!="string"||!o.trim())throw m("tool must be a non-empty string","tool");const i=r.arguments??{};if(!i||typeof i!="object"||Array.isArray(i))throw m("arguments must be an object","arguments");const d=r.version;if(d!==void 0&&(typeof d!="number"||!Number.isInteger(d)||d<1))throw m("version must be an integer >= 1","version");const a=r.approval;if(a!==void 0&&(typeof a!="string"||!a))throw m("approval must be a question id","approval");const l=r.machine;if(l!==void 0&&(typeof l!="string"||!l.trim()))throw m("machine must be a machine id","machine");return{provider:t,tool:o.trim(),arguments:i,...d===void 0?{}:{version:d},...a===void 0?{}:{approval:a},...l===void 0?{}:{machine:l.trim()}}}s(K,"parseCallInput");async function Q(e,r=new URLSearchParams){const t=s((u,v,w)=>{const c=r.get(u);if(c===null)return v;if(!/^\d+$/.test(c)||Number(c)>w||Number(c)<1)throw m(`invalid ${u}`,u);return Number(c)},"numeric"),o=r.has("after")?t("after",0,Number.MAX_SAFE_INTEGER):void 0,i=t("limit",100,1e3),d=Object.fromEntries(["operation","outcome","run_id","since","until"].filter(u=>r.has(u)).map(u=>[u,r.get(u)])),a=$(e.sub),l=a===void 0?{}:{sub:a};return{status:200,body:await z(e.class==="person"?null:e.grantee,{after:o,limit:i,...l,...d})}}s(Q,"auditList");async function Y(e,r,t){let o=r;const i=performance.now(),d=U("user"),{skipped:a}=D(d),l=new Set(d.filter(n=>n.enabled&&n.manifest.provider?.id===n.name&&!a.has(n.name)).map(n=>n.name)),u=C(await _()).filter(n=>!a.has(n)),v=[...new Set([...l,...u])].sort();if(o!==void 0){const n=M(o);if(n===null)throw new f("not_found",`provider "${o}" is not available`);o=n}if(o!==void 0&&!v.includes(o))throw new f("not_found",`provider "${o}" is not available`);const w=o===void 0?v:[o],c=e.class==="person"?(await _()).flatMap(n=>n.status==="active"?n.resolved_scopes.map(({scope:p})=>p):[]):e.resolved??[],h=await Promise.all(w.map(async n=>{if(l.has(n))return k(e,n);if(!c.some(b=>b.startsWith(`${n}:`)&&P(e,b)))return null;const p=B(n);return{provider:n,display_name:n,status:p.status,...p.error?{error:p.error}:{},groups:[],commands:[]}})).then(n=>n.filter(p=>p!==null));if(g({level:"debug",event:"api.provider.tools",duration_ms:performance.now()-i,fields:{caller:e.class,provider:o??null,providers:h.length}}),o!==void 0){if(h.length===0)throw new f("not_found",`provider "${o}" is not available`);return{status:200,body:h[0]}}return{status:200,body:{providers:h}}}s(Y,"providerTools");async function ee(e,r,t){return j(e,r,t)}s(ee,"providerCall");async function re(e,r,t,o){if(!X())throw new f("not_found","provider operations need a directory-connected runtime");if(e==="audit.list")return await Q(r,t.query);if(e==="provider.tools")return Y(r,t.params.provider===void 0?void 0:E(t.params.provider),o);if(e==="provider.call"){let i;try{i=K(t.body)}catch(d){const a=t.body&&typeof t.body=="object"&&!Array.isArray(t.body)?t.body:{};throw await L({request_id:o.requestId,caller:r,provider:typeof a.provider=="string"?a.provider:"",tool:typeof a.tool=="string"?a.tool:"",outcome:`refused:${d instanceof f?d.code:"invalid_request"}`}),d}return ee(r,i,o)}throw new f("not_found","unknown operation")}s(re,"handleProviderOperation");function oe(e){const r=new AbortController,t=s(()=>{e.writableFinished||r.abort()},"abort");return e.on("close",t),{signal:r.signal,release:s(()=>e.off("close",t),"release")}}s(oe,"abortOnClose");function te(e,r,t,o){const i=F(e,r,t,o??void 0);return i.status>=500&&!(e instanceof f)&&g({event:"api.provider.failed",level:"error",error:e instanceof Error?e:new Error(String(e)),fields:{request_id:r}}),i}s(te,"providerFailure");const Se=[{method:"GET",pattern:"/v1/audit",name:"audit.list"},{method:"GET",pattern:"/v1/providers/tools",name:"provider.tools"},{method:"GET",pattern:"/v1/providers/:provider/tools",name:"provider.tools"},{method:"POST",pattern:"/v1/provider/call",name:"provider.call"}].map(({method:e,pattern:r,name:t})=>({method:e,pattern:r,handler:s(async o=>{const i=R(),{signal:d,release:a}=oe(o.res);let l=null;try{return l=await V(o.principal),{...await re(t,l,{params:o.params,body:o.body,query:new URL(o.req.url??"/","http://runtime.local").searchParams},{requestId:i,signal:d,...o.causedBy===void 0?{}:{causedBy:o.causedBy}}),headers:{"Request-Id":i}}}catch(u){return te(u,i,!1,l?.run_id)}finally{a()}},"handler")}));export{_e as PROVIDER_OPERATIONS,oe as abortOnClose,P as callerAllows,ge as callerFromApp,V as callerFromRequest,re as handleProviderOperation,K as parseCallInput,E as parseProvider,te as providerFailure,X as providerOperationsEnabled,Se as providerRoutes,ye as requireGroup};

package/dist/daemon/api/handlers/runs.js

@@ -1 +1 @@
-var S=Object.defineProperty;var c=(r,t)=>S(r,"name",{value:t,configurable:!0});import{callerGrant as g}from"../principal.js";import{grantVersion as b,payerOfGrant as O}from"../../../core/grants/mirror.js";import{holdGrant as $}from"../../../core/grants/watch.js";import{RunError as n,idempotencyKeyOf as v,cancelRun as N,deleteRun as A,interruptRun as j,listRuns as x,messageRun as B,renameRun as J,requestedScopes as z,startRun as D,traceRun as E,waitRun as G}from"../../../core/runs/operations.js";import{canReadRun as y,requireRun as f,runCallerApp as K}from"../router.js";import{waitSeconds as q}from"../long-poll-wait.js";import{outputSchemaProblem as M}from"../../../core/runtime/structured-output.js";function m(r){if(!r||typeof r!="object"||Array.isArray(r))throw new n(400,"invalid_request","a JSON object is required");return r}c(m,"object");function k(r,t,o,u,l){if(r===null)return l;if(!/^(0|[1-9]\d*)$/.test(r)||!Number.isSafeInteger(Number(r))||Number(r)<o||Number(r)>u)throw new n(400,"invalid_request",`invalid ${t}`,t);return Number(r)}c(k,"integer");const T=256*1024;async function X(r,t,o,u,l,_,h){switch(r.name){case"grant.get":{if("class"in t)throw new n(403,"permission_error","an app token is required");const e=q("grant.get",u),s=u.get("since");if(s!==null&&!/^[A-Za-z0-9_-]{1,64}$/.test(s))throw new n(400,"invalid_request","invalid since","since");const i=e&&s!==null?$(t.grant):void 0;let d;try{if(d=await g(t),i){const w=Date.now()+e*1e3;for(;b(d)===s&&Date.now()<w;)await i.changed(Math.max(0,(w-Date.now())/1e3)),d=await g(t)}}finally{i?.release()}return{status:200,body:{sub:t.sub,grantee:t.grantee,client_id:t.client_id,grant:t.grant,rev:d.rev,resolved_scopes:d.resolved_scopes,spend_cap:d.spend_cap,exp:t.exp,payer:await O(t.grant),dependencies:d.dependencies??{},version:b(d)}}}case"run.start":{if("class"in t)throw new n(403,"permission_error","an app token is required");const e=m(l),s=["mode","parent","fork_from","node_id","env","tools","system_prompt"];for(const a of s)if(e[a]!==void 0)throw new n(403,"owner_only",`${a} is owner-only`,a);const i=["payer","model_policy","kind"];for(const a of i)if(e[a]!==void 0)throw new n(400,"invalid_request",`${a} is not available`,a);for(const a of Object.keys(e))if(!["prompt","scopes","metadata","profile","isolated","cwd","worktree","output_schema","message","model","deadline"].includes(a))throw new n(400,"invalid_request",`unknown field ${a}`,a);if(e.model!==void 0&&(typeof e.model!="string"||!e.model.trim()))throw new n(400,"invalid_request","model must be a non-empty string","model");if(e.deadline!==void 0&&(typeof e.deadline!="string"||!e.deadline.trim()))throw new n(400,"invalid_request","deadline must be a duration string such as 10m","deadline");if(e.profile!==void 0&&(typeof e.profile!="string"||!e.profile))throw new n(400,"invalid_request","profile must be a profile id","profile");if(e.isolated!==void 0&&typeof e.isolated!="boolean")throw new n(400,"invalid_request","isolated must be a boolean","isolated");if(e.cwd!==void 0&&(e.isolated!==!0||typeof e.cwd!="string"||!e.cwd))throw new n(400,"invalid_request","cwd is available only for an isolated run and must be an absolute path inside its root folder","cwd");if(e.worktree!==void 0&&e.isolated!==!0)throw new n(400,"invalid_request","worktree is not available","worktree");if(e.isolated===!0&&e.worktree!==void 0)throw new n(400,"invalid_request","worktree is unavailable for an isolated run","worktree");if(typeof e.prompt!="string"||!e.prompt.trim())throw new n(400,"invalid_request","prompt is required","prompt");if(e.message!==void 0&&(typeof e.message!="string"||!e.message.trim()))throw new n(400,"invalid_request","message must be a non-empty string","message");const d=e.metadata===void 0?{}:m(e.metadata);if(Buffer.byteLength(JSON.stringify(d))>4096)throw new n(400,"invalid_request","metadata exceeds 4 KB","metadata");let w;if(e.output_schema!==void 0){const a=e.output_schema;if(!a||typeof a!="object"||Array.isArray(a))throw new n(400,"invalid_request","output_schema must be a JSON Schema object","output_schema");if(Buffer.byteLength(JSON.stringify(a))>T)throw new n(400,"invalid_request","output_schema exceeds 256 KB","output_schema");const p=await M(a);if(p!==null)throw new n(400,"invalid_request",`output_schema is not usable: ${p}`,"output_schema");w=a}const R=z(t.resolved,e.scopes,t.grantee);return{status:201,body:await D(t,{prompt:e.prompt,scopes:R,metadata:d,profile:e.profile,isolated:e.isolated,cwd:e.cwd,...e.model===void 0?{}:{model:e.model},...e.deadline===void 0?{}:{deadline:e.deadline},...w===void 0?{}:{output_schema:w},...e.message===void 0?{}:{message:e.message},...h===void 0?{}:{causedBy:h}},v(_))}}case"run.list":{const e=u.get("status")??void 0;if(e&&!["running","waiting_on_user","idle","settled"].includes(e))throw new n(400,"invalid_request","invalid status","status");const s=u.get("app");if(s!==null&&!/^(?:app:)?[a-z0-9][a-z0-9-]*$/.test(s))throw new n(400,"invalid_request","invalid app","app");const i=s===null?K(t):s.startsWith("app:")?s:`app:${s}`;if(i!==null&&!await y(t,i))throw new n(404,"not_found","run not found");return{status:200,body:await x(i,{status:e,after:u.get("after")??void 0,limit:k(u.get("limit"),"limit",1,100,50),..."class"in t&&(t.class==="broker"||t.class==="cron")&&i!==null?{visible:c(async d=>await y(t,i,d),"visible")}:{}})}}case"run.get":{const e=q("run.get",u),s=await f(t,o),i=await G(o,s.grantee,e);return await f(t,o),{status:200,body:i}}case"run.message":{const e=m(l);if(typeof e.message!="string"||!e.message.trim())throw new n(400,"invalid_request","message is required","message");if(e.start_turn!==void 0&&typeof e.start_turn!="boolean")throw new n(400,"invalid_request","start_turn must be a boolean","start_turn");return{status:202,body:await B(await f(t,o,!0),e.message,void 0,e.start_turn,v(_))}}case"run.interrupt":{const e=m(l===void 0?{}:l);if(e.children!==void 0&&e.children!=="stop"&&e.children!=="continue")throw new n(400,"invalid_request","invalid children","children");return{status:200,body:await j(await f(t,o,!0),e.children)}}case"run.cancel":{const e=m(l===void 0?{}:l);if(e.keep_schedules!==void 0&&typeof e.keep_schedules!="boolean")throw new n(400,"invalid_request","invalid keep_schedules","keep_schedules");return{status:200,body:await N(await f(t,o,!0),{keepSchedules:e.keep_schedules})}}case"run.rename":{const e=m(l);for(const s of Object.keys(e))if(s!=="name")throw new n(400,"invalid_request",`unknown field ${s}`,s);return{status:200,body:await J(await f(t,o,!0),e.name)}}case"run.delete":{const{uploads_pending:e}=await A(await f(t,o,!0,!0));return{status:200,body:{run_id:o,uploads_pending:e}}}case"trace.get":{const e=u.get("format")??void 0;if(e&&e!=="entries")throw new n(400,"invalid_request","unknown trace format","format");const s=await f(t,o);return{status:200,body:await E(o,s.grantee,e)}}default:throw new n(404,"not_found","unknown operation")}}c(X,"handleRunOperation");export{X as handleRunOperation,k as integer};
+var S=Object.defineProperty;var c=(a,t)=>S(a,"name",{value:t,configurable:!0});import{callerGrant as g}from"../principal.js";import{grantVersion as b,payerOfGrant as O}from"../../../core/grants/mirror.js";import{holdGrant as $}from"../../../core/grants/watch.js";import{RunError as n,idempotencyKeyOf as v,cancelRun as N,cloudPersonScope as A,deleteRun as j,interruptRun as x,listRuns as B,messageRun as J,renameRun as z,requestedScopes as D,startRun as E,traceRun as G,waitRun as K}from"../../../core/runs/operations.js";import{canReadRun as y,requireRun as w,runCallerApp as M}from"../router.js";import{waitSeconds as q}from"../long-poll-wait.js";import{outputSchemaProblem as P}from"../../../core/runtime/structured-output.js";function m(a){if(!a||typeof a!="object"||Array.isArray(a))throw new n(400,"invalid_request","a JSON object is required");return a}c(m,"object");function k(a,t,i,u,l){if(a===null)return l;if(!/^(0|[1-9]\d*)$/.test(a)||!Number.isSafeInteger(Number(a))||Number(a)<i||Number(a)>u)throw new n(400,"invalid_request",`invalid ${t}`,t);return Number(a)}c(k,"integer");const T=256*1024;async function Y(a,t,i,u,l,_,h){switch(a.name){case"grant.get":{if("class"in t)throw new n(403,"permission_error","an app token is required");const e=q("grant.get",u),s=u.get("since");if(s!==null&&!/^[A-Za-z0-9_-]{1,64}$/.test(s))throw new n(400,"invalid_request","invalid since","since");const d=e&&s!==null?$(t.grant):void 0;let o;try{if(o=await g(t),d){const f=Date.now()+e*1e3;for(;b(o)===s&&Date.now()<f;)await d.changed(Math.max(0,(f-Date.now())/1e3)),o=await g(t)}}finally{d?.release()}return{status:200,body:{sub:t.sub,grantee:t.grantee,client_id:t.client_id,grant:t.grant,rev:o.rev,resolved_scopes:o.resolved_scopes,spend_cap:o.spend_cap,exp:t.exp,payer:await O(t.grant),dependencies:o.dependencies??{},version:b(o)}}}case"run.start":{if("class"in t)throw new n(403,"permission_error","an app token is required");const e=m(l),s=["mode","parent","fork_from","node_id","env","tools","system_prompt"];for(const r of s)if(e[r]!==void 0)throw new n(403,"owner_only",`${r} is owner-only`,r);const d=["payer","model_policy","kind"];for(const r of d)if(e[r]!==void 0)throw new n(400,"invalid_request",`${r} is not available`,r);for(const r of Object.keys(e))if(!["prompt","scopes","metadata","profile","isolated","cwd","worktree","output_schema","message","model","deadline"].includes(r))throw new n(400,"invalid_request",`unknown field ${r}`,r);if(e.model!==void 0&&(typeof e.model!="string"||!e.model.trim()))throw new n(400,"invalid_request","model must be a non-empty string","model");if(e.deadline!==void 0&&(typeof e.deadline!="string"||!e.deadline.trim()))throw new n(400,"invalid_request","deadline must be a duration string such as 10m","deadline");if(e.profile!==void 0&&(typeof e.profile!="string"||!e.profile))throw new n(400,"invalid_request","profile must be a profile id","profile");if(e.isolated!==void 0&&typeof e.isolated!="boolean")throw new n(400,"invalid_request","isolated must be a boolean","isolated");if(e.cwd!==void 0&&(e.isolated!==!0||typeof e.cwd!="string"||!e.cwd))throw new n(400,"invalid_request","cwd is available only for an isolated run and must be an absolute path inside its root folder","cwd");if(e.worktree!==void 0&&e.isolated!==!0)throw new n(400,"invalid_request","worktree is not available","worktree");if(e.isolated===!0&&e.worktree!==void 0)throw new n(400,"invalid_request","worktree is unavailable for an isolated run","worktree");if(typeof e.prompt!="string"||!e.prompt.trim())throw new n(400,"invalid_request","prompt is required","prompt");if(e.message!==void 0&&(typeof e.message!="string"||!e.message.trim()))throw new n(400,"invalid_request","message must be a non-empty string","message");const o=e.metadata===void 0?{}:m(e.metadata);if(Buffer.byteLength(JSON.stringify(o))>4096)throw new n(400,"invalid_request","metadata exceeds 4 KB","metadata");let f;if(e.output_schema!==void 0){const r=e.output_schema;if(!r||typeof r!="object"||Array.isArray(r))throw new n(400,"invalid_request","output_schema must be a JSON Schema object","output_schema");if(Buffer.byteLength(JSON.stringify(r))>T)throw new n(400,"invalid_request","output_schema exceeds 256 KB","output_schema");const p=await P(r);if(p!==null)throw new n(400,"invalid_request",`output_schema is not usable: ${p}`,"output_schema");f=r}const R=D(t.resolved,e.scopes,t.grantee);return{status:201,body:await E(t,{prompt:e.prompt,scopes:R,metadata:o,profile:e.profile,isolated:e.isolated,cwd:e.cwd,...e.model===void 0?{}:{model:e.model},...e.deadline===void 0?{}:{deadline:e.deadline},...f===void 0?{}:{output_schema:f},...e.message===void 0?{}:{message:e.message},...h===void 0?{}:{causedBy:h}},v(_))}}case"run.list":{const e=u.get("status")??void 0;if(e&&!["running","waiting_on_user","idle","settled"].includes(e))throw new n(400,"invalid_request","invalid status","status");const s=u.get("app");if(s!==null&&!/^(?:app:)?[a-z0-9][a-z0-9-]*$/.test(s))throw new n(400,"invalid_request","invalid app","app");const d=s===null?M(t):s.startsWith("app:")?s:`app:${s}`;if(d!==null&&!await y(t,d))throw new n(404,"not_found","run not found");const o=A(t.sub);return{status:200,body:await B(d,{status:e,...o===void 0?{}:{sub:o},after:u.get("after")??void 0,limit:k(u.get("limit"),"limit",1,100,50),..."class"in t&&(t.class==="broker"||t.class==="cron")&&d!==null?{visible:c(async f=>await y(t,d,f),"visible")}:{}})}}case"run.get":{const e=q("run.get",u),s=await w(t,i),d=await K(i,s.grantee,e);return await w(t,i),{status:200,body:d}}case"run.message":{const e=m(l);if(typeof e.message!="string"||!e.message.trim())throw new n(400,"invalid_request","message is required","message");if(e.start_turn!==void 0&&typeof e.start_turn!="boolean")throw new n(400,"invalid_request","start_turn must be a boolean","start_turn");return{status:202,body:await J(await w(t,i,!0),e.message,void 0,e.start_turn,v(_))}}case"run.interrupt":{const e=m(l===void 0?{}:l);if(e.children!==void 0&&e.children!=="stop"&&e.children!=="continue")throw new n(400,"invalid_request","invalid children","children");return{status:200,body:await x(await w(t,i,!0),e.children)}}case"run.cancel":{const e=m(l===void 0?{}:l);if(e.keep_schedules!==void 0&&typeof e.keep_schedules!="boolean")throw new n(400,"invalid_request","invalid keep_schedules","keep_schedules");return{status:200,body:await N(await w(t,i,!0),{keepSchedules:e.keep_schedules})}}case"run.rename":{const e=m(l);for(const s of Object.keys(e))if(s!=="name")throw new n(400,"invalid_request",`unknown field ${s}`,s);return{status:200,body:await z(await w(t,i,!0),e.name)}}case"run.delete":{const{uploads_pending:e}=await j(await w(t,i,!0,!0));return{status:200,body:{run_id:i,uploads_pending:e}}}case"trace.get":{const e=u.get("format")??void 0;if(e&&e!=="entries")throw new n(400,"invalid_request","unknown trace format","format");const s=await w(t,i);return{status:200,body:await G(i,s.grantee,e)}}default:throw new n(404,"not_found","unknown operation")}}c(Y,"handleRunOperation");export{Y as handleRunOperation,k as integer};

package/dist/daemon/api/handlers/transfer.js

@@ -1 +1 @@
-var w=Object.defineProperty;var s=(e,a)=>w(e,"name",{value:a,configurable:!0});import{isAbsolute as h,resolve as _}from"node:path";import{RunError as n}from"../../../core/runs/operations.js";import{invalidStorageName as m,storageClient as l,StorageRefused as y,UPLOAD_MAX_BYTES as g}from"../../../core/storage/client.js";import{serveDownload as b}from"../../../core/storage/download.js";import{createShare as q,deleteOwnShare as v,listOwnShares as A}from"../../../core/storage/shares.js";import{getUpload as S,insertUpload as k,uploadUseAt as x}from"../../../core/storage/tables.js";import{requireRun as z}from"../router.js";const C=new Set(["upload.create","attachment.link","file.download","share.create","share.list","share.delete"]);function c(e){if(!e||typeof e!="object"||Array.isArray(e))throw new n(400,"invalid_request","a JSON object is required");return e}s(c,"object");function f(e){return{app:e.grantee,resolved:e.resolved,launched:null}}s(f,"fileCaller");const O=/^[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]{0,126}\/[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]{0,126}(?:\s*;.{0,200})?$/;async function T(e,a){const i=c(a);for(const p of Object.keys(i))if(!["name","media_type","size"].includes(p))throw new n(400,"invalid_request",`unknown field ${p}`,p);const{name:r,media_type:o,size:t}=i;if(typeof t!="number"||!Number.isSafeInteger(t)||t<0)throw new n(400,"invalid_request","size must be a non-negative integer","size");if(t>g)throw new n(400,"invalid_request","size exceeds 100 MiB","size");if(typeof r!="string")throw new n(400,"invalid_request","name is required","name");const d=m(r);if(d)throw new n(400,"invalid_request",d,"name");if(typeof o!="string"||!O.test(o))throw new n(400,"invalid_request","media_type must be a media type","media_type");const u=await l().createUpload({name:r,media_type:o,size:t});return await k({upload_id:u.upload_id,grantee:e.grantee,name:r,media_type:o,size:t,created_at:new Date().toISOString()}),{upload_id:u.upload_id,url:u.url,upload_link:u.upload_link,expires_at:u.expires_at}}s(T,"uploadCreate");async function D(e,a){if(!a)throw new n(400,"invalid_request","path is required","path");if(!h(a))throw new n(400,"invalid_request","path must be absolute","path");const i=await x(_(a)),r=s(()=>new n(404,"not_found","no upload is recorded at that path"),"missing");if(!i)throw r();try{await z(e,i.run_id)}catch(t){throw t instanceof n&&t.code==="not_found"?r():t}const o=await S(i.upload_id);if(!o||o.delete_pending_since)throw r();try{return await l().signDownload(i.upload_id)}catch(t){throw t instanceof y?r():t}}s(D,"attachmentLink");async function M(e,a,i,r,o){switch(e.name){case"upload.create":return{status:201,body:await T(a,o)};case"attachment.link":return{status:200,body:await D(a,r.get("path"))};case"share.create":{const t=c(o);for(const d of Object.keys(t))if(!["path","expires_at"].includes(d))throw new n(400,"invalid_request",`unknown field ${d}`,d);return{status:201,body:await q(f(a),{path:t.path,expires_at:t.expires_at})}}case"share.list":return{status:200,body:await A(a.grantee)};case"share.delete":return{status:200,body:await v(a.grantee,i.share_id)};default:throw new n(404,"not_found","unknown operation")}}s(M,"handleTransferOperation");function P(e,a,i,r){return b(e,a,f(i),r.get("path"))}s(P,"handleTransferDownload");export{C as TRANSFER_OPERATIONS,f as fileCaller,P as handleTransferDownload,M as handleTransferOperation};
+var h=Object.defineProperty;var s=(e,a)=>h(e,"name",{value:a,configurable:!0});import{isAbsolute as m,resolve as _}from"node:path";import{isCloudRole as y}from"../../../core/canvas/person-state.js";import{RunError as r}from"../../../core/runs/operations.js";import{invalidStorageName as g,storageClient as p,StorageRefused as b,UPLOAD_MAX_BYTES as q}from"../../../core/storage/client.js";import{serveDownload as v}from"../../../core/storage/download.js";import{createShare as A,deleteOwnShare as S,listOwnShares as k}from"../../../core/storage/shares.js";import{getUpload as O,insertUpload as x,uploadUseAt as z}from"../../../core/storage/tables.js";import{requireRun as R}from"../router.js";const B=new Set(["upload.create","attachment.link","file.download","share.create","share.list","share.delete"]);function f(e){if(!e||typeof e!="object"||Array.isArray(e))throw new r(400,"invalid_request","a JSON object is required");return e}s(f,"object");function c(e){return{app:e.grantee,resolved:e.resolved,launched:null}}s(c,"fileCaller");const T=/^[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]{0,126}\/[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]{0,126}(?:\s*;.{0,200})?$/;async function D(e,a){const i=f(a);for(const l of Object.keys(i))if(!["name","media_type","size"].includes(l))throw new r(400,"invalid_request",`unknown field ${l}`,l);const{name:n,media_type:o,size:t}=i;if(typeof t!="number"||!Number.isSafeInteger(t)||t<0)throw new r(400,"invalid_request","size must be a non-negative integer","size");if(t>q)throw new r(400,"invalid_request","size exceeds 100 MiB","size");if(typeof n!="string")throw new r(400,"invalid_request","name is required","name");const d=g(n);if(d)throw new r(400,"invalid_request",d,"name");if(typeof o!="string"||!T.test(o))throw new r(400,"invalid_request","media_type must be a media type","media_type");const u=await p().createUpload({name:n,media_type:o,size:t});return await x({upload_id:u.upload_id,grantee:e.grantee,name:n,media_type:o,size:t,created_at:new Date().toISOString()}),{upload_id:u.upload_id,url:u.url,upload_link:u.upload_link,expires_at:u.expires_at}}s(D,"uploadCreate");async function E(e,a){if(!a)throw new r(400,"invalid_request","path is required","path");if(!m(a))throw new r(400,"invalid_request","path must be absolute","path");const i=await z(_(a)),n=s(()=>new r(404,"not_found","no upload is recorded at that path"),"missing");if(!i)throw n();try{await R(e,i.run_id)}catch(t){throw t instanceof r&&t.code==="not_found"?n():t}const o=await O(i.upload_id);if(!o||o.delete_pending_since)throw n();try{return await p().signDownload(i.upload_id)}catch(t){throw t instanceof b?n():t}}s(E,"attachmentLink");function w(e){if(y())throw new r(403,"permission_error",`${e} is not served by a cloud role: file transfer is not yet scoped to a person`)}s(w,"refuseOnCloudRole");async function L(e,a,i,n,o){switch(e.name!=="attachment.link"&&w(e.name),e.name){case"upload.create":return{status:201,body:await D(a,o)};case"attachment.link":return{status:200,body:await E(a,n.get("path"))};case"share.create":{const t=f(o);for(const d of Object.keys(t))if(!["path","expires_at"].includes(d))throw new r(400,"invalid_request",`unknown field ${d}`,d);return{status:201,body:await A(c(a),{path:t.path,expires_at:t.expires_at})}}case"share.list":return{status:200,body:await k(a.grantee)};case"share.delete":return{status:200,body:await S(a.grantee,i.share_id)};default:throw new r(404,"not_found","unknown operation")}}s(L,"handleTransferOperation");function Y(e,a,i,n){return w("file.download"),v(e,a,c(i),n.get("path"))}s(Y,"handleTransferDownload");export{B as TRANSFER_OPERATIONS,c as fileCaller,Y as handleTransferDownload,L as handleTransferOperation};

package/dist/daemon/api/reader.js

@@ -1 +1 @@
-var R=Object.defineProperty;var c=(n,e)=>R(n,"name",{value:e,configurable:!0});import{ApiError as d}from"../../api/index.js";import{readerFor as N,warmNodeRepos as h}from"../../core/graph/reader.js";import{canRead as g}from"../../core/graph/access.js";import{ownersByHandle as y,resolveName as x,viewOf as F}from"../../core/graph/names.js";import{ensureOwner as I,ownerForGrantee as j}from"../../core/graph/objects.js";import{checkoutsForCwd as v,reposForCwd as L,warmCheckoutIdentities as O}from"../../core/graph/repo-sync/repos.js";import{lookupProfile as A}from"../../core/profiles/manifest.js";import{openDb as $}from"../../core/canvas/db.js";import{filterAsync as D,mapAsync as S}from"../../core/async-array.js";import{personId as _}from"../../core/canvas/person.js";async function K(n,e){return await N(n,e.principal,async o=>await v(n,o))}c(K,"readerFor");async function Q(n,e){e!==void 0&&await O(e),n.class==="broker"&&await h(await $(),n.node)}c(Q,"warmReaderRepos");async function V(n){const e=await $(),o=await e.prepareUncached("SELECT DISTINCT w.watcher FROM watches w JOIN objects o ON o.id = w.watcher AND o.type = 'node' WHERE w.object = ?").all(n);for(const{watcher:r}of o)await h(e,r)}c(V,"warmDocumentWatchers");async function X(n,e,o){const r=await x(n,e,o);if("object"in r)return r.object;if("deleted"in r||"remote"in r)return r;if("ambiguous"in r){const s=await S(r.ambiguous,async f=>`${await b(n,f)}/${f.name}`);throw new d(409,"ambiguous_name",`'${o}' names more than one object: ${s.join(", ")}`,{candidates:s,next:"Read one of them by its full `<type>:<owner>/<name>`."})}const t=o.replace(/^\s*\[\[(.*)\]\]\s*$/,"$1").trim(),i=/^(person|app|repo|profile):([^/]+)$/.exec(t),a=await D(i?await y(n,i[2],i[1]):(await y(n,t)).filter(s=>s.type!=="node"),async s=>await g(n,e,s));if(a.length>0){const s=await F(n,e),f=c(m=>{const w=s.findIndex(E=>E.id===m.id);return w<0?1/0:w},"rank"),l=[...a].sort((m,w)=>f(m)-f(w))[0];if(f(l)===1/0&&a.length>1){const m=a.map(w=>`${w.type}:${w.name}`);throw new d(409,"ambiguous_name",`'${o}' names more than one owner: ${m.join(", ")}`,{candidates:m,next:"Name one as `<type>:<handle>`."})}return l.deleted_at?{deleted:l}:l}const p=`'${o}' not found: no object by that name in your view`,u=`Search for it with \`crtr canvas search ${t}\`.`;throw new d(404,"not_found",p,{error:"not_found",message:p,next:u})}c(X,"resolveRef");async function b(n,e){if(e.owner===null)return"";const o=await n.prepare("SELECT type, id, name FROM objects WHERE id = ?").get(e.owner);return o.type==="node"?o.id:`${o.type}:${o.name}`}c(b,"typedOwnerHandle");async function Y(n,e,o,r){const t=o??(e.class==="node"?"node":e.class==="person"?"user":"app"),i=c(a=>new d(400,"invalid_owner",a,{next:"Run `crtr doc write --owner -h`."}),"refuse");if(t==="node"){if(e.class!=="node")throw i("`--owner node` needs a node; you are not running as one");return e.node}if(t==="user")return await j(n,_());if(t==="app"){if(e.class==="person")throw i("`--owner app` needs an app; a person has none \u2014 use `--owner user`");return e.app}if(t==="profile"){if(e.class!=="node"||!e.profile)throw i("`--owner profile` needs a profile; you have none");return e.profile}if(t==="repo"){const a=r?await L(n,r):[],p=a[0]?a:e.class==="node"?e.repos:[];if(!p[0])throw i(`\`--owner repo\` needs a repo; ${r??(e.class==="node"?e.cwd:"your directory")} is not inside one`);return p[0]}if(t.startsWith("repo:"))return await k(n,"repo",t.slice(5),i);if(t.startsWith("profile:")){const a=t.slice(8),p=await n.prepare("SELECT * FROM objects WHERE type = 'profile' AND name = ? AND home_machine IS NULL").get(a);if(p)return p;const u=A(a);if(u.kind!=="resolved")throw i(`no profile named '${a}'`);const s=e.class==="person"?e.person:e.app;return await I(n,"profile","profile",u.entry.profileId,u.entry.manifest.name,s)}throw i(`unknown --owner value '${t}'`)}c(Y,"ownerFromFlag");async function k(n,e,o,r){const t=await n.prepare("SELECT * FROM objects WHERE type = ? AND name = ? AND deleted_at IS NULL AND home_machine IS NULL").get(e,o);if(!t)throw r(`no ${e} named '${o}'`);return t}c(k,"namedOwner");export{Y as ownerFromFlag,K as readerFor,X as resolveRef,V as warmDocumentWatchers,Q as warmReaderRepos};
+var R=Object.defineProperty;var p=(n,e)=>R(n,"name",{value:e,configurable:!0});import{ApiError as d}from"../../api/index.js";import{readerFor as N,warmNodeRepos as h}from"../../core/graph/reader.js";import{canRead as g}from"../../core/graph/access.js";import{ownersByHandle as y,resolveName as I,viewOf as x}from"../../core/graph/names.js";import{ensureOwner as F,ownerForGrantee as j,profileHandle as v}from"../../core/graph/objects.js";import{checkoutsForCwd as L,reposForCwd as O,warmCheckoutIdentities as A}from"../../core/graph/repo-sync/repos.js";import{lookupProfile as D}from"../../core/profiles/manifest.js";import{openDb as $}from"../../core/canvas/db.js";import{filterAsync as S,mapAsync as _}from"../../core/async-array.js";import{personId as b}from"../../core/canvas/person.js";async function Q(n,e){return await N(n,e.principal,async o=>await L(n,o))}p(Q,"readerFor");async function V(n,e){e!==void 0&&await A(e),n.class==="broker"&&await h(await $(),n.node)}p(V,"warmReaderRepos");async function X(n){const e=await $(),o=await e.prepareUncached("SELECT DISTINCT w.watcher FROM watches w JOIN objects o ON o.id = w.watcher AND o.type = 'node' WHERE w.object = ?").all(n);for(const{watcher:r}of o)await h(e,r)}p(X,"warmDocumentWatchers");async function Y(n,e,o){const r=await I(n,e,o);if("object"in r)return r.object;if("deleted"in r||"remote"in r)return r;if("ambiguous"in r){const s=await _(r.ambiguous,async m=>`${await k(n,m)}/${m.name}`);throw new d(409,"ambiguous_name",`'${o}' names more than one object: ${s.join(", ")}`,{candidates:s,next:"Read one of them by its full `<type>:<owner>/<name>`."})}const t=o.replace(/^\s*\[\[(.*)\]\]\s*$/,"$1").trim(),i=/^(person|app|repo|profile):([^/]+)$/.exec(t),a=await S(i?await y(n,i[2],i[1]):(await y(n,t)).filter(s=>s.type!=="node"),async s=>await g(n,e,s));if(a.length>0){const s=await x(n,e),m=p(u=>{const f=s.findIndex(E=>E.id===u.id);return f<0?1/0:f},"rank"),l=[...a].sort((u,f)=>m(u)-m(f))[0];if(m(l)===1/0&&a.length>1){const u=a.map(f=>`${f.type}:${f.name}`);throw new d(409,"ambiguous_name",`'${o}' names more than one owner: ${u.join(", ")}`,{candidates:u,next:"Name one as `<type>:<handle>`."})}return l.deleted_at?{deleted:l}:l}const c=`'${o}' not found: no object by that name in your view`,w=`Search for it with \`crtr canvas search ${t}\`.`;throw new d(404,"not_found",c,{error:"not_found",message:c,next:w})}p(Y,"resolveRef");async function k(n,e){if(e.owner===null)return"";const o=await n.prepare("SELECT type, id, name FROM objects WHERE id = ?").get(e.owner);return o.type==="node"?o.id:`${o.type}:${o.name}`}p(k,"typedOwnerHandle");async function Z(n,e,o,r){const t=o??(e.class==="node"?"node":e.class==="person"?"user":"app"),i=p(a=>new d(400,"invalid_owner",a,{next:"Run `crtr doc write --owner -h`."}),"refuse");if(t==="node"){if(e.class!=="node")throw i("`--owner node` needs a node; you are not running as one");return e.node}if(t==="user")return await j(n,b());if(t==="app"){if(e.class==="person")throw i("`--owner app` needs an app; a person has none \u2014 use `--owner user`");return e.app}if(t==="profile"){if(e.class!=="node"||!e.profile)throw i("`--owner profile` needs a profile; you have none");return e.profile}if(t==="repo"){const a=r?await O(n,r):[],c=a[0]?a:e.class==="node"?e.repos:[];if(!c[0])throw i(`\`--owner repo\` needs a repo; ${r??(e.class==="node"?e.cwd:"your directory")} is not inside one`);return c[0]}if(t.startsWith("repo:"))return await C(n,"repo",t.slice(5),i);if(t.startsWith("profile:")){const a=t.slice(8),c=await n.prepare("SELECT * FROM objects WHERE type = 'profile' AND name = ? AND home_machine IS NULL").get(a);if(c)return c;const w=D(a);if(w.kind!=="resolved")throw i(`no profile named '${a}'`);const s=e.class==="person"?e.person:e.app;return await F(n,"profile","profile",w.entry.profileId,v(w.entry.profileId,w.entry.manifest.name),s)}throw i(`unknown --owner value '${t}'`)}p(Z,"ownerFromFlag");async function C(n,e,o,r){const t=await n.prepare("SELECT * FROM objects WHERE type = ? AND name = ? AND deleted_at IS NULL AND home_machine IS NULL").get(e,o);if(!t)throw r(`no ${e} named '${o}'`);return t}p(C,"namedOwner");export{Z as ownerFromFlag,Q as readerFor,Y as resolveRef,X as warmDocumentWatchers,V as warmReaderRepos};