@nosana/api 2.12.0 → 2.13.2

package/README.md

@@ -151,6 +151,9 @@ await vault.topup({ NOS: 100 });
 | `updateMarket` | `market: string` | `Promise<void>` |
 | `duplicate` | `options: DeploymentDuplicateOptions` | `Promise<Deployment>` |
 | `generateAuthHeader` | — | `Promise<unknown>` |
+| `ssh.keys` | — | `Promise<string[]>` |
+| `ssh.add` | `publicKeys: string \| string[]` | `Promise<DeploymentUpdateSshKeysResult>` |
+| `ssh.remove` | `publicKeys: string \| string[]` | `Promise<DeploymentUpdateSshKeysResult>` |
 
 ### `api.templates` — Deployment Templates
 
@@ -179,6 +182,38 @@ await vault.topup({ NOS: 100 });
 | `getTemplatePerformance` | `nodeId: string` | `Promise<Record<string, unknown>>` |
 | `getBenchmarkSummary` | `request?: BenchmarkSummaryRequest` | `Promise<Record<string, unknown>>` |
 
+### `api.node` / `api.jobs.get(job)` — Node access
+
+A node verifies the job owner's signature, and the client manager signs on the
+caller's behalf — so node access works under both wallet and API-key auth. It has
+the same shape unauthenticated, but then the node refuses what needs a signer.
+
+| Call | Parameters | Returns |
+|--------|-----------|---------|
+| `node(address)` | `address: string` | `Promise<NodeInfo>` — a node's public info |
+| `jobs.get(job)` | `job: string` | `Promise<Job & NodeJobApi>` — the job's current indexer state flat-merged with its node job API |
+
+`jobs.get` returns the job's state with its node job API on the same object, so
+`(await api.jobs.get(id)).ssh.add(key)` works. Until a node picks the job up, the
+node methods are present but fail saying so.
+
+**Node job methods** (on `await api.jobs.get(job)`, alongside the job's indexer fields):
+
+| Method | Parameters | Returns |
+|--------|-----------|---------|
+| `definition` / `setDefinition` | — / `definition: JobDefinition` | `Promise<JobDefinition>` / `Promise<void>` |
+| `results` | — | `Promise<FlowState>` |
+| `operations` / `operation` / `group` | — / `op: string` / `group?: string` | `Promise<NodeOperationStatuses>` |
+| `restartGroup` / `restartOperation` | `group: string` / `group: string, op: string` | `Promise<void>` |
+| `stopGroup` / `stopOperation` / `stop` | `group: string` / `group: string, op: string` / — | `Promise<void>` |
+| `endpoints` | — | `Promise<NodeJobEndpoints>` |
+| `stats` | `query?: NodeStatsQuery` | `Promise<NodeTaskStat[]>` |
+| `streamInfo` / `streamStats` | `handlers, query?` | `NodeStreamSubscription` |
+| `logs` / `status` | `handlers, filter?, options?` | `NodeStreamSubscription` |
+| `ssh.keys` / `ssh.add` / `ssh.remove` | — / `publicKey, { expiresAt? }` / `publicKey` | see `NodeJobSsh` |
+| `ssh.command` | `options?: SshCommandOptions` | `SshConnectionDescriptor` |
+| `terminal` | `options: NodeTerminalOptions` | `Promise<TerminalSession>` |
+
 ### `api.stats` — Platform Statistics
 
 | Method | Parameters | Returns |

package/dist/client/createClient.d.ts

@@ -1,10 +1,12 @@
 import type { AuthenticatedClient, ClientConnection } from './type.utils.js';
-import type { ApiKeyAuth, SignerAuth, CreateNosanaApiOptions } from '../types.js';
+import type { ApiKeyAuth, SignedHeaderAuth, CreateNosanaApiOptions } from '../types.js';
+/** The message signer auth signs on every request; nodes accept it on their sockets too. */
+export declare const NOSANA_API_AUTH_MESSAGE = "NosanaApiAuthentication";
 /**
  * The headers the client sends on every request. Resolved per call: signer auth
  * signs a fresh message each time.
  */
-export declare function authHeaders(authParams: ApiKeyAuth | SignerAuth | undefined): Promise<Record<string, string>>;
+export declare function authHeaders(authParams: ApiKeyAuth | SignedHeaderAuth | undefined): Promise<Record<string, string>>;
 /**
  * Creates an authenticated OpenAPI client with shared auth middleware.
  * Used as the base factory for all service-specific API clients.
@@ -14,7 +16,7 @@ export declare function authHeaders(authParams: ApiKeyAuth | SignerAuth | undefi
  * differently from an ordinary request. Services that never stream simply
  * leave it unexposed in their return types.
  */
-export declare function createAuthenticatedClient<Paths extends Record<string, any>>(baseUrl: string, authParams: ApiKeyAuth | SignerAuth | undefined, options?: Pick<CreateNosanaApiOptions, 'include_credentials'>, defaultHeaders?: Record<string, string>): AuthenticatedClient<Paths> & {
+export declare function createAuthenticatedClient<Paths extends Record<string, any>>(baseUrl: string, authParams: ApiKeyAuth | SignedHeaderAuth | undefined, options?: Pick<CreateNosanaApiOptions, 'include_credentials'>, defaultHeaders?: Record<string, string>): AuthenticatedClient<Paths> & {
     connection: ClientConnection;
 };
 //# sourceMappingURL=createClient.d.ts.map

package/dist/client/createClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createClient.d.ts","sourceRoot":"","sources":["../../src/client/createClient.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,mBAAmB,EAEnB,gBAAgB,EACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAElF;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,UAAU,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,GAC9C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAWjC;AAED;;;;;;;;GAQG;AAEH,wBAAgB,yBAAyB,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzE,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,EAC/C,OAAO,CAAC,EAAE,IAAI,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,EAC7D,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,mBAAmB,CAAC,KAAK,CAAC,GAAG;IAAE,UAAU,EAAE,gBAAgB,CAAA;CAAE,CAgC/D"}
+{"version":3,"file":"createClient.d.ts","sourceRoot":"","sources":["../../src/client/createClient.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,mBAAmB,EAEnB,gBAAgB,EACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAExF,4FAA4F;AAC5F,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,UAAU,EAAE,UAAU,GAAG,gBAAgB,GAAG,SAAS,GACpD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAWjC;AAED;;;;;;;;GAQG;AAEH,wBAAgB,yBAAyB,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzE,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,UAAU,GAAG,gBAAgB,GAAG,SAAS,EACrD,OAAO,CAAC,EAAE,IAAI,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,EAC7D,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,mBAAmB,CAAC,KAAK,CAAC,GAAG;IAAE,UAAU,EAAE,gBAAgB,CAAA;CAAE,CAgC/D"}

package/dist/client/createClient.js

@@ -1,4 +1,6 @@
 import createClient from 'openapi-fetch';
+/** The message signer auth signs on every request; nodes accept it on their sockets too. */
+export const NOSANA_API_AUTH_MESSAGE = 'NosanaApiAuthentication';
 /**
  * The headers the client sends on every request. Resolved per call: signer auth
  * signs a fresh message each time.
@@ -10,8 +12,8 @@ export async function authHeaders(authParams) {
         return { Authorization: `Bearer ${authParams}` };
     }
     return {
-        'x-user-id': authParams.identifier,
-        Authorization: await authParams.generate('NosanaApiAuthentication'),
+        ...(authParams.identifier ? { 'x-user-id': authParams.identifier } : {}),
+        Authorization: await authParams.generate(NOSANA_API_AUTH_MESSAGE),
     };
 }
 /**

package/dist/client/createClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"createClient.js","sourceRoot":"","sources":["../../src/client/createClient.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,eAAe,CAAC;AAUzC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAA+C;IAE/C,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAE3B,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE,CAAC;IACnD,CAAC;IAED,OAAO;QACL,WAAW,EAAE,UAAU,CAAC,UAAU;QAClC,aAAa,EAAE,MAAM,UAAU,CAAC,QAAQ,CAAC,yBAAyB,CAAC;KACpE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,8DAA8D;AAC9D,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,UAA+C,EAC/C,OAA6D,EAC7D,cAAuC;IAEvC,MAAM,cAAc,GAAe;QACjC,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;YACzB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBAC1E,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;KACF,CAAC;IAEF,MAAM,MAAM,GAAG,YAAY,CAA4B;QACrD,OAAO;QACP,GAAG,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;QAC3B,UAAU,EAAE;YACV,OAAO;YACP,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBACpB,GAAG,cAAc;gBACjB,sEAAsE;gBACtE,GAAG,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,CAAC;aACvE,CAAC;YACF,GAAG,CAAC,OAAO,EAAE,mBAAmB;gBAC9B,CAAC,CAAC,EAAE,WAAW,EAAE,SAAkB,EAAE;gBACrC,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"createClient.js","sourceRoot":"","sources":["../../src/client/createClient.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,eAAe,CAAC;AAUzC,4FAA4F;AAC5F,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAEjE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAAqD;IAErD,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAE3B,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE,CAAC;IACnD,CAAC;IAED,OAAO;QACL,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,aAAa,EAAE,MAAM,UAAU,CAAC,QAAQ,CAAC,uBAAuB,CAAC;KAClE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,8DAA8D;AAC9D,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,UAAqD,EACrD,OAA6D,EAC7D,cAAuC;IAEvC,MAAM,cAAc,GAAe;QACjC,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;YACzB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBAC1E,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;KACF,CAAC;IAEF,MAAM,MAAM,GAAG,YAAY,CAA4B;QACrD,OAAO;QACP,GAAG,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;QAC3B,UAAU,EAAE;YACV,OAAO;YACP,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBACpB,GAAG,cAAc;gBACjB,sEAAsE;gBACtE,GAAG,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,CAAC;aACvE,CAAC;YACF,GAAG,CAAC,OAAO,EAAE,mBAAmB;gBAC9B,CAAC,CAAC,EAAE,WAAW,EAAE,SAAkB,EAAE;gBACrC,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/client/deployment-manager/schema.d.ts

@@ -1001,8 +1001,172 @@ export interface paths {
             };
         };
         put?: never;
-        post?: never;
-        delete?: never;
+        /** @description Grant one or more SSH public keys access to the deployment's jobs. */
+        post: {
+            parameters: {
+                query?: never;
+                header: {
+                    "x-user-id": string;
+                    /** @description Signed authentication message, */
+                    authorization: string;
+                    /** @description Nosana API key */
+                    "x-nosana-api"?: string;
+                };
+                path: {
+                    deployment: components["schemas"]["PublicKey"];
+                };
+                cookie?: never;
+            };
+            requestBody: {
+                content: {
+                    "application/json": {
+                        /** @description SSH public keys to grant. Keys already present (same type and material) are left as they are; the deployment holds at most 10. */
+                        public_keys: string[];
+                    };
+                };
+            };
+            responses: {
+                /** @description The deployment's SSH keys after the change. Check `jobs` for nodes that rejected or did not receive the new keys. */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            public_keys: string[];
+                            /** Format: date-time */
+                            updated_at: string;
+                            /** @description Per running job whose node was contacted to apply the change. Empty when nothing changed or nothing is running. */
+                            jobs: {
+                                job: string;
+                                node: string;
+                                status: "authorized" | "revoked" | "failed";
+                                error?: string;
+                            }[];
+                        };
+                    };
+                };
+                /** @description Bad Request. A key is not a valid OpenSSH public key, or the set exceeds the limits. */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Unauthorized. Invalid or missing authentication. */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Deployment not found. */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Internal Server Error. */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
+        /** @description Revoke one or more SSH public keys from the deployment's jobs. */
+        delete: {
+            parameters: {
+                query?: never;
+                header: {
+                    "x-user-id": string;
+                    /** @description Signed authentication message, */
+                    authorization: string;
+                    /** @description Nosana API key */
+                    "x-nosana-api"?: string;
+                };
+                path: {
+                    deployment: components["schemas"]["PublicKey"];
+                };
+                cookie?: never;
+            };
+            requestBody: {
+                content: {
+                    "application/json": {
+                        /** @description SSH public keys to revoke. A key is matched by type and material, so a differing comment still revokes it. */
+                        public_keys: string[];
+                    };
+                };
+            };
+            responses: {
+                /** @description The deployment's SSH keys after the change. Check `jobs` for nodes that did not apply the revocation. */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            public_keys: string[];
+                            /** Format: date-time */
+                            updated_at: string;
+                            /** @description Per running job whose node was contacted to apply the change. Empty when nothing changed or nothing is running. */
+                            jobs: {
+                                job: string;
+                                node: string;
+                                status: "authorized" | "revoked" | "failed";
+                                error?: string;
+                            }[];
+                        };
+                    };
+                };
+                /** @description Bad Request. A key is not a valid OpenSSH public key. */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Unauthorized. Invalid or missing authentication. */
+                401: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Deployment not found. */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+                /** @description Internal Server Error. */
+                500: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["Error"];
+                    };
+                };
+            };
+        };
         options?: never;
         head?: never;
         patch?: never;
@@ -1889,104 +2053,6 @@ export interface paths {
         };
         trace?: never;
     };
-    "/deployments/{deployment}/update-ssh-keys": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        /** @description Replace the deployment's SSH public keys. The new set is stored on the deployment (not on a revision — no new revision or restart) and injected into every job posted from now on. New keys are also authorized on the node of every job currently running; removed keys stop working only when a job restarts. */
-        patch: {
-            parameters: {
-                query?: never;
-                header: {
-                    "x-user-id": string;
-                    /** @description Signed authentication message, */
-                    authorization: string;
-                    /** @description Nosana API key */
-                    "x-nosana-api"?: string;
-                };
-                path: {
-                    deployment: components["schemas"]["PublicKey"];
-                };
-                cookie?: never;
-            };
-            requestBody: {
-                content: {
-                    "application/json": {
-                        /** @description The complete set of SSH public keys allowed to reach this deployment's jobs (at most 10). Replaces the current set; an empty array revokes SSH access. */
-                        public_keys: string[];
-                    };
-                };
-            };
-            responses: {
-                /** @description SSH keys updated. Check `jobs` for nodes that rejected or did not receive the new keys. */
-                200: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": {
-                            public_keys: string[];
-                            /** Format: date-time */
-                            updated_at: string;
-                            /** @description Per running job: whether its node authorized the new keys. Empty when the new set is empty — a revocation cannot reach running jobs. */
-                            jobs: {
-                                job: string;
-                                node: string;
-                                status: "authorized" | "failed";
-                                error?: string;
-                            }[];
-                        };
-                    };
-                };
-                /** @description Bad Request. A key is not a valid OpenSSH public key, or the set exceeds the limits. */
-                400: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["Error"];
-                    };
-                };
-                /** @description Unauthorized. Invalid or missing authentication. */
-                401: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": "Unauthorized";
-                    };
-                };
-                /** @description Deployment not found. */
-                404: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["Error"];
-                    };
-                };
-                /** @description Internal Server Error. */
-                500: {
-                    headers: {
-                        [name: string]: unknown;
-                    };
-                    content: {
-                        "application/json": components["schemas"]["Error"];
-                    };
-                };
-            };
-        };
-        trace?: never;
-    };
     "/deployments/{deployment}/update-timeout": {
         parameters: {
             query?: never;