@nylorun/runtime 0.1.1-beta

package/dist/model/configure.js

@@ -0,0 +1,115 @@
+import { mkdir, writeFile, rename, rm } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { join } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { ProjectCredentialStore } from "./auth-store.js";
+import { modelsFor } from "./models.js";
+export class ConfigurationCancelled extends Error {
+    signal;
+    exitCode;
+    constructor(signal) {
+        super(`Provider configuration cancelled (${signal}).`);
+        this.signal = signal;
+        this.exitCode = signal === "SIGINT" ? 130 : 143;
+    }
+}
+// Internal options also allow isolated prompt tests without changing process globals.
+export async function configureProvider(options = {}) {
+    const root = options.root ?? process.cwd();
+    const output = options.output ?? process.stdout;
+    const controller = new AbortController();
+    const signal = controller.signal;
+    const forwardAbort = () => controller.abort(options.signal.reason);
+    options.signal?.throwIfAborted();
+    const store = new ProjectCredentialStore(join(root, ".env", "auth.json"));
+    const models = modelsFor({ provider: "", model: "" }, store);
+    const providers = models.getProviders();
+    const prompt = createInterface({
+        input: options.input ?? process.stdin,
+        output,
+    });
+    const onInt = () => controller.abort(new ConfigurationCancelled("SIGINT"));
+    const onClose = () => controller.abort(new Error("Configuration input closed before setup completed."));
+    const closeOnAbort = () => prompt.close();
+    prompt.on("SIGINT", onInt);
+    prompt.on("close", onClose);
+    signal.addEventListener("abort", closeOnAbort, { once: true });
+    options.signal?.addEventListener("abort", forwardAbort, { once: true });
+    if (options.signal?.aborted)
+        forwardAbort();
+    async function question(message) {
+        signal.throwIfAborted();
+        return prompt.question(message, { signal });
+    }
+    try {
+        signal.throwIfAborted();
+        output.write("0. Custom OpenAI-compatible provider\n");
+        providers.forEach((provider, index) => output.write(`${index + 1}. ${provider.name} (${provider.id})\n`));
+        const choice = Number(await question("Choose a provider: "));
+        if (choice === 0) {
+            const baseUrl = (await question("OpenAI-compatible base URL: "))
+                .trim()
+                .replace(/\/$/, "");
+            const model = (await question("Model id: ")).trim();
+            if (!baseUrl || !model)
+                throw new Error("A base URL and model id are required.");
+            const selection = {
+                provider: "custom",
+                model,
+                custom: { baseUrl },
+            };
+            const customModels = modelsFor(selection, store);
+            await customModels.login("custom", "api_key", interaction());
+            await save(selection);
+        }
+        else {
+            const chosen = providers[choice - 1];
+            if (!chosen)
+                throw new Error("Choose a listed provider.");
+            const available = models.getModels(chosen.id);
+            available.forEach((model, index) => output.write(`${index + 1}. ${model.name} (${model.id})\n`));
+            const model = available[Number(await question("Choose a model: ")) - 1];
+            if (!model)
+                throw new Error("Choose a listed model.");
+            if (!(await models.checkAuth(chosen.id, { signal }))) {
+                await models.login(chosen.id, chosen.auth.oauth ? "oauth" : "api_key", interaction());
+            }
+            await save({ provider: chosen.id, model: model.id });
+        }
+        signal.throwIfAborted();
+        output.write("Provider configuration saved.\n");
+    }
+    catch (error) {
+        throw signal.aborted ? signal.reason : error;
+    }
+    finally {
+        options.signal?.removeEventListener("abort", forwardAbort);
+        signal.removeEventListener("abort", closeOnAbort);
+        prompt.removeListener("SIGINT", onInt);
+        prompt.removeListener("close", onClose);
+        prompt.close();
+    }
+    function interaction() {
+        return {
+            signal,
+            prompt: async (item) => question(item.message + ": "),
+            notify: (event) => output.write((event.url ?? event.verificationUri ?? event.message) + "\n"),
+        };
+    }
+    async function save(selection) {
+        signal.throwIfAborted();
+        const directory = join(root, "config");
+        const temporary = join(directory, `.model-${randomUUID()}.json`);
+        try {
+            await mkdir(directory, { recursive: true });
+            await writeFile(temporary, JSON.stringify(selection, null, 2) + "\n", {
+                signal,
+            });
+            signal.throwIfAborted();
+            await rename(temporary, join(directory, "model.json"));
+        }
+        finally {
+            await rm(temporary, { force: true });
+        }
+    }
+}

package/dist/model/models.d.ts

@@ -0,0 +1,9 @@
+import type { ProjectCredentialStore } from "./auth-store.js";
+export type Selection = Readonly<{
+    provider: string;
+    model: string;
+    custom?: Readonly<{
+        baseUrl: string;
+    }>;
+}>;
+export declare function modelsFor(selection: Selection, credentials: ProjectCredentialStore): import("@earendil-works/pi-ai").MutableModels;

package/dist/model/models.js

@@ -0,0 +1,31 @@
+import { createProvider, envApiKeyAuth, } from "@earendil-works/pi-ai";
+import { stream, streamSimple, } from "@earendil-works/pi-ai/api/openai-completions";
+import { builtinModels } from "@earendil-works/pi-ai/providers/all";
+export function modelsFor(selection, credentials) {
+    const models = builtinModels({ credentials });
+    if (!selection.custom)
+        return models;
+    const model = {
+        id: selection.model,
+        name: selection.model,
+        api: "openai-completions",
+        provider: "custom",
+        baseUrl: selection.custom.baseUrl,
+        reasoning: false,
+        input: ["text", "image"],
+        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+        contextWindow: 128000,
+        maxTokens: 16384,
+    };
+    models.setProvider(createProvider({
+        id: "custom",
+        name: "Custom OpenAI-compatible",
+        baseUrl: selection.custom.baseUrl,
+        auth: {
+            apiKey: envApiKeyAuth("Custom API key", ["NYLO_CUSTOM_API_KEY"]),
+        },
+        models: [model],
+        api: { stream, streamSimple },
+    }));
+    return models;
+}

package/dist/model/pi-model.d.ts

@@ -0,0 +1,10 @@
+import type { RuntimeModelAdapter } from "../contracts.js";
+import type { RuntimeMedia } from "../adapters/media.js";
+import { type Selection } from "./models.js";
+export interface PiModelOptions {
+    readonly root?: string;
+    readonly selection?: Selection;
+    readonly media?: Pick<RuntimeMedia, "dataUrl">;
+}
+/** A plain portable callable. Provider credentials are read only when it is invoked. */
+export declare function piModel(options?: PiModelOptions): RuntimeModelAdapter;

package/dist/model/pi-model.js

@@ -0,0 +1,166 @@
+import { join } from "node:path";
+import { scrub } from "../adapters/journal.js";
+import { ProjectCredentialStore } from "./auth-store.js";
+import { modelsFor } from "./models.js";
+import { modelSelection, projectSecrets } from "./settings.js";
+const emptyUsage = () => ({
+    input: 0,
+    output: 0,
+    totalTokens: 0,
+    cacheRead: 0,
+    cacheWrite: 0,
+    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+});
+/** A plain portable callable. Provider credentials are read only when it is invoked. */
+export function piModel(options = {}) {
+    return async (call, context) => {
+        context.signal.throwIfAborted();
+        const root = options.root ?? process.cwd();
+        const selection = options.selection ?? modelSelection(root);
+        const registry = modelsFor(selection, new ProjectCredentialStore(join(root, ".env", "auth.json")));
+        const selected = registry.getModel(selection.provider, selection.model);
+        if (!selected)
+            throw new Error("Unknown model. Run nylorun configure.");
+        const messages = [];
+        const instructions = [];
+        const content = async (parts) => {
+            const result = [];
+            for (const part of parts) {
+                if (part.type === "text")
+                    result.push({ type: "text", text: part.text });
+                else if (part.type === "media") {
+                    if (!selected.input.includes("image"))
+                        throw new Error("The configured model does not accept images.");
+                    const ref = part.reference;
+                    if (!ref ||
+                        typeof ref !== "object" ||
+                        Array.isArray(ref) ||
+                        !("agentId" in ref) ||
+                        !("assetId" in ref) ||
+                        typeof ref.agentId !== "string" ||
+                        typeof ref.assetId !== "string")
+                        throw new Error("Expected a local media reference.");
+                    const asset = await options.media?.dataUrl({ agentId: ref.agentId, assetId: ref.assetId }, call.sessionId);
+                    if (!asset)
+                        throw new Error("Media is unavailable; pass the shared media adapter to piModel({ media }).");
+                    const comma = asset.url.indexOf(",");
+                    result.push({
+                        type: "image",
+                        data: asset.url.slice(comma + 1),
+                        mimeType: asset.asset.mediaType,
+                    });
+                }
+            }
+            return result;
+        };
+        for (const item of call.prompt) {
+            if (item.kind === "instructions") {
+                instructions.push(...item.content.flatMap((part) => part.type === "text" ? [part.text] : []));
+            }
+            else if (item.kind === "tool-result") {
+                messages.push({
+                    role: "toolResult",
+                    toolCallId: item.toolCallId,
+                    toolName: item.toolName,
+                    isError: item.status !== "completed",
+                    timestamp: Date.now(),
+                    content: await content(item.content),
+                });
+            }
+            else if (item.role === "assistant") {
+                messages.push({
+                    role: "assistant",
+                    api: selected.api,
+                    provider: selected.provider,
+                    model: selected.id,
+                    timestamp: Date.now(),
+                    usage: emptyUsage(),
+                    stopReason: item.content.some((p) => p.type === "tool-call")
+                        ? "toolUse"
+                        : "stop",
+                    content: item.content.flatMap((part) => part.type === "tool-call"
+                        ? [
+                            {
+                                type: "toolCall",
+                                id: part.id,
+                                name: part.name,
+                                arguments: { ...part.args },
+                            },
+                        ]
+                        : part.type === "text"
+                            ? [{ type: "text", text: part.text }]
+                            : []),
+                });
+            }
+            else
+                messages.push({
+                    role: "user",
+                    content: await content(item.content),
+                    timestamp: Date.now(),
+                });
+        }
+        const tools = call.tools.map((tool) => ({
+            name: tool.name,
+            description: tool.description ?? "",
+            parameters: { ...tool.inputSchema },
+        }));
+        const request = {
+            systemPrompt: instructions.join("\n"),
+            messages,
+            tools,
+        };
+        const secrets = projectSecrets(root);
+        // Publish only portable references, never the materialized provider image bytes.
+        context.reportPreparedCall?.({
+            adapter: "runtime.pi-ai",
+            call: scrub(call, secrets),
+        });
+        try {
+            const response = await registry.complete(selected, request, {
+                signal: context.signal,
+                temperature: call.model?.controls?.temperature,
+                maxTokens: call.model?.controls?.maxOutputTokens,
+                ...(call.model?.config
+                    ? { samplingParams: { ...call.model.config } }
+                    : {}),
+            });
+            context.signal.throwIfAborted();
+            if (response.stopReason === "error" ||
+                response.stopReason === "aborted" ||
+                response.stopReason === "deferred")
+                throw new Error(response.errorMessage ?? `Provider stopped: ${response.stopReason}`);
+            const output = [];
+            for (const part of response.content) {
+                if (part.type === "text")
+                    output.push({ type: "text", text: part.text });
+                else if (part.type === "thinking")
+                    output.push({ type: "reasoning", text: part.thinking });
+                else if (part.type === "toolCall")
+                    output.push({
+                        type: "tool-call",
+                        id: part.id,
+                        name: part.name,
+                        args: part.arguments,
+                    });
+            }
+            return {
+                output,
+                finishReason: response.stopReason === "toolUse"
+                    ? "tool-calls"
+                    : response.stopReason === "length"
+                        ? "length"
+                        : "stop",
+                usage: {
+                    inputTokens: response.usage.input,
+                    outputTokens: response.usage.output,
+                    totalTokens: response.usage.totalTokens,
+                    costUsd: response.usage.cost.total,
+                },
+                evidence: { resolvedModel: response.responseModel ?? selected.id },
+            };
+        }
+        catch (error) {
+            throw new Error(String(scrub(error instanceof Error ? error.message : String(error), projectSecrets(root))));
+        }
+    };
+}

package/dist/model/settings.d.ts

@@ -0,0 +1,3 @@
+import type { Selection } from "./models.js";
+export declare function modelSelection(root?: string): Selection;
+export declare function projectSecrets(root?: string): readonly string[];

package/dist/model/settings.js

@@ -0,0 +1,35 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+export function modelSelection(root = process.cwd()) {
+    try {
+        const value = JSON.parse(readFileSync(join(root, "config", "model.json"), "utf8"));
+        if (typeof value.provider === "string" &&
+            value.provider &&
+            typeof value.model === "string" &&
+            value.model &&
+            (value.custom === undefined || typeof value.custom.baseUrl === "string"))
+            return value;
+    }
+    catch {
+        /* Report one actionable setup error without file or credential contents. */
+    }
+    throw new Error("Run nylorun configure to connect a model provider.");
+}
+export function projectSecrets(root = process.cwd()) {
+    const values = Object.entries(process.env)
+        .filter(([key]) => /key|token|secret|password|credential/i.test(key))
+        .flatMap(([, value]) => (value ? [value] : []));
+    try {
+        const collect = (value) => {
+            if (typeof value === "string")
+                values.push(value);
+            else if (value && typeof value === "object")
+                Object.values(value).forEach(collect);
+        };
+        collect(JSON.parse(readFileSync(join(root, ".env", "auth.json"), "utf8")));
+    }
+    catch {
+        /* The vault may not exist before setup. */
+    }
+    return values;
+}

package/dist/server/ag-ui.d.ts

@@ -0,0 +1,8 @@
+import type { CanonicalEvent } from "../adapters/journal.js";
+/** Minimal truthful AG-UI projection from the same canonical events Studio displays. */
+export declare function agUiEvents(events: readonly CanonicalEvent[], threadId: string, runId: string): readonly Record<string, unknown>[];
+/**
+ * Preserve headers installed by the Hono host (notably loopback CORS) when a
+ * route returns a raw streaming Response instead of `context.json()`.
+ */
+export declare function sse(events: readonly Record<string, unknown>[], inherited?: HeadersInit): Response;

package/dist/server/ag-ui.js

@@ -0,0 +1,67 @@
+/** Minimal truthful AG-UI projection from the same canonical events Studio displays. */
+export function agUiEvents(events, threadId, runId) {
+    const output = [
+        { type: "RUN_STARTED", threadId, runId },
+    ];
+    for (const event of events) {
+        if (event.type === "tool.sealed") {
+            const calls = Array.isArray(event.payload.attributes
+                ?.executable)
+                ? event.payload.attributes
+                    .executable
+                : [];
+            for (const call of calls) {
+                const id = typeof call.callId === "string" ? call.callId : undefined;
+                const name = typeof call.toolName === "string" ? call.toolName : undefined;
+                if (!id || !name)
+                    continue;
+                output.push({ type: "TOOL_CALL_START", toolCallId: id, toolCallName: name }, {
+                    type: "TOOL_CALL_ARGS",
+                    toolCallId: id,
+                    delta: JSON.stringify(call.args ?? {}),
+                }, { type: "TOOL_CALL_END", toolCallId: id });
+            }
+        }
+        else if (event.type === "tool.completed" &&
+            typeof event.payload.callId === "string") {
+            output.push({
+                type: "TOOL_CALL_RESULT",
+                messageId: `nylorun-${threadId}-${event.seq}`,
+                toolCallId: event.payload.callId,
+                content: JSON.stringify(event.payload.attributes ?? {
+                    outcome: event.payload.outcome ?? "completed",
+                }),
+            });
+        }
+        else if (event.type === "final" && event.payload.output !== undefined) {
+            const messageId = `nylorun-${threadId}-${event.seq}`;
+            const text = typeof event.payload.output === "string"
+                ? event.payload.output
+                : JSON.stringify(event.payload.output);
+            output.push({ type: "TEXT_MESSAGE_START", messageId, role: "assistant" }, { type: "TEXT_MESSAGE_CONTENT", messageId, delta: text }, { type: "TEXT_MESSAGE_END", messageId });
+        }
+        else if (event.type === "error") {
+            output.push({
+                type: "RUN_ERROR",
+                message: typeof event.payload.message === "string"
+                    ? event.payload.message
+                    : "Agent run failed.",
+            });
+        }
+    }
+    output.push({ type: "RUN_FINISHED", threadId, runId });
+    return Object.freeze(output);
+}
+/**
+ * Preserve headers installed by the Hono host (notably loopback CORS) when a
+ * route returns a raw streaming Response instead of `context.json()`.
+ */
+export function sse(events, inherited) {
+    const headers = new Headers(inherited);
+    headers.set("content-type", "text/event-stream; charset=utf-8");
+    headers.set("cache-control", "no-cache");
+    headers.set("connection", "keep-alive");
+    return new Response(events.map((event) => `data: ${JSON.stringify(event)}\n\n`).join(""), {
+        headers,
+    });
+}

package/dist/server/digests.d.ts

@@ -0,0 +1,11 @@
+import type { RuntimeEvent } from "../contracts.js";
+/** Optional diagnostic enrichment; engines need not emit model diagnostics. */
+export declare function observedPayload(event: RuntimeEvent): Record<string, unknown>;
+export declare function modelRequestDigests(value: unknown): {
+    prompt: string;
+    tools: string;
+    model: string;
+    output: string;
+    configuration: string;
+    context: string;
+};

package/dist/server/digests.js

@@ -0,0 +1,39 @@
+import { createHash } from "node:crypto";
+/** Optional diagnostic enrichment; engines need not emit model diagnostics. */
+export function observedPayload(event) {
+    const attributes = record(event.attributes);
+    if (event.type !== "model.requested" || !record(attributes?.call))
+        return { ...event };
+    return { ...event, digests: modelRequestDigests(attributes) };
+}
+export function modelRequestDigests(value) {
+    const attributes = record(value) ?? {};
+    const call = record(attributes.call) ?? {};
+    const configuration = record(attributes.configuration) ?? {};
+    return {
+        prompt: digest(call.prompt),
+        tools: digest({ call: call.tools, contracts: configuration.toolContracts }),
+        model: digest(call.model ?? null),
+        output: digest(call.outputSchema ?? null),
+        configuration: digest(attributes.configuration),
+        context: digest(attributes.context),
+    };
+}
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function digest(value) {
+    return createHash("sha256").update(canonical(value)).digest("hex");
+}
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    if (value && typeof value === "object")
+        return `{${Object.entries(value)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`)
+            .join(",")}}`;
+    return JSON.stringify(value) ?? "null";
+}

package/dist/server/host.d.ts

@@ -0,0 +1,14 @@
+import { Hono } from "hono";
+import type { RuntimeConfig } from "../config.js";
+export declare function createRuntime(options: RuntimeConfig): Promise<Readonly<{
+    app: Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
+    hasSession: (agentId: string, sessionId: string) => boolean;
+    close: () => Promise<void>;
+}>>;
+/** Host headers a loopback bind answers to, on the port actually in use. */
+export declare function loopbackHosts(port: number): readonly string[];
+/**
+ * Decide whether a request's Host header is served. Entries are exact
+ * `host:port` values or bare host names that accept any port; `*` accepts all.
+ */
+export declare function allowedHost(header: string | undefined, allowed: readonly string[]): boolean;