@nylorun/runtime 0.13.0-beta → 0.15.0-beta

package/dist/tenant/live.js

@@ -1,290 +0,0 @@
-import { decodeCursor, encodeCursor } from "../store/cursor.js";
-import { streamOfSession, } from "../streams/types.js";
-import { fail } from "./http.js";
-export function createLiveHub() {
-    return { wiring: undefined, feeds: new Map(), executorStreams: new Map() };
-}
-const WORK_AVAILABLE = 'event: work_available\ndata: {"type":"work_available"}\n\n';
-const RETRY_MIN_MS = 100;
-const RETRY_MAX_MS = 2000;
-function frame(event) {
-    return `id: ${event.cursor}\nevent: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`;
-}
-export function send(response, data) {
-    if (!response.write(data))
-        response.destroy();
-}
-/** Start an SSE response with keepalives; `onClose` runs once the client goes away. */
-export function openSse(request, response, onClose) {
-    response.writeHead(200, {
-        "content-type": "text/event-stream",
-        "cache-control": "no-cache",
-        connection: "keep-alive",
-        "x-accel-buffering": "no",
-    });
-    response.flushHeaders();
-    const timer = setInterval(() => send(response, ": keepalive\n\n"), 15000);
-    timer.unref();
-    request.on("close", () => {
-        clearInterval(timer);
-        onClose();
-    });
-}
-/** The resume cursor: `?cursor=` wins over `Last-Event-ID`. */
-export function requestCursor(request, url) {
-    return (url.searchParams.get("cursor") ??
-        (typeof request.headers["last-event-id"] === "string"
-            ? request.headers["last-event-id"]
-            : undefined));
-}
-/** The first sequence to read: after the cursor's, or the session's first event. */
-function startSeq(sessionId, cursor) {
-    return cursor ? decodeCursor(sessionId, cursor) + 1 : 0;
-}
-/** `agent` keeps only events of one agent used as a tool, by delegationId or path. */
-function belongsTo(event, agent) {
-    const ref = event.payload?.agent;
-    return ref?.delegationId === agent || ref?.path === agent;
-}
-/** The stream of the session's current incarnation, or undefined when the session is gone. */
-async function currentStream(ctx, sessionId) {
-    const session = await ctx.store.tx((t) => t.get("sessions", sessionId));
-    return session && streamOfSession(session);
-}
-function streamsOf(ctx) {
-    return (ctx.live.wiring?.streams ?? fail(503, "Session streams are unavailable"));
-}
-/**
- * `GET /v1/sessions/:id/items`: the session stream after the cursor, up to its tail when the
- * read starts. The cursor returned is the last record read (the request's cursor when none
- * was), whatever the `agent` filter kept.
- */
-export async function readHistory(ctx, sessionId, cursor, agent) {
-    const from = startSeq(sessionId, cursor);
-    const streams = streamsOf(ctx);
-    const stream = (await currentStream(ctx, sessionId)) ?? fail(404, "Session not found");
-    const items = [];
-    let last;
-    try {
-        for await (const record of streams.read(ctx.config.tenantId, stream, from, { follow: false })) {
-            last = record.seq;
-            if (agent === undefined || belongsTo(record.body, agent))
-                items.push(record.body);
-        }
-    }
-    catch (error) {
-        ctx.config.logger.warn("session history read failed", {
-            sessionId,
-            message: error instanceof Error ? error.message : String(error),
-        });
-        fail(503, "Session history is unavailable");
-    }
-    return {
-        items,
-        cursor: last !== undefined ? encodeCursor(sessionId, last) : cursor ?? null,
-    };
-}
-/**
- * `GET /v1/sessions/:id/events`: joins the session's shared read at the client's cursor and
- * follows it until the client leaves, the session is reset or deleted, or the Tenant closes.
- */
-export async function streamSessionEvents(ctx, request, response, sessionId, cursor) {
-    const from = startSeq(sessionId, cursor);
-    streamsOf(ctx);
-    const stream = (await currentStream(ctx, sessionId)) ?? fail(404, "Session not found");
-    const hub = ctx.live;
-    const observer = { response, next: from };
-    let feed = hub.feeds.get(sessionId);
-    if (feed && feed.stream !== stream) {
-        // The session was created again since that feed started: it follows an abandoned stream.
-        endFeed(hub, feed);
-        feed = undefined;
-    }
-    if (!feed) {
-        feed = {
-            sessionId,
-            stream,
-            next: from,
-            observers: new Set(),
-            read: new AbortController(),
-        };
-        hub.feeds.set(sessionId, feed);
-        runFeed(ctx, feed);
-    }
-    else if (from < feed.next) {
-        // Behind the shared read: restart it here; observers ahead skip what they have.
-        feed.read.abort();
-        feed.read = new AbortController();
-        feed.next = from;
-        runFeed(ctx, feed);
-    }
-    const joined = feed;
-    joined.observers.add(observer);
-    openSse(request, response, () => leave(hub, joined, observer));
-}
-function leave(hub, feed, observer) {
-    feed.observers.delete(observer);
-    if (feed.observers.size > 0)
-        return;
-    feed.read.abort();
-    if (hub.feeds.get(feed.sessionId) === feed)
-        hub.feeds.delete(feed.sessionId);
-}
-function deliver(observer, record) {
-    if (record.seq < observer.next)
-        return;
-    observer.next = record.seq + 1;
-    send(observer.response, frame(record.body));
-}
-/**
- * Follows the feed's stream from `feed.next` for the current `feed.read`, retrying failed
- * reads from where it stopped while the session still has that stream. A read that ends by
- * itself (the stream's Tenant is gone or the streams closed), or a session that is gone or
- * has a new incarnation, ends the observers.
- */
-function runFeed(ctx, feed) {
-    const read = feed.read;
-    const signal = read.signal;
-    void (async () => {
-        let delay = RETRY_MIN_MS;
-        while (!signal.aborted) {
-            const streams = ctx.live.wiring?.streams;
-            if (!streams)
-                break;
-            try {
-                for await (const record of streams.read(ctx.config.tenantId, feed.stream, feed.next, { signal })) {
-                    // A restart replaced this read: the new one owns `feed.next`.
-                    if (signal.aborted || feed.read !== read)
-                        return;
-                    if (record.seq < feed.next)
-                        continue;
-                    feed.next = record.seq + 1;
-                    delay = RETRY_MIN_MS;
-                    for (const observer of feed.observers)
-                        deliver(observer, record);
-                }
-                if (signal.aborted)
-                    return;
-                break;
-            }
-            catch (error) {
-                if (signal.aborted)
-                    return;
-                ctx.config.logger.warn("session stream read failed; retrying", {
-                    sessionId: feed.sessionId,
-                    message: error instanceof Error ? error.message : String(error),
-                });
-            }
-            if (!(await stillCurrent(ctx, feed)))
-                break;
-            await sleep(delay, signal);
-            delay = Math.min(delay * 2, RETRY_MAX_MS);
-        }
-        if (signal.aborted || feed.read !== read)
-            return;
-        endFeed(ctx.live, feed);
-    })();
-}
-/** False when the feed's session is gone or has a new incarnation. True when unsure. */
-async function stillCurrent(ctx, feed) {
-    try {
-        return (await currentStream(ctx, feed.sessionId)) === feed.stream;
-    }
-    catch {
-        return true;
-    }
-}
-/**
- * Ends every feed in this process whose session is gone or has a new incarnation. Run on a
- * `sessions.reset` signal and periodically, so feeds on nodes other than the one that reset
- * the Tenant end too.
- */
-export async function checkFeeds(ctx) {
-    const feeds = [...ctx.live.feeds.values()];
-    if (feeds.length === 0)
-        return;
-    const current = await ctx.store.tx(async (t) => {
-        const streams = new Map();
-        for (const feed of feeds) {
-            const session = await t.get("sessions", feed.sessionId);
-            streams.set(feed.sessionId, session && streamOfSession(session));
-        }
-        return streams;
-    });
-    for (const feed of feeds)
-        if (ctx.live.feeds.get(feed.sessionId) === feed &&
-            current.get(feed.sessionId) !== feed.stream)
-            endFeed(ctx.live, feed);
-}
-function endFeed(hub, feed) {
-    feed.read.abort();
-    if (hub.feeds.get(feed.sessionId) === feed)
-        hub.feeds.delete(feed.sessionId);
-    for (const observer of feed.observers)
-        observer.response.end();
-    feed.observers.clear();
-}
-/** `GET /v1/executors/connect`: an executor's work stream, primed with one `work_available`. */
-export function streamExecutorWork(hub, request, response, tokenHash) {
-    let streams = hub.executorStreams.get(tokenHash);
-    if (!streams)
-        hub.executorStreams.set(tokenHash, (streams = new Set()));
-    const set = streams;
-    set.add(response);
-    openSse(request, response, () => {
-        set.delete(response);
-        if (!set.size && hub.executorStreams.get(tokenHash) === set)
-            hub.executorStreams.delete(tokenHash);
-    });
-    send(response, WORK_AVAILABLE);
-}
-/** Called by the `tenant/work` reader for each signal: wake every connected executor. */
-export function announceWork(hub) {
-    for (const streams of hub.executorStreams.values())
-        for (const response of streams)
-            send(response, WORK_AVAILABLE);
-}
-export function executorConnected(hub, tokenHash) {
-    return (hub.executorStreams.get(tokenHash)?.size ?? 0) > 0;
-}
-export function connectedExecutorCount(hub) {
-    return [...hub.executorStreams.values()].filter((set) => set.size > 0)
-        .length;
-}
-/** End the streams a token owns (rotation or deregistration). */
-export function endExecutorStreams(hub, tokenHash) {
-    for (const r of hub.executorStreams.get(tokenHash) ?? [])
-        r.end();
-    hub.executorStreams.delete(tokenHash);
-}
-/** Reset or close: end every session observer and stop every shared read. */
-export function clearObservers(hub) {
-    for (const feed of [...hub.feeds.values()])
-        endFeed(hub, feed);
-    hub.feeds.clear();
-}
-/** Reset: end and forget every executor stream. */
-export function clearExecutorStreams(hub) {
-    for (const streams of hub.executorStreams.values())
-        for (const r of streams)
-            r.end();
-    hub.executorStreams.clear();
-}
-/** Close: end every executor stream, then every session observer. */
-export function endAllStreams(hub) {
-    clearExecutorStreams(hub);
-    clearObservers(hub);
-}
-export function sleep(ms, signal) {
-    return new Promise((resolve) => {
-        if (signal.aborted)
-            return resolve();
-        const done = () => {
-            clearTimeout(timer);
-            signal.removeEventListener("abort", done);
-            resolve();
-        };
-        const timer = setTimeout(done, ms);
-        signal.addEventListener("abort", done, { once: true });
-    });
-}

package/dist/tenant/quarantine-error.d.ts

@@ -1,6 +0,0 @@
-import type { Quarantine } from "./types.js";
-/** Typed quarantine raised while opening a Tenant Runtime (A7). */
-export declare class QuarantineError extends Error {
-    readonly quarantine: Quarantine;
-    constructor(code: Quarantine["code"], message: string, repair?: string);
-}

package/dist/tenant/quarantine-error.js

@@ -1,9 +0,0 @@
-/** Typed quarantine raised while opening a Tenant Runtime (A7). */
-export class QuarantineError extends Error {
-    quarantine;
-    constructor(code, message, repair = "nylo tenant status") {
-        super(message);
-        this.name = "QuarantineError";
-        this.quarantine = { code, message, repair };
-    }
-}

package/dist/tenant/quarantine.d.ts

@@ -1,27 +0,0 @@
-import type { Quarantine } from "./types.js";
-/** Typed quarantine failure thrown by stores and migration. */
-export declare class QuarantineError extends Error implements Quarantine {
-    readonly code: Quarantine["code"];
-    readonly repair: string;
-    constructor(fields: Quarantine);
-    toQuarantine(): Quarantine;
-}
-export declare function isQuarantineError(error: unknown): error is QuarantineError;
-export declare function asQuarantine(error: unknown): Quarantine | undefined;
-/** CLI-facing repair strings for every quarantine code (B9). */
-export declare function repairFor(code: Quarantine["code"], detail?: {
-    tenantId?: string;
-}): string;
-export declare function quarantine(code: Quarantine["code"], message: string, detail?: {
-    tenantId?: string;
-}): QuarantineError;
-/** Conflict when create bootstrap material does not match an existing Tenant (HTTP 409). */
-export declare class TenantConflictError extends Error {
-    readonly statusCode: 409;
-    constructor(message?: string);
-}
-/** Delete refused because the Tenant still has live work (HTTP 409). */
-export declare class TenantBusyError extends Error {
-    readonly statusCode: 409;
-    constructor(message?: string);
-}

package/dist/tenant/quarantine.js

@@ -1,72 +0,0 @@
-/** Typed quarantine failure thrown by stores and migration. */
-export class QuarantineError extends Error {
-    code;
-    repair;
-    constructor(fields) {
-        super(fields.message);
-        this.name = "QuarantineError";
-        this.code = fields.code;
-        this.repair = fields.repair;
-    }
-    toQuarantine() {
-        return { code: this.code, message: this.message, repair: this.repair };
-    }
-}
-export function isQuarantineError(error) {
-    return error instanceof QuarantineError;
-}
-export function asQuarantine(error) {
-    if (isQuarantineError(error))
-        return error.toQuarantine();
-    if (error &&
-        typeof error === "object" &&
-        "code" in error &&
-        "message" in error &&
-        "repair" in error) {
-        return error;
-    }
-    return undefined;
-}
-/** CLI-facing repair strings for every quarantine code (B9). */
-export function repairFor(code, detail = {}) {
-    const id = detail.tenantId ? ` ${detail.tenantId}` : "";
-    switch (code) {
-        case "kek-missing":
-            return `nylo tenant status${id} — restore vault-kek for this Tenant (ciphertext cannot be opened without it)`;
-        case "corrupt":
-            return `nylo tenant status${id} — restore the Tenant from backup`;
-        case "schema-too-new":
-            return `nylo tenant status${id} — the Tenant was migrated by a newer Runtime; run that version or newer`;
-        case "migration-failed":
-            return `nylo tenant status${id} — inspect the Runtime log for the failed migration, fix it, then restart the Runtime`;
-        case "envelope-invalid":
-            return `nylo tenant status${id} — the Tenant envelope is missing or invalid; restore the Tenant from backup`;
-        case "open-timeout":
-            return `nylo tenant status${id} — open timed out; inspect the Runtime log and Postgres, then retry`;
-        case "open-failed":
-            return `nylo tenant status${id} — inspect Tenant logs and repair before the Host retries open`;
-    }
-}
-export function quarantine(code, message, detail = {}) {
-    return new QuarantineError({
-        code,
-        message,
-        repair: repairFor(code, detail),
-    });
-}
-/** Conflict when create bootstrap material does not match an existing Tenant (HTTP 409). */
-export class TenantConflictError extends Error {
-    statusCode = 409;
-    constructor(message = "Tenant already exists with different bootstrap material") {
-        super(message);
-        this.name = "TenantConflictError";
-    }
-}
-/** Delete refused because the Tenant still has live work (HTTP 409). */
-export class TenantBusyError extends Error {
-    statusCode = 409;
-    constructor(message = "Tenant has live work; pass activeWork=drain|cancel or retry later") {
-        super(message);
-        this.name = "TenantBusyError";
-    }
-}

package/dist/tenant/routes-tenant.d.ts

@@ -1,12 +0,0 @@
-/**
- * Tenant administration and vault routes: `/v1/tenant` (status, reset, config seed, host
- * model and providers, sandbox report) and `/v1/vaults` (vaults and credentials).
- * A reset that deletes sessions abandons their streams (a session created again gets a new
- * incarnation) and collects them afterwards; it never deletes the Tenant's basin.
- *
- * Later waves: Wave 2 / X changes what reset clears once work leaves process memory.
- */
-import type { IncomingMessage } from "node:http";
-import type { AuthScope, TenantContext } from "./context.js";
-export declare function dispatchTenant(ctx: TenantContext, scope: AuthScope, method: string | undefined, path: string[], request: IncomingMessage): Promise<unknown>;
-export declare function dispatchVault(ctx: TenantContext, scope: AuthScope, method: string | undefined, path: string[], url: URL, request: IncomingMessage): Promise<unknown>;

package/dist/tenant/routes-tenant.js

@@ -1,137 +0,0 @@
-import { CreateCredentialRequestSchema, CreateVaultRequestSchema, PutHostModelRequestSchema, ResetTenantRequestSchema, RotateCredentialRequestSchema, SeedTenantConfigRequestSchema, SelectHostModelRequestSchema, } from "@nylorun/core/contracts";
-import { hostModelCatalog } from "../model/catalog.js";
-import { resetTenant } from "./reset.js";
-import { buildTenantStatus, seedTenantConfig } from "./status.js";
-import { ownerOf } from "./auth.js";
-import { fail, readBody } from "./http.js";
-import { clearExecutorStreams, clearObservers } from "./live.js";
-import { requestStreamCollection, sessionStreamsAbandoned, streamsStatus, } from "./streams.js";
-import { clearWork, drain } from "./scheduler.js";
-import { usesFixtureModel } from "./model-setting.js";
-export async function dispatchTenant(ctx, scope, method, path, request) {
-    const { vault } = ctx;
-    // A subject reaches only the routes `authorize` allowed its scopes.
-    if (scope.kind === "executor") {
-        await vault.reject(path.join("/"));
-        fail(403, "Application credential required");
-    }
-    if (path.length === 2 && method === "GET")
-        return await buildTenantStatus({
-            envelope: ctx.envelope,
-            config: ctx.config,
-            store: ctx.store,
-            registry: ctx.registry,
-            vault,
-            sandbox: ctx.sandbox,
-            closing: ctx.closing || ctx.closed,
-            modelConfigured: !ctx.useVaultModel ||
-                (await ctx.store.tx((t) => usesFixtureModel(t))) ||
-                (await vault.getHostModel()).configured,
-            executorStreams: ctx.live.executorStreams,
-            ...(ctx.stuckInvocations
-                ? { stuckInvocations: ctx.stuckInvocations }
-                : {}),
-            streamsStatus: () => streamsStatus(ctx),
-        });
-    if (path[2] === "reset" && path.length === 3 && method === "POST") {
-        const body = ResetTenantRequestSchema.parse(await readBody(request));
-        await drain(ctx, body.activeWork, 30_000);
-        // The deleted sessions' streams are abandoned: a session created again with the same id,
-        // during or after the reset, gets a new incarnation and starts at sequence 0. The pending
-        // collection is recorded first, so a crash before it runs leaves it to the sweep.
-        const sessionsReset = body.scope !== "sandboxes";
-        if (sessionsReset)
-            await requestStreamCollection(ctx);
-        await resetTenant({
-            store: ctx.store,
-            registry: ctx.registry,
-            sandbox: ctx.sandbox,
-            paths: ctx.config.paths,
-            clearSessionState: () => {
-                clearWork(ctx);
-                clearObservers(ctx.live);
-            },
-            clearExecutorStreams: () => clearExecutorStreams(ctx.live),
-        }, body.scope);
-        if (sessionsReset)
-            sessionStreamsAbandoned(ctx);
-        // Reset leaves the Tenant open for new work.
-        ctx.closing = false;
-        return { ok: true };
-    }
-    if (path[2] === "config" &&
-        path[3] === "seed" &&
-        path.length === 4 &&
-        method === "PUT") {
-        const body = SeedTenantConfigRequestSchema.parse(await readBody(request));
-        return await seedTenantConfig({ store: ctx.store, vault }, body);
-    }
-    if (path[2] === "models" && path.length === 3 && method === "GET")
-        return hostModelCatalog();
-    if (path[2] === "sandbox" && path.length === 3 && method === "GET")
-        return ctx.sandbox.report();
-    if (path[2] === "providers" && path.length === 3 && method === "GET")
-        return vault.listHostProviders();
-    if (path[2] === "model" && path.length === 3 && method === "GET")
-        return vault.getHostModel();
-    if (path[2] === "model" && path.length === 3 && method === "PUT")
-        return vault.putHostModel(PutHostModelRequestSchema.parse(await readBody(request)));
-    if (path[2] === "model" &&
-        path[3] === "selection" &&
-        path.length === 4 &&
-        method === "PUT")
-        return vault.selectHostModel(SelectHostModelRequestSchema.parse(await readBody(request)));
-    fail(404, "Route not found");
-}
-export async function dispatchVault(ctx, scope, method, path, url, request) {
-    const { vault } = ctx;
-    if (scope.kind === "executor") {
-        await vault.reject(path.join("/"));
-        fail(403, "Application credential required");
-    }
-    // Acting for a subject: only the subject's own vaults, and never on another's behalf.
-    const owner = ownerOf(scope);
-    if (path.length === 2 && method === "POST") {
-        const body = CreateVaultRequestSchema.parse(await readBody(request));
-        if (owner !== undefined && body.ownerUserId !== owner)
-            fail(403, "ownerUserId must be the subject");
-        return vault.createVault(body);
-    }
-    if (path.length === 2 && method === "GET") {
-        const ownerUserId = url.searchParams.get("ownerUserId") ??
-            owner ??
-            fail(400, "ownerUserId is required");
-        if (owner !== undefined && ownerUserId !== owner)
-            fail(403, "ownerUserId must be the subject");
-        return { vaults: await vault.listVaults(ownerUserId) };
-    }
-    const vaultId = path[2];
-    if (!vaultId)
-        fail(404, "Vault not found");
-    if (owner !== undefined)
-        await vault.assertOwner(vaultId, owner);
-    if (path.length === 3 && method === "GET")
-        return vault.getVault(vaultId);
-    if (path.length === 3 && method === "DELETE")
-        return vault.deleteVault(vaultId);
-    if (path[3] !== "credentials")
-        fail(404, "Route not found");
-    if (path.length === 4 && method === "POST") {
-        const body = CreateCredentialRequestSchema.parse(await readBody(request));
-        return vault.createCredential(vaultId, body);
-    }
-    if (path.length === 4 && method === "GET")
-        return { credentials: await vault.listCredentials(vaultId) };
-    const credentialId = path[4];
-    if (!credentialId)
-        fail(404, "Credential not found");
-    if (path.length === 5 && method === "GET")
-        return vault.getCredential(vaultId, credentialId);
-    if (path.length === 5 && method === "POST") {
-        const body = RotateCredentialRequestSchema.parse(await readBody(request));
-        return vault.rotateCredential(vaultId, credentialId, body);
-    }
-    if (path.length === 5 && method === "DELETE")
-        return vault.deleteCredential(vaultId, credentialId);
-    fail(404, "Route not found");
-}

package/dist/tenant/routes.d.ts

@@ -1,9 +0,0 @@
-/**
- * The Tenant HTTP router: authenticates the bearer token, matches `/v1/...` routes and
- * delegates to the service modules (commands, actions, sessions, live, routes-tenant). It
- * maps typed errors to responses and owns no business logic of its own. History, SSE and
- * executor work streams read Durable Streams (`live.ts`).
- */
-import type { IncomingMessage, ServerResponse } from "node:http";
-import { type TenantContext } from "./context.js";
-export declare function handle(ctx: TenantContext, request: IncomingMessage, response: ServerResponse, _url?: URL): Promise<void>;