@nylorun/runtime 0.13.0-beta → 0.15.0-beta

package/dist/tenant/routes.js

@@ -1,151 +0,0 @@
-import { PutAgentRequestSchema, PutSessionRequestSchema, RegisterExecutorsRequestSchema, SessionCommandSchema, } from "@nylorun/core/contracts";
-import { VaultError } from "../vault/error.js";
-import { SandboxRouteError, handleSessionSandboxTool, } from "../core/sandbox-routes.js";
-import { loadSession, sessionOf } from "./context.js";
-import { HttpError, OpaqueAuthError, fail, readBody, requestAborted, } from "./http.js";
-import { authenticate, authorize, ownerOf, requireApplication, requirePrincipal, } from "./auth.js";
-import { command } from "./commands.js";
-import { actionSandboxTool, deleteExecutor, listExecutors, listPendingActions, registerExecutors, sandboxRouteDeps, updateAction, } from "./actions.js";
-import { listDefinitions, listSessions, putDefinition, putSession, sessionView, } from "./sessions.js";
-import { readHistory, requestCursor, streamExecutorWork, streamSessionEvents, } from "./live.js";
-import { dispatchTenant, dispatchVault } from "./routes-tenant.js";
-export async function handle(ctx, request, response, _url) {
-    const json = (value, status = 200) => {
-        const payload = JSON.stringify(value);
-        response.writeHead(status, {
-            "content-type": "application/json",
-            "content-length": Buffer.byteLength(payload),
-        });
-        response.end(payload);
-    };
-    try {
-        const url = _url ?? new URL(request.url ?? "/", "http://runtime");
-        const path = url.pathname
-            .split("/")
-            .filter(Boolean)
-            .map(decodeURIComponent);
-        const method = request.method;
-        const scope = await authenticate(ctx, request);
-        if (path[0] !== "v1")
-            fail(404, "Route not found");
-        authorize(scope, method, path);
-        // Set when the request acts for a subject: only the subject's own sessions are reachable.
-        const owner = ownerOf(scope);
-        if (path[1] === "executors" && path[2] === "connect" && method === "GET") {
-            if (scope.kind !== "executor")
-                return fail(403, "Executor credential required");
-            streamExecutorWork(ctx.live, request, response, scope.executor.tokenHash);
-            return;
-        }
-        if (path[1] === "actions") {
-            if (scope.kind !== "executor")
-                return fail(403, "Executor credential required");
-            if (path.length === 2 && method === "GET")
-                return json(await listPendingActions(ctx, scope.executor));
-            const actionId = path[2];
-            if (!actionId)
-                fail(404, "Action not found");
-            if (method === "POST" &&
-                path[3] === "sandbox" &&
-                path[4] &&
-                path.length === 5)
-                return json(await actionSandboxTool(ctx, scope, actionId, path[4], request));
-            const body = await readBody(request);
-            return json(await updateAction(ctx, scope, actionId, method, path[3], body));
-        }
-        if (path[1] === "sessions" &&
-            path[2] &&
-            path[3] === "commands" &&
-            method === "POST")
-            return json(await command(ctx, path[2], SessionCommandSchema.parse(await readBody(request)), scope));
-        if (path[1] === "vaults")
-            return json(await dispatchVault(ctx, scope, method, path, url, request));
-        if (path[1] === "tenant")
-            return json(await dispatchTenant(ctx, scope, method, path, request));
-        const principalId = requirePrincipal(scope);
-        if (path[1] === "executors" && path.length === 2 && method === "GET")
-            return json(listExecutors(ctx));
-        // The length guard matters: the connect branch above only matches GET, so without it a
-        // PUT to /v1/executors/connect would register an agent literally named "connect".
-        if (path[1] === "executors" && path.length === 2 && method === "PUT")
-            return json(await registerExecutors(ctx, principalId, RegisterExecutorsRequestSchema.parse(await readBody(request))));
-        if (path[1] === "executors" &&
-            path.length === 3 &&
-            path[2] &&
-            method === "DELETE")
-            return json(await deleteExecutor(ctx, path[2]));
-        if (path[1] === "agents" && path.length === 2 && method === "GET")
-            return json(await listDefinitions(ctx));
-        if (path[1] === "sessions" && path.length === 2 && method === "GET")
-            return json(await listSessions(ctx, url.searchParams.get("agentId"), owner));
-        if (path[1] === "agents" &&
-            path[2] &&
-            path.length === 3 &&
-            method === "PUT")
-            return json(await putDefinition(ctx, path[2], PutAgentRequestSchema.parse(await readBody(request))));
-        if (path[1] === "sessions" && path[2]) {
-            const id = path[2];
-            if (method === "PUT" && path.length === 3) {
-                const body = PutSessionRequestSchema.parse(await readBody(request));
-                const session = await putSession(ctx, id, body, owner);
-                return json(await ctx.store.tx((t) => sessionView(t, session)));
-            }
-            if (method === "GET" && path.length === 3)
-                return json(await ctx.store.tx(async (t) => sessionView(t, await sessionOf(t, id, owner))));
-            // Every other session route needs the session to exist.
-            await loadSession(ctx, id, owner);
-            const cursor = requestCursor(request, url);
-            if (method === "GET" && path[3] === "items")
-                return json(await readHistory(ctx, id, cursor, url.searchParams.get("agent") ?? undefined));
-            if (method === "GET" && path[3] === "events") {
-                await streamSessionEvents(ctx, request, response, id, cursor);
-                return;
-            }
-            if (method === "POST" &&
-                path[3] === "sandbox" &&
-                path[4] &&
-                path.length === 5) {
-                requireApplication(scope);
-                try {
-                    const outcome = await handleSessionSandboxTool(sandboxRouteDeps(ctx), id, path[4], await readBody(request), requestAborted(request));
-                    return json(outcome);
-                }
-                catch (error) {
-                    if (error instanceof SandboxRouteError)
-                        fail(error.status, error.message);
-                    throw error;
-                }
-            }
-        }
-        fail(404, "Route not found");
-    }
-    catch (error) {
-        if (response.headersSent) {
-            response.end();
-            return;
-        }
-        if (error instanceof OpaqueAuthError) {
-            json(error.body, error.status);
-            return;
-        }
-        const status = error instanceof HttpError ||
-            error instanceof VaultError ||
-            error instanceof SandboxRouteError
-            ? error.status
-            : error?.name === "ZodError" ||
-                error?.message === "Invalid cursor"
-                ? 400
-                : 500;
-        const rejection = error instanceof HttpError ? error.rejection : {};
-        json({
-            status: "rejected",
-            code: status === 500
-                ? "internal_error"
-                : rejection.code ?? "request_rejected",
-            message: status === 500 ? "Runtime request failed" : error.message,
-            ...(rejection.details === undefined
-                ? {}
-                : { details: rejection.details }),
-        }, status);
-    }
-}

package/dist/tenant/store-memory.d.ts

@@ -1,16 +0,0 @@
-import type { SessionStore } from "../store/types.js";
-import { type Logger, type OpenTenantRuntime, type TenantConfig, type TenantStore } from "./types.js";
-export interface MemoryTenantStoreOptions {
-    /** When set, each Tenant's directory under this Host root lives as long as the Tenant. */
-    hostRoot?: string;
-    openRuntime: OpenTenantRuntime;
-    configFor: (tenantId: string) => TenantConfig;
-    logger?: Logger;
-}
-export type MemoryTenantStore = TenantStore & {
-    /** Test helper: current Tenant ids. */
-    ids(): string[];
-    /** Test helper: a Session Store on a Tenant's data, as another process would open it. */
-    sessionStore(id: string): SessionStore;
-};
-export declare function createMemoryTenantStore(options: MemoryTenantStoreOptions): MemoryTenantStore;

package/dist/tenant/store-memory.js

@@ -1,111 +0,0 @@
-/**
- * An in-memory Tenant store for tests: each Tenant is a `MemoryStoreData` (its Session
- * Store's data) and an envelope. It behaves like the Postgres store (`store-pg.ts`): the
- * Tenant directory under the Host root, when one is given, is created with the Tenant and
- * removed with it, and `open` hands the Tenant Runtime a fresh Session Store on the Tenant's
- * data. Not a supported profile.
- */
-import { mkdirSync, rmSync } from "node:fs";
-import { isTenantId } from "@nylorun/core/compatibility";
-import { MEMORY_SCHEMA_VERSION, MemorySessionStore, MemoryStoreData, } from "../store/memory.js";
-import { quarantine } from "./quarantine.js";
-import { parseEnvelope } from "./envelope.js";
-import { tenantPaths } from "./paths.js";
-import { bootstrapPrincipal, bootstrapPrincipalMatches } from "./principals.js";
-import { TenantNotFoundError, } from "./types.js";
-export function createMemoryTenantStore(options) {
-    const records = new Map();
-    function sessionStore(id, data) {
-        return new MemorySessionStore({
-            tenantId: id,
-            onError: (error) => options.logger?.error("post-commit step failed", {
-                message: error instanceof Error ? error.message : String(error),
-            }),
-        }, data);
-    }
-    function makeDirectory(id) {
-        if (!options.hostRoot)
-            return;
-        const p = tenantPaths(options.hostRoot, id);
-        mkdirSync(p.root, { recursive: true, mode: 0o700 });
-        for (const dir of [p.home, p.tmp, p.sandboxes, p.pluginData, p.logs])
-            mkdirSync(dir, { recursive: true });
-    }
-    function removeDirectory(id) {
-        if (options.hostRoot)
-            rmSync(tenantPaths(options.hostRoot, id).root, {
-                recursive: true,
-                force: true,
-            });
-    }
-    async function withStore(id, data, fn) {
-        const store = sessionStore(id, data);
-        try {
-            return await fn(store);
-        }
-        finally {
-            await store.close();
-        }
-    }
-    return {
-        ids() {
-            return [...records.keys()];
-        },
-        sessionStore(id) {
-            const record = records.get(id);
-            if (!record)
-                throw new TenantNotFoundError(id);
-            return sessionStore(id, record.data);
-        },
-        async enumerate() {
-            return [...records.keys()].filter(isTenantId).sort();
-        },
-        async readEnvelope(id) {
-            const record = records.get(id);
-            if (!record)
-                throw new TenantNotFoundError(id);
-            return parseEnvelope(record.envelope, id);
-        },
-        async create(envelope, bootstrap) {
-            const parsed = parseEnvelope({ ...envelope, schemaVersion: MEMORY_SCHEMA_VERSION }, envelope.id);
-            if (records.has(parsed.id))
-                return "exists";
-            makeDirectory(parsed.id);
-            const data = new MemoryStoreData();
-            await withStore(parsed.id, data, (store) => store.tx((t) => bootstrapPrincipal(t, bootstrap)));
-            records.set(parsed.id, { envelope: parsed, data });
-            return "created";
-        },
-        async bootstrapMatches(id, bootstrap) {
-            const record = records.get(id);
-            if (!record)
-                return false;
-            return withStore(id, record.data, (store) => store.tx((t) => bootstrapPrincipalMatches(t, bootstrap)));
-        },
-        async open(id) {
-            const record = records.get(id);
-            if (!record)
-                throw new TenantNotFoundError(id);
-            if (record.envelope.schemaVersion > MEMORY_SCHEMA_VERSION)
-                throw quarantine("schema-too-new", `Tenant schema version ${record.envelope.schemaVersion} is newer than this Runtime's ${MEMORY_SCHEMA_VERSION}`, { tenantId: id });
-            makeDirectory(id);
-            const store = sessionStore(id, record.data);
-            try {
-                return await options.openRuntime({ ...options.configFor(id), tenantId: id }, { store, envelope: record.envelope });
-            }
-            catch (error) {
-                await store.close().catch(() => undefined);
-                throw error;
-            }
-        },
-        async trash(id) {
-            records.delete(id);
-            removeDirectory(id);
-        },
-        async removePartial(id) {
-            if (records.has(id))
-                return;
-            removeDirectory(id);
-        },
-    };
-}