@nylorun/runtime 0.6.0-beta → 0.8.0-beta

package/dist/vault/url.d.ts

@@ -0,0 +1,3 @@
+export declare function normalizeVaultUrl(input: string, options?: {
+    httpsOnly?: boolean;
+}): string;

package/dist/vault/url.js

@@ -0,0 +1,27 @@
+import { VaultError } from "./error.js";
+export function normalizeVaultUrl(input, options = {}) {
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch {
+        throw new VaultError(400, "Credential url is invalid");
+    }
+    if (url.username !== "" || url.password !== "")
+        throw new VaultError(400, "Credential url must not contain userinfo");
+    if (url.hash !== "")
+        throw new VaultError(400, "Credential url must not contain a fragment");
+    if (url.hostname.includes("*") || url.pathname.includes("*"))
+        throw new VaultError(400, "Credential url must not contain a wildcard");
+    if (options.httpsOnly) {
+        if (url.protocol !== "https:")
+            throw new VaultError(400, "Credential url must use https");
+    }
+    else if (url.protocol !== "https:" && url.protocol !== "http:") {
+        throw new VaultError(400, "Credential url must use http or https");
+    }
+    if ((url.protocol === "https:" && url.port === "443") ||
+        (url.protocol === "http:" && url.port === "80"))
+        url.port = "";
+    return `${url.origin}${url.pathname}${url.search}`;
+}

package/dist/version.d.ts

@@ -0,0 +1 @@
+export declare const RUNTIME_VERSION = "0.8.0-beta";

package/dist/version.js

@@ -0,0 +1,3 @@
+// Kept in step with package.json by runtime/scripts/check-package.mjs, which runs in npm run check.
+// release:prepare also rewrites this when it bumps @nylorun/runtime.
+export const RUNTIME_VERSION = "0.8.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.6.0-beta",
+  "version": "0.8.0-beta",
   "description": "SQLite agent execution host and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -29,7 +29,8 @@
     "./configuration": {
       "types": "./dist/configuration.d.ts",
       "import": "./dist/configuration.js"
-    }
+    },
+    "./package.json": "./package.json"
   },
   "files": [
     "dist",
@@ -51,16 +52,21 @@
     "start": "node dist/core/main.js"
   },
   "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "@earendil-works/pi-ai": "0.85.1",
     "@hono/node-server": "^2.1.1",
-    "@nylorun/harness": "0.15.0-beta",
-    "@nylorun/core": "0.1.1-beta"
+    "@nylorun/harness": "0.17.0-beta",
+    "@nylorun/core": "0.3.0-beta",
+    "just-bash": "3.4.2"
+  },
+  "optionalDependencies": {
+    "microsandbox": "0.7.2"
   },
   "devDependencies": {
     "@types/node": "^26.5.0",
     "@typescript/native": "npm:typescript@^7.0.2",
-    "hono": "^4.13.7",
+    "hono": "^4.13.8",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "vitest": "^5.0.0"
+    "vitest": "^5.0.1"
   }
 }

package/dist/config.d.ts

@@ -1,20 +0,0 @@
-import type { ModelAdapter } from "@nylorun/core/define";
-import type { SessionStore } from "./sessions/store.js";
-import type { RuntimeMedia } from "./media.js";
-import type { ModelEnvironment } from "./model/http-model.js";
-export interface RuntimeConfig {
-    readonly onModelCall?: ModelAdapter;
-    readonly createModel?: (options: import("./model/defaults.js").ModelFactoryOptions) => ModelAdapter;
-    readonly observer?: (event: {
-        readonly type: string;
-    }) => void | Promise<void>;
-    readonly sessions?: SessionStore;
-    readonly media?: RuntimeMedia;
-    readonly environment?: ModelEnvironment;
-    readonly tokens?: boolean;
-    readonly delivery?: {
-        readonly previewBytes?: number;
-        readonly eventBytes?: number;
-        readonly eventCount?: number;
-    };
-}

package/dist/model/defaults.d.ts

@@ -1,17 +0,0 @@
-import type { ModelAdapter } from "@nylorun/core/define";
-import { type ModelEnvironment } from "./http-model.js";
-export interface ModelPreview {
-    readonly invocationId: string;
-    readonly text: string;
-}
-export interface ModelFactoryOptions {
-    readonly environment?: ModelEnvironment;
-    readonly media?: import("../media.js").RuntimeMedia;
-    readonly onPreview?: (preview: ModelPreview) => void;
-}
-/** Installed only by the Node launcher before application imports. */
-export declare function installNodeModelFactory(factory: (options: ModelFactoryOptions) => ModelAdapter): void;
-export declare function defaultModel(options: ModelFactoryOptions): ModelAdapter;
-export declare function processEnvironment(): ModelEnvironment;
-export declare function installRuntimeLifecycle(register: (close: () => Promise<void>) => void): void;
-export declare function registerRuntimeLifecycle(close: () => Promise<void>): void;

package/dist/model/defaults.js

@@ -1,21 +0,0 @@
-import { httpModel } from "./http-model.js";
-let nodeFactory;
-/** Installed only by the Node launcher before application imports. */
-export function installNodeModelFactory(factory) {
-    nodeFactory = factory;
-}
-export function defaultModel(options) {
-    return options.environment === undefined && nodeFactory
-        ? nodeFactory(options)
-        : httpModel(options);
-}
-export function processEnvironment() {
-    return typeof process === "undefined" ? {} : process.env;
-}
-let runtimeLifecycle;
-export function installRuntimeLifecycle(register) {
-    runtimeLifecycle = register;
-}
-export function registerRuntimeLifecycle(close) {
-    runtimeLifecycle?.(close);
-}

package/dist/model/http-model.d.ts

@@ -1,12 +0,0 @@
-import type { ModelAdapter } from "@nylorun/core/define";
-import type { ModelFactoryOptions } from "./defaults.js";
-export type ModelEnvironment = Readonly<Record<string, string | undefined>>;
-export interface HttpModelOptions extends ModelFactoryOptions {
-    readonly provider?: "openai" | "custom" | "anthropic";
-    readonly model?: string;
-    readonly apiKey?: string;
-    readonly baseUrl?: string;
-    readonly fetch?: typeof fetch;
-}
-/** Fetch-only adapter for OpenAI-compatible and Anthropic HTTP endpoints. */
-export declare function httpModel(options?: HttpModelOptions): ModelAdapter;

package/dist/model/http-model.js

@@ -1,299 +0,0 @@
-/** Fetch-only adapter for OpenAI-compatible and Anthropic HTTP endpoints. */
-export function httpModel(options = {}) {
-    return async (call, context) => {
-        const env = options.environment ??
-            (typeof process === "undefined" ? {} : process.env);
-        const provider = options.provider ?? env.MODEL_PROVIDER;
-        const model = call.model?.id ?? options.model ?? env.MODEL;
-        const baseUrl = options.baseUrl ?? env.MODEL_PROVIDER_BASE_URL;
-        if (!provider || !model)
-            throw new Error("Set both MODEL_PROVIDER and MODEL, or supply a model adapter.");
-        if (!["openai", "custom", "anthropic"].includes(provider))
-            throw new Error(`The portable HTTP adapter does not support '${provider}'. Supply onModelCall or use the Node piModel adapter.`);
-        if (provider === "custom" && !baseUrl)
-            throw new Error("MODEL_PROVIDER=custom requires MODEL_PROVIDER_BASE_URL.");
-        const apiKey = options.apiKey ??
-            env.MODEL_PROVIDER_API_KEY ??
-            (provider === "anthropic" ? env.ANTHROPIC_API_KEY : env.OPENAI_API_KEY);
-        if (!apiKey)
-            throw new Error("Set MODEL_PROVIDER_API_KEY or the provider-native API key variable.");
-        const text = (parts) => parts
-            .flatMap((part) => (part.type === "text" ? [part.text] : []))
-            .join("\n");
-        if (call.prompt.some((item) => item.content.some((part) => part.type === "media")))
-            throw new Error("Supply a media-aware model adapter for media inputs.");
-        context.signal.throwIfAborted();
-        let body;
-        let url;
-        let headers;
-        const streaming = provider !== "anthropic" && options.onPreview !== undefined;
-        if (provider === "anthropic") {
-            const messages = call.prompt
-                .filter((item) => item.kind !== "instructions")
-                .map((item) => {
-                if (item.kind === "tool-result")
-                    return {
-                        role: "user",
-                        content: [
-                            {
-                                type: "tool_result",
-                                tool_use_id: item.toolCallId,
-                                content: text(item.content),
-                                is_error: item.status !== "completed",
-                            },
-                        ],
-                    };
-                return {
-                    role: item.role === "assistant" ? "assistant" : "user",
-                    content: item.content.flatMap((part) => part.type === "tool-call"
-                        ? [
-                            {
-                                type: "tool_use",
-                                id: part.id,
-                                name: part.name,
-                                input: part.args,
-                            },
-                        ]
-                        : part.type === "text"
-                            ? [{ type: "text", text: part.text }]
-                            : []),
-                };
-            });
-            body = {
-                model,
-                messages,
-                max_tokens: call.model?.controls?.maxOutputTokens ?? 4096,
-                system: call.prompt
-                    .filter((item) => item.kind === "instructions")
-                    .map((item) => text(item.content))
-                    .join("\n"),
-                ...(call.tools.length
-                    ? {
-                        tools: call.tools.map((tool) => ({
-                            name: tool.name,
-                            description: tool.description ?? "",
-                            input_schema: tool.inputSchema,
-                        })),
-                    }
-                    : {}),
-                ...(call.outputSchema
-                    ? {
-                        output_config: {
-                            format: { type: "json_schema", schema: call.outputSchema },
-                        },
-                    }
-                    : {}),
-                ...(call.model?.controls?.temperature === undefined
-                    ? {}
-                    : { temperature: call.model.controls.temperature }),
-            };
-            url = `${(baseUrl ?? "https://api.anthropic.com").replace(/\/$/, "")}/v1/messages`;
-            headers = {
-                "content-type": "application/json",
-                "x-api-key": apiKey,
-                "anthropic-version": "2023-06-01",
-            };
-        }
-        else {
-            const messages = call.prompt.map((item) => {
-                if (item.kind === "tool-result")
-                    return {
-                        role: "tool",
-                        tool_call_id: item.toolCallId,
-                        content: text(item.content),
-                    };
-                const calls = item.content
-                    .filter((part) => part.type === "tool-call")
-                    .map((part) => ({
-                    id: part.id,
-                    type: "function",
-                    function: { name: part.name, arguments: JSON.stringify(part.args) },
-                }));
-                return {
-                    role: item.kind === "instructions" ? "system" : item.role,
-                    content: text(item.content),
-                    ...(calls.length ? { tool_calls: calls } : {}),
-                };
-            });
-            body = {
-                model,
-                messages,
-                stream: streaming,
-                ...(call.tools.length
-                    ? {
-                        tools: call.tools.map((tool) => ({
-                            type: "function",
-                            function: {
-                                name: tool.name,
-                                description: tool.description,
-                                parameters: tool.inputSchema,
-                            },
-                        })),
-                    }
-                    : {}),
-                ...(call.outputSchema
-                    ? {
-                        response_format: {
-                            type: "json_schema",
-                            json_schema: {
-                                name: "agent_output",
-                                strict: true,
-                                schema: call.outputSchema,
-                            },
-                        },
-                    }
-                    : {}),
-                ...(call.model?.controls?.temperature === undefined
-                    ? {}
-                    : { temperature: call.model.controls.temperature }),
-                ...(call.model?.controls?.maxOutputTokens === undefined
-                    ? {}
-                    : { max_completion_tokens: call.model.controls.maxOutputTokens }),
-            };
-            url = `${(baseUrl ?? "https://api.openai.com/v1").replace(/\/$/, "")}/chat/completions`;
-            headers = {
-                "content-type": "application/json",
-                authorization: `Bearer ${apiKey}`,
-            };
-        }
-        if (!["https:", "http:"].includes(new URL(url).protocol))
-            throw new Error("Model endpoint must use HTTP(S).");
-        context.reportPreparedCall?.({
-            adapter: "runtime.http",
-            call: JSON.parse(JSON.stringify(body)),
-        });
-        const response = await (options.fetch ?? fetch)(url, {
-            method: "POST",
-            headers,
-            body: JSON.stringify(body),
-            signal: context.signal,
-        });
-        if (!response.ok)
-            throw new Error(`Model provider returned HTTP ${response.status}. Check the selected model, credentials, and endpoint.`);
-        let result;
-        if (streaming)
-            result = await readOpenAIStream(response, (value) => {
-                try {
-                    void Promise.resolve(options.onPreview?.({
-                        invocationId: context.invocationId,
-                        text: value,
-                    })).catch(() => { });
-                }
-                catch {
-                    /* Preview delivery cannot affect generation. */
-                }
-            });
-        else
-            result = await response.json();
-        context.signal.throwIfAborted();
-        const output = [];
-        if (provider === "anthropic") {
-            for (const part of result.content ?? []) {
-                if (part.type === "text")
-                    output.push(call.outputSchema &&
-                        !(result.content ?? []).some((item) => item.type === "tool_use")
-                        ? { type: "json", value: JSON.parse(part.text) }
-                        : { type: "text", text: part.text });
-                if (part.type === "tool_use")
-                    output.push({
-                        type: "tool-call",
-                        id: part.id,
-                        name: part.name,
-                        args: part.input,
-                    });
-            }
-        }
-        else {
-            const message = result.choices?.[0]?.message;
-            if (!message)
-                throw new Error("Model provider returned no message.");
-            if (message.content)
-                output.push(call.outputSchema && !message.tool_calls?.length
-                    ? { type: "json", value: JSON.parse(message.content) }
-                    : { type: "text", text: message.content });
-            for (const tool of message.tool_calls ?? [])
-                output.push({
-                    type: "tool-call",
-                    id: tool.id,
-                    name: tool.function.name,
-                    args: JSON.parse(tool.function.arguments),
-                });
-        }
-        return { output, evidence: { resolvedModel: result.model ?? model } };
-    };
-}
-async function readOpenAIStream(response, preview) {
-    if (!response.body)
-        throw new Error("Model provider returned no stream.");
-    const reader = response.body.getReader();
-    const decoder = new TextDecoder();
-    let buffer = "", content = "", complete = false;
-    const calls = new Map();
-    const line = (value) => {
-        if (!value.startsWith("data:"))
-            return;
-        const data = value.slice(5).trim();
-        if (data === "[DONE]") {
-            complete = true;
-            return;
-        }
-        if (!data)
-            return;
-        const chunk = JSON.parse(data);
-        if (chunk.error)
-            throw new Error("Model provider reported a streaming error.");
-        const delta = chunk.choices?.[0]?.delta;
-        if (typeof delta?.content === "string") {
-            content += delta.content;
-            preview(delta.content);
-        }
-        for (const tool of delta?.tool_calls ?? []) {
-            const target = calls.get(tool.index) ?? {
-                id: "",
-                type: "function",
-                function: { name: "", arguments: "" },
-            };
-            if (tool.id)
-                target.id = tool.id;
-            if (tool.function?.name)
-                target.function.name += tool.function.name;
-            if (tool.function?.arguments)
-                target.function.arguments += tool.function.arguments;
-            calls.set(tool.index, target);
-        }
-    };
-    try {
-        while (!complete) {
-            const next = await reader.read();
-            buffer += decoder.decode(next.value, { stream: !next.done });
-            let end;
-            while ((end = buffer.indexOf("\n")) >= 0) {
-                line(buffer.slice(0, end).replace(/\r$/, ""));
-                buffer = buffer.slice(end + 1);
-            }
-            if (next.done) {
-                if (buffer)
-                    line(buffer);
-                break;
-            }
-        }
-        if (!complete)
-            throw new Error("Model stream ended before completion.");
-        return {
-            choices: [
-                {
-                    message: {
-                        content,
-                        tool_calls: [...calls]
-                            .sort(([a], [b]) => a - b)
-                            .map(([, value]) => value),
-                    },
-                },
-            ],
-        };
-    }
-    finally {
-        await reader.cancel().catch(() => { });
-        reader.releaseLock();
-    }
-}

package/dist/node/local-sessions.d.ts

@@ -1,5 +0,0 @@
-import { type ManagedSessionStore } from "../sessions/store.js";
-/** Single-owner local disk store. No lease stealing, replay, or shared-filesystem guarantee. */
-export declare function localSessions(options: {
-    root: string;
-}): ManagedSessionStore;

package/dist/node/local-sessions.js

@@ -1,174 +0,0 @@
-import { mkdir, open, readFile, readdir, rename, rm, realpath, } from "node:fs/promises";
-import { resolve, join } from "node:path";
-import { randomUUID } from "node:crypto";
-import { sessionSummary, } from "../sessions/store.js";
-/** Single-owner local disk store. No lease stealing, replay, or shared-filesystem guarantee. */
-export function localSessions(options) {
-    let closed = false;
-    let directory;
-    const token = randomUUID();
-    const acquired = (async () => {
-        await mkdir(resolve(options.root), { recursive: true, mode: 0o700 });
-        directory = await realpath(resolve(options.root));
-        const path = join(directory, ".owner.lock");
-        let handle;
-        try {
-            handle = await open(path, "wx", 0o600);
-        }
-        catch (cause) {
-            throw new Error(`Session store ${directory} already has an owner. Stop the owner before opening it again. After a crash, confirm it has stopped and manually remove .owner.lock.`, { cause });
-        }
-        try {
-            await handle.writeFile(JSON.stringify({ token, pid: process.pid }));
-            await handle.sync();
-        }
-        finally {
-            await handle.close();
-        }
-    })();
-    void acquired.catch(() => { });
-    let operations = Promise.resolve();
-    const check = async () => {
-        await acquired;
-        if (closed)
-            throw new Error("Session store is closed");
-        const owner = JSON.parse(await readFile(join(directory, ".owner.lock"), "utf8"));
-        if (owner.token !== token)
-            throw new Error("Session store ownership was lost; refusing further writes");
-    };
-    const pathFor = (agentId, sessionId) => join(directory, safe(agentId), `${safe(sessionId)}.json`);
-    const get = async (agentId, sessionId) => {
-        await check();
-        try {
-            const value = JSON.parse(await readFile(pathFor(agentId, sessionId), "utf8"));
-            if (value.version !== 1 ||
-                value.id !== sessionId ||
-                value.agentId !== agentId ||
-                !Array.isArray(value.events))
-                throw new Error("Invalid stored session document");
-            return value;
-        }
-        catch (error) {
-            if (!isMissing(error))
-                throw error;
-            try {
-                const contents = await readFile(join(directory, safe(agentId), safe(sessionId), "events.jsonl"), "utf8");
-                const events = contents
-                    .split("\n")
-                    .filter(Boolean)
-                    .map((line) => JSON.parse(line));
-                return {
-                    version: 1,
-                    id: sessionId,
-                    agentId,
-                    status: "archived",
-                    startedAt: events[0] ? Date.parse(events[0].ts) : 0,
-                    updatedAt: 0,
-                    events,
-                };
-            }
-            catch (legacyError) {
-                if (isMissing(legacyError))
-                    return undefined;
-                throw legacyError;
-            }
-        }
-    };
-    return {
-        get,
-        put(agentId, sessionId, session) {
-            const contents = JSON.stringify(session);
-            const operation = operations.then(async () => {
-                await check();
-                if (session.id !== sessionId || session.agentId !== agentId)
-                    throw new Error("Session identity mismatch");
-                const target = pathFor(agentId, sessionId);
-                await mkdir(join(directory, safe(agentId)), {
-                    recursive: true,
-                    mode: 0o700,
-                });
-                const temporary = `${target}.${randomUUID()}.tmp`;
-                try {
-                    const file = await open(temporary, "wx", 0o600);
-                    try {
-                        await file.writeFile(contents);
-                        await file.sync();
-                    }
-                    finally {
-                        await file.close();
-                    }
-                    await check();
-                    await rename(temporary, target);
-                    const parent = await open(join(directory, safe(agentId)), "r");
-                    try {
-                        await parent.sync();
-                    }
-                    finally {
-                        await parent.close();
-                    }
-                }
-                finally {
-                    await rm(temporary, { force: true });
-                }
-            });
-            operations = operation.catch(() => { });
-            return operation;
-        },
-        async list(agentId) {
-            await check();
-            let names;
-            try {
-                names = await readdir(join(directory, safe(agentId)), {
-                    withFileTypes: true,
-                });
-            }
-            catch (error) {
-                if (isMissing(error))
-                    return [];
-                throw error;
-            }
-            const sessions = await Promise.all(names
-                .filter((item) => item.isDirectory() || item.name.endsWith(".json"))
-                .map((item) => get(agentId, item.isDirectory() ? item.name : item.name.slice(0, -5))));
-            return sessions
-                .flatMap((session) => (session ? [sessionSummary(session)] : []))
-                .sort((a, b) => b.startedAt - a.startedAt);
-        },
-        async delete(agentId, sessionId) {
-            const operation = operations.then(async () => {
-                await check();
-                const target = pathFor(agentId, sessionId);
-                try {
-                    await rm(target);
-                    return true;
-                }
-                catch (error) {
-                    if (isMissing(error))
-                        return false;
-                    throw error;
-                }
-            });
-            operations = operation.then(() => { }, () => { });
-            return operation;
-        },
-        async close() {
-            await operations;
-            if (closed)
-                return;
-            await check();
-            closed = true;
-            await rm(join(directory, ".owner.lock"));
-        },
-    };
-}
-function safe(value) {
-    if (value === "." || value === ".." || !/^[a-zA-Z0-9._-]+$/.test(value))
-        throw new Error("Invalid session path identifier");
-    return value;
-}
-function isMissing(error) {
-    return (!!error &&
-        typeof error === "object" &&
-        "code" in error &&
-        error.code === "ENOENT");
-}

package/dist/server/ag-ui.d.ts

@@ -1,8 +0,0 @@
-import type { CanonicalEvent } from "../sessions/store.js";
-/** Minimal truthful AG-UI projection from the same canonical events Studio displays. */
-export declare function agUiEvents(events: readonly CanonicalEvent[], threadId: string, runId: string): readonly Record<string, unknown>[];
-/**
- * Preserve headers installed by the Hono host (notably loopback CORS) when a
- * route returns a raw streaming Response instead of `context.json()`.
- */
-export declare function sse(events: readonly Record<string, unknown>[], inherited?: HeadersInit): Response;