@nyte-ai/host 0.0.0-stage → 0.0.18

package/dist/chunks/canvas-preview-31w7xm8z.js

@@ -0,0 +1,34 @@
+// src/identity.ts
+import { SdkError } from "@nyte-ai/schema";
+var PKCS8_PREFIX = Uint8Array.fromHex("302e020100300506032b657004220420");
+var encoder = new TextEncoder;
+async function seedSigner2(id, seed) {
+  const { signing, publicKey } = await identityKeys(seed);
+  return {
+    id,
+    async sign(nonce) {
+      const signature = new Uint8Array(await crypto.subtle.sign("Ed25519", signing, encoder.encode(`nyte/identity
+${id}
+${nonce}`)));
+      return {
+        hostId: id,
+        nonce,
+        signature: signature.toBase64({ alphabet: "base64url", omitPadding: true }),
+        publicKey
+      };
+    }
+  };
+}
+async function identityKeys(seed) {
+  if (seed.length !== 32)
+    throw new SdkError("invalid", `The identity seed is ${seed.length} bytes, not 32.`);
+  const pkcs8 = new Uint8Array([...PKCS8_PREFIX, ...seed]);
+  const readable = await crypto.subtle.importKey("pkcs8", pkcs8, "Ed25519", true, ["sign"]);
+  const { x } = await crypto.subtle.exportKey("jwk", readable);
+  if (x === undefined)
+    throw new SdkError("internal", "The identity key has no public half.");
+  const signing = await crypto.subtle.importKey("pkcs8", pkcs8, "Ed25519", false, ["sign"]);
+  return { signing, publicKey: x };
+}
+
+export { seedSigner2 };

package/dist/chunks/canvas-preview-4b6sayhg.js

@@ -0,0 +1,295 @@
+import {
+  prefixEnd2,
+  mintRevision2,
+  decodeEvent2,
+  parseNumber2,
+  parseText2,
+  parseRef2,
+  parseStoredRecord2,
+  parseStoredObject2,
+  loggedRow2,
+  collect2,
+  memoryReader2
+} from "./canvas-preview-69fkk9yn.js";
+import {
+  sessionIndexChanges2,
+  sqlSessionIndex2,
+  postgresSessionIndexQuery2
+} from "./canvas-preview-0cmbkp2j.js";
+
+// src/postgres.ts
+import { asSeq } from "@nyte-ai/schema";
+import {
+  admits,
+  fenceNames,
+  assertStoreVersion,
+  blobId,
+  decodeObject,
+  collectSessionEvents,
+  migrateStore,
+  objectId,
+  sessionIndexRef,
+  parseSessionRef
+} from "@nyte-ai/core/store";
+import { Pool } from "pg";
+var MIGRATION_LOCK = "SELECT pg_advisory_xact_lock(hashtextextended('nyte:store', 0))";
+var SHARED_MIGRATION_LOCK = "SELECT pg_advisory_xact_lock_shared(hashtextextended('nyte:store', 0))";
+function postgresStore2(input) {
+  const pool = "pool" in input ? input.pool : new Pool({ connectionString: input.connectionString });
+  let ready = null;
+  return {
+    open() {
+      ready ??= migrateStore(postgresTarget(pool)).then(() => connect(pool), (error) => {
+        ready = null;
+        throw error;
+      });
+      return ready;
+    },
+    async close() {
+      ready = null;
+      if (!("pool" in input))
+        await pool.end();
+    }
+  };
+}
+async function storedVersion(client) {
+  const { rows } = await client.query("SELECT to_regclass('store_meta') IS NOT NULL AS stamped");
+  if (rows[0]?.stamped !== true)
+    return 0;
+  const stamp = await client.query("SELECT version FROM store_meta WHERE id = 1");
+  const version = stamp.rows[0]?.version;
+  return version === undefined ? 0 : parseNumber2(version);
+}
+function postgresTarget(pool) {
+  return {
+    dialect: "postgres",
+    stamp: () => withClient(pool, async (client) => {
+      const version = await storedVersion(client);
+      const { rows } = await client.query("SELECT to_regclass('refs') IS NOT NULL AS present");
+      const empty = rows[0]?.present !== true || (await client.query("SELECT 1 FROM refs LIMIT 1")).rows.length === 0;
+      return { version, empty };
+    }),
+    records: async () => (await withClient(pool, (client) => client.query("SELECT refs.name, refs.target, refs.revision, objects.body FROM refs JOIN objects ON objects.id = refs.target WHERE objects.body IS NOT NULL"))).rows.map(parseStoredRecord2),
+    async* objects(kind) {
+      const { rows } = await withClient(pool, (client) => client.query("SELECT id, body FROM objects WHERE body IS NOT NULL AND strpos(body, $1) > 0", [`"kind":${JSON.stringify(kind)}`]));
+      yield* rows.map(parseStoredObject2);
+    },
+    async* logs() {
+      const sessions = await withClient(pool, async (client) => {
+        const { rows } = await client.query("SELECT to_regclass('log') IS NOT NULL AS present");
+        return rows[0]?.present === true ? (await client.query("SELECT DISTINCT session FROM log")).rows : [];
+      });
+      for (const row of sessions) {
+        const session = parseText2(row.session);
+        if (session === null)
+          continue;
+        const { rows } = await withClient(pool, (client) => client.query("SELECT seq, event FROM log WHERE session = $1 ORDER BY seq", [session]));
+        yield { session, events: rows.map(loggedRow2) };
+      }
+    },
+    commit: (change) => withClient(pool, async (client) => {
+      await client.query("BEGIN");
+      try {
+        await client.query(MIGRATION_LOCK);
+        if (await storedVersion(client) !== change.from) {
+          await client.query("ROLLBACK");
+          return "moved";
+        }
+        for (const statement of change.sql)
+          await client.query(statement);
+        for (const moved of change.repoints) {
+          await client.query("INSERT INTO objects (id, body) VALUES ($1, $2) ON CONFLICT (id) DO UPDATE SET body = excluded.body WHERE objects.body IS NULL", [moved.id, moved.body]);
+          const { rows } = await client.query("UPDATE refs SET target = $1, revision = $2 WHERE name = $3 AND revision = $4 RETURNING name", [moved.id, mintRevision2(), moved.name, moved.expect]);
+          if (rows.length === 0) {
+            await client.query("ROLLBACK");
+            return "conflict";
+          }
+          await updateSessionIndex(client, moved.name, moved.id, mintRevision2());
+        }
+        for (const created of change.creates) {
+          await client.query("INSERT INTO objects (id, body) VALUES ($1, $2) ON CONFLICT (id) DO UPDATE SET body = excluded.body WHERE objects.body IS NULL", [created.target, created.body]);
+          const revision = mintRevision2();
+          const { rows } = await client.query("INSERT INTO refs (name, target, revision) VALUES ($1, $2, $3) ON CONFLICT (name) DO NOTHING RETURNING name", [created.name, created.target, revision]);
+          if (rows.length > 0)
+            await updateSessionIndex(client, created.name, created.target, revision);
+        }
+        for (const relog of change.relogs) {
+          const { rows } = await client.query("UPDATE log SET event = $1 WHERE session = $2 AND seq = $3 AND event = $4 RETURNING seq", [relog.event, relog.session, relog.seq, relog.expect]);
+          if (rows.length === 0) {
+            await client.query("ROLLBACK");
+            return "conflict";
+          }
+        }
+        if (change.reindexSessions) {
+          const { rows } = await client.query("SELECT name, target, revision FROM refs");
+          for (const row of rows) {
+            const ref = parseRef2(row);
+            await updateSessionIndex(client, ref.name, ref.target, ref.revision);
+          }
+        }
+        await client.query("INSERT INTO store_meta (id, version) VALUES (1, $1) ON CONFLICT (id) DO UPDATE SET version = excluded.version", [change.to]);
+        await client.query("COMMIT");
+        return "committed";
+      } catch (error) {
+        await client.query("ROLLBACK").catch(() => {
+          return;
+        });
+        throw error;
+      }
+    })
+  };
+}
+async function withClient(pool, work) {
+  const client = await pool.connect();
+  try {
+    return await work(client);
+  } finally {
+    client.release();
+  }
+}
+function connect(pool) {
+  const query = (text, values) => withClient(pool, (client) => client.query(text, values));
+  const readTail = async (client, session) => {
+    const { rows } = await client.query("SELECT MAX(seq) AS tail FROM log WHERE session = $1", [
+      session
+    ]);
+    const value = rows[0]?.tail;
+    return asSeq(value === null || value === undefined ? 0 : parseNumber2(value));
+  };
+  return {
+    sessions: sqlSessionIndex2(async (text, values) => (await query(postgresSessionIndexQuery2(text), values)).rows),
+    objects: {
+      async put(object) {
+        const id = await objectId(object);
+        await query("INSERT INTO objects (id, body) VALUES ($1, $2) ON CONFLICT (id) DO UPDATE SET body = excluded.body WHERE objects.body IS NULL", [id, JSON.stringify(object)]);
+        return id;
+      },
+      async get(id) {
+        const { rows } = await query("SELECT body FROM objects WHERE id = $1", [id]);
+        const body = parseText2(rows[0]?.body);
+        return body === null ? null : decodeObject(body);
+      },
+      async putBlob(bytes) {
+        const joined = await collect2(bytes);
+        const id = await blobId(joined);
+        await query("INSERT INTO objects (id, bytes) VALUES ($1, $2) ON CONFLICT (id) DO UPDATE SET bytes = excluded.bytes WHERE objects.bytes IS NULL", [id, joined]);
+        return id;
+      },
+      async blob(id) {
+        const { rows } = await query("SELECT bytes FROM objects WHERE id = $1", [id]);
+        const bytes = rows[0]?.bytes;
+        return bytes instanceof Uint8Array ? memoryReader2(new Uint8Array(bytes)) : null;
+      }
+    },
+    refs: {
+      async get(name) {
+        const { rows } = await query("SELECT name, target, revision FROM refs WHERE name = $1", [
+          name
+        ]);
+        const row = rows[0];
+        return row === undefined ? null : parseRef2(row);
+      },
+      async list(prefix) {
+        const end = prefixEnd2(prefix);
+        const { rows } = end === null ? await query("SELECT name, target, revision FROM refs WHERE name >= $1 ORDER BY name", [prefix]) : await query("SELECT name, target, revision FROM refs WHERE name >= $1 AND name < $2 ORDER BY name", [prefix, end]);
+        return rows.map(parseRef2);
+      },
+      set: (updates) => withClient(pool, (client) => publish(client, updates, readTail)),
+      async log(session, after, limit) {
+        const { rows } = await query("SELECT seq, at, event FROM log WHERE session = $1 AND seq > $2 ORDER BY seq LIMIT $3", [session, after, limit]);
+        return rows.map((row) => decodeEvent2(parseNumber2(row.seq), parseNumber2(row.at), parseText2(row.event) ?? ""));
+      },
+      tail: (session) => withClient(pool, (client) => readTail(client, session))
+    }
+  };
+}
+async function publish(client, updates, readTail) {
+  const logged = collectSessionEvents(updates);
+  const fences = fenceNames(updates);
+  const names = [...new Set([...updates.map((update) => update.name), ...fences])];
+  const sessions = [
+    ...new Set(updates.flatMap(({ name }) => {
+      const session = parseSessionRef(name);
+      return session === null ? [] : [session];
+    }))
+  ];
+  const locks = [
+    ...names.map((name) => `ref:${name}`),
+    ...sessions.map((id) => `log:${id}`)
+  ].sort();
+  await client.query("BEGIN");
+  try {
+    await client.query(SHARED_MIGRATION_LOCK);
+    assertStoreVersion(await storedVersion(client));
+    for (const key of locks)
+      await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [key]);
+    const { rows } = names.length === 0 ? { rows: [] } : await client.query(`SELECT name, target, revision FROM refs WHERE name IN (${names.map((_, index) => `$${index + 1}`).join(", ")})`, names);
+    const before = new Map(rows.map((row) => {
+      const ref = parseRef2(row);
+      return [ref.name, ref];
+    }));
+    const fenced = fences.find((name) => !before.has(name));
+    if (fenced !== undefined) {
+      await client.query("ROLLBACK");
+      return { kind: "fenced", name: fenced };
+    }
+    const stale = updates.find((update) => !admits(update, before.get(update.name)));
+    if (stale !== undefined) {
+      await client.query("ROLLBACK");
+      return {
+        kind: "stale",
+        name: stale.name,
+        revision: before.get(stale.name)?.revision ?? null
+      };
+    }
+    const revisions = [];
+    const touched = new Map;
+    for (const update of updates) {
+      const revision = mintRevision2();
+      revisions.push(revision);
+      if (update.target === null)
+        await client.query("DELETE FROM refs WHERE name = $1", [update.name]);
+      else
+        await client.query("INSERT INTO refs (name, target, revision) VALUES ($1, $2, $3) ON CONFLICT (name) DO UPDATE SET target = excluded.target, revision = excluded.revision", [update.name, update.target, revision]);
+      await updateSessionIndex(client, update.name, update.target, revision);
+      const session = parseSessionRef(update.name);
+      if (session !== null)
+        touched.set(session, revision);
+    }
+    for (const [session, version] of touched)
+      await client.query("UPDATE session_index SET version = $1 WHERE session = $2", [
+        version,
+        session
+      ]);
+    const at = Date.now();
+    const tails = new Map;
+    const appended = [];
+    for (const { session, event } of logged) {
+      const seq = (tails.get(session) ?? await readTail(client, session)) + 1;
+      tails.set(session, seq);
+      await client.query("INSERT INTO log (session, seq, at, event) VALUES ($1, $2, $3, $4)", [
+        session,
+        seq,
+        at,
+        JSON.stringify(event)
+      ]);
+      appended.push(asSeq(seq));
+    }
+    await client.query("COMMIT");
+    return { kind: "set", logged: appended, at, revisions };
+  } catch (error) {
+    await client.query("ROLLBACK").catch(() => {
+      return;
+    });
+    throw error;
+  }
+}
+async function updateSessionIndex(client, name, target, revision) {
+  if (sessionIndexRef(name) === null)
+    return;
+  const body = target === null ? null : parseText2((await client.query("SELECT body FROM objects WHERE id = $1", [target])).rows[0]?.body);
+  for (const change of sessionIndexChanges2(name, body === null ? null : decodeObject(body), revision))
+    await client.query(postgresSessionIndexQuery2(change.text), change.values);
+}
+
+export { postgresStore2 };

package/dist/chunks/canvas-preview-4e0pxa32.js

@@ -0,0 +1,63 @@
+import {
+  sha2562
+} from "./canvas-preview-0nq75h9k.js";
+
+// src/local/workspace-migration.ts
+import { realpath, stat } from "node:fs/promises";
+import { decodeWorkspaceRecord, envelope } from "@nyte-ai/core/store";
+import { asId, SdkError } from "@nyte-ai/schema";
+import { Type } from "typebox";
+import { Value } from "typebox/value";
+var MIGRATION = "host/migrations/local-workspace-identity-v2";
+var MigrationState = Type.Object({ pending: Type.Array(Type.String()) });
+async function migrateLocalWorkspaceIdentities2(connection) {
+  for (let attempt = 0;attempt < 3; attempt += 1) {
+    const marker = await connection.refs.get(MIGRATION);
+    const state = marker?.target == null ? null : await connection.objects.get(marker.target);
+    const pending = Value.Check(MigrationState, state) ? state.pending : null;
+    if (marker !== null && pending === null)
+      throw new SdkError("internal", "The workspace identity migration state is malformed.");
+    if (pending?.length === 0)
+      return;
+    const refs = pending === null ? await connection.refs.list("workspaces/") : await Promise.all(pending.map((name) => connection.refs.get(name)));
+    const updates = [];
+    const remaining = [];
+    for (const ref of refs) {
+      if (ref === null)
+        continue;
+      const record = decodeWorkspaceRecord(ref.target === null ? null : await connection.objects.get(ref.target));
+      if (record?.target.kind !== "local" || !("path" in record.target))
+        continue;
+      const real = await realpath(record.target.path).catch(() => null);
+      if (real === null) {
+        remaining.push(ref.name);
+        continue;
+      }
+      const metadata = await stat(real, { bigint: true }).catch(() => null);
+      if (metadata === null) {
+        remaining.push(ref.name);
+        continue;
+      }
+      if (!metadata.isDirectory() || metadata.ino === 0n || metadata.birthtimeNs === 0n || metadata.birthtimeNs / 1000000n > BigInt(Math.floor(record.createdAt)) || record.identity !== sha2562(`${metadata.dev}:${metadata.ino}`))
+        continue;
+      const identity = asId(sha2562(`${metadata.birthtimeNs}:${metadata.ino}`));
+      updates.push({
+        name: ref.name,
+        expect: ref.revision,
+        target: await connection.objects.put(envelope("workspace", { ...record, identity }, Date.now()))
+      });
+    }
+    if (updates.length === 0 && pending !== null && pending.length === remaining.length && remaining.every((name, index) => pending[index] === name))
+      return;
+    updates.push({
+      name: MIGRATION,
+      expect: marker?.revision ?? "absent",
+      target: await connection.objects.put({ pending: remaining })
+    });
+    if ((await connection.refs.set(updates)).kind === "set")
+      return;
+  }
+  throw new SdkError("unavailable", "Workspace identities changed while Nyte was updating them.");
+}
+
+export { migrateLocalWorkspaceIdentities2 };

package/dist/chunks/canvas-preview-518dh8by.js

@@ -0,0 +1,169 @@
+// src/credentials.ts
+import { readCredentialAccounts } from "@nyte-ai/ai/auth/types";
+import { SdkError } from "@nyte-ai/schema";
+import { keyedSerial } from "@nyte-ai/schema/serial";
+import { decodeKvValue, envelope, kvRef } from "@nyte-ai/core/store";
+import { Type } from "typebox";
+import { Value } from "typebox/value";
+var SealedCredentialSchema = Type.Union([
+  Type.Object({
+    type: Type.Union([Type.Literal("api_key"), Type.Literal("oauth")]),
+    iv: Type.String(),
+    ciphertext: Type.String()
+  }),
+  Type.Object({
+    active: Type.Union([Type.String(), Type.Null()]),
+    accounts: Type.Array(Type.Object({
+      id: Type.String({ minLength: 1 }),
+      label: Type.String({ minLength: 1 }),
+      type: Type.Union([Type.Literal("api_key"), Type.Literal("oauth")])
+    })),
+    iv: Type.String(),
+    ciphertext: Type.String()
+  })
+]);
+var PREFIX = kvRef("secret", "models", "");
+var RETRIES = 5;
+function credentialStore2(store, secrets) {
+  let key = null;
+  const writes = keyedSerial();
+  const readKey = () => {
+    const known = key ?? importedKey(secrets);
+    key = known;
+    known.catch(() => {
+      if (key === known)
+        key = null;
+    });
+    return known;
+  };
+  const serialised = (provider, signal, task) => writes.run(provider, () => {
+    signal?.throwIfAborted();
+    return task();
+  });
+  return {
+    async read(provider, options) {
+      options?.signal?.throwIfAborted();
+      const { sealed } = await connected(store, (connection) => recordAt(connection, provider));
+      if (sealed === null)
+        return;
+      const unlocked = await readKey().catch(() => null);
+      return unlocked === null ? undefined : unsealCredential(unlocked, sealed);
+    },
+    async list(options) {
+      options?.signal?.throwIfAborted();
+      return connected(store, async (connection) => {
+        const refs = await connection.refs.list(PREFIX);
+        const rows = await Promise.all(refs.map(async (ref) => {
+          const sealed = ref.target === null ? null : readSealedCredential(decodeKvValue(await connection.objects.get(ref.target)));
+          if (sealed === null)
+            return [];
+          const providerId = ref.name.slice(PREFIX.length);
+          if ("type" in sealed)
+            return [
+              { providerId, id: "default", label: "Default", type: sealed.type, active: true }
+            ];
+          return sealed.accounts.map((account) => ({
+            providerId,
+            ...account,
+            active: sealed.active === account.id
+          }));
+        }));
+        return rows.flat();
+      });
+    },
+    modify(provider, fn, options) {
+      return serialised(provider, options?.signal, async () => modifyCredential(store, await readKey(), provider, fn, options?.signal));
+    },
+    delete(provider, options) {
+      return serialised(provider, options?.signal, () => connected(store, async (connection) => {
+        await connection.refs.set([{ name: kvRef("secret", "models", provider), target: null }]);
+      }));
+    }
+  };
+}
+async function sealSecret2(secrets, plain) {
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, await importedKey(secrets), new TextEncoder().encode(plain));
+  return `${iv.toBase64()}.${new Uint8Array(ciphertext).toBase64()}`;
+}
+async function openSecret2(secrets, sealed) {
+  const [iv = "", ciphertext = ""] = sealed.split(".");
+  const plain = await crypto.subtle.decrypt({ name: "AES-GCM", iv: Uint8Array.fromBase64(iv) }, await importedKey(secrets), Uint8Array.fromBase64(ciphertext));
+  return new TextDecoder().decode(plain);
+}
+async function importedKey(secrets) {
+  const bytes = await secrets.key();
+  if (bytes.length !== 32)
+    throw new SdkError("invalid", `The secrets key is ${bytes.length} bytes; AES-256 needs 32.`);
+  return crypto.subtle.importKey("raw", new Uint8Array(bytes), "AES-GCM", false, [
+    "encrypt",
+    "decrypt"
+  ]);
+}
+async function unsealCredential(key, record) {
+  let parsed;
+  try {
+    const plain = await crypto.subtle.decrypt({ name: "AES-GCM", iv: Uint8Array.fromBase64(record.iv) }, key, Uint8Array.fromBase64(record.ciphertext));
+    parsed = JSON.parse(new TextDecoder().decode(plain));
+  } catch {
+    return;
+  }
+  return readCredentialAccounts(parsed);
+}
+async function modifyCredential(store, key, provider, fn, signal) {
+  const name = kvRef("secret", "models", provider);
+  let started = false;
+  return connected(store, async (connection) => {
+    for (let attempt = 0;attempt <= RETRIES; attempt += 1) {
+      const { ref, sealed } = await recordAt(connection, provider);
+      const current = sealed === null ? undefined : await unsealCredential(key, sealed);
+      if (!started)
+        signal?.throwIfAborted();
+      started = true;
+      const next = await fn(current);
+      if (next === undefined)
+        return current;
+      const target = next.accounts.length === 0 ? null : await connection.objects.put(envelope("kv", await seal(key, next), Date.now()));
+      const outcome = await connection.refs.set([
+        { name, target, expect: ref === null ? "absent" : ref.revision }
+      ]);
+      if (outcome.kind === "set")
+        return next;
+    }
+    throw new SdkError("unavailable", `The ${provider} credential kept changing under this write; try again.`);
+  });
+}
+async function seal(key, credential) {
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const ciphertext = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, new TextEncoder().encode(JSON.stringify(credential))));
+  return {
+    active: credential.active,
+    accounts: credential.accounts.map((account) => ({
+      id: account.id,
+      label: account.label,
+      type: account.credential.type
+    })),
+    iv: iv.toBase64(),
+    ciphertext: ciphertext.toBase64()
+  };
+}
+async function recordAt(connection, provider) {
+  const ref = await connection.refs.get(kvRef("secret", "models", provider));
+  return {
+    ref,
+    sealed: ref === null || ref.target === null ? null : readSealedCredential(decodeKvValue(await connection.objects.get(ref.target)))
+  };
+}
+function readSealedCredential(body) {
+  if (!Value.Check(SealedCredentialSchema, body))
+    return null;
+  if ("type" in body)
+    return body;
+  const ids = new Set(body.accounts.map((account) => account.id));
+  return ids.size === body.accounts.length && (body.active === null || ids.has(body.active)) ? body : null;
+}
+async function connected(store, task) {
+  return task(await store.open());
+}
+
+export { credentialStore2, sealSecret2, openSecret2 };