@nyte-ai/host 0.0.0-stage → 0.0.18

package/dist/chunks/canvas-preview-76fwvd6e.js

@@ -0,0 +1,272 @@
+import {
+  createHandler2
+} from "./canvas-preview-d9wwhbtz.js";
+
+// src/listen-fetch.ts
+import { SdkError } from "@nyte-ai/schema";
+import { serial } from "@nyte-ai/schema/serial";
+import { dev } from "@nyte-ai/core";
+import { TOKEN, TOKEN_AUTHORITY } from "@nyte-ai/core/server";
+import {
+  HOST_HEADER,
+  OPERATIONS_HEADER,
+  asSdkError,
+  encodeError,
+  errorStatus,
+  operationsDigest
+} from "@nyte-ai/protocol";
+var encoder = new TextEncoder;
+async function listenFetch2(host, options) {
+  const { auth } = options;
+  if (auth.kind === "token" && auth.token.length < 16)
+    throw new SdkError("invalid", "A listener token needs at least 16 characters.");
+  const { server } = host;
+  const operations = await operationsDigest();
+  const cache = new Map;
+  const devices = new Map;
+  const streams = new Map;
+  const flights = new WeakMap;
+  let generation = new AbortController;
+  let closing = null;
+  let principalsRevision = null;
+  const rechecks = serial();
+  const drop = (key, entry, reason) => {
+    if (cache.get(key) === entry)
+      cache.delete(key);
+    entry.dispose();
+    for (const [digest, device] of devices)
+      if (device.principal === entry.principal)
+        devices.delete(digest);
+    const open = streams.get(entry.principal);
+    streams.delete(entry.principal);
+    for (const flight of open ?? [])
+      flight.controller.abort(reason);
+    entry.connection.close();
+  };
+  const land = (flight) => {
+    for (const [principal, open] of streams)
+      if (open.delete(flight) && open.size === 0)
+        streams.delete(principal);
+  };
+  const connectionFor = (flight, principal, authority, token) => {
+    const key = JSON.stringify([principal, [...authority].sort()]);
+    const entry = cache.get(key) ?? admit(key, principal, authority, token);
+    flight.principal = principal;
+    const open = streams.get(principal) ?? new Set;
+    open.add(flight);
+    streams.set(principal, open);
+    return entry.connection;
+  };
+  const admit = (key, principal, authority, token) => {
+    const connection = server.connect({
+      principal,
+      authority,
+      credential: { kind: "token", token },
+      origin: null
+    });
+    const entry = { connection, principal, dispose: () => {
+      return;
+    } };
+    const admitted = server.connections.register(principal, () => drop(key, entry, new SdkError("unauthenticated", "The principal was revoked.")));
+    if (admitted.kind === "revoked")
+      throw new SdkError("unauthenticated", "The principal was revoked.");
+    entry.dispose = admitted.dispose;
+    cache.set(key, entry);
+    return entry;
+  };
+  const reread = async (token, digest) => {
+    const found = await server.authenticate(token);
+    if (found === null) {
+      const known = devices.get(digest);
+      devices.delete(digest);
+      if (known !== undefined)
+        server.connections.revoke(known.principal);
+      return null;
+    }
+    return { ...found, token };
+  };
+  const findDevice = async (token) => {
+    const digest = hex(await sha256(token));
+    const device = devices.get(digest) ?? await reread(token, digest);
+    return device === null ? null : { digest, device };
+  };
+  const recheck = async () => {
+    if (devices.size === 0)
+      return;
+    const revision = await server.principalsRevision();
+    if (revision === principalsRevision)
+      return;
+    principalsRevision = revision;
+    await Promise.all([...devices].map(([digest, known]) => reread(known.token, digest)));
+  };
+  const externalCommit = () => {
+    rechecks.run(recheck).catch((error) => dev("listen", "device re-check failed", { error: String(error) }));
+  };
+  const unwatchCommits = server.onExternalCommit(externalCommit);
+  const isListenerToken = auth.kind === "token" ? (token) => sameSecret(token, auth.token) : async () => false;
+  const fallback = auth.kind === "custom" ? async (request) => {
+    const verdict = await auth.authorize(request);
+    if ("deny" in verdict)
+      throw verdict.deny === "forbidden" ? new SdkError("denied", "This principal may not call the host.") : new SdkError("unauthenticated", "The request is not authorized.");
+    return verdict;
+  } : async (_request, token) => {
+    throw new SdkError("unauthenticated", token === undefined ? "Send Authorization: Bearer <token>." : "The token is not accepted.");
+  };
+  const authenticate = async (request, flight) => {
+    const header = request.headers.get("Authorization") ?? "";
+    const pairing = /^Pairing\s+(\S+)\s*$/i.exec(header)?.[1];
+    if (pairing !== undefined) {
+      const redeemed = await server.redeem(pairing);
+      if (redeemed === null)
+        throw new SdkError("unauthenticated", "The pairing code is unknown or has expired.");
+      const digest = hex(await sha256(redeemed.token));
+      const { principal, authority, token } = redeemed;
+      const connection = connectionFor(flight, principal, authority, token);
+      devices.set(digest, { principal, authority, token });
+      return { connection, authority, headers: { "X-Nyte-Credential": token } };
+    }
+    const token = /^Bearer\s+(\S+)\s*$/i.exec(header)?.[1];
+    if (token !== undefined) {
+      if (await isListenerToken(token))
+        return {
+          connection: connectionFor(flight, TOKEN, TOKEN_AUTHORITY, token),
+          authority: TOKEN_AUTHORITY
+        };
+      const remembered = await findDevice(token);
+      if (remembered !== null) {
+        const { digest, device } = remembered;
+        const connection = connectionFor(flight, device.principal, device.authority, token);
+        devices.set(digest, device);
+        return { connection, authority: device.authority };
+      }
+    }
+    const verdict = await fallback(request, token);
+    return {
+      connection: connectionFor(flight, verdict.principal, verdict.authority, ""),
+      authority: verdict.authority
+    };
+  };
+  const handler = createHandler2({
+    server,
+    origins: options.origins,
+    maxBodyBytes: options.maxBodyBytes,
+    connection: (request) => {
+      const flight = flights.get(request);
+      if (flight === undefined)
+        throw new Error("The listener did not register this request.");
+      return authenticate(request, flight);
+    }
+  });
+  const cors = (request) => {
+    const origin = request.headers.get("Origin");
+    return origin !== null && (options.origins ?? []).includes(origin) ? {
+      "Access-Control-Allow-Origin": origin,
+      "Access-Control-Expose-Headers": `${HOST_HEADER}, ${OPERATIONS_HEADER}`,
+      Vary: "Origin"
+    } : {};
+  };
+  const serve = async (request, trace) => {
+    if (closing !== null)
+      return failure(new SdkError("unavailable", "This listener is closed."), {});
+    const early = await options.before?.(request);
+    if (early !== undefined)
+      return early;
+    const url = new URL(request.url);
+    if (request.method === "GET" && url.pathname === "/.nyte/identity") {
+      const nonce = url.searchParams.get("nonce");
+      if (options.identity === undefined || nonce === null || nonce === "")
+        return failure(new SdkError("unknown", "This host answers no identity challenge."), cors(request));
+      return json({ ...await options.identity.sign(nonce), hostId: server.hostId }, cors(request));
+    }
+    if (request.method === "GET" && url.pathname === "/.nyte/describe") {
+      if (options.describe === undefined)
+        return failure(new SdkError("unknown", "This host describes nothing."), cors(request));
+      return json(await options.describe(), cors(request));
+    }
+    const controller = new AbortController;
+    const forwarded = new Request(request, {
+      signal: AbortSignal.any([request.signal, generation.signal, controller.signal])
+    });
+    const flight = { request: forwarded, controller, principal: null };
+    flights.set(forwarded, flight);
+    const response = await handler(forwarded);
+    trace.principal = flight.principal;
+    return landing(response, () => land(flight));
+  };
+  const fetch = async (request) => {
+    const started = Date.now();
+    const trace = { principal: null };
+    const response = await serve(request, trace).catch((error) => failure(asSdkError(error), cors(request)));
+    dev("listen", "request", {
+      method: request.method,
+      path: new URL(request.url).pathname,
+      status: response.status,
+      principal: trace.principal === null ? "none" : trace.principal === TOKEN ? "token" : "principal",
+      ms: Date.now() - started
+    });
+    return withHost(response, server.hostId, operations);
+  };
+  const execution = options.execution ?? { kind: "run", coverage: { kind: "all" } };
+  const coverage = execution.kind === "admit-only" || server.execution.kind === "dispatch" ? null : server.execution.kind === "admit-only" ? server.drive(execution.coverage) : await host.execution.cover(execution.coverage);
+  const disconnectClients = () => {
+    for (const [key, entry] of cache)
+      drop(key, entry, new SdkError("unavailable", "The host disconnected its clients."));
+    devices.clear();
+    generation.abort(new SdkError("unavailable", "The host disconnected its clients."));
+    generation = new AbortController;
+  };
+  const close = () => {
+    closing ??= (async () => {
+      unwatchCommits();
+      disconnectClients();
+      await coverage?.close();
+    })();
+    return closing;
+  };
+  return { address: null, fetch, disconnectClients, close, [Symbol.asyncDispose]: close };
+}
+function landing(response, done) {
+  if (response.body === null) {
+    done();
+    return response;
+  }
+  const settles = { flush: done, cancel: done };
+  return new Response(response.body.pipeThrough(new TransformStream(settles)), { status: response.status, statusText: response.statusText, headers: response.headers });
+}
+function withHost(response, hostId, operations) {
+  const headers = new Headers(response.headers);
+  headers.set(HOST_HEADER, hostId);
+  headers.set(OPERATIONS_HEADER, operations);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers
+  });
+}
+function json(value, headers) {
+  return new Response(JSON.stringify(value), {
+    status: 200,
+    headers: { ...headers, "Content-Type": "application/json" }
+  });
+}
+function failure(error, headers) {
+  return new Response(JSON.stringify(encodeError(error)), {
+    status: errorStatus[error.code],
+    headers: { ...headers, "Content-Type": "application/json" }
+  });
+}
+async function sha256(text) {
+  return new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(text)));
+}
+function hex(bytes) {
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function sameSecret(given, expected) {
+  const [left, right] = await Promise.all([sha256(given), sha256(expected)]);
+  let difference = left.length ^ right.length;
+  for (let index = 0;index < left.length; index += 1)
+    difference |= (left[index] ?? 0) ^ (right[index] ?? 0);
+  return difference === 0;
+}
+
+export { listenFetch2 };