@ossy/platform 1.39.2 → 3.0.1

package/src/audit/task-run-list.aggregate.js

@@ -0,0 +1,76 @@
+/**
+ * ADR 0008 projection — workspace-scoped task run list for UI and billing queries.
+ */
+export class TaskRunListProjection {
+
+  static kind = 'projection'
+  static ProjectionId = '@ossy/platform/data/task-run-list'
+
+  static sources = [
+    { type: '@ossy/platform/schema/task-run', event: 'Started' },
+    { type: '@ossy/platform/schema/task-run', event: 'Completed' },
+    { type: '@ossy/platform/schema/task-run', event: 'Failed' },
+  ]
+
+  static scopeFromEvent (event) {
+    return event.payload?.belongsTo ?? null
+  }
+
+  static cacheKeys (scopeId) {
+    return [`projection:${TaskRunListProjection.ProjectionId}:${scopeId}`]
+  }
+
+  static initialState (scopeId) {
+    return { workspaceId: scopeId, runs: [] }
+  }
+
+  static Apply (event, state) {
+    const workspaceId = event.payload?.belongsTo ?? state.workspaceId
+    const entry = {
+      id: event.resourceId,
+      taskId: event.payload.taskId,
+      moduleId: event.payload.moduleId,
+      trigger: event.payload.trigger,
+      actionInvocationId: event.payload.actionInvocationId ?? null,
+      actorId: event.payload.actorId ?? event.createdBy ?? null,
+      executionEnv: event.payload.executionEnv ?? 'ossy_server',
+      updatedAt: event.created,
+    }
+
+    const runs = [...(state.runs ?? [])]
+
+    if (event.event === 'Started') {
+      entry.status = 'in progress'
+      entry.startedAt = event.created
+      runs.unshift(entry)
+      return { workspaceId, runs: runs.slice(0, 200) }
+    }
+
+    const idx = runs.findIndex(r => r.id === event.resourceId)
+    if (idx < 0) {
+      runs.unshift({
+        ...entry,
+        status: event.event === 'Completed' ? 'success' : 'failed',
+        startedAt: event.created,
+        completedAt: event.created,
+        durationMs: event.payload.durationMs,
+      })
+      return { workspaceId, runs: runs.slice(0, 200) }
+    }
+
+    runs[idx] = {
+      ...runs[idx],
+      ...entry,
+      status: event.event === 'Completed' ? 'success' : 'failed',
+      completedAt: event.created,
+      durationMs: event.payload.durationMs,
+      error: event.event === 'Failed' ? event.payload.error : undefined,
+      resultSummary: event.event === 'Completed' ? event.payload.resultSummary : undefined,
+    }
+
+    return { workspaceId, runs }
+  }
+}
+
+export { TaskRunListProjection as Aggregate }
+export const id = 'platform/data/task-run-list'

package/src/audit/task-run-service.js

@@ -0,0 +1,208 @@
+import { nanoid } from 'nanoid'
+import { Aggregate } from '@ossy/event-store'
+import { createLogger, metrics } from '@ossy/observability'
+import { TaskRun } from './task-run.aggregate.js'
+import { MeteringService } from '../metering/metering-service.js'
+import { detectChannel } from './detect-channel.js'
+import {
+  moduleIdFromTaskId,
+  resolveActorId,
+  resolveWorkspaceId,
+  summarizeError,
+  summarizeResult,
+} from './audit-helpers.js'
+import { rejectOnAbort } from '../request-diagnostics.js'
+
+const log = createLogger('platform/task-run')
+
+function assertNotAborted (context) {
+  if (context.signal?.aborted) {
+    throw context.signal.reason instanceof Error
+      ? context.signal.reason
+      : new Error('Operation aborted')
+  }
+}
+
+function recordTaskMetrics (taskId, durationMs) {
+  try { metrics.timing('task.duration', durationMs, { task: taskId }) } catch {}
+  try { metrics.increment('task.run', { task: taskId }) } catch {}
+}
+
+/**
+ * Records task execution lifecycle as ADR 0008 entity events.
+ */
+export const TaskRunService = {
+
+  /**
+   * Run a task handler with audit lifecycle (sync path).
+   *
+   * @param {{
+   *   taskId: string,
+   *   handler: (context: object) => Promise<unknown>,
+   *   context?: object,
+   *   trigger: 'on_action' | 'on_event' | 'on_schedule' | 'invoke',
+   *   triggeredBy?: object,
+   *   executionEnv?: string,
+   * }} opts
+   */
+  async execute (opts) {
+    const {
+      taskId,
+      handler,
+      context = {},
+      trigger,
+      triggeredBy = {},
+      executionEnv = 'ossy_server',
+      audit = true,
+    } = opts
+
+    if (audit === false) {
+      assertNotAborted(context)
+      if (context.signal) {
+        return Promise.race([handler(context), rejectOnAbort(context.signal)])
+      }
+      return handler(context)
+    }
+
+    const runId = nanoid()
+    const workspaceId = resolveWorkspaceId(context)
+    const actorId = resolveActorId(context)
+    const startMs = Date.now()
+
+    context.audit = context.audit ?? {}
+    context.audit.taskRunId = runId
+
+    await TaskRunService._appendStarted({
+      runId,
+      taskId,
+      trigger,
+      triggeredBy,
+      workspaceId,
+      actorId,
+      executionEnv,
+      actionInvocationId: context.actionInvocationId ?? null,
+    })
+
+    try {
+      assertNotAborted(context)
+      const result = context.signal
+        ? await Promise.race([handler(context), rejectOnAbort(context.signal)])
+        : await handler(context)
+      const durationMs = Date.now() - startMs
+      await TaskRunService._appendCompleted({
+        runId,
+        actorId,
+        durationMs,
+        resultSummary: summarizeResult(result),
+      })
+      recordTaskMetrics(taskId, durationMs)
+      await MeteringService.record({
+        kind: 'task',
+        actionId: context.actionId ?? null,
+        taskId,
+        channel: detectChannel(context.req),
+        workspaceId,
+        actorId,
+        durationMs,
+        success: true,
+        actionInvocationId: context.actionInvocationId ?? null,
+        taskRunId: runId,
+        trigger,
+      })
+      return result
+    } catch (error) {
+      const durationMs = Date.now() - startMs
+      await TaskRunService._appendFailed({
+        runId,
+        actorId,
+        durationMs,
+        error: summarizeError(error),
+      })
+      recordTaskMetrics(taskId, durationMs)
+      await MeteringService.record({
+        kind: 'task',
+        actionId: context.actionId ?? null,
+        taskId,
+        channel: detectChannel(context.req),
+        workspaceId,
+        actorId,
+        durationMs,
+        success: false,
+        actionInvocationId: context.actionInvocationId ?? null,
+        taskRunId: runId,
+        trigger,
+      })
+      throw error
+    }
+  },
+
+  /**
+   * Fire-and-forget task execution with audit lifecycle (async path).
+   *
+   * @param {Parameters<typeof TaskRunService.execute>[0]} opts
+   */
+  executeAsync (opts) {
+    TaskRunService.execute(opts).catch(error => {
+      log.error(`Async task run failed: "${opts.taskId}"`, { taskId: opts.taskId }, error)
+    })
+  },
+
+  async _appendStarted ({
+    runId,
+    taskId,
+    trigger,
+    triggeredBy,
+    workspaceId,
+    actorId,
+    executionEnv,
+    actionInvocationId,
+  }) {
+    try {
+      await Aggregate.Of(TaskRun, {
+        resourceId: runId,
+        type: '@ossy/platform/schema/task-run',
+        event: 'Started',
+        createdBy: actorId ?? undefined,
+        payload: {
+          taskId,
+          moduleId: moduleIdFromTaskId(taskId),
+          trigger,
+          triggeredBy,
+          executionEnv,
+          actionInvocationId,
+          actorId,
+          belongsTo: workspaceId,
+          location: '/@ossy/tasks/runs/',
+        },
+      })
+    } catch (err) {
+      log.warn('[TaskRunService] Failed to record Started', { taskId, runId }, err)
+    }
+  },
+
+  async _appendCompleted ({ runId, actorId, durationMs, resultSummary }) {
+    try {
+      await Aggregate.Of(TaskRun, runId)
+        .then(Aggregate.Add({
+          event: 'Completed',
+          createdBy: actorId ?? undefined,
+          payload: { durationMs, resultSummary },
+        }))
+    } catch (err) {
+      log.warn('[TaskRunService] Failed to record Completed', { runId }, err)
+    }
+  },
+
+  async _appendFailed ({ runId, actorId, durationMs, error }) {
+    try {
+      await Aggregate.Of(TaskRun, runId)
+        .then(Aggregate.Add({
+          event: 'Failed',
+          createdBy: actorId ?? undefined,
+          payload: { durationMs, error },
+        }))
+    } catch (err) {
+      log.warn('[TaskRunService] Failed to record Failed', { runId }, err)
+    }
+  },
+}

package/src/audit/task-run.aggregate.js

@@ -0,0 +1,58 @@
+/**
+ * ADR 0008 entity — one stream per task execution (sync invoke, changestream, cron, on_action).
+ */
+export class TaskRun {
+
+  static kind = 'entity'
+  static SchemaId = '@ossy/platform/schema/task-run'
+  static AggregateType = 'TaskRun'
+
+  static View (events, state = {}) {
+    return events.reduce((run, event) => {
+      switch (event.event) {
+
+        case 'Started':
+          return {
+            ...run,
+            id: event.resourceId,
+            type: event.type,
+            taskId: event.payload.taskId,
+            moduleId: event.payload.moduleId,
+            status: 'in progress',
+            trigger: event.payload.trigger,
+            triggeredBy: event.payload.triggeredBy ?? {},
+            actionInvocationId: event.payload.actionInvocationId ?? null,
+            actorId: event.payload.actorId ?? event.createdBy ?? null,
+            workspaceId: event.payload.belongsTo ?? null,
+            executionEnv: event.payload.executionEnv ?? 'ossy_server',
+            startedAt: event.created,
+            created: event.created,
+          }
+
+        case 'Completed':
+          return {
+            ...run,
+            status: 'success',
+            completedAt: event.created,
+            durationMs: event.payload.durationMs,
+            resultSummary: event.payload.resultSummary ?? null,
+          }
+
+        case 'Failed':
+          return {
+            ...run,
+            status: 'failed',
+            completedAt: event.created,
+            durationMs: event.payload.durationMs,
+            error: event.payload.error ?? null,
+          }
+
+        default:
+          return run
+      }
+    }, state)
+  }
+}
+
+export { TaskRun as Aggregate }
+export const id = 'platform/schema/task-run'

package/src/auth/action-scopes.js

@@ -0,0 +1,3 @@
+import { normalizeScopes, assertActionScoped, isActionAllowedByScopes } from '@ossy/schema'
+
+export { normalizeScopes, assertActionScoped, isActionAllowedByScopes }

package/src/capability-schemas/action-capability.schema.js

@@ -0,0 +1 @@
+export { default } from '@ossy/schema/capability-schemas/action-capability.schema.js'

package/src/capability-schemas/action-meta.schema.js

@@ -0,0 +1 @@
+export { default } from '@ossy/schema/capability-schemas/action-meta.schema.js'

package/src/capability-schemas/component-capability.schema.js

@@ -0,0 +1 @@
+export { default } from '@ossy/schema/capability-schemas/component-capability.schema.js'

package/src/capability-schemas/page-capability.schema.js

@@ -0,0 +1 @@
+export { default } from '@ossy/schema/capability-schemas/page-capability.schema.js'

package/src/capability-schemas/page-meta.schema.js

@@ -0,0 +1 @@
+export { default } from '@ossy/schema/capability-schemas/page-meta.schema.js'

package/src/capability-schemas/task-capability.schema.js

@@ -0,0 +1 @@
+export { default } from '@ossy/schema/capability-schemas/task-capability.schema.js'

package/src/capability-schemas/task-meta.schema.js

@@ -0,0 +1 @@
+export { default } from '@ossy/schema/capability-schemas/task-meta.schema.js'

package/src/capability-schemas/task-output.schema.js

@@ -0,0 +1 @@
+export { default } from '@ossy/schema/capability-schemas/task-output.schema.js'

package/src/capability-schemas/task-trigger-authoring.schema.js

@@ -0,0 +1 @@
+export { default } from '@ossy/schema/capability-schemas/task-trigger-authoring.schema.js'

package/src/capability-schemas/task-trigger.schema.js

@@ -0,0 +1 @@
+export { default } from '@ossy/schema/capability-schemas/task-trigger.schema.js'

package/src/directory.schema.js

@@ -0,0 +1,7 @@
+export default {
+  id: '@ossy/platform/schema/directory',
+  name: 'Directory',
+  categoryName: 'Platform',
+  icon: 'folder',
+  fields: [],
+}

package/src/entitlements/action-entitlement.js

@@ -0,0 +1,69 @@
+import { Aggregate } from '@ossy/event-store'
+import { isServiceEntitled, packageNameToSlug } from '@ossy/workspaces/entitlements'
+
+/** @typedef {{ packageName: string, entitlementRequired: boolean }} ActionEntitlementMeta */
+
+/**
+ * @param {{ actions?: Array<{ id: string, package?: string }>, definitions?: Record<string, { entitlementRequired?: boolean }> }} manifest
+ * @returns {Map<string, ActionEntitlementMeta>}
+ */
+export function buildActionEntitlementIndex (manifest) {
+  /** @type {Map<string, ActionEntitlementMeta>} */
+  const index = new Map()
+  for (const action of manifest.actions || []) {
+    if (!action.package) continue
+    const slug = packageNameToSlug(action.package)
+    const def = manifest.definitions?.[slug]
+    const entitlementRequired = def?.entitlementRequired !== false
+    index.set(action.id, { packageName: action.package, entitlementRequired })
+  }
+  return index
+}
+
+/**
+ * Enforce workspace package entitlements for workspace-scoped actions (ADR 0010 Wave 1).
+ *
+ * @param {{
+ *   actionId: string,
+ *   access: string,
+ *   workspaceId?: string,
+ *   entitlementIndex: Map<string, ActionEntitlementMeta>,
+ *   loadWorkspace: (workspaceId: string) => Promise<{ services?: Record<string, unknown> } | null>,
+ * }} opts
+ */
+export async function assertActionEntitled ({
+  actionId,
+  access,
+  workspaceId,
+  entitlementIndex,
+  loadWorkspace,
+}) {
+  if (access !== 'workspace' || !workspaceId) return
+
+  const meta = entitlementIndex.get(actionId)
+  if (!meta?.entitlementRequired) return
+
+  const workspace = await loadWorkspace(workspaceId)
+  if (!workspace) {
+    throw Object.assign(new Error('Workspace not found'), { status: 404 })
+  }
+
+  if (!isServiceEntitled(workspace.services, meta.packageName)) {
+    throw Object.assign(new Error(`Service ${meta.packageName} is not entitled for this workspace`), {
+      status: 403,
+      code: 'SERVICE_NOT_ENTITLED',
+      package: meta.packageName,
+    })
+  }
+}
+
+/**
+ * @param {import('@ossy/workspaces/server').Workspace} WorkspaceAggregate
+ * @returns {(workspaceId: string) => Promise<{ services?: Record<string, unknown> } | null>}
+ */
+export function createWorkspaceLoader (WorkspaceAggregate) {
+  return async (workspaceId) => {
+    const workspace = await Aggregate.Of(WorkspaceAggregate, workspaceId).then(Aggregate.View())
+    return workspace?.id ? workspace : null
+  }
+}

package/src/file.schema.js

@@ -0,0 +1,11 @@
+export default {
+  id: '@ossy/platform/schema/file',
+  name: 'File',
+  categoryName: 'Platform',
+  icon: 'file',
+  fields: [
+    { name: 'Key', type: 'text' },
+    { name: 'ContentLength', type: 'number' },
+    { name: 'ContentType', type: 'text' },
+  ],
+}

package/src/index.js

@@ -1,9 +1,9 @@
 export { TaskService } from './tasks/task-service.js'
 export { loadAndRegisterTasks } from './tasks/task-registry.js'
 export { ChangeStream } from './tasks/change-stream.js'
-export { registerResourceTemplate, getSystemResourceTemplates } from './resources/resource-template.registry.js'
-export { normalizeAndValidateDocumentContent, validateResourceTemplatesForImport, ALLOWED_FIELD_TYPES } from './resources/resource-template.validation.js'
-export { Definition } from './Definition.js'
+export { registerSchema, getSystemSchemas } from './resources/schema.registry.js'
+export { getPlatformSchema, initPlatformSchema, createSchemaEngine, schemaForWorkspace } from './resources/schema.service.js'
+export { validateSchemasForImport, ALLOWED_FIELD_TYPES, normalizeFieldType, resolveFieldDef } from './resources/schema.validation.js'
 export { IntegrationService } from './integration.service.js'
 export { ConfigService } from './config.service.js'
 export { ActionService } from './actions/action.service.js'
@@ -12,3 +12,12 @@ export { UsersMiddleware } from './users.middleware.js'
 export { WorkspacesMiddleware } from './workspaces.middleware.js'
 export { matchesCron } from './tasks/cron.js'
 export { matchesGlob, globToRegex, policyToQueryClause } from './tasks/glob.js'
+export {
+  USER_SETTINGS_COOKIE,
+  AUTH_COOKIE,
+  readUserAppSettings,
+  mergeUserAppSettingsCookie,
+  clearWorkspaceFromUserAppSettings,
+  setAuthCookie,
+  clearAuthCookie,
+} from './user-app-settings.js'

package/src/mcp/create-ossy-mcp-server.js

@@ -0,0 +1,97 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'
+import { jsonSchemaToZodShape } from './json-schema-to-zod.js'
+import {
+  TASK_TOPOLOGY_RESOURCE_URI,
+  capabilitiesTaskTopologyResource,
+} from '@ossy/app/manifest/build-capabilities'
+
+/**
+ * @param {{
+ *   capabilities: { tools: Array<object>, tasks?: object[], graph?: object },
+ *   invokeAction: (actionId: string, payload: object, req?: object) => Promise<unknown>,
+ *   customTools?: Array<{
+ *     name: string,
+ *     description: string,
+ *     inputSchema?: object,
+ *     handler: (args: object, req?: object) => Promise<unknown>,
+ *   }>,
+ * }} options
+ */
+export function createOssyMcpServer ({ capabilities, invokeAction, customTools = [] }) {
+  const server = new McpServer({
+    name: 'ossy',
+    version: '0.2.0',
+  })
+
+  const topology = capabilitiesTaskTopologyResource(capabilities)
+  if (topology.tasks.length || topology.graph.edges?.length) {
+    server.registerResource(
+      'task-topology',
+      TASK_TOPOLOGY_RESOURCE_URI,
+      {
+        title: 'Task topology',
+        description: 'Read-only task catalog and trigger graph for multi-step agent planning (ADR 0011).',
+        mimeType: 'application/json',
+      },
+      async () => ({
+        contents: [{
+          uri: TASK_TOPOLOGY_RESOURCE_URI,
+          mimeType: 'application/json',
+          text: JSON.stringify(topology, null, 2),
+        }],
+      }),
+    )
+  }
+
+  for (const tool of capabilities.tools || []) {
+    const inputShape = jsonSchemaToZodShape(tool.inputSchema || { type: 'object' })
+    server.registerTool(
+      tool.name,
+      {
+        description: tool.description || tool.title || tool.actionId,
+        inputSchema: inputShape,
+      },
+      async (args, extra) => {
+        try {
+          const result = await invokeAction(tool.actionId, args, extra?.requestInfo)
+          return {
+            content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
+          }
+        } catch (err) {
+          return {
+            isError: true,
+            content: [{ type: 'text', text: err?.message || String(err) }],
+          }
+        }
+      },
+    )
+  }
+
+  for (const tool of customTools) {
+    const inputShape = tool.inputSchema
+      ? jsonSchemaToZodShape(tool.inputSchema)
+      : undefined
+    server.registerTool(
+      tool.name,
+      {
+        description: tool.description,
+        ...(inputShape ? { inputSchema: inputShape } : {}),
+      },
+      async (args, extra) => {
+        try {
+          const result = await tool.handler(args, extra?.requestInfo)
+          return {
+            content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
+          }
+        } catch (err) {
+          return {
+            isError: true,
+            content: [{ type: 'text', text: err?.message || String(err) }],
+          }
+        }
+      },
+    )
+  }
+
+  return server
+}

package/src/mcp/json-schema-to-zod.js

@@ -0,0 +1,64 @@
+import { z } from 'zod'
+
+/**
+ * Minimal JSON Schema → Zod conversion for MCP tool registration.
+ * Supports the subset produced by build-capabilities.
+ *
+ * @param {object} schema
+ * @returns {import('zod').ZodTypeAny}
+ */
+export function jsonSchemaToZod (schema) {
+  if (!schema || typeof schema !== 'object') {
+    return z.record(z.unknown())
+  }
+
+  if (Array.isArray(schema.oneOf) && schema.oneOf.length) {
+    return z.union(schema.oneOf.map(jsonSchemaToZod))
+  }
+
+  if (schema.type === 'object' || schema.properties) {
+    const shape = {}
+    for (const [key, propSchema] of Object.entries(schema.properties || {})) {
+      let field = jsonSchemaToZod(propSchema)
+      if (!schema.required?.includes(key)) {
+        field = field.optional()
+      }
+      shape[key] = field
+    }
+    const objectSchema = z.object(shape)
+    return schema.additionalProperties ? objectSchema.passthrough() : objectSchema
+  }
+
+  if (schema.type === 'array') {
+    return z.array(jsonSchemaToZod(schema.items || {}))
+  }
+
+  if (schema.type === 'number' || schema.type === 'integer') {
+    let field = z.number()
+    if (schema.description) field = field.describe(schema.description)
+    return field
+  }
+
+  if (schema.type === 'boolean') {
+    return z.boolean()
+  }
+
+  let field = z.string()
+  if (schema.description) field = field.describe(schema.description)
+  if (Array.isArray(schema.enum) && schema.enum.length) {
+    field = z.enum(schema.enum)
+  }
+  return field
+}
+
+/**
+ * @param {object} inputSchema JSON Schema object
+ * @returns {import('zod').ZodRawShape}
+ */
+export function jsonSchemaToZodShape (inputSchema) {
+  const zodSchema = jsonSchemaToZod(inputSchema)
+  if (zodSchema instanceof z.ZodObject) {
+    return zodSchema.shape
+  }
+  return { payload: zodSchema }
+}