agent-hitch 0.2.5 → 0.2.7

package/dist/src/control-plane/remote-worker-artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-worker-artifacts.js","sourceRoot":"","sources":["../../../src/control-plane/remote-worker-artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEpH,MAAM,SAAS,GAAG,mCAAmC,CAAC;AACtD,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AACxC,MAAM,MAAM,GAAG,yBAAyB,CAAC;AACzC,MAAM,0BAA0B,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAYrD,MAAM,OAAO,yBAAyB;IACnB,SAAS,CAAS;IAClB,KAAK,CAAS;IACd,gBAAgB,CAAS;IAE1C,YAAY,KAAkD;QAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;QACrE,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,uDAAuD,CAAC,CAAC;QAC/I,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,aAAa,CAAC;QACrC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,mBAAmB,CAAC;QACvC,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAOZ;QACC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,QAAQ,CAAC,YAAY,GAAG,IAAI,CAAC,gBAAgB;YAAE,MAAM,aAAa,CAAC,0DAA0D,CAAC,CAAC;QACnI,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,IAAI,EAAE;YACzF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACvF,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,YAAY;oBAAE,MAAM,QAAQ,CAAC,wEAAwE,CAAC,CAAC;gBAC3K,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACrJ,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;YAChF,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YACtC,MAAM,SAAS,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;YAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAC9H,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;oBACrC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACjC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;oBACrB,IAAI,IAAI,GAAG,QAAQ,CAAC,YAAY,IAAI,IAAI,GAAG,IAAI,CAAC,gBAAgB;wBAAE,MAAM,aAAa,CAAC,uDAAuD,CAAC,CAAC;oBAC/I,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACnB,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC5B,CAAC;gBACD,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACtB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACrC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAY,CAAC;YACxD,IAAI,IAAI,KAAK,QAAQ,CAAC,YAAY,IAAI,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACjE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrC,MAAM,aAAa,CAAC,sEAAsE,CAAC,CAAC;YAC9F,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBAChC,MAAM,MAAM,GAAiC;oBAC3C,cAAc,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO;oBAC7E,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBAC7F,CAAC;gBACF,MAAM,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;gBAClG,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrC,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,EAAE,EAAE,WAAW,EAAE,wBAAwB,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,OAAe,EAAE,GAA4B,EAAE,KAAa;QACzF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI;YAAE,MAAM,eAAe,CAAC,0FAA0F,CAAC,CAAC;QACrL,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI;YAAE,MAAM,eAAe,CAAC,4DAA4D,CAAC,CAAC;QAChL,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,CAAC,MAAM;YAAE,MAAM,eAAe,CAAC,0DAA0D,CAAC,CAAC;QACrK,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,CAAC,QAAgB,EAAE,OAAe,EAAE,MAAc;QACvD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5F,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,OAAe,EAAE,MAAc;QAClE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,MAAM,aAAa,CAAC,0CAA0C,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAiB,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAW,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3G,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAEO,QAAQ,CAAC,QAAgB,EAAE,OAAe,EAAE,GAAW;QAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;IAC/E,CAAC;IAEO,UAAU,CAAC,QAAgB,EAAE,OAAe,EAAE,GAAW;QAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;IAC/E,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,KAAiG;IACzH,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK;WACzE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC;WACrD,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,YAAY,GAAG,CAAC;QAAE,MAAM,aAAa,CAAC,4CAA4C,CAAC,CAAC;IAC5I,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAgB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,aAAa,CAAC,0CAA0C,CAAC,CAAC;IACjI,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,IAAI,GAAG,CAAC,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IACpG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,cAAc,KAAK,GAAG;WACtF,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAAE,MAAM,aAAa,CAAC,0CAA0C,CAAC,CAAC;IACnK,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1L,OAAO,MAAiD,CAAC;AAC3D,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,IAAgB,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACzI,SAAS,eAAe,CAAC,OAAe,IAAgB,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5I,SAAS,QAAQ,CAAC,OAAe,IAAgB,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC"}

package/dist/src/control-plane/remote-worker-client.js

@@ -0,0 +1,202 @@
+import { createHash } from "node:crypto";
+import { HitchError, safeDiagnosticMessage } from "../foundation/index.js";
+import { parseRemoteWorkOffer } from "./remote-worker-protocol.js";
+const TOKEN = /^[a-f0-9]{64}$/;
+const WORKER = /^worker_[a-z0-9][a-z0-9_-]{0,62}$/;
+const MAX_ERROR_BYTES = 8_192;
+const MAX_CREDENTIAL_ENVELOPE_BYTES = 1024 * 1024;
+export class RemoteWorkerHttpClient {
+    workerId;
+    generation;
+    baseUrl;
+    token;
+    request;
+    constructor(input) {
+        this.baseUrl = parseBaseUrl(input.baseUrl);
+        const credential = parseRemoteWorkerCredential(input.credential);
+        this.workerId = credential.worker_id;
+        this.generation = credential.generation;
+        this.token = credential.token;
+        this.request = input.request ?? fetch;
+    }
+    static async register(input) {
+        if (!TOKEN.test(input.adminToken))
+            throw clientError("remote worker admin credential is invalid");
+        const response = await call(input.request ?? fetch, new URL("v1/workers/register", parseBaseUrl(input.baseUrl)), input.adminToken, {
+            method: "POST", body: JSON.stringify(input.registration), headers: { "content-type": "application/json" },
+        });
+        const body = object(await responseJSON(response));
+        const worker = object(body.worker);
+        const identity = object(worker.worker);
+        const credential = object(body.credential);
+        return parseRemoteWorkerCredential({
+            schema_version: "1", worker_id: identity.worker_id,
+            generation: worker.generation, token: credential.token,
+        });
+    }
+    async listOffers() {
+        const response = await this.call(`v1/workers/${this.workerId}/offers?generation=${this.generation}`);
+        const body = object(await responseJSON(response));
+        if (body.schema_version !== "1" || !Array.isArray(body.offers))
+            throw clientError("remote worker offer response is invalid");
+        return body.offers.map(parseRemoteWorkOffer);
+    }
+    async heartbeat(allocated, activeLeases, health = "healthy") {
+        await this.call(`v1/workers/${this.workerId}/heartbeat`, {
+            method: "POST", body: JSON.stringify({
+                schema_version: "1", generation: this.generation, health, allocated,
+                active_leases: [...activeLeases].sort((left, right) => left.lease_id.localeCompare(right.lease_id)), sent_at: new Date().toISOString(),
+            }), headers: { "content-type": "application/json" },
+        });
+    }
+    async downloadInput(offer, ref) {
+        this.assertOffer(offer);
+        const response = await this.call(`v1/workers/${this.workerId}/leases/${offer.lease.lease_id}/inputs/${ref.digest}?generation=${this.generation}`);
+        const length = response.headers.get("content-length");
+        if (length !== String(ref.size))
+            throw clientError("remote work input size header is invalid");
+        const body = Buffer.from(await response.arrayBuffer());
+        if (body.length !== ref.size || digest(body) !== ref.digest)
+            throw clientError("remote work input integrity check failed");
+        return body;
+    }
+    accept(offer) { return this.receipt(offer, "accept", { accepted: true }); }
+    async credentials(offer) {
+        this.assertOffer(offer);
+        if (offer.state !== "accepted")
+            throw clientError("remote credentials require an accepted offer");
+        const response = await this.call(`v1/workers/${this.workerId}/leases/${offer.lease.lease_id}/credentials?generation=${this.generation}&epoch=${offer.lease.epoch}`);
+        if (response.headers.get("cache-control") !== "no-store")
+            throw clientError("remote credential response is cacheable");
+        return parseCredentialEnvelope(object(object(await responseJSON(response, MAX_CREDENTIAL_ENVELOPE_BYTES)).envelope), offer);
+    }
+    reject(offer, rejectionCode) {
+        if (!rejectionCode || rejectionCode.length > 128 || !/^[a-z0-9][a-z0-9._-]*$/.test(rejectionCode))
+            throw clientError("remote work rejection code is invalid");
+        return this.receipt(offer, "accept", { accepted: false, rejection_code: rejectionCode });
+    }
+    async emit(offer, sequence, type, payload) {
+        this.assertOffer(offer);
+        await this.call(`v1/workers/${this.workerId}/leases/${offer.lease.lease_id}/events`, {
+            method: "POST", body: JSON.stringify({
+                schema_version: "1", generation: this.generation, lease_id: offer.lease.lease_id,
+                epoch: offer.lease.epoch, sequence, type, ...(payload ? { payload } : {}), sent_at: new Date().toISOString(),
+            }), headers: { "content-type": "application/json" },
+        });
+    }
+    async uploadArtifact(offer, kind, body) {
+        this.assertOffer(offer);
+        const ref = { kind, digest: digest(body), size: body.length };
+        await this.call(`v1/workers/${this.workerId}/leases/${offer.lease.lease_id}/artifacts/${ref.digest}?generation=${this.generation}&epoch=${offer.lease.epoch}`, {
+            method: "PUT", body, headers: { "content-type": "application/octet-stream", "content-length": String(body.length) },
+        });
+        return ref;
+    }
+    complete(offer, status, artifacts) {
+        return this.receipt(offer, "complete", { lease_id: offer.lease.lease_id, epoch: offer.lease.epoch, status, artifacts });
+    }
+    release(offer) {
+        return this.receipt(offer, "release", { lease_id: offer.lease.lease_id, epoch: offer.lease.epoch });
+    }
+    async receipt(offer, action, fields) {
+        this.assertOffer(offer);
+        const response = await this.call(`v1/workers/${this.workerId}/offers/${offer.offer_id}/${action}`, {
+            method: "POST", body: JSON.stringify({
+                schema_version: "1", offer_id: offer.offer_id, nonce: offer.nonce, generation: this.generation,
+                ...fields, sent_at: new Date().toISOString(),
+            }), headers: { "content-type": "application/json" },
+        });
+        return parseRemoteWorkOffer(object(await responseJSON(response)).offer);
+    }
+    call(relative, init = {}) {
+        return call(this.request, new URL(relative, this.baseUrl), this.token, init);
+    }
+    assertOffer(offer) {
+        if (offer.worker_id !== this.workerId || offer.generation !== this.generation)
+            throw clientError("remote work offer does not belong to this worker generation");
+    }
+}
+export function parseRemoteWorkerCredential(value) {
+    const record = object(value);
+    if (Object.keys(record).some((key) => !["schema_version", "worker_id", "generation", "token"].includes(key))
+        || record.schema_version !== "1" || typeof record.worker_id !== "string" || !WORKER.test(record.worker_id)
+        || !Number.isSafeInteger(record.generation) || record.generation < 1
+        || typeof record.token !== "string" || !TOKEN.test(record.token))
+        throw clientError("remote worker credential is invalid");
+    return record;
+}
+async function call(request, url, token, init = {}) {
+    let response;
+    const headers = new Headers(init.headers);
+    headers.set("authorization", `Bearer ${token}`);
+    try {
+        response = await request(url, { ...init, headers });
+    }
+    catch (error) {
+        throw clientError(`remote worker request failed: ${safeDiagnosticMessage(error, [token], 512)}`);
+    }
+    if (response.ok)
+        return response;
+    const body = (await response.text()).slice(0, MAX_ERROR_BYTES);
+    let message = `HTTP ${response.status}`;
+    try {
+        const error = object(object(JSON.parse(body)).error);
+        if (typeof error.code === "string")
+            message += ` ${error.code}`;
+        if (typeof error.message === "string")
+            message += `: ${error.message}`;
+    }
+    catch { /* Keep the bounded status-only error. */ }
+    throw clientError(`remote worker request failed: ${safeDiagnosticMessage(message, [token], 512)}`);
+}
+async function responseJSON(response, maximum = MAX_ERROR_BYTES) {
+    const raw = await response.text();
+    if (Buffer.byteLength(raw) > maximum)
+        throw clientError("remote worker response exceeds its size limit");
+    const text = raw.slice(0, maximum);
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw clientError("remote worker response is not valid JSON");
+    }
+}
+function parseCredentialEnvelope(record, offer) {
+    const allowed = new Set(["schema_version", "worker_id", "generation", "offer_id", "lease_id", "epoch", "issued_at", "expires_at", "credentials"]);
+    const credentials = object(record.credentials);
+    const names = Object.keys(credentials).sort();
+    const expected = [...(offer.credential_names ?? [])].sort();
+    if (Object.keys(record).some((key) => !allowed.has(key)) || record.schema_version !== "1"
+        || record.worker_id !== offer.worker_id || record.generation !== offer.generation || record.offer_id !== offer.offer_id
+        || record.lease_id !== offer.lease.lease_id || record.epoch !== offer.lease.epoch
+        || typeof record.issued_at !== "string" || typeof record.expires_at !== "string"
+        || !Number.isFinite(Date.parse(record.issued_at)) || !Number.isFinite(Date.parse(record.expires_at))
+        || Date.parse(record.expires_at) <= Date.now() || Date.parse(record.expires_at) - Date.parse(record.issued_at) > 5 * 60_000
+        || JSON.stringify(names) !== JSON.stringify(expected)
+        || names.some((name) => !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)
+            || typeof credentials[name] !== "string" || Buffer.byteLength(credentials[name]) > 64 * 1024)) {
+        throw clientError("remote credential envelope is invalid");
+    }
+    return record;
+}
+function parseBaseUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw clientError("remote worker server URL is invalid");
+    }
+    if (!new Set(["http:", "https:"]).has(url.protocol) || url.username || url.password || url.search || url.hash)
+        throw clientError("remote worker server URL is invalid");
+    url.pathname = `${url.pathname.replace(/\/*$/, "")}/`;
+    return url;
+}
+function object(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw clientError("remote worker response is invalid");
+    return value;
+}
+function digest(body) { return `sha256:${createHash("sha256").update(body).digest("hex")}`; }
+function clientError(message) { return new HitchError(message, { code: "remote_worker_client_error", exitCode: 10 }); }
+//# sourceMappingURL=remote-worker-client.js.map

package/dist/src/control-plane/remote-worker-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-worker-client.js","sourceRoot":"","sources":["../../../src/control-plane/remote-worker-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAWzC,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAC/B,MAAM,MAAM,GAAG,mCAAmC,CAAC;AACnD,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,6BAA6B,GAAG,IAAI,GAAG,IAAI,CAAC;AASlD,MAAM,OAAO,sBAAsB;IACxB,QAAQ,CAAS;IACjB,UAAU,CAAS;IACX,OAAO,CAAM;IACb,KAAK,CAAS;IACd,OAAO,CAAe;IAEvC,YAAY,KAAwF;QAClG,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,2BAA2B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC;IACxC,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAKrB;QACC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAAE,MAAM,WAAW,CAAC,2CAA2C,CAAC,CAAC;QAClG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,EAAE,IAAI,GAAG,CAAC,qBAAqB,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,EAAE;YACjI,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAC1G,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3C,OAAO,2BAA2B,CAAC;YACjC,cAAc,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS;YAClD,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK;SACvD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,sBAAsB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACrG,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,cAAc,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,WAAW,CAAC,yCAAyC,CAAC,CAAC;QAC7H,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,SAA2B,EAAE,YAAwD,EAAE,SAA4C,SAAS;QAC1J,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,YAAY,EAAE;YACvD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnC,cAAc,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS;gBACnE,aAAa,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACvI,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAwB,EAAE,GAAyB;QACrE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,WAAW,KAAK,CAAC,KAAK,CAAC,QAAQ,WAAW,GAAG,CAAC,MAAM,eAAe,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAClJ,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACtD,IAAI,MAAM,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,WAAW,CAAC,0CAA0C,CAAC,CAAC;QAC/F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM;YAAE,MAAM,WAAW,CAAC,0CAA0C,CAAC,CAAC;QAC3H,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,KAAwB,IAAgC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAE1H,KAAK,CAAC,WAAW,CAAC,KAAwB;QACxC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,MAAM,WAAW,CAAC,8CAA8C,CAAC,CAAC;QAClG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAC9B,cAAc,IAAI,CAAC,QAAQ,WAAW,KAAK,CAAC,KAAK,CAAC,QAAQ,2BAA2B,IAAI,CAAC,UAAU,UAAU,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAClI,CAAC;QACF,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,UAAU;YAAE,MAAM,WAAW,CAAC,yCAAyC,CAAC,CAAC;QACvH,OAAO,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,YAAY,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9H,CAAC;IACD,MAAM,CAAC,KAAwB,EAAE,aAAqB;QACpD,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,aAAa,CAAC;YAAE,MAAM,WAAW,CAAC,uCAAuC,CAAC,CAAC;QAC9J,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,QAAgB,EAAE,IAAY,EAAE,OAAiC;QACpG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,WAAW,KAAK,CAAC,KAAK,CAAC,QAAQ,SAAS,EAAE;YACnF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnC,cAAc,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;gBAChF,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAC7G,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAwB,EAAE,IAAqC,EAAE,IAAY;QAChG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,GAAG,GAA4B,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACvF,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,WAAW,KAAK,CAAC,KAAK,CAAC,QAAQ,cAAc,GAAG,CAAC,MAAM,eAAe,IAAI,CAAC,UAAU,UAAU,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE;YAC7J,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;SACpH,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAED,QAAQ,CAAC,KAAwB,EAAE,MAA4C,EAAE,SAAoC;QACnH,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1H,CAAC;IAED,OAAO,CAAC,KAAwB;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACtG,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,KAAwB,EAAE,MAAyC,EAAE,MAA+B;QACxH,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,WAAW,KAAK,CAAC,QAAQ,IAAI,MAAM,EAAE,EAAE;YACjG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnC,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC9F,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAC7C,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SACpD,CAAC,CAAC;QACH,OAAO,oBAAoB,CAAC,MAAM,CAAC,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC;IAEO,IAAI,CAAC,QAAgB,EAAE,OAAoB,EAAE;QACnD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/E,CAAC;IAEO,WAAW,CAAC,KAAwB;QAC1C,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU;YAAE,MAAM,WAAW,CAAC,6DAA6D,CAAC,CAAC;IAClK,CAAC;CACF;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;WACvG,MAAM,CAAC,cAAc,KAAK,GAAG,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;WACvG,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,IAAK,MAAM,CAAC,UAAqB,GAAG,CAAC;WAC7E,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,MAAM,WAAW,CAAC,qCAAqC,CAAC,CAAC;IAC7H,OAAO,MAA6C,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,OAAqB,EAAE,GAAQ,EAAE,KAAa,EAAE,OAAoB,EAAE;IACxF,IAAI,QAAkB,CAAC;IACvB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAAC,CAAC;IAC5D,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,WAAW,CAAC,iCAAiC,qBAAqB,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IACnH,IAAI,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IACjC,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IAC/D,IAAI,OAAO,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAChE,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC,CAAC,yCAAyC,CAAC,CAAC;IACrD,MAAM,WAAW,CAAC,iCAAiC,qBAAqB,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AACrG,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAkB,EAAE,OAAO,GAAG,eAAe;IACvE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO;QAAE,MAAM,WAAW,CAAC,+CAA+C,CAAC,CAAC;IACzG,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IAAC,CAAC;IAC3C,MAAM,CAAC;QAAC,MAAM,WAAW,CAAC,0CAA0C,CAAC,CAAC;IAAC,CAAC;AAC1E,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA+B,EAAE,KAAwB;IACxF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC;IAClJ,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,cAAc,KAAK,GAAG;WACpF,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;WACpH,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,KAAK;WAC9E,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;WAC7E,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;WACjG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM;WACxH,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;WAClD,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;eACzD,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAC5G,MAAM,WAAW,CAAC,uCAAuC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAA+C,CAAC;AACzD,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,WAAW,CAAC,qCAAqC,CAAC,CAAC;IAAC,CAAC;IACjG,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;QAAE,MAAM,WAAW,CAAC,qCAAqC,CAAC,CAAC;IACxK,GAAG,CAAC,QAAQ,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC;IACtD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,WAAW,CAAC,mCAAmC,CAAC,CAAC;IACxH,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,IAAY,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7G,SAAS,WAAW,CAAC,OAAe,IAAgB,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC"}

package/dist/src/control-plane/remote-worker-configuration.js

@@ -0,0 +1,34 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { atomicWriteJSON, invalidInput } from "../foundation/index.js";
+import { parseRemoteWorkerCredential } from "./remote-worker-client.js";
+import { parseRemoteWorkerRegistration } from "./remote-workers.js";
+export async function loadRemoteWorkerRegistration(file) {
+    return parseRemoteWorkerRegistration(await jsonFile(file, "worker registration"));
+}
+export async function loadRemoteWorkerCredential(file) {
+    return parseRemoteWorkerCredential(await jsonFile(file, "worker credential"));
+}
+export async function loadRemoteWorkerToken(file) {
+    try {
+        return (await readFile(path.resolve(file), "utf8")).trim();
+    }
+    catch (error) {
+        throw invalidInput(`worker admin credential is not readable: ${safeMessage(error)}`);
+    }
+}
+export function writeRemoteWorkerCredential(file, credential) {
+    return atomicWriteJSON(path.resolve(file), parseRemoteWorkerCredential(credential), 0o600);
+}
+async function jsonFile(file, label) {
+    try {
+        return JSON.parse(await readFile(path.resolve(file), "utf8"));
+    }
+    catch (error) {
+        throw invalidInput(`${label} is not readable JSON: ${safeMessage(error)}`);
+    }
+}
+function safeMessage(error) {
+    return (error?.message || String(error)).replace(/[\0\r\n]/g, " ").slice(0, 1_024);
+}
+//# sourceMappingURL=remote-worker-configuration.js.map

package/dist/src/control-plane/remote-worker-configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-worker-configuration.js","sourceRoot":"","sources":["../../../src/control-plane/remote-worker-configuration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAExE,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAEpE,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,IAAY;IAC7D,OAAO,6BAA6B,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,IAAY;IAC3D,OAAO,2BAA2B,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY;IACtD,IAAI,CAAC;QAAC,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;IACnE,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,YAAY,CAAC,4CAA4C,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AACzG,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAAY,EAAE,UAAoC;IAC5F,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,2BAA2B,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;AAC7F,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,KAAa;IACjD,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAY,CAAC;IAAC,CAAC;IACjF,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,YAAY,CAAC,GAAG,KAAK,0BAA0B,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AAC/F,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,CAAE,KAAe,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAChG,CAAC"}

package/dist/src/control-plane/remote-worker-credentials.js

@@ -0,0 +1,58 @@
+import { HitchError, PROVIDER_ENVIRONMENT_NAMES } from "../foundation/index.js";
+export const DEFAULT_CREDENTIAL_ENVELOPE_TTL_MS = 60_000;
+export class RemoteCredentialEnvelopeIssuer {
+    env;
+    ttlMs;
+    constructor(input = {}) {
+        const ttl = input.ttlMs ?? DEFAULT_CREDENTIAL_ENVELOPE_TTL_MS;
+        if (!Number.isSafeInteger(ttl) || ttl < 1_000 || ttl > 5 * 60_000) {
+            throw new TypeError("remote credential envelope TTL is invalid");
+        }
+        this.env = input.env ?? process.env;
+        this.ttlMs = ttl;
+    }
+    namesFor(explicitNames) {
+        const names = new Set(PROVIDER_ENVIRONMENT_NAMES.filter((name) => this.env[name] !== undefined));
+        for (const name of canonicalRemoteCredentialNames(explicitNames))
+            names.add(name);
+        return this.requireAvailable([...names]);
+    }
+    requireAvailable(value) {
+        const names = canonicalRemoteCredentialNames(value);
+        for (const name of names) {
+            if (this.env[name] === undefined) {
+                throw new HitchError(`remote credential is unavailable: ${name}`, { code: "credential_unavailable", exitCode: 10 });
+            }
+        }
+        return names;
+    }
+    issue(offer) {
+        if (offer.state !== "accepted")
+            throw credentialError("remote credential envelope requires an accepted active lease");
+        const credentials = {};
+        for (const name of offer.credential_names ?? []) {
+            const value = this.env[name];
+            if (value === undefined) {
+                throw new HitchError(`remote credential is unavailable: ${name}`, { code: "credential_unavailable", exitCode: 10 });
+            }
+            credentials[name] = value;
+        }
+        const issued = new Date();
+        return {
+            schema_version: "1", worker_id: offer.worker_id, generation: offer.generation, offer_id: offer.offer_id,
+            lease_id: offer.lease.lease_id, epoch: offer.lease.epoch, issued_at: issued.toISOString(),
+            expires_at: new Date(issued.getTime() + this.ttlMs).toISOString(), credentials,
+        };
+    }
+}
+export function canonicalRemoteCredentialNames(value) {
+    if (!Array.isArray(value) || value.length > 256
+        || value.some((name) => typeof name !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+        || new Set(value).size !== value.length)
+        throw credentialError("remote credential names are invalid");
+    return [...value].sort();
+}
+function credentialError(message) {
+    return new HitchError(message, { code: "worker_protocol_invalid", exitCode: 12 });
+}
+//# sourceMappingURL=remote-worker-credentials.js.map

package/dist/src/control-plane/remote-worker-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-worker-credentials.js","sourceRoot":"","sources":["../../../src/control-plane/remote-worker-credentials.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEhF,MAAM,CAAC,MAAM,kCAAkC,GAAG,MAAM,CAAC;AAEzD,MAAM,OAAO,8BAA8B;IACxB,GAAG,CAAoB;IACvB,KAAK,CAAS;IAE/B,YAAY,QAAqD,EAAE;QACjE,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,kCAAkC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,KAAK,IAAI,GAAG,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC;YAClE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC;IACnB,CAAC;IAED,QAAQ,CAAC,aAAgC;QACvC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,0BAA0B,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;QACzG,KAAK,MAAM,IAAI,IAAI,8BAA8B,CAAC,aAAa,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,gBAAgB,CAAC,KAAwB;QACvC,MAAM,KAAK,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;QACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACjC,MAAM,IAAI,UAAU,CAAC,qCAAqC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YACtH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,KAAwB;QAC5B,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,MAAM,eAAe,CAAC,8DAA8D,CAAC,CAAC;QACtH,MAAM,WAAW,GAA2B,EAAE,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,UAAU,CAAC,qCAAqC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YACtH,CAAC;YACD,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC5B,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QAC1B,OAAO;YACL,cAAc,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACvG,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE;YACzF,UAAU,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,WAAW;SAC/E,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,8BAA8B,CAAC,KAAwB;IACrE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;WAC1C,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;WACxF,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QAAE,MAAM,eAAe,CAAC,qCAAqC,CAAC,CAAC;IACxG,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;AACpF,CAAC"}