open-managed-agents 0.1.0

package/dist/src/control-plane/admin/auth.js

@@ -0,0 +1,43 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { readFileSync } from "node:fs";
+export const ADMIN_KEY_ENV = "OMA_ADMIN_KEY";
+export const ADMIN_KEY_FILE_ENV = "OMA_ADMIN_KEY_FILE";
+const ADMIN_KEY_BYTES = 32;
+export function generateAdminKey() {
+    return randomBytes(ADMIN_KEY_BYTES).toString("base64");
+}
+export function loadAdminKey(env = process.env) {
+    const direct = env[ADMIN_KEY_ENV];
+    const file = env[ADMIN_KEY_FILE_ENV];
+    if (direct !== undefined && file !== undefined) {
+        throw new Error(`set exactly one of ${ADMIN_KEY_ENV} or ${ADMIN_KEY_FILE_ENV}, not both`);
+    }
+    if (direct === undefined && file === undefined)
+        return undefined;
+    const value = direct === undefined ? readFileSync(file, "utf8").trim() : direct.trim();
+    parseAdminKey(value, direct === undefined ? ADMIN_KEY_FILE_ENV : ADMIN_KEY_ENV);
+    return value;
+}
+function parseAdminKey(value, source) {
+    const decoded = Buffer.from(value, "base64");
+    if (decoded.length !== ADMIN_KEY_BYTES ||
+        decoded.toString("base64") !== value) {
+        throw new Error(`${source} must be exactly ${ADMIN_KEY_BYTES} random bytes, ` +
+            `base64-encoded (generate one with: node -e "console.log(` +
+            `require('crypto').randomBytes(32).toString('base64'))")`);
+    }
+}
+export function createAdminAuth(adminKey) {
+    const expectedDigest = sha256(adminKey);
+    return {
+        verify(presented) {
+            return timingSafeEqual(sha256(presented), expectedDigest);
+        },
+        fingerprint() {
+            return expectedDigest.toString("hex");
+        },
+    };
+}
+function sha256(value) {
+    return createHash("sha256").update(value).digest();
+}

package/dist/src/control-plane/admin/routes.js

@@ -0,0 +1,76 @@
+import { Hono } from "hono";
+import { invalidRequest } from "../errors.js";
+import { parseJsonBody, parseLimit } from "../http.js";
+import { log } from "../logging.js";
+export function adminRoutes(service) {
+    const app = new Hono();
+    app.post("/workspaces", async (c) => {
+        const body = await parseJsonBody(c.req);
+        const workspace = service.createWorkspace(body);
+        emitAdminAudit(c.get("requestId"), {
+            action: "create_workspace",
+            workspace_id: workspace.id,
+        });
+        return c.json(workspace, 201);
+    });
+    app.get("/workspaces", (c) => {
+        return c.json(service.listWorkspaces(), 200);
+    });
+    app.get("/workspaces/:id", (c) => {
+        return c.json(service.getWorkspace(c.req.param("id")), 200);
+    });
+    app.post("/workspaces/:id/keys", async (c) => {
+        const body = await parseOptionalJsonBody(c.req);
+        const minted = service.mintKey(c.req.param("id"), body);
+        emitAdminAudit(c.get("requestId"), {
+            action: "mint_key",
+            workspace_id: minted.workspace_id,
+            key_sha256: minted.key_sha256,
+        });
+        return c.json(minted, 201);
+    });
+    app.get("/workspaces/:id/keys", (c) => {
+        return c.json(service.listKeys(c.req.param("id")), 200);
+    });
+    app.get("/workspaces/:id/mcp-credentials", (c) => {
+        const limit = parseLimit(c.req.query("limit"));
+        const page = c.req.query("page") || undefined;
+        return c.json(service.listWorkspaceCredentialMetadata(c.req.param("id"), {
+            ...(limit === undefined ? {} : { limit }),
+            ...(page === undefined ? {} : { page }),
+        }), 200);
+    });
+    app.delete("/keys/:sha256", (c) => {
+        const revoked = service.revokeKey(c.req.param("sha256"));
+        emitAdminAudit(c.get("requestId"), {
+            action: "revoke_key",
+            workspace_id: revoked.workspace_id,
+            key_sha256: revoked.key_sha256,
+            revoked_at: revoked.revoked_at,
+        });
+        return c.json(revoked, 200);
+    });
+    return app;
+}
+function emitAdminAudit(requestId, event) {
+    // Wire shape predates the structured logger; `type: "admin_audit"` is the
+    // grep contract and stays (0121 C1 — the logger adds ts/level/event around
+    // it). Emitted at the audit level: OMA_LOG_LEVEL must never be able to
+    // silence the admin audit trail.
+    log.audit("admin_audit", {
+        type: "admin_audit",
+        request_id: requestId,
+        ...event,
+    });
+}
+async function parseOptionalJsonBody(req) {
+    const text = await req.text();
+    if (text.trim() === "")
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch (error) {
+        throw invalidRequest("Request body must be valid JSON", String(error));
+    }
+}

package/dist/src/control-plane/admin/service.js

@@ -0,0 +1,102 @@
+import { invalidRequest, notFound } from "../errors.js";
+export class DefaultAdminService {
+    workspaces;
+    vaults;
+    constructor(workspaces, vaults) {
+        this.workspaces = workspaces;
+        this.vaults = vaults;
+    }
+    createWorkspace(input) {
+        const { name } = parseCreateWorkspace(input);
+        return toAdminWorkspace(this.workspaces.createWorkspace(name));
+    }
+    listWorkspaces() {
+        return this.workspaces.listWorkspaces().map(toAdminWorkspace);
+    }
+    getWorkspace(workspaceId) {
+        const row = this.workspaces.getWorkspace(workspaceId);
+        if (!row)
+            throw notFound(`Workspace not found: ${workspaceId}`);
+        return toAdminWorkspace(row);
+    }
+    mintKey(workspaceId, input) {
+        const { label } = parseMintKey(input);
+        try {
+            return toAdminMintedKey(this.workspaces.mintKey(workspaceId, label));
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.startsWith("Workspace not found:")) {
+                throw notFound(error.message);
+            }
+            throw error;
+        }
+    }
+    listKeys(workspaceId) {
+        if (!this.workspaces.getWorkspace(workspaceId)) {
+            throw notFound(`Workspace not found: ${workspaceId}`);
+        }
+        return this.workspaces.listKeys(workspaceId).map(toAdminKeyMetadata);
+    }
+    listWorkspaceCredentialMetadata(workspaceId, opts) {
+        if (!this.workspaces.getWorkspace(workspaceId)) {
+            throw notFound(`Workspace not found: ${workspaceId}`);
+        }
+        return this.vaults?.listWorkspaceCredentialAdminMetadata(workspaceId, opts)
+            ?? { data: [], has_more: false, next_page: null };
+    }
+    revokeKey(keySha256) {
+        const existing = this.workspaces.getKey(keySha256);
+        if (!existing)
+            throw notFound(`Key not found: ${keySha256}`);
+        if (existing.revoked_at !== null)
+            return toAdminKeyMetadata(existing);
+        this.workspaces.revokeKey(keySha256);
+        return toAdminKeyMetadata(this.workspaces.getKey(keySha256) ?? existing);
+    }
+}
+function parseCreateWorkspace(input) {
+    if (typeof input !== "object" || input === null || Array.isArray(input)) {
+        throw invalidRequest("Request body must be a JSON object");
+    }
+    const { name } = input;
+    if (typeof name !== "string" || name.trim().length === 0) {
+        throw invalidRequest("`name` must be a non-empty string");
+    }
+    return { name: name.trim() };
+}
+function parseMintKey(input) {
+    if (input === undefined)
+        return { label: "default" };
+    if (typeof input !== "object" || input === null || Array.isArray(input)) {
+        throw invalidRequest("Request body must be a JSON object");
+    }
+    const { label = "default" } = input;
+    if (typeof label !== "string" || label.trim().length === 0) {
+        throw invalidRequest("`label` must be a non-empty string");
+    }
+    return { label: label.trim() };
+}
+function toAdminWorkspace(row) {
+    return {
+        id: row.workspace_id,
+        name: row.name,
+        created_at: row.created_at,
+    };
+}
+function toAdminMintedKey(row) {
+    return {
+        workspace_id: row.workspaceId,
+        label: row.label,
+        key_sha256: row.keySha256,
+        api_key: row.plaintextKey,
+    };
+}
+function toAdminKeyMetadata(row) {
+    return {
+        key_sha256: row.key_sha256,
+        workspace_id: row.workspace_id,
+        label: row.label,
+        created_at: row.created_at,
+        revoked_at: row.revoked_at,
+    };
+}

package/dist/src/control-plane/admission.js

@@ -0,0 +1,90 @@
+import { overloaded, rateLimited } from "./errors.js";
+export function parseAdmissionLimitsFromEnv(env) {
+    return {
+        ...limitFromEnv("maxActiveSessionsPerWorkspace", "OMA_MAX_ACTIVE_SESSIONS_PER_WORKSPACE", env.OMA_MAX_ACTIVE_SESSIONS_PER_WORKSPACE),
+        ...limitFromEnv("maxPendingRuntimeTurnsPerWorkspace", "OMA_MAX_PENDING_RUNTIME_TURNS_PER_WORKSPACE", env.OMA_MAX_PENDING_RUNTIME_TURNS_PER_WORKSPACE),
+        ...limitFromEnv("maxConcurrentUploadsPerWorkspace", "OMA_MAX_CONCURRENT_UPLOADS_PER_WORKSPACE", env.OMA_MAX_CONCURRENT_UPLOADS_PER_WORKSPACE),
+        ...limitFromEnv("maxConcurrentUploads", "OMA_MAX_CONCURRENT_UPLOADS", env.OMA_MAX_CONCURRENT_UPLOADS),
+        ...limitFromEnv("maxConcurrentSseStreamsPerWorkspace", "OMA_MAX_CONCURRENT_SSE_STREAMS_PER_WORKSPACE", env.OMA_MAX_CONCURRENT_SSE_STREAMS_PER_WORKSPACE),
+        ...limitFromEnv("maxConcurrentSseStreams", "OMA_MAX_CONCURRENT_SSE_STREAMS", env.OMA_MAX_CONCURRENT_SSE_STREAMS),
+    };
+}
+function limitFromEnv(key, name, raw) {
+    if (raw === undefined)
+        return {};
+    const value = Number(raw.trim());
+    if (!Number.isInteger(value) || value <= 0) {
+        throw new Error(`${name} must be a positive integer, got ${JSON.stringify(raw)}`);
+    }
+    return { [key]: value };
+}
+// Tracks in-flight operations whose cost is their lifetime (uploads buffering
+// in RAM, open SSE streams). acquire() throws the wire-shaped rejection;
+// the returned release is idempotent so close/cancel/error paths can all
+// call it safely.
+export class InFlightGauge {
+    resource;
+    maxPerWorkspace;
+    maxTotal;
+    onReject;
+    perWorkspaceCounts = new Map();
+    total = 0;
+    constructor(resource, maxPerWorkspace, maxTotal, onReject) {
+        this.resource = resource;
+        this.maxPerWorkspace = maxPerWorkspace;
+        this.maxTotal = maxTotal;
+        this.onReject = onReject;
+    }
+    acquire(workspaceId) {
+        const current = this.perWorkspaceCounts.get(workspaceId) ?? 0;
+        if (this.maxPerWorkspace !== undefined && current >= this.maxPerWorkspace) {
+            this.onReject?.("429");
+            throw rateLimited(`Concurrent ${this.resource} limit reached for this workspace; retry later`);
+        }
+        if (this.maxTotal !== undefined && this.total >= this.maxTotal) {
+            this.onReject?.("529");
+            throw overloaded();
+        }
+        this.perWorkspaceCounts.set(workspaceId, current + 1);
+        this.total += 1;
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            const count = this.perWorkspaceCounts.get(workspaceId) ?? 1;
+            if (count <= 1)
+                this.perWorkspaceCounts.delete(workspaceId);
+            else
+                this.perWorkspaceCounts.set(workspaceId, count - 1);
+            this.total -= 1;
+        };
+    }
+    inFlight(workspaceId) {
+        return this.perWorkspaceCounts.get(workspaceId) ?? 0;
+    }
+    // For the /metrics SSE-streams gauge (0121 C2).
+    get totalInFlight() {
+        return this.total;
+    }
+}
+export function createAdmissionLimits(config, 
+// 0121 C2: telemetry-only; absent hooks change nothing.
+onRejection) {
+    return {
+        ...(config.maxActiveSessionsPerWorkspace === undefined
+            ? {}
+            : { maxActiveSessionsPerWorkspace: config.maxActiveSessionsPerWorkspace }),
+        ...(config.maxPendingRuntimeTurnsPerWorkspace === undefined
+            ? {}
+            : {
+                maxPendingRuntimeTurnsPerWorkspace: config.maxPendingRuntimeTurnsPerWorkspace,
+            }),
+        uploads: new InFlightGauge("file upload", config.maxConcurrentUploadsPerWorkspace, config.maxConcurrentUploads, onRejection === undefined
+            ? undefined
+            : (status) => onRejection("uploads", status)),
+        sseStreams: new InFlightGauge("SSE stream", config.maxConcurrentSseStreamsPerWorkspace, config.maxConcurrentSseStreams, onRejection === undefined
+            ? undefined
+            : (status) => onRejection("streams", status)),
+    };
+}

package/dist/src/control-plane/agents/routes.js

@@ -0,0 +1,63 @@
+import { Hono } from "hono";
+import { invalidRequest } from "../errors.js";
+import { parseJsonBody, parseLimit } from "../http.js";
+import { workspaceIdFrom } from "../workspace.js";
+export function agentsRoutes(service) {
+    const app = new Hono();
+    app.post("/", async (c) => {
+        const body = await parseJsonBody(c.req);
+        const agent = service.create(workspaceIdFrom(c), body);
+        return c.json(agent, 200);
+    });
+    app.get("/", (c) => {
+        const limit = parseLimit(c.req.query("limit"));
+        const page = c.req.query("page") || undefined;
+        const includeArchived = parseBoolean(c.req.query("include_archived"));
+        return c.json(service.list(workspaceIdFrom(c), {
+            ...(limit === undefined ? {} : { limit }),
+            ...(page === undefined ? {} : { page }),
+            ...(includeArchived === undefined ? {} : { includeArchived }),
+        }), 200);
+    });
+    app.get("/:id/versions", (c) => {
+        const limit = parseLimit(c.req.query("limit"));
+        const page = c.req.query("page") || undefined;
+        return c.json(service.listVersions(workspaceIdFrom(c), c.req.param("id"), {
+            ...(limit === undefined ? {} : { limit }),
+            ...(page === undefined ? {} : { page }),
+        }), 200);
+    });
+    app.get("/:id", (c) => {
+        const version = parsePositiveInteger(c.req.query("version"), "version");
+        return c.json(service.retrieve(workspaceIdFrom(c), c.req.param("id"), version), 200);
+    });
+    app.post("/:id", async (c) => {
+        const body = await parseJsonBody(c.req);
+        return c.json(service.update(workspaceIdFrom(c), c.req.param("id"), body), 200);
+    });
+    app.post("/:id/archive", (c) => {
+        return c.json(service.archive(workspaceIdFrom(c), c.req.param("id")), 200);
+    });
+    return app;
+}
+function parsePositiveInteger(value, field) {
+    if (value === undefined)
+        return undefined;
+    if (!/^[1-9][0-9]*$/.test(value)) {
+        throw invalidRequest(`\`${field}\` must be a positive integer`);
+    }
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed)) {
+        throw invalidRequest(`\`${field}\` must be a positive integer`);
+    }
+    return parsed;
+}
+function parseBoolean(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === "true")
+        return true;
+    if (value === "false")
+        return false;
+    throw invalidRequest("`include_archived` must be `true` or `false`");
+}