manifold-cli 0.0.39__py3-none-any.whl

manifold_cli/services/token.py

@@ -0,0 +1,52 @@
+"""Access-token use cases - create, list, and revoke credentials."""
+
+from datetime import datetime
+from typing import Protocol
+from uuid import UUID
+
+from manifold_cli.models.token import AccessToken, CreatedAccessToken, Scope
+
+
+class TokenApiClient(Protocol):
+    """The access-token endpoints TokenService drives on the API client."""
+
+    def create_access_token(
+        self,
+        name: str,
+        scopes: list[Scope],
+        *,
+        expires_at: datetime | None,
+    ) -> CreatedAccessToken: ...
+
+    def list_access_tokens(self) -> list[AccessToken]: ...
+
+    def revoke_access_token(self, token_id: UUID) -> AccessToken:
+        """Raise AccessTokenNotFoundError when the token is not the caller's."""
+        ...
+
+
+class TokenService:
+    def __init__(self, manifold_client: TokenApiClient):
+        self._manifold_client = manifold_client
+
+    def create(
+        self,
+        name: str,
+        scopes: list[Scope],
+        *,
+        expires_at: datetime | None,
+    ) -> CreatedAccessToken:
+        """Create an access token and return the only copy of its plaintext."""
+        return self._manifold_client.create_access_token(
+            name, scopes, expires_at=expires_at
+        )
+
+    # NOTE: this shadows the builtin `list` for the rest of the class body, so a
+    # method defined below cannot annotate anything as `list[...]`.
+    def list(self) -> list[AccessToken]:
+        """The caller's tokens, oldest first, revoked included."""
+        return self._manifold_client.list_access_tokens()
+
+    def revoke(self, token_id: UUID) -> AccessToken:
+        """Revoke an access token and return its stored metadata."""
+        return self._manifold_client.revoke_access_token(token_id)

manifold_cli/settings.py

@@ -0,0 +1,30 @@
+import os
+from pathlib import Path
+
+
+def _default_config_dir() -> Path:
+    xdg = os.environ.get("XDG_CONFIG_HOME")
+    base = Path(xdg) if xdg else Path.home() / ".config"
+    return base / "manifold"
+
+
+class Settings:
+    MANIFOLD_TOKEN: str | None = os.environ.get("MANIFOLD_TOKEN")
+    MANIFOLD_API_URL: str = os.environ.get(
+        "MANIFOLD_API_URL", "https://api.manifold.bifrost.ai"
+    )
+    MANIFOLD_WEBAPP_URL: str = os.environ.get(
+        "MANIFOLD_WEBAPP_URL",
+        MANIFOLD_API_URL.replace("://api.", "://app.", 1),
+    )
+    MANIFOLD_CONFIG_DIR: Path = Path(
+        os.environ.get("MANIFOLD_CONFIG_DIR", str(_default_config_dir()))
+    )
+    CREDENTIALS_PATH: Path = MANIFOLD_CONFIG_DIR / "credentials.json"
+    # The root the runner homes sit under. Overridable on its own, so a box
+    # under systemd puts them somewhere a service account reaches
+    # (/etc/manifold/runners) while the human's credential stays in the
+    # config dir.
+    MANIFOLD_RUNNERS_DIR: Path = Path(
+        os.environ.get("MANIFOLD_RUNNERS_DIR", str(MANIFOLD_CONFIG_DIR / "runners"))
+    )

manifold_cli/transport/__init__.py

@@ -0,0 +1,31 @@
+"""Transport package: interfaces, adapters, and the registry."""
+
+from manifold_cli.transport.interfaces import (
+    ByteStream,
+    Connector,
+    Listener,
+    StreamClosedError,
+    TransportError,
+)
+from manifold_cli.transport.iroh import IrohConnector, IrohListener, IrohTransport
+from manifold_cli.transport.registry import Transport, TransportRegistry
+from manifold_cli.transport.tcp import TcpConnector, TcpListener, TcpTransport
+
+DEFAULT_TRANSPORTS = TransportRegistry([TcpTransport(), IrohTransport()])
+
+__all__ = [
+    "DEFAULT_TRANSPORTS",
+    "ByteStream",
+    "Connector",
+    "IrohConnector",
+    "IrohListener",
+    "IrohTransport",
+    "Listener",
+    "StreamClosedError",
+    "TcpConnector",
+    "TcpListener",
+    "TcpTransport",
+    "Transport",
+    "TransportError",
+    "TransportRegistry",
+]

manifold_cli/transport/diagnostics.py

@@ -0,0 +1,72 @@
+"""Transport diagnostics: a built-in echo policy and a ping round-trip.
+
+These smoke-test a transport end to end -- `manifold policy serve --echo`
+serves the echo side and `manifold benchmark run --ping` dials it.
+"""
+
+import asyncio
+import time
+from collections.abc import Callable
+from dataclasses import dataclass
+
+from manifold_cli.transport.interfaces import ByteStream, Connector, Listener
+
+ECHO_CHUNK_SIZE = 64 * 1024
+
+OnEvent = Callable[[str], None]
+
+
+async def echo_once(stream: ByteStream, client: str, on_event: OnEvent) -> None:
+    """Echo one client's bytes back, logging each chunk it receives."""
+    total = 0
+    try:
+        while True:
+            chunk = await stream.read(ECHO_CHUNK_SIZE)
+            if not chunk:
+                break
+            total += len(chunk)
+            on_event(f"{client} received and echoed {len(chunk)} bytes")
+            await stream.write(chunk)
+    finally:
+        await stream.close()
+    on_event(f"{client} disconnected ({total} bytes total)")
+
+
+async def serve_echo(listener: Listener, on_event: OnEvent) -> None:
+    tasks: set[asyncio.Task[None]] = set()
+    client_count = 0
+    try:
+        while True:
+            stream = await listener.accept()
+            client_count += 1
+            client = f"client {client_count}"
+            on_event(f"{client} connected")
+            task = asyncio.create_task(echo_once(stream, client, on_event))
+            tasks.add(task)
+            task.add_done_callback(tasks.discard)
+    finally:
+        for task in tasks:
+            task.cancel()
+        await asyncio.gather(*tasks, return_exceptions=True)
+        await listener.close()
+
+
+@dataclass(frozen=True)
+class PingResult:
+    matched: bool
+    size: int
+    elapsed_ms: float
+
+
+async def ping(connector: Connector, payload: bytes) -> PingResult:
+    stream = await connector.connect()
+    start = time.perf_counter()
+    try:
+        await stream.write(payload)
+        echoed = await stream.read_exactly(len(payload))
+    finally:
+        await stream.close()
+    elapsed_ms = (time.perf_counter() - start) * 1000
+    return PingResult(
+        matched=echoed == payload, size=len(payload), elapsed_ms=elapsed_ms
+    )

manifold_cli/transport/interfaces.py

@@ -0,0 +1,69 @@
+"""Byte-only transport interfaces: ByteStream, Connector, Listener."""
+
+from typing import Protocol, runtime_checkable
+
+
+class TransportError(Exception):
+    """Transport-level error; adapters translate infrastructure failures into this."""
+
+
+class StreamClosedError(TransportError):
+    """Raised by `read_exactly` when EOF arrives before `n` bytes.
+
+    `partial` holds the bytes read before EOF.
+    """
+
+    def __init__(self, partial: bytes, expected: int) -> None:
+        self.partial = partial
+        self.expected = expected
+        super().__init__(
+            f"stream closed after {len(partial)} of {expected} expected bytes"
+        )
+
+
+@runtime_checkable
+class ByteStream(Protocol):
+    """A duplex byte pipe."""
+
+    async def read(self, n: int) -> bytes:
+        """Read up to `n` bytes; returns `b""` at EOF."""
+        ...
+
+    async def read_exactly(self, n: int) -> bytes:
+        """Read exactly `n` bytes; raises `StreamClosedError` on EOF."""
+        ...
+
+    async def write(self, data: bytes) -> None:
+        """Write all of `data` and flush."""
+        ...
+
+    async def close(self) -> None:
+        """Close the stream. Idempotent."""
+        ...
+
+
+@runtime_checkable
+class Connector(Protocol):
+    """The dialing side of a transport."""
+
+    async def connect(self) -> ByteStream:
+        """Open a new `ByteStream` to the configured peer."""
+        ...
+
+
+@runtime_checkable
+class Listener(Protocol):
+    """The serving side of a transport."""
+
+    @property
+    def target(self) -> str:
+        """Dialable target string (e.g. `tcp:HOST:PORT` or `iroh:ID`)."""
+        ...
+
+    async def accept(self) -> ByteStream:
+        """Return the next inbound stream; raises `StreamClosedError` if closed."""
+        ...
+
+    async def close(self) -> None:
+        """Stop accepting and release the bound address. Idempotent."""
+        ...

manifold_cli/transport/iroh.py

@@ -0,0 +1,317 @@
+"""Iroh (QUIC/NAT-traversal) transport adapter."""
+
+from __future__ import annotations
+
+import asyncio
+import contextlib
+import ctypes
+import logging
+import struct
+import weakref
+from collections.abc import Awaitable, Callable
+from importlib.metadata import version
+
+import iroh
+import iroh.iroh_ffi
+
+from manifold_cli.transport.interfaces import StreamClosedError, TransportError
+
+logger = logging.getLogger(__name__)
+
+ALPN = b"manifold/transport/0"
+# Nebius admits inbound UDP to the runners on exactly these ports, through
+# `runner_iroh_ingress` in manifold's
+# deployment/terraform-runners-nebius/network.tf. Change both together. The
+# port numbers are arbitrary: any free ports below Linux's ephemeral range
+# (32768-60999) work. Keep the range to eight ports, because Nebius accepts at
+# most eight destination ports in one security rule.
+ENDPOINT_PORTS = range(21300, 21308)
+READ_CHUNK_SIZE = 64 * 1024
+ONLINE_TIMEOUT_SECONDS = 20.0
+DRAIN_TIMEOUT_SECONDS = 5.0
+CLOSE_CODE_OK = 0
+
+# The replacements below match the `_UniffiRustBufferBuilder` methods
+# generated in these releases only; other releases are not patched.
+IROH_VERSIONS_WITH_BYTE_LOOP = frozenset({"1.0.0", "1.1.0"})
+
+
+def _pack_into(self, size, format, value) -> None:
+    with self._reserve(size):
+        packed = struct.pack(format, value)
+        if size > 0:
+            ctypes.memmove(
+                ctypes.addressof(self.rbuf.data.contents) + self.rbuf.len,
+                packed,
+                size,
+            )
+
+
+def _write(self, value) -> None:
+    length = len(value)
+    with self._reserve(length):
+        if length > 0:
+            # memmove refuses a bytearray or memoryview; the binding's
+            # check_lower admits any bytes-like value.
+            ctypes.memmove(
+                ctypes.addressof(self.rbuf.data.contents) + self.rbuf.len,
+                bytes(value),
+                length,
+            )
+
+
+if version("iroh") in IROH_VERSIONS_WITH_BYTE_LOOP:
+    iroh.iroh_ffi._UniffiRustBufferBuilder._pack_into = _pack_into
+    iroh.iroh_ffi._UniffiRustBufferBuilder.write = _write
+
+
+async def wait_online(endpoint: iroh.Endpoint) -> None:
+    # online() can hang; wrapped in a timeout (relay needed only for id-only dialing).
+    with contextlib.suppress(TimeoutError):
+        await asyncio.wait_for(endpoint.online(), timeout=ONLINE_TIMEOUT_SECONDS)
+
+
+class BiStream:
+    """The send + recv halves of one resolved iroh bi-directional stream."""
+
+    def __init__(self, send: iroh.SendStream, recv: iroh.RecvStream) -> None:
+        self.send = send
+        self.recv = recv
+
+
+class IrohByteStream:
+    """A `ByteStream` over one iroh bi-directional stream."""
+
+    def __init__(
+        self,
+        connection: iroh.Connection,
+        open_bi_stream: Callable[[iroh.Connection], Awaitable[BiStream]],
+    ) -> None:
+        self._connection = connection
+        self._open_bi_stream = open_bi_stream
+        self._bi: BiStream | None = None
+        self._closed = False
+        # bi_lock: concurrent first read+write must not open two separate bi-streams.
+        self._bi_lock = asyncio.Lock()
+
+    async def _bi_stream(self) -> BiStream:
+        if self._bi is None:
+            async with self._bi_lock:
+                if self._bi is None:
+                    self._bi = await self._open_bi_stream(self._connection)
+        return self._bi
+
+    async def read(self, n: int) -> bytes:
+        if n == 0:
+            return b""
+        bi = await self._bi_stream()
+        try:
+            return await bi.recv.read(n)
+        except iroh.IrohError:
+            # QUIC raises on peer-close where a socket would return b"" (EOF).
+            return b""
+
+    async def read_exactly(self, n: int) -> bytes:
+        if n == 0:
+            return b""
+        buffer = bytearray()
+        while len(buffer) < n:
+            chunk = await self.read(min(READ_CHUNK_SIZE, n - len(buffer)))
+            if not chunk:
+                raise StreamClosedError(bytes(buffer), n)
+            buffer.extend(chunk)
+        return bytes(buffer)
+
+    async def write(self, data: bytes) -> None:
+        if self._closed:
+            raise StreamClosedError(b"", len(data))
+        bi = await self._bi_stream()
+        await bi.send.write_all(data)
+
+    async def close(self) -> None:
+        if self._closed:
+            return
+        self._closed = True
+        # Must finish() then wait for stopped() before connection.close(): closing
+        # immediately drops buffered bytes the peer has not read yet.
+        try:
+            if self._bi is not None:
+                with contextlib.suppress(iroh.IrohError, TimeoutError):
+                    await self._bi.send.finish()
+                    await asyncio.wait_for(
+                        self._bi.send.stopped(), timeout=DRAIN_TIMEOUT_SECONDS
+                    )
+        finally:
+            with contextlib.suppress(iroh.IrohError):
+                self._connection.close(CLOSE_CODE_OK, b"closed")
+
+
+async def open_bi_dial(connection: iroh.Connection) -> BiStream:
+    bi = await connection.open_bi()
+    return BiStream(bi.send(), bi.recv())
+
+
+async def open_bi_accept(connection: iroh.Connection) -> BiStream:
+    bi = await connection.accept_bi()
+    return BiStream(bi.send(), bi.recv())
+
+
+class IrohConnector:
+    """Dials an iroh endpoint id from the process's shared `DialEndpoint`."""
+
+    def __init__(self, endpoint_id: str, dial_endpoint: DialEndpoint) -> None:
+        self._endpoint_id = endpoint_id.removeprefix("iroh:")
+        self._dial_endpoint = dial_endpoint
+
+    async def connect(self) -> IrohByteStream:
+        try:
+            endpoint_id = iroh.EndpointId.from_string(self._endpoint_id)
+        except iroh.IrohError as exc:
+            raise TransportError(
+                f"invalid iroh endpoint id {self._endpoint_id!r}"
+            ) from exc
+        endpoint = await self._dial_endpoint.endpoint()
+        await wait_online(endpoint)
+        addr = iroh.EndpointAddr(endpoint_id, None, [])
+        try:
+            connection = await endpoint.connect(addr, ALPN)
+        except iroh.IrohError as exc:
+            raise TransportError(
+                f"could not connect to iroh endpoint {self._endpoint_id!r}: {exc}"
+            ) from exc
+        return IrohByteStream(connection, open_bi_dial)
+
+
+class DialEndpoint:
+    """The one iroh endpoint that every `IrohConnector` of a process dials from.
+
+    The endpoint binds the first free port of `ports`, and a random port once
+    every port in the range is in use.
+    """
+
+    def __init__(self, ports: range, preset: Callable[[], iroh.Preset]) -> None:
+        self._ports = ports
+        self._preset = preset
+        self._endpoint: iroh.Endpoint | None = None
+        # One bind lock per event loop: an asyncio.Lock binds to the first loop
+        # it waits in, and the daemon runs each side in a loop of its own.
+        self._bind_locks: weakref.WeakKeyDictionary[
+            asyncio.AbstractEventLoop, asyncio.Lock
+        ] = weakref.WeakKeyDictionary()
+
+    async def endpoint(self) -> iroh.Endpoint:
+        """The endpoint, bound on first use."""
+        lock = self._bind_locks.setdefault(asyncio.get_running_loop(), asyncio.Lock())
+        # Concurrent first dials must not bind two endpoints.
+        async with lock:
+            if self._endpoint is None:
+                self._endpoint = await self._bind()
+            return self._endpoint
+
+    async def _bind(self) -> iroh.Endpoint:
+        return await bind_endpoint(self._ports, self._preset)
+
+
+class IrohListener:
+    """Accepts inbound iroh connections as `ByteStream`s."""
+
+    def __init__(self, endpoint: iroh.Endpoint) -> None:
+        self._endpoint = endpoint
+        self._endpoint_id = str(endpoint.id())
+        self._pending: list[IrohByteStream] = []
+        self._closed = False
+        self._ready = asyncio.Event()
+        self._accept_loop = asyncio.create_task(self._run_accept_loop())
+
+    @classmethod
+    async def open(
+        cls, ports: range, preset: Callable[[], iroh.Preset]
+    ) -> IrohListener:
+        endpoint = await bind_endpoint(ports, preset)
+        await wait_online(endpoint)
+        return cls(endpoint)
+
+    async def _run_accept_loop(self) -> None:
+        while not self._closed:
+            try:
+                incoming = await self._endpoint.accept_next()
+                if incoming is None:
+                    return
+                accepting = await incoming.accept()
+                connection = await accepting.connect()
+            except iroh.IrohError:
+                if self._closed:
+                    return
+                continue
+            # Hand off the connection; accept_bi blocks until peer writes (deadlock).
+            self._pending.append(IrohByteStream(connection, open_bi_accept))
+            self._ready.set()
+
+    @property
+    def target(self) -> str:
+        return f"iroh:{self._endpoint_id}"
+
+    async def accept(self) -> IrohByteStream:
+        while not self._pending:
+            if self._closed:
+                raise StreamClosedError(b"", 0)
+            self._ready.clear()
+            await self._ready.wait()
+        return self._pending.pop(0)
+
+    async def close(self) -> None:
+        if self._closed:
+            return
+        self._closed = True
+        self._ready.set()
+        self._accept_loop.cancel()
+        with contextlib.suppress(asyncio.CancelledError):
+            await self._accept_loop
+        try:
+            while self._pending:
+                with contextlib.suppress(iroh.IrohError):
+                    await self._pending.pop(0).close()
+        finally:
+            await self._endpoint.close()
+
+
+async def bind_endpoint(
+    ports: range, preset: Callable[[], iroh.Preset]
+) -> iroh.Endpoint:
+    """Bind an endpoint to the first free port of `ports`, or to a random port
+    once every port in the range is in use."""
+    error: iroh.IrohError | None = None
+    for port in ports:
+        try:
+            return await iroh.Endpoint.bind(
+                iroh.EndpointOptions(
+                    preset=preset(), alpns=[ALPN], bind_addr=f"0.0.0.0:{port}"
+                )
+            )
+        except iroh.IrohError as exc:
+            error = exc
+    logger.warning(
+        "could not bind iroh ports %d-%d (%s); binding a random port",
+        ports.start,
+        ports.stop - 1,
+        error,
+    )
+    return await iroh.Endpoint.bind(
+        iroh.EndpointOptions(preset=preset(), alpns=[ALPN], bind_addr=None)
+    )
+
+
+class IrohTransport:
+    """The `iroh` transport descriptor."""
+
+    scheme = "iroh"
+
+    def __init__(self) -> None:
+        self._dial_endpoint = DialEndpoint(ENDPOINT_PORTS, iroh.preset_n0)
+
+    def build_connector(self, rest: str) -> IrohConnector:
+        return IrohConnector(rest, self._dial_endpoint)
+
+    async def open_listener(self, rest: str) -> IrohListener:
+        del rest
+        return await IrohListener.open(ENDPOINT_PORTS, iroh.preset_n0)

manifold_cli/transport/registry.py

@@ -0,0 +1,34 @@
+"""Transport registry: maps `scheme:rest` target strings to adapter descriptors."""
+
+from collections.abc import Iterable
+from typing import Protocol
+
+from manifold_cli.transport.interfaces import Connector, Listener, TransportError
+
+
+class Transport(Protocol):
+    """A transport adapter descriptor exported by each adapter module."""
+
+    scheme: str
+
+    def build_connector(self, rest: str) -> Connector: ...
+    async def open_listener(self, rest: str) -> Listener: ...
+
+
+class TransportRegistry:
+    """Maps scheme to adapter; raises `TransportError` on unknown schemes."""
+
+    def __init__(self, transports: Iterable[Transport]) -> None:
+        self.transports = {transport.scheme: transport for transport in transports}
+
+    def resolve(self, target: str) -> tuple[Transport, str]:
+        """Split `target` into its adapter and the trailing `rest` (after `scheme:`)."""
+        scheme, _, rest = target.partition(":")
+        transport = self.transports.get(scheme)
+        if transport is None:
+            known = ", ".join(sorted(self.transports)) or "(none)"
+            raise TransportError(
+                f"unknown transport scheme {scheme!r} in target {target!r}; "
+                f"known schemes: {known}"
+            )
+        return transport, rest