jsruntime

type Binding struct {
	JS  string
	Cap string
}

type Budget struct {
	TimeoutMs      int `json:"timeoutMs,omitempty"`
	MemoryMB       int `json:"memoryMb,omitempty"`
	MaxCalls       int `json:"maxCalls,omitempty"`
	MaxSendCalls   int `json:"maxSendCalls,omitempty"`
	MaxLogBytes    int `json:"maxLogBytes,omitempty"`
	MaxResultBytes int `json:"maxResultBytes,omitempty"`
}

type BudgetPolicy struct {
	Defaults Budget     `json:"defaults,omitzero"`
	Maxima   Budget     `json:"maxima,omitzero"`
	Host     HostBudget `json:"host,omitzero"`
}

type BudgetSpec struct {
	Key   string `json:"key"`
	Label string `json:"label"`
	Unit  string `json:"unit"`
	// Factor converts the operator's unit to the stored one: a value entered as
	// seconds is stored as milliseconds with a factor of 1000. Every other figure on
	// this struct is already in the operator's unit; the field on Budget is not.
	Factor int `json:"factor"`
	// Default is what a run gets when nobody set one; DefaultMax is the most a run may
	// ask for while the operator has named no maximum. Both are Joro's own numbers, and
	// both are replaced outright by whatever the operator types.
	//
	// DefaultMax is absent only on a host spec, which has no requestable side and so no
	// maximum to speak of — one editable figure and, where it applies, a Cap.
	Default    int `json:"default"`
	DefaultMax int `json:"defaultMax,omitempty"`
	// Cap is the one figure the operator cannot exceed, and CapReason says what it is
	// fixed against. Zero means there is no cap and their number is final — which is
	// the case for most of these, so a field is never shown as free when it is not.
	Cap         int    `json:"cap,omitempty"`
	CapReason   string `json:"capReason,omitempty"`
	Description string `json:"description"`
}

type CallError struct {
	Code string
	Msg  string
	// Denied distinguishes an authorization refusal from a handler that ran and
	// failed. It changes the run's termination reason when the script does not
	// catch it, because a denial is fixed by a grant and a handler error is not.
	Denied bool
}

type HostBridge interface {
	// Invoke runs one capability. args and the returned value are JSON. An error
	// becomes a JavaScript throw; a *CallError additionally carries a code the
	// script can branch on and tells the runtime whether the failure was a denial.
	Invoke(ctx context.Context, id string, args json.RawMessage) (json.RawMessage, error)
}

type HostBudget struct {
	StorageOps       int `json:"storageOps,omitempty"`
	SourceBytes      int `json:"sourceBytes,omitempty"`
	ConcurrentRuns   int `json:"concurrentRuns,omitempty"`
	AgentLogBytes    int `json:"agentLogBytes,omitempty"`
	AgentResultBytes int `json:"agentResultBytes,omitempty"`
}

type Limits struct {
	Timeout     time.Duration `json:"timeout"`
	MemoryBytes int64         `json:"memoryBytes"`

	// MaxCalls bounds SDK calls of any kind; MaxSendCalls separately bounds the
	// subset that puts bytes on the wire. Two counters because the cost of a read
	// is context and the cost of a send is traffic against someone's target.
	MaxCalls     int `json:"maxCalls"`
	MaxSendCalls int `json:"maxSendCalls"`

	MaxLogBytes    int `json:"maxLogBytes"`
	MaxResultBytes int `json:"maxResultBytes"`

	// Cumulative bytes across every SDK call, in and out. A script that stays
	// inside MaxCalls can still drag megabytes through the bridge one call at a
	// time, and the parent has to hold each result in memory to forward it.
	MaxCallInputBytes  int `json:"maxCallInputBytes"`
	MaxCallOutputBytes int `json:"maxCallOutputBytes"`

	// MaxStorageOps and MaxSourceBytes come from the host half of the budget rather
	// than from anything a run or an author may request: one bounds how hard a loop
	// can hammer the host pipe, the other how large a program may be at all.
	MaxStorageOps  int `json:"maxStorageOps"`
	MaxSourceBytes int `json:"maxSourceBytes"`
}

type LogLine struct {
	At    string `json:"at"`
	Level string `json:"level"`
	Text  string `json:"text"`
}

type Meta struct {
	RunID     string `json:"runId"`
	StartedAt string `json:"startedAt"`

	AutomationID      string `json:"automationId,omitempty"`
	AutomationVersion string `json:"automationVersion,omitempty"`

	TriggerType string `json:"triggerType"`

	// TriggerData is merged into ctx.trigger beside the type, so an event-driven run
	// can see what woke it. It carries references — a request seq, a finding id, a
	// campaign id — and never a resolved object: the script fetches detail through the
	// SDK, where its principal is enforced. Receiving an event is not permission to
	// read what the event is about.
	TriggerData json.RawMessage `json:"triggerData,omitempty"`
}

type Request struct {
	Source string          `json:"source"`
	Input  json.RawMessage `json:"input,omitempty"`
	Meta   Meta            `json:"meta"`
	Limits Limits          `json:"limits"`

	// SendCaps names the capability IDs that put bytes on the wire, so the runtime
	// can charge them against MaxSendCalls. The host supplies it rather than this
	// package carrying a list of Joro capability IDs that could fall out of step
	// with the registry — and passing it as data means the in-process and worker
	// paths share one mechanism instead of the worker having to bridge an interface.
	SendCaps []string `json:"sendCaps,omitempty"`
}

type Result struct {
	Reason string `json:"reason"`

	// Outcome is Reason as a stable identifier, for a caller that branches on how the
	// run ended rather than displaying it. Derived from Reason by OutcomeFor and stamped
	// once, by the host, where a Result is turned into a run record — a direct Runtime
	// caller therefore sees it empty, which is why nothing inside this package reads it.
	Outcome string `json:"outcome"`

	// Err carries the script's own error message when Reason is an exception, a
	// denial, or a runtime failure. Never a Go error string with a wrapped chain —
	// the audience is a person reading Activity or a model correcting its own code.
	Err string `json:"err,omitempty"`

	// Value is the JSON-marshalled return value of run(). Absent unless the run
	// succeeded.
	Value json.RawMessage `json:"value,omitempty"`

	Logs          []LogLine `json:"logs,omitempty"`
	LogsTruncated bool      `json:"logsTruncated,omitempty"`

	Calls     int `json:"calls"`
	SendCalls int `json:"sendCalls"`
	// StorageOps counts joro.storage calls. Tracked separately from Calls because
	// storage is not a capability invocation: it consumes no registry budget, engages
	// no scope guard, and writes no audit entry.
	StorageOps      int `json:"storageOps,omitempty"`
	CallInputBytes  int `json:"callInputBytes"`
	CallOutputBytes int `json:"callOutputBytes"`

	// Budget is what this run was actually held to, after the operator's global was
	// applied. Reported rather than left implicit because a count with nothing to read
	// it against explains nothing — and because a model that asked for more than it got
	// learns the real number here, which the static tool schema cannot tell it.
	Budget Budget `json:"budget"`

	DurationMs int64 `json:"durationMs"`
}

type Runtime interface {
	Run(ctx context.Context, req Request, bridge HostBridge) (Result, error)
}

type StorageBridge interface {
	Storage(ctx context.Context, op, key string, value json.RawMessage) (json.RawMessage, error)
}

type VM struct{}

type WorkerRuntime struct {

	// Env is the child's environment. Nil inherits the parent's, which is the
	// default because the Go runtime reads a few variables and an empty environment
	// is not portable. It changes nothing about the sandbox either way: the script
	// has no way to read the process environment, since the global object holds no
	// accessor for one.
	Env []string
	// contains filtered or unexported fields
}