systemprompt-runtime 0.57.0

Application runtime for systemprompt.io AI governance infrastructure. AppContext, lifecycle builder, extension registry, and module wiring for the MCP governance pipeline.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94

//! Application-owned credential resolution for Git import, sync and
//! verification.
//!
//! Copyright (c) systemprompt.io — Business Source License 1.1.
//! See <https://systemprompt.io> for licensing details.

use super::OrchestrationError;
use std::collections::BTreeMap;
use systemprompt_config::SecretsBootstrap;
use systemprompt_identifiers::{ManagedSourceId, UserId};
use systemprompt_marketplace::managed::{
    GitSyncRequest, GitSyncResult, ManagedRepository, SourceSpec,
};
use systemprompt_models::feedback::verification::{
    DependencyVerificationManifest, DependencyVerificationRequest,
};

#[derive(Debug, Clone)]
pub struct GitSourceOrchestrator {
    managed: ManagedRepository,
}

impl GitSourceOrchestrator {
    pub const fn new(managed: ManagedRepository) -> Self {
        Self { managed }
    }

    pub async fn synchronize(
        &self,
        owner: &UserId,
        request: &GitSyncRequest,
    ) -> Result<GitSyncResult, OrchestrationError> {
        let credential = self.credential(owner, &request.source_id).await?;
        Ok(self
            .managed
            .sync_git_source_with_credential(owner, request, credential.as_deref())
            .await?)
    }

    pub async fn verify(
        &self,
        owner: &UserId,
        request: &DependencyVerificationRequest,
    ) -> Result<DependencyVerificationManifest, OrchestrationError> {
        request.validate().map_err(|error| {
            OrchestrationError::Source(format!("Invalid dependency verification request: {error}"))
        })?;
        let mut credentials = BTreeMap::new();
        for revision in &request.revisions {
            if !credentials.contains_key(&revision.source_id)
                && let Some(credential) = self.credential(owner, &revision.source_id).await?
            {
                credentials.insert(revision.source_id.clone(), credential);
            }
        }
        Ok(self
            .managed
            .verify_git_dependencies(owner, request, &credentials)
            .await?)
    }

    async fn credential(
        &self,
        owner: &UserId,
        source: &ManagedSourceId,
    ) -> Result<Option<String>, OrchestrationError> {
        match self.managed.get_source(owner, source).await? {
            SourceSpec::Git {
                credential_reference: Some(reference),
                ..
            } => {
                let secrets = SecretsBootstrap::get().map_err(|error| {
                    OrchestrationError::Source(format!("Git credentials are unavailable: {error}"))
                })?;
                let credential = secrets
                    .get(&reference)
                    .filter(|value| !value.is_empty())
                    .ok_or_else(|| {
                        OrchestrationError::Source(
                            "Git credential reference is unresolved".to_owned(),
                        )
                    })?;
                Ok(Some(credential.clone()))
            },
            SourceSpec::Git {
                credential_reference: None,
                ..
            } => Ok(None),
            _ => Err(OrchestrationError::Source(
                "Operation requires a registered Git source".to_owned(),
            )),
        }
    }
}