@a5c-ai/genty-runtime 5.1.1-staging.00ceebd28cf2

package/dist/daemon/types.d.ts

@@ -0,0 +1,122 @@
+/**
+ * GAP-REMOTE-001: Daemon Mode — Type definitions.
+ */
+import type { AutomationRule, TimerAutomationRule, WebhookAutomationRule } from "@a5c-ai/comm-adapter";
+export interface DaemonConfig {
+    workspace: string;
+    triggers: TriggerConfig[];
+    maxConcurrentRuns?: number;
+    triggerAdmission?: TriggerAdmissionConfig;
+}
+export interface TriggerRateLimitConfig {
+    maxTriggers: number;
+    windowMs: number;
+}
+export interface TriggerAdmissionConfig {
+    maxPendingRuns?: number;
+    rateLimit?: TriggerRateLimitConfig;
+    dedupeWindowMs?: number;
+}
+export interface FileTriggerConfig {
+    type: "file";
+    pattern: string;
+    processId: string;
+    entrypoint: string;
+    debounceMs?: number;
+}
+export type TriggerConfig = FileTriggerConfig | AutomationRule;
+export interface FileTriggerEvent {
+    type: "file";
+    processId: string;
+    entrypoint: string;
+    inputs?: Record<string, unknown>;
+}
+export interface AutomationTriggerEvent {
+    type: "automation";
+    rule: AutomationRule;
+    inputs?: Record<string, unknown>;
+}
+export type TriggerEvent = FileTriggerEvent | AutomationTriggerEvent;
+export declare function isFileTriggerConfig(trigger: TriggerConfig): trigger is FileTriggerConfig;
+export declare function isTimerAutomationRule(trigger: TriggerConfig): trigger is TimerAutomationRule;
+export declare function isWebhookAutomationRule(trigger: TriggerConfig): trigger is WebhookAutomationRule;
+export declare function isFileTriggerEvent(event: TriggerEvent): event is FileTriggerEvent;
+export declare function isAutomationTriggerEvent(event: TriggerEvent): event is AutomationTriggerEvent;
+export interface LegacyTriggerConfig {
+    type: "file" | "webhook" | "timer";
+    processId: string;
+    entrypoint: string;
+    pattern?: string;
+    port?: number;
+    cron?: string;
+    debounceMs?: number;
+}
+export interface DaemonStartOptions {
+    daemonDir: string;
+    workspace: string;
+    foreground?: boolean;
+    config?: DaemonConfig;
+}
+export interface DaemonStartOutput {
+    pid: number;
+    daemonDir: string;
+    startedAt: string;
+}
+export interface DaemonStopOptions {
+    daemonDir: string;
+    gracePeriodMs?: number;
+}
+export interface DaemonStopOutput {
+    pid: number;
+    stoppedAt: string;
+}
+export interface DaemonStatusOptions {
+    daemonDir: string;
+}
+export interface DaemonStatusOutput {
+    running: boolean;
+    pid?: number;
+    uptime?: number;
+    startedAt?: string;
+    activeTriggers?: number;
+    pendingRuns?: number;
+    deadLetterRuns?: number;
+}
+export interface DaemonWatchdogOptions {
+    daemonDir: string;
+    pollIntervalMs?: number;
+    maxRestarts?: number;
+    signal?: AbortSignal;
+}
+export interface DaemonWatchdogOutput {
+    restarts: number;
+    stoppedAt: string;
+}
+export interface FileWatcherHandle {
+    dispose(): void;
+}
+export interface WebhookListenerOptions {
+    rule: WebhookAutomationRule;
+    onTrigger: TriggerCallback;
+}
+export interface WebhookListenerHandle {
+    close(): Promise<void>;
+    port: number;
+}
+export type TriggerAdmissionStatus = "accepted" | "deferred" | "rejected" | "duplicate";
+export interface TriggerAdmissionResult {
+    status: TriggerAdmissionStatus;
+    reason?: string;
+    retryAfterMs?: number;
+    queueDepth?: number;
+    fingerprint?: string;
+}
+export type TriggerCallback = (trigger: TriggerEvent) => void | TriggerAdmissionResult | Promise<void | TriggerAdmissionResult>;
+export interface DaemonMetadata {
+    workspace: string;
+    startedAt: string;
+    triggers: TriggerConfig[];
+    maxConcurrentRuns: number;
+    pid: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/daemon/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/daemon/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,sBAAsB,CAAC;AAI9B,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,aAAa,GAAG,iBAAiB,GAAG,cAAc,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,MAAM,YAAY,GAAG,gBAAgB,GAAG,sBAAsB,CAAC;AAErE,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,IAAI,iBAAiB,CAExF;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,IAAI,mBAAmB,CAE5F;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,IAAI,qBAAqB,CAEhG;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,YAAY,GAAG,KAAK,IAAI,gBAAgB,CAEjF;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,YAAY,GAAG,KAAK,IAAI,sBAAsB,CAE7F;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,iBAAiB;IAChC,OAAO,IAAI,IAAI,CAAC;CACjB;AAID,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,SAAS,EAAE,eAAe,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;CACd;AAID,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,CAAC;AAExF,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,eAAe,GAAG,CAC5B,OAAO,EAAE,YAAY,KAClB,IAAI,GAAG,sBAAsB,GAAG,OAAO,CAAC,IAAI,GAAG,sBAAsB,CAAC,CAAC;AAI5E,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;CACb"}

package/dist/daemon/types.js

@@ -0,0 +1,25 @@
+"use strict";
+/**
+ * GAP-REMOTE-001: Daemon Mode — Type definitions.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isFileTriggerConfig = isFileTriggerConfig;
+exports.isTimerAutomationRule = isTimerAutomationRule;
+exports.isWebhookAutomationRule = isWebhookAutomationRule;
+exports.isFileTriggerEvent = isFileTriggerEvent;
+exports.isAutomationTriggerEvent = isAutomationTriggerEvent;
+function isFileTriggerConfig(trigger) {
+    return "type" in trigger && trigger.type === "file";
+}
+function isTimerAutomationRule(trigger) {
+    return "trigger" in trigger && trigger.trigger.type === "timer";
+}
+function isWebhookAutomationRule(trigger) {
+    return "trigger" in trigger && trigger.trigger.type === "webhook";
+}
+function isFileTriggerEvent(event) {
+    return event.type !== "automation";
+}
+function isAutomationTriggerEvent(event) {
+    return event.type === "automation";
+}

package/dist/daemon/webhookListener.d.ts

@@ -0,0 +1,6 @@
+/**
+ * GAP-REMOTE-001: Webhook Listener — HTTP trigger endpoint.
+ */
+import type { WebhookListenerOptions, WebhookListenerHandle } from "./types";
+export declare function createWebhookListener(options: WebhookListenerOptions): Promise<WebhookListenerHandle>;
+//# sourceMappingURL=webhookListener.d.ts.map

package/dist/daemon/webhookListener.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhookListener.d.ts","sourceRoot":"","sources":["../../src/daemon/webhookListener.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAA0B,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAIrG,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAiFhC"}

package/dist/daemon/webhookListener.js

@@ -0,0 +1,132 @@
+"use strict";
+/**
+ * GAP-REMOTE-001: Webhook Listener — HTTP trigger endpoint.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createWebhookListener = createWebhookListener;
+const http = __importStar(require("node:http"));
+const MAX_BODY_BYTES = 1024 * 1024; // 1 MiB
+async function createWebhookListener(options) {
+    const { rule, onTrigger } = options;
+    const port = rule.trigger.port;
+    const path = rule.trigger.path ?? "/trigger";
+    const method = rule.trigger.method ?? "POST";
+    const authToken = rule.trigger.auth?.type === "bearer" ? rule.trigger.auth.token : undefined;
+    const server = http.createServer((req, res) => {
+        if (req.method !== method || req.url !== path) {
+            res.writeHead(404, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Not found" }));
+            return;
+        }
+        // Auth check
+        if (authToken) {
+            const authHeader = req.headers.authorization;
+            if (!authHeader || authHeader !== `Bearer ${authToken}`) {
+                res.writeHead(401, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Unauthorized" }));
+                return;
+            }
+        }
+        let body = "";
+        let bodySize = 0;
+        req.on("data", (chunk) => {
+            bodySize += chunk.length;
+            if (bodySize > MAX_BODY_BYTES) {
+                res.writeHead(413, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Payload too large" }));
+                req.destroy();
+                return;
+            }
+            body += chunk.toString();
+        });
+        req.on("end", () => {
+            try {
+                const payload = JSON.parse(body);
+                const inputs = typeof payload.inputs === "object" && payload.inputs !== null && !Array.isArray(payload.inputs)
+                    ? payload.inputs
+                    : undefined;
+                void Promise.resolve(onTrigger({
+                    type: "automation",
+                    rule,
+                    inputs,
+                })).then((admission) => {
+                    const result = normalizeAdmissionResult(admission);
+                    res.writeHead(statusForAdmission(result), {
+                        "Content-Type": "application/json",
+                        ...(result.retryAfterMs ? { "Retry-After": String(Math.ceil(result.retryAfterMs / 1000)) } : {}),
+                    });
+                    res.end(JSON.stringify({ ok: result.status === "accepted" || result.status === "deferred", ...result }));
+                }, () => {
+                    res.writeHead(500, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "Trigger callback failed" }));
+                });
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Invalid JSON body" }));
+            }
+        });
+    });
+    return new Promise((resolve, reject) => {
+        server.on("error", reject);
+        server.listen(port, () => {
+            const addr = server.address();
+            const actualPort = typeof addr === "object" && addr ? addr.port : port;
+            resolve({
+                port: actualPort,
+                async close() {
+                    return new Promise((res, rej) => {
+                        server.close((err) => (err ? rej(err) : res()));
+                    });
+                },
+            });
+        });
+    });
+}
+function normalizeAdmissionResult(admission) {
+    return admission ?? { status: "accepted" };
+}
+function statusForAdmission(admission) {
+    if (admission.status === "accepted")
+        return 200;
+    if (admission.status === "deferred" || admission.status === "duplicate")
+        return 202;
+    if (admission.reason === "rate-limit")
+        return 429;
+    if (admission.reason === "queue-full")
+        return 503;
+    return 409;
+}

package/dist/execution/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Execution module — execution mode abstraction interfaces and implementations.
+ */
+export type { ExecutionMode, LocalExecutionConfig, DockerExecutionConfig, SshExecutionConfig, KubernetesExecutionConfig, ExecutionConfig, ExecutionHandle, ExecutionProvider, ExecutionPolicy, ExecutionEnvironmentPolicy, ExecutionFilesystemPolicy, ExecutionNetworkPolicy, ExecutionResourcePolicy, ExecutionSandboxPolicy, ExecutionMount, DockerPolicy, SshHostKeyPolicy, KubernetesPolicy, NormalizedResourceLimits, } from "./types";
+export { resolveExecutionEnvironment, validateFilesystemPolicy, validateFilesystemMounts, validateLocalExecutionPolicy, normalizeResourceLimits, admitExecutionPolicy, shouldInheritParentEnv, } from "./policy";
+export type { ResourceAdmission } from "./policy";
+export { LocalExecutor, DockerExecutor, SshExecutor, KubernetesExecutor, } from "./modes";
+export type { Executor, KubernetesExecutionHandle } from "./modes";
+export { ExecutionProviderImpl } from "./provider";
+//# sourceMappingURL=index.d.ts.map

package/dist/execution/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/execution/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,YAAY,EACV,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,yBAAyB,EACzB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,4BAA4B,EAC5B,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAGlD,OAAO,EACL,aAAa,EACb,cAAc,EACd,WAAW,EACX,kBAAkB,GACnB,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,QAAQ,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAC;AAGnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC"}

package/dist/execution/index.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExecutionProviderImpl = exports.KubernetesExecutor = exports.SshExecutor = exports.DockerExecutor = exports.LocalExecutor = exports.shouldInheritParentEnv = exports.admitExecutionPolicy = exports.normalizeResourceLimits = exports.validateLocalExecutionPolicy = exports.validateFilesystemMounts = exports.validateFilesystemPolicy = exports.resolveExecutionEnvironment = void 0;
+var policy_1 = require("./policy");
+Object.defineProperty(exports, "resolveExecutionEnvironment", { enumerable: true, get: function () { return policy_1.resolveExecutionEnvironment; } });
+Object.defineProperty(exports, "validateFilesystemPolicy", { enumerable: true, get: function () { return policy_1.validateFilesystemPolicy; } });
+Object.defineProperty(exports, "validateFilesystemMounts", { enumerable: true, get: function () { return policy_1.validateFilesystemMounts; } });
+Object.defineProperty(exports, "validateLocalExecutionPolicy", { enumerable: true, get: function () { return policy_1.validateLocalExecutionPolicy; } });
+Object.defineProperty(exports, "normalizeResourceLimits", { enumerable: true, get: function () { return policy_1.normalizeResourceLimits; } });
+Object.defineProperty(exports, "admitExecutionPolicy", { enumerable: true, get: function () { return policy_1.admitExecutionPolicy; } });
+Object.defineProperty(exports, "shouldInheritParentEnv", { enumerable: true, get: function () { return policy_1.shouldInheritParentEnv; } });
+// Mode executors
+var modes_1 = require("./modes");
+Object.defineProperty(exports, "LocalExecutor", { enumerable: true, get: function () { return modes_1.LocalExecutor; } });
+Object.defineProperty(exports, "DockerExecutor", { enumerable: true, get: function () { return modes_1.DockerExecutor; } });
+Object.defineProperty(exports, "SshExecutor", { enumerable: true, get: function () { return modes_1.SshExecutor; } });
+Object.defineProperty(exports, "KubernetesExecutor", { enumerable: true, get: function () { return modes_1.KubernetesExecutor; } });
+// Provider
+var provider_1 = require("./provider");
+Object.defineProperty(exports, "ExecutionProviderImpl", { enumerable: true, get: function () { return provider_1.ExecutionProviderImpl; } });

package/dist/execution/modes/docker.d.ts

@@ -0,0 +1,26 @@
+/**
+ * DockerExecutor — constructs `docker run` commands and spawns them
+ * via child_process.
+ *
+ * This is a structural stub: it correctly assembles the Docker CLI
+ * invocation from DockerExecutionConfig, but the host must have Docker
+ * installed and the daemon running for it to work at runtime.
+ */
+import type { ExecutionHandle, DockerExecutionConfig } from "../types";
+import type { Executor } from "./local";
+export declare class DockerExecutor implements Executor<DockerExecutionConfig> {
+    private readonly processes;
+    private readonly preflight;
+    constructor(options?: {
+        preflight?: (config: DockerExecutionConfig) => Promise<void>;
+    });
+    spawn(command: string, args: string[], config: DockerExecutionConfig): Promise<ExecutionHandle>;
+    attach(id: string): Promise<ExecutionHandle | undefined>;
+    list(): ExecutionHandle[];
+    destroy(id: string): Promise<void>;
+    /** Build the full `docker run` argument list. */
+    _buildDockerArgs(id: string, command: string, args: string[], config: DockerExecutionConfig): string[];
+    private _dockerNetwork;
+    private _toPublicHandle;
+}
+//# sourceMappingURL=docker.d.ts.map

package/dist/execution/modes/docker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../src/execution/modes/docker.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EACV,eAAe,EACf,qBAAqB,EACtB,MAAM,UAAU,CAAC;AAKlB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAsBxC,qBAAa,cAAe,YAAW,QAAQ,CAAC,qBAAqB,CAAC;IACpE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmD;gBAEjE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,qBAAqB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE;IAIhF,KAAK,CACT,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,eAAe,CAAC;IA+BrB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAM9D,IAAI,IAAI,eAAe,EAAE;IAInB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BxC,iDAAiD;IACjD,gBAAgB,CACd,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,MAAM,EAAE,qBAAqB,GAC5B,MAAM,EAAE;IAyEX,OAAO,CAAC,cAAc;IAiBtB,OAAO,CAAC,eAAe;CAyBxB"}

package/dist/execution/modes/docker.js

@@ -0,0 +1,183 @@
+"use strict";
+/**
+ * DockerExecutor — constructs `docker run` commands and spawns them
+ * via child_process.
+ *
+ * This is a structural stub: it correctly assembles the Docker CLI
+ * invocation from DockerExecutionConfig, but the host must have Docker
+ * installed and the daemon running for it to work at runtime.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DockerExecutor = void 0;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const policy_1 = require("../policy");
+// ---------------------------------------------------------------------------
+// DockerExecutor
+// ---------------------------------------------------------------------------
+class DockerExecutor {
+    processes = new Map();
+    preflight;
+    constructor(options) {
+        this.preflight = options?.preflight ?? (async () => { });
+    }
+    async spawn(command, args, config) {
+        const id = (0, node_crypto_1.randomUUID)();
+        if (config.policy?.docker?.skipPreflight !== true) {
+            await this.preflight(config);
+        }
+        const dockerArgs = this._buildDockerArgs(id, command, args, config);
+        const child = (0, node_child_process_1.spawn)("docker", dockerArgs, {
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        const handle = {
+            id,
+            mode: "docker",
+            status: "running",
+        };
+        const entry = { handle, process: child, config };
+        this.processes.set(id, entry);
+        child.on("exit", (code) => {
+            handle.status = code === 0 ? "stopped" : "failed";
+        });
+        child.on("error", () => {
+            handle.status = "failed";
+        });
+        return this._toPublicHandle(entry);
+    }
+    async attach(id) {
+        const entry = this.processes.get(id);
+        if (!entry)
+            return undefined;
+        return this._toPublicHandle(entry);
+    }
+    list() {
+        return [...this.processes.values()].map((e) => this._toPublicHandle(e));
+    }
+    async destroy(id) {
+        const entry = this.processes.get(id);
+        if (!entry)
+            return;
+        // Attempt `docker stop` on the container (uses the handle id as name).
+        const child = entry.process;
+        if (!child.killed && child.exitCode === null) {
+            child.kill("SIGTERM");
+            await new Promise((resolve) => {
+                const timeout = setTimeout(() => {
+                    if (!child.killed && child.exitCode === null) {
+                        child.kill("SIGKILL");
+                    }
+                    resolve();
+                }, 5_000);
+                child.on("exit", () => {
+                    clearTimeout(timeout);
+                    resolve();
+                });
+            });
+        }
+        entry.handle.status = "stopped";
+        this.processes.delete(id);
+    }
+    // ---------- Helpers -------------------------------------------------------
+    /** Build the full `docker run` argument list. */
+    _buildDockerArgs(id, command, args, config) {
+        const dockerArgs = ["run", "--rm", "--name", `babysitter-${id.slice(0, 8)}`];
+        const policy = config.policy;
+        (0, policy_1.validateFilesystemMounts)(policy);
+        const dockerPolicy = policy?.docker;
+        const insecureDocker = dockerPolicy?.insecureAllowPrivilegedOptions === true;
+        const readOnlyRoot = dockerPolicy?.readOnlyRootFilesystem ?? policy?.filesystem?.readOnlyRootFilesystem ?? true;
+        if (readOnlyRoot) {
+            dockerArgs.push("--read-only");
+        }
+        else if (!insecureDocker) {
+            throw new Error("Writable Docker root filesystem requires insecureAllowPrivilegedOptions");
+        }
+        for (const cap of dockerPolicy?.capDrop ?? ["ALL"]) {
+            dockerArgs.push("--cap-drop", cap);
+        }
+        for (const opt of dockerPolicy?.securityOpt ?? ["no-new-privileges"]) {
+            dockerArgs.push("--security-opt", opt);
+        }
+        dockerArgs.push("--user", dockerPolicy?.user ?? "65532:65532");
+        // Volume mounts.
+        if (config.volumes) {
+            for (const vol of config.volumes) {
+                dockerArgs.push("-v", vol);
+            }
+        }
+        for (const mount of policy?.filesystem?.mounts ?? []) {
+            const suffix = mount.readOnly ?? true ? ":ro" : "";
+            dockerArgs.push("-v", `${mount.hostPath}:${mount.containerPath}${suffix}`);
+        }
+        // Network.
+        const network = this._dockerNetwork(config);
+        if (network === "host" && !insecureDocker) {
+            throw new Error("Docker host network requires insecureAllowPrivilegedOptions");
+        }
+        dockerArgs.push("--network", network);
+        for (const dns of policy?.network?.dns ?? []) {
+            dockerArgs.push("--dns", dns);
+        }
+        if (policy?.resources?.cpuCount !== undefined) {
+            dockerArgs.push("--cpus", String(policy.resources.cpuCount));
+        }
+        if (policy?.resources?.memoryBytes !== undefined) {
+            dockerArgs.push("--memory", String(policy.resources.memoryBytes));
+        }
+        if (policy?.resources?.pidsLimit !== undefined) {
+            dockerArgs.push("--pids-limit", String(policy.resources.pidsLimit));
+        }
+        // Environment variables.
+        for (const [key, value] of Object.entries((0, policy_1.resolveExecutionEnvironment)(config.env, policy))) {
+            dockerArgs.push("-e", `${key}=${value}`);
+        }
+        // Image.
+        dockerArgs.push(config.image);
+        // Command and arguments.
+        dockerArgs.push(command, ...args);
+        return dockerArgs;
+    }
+    _dockerNetwork(config) {
+        if (config.network) {
+            return config.network;
+        }
+        const network = config.policy?.network;
+        if (!network) {
+            return "none";
+        }
+        if (network.mode === "custom") {
+            if (!network.name) {
+                throw new Error("Docker custom network policy requires a network name");
+            }
+            return network.name;
+        }
+        return network.mode ?? "none";
+    }
+    _toPublicHandle(entry) {
+        const self = this;
+        return {
+            get id() {
+                return entry.handle.id;
+            },
+            get mode() {
+                return entry.handle.mode;
+            },
+            get status() {
+                return entry.handle.status;
+            },
+            async attach() {
+                if (entry.process.stdout) {
+                    entry.process.stdout.pipe(process.stdout, { end: false });
+                }
+                if (entry.process.stderr) {
+                    entry.process.stderr.pipe(process.stderr, { end: false });
+                }
+            },
+            async destroy() {
+                await self.destroy(entry.handle.id);
+            },
+        };
+    }
+}
+exports.DockerExecutor = DockerExecutor;

package/dist/execution/modes/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Execution mode implementations — barrel export.
+ */
+export { LocalExecutor } from "./local";
+export type { Executor } from "./local";
+export { DockerExecutor } from "./docker";
+export { SshExecutor } from "./ssh";
+export { KubernetesExecutor } from "./kubernetes";
+export type { KubernetesExecutionHandle } from "./kubernetes";
+//# sourceMappingURL=index.d.ts.map

package/dist/execution/modes/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/execution/modes/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,YAAY,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC"}

package/dist/execution/modes/index.js

@@ -0,0 +1,14 @@
+"use strict";
+/**
+ * Execution mode implementations — barrel export.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KubernetesExecutor = exports.SshExecutor = exports.DockerExecutor = exports.LocalExecutor = void 0;
+var local_1 = require("./local");
+Object.defineProperty(exports, "LocalExecutor", { enumerable: true, get: function () { return local_1.LocalExecutor; } });
+var docker_1 = require("./docker");
+Object.defineProperty(exports, "DockerExecutor", { enumerable: true, get: function () { return docker_1.DockerExecutor; } });
+var ssh_1 = require("./ssh");
+Object.defineProperty(exports, "SshExecutor", { enumerable: true, get: function () { return ssh_1.SshExecutor; } });
+var kubernetes_1 = require("./kubernetes");
+Object.defineProperty(exports, "KubernetesExecutor", { enumerable: true, get: function () { return kubernetes_1.KubernetesExecutor; } });

package/dist/execution/modes/kubernetes.d.ts

@@ -0,0 +1,46 @@
+/**
+ * KubernetesExecutor — kubectl-backed Kubernetes Job execution.
+ */
+import type { ExecutionHandle, KubernetesExecutionConfig } from "../types";
+import type { Executor } from "./local";
+export interface KubectlResult {
+    stdout: string;
+    stderr: string;
+}
+export type KubectlInvoker = (args: string[], options?: {
+    input?: string;
+    timeoutMs?: number;
+}) => Promise<KubectlResult>;
+export interface KubernetesExecutorOptions {
+    kubectl?: KubectlInvoker;
+    kubectlPath?: string;
+    pollIntervalMs?: number;
+}
+export interface KubernetesExecutionHandle extends ExecutionHandle {
+    readonly mode: "kubernetes";
+    readonly manifest: string;
+    readonly jobName: string;
+    readonly logs?: string;
+}
+export declare class KubernetesExecutor implements Executor<KubernetesExecutionConfig> {
+    private readonly entries;
+    private readonly kubectl;
+    private readonly pollIntervalMs;
+    constructor(options?: KubernetesExecutorOptions);
+    spawn(command: string, args: string[], config: KubernetesExecutionConfig): Promise<KubernetesExecutionHandle>;
+    attach(id: string): Promise<KubernetesExecutionHandle | undefined>;
+    list(): KubernetesExecutionHandle[];
+    destroy(id: string): Promise<void>;
+    waitForCompletion(id: string): Promise<KubernetesExecutionHandle>;
+    _buildManifest(jobName: string, command: string, args: string[], config: KubernetesExecutionConfig): string;
+    private streamLogs;
+    private readJobStatus;
+    private _resourcesYaml;
+    private _resourcesFromConfig;
+    private _envYaml;
+    private _volumeMountsYaml;
+    private _volumesYaml;
+    private _securityContextYaml;
+    private _toPublicHandle;
+}
+//# sourceMappingURL=kubernetes.d.ts.map

package/dist/execution/modes/kubernetes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubernetes.d.ts","sourceRoot":"","sources":["../../../src/execution/modes/kubernetes.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EACV,eAAe,EACf,yBAAyB,EAC1B,MAAM,UAAU,CAAC;AAKlB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,cAAc,GAAG,CAC3B,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,KAC7C,OAAO,CAAC,aAAa,CAAC,CAAC;AAE5B,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAgBD,MAAM,WAAW,yBAA0B,SAAQ,eAAe;IAChE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,kBAAmB,YAAW,QAAQ,CAAC,yBAAyB,CAAC;IAC5E,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+B;IACvD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;gBAE5B,OAAO,CAAC,EAAE,yBAAyB;IAKzC,KAAK,CACT,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,yBAAyB,CAAC;IAuB/B,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC;IAMxE,IAAI,IAAI,yBAAyB,EAAE;IAI7B,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBlC,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAmCvE,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,MAAM,EAAE,yBAAyB,GAChC,MAAM;YA+CK,UAAU;YAWV,aAAa;IAmB3B,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,oBAAoB;IAW5B,OAAO,CAAC,QAAQ;IAchB,OAAO,CAAC,iBAAiB;IAezB,OAAO,CAAC,YAAY;IAepB,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,eAAe;CA6BxB"}