@b00dea/cockpit 0.0.0-stage → 0.1.0

package/dist/environment/lifecycle.js

@@ -0,0 +1,354 @@
+import { createHash } from 'node:crypto';
+import { ENVIRONMENT_CODES, snapshotLifecyclePlan, } from './contract.js';
+import { consumeLifecycleStageProjection } from './lifecycle-stage.js';
+import { consumePortLeaseProjection } from './ports.js';
+import { isRuntimeTopologyEvidence, isRuntimeServiceEvidence, } from './runtime.js';
+const SHA256 = /^[a-f0-9]{64}$/;
+const SERVICE_ID = /^[a-z0-9][a-z0-9_.-]*$/;
+const MAX_BASIS_BYTES = 1_048_576;
+const MAX_SERVICES = 4_096;
+const MAX_EDGES = 16_384;
+const MAX_VALIDITY_MS = 300_000;
+const DOMAIN = 'cockpit-lifecycle-work-basis/v1';
+const admittedUpPlans = new WeakMap();
+const issuedPlans = new WeakMap();
+function refusal(code, message, target) {
+    return {
+        kind: 'refusal',
+        diagnostics: [{ severity: 'error', code, message, target }],
+    };
+}
+function codePointCompare(left, right) {
+    const a = Array.from(left, (value) => value.codePointAt(0));
+    const b = Array.from(right, (value) => value.codePointAt(0));
+    for (let index = 0; index < Math.min(a.length, b.length); index += 1) {
+        if (a[index] !== b[index])
+            return a[index] - b[index];
+    }
+    return a.length - b.length;
+}
+function canonicalValue(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalValue);
+    if (value !== null && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value)
+            .sort(([left], [right]) => codePointCompare(left, right))
+            .map(([key, item]) => [key, canonicalValue(item)]));
+    }
+    return value;
+}
+function unique(values, key) {
+    return new Set(values.map(key)).size === values.length;
+}
+function canonicalSet(values, key) {
+    if (!unique(values, key))
+        return undefined;
+    return [...values].sort((left, right) => codePointCompare(key(left), key(right)));
+}
+function canonicalExecution(value) {
+    const paths = canonicalSet(value.paths, String);
+    const ports = unique(value.ports, String) ? [...value.ports].sort((left, right) => left - right) : undefined;
+    const consumedFiles = canonicalSet(value.consumedFiles, (item) => item.path);
+    const expected = canonicalSet(value.expected, (item) => JSON.stringify(canonicalValue(item)));
+    const filesystemChecks = canonicalSet(value.filesystemChecks, (item) => item.path);
+    if (!paths || !ports || !expected || !consumedFiles || !filesystemChecks)
+        return undefined;
+    const compensation = value.compensation.map(canonicalExecution);
+    if (compensation.some((item) => item === undefined))
+        return undefined;
+    return {
+        argv: [...value.argv], argv0: value.argv0, cwd: value.cwd, env: { ...value.env },
+        stdoutLimitBytes: value.stdoutLimitBytes,
+        stderrLimitBytes: value.stderrLimitBytes, paths, ports, expected: expected.map((item) => ({ ...item })),
+        consumedFiles: consumedFiles.map((item) => ({ ...item, argvIndexes: [...item.argvIndexes] })),
+        filesystemChecks: filesystemChecks.map((item) => ({ ...item })), compensation,
+    };
+}
+function workBasis(verb, semantics, ports, context = {}) {
+    const order = [...semantics.topology.order];
+    if (order.length > MAX_SERVICES || !unique(order, String) || order.some((service) => !SERVICE_ID.test(service))
+        || semantics.topology.services.length !== order.length || semantics.services.length !== order.length)
+        return undefined;
+    const serviceIds = new Set(order);
+    if (!unique(semantics.topology.services, ({ id }) => id)
+        || semantics.topology.services.some(({ id }) => !serviceIds.has(id)))
+        return undefined;
+    const topologyById = new Map(semantics.topology.services.map((service) => [service.id, service]));
+    let edgeCount = 0;
+    const topologyServices = [];
+    const serviceSemantics = [];
+    for (let index = 0; index < order.length; index += 1) {
+        const service = topologyById.get(order[index]);
+        const runtimeService = semantics.services[index];
+        if (!service || !runtimeService || service.id !== order[index] || runtimeService.id !== order[index]
+            || service.dependsOn.some((dependency) => !serviceIds.has(dependency)))
+            return undefined;
+        const dependencies = canonicalSet(service.dependsOn, String);
+        const mounts = canonicalSet(service.bindMountSources, String);
+        if (!dependencies || !mounts)
+            return undefined;
+        edgeCount += dependencies.length;
+        if (edgeCount > MAX_EDGES)
+            return undefined;
+        const start = canonicalExecution(runtimeService.start);
+        const status = canonicalExecution(runtimeService.status);
+        const identity = canonicalExecution(runtimeService.identity);
+        const inspect = canonicalExecution(runtimeService.inspect);
+        if (!start || !status || !identity || !inspect)
+            return undefined;
+        topologyServices.push({ id: service.id, dependsOn: dependencies, bindMountSources: mounts, healthcheck: service.healthcheck });
+        serviceSemantics.push({ id: runtimeService.id, start, status, identity, inspect, healthAcceptance: { ...runtimeService.healthAcceptance } });
+    }
+    const expectedMountSources = canonicalSet(semantics.runtimeChecks.expectedMountSources, String);
+    if (!expectedMountSources || ports.lease.stackId !== semantics.stackId
+        || !unique(ports.entrypoints, (entrypoint) => entrypoint.name))
+        return undefined;
+    // The basis names the work, so saved progress stays valid while the work is the same. Budgets
+    // (cold start, step timeouts) and the lifecycle stage are left out: the first `up` itself moves
+    // the stage to steady, and the next `up` read that as different work, re-ran every start as a
+    // no-op and reported a fresh start with an invented cold-start time. The leased ports stand in
+    // for the entrypoint URLs derived from them, which only name those ports.
+    const basis = canonicalValue({
+        domain: DOMAIN, verb, stackId: semantics.stackId, configSha256: semantics.configSha256,
+        runtimeVersion: semantics.runtimeVersion, composeVersion: semantics.composeVersion,
+        projectName: semantics.projectName,
+        runtimeChecks: { expectedMountSources },
+        topology: { order, services: topologyServices }, services: serviceSemantics,
+        ports: { ...ports.lease.ports },
+        ...(context.reclaim === undefined ? {} : {
+            reclaim: {
+                planDigest: context.reclaim.planDigest,
+                commitments: context.reclaim.commitments.map(({ targetId, format, sha256, body }) => ({
+                    targetId, format, sha256, body,
+                })),
+            },
+        }),
+    });
+    const serialized = JSON.stringify(basis);
+    if (Buffer.byteLength(serialized, 'utf8') > MAX_BASIS_BYTES)
+        return undefined;
+    return createHash('sha256').update(Buffer.from(serialized, 'utf8')).digest('hex');
+}
+function consumePlannerEvidence(runtimeProjection, portProjection) {
+    const runtime = isRuntimeTopologyEvidence(runtimeProjection.topology) ? runtimeProjection : undefined;
+    const ports = consumePortLeaseProjection(portProjection);
+    if (!runtime || !ports || runtime.semantics.stackId !== ports.lease.stackId
+        || !Number.isSafeInteger(ports.ownership.holderCount) || ports.ownership.holderCount < 0
+        || ports.ownership.holderIds.length !== ports.ownership.holderCount
+        || !unique(ports.ownership.holderIds, String)
+        || !ports.ownership.holderIds.includes(ports.ownership.holderId))
+        return undefined;
+    return { runtime, ports };
+}
+function validProgress(progress) {
+    return progress === null || SHA256.test(progress.workBasisSha256) && SHA256.test(progress.operationGeneration)
+        && progress.completedServices.length <= MAX_SERVICES
+        && progress.completedServices.every((item) => SERVICE_ID.test(item.service) && SHA256.test(item.containerId));
+}
+function completedPrefix(evidence, progress, runtime) {
+    if (evidence.length !== progress.completedServices.length)
+        return undefined;
+    for (let index = 0; index < evidence.length; index += 1) {
+        const item = evidence[index];
+        const completed = progress.completedServices[index];
+        const service = runtime.semantics.services[index];
+        if (!item || !completed || !service
+            || item.stackId !== runtime.semantics.stackId || item.configSha256 !== runtime.semantics.configSha256
+            || item.batchId !== runtime.topology.batchId || item.executableSha256 !== runtime.topology.executableSha256
+            || item.runtimeVersion !== runtime.semantics.runtimeVersion || item.composeVersion !== runtime.semantics.composeVersion
+            || item.projectName !== runtime.semantics.projectName || item.service !== service.id
+            || item.service !== completed.service || item.containerId !== completed.containerId
+            || item.state !== service.healthAcceptance.state || item.health !== service.healthAcceptance.health)
+            return undefined;
+    }
+    return evidence;
+}
+function lifecyclePlan(verb, workBasisSha256, operationGeneration, completedServices, steps, completedStepCount, compensation) {
+    const plan = snapshotLifecyclePlan({
+        verb,
+        progress: { workBasisSha256, operationGeneration, completedServices },
+        steps,
+        resumeBoundary: {
+            completedStepIds: steps.slice(0, completedStepCount).map(({ id }) => id),
+            nextStepId: steps[completedStepCount]?.id ?? null,
+        },
+        compensation,
+        diagnostics: [],
+    });
+    return plan;
+}
+function issue(plan, issuance) {
+    issuedPlans.set(plan, issuance);
+    return plan;
+}
+export function consumeLifecycleIssuance(plan) {
+    if (!plan || typeof plan !== 'object')
+        return undefined;
+    const issuance = issuedPlans.get(plan);
+    if (!issuance)
+        return undefined;
+    issuedPlans.delete(plan);
+    return issuance;
+}
+export function admitUpProgress(input) {
+    if (!SHA256.test(input.operationGeneration)) {
+        return refusal(ENVIRONMENT_CODES.LIFECYCLE_EVIDENCE_INVALID, 'lifecycle planning evidence is invalid', 'up');
+    }
+    const stage = consumeLifecycleStageProjection(input.lifecycleStage);
+    const evidence = consumePlannerEvidence(input.runtime, input.ports);
+    if (!stage || !evidence || stage.stackId !== evidence.runtime.semantics.stackId) {
+        return refusal(ENVIRONMENT_CODES.LIFECYCLE_EVIDENCE_INVALID, 'lifecycle planning evidence is invalid', 'up');
+    }
+    const basis = workBasis('up', evidence.runtime.semantics, evidence.ports);
+    if (!basis)
+        return refusal(ENVIRONMENT_CODES.LIFECYCLE_EVIDENCE_INVALID, 'lifecycle work evidence is invalid', 'up');
+    const prior = input.progress;
+    if (!validProgress(prior) || prior !== null && (prior.workBasisSha256 !== basis
+        || prior.operationGeneration !== input.operationGeneration)) {
+        return refusal(ENVIRONMENT_CODES.LIFECYCLE_PROGRESS_INVALID, 'lifecycle progress does not match the current work', 'up-progress');
+    }
+    const progress = prior ?? {
+        workBasisSha256: basis,
+        operationGeneration: input.operationGeneration,
+        completedServices: [],
+    };
+    const authority = {};
+    admittedUpPlans.set(authority, { ...evidence, progress, mode: prior === null ? 'start' : 'resume' });
+    return { kind: 'admitted', authority };
+}
+export function planAdmittedUp(input) {
+    const evidence = admittedUpPlans.get(input.authority);
+    admittedUpPlans.delete(input.authority);
+    const now = Date.now();
+    const window = evidence?.runtime.topology.observationWindow;
+    if (!evidence || !window
+        || !Number.isFinite(Date.parse(window.startedAt)) || !Number.isFinite(Date.parse(window.expiresAt))
+        || now < Date.parse(window.startedAt) || now > Date.parse(window.expiresAt)) {
+        return refusal(ENVIRONMENT_CODES.LIFECYCLE_EVIDENCE_INVALID, 'lifecycle planning authority is unavailable or expired', 'up');
+    }
+    const { progress } = evidence;
+    const completedEvidence = input.completedServices;
+    if (completedEvidence.length > MAX_SERVICES || !completedEvidence.every((item) => isRuntimeServiceEvidence(item))) {
+        return refusal(ENVIRONMENT_CODES.LIFECYCLE_EVIDENCE_INVALID, 'completed service evidence is invalid', 'up-evidence');
+    }
+    const completed = completedPrefix(completedEvidence, progress, evidence.runtime);
+    const order = evidence.runtime.semantics.topology.order;
+    if (!completed || completed.length > order.length
+        || completed.some((item, index) => item.service !== order[index])) {
+        return refusal(ENVIRONMENT_CODES.LIFECYCLE_PROGRESS_INVALID, 'completed services are not the current dependency prefix', 'up-progress');
+    }
+    const steps = [
+        { id: 'lifecycle:preflight', kind: 'preflight' },
+        { id: 'lifecycle:claim:acquire', kind: 'claim', action: 'acquire' },
+        ...order.map((service) => ({ id: `lifecycle:service:${service}`, kind: 'service', service })),
+        {
+            id: 'lifecycle:entrypoints', kind: 'publish-entrypoints',
+            values: evidence.ports.entrypoints.map((entrypoint) => ({ ...entrypoint })),
+        },
+    ];
+    const compensation = evidence.ports.ownership.change === 'acquired'
+        ? [{
+                step: { id: 'lifecycle:claim:release', kind: 'claim', action: 'release' },
+                ownership: {
+                    stackId: evidence.ports.lease.stackId, holderId: evidence.ports.ownership.holderId,
+                    recordRevision: evidence.ports.ownership.recordRevision, change: 'acquired',
+                },
+            }] : [];
+    const complete = completed.length === order.length && evidence.mode === 'resume';
+    const completedStepCount = complete ? steps.length : 2 + completed.length;
+    const plan = lifecyclePlan('up', progress.workBasisSha256, progress.operationGeneration, progress.completedServices, steps, completedStepCount, compensation);
+    if (!plan)
+        return refusal(ENVIRONMENT_CODES.LIFECYCLE_EVIDENCE_INVALID, 'lifecycle plan could not be represented', 'up');
+    issue(plan, {
+        topology: evidence.runtime.topology, firstIncompleteServiceIndex: completed.length,
+        portOwnership: evidence.ports.ownership, drainRequest: null, reclaim: null,
+    });
+    if (complete)
+        return { kind: 'noop', plan };
+    return { kind: 'execute', mode: evidence.mode, plan };
+}
+function validDrainInputs(generation, runtimeStopValidForMs, reclaimValidForMs) {
+    const validity = (ms) => Number.isSafeInteger(ms) && ms >= 1 && ms <= MAX_VALIDITY_MS;
+    return SHA256.test(generation) && validity(runtimeStopValidForMs)
+        && (reclaimValidForMs === undefined || validity(reclaimValidForMs));
+}
+function drainRequest(purpose, evidence, generation, runtimeStopValidForMs, reclaimValidForMs, reclaim) {
+    const operationBasis = workBasis(purpose, evidence.runtime.semantics, evidence.ports, reclaim === undefined ? {} : { reclaim });
+    const targetIds = [
+        evidence.runtime.semantics.stackId,
+        ...(reclaim?.commitments.map(({ targetId }) => targetId) ?? []),
+    ].sort();
+    const actions = [
+        { stage: 'runtime-stop', targetId: evidence.runtime.semantics.stackId, validForMs: runtimeStopValidForMs },
+        ...(reclaim?.commitments.map(({ targetId, ...targetCommitment }) => ({
+            stage: 'reclaim', targetId, validForMs: reclaimValidForMs, targetCommitment: { ...targetCommitment },
+        })) ?? []),
+    ];
+    return {
+        purpose, stackId: evidence.runtime.semantics.stackId,
+        holderId: evidence.ports.ownership.holderId, requesterId: evidence.ports.ownership.holderId,
+        configSha256: evidence.runtime.semantics.configSha256,
+        planDigest: reclaim?.planDigest ?? operationBasis,
+        operationBasis, generation,
+        targetIds, actions, expectedCoordinationRevision: evidence.ports.ownership.recordRevision,
+    };
+}
+function passivePlan(verb, evidence, generation, steps, request, reclaim) {
+    const basis = workBasis(verb, evidence.runtime.semantics, evidence.ports, reclaim === null ? {} : { reclaim });
+    if (!basis)
+        return undefined;
+    const plan = lifecyclePlan(verb, basis, generation, [], steps, 0, []);
+    if (!plan)
+        return undefined;
+    return issue(plan, {
+        topology: evidence.runtime.topology, firstIncompleteServiceIndex: 0,
+        portOwnership: evidence.ports.ownership, drainRequest: request, reclaim,
+    });
+}
+export function planSleep(input) {
+    if (!validDrainInputs(input.operationGeneration, input.runtimeStopValidForMs)) {
+        return refusal(ENVIRONMENT_CODES.LIFECYCLE_EVIDENCE_INVALID, 'sleep planning evidence is invalid', 'sleep');
+    }
+    const evidence = consumePlannerEvidence(input.runtime, input.ports);
+    if (!evidence)
+        return refusal(ENVIRONMENT_CODES.LIFECYCLE_EVIDENCE_INVALID, 'sleep planning evidence is invalid', 'sleep');
+    if (evidence.ports.ownership.holderCount > 1) {
+        const steps = [{ id: 'lifecycle:claim:release', kind: 'claim', action: 'release' }];
+        const plan = passivePlan('sleep', evidence, input.operationGeneration, steps, null, null);
+        return plan ? { kind: 'release-only', plan }
+            : refusal(ENVIRONMENT_CODES.LIFECYCLE_EVIDENCE_INVALID, 'sleep plan could not be represented', 'sleep');
+    }
+    const request = drainRequest('sleep', evidence, input.operationGeneration, input.runtimeStopValidForMs);
+    const plan = passivePlan('sleep', evidence, input.operationGeneration, [{ id: 'lifecycle:preflight', kind: 'preflight' }], request, null);
+    return plan ? { kind: 'drain', plan, request }
+        : refusal(ENVIRONMENT_CODES.LIFECYCLE_EVIDENCE_INVALID, 'sleep plan could not be represented', 'sleep');
+}
+function planDestructive(verb, input) {
+    if (!validDrainInputs(input.operationGeneration, input.runtimeStopValidForMs, input.reclaimValidForMs)) {
+        return refusal(ENVIRONMENT_CODES.LIFECYCLE_EVIDENCE_INVALID, `${verb} planning evidence is invalid`, verb);
+    }
+    const evidence = consumePlannerEvidence(input.runtime, input.ports);
+    const reclaim = input.reclaim;
+    if (!evidence || reclaim.purpose !== verb || reclaim.stackId !== evidence.runtime.semantics.stackId
+        || reclaim.configSha256 !== evidence.runtime.semantics.configSha256
+        || verb === 'reset' && reclaim.commitments.length === 0
+        || !unique(reclaim.commitments, ({ targetId }) => targetId)
+        || reclaim.commitments.some(({ targetId }, index) => index > 0
+            && reclaim.commitments[index - 1].targetId >= targetId)
+        || reclaim.commitments.some(({ targetId }) => targetId === evidence.runtime.semantics.stackId)) {
+        return refusal(ENVIRONMENT_CODES.LIFECYCLE_EVIDENCE_INVALID, `${verb} requires valid runtime, port, and reclaim evidence`, verb);
+    }
+    if (evidence.ports.ownership.holderCount !== 1) {
+        return refusal(ENVIRONMENT_CODES.CLAIM_CO_TENANT, `${verb} requires exact exclusive ownership`, verb);
+    }
+    const request = drainRequest(verb, evidence, input.operationGeneration, input.runtimeStopValidForMs, input.reclaimValidForMs, reclaim);
+    const plan = passivePlan(verb, evidence, input.operationGeneration, [{ id: 'lifecycle:preflight', kind: 'preflight' }], request, reclaim);
+    return plan ? { kind: 'drain', plan, request }
+        : refusal(ENVIRONMENT_CODES.LIFECYCLE_EVIDENCE_INVALID, `${verb} plan could not be represented`, verb);
+}
+export function planDown(input) {
+    return planDestructive('down', input);
+}
+export function planResetLifecycle(input) {
+    return planDestructive('reset', input);
+}

package/dist/environment/logs.d.ts

@@ -0,0 +1,132 @@
+import { type ExecuteProbeOutcome } from '../environment-exec/execute.js';
+import { ENVIRONMENT_CODES, type ExecutionFailureCode, type ExecutionStep, type StackId } from './contract.js';
+import { type CapturedRuntimeEvidence } from './evidence.js';
+import { type ComposeArtifact, type RuntimeAdapterAuthority, type RuntimeServiceFailureEvidence, type RuntimeServiceObservation } from './runtime.js';
+import { type ResolvedExecutable } from './executable.js';
+export interface LogRequest {
+    runtime: 'docker-compose';
+    executable: ResolvedExecutable;
+    cwd: string;
+    stackId: StackId;
+    configSha256: string;
+    batchId: string;
+    containerId: string;
+    runtimeVersion: string;
+    composeVersion: string;
+    restartBatches?: readonly [string, string];
+    projectName: string;
+    composeFiles: readonly ComposeArtifact[];
+    services: readonly string[];
+    service: string;
+    since: string;
+    tail: number;
+    follow: boolean;
+    timeoutMs: number;
+    outputLimitBytes: number;
+    env: Readonly<Record<string, string>>;
+}
+export type LogPlan = {
+    kind: 'planned';
+    step: ExecutionStep;
+} | {
+    kind: 'unavailable';
+    code: typeof ENVIRONMENT_CODES.RUNTIME_UNAVAILABLE | typeof ENVIRONMENT_CODES.EVIDENCE_UNAVAILABLE;
+    reason: string;
+};
+export declare function planLogs(rawInput: LogRequest, ownComposeAuthority?: Extract<RuntimeAdapterAuthority, {
+    ownComposeFiles: true;
+}>): LogPlan;
+export interface FailureLogRequest {
+    readonly evidence: RuntimeServiceObservation | RuntimeServiceFailureEvidence;
+    readonly tail: number;
+    readonly timeoutMs: number;
+    readonly outputLimitBytes: number;
+}
+export type FailureLogPlan = {
+    readonly kind: 'planned';
+    readonly step: ExecutionStep;
+} | {
+    readonly kind: 'unavailable';
+    readonly reason: string;
+};
+export declare function planFailureLogs(input: FailureLogRequest): FailureLogPlan;
+export type LogExecution = ExecuteProbeOutcome;
+export type LogRecord = Readonly<{
+    stackId: StackId;
+    configSha256: string;
+    batchId: string;
+    containerId: string;
+    service: string;
+    runtimeVersion: string;
+    executableSha256: string;
+    timestamp: string;
+    message: string;
+    stream: 'stdout' | 'stderr';
+    restart: boolean;
+}>;
+export type EarlyFailureLogRecord = Readonly<Omit<LogRecord, 'containerId' | 'stream'> & {
+    containerId: null;
+    stream: 'combined';
+}>;
+export type FailureLogRecord = LogRecord | EarlyFailureLogRecord;
+export type FailureLogAdmission = {
+    readonly kind: 'complete';
+    readonly records: readonly FailureLogRecord[];
+} | {
+    readonly kind: 'unavailable';
+    readonly records: readonly FailureLogRecord[];
+} | {
+    readonly kind: 'unavailable';
+    readonly code: ExecutionFailureCode;
+    readonly service: string;
+    readonly records: readonly FailureLogRecord[];
+};
+export declare function admitFailureLogs(input: {
+    readonly plan: FailureLogPlan;
+    readonly outcome: ExecuteProbeOutcome;
+}): FailureLogAdmission;
+/**
+ * The bounded message a failed service's diagnostic carries. A restart policy replays the same crash
+ * on every start, which filled the excerpt with one line repeated; each distinct line is shown once,
+ * where it last occurred, with its count. A line is labelled with its stream only when the runtime
+ * reported which stream it was.
+ */
+export declare function failureLogExcerpt(service: string, records: readonly FailureLogRecord[]): string;
+export interface RestartWindow {
+    readonly before: CapturedRuntimeEvidence;
+    readonly after: CapturedRuntimeEvidence;
+}
+export declare function collectLogs(plan: Extract<LogPlan, {
+    kind: 'planned';
+}>, execute: (step: ExecutionStep, options: {
+    signal?: AbortSignal;
+}) => Promise<LogExecution>, signal?: AbortSignal, restart?: RestartWindow): Promise<{
+    kind: 'unavailable';
+    code: "EVIDENCE_UNAVAILABLE";
+    reason: string;
+    records: never[];
+} | {
+    kind: 'unavailable';
+    code: "EXECUTION_ABORTED" | "EXECUTION_PRECONDITION_CHANGED" | "EXECUTION_SPAWN_FAILED" | "EXECUTION_STAGING_CLEANUP_FAILED" | "EXECUTION_STAGING_FAILED" | "EXECUTION_STDERR_LIMIT" | "EXECUTION_STDOUT_LIMIT" | "EXECUTION_STEP_FAILED" | "EXECUTION_TERMINATION_UNCONFIRMED" | "EXECUTION_TIMEOUT";
+    reason: string;
+    records: never[];
+    truncated?: undefined;
+} | {
+    reason?: undefined;
+    code?: undefined;
+    kind: "cancelled" | "complete";
+    records: Readonly<{
+        stackId: StackId;
+        configSha256: string;
+        batchId: string;
+        containerId: string;
+        service: string;
+        runtimeVersion: string;
+        executableSha256: string;
+        timestamp: string;
+        message: string;
+        stream: 'stdout' | 'stderr';
+        restart: boolean;
+    }>[];
+    truncated: boolean;
+}>;