@descryy/runtime-orchestrator 0.4.8 → 0.4.9

package/dist/cgroup-partial-restriction.d.ts

@@ -1,80 +0,0 @@
-/**
- * Partial going-forward resource restriction for an already-running, attached-to
- * process, via cgroups v2 — narrower alternative to `respawn-and-supervise.ts`.
- *
- * Moving a live pid into a delegated cgroup applies real kernel-enforced limits
- * (`memory.max`, `cpu.max`, `pids.max`) without killing/restarting it. **It does
- * NOT and cannot give filesystem or network isolation** — that needs `setns()`
- * against a live pid, out of scope here. `CGROUP_PARTIAL_RESTRICTION_SCOPE` is the
- * literal string every result carries so nothing downstream rounds this up to
- * "sandboxed"/"isolated" (which would misrepresent it as `sandbox.ts`'s real
- * spawn-time bwrap isolation).
- *
- * Finding the delegated ancestor: a non-root user can only write under
- * `/sys/fs/cgroup` where a systemd user session delegates it (`Delegate=yes`).
- * Delegation isn't uniform all the way down — a leaf cgroup already holding a
- * process (e.g. this Node process's own scope) generally can't extend
- * `subtree_control` further; writing fails `EBUSY` (measured on this repo's dev
- * host). So `findDelegatedCgroupAncestor` doesn't trust subtree_control text or
- * permission bits — it walks up from `/proc/self/cgroup` and, at each ancestor,
- * creates a real temporary probe child and checks whether the kernel actually gave
- * it a `memory.max` file.
- */
-import type { CapabilityStatus } from "@descryy/runtime-contracts";
-/** Literal scope string every `CgroupMoveResult` carries under `scope` — never restated by hand, so quotes of it can't drift. */
-export declare const CGROUP_PARTIAL_RESTRICTION_SCOPE: "partial -- resource limits only, no filesystem or network isolation";
-/**
- * Walks up from this process's cgroup toward `/sys/fs/cgroup`, returning the
- * deepest ancestor whose children genuinely get a real `memory.max` — the actual
- * delegation boundary. `null` if cgroups v2 isn't mounted, own path can't be
- * determined, or no ancestor passes the probe.
- */
-export declare function findDelegatedCgroupAncestor(): string | null;
-export declare function cgroupV2Capability(): CapabilityStatus;
-export interface CgroupResourceLimits {
-    /**
-     * Maps to cgroups v2 `memory.max`, in bytes. Also writes `memory.swap.max=0` for
-     * the same cgroup — measured: with swap available, `memory.max` alone doesn't
-     * kill anything, it just pushes pages to swap under pressure. Disabling swap is
-     * what makes it a hard, OOM-killer-enforced limit rather than a soft one. Not
-     * independently toggleable — "cap it but let it swap" would be a separate field.
-     */
-    readonly memoryMaxBytes?: number;
-    /** Maps to cgroups v2 `pids.max` -- caps tasks (processes/threads) this cgroup may hold. */
-    readonly maxProcesses?: number;
-    /**
-     * Raw cgroups v2 `cpu.max` value (`"$MAX $PERIOD"`, e.g. `"50000 100000"` for
-     * 50% of one CPU). Throws rather than silently dropping if the delegated
-     * ancestor has no writable `cpu.max` — measured on this repo's dev host: `cpu`
-     * was NOT delegated at the same level `memory`/`pids` were.
-     */
-    readonly cpuMax?: string;
-}
-export interface CgroupMoveResult {
-    readonly applied: true;
-    readonly cgroupPath: string;
-    /** Always the literal `CGROUP_PARTIAL_RESTRICTION_SCOPE` string. */
-    readonly scope: typeof CGROUP_PARTIAL_RESTRICTION_SCOPE;
-    readonly appliedLimits: CgroupResourceLimits;
-    /**
-     * Best-effort removal of the cgroup this call created. Succeeds only once
-     * `cgroup.procs` is empty (pid exited or moved elsewhere) -- cgroups v2 refuses
-     * to remove a non-empty cgroup. Returns whether removal happened; never throws.
-     */
-    readonly release: () => boolean;
-}
-/**
- * Moves `options.pid` (a process this runtime did not spawn) into a newly created,
- * resource-limited cgroup. Throws if the target isn't alive, `cgroupV2Capability()`
- * is unavailable, or a declared limit's controller file doesn't exist.
- *
- * Limits are written before the pid is moved in, so a process is never observed
- * with a half-applied limit set; on any write failure the still-empty cgroup is
- * removed and the error rethrown, never left orphaned.
- */
-export declare function moveProcessIntoRestrictedCgroup(options: {
-    readonly pid: number;
-    readonly limits: CgroupResourceLimits;
-    readonly nameHint?: string;
-}): CgroupMoveResult;
-//# sourceMappingURL=cgroup-partial-restriction.d.ts.map

package/dist/cgroup-partial-restriction.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cgroup-partial-restriction.d.ts","sourceRoot":"","sources":["../src/cgroup-partial-restriction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAKnE,iIAAiI;AACjI,eAAO,MAAM,gCAAgC,EAAG,qEAA8E,CAAC;AA2C/H;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,GAAG,IAAI,CAc3D;AAED,wBAAgB,kBAAkB,IAAI,gBAAgB,CAkBrD;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,4FAA4F;IAC5F,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,OAAO,gCAAgC,CAAC;IACxD,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC;CACjC;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE;IACvD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,GAAG,gBAAgB,CAsEnB"}

package/dist/cgroup-partial-restriction.js

@@ -1,189 +0,0 @@
-/**
- * Partial going-forward resource restriction for an already-running, attached-to
- * process, via cgroups v2 — narrower alternative to `respawn-and-supervise.ts`.
- *
- * Moving a live pid into a delegated cgroup applies real kernel-enforced limits
- * (`memory.max`, `cpu.max`, `pids.max`) without killing/restarting it. **It does
- * NOT and cannot give filesystem or network isolation** — that needs `setns()`
- * against a live pid, out of scope here. `CGROUP_PARTIAL_RESTRICTION_SCOPE` is the
- * literal string every result carries so nothing downstream rounds this up to
- * "sandboxed"/"isolated" (which would misrepresent it as `sandbox.ts`'s real
- * spawn-time bwrap isolation).
- *
- * Finding the delegated ancestor: a non-root user can only write under
- * `/sys/fs/cgroup` where a systemd user session delegates it (`Delegate=yes`).
- * Delegation isn't uniform all the way down — a leaf cgroup already holding a
- * process (e.g. this Node process's own scope) generally can't extend
- * `subtree_control` further; writing fails `EBUSY` (measured on this repo's dev
- * host). So `findDelegatedCgroupAncestor` doesn't trust subtree_control text or
- * permission bits — it walks up from `/proc/self/cgroup` and, at each ancestor,
- * creates a real temporary probe child and checks whether the kernel actually gave
- * it a `memory.max` file.
- */
-import { existsSync, mkdirSync, readFileSync, rmdirSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { isProcessAlive } from "./attach-to-running-process.js";
-const CGROUP_ROOT = "/sys/fs/cgroup";
-/** Literal scope string every `CgroupMoveResult` carries under `scope` — never restated by hand, so quotes of it can't drift. */
-export const CGROUP_PARTIAL_RESTRICTION_SCOPE = "partial -- resource limits only, no filesystem or network isolation";
-function ownUnifiedCgroupPath() {
-    let content;
-    try {
-        content = readFileSync("/proc/self/cgroup", "utf8");
-    }
-    catch {
-        return null;
-    }
-    for (const line of content.trim().split("\n")) {
-        // unified-hierarchy lines read "0::<path>"; only the "0::" line matters here
-        const firstColon = line.indexOf(":");
-        const secondColon = line.indexOf(":", firstColon + 1);
-        if (firstColon === -1 || secondColon === -1)
-            continue;
-        if (line.slice(0, firstColon) === "0" && firstColon + 1 === secondColon) {
-            return line.slice(secondColon + 1);
-        }
-    }
-    return null;
-}
-/**
- * Real empirical probe, not a permission-bit read — a directory can be
- * `mkdir`-able yet its child still lack `memory.max` if the controller was never
- * enabled in `subtree_control` (this process's own leaf scope is exactly this
- * shape, measured directly).
- */
-function probeControllableChild(candidateDir) {
-    const probe = join(candidateDir, `.descry-cgroup-probe-${String(process.pid)}-${String(Date.now())}-${String(Math.random()).slice(2, 8)}`);
-    try {
-        mkdirSync(probe);
-    }
-    catch {
-        return false;
-    }
-    const controllable = existsSync(join(probe, "memory.max"));
-    try {
-        rmdirSync(probe);
-    }
-    catch {
-        // best-effort cleanup; not our problem if something raced to touch it first
-    }
-    return controllable;
-}
-/**
- * Walks up from this process's cgroup toward `/sys/fs/cgroup`, returning the
- * deepest ancestor whose children genuinely get a real `memory.max` — the actual
- * delegation boundary. `null` if cgroups v2 isn't mounted, own path can't be
- * determined, or no ancestor passes the probe.
- */
-export function findDelegatedCgroupAncestor() {
-    if (process.platform !== "linux")
-        return null;
-    if (!existsSync(join(CGROUP_ROOT, "cgroup.controllers")))
-        return null;
-    const ownPath = ownUnifiedCgroupPath();
-    if (ownPath === null)
-        return null;
-    let dir = join(CGROUP_ROOT, ownPath.replace(/^\/+/, ""));
-    // never test CGROUP_ROOT itself: root-wide limits are root-only anyway
-    while (dir !== CGROUP_ROOT && dirname(dir) !== dir) {
-        if (existsSync(dir) && probeControllableChild(dir))
-            return dir;
-        dir = dirname(dir);
-    }
-    return null;
-}
-export function cgroupV2Capability() {
-    if (process.platform !== "linux") {
-        return { availability: "unavailable", reason: `cgroups v2 resource-limit move is Linux-only; not available on "${process.platform}"` };
-    }
-    if (!existsSync(join(CGROUP_ROOT, "cgroup.controllers"))) {
-        return { availability: "unavailable", reason: `${CGROUP_ROOT} has no cgroup.controllers file -- this host is not using the cgroups v2 unified hierarchy` };
-    }
-    const ancestor = findDelegatedCgroupAncestor();
-    if (ancestor === null) {
-        return {
-            availability: "unavailable",
-            reason: "cgroups v2 is mounted, but no writable, controller-delegated cgroup ancestor was found for this process -- commonly means this " +
-                "process is not running under a systemd user session with delegation (Delegate=yes on user@<uid>.service), or is running as a " +
-                "user with no cgroup delegation anywhere in its own ancestry. Refusing rather than silently doing nothing.",
-        };
-    }
-    return { availability: "available", reason: null };
-}
-/**
- * Moves `options.pid` (a process this runtime did not spawn) into a newly created,
- * resource-limited cgroup. Throws if the target isn't alive, `cgroupV2Capability()`
- * is unavailable, or a declared limit's controller file doesn't exist.
- *
- * Limits are written before the pid is moved in, so a process is never observed
- * with a half-applied limit set; on any write failure the still-empty cgroup is
- * removed and the error rethrown, never left orphaned.
- */
-export function moveProcessIntoRestrictedCgroup(options) {
-    if (!isProcessAlive(options.pid)) {
-        throw new Error(`moveProcessIntoRestrictedCgroup: pid ${String(options.pid)} is not running -- cannot move a target that does not exist.`);
-    }
-    const capability = cgroupV2Capability();
-    if (capability.availability !== "available") {
-        throw new Error(`moveProcessIntoRestrictedCgroup: cannot apply -- ${capability.reason}`);
-    }
-    const ancestor = findDelegatedCgroupAncestor();
-    if (ancestor === null) {
-        // unreachable given availability check above; narrows the type honestly
-        throw new Error("moveProcessIntoRestrictedCgroup: no delegated cgroup ancestor found despite capability reporting available -- internal inconsistency.");
-    }
-    const cgroupPath = join(ancestor, `descry-restrict-${options.nameHint ?? String(options.pid)}-${String(Date.now())}`);
-    mkdirSync(cgroupPath);
-    try {
-        if (options.limits.cpuMax !== undefined && !existsSync(join(cgroupPath, "cpu.max"))) {
-            throw new Error(`cpuMax was requested but the delegated cgroup ancestor (${ancestor}) does not expose a writable cpu.max to its children on this host -- ` +
-                "refusing rather than silently ignoring the limit.");
-        }
-        if (options.limits.memoryMaxBytes !== undefined) {
-            writeFileSync(join(cgroupPath, "memory.max"), String(options.limits.memoryMaxBytes));
-            // see memoryMaxBytes doc: without this, swap makes memory.max a soft limit.
-            // best-effort -- no memory.swap.max file (swap accounting disabled/not
-            // delegated) still gets a real memory.max, just without this hardening
-            try {
-                writeFileSync(join(cgroupPath, "memory.swap.max"), "0");
-            }
-            catch {
-                // disclosed above, not pretended to have succeeded
-            }
-        }
-        if (options.limits.maxProcesses !== undefined) {
-            writeFileSync(join(cgroupPath, "pids.max"), String(options.limits.maxProcesses));
-        }
-        if (options.limits.cpuMax !== undefined) {
-            writeFileSync(join(cgroupPath, "cpu.max"), options.limits.cpuMax);
-        }
-        // moved last, only once every requested limit is confirmed written
-        writeFileSync(join(cgroupPath, "cgroup.procs"), String(options.pid));
-    }
-    catch (error) {
-        try {
-            rmdirSync(cgroupPath);
-        }
-        catch {
-            // best-effort: if the pid was already moved in, the dir is non-empty
-            // and can't be removed
-        }
-        throw new Error(`moveProcessIntoRestrictedCgroup: failed to apply limits or move pid ${String(options.pid)} into ${cgroupPath}: ${error instanceof Error ? error.message : String(error)}`);
-    }
-    return {
-        applied: true,
-        cgroupPath,
-        scope: CGROUP_PARTIAL_RESTRICTION_SCOPE,
-        appliedLimits: options.limits,
-        release: () => {
-            try {
-                rmdirSync(cgroupPath);
-                return true;
-            }
-            catch {
-                return false;
-            }
-        },
-    };
-}
-//# sourceMappingURL=cgroup-partial-restriction.js.map

package/dist/cgroup-partial-restriction.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cgroup-partial-restriction.js","sourceRoot":"","sources":["../src/cgroup-partial-restriction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAErC,iIAAiI;AACjI,MAAM,CAAC,MAAM,gCAAgC,GAAG,qEAA8E,CAAC;AAE/H,SAAS,oBAAoB;IAC3B,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,6EAA6E;QAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,UAAU,KAAK,CAAC,CAAC,IAAI,WAAW,KAAK,CAAC,CAAC;YAAE,SAAS;QACtD,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,GAAG,IAAI,UAAU,GAAG,CAAC,KAAK,WAAW,EAAE,CAAC;YACxE,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,YAAoB;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,wBAAwB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3I,IAAI,CAAC;QACH,SAAS,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,SAAS,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;IAC9E,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B;IACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtE,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;IACvC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAElC,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IACzD,uEAAuE;IACvE,OAAO,GAAG,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;QACnD,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QAC/D,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,mEAAmE,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC;IACzI,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,WAAW,4FAA4F,EAAE,CAAC;IAC7J,CAAC;IACD,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;IAC/C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,YAAY,EAAE,aAAa;YAC3B,MAAM,EACJ,iIAAiI;gBACjI,+HAA+H;gBAC/H,2GAA2G;SAC9G,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAoCD;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAI/C;IACC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC7I,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IACxC,IAAI,UAAU,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oDAAoD,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;IAC/C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,wEAAwE;QACxE,MAAM,IAAI,KAAK,CAAC,uIAAuI,CAAC,CAAC;IAC3J,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,mBAAmB,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACtH,SAAS,CAAC,UAAU,CAAC,CAAC;IAEtB,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CACb,2DAA2D,QAAQ,uEAAuE;gBACxI,mDAAmD,CACtD,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAChD,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;YACrF,4EAA4E;YAC5E,uEAAuE;YACvE,uEAAuE;YACvE,IAAI,CAAC;gBACH,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,mDAAmD;YACrD,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC9C,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACxC,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;QACD,mEAAmE;QACnE,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,SAAS,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,uBAAuB;QACzB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uEAAuE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,UAAU,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC3K,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QACb,UAAU;QACV,KAAK,EAAE,gCAAgC;QACvC,aAAa,EAAE,OAAO,CAAC,MAAM;QAC7B,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,CAAC;gBACH,SAAS,CAAC,UAAU,CAAC,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/collector-version.d.ts

@@ -1,7 +0,0 @@
-/**
- * `Evidence.collectorVersion` for orchestrator-emitted evidence (e.g. `COLLECTOR_ERROR`
- * before any collector ran). Reads `package.json` directly so it can't drift from
- * what shipped, same approach as `nodeVersion`'s use of `process.version`.
- */
-export declare const COLLECTOR_VERSION: string;
-//# sourceMappingURL=collector-version.d.ts.map

package/dist/collector-version.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"collector-version.d.ts","sourceRoot":"","sources":["../src/collector-version.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,eAAO,MAAM,iBAAiB,EAAE,MAA6E,CAAC"}

package/dist/collector-version.js

@@ -1,9 +0,0 @@
-/**
- * `Evidence.collectorVersion` for orchestrator-emitted evidence (e.g. `COLLECTOR_ERROR`
- * before any collector ran). Reads `package.json` directly so it can't drift from
- * what shipped, same approach as `nodeVersion`'s use of `process.version`.
- */
-import { createRequire } from "node:module";
-const require = createRequire(import.meta.url);
-export const COLLECTOR_VERSION = require("../package.json").version;
-//# sourceMappingURL=collector-version.js.map

package/dist/collector-version.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"collector-version.js","sourceRoot":"","sources":["../src/collector-version.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,MAAM,CAAC,MAAM,iBAAiB,GAAY,OAAO,CAAC,iBAAiB,CAAkC,CAAC,OAAO,CAAC"}

package/dist/index.d.ts

@@ -1,19 +0,0 @@
-export type { PollingProcessOutputSourceOptions } from "./polling-output-source.ts";
-export { createPollingProcessOutputSource } from "./polling-output-source.ts";
-export type { AttachToRunningProcessOptions, AttachedProcessOutputSource } from "./attach-to-running-process.ts";
-export { attachToRunningProcess, isProcessAlive } from "./attach-to-running-process.ts";
-export type { AttachToRunningNodeProcessOptions } from "./attach-to-running-node-process.ts";
-export { attachToRunningNodeProcess, discoverNodeInspectorUrl } from "./attach-to-running-node-process.ts";
-export type { CdpSession } from "./cdp-client.ts";
-export { connectCdp } from "./cdp-client.ts";
-export type { AttachToRunningJvmProcessOptions } from "./attach-to-running-jvm-process.ts";
-export { attachToRunningJvmProcess } from "./attach-to-running-jvm-process.ts";
-export type { RespawnCommand, RespawnCommandSource, RespawnAndSuperviseOptions, RespawnAndSuperviseResult, } from "./respawn-and-supervise.ts";
-export { respawnAndSupervise, inferRespawnCommandFromProc } from "./respawn-and-supervise.ts";
-export type { CgroupResourceLimits, CgroupMoveResult, } from "./cgroup-partial-restriction.ts";
-export { CGROUP_PARTIAL_RESTRICTION_SCOPE, cgroupV2Capability, findDelegatedCgroupAncestor, moveProcessIntoRestrictedCgroup, } from "./cgroup-partial-restriction.ts";
-export type { InstrumentedExecutionInput, InstrumentedExecutionResult, ExecutionBudgetOutcome } from "./instrumented-execution.ts";
-export { runInstrumentedExecution, createSourceRootResolver, applyOutboundLaunch } from "./instrumented-execution.ts";
-export type { BackendObservationMechanism, RunRemoteLogObservationInput, RunRemoteLogObservationResult, } from "./profile-backend-observation.ts";
-export { backendObservationMechanismFor, runRemoteLogObservation } from "./profile-backend-observation.ts";
-//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAC9E,YAAY,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AACjH,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACxF,YAAY,EAAE,iCAAiC,EAAE,MAAM,qCAAqC,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC3G,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,YAAY,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAC9F,YAAY,EACV,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,gCAAgC,EAChC,kBAAkB,EAClB,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACnI,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACtH,YAAY,EACV,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/index.js

@@ -1,10 +0,0 @@
-export { createPollingProcessOutputSource } from "./polling-output-source.js";
-export { attachToRunningProcess, isProcessAlive } from "./attach-to-running-process.js";
-export { attachToRunningNodeProcess, discoverNodeInspectorUrl } from "./attach-to-running-node-process.js";
-export { connectCdp } from "./cdp-client.js";
-export { attachToRunningJvmProcess } from "./attach-to-running-jvm-process.js";
-export { respawnAndSupervise, inferRespawnCommandFromProc } from "./respawn-and-supervise.js";
-export { CGROUP_PARTIAL_RESTRICTION_SCOPE, cgroupV2Capability, findDelegatedCgroupAncestor, moveProcessIntoRestrictedCgroup, } from "./cgroup-partial-restriction.js";
-export { runInstrumentedExecution, createSourceRootResolver, applyOutboundLaunch } from "./instrumented-execution.js";
-export { backendObservationMechanismFor, runRemoteLogObservation } from "./profile-backend-observation.js";
-//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAE9E,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAExF,OAAO,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAE3G,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAO/E,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAK9F,OAAO,EACL,gCAAgC,EAChC,kBAAkB,EAClB,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAMtH,OAAO,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/instrumented-execution.d.ts

@@ -1,135 +0,0 @@
-/**
- * The assembly wiring the runtime's pieces together in production code (previously
- * only connected ad hoc by tests). Runs an `ExecutionController` over a `services`
- * configuration; wraps each spawned process in a live `ProcessOutputSource`
- * (polls the buffer, yields each line once); builds a `CollectorContext` with a
- * real `resolveSourceRoot` closed over the execution's own processes; starts,
- * drains and stops the adapter's collectors; writes every emitted item through
- * `EvidenceStore` so redaction runs (plan §28).
- *
- * Deliberately does not decide whether a finding exists, correlate to graph
- * nodes, or drive a browser — separate stages, separate contracts.
- */
-import type { Evidence, Execution, ExecutionConfiguration, ProcessHandle, ServiceRootLookup } from "@descryy/runtime-contracts";
-import type { RuntimeAdapter, OutboundHttpLaunch } from "@descryy/runtime-backend-observation";
-import { type CreateExecutionInput, type RunOptions } from "@descryy/runtime-controller";
-import { EvidenceStore } from "@descryy/runtime-evidence-store";
-export interface InstrumentedExecutionInput {
-    /** Carries the `ExecutionConfiguration` itself — the controller's own input shape, not a parallel copy that could drift from it. */
-    readonly execution: CreateExecutionInput;
-    readonly runOptions: RunOptions;
-    /** Supplies the collectors. One adapter per execution: a run observes one backend runtime. */
-    readonly adapter: RuntimeAdapter;
-    /** Where evidence is written. Provided rather than constructed so a caller owns the database's lifetime and its redaction policy. */
-    readonly store: EvidenceStore;
-    /**
-     * How long to keep draining collector output after the services are up.
-     * There is no "the application is done" signal at this layer — a server
-     * runs until stopped — so the caller states how long the observation
-     * window is rather than this module guessing.
-     */
-    readonly observeForMs: number;
-    /**
-     * Opt-in, per service name: front that service with `InboundProxy` (RT-192,
-     * DEC-271) once its own readiness has already succeeded — reads the answer
-     * `controller.run()` already produced (`serviceStartResults`), never re-asks.
-     * Absent or unnamed service: unchanged behaviour, no proxy.
-     *
-     * Does not close any per-language "HTTP observation" checklist row — those use
-     * self-initiated fixtures with no separate public port for a proxy to front.
-     * This only makes `InboundProxy` available for a future externally-driven
-     * scenario.
-     */
-    readonly frontWithInboundProxy?: Readonly<Record<string, boolean>>;
-    /**
-     * Fires once every collector (including any fronting proxy) has started, before
-     * the observation window's sleep. Lets a caller drive real traffic through a
-     * just-started proxy while it's still alive — `InstrumentedExecutionResult` is
-     * only returned after the run has stopped everything, too late for that. A
-     * throwing callback is not caught here.
-     */
-    readonly onReady?: (info: {
-        readonly execution: Execution;
-        /** Service name → the proxy's own bound port, for every service that was both flagged AND successfully fronted. */
-        readonly proxyPorts: Readonly<Record<string, number>>;
-    }) => void | Promise<void>;
-}
-export interface InstrumentedExecutionResult {
-    readonly execution: Execution;
-    readonly evidence: readonly Evidence[];
-    /** Every collector's own report of what it could do, after the run — not what it claimed at construction. */
-    readonly collectorCapabilities: readonly {
-        readonly collectorId: string;
-        readonly capabilities: ReturnType<import("@descryy/runtime-contracts").Collector["capabilities"]>;
-    }[];
-    /** Set when `run()` refused before spawning anything. Evidence is empty and that is a refusal, not an absence of failures. */
-    readonly validationError: string | null;
-    /**
-     * What the declared whole-execution budget actually did to this run.
-     *
-     * `timeoutMs` used to bound only the service, not the observation window: a
-     * 1500ms budget with a 12000ms window measurably returned after 12288ms with
-     * zero evidence, since services had been dead for the last 10.8s. Reported as a
-     * struct so a caller can tell a full window that found nothing from one cut
-     * short before it could.
-     */
-    readonly budget: ExecutionBudgetOutcome;
-    /**
-     * Service name → the combined stdout+stderr that service produced.
-     *
-     * The controller has always captured this and exposed it
-     * (`ExecutionController.readProcessOutput`); it was used only for readiness
-     * polling and never left this function, so a caller got
-     * `processes[].exitCode` and nothing about *why*. An exit code alone can
-     * actively mislead — `prlimit`, which wraps every sandboxed spawn, exits 126
-     * for "found but not executable" and writes the reason to stderr, and 126 has
-     * already been misread once as a nested-sandbox failure (bwrap exits 1 for
-     * every namespace failure, so it never means that).
-     *
-     * **A missing key and an empty string are different claims.** Present-and-
-     * empty is "this ran and said nothing"; absent is "no process was attributed
-     * to this service at all". Collapsing them loses the distinction for good.
-     *
-     * **RT-261 update — no longer whole.** Backed by `ManagedProcess.readOutput()`,
-     * which now holds head+tail per service (`OUTPUT_HEAD_BYTES`/`OUTPUT_TAIL_BYTES`
-     * in `@descryy/runtime-controller`'s `process-manager.ts`), not the full
-     * accumulated buffer -- a chatty service no longer grows Descry's own memory
-     * without bound. When a service's real output exceeded that bound, the
-     * string itself carries one inline marker naming how many bytes were
-     * dropped and the real total, so the cut is visible in the text a reader
-     * already has, not only in a structured field alongside it.
-     */
-    readonly serviceOutput: Readonly<Record<string, string>>;
-}
-/** See `InstrumentedExecutionResult.budget`. */
-export interface ExecutionBudgetOutcome {
-    /** `ExecutionConfiguration.timeoutMs`, verbatim. */
-    readonly declaredMs: number;
-    /** Wall-clock time this function actually took. */
-    readonly elapsedMs: number;
-    /** What `observeForMs` asked for. */
-    readonly requestedObservationMs: number;
-    /** What the budget left for it. Less than `requestedObservationMs` means the window was cut short. */
-    readonly observedForMs: number;
-    /** True when the run finished past its own deadline — teardown of real processes can overshoot even a bounded window. */
-    readonly exceeded: boolean;
-}
-/**
- * Builds the origin → source-root lookup a collector reads through
- * `CollectorContext.resolveSourceRoot`. Closes over the execution's own
- * processes, which is what makes the port→service join possible at all — under
- * ephemeral ports only the running process knows its own port.
- */
-export declare function createSourceRootResolver(processes: readonly ProcessHandle[], configuration: ExecutionConfiguration): (origin: string) => ServiceRootLookup;
-/**
- * Rewrites every spawnable service so it launches with outbound
- * instrumentation in place.
- *
- * The declaration comes from the adapter and names no language; this function
- * applies it and also names none. `attach`-mode services are skipped: their
- * process is already running, so there is no launch left to influence, and
- * pretending otherwise would claim instrumentation that is not there.
- */
-export declare function applyOutboundLaunch(execution: CreateExecutionInput, launch: OutboundHttpLaunch): CreateExecutionInput;
-export declare function runInstrumentedExecution(input: InstrumentedExecutionInput): Promise<InstrumentedExecutionResult>;
-//# sourceMappingURL=instrumented-execution.d.ts.map

package/dist/instrumented-execution.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"instrumented-execution.d.ts","sourceRoot":"","sources":["../src/instrumented-execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAEV,QAAQ,EACR,SAAS,EACT,sBAAsB,EACtB,aAAa,EACb,iBAAiB,EAClB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EAAE,cAAc,EAAuB,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAGpH,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,UAAU,EAQhB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAKhE,MAAM,WAAW,0BAA0B;IACzC,oIAAoI;IACpI,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,8FAA8F;IAC9F,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,qIAAqI;IACrI,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE;QACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,mHAAmH;QACnH,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;KACvD,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAC;IACvC,6GAA6G;IAC7G,QAAQ,CAAC,qBAAqB,EAAE,SAAS;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC,OAAO,4BAA4B,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAA;KAAE,EAAE,CAAC;IAC/K,8HAA8H;IAC9H,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC1D;AAED,gDAAgD;AAChD,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qCAAqC;IACrC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,sGAAsG;IACtG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,yHAAyH;IACzH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAiBD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,SAAS,aAAa,EAAE,EACnC,aAAa,EAAE,sBAAsB,GACpC,CAAC,MAAM,EAAE,MAAM,KAAK,iBAAiB,CAEvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,oBAAoB,EAC/B,MAAM,EAAE,kBAAkB,GACzB,oBAAoB,CAwBtB;AAgCD,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CA+nBtH"}