@dofe/infra-workspace 0.1.0

package/dist/docker-volume.d.ts

@@ -0,0 +1,8 @@
+export type DockerVolumeAccess = 'ro' | 'rw';
+export interface DockerVolumeArgInput {
+    hostPath: string;
+    containerPath: string;
+    access?: DockerVolumeAccess;
+}
+export declare function buildDockerVolumeArg(input: DockerVolumeArgInput): string;
+//# sourceMappingURL=docker-volume.d.ts.map

package/dist/docker-volume.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-volume.d.ts","sourceRoot":"","sources":["../../../packages/workspace/src/docker-volume.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE7C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,kBAAkB,CAAC;CAC7B;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CAExE"}

package/dist/docker-volume.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildDockerVolumeArg = buildDockerVolumeArg;
+function buildDockerVolumeArg(input) {
+    return `${input.hostPath}:${input.containerPath}:${input.access ?? 'rw'}`;
+}
+//# sourceMappingURL=docker-volume.js.map

package/dist/docker-volume.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-volume.js","sourceRoot":"","sources":["../../../packages/workspace/src/docker-volume.ts"],"names":[],"mappings":";;AAQA,oDAEC;AAFD,SAAgB,oBAAoB,CAAC,KAA2B;IAC9D,OAAO,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;AAC5E,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export * from './path-policy';
+export * from './workspace-root';
+export * from './docker-volume';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../packages/workspace/src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC"}

package/dist/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./path-policy"), exports);
+__exportStar(require("./workspace-root"), exports);
+__exportStar(require("./docker-volume"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../packages/workspace/src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA8B;AAC9B,mDAAiC;AACjC,kDAAgC"}

package/dist/path-policy.d.ts

@@ -0,0 +1,12 @@
+export interface ResolveAllowedPathOptions {
+    input: string;
+    allowedRoots: readonly string[];
+    mustExist?: boolean;
+    directoryOnly?: boolean;
+    fieldName?: string;
+}
+export declare function isSameOrChildPath(root: string, target: string): boolean;
+export declare function normalizeAllowedRoots(roots: readonly string[]): string[];
+export declare function resolveAllowedTargetPath(options: ResolveAllowedPathOptions): Promise<string>;
+export declare function interpolatePathTemplate(template: string, values: Record<string, string | number | boolean | null | undefined>): string;
+//# sourceMappingURL=path-policy.d.ts.map

package/dist/path-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-policy.d.ts","sourceRoot":"","sources":["../../../packages/workspace/src/path-policy.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAQvE;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAExE;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,GACnE,MAAM,CAKR"}

package/dist/path-policy.js

@@ -0,0 +1,49 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSameOrChildPath = isSameOrChildPath;
+exports.normalizeAllowedRoots = normalizeAllowedRoots;
+exports.resolveAllowedTargetPath = resolveAllowedTargetPath;
+exports.interpolatePathTemplate = interpolatePathTemplate;
+const path_1 = __importDefault(require("path"));
+const promises_1 = require("fs/promises");
+function isSameOrChildPath(root, target) {
+    const resolvedRoot = path_1.default.resolve(root);
+    const resolvedTarget = path_1.default.resolve(target);
+    const relative = path_1.default.relative(resolvedRoot, resolvedTarget);
+    return (relative === '' ||
+        (!relative.startsWith('..') && !path_1.default.isAbsolute(relative)));
+}
+function normalizeAllowedRoots(roots) {
+    return roots.map((root) => path_1.default.resolve(root));
+}
+async function resolveAllowedTargetPath(options) {
+    const fieldName = options.fieldName ?? 'path';
+    if (!path_1.default.isAbsolute(options.input)) {
+        throw new Error(`${fieldName} must be an absolute path`);
+    }
+    const target = path_1.default.resolve(options.input);
+    const allowedRoots = normalizeAllowedRoots(options.allowedRoots);
+    if (!allowedRoots.some((root) => isSameOrChildPath(root, target))) {
+        throw new Error(`${fieldName} is outside allowed roots: ${target}`);
+    }
+    if (options.mustExist || options.directoryOnly) {
+        const current = await (0, promises_1.stat)(target).catch(() => undefined);
+        if (!current) {
+            throw new Error(`${fieldName} does not exist: ${target}`);
+        }
+        if (options.directoryOnly && !current.isDirectory()) {
+            throw new Error(`${fieldName} is not a directory: ${target}`);
+        }
+    }
+    return target;
+}
+function interpolatePathTemplate(template, values) {
+    return template.replace(/\{([A-Za-z0-9_]+)\}/g, (match, key) => {
+        const value = values[key];
+        return value === undefined || value === null ? match : String(value);
+    });
+}
+//# sourceMappingURL=path-policy.js.map

package/dist/path-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-policy.js","sourceRoot":"","sources":["../../../packages/workspace/src/path-policy.ts"],"names":[],"mappings":";;;;;AAWA,8CAQC;AAED,sDAEC;AAED,4DAyBC;AAED,0DAQC;AA5DD,gDAAwB;AACxB,0CAAmC;AAUnC,SAAgB,iBAAiB,CAAC,IAAY,EAAE,MAAc;IAC5D,MAAM,YAAY,GAAG,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,cAAc,GAAG,cAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,cAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAC7D,OAAO,CACL,QAAQ,KAAK,EAAE;QACf,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,cAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED,SAAgB,qBAAqB,CAAC,KAAwB;IAC5D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACjD,CAAC;AAEM,KAAK,UAAU,wBAAwB,CAC5C,OAAkC;IAElC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,IAAI,CAAC,cAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,2BAA2B,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,MAAM,GAAG,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACjE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,8BAA8B,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,IAAA,eAAI,EAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,oBAAoB,MAAM,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,wBAAwB,MAAM,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,uBAAuB,CACrC,QAAgB,EAChB,MAAoE;IAEpE,OAAO,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QACrE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/workspace-root.d.ts

@@ -0,0 +1,9 @@
+export interface FindWorkspaceRootOptions {
+    startDir?: string;
+    envRoot?: string;
+    markerFiles?: readonly string[];
+    fallback?: string;
+}
+export declare function findWorkspaceRoot(options?: FindWorkspaceRootOptions): string;
+export declare function resolveConfiguredRoots(configured: string | undefined, fallbackRoot: string, delimiter?: ":" | ";"): string[];
+//# sourceMappingURL=workspace-root.d.ts.map

package/dist/workspace-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-root.d.ts","sourceRoot":"","sources":["../../../packages/workspace/src/workspace-root.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,wBAA6B,GAAG,MAAM,CAgBhF;AAED,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,EACpB,SAAS,YAAiB,GACzB,MAAM,EAAE,CASV"}

package/dist/workspace-root.js

@@ -0,0 +1,32 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findWorkspaceRoot = findWorkspaceRoot;
+exports.resolveConfiguredRoots = resolveConfiguredRoots;
+const fs_1 = require("fs");
+const path_1 = __importDefault(require("path"));
+function findWorkspaceRoot(options = {}) {
+    const fallback = path_1.default.resolve(options.fallback ?? process.cwd());
+    let current = path_1.default.resolve(options.envRoot || options.startDir || process.cwd());
+    const markerFiles = options.markerFiles ?? ['pnpm-workspace.yaml'];
+    for (;;) {
+        if (markerFiles.every((marker) => (0, fs_1.existsSync)(path_1.default.join(current, marker)))) {
+            return current;
+        }
+        const parent = path_1.default.dirname(current);
+        if (parent === current) {
+            return fallback;
+        }
+        current = parent;
+    }
+}
+function resolveConfiguredRoots(configured, fallbackRoot, delimiter = path_1.default.delimiter) {
+    const roots = (configured ?? '')
+        .split(delimiter)
+        .map((item) => item.trim())
+        .filter(Boolean);
+    return (roots.length > 0 ? roots : [fallbackRoot]).map((root) => path_1.default.resolve(root));
+}
+//# sourceMappingURL=workspace-root.js.map

package/dist/workspace-root.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-root.js","sourceRoot":"","sources":["../../../packages/workspace/src/workspace-root.ts"],"names":[],"mappings":";;;;;AAUA,8CAgBC;AAED,wDAaC;AAzCD,2BAAgC;AAChC,gDAAwB;AASxB,SAAgB,iBAAiB,CAAC,UAAoC,EAAE;IACtE,MAAM,QAAQ,GAAG,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACjE,IAAI,OAAO,GAAG,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACjF,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAEnE,SAAS,CAAC;QACR,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAA,eAAU,EAAC,cAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,MAAM,GAAG,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAgB,sBAAsB,CACpC,UAA8B,EAC9B,YAAoB,EACpB,SAAS,GAAG,cAAI,CAAC,SAAS;IAE1B,MAAM,KAAK,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;SAC7B,KAAK,CAAC,SAAS,CAAC;SAChB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAC9D,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CACnB,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@dofe/infra-workspace",
+  "version": "0.1.0",
+  "description": "Workspace and managed-path primitives for dofe.ai runtimes",
+  "engines": {
+    "node": ">=20.19.0"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./docker-volume": {
+      "types": "./dist/docker-volume.d.ts",
+      "default": "./dist/docker-volume.js"
+    },
+    "./path-policy": {
+      "types": "./dist/path-policy.d.ts",
+      "default": "./dist/path-policy.js"
+    },
+    "./workspace-root": {
+      "types": "./dist/workspace-root.d.ts",
+      "default": "./dist/workspace-root.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "test",
+    "package.json"
+  ],
+  "license": "UNLICENSED",
+  "devDependencies": {
+    "@types/node": "^25.9.4",
+    "rimraf": "^6.1.2",
+    "typescript": "^6.0.3"
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "clean": "rimraf dist",
+    "test:smoke": "node --test test/*.smoke.mjs",
+    "postbuild": "node ../../scripts/generate-exports.mjs"
+  }
+}

package/test/path-policy.smoke.mjs

@@ -0,0 +1,73 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import os from 'node:os';
+import path from 'node:path';
+import { mkdir, writeFile } from 'node:fs/promises';
+import {
+  buildDockerVolumeArg,
+  findWorkspaceRoot,
+  interpolatePathTemplate,
+  isSameOrChildPath,
+  resolveAllowedTargetPath,
+  resolveConfiguredRoots,
+} from '../dist/index.js';
+
+test('isSameOrChildPath accepts exact paths and descendants only', () => {
+  const root = path.join(os.tmpdir(), 'infra-workspace-root');
+
+  assert.equal(isSameOrChildPath(root, root), true);
+  assert.equal(isSameOrChildPath(root, path.join(root, 'child')), true);
+  assert.equal(isSameOrChildPath(root, `${root}-sibling`), false);
+});
+
+test('resolveAllowedTargetPath validates allowed absolute directories', async () => {
+  const root = path.join(os.tmpdir(), `infra-workspace-${Date.now()}`);
+  await mkdir(root, { recursive: true });
+  const child = path.join(root, 'repo');
+  await mkdir(child);
+
+  await assert.rejects(
+    () =>
+      resolveAllowedTargetPath({
+        input: 'relative/path',
+        allowedRoots: [root],
+      }),
+    /absolute path/,
+  );
+  assert.equal(
+    await resolveAllowedTargetPath({
+      input: child,
+      allowedRoots: [root],
+      directoryOnly: true,
+    }),
+    child,
+  );
+});
+
+test('findWorkspaceRoot and configured roots support monorepo markers', async () => {
+  const root = path.join(os.tmpdir(), `infra-workspace-marker-${Date.now()}`);
+  const nested = path.join(root, 'apps', 'api');
+  await mkdir(nested, { recursive: true });
+  await writeFile(path.join(root, 'pnpm-workspace.yaml'), 'packages: []\n');
+
+  assert.equal(findWorkspaceRoot({ startDir: nested }), root);
+  assert.deepEqual(resolveConfiguredRoots('', root), [root]);
+});
+
+test('path templates and Docker volume args are deterministic', () => {
+  assert.equal(
+    interpolatePathTemplate('/workspace/{scopeId}/{agentId}', {
+      scopeId: 'team-1',
+      agentId: 'bot-1',
+    }),
+    '/workspace/team-1/bot-1',
+  );
+  assert.equal(
+    buildDockerVolumeArg({
+      hostPath: '/workspace/agents/bot-1',
+      containerPath: '/app/workspace',
+      access: 'ro',
+    }),
+    '/workspace/agents/bot-1:/app/workspace:ro',
+  );
+});