@dsh-enhanced/plugin-control-plane 0.1.32 → 0.1.34

package/bin/dsh-task-observation-authority.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+
+import { realpathSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+
+try {
+  const wrapper = realpathSync(process.argv[1])
+  const modulePath = join(dirname(wrapper), '../lib/task-observation-authority.js')
+  const { runTaskObservationAuthority } = await import(pathToFileURL(modulePath).href)
+  await runTaskObservationAuthority()
+} catch {
+  process.stderr.write('task observation authority refused the request\n')
+  process.exitCode = 1
+}

package/lib/adapter-process.d.ts

@@ -0,0 +1,23 @@
+/** A deliberately small process owner for descriptor-pinned helpers.
+ *
+ * `detached` gives the direct child a fresh Linux process group.  This is a
+ * cleanup boundary, not a sandbox: a helper which calls setsid(2) can leave
+ * that group and is outside the guarantee made here.
+ */
+export type ControlledProcessErrorCode = 'START' | 'TIMEOUT' | 'OUTPUT_LIMIT' | 'NON_ZERO' | 'CLEANUP' | 'ABORTED';
+export declare class ControlledProcessError extends Error {
+    readonly code: ControlledProcessErrorCode;
+    constructor(code: ControlledProcessErrorCode, message: string);
+}
+export interface ControlledProcessOptions {
+    signal?: AbortSignal;
+    command: string;
+    args: readonly string[];
+    env: NodeJS.ProcessEnv;
+    stdio: Array<'pipe' | 'ignore' | number>;
+    stdin: string | undefined;
+    timeoutMs: number;
+    maximumOutput: number;
+}
+export declare function executeControlledProcess(options: ControlledProcessOptions): Promise<string>;
+//# sourceMappingURL=adapter-process.d.ts.map

package/lib/adapter-process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-process.d.ts","sourceRoot":"","sources":["../src/adapter-process.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,OAAO,GAAG,SAAS,GAAG,cAAc,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAA;AAElH,qBAAa,sBAAuB,SAAQ,KAAK;IACnC,QAAQ,CAAC,IAAI,EAAE,0BAA0B;gBAAhC,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,MAAM;CAIvE;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IACvB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;IACtB,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC,CAAA;IACxC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;CACtB;AAsHD,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CA2GjG"}

package/lib/adapter-process.js

@@ -0,0 +1,305 @@
+import { spawn } from 'node:child_process';
+import { readdir, readFile } from 'node:fs/promises';
+export class ControlledProcessError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'ControlledProcessError';
+    }
+}
+const CLEANUP_GRACE_MS = 75;
+const CLEANUP_SETTLE_MS = 300;
+const OUTPUT_DRAIN_MS = 100;
+const POLL_MS = 25;
+const PROC_CONCURRENCY = 16;
+const MAX_PROC_ENTRIES = 4_096;
+function errorCode(error) {
+    return typeof error === 'object' && error !== null && 'code' in error && typeof error.code === 'string' ? error.code : undefined;
+}
+function remaining(deadline) {
+    const value = deadline - performance.now();
+    if (value <= 0)
+        throw new ControlledProcessError('CLEANUP', 'helper process-group cleanup exceeded its fixed deadline');
+    return value;
+}
+async function bounded(work, deadline) {
+    return new Promise((resolve, reject) => {
+        let timer;
+        // Observe work even if the deadline expired between starting IO and
+        // installing this timer; a late rejection must not become unhandled.
+        void work.then(value => { if (timer !== undefined)
+            clearTimeout(timer); resolve(value); }, error => { if (timer !== undefined)
+            clearTimeout(timer); reject(error); });
+        try {
+            timer = setTimeout(() => reject(new ControlledProcessError('CLEANUP', 'helper process-group cleanup exceeded its fixed deadline')), remaining(deadline));
+        }
+        catch (error) {
+            reject(error);
+        }
+    });
+}
+async function groupMembers(groupId, deadline) {
+    let entries;
+    try {
+        entries = await bounded(readdir('/proc'), deadline);
+    }
+    catch (error) {
+        if (error instanceof ControlledProcessError)
+            throw error;
+        throw new ControlledProcessError('CLEANUP', 'could not inspect the helper process group');
+    }
+    const processes = entries.filter(entry => /^\d+$/u.test(entry));
+    if (processes.length > MAX_PROC_ENTRIES)
+        throw new ControlledProcessError('CLEANUP', 'too many processes to prove helper process-group cleanup');
+    const members = [];
+    let next = 0;
+    const inspect = async () => {
+        for (;;) {
+            const entry = processes[next++];
+            if (entry === undefined)
+                return;
+            remaining(deadline);
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), remaining(deadline));
+            try {
+                const source = await readFile(`/proc/${entry}/stat`, { encoding: 'utf8', signal: controller.signal });
+                const close = source.lastIndexOf(')');
+                // Fields after the comm are state (3), ppid (4), pgrp (5).  A zombie is
+                // already dead, so it does not retain helper authority.
+                const fields = source.slice(close + 2).trim().split(/\s+/u);
+                if (close >= 1 && fields[0] !== 'Z' && Number(fields[2]) === groupId)
+                    members.push(Number(entry));
+            }
+            catch (error) {
+                if (errorCode(error) !== 'ENOENT')
+                    throw new ControlledProcessError('CLEANUP', 'could not inspect the helper process group');
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        }
+    };
+    try {
+        await bounded(Promise.all(Array.from({ length: Math.min(PROC_CONCURRENCY, processes.length) }, inspect)).then(() => undefined), deadline);
+    }
+    catch (error) {
+        if (error instanceof ControlledProcessError)
+            throw error;
+        throw new ControlledProcessError('CLEANUP', 'could not inspect the helper process group');
+    }
+    return members;
+}
+function signalGroup(groupId, signal) {
+    try {
+        process.kill(-groupId, signal);
+    }
+    catch (error) {
+        // ESRCH means the group disappeared between the inspection and signal.
+        if (errorCode(error) !== 'ESRCH')
+            throw new ControlledProcessError('CLEANUP', 'could not signal the helper process group');
+    }
+}
+function groupExists(groupId) {
+    try {
+        process.kill(-groupId, 0);
+        return true;
+    }
+    catch (error) {
+        if (errorCode(error) === 'ESRCH')
+            return false;
+        throw new ControlledProcessError('CLEANUP', 'could not inspect the helper process group');
+    }
+}
+function pause(ms, deadline) {
+    return new Promise((resolve, reject) => {
+        const wait = deadline === undefined ? ms : Math.min(ms, remaining(deadline));
+        setTimeout(() => {
+            try {
+                if (deadline !== undefined)
+                    remaining(deadline);
+                resolve();
+            }
+            catch (error) {
+                reject(error);
+            }
+        }, wait);
+    });
+}
+async function reclaimGroup(groupId, deadline) {
+    // Always reclaim after the leader exits as well.  A successful leader can
+    // otherwise leave a same-group writer holding stdout, preventing `close`.
+    // ESRCH is the normal leader-exit fast path; it avoids a full /proc scan.
+    if (!groupExists(groupId))
+        return;
+    try {
+        signalGroup(groupId, 'SIGTERM');
+        await pause(CLEANUP_GRACE_MS, deadline);
+        if (!groupExists(groupId))
+            return;
+        // Do not make an observational failure a reason to skip forceful cleanup.
+        // The scan only proves that SIGKILL succeeded; it does not gate SIGKILL.
+        signalGroup(groupId, 'SIGKILL');
+        while (performance.now() < deadline) {
+            await pause(POLL_MS, deadline);
+            if (!groupExists(groupId))
+                return;
+            const members = await groupMembers(groupId, deadline);
+            if (members.length === 0)
+                return;
+        }
+        throw new ControlledProcessError('CLEANUP', 'could not prove the helper process group was reclaimed');
+    }
+    catch (error) {
+        // A final best-effort kill also covers a failed /proc scan or deadline.
+        try {
+            signalGroup(groupId, 'SIGKILL');
+        }
+        catch { /* preserve original cleanup failure */ }
+        throw error;
+    }
+}
+export async function executeControlledProcess(options) {
+    if (options.signal?.aborted)
+        throw new ControlledProcessError('ABORTED', 'helper process cancelled');
+    if (process.platform !== 'linux')
+        throw new ControlledProcessError('START', 'controlled helper processes require Linux');
+    return new Promise((resolve, reject) => {
+        let child;
+        try {
+            child = spawn(options.command, [...options.args], { env: options.env, shell: false, detached: true, stdio: options.stdio });
+        }
+        catch {
+            reject(new ControlledProcessError('START', 'helper process could not start'));
+            return;
+        }
+        const chunks = [];
+        let bytes = 0;
+        let cause;
+        let leaderExited = false;
+        let settling = false;
+        let settled = false;
+        let timer;
+        let stdoutEnded = child.stdout === null;
+        let resolveStdoutEnd;
+        const stdoutEnd = new Promise(resolve => { resolveStdoutEnd = resolve; });
+        let resolveLeaderExit;
+        const leaderExit = new Promise(resolve => { resolveLeaderExit = resolve; });
+        const finish = (error, output) => {
+            if (settled)
+                return;
+            settled = true;
+            options.signal?.removeEventListener('abort', onAbort);
+            if (timer !== undefined)
+                clearTimeout(timer);
+            child.stdout?.destroy();
+            child.stdin?.destroy();
+            if (error !== undefined)
+                reject(error);
+            else
+                resolve(output ?? '');
+        };
+        const reclaimAndSettle = async () => {
+            if (settling || settled)
+                return;
+            settling = true;
+            const groupId = child.pid;
+            const cleanupDeadline = performance.now() + CLEANUP_GRACE_MS + CLEANUP_SETTLE_MS;
+            try {
+                if (groupId === undefined)
+                    throw new ControlledProcessError('START', 'helper process could not start');
+                await reclaimGroup(groupId, cleanupDeadline);
+                // A missing group is not proof that the direct leader has exited.  Do
+                // not accept a scan race as successful termination.
+                if (!leaderExited)
+                    await bounded(leaderExit, cleanupDeadline);
+                if (!leaderExited)
+                    throw new ControlledProcessError('CLEANUP', 'could not observe the helper leader exit');
+                if (cause === 'ABORTED')
+                    finish(new ControlledProcessError('ABORTED', 'helper process cancelled'));
+                else if (cause === 'TIMEOUT')
+                    finish(new ControlledProcessError('TIMEOUT', 'helper process exceeded its deadline'));
+                else if (cause === 'OUTPUT_LIMIT')
+                    finish(new ControlledProcessError('OUTPUT_LIMIT', 'helper process exceeded its output bound'));
+                else if (cause === 'NON_ZERO')
+                    finish(new ControlledProcessError('NON_ZERO', 'helper process returned a non-zero status'));
+                else if (cause === 'START')
+                    finish(new ControlledProcessError('START', 'helper process could not start or its output failed'));
+                else {
+                    // `exit` can precede final pipe delivery.  The group is already
+                    // empty, so this is only a bounded drain for a valid receipt, never
+                    // a lifecycle wait on a descendant-held pipe.
+                    if (!stdoutEnded)
+                        await Promise.race([stdoutEnd, pause(OUTPUT_DRAIN_MS)]);
+                    if (!stdoutEnded)
+                        throw new ControlledProcessError('CLEANUP', 'helper stdout did not close after process-group reclamation');
+                    // The execution deadline remains active through cleanup.  A timer or
+                    // stream error can therefore win while the bounded receipt drain is
+                    // pending; never turn that late cause into a successful receipt.
+                    const finalCause = currentCause();
+                    if (finalCause === 'ABORTED')
+                        finish(new ControlledProcessError('ABORTED', 'helper process cancelled'));
+                    else if (finalCause === 'TIMEOUT')
+                        finish(new ControlledProcessError('TIMEOUT', 'helper process exceeded its deadline'));
+                    else if (finalCause === 'OUTPUT_LIMIT')
+                        finish(new ControlledProcessError('OUTPUT_LIMIT', 'helper process exceeded its output bound'));
+                    else if (finalCause === 'NON_ZERO')
+                        finish(new ControlledProcessError('NON_ZERO', 'helper process returned a non-zero status'));
+                    else if (finalCause === 'START')
+                        finish(new ControlledProcessError('START', 'helper process could not start or its output failed'));
+                    else
+                        finish(undefined, Buffer.concat(chunks).toString('utf8'));
+                }
+            }
+            catch (error) {
+                finish(error instanceof ControlledProcessError ? error : new ControlledProcessError('CLEANUP', 'could not reclaim the helper process group'));
+            }
+        };
+        const terminate = (next) => {
+            if (cause === undefined)
+                cause = next;
+            // Begin cleanup immediately; do not wait for `close`, because a child
+            // can inherit stdout after the leader has gone away.
+            void reclaimAndSettle();
+        };
+        // A function call intentionally prevents TypeScript from treating `cause`
+        // as immutable across an awaited bounded drain.
+        const currentCause = () => cause;
+        child.once('error', () => terminate('START'));
+        child.stdout?.on('error', () => terminate('START'));
+        child.stdout?.once('end', () => { stdoutEnded = true; resolveStdoutEnd?.(); });
+        child.stdout?.on('data', (chunk) => {
+            if (settled || cause !== undefined)
+                return;
+            bytes += chunk.length;
+            if (bytes > options.maximumOutput)
+                terminate('OUTPUT_LIMIT');
+            else
+                chunks.push(chunk);
+        });
+        child.once('exit', code => {
+            leaderExited = true;
+            resolveLeaderExit?.();
+            if (cause === undefined && code !== 0)
+                cause = 'NON_ZERO';
+            void reclaimAndSettle();
+        });
+        // No `close` dependency: it is not a lifecycle proof when descendants
+        // inherit stdout.  The group scan and fixed cleanup deadline are.
+        child.once('close', () => { if (!leaderExited && cause === undefined)
+            terminate('START'); });
+        child.stdin?.on('error', () => { });
+        const onAbort = () => terminate('ABORTED');
+        options.signal?.addEventListener('abort', onAbort, { once: true });
+        if (options.signal?.aborted)
+            onAbort();
+        timer = setTimeout(() => terminate('TIMEOUT'), options.timeoutMs);
+        try {
+            child.stdin?.end(options.stdin, 'utf8');
+        }
+        catch {
+            terminate('START');
+        }
+    });
+}
+//# sourceMappingURL=adapter-process.js.map

package/lib/adapter-process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-process.js","sourceRoot":"","sources":["../src/adapter-process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAUpD,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC1B;IAArB,YAAqB,IAAgC,EAAE,OAAe;QACpE,KAAK,CAAC,OAAO,CAAC,CAAA;QADK,SAAI,GAAJ,IAAI,CAA4B;QAEnD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAaD,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAC3B,MAAM,iBAAiB,GAAG,GAAG,CAAA;AAC7B,MAAM,eAAe,GAAG,GAAG,CAAA;AAC3B,MAAM,OAAO,GAAG,EAAE,CAAA;AAClB,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAC3B,MAAM,gBAAgB,GAAG,KAAK,CAAA;AAE9B,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AAClI,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IACjC,MAAM,KAAK,GAAG,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;IAC1C,IAAI,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,SAAS,EAAE,0DAA0D,CAAC,CAAA;IACvH,OAAO,KAAK,CAAA;AACd,CAAC;AAED,KAAK,UAAU,OAAO,CAAI,IAAgB,EAAE,QAAgB;IAC1D,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,IAAI,KAAiC,CAAA;QACrC,oEAAoE;QACpE,qEAAqE;QACrE,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC,EACtF,KAAK,CAAC,EAAE,GAAG,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QAC3E,IAAI,CAAC;YACH,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,sBAAsB,CAAC,SAAS,EAAE,0DAA0D,CAAC,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC1J,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAAC,CAAC;IACnC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,QAAgB;IAC3D,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QAAC,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAA;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACzE,IAAI,KAAK,YAAY,sBAAsB;YAAE,MAAM,KAAK,CAAA;QACxD,MAAM,IAAI,sBAAsB,CAAC,SAAS,EAAE,4CAA4C,CAAC,CAAA;IAC3F,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IAC/D,IAAI,SAAS,CAAC,MAAM,GAAG,gBAAgB;QAAE,MAAM,IAAI,sBAAsB,CAAC,SAAS,EAAE,0DAA0D,CAAC,CAAA;IAChJ,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;QACxC,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;YAC/B,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAM;YAC/B,SAAS,CAAC,QAAQ,CAAC,CAAA;YACnB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;YACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAA;YACvE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,KAAK,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;gBACrG,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;gBACrC,wEAAwE;gBACxE,wDAAwD;gBACxD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;gBAC3D,IAAI,KAAK,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO;oBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;YACnG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;oBAAE,MAAM,IAAI,sBAAsB,CAAC,SAAS,EAAE,4CAA4C,CAAC,CAAA;YAC9H,CAAC;oBAAS,CAAC;gBAAC,YAAY,CAAC,KAAK,CAAC,CAAA;YAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAA;IACD,IAAI,CAAC;QAAC,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAA;IAAC,CAAC;IACjJ,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,sBAAsB;YAAE,MAAM,KAAK,CAAA;QACxD,MAAM,IAAI,sBAAsB,CAAC,SAAS,EAAE,4CAA4C,CAAC,CAAA;IAC3F,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,MAAsB;IAC1D,IAAI,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACpD,uEAAuE;QACvE,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,OAAO;YAAE,MAAM,IAAI,sBAAsB,CAAC,SAAS,EAAE,2CAA2C,CAAC,CAAA;IAC5H,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAC5D,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,OAAO;YAAE,OAAO,KAAK,CAAA;QAC9C,MAAM,IAAI,sBAAsB,CAAC,SAAS,EAAE,4CAA4C,CAAC,CAAA;IAC3F,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU,EAAE,QAAiB;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC5E,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,CAAC;gBAAC,IAAI,QAAQ,KAAK,SAAS;oBAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;gBAAC,OAAO,EAAE,CAAA;YAAC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAAC,CAAC;QACpG,CAAC,EAAE,IAAI,CAAC,CAAA;IACV,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,QAAgB;IAC3D,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;QAAE,OAAM;IACjC,IAAI,CAAC;QACH,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAC/B,MAAM,KAAK,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;YAAE,OAAM;QACjC,0EAA0E;QAC1E,yEAAyE;QACzE,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAC/B,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YACpC,MAAM,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAC9B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;gBAAE,OAAM;YACjC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAM;QAClC,CAAC;QACD,MAAM,IAAI,sBAAsB,CAAC,SAAS,EAAE,wDAAwD,CAAC,CAAA;IACvG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,IAAI,CAAC;YAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,uCAAuC,CAAC,CAAC;QACzF,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAiC;IAC9E,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,sBAAsB,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAA;IACpG,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,IAAI,sBAAsB,CAAC,OAAO,EAAE,2CAA2C,CAAC,CAAA;IACxH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,KAAK,CAAA;QACT,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QAC7H,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,sBAAsB,CAAC,OAAO,EAAE,gCAAgC,CAAC,CAAC,CAAA;YAC7E,OAAM;QACR,CAAC;QACD,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,IAAI,KAA6C,CAAA;QACjD,IAAI,YAAY,GAAG,KAAK,CAAA;QACxB,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,IAAI,KAAiC,CAAA;QACrC,IAAI,WAAW,GAAG,KAAK,CAAC,MAAM,KAAK,IAAI,CAAA;QACvC,IAAI,gBAA0C,CAAA;QAC9C,MAAM,SAAS,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,GAAG,gBAAgB,GAAG,OAAO,CAAA,CAAC,CAAC,CAAC,CAAA;QAC9E,IAAI,iBAA2C,CAAA;QAC/C,MAAM,UAAU,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,GAAG,iBAAiB,GAAG,OAAO,CAAA,CAAC,CAAC,CAAC,CAAA;QAEhF,MAAM,MAAM,GAAG,CAAC,KAAyC,EAAE,MAAe,EAAQ,EAAE;YAClF,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YACrD,IAAI,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAC5C,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAA;YACvB,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,CAAA;YACtB,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAA;;gBACjC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;QAC5B,CAAC,CAAA;QACD,MAAM,gBAAgB,GAAG,KAAK,IAAmB,EAAE;YACjD,IAAI,QAAQ,IAAI,OAAO;gBAAE,OAAM;YAC/B,QAAQ,GAAG,IAAI,CAAA;YACf,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAA;YACzB,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,iBAAiB,CAAA;YAChF,IAAI,CAAC;gBACH,IAAI,OAAO,KAAK,SAAS;oBAAE,MAAM,IAAI,sBAAsB,CAAC,OAAO,EAAE,gCAAgC,CAAC,CAAA;gBACtG,MAAM,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAA;gBAC5C,sEAAsE;gBACtE,oDAAoD;gBACpD,IAAI,CAAC,YAAY;oBAAE,MAAM,OAAO,CAAC,UAAU,EAAE,eAAe,CAAC,CAAA;gBAC7D,IAAI,CAAC,YAAY;oBAAE,MAAM,IAAI,sBAAsB,CAAC,SAAS,EAAE,0CAA0C,CAAC,CAAA;gBAC1G,IAAI,KAAK,KAAK,SAAS;oBAAE,MAAM,CAAC,IAAI,sBAAsB,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC,CAAA;qBAC7F,IAAI,KAAK,KAAK,SAAS;oBAAE,MAAM,CAAC,IAAI,sBAAsB,CAAC,SAAS,EAAE,sCAAsC,CAAC,CAAC,CAAA;qBAC9G,IAAI,KAAK,KAAK,cAAc;oBAAE,MAAM,CAAC,IAAI,sBAAsB,CAAC,cAAc,EAAE,0CAA0C,CAAC,CAAC,CAAA;qBAC5H,IAAI,KAAK,KAAK,UAAU;oBAAE,MAAM,CAAC,IAAI,sBAAsB,CAAC,UAAU,EAAE,2CAA2C,CAAC,CAAC,CAAA;qBACrH,IAAI,KAAK,KAAK,OAAO;oBAAE,MAAM,CAAC,IAAI,sBAAsB,CAAC,OAAO,EAAE,qDAAqD,CAAC,CAAC,CAAA;qBACzH,CAAC;oBACJ,gEAAgE;oBAChE,oEAAoE;oBACpE,8CAA8C;oBAC9C,IAAI,CAAC,WAAW;wBAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;oBACzE,IAAI,CAAC,WAAW;wBAAE,MAAM,IAAI,sBAAsB,CAAC,SAAS,EAAE,6DAA6D,CAAC,CAAA;oBAC5H,qEAAqE;oBACrE,oEAAoE;oBACpE,iEAAiE;oBACjE,MAAM,UAAU,GAAG,YAAY,EAAE,CAAA;oBACjC,IAAI,UAAU,KAAK,SAAS;wBAAE,MAAM,CAAC,IAAI,sBAAsB,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC,CAAA;yBAClG,IAAI,UAAU,KAAK,SAAS;wBAAE,MAAM,CAAC,IAAI,sBAAsB,CAAC,SAAS,EAAE,sCAAsC,CAAC,CAAC,CAAA;yBACnH,IAAI,UAAU,KAAK,cAAc;wBAAE,MAAM,CAAC,IAAI,sBAAsB,CAAC,cAAc,EAAE,0CAA0C,CAAC,CAAC,CAAA;yBACjI,IAAI,UAAU,KAAK,UAAU;wBAAE,MAAM,CAAC,IAAI,sBAAsB,CAAC,UAAU,EAAE,2CAA2C,CAAC,CAAC,CAAA;yBAC1H,IAAI,UAAU,KAAK,OAAO;wBAAE,MAAM,CAAC,IAAI,sBAAsB,CAAC,OAAO,EAAE,qDAAqD,CAAC,CAAC,CAAA;;wBAC9H,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;gBAChE,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,YAAY,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,sBAAsB,CAAC,SAAS,EAAE,4CAA4C,CAAC,CAAC,CAAA;YAC/I,CAAC;QACH,CAAC,CAAA;QACD,MAAM,SAAS,GAAG,CAAC,IAAgC,EAAQ,EAAE;YAC3D,IAAI,KAAK,KAAK,SAAS;gBAAE,KAAK,GAAG,IAAI,CAAA;YACrC,sEAAsE;YACtE,qDAAqD;YACrD,KAAK,gBAAgB,EAAE,CAAA;QACzB,CAAC,CAAA;QACD,0EAA0E;QAC1E,gDAAgD;QAChD,MAAM,YAAY,GAAG,GAA2C,EAAE,CAAC,KAAK,CAAA;QAExE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;QAC7C,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;QACnD,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,WAAW,GAAG,IAAI,CAAC,CAAC,gBAAgB,EAAE,EAAE,CAAA,CAAC,CAAC,CAAC,CAAA;QAC7E,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,IAAI,OAAO,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAM;YAC1C,KAAK,IAAI,KAAK,CAAC,MAAM,CAAA;YACrB,IAAI,KAAK,GAAG,OAAO,CAAC,aAAa;gBAAE,SAAS,CAAC,cAAc,CAAC,CAAA;;gBACvD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACzB,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;YACxB,YAAY,GAAG,IAAI,CAAA;YACnB,iBAAiB,EAAE,EAAE,CAAA;YACrB,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,CAAC;gBAAE,KAAK,GAAG,UAAU,CAAA;YACzD,KAAK,gBAAgB,EAAE,CAAA;QACzB,CAAC,CAAC,CAAA;QACF,sEAAsE;QACtE,kEAAkE;QAClE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS,CAAC,OAAO,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QAC3F,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAgD,CAAC,CAAC,CAAA;QAChF,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QAChD,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAClE,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YAAE,OAAO,EAAE,CAAA;QACtC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QACjE,IAAI,CAAC;YAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAAC,CAAC;IAC9E,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/lib/adoption-coordinator.d.ts

@@ -0,0 +1,63 @@
+import type { AssistantAutomationsService } from '@dsh-enhanced/assistant-automations';
+import { type ControlPlaneStore } from './store.js';
+import type { PluginControlTrustConfig } from './trust.js';
+import type { PluginActivationPlan } from './types.js';
+export interface AdoptionCoordinatorConfig {
+    coordinatorId: string;
+    scope: {
+        workspace: string;
+        preset: string;
+        principalId: string;
+        ownerRouteId: string;
+    };
+    timeoutMs: number;
+    budgetId: string;
+    budgetAmount: number;
+}
+export declare function validateAdoptionCoordinatorConfig(value: unknown): asserts value is AdoptionCoordinatorConfig;
+/**
+ * Advance an already signed source handoff only through Host attestation.
+ * This Host deliberately leaves `commit-pending` for the target Host.
+ */
+export declare function coordinateAdoptionHandoff(options: {
+    store: ControlPlaneStore;
+    trust: PluginControlTrustConfig;
+    planId: string;
+    signal?: AbortSignal;
+    assertCurrent?: () => void | Promise<void>;
+}): Promise<PluginActivationPlan>;
+type Automations = Pick<AssistantAutomationsService, 'registerHostExecutor' | 'reconcileSystem' | 'inspectSystemOwnedActivation'>;
+/** Native Automations cron coordinator. It owns no private scheduler or final commit. */
+export declare class AdoptionCoordinatorRuntime {
+    private readonly options;
+    private readonly abort;
+    private readonly flights;
+    private readonly generation;
+    private readonly activationNonce;
+    private readonly automationId;
+    private active;
+    private cursor;
+    private unregister?;
+    private closing?;
+    private lastError;
+    constructor(options: {
+        config: AdoptionCoordinatorConfig;
+        store: ControlPlaneStore;
+        trust: PluginControlTrustConfig;
+        automations: Automations;
+        assertCurrent: () => void;
+    });
+    start(): void;
+    close(): Promise<void>;
+    health: () => {
+        connected: boolean;
+        lastError: string | null;
+    };
+    private track;
+    private current;
+    private definition;
+    private handoffs;
+    private execute;
+}
+export {};
+//# sourceMappingURL=adoption-coordinator.d.ts.map

package/lib/adoption-coordinator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adoption-coordinator.d.ts","sourceRoot":"","sources":["../src/adoption-coordinator.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,2BAA2B,EAAuF,MAAM,qCAAqC,CAAA;AAE3K,OAAO,EAAsB,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAUtD,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;IACvF,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,yBAAyB,CAkB5G;AAKD;;;GAGG;AACH,wBAAsB,yBAAyB,CAAC,OAAO,EAAE;IACvD,KAAK,EAAE,iBAAiB,CAAA;IACxB,KAAK,EAAE,wBAAwB,CAAA;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3C,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAmEhC;AAED,KAAK,WAAW,GAAG,IAAI,CAAC,2BAA2B,EAAE,sBAAsB,GAAG,iBAAiB,GAAG,8BAA8B,CAAC,CAAA;AAGjI,yFAAyF;AACzF,qBAAa,0BAA0B;IAWzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAVpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IACtD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAe;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAQ;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,MAAM,CAAI;IAClB,OAAO,CAAC,UAAU,CAAC,CAAY;IAC/B,OAAO,CAAC,OAAO,CAAC,CAAe;IAC/B,OAAO,CAAC,SAAS,CAAsB;gBACV,OAAO,EAAE;QAAE,MAAM,EAAE,yBAAyB,CAAC;QAAC,KAAK,EAAE,iBAAiB,CAAC;QAAC,KAAK,EAAE,wBAAwB,CAAC;QAAC,WAAW,EAAE,WAAW,CAAC;QAAC,aAAa,EAAE,MAAM,IAAI,CAAA;KAAE;IAO3L,KAAK,IAAI,IAAI;IAmBb,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBtB,MAAM;;;MAAgE;IAEtE,OAAO,CAAC,KAAK;IAKb,OAAO,CAAC,OAAO;IAKf,OAAO,CAAC,UAAU;IAQlB,OAAO,CAAC,QAAQ;YAGF,OAAO;CA8BtB"}