@dsh-enhanced/plugin-control-plane 0.1.48 → 0.1.53

package/lib/source-build.d.ts

@@ -1,7 +1,16 @@
-import type { SourcePreparedEvidence } from './types.js';
-export interface SourceBuildConfig {
+import { type SourceRevisionBinding } from './source-revision.js';
+import type { CreationCapabilitySourceSnapshot } from './creation-capability-source.js';
+import type { PluginCreationVerificationCertificate } from '@dsh-enhanced/assistant-growth-contract';
+import { type SourceCreationBinding } from './source-creation.js';
+import type { DockerSourcePreparedEvidence, SourcePreparedEvidence } from './types.js';
+import type { NativeMacRuntime } from '@dsh-enhanced/assistant-isolation';
+export interface DockerSourceBuildConfig {
     /** Canonical owner-controlled docker client. */
     dockerPath: string;
+    /** Canonical, owner-held local Docker Desktop socket for portable repository builds. */
+    socketPath?: string;
+    /** Engine identity frozen by the owner bootstrap receipt. */
+    daemonId?: string;
     /** Image pinned by manifest reference or a local immutable image content ID. */
     image: string;
     timeoutMs: number;
@@ -13,7 +22,7 @@ export interface SourceBuildConfig {
     /** Host-owned package/runtime version bump before the checked tree is frozen. */
     versioning?: 'patch';
     /** Owner-only opt-in for the larger, full-repository check budget. */
-    profile?: 'standard' | 'repository';
+    profile?: 'standard' | 'repository' | 'portable-repository';
     /** Writable /tmp tmpfs size. Defaults to 32 MiB for standard, 2048 MiB for repository. */
     temporaryMiB?: number;
     /** Explicit owner opt-in for nested unprivileged sandboxes. Relaxes Docker's
@@ -22,14 +31,29 @@ export interface SourceBuildConfig {
         seccompPath: string;
     };
 }
-export interface SourceBuildResult {
+export interface NativeSourceBuildConfig {
+    backend: 'macos-seatbelt';
+    runtime: NativeMacRuntime;
+    stateRoot: string;
+    authorityDigest: string;
+    expiresAt: number;
+    maxRuns: number;
+    maxTotalDurationMs: number;
+    timeoutMs: number;
+    outputBytes: number;
+    versioning?: 'patch';
+}
+export type SourceBuildConfig = DockerSourceBuildConfig | NativeSourceBuildConfig;
+export interface SourceBuildResult<E extends SourcePreparedEvidence = SourcePreparedEvidence> {
     treeDigest: string;
     patchDigest: string;
     checkedAt: number;
-    evidence: SourcePreparedEvidence;
+    evidence: E;
+    /** Host-only bytes from the same verified in-container pack read. Never persisted in source evidence. */
+    packArtifact?: Buffer;
 }
 /** Exact in-container command recorded in prepared source evidence. */
-export declare const PREPARED_SOURCE_BUILD_SCRIPT = "set -eu; checked() { phase=\"$1\"; shift; if \"$@\" >\"/tmp/$phase.log\" 2>&1; then return 0; else code=$?; printf \"source build phase failed: %s\\n\" \"$phase\" >&2; tail -c 8192 \"/tmp/$phase.log\" >&2; return \"$code\"; fi; }; umask 077; mkdir -p /workspace; tar -x -C /workspace; cd /workspace; checked install pnpm install --offline --frozen-lockfile --ignore-scripts; checked check pnpm check; mkdir -p /workspace/.dsh-pack; cd \"$PLUGIN_ROOT\"; checked pack pnpm pack --pack-destination /workspace/.dsh-pack; set -- /workspace/.dsh-pack/*.tgz; test \"$#\" = 1; pack=\"$1\"; printf \"DSH_PREPARED_PACK\\t%s\\t%s\\t%s\\t%s\\t%s\\n\" \"${pack##*/}\" \"$(wc -c < \"$pack\" | tr -d \" \")\" \"$(sha256sum \"$pack\" | cut -d \" \" -f1)\" \"$(node --version)\" \"$(pnpm --version)\"";
+export declare const PREPARED_SOURCE_BUILD_SCRIPT: string;
 export declare function validateSourceBuildConfig(config: SourceBuildConfig): void;
 /**
  * Archive an exact temporary-index tree into a disposable, mount-free Docker
@@ -37,7 +61,7 @@ export declare function validateSourceBuildConfig(config: SourceBuildConfig): vo
  * value, or Host path crosses the boundary: the sole input is tar on stdin.
  */
 export declare function runDockerPreparedChecks(input: {
-    config: SourceBuildConfig;
+    config: DockerSourceBuildConfig;
     worktree: string;
     baseCommit: string;
     name: string;
@@ -51,9 +75,19 @@ export declare function runDockerPreparedChecks(input: {
         id: string;
         containerName: string;
     };
-}): Promise<SourceBuildResult>;
+    /** Frozen owner grant and generator proof for Host-scaffolded creation only. */
+    creation?: SourceCreationBinding;
+    revision?: {
+        binding: SourceRevisionBinding;
+        parentSource: CreationCapabilitySourceSnapshot;
+        parentCertificate: PluginCreationVerificationCertificate;
+        files: readonly import('./source-workspace.js').ScopedPluginFile[];
+    };
+    /** Host-only request to return the exact already-verified pack bytes for independent verification. */
+    capturePack?: true;
+}): Promise<SourceBuildResult<DockerSourcePreparedEvidence>>;
 /** Reconcile only a labeled, image-bound durable container, then prove absence. */
-export declare function removeSourceJobContainer(config: SourceBuildConfig, job: {
+export declare function removeSourceJobContainer(config: DockerSourceBuildConfig, job: {
     id: string;
     containerName: string;
 }): Promise<void>;

package/lib/source-build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source-build.d.ts","sourceRoot":"","sources":["../src/source-build.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAExD,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAA;IAClB,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,sEAAsE;IACtE,OAAO,CAAC,EAAE,UAAU,GAAG,YAAY,CAAA;IACnC,0FAA0F;IAC1F,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;iFAC6E;IAC7E,iBAAiB,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;CAC5C;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,sBAAsB,CAAA;CACjC;AAMD,uEAAuE;AACvE,eAAO,MAAM,4BAA4B,oxBAA4uB,CAAA;AAYrxB,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CA2BzE;AAiDD;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,MAAM,EAAE,iBAAiB,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACxB,WAAW,EAAE,MAAM,CAAC,UAAU,CAAA;IAC9B,MAAM,EAAE,WAAW,CAAA;IACnB,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,kEAAkE;IAClE,SAAS,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAA;CAClD,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkG7B;AAED,mFAAmF;AACnF,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBnI"}
+{"version":3,"file":"source-build.d.ts","sourceRoot":"","sources":["../src/source-build.ts"],"names":[],"mappings":"AAMA,OAAO,EAAgC,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC/F,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAA;AACvF,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,yCAAyC,CAAA;AACpG,OAAO,EAAgC,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAE/F,OAAO,KAAK,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AACtF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAA;AAEzE,MAAM,WAAW,uBAAuB;IACtC,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAA;IAClB,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,sEAAsE;IACtE,OAAO,CAAC,EAAE,UAAU,GAAG,YAAY,GAAG,qBAAqB,CAAA;IAC3D,0FAA0F;IAC1F,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;iFAC6E;IAC7E,iBAAiB,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;CAC5C;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,gBAAgB,CAAA;IACzB,OAAO,EAAE,gBAAgB,CAAA;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,EAAE,MAAM,CAAA;IACvB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,kBAAkB,EAAE,MAAM,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,MAAM,MAAM,iBAAiB,GAAG,uBAAuB,GAAG,uBAAuB,CAAA;AA0BjF,MAAM,WAAW,iBAAiB,CAAC,CAAC,SAAS,sBAAsB,GAAG,sBAAsB;IAC1F,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,CAAC,CAAA;IACX,yGAAyG;IACzG,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AASD,uEAAuE;AACvE,eAAO,MAAM,4BAA4B,QAsaxC,CAAA;AAYD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAqDzE;AAyED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,MAAM,EAAE,uBAAuB,CAAA;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACxB,WAAW,EAAE,MAAM,CAAC,UAAU,CAAA;IAC9B,MAAM,EAAE,WAAW,CAAA;IACnB,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,kEAAkE;IAClE,SAAS,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAA;IACjD,gFAAgF;IAChF,QAAQ,CAAC,EAAE,qBAAqB,CAAA;IAChC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,qBAAqB,CAAC;QAAC,YAAY,EAAE,gCAAgC,CAAC;QAAC,iBAAiB,EAAE,qCAAqC,CAAC;QAAC,KAAK,EAAE,SAAS,OAAO,uBAAuB,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAA;IAC3N,sGAAsG;IACtG,WAAW,CAAC,EAAE,IAAI,CAAA;CACnB,GAAG,OAAO,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,CAAC,CAoL3D;AAED,mFAAmF;AACnF,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,uBAAuB,EAAE,GAAG,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBzI"}