@dudousxd/nestjs-catalog 0.9.0 → 0.11.0

package/dist/client.js

@@ -11,7 +11,7 @@
  * types are.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isWorkflowNodeKind = exports.isWorkflowExecutionMode = exports.workflowRunOrder = exports.workflowGraphHash = exports.WORKFLOW_NODE_KINDS = exports.WORKFLOW_NODE_ID_PATTERN = exports.WORKFLOW_ISSUE_CODES = exports.WORKFLOW_EXECUTION_MODES = exports.validateWorkflow = exports.TRANSFORM_LANGUAGES = exports.isWorkflowNode = exports.isWorkflowEdge = exports.isTransformLanguage = exports.isConnectorKind = exports.CONNECTOR_KINDS = exports.catalogRoutes = void 0;
+exports.isWorkflowStatus = exports.isWorkflowNodeKind = exports.isWorkflowExecutionMode = exports.workflowRunOrder = exports.workflowGraphHash = exports.WORKFLOW_STATUSES = exports.WORKFLOW_NODE_KINDS = exports.WORKFLOW_NODE_ID_PATTERN = exports.WORKFLOW_ISSUE_CODES = exports.WORKFLOW_EXECUTION_MODES = exports.validateWorkflow = exports.TRANSFORM_LANGUAGES = exports.isWorkflowNode = exports.isWorkflowEdge = exports.isTransformLanguage = exports.isConnectorKind = exports.CONNECTOR_KINDS = exports.catalogRoutes = void 0;
 /**
  * Builds the paths the catalog controller serves, relative to wherever it was
  * mounted. Kept as string builders rather than a fetch wrapper so the host
@@ -87,7 +87,15 @@ Object.defineProperty(exports, "WORKFLOW_EXECUTION_MODES", { enumerable: true, g
 Object.defineProperty(exports, "WORKFLOW_ISSUE_CODES", { enumerable: true, get: function () { return catalog_pipeline_2.WORKFLOW_ISSUE_CODES; } });
 Object.defineProperty(exports, "WORKFLOW_NODE_ID_PATTERN", { enumerable: true, get: function () { return catalog_pipeline_2.WORKFLOW_NODE_ID_PATTERN; } });
 Object.defineProperty(exports, "WORKFLOW_NODE_KINDS", { enumerable: true, get: function () { return catalog_pipeline_2.WORKFLOW_NODE_KINDS; } });
+// The draft/ready pair, for the same reason as the list above: a canvas that
+// cannot see it restates it, and the copy is what drifts. Without this the
+// editor could not tell a graph it is allowed to store from one the server
+// would refuse — so it told everybody the second, which is wrong for every
+// draft and is exactly the kind of confident-and-false sentence this codebase
+// keeps removing.
+Object.defineProperty(exports, "WORKFLOW_STATUSES", { enumerable: true, get: function () { return catalog_pipeline_2.WORKFLOW_STATUSES; } });
 Object.defineProperty(exports, "workflowGraphHash", { enumerable: true, get: function () { return catalog_pipeline_2.workflowGraphHash; } });
 Object.defineProperty(exports, "workflowRunOrder", { enumerable: true, get: function () { return catalog_pipeline_2.workflowRunOrder; } });
 Object.defineProperty(exports, "isWorkflowExecutionMode", { enumerable: true, get: function () { return catalog_pipeline_2.isWorkflowExecutionMode; } });
 Object.defineProperty(exports, "isWorkflowNodeKind", { enumerable: true, get: function () { return catalog_pipeline_2.isWorkflowNodeKind; } });
+Object.defineProperty(exports, "isWorkflowStatus", { enumerable: true, get: function () { return catalog_pipeline_2.isWorkflowStatus; } });

package/dist/index.d.ts

@@ -1,13 +1,14 @@
 export { CatalogProperty, type CatalogPropertyOptions, CatalogType, type CatalogTypeOptions, } from './catalog.decorators';
-export { CATALOG_EVENT_PHASE, CATALOG_EVENT_PHASE_FALLBACK, CATALOG_EVENTS, CATALOG_LIB, type CatalogEvent, type CatalogEventPayloads, catalogEventPhase, channelNameFor, emitCatalog, } from './catalog.events';
+export { CATALOG_EVENT_PHASE, CATALOG_EVENT_PHASE_FALLBACK, CATALOG_EVENTS, CATALOG_LIB, type CatalogEvent, type CatalogEventPayloads, UNATTRIBUTED_PRINCIPAL_ID, catalogEventPhase, channelNameFor, curationActor, emitCatalog, } from './catalog.events';
 export { CatalogModule } from './catalog.module';
 export { assertReadOnlyShape, type CatalogQueryRelation, type CatalogQueryRequest, type CatalogQueryResult, type CatalogQueryStore, isQueryStore, } from './catalog.query';
 export { CATALOG_OPTIONS, type CatalogModuleOptions } from './catalog.options';
+export * from './catalog.secrets';
 export { type CatalogOverlayStore, FileCatalogOverlayStore, InMemoryCatalogOverlayStore, } from './catalog.overlay-store';
 export { CATALOG_OVERLAY_STORE } from './catalog.overlay-store.token';
 export { MikroOrmCatalogRegistry } from './catalog.registry';
 export { CatalogRegistry } from './catalog.registry.base';
-export { CATALOG_PIPELINE_STORE, type CatalogConnection, type CatalogConnector, type ConnectionCheck, CONNECTOR_KINDS, type CatalogPipelineStore, type CatalogStageStore, type CatalogTransform, type CatalogWorkflow, type CatalogWorkflowCapabilities, type CatalogWorkflowStore, type ConnectorKind, type ConnectorRun, isConnectorKind, isPipelineStore, isTransformLanguage, isWorkflowEdge, isWorkflowExecutionMode, isWorkflowNode, isWorkflowNodeKind, supportsWorkflows, supportsWorkflowStages, TRANSFORM_RUNNER, TRANSFORM_LANGUAGES, type TransformLanguage, type TransformResult, type TransformRunner, validateWorkflow, WORKFLOW_EXECUTION_MODES, WORKFLOW_ISSUE_CODES, WORKFLOW_NODE_ID_PATTERN, WORKFLOW_NODE_KINDS, type WorkflowEdge, type WorkflowExecutionMode, type WorkflowGraph, workflowGraphHash, type WorkflowIssueCode, type WorkflowNode, type WorkflowNodeKind, type WorkflowNodeOutcome, type WorkflowNodeStepInput, type WorkflowNodeStepOutput, workflowRunOrder, type WorkflowSinkNode, type WorkflowSourceNode, type WorkflowStageRef, type WorkflowTransformNode, type WorkflowValidationIssue, } from './catalog.pipeline';
+export { CATALOG_PIPELINE_STORE, type CatalogConnection, type CatalogConnector, type ConnectionCheck, CONNECTOR_KINDS, type CatalogPipelineStore, type CatalogStageStore, type CatalogTransform, type CatalogWorkflow, type CatalogWorkflowCapabilities, type CatalogWorkflowStore, type ConnectorKind, type ConnectorRun, isConnectorKind, isPipelineStore, isTransformLanguage, isWorkflowEdge, isWorkflowExecutionMode, isWorkflowNode, isWorkflowNodeKind, isWorkflowStatus, supportsWorkflows, supportsWorkflowStages, TRANSFORM_RUNNER, TRANSFORM_LANGUAGES, type TransformLanguage, type TransformResult, type TransformRunner, validateWorkflow, WORKFLOW_EXECUTION_MODES, WORKFLOW_ISSUE_CODES, WORKFLOW_NODE_ID_PATTERN, WORKFLOW_NODE_KINDS, WORKFLOW_STATUSES, type WorkflowEdge, type WorkflowExecutionMode, type WorkflowGraph, workflowGraphHash, type WorkflowIssueCode, type WorkflowNode, type WorkflowNodeKind, type WorkflowNodeOutcome, type WorkflowNodeStepInput, type WorkflowNodeStepOutput, workflowRunOrder, type WorkflowSinkNode, type WorkflowSourceNode, type WorkflowStageRef, type WorkflowStatus, type WorkflowTransformNode, type WorkflowValidationIssue, } from './catalog.pipeline';
 export * from './catalog.environment';
 export { QueryCache, toCsv } from './catalog.query-cache';
 export { SubprocessTransformRunner, type TransformRunnerOptions, } from './transform-runner';

package/dist/index.js

@@ -14,8 +14,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CATALOG_TRACE_OUTCOMES = exports.visibleToPrincipal = exports.searchCatalog = exports.maySearch = exports.emptySearch = exports.bestMatch = exports.MAX_SEARCH_LIMIT = exports.DEFAULT_SEARCH_LIMIT = exports.CatalogService = exports.SubprocessTransformRunner = exports.toCsv = exports.QueryCache = exports.workflowRunOrder = exports.workflowGraphHash = exports.WORKFLOW_NODE_KINDS = exports.WORKFLOW_NODE_ID_PATTERN = exports.WORKFLOW_ISSUE_CODES = exports.WORKFLOW_EXECUTION_MODES = exports.validateWorkflow = exports.TRANSFORM_LANGUAGES = exports.TRANSFORM_RUNNER = exports.supportsWorkflowStages = exports.supportsWorkflows = exports.isWorkflowNodeKind = exports.isWorkflowNode = exports.isWorkflowExecutionMode = exports.isWorkflowEdge = exports.isTransformLanguage = exports.isPipelineStore = exports.isConnectorKind = exports.CONNECTOR_KINDS = exports.CATALOG_PIPELINE_STORE = exports.CatalogRegistry = exports.MikroOrmCatalogRegistry = exports.CATALOG_OVERLAY_STORE = exports.InMemoryCatalogOverlayStore = exports.FileCatalogOverlayStore = exports.CATALOG_OPTIONS = exports.isQueryStore = exports.assertReadOnlyShape = exports.CatalogModule = exports.emitCatalog = exports.channelNameFor = exports.catalogEventPhase = exports.CATALOG_LIB = exports.CATALOG_EVENTS = exports.CATALOG_EVENT_PHASE_FALLBACK = exports.CATALOG_EVENT_PHASE = exports.CatalogType = exports.CatalogProperty = void 0;
-exports.RequireScopes = exports.RequireHuman = exports.REQUIRES_HUMAN = exports.REQUIRED_SCOPES = exports.MikroOrmReadStore = exports.supportsCarryForward = exports.isWriteStore = exports.isReservedColumn = exports.isCatalogStoreCapabilities = exports.findColumnCollisions = exports.CatalogColumnCollisionError = exports.CATALOG_STORE = exports.CATALOG_SNAPSHOT_MODES = exports.CATALOG_RESERVED_COLUMNS = exports.assertNoColumnCollisions = exports.StaticKeyPrincipalResolver = exports.readableObjectPage = exports.mayWrite = exports.mayRead = exports.maySeeClassification = exports.PRINCIPAL_ACTOR_SEPARATOR = exports.parsePrincipalId = exports.hasScope = exports.expandScopes = exports.delegatePrincipal = exports.composePrincipalId = exports.CATALOG_PRINCIPAL_RESOLVER = exports.traceOutcomeFilter = exports.isWorkspaceStore = exports.isTraceStore = exports.isCatalogTraceOutcome = exports.embeddedVisualization = exports.CATALOG_WORKSPACE_STORE = exports.CATALOG_TRACE_STORE = void 0;
+exports.emptySearch = exports.bestMatch = exports.MAX_SEARCH_LIMIT = exports.DEFAULT_SEARCH_LIMIT = exports.CatalogService = exports.SubprocessTransformRunner = exports.toCsv = exports.QueryCache = exports.workflowRunOrder = exports.workflowGraphHash = exports.WORKFLOW_STATUSES = exports.WORKFLOW_NODE_KINDS = exports.WORKFLOW_NODE_ID_PATTERN = exports.WORKFLOW_ISSUE_CODES = exports.WORKFLOW_EXECUTION_MODES = exports.validateWorkflow = exports.TRANSFORM_LANGUAGES = exports.TRANSFORM_RUNNER = exports.supportsWorkflowStages = exports.supportsWorkflows = exports.isWorkflowStatus = exports.isWorkflowNodeKind = exports.isWorkflowNode = exports.isWorkflowExecutionMode = exports.isWorkflowEdge = exports.isTransformLanguage = exports.isPipelineStore = exports.isConnectorKind = exports.CONNECTOR_KINDS = exports.CATALOG_PIPELINE_STORE = exports.CatalogRegistry = exports.MikroOrmCatalogRegistry = exports.CATALOG_OVERLAY_STORE = exports.InMemoryCatalogOverlayStore = exports.FileCatalogOverlayStore = exports.CATALOG_OPTIONS = exports.isQueryStore = exports.assertReadOnlyShape = exports.CatalogModule = exports.emitCatalog = exports.curationActor = exports.channelNameFor = exports.catalogEventPhase = exports.UNATTRIBUTED_PRINCIPAL_ID = exports.CATALOG_LIB = exports.CATALOG_EVENTS = exports.CATALOG_EVENT_PHASE_FALLBACK = exports.CATALOG_EVENT_PHASE = exports.CatalogType = exports.CatalogProperty = void 0;
+exports.RequireScopes = exports.RequireHuman = exports.REQUIRES_HUMAN = exports.REQUIRED_SCOPES = exports.MikroOrmReadStore = exports.supportsCarryForward = exports.isWriteStore = exports.isReservedColumn = exports.isCatalogStoreCapabilities = exports.findColumnCollisions = exports.CatalogColumnCollisionError = exports.CATALOG_STORE = exports.CATALOG_SNAPSHOT_MODES = exports.CATALOG_RESERVED_COLUMNS = exports.assertNoColumnCollisions = exports.StaticKeyPrincipalResolver = exports.readableObjectPage = exports.mayWrite = exports.mayRead = exports.maySeeClassification = exports.PRINCIPAL_ACTOR_SEPARATOR = exports.parsePrincipalId = exports.hasScope = exports.expandScopes = exports.delegatePrincipal = exports.composePrincipalId = exports.CATALOG_PRINCIPAL_RESOLVER = exports.traceOutcomeFilter = exports.isWorkspaceStore = exports.isTraceStore = exports.isCatalogTraceOutcome = exports.embeddedVisualization = exports.CATALOG_WORKSPACE_STORE = exports.CATALOG_TRACE_STORE = exports.CATALOG_TRACE_OUTCOMES = exports.visibleToPrincipal = exports.searchCatalog = exports.maySearch = void 0;
 var catalog_decorators_1 = require("./catalog.decorators");
 Object.defineProperty(exports, "CatalogProperty", { enumerable: true, get: function () { return catalog_decorators_1.CatalogProperty; } });
 Object.defineProperty(exports, "CatalogType", { enumerable: true, get: function () { return catalog_decorators_1.CatalogType; } });
@@ -24,8 +24,10 @@ Object.defineProperty(exports, "CATALOG_EVENT_PHASE", { enumerable: true, get: f
 Object.defineProperty(exports, "CATALOG_EVENT_PHASE_FALLBACK", { enumerable: true, get: function () { return catalog_events_1.CATALOG_EVENT_PHASE_FALLBACK; } });
 Object.defineProperty(exports, "CATALOG_EVENTS", { enumerable: true, get: function () { return catalog_events_1.CATALOG_EVENTS; } });
 Object.defineProperty(exports, "CATALOG_LIB", { enumerable: true, get: function () { return catalog_events_1.CATALOG_LIB; } });
+Object.defineProperty(exports, "UNATTRIBUTED_PRINCIPAL_ID", { enumerable: true, get: function () { return catalog_events_1.UNATTRIBUTED_PRINCIPAL_ID; } });
 Object.defineProperty(exports, "catalogEventPhase", { enumerable: true, get: function () { return catalog_events_1.catalogEventPhase; } });
 Object.defineProperty(exports, "channelNameFor", { enumerable: true, get: function () { return catalog_events_1.channelNameFor; } });
+Object.defineProperty(exports, "curationActor", { enumerable: true, get: function () { return catalog_events_1.curationActor; } });
 Object.defineProperty(exports, "emitCatalog", { enumerable: true, get: function () { return catalog_events_1.emitCatalog; } });
 var catalog_module_1 = require("./catalog.module");
 Object.defineProperty(exports, "CatalogModule", { enumerable: true, get: function () { return catalog_module_1.CatalogModule; } });
@@ -34,6 +36,14 @@ Object.defineProperty(exports, "assertReadOnlyShape", { enumerable: true, get: f
 Object.defineProperty(exports, "isQueryStore", { enumerable: true, get: function () { return catalog_query_1.isQueryStore; } });
 var catalog_options_1 = require("./catalog.options");
 Object.defineProperty(exports, "CATALOG_OPTIONS", { enumerable: true, get: function () { return catalog_options_1.CATALOG_OPTIONS; } });
+// Everything, deliberately, and here more than anywhere: this is a seam two
+// separate provider packages are being written against. A barrel that shipped
+// `CATALOG_SECRET_VAULT` and `CatalogSecretVault` but not `SealedSecret` or
+// `SecretContext` — the return type and the argument of the two methods a
+// provider implements — would be the exact gap `index.barrel.spec.ts` was
+// written after, reproduced on the one surface where a third party compiles
+// against it.
+__exportStar(require("./catalog.secrets"), exports);
 var catalog_overlay_store_1 = require("./catalog.overlay-store");
 Object.defineProperty(exports, "FileCatalogOverlayStore", { enumerable: true, get: function () { return catalog_overlay_store_1.FileCatalogOverlayStore; } });
 Object.defineProperty(exports, "InMemoryCatalogOverlayStore", { enumerable: true, get: function () { return catalog_overlay_store_1.InMemoryCatalogOverlayStore; } });
@@ -53,6 +63,7 @@ Object.defineProperty(exports, "isWorkflowEdge", { enumerable: true, get: functi
 Object.defineProperty(exports, "isWorkflowExecutionMode", { enumerable: true, get: function () { return catalog_pipeline_1.isWorkflowExecutionMode; } });
 Object.defineProperty(exports, "isWorkflowNode", { enumerable: true, get: function () { return catalog_pipeline_1.isWorkflowNode; } });
 Object.defineProperty(exports, "isWorkflowNodeKind", { enumerable: true, get: function () { return catalog_pipeline_1.isWorkflowNodeKind; } });
+Object.defineProperty(exports, "isWorkflowStatus", { enumerable: true, get: function () { return catalog_pipeline_1.isWorkflowStatus; } });
 Object.defineProperty(exports, "supportsWorkflows", { enumerable: true, get: function () { return catalog_pipeline_1.supportsWorkflows; } });
 Object.defineProperty(exports, "supportsWorkflowStages", { enumerable: true, get: function () { return catalog_pipeline_1.supportsWorkflowStages; } });
 Object.defineProperty(exports, "TRANSFORM_RUNNER", { enumerable: true, get: function () { return catalog_pipeline_1.TRANSFORM_RUNNER; } });
@@ -62,6 +73,7 @@ Object.defineProperty(exports, "WORKFLOW_EXECUTION_MODES", { enumerable: true, g
 Object.defineProperty(exports, "WORKFLOW_ISSUE_CODES", { enumerable: true, get: function () { return catalog_pipeline_1.WORKFLOW_ISSUE_CODES; } });
 Object.defineProperty(exports, "WORKFLOW_NODE_ID_PATTERN", { enumerable: true, get: function () { return catalog_pipeline_1.WORKFLOW_NODE_ID_PATTERN; } });
 Object.defineProperty(exports, "WORKFLOW_NODE_KINDS", { enumerable: true, get: function () { return catalog_pipeline_1.WORKFLOW_NODE_KINDS; } });
+Object.defineProperty(exports, "WORKFLOW_STATUSES", { enumerable: true, get: function () { return catalog_pipeline_1.WORKFLOW_STATUSES; } });
 Object.defineProperty(exports, "workflowGraphHash", { enumerable: true, get: function () { return catalog_pipeline_1.workflowGraphHash; } });
 Object.defineProperty(exports, "workflowRunOrder", { enumerable: true, get: function () { return catalog_pipeline_1.workflowRunOrder; } });
 // The environment surface: which catalog database a call is served from, and

package/dist/transform-runner.d.ts

@@ -15,11 +15,28 @@ export interface TransformRunnerOptions {
 /**
  * Runs a transform in a child process, with a clock on it.
  *
- * **This is not a security boundary.** It stops accidents — an infinite loop, a
- * runaway allocation, a stray read of `process.env.DATABASE_PASSWORD` — because
- * the child gets a timeout and an empty environment. It does not stop code
- * written to escape it: a child process can still open sockets and read the
- * filesystem as whatever user the service runs as.
+ * **This is not a security boundary, and the trimmed environment is not one
+ * either.** It stops accidents — an infinite loop, a runaway allocation, a stray
+ * read of `process.env.DATABASE_PASSWORD` — because the child gets a timeout and
+ * an environment of `{PATH, NODE_ENV}`. It does not stop code written to escape
+ * it, and it is worth being exact about how thin the allowlist is rather than
+ * leaving a reader to assume it holds:
+ *
+ * - the child inherits nothing of the parent's environment **through `env`**,
+ *   and reads all of it anyway from `/proc/<ppid>/environ`, which is readable
+ *   because parent and child run as the same uid;
+ * - it runs in a working directory of this runner's choosing but on the host's
+ *   filesystem, so a service account token under
+ *   `/var/run/secrets/kubernetes.io/serviceaccount/` is an absolute path away;
+ * - it can open sockets, as whatever user the service runs as.
+ *
+ * So the allowlist is a guard rail against the accident, and the reachability of
+ * everything it names is a property of the process boundary, not a leak to be
+ * patched. **Running a transform is running code in this pod.** Who is allowed
+ * to is therefore an authorisation question and not a sandboxing one, and it is
+ * answered at the HTTP surface — see the "Running a transform is running code"
+ * section of `@dudousxd/nestjs-catalog-pipeline`'s README, which is where a host
+ * can actually read it, and `pipeline.controller.ts` for the checks themselves.
  *
  * That is a deliberate trade for the case this is built for, where transforms
  * are written by the same people who already have database access. A catalog

package/dist/transform-runner.js

@@ -13,10 +13,50 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SubprocessTransformRunner = void 0;
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const common_1 = require("@nestjs/common");
 const DEFAULT_TIMEOUT_MS = 30_000;
 const MAX_OUTPUT_BYTES = 32 * 1024 * 1024;
+/**
+ * How much of the child's stderr is held, and why it is a different number from
+ * {@link MAX_OUTPUT_BYTES} with a different consequence.
+ *
+ * It had no bound at all, which is the one shape a capture must never have when
+ * the thing filling it is user code: `stderr += chunk` ran for the whole timeout
+ * window, so a transform whose only line is a loop writing to fd 2 grew the
+ * **parent's** heap — not the child's — at whatever rate the pipe would carry,
+ * and took the pod out with it. The timeout is no answer to that: thirty seconds
+ * of an unthrottled writer is gigabytes, and the process that dies is the one
+ * serving every other request.
+ *
+ * Bounded rather than killed, which is the opposite of what stdout overflow
+ * does, and the asymmetry is the point. Stdout *is* the result channel — past
+ * {@link MAX_OUTPUT_BYTES} there is no readable JSON line at the end of it and
+ * the run has already failed, so killing costs nothing. Stderr is only ever the
+ * diagnostic: a transform that writes a great deal to it and then returns a
+ * perfectly good array of rows is a working transform, and killing it would turn
+ * a noisy dependency's warnings into a failed load.
+ *
+ * The **head** is kept, because the head is what is read. Both places that
+ * consume this take `stderr.slice(0, 500)` — the first line of a traceback, the
+ * import error, the thing that says what went wrong — so dropping the tail
+ * discards exactly the part nobody was going to see. 64 KiB is far more than any
+ * of those and small enough that the ceiling is not itself a memory decision.
+ */
+const MAX_CAPTURED_STDERR_BYTES = 64 * 1024;
+/**
+ * Whether the child is put in its own process group, so that stopping it stops
+ * what it started.
+ *
+ * POSIX only, because the mechanism is POSIX: `detached` there makes the child a
+ * process-group leader and `process.kill(-pid)` signals the whole group, which
+ * is the only way to reach a grandchild. On Windows `detached` means something
+ * else entirely (a new console) and a negative pid is not a group, so the
+ * platform gets the single-process kill it always had rather than a call that
+ * would throw on every timeout.
+ */
+const KILL_PROCESS_GROUP = process.platform !== 'win32';
 /**
  * How much of what a transform logged is carried back, on both axes.
  *
@@ -73,11 +113,28 @@ const REPORTED_PACKAGES = ['pandas', 'numpy', 'pyarrow', 'requests'];
 /**
  * Runs a transform in a child process, with a clock on it.
  *
- * **This is not a security boundary.** It stops accidents — an infinite loop, a
- * runaway allocation, a stray read of `process.env.DATABASE_PASSWORD` — because
- * the child gets a timeout and an empty environment. It does not stop code
- * written to escape it: a child process can still open sockets and read the
- * filesystem as whatever user the service runs as.
+ * **This is not a security boundary, and the trimmed environment is not one
+ * either.** It stops accidents — an infinite loop, a runaway allocation, a stray
+ * read of `process.env.DATABASE_PASSWORD` — because the child gets a timeout and
+ * an environment of `{PATH, NODE_ENV}`. It does not stop code written to escape
+ * it, and it is worth being exact about how thin the allowlist is rather than
+ * leaving a reader to assume it holds:
+ *
+ * - the child inherits nothing of the parent's environment **through `env`**,
+ *   and reads all of it anyway from `/proc/<ppid>/environ`, which is readable
+ *   because parent and child run as the same uid;
+ * - it runs in a working directory of this runner's choosing but on the host's
+ *   filesystem, so a service account token under
+ *   `/var/run/secrets/kubernetes.io/serviceaccount/` is an absolute path away;
+ * - it can open sockets, as whatever user the service runs as.
+ *
+ * So the allowlist is a guard rail against the accident, and the reachability of
+ * everything it names is a property of the process boundary, not a leak to be
+ * patched. **Running a transform is running code in this pod.** Who is allowed
+ * to is therefore an authorisation question and not a sandboxing one, and it is
+ * answered at the HTTP surface — see the "Running a transform is running code"
+ * section of `@dudousxd/nestjs-catalog-pipeline`'s README, which is where a host
+ * can actually read it, and `pipeline.controller.ts` for the checks themselves.
  *
  * That is a deliberate trade for the case this is built for, where transforms
  * are written by the same people who already have database access. A catalog
@@ -179,7 +236,21 @@ let SubprocessTransformRunner = SubprocessTransformRunner_1 = class SubprocessTr
             const child = (0, node_child_process_1.spawn)(command, args, {
                 // An empty environment, not the parent's. A transform has no business
                 // reading the database password, and inheriting env is how it would.
+                // Read the class docblock before treating this as containment: the same
+                // values are a `/proc/<ppid>/environ` read away, and this is a guard
+                // rail against the accidental read rather than a boundary.
                 env: { PATH: process.env.PATH ?? '', NODE_ENV: 'production' },
+                // Not the parent's, which is a running service's directory and holds
+                // the `.env` the allowlist above exists to withhold — a transform whose
+                // first line is `readFileSync(".env")` was reading the host application's
+                // configuration by relative path. A temporary directory keeps the file
+                // writes a transform may legitimately want working while making the one
+                // path it can name without knowing anything about the deployment
+                // uninteresting. Absolute paths are unaffected, and cannot be.
+                cwd: (0, node_os_1.tmpdir)(),
+                // Its own process group, so the timeout below can reach a grandchild.
+                // See {@link KILL_PROCESS_GROUP}.
+                detached: KILL_PROCESS_GROUP,
                 stdio: ['pipe', 'pipe', 'pipe'],
             });
             let stdout = '';
@@ -189,16 +260,22 @@ let SubprocessTransformRunner = SubprocessTransformRunner_1 = class SubprocessTr
                 if (settled)
                     return;
                 settled = true;
-                child.kill('SIGKILL');
+                stop(child);
                 reject(new Error(`The transform ran for longer than ${timeoutMs}ms and was stopped.`));
             }, timeoutMs);
             child.stdout.on('data', (chunk) => {
                 stdout += chunk.toString();
                 if (stdout.length > MAX_OUTPUT_BYTES)
-                    child.kill('SIGKILL');
+                    stop(child);
             });
             child.stderr.on('data', (chunk) => {
-                stderr += chunk.toString();
+                // Appended only while there is room, rather than appended and trimmed:
+                // trimming after the fact still materialises the whole chunk into the
+                // parent's heap, which is the thing being bounded. See
+                // {@link MAX_CAPTURED_STDERR_BYTES} for why this bounds rather than kills.
+                if (stderr.length >= MAX_CAPTURED_STDERR_BYTES)
+                    return;
+                stderr += chunk.toString().slice(0, MAX_CAPTURED_STDERR_BYTES - stderr.length);
             });
             child.on('error', (error) => {
                 if (settled)
@@ -228,7 +305,12 @@ let SubprocessTransformRunner = SubprocessTransformRunner_1 = class SubprocessTr
             return this.pythonPath;
         const venv = this.options.pythonVenv ?? process.env.CATALOG_PYTHON_VENV;
         if (venv) {
-            const candidate = (0, node_path_1.join)(venv, 'bin', 'python');
+            // Absolute, and it has to be: a child now runs in a temporary directory
+            // rather than the parent's, so a relative `CATALOG_PYTHON_VENV` — which
+            // `existsSync` here resolves against the *parent's* cwd — would pass this
+            // check and then fail to spawn. Resolved once, at the point the two cwds
+            // are still the same.
+            const candidate = (0, node_path_1.resolve)((0, node_path_1.join)(venv, 'bin', 'python'));
             if ((0, node_fs_1.existsSync)(candidate)) {
                 this.pythonPath = candidate;
                 this.logger.log(`Python transforms run in the venv at ${venv}`);
@@ -256,6 +338,41 @@ exports.SubprocessTransformRunner = SubprocessTransformRunner = SubprocessTransf
     (0, common_1.Injectable)(),
     __metadata("design:paramtypes", [Object])
 ], SubprocessTransformRunner);
+/**
+ * Stop the transform, and everything the transform started.
+ *
+ * `child.kill()` signals one pid. A transform that double-forks — two lines of
+ * `child_process.spawn` with `detached` and an `unref` — leaves a grandchild
+ * that the direct child's death says nothing about, so the timeout expired, the
+ * caller was told the run had been stopped, and the work carried on
+ * indefinitely. That is not a hypothetical: it is the standard way a timeout on
+ * a process is escaped, and a bound that a caller can opt out of is not a bound.
+ *
+ * So the child leads its own process group and the negative pid signals the
+ * group, which is every descendant that has not deliberately left it. Leaving
+ * one is possible (`setsid` again) and there is no answer to that short of a
+ * cgroup or a container — the same place the class docblock's honesty about the
+ * boundary ends up, for the same reason.
+ *
+ * Falls through to the single-process kill whenever the group kill cannot be the
+ * one that happens: on Windows, where a negative pid is not a group, and on an
+ * `ESRCH` where the group is already gone and the direct kill is a harmless
+ * no-op. A throw here would replace a timeout error — which says something true
+ * and useful — with an unhandled one that says nothing.
+ */
+function stop(child) {
+    const pid = child.pid;
+    if (KILL_PROCESS_GROUP && pid !== undefined) {
+        try {
+            process.kill(-pid, 'SIGKILL');
+            return;
+        }
+        catch {
+            // Already gone, or never grouped. The direct kill below covers both.
+        }
+    }
+    child.kill('SIGKILL');
+}
 /**
  * The traceback, plus the tail of what the code printed on its way to it.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dudousxd/nestjs-catalog",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "A metadata registry for NestJS: object types, properties and relations, derived from your ORM and enriched with decorators.",
   "license": "MIT",
   "author": "Davide Carvalho",