@elie-laloum/outpost 1.1.3 → 2.0.0

package/dist/providers/container-files.js

@@ -1,16 +1,105 @@
-import { mkdir } from "node:fs/promises";
-import { dirname, posix } from "node:path";
-export function containerFiles(call, name) {
+import { randomUUID } from "node:crypto";
+import { lstat, mkdir, mkdtemp } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, dirname, join, posix, resolve } from "node:path";
+import { invariant, OutpostError } from "../domain/errors.js";
+import { quote } from "../infrastructure/process.js";
+import { copyTransfer, removeTransferDirectory, transferDestination, } from "../infrastructure/transfer-copy.js";
+import { transfer } from "../infrastructure/transfer.js";
+import { containerArchive } from "./container-archive.js";
+export function containerFiles(runtime, archive = containerArchive) {
+    const { call, name } = runtime;
     return {
-        async upload(source, destination, options = {}) {
-            options.signal?.throwIfAborted();
-            await call(["exec", name, "mkdir", "-p", posix.dirname(destination)], options);
-            await call(["cp", source, `${name}:${destination}`], options);
+        upload(source, destination, options = {}) {
+            return transfer(options, async (signal) => {
+                if (runtime.isClosed())
+                    throw new OutpostError("provider", "Container sandbox is closed");
+                const absolute = resolve(source);
+                const scratch = `/tmp/outpost-transfer-${randomUUID()}`;
+                const entry = basename(absolute);
+                invariant(entry, "Upload a directory's contents using a non-root path");
+                const contents = /[\\/]\.$/.test(source);
+                await call(["exec", name, "mkdir", "-m", "700", scratch], { signal });
+                try {
+                    await archive(runtime, {
+                        executable: "tar",
+                        arguments: ["-cf", "-", "-C", dirname(absolute), "--", entry],
+                    }, {
+                        executable: "tar",
+                        arguments: [
+                            "-xpf",
+                            "-",
+                            "--ignore-zeros",
+                            "--no-same-owner",
+                            "-C",
+                            scratch,
+                        ],
+                    }, true, signal);
+                    await call([
+                        "exec",
+                        name,
+                        "sh",
+                        "-c",
+                        `mkdir -p ${quote(posix.dirname(destination))} && cp -a -- ${quote(posix.join(scratch, entry) + (contents ? "/." : ""))} ${quote(destination)}`,
+                    ], { signal });
+                }
+                finally {
+                    await call([
+                        "exec",
+                        name,
+                        "sh",
+                        "-c",
+                        `chmod -R u+rwX ${quote(scratch)} && rm -rf -- ${quote(scratch)}`,
+                    ]);
+                }
+            });
         },
-        async download(source, destination, options = {}) {
-            options.signal?.throwIfAborted();
-            await mkdir(dirname(destination), { recursive: true });
-            await call(["cp", `${name}:${source}`, destination], options);
+        download(source, destination, options = {}) {
+            return transfer(options, async (signal) => {
+                if (runtime.isClosed())
+                    throw new OutpostError("provider", "Container sandbox is closed");
+                await transferDestination(destination);
+                const absolute = posix.resolve(runtime.root, source);
+                const entry = posix.basename(absolute);
+                invariant(entry, "Download a directory's contents using a non-root path");
+                const scratch = await mkdtemp(join(tmpdir(), "outpost-transfer-"));
+                try {
+                    await archive(runtime, {
+                        executable: "tar",
+                        arguments: [
+                            "-xpf",
+                            "-",
+                            "--ignore-zeros",
+                            "--no-same-owner",
+                            "-C",
+                            scratch,
+                        ],
+                    }, {
+                        executable: "tar",
+                        arguments: [
+                            "-cf",
+                            "-",
+                            "-C",
+                            posix.dirname(absolute),
+                            "--",
+                            entry,
+                        ],
+                    }, false, signal);
+                    const existing = await lstat(destination).catch((cause) => {
+                        if (cause.code === "ENOENT")
+                            return undefined;
+                        throw cause;
+                    });
+                    const target = existing?.isDirectory() && !source.endsWith("/.")
+                        ? join(destination, entry)
+                        : destination;
+                    await mkdir(dirname(target), { recursive: true });
+                    await copyTransfer(join(scratch, entry), target, signal);
+                }
+                finally {
+                    await removeTransferDirectory(scratch);
+                }
+            });
         },
     };
 }

package/dist/providers/container-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"container-files.js","sourceRoot":"","sources":["../../src/providers/container-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAI3C,MAAM,UAAU,cAAc,CAC5B,IAA8B,EAC9B,IAAY;IAEZ,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,EAAE;YAC5C,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACjC,MAAM,IAAI,CACR,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,EACzD,OAAO,CACR,CAAC;YACF,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,WAAW,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QAChE,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,EAAE;YAC9C,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACjC,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,MAAM,EAAE,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { mkdir } from \"node:fs/promises\";\nimport { dirname, posix } from \"node:path\";\nimport type { SandboxLease } from \"../domain/sandbox.types.ts\";\nimport type { ContainerRuntime } from \"./container.types.ts\";\n\nexport function containerFiles(\n  call: ContainerRuntime[\"call\"],\n  name: string,\n): Pick<SandboxLease, \"upload\" | \"download\"> {\n  return {\n    async upload(source, destination, options = {}) {\n      options.signal?.throwIfAborted();\n      await call(\n        [\"exec\", name, \"mkdir\", \"-p\", posix.dirname(destination)],\n        options,\n      );\n      await call([\"cp\", source, `${name}:${destination}`], options);\n    },\n    async download(source, destination, options = {}) {\n      options.signal?.throwIfAborted();\n      await mkdir(dirname(destination), { recursive: true });\n      await call([\"cp\", `${name}:${source}`, destination], options);\n    },\n  };\n}\n"]}
+{"version":3,"file":"container-files.js","sourceRoot":"","sources":["../../src/providers/container-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAC;AACrD,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D,MAAM,UAAU,cAAc,CAC5B,OAAyB,EACzB,OAAO,GAAG,gBAAgB;IAE1B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IAC/B,OAAO;QACL,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,EAAE;YACtC,OAAO,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACxC,IAAI,OAAO,CAAC,QAAQ,EAAE;oBACpB,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;gBACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;gBACjC,MAAM,OAAO,GAAG,yBAAyB,UAAU,EAAE,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACjC,SAAS,CAAC,KAAK,EAAE,qDAAqD,CAAC,CAAC;gBACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBACtE,IAAI,CAAC;oBACH,MAAM,OAAO,CACX,OAAO,EACP;wBACE,UAAU,EAAE,KAAK;wBACjB,SAAS,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC;qBAC9D,EACD;wBACE,UAAU,EAAE,KAAK;wBACjB,SAAS,EAAE;4BACT,MAAM;4BACN,GAAG;4BACH,gBAAgB;4BAChB,iBAAiB;4BACjB,IAAI;4BACJ,OAAO;yBACR;qBACF,EACD,IAAI,EACJ,MAAM,CACP,CAAC;oBACF,MAAM,IAAI,CACR;wBACE,MAAM;wBACN,IAAI;wBACJ,IAAI;wBACJ,IAAI;wBACJ,YAAY,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,gBAAgB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE;qBAChJ,EACD,EAAE,MAAM,EAAE,CACX,CAAC;gBACJ,CAAC;wBAAS,CAAC;oBACT,MAAM,IAAI,CAAC;wBACT,MAAM;wBACN,IAAI;wBACJ,IAAI;wBACJ,IAAI;wBACJ,kBAAkB,KAAK,CAAC,OAAO,CAAC,iBAAiB,KAAK,CAAC,OAAO,CAAC,EAAE;qBAClE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QACD,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,EAAE;YACxC,OAAO,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACxC,IAAI,OAAO,CAAC,QAAQ,EAAE;oBACpB,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;gBACpE,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;gBACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACrD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACvC,SAAS,CACP,KAAK,EACL,uDAAuD,CACxD,CAAC;gBACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;gBACnE,IAAI,CAAC;oBACH,MAAM,OAAO,CACX,OAAO,EACP;wBACE,UAAU,EAAE,KAAK;wBACjB,SAAS,EAAE;4BACT,MAAM;4BACN,GAAG;4BACH,gBAAgB;4BAChB,iBAAiB;4BACjB,IAAI;4BACJ,OAAO;yBACR;qBACF,EACD;wBACE,UAAU,EAAE,KAAK;wBACjB,SAAS,EAAE;4BACT,KAAK;4BACL,GAAG;4BACH,IAAI;4BACJ,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;4BACvB,IAAI;4BACJ,KAAK;yBACN;qBACF,EACD,KAAK,EACL,MAAM,CACP,CAAC;oBACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAC7C,CAAC,KAA4B,EAAE,EAAE;wBAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;4BAAE,OAAO,SAAS,CAAC;wBAC9C,MAAM,KAAK,CAAC;oBACd,CAAC,CACF,CAAC;oBACF,MAAM,MAAM,GACV,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAC/C,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC;wBAC1B,CAAC,CAAC,WAAW,CAAC;oBAClB,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;oBAClD,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC3D,CAAC;wBAAS,CAAC;oBACT,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { lstat, mkdir, mkdtemp } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { basename, dirname, join, posix, resolve } from \"node:path\";\nimport type { SandboxLease } from \"../domain/sandbox.types.ts\";\nimport { invariant, OutpostError } from \"../domain/errors.ts\";\nimport { quote } from \"../infrastructure/process.ts\";\nimport {\n  copyTransfer,\n  removeTransferDirectory,\n  transferDestination,\n} from \"../infrastructure/transfer-copy.ts\";\nimport { transfer } from \"../infrastructure/transfer.ts\";\nimport { containerArchive } from \"./container-archive.ts\";\nimport type { ContainerRuntime } from \"./container.types.ts\";\n\nexport function containerFiles(\n  runtime: ContainerRuntime,\n  archive = containerArchive,\n): Pick<SandboxLease, \"upload\" | \"download\"> {\n  const { call, name } = runtime;\n  return {\n    upload(source, destination, options = {}) {\n      return transfer(options, async (signal) => {\n        if (runtime.isClosed())\n          throw new OutpostError(\"provider\", \"Container sandbox is closed\");\n        const absolute = resolve(source);\n        const scratch = `/tmp/outpost-transfer-${randomUUID()}`;\n        const entry = basename(absolute);\n        invariant(entry, \"Upload a directory's contents using a non-root path\");\n        const contents = /[\\\\/]\\.$/.test(source);\n        await call([\"exec\", name, \"mkdir\", \"-m\", \"700\", scratch], { signal });\n        try {\n          await archive(\n            runtime,\n            {\n              executable: \"tar\",\n              arguments: [\"-cf\", \"-\", \"-C\", dirname(absolute), \"--\", entry],\n            },\n            {\n              executable: \"tar\",\n              arguments: [\n                \"-xpf\",\n                \"-\",\n                \"--ignore-zeros\",\n                \"--no-same-owner\",\n                \"-C\",\n                scratch,\n              ],\n            },\n            true,\n            signal,\n          );\n          await call(\n            [\n              \"exec\",\n              name,\n              \"sh\",\n              \"-c\",\n              `mkdir -p ${quote(posix.dirname(destination))} && cp -a -- ${quote(posix.join(scratch, entry) + (contents ? \"/.\" : \"\"))} ${quote(destination)}`,\n            ],\n            { signal },\n          );\n        } finally {\n          await call([\n            \"exec\",\n            name,\n            \"sh\",\n            \"-c\",\n            `chmod -R u+rwX ${quote(scratch)} && rm -rf -- ${quote(scratch)}`,\n          ]);\n        }\n      });\n    },\n    download(source, destination, options = {}) {\n      return transfer(options, async (signal) => {\n        if (runtime.isClosed())\n          throw new OutpostError(\"provider\", \"Container sandbox is closed\");\n        await transferDestination(destination);\n        const absolute = posix.resolve(runtime.root, source);\n        const entry = posix.basename(absolute);\n        invariant(\n          entry,\n          \"Download a directory's contents using a non-root path\",\n        );\n        const scratch = await mkdtemp(join(tmpdir(), \"outpost-transfer-\"));\n        try {\n          await archive(\n            runtime,\n            {\n              executable: \"tar\",\n              arguments: [\n                \"-xpf\",\n                \"-\",\n                \"--ignore-zeros\",\n                \"--no-same-owner\",\n                \"-C\",\n                scratch,\n              ],\n            },\n            {\n              executable: \"tar\",\n              arguments: [\n                \"-cf\",\n                \"-\",\n                \"-C\",\n                posix.dirname(absolute),\n                \"--\",\n                entry,\n              ],\n            },\n            false,\n            signal,\n          );\n          const existing = await lstat(destination).catch(\n            (cause: NodeJS.ErrnoException) => {\n              if (cause.code === \"ENOENT\") return undefined;\n              throw cause;\n            },\n          );\n          const target =\n            existing?.isDirectory() && !source.endsWith(\"/.\")\n              ? join(destination, entry)\n              : destination;\n          await mkdir(dirname(target), { recursive: true });\n          await copyTransfer(join(scratch, entry), target, signal);\n        } finally {\n          await removeTransferDirectory(scratch);\n        }\n      });\n    },\n  };\n}\n"]}

package/dist/providers/container.js

@@ -101,7 +101,7 @@ export function containerProvider(engine, options = {}, executor = executeProces
                     name,
                     "sh",
                     "-c",
-                    "command -v setsid >/dev/null && command -v kill >/dev/null",
+                    "command -v setsid >/dev/null && command -v kill >/dev/null && command -v tar >/dev/null && command -v cp >/dev/null",
                 ]);
             }
             catch (cause) {
@@ -134,7 +134,16 @@ export function containerProvider(engine, options = {}, executor = executeProces
                     call,
                     isClosed: () => closed,
                 }),
-                ...containerFiles(call, name),
+                ...containerFiles({
+                    engine,
+                    config,
+                    executor,
+                    root,
+                    name,
+                    env,
+                    call,
+                    isClosed: () => closed,
+                }),
                 release,
             };
         },

package/dist/providers/container.js.map

@@ -1 +1 @@
-{"version":3,"file":"container.js","sourceRoot":"","sources":["../../src/providers/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,OAAO,EACL,cAAc,EACd,KAAK,EACL,cAAc,GACf,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAK7D,MAAM,UAAU,SAAS,CAAC,UAAkB;IAC1C,OAAO,WACL,QAAQ,CAAC,UAAU,CAAC;SACjB,WAAW,EAAE;SACb,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,IAAI,WACtC,EAAE,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,MAAuB,EACvB,UAA4B,EAAE,EAC9B,WAAqB,cAAc,EACnC,WAA4B,OAAO,CAAC,QAAQ;IAE5C,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAC3B,SAAS,CACP,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,EAC/C,uBAAuB,CACxB,CAAC;IACJ,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;QAC/B,SAAS,CACP,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC;YACnC,MAAM,CAAC,QAAQ,IAAI,iBAAiB,CAAC,eAAe,EACtD,8BAA8B,CAC/B,CAAC;IACJ,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE;QAClC,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,WAAW,UAAU,EAAE,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI;gBAC1B,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,iBAAiB,CAAC,GAAG;gBAChD,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,iBAAiB,CAAC,GAAG;aACjD,CAAC;YACF,SAAS,CACP,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;gBACxB,IAAI,CAAC,GAAG,IAAI,CAAC;gBACb,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC1B,IAAI,CAAC,GAAG,IAAI,CAAC,EACf,wBAAwB,CACzB,CAAC;YACF,MAAM,IAAI,GAAG,CAAC,IAAuB,EAAE,QAA0B,EAAE,EAAE,EAAE,CACrE,cAAc,CACZ;gBACE,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,iBAAiB,CAAC,UAAU;gBACxC,GAAG,KAAK;aACT,EACD,QAAQ,CACT,CAAC;YACJ,MAAM,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACtE,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,EACjC,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC;YAChC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,eAAe,CACzD,OAAO,EACP,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,IAAI,CACL,CAAC;YACF,MAAM,IAAI,GAAG,aAAa,CAAC;gBACzB,MAAM;gBACN,MAAM;gBACN,IAAI;gBACJ,IAAI;gBACJ,IAAI;gBACJ,KAAK;gBACL,OAAO;gBACP,WAAW;aACZ,CAAC,CAAC;YACH,IAAI,MAAM,GAAG,KAAK,EAChB,SAAoC,CAAC;YACvC,IAAI,UAAU,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,GAAkB,EAAE;gBAClC,MAAM,GAAG,IAAI,CAAC;gBACd,SAAS,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;qBACxC,IAAI,CAAC,GAAG,EAAE;oBACT,UAAU,EAAE,CAAC;gBACf,CAAC,CAAC;qBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBACf,SAAS,GAAG,SAAS,CAAC;oBACtB,MAAM,KAAK,CAAC;gBACd,CAAC,CAAC,CAAC;gBACL,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,EAAE;oBACf,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtD,CAAC,CAAC;gBACH,MAAM,IAAI,CACR,CAAC,OAAO,EAAE,IAAI,CAAC,EACf,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CACjD,CAAC;gBACF,KAAK,MAAM,MAAM,IAAI,WAAW;oBAC9B,MAAM,IAAI,CAAC;wBACT,MAAM;wBACN,QAAQ;wBACR,KAAK;wBACL,IAAI;wBACJ,IAAI;wBACJ,IAAI;wBACJ,YAAY,KAAK,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE;qBAC9E,CAAC,CAAC;gBACL,IAAI,WAAW,CAAC,IAAI;oBAClB,MAAM,IAAI,CAAC;wBACT,MAAM;wBACN,QAAQ;wBACR,KAAK;wBACL,IAAI;wBACJ,OAAO;wBACP,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;wBACzB,IAAI;qBACL,CAAC,CAAC;gBACL,MAAM,IAAI,CAAC;oBACT,MAAM;oBACN,IAAI;oBACJ,IAAI;oBACJ,IAAI;oBACJ,4DAA4D;iBAC7D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,OAAO,EAAE,CAAC;gBAClB,CAAC;gBAAC,OAAO,OAAO,EAAE,CAAC;oBACjB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,OAAO,CAAC,EAChB,yCAAyC,CAC1C,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE;gBACzC,IAAI,CAAC,MAAM;oBACT,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;wBAC5C,OAAO,EAAE,iBAAiB,CAAC,SAAS;wBACpC,KAAK,EAAE,QAAQ;wBACf,WAAW,EAAE,IAAI;qBAClB,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;YACH,OAAO;gBACL,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,gBAAgB,CAAC;oBACvB,MAAM;oBACN,MAAM;oBACN,QAAQ;oBACR,IAAI;oBACJ,IAAI;oBACJ,GAAG;oBACH,IAAI;oBACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM;iBACvB,CAAC;gBACF,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC;gBAC7B,OAAO;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { execFileSync } from \"node:child_process\";\nimport { randomUUID } from \"node:crypto\";\nimport { basename } from \"node:path\";\nimport type { Command } from \"../domain/command.types.ts\";\nimport { invariant } from \"../domain/errors.ts\";\nimport type { SandboxProvider } from \"../domain/sandbox.types.ts\";\nimport {\n  executeProcess,\n  quote,\n  requireSuccess,\n} from \"../infrastructure/process.ts\";\nimport type { Executor } from \"../infrastructure/process.types.ts\";\nimport { registerCleanup } from \"../infrastructure/shutdown.ts\";\nimport { containerCommand } from \"./container-command.ts\";\nimport { containerFiles } from \"./container-files.ts\";\nimport { containerMounts } from \"./container-mounts.ts\";\nimport { containerPlan } from \"./container-plan.ts\";\nimport { containerPreflight } from \"./container-preflight.ts\";\nimport { containerDefaults } from \"./container.constants.ts\";\nimport type { ContainerEngine, ContainerOptions } from \"./container.types.ts\";\n\nexport type { ContainerOptions } from \"./container.types.ts\";\n\nexport function imageName(repository: string): string {\n  return `outpost:${\n    basename(repository)\n      .toLowerCase()\n      .replace(/[^a-z0-9_.-]/g, \"-\") || \"workspace\"\n  }`;\n}\n\nexport function containerProvider(\n  engine: ContainerEngine,\n  options: ContainerOptions = {},\n  executor: Executor = executeProcess,\n  platform: NodeJS.Platform = process.platform,\n): SandboxProvider {\n  const config = { ...options };\n  if (config.cpus !== undefined)\n    invariant(\n      Number.isFinite(config.cpus) && config.cpus > 0,\n      \"cpus must be positive\",\n    );\n  if (config.memoryMb !== undefined)\n    invariant(\n      Number.isSafeInteger(config.memoryMb) &&\n        config.memoryMb >= containerDefaults.minimumMemoryMb,\n      \"memoryMb must be at least 64\",\n    );\n  return {\n    name: engine,\n    placement: \"mounted\",\n    variables: { ...config.variables },\n    async acquire(context) {\n      context.signal?.throwIfAborted();\n      const name = `outpost-${randomUUID()}`;\n      const image = config.image ?? imageName(context.repository);\n      const user = config.user ?? {\n        uid: process.getuid?.() ?? containerDefaults.uid,\n        gid: process.getgid?.() ?? containerDefaults.gid,\n      };\n      invariant(\n        Number.isInteger(user.uid) &&\n          user.uid >= 0 &&\n          Number.isInteger(user.gid) &&\n          user.gid >= 0,\n        \"Invalid container user\",\n      );\n      const call = (args: readonly string[], extra: Partial<Command> = {}) =>\n        requireSuccess(\n          {\n            executable: engine,\n            arguments: args,\n            deadlineMs: containerDefaults.deadlineMs,\n            ...extra,\n          },\n          executor,\n        );\n      await containerPreflight(engine, platform, call, config, image, user);\n      const root = containerDefaults.root,\n        home = containerDefaults.home;\n      const { env, volumes, fileParents } = await containerMounts(\n        context,\n        config,\n        platform,\n        root,\n        home,\n      );\n      const args = containerPlan({\n        config,\n        engine,\n        user,\n        root,\n        name,\n        image,\n        volumes,\n        fileParents,\n      });\n      let closed = false,\n        releasing: Promise<void> | undefined;\n      let unregister = () => {};\n      const release = (): Promise<void> => {\n        closed = true;\n        releasing ??= call([\"rm\", \"--force\", name])\n          .then(() => {\n            unregister();\n          })\n          .catch((error) => {\n            releasing = undefined;\n            throw error;\n          });\n        return releasing;\n      };\n      try {\n        await call(args, {\n          ...(context.signal ? { signal: context.signal } : {}),\n        });\n        await call(\n          [\"start\", name],\n          context.signal ? { signal: context.signal } : {},\n        );\n        for (const parent of fileParents)\n          await call([\n            \"exec\",\n            \"--user\",\n            \"0:0\",\n            name,\n            \"sh\",\n            \"-c\",\n            `mkdir -p ${quote(parent)} && chown ${user.uid}:${user.gid} ${quote(parent)}`,\n          ]);\n        if (fileParents.size)\n          await call([\n            \"exec\",\n            \"--user\",\n            \"0:0\",\n            name,\n            \"chown\",\n            `${user.uid}:${user.gid}`,\n            home,\n          ]);\n        await call([\n          \"exec\",\n          name,\n          \"sh\",\n          \"-c\",\n          \"command -v setsid >/dev/null && command -v kill >/dev/null\",\n        ]);\n      } catch (cause) {\n        try {\n          await release();\n        } catch (cleanup) {\n          throw new AggregateError(\n            [cause, cleanup],\n            \"Sandbox provisioning and cleanup failed\",\n          );\n        }\n        throw cause;\n      }\n      unregister = registerCleanup(release, () => {\n        if (!closed)\n          execFileSync(engine, [\"rm\", \"--force\", name], {\n            timeout: containerDefaults.cleanupMs,\n            stdio: \"ignore\",\n            windowsHide: true,\n          });\n      });\n      return {\n        root,\n        home,\n        invoke: containerCommand({\n          engine,\n          config,\n          executor,\n          root,\n          name,\n          env,\n          call,\n          isClosed: () => closed,\n        }),\n        ...containerFiles(call, name),\n        release,\n      };\n    },\n  };\n}\n"]}
+{"version":3,"file":"container.js","sourceRoot":"","sources":["../../src/providers/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,OAAO,EACL,cAAc,EACd,KAAK,EACL,cAAc,GACf,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAK7D,MAAM,UAAU,SAAS,CAAC,UAAkB;IAC1C,OAAO,WACL,QAAQ,CAAC,UAAU,CAAC;SACjB,WAAW,EAAE;SACb,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,IAAI,WACtC,EAAE,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,MAAuB,EACvB,UAA4B,EAAE,EAC9B,WAAqB,cAAc,EACnC,WAA4B,OAAO,CAAC,QAAQ;IAE5C,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAC3B,SAAS,CACP,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,EAC/C,uBAAuB,CACxB,CAAC;IACJ,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;QAC/B,SAAS,CACP,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC;YACnC,MAAM,CAAC,QAAQ,IAAI,iBAAiB,CAAC,eAAe,EACtD,8BAA8B,CAC/B,CAAC;IACJ,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE;QAClC,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,WAAW,UAAU,EAAE,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI;gBAC1B,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,iBAAiB,CAAC,GAAG;gBAChD,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,iBAAiB,CAAC,GAAG;aACjD,CAAC;YACF,SAAS,CACP,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;gBACxB,IAAI,CAAC,GAAG,IAAI,CAAC;gBACb,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC1B,IAAI,CAAC,GAAG,IAAI,CAAC,EACf,wBAAwB,CACzB,CAAC;YACF,MAAM,IAAI,GAAG,CAAC,IAAuB,EAAE,QAA0B,EAAE,EAAE,EAAE,CACrE,cAAc,CACZ;gBACE,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,iBAAiB,CAAC,UAAU;gBACxC,GAAG,KAAK;aACT,EACD,QAAQ,CACT,CAAC;YACJ,MAAM,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACtE,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,EACjC,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC;YAChC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,eAAe,CACzD,OAAO,EACP,MAAM,EACN,QAAQ,EACR,IAAI,EACJ,IAAI,CACL,CAAC;YACF,MAAM,IAAI,GAAG,aAAa,CAAC;gBACzB,MAAM;gBACN,MAAM;gBACN,IAAI;gBACJ,IAAI;gBACJ,IAAI;gBACJ,KAAK;gBACL,OAAO;gBACP,WAAW;aACZ,CAAC,CAAC;YACH,IAAI,MAAM,GAAG,KAAK,EAChB,SAAoC,CAAC;YACvC,IAAI,UAAU,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,GAAkB,EAAE;gBAClC,MAAM,GAAG,IAAI,CAAC;gBACd,SAAS,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;qBACxC,IAAI,CAAC,GAAG,EAAE;oBACT,UAAU,EAAE,CAAC;gBACf,CAAC,CAAC;qBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBACf,SAAS,GAAG,SAAS,CAAC;oBACtB,MAAM,KAAK,CAAC;gBACd,CAAC,CAAC,CAAC;gBACL,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,EAAE;oBACf,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtD,CAAC,CAAC;gBACH,MAAM,IAAI,CACR,CAAC,OAAO,EAAE,IAAI,CAAC,EACf,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CACjD,CAAC;gBACF,KAAK,MAAM,MAAM,IAAI,WAAW;oBAC9B,MAAM,IAAI,CAAC;wBACT,MAAM;wBACN,QAAQ;wBACR,KAAK;wBACL,IAAI;wBACJ,IAAI;wBACJ,IAAI;wBACJ,YAAY,KAAK,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE;qBAC9E,CAAC,CAAC;gBACL,IAAI,WAAW,CAAC,IAAI;oBAClB,MAAM,IAAI,CAAC;wBACT,MAAM;wBACN,QAAQ;wBACR,KAAK;wBACL,IAAI;wBACJ,OAAO;wBACP,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;wBACzB,IAAI;qBACL,CAAC,CAAC;gBACL,MAAM,IAAI,CAAC;oBACT,MAAM;oBACN,IAAI;oBACJ,IAAI;oBACJ,IAAI;oBACJ,qHAAqH;iBACtH,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,OAAO,EAAE,CAAC;gBAClB,CAAC;gBAAC,OAAO,OAAO,EAAE,CAAC;oBACjB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,OAAO,CAAC,EAChB,yCAAyC,CAC1C,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE;gBACzC,IAAI,CAAC,MAAM;oBACT,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;wBAC5C,OAAO,EAAE,iBAAiB,CAAC,SAAS;wBACpC,KAAK,EAAE,QAAQ;wBACf,WAAW,EAAE,IAAI;qBAClB,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;YACH,OAAO;gBACL,IAAI;gBACJ,IAAI;gBACJ,MAAM,EAAE,gBAAgB,CAAC;oBACvB,MAAM;oBACN,MAAM;oBACN,QAAQ;oBACR,IAAI;oBACJ,IAAI;oBACJ,GAAG;oBACH,IAAI;oBACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM;iBACvB,CAAC;gBACF,GAAG,cAAc,CAAC;oBAChB,MAAM;oBACN,MAAM;oBACN,QAAQ;oBACR,IAAI;oBACJ,IAAI;oBACJ,GAAG;oBACH,IAAI;oBACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM;iBACvB,CAAC;gBACF,OAAO;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { execFileSync } from \"node:child_process\";\nimport { randomUUID } from \"node:crypto\";\nimport { basename } from \"node:path\";\nimport type { Command } from \"../domain/command.types.ts\";\nimport { invariant } from \"../domain/errors.ts\";\nimport type { SandboxProvider } from \"../domain/sandbox.types.ts\";\nimport {\n  executeProcess,\n  quote,\n  requireSuccess,\n} from \"../infrastructure/process.ts\";\nimport type { Executor } from \"../infrastructure/process.types.ts\";\nimport { registerCleanup } from \"../infrastructure/shutdown.ts\";\nimport { containerCommand } from \"./container-command.ts\";\nimport { containerFiles } from \"./container-files.ts\";\nimport { containerMounts } from \"./container-mounts.ts\";\nimport { containerPlan } from \"./container-plan.ts\";\nimport { containerPreflight } from \"./container-preflight.ts\";\nimport { containerDefaults } from \"./container.constants.ts\";\nimport type { ContainerEngine, ContainerOptions } from \"./container.types.ts\";\n\nexport type { ContainerOptions } from \"./container.types.ts\";\n\nexport function imageName(repository: string): string {\n  return `outpost:${\n    basename(repository)\n      .toLowerCase()\n      .replace(/[^a-z0-9_.-]/g, \"-\") || \"workspace\"\n  }`;\n}\n\nexport function containerProvider(\n  engine: ContainerEngine,\n  options: ContainerOptions = {},\n  executor: Executor = executeProcess,\n  platform: NodeJS.Platform = process.platform,\n): SandboxProvider {\n  const config = { ...options };\n  if (config.cpus !== undefined)\n    invariant(\n      Number.isFinite(config.cpus) && config.cpus > 0,\n      \"cpus must be positive\",\n    );\n  if (config.memoryMb !== undefined)\n    invariant(\n      Number.isSafeInteger(config.memoryMb) &&\n        config.memoryMb >= containerDefaults.minimumMemoryMb,\n      \"memoryMb must be at least 64\",\n    );\n  return {\n    name: engine,\n    placement: \"mounted\",\n    variables: { ...config.variables },\n    async acquire(context) {\n      context.signal?.throwIfAborted();\n      const name = `outpost-${randomUUID()}`;\n      const image = config.image ?? imageName(context.repository);\n      const user = config.user ?? {\n        uid: process.getuid?.() ?? containerDefaults.uid,\n        gid: process.getgid?.() ?? containerDefaults.gid,\n      };\n      invariant(\n        Number.isInteger(user.uid) &&\n          user.uid >= 0 &&\n          Number.isInteger(user.gid) &&\n          user.gid >= 0,\n        \"Invalid container user\",\n      );\n      const call = (args: readonly string[], extra: Partial<Command> = {}) =>\n        requireSuccess(\n          {\n            executable: engine,\n            arguments: args,\n            deadlineMs: containerDefaults.deadlineMs,\n            ...extra,\n          },\n          executor,\n        );\n      await containerPreflight(engine, platform, call, config, image, user);\n      const root = containerDefaults.root,\n        home = containerDefaults.home;\n      const { env, volumes, fileParents } = await containerMounts(\n        context,\n        config,\n        platform,\n        root,\n        home,\n      );\n      const args = containerPlan({\n        config,\n        engine,\n        user,\n        root,\n        name,\n        image,\n        volumes,\n        fileParents,\n      });\n      let closed = false,\n        releasing: Promise<void> | undefined;\n      let unregister = () => {};\n      const release = (): Promise<void> => {\n        closed = true;\n        releasing ??= call([\"rm\", \"--force\", name])\n          .then(() => {\n            unregister();\n          })\n          .catch((error) => {\n            releasing = undefined;\n            throw error;\n          });\n        return releasing;\n      };\n      try {\n        await call(args, {\n          ...(context.signal ? { signal: context.signal } : {}),\n        });\n        await call(\n          [\"start\", name],\n          context.signal ? { signal: context.signal } : {},\n        );\n        for (const parent of fileParents)\n          await call([\n            \"exec\",\n            \"--user\",\n            \"0:0\",\n            name,\n            \"sh\",\n            \"-c\",\n            `mkdir -p ${quote(parent)} && chown ${user.uid}:${user.gid} ${quote(parent)}`,\n          ]);\n        if (fileParents.size)\n          await call([\n            \"exec\",\n            \"--user\",\n            \"0:0\",\n            name,\n            \"chown\",\n            `${user.uid}:${user.gid}`,\n            home,\n          ]);\n        await call([\n          \"exec\",\n          name,\n          \"sh\",\n          \"-c\",\n          \"command -v setsid >/dev/null && command -v kill >/dev/null && command -v tar >/dev/null && command -v cp >/dev/null\",\n        ]);\n      } catch (cause) {\n        try {\n          await release();\n        } catch (cleanup) {\n          throw new AggregateError(\n            [cause, cleanup],\n            \"Sandbox provisioning and cleanup failed\",\n          );\n        }\n        throw cause;\n      }\n      unregister = registerCleanup(release, () => {\n        if (!closed)\n          execFileSync(engine, [\"rm\", \"--force\", name], {\n            timeout: containerDefaults.cleanupMs,\n            stdio: \"ignore\",\n            windowsHide: true,\n          });\n      });\n      return {\n        root,\n        home,\n        invoke: containerCommand({\n          engine,\n          config,\n          executor,\n          root,\n          name,\n          env,\n          call,\n          isClosed: () => closed,\n        }),\n        ...containerFiles({\n          engine,\n          config,\n          executor,\n          root,\n          name,\n          env,\n          call,\n          isClosed: () => closed,\n        }),\n        release,\n      };\n    },\n  };\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elie-laloum/outpost",
-  "version": "1.1.3",
+  "version": "2.0.0",
   "description": "Programmable sandboxes, coding agents and typed workflows.",
   "type": "module",
   "license": "MIT",

package/dist/adapters/backlogs/backlog.constants.d.ts

@@ -1,4 +0,0 @@
-export declare const backlogDefaults: Readonly<{
-    deadlineMs: 60000;
-    retainBytes: 16777216;
-}>;

package/dist/adapters/backlogs/backlog.constants.js

@@ -1,5 +0,0 @@
-export const backlogDefaults = Object.freeze({
-    deadlineMs: 60_000,
-    retainBytes: 16_777_216,
-});
-//# sourceMappingURL=backlog.constants.js.map

package/dist/adapters/backlogs/backlog.constants.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"backlog.constants.js","sourceRoot":"","sources":["../../../src/adapters/backlogs/backlog.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3C,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,UAAU;CACxB,CAAC,CAAC","sourcesContent":["export const backlogDefaults = Object.freeze({\n  deadlineMs: 60_000,\n  retainBytes: 16_777_216,\n});\n"]}

package/dist/adapters/backlogs/beads-adapter.d.ts

@@ -1,4 +0,0 @@
-import type { Backlog } from "../../domain/backlog.types.ts";
-import type { Executor } from "../../infrastructure/process.types.ts";
-import type { BacklogSettings } from "./settings.types.ts";
-export declare function beadsBacklog(settings?: BacklogSettings, executor?: Executor): Backlog;

package/dist/adapters/backlogs/beads-adapter.js

@@ -1,31 +0,0 @@
-import { invariant } from "../../domain/errors.js";
-import { cli } from "./cli.js";
-import { issue } from "./issue.js";
-export function beadsBacklog(settings = {}, executor) {
-    const run = cli("bd", settings, executor);
-    const identifier = (id) => {
-        invariant(/^[\w][\w.-]*$/.test(id), "Invalid Beads issue id");
-        return id;
-    };
-    return {
-        async list(signal) {
-            const data = JSON.parse(await run([
-                "ready",
-                "--json",
-                "--limit",
-                "0",
-                ...(settings.label ? ["--label", settings.label] : []),
-            ], signal));
-            invariant(Array.isArray(data), "Invalid Beads backlog");
-            return data.map(issue);
-        },
-        async get(id, signal) {
-            const data = JSON.parse(await run(["show", identifier(id), "--json"], signal));
-            return issue(Array.isArray(data) ? data[0] : data);
-        },
-        async close(id, signal) {
-            await run(["close", identifier(id)], signal);
-        },
-    };
-}
-//# sourceMappingURL=beads-adapter.js.map

package/dist/adapters/backlogs/beads-adapter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"beads-adapter.js","sourceRoot":"","sources":["../../../src/adapters/backlogs/beads-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAGnC,MAAM,UAAU,YAAY,CAC1B,WAA4B,EAAE,EAC9B,QAAmB;IAEnB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,EAAE;QAChC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAC9D,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAC9B,MAAM,GAAG,CACP;gBACE,OAAO;gBACP,QAAQ;gBACR,SAAS;gBACT,GAAG;gBACH,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,EACD,MAAM,CACP,CACF,CAAC;YACF,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,uBAAuB,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM;YAClB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CACrB,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CACtD,CAAC;YACF,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM;YACpB,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { Backlog } from \"../../domain/backlog.types.ts\";\nimport { invariant } from \"../../domain/errors.ts\";\nimport type { Executor } from \"../../infrastructure/process.types.ts\";\nimport { cli } from \"./cli.ts\";\nimport { issue } from \"./issue.ts\";\nimport type { BacklogSettings } from \"./settings.types.ts\";\n\nexport function beadsBacklog(\n  settings: BacklogSettings = {},\n  executor?: Executor,\n): Backlog {\n  const run = cli(\"bd\", settings, executor);\n  const identifier = (id: string) => {\n    invariant(/^[\\w][\\w.-]*$/.test(id), \"Invalid Beads issue id\");\n    return id;\n  };\n  return {\n    async list(signal) {\n      const data: unknown = JSON.parse(\n        await run(\n          [\n            \"ready\",\n            \"--json\",\n            \"--limit\",\n            \"0\",\n            ...(settings.label ? [\"--label\", settings.label] : []),\n          ],\n          signal,\n        ),\n      );\n      invariant(Array.isArray(data), \"Invalid Beads backlog\");\n      return data.map(issue);\n    },\n    async get(id, signal) {\n      const data = JSON.parse(\n        await run([\"show\", identifier(id), \"--json\"], signal),\n      );\n      return issue(Array.isArray(data) ? data[0] : data);\n    },\n    async close(id, signal) {\n      await run([\"close\", identifier(id)], signal);\n    },\n  };\n}\n"]}

package/dist/adapters/backlogs/cli.d.ts

@@ -1,3 +0,0 @@
-import type { Executor } from "../../infrastructure/process.types.ts";
-import type { BacklogSettings } from "./settings.types.ts";
-export declare function cli(program: string, settings: BacklogSettings, executor?: Executor): (args: readonly string[], signal?: AbortSignal) => Promise<string>;

package/dist/adapters/backlogs/cli.js

@@ -1,20 +0,0 @@
-import { requireSuccess } from "../../infrastructure/process.js";
-import { resolveVariables } from "../../infrastructure/settings.js";
-import { backlogDefaults } from "./backlog.constants.js";
-export function cli(program, settings, executor) {
-    const directory = settings.directory ?? process.cwd();
-    return async (args, signal) => {
-        signal?.throwIfAborted();
-        const variables = await resolveVariables(directory);
-        return (await requireSuccess({
-            executable: program,
-            arguments: args,
-            directory,
-            variables,
-            deadlineMs: settings.deadlineMs ?? backlogDefaults.deadlineMs,
-            retain: backlogDefaults.retainBytes,
-            ...(signal ? { signal } : {}),
-        }, executor)).stdout;
-    };
-}
-//# sourceMappingURL=cli.js.map

package/dist/adapters/backlogs/cli.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../../src/adapters/backlogs/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGzD,MAAM,UAAU,GAAG,CACjB,OAAe,EACf,QAAyB,EACzB,QAAmB;IAEnB,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtD,OAAO,KAAK,EAAE,IAAuB,EAAE,MAAoB,EAAE,EAAE;QAC7D,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO,CACL,MAAM,cAAc,CAClB;YACE,UAAU,EAAE,OAAO;YACnB,SAAS,EAAE,IAAI;YACf,SAAS;YACT,SAAS;YACT,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,eAAe,CAAC,UAAU;YAC7D,MAAM,EAAE,eAAe,CAAC,WAAW;YACnC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,EACD,QAAQ,CACT,CACF,CAAC,MAAM,CAAC;IACX,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import { requireSuccess } from \"../../infrastructure/process.ts\";\nimport type { Executor } from \"../../infrastructure/process.types.ts\";\nimport { resolveVariables } from \"../../infrastructure/settings.ts\";\nimport { backlogDefaults } from \"./backlog.constants.ts\";\nimport type { BacklogSettings } from \"./settings.types.ts\";\n\nexport function cli(\n  program: string,\n  settings: BacklogSettings,\n  executor?: Executor,\n) {\n  const directory = settings.directory ?? process.cwd();\n  return async (args: readonly string[], signal?: AbortSignal) => {\n    signal?.throwIfAborted();\n    const variables = await resolveVariables(directory);\n    return (\n      await requireSuccess(\n        {\n          executable: program,\n          arguments: args,\n          directory,\n          variables,\n          deadlineMs: settings.deadlineMs ?? backlogDefaults.deadlineMs,\n          retain: backlogDefaults.retainBytes,\n          ...(signal ? { signal } : {}),\n        },\n        executor,\n      )\n    ).stdout;\n  };\n}\n"]}

package/dist/adapters/backlogs/github-adapter.d.ts

@@ -1,4 +0,0 @@
-import type { Backlog } from "../../domain/backlog.types.ts";
-import type { Executor } from "../../infrastructure/process.types.ts";
-import type { BacklogSettings } from "./settings.types.ts";
-export declare function githubBacklog(settings?: BacklogSettings, executor?: Executor): Backlog;

package/dist/adapters/backlogs/github-adapter.js

@@ -1,28 +0,0 @@
-import { invariant } from "../../domain/errors.js";
-import { cli } from "./cli.js";
-import { issue } from "./issue.js";
-export function githubBacklog(settings = {}, executor) {
-    const run = cli("gh", settings, executor);
-    const identifier = (id) => {
-        invariant(/^[1-9]\d*$/.test(id), "GitHub issue id must be a positive number");
-        return id;
-    };
-    return {
-        async list(signal) {
-            const endpoint = `repos/{owner}/{repo}/issues?state=open&per_page=100${settings.label ? `&labels=${encodeURIComponent(settings.label)}` : ""}`;
-            const pages = JSON.parse(await run(["api", endpoint, "--paginate", "--slurp"], signal));
-            invariant(Array.isArray(pages) && pages.every(Array.isArray), "Invalid GitHub issue pages");
-            return pages
-                .flat()
-                .filter((item) => !item.pull_request)
-                .map(issue);
-        },
-        async get(id, signal) {
-            return issue(JSON.parse(await run(["issue", "view", identifier(id), "--json", "number,title,body"], signal)));
-        },
-        async close(id, signal) {
-            await run(["issue", "close", identifier(id), "--reason", "completed"], signal);
-        },
-    };
-}
-//# sourceMappingURL=github-adapter.js.map

package/dist/adapters/backlogs/github-adapter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"github-adapter.js","sourceRoot":"","sources":["../../../src/adapters/backlogs/github-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAGnC,MAAM,UAAU,aAAa,CAC3B,WAA4B,EAAE,EAC9B,QAAmB;IAEnB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,EAAE;QAChC,SAAS,CACP,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,EACrB,2CAA2C,CAC5C,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,QAAQ,GAAG,sDAAsD,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC/I,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAC/B,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAC9D,CAAC;YACF,SAAS,CACP,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAClD,4BAA4B,CAC7B,CAAC;YACF,OAAO,KAAK;iBACT,IAAI,EAAE;iBACN,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;iBACpC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM;YAClB,OAAO,KAAK,CACV,IAAI,CAAC,KAAK,CACR,MAAM,GAAG,CACP,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,mBAAmB,CAAC,EAChE,MAAM,CACP,CACF,CACF,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM;YACpB,MAAM,GAAG,CACP,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,EAC3D,MAAM,CACP,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { Backlog } from \"../../domain/backlog.types.ts\";\nimport { invariant } from \"../../domain/errors.ts\";\nimport type { Executor } from \"../../infrastructure/process.types.ts\";\nimport { cli } from \"./cli.ts\";\nimport { issue } from \"./issue.ts\";\nimport type { BacklogSettings } from \"./settings.types.ts\";\n\nexport function githubBacklog(\n  settings: BacklogSettings = {},\n  executor?: Executor,\n): Backlog {\n  const run = cli(\"gh\", settings, executor);\n  const identifier = (id: string) => {\n    invariant(\n      /^[1-9]\\d*$/.test(id),\n      \"GitHub issue id must be a positive number\",\n    );\n    return id;\n  };\n  return {\n    async list(signal) {\n      const endpoint = `repos/{owner}/{repo}/issues?state=open&per_page=100${settings.label ? `&labels=${encodeURIComponent(settings.label)}` : \"\"}`;\n      const pages: unknown = JSON.parse(\n        await run([\"api\", endpoint, \"--paginate\", \"--slurp\"], signal),\n      );\n      invariant(\n        Array.isArray(pages) && pages.every(Array.isArray),\n        \"Invalid GitHub issue pages\",\n      );\n      return pages\n        .flat()\n        .filter((item) => !item.pull_request)\n        .map(issue);\n    },\n    async get(id, signal) {\n      return issue(\n        JSON.parse(\n          await run(\n            [\"issue\", \"view\", identifier(id), \"--json\", \"number,title,body\"],\n            signal,\n          ),\n        ),\n      );\n    },\n    async close(id, signal) {\n      await run(\n        [\"issue\", \"close\", identifier(id), \"--reason\", \"completed\"],\n        signal,\n      );\n    },\n  };\n}\n"]}

package/dist/adapters/backlogs/issue.d.ts

@@ -1,2 +0,0 @@
-import type { Issue } from "../../domain/backlog.types.ts";
-export declare function issue(input: unknown): Issue;

package/dist/adapters/backlogs/issue.js

@@ -1,13 +0,0 @@
-import { invariant } from "../../domain/errors.js";
-export function issue(input) {
-    invariant(!!input && typeof input === "object", "Tracker returned an invalid issue");
-    const item = input;
-    invariant((typeof item.id === "string" || typeof item.number === "number") &&
-        typeof item.title === "string", "Tracker issue needs an id and a title");
-    return {
-        id: String(item.number ?? item.id),
-        title: item.title,
-        body: String(item.body ?? item.description ?? ""),
-    };
-}
-//# sourceMappingURL=issue.js.map

package/dist/adapters/backlogs/issue.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"issue.js","sourceRoot":"","sources":["../../../src/adapters/backlogs/issue.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,MAAM,UAAU,KAAK,CAAC,KAAc;IAClC,SAAS,CACP,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EACpC,mCAAmC,CACpC,CAAC;IACF,MAAM,IAAI,GAAG,KAAgC,CAAC;IAC9C,SAAS,CACP,CAAC,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC;QAC9D,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAChC,uCAAuC,CACxC,CAAC;IACF,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;QAClC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC","sourcesContent":["import type { Issue } from \"../../domain/backlog.types.ts\";\nimport { invariant } from \"../../domain/errors.ts\";\n\nexport function issue(input: unknown): Issue {\n  invariant(\n    !!input && typeof input === \"object\",\n    \"Tracker returned an invalid issue\",\n  );\n  const item = input as Record<string, unknown>;\n  invariant(\n    (typeof item.id === \"string\" || typeof item.number === \"number\") &&\n      typeof item.title === \"string\",\n    \"Tracker issue needs an id and a title\",\n  );\n  return {\n    id: String(item.number ?? item.id),\n    title: item.title,\n    body: String(item.body ?? item.description ?? \"\"),\n  };\n}\n"]}

package/dist/adapters/backlogs/settings.types.d.ts

@@ -1,5 +0,0 @@
-export interface BacklogSettings {
-    readonly directory?: string;
-    readonly label?: string;
-    readonly deadlineMs?: number;
-}

package/dist/adapters/backlogs/settings.types.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=settings.types.js.map

package/dist/adapters/backlogs/settings.types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"settings.types.js","sourceRoot":"","sources":["../../../src/adapters/backlogs/settings.types.ts"],"names":[],"mappings":"","sourcesContent":["export interface BacklogSettings {\n  readonly directory?: string;\n  readonly label?: string;\n  readonly deadlineMs?: number;\n}\n"]}

package/dist/application/campaign-integration.d.ts

@@ -1,2 +0,0 @@
-import type { CampaignContext, CompletedIssue } from "./campaign.types.ts";
-export declare function integrateIssues(context: CampaignContext, completed: readonly CompletedIssue[]): Promise<void>;

package/dist/application/campaign-integration.js

@@ -1,44 +0,0 @@
-import { invariant, OutpostError } from "../domain/errors.js";
-import { createSandbox } from "./sandbox.js";
-export async function integrateIssues(context, completed) {
-    const { runtime, standards, options: { merger }, } = context;
-    const integration = await createSandbox({
-        ...runtime,
-        agent: merger ?? runtime.agent,
-        branch: { mode: "integrate" },
-    });
-    let integrated = false;
-    try {
-        for (const item of completed) {
-            const merged = await integration.command({
-                executable: "git",
-                arguments: ["merge", "--no-edit", item.head],
-                ...(runtime.signal ? { signal: runtime.signal } : {}),
-            });
-            await integration.dispatch({
-                agent: merger ?? runtime.agent,
-                ...(runtime.signal ? { signal: runtime.signal } : {}),
-                brief: {
-                    text: `Validate integration of issue ${item.id} from commit ${item.head}. ${merged.status ? "Resolve the current Git merge conflict and finish the merge." : "The commits have been merged."} Run relevant tests, fix integration defects and commit any changes. ${standards} Do not close issues. When complete, write <outpost>done</outpost>.`,
-                },
-            });
-            const verified = await integration.command({
-                executable: "git",
-                arguments: ["merge-base", "--is-ancestor", item.head, "HEAD"],
-            });
-            if (verified.status)
-                throw new OutpostError("conflict", "Merge did not include the issue commits", { issue: item.id, branch: item.branch });
-        }
-        const clean = await integration.command({
-            executable: "git",
-            arguments: ["status", "--porcelain"],
-        });
-        invariant(clean.status === 0 && !clean.stdout.trim(), "Integration has uncommitted changes");
-        await integration.workspace.integrate();
-        integrated = true;
-    }
-    finally {
-        await integration.close({ preserve: !integrated });
-    }
-}
-//# sourceMappingURL=campaign-integration.js.map

package/dist/application/campaign-integration.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"campaign-integration.js","sourceRoot":"","sources":["../../src/application/campaign-integration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAwB,EACxB,SAAoC;IAEpC,MAAM,EACJ,OAAO,EACP,SAAS,EACT,OAAO,EAAE,EAAE,MAAM,EAAE,GACpB,GAAG,OAAO,CAAC;IACZ,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC;QACtC,GAAG,OAAO;QACV,KAAK,EAAE,MAAM,IAAI,OAAO,CAAC,KAAK;QAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;KAC9B,CAAC,CAAC;IACH,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC;gBACvC,UAAU,EAAE,KAAK;gBACjB,SAAS,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC;gBAC5C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtD,CAAC,CAAC;YACH,MAAM,WAAW,CAAC,QAAQ,CAAC;gBACzB,KAAK,EAAE,MAAM,IAAI,OAAO,CAAC,KAAK;gBAC9B,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,KAAK,EAAE;oBACL,IAAI,EAAE,iCAAiC,IAAI,CAAC,EAAE,gBAAgB,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,8DAA8D,CAAC,CAAC,CAAC,+BAA+B,wEAAwE,SAAS,qEAAqE;iBACnV;aACF,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC;gBACzC,UAAU,EAAE,KAAK;gBACjB,SAAS,EAAE,CAAC,YAAY,EAAE,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;aAC9D,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,MAAM;gBACjB,MAAM,IAAI,YAAY,CACpB,UAAU,EACV,yCAAyC,EACzC,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CACxC,CAAC;QACN,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC;YACtC,UAAU,EAAE,KAAK;YACjB,SAAS,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC;SACrC,CAAC,CAAC;QACH,SAAS,CACP,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAC1C,qCAAqC,CACtC,CAAC;QACF,MAAM,WAAW,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;QACxC,UAAU,GAAG,IAAI,CAAC;IACpB,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;IACrD,CAAC;AACH,CAAC","sourcesContent":["import { invariant, OutpostError } from \"../domain/errors.ts\";\nimport type { CampaignContext, CompletedIssue } from \"./campaign.types.ts\";\nimport { createSandbox } from \"./sandbox.ts\";\n\nexport async function integrateIssues(\n  context: CampaignContext,\n  completed: readonly CompletedIssue[],\n): Promise<void> {\n  const {\n    runtime,\n    standards,\n    options: { merger },\n  } = context;\n  const integration = await createSandbox({\n    ...runtime,\n    agent: merger ?? runtime.agent,\n    branch: { mode: \"integrate\" },\n  });\n  let integrated = false;\n  try {\n    for (const item of completed) {\n      const merged = await integration.command({\n        executable: \"git\",\n        arguments: [\"merge\", \"--no-edit\", item.head],\n        ...(runtime.signal ? { signal: runtime.signal } : {}),\n      });\n      await integration.dispatch({\n        agent: merger ?? runtime.agent,\n        ...(runtime.signal ? { signal: runtime.signal } : {}),\n        brief: {\n          text: `Validate integration of issue ${item.id} from commit ${item.head}. ${merged.status ? \"Resolve the current Git merge conflict and finish the merge.\" : \"The commits have been merged.\"} Run relevant tests, fix integration defects and commit any changes. ${standards} Do not close issues. When complete, write <outpost>done</outpost>.`,\n        },\n      });\n      const verified = await integration.command({\n        executable: \"git\",\n        arguments: [\"merge-base\", \"--is-ancestor\", item.head, \"HEAD\"],\n      });\n      if (verified.status)\n        throw new OutpostError(\n          \"conflict\",\n          \"Merge did not include the issue commits\",\n          { issue: item.id, branch: item.branch },\n        );\n    }\n    const clean = await integration.command({\n      executable: \"git\",\n      arguments: [\"status\", \"--porcelain\"],\n    });\n    invariant(\n      clean.status === 0 && !clean.stdout.trim(),\n      \"Integration has uncommitted changes\",\n    );\n    await integration.workspace.integrate();\n    integrated = true;\n  } finally {\n    await integration.close({ preserve: !integrated });\n  }\n}\n"]}

package/dist/application/campaign-planner.d.ts

@@ -1,3 +0,0 @@
-import type { Assignment, Issue } from "../domain/backlog.types.ts";
-import type { CampaignContext } from "./campaign.types.ts";
-export declare function planIssues(context: CampaignContext, ready: readonly Issue[], concurrency: number): Promise<readonly Assignment[]>;

package/dist/application/campaign-planner.js

@@ -1,35 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { readPlan } from "../domain/backlog.js";
-import { invariant } from "../domain/errors.js";
-import { response } from "../domain/response.js";
-import { dispatch } from "./dispatch.js";
-export async function planIssues(context, ready, concurrency) {
-    const { runtime, emit, options: { planner }, } = context;
-    const prefix = `outpost/batch-${randomUUID().slice(0, 8)}`;
-    let assignments;
-    if (planner !== false) {
-        emit("plan");
-        const plan = await dispatch({
-            ...runtime,
-            agent: planner ?? runtime.agent,
-            branch: { mode: "named", name: `${prefix}-planning` },
-            brief: {
-                text: `Select independent, unblocked issues from this backlog. Read the repository without editing files. Return <assignments>{"issues":[{"id":"an existing id","branch":"${prefix}-short-name"}]}</assignments>. Return an empty array when blocked.\n${JSON.stringify(ready)}`,
-            },
-            response: response.json({
-                tag: "assignments",
-                schema: readPlan,
-                repairs: 1,
-            }),
-        });
-        invariant(!plan.commits.length && !plan.retainedDirectory, "Planner changed its workspace; inspect the planning branch before continuing");
-        assignments = plan.value;
-    }
-    else
-        assignments = ready.slice(0, concurrency).map((issue, index) => ({
-            id: issue.id,
-            branch: `${prefix}-${index + 1}`,
-        }));
-    return assignments;
-}
-//# sourceMappingURL=campaign-planner.js.map

package/dist/application/campaign-planner.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"campaign-planner.js","sourceRoot":"","sources":["../../src/application/campaign-planner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAwB,EACxB,KAAuB,EACvB,WAAmB;IAEnB,MAAM,EACJ,OAAO,EACP,IAAI,EACJ,OAAO,EAAE,EAAE,OAAO,EAAE,GACrB,GAAG,OAAO,CAAC;IACZ,MAAM,MAAM,GAAG,iBAAiB,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC3D,IAAI,WAAkC,CAAC;IACvC,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC;YAC1B,GAAG,OAAO;YACV,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC,KAAK;YAC/B,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,EAAE;YACrD,KAAK,EAAE;gBACL,IAAI,EAAE,sKAAsK,MAAM,uEAAuE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;aACjR;YACD,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC;gBACtB,GAAG,EAAE,aAAa;gBAClB,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,CAAC;aACX,CAAC;SACH,CAAC,CAAC;QACH,SAAS,CACP,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAC/C,8EAA8E,CAC/E,CAAC;QACF,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC;IAC3B,CAAC;;QACC,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC/D,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,MAAM,EAAE,GAAG,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE;SACjC,CAAC,CAAC,CAAC;IAEN,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { readPlan } from \"../domain/backlog.ts\";\nimport type { Assignment, Issue } from \"../domain/backlog.types.ts\";\nimport { invariant } from \"../domain/errors.ts\";\nimport { response } from \"../domain/response.ts\";\nimport type { CampaignContext } from \"./campaign.types.ts\";\nimport { dispatch } from \"./dispatch.ts\";\n\nexport async function planIssues(\n  context: CampaignContext,\n  ready: readonly Issue[],\n  concurrency: number,\n): Promise<readonly Assignment[]> {\n  const {\n    runtime,\n    emit,\n    options: { planner },\n  } = context;\n  const prefix = `outpost/batch-${randomUUID().slice(0, 8)}`;\n  let assignments: readonly Assignment[];\n  if (planner !== false) {\n    emit(\"plan\");\n    const plan = await dispatch({\n      ...runtime,\n      agent: planner ?? runtime.agent,\n      branch: { mode: \"named\", name: `${prefix}-planning` },\n      brief: {\n        text: `Select independent, unblocked issues from this backlog. Read the repository without editing files. Return <assignments>{\"issues\":[{\"id\":\"an existing id\",\"branch\":\"${prefix}-short-name\"}]}</assignments>. Return an empty array when blocked.\\n${JSON.stringify(ready)}`,\n      },\n      response: response.json({\n        tag: \"assignments\",\n        schema: readPlan,\n        repairs: 1,\n      }),\n    });\n    invariant(\n      !plan.commits.length && !plan.retainedDirectory,\n      \"Planner changed its workspace; inspect the planning branch before continuing\",\n    );\n    assignments = plan.value;\n  } else\n    assignments = ready.slice(0, concurrency).map((issue, index) => ({\n      id: issue.id,\n      branch: `${prefix}-${index + 1}`,\n    }));\n\n  return assignments;\n}\n"]}

package/dist/application/campaign-worker.d.ts

@@ -1,3 +0,0 @@
-import type { Assignment } from "../domain/backlog.types.ts";
-import type { CampaignContext, CompletedIssue } from "./campaign.types.ts";
-export declare function implementIssue(context: CampaignContext, assignment: Assignment, baseline: string, signal: AbortSignal): Promise<CompletedIssue | undefined>;

package/dist/application/campaign-worker.js

@@ -1,54 +0,0 @@
-import { invariant } from "../domain/errors.js";
-import { git } from "../infrastructure/git/command.js";
-import { campaignDefaults } from "./campaign.constants.js";
-import { createSandbox } from "./sandbox.js";
-export async function implementIssue(context, assignment, baseline, signal) {
-    const { runtime, standards, emit, options: { backlog, reviewer, implementationPasses, reviewPasses }, } = context;
-    const issue = await backlog.get(assignment.id, signal);
-    invariant(issue.id === assignment.id, "Tracker returned a different issue");
-    const sandbox = await createSandbox({
-        ...runtime,
-        signal,
-        branch: { mode: "named", name: assignment.branch, from: baseline },
-    });
-    let success = false;
-    try {
-        emit("implement", issue.id);
-        const implemented = await sandbox.dispatch({
-            agent: runtime.agent,
-            signal,
-            passes: implementationPasses ?? campaignDefaults.implementationPasses,
-            brief: {
-                text: `Implement issue ${issue.id}: ${issue.title}\n${issue.body ?? ""}\n${standards}\nDo not close the issue. When complete, write <outpost>done</outpost>.`,
-            },
-        });
-        if (!implemented.commits.length) {
-            success = true;
-            return undefined;
-        }
-        if (reviewer !== false) {
-            emit("review", issue.id);
-            await sandbox.dispatch({
-                agent: reviewer ?? runtime.agent,
-                signal,
-                passes: reviewPasses ?? campaignDefaults.reviewPasses,
-                brief: {
-                    text: `Review issue ${issue.id} on ${assignment.branch}. Inspect git diff ${baseline}...HEAD, fix concrete defects, run the relevant tests and commit corrections.\n${standards}\nDo not close the issue. When complete, write <outpost>done</outpost>.`,
-                },
-            });
-        }
-        const clean = await sandbox.command({
-            executable: "git",
-            arguments: ["status", "--porcelain"],
-            signal,
-        });
-        invariant(clean.status === 0 && !clean.stdout.trim(), `Issue ${issue.id} has uncommitted changes`);
-        const head = (await git(sandbox.workspace.directory, ["rev-parse", "HEAD"])).trim();
-        success = true;
-        return { ...assignment, head };
-    }
-    finally {
-        await sandbox.close({ preserve: !success });
-    }
-}
-//# sourceMappingURL=campaign-worker.js.map

package/dist/application/campaign-worker.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"campaign-worker.js","sourceRoot":"","sources":["../../src/application/campaign-worker.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,kCAAkC,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAwB,EACxB,UAAsB,EACtB,QAAgB,EAChB,MAAmB;IAEnB,MAAM,EACJ,OAAO,EACP,SAAS,EACT,IAAI,EACJ,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,YAAY,EAAE,GACnE,GAAG,OAAO,CAAC;IACZ,MAAM,KAAK,GAAU,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9D,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC;QAClC,GAAG,OAAO;QACV,MAAM;QACN,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;KACnE,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;YACzC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM;YACN,MAAM,EAAE,oBAAoB,IAAI,gBAAgB,CAAC,oBAAoB;YACrE,KAAK,EAAE;gBACL,IAAI,EAAE,mBAAmB,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,IAAI,EAAE,KAAK,SAAS,yEAAyE;aAC9J;SACF,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAChC,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,OAAO,CAAC,QAAQ,CAAC;gBACrB,KAAK,EAAE,QAAQ,IAAI,OAAO,CAAC,KAAK;gBAChC,MAAM;gBACN,MAAM,EAAE,YAAY,IAAI,gBAAgB,CAAC,YAAY;gBACrD,KAAK,EAAE;oBACL,IAAI,EAAE,gBAAgB,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,MAAM,sBAAsB,QAAQ,kFAAkF,SAAS,yEAAyE;iBACzP;aACF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YAClC,UAAU,EAAE,KAAK;YACjB,SAAS,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC;YACpC,MAAM;SACP,CAAC,CAAC;QACH,SAAS,CACP,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAC1C,SAAS,KAAK,CAAC,EAAE,0BAA0B,CAC5C,CAAC;QACF,MAAM,IAAI,GAAG,CACX,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAC9D,CAAC,IAAI,EAAE,CAAC;QACT,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC","sourcesContent":["import type { Assignment, Issue } from \"../domain/backlog.types.ts\";\nimport { invariant } from \"../domain/errors.ts\";\nimport { git } from \"../infrastructure/git/command.ts\";\nimport { campaignDefaults } from \"./campaign.constants.ts\";\nimport type { CampaignContext, CompletedIssue } from \"./campaign.types.ts\";\nimport { createSandbox } from \"./sandbox.ts\";\n\nexport async function implementIssue(\n  context: CampaignContext,\n  assignment: Assignment,\n  baseline: string,\n  signal: AbortSignal,\n): Promise<CompletedIssue | undefined> {\n  const {\n    runtime,\n    standards,\n    emit,\n    options: { backlog, reviewer, implementationPasses, reviewPasses },\n  } = context;\n  const issue: Issue = await backlog.get(assignment.id, signal);\n  invariant(issue.id === assignment.id, \"Tracker returned a different issue\");\n  const sandbox = await createSandbox({\n    ...runtime,\n    signal,\n    branch: { mode: \"named\", name: assignment.branch, from: baseline },\n  });\n  let success = false;\n  try {\n    emit(\"implement\", issue.id);\n    const implemented = await sandbox.dispatch({\n      agent: runtime.agent,\n      signal,\n      passes: implementationPasses ?? campaignDefaults.implementationPasses,\n      brief: {\n        text: `Implement issue ${issue.id}: ${issue.title}\\n${issue.body ?? \"\"}\\n${standards}\\nDo not close the issue. When complete, write <outpost>done</outpost>.`,\n      },\n    });\n    if (!implemented.commits.length) {\n      success = true;\n      return undefined;\n    }\n    if (reviewer !== false) {\n      emit(\"review\", issue.id);\n      await sandbox.dispatch({\n        agent: reviewer ?? runtime.agent,\n        signal,\n        passes: reviewPasses ?? campaignDefaults.reviewPasses,\n        brief: {\n          text: `Review issue ${issue.id} on ${assignment.branch}. Inspect git diff ${baseline}...HEAD, fix concrete defects, run the relevant tests and commit corrections.\\n${standards}\\nDo not close the issue. When complete, write <outpost>done</outpost>.`,\n        },\n      });\n    }\n    const clean = await sandbox.command({\n      executable: \"git\",\n      arguments: [\"status\", \"--porcelain\"],\n      signal,\n    });\n    invariant(\n      clean.status === 0 && !clean.stdout.trim(),\n      `Issue ${issue.id} has uncommitted changes`,\n    );\n    const head = (\n      await git(sandbox.workspace.directory, [\"rev-parse\", \"HEAD\"])\n    ).trim();\n    success = true;\n    return { ...assignment, head };\n  } finally {\n    await sandbox.close({ preserve: !success });\n  }\n}\n"]}