@hraness/slopcamera 3.2.6 → 3.2.8

package/apps/desktop/code/runtime-identity.ts

@@ -9,7 +9,6 @@ import {
   extname,
   join,
   relative,
-  resolve,
   sep,
 } from "node:path";
 
@@ -31,6 +30,7 @@ import {
   WorkflowRuntimeIdentitySchema,
   type WorkflowRuntimeIdentity,
 } from "./contracts";
+import { hostSourceRoots } from "./host-source-layout";
 import type { WorkflowSourceBundle } from "./source-bundle";
 
 export interface CreateWorkflowRuntimeIdentityOptions {
@@ -38,7 +38,7 @@ export interface CreateWorkflowRuntimeIdentityOptions {
   readonly bundle: WorkflowSourceBundle;
 }
 
-const APPLICATION_BUILD_DOMAIN = "studio.application-build/v1";
+const APPLICATION_BUILD_DOMAIN = "studio.application-build/v2";
 const HOST_APPLICATION_BUILD_DOMAIN = "studio.host-application-build/v1";
 const APPLICATION_SOURCE_EXTENSIONS = new Set([
   ".json",
@@ -52,17 +52,23 @@ const APPLICATION_SOURCE_EXTENSIONS = new Set([
 const DESKTOP_SOURCE_DIRECTORIES = [
   "analysis",
   "application",
-  "capture",
   "cli",
   "code",
   "contracts",
   "core",
-  "runtime",
   "studio",
   "workflows",
 ] as const;
 const MAXIMUM_APPLICATION_SOURCE_FILES = 4_096;
 const MAXIMUM_APPLICATION_SOURCE_FILE_BYTES = 64 * 1024 * 1024;
+// The reviewed packed boundary never ships the Zig runtime build tree or the
+// root lockfile, while the committed CLI bundle ships beside the checked
+// sources in both layouts. Each of these inputs stays hash-bound wherever it
+// is present and is skipped only when it is absent.
+const OPTIONAL_APPLICATION_SOURCE_FILES = new Set<string>([
+  "apps/desktop/dist/cli/main.js",
+  "bun.lock",
+]);
 let cachedApplicationBuild: Promise<string> | undefined;
 
 function isWithin(root: string, candidate: string): boolean {
@@ -137,6 +143,22 @@ async function collectSourceFiles(
   }
 }
 
+async function presentDesktopDirectory(
+  desktopRoot: string,
+  directory: string,
+): Promise<string | undefined> {
+  const path = join(desktopRoot, directory);
+  try {
+    if ((await lstat(path)).isDirectory()) return path;
+    return undefined;
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return undefined;
+    }
+    throw error;
+  }
+}
+
 async function computeApplicationBuildIdentity(options: {
   readonly desktopRoot: string;
   readonly repositoryRoot: string;
@@ -151,9 +173,16 @@ async function computeApplicationBuildIdentity(options: {
   }
   const sources: Array<{ readonly logicalPath: string; readonly path: string }> = [];
   for (const directory of DESKTOP_SOURCE_DIRECTORIES) {
+    const path = await presentDesktopDirectory(desktopRoot, directory);
+    if (path === undefined) {
+      throw new ApplicationError(
+        "not-found",
+        `Application build source directory is missing: apps/desktop/${directory}`,
+      );
+    }
     await collectSourceFiles(
       desktopRoot,
-      join(desktopRoot, directory),
+      path,
       `apps/desktop/${directory}`,
       sources,
     );
@@ -176,10 +205,20 @@ async function computeApplicationBuildIdentity(options: {
     );
   }
   for (const [logicalPath, path] of [
+    ["apps/desktop/dist/cli/main.js", join(desktopRoot, "dist", "cli", "main.js")],
     ["bun.lock", join(repositoryRoot, "bun.lock")],
     ["package.json", join(repositoryRoot, "package.json")],
   ] as const) {
-    const physical = await realpath(path);
+    let physical: string;
+    try {
+      physical = await realpath(path);
+    } catch (error) {
+      if (
+        OPTIONAL_APPLICATION_SOURCE_FILES.has(logicalPath)
+        && error instanceof Error && "code" in error && error.code === "ENOENT"
+      ) continue;
+      throw error;
+    }
     if (!isWithin(repositoryRoot, physical)) {
       throw new ApplicationError("unsafe-path", `Application build source escapes: ${logicalPath}`);
     }
@@ -227,8 +266,11 @@ export async function createApplicationBuildIdentity(options: {
   readonly desktopRoot?: string;
   readonly repositoryRoot?: string;
 } = {}): Promise<string> {
-  const defaultDesktopRoot = resolve(import.meta.dir, "..");
-  const defaultRepositoryRoot = resolve(defaultDesktopRoot, "../..");
+  // Inside the committed bundle, import.meta.dir is apps/desktop/dist/cli;
+  // the checked host sources stay at their installed paths below apps/desktop.
+  const defaults = hostSourceRoots(import.meta.dir);
+  const defaultDesktopRoot = defaults.desktopRoot;
+  const defaultRepositoryRoot = defaults.repositoryRoot;
   if (options.desktopRoot !== undefined || options.repositoryRoot !== undefined) {
     return await computeApplicationBuildIdentity({
       desktopRoot: options.desktopRoot ?? defaultDesktopRoot,

package/apps/desktop/code/semantic-builder.ts

@@ -50,11 +50,6 @@ import type {
   ProjectRenderPlanOutput,
   ProjectSnapshotOutput,
   PromoteVariantSelectionOutput,
-  RecordingPauseOutput,
-  RecordingResumeOutput,
-  RecordingStartInput,
-  RecordingStartOutput,
-  RecordingStopOutput,
   SceneAnalysisOperationInput,
   SceneAnalysisOperationOutput,
   SelectVariantInput,
@@ -301,8 +296,6 @@ export type MediaAudioEffectsOptions =
   OperationInputValue<MediaAudioEffectsInput>;
 export type MediaColorGradeOptions =
   OperationInputValue<MediaColorGradeInput>;
-export type RecordingStartOptions =
-  OperationInputValue<RecordingStartInput>;
 
 export type FaceFollowOptions = {
   readonly [Key in keyof Omit<FollowFacesInput, "project">]:
@@ -1344,42 +1337,6 @@ export class WorkflowBuilder {
     }, options),
   });
 
-  readonly recording = Object.freeze({
-    pause: (
-      key: string,
-      options?: OperationNodeOptions,
-    ): Ref<RecordingPauseOutput> => this.#graph.operationByKind(key, {
-      input: {},
-      kind: "recording.pause",
-      version: 1,
-    }, options),
-    resume: (
-      key: string,
-      options?: OperationNodeOptions,
-    ): Ref<RecordingResumeOutput> => this.#graph.operationByKind(key, {
-      input: {},
-      kind: "recording.resume",
-      version: 1,
-    }, options),
-    start: (
-      key: string,
-      input: RecordingStartOptions,
-      options?: OperationNodeOptions,
-    ): Ref<RecordingStartOutput> => this.#graph.operationByKind(key, {
-      input,
-      kind: "recording.start",
-      version: 2,
-    }, options),
-    stop: (
-      key: string,
-      options?: OperationNodeOptions,
-    ): Ref<RecordingStopOutput> => this.#graph.operationByKind(key, {
-      input: {},
-      kind: "recording.stop",
-      version: 1,
-    }, options),
-  });
-
   private constructor(graph: WorkflowGraphBuilder) {
     this.#graph = graph;
   }

package/apps/desktop/code/source-bundle.ts

@@ -28,6 +28,7 @@ import {
   canonicalJson,
   sha256Hex,
 } from "../core/canonical-json";
+import { hostSourceRoots } from "./host-source-layout";
 import type { WorkflowBundleIdentity as GraphWorkflowBundleIdentity } from "./contracts";
 import { typecheckWorkflowSnapshot } from "./source-typecheck";
 import { captureWorkerProcessStartIdentity } from "./worker-process-identity";
@@ -52,6 +53,10 @@ const MAX_TIMER_DURATION_MS = 2_147_483_647;
 const BUNDLER_GUARDIAN_HANDSHAKE_MS = 2_000;
 const BUNDLER_GUARDIAN_DIAGNOSTIC_BYTES = 2_000;
 
+// Spawned helpers always run the checked TypeScript sources, never a path
+// derived from this module's bundled location below apps/desktop/dist/cli.
+const HOST_ROOTS = hostSourceRoots(import.meta.dir);
+
 const BUNDLE_SUBPROCESS_SOURCE = String.raw`
 import { fstatSync } from "node:fs";
 const processIdentity = await import(process.argv[5]);
@@ -756,11 +761,16 @@ async function startBundlerRetirementGuardian(options: {
         "--has-lease",
         options.inheritedHostResourceFileDescriptor === 0 ? "false" : "true",
         "--identity-module",
-        pathToFileURL(join(import.meta.dir, "worker-process-identity.ts")).href,
+        pathToFileURL(join(
+          HOST_ROOTS.desktopRoot,
+          "code",
+          "worker-process-identity.ts",
+        )).href,
         "--host-resource-lock-module",
         pathToFileURL(join(
-          import.meta.dir,
-          "../../../src/host-resource-posix.ts",
+          HOST_ROOTS.repositoryRoot,
+          "src",
+          "host-resource-posix.ts",
         )).href,
       ],
       {
@@ -941,6 +951,7 @@ async function buildWorkflowBundle(
   modules: readonly CapturedSourceModule[],
   aliases: Readonly<Record<string, string>>,
   configSearchPath: string,
+  hostBoundary: string,
   includeRuntimeTypes: boolean,
   semanticCheck: boolean,
   inheritedHostResourceFileDescriptor: number,
@@ -979,6 +990,7 @@ async function buildWorkflowBundle(
         aliases,
         configSearchPath,
         entryPath,
+        hostBoundary,
         includeRuntimeTypes,
         sourceRoot,
       });
@@ -997,7 +1009,11 @@ async function buildWorkflowBundle(
         outputPath,
         inheritedHostResourceFileDescriptor === 0 ? "0" : "3",
         String(maximumBundleBytes),
-        pathToFileURL(join(import.meta.dir, "worker-process-identity.ts")).href,
+        pathToFileURL(join(
+          HOST_ROOTS.desktopRoot,
+          "code",
+          "worker-process-identity.ts",
+        )).href,
       ],
       {
         cwd: sourceRoot,
@@ -1571,14 +1587,15 @@ async function bundleWorkflowSourceInternal(
   const aliasSpecifiers = new Set(sourceGraph.bareImports);
   const aliases = await bareImportAliases(
     [...aliasSpecifiers].sort(),
-    resolve(options.bareImportResolutionRoot ?? import.meta.dir),
+    resolve(options.bareImportResolutionRoot ?? HOST_ROOTS.desktopRoot),
   );
   const entryRelativePath = relative(allowedRoot, entryPath);
   const bytes = await buildWorkflowBundle(
     entryRelativePath,
     sourceGraph.modules,
     aliases,
-    resolve(options.bareImportResolutionRoot ?? import.meta.dir),
+    resolve(options.bareImportResolutionRoot ?? HOST_ROOTS.desktopRoot),
+    HOST_ROOTS.repositoryRoot,
     (
       sourceGraph.bareImports.some(specifier => (
         specifier === "bun" || specifier.startsWith("node:")

package/apps/desktop/code/source-typecheck.ts

@@ -1,4 +1,4 @@
-import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 
 import ts from "typescript";
 
@@ -12,11 +12,38 @@ const WORKFLOW_GLOBALS_SOURCE = [
   "declare const process: any;",
   "",
 ].join("\n");
+// Packed distributions ship no host tsconfig; this closed fallback preserves
+// the host compiler contract instead of adopting a foreign caller tsconfig.
+const PACKED_WORKFLOW_CONFIG = {
+  compilerOptions: {
+    allowImportingTsExtensions: true,
+    exactOptionalPropertyTypes: true,
+    isolatedModules: true,
+    jsx: "react-jsx",
+    lib: ["ES2023", "DOM", "DOM.Iterable"],
+    module: "Preserve",
+    moduleDetection: "force",
+    moduleResolution: "Bundler",
+    noEmit: true,
+    noFallthroughCasesInSwitch: true,
+    noImplicitOverride: true,
+    noImplicitReturns: true,
+    noUncheckedIndexedAccess: true,
+    noUnusedLocals: true,
+    noUnusedParameters: true,
+    skipLibCheck: true,
+    strict: true,
+    target: "ES2023",
+    useUnknownInCatchVariables: true,
+    verbatimModuleSyntax: true,
+  },
+};
 
 export interface TypecheckWorkflowSnapshotOptions {
   readonly aliases: Readonly<Record<string, string>>;
   readonly configSearchPath: string;
   readonly entryPath: string;
+  readonly hostBoundary: string;
   readonly includeRuntimeTypes: boolean;
   readonly sourceRoot: string;
 }
@@ -26,6 +53,37 @@ function isWithin(root: string, candidate: string): boolean {
   return fromRoot === "" || (!fromRoot.startsWith("..") && !isAbsolute(fromRoot));
 }
 
+/** Finds the host tsconfig without crossing into a foreign caller tree. */
+function boundedHostConfigPath(
+  searchPath: string,
+  boundary: string,
+): string | undefined {
+  const limit = resolve(boundary);
+  let candidate = resolve(searchPath);
+  while (isWithin(limit, candidate)) {
+    const path = join(candidate, "tsconfig.json");
+    if (ts.sys.fileExists(path)) return path;
+    const parent = dirname(candidate);
+    if (parent === candidate) return undefined;
+    candidate = parent;
+  }
+  return undefined;
+}
+
+/**
+ * Resolves the installed @types/bun package from the host tree so runtime
+ * types never depend on the caller's working directory or dependencies.
+ */
+function bunTypeRoots(hostBoundary: string): string | undefined {
+  try {
+    return dirname(dirname(
+      Bun.resolveSync("@types/bun/package.json", resolve(hostBoundary)),
+    ));
+  } catch {
+    return undefined;
+  }
+}
+
 function diagnosticText(
   diagnostic: ts.Diagnostic,
   sourceRoot: string,
@@ -77,49 +135,72 @@ function boundedDiagnostics(
 export function typecheckWorkflowSnapshot(
   options: TypecheckWorkflowSnapshotOptions,
 ): void {
-  const configPath = ts.findConfigFile(
-    resolve(options.configSearchPath),
-    path => ts.sys.fileExists(path),
-    "tsconfig.json",
+  const configPath = boundedHostConfigPath(
+    options.configSearchPath,
+    options.hostBoundary,
   );
+  const hostDirectory = configPath === undefined
+    ? resolve(options.hostBoundary)
+    : dirname(configPath);
+  let parsedOptions: ts.CompilerOptions;
   if (configPath === undefined) {
-    throw new ApplicationError(
-      "internal",
-      "Workflow semantic checking could not locate the host TypeScript configuration.",
+    const parsed = ts.parseJsonConfigFileContent(
+      PACKED_WORKFLOW_CONFIG,
+      ts.sys,
+      hostDirectory,
+      {
+        composite: false,
+        declaration: false,
+        emitDeclarationOnly: false,
+        incremental: false,
+        noEmit: true,
+      },
+      "slopcamera-packed-workflow.tsconfig.json",
     );
-  }
-  const config = ts.readConfigFile(configPath, path => ts.sys.readFile(path));
-  if (config.error !== undefined) {
-    throw new ApplicationError(
-      "internal",
-      `Workflow semantic checking could not read the host TypeScript configuration: ${
-        diagnosticText(config.error, options.sourceRoot)
-      }`,
-    );
-  }
-  const parsed = ts.parseJsonConfigFileContent(
-    config.config,
-    ts.sys,
-    dirname(configPath),
-    {
-      composite: false,
-      declaration: false,
-      emitDeclarationOnly: false,
-      incremental: false,
-      noEmit: true,
-    },
-    configPath,
-  );
-  if (parsed.errors.length > 0) {
-    throw new ApplicationError(
-      "internal",
-      `Workflow semantic checking could not parse the host TypeScript configuration:\n${
-        boundedDiagnostics(parsed.errors, options.sourceRoot)
-      }`,
+    if (parsed.errors.length > 0) {
+      throw new ApplicationError(
+        "internal",
+        `Workflow semantic checking could not apply its packed TypeScript configuration:\n${
+          boundedDiagnostics(parsed.errors, options.sourceRoot)
+        }`,
+      );
+    }
+    parsedOptions = parsed.options;
+  } else {
+    const config = ts.readConfigFile(configPath, path => ts.sys.readFile(path));
+    if (config.error !== undefined) {
+      throw new ApplicationError(
+        "internal",
+        `Workflow semantic checking could not read the host TypeScript configuration: ${
+          diagnosticText(config.error, options.sourceRoot)
+        }`,
+      );
+    }
+    const parsed = ts.parseJsonConfigFileContent(
+      config.config,
+      ts.sys,
+      hostDirectory,
+      {
+        composite: false,
+        declaration: false,
+        emitDeclarationOnly: false,
+        incremental: false,
+        noEmit: true,
+      },
+      configPath,
     );
+    if (parsed.errors.length > 0) {
+      throw new ApplicationError(
+        "internal",
+        `Workflow semantic checking could not parse the host TypeScript configuration:\n${
+          boundedDiagnostics(parsed.errors, options.sourceRoot)
+        }`,
+      );
+    }
+    parsedOptions = parsed.options;
   }
   const typecheckImporterPath = resolve(
-    dirname(configPath),
+    hostDirectory,
     "slopcamera-workflow-typecheck.ts",
   );
   const aliasPaths = Object.fromEntries(
@@ -132,7 +213,7 @@ export function typecheckWorkflowSnapshot(
         const declaration = ts.resolveModuleName(
           specifier,
           typecheckImporterPath,
-          parsed.options,
+          parsedOptions,
           ts.sys,
         ).resolvedModule?.resolvedFileName;
         return [
@@ -143,8 +224,14 @@ export function typecheckWorkflowSnapshot(
         ];
       }),
   );
+  // Runtime-typed workflows use the host's installed @types/bun when it is
+  // present and the explicit any-globals shim when it is not.
+  const runtimeTypeRoots = options.includeRuntimeTypes
+    ? bunTypeRoots(options.hostBoundary)
+    : undefined;
+  const realRuntimeTypes = runtimeTypeRoots !== undefined;
   const compilerOptions: ts.CompilerOptions = {
-    ...parsed.options,
+    ...parsedOptions,
     baseUrl: options.sourceRoot,
     composite: false,
     declaration: false,
@@ -152,10 +239,11 @@ export function typecheckWorkflowSnapshot(
     incremental: false,
     noEmit: true,
     paths: {
-      ...parsed.options.paths,
+      ...parsedOptions.paths,
       ...aliasPaths,
     },
-    types: options.includeRuntimeTypes ? ["bun"] : [],
+    ...(realRuntimeTypes ? { typeRoots: [runtimeTypeRoots] } : {}),
+    types: realRuntimeTypes ? ["bun"] : [],
   };
   delete compilerOptions.tsBuildInfoFile;
   const host = ts.createCompilerHost(compilerOptions, true);
@@ -189,7 +277,7 @@ export function typecheckWorkflowSnapshot(
     options: compilerOptions,
     rootNames: [
       options.entryPath,
-      ...(options.includeRuntimeTypes ? [] : [WORKFLOW_GLOBALS_PATH]),
+      ...(realRuntimeTypes ? [] : [WORKFLOW_GLOBALS_PATH]),
     ],
   });
   const diagnostics = program.getSourceFiles()

package/apps/desktop/code/worker-client.ts

@@ -22,6 +22,7 @@ import { z } from "zod";
 
 import { ApplicationError } from "../application/errors";
 import type { OperationDiscovery } from "../application/registry";
+import { hostSourceRoots } from "./host-source-layout";
 import { canonicalJson } from "../core/canonical-json";
 import {
   AuthoredWorkflowGraphV1Schema,
@@ -46,6 +47,9 @@ const DEFAULT_TIMEOUT_MS = 30_000;
 const DEFAULT_MAXIMUM_DIAGNOSTIC_BYTES = 64 * 1024;
 const CODE_WORKER_CANCEL_GRACE_MS = 250;
 export const MAX_CODE_WORKER_POOL_SIZE = 4;
+// Spawned helpers always run the checked TypeScript sources, never a path
+// derived from this module's bundled location below apps/desktop/dist/cli.
+const HOST_ROOTS = hostSourceRoots(import.meta.dir);
 
 const WorkerBuiltWorkflowSchema = z.strictObject({
   graph: AuthoredWorkflowGraphV1Schema,
@@ -856,7 +860,11 @@ async function startCodeWorkerLeaseGuardian(options: {
       "Code-worker host-resource lease descriptor is unsafe to inherit.",
     );
   }
-  const guardianEntryPath = join(import.meta.dir, "worker-lease-guardian.ts");
+  const guardianEntryPath = join(
+    HOST_ROOTS.desktopRoot,
+    "code",
+    "worker-lease-guardian.ts",
+  );
   const guardian = spawn(
     options.bunExecutable,
     [
@@ -1435,7 +1443,11 @@ export async function startCodeWorker(
     );
   }
   const workerEntryPath = resolve(
-    options.workerEntryPath ?? join(import.meta.dir, "worker-entry.ts"),
+    options.workerEntryPath ?? join(
+      HOST_ROOTS.desktopRoot,
+      "code",
+      "worker-entry.ts",
+    ),
   );
   const workerEntrySha256 = createHash("sha256")
     .update(await readFile(workerEntryPath))