@kodycodes/cli 1.2.1 → 1.4.0

package/dist/local-execute.js

@@ -0,0 +1,286 @@
+import { spawn } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { rmSync } from 'node:fs';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { createServer, request as httpRequest, } from 'node:http';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
+import { assertTokenSafeApiUrl, callCapabilityProxy, openCapabilityProxySession, } from './capability-proxy.js';
+import { apiTokenEnvVar } from './defaults.js';
+import { createLocalEntrySource, createLocalRuntimeModuleSource, createWorkerdConfig, runSecretEnvVar, runSecretHeader, } from './local-runtime-source.js';
+import { redact } from './redact.js';
+import { ensureWorkerdBinary } from './workerd-binary.js';
+const workerdStartTimeoutMs = 30_000;
+const workerdExitGraceMs = 1_000;
+export function assertNoStaticPackageImports(code) {
+    if (/(?:\bfrom\s*|\bimport\s*\(?\s*)["']kody:@/.test(code)) {
+        throw new Error('execute --local does not resolve saved-package imports (kody:@…) yet. Call the export with packages.invoke(specifier, options) from kody:runtime, or run execute without --local.');
+    }
+}
+export async function runLocalExecute(input) {
+    assertNoStaticPackageImports(input.code);
+    assertTokenSafeApiUrl(input.apiUrl);
+    const client = { apiUrl: input.apiUrl, token: input.token, fetchFn: input.fetchFn };
+    await openCapabilityProxySession(client);
+    const workerdPath = input.workerdPath ??
+        (await ensureWorkerdBinary({
+            onDownload: (url) => input.onStatus?.(`Downloading workerd for local execute from ${url}…`),
+        }));
+    const runSecret = randomBytes(32).toString('hex');
+    const workDir = await mkdtemp(join(tmpdir(), 'kody-local-'));
+    let child;
+    let bridge;
+    // SIGTERM makes workerd drain in-flight requests, which a hung module never finishes.
+    const stopWorkerd = () => child?.kill('SIGKILL');
+    const releaseSignals = cleanupOnSignal(() => {
+        stopWorkerd();
+        rmSync(workDir, { recursive: true, force: true });
+    });
+    const startedAt = new Date();
+    const finish = (sandbox) => buildLocalExecuteResult({
+        sandbox,
+        startedAt,
+        endedAt: new Date(),
+        conversationId: input.conversationId,
+    });
+    try {
+        bridge = await startBridge({
+            runSecret,
+            forward: (call, signal) => callCapabilityProxy({
+                ...client,
+                ...call,
+                conversationId: input.conversationId,
+                signal,
+            }),
+        });
+        const files = { entry: 'entry.js', user: 'main.js', runtime: 'runtime.js' };
+        await writeFile(join(workDir, files.entry), createLocalEntrySource());
+        await writeFile(join(workDir, files.user), input.code);
+        await writeFile(join(workDir, files.runtime), createLocalRuntimeModuleSource());
+        const configPath = join(workDir, 'config.capnp');
+        await writeFile(configPath, createWorkerdConfig({ bridgePort: bridge.port, files }));
+        const env = { ...process.env, [runSecretEnvVar]: runSecret };
+        delete env[apiTokenEnvVar];
+        child = spawn(workerdPath, ['serve', configPath, '--control-fd=3'], {
+            cwd: workDir,
+            env,
+            stdio: ['ignore', 'pipe', 'pipe', 'pipe'],
+        });
+        const workerd = watchWorkerd(child);
+        const started = await workerd.listening;
+        if ('exitDetail' in started) {
+            return finish({ error: `Local execute could not load the module${started.exitDetail}` });
+        }
+        let response;
+        try {
+            response = await postToWorkerd({
+                port: started.port,
+                runSecret,
+                body: JSON.stringify({ params: input.params ?? {} }),
+            });
+        }
+        catch (error) {
+            const exitDetail = await Promise.race([workerd.exited, delay(workerdExitGraceMs, null)]);
+            if (exitDetail !== null)
+                throw new Error(`workerd exited during the run${exitDetail}`);
+            const reason = error instanceof Error ? error.message : String(error);
+            throw new Error(`Local execute run failed (${reason}).${workerd.stderr()}`);
+        }
+        if (response.status !== 200) {
+            throw new Error(`Local execute runtime returned HTTP ${response.status}.${workerd.stderr()}`);
+        }
+        return finish(JSON.parse(response.body));
+    }
+    finally {
+        releaseSignals();
+        stopWorkerd();
+        await bridge?.close();
+        await rm(workDir, { recursive: true, force: true });
+    }
+}
+/** Same envelope as cloud execute so `formatToolResult` and `--json` behave identically. */
+export function buildLocalExecuteResult(input) {
+    const { sandbox } = input;
+    const logs = sandbox.logs ?? [];
+    const base = {
+        ...(input.conversationId !== undefined ? { conversationId: input.conversationId } : {}),
+        timing: {
+            startedAt: input.startedAt.toISOString(),
+            endedAt: input.endedAt.toISOString(),
+            durationMs: input.endedAt.getTime() - input.startedAt.getTime(),
+        },
+    };
+    if (typeof sandbox.error === 'string') {
+        return {
+            content: [{ type: 'text', text: `Error: ${sandbox.error}` }],
+            structuredContent: { ...base, returnedBytes: 0, error: sandbox.error, logs },
+            isError: true,
+        };
+    }
+    const text = typeof sandbox.result === 'string'
+        ? sandbox.result
+        : (JSON.stringify(sandbox.result, null, 2) ?? 'undefined');
+    const serialized = typeof sandbox.result === 'string'
+        ? sandbox.result
+        : (JSON.stringify(sandbox.result) ?? 'undefined');
+    return {
+        content: [{ type: 'text', text }],
+        structuredContent: {
+            ...base,
+            returnedBytes: Buffer.byteLength(serialized),
+            result: sandbox.result,
+            logs,
+        },
+        isError: false,
+    };
+}
+/**
+ * `finally` does not run when the CLI is killed by a signal; without this,
+ * workerd is orphaned and the user's module stays in the temp dir.
+ */
+function cleanupOnSignal(cleanup) {
+    const signals = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+    const release = () => {
+        for (const signal of signals)
+            process.off(signal, handler);
+    };
+    const handler = (signal) => {
+        release();
+        cleanup();
+        process.kill(process.pid, signal);
+    };
+    for (const signal of signals)
+        process.once(signal, handler);
+    return release;
+}
+function watchWorkerd(child) {
+    let stderrText = '';
+    child.stderr?.on('data', (chunk) => {
+        stderrText += chunk.toString('utf8');
+    });
+    child.stdout?.resume();
+    const stderr = () => {
+        const trimmed = redact(stderrText.trim());
+        return trimmed ? `\n${trimmed}` : '';
+    };
+    const exited = new Promise((resolve) => {
+        child.once('exit', (code, signal) => {
+            resolve(` (workerd exit ${signal ?? code})${stderr()}`);
+        });
+    });
+    const listening = new Promise((resolve, reject) => {
+        const control = child.stdio[3];
+        let buffered = '';
+        const timer = setTimeout(() => {
+            reject(new Error(`workerd did not start within ${workerdStartTimeoutMs / 1000}s.${stderr()}`));
+        }, workerdStartTimeoutMs);
+        control?.on('data', (chunk) => {
+            buffered += chunk.toString('utf8');
+            for (const line of buffered.split('\n')) {
+                const port = parseListenPort(line);
+                if (port !== null) {
+                    clearTimeout(timer);
+                    resolve({ port });
+                }
+            }
+        });
+        child.once('error', (error) => {
+            clearTimeout(timer);
+            reject(new Error(`Could not start workerd: ${error.message}`));
+        });
+        void exited.then((exitDetail) => {
+            clearTimeout(timer);
+            resolve({ exitDetail });
+        });
+    });
+    return { listening, exited, stderr };
+}
+function parseListenPort(line) {
+    if (!line.trim())
+        return null;
+    try {
+        const event = JSON.parse(line);
+        return event.event === 'listen' && event.socket === 'http' && typeof event.port === 'number'
+            ? event.port
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** node:http rather than fetch: local runs have no time limit, and fetch gives up after 300s. */
+function postToWorkerd(input) {
+    return new Promise((resolve, reject) => {
+        const request = httpRequest({
+            host: '127.0.0.1',
+            port: input.port,
+            method: 'POST',
+            path: '/',
+            headers: {
+                'content-type': 'application/json',
+                'content-length': Buffer.byteLength(input.body),
+                [runSecretHeader]: input.runSecret,
+            },
+        }, (response) => {
+            readBody(response).then((body) => resolve({ status: response.statusCode ?? 0, body }), reject);
+        });
+        request.on('error', reject);
+        request.end(input.body);
+    });
+}
+async function startBridge(input) {
+    const inFlight = new AbortController();
+    const server = createServer(async (request, response) => {
+        const reply = (status, body) => {
+            response.writeHead(status, { 'content-type': 'application/json' });
+            response.end(JSON.stringify(body));
+        };
+        if (request.method !== 'POST' ||
+            request.url !== '/call' ||
+            request.headers[runSecretHeader] !== input.runSecret) {
+            reply(403, { error: 'Forbidden' });
+            return;
+        }
+        try {
+            const call = parseBridgeCall(await readBody(request));
+            const result = await input.forward(call, inFlight.signal);
+            reply(200, { result });
+        }
+        catch (error) {
+            reply(200, { error: redact(error instanceof Error ? error.message : String(error)) });
+        }
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => resolve());
+    });
+    return {
+        port: server.address().port,
+        close: () => new Promise((resolve) => {
+            inFlight.abort();
+            server.closeAllConnections();
+            server.close(() => resolve());
+        }),
+    };
+}
+function parseBridgeCall(body) {
+    const parsed = JSON.parse(body);
+    if (!Array.isArray(parsed.path) ||
+        parsed.path.length === 0 ||
+        !parsed.path.every((segment) => typeof segment === 'string')) {
+        throw new Error('Invalid kody:runtime call path.');
+    }
+    return {
+        path: parsed.path,
+        args: Array.isArray(parsed.args) ? parsed.args : [],
+    };
+}
+async function readBody(stream) {
+    const chunks = [];
+    for await (const chunk of stream) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+//# sourceMappingURL=local-execute.js.map

package/dist/local-execute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-execute.js","sourceRoot":"","sources":["../src/local-execute.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAA;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EACN,YAAY,EACZ,OAAO,IAAI,WAAW,GAGtB,MAAM,WAAW,CAAA;AAElB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EACN,qBAAqB,EACrB,mBAAmB,EACnB,0BAA0B,GAC1B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EACN,sBAAsB,EACtB,8BAA8B,EAC9B,mBAAmB,EACnB,eAAe,EACf,eAAe,GACf,MAAM,2BAA2B,CAAA;AAElC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAmBzD,MAAM,qBAAqB,GAAG,MAAM,CAAA;AACpC,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAEhC,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACxD,IAAI,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACd,mLAAmL,CACnL,CAAA;IACF,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAwB;IAC7D,4BAA4B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxC,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;IACnF,MAAM,0BAA0B,CAAC,MAAM,CAAC,CAAA;IACxC,MAAM,WAAW,GAChB,KAAK,CAAC,WAAW;QACjB,CAAC,MAAM,mBAAmB,CAAC;YAC1B,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,8CAA8C,GAAG,GAAG,CAAC;SAC3F,CAAC,CAAC,CAAA;IAEJ,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAA;IAC5D,IAAI,KAA+B,CAAA;IACnC,IAAI,MAA0B,CAAA;IAC9B,sFAAsF;IACtF,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAChD,MAAM,cAAc,GAAG,eAAe,CAAC,GAAG,EAAE;QAC3C,WAAW,EAAE,CAAA;QACb,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAA;IAC5B,MAAM,MAAM,GAAG,CAAC,OAAwB,EAAE,EAAE,CAC3C,uBAAuB,CAAC;QACvB,OAAO;QACP,SAAS;QACT,OAAO,EAAE,IAAI,IAAI,EAAE;QACnB,cAAc,EAAE,KAAK,CAAC,cAAc;KACpC,CAAC,CAAA;IACH,IAAI,CAAC;QACJ,MAAM,GAAG,MAAM,WAAW,CAAC;YAC1B,SAAS;YACT,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CACzB,mBAAmB,CAAC;gBACnB,GAAG,MAAM;gBACT,GAAG,IAAI;gBACP,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,MAAM;aACN,CAAC;SACH,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;QAC3E,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAA;QACrE,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QACtD,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,8BAA8B,EAAE,CAAC,CAAA;QAC/E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;QAChD,MAAM,SAAS,CAAC,UAAU,EAAE,mBAAmB,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QAEpF,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,CAAA;QAC/E,OAAO,GAAG,CAAC,cAAc,CAAC,CAAA;QAC1B,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,CAAC,EAAE;YACnE,GAAG,EAAE,OAAO;YACZ,GAAG;YACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SACzC,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QACnC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAA;QACvC,IAAI,YAAY,IAAI,OAAO,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,EAAE,KAAK,EAAE,0CAA0C,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;QACzF,CAAC;QACD,IAAI,QAA0C,CAAA;QAC9C,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,aAAa,CAAC;gBAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,SAAS;gBACT,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;aACpD,CAAC,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;YACxF,IAAI,UAAU,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,UAAU,EAAE,CAAC,CAAA;YACtF,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACrE,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAC5E,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAC9F,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAoB,CAAC,CAAA;IAC5D,CAAC;YAAS,CAAC;QACV,cAAc,EAAE,CAAA;QAChB,WAAW,EAAE,CAAA;QACb,MAAM,MAAM,EAAE,KAAK,EAAE,CAAA;QACrB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,CAAC;AACF,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,uBAAuB,CAAC,KAKvC;IACA,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IACzB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAC/B,MAAM,IAAI,GAAG;QACZ,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,EAAE;YACP,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;YACxC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE;YACpC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE;SAC/D;KACD,CAAA;IACD,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5D,iBAAiB,EAAE,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE;YAC5E,OAAO,EAAE,IAAI;SACb,CAAA;IACF,CAAC;IACD,MAAM,IAAI,GACT,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QACjC,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,WAAW,CAAC,CAAA;IAC5D,MAAM,UAAU,GACf,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QACjC,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,CAAA;IACnD,OAAO;QACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACjC,iBAAiB,EAAE;YAClB,GAAG,IAAI;YACP,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;YAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI;SACJ;QACD,OAAO,EAAE,KAAK;KACd,CAAA;AACF,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,OAAmB;IAC3C,MAAM,OAAO,GAA0B,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;IACtE,MAAM,OAAO,GAAG,GAAG,EAAE;QACpB,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC3D,CAAC,CAAA;IACD,MAAM,OAAO,GAAG,CAAC,MAAsB,EAAE,EAAE;QAC1C,OAAO,EAAE,CAAA;QACT,OAAO,EAAE,CAAA;QACT,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAClC,CAAC,CAAA;IACD,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC3D,OAAO,OAAO,CAAA;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAmB;IACxC,IAAI,UAAU,GAAG,EAAE,CAAA;IACnB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QAC1C,UAAU,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG,GAAG,EAAE;QACnB,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAA;QACzC,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACrC,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QAC9C,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACnC,OAAO,CAAC,kBAAkB,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,IAAI,OAAO,CAA4C,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5F,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAoB,CAAA;QACjD,IAAI,QAAQ,GAAG,EAAE,CAAA;QACjB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,qBAAqB,GAAG,IAAI,KAAK,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;QAC/F,CAAC,EAAE,qBAAqB,CAAC,CAAA;QACzB,OAAO,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACrC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAClC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;gBAClC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBACnB,YAAY,CAAC,KAAK,CAAC,CAAA;oBACnB,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;gBAClB,CAAC;YACF,CAAC;QACF,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC7B,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QAC/D,CAAC,CAAC,CAAA;QACF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;YAC/B,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;QACxB,CAAC,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;IACF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AACrC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAA;IAC7B,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuD,CAAA;QACpF,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAC3F,CAAC,CAAC,KAAK,CAAC,IAAI;YACZ,CAAC,CAAC,IAAI,CAAA;IACR,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,iGAAiG;AACjG,SAAS,aAAa,CAAC,KAItB;IACA,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,OAAO,GAAG,WAAW,CAC1B;YACC,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG;YACT,OAAO,EAAE;gBACR,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC/C,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,SAAS;aAClC;SACD,EACD,CAAC,QAAQ,EAAE,EAAE;YACZ,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CACtB,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAC7D,MAAM,CACN,CAAA;QACF,CAAC,CACD,CAAA;QACD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAM1B;IACA,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAA;IACtC,MAAM,MAAM,GAAW,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC/D,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,IAAa,EAAE,EAAE;YAC/C,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;YAClE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;QACnC,CAAC,CAAA;QACD,IACC,OAAO,CAAC,MAAM,KAAK,MAAM;YACzB,OAAO,CAAC,GAAG,KAAK,OAAO;YACvB,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,KAAK,CAAC,SAAS,EACnD,CAAC;YACF,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;YAClC,OAAM;QACP,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;YACrD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;YACzD,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;QACtF,CAAC;IACF,CAAC,CAAC,CAAA;IACF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC5B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IACF,OAAO;QACN,IAAI,EAAG,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI;QAC5C,KAAK,EAAE,GAAG,EAAE,CACX,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC7B,QAAQ,CAAC,KAAK,EAAE,CAAA;YAChB,MAAM,CAAC,mBAAmB,EAAE,CAAA;YAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9B,CAAC,CAAC;KACH,CAAA;AACF,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuC,CAAA;IACrE,IACC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QACxB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,EAC3D,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACnD,CAAC;IACD,OAAO;QACN,IAAI,EAAE,MAAM,CAAC,IAAqB;QAClC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;KACnD,CAAA;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAuB;IAC9C,MAAM,MAAM,GAAkB,EAAE,CAAA;IAChC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC9C,CAAC"}

package/dist/local-runtime-source.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Sources for the workerd process behind `execute --local`. User code sees the
+ * same `kody:runtime` surface as ad hoc cloud execute; every call becomes a
+ * `{ path, args }` hop to the CLI's loopback bridge, which adds the API token
+ * and forwards it to CapabilityProxy. The token never enters workerd.
+ */
+export declare const localExecuteCompatibilityDate = "2026-04-16";
+export declare const localExecuteCompatibilityFlags: readonly ["nodejs_compat"];
+export declare const localWorkerModuleNames: {
+    readonly entry: "__kody_local_entry.js";
+    readonly user: "main.js";
+    readonly runtime: "kody:runtime";
+};
+/** Header carrying the per-run secret on workerd → bridge and CLI → workerd hops. */
+export declare const runSecretHeader = "x-kody-run-secret";
+export declare const runSecretEnvVar = "KODY_RUN_SECRET";
+export declare function createLocalRuntimeModuleSource(): string;
+export declare function createLocalEntrySource(): string;
+/**
+ * workerd text config. `files` are embedded relative to the config file.
+ * Outbound fetch reaches public and private networks: local execute runs as
+ * the user on their own machine, and reaching local services is part of why
+ * one would run locally.
+ */
+export declare function createWorkerdConfig(input: {
+    bridgePort: number;
+    files: {
+        entry: string;
+        user: string;
+        runtime: string;
+    };
+}): string;

package/dist/local-runtime-source.js

@@ -0,0 +1,199 @@
+/**
+ * Sources for the workerd process behind `execute --local`. User code sees the
+ * same `kody:runtime` surface as ad hoc cloud execute; every call becomes a
+ * `{ path, args }` hop to the CLI's loopback bridge, which adds the API token
+ * and forwards it to CapabilityProxy. The token never enters workerd.
+ */
+export const localExecuteCompatibilityDate = '2026-04-16';
+export const localExecuteCompatibilityFlags = ['nodejs_compat'];
+export const localWorkerModuleNames = {
+    entry: '__kody_local_entry.js',
+    user: 'main.js',
+    runtime: 'kody:runtime',
+};
+/** Header carrying the per-run secret on workerd → bridge and CLI → workerd hops. */
+export const runSecretHeader = 'x-kody-run-secret';
+export const runSecretEnvVar = 'KODY_RUN_SECRET';
+export function createLocalRuntimeModuleSource() {
+    return `
+let __kodyBridge = null;
+
+export function __kodyInstallLocalBridge(bridge) {
+	__kodyBridge = bridge;
+}
+
+function __kodyCall(path, args) {
+	if (__kodyBridge === null) {
+		throw new Error('kody:runtime is only available while an execute --local run is in progress.');
+	}
+	return __kodyBridge(path, args);
+}
+
+function __kodyNamespace(path) {
+	const label = '[KodyRuntime:' + path.join('.') + ']';
+	return new Proxy(function () {}, {
+		get(_target, property) {
+			if (typeof property === 'symbol' || property === 'then' || property === 'toJSON') {
+				return undefined;
+			}
+			if (property === 'toString' || property === 'inspect') return () => label;
+			return __kodyNamespace([...path, property]);
+		},
+		apply(_target, _thisArg, args) {
+			return __kodyCall(path, args);
+		},
+	});
+}
+
+export const kody = __kodyNamespace(['kody']);
+
+export const workflows = {
+	create: async (input) => await __kodyCall(['workflows', 'create'], [input ?? {}]),
+};
+
+export const packages = {
+	invoke: async (specifier, options) => {
+		if (typeof specifier !== 'string') {
+			throw new Error(
+				'Object-only packages.invoke was removed. Use a static import (import fn from "kody:@owner/package/export") when the name is known, or import(specifier) when the name is data.',
+			);
+		}
+		return await __kodyCall(['packages', 'invoke'], [specifier, options ?? {}]);
+	},
+};
+
+export function packageStorage() {
+	throw new Error(
+		'packageStorage() requires package provenance: this module was not bundled from a saved package and the run has no package context. ' +
+			'Ad hoc execute has no scratch SQLite helper. Persist durable state from a saved package with packageStorage().',
+	);
+}
+
+function __kodyPackageSecretsUnavailable() {
+	throw new Error(
+		'packageSecrets is not available in this execution context. It is bound for stamped saved-package modules and saved-package runtime contexts.',
+	);
+}
+
+export const packageSecrets = {
+	get: async () => __kodyPackageSecretsUnavailable(),
+	has: async () => __kodyPackageSecretsUnavailable(),
+};
+export const packageContext = Object.freeze({});
+export const email = null;
+export const events = null;
+export const createAuthenticatedFetch = undefined;
+export const secretHeaders = undefined;
+export const oauthClientCredentials = undefined;
+
+const __kodyRuntimeDefault = Object.freeze({
+	kody,
+	packageStorage,
+	createAuthenticatedFetch,
+	secretHeaders,
+	oauthClientCredentials,
+	packageContext,
+	packageSecrets,
+	email,
+	workflows,
+	packages,
+	events,
+});
+export default __kodyRuntimeDefault;
+export const KodyRuntime = Object.freeze({ defaultValue: __kodyRuntimeDefault });
+`.trimStart();
+}
+export function createLocalEntrySource() {
+    return `
+import { __kodyInstallLocalBridge } from ${JSON.stringify(localWorkerModuleNames.runtime)};
+
+const __kodyRunSecretHeader = ${JSON.stringify(runSecretHeader)};
+let __kodyClaimed = false;
+
+function __kodyFormatLogArgs(args) {
+	return args.map(String).join(' ');
+}
+
+export default {
+	async fetch(request, env) {
+		const secret = env.${runSecretEnvVar};
+		if (__kodyClaimed || !secret || request.headers.get(__kodyRunSecretHeader) !== secret) {
+			return new Response('Forbidden', { status: 403 });
+		}
+		__kodyClaimed = true;
+		const { params } = await request.json();
+		__kodyInstallLocalBridge(async (path, args) => {
+			const response = await env.KODY_BRIDGE.fetch('http://kody-bridge/call', {
+				method: 'POST',
+				headers: { 'content-type': 'application/json', [__kodyRunSecretHeader]: secret },
+				body: JSON.stringify({ path, args }),
+			});
+			const data = await response.json();
+			if (data.error) throw new Error(data.error);
+			return data.result;
+		});
+		const logs = [];
+		const nativeConsole = globalThis.console;
+		globalThis.console = {
+			...nativeConsole,
+			log: (...a) => { logs.push(__kodyFormatLogArgs(a)); },
+			info: (...a) => { logs.push('[info] ' + __kodyFormatLogArgs(a)); },
+			debug: (...a) => { logs.push('[debug] ' + __kodyFormatLogArgs(a)); },
+			warn: (...a) => { logs.push('[warn] ' + __kodyFormatLogArgs(a)); },
+			error: (...a) => { logs.push('[error] ' + __kodyFormatLogArgs(a)); },
+		};
+		try {
+			const module = await import(${JSON.stringify(`./${localWorkerModuleNames.user}`)});
+			if (typeof module?.default !== 'function') {
+				throw new Error('Kody execute modules must default export a function.');
+			}
+			const result = await module.default(params);
+			return new Response(JSON.stringify({ result, logs }), {
+				headers: { 'content-type': 'application/json' },
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			return Response.json({ error: message, logs });
+		} finally {
+			globalThis.console = nativeConsole;
+		}
+	},
+};
+`.trimStart();
+}
+/**
+ * workerd text config. `files` are embedded relative to the config file.
+ * Outbound fetch reaches public and private networks: local execute runs as
+ * the user on their own machine, and reaching local services is part of why
+ * one would run locally.
+ */
+export function createWorkerdConfig(input) {
+    const flags = localExecuteCompatibilityFlags.map((flag) => JSON.stringify(flag)).join(', ');
+    return `using Workerd = import "/workerd/workerd.capnp";
+
+const config :Workerd.Config = (
+  services = [
+    (name = "main", worker = .kodyWorker),
+    (name = "kody-bridge", external = (address = "127.0.0.1:${input.bridgePort}", http = ())),
+    (name = "internet", network = (allow = ["public", "private", "local"], tlsOptions = (trustBrowserCas = true))),
+  ],
+  sockets = [ (name = "http", address = "127.0.0.1:0", http = (), service = "main") ],
+);
+
+const kodyWorker :Workerd.Worker = (
+  modules = [
+    (name = ${JSON.stringify(localWorkerModuleNames.entry)}, esModule = embed ${JSON.stringify(input.files.entry)}),
+    (name = ${JSON.stringify(localWorkerModuleNames.user)}, esModule = embed ${JSON.stringify(input.files.user)}),
+    (name = ${JSON.stringify(localWorkerModuleNames.runtime)}, esModule = embed ${JSON.stringify(input.files.runtime)}),
+  ],
+  compatibilityDate = ${JSON.stringify(localExecuteCompatibilityDate)},
+  compatibilityFlags = [${flags}],
+  globalOutbound = "internet",
+  bindings = [
+    (name = "KODY_BRIDGE", service = "kody-bridge"),
+    (name = ${JSON.stringify(runSecretEnvVar)}, fromEnvironment = ${JSON.stringify(runSecretEnvVar)}),
+  ],
+);
+`;
+}
+//# sourceMappingURL=local-runtime-source.js.map

package/dist/local-runtime-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-runtime-source.js","sourceRoot":"","sources":["../src/local-runtime-source.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,YAAY,CAAA;AACzD,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,eAAe,CAAU,CAAA;AAExE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACrC,KAAK,EAAE,uBAAuB;IAC9B,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,cAAc;CACd,CAAA;AAEV,qFAAqF;AACrF,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAA;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAA;AAEhD,MAAM,UAAU,8BAA8B;IAC7C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsFP,CAAC,SAAS,EAAE,CAAA;AACb,CAAC;AAED,MAAM,UAAU,sBAAsB;IACrC,OAAO;2CACmC,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,OAAO,CAAC;;gCAEzD,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;;;;;;;uBASxC,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;iCA2BL,IAAI,CAAC,SAAS,CAAC,KAAK,sBAAsB,CAAC,IAAI,EAAE,CAAC;;;;;;;;;;;;;;;;CAgBlF,CAAC,SAAS,EAAE,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAGnC;IACA,MAAM,KAAK,GAAG,8BAA8B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3F,OAAO;;;;;8DAKsD,KAAK,CAAC,UAAU;;;;;;;;cAQhE,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,KAAK,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;cACnG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;cACjG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,OAAO,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;;wBAE7F,IAAI,CAAC,SAAS,CAAC,6BAA6B,CAAC;0BAC3C,KAAK;;;;cAIjB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;;;CAGlG,CAAA;AACD,CAAC"}

package/dist/network-error.d.ts

@@ -0,0 +1,2 @@
+/** `fetch failed` alone hides why; undici puts ECONNREFUSED / ENOTFOUND on `cause.code`. */
+export declare function describeNetworkError(error: unknown): string;

package/dist/network-error.js

@@ -0,0 +1,11 @@
+/** `fetch failed` alone hides why; undici puts ECONNREFUSED / ENOTFOUND on `cause.code`. */
+export function describeNetworkError(error) {
+    if (!(error instanceof Error))
+        return String(error);
+    const cause = error.cause;
+    const causeCode = cause && typeof cause === 'object' && 'code' in cause && typeof cause.code === 'string'
+        ? cause.code
+        : null;
+    return causeCode ? `${error.message}: ${causeCode}` : error.message;
+}
+//# sourceMappingURL=network-error.js.map

package/dist/network-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-error.js","sourceRoot":"","sources":["../src/network-error.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,MAAM,UAAU,oBAAoB,CAAC,KAAc;IAClD,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACnD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACzB,MAAM,SAAS,GACd,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QACtF,CAAC,CAAC,KAAK,CAAC,IAAI;QACZ,CAAC,CAAC,IAAI,CAAA;IACR,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAA;AACpE,CAAC"}

package/dist/workerd-binary.d.ts

@@ -0,0 +1,31 @@
+/** Matches the workerd the Kody platform runs; bump together with the digests. */
+export declare const workerdVersion = "1.20260815.1";
+/** sha256 of each gzipped release asset on github.com/cloudflare/workerd. */
+export declare const workerdAssetDigests: {
+    readonly 'linux-64': "05099ec6f50832fcbc327490e5a971d682c97231fb01943b61726db07677e559";
+    readonly 'linux-arm64': "0331597b53771170df2ab8344d9ae81d38bad4959e47152dd86592eedd9264c7";
+    readonly 'darwin-64': "752ec91c01dfc44d660de6e3a654879cfc1277caa7f3c5312871c608c4c2d6df";
+    readonly 'darwin-arm64': "c189fc08f691739c37d8784945e943e33b66cbd4e14635a061fe516dc95f2b39";
+};
+export type WorkerdTarget = keyof typeof workerdAssetDigests;
+export declare function workerdTargetFor(platform?: NodeJS.Platform, arch?: string): WorkerdTarget;
+export declare function workerdAssetUrl(target: WorkerdTarget, version?: string): string;
+export declare function userCacheDir(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, home?: string): string;
+export declare function cachedWorkerdPath(cacheDir: string, target: WorkerdTarget): string;
+/**
+ * Returns a runnable workerd path: `KODY_WORKERD_PATH` when set, otherwise the
+ * pinned release under the user cache dir (downloaded and verified on first use).
+ */
+export declare function ensureWorkerdBinary(input?: {
+    env?: NodeJS.ProcessEnv;
+    cacheDir?: string;
+    target?: WorkerdTarget;
+    fetchFn?: typeof fetch;
+    onDownload?: (url: string) => void;
+}): Promise<string>;
+export declare function downloadVerifiedGzip(input: {
+    url: string;
+    sha256: string;
+    destination: string;
+    fetchFn: typeof fetch;
+}): Promise<void>;