@kynver-app/runtime 0.1.39 → 0.1.47

package/dist/vercel/vercel-evidence.d.ts

@@ -0,0 +1,48 @@
+import { type GitHubCommitStatusRow, type GitHubStatusState, type GitHubVercelStatusContext } from "./vercel-github-status.js";
+import { type ClassifiedVercelUrl } from "./vercel-url.js";
+export type VercelEvidenceStatus = "ready" | "building" | "error" | "unavailable" | "not_run";
+export interface VercelEvidenceResult {
+    status: VercelEvidenceStatus;
+    previewUrl: string | null;
+    deploymentUrl: string | null;
+    summary: string | null;
+    observedAt: string | null;
+    /** True when `vercel inspect` was not run (dashboard URL or trusted GitHub state). */
+    inspectSkipped: boolean;
+    inspectReason: string | null;
+    githubState: GitHubStatusState | null;
+    vercelContext: string | null;
+}
+export interface VercelInspectCommandResult {
+    ok: boolean;
+    exitCode: number | null;
+    stdout: string;
+    stderr: string;
+    error: string | null;
+}
+export type RunVercelInspect = (target: string, waitSeconds: number) => VercelInspectCommandResult;
+/**
+ * Resolve the CLI inspect target. Never returns a vercel.com dashboard page URL.
+ */
+export declare function resolveVercelInspectTarget(rawUrl: string | null | undefined): {
+    target: string | null;
+    classified: ClassifiedVercelUrl | null;
+    reason: string | null;
+};
+export declare function evidenceFromGitHubVercelStatus(statuses: GitHubCommitStatusRow[] | null | undefined, options?: {
+    observedAt?: string;
+}): VercelEvidenceResult;
+export interface CollectVercelEvidenceInput {
+    statuses?: GitHubCommitStatusRow[] | null;
+    /** When false, never shell out to the Vercel CLI (GitHub status only). */
+    allowInspect?: boolean;
+    waitSeconds?: number;
+    runInspect?: RunVercelInspect;
+    observedAt?: string;
+}
+/**
+ * Prefer GitHub Vercel StatusContext.state for gates. Run `vercel inspect` only when
+ * inspectable (deployment host or id) and GitHub state is not already terminal success.
+ */
+export declare function collectVercelEvidence(input: CollectVercelEvidenceInput): VercelEvidenceResult;
+export type { GitHubVercelStatusContext };

package/dist/vercel/vercel-github-status.d.ts

@@ -0,0 +1,19 @@
+export type GitHubStatusState = "success" | "pending" | "failure" | "error" | "unknown";
+export interface GitHubCommitStatusRow {
+    context?: string | null;
+    state?: string | null;
+    target_url?: string | null;
+    description?: string | null;
+}
+export interface GitHubVercelStatusContext {
+    context: string;
+    state: GitHubStatusState;
+    targetUrl: string | null;
+    description: string | null;
+    deploymentId: string | null;
+    previewUrl: string | null;
+    dashboardUrl: string | null;
+}
+export declare function normalizeGitHubStatusState(state: unknown): GitHubStatusState;
+export declare function isVercelStatusContext(context: unknown): boolean;
+export declare function pickVercelStatusContext(statuses: GitHubCommitStatusRow[] | null | undefined): GitHubVercelStatusContext | null;

package/dist/vercel/vercel-url.d.ts

@@ -0,0 +1,16 @@
+export type VercelUrlKind = "deployment_host" | "dashboard" | "deployment_id" | "unknown";
+export interface ClassifiedVercelUrl {
+    kind: VercelUrlKind;
+    /** Original URL when it is a usable preview/deployment host. */
+    previewUrl: string | null;
+    /** Argument suitable for `vercel inspect` (id or host URL), never a dashboard page URL. */
+    inspectTarget: string | null;
+    /** Deployment id extracted from dashboard paths when present. */
+    deploymentId: string | null;
+}
+/**
+ * Classify a Vercel-related URL from GitHub commit status target_url.
+ * `vercel inspect` accepts deployment ids and `*.vercel.app` hosts — not vercel.com dashboard links.
+ */
+export declare function classifyVercelUrl(raw: string): ClassifiedVercelUrl;
+export declare function isDashboardVercelUrl(raw: string): boolean;

package/dist/worker-env.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Worker spawn env scrub — harness workers must not inherit host deployment secrets.
+ */
+/** Exact env keys that must never reach a worker child process. */
+export declare const FORBIDDEN_WORKER_ENV_KEYS: readonly ["ANTHROPIC_API_KEY", "ANALYST_API_KEY", "RECRUITER_API_KEY", "AUTH_SECRET", "NEXTAUTH_SECRET", "DATABASE_URL", "PRODUCTION_DATABASE_URL", "REDIS_URL", "GOOGLE_CLIENT_SECRET", "GITHUB_CLIENT_SECRET", "KYNVER_API_KEY", "KYNVER_SERVICE_SECRET", "KYNVER_RUNTIME_SECRET", "OPENCLAW_CRON_SECRET", "QSTASH_TOKEN", "QSTASH_CURRENT_SIGNING_KEY", "QSTASH_NEXT_SIGNING_KEY", "TOOL_SECRETS_KEK", "TOOL_EXECUTOR_DISPATCH_SECRET", "CLOUDFLARE_API_TOKEN", "STRIPE_SECRET_KEY", "STRIPE_WEBHOOK_SECRET", "STRIPE_IDENTITY_WEBHOOK_SECRET", "VOYAGE_API_KEY", "PERPLEXITY_API_KEY", "FRED_API_KEY", "FMP_API_KEY", "CURSOR_API_KEY"];
+export declare function isForbiddenWorkerEnvKey(key: string): boolean;
+export declare function listForbiddenWorkerEnvKeys(env: NodeJS.ProcessEnv): string[];
+export declare function scrubWorkerEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export interface WorkerEnvAudit {
+    forbiddenPresent: string[];
+    safe: boolean;
+}
+export declare function auditWorkerEnv(env: NodeJS.ProcessEnv): WorkerEnvAudit;
+/** @deprecated Use {@link scrubWorkerEnv} — kept for existing imports from git.ts */
+export declare function scrubClaudeEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;

package/dist/worker-lifecycle.d.ts

@@ -0,0 +1,28 @@
+import type { HarnessWorkerRecord, RawHarnessWorkerStatus } from "./status.js";
+export interface CompletionSnapshot {
+    finalResult?: unknown;
+    prUrl?: string | null;
+    summary?: string | null;
+}
+export declare function isCompletionAcknowledged(worker: HarnessWorkerRecord): boolean;
+export declare function completionSnapshotFromStatus(status: RawHarnessWorkerStatus): CompletionSnapshot;
+/**
+ * Persist local terminal lifecycle after AgentOS acknowledges harness completion.
+ * Prevents a later PID reuse or still-running wrapper from re-reporting the worker
+ * as `running` once the board task has advanced.
+ */
+export declare function persistCompletionAcknowledged(worker: HarnessWorkerRecord, status: RawHarnessWorkerStatus, opts?: {
+    source?: string;
+}): void;
+/**
+ * When the board task has left `running` but the local worker still looks live
+ * (common after server-side completion reconcile), mirror the terminal lifecycle
+ * on disk so harness status matches AgentOS.
+ */
+export declare function syncCompletionAcknowledgedFromOperatorTick(runId: string, operatorTick: unknown): Array<{
+    worker: string;
+    taskId: string;
+    taskStatus: string;
+}>;
+/** Reload helper for callers that already hold a worker name. */
+export declare function acknowledgeWorkerIfBoardTaskAdvanced(runId: string, workerName: string, operatorTick: unknown): boolean;

package/dist/worker-ops.d.ts

@@ -0,0 +1,20 @@
+export declare function tryCompleteWorker(args: Record<string, string | boolean>): Promise<{
+    ok: boolean;
+    skipped?: boolean;
+    reason?: string;
+    nextAction?: string;
+    httpStatus?: number;
+    response?: unknown;
+    completionBlocked?: boolean;
+    prHandoff?: {
+        prUrl?: string;
+        created?: boolean;
+    };
+}>;
+export declare function completeWorker(args: Record<string, string | boolean>): Promise<void>;
+export declare function workerStatus(args: Record<string, string | boolean>): void;
+export declare function buildRunBoard(runId: string): Record<string, unknown>;
+export declare function publishHarnessBoardSnapshot(args: Record<string, string | boolean>, source: string): Promise<Record<string, unknown> | null>;
+export declare function runStatus(args: Record<string, string | boolean>): void;
+export declare function tailWorker(args: Record<string, string | boolean>): void;
+export declare function stopWorker(args: Record<string, string | boolean>): void;

package/dist/workspace-runtime-config.d.ts

@@ -0,0 +1,8 @@
+export interface WorkspaceRuntimePreferences {
+    maxConcurrentWorkers: number | null;
+}
+/**
+ * Pull the Command Center worker cap each pipeline tick so the daemon honors
+ * workspace settings without restarting or editing ~/.kynver/config.json.
+ */
+export declare function fetchWorkspaceRuntimePreferences(agentOsId: string, args: Record<string, string | boolean>): Promise<WorkspaceRuntimePreferences | null>;

package/dist/worktree.d.ts

@@ -0,0 +1,4 @@
+import { loadRun, runDirectory, saveRun } from "./run-store.js";
+export declare function createRun(args: Record<string, string | boolean>): void;
+export declare function listRuns(): void;
+export { loadRun, saveRun, runDirectory };

package/package.json

@@ -1,26 +1,30 @@
 {
   "name": "@kynver-app/runtime",
-  "version": "0.1.39",
+  "version": "0.1.47",
   "description": "Kynver AgentOS local execution runtime and CLI",
   "type": "module",
   "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "bin": {
     "kynver": "./dist/cli.js"
   },
   "exports": {
     ".": {
+      "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
       "default": "./dist/index.js"
-    }
+    },
+    "./package.json": "./package.json"
   },
   "files": [
     "dist/**",
     "README.md"
   ],
   "scripts": {
-    "build": "esbuild src/cli.ts src/index.ts --bundle --platform=node --format=esm --packages=external --outdir=dist --sourcemap",
+    "build": "esbuild src/cli.ts src/index.ts --bundle --platform=node --format=esm --packages=external --outdir=dist --sourcemap && tsc -p tsconfig.json --emitDeclarationOnly && node scripts/chmod-cli-bin.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "vitest run --config vitest.config.ts"
+    "test": "vitest run --config vitest.config.ts",
+    "prepublishOnly": "node ../../scripts/npm-publish-guard.mjs"
   },
   "engines": {
     "node": ">=18"