@mevdragon/vidfarm-devcli 0.2.12 → 0.2.13

package/dist/src/services/template-sources.js

@@ -1,15 +1,16 @@
 import { createHash, createHmac } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import os from "node:os";
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+import { gunzipSync, gzipSync } from "node:zlib";
 import { config } from "../config.js";
-import { database } from "../db.js";
+import { serverlessRecords } from "./serverless-records.js";
 import { createId } from "../lib/ids.js";
 import { defaultSkillPathForTemplateModule, deriveTemplateRootDirFromModulePath } from "../lib/template-paths.js";
 import { nowIso } from "../lib/time.js";
 import { loadTemplateFromModule } from "./template-loader.js";
+import { loadTemplateFromRuntimeRelease } from "./template-runtime-bundles.js";
 import { TemplateCertificationService } from "./template-certification.js";
 import { StorageService } from "./storage.js";
 const execFileAsync = promisify(execFile);
@@ -26,16 +27,16 @@ export class TemplateSourceAlreadyRegisteredError extends Error {
 }
 export class TemplateSourceService {
     certification = new TemplateCertificationService();
-    listSources(input) {
-        return database.listTemplateSources(input);
+    async listSources(input) {
+        return await serverlessRecords.listTemplateSources(input);
     }
-    listReleases(input) {
-        return database.listTemplateReleases(input);
+    async listReleases(input) {
+        return await serverlessRecords.listTemplateReleases(input);
     }
     async registerSource(input) {
         deriveTemplateRootDirFromModulePath(input.templateModulePath);
         const branch = input.branch ?? "production";
-        const existingByTemplateId = database.getTemplateSourceByTemplateId(input.templateId);
+        const existingByTemplateId = await serverlessRecords.getTemplateSourceByTemplateId(input.templateId);
         if (existingByTemplateId && existingByTemplateId.slugId !== input.slugId) {
             throw new TemplateSourceAlreadyRegisteredError({
                 message: `Template ${input.templateId} is already registered with slug ${existingByTemplateId.slugId}.`,
@@ -43,7 +44,7 @@ export class TemplateSourceService {
                 conflictField: "template_id"
             });
         }
-        const existingBySlugId = database.getTemplateSourceBySlugId(input.slugId);
+        const existingBySlugId = await serverlessRecords.getTemplateSourceBySlugId(input.slugId);
         if (existingBySlugId && existingBySlugId.templateId !== input.templateId) {
             throw new TemplateSourceAlreadyRegisteredError({
                 message: `Template slug ${input.slugId} is already registered to template ${existingBySlugId.templateId}.`,
@@ -51,7 +52,7 @@ export class TemplateSourceService {
                 conflictField: "slug_id"
             });
         }
-        const existingByLocation = database.getTemplateSourceByLocation(input.repoUrl, branch, input.templateModulePath);
+        const existingByLocation = await serverlessRecords.getTemplateSourceByLocation(input.repoUrl, branch, input.templateModulePath);
         if (existingByLocation &&
             (existingByLocation.templateId !== input.templateId || existingByLocation.slugId !== input.slugId)) {
             throw new TemplateSourceAlreadyRegisteredError({
@@ -72,7 +73,7 @@ export class TemplateSourceService {
                 existingSource.installCommand !== installCommand ||
                 existingSource.buildCommand !== buildCommand;
             const nextSource = metadataChanged
-                ? database.updateTemplateSource({
+                ? await serverlessRecords.updateTemplateSource({
                     id: existingSource.id,
                     repoUrl: input.repoUrl,
                     branch,
@@ -90,7 +91,7 @@ export class TemplateSourceService {
             };
         }
         try {
-            const source = database.createTemplateSource({
+            const source = await serverlessRecords.createTemplateSource({
                 id: createId("tsrc"),
                 templateId: input.templateId,
                 slugId: input.slugId,
@@ -109,9 +110,9 @@ export class TemplateSourceService {
             };
         }
         catch (error) {
-            const existingSource = database.getTemplateSourceByTemplateId(input.templateId) ??
-                database.getTemplateSourceBySlugId(input.slugId) ??
-                database.getTemplateSourceByLocation(input.repoUrl, branch, input.templateModulePath);
+            const existingSource = await serverlessRecords.getTemplateSourceByTemplateId(input.templateId) ??
+                await serverlessRecords.getTemplateSourceBySlugId(input.slugId) ??
+                await serverlessRecords.getTemplateSourceByLocation(input.repoUrl, branch, input.templateModulePath);
             if (existingSource) {
                 throw new TemplateSourceAlreadyRegisteredError({
                     message: `Template registration already exists with status ${existingSource.status}.`,
@@ -127,7 +128,7 @@ export class TemplateSourceService {
         }
     }
     async importRelease(input) {
-        const source = database.getTemplateSource(input.sourceId);
+        const source = await serverlessRecords.getTemplateSource(input.sourceId);
         if (!source) {
             throw new Error("Template source not found.");
         }
@@ -138,26 +139,42 @@ export class TemplateSourceService {
         const checkoutPath = path.join(config.TEMPLATE_SOURCE_ROOT, source.templateId, commitSha);
         const skillPath = path.join(checkoutPath, artifactManifest?.skill_path ?? source.skillPath);
         const authRepoUrl = this.resolveGitRemoteUrl(source.repoUrl);
-        if (!existsSync(checkoutPath)) {
+        const importReadyMarkerPath = path.join(checkoutPath, ".vidfarm-import-ready");
+        if (!existsSync(importReadyMarkerPath)) {
+            rmSync(checkoutPath, { recursive: true, force: true });
             mkdirSync(path.dirname(checkoutPath), { recursive: true });
-            if (artifactManifest) {
-                await this.extractArtifactToCheckout({
-                    checkoutPath,
-                    artifactKey: artifactManifest.artifact_key,
-                    expectedSha256: artifactManifest.artifact_sha256
-                });
-            }
-            else {
-                await this.runShell(["git", "clone", "--branch", source.branch, authRepoUrl, checkoutPath], process.cwd());
-                await this.runShell(["git", "checkout", commitSha], checkoutPath);
-            }
-            if (source.installCommand.trim()) {
-                await this.runCommandString(source.installCommand, checkoutPath);
+            try {
+                if (artifactManifest) {
+                    await this.extractArtifactToCheckout({
+                        checkoutPath,
+                        artifactKey: artifactManifest.artifact_key,
+                        expectedSha256: artifactManifest.artifact_sha256
+                    });
+                }
+                else {
+                    await this.runShell(["git", "clone", "--branch", source.branch, authRepoUrl, checkoutPath], process.cwd());
+                    await this.runShell(["git", "checkout", commitSha], checkoutPath);
+                }
+                if (source.installCommand.trim()) {
+                    await this.runCommandString(source.installCommand, checkoutPath);
+                }
+                if (source.buildCommand.trim()) {
+                    await this.runCommandString(source.buildCommand, checkoutPath);
+                }
+                writeFileSync(importReadyMarkerPath, JSON.stringify({
+                    source_id: source.id,
+                    template_id: source.templateId,
+                    commit_sha: commitSha,
+                    artifact_manifest_key: input.artifactManifestKey ?? null,
+                    imported_at: nowIso()
+                }, null, 2));
             }
-            if (source.buildCommand.trim()) {
-                await this.runCommandString(source.buildCommand, checkoutPath);
+            catch (error) {
+                rmSync(checkoutPath, { recursive: true, force: true });
+                throw error;
             }
         }
+        linkSharedNodeModules(checkoutPath);
         const modulePath = this.resolveImportableModulePath(checkoutPath, source.templateModulePath);
         const template = await loadTemplateFromModule(modulePath);
         if (template.id !== source.templateId) {
@@ -166,9 +183,14 @@ export class TemplateSourceService {
         if (template.slugId !== source.slugId) {
             throw new Error(`Imported template slug_id ${template.slugId} does not match source slug_id ${source.slugId}.`);
         }
-        const certificationReport = await this.certification.certify({ template, skillPath });
+        const certificationReport = await this.certification.certify({ template, skillPath, modulePath });
         const status = certificationReport.passed ? "pending_approval" : "failed";
-        return database.createTemplateRelease({
+        const runtimeArtifact = await this.createRuntimeArtifact({
+            source,
+            commitSha,
+            checkoutPath
+        });
+        const release = await serverlessRecords.createTemplateRelease({
             id: createId("trel"),
             sourceId: source.id,
             templateId: source.templateId,
@@ -177,15 +199,21 @@ export class TemplateSourceService {
             checkoutPath,
             skillPath,
             modulePath,
+            runtimeModulePath: path.relative(checkoutPath, modulePath).split(path.sep).join("/"),
             artifactManifestKey: input.artifactManifestKey ?? null,
             artifactKey: artifactManifest?.artifact_key ?? null,
+            runtimeArtifactKey: runtimeArtifact.key,
+            runtimeArtifactSha256: runtimeArtifact.sha256,
+            templateSnapshot: createTemplateReleaseSnapshot(template),
             status,
             certificationReport,
             activatedAt: null
         });
+        this.pruneCheckoutInstallArtifacts(checkoutPath);
+        return release;
     }
     async publishRelease(input) {
-        const source = database.getTemplateSource(input.sourceId);
+        const source = await serverlessRecords.getTemplateSource(input.sourceId);
         if (!source) {
             throw new Error("Template source not found.");
         }
@@ -196,7 +224,7 @@ export class TemplateSourceService {
         if (!trimmedCommitSha) {
             throw new Error("commit_sha is required.");
         }
-        const existingRelease = database.getTemplateReleaseBySourceAndCommit(source.id, trimmedCommitSha);
+        const existingRelease = await serverlessRecords.getTemplateReleaseBySourceAndCommit(source.id, trimmedCommitSha);
         if (existingRelease &&
             (existingRelease.status === "pending_approval"
                 || existingRelease.status === "approved"
@@ -218,7 +246,7 @@ export class TemplateSourceService {
         };
     }
     async publishArtifactRelease(input) {
-        const source = database.getTemplateSource(input.sourceId);
+        const source = await serverlessRecords.getTemplateSource(input.sourceId);
         if (!source) {
             throw new Error("Template source not found.");
         }
@@ -233,7 +261,7 @@ export class TemplateSourceService {
         if (!/^[0-9a-f]{64}$/i.test(trimmedArtifactSha256)) {
             throw new Error("artifact_sha256 must be a 64-character hexadecimal SHA-256 hash.");
         }
-        const existingRelease = database.getTemplateReleaseBySourceAndCommit(source.id, trimmedCommitSha);
+        const existingRelease = await serverlessRecords.getTemplateReleaseBySourceAndCommit(source.id, trimmedCommitSha);
         if (existingRelease &&
             (existingRelease.status === "pending_approval"
                 || existingRelease.status === "approved"
@@ -261,7 +289,7 @@ export class TemplateSourceService {
         };
     }
     async createDeveloperArtifactUpload(input) {
-        const source = database.getTemplateSource(input.sourceId);
+        const source = await serverlessRecords.getTemplateSource(input.sourceId);
         if (!source) {
             throw new Error("Template source not found.");
         }
@@ -275,7 +303,6 @@ export class TemplateSourceService {
         const artifact = this.buildArtifactKeys(source, trimmedCommitSha);
         const upload = await storage.createWriteUrl(artifact.artifactKey, {
             contentType: "application/gzip",
-            publicRead: false,
             expiresIn: 3600
         });
         return {
@@ -283,12 +310,12 @@ export class TemplateSourceService {
             upload
         };
     }
-    approveSource(input) {
-        const source = database.getTemplateSource(input.sourceId);
+    async approveSource(input) {
+        const source = await serverlessRecords.getTemplateSource(input.sourceId);
         if (!source) {
             throw new Error("Template source not found.");
         }
-        return database.updateTemplateSource({
+        return await serverlessRecords.updateTemplateSource({
             id: source.id,
             repoUrl: source.repoUrl,
             branch: source.branch,
@@ -299,12 +326,12 @@ export class TemplateSourceService {
             status: "approved"
         });
     }
-    rejectSource(input) {
-        const source = database.getTemplateSource(input.sourceId);
+    async rejectSource(input) {
+        const source = await serverlessRecords.getTemplateSource(input.sourceId);
         if (!source) {
             throw new Error("Template source not found.");
         }
-        return database.updateTemplateSource({
+        return await serverlessRecords.updateTemplateSource({
             id: source.id,
             repoUrl: source.repoUrl,
             branch: source.branch,
@@ -315,8 +342,8 @@ export class TemplateSourceService {
             status: "rejected"
         });
     }
-    approveRelease(input) {
-        const release = database.getTemplateRelease(input.releaseId);
+    async approveRelease(input) {
+        const release = await serverlessRecords.getTemplateRelease(input.releaseId);
         if (!release) {
             throw new Error("Template release not found.");
         }
@@ -326,58 +353,63 @@ export class TemplateSourceService {
         if (release.status === "active") {
             return release;
         }
-        database.updateTemplateReleaseStatus({
-            id: release.id,
+        await serverlessRecords.updateTemplateReleaseStatus({
+            releaseId: release.id,
             status: "approved",
             certificationReport: release.certificationReport,
             activatedAt: null
         });
-        return database.getTemplateRelease(release.id);
+        return await serverlessRecords.getTemplateRelease(release.id);
     }
-    rejectRelease(input) {
-        const release = database.getTemplateRelease(input.releaseId);
+    async rejectRelease(input) {
+        const release = await serverlessRecords.getTemplateRelease(input.releaseId);
         if (!release) {
             throw new Error("Template release not found.");
         }
-        database.updateTemplateReleaseStatus({
-            id: release.id,
+        await serverlessRecords.updateTemplateReleaseStatus({
+            releaseId: release.id,
             status: "rejected",
             certificationReport: release.certificationReport,
             activatedAt: null
         });
-        return database.getTemplateRelease(release.id);
+        return await serverlessRecords.getTemplateRelease(release.id);
     }
     async activateRelease(input) {
-        const release = database.getTemplateRelease(input.releaseId);
+        const release = await serverlessRecords.getTemplateRelease(input.releaseId);
         if (!release) {
             throw new Error("Template release not found.");
         }
         if (release.status !== "approved" && release.status !== "active") {
             throw new Error("Only approved releases can be activated.");
         }
-        const template = await loadTemplateFromModule(release.modulePath);
+        const template = release.runtimeArtifactKey
+            ? await loadTemplateFromRuntimeRelease(release)
+            : await loadTemplateFromModule(release.modulePath);
         const certificationReport = release.certificationReport ?? await this.certification.certify({
             template,
-            skillPath: release.skillPath
+            skillPath: release.skillPath,
+            modulePath: release.modulePath
         });
         if (!certificationReport.passed) {
-            database.updateTemplateReleaseStatus({
-                id: release.id,
+            await serverlessRecords.updateTemplateReleaseStatus({
+                releaseId: release.id,
                 status: "failed",
                 certificationReport
             });
             throw new Error("Template release failed certification and cannot be activated.");
         }
         await this.syncTemplateAboutAssets({ release, template });
-        database.clearActiveTemplateReleases(release.templateId);
-        database.updateTemplateReleaseStatus({
-            id: release.id,
+        await serverlessRecords.clearActiveTemplateReleases(release.templateId);
+        await serverlessRecords.updateTemplateReleaseStatus({
+            releaseId: release.id,
             status: "active",
             certificationReport,
             activatedAt: nowIso()
         });
+        const activeRelease = await serverlessRecords.getTemplateRelease(release.id);
+        await serverlessRecords.putActiveTemplateRelease(activeRelease);
         return {
-            release: database.getTemplateRelease(release.id),
+            release: activeRelease,
             template: {
                 ...template,
                 skillPath: release.skillPath
@@ -385,11 +417,11 @@ export class TemplateSourceService {
         };
     }
     async getSourceSyncStatus(sourceId) {
-        const source = database.getTemplateSource(sourceId);
+        const source = await serverlessRecords.getTemplateSource(sourceId);
         if (!source) {
             throw new Error("Template source not found.");
         }
-        const latestRelease = database.getLatestTemplateReleaseForSource(source.id);
+        const latestRelease = await serverlessRecords.getLatestTemplateReleaseForSource(source.id);
         try {
             const headCommitSha = await this.resolveBranchHead(source.repoUrl, source.branch);
             return {
@@ -419,22 +451,64 @@ export class TemplateSourceService {
         return line.split(/\s+/)[0];
     }
     async runShell(args, cwd) {
-        await execFileAsync(args[0], args.slice(1), { cwd });
+        try {
+            await execFileAsync(args[0], args.slice(1), { cwd });
+        }
+        catch (error) {
+            throw new Error(formatCommandFailure(args.join(" "), cwd, error));
+        }
     }
     async runCommandString(command, cwd) {
-        await execFileAsync("/bin/sh", ["-lc", command], {
-            cwd,
-            env: {
-                ...process.env,
-                NODE_ENV: "development",
-                npm_config_production: "false",
-                NPM_CONFIG_PRODUCTION: "false",
-                NPM_CONFIG_INCLUDE: "dev"
-            }
-        });
+        const scratchDir = path.join(config.TEMPLATE_SOURCE_ROOT, ".command-scratch", createId("cmd"));
+        const homeDir = path.join(scratchDir, "home");
+        const npmCacheDir = path.join(scratchDir, "npm-cache");
+        const tempDir = path.join(scratchDir, "tmp");
+        mkdirSync(homeDir, { recursive: true });
+        mkdirSync(npmCacheDir, { recursive: true });
+        mkdirSync(tempDir, { recursive: true });
+        rmSync(path.join(config.TEMPLATE_SOURCE_ROOT, "npm-cache"), { recursive: true, force: true });
+        try {
+            await execFileAsync("/bin/sh", ["-lc", command], {
+                cwd,
+                env: {
+                    ...process.env,
+                    HOME: homeDir,
+                    TMPDIR: tempDir,
+                    TMP: tempDir,
+                    TEMP: tempDir,
+                    npm_config_cache: npmCacheDir,
+                    NPM_CONFIG_CACHE: npmCacheDir,
+                    npm_config_tmp: tempDir,
+                    NPM_CONFIG_TMP: tempDir,
+                    npm_config_audit: "false",
+                    NPM_CONFIG_AUDIT: "false",
+                    npm_config_fund: "false",
+                    NPM_CONFIG_FUND: "false",
+                    npm_config_progress: "false",
+                    NPM_CONFIG_PROGRESS: "false",
+                    npm_config_update_notifier: "false",
+                    NPM_CONFIG_UPDATE_NOTIFIER: "false",
+                    npm_config_loglevel: "warn",
+                    NPM_CONFIG_LOGLEVEL: "warn",
+                    NODE_ENV: "development",
+                    npm_config_production: "false",
+                    NPM_CONFIG_PRODUCTION: "false",
+                    NPM_CONFIG_INCLUDE: "dev"
+                }
+            });
+        }
+        catch (error) {
+            throw new Error(formatCommandFailure(command, cwd, error));
+        }
+        finally {
+            rmSync(scratchDir, { recursive: true, force: true });
+        }
     }
     async syncTemplateAboutAssets(input) {
-        const entries = Array.from(new Set(input.template.about.preview_media
+        const entries = Array.from(new Set([
+            ...input.template.about.preview_media,
+            ...input.template.examples.flatMap((example) => example.map((entry) => entry.media_url))
+        ]
             .filter((entry) => !/^https?:\/\//i.test(entry))
             .filter((entry) => !entry.replace(/^\/+/, "").startsWith("templates/"))));
         for (const entry of entries) {
@@ -535,14 +609,25 @@ export class TemplateSourceService {
             throw new Error(`Template artifact hash mismatch for ${input.artifactKey}.`);
         }
         mkdirSync(input.checkoutPath, { recursive: true });
-        const tempArchivePath = path.join(os.tmpdir(), `vidfarm-template-${createId("tmp")}.tar.gz`);
-        writeFileSync(tempArchivePath, archive);
-        try {
-            await execFileAsync("tar", ["-xzf", tempArchivePath, "-C", input.checkoutPath], { cwd: process.cwd() });
-        }
-        finally {
-            rmSync(tempArchivePath, { force: true });
-        }
+        extractTarGzBuffer(archive, input.checkoutPath);
+    }
+    async createRuntimeArtifact(input) {
+        const runtimeKey = `template-runtime-artifacts/${input.source.templateId}/${input.commitSha}/runtime.tar.gz`;
+        const buffer = createTarGzFromDirectory(input.checkoutPath, (relativePath) => {
+            return hasPathSegment(relativePath, "node_modules")
+                || hasPathSegment(relativePath, ".git")
+                || hasPathSegment(relativePath, ".next")
+                || hasPathSegment(relativePath, ".turbo")
+                || relativePath === "dist/.tsbuildinfo"
+                || relativePath.endsWith("/dist/.tsbuildinfo")
+                || relativePath === ".vidfarm-import-ready";
+        });
+        const sha256 = createHash("sha256").update(buffer).digest("hex");
+        await storage.putBuffer(runtimeKey, buffer, "application/gzip");
+        return {
+            key: runtimeKey,
+            sha256
+        };
     }
     serializeArtifactManifestPayload(input) {
         return JSON.stringify({
@@ -626,6 +711,45 @@ export class TemplateSourceService {
         }
         throw new Error(`Template module path ${declaredModulePath} was not found in the imported release.`);
     }
+    pruneCheckoutInstallArtifacts(checkoutPath) {
+        removeNestedDirectories(checkoutPath, new Set(["node_modules"]));
+        linkSharedNodeModules(checkoutPath);
+    }
+}
+export function createTemplateReleaseSnapshot(template) {
+    return {
+        id: template.id,
+        slugId: template.slugId,
+        version: template.version,
+        about: {
+            title: template.about.title,
+            description: template.about.description,
+            difficulty: template.about.difficulty,
+            viral_dna: template.about.viral_dna,
+            visual_dna: template.about.visual_dna,
+            preview_media: [...template.about.preview_media],
+            link_to_original: template.about.link_to_original,
+            links_to_inspiration: [...template.about.links_to_inspiration],
+            sound: {
+                sound_title: template.about.sound.sound_title,
+                sound_url: template.about.sound.sound_url
+            },
+            proposal_generator: template.about.proposal_generator,
+            skeleton_prompt: template.about.skeleton_prompt,
+            sample_prompts: [...template.about.sample_prompts]
+        },
+        examples: template.examples.map((example) => example.map((entry) => ({
+            media_url: entry.media_url,
+            note: entry.note
+        }))),
+        operations: Object.entries(template.operations).map(([name, operation]) => ({
+            name,
+            description: operation.description,
+            workflow: operation.workflow,
+            providerHint: operation.providerHint ?? null,
+            webhookSupport: operation.webhookSupport ?? null
+        }))
+    };
 }
 function inferContentType(filePath) {
     switch (path.extname(filePath).toLowerCase()) {
@@ -650,3 +774,244 @@ function inferContentType(filePath) {
             return "application/octet-stream";
     }
 }
+function hasPathSegment(relativePath, segment) {
+    return relativePath.split("/").includes(segment);
+}
+function removeNestedDirectories(rootDir, directoryNames) {
+    if (!existsSync(rootDir)) {
+        return;
+    }
+    for (const entryName of readdirSync(rootDir)) {
+        const absolutePath = path.join(rootDir, entryName);
+        const stat = statSync(absolutePath);
+        if (!stat.isDirectory()) {
+            continue;
+        }
+        if (directoryNames.has(entryName)) {
+            rmSync(absolutePath, { recursive: true, force: true });
+            continue;
+        }
+        removeNestedDirectories(absolutePath, directoryNames);
+    }
+}
+function linkSharedNodeModules(checkoutPath) {
+    const target = path.resolve(process.env.LAMBDA_TASK_ROOT ?? process.cwd(), "node_modules");
+    const linkPath = path.join(checkoutPath, "node_modules");
+    if (!existsSync(target) || existsSync(linkPath)) {
+        return;
+    }
+    symlinkSync(target, linkPath, "dir");
+}
+function formatCommandFailure(command, cwd, error) {
+    const details = childProcessFailureDetails(error);
+    const diskHint = /\bENOSPC\b|no space left on device/i.test(details)
+        ? " The command ran out of writable temporary storage; Vidfarm cleaned the partial checkout and npm scratch cache before returning this error."
+        : "";
+    return `Template import command failed: ${sanitizeSensitiveText(command)} (cwd: ${cwd}).${diskHint}${details ? `\n${details}` : ""}`;
+}
+function childProcessFailureDetails(error) {
+    if (!(error instanceof Error)) {
+        return String(error);
+    }
+    const childError = error;
+    const parts = [
+        sanitizeSensitiveText(childError.message),
+        childError.code == null ? "" : `exit/code: ${String(childError.code)}`,
+        childError.signal == null ? "" : `signal: ${childError.signal}`,
+        childError.stderr ? `stderr:\n${truncateCommandOutput(childError.stderr)}` : "",
+        childError.stdout ? `stdout:\n${truncateCommandOutput(childError.stdout)}` : ""
+    ].filter(Boolean);
+    return parts.join("\n");
+}
+function truncateCommandOutput(value) {
+    const text = Buffer.isBuffer(value) ? value.toString("utf8") : value;
+    const trimmed = sanitizeSensitiveText(text.trim());
+    return trimmed.length > 4_000 ? `${trimmed.slice(0, 4_000)}\n[output truncated]` : trimmed;
+}
+function sanitizeSensitiveText(value) {
+    return value
+        .replace(/https:\/\/x-access-token:[^@\s]+@github\.com\//gi, "https://x-access-token:[redacted]@github.com/")
+        .replace(/([?&](?:token|access_token|api_key|key|secret)=)[^&\s]+/gi, "$1[redacted]");
+}
+function extractTarGzBuffer(archive, outputDir) {
+    const tar = gunzipSync(archive);
+    let offset = 0;
+    let nextPath = null;
+    while (offset + 512 <= tar.length) {
+        const header = tar.subarray(offset, offset + 512);
+        offset += 512;
+        if (header.every((byte) => byte === 0)) {
+            break;
+        }
+        const rawName = readTarString(header, 0, 100);
+        const prefix = readTarString(header, 345, 155);
+        const headerPath = [prefix, rawName].filter(Boolean).join("/");
+        const size = readTarOctal(header, 124, 12);
+        const typeFlag = readTarString(header, 156, 1) || "0";
+        const body = tar.subarray(offset, offset + size);
+        offset += Math.ceil(size / 512) * 512;
+        if (typeFlag === "x") {
+            nextPath = readPaxPath(body) ?? nextPath;
+            continue;
+        }
+        if (typeFlag === "g") {
+            continue;
+        }
+        if (typeFlag === "L") {
+            nextPath = body.toString("utf8").replace(/\0.*$/u, "");
+            continue;
+        }
+        const fullName = nextPath ?? headerPath;
+        nextPath = null;
+        if (!fullName || fullName === ".") {
+            continue;
+        }
+        const outputPath = resolveTarOutputPath(outputDir, fullName);
+        if (!outputPath) {
+            continue;
+        }
+        if (typeFlag === "5") {
+            mkdirSync(outputPath, { recursive: true });
+            continue;
+        }
+        if (typeFlag === "2") {
+            continue;
+        }
+        if (typeFlag !== "0" && typeFlag !== "") {
+            continue;
+        }
+        mkdirSync(path.dirname(outputPath), { recursive: true });
+        writeFileSync(outputPath, body);
+    }
+}
+function createTarGzFromDirectory(rootDir, shouldExclude) {
+    const chunks = [];
+    for (const entry of listTarEntries(rootDir, "", shouldExclude)) {
+        const stat = statSync(entry.absolutePath);
+        const archivePath = entry.relativePath;
+        if (stat.isDirectory()) {
+            chunks.push(createTarHeader(`${archivePath.replace(/\/+$/u, "")}/`, 0, "5", stat.mtime));
+            continue;
+        }
+        if (!stat.isFile()) {
+            continue;
+        }
+        const body = readFileSync(entry.absolutePath);
+        chunks.push(createTarHeader(archivePath, body.length, "0", stat.mtime));
+        chunks.push(body);
+        const padding = body.length % 512;
+        if (padding) {
+            chunks.push(Buffer.alloc(512 - padding));
+        }
+    }
+    chunks.push(Buffer.alloc(1024));
+    return gzipSync(Buffer.concat(chunks));
+}
+function listTarEntries(rootDir, relativeDir, shouldExclude) {
+    const directory = path.join(rootDir, relativeDir);
+    const entries = [];
+    for (const name of readdirSync(directory).sort()) {
+        const relativePath = path.posix.join(relativeDir.split(path.sep).join("/"), name);
+        if (shouldExclude(relativePath)) {
+            continue;
+        }
+        const absolutePath = path.join(rootDir, relativePath);
+        const stat = statSync(absolutePath);
+        entries.push({ absolutePath, relativePath });
+        if (stat.isDirectory()) {
+            entries.push(...listTarEntries(rootDir, relativePath, shouldExclude));
+        }
+    }
+    return entries;
+}
+function createTarHeader(name, size, typeFlag, mtime) {
+    const header = Buffer.alloc(512);
+    const { namePart, prefixPart } = splitTarPath(name);
+    writeTarString(header, namePart, 0, 100);
+    writeTarOctal(header, typeFlag === "5" ? 0o755 : 0o644, 100, 8);
+    writeTarOctal(header, 0, 108, 8);
+    writeTarOctal(header, 0, 116, 8);
+    writeTarOctal(header, size, 124, 12);
+    writeTarOctal(header, Math.floor(mtime.getTime() / 1000), 136, 12);
+    header.fill(0x20, 148, 156);
+    writeTarString(header, typeFlag, 156, 1);
+    writeTarString(header, "ustar", 257, 6);
+    writeTarString(header, "00", 263, 2);
+    writeTarString(header, prefixPart, 345, 155);
+    let checksum = 0;
+    for (const byte of header) {
+        checksum += byte;
+    }
+    const checksumText = checksum.toString(8).padStart(6, "0");
+    writeTarString(header, `${checksumText}\0 `, 148, 8);
+    return header;
+}
+function splitTarPath(input) {
+    const normalized = input.replace(/^\.?\//u, "");
+    if (Buffer.byteLength(normalized) <= 100) {
+        return { namePart: normalized, prefixPart: "" };
+    }
+    const parts = normalized.split("/");
+    for (let index = 1; index < parts.length; index += 1) {
+        const prefixPart = parts.slice(0, index).join("/");
+        const namePart = parts.slice(index).join("/");
+        if (Buffer.byteLength(prefixPart) <= 155 && Buffer.byteLength(namePart) <= 100) {
+            return { namePart, prefixPart };
+        }
+    }
+    throw new Error(`Template runtime artifact path is too long for ustar: ${input}`);
+}
+function readPaxPath(body) {
+    const text = body.toString("utf8");
+    let offset = 0;
+    while (offset < text.length) {
+        const spaceIndex = text.indexOf(" ", offset);
+        if (spaceIndex === -1) {
+            break;
+        }
+        const length = Number.parseInt(text.slice(offset, spaceIndex), 10);
+        if (!Number.isFinite(length) || length <= 0) {
+            break;
+        }
+        const record = text.slice(spaceIndex + 1, offset + length).replace(/\n$/u, "");
+        const equalsIndex = record.indexOf("=");
+        if (equalsIndex !== -1 && record.slice(0, equalsIndex) === "path") {
+            return record.slice(equalsIndex + 1);
+        }
+        offset += length;
+    }
+    return null;
+}
+function resolveTarOutputPath(rootDir, entryPath) {
+    const normalized = entryPath.replace(/^\.?\//u, "");
+    if (!normalized || normalized.startsWith("/") || normalized.includes("..")) {
+        return null;
+    }
+    const outputPath = path.resolve(rootDir, normalized);
+    const root = path.resolve(rootDir);
+    if (outputPath !== root && !outputPath.startsWith(`${root}${path.sep}`)) {
+        return null;
+    }
+    return outputPath;
+}
+function readTarString(buffer, offset, length) {
+    return buffer
+        .subarray(offset, offset + length)
+        .toString("utf8")
+        .replace(/\0.*$/u, "")
+        .trim();
+}
+function readTarOctal(buffer, offset, length) {
+    return Number.parseInt(readTarString(buffer, offset, length) || "0", 8) || 0;
+}
+function writeTarString(buffer, value, offset, length) {
+    const bytes = Buffer.from(value, "utf8");
+    if (bytes.length > length) {
+        throw new Error(`Tar header value is too long: ${value}`);
+    }
+    bytes.copy(buffer, offset, 0, bytes.length);
+}
+function writeTarOctal(buffer, value, offset, length) {
+    writeTarString(buffer, value.toString(8).padStart(length - 1, "0"), offset, length - 1);
+}
+//# sourceMappingURL=template-sources.js.map