@mevdragon/vidfarm-devcli 0.5.3 → 0.6.0

package/dist/src/services/template-sources.js

@@ -0,0 +1,1017 @@
+import { createHash, createHmac } from "node:crypto";
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { gunzipSync, gzipSync } from "node:zlib";
+import { config } from "../config.js";
+import { serverlessRecords } from "./serverless-records.js";
+import { createId } from "../lib/ids.js";
+import { defaultSkillPathForTemplateModule, deriveTemplateRootDirFromModulePath } from "../lib/template-paths.js";
+import { nowIso } from "../lib/time.js";
+import { loadTemplateFromModule } from "./template-loader.js";
+import { loadTemplateFromRuntimeRelease } from "./template-runtime-bundles.js";
+import { TemplateCertificationService } from "./template-certification.js";
+import { StorageService } from "./storage.js";
+const execFileAsync = promisify(execFile);
+const storage = new StorageService();
+export class TemplateSourceAlreadyRegisteredError extends Error {
+    existingSource;
+    conflictField;
+    constructor(input) {
+        super(input.message);
+        this.name = "TemplateSourceAlreadyRegisteredError";
+        this.existingSource = input.existingSource;
+        this.conflictField = input.conflictField;
+    }
+}
+export class TemplateSourceService {
+    certification = new TemplateCertificationService();
+    async listSources(input) {
+        return await serverlessRecords.listTemplateSources(input);
+    }
+    async listReleases(input) {
+        return await serverlessRecords.listTemplateReleases(input);
+    }
+    async registerSource(input) {
+        deriveTemplateRootDirFromModulePath(input.templateModulePath);
+        const branch = input.branch ?? "production";
+        const existingByTemplateId = await serverlessRecords.getTemplateSourceByTemplateId(input.templateId);
+        if (existingByTemplateId && existingByTemplateId.slugId !== input.slugId) {
+            throw new TemplateSourceAlreadyRegisteredError({
+                message: `Template ${input.templateId} is already registered with slug ${existingByTemplateId.slugId}.`,
+                existingSource: existingByTemplateId,
+                conflictField: "template_id"
+            });
+        }
+        const existingBySlugId = await serverlessRecords.getTemplateSourceBySlugId(input.slugId);
+        if (existingBySlugId && existingBySlugId.templateId !== input.templateId) {
+            throw new TemplateSourceAlreadyRegisteredError({
+                message: `Template slug ${input.slugId} is already registered to template ${existingBySlugId.templateId}.`,
+                existingSource: existingBySlugId,
+                conflictField: "slug_id"
+            });
+        }
+        const existingByLocation = await serverlessRecords.getTemplateSourceByLocation(input.repoUrl, branch, input.templateModulePath);
+        if (existingByLocation &&
+            (existingByLocation.templateId !== input.templateId || existingByLocation.slugId !== input.slugId)) {
+            throw new TemplateSourceAlreadyRegisteredError({
+                message: `Template source ${input.repoUrl}#${branch}:${input.templateModulePath} is already registered to ${existingByLocation.templateId}/${existingByLocation.slugId}.`,
+                existingSource: existingByLocation,
+                conflictField: "source_location"
+            });
+        }
+        const existingSource = existingByTemplateId ?? existingBySlugId ?? existingByLocation ?? null;
+        const installCommand = input.installCommand ?? "npm install";
+        const buildCommand = input.buildCommand ?? "npm run build";
+        const skillPath = input.skillPath ?? defaultSkillPathForTemplateModule(input.templateModulePath);
+        if (existingSource) {
+            const metadataChanged = existingSource.repoUrl !== input.repoUrl ||
+                existingSource.branch !== branch ||
+                existingSource.templateModulePath !== input.templateModulePath ||
+                existingSource.skillPath !== skillPath ||
+                existingSource.installCommand !== installCommand ||
+                existingSource.buildCommand !== buildCommand;
+            const nextSource = metadataChanged
+                ? await serverlessRecords.updateTemplateSource({
+                    id: existingSource.id,
+                    repoUrl: input.repoUrl,
+                    branch,
+                    templateModulePath: input.templateModulePath,
+                    skillPath,
+                    installCommand,
+                    buildCommand,
+                    status: existingSource.status === "disabled" ? "disabled" : "pending_review"
+                })
+                : existingSource;
+            return {
+                source: nextSource,
+                action: nextSource.updatedAt === existingSource.updatedAt ? "unchanged" : "updated",
+                sync: await this.getSourceSyncStatus(nextSource.id)
+            };
+        }
+        try {
+            const source = await serverlessRecords.createTemplateSource({
+                id: createId("tsrc"),
+                templateId: input.templateId,
+                slugId: input.slugId,
+                repoUrl: input.repoUrl,
+                branch,
+                templateModulePath: input.templateModulePath,
+                skillPath,
+                installCommand,
+                buildCommand,
+                status: "pending_review"
+            });
+            return {
+                source,
+                action: "created",
+                sync: await this.getSourceSyncStatus(source.id)
+            };
+        }
+        catch (error) {
+            const existingSource = await serverlessRecords.getTemplateSourceByTemplateId(input.templateId) ??
+                await serverlessRecords.getTemplateSourceBySlugId(input.slugId) ??
+                await serverlessRecords.getTemplateSourceByLocation(input.repoUrl, branch, input.templateModulePath);
+            if (existingSource) {
+                throw new TemplateSourceAlreadyRegisteredError({
+                    message: `Template registration already exists with status ${existingSource.status}.`,
+                    existingSource,
+                    conflictField: existingSource.templateId === input.templateId
+                        ? "template_id"
+                        : existingSource.slugId === input.slugId
+                            ? "slug_id"
+                            : "source_location"
+                });
+            }
+            throw error;
+        }
+    }
+    async importRelease(input) {
+        const source = await serverlessRecords.getTemplateSource(input.sourceId);
+        if (!source) {
+            throw new Error("Template source not found.");
+        }
+        const artifactManifest = input.artifactManifestKey
+            ? await this.loadAndVerifyArtifactManifest(input.artifactManifestKey, source)
+            : null;
+        const commitSha = artifactManifest?.commit_sha ?? input.commitSha ?? await this.resolveBranchHead(source.repoUrl, source.branch);
+        const checkoutPath = path.join(config.TEMPLATE_SOURCE_ROOT, source.templateId, commitSha);
+        const skillPath = path.join(checkoutPath, artifactManifest?.skill_path ?? source.skillPath);
+        const authRepoUrl = this.resolveGitRemoteUrl(source.repoUrl);
+        const importReadyMarkerPath = path.join(checkoutPath, ".vidfarm-import-ready");
+        if (!existsSync(importReadyMarkerPath)) {
+            rmSync(checkoutPath, { recursive: true, force: true });
+            mkdirSync(path.dirname(checkoutPath), { recursive: true });
+            try {
+                if (artifactManifest) {
+                    await this.extractArtifactToCheckout({
+                        checkoutPath,
+                        artifactKey: artifactManifest.artifact_key,
+                        expectedSha256: artifactManifest.artifact_sha256
+                    });
+                }
+                else {
+                    await this.runShell(["git", "clone", "--branch", source.branch, authRepoUrl, checkoutPath], process.cwd());
+                    await this.runShell(["git", "checkout", commitSha], checkoutPath);
+                }
+                if (source.installCommand.trim()) {
+                    await this.runCommandString(source.installCommand, checkoutPath);
+                }
+                if (source.buildCommand.trim()) {
+                    await this.runCommandString(source.buildCommand, checkoutPath);
+                }
+                writeFileSync(importReadyMarkerPath, JSON.stringify({
+                    source_id: source.id,
+                    template_id: source.templateId,
+                    commit_sha: commitSha,
+                    artifact_manifest_key: input.artifactManifestKey ?? null,
+                    imported_at: nowIso()
+                }, null, 2));
+            }
+            catch (error) {
+                rmSync(checkoutPath, { recursive: true, force: true });
+                throw error;
+            }
+        }
+        linkSharedNodeModules(checkoutPath);
+        const modulePath = this.resolveImportableModulePath(checkoutPath, source.templateModulePath);
+        const template = await loadTemplateFromModule(modulePath);
+        if (template.id !== source.templateId) {
+            throw new Error(`Imported template id ${template.id} does not match source template id ${source.templateId}.`);
+        }
+        if (template.slugId !== source.slugId) {
+            throw new Error(`Imported template slug_id ${template.slugId} does not match source slug_id ${source.slugId}.`);
+        }
+        const certificationReport = await this.certification.certify({ template, skillPath, modulePath });
+        const status = certificationReport.passed ? "pending_approval" : "failed";
+        const runtimeArtifact = await this.createRuntimeArtifact({
+            source,
+            commitSha,
+            checkoutPath
+        });
+        const release = await serverlessRecords.createTemplateRelease({
+            id: createId("trel"),
+            sourceId: source.id,
+            templateId: source.templateId,
+            branch: source.branch,
+            commitSha,
+            checkoutPath,
+            skillPath,
+            modulePath,
+            runtimeModulePath: path.relative(checkoutPath, modulePath).split(path.sep).join("/"),
+            artifactManifestKey: input.artifactManifestKey ?? null,
+            artifactKey: artifactManifest?.artifact_key ?? null,
+            runtimeArtifactKey: runtimeArtifact.key,
+            runtimeArtifactSha256: runtimeArtifact.sha256,
+            templateSnapshot: createTemplateReleaseSnapshot(template),
+            status,
+            certificationReport,
+            activatedAt: null
+        });
+        this.pruneCheckoutInstallArtifacts(checkoutPath);
+        return release;
+    }
+    async publishRelease(input) {
+        const source = await serverlessRecords.getTemplateSource(input.sourceId);
+        if (!source) {
+            throw new Error("Template source not found.");
+        }
+        if (source.status !== "approved") {
+            throw new Error("Template source must be approved before a developer can publish an update.");
+        }
+        const trimmedCommitSha = input.commitSha.trim();
+        if (!trimmedCommitSha) {
+            throw new Error("commit_sha is required.");
+        }
+        const existingRelease = await serverlessRecords.getTemplateReleaseBySourceAndCommit(source.id, trimmedCommitSha);
+        if (existingRelease &&
+            (existingRelease.status === "pending_approval"
+                || existingRelease.status === "approved"
+                || existingRelease.status === "active")) {
+            return {
+                source,
+                release: existingRelease,
+                publishAction: "updated"
+            };
+        }
+        const release = await this.importRelease({
+            sourceId: source.id,
+            commitSha: trimmedCommitSha
+        });
+        return {
+            source,
+            release,
+            publishAction: existingRelease ? "updated" : "created"
+        };
+    }
+    async publishArtifactRelease(input) {
+        const source = await serverlessRecords.getTemplateSource(input.sourceId);
+        if (!source) {
+            throw new Error("Template source not found.");
+        }
+        if (source.status !== "approved") {
+            throw new Error("Template source must be approved before a developer can publish an update.");
+        }
+        const trimmedCommitSha = input.commitSha.trim();
+        const trimmedArtifactSha256 = input.artifactSha256.trim().toLowerCase();
+        if (!trimmedCommitSha) {
+            throw new Error("commit_sha is required.");
+        }
+        if (!/^[0-9a-f]{64}$/i.test(trimmedArtifactSha256)) {
+            throw new Error("artifact_sha256 must be a 64-character hexadecimal SHA-256 hash.");
+        }
+        const existingRelease = await serverlessRecords.getTemplateReleaseBySourceAndCommit(source.id, trimmedCommitSha);
+        if (existingRelease &&
+            (existingRelease.status === "pending_approval"
+                || existingRelease.status === "approved"
+                || existingRelease.status === "active")) {
+            return {
+                source,
+                release: existingRelease,
+                publishAction: "updated"
+            };
+        }
+        const { manifestKey } = await this.createSignedArtifactManifest({
+            source,
+            commitSha: trimmedCommitSha,
+            artifactSha256: trimmedArtifactSha256,
+            signedBy: input.signedBy
+        });
+        const release = await this.importRelease({
+            sourceId: source.id,
+            artifactManifestKey: manifestKey
+        });
+        return {
+            source,
+            release,
+            publishAction: existingRelease ? "updated" : "created"
+        };
+    }
+    async createDeveloperArtifactUpload(input) {
+        const source = await serverlessRecords.getTemplateSource(input.sourceId);
+        if (!source) {
+            throw new Error("Template source not found.");
+        }
+        if (source.status !== "approved") {
+            throw new Error("Template source must be approved before a developer can publish an update.");
+        }
+        const trimmedCommitSha = input.commitSha.trim();
+        if (!trimmedCommitSha) {
+            throw new Error("commit_sha is required.");
+        }
+        const artifact = this.buildArtifactKeys(source, trimmedCommitSha);
+        const upload = await storage.createWriteUrl(artifact.artifactKey, {
+            contentType: "application/gzip",
+            expiresIn: 3600
+        });
+        return {
+            ...artifact,
+            upload
+        };
+    }
+    async approveSource(input) {
+        const source = await serverlessRecords.getTemplateSource(input.sourceId);
+        if (!source) {
+            throw new Error("Template source not found.");
+        }
+        return await serverlessRecords.updateTemplateSource({
+            id: source.id,
+            repoUrl: source.repoUrl,
+            branch: source.branch,
+            templateModulePath: source.templateModulePath,
+            skillPath: source.skillPath,
+            installCommand: source.installCommand,
+            buildCommand: source.buildCommand,
+            status: "approved"
+        });
+    }
+    async rejectSource(input) {
+        const source = await serverlessRecords.getTemplateSource(input.sourceId);
+        if (!source) {
+            throw new Error("Template source not found.");
+        }
+        return await serverlessRecords.updateTemplateSource({
+            id: source.id,
+            repoUrl: source.repoUrl,
+            branch: source.branch,
+            templateModulePath: source.templateModulePath,
+            skillPath: source.skillPath,
+            installCommand: source.installCommand,
+            buildCommand: source.buildCommand,
+            status: "rejected"
+        });
+    }
+    async approveRelease(input) {
+        const release = await serverlessRecords.getTemplateRelease(input.releaseId);
+        if (!release) {
+            throw new Error("Template release not found.");
+        }
+        if (release.status !== "pending_approval" && release.status !== "approved" && release.status !== "active") {
+            throw new Error("Only pending-approval releases can be approved.");
+        }
+        if (release.status === "active") {
+            return release;
+        }
+        await serverlessRecords.updateTemplateReleaseStatus({
+            releaseId: release.id,
+            status: "approved",
+            certificationReport: release.certificationReport,
+            activatedAt: null
+        });
+        return await serverlessRecords.getTemplateRelease(release.id);
+    }
+    async rejectRelease(input) {
+        const release = await serverlessRecords.getTemplateRelease(input.releaseId);
+        if (!release) {
+            throw new Error("Template release not found.");
+        }
+        await serverlessRecords.updateTemplateReleaseStatus({
+            releaseId: release.id,
+            status: "rejected",
+            certificationReport: release.certificationReport,
+            activatedAt: null
+        });
+        return await serverlessRecords.getTemplateRelease(release.id);
+    }
+    async activateRelease(input) {
+        const release = await serverlessRecords.getTemplateRelease(input.releaseId);
+        if (!release) {
+            throw new Error("Template release not found.");
+        }
+        if (release.status !== "approved" && release.status !== "active") {
+            throw new Error("Only approved releases can be activated.");
+        }
+        const template = release.runtimeArtifactKey
+            ? await loadTemplateFromRuntimeRelease(release)
+            : await loadTemplateFromModule(release.modulePath);
+        const certificationReport = release.certificationReport ?? await this.certification.certify({
+            template,
+            skillPath: release.skillPath,
+            modulePath: release.modulePath
+        });
+        if (!certificationReport.passed) {
+            await serverlessRecords.updateTemplateReleaseStatus({
+                releaseId: release.id,
+                status: "failed",
+                certificationReport
+            });
+            throw new Error("Template release failed certification and cannot be activated.");
+        }
+        await this.syncTemplateAboutAssets({ release, template });
+        await serverlessRecords.clearActiveTemplateReleases(release.templateId);
+        await serverlessRecords.updateTemplateReleaseStatus({
+            releaseId: release.id,
+            status: "active",
+            certificationReport,
+            activatedAt: nowIso()
+        });
+        const activeRelease = await serverlessRecords.getTemplateRelease(release.id);
+        await serverlessRecords.putActiveTemplateRelease(activeRelease);
+        return {
+            release: activeRelease,
+            template: {
+                ...template,
+                skillPath: release.skillPath
+            }
+        };
+    }
+    async getSourceSyncStatus(sourceId) {
+        const source = await serverlessRecords.getTemplateSource(sourceId);
+        if (!source) {
+            throw new Error("Template source not found.");
+        }
+        const latestRelease = await serverlessRecords.getLatestTemplateReleaseForSource(source.id);
+        try {
+            const headCommitSha = await this.resolveBranchHead(source.repoUrl, source.branch);
+            return {
+                headCommitSha,
+                latestReleaseCommitSha: latestRelease?.commitSha ?? null,
+                importTargetCommitSha: headCommitSha,
+                hasUnimportedUpdate: latestRelease ? latestRelease.commitSha !== headCommitSha : true,
+                headLookupError: null
+            };
+        }
+        catch (error) {
+            return {
+                headCommitSha: null,
+                latestReleaseCommitSha: latestRelease?.commitSha ?? null,
+                importTargetCommitSha: latestRelease?.commitSha ?? null,
+                hasUnimportedUpdate: null,
+                headLookupError: error instanceof Error ? error.message : String(error)
+            };
+        }
+    }
+    async resolveBranchHead(repoUrl, branch) {
+        const { stdout } = await execFileAsync("git", ["ls-remote", this.resolveGitRemoteUrl(repoUrl), branch], { cwd: process.cwd() });
+        const line = stdout.trim().split("\n").find(Boolean);
+        if (!line) {
+            throw new Error(`Unable to resolve branch ${branch} for ${repoUrl}`);
+        }
+        return line.split(/\s+/)[0];
+    }
+    async runShell(args, cwd) {
+        try {
+            await execFileAsync(args[0], args.slice(1), { cwd });
+        }
+        catch (error) {
+            throw new Error(formatCommandFailure(args.join(" "), cwd, error));
+        }
+    }
+    async runCommandString(command, cwd) {
+        const scratchDir = path.join(config.TEMPLATE_SOURCE_ROOT, ".command-scratch", createId("cmd"));
+        const homeDir = path.join(scratchDir, "home");
+        const npmCacheDir = path.join(scratchDir, "npm-cache");
+        const tempDir = path.join(scratchDir, "tmp");
+        mkdirSync(homeDir, { recursive: true });
+        mkdirSync(npmCacheDir, { recursive: true });
+        mkdirSync(tempDir, { recursive: true });
+        rmSync(path.join(config.TEMPLATE_SOURCE_ROOT, "npm-cache"), { recursive: true, force: true });
+        try {
+            await execFileAsync("/bin/sh", ["-lc", command], {
+                cwd,
+                env: {
+                    ...process.env,
+                    HOME: homeDir,
+                    TMPDIR: tempDir,
+                    TMP: tempDir,
+                    TEMP: tempDir,
+                    npm_config_cache: npmCacheDir,
+                    NPM_CONFIG_CACHE: npmCacheDir,
+                    npm_config_tmp: tempDir,
+                    NPM_CONFIG_TMP: tempDir,
+                    npm_config_audit: "false",
+                    NPM_CONFIG_AUDIT: "false",
+                    npm_config_fund: "false",
+                    NPM_CONFIG_FUND: "false",
+                    npm_config_progress: "false",
+                    NPM_CONFIG_PROGRESS: "false",
+                    npm_config_update_notifier: "false",
+                    NPM_CONFIG_UPDATE_NOTIFIER: "false",
+                    npm_config_loglevel: "warn",
+                    NPM_CONFIG_LOGLEVEL: "warn",
+                    NODE_ENV: "development",
+                    npm_config_production: "false",
+                    NPM_CONFIG_PRODUCTION: "false",
+                    NPM_CONFIG_INCLUDE: "dev"
+                }
+            });
+        }
+        catch (error) {
+            throw new Error(formatCommandFailure(command, cwd, error));
+        }
+        finally {
+            rmSync(scratchDir, { recursive: true, force: true });
+        }
+    }
+    async syncTemplateAboutAssets(input) {
+        const entries = Array.from(new Set([
+            ...input.template.about.preview_media,
+            ...input.template.examples.flatMap((example) => example.map((entry) => entry.media_url))
+        ]
+            .filter((entry) => !/^https?:\/\//i.test(entry))
+            .filter((entry) => !entry.replace(/^\/+/, "").startsWith("templates/"))));
+        for (const entry of entries) {
+            const asset = this.resolveTemplateAboutAsset(input.release, entry);
+            if (!asset) {
+                throw new Error(`Template about asset not found in release checkout: ${entry}`);
+            }
+            await storage.putBuffer(storage.templateAboutKey(input.template.id, asset.storageAssetPath), readFileSync(asset.sourcePath), inferContentType(asset.sourcePath));
+        }
+    }
+    resolveTemplateAboutAsset(release, entry) {
+        const normalizedEntry = entry.replace(/^\/+/, "");
+        const sourceRelativePath = normalizedEntry.startsWith("about/")
+            ? normalizedEntry
+            : path.posix.join("about", normalizedEntry);
+        const storageAssetPath = normalizedEntry.startsWith("about/")
+            ? normalizedEntry.slice("about/".length)
+            : normalizedEntry;
+        const checkoutRoot = path.resolve(release.checkoutPath);
+        let currentDir = path.dirname(release.modulePath);
+        while (true) {
+            const candidatePath = path.join(currentDir, sourceRelativePath);
+            if (existsSync(candidatePath)) {
+                return {
+                    sourcePath: candidatePath,
+                    storageAssetPath
+                };
+            }
+            if (path.resolve(currentDir) === checkoutRoot) {
+                break;
+            }
+            const parentDir = path.dirname(currentDir);
+            if (parentDir === currentDir) {
+                break;
+            }
+            currentDir = parentDir;
+        }
+        return null;
+    }
+    async loadAndVerifyArtifactManifest(manifestKey, source) {
+        const raw = await storage.readText(manifestKey);
+        if (!raw) {
+            throw new Error(`Artifact manifest not found: ${manifestKey}`);
+        }
+        const manifest = JSON.parse(raw);
+        if (manifest.version !== 1 || manifest.algorithm !== "hmac-sha256") {
+            throw new Error("Unsupported template artifact manifest version or algorithm.");
+        }
+        if (!config.ARTIFACT_SIGNING_SECRET) {
+            throw new Error("ARTIFACT_SIGNING_SECRET or SUPERAGENCY_KEY is required to verify artifact manifests.");
+        }
+        const expectedSignature = createHmac("sha256", config.ARTIFACT_SIGNING_SECRET)
+            .update(this.serializeArtifactManifestPayload({
+            version: 1,
+            algorithm: "hmac-sha256",
+            template_id: String(manifest.template_id ?? ""),
+            slug_id: String(manifest.slug_id ?? ""),
+            repo_url: String(manifest.repo_url ?? ""),
+            branch: String(manifest.branch ?? ""),
+            commit_sha: String(manifest.commit_sha ?? ""),
+            template_module_path: String(manifest.template_module_path ?? ""),
+            skill_path: String(manifest.skill_path ?? ""),
+            install_command: String(manifest.install_command ?? ""),
+            build_command: String(manifest.build_command ?? ""),
+            artifact_key: String(manifest.artifact_key ?? ""),
+            artifact_sha256: String(manifest.artifact_sha256 ?? ""),
+            created_at: String(manifest.created_at ?? ""),
+            signed_by: String(manifest.signed_by ?? "")
+        }))
+            .digest("hex");
+        if (manifest.signature !== expectedSignature) {
+            throw new Error("Template artifact manifest signature verification failed.");
+        }
+        if (manifest.template_id !== source.templateId || manifest.slug_id !== source.slugId) {
+            throw new Error("Template artifact manifest does not match the registered template identity.");
+        }
+        if (manifest.repo_url !== source.repoUrl || manifest.branch !== source.branch) {
+            throw new Error("Template artifact manifest does not match the registered repo URL or branch.");
+        }
+        if (manifest.template_module_path !== source.templateModulePath) {
+            throw new Error("Template artifact manifest does not match the registered template module path.");
+        }
+        if (manifest.skill_path !== source.skillPath) {
+            throw new Error("Template artifact manifest does not match the registered skill path.");
+        }
+        if (manifest.install_command !== source.installCommand || manifest.build_command !== source.buildCommand) {
+            throw new Error("Template artifact manifest does not match the registered install or build command.");
+        }
+        return manifest;
+    }
+    async extractArtifactToCheckout(input) {
+        const archive = await storage.readBuffer(input.artifactKey);
+        if (!archive) {
+            throw new Error(`Template artifact not found: ${input.artifactKey}`);
+        }
+        const actualSha256 = createHash("sha256").update(archive).digest("hex");
+        if (actualSha256 !== input.expectedSha256) {
+            throw new Error(`Template artifact hash mismatch for ${input.artifactKey}.`);
+        }
+        mkdirSync(input.checkoutPath, { recursive: true });
+        extractTarGzBuffer(archive, input.checkoutPath);
+    }
+    async createRuntimeArtifact(input) {
+        const runtimeKey = `template-runtime-artifacts/${input.source.templateId}/${input.commitSha}/runtime.tar.gz`;
+        const buffer = createTarGzFromDirectory(input.checkoutPath, (relativePath) => {
+            return hasPathSegment(relativePath, "node_modules")
+                || hasPathSegment(relativePath, ".git")
+                || hasPathSegment(relativePath, ".next")
+                || hasPathSegment(relativePath, ".turbo")
+                || relativePath === "dist/.tsbuildinfo"
+                || relativePath.endsWith("/dist/.tsbuildinfo")
+                || relativePath === ".vidfarm-import-ready";
+        });
+        const sha256 = createHash("sha256").update(buffer).digest("hex");
+        await storage.putBuffer(runtimeKey, buffer, "application/gzip");
+        return {
+            key: runtimeKey,
+            sha256
+        };
+    }
+    serializeArtifactManifestPayload(input) {
+        return JSON.stringify({
+            version: input.version,
+            algorithm: input.algorithm,
+            template_id: input.template_id,
+            slug_id: input.slug_id,
+            repo_url: input.repo_url,
+            branch: input.branch,
+            commit_sha: input.commit_sha,
+            template_module_path: input.template_module_path,
+            skill_path: input.skill_path,
+            install_command: input.install_command,
+            build_command: input.build_command,
+            artifact_key: input.artifact_key,
+            artifact_sha256: input.artifact_sha256,
+            created_at: input.created_at,
+            signed_by: input.signed_by
+        });
+    }
+    buildArtifactKeys(source, commitSha) {
+        return {
+            artifactKey: `template-artifacts/${source.templateId}/${commitSha}/source.tar.gz`,
+            manifestKey: `template-artifacts/${source.templateId}/${commitSha}/manifest.json`
+        };
+    }
+    async createSignedArtifactManifest(input) {
+        const artifact = this.buildArtifactKeys(input.source, input.commitSha);
+        const createdAt = nowIso();
+        const payload = {
+            version: 1,
+            algorithm: "hmac-sha256",
+            template_id: input.source.templateId,
+            slug_id: input.source.slugId,
+            repo_url: input.source.repoUrl,
+            branch: input.source.branch,
+            commit_sha: input.commitSha,
+            template_module_path: input.source.templateModulePath,
+            skill_path: input.source.skillPath,
+            install_command: input.source.installCommand,
+            build_command: input.source.buildCommand,
+            artifact_key: artifact.artifactKey,
+            artifact_sha256: input.artifactSha256,
+            created_at: createdAt,
+            signed_by: input.signedBy
+        };
+        const signature = createHmac("sha256", config.ARTIFACT_SIGNING_SECRET)
+            .update(this.serializeArtifactManifestPayload(payload))
+            .digest("hex");
+        await storage.putText(artifact.manifestKey, JSON.stringify({
+            ...payload,
+            signature
+        }, null, 2), "application/json");
+        return {
+            ...artifact,
+            signature
+        };
+    }
+    resolveGitRemoteUrl(repoUrl) {
+        const githubToken = config.VIDFARM_GITHUB_TOKEN || config.GITHUB_TOKEN;
+        if (!githubToken) {
+            return repoUrl;
+        }
+        if (!/^https:\/\/github\.com\//i.test(repoUrl)) {
+            return repoUrl;
+        }
+        return repoUrl.replace(/^https:\/\/github\.com\//i, `https://x-access-token:${encodeURIComponent(githubToken)}@github.com/`);
+    }
+    resolveImportableModulePath(checkoutPath, declaredModulePath) {
+        const sourceModulePath = path.join(checkoutPath, declaredModulePath);
+        const extension = path.extname(sourceModulePath).toLowerCase();
+        if (extension === ".ts" || extension === ".tsx") {
+            const compiledModulePath = sourceModulePath.replace(/\.(ts|tsx)$/i, ".js");
+            if (existsSync(compiledModulePath)) {
+                return compiledModulePath;
+            }
+            throw new Error(`Template module path ${declaredModulePath} is TypeScript, but the compiled module ${path.relative(checkoutPath, compiledModulePath)} was not found after build.`);
+        }
+        if (existsSync(sourceModulePath)) {
+            return sourceModulePath;
+        }
+        throw new Error(`Template module path ${declaredModulePath} was not found in the imported release.`);
+    }
+    pruneCheckoutInstallArtifacts(checkoutPath) {
+        removeNestedDirectories(checkoutPath, new Set(["node_modules"]));
+        linkSharedNodeModules(checkoutPath);
+    }
+}
+export function createTemplateReleaseSnapshot(template) {
+    return {
+        id: template.id,
+        slugId: template.slugId,
+        version: template.version,
+        about: {
+            title: template.about.title,
+            description: template.about.description,
+            difficulty: template.about.difficulty,
+            viral_dna: template.about.viral_dna,
+            visual_dna: template.about.visual_dna,
+            preview_media: [...template.about.preview_media],
+            link_to_original: template.about.link_to_original,
+            links_to_inspiration: [...template.about.links_to_inspiration],
+            sound: {
+                sound_title: template.about.sound.sound_title,
+                sound_url: template.about.sound.sound_url
+            },
+            proposal_generator: template.about.proposal_generator,
+            skeleton_prompt: template.about.skeleton_prompt,
+            sample_prompts: [...template.about.sample_prompts]
+        },
+        examples: template.examples.map((example) => example.map((entry) => ({
+            media_url: entry.media_url,
+            note: entry.note
+        }))),
+        operations: Object.entries(template.operations).map(([name, operation]) => ({
+            name,
+            description: operation.description,
+            workflow: operation.workflow,
+            providerHint: operation.providerHint ?? null,
+            webhookSupport: operation.webhookSupport ?? null
+        }))
+    };
+}
+function inferContentType(filePath) {
+    switch (path.extname(filePath).toLowerCase()) {
+        case ".png":
+            return "image/png";
+        case ".gif":
+            return "image/gif";
+        case ".jpg":
+        case ".jpeg":
+            return "image/jpeg";
+        case ".webp":
+            return "image/webp";
+        case ".svg":
+            return "image/svg+xml";
+        case ".mp4":
+            return "video/mp4";
+        case ".webm":
+            return "video/webm";
+        case ".mov":
+            return "video/quicktime";
+        default:
+            return "application/octet-stream";
+    }
+}
+function hasPathSegment(relativePath, segment) {
+    return relativePath.split("/").includes(segment);
+}
+function removeNestedDirectories(rootDir, directoryNames) {
+    if (!existsSync(rootDir)) {
+        return;
+    }
+    for (const entryName of readdirSync(rootDir)) {
+        const absolutePath = path.join(rootDir, entryName);
+        const stat = statSync(absolutePath);
+        if (!stat.isDirectory()) {
+            continue;
+        }
+        if (directoryNames.has(entryName)) {
+            rmSync(absolutePath, { recursive: true, force: true });
+            continue;
+        }
+        removeNestedDirectories(absolutePath, directoryNames);
+    }
+}
+function linkSharedNodeModules(checkoutPath) {
+    const target = path.resolve(process.env.LAMBDA_TASK_ROOT ?? process.cwd(), "node_modules");
+    const linkPath = path.join(checkoutPath, "node_modules");
+    if (!existsSync(target) || existsSync(linkPath)) {
+        return;
+    }
+    symlinkSync(target, linkPath, "dir");
+}
+function formatCommandFailure(command, cwd, error) {
+    const details = childProcessFailureDetails(error);
+    const diskHint = /\bENOSPC\b|no space left on device/i.test(details)
+        ? " The command ran out of writable temporary storage; Vidfarm cleaned the partial checkout and npm scratch cache before returning this error."
+        : "";
+    return `Template import command failed: ${sanitizeSensitiveText(command)} (cwd: ${cwd}).${diskHint}${details ? `\n${details}` : ""}`;
+}
+function childProcessFailureDetails(error) {
+    if (!(error instanceof Error)) {
+        return String(error);
+    }
+    const childError = error;
+    const parts = [
+        sanitizeSensitiveText(childError.message),
+        childError.code == null ? "" : `exit/code: ${String(childError.code)}`,
+        childError.signal == null ? "" : `signal: ${childError.signal}`,
+        childError.stderr ? `stderr:\n${truncateCommandOutput(childError.stderr)}` : "",
+        childError.stdout ? `stdout:\n${truncateCommandOutput(childError.stdout)}` : ""
+    ].filter(Boolean);
+    return parts.join("\n");
+}
+function truncateCommandOutput(value) {
+    const text = Buffer.isBuffer(value) ? value.toString("utf8") : value;
+    const trimmed = sanitizeSensitiveText(text.trim());
+    return trimmed.length > 4_000 ? `${trimmed.slice(0, 4_000)}\n[output truncated]` : trimmed;
+}
+function sanitizeSensitiveText(value) {
+    return value
+        .replace(/https:\/\/x-access-token:[^@\s]+@github\.com\//gi, "https://x-access-token:[redacted]@github.com/")
+        .replace(/([?&](?:token|access_token|api_key|key|secret)=)[^&\s]+/gi, "$1[redacted]");
+}
+function extractTarGzBuffer(archive, outputDir) {
+    const tar = gunzipSync(archive);
+    let offset = 0;
+    let nextPath = null;
+    while (offset + 512 <= tar.length) {
+        const header = tar.subarray(offset, offset + 512);
+        offset += 512;
+        if (header.every((byte) => byte === 0)) {
+            break;
+        }
+        const rawName = readTarString(header, 0, 100);
+        const prefix = readTarString(header, 345, 155);
+        const headerPath = [prefix, rawName].filter(Boolean).join("/");
+        const size = readTarOctal(header, 124, 12);
+        const typeFlag = readTarString(header, 156, 1) || "0";
+        const body = tar.subarray(offset, offset + size);
+        offset += Math.ceil(size / 512) * 512;
+        if (typeFlag === "x") {
+            nextPath = readPaxPath(body) ?? nextPath;
+            continue;
+        }
+        if (typeFlag === "g") {
+            continue;
+        }
+        if (typeFlag === "L") {
+            nextPath = body.toString("utf8").replace(/\0.*$/u, "");
+            continue;
+        }
+        const fullName = nextPath ?? headerPath;
+        nextPath = null;
+        if (!fullName || fullName === ".") {
+            continue;
+        }
+        const outputPath = resolveTarOutputPath(outputDir, fullName);
+        if (!outputPath) {
+            continue;
+        }
+        if (typeFlag === "5") {
+            mkdirSync(outputPath, { recursive: true });
+            continue;
+        }
+        if (typeFlag === "2") {
+            continue;
+        }
+        if (typeFlag !== "0" && typeFlag !== "") {
+            continue;
+        }
+        mkdirSync(path.dirname(outputPath), { recursive: true });
+        writeFileSync(outputPath, body);
+    }
+}
+function createTarGzFromDirectory(rootDir, shouldExclude) {
+    const chunks = [];
+    for (const entry of listTarEntries(rootDir, "", shouldExclude)) {
+        const stat = statSync(entry.absolutePath);
+        const archivePath = entry.relativePath;
+        if (stat.isDirectory()) {
+            chunks.push(createTarHeader(`${archivePath.replace(/\/+$/u, "")}/`, 0, "5", stat.mtime));
+            continue;
+        }
+        if (!stat.isFile()) {
+            continue;
+        }
+        const body = readFileSync(entry.absolutePath);
+        chunks.push(createTarHeader(archivePath, body.length, "0", stat.mtime));
+        chunks.push(body);
+        const padding = body.length % 512;
+        if (padding) {
+            chunks.push(Buffer.alloc(512 - padding));
+        }
+    }
+    chunks.push(Buffer.alloc(1024));
+    return gzipSync(Buffer.concat(chunks));
+}
+function listTarEntries(rootDir, relativeDir, shouldExclude) {
+    const directory = path.join(rootDir, relativeDir);
+    const entries = [];
+    for (const name of readdirSync(directory).sort()) {
+        const relativePath = path.posix.join(relativeDir.split(path.sep).join("/"), name);
+        if (shouldExclude(relativePath)) {
+            continue;
+        }
+        const absolutePath = path.join(rootDir, relativePath);
+        const stat = statSync(absolutePath);
+        entries.push({ absolutePath, relativePath });
+        if (stat.isDirectory()) {
+            entries.push(...listTarEntries(rootDir, relativePath, shouldExclude));
+        }
+    }
+    return entries;
+}
+function createTarHeader(name, size, typeFlag, mtime) {
+    const header = Buffer.alloc(512);
+    const { namePart, prefixPart } = splitTarPath(name);
+    writeTarString(header, namePart, 0, 100);
+    writeTarOctal(header, typeFlag === "5" ? 0o755 : 0o644, 100, 8);
+    writeTarOctal(header, 0, 108, 8);
+    writeTarOctal(header, 0, 116, 8);
+    writeTarOctal(header, size, 124, 12);
+    writeTarOctal(header, Math.floor(mtime.getTime() / 1000), 136, 12);
+    header.fill(0x20, 148, 156);
+    writeTarString(header, typeFlag, 156, 1);
+    writeTarString(header, "ustar", 257, 6);
+    writeTarString(header, "00", 263, 2);
+    writeTarString(header, prefixPart, 345, 155);
+    let checksum = 0;
+    for (const byte of header) {
+        checksum += byte;
+    }
+    const checksumText = checksum.toString(8).padStart(6, "0");
+    writeTarString(header, `${checksumText}\0 `, 148, 8);
+    return header;
+}
+function splitTarPath(input) {
+    const normalized = input.replace(/^\.?\//u, "");
+    if (Buffer.byteLength(normalized) <= 100) {
+        return { namePart: normalized, prefixPart: "" };
+    }
+    const parts = normalized.split("/");
+    for (let index = 1; index < parts.length; index += 1) {
+        const prefixPart = parts.slice(0, index).join("/");
+        const namePart = parts.slice(index).join("/");
+        if (Buffer.byteLength(prefixPart) <= 155 && Buffer.byteLength(namePart) <= 100) {
+            return { namePart, prefixPart };
+        }
+    }
+    throw new Error(`Template runtime artifact path is too long for ustar: ${input}`);
+}
+function readPaxPath(body) {
+    const text = body.toString("utf8");
+    let offset = 0;
+    while (offset < text.length) {
+        const spaceIndex = text.indexOf(" ", offset);
+        if (spaceIndex === -1) {
+            break;
+        }
+        const length = Number.parseInt(text.slice(offset, spaceIndex), 10);
+        if (!Number.isFinite(length) || length <= 0) {
+            break;
+        }
+        const record = text.slice(spaceIndex + 1, offset + length).replace(/\n$/u, "");
+        const equalsIndex = record.indexOf("=");
+        if (equalsIndex !== -1 && record.slice(0, equalsIndex) === "path") {
+            return record.slice(equalsIndex + 1);
+        }
+        offset += length;
+    }
+    return null;
+}
+function resolveTarOutputPath(rootDir, entryPath) {
+    const normalized = entryPath.replace(/^\.?\//u, "");
+    if (!normalized || normalized.startsWith("/") || normalized.includes("..")) {
+        return null;
+    }
+    const outputPath = path.resolve(rootDir, normalized);
+    const root = path.resolve(rootDir);
+    if (outputPath !== root && !outputPath.startsWith(`${root}${path.sep}`)) {
+        return null;
+    }
+    return outputPath;
+}
+function readTarString(buffer, offset, length) {
+    return buffer
+        .subarray(offset, offset + length)
+        .toString("utf8")
+        .replace(/\0.*$/u, "")
+        .trim();
+}
+function readTarOctal(buffer, offset, length) {
+    return Number.parseInt(readTarString(buffer, offset, length) || "0", 8) || 0;
+}
+function writeTarString(buffer, value, offset, length) {
+    const bytes = Buffer.from(value, "utf8");
+    if (bytes.length > length) {
+        throw new Error(`Tar header value is too long: ${value}`);
+    }
+    bytes.copy(buffer, offset, 0, bytes.length);
+}
+function writeTarOctal(buffer, value, offset, length) {
+    writeTarString(buffer, value.toString(8).padStart(length - 1, "0"), offset, length - 1);
+}
+//# sourceMappingURL=template-sources.js.map