@opensoftware/foreman 0.0.0-stage → 0.1.0

package/dist/adapters/sandbox.js

@@ -0,0 +1,56 @@
+// A stage's sandbox through the sandbox port (ADR 0054, ADR 0068). The adapter is a program; the foreman creates a
+// sandbox from the spec, copies the run's folder in, runs the harness with exec, copies the folder out and destroys it.
+import { execFile } from "node:child_process";
+import { cpSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, posix } from "node:path";
+/** Runs one command of the adapter; a failure names the command and what the adapter wrote to standard error. */
+function adapterRun(adapter, env) {
+    const [file, ...args] = adapter;
+    return (...command) => new Promise((resolve, reject) => {
+        execFile(file, [...args, ...command], { env }, (error, stdout, stderr) => {
+            if (error)
+                reject(new Error(`the sandbox adapter's ${command[0]} failed: ${stderr.trim() || error.message}`));
+            else
+                resolve(stdout.trim());
+        });
+    });
+}
+/**
+ * A new sandbox from the spec for the files of `local`, the run's folder, which it holds at `<working folder>/<name>`
+ * after `copyIn`. The caller destroys it.
+ */
+export async function createSandbox(adapter, spec, local, name, env) {
+    const run = adapterRun(adapter, env);
+    const temporary = mkdtempSync(join(tmpdir(), "foreman-sandbox-"));
+    let id;
+    try {
+        writeFileSync(join(temporary, "spec.json"), JSON.stringify(spec));
+        id = (await run("create", join(temporary, "spec.json"))).split("\n").pop();
+    }
+    finally {
+        rmSync(temporary, { recursive: true, force: true });
+    }
+    return {
+        async copyIn() {
+            const working = await run("exec", id, "--", "pwd");
+            // The path does not exist in the sandbox yet, so every adapter copies the folder itself, not into it.
+            await run("copy", local, `${id}:${name}`);
+            return posix.join(working, name);
+        },
+        exec: (command) => [...adapter, "exec", id, "--", ...command],
+        async copyOut() {
+            const out = mkdtempSync(join(tmpdir(), "foreman-sandbox-out-"));
+            try {
+                await run("copy", `${id}:${name}`, join(out, name));
+                rmSync(local, { recursive: true, force: true });
+                cpSync(join(out, name), local, { recursive: true });
+            }
+            finally {
+                rmSync(out, { recursive: true, force: true });
+            }
+        },
+        destroy: async () => void (await run("destroy", id)),
+    };
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/adapters/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/adapters/sandbox.ts"],"names":[],"mappings":"AAAA,mHAAmH;AACnH,wHAAwH;AACxH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAaxC,iHAAiH;AACjH,SAAS,UAAU,CAAC,OAAiB,EAAE,GAAuC;IAC5E,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAgC,CAAC;IACzD,OAAO,CAAC,GAAG,OAAiB,EAAE,EAAE,CAC9B,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACvE,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,OAAO,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;;gBACzG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAiB,EACjB,IAAiB,EACjB,KAAa,EACb,IAAY,EACZ,GAAuC;IAEvC,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAClE,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAY,CAAC;IACvF,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO;QACL,KAAK,CAAC,MAAM;YACV,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACnD,sGAAsG;YACtG,MAAM,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QAC7D,KAAK,CAAC,OAAO;YACX,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;YAChE,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;gBACpD,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;KACrD,CAAC;AACJ,CAAC"}

package/dist/cli.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+// foreman <command>: the entry layer only parses arguments and calls the commands.
+import { parseArgs } from "node:util";
+import { runProgram } from "@opensoftware/cli";
+import { serve } from "./commands/serve.js";
+const HELP = `Usage: foreman <command>
+
+Commands:
+  serve  Serve the run API on PORT and run the factory's workflow in FOREMAN_FACTORY on Temporal at
+         FOREMAN_TEMPORAL_ADDRESS.
+`;
+const { positionals, values } = parseArgs({ allowPositionals: true, options: { help: { type: "boolean" } } });
+const serving = () => serve(process.env);
+process.exitCode = await runProgram({
+    name: "foreman",
+    usage: HELP,
+    command: positionals[0] === "serve" ? serving : undefined,
+    help: values.help,
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,mFAAmF;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAgB,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAE5C,MAAM,IAAI,GAAG;;;;;CAKZ,CAAC;AAEF,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;AAC9G,MAAM,OAAO,GAAY,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAClD,OAAO,CAAC,QAAQ,GAAG,MAAM,UAAU,CAAC;IAClC,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,IAAI;IACX,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;IACzD,IAAI,EAAE,MAAM,CAAC,IAAI;CAClB,CAAC,CAAC"}

package/dist/commands/runs.js

@@ -0,0 +1,68 @@
+// The runs of the foreman as Temporal workflows (ADR 0067): start one per work item, read its view, signal it.
+import { UsageError } from "@opensoftware/cli";
+import { validate } from "@opensoftware/contracts";
+import { WorkflowExecutionAlreadyStartedError, WorkflowIdReusePolicy, WorkflowNotFoundError, } from "@temporalio/client";
+import { firstView, hasEnded, runIdOf, signalOf } from "../domain/run.js";
+import { factoryRun, gateSignal, steeringQuery, steerSignal, viewQuery } from "../workflows/run.js";
+export class Conflict extends Error {
+}
+function checked(format, document, what) {
+    const problems = validate(format, document);
+    if (problems.length)
+        throw new UsageError(`${what}: ${problems.map((problem) => `${problem.path || "/"}: ${problem.message}`).join("; ")}`);
+    return document;
+}
+export function runs(options) {
+    const { client, taskQueue } = options;
+    const handle = (runId) => client.workflow.getHandle(runId);
+    const view = (runId) => handle(runId)
+        .query(viewQuery)
+        .catch((error) => (error instanceof WorkflowNotFoundError ? undefined : Promise.reject(error)));
+    return {
+        async start(document) {
+            const workItem = checked("work-item", document, "the body is not a work item");
+            const { definition, version } = await options.factory();
+            const first = firstView(workItem, definition, version, options.now());
+            try {
+                await client.workflow.start(factoryRun, {
+                    workflowId: first.runId,
+                    taskQueue,
+                    // One run per work item, also after it ended.
+                    workflowIdReusePolicy: WorkflowIdReusePolicy.REJECT_DUPLICATE,
+                    args: [{ view: first, definition }],
+                });
+                return { created: true, view: first };
+            }
+            catch (error) {
+                if (!(error instanceof WorkflowExecutionAlreadyStartedError))
+                    throw error;
+                return { created: false, view: (await view(first.runId)) };
+            }
+        },
+        view,
+        async signal(runId, document) {
+            const signal = signalOf(document);
+            if (typeof signal === "string")
+                throw new UsageError(`the body is not a signal: ${signal}`);
+            const current = await view(runId);
+            if (!current)
+                return undefined;
+            if (hasEnded(current))
+                throw new Conflict(`${runId} is ${current.state}`);
+            if (signal.type === "steer") {
+                await handle(runId).signal(steerSignal, signal.message);
+            }
+            else {
+                await handle(runId).cancel();
+            }
+            return current;
+        },
+        async steering(runId) {
+            return handle(runId).query(steeringQuery);
+        },
+        async decided(workItemId, decision) {
+            await handle(runIdOf(workItemId)).signal(gateSignal, decision);
+        },
+    };
+}
+//# sourceMappingURL=runs.js.map

package/dist/commands/runs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runs.js","sourceRoot":"","sources":["../../src/commands/runs.ts"],"names":[],"mappings":"AAAA,+GAA+G;AAC/G,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAiB,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAEL,oCAAoC,EACpC,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAqB,QAAQ,EAAgB,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC3G,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEpG,MAAM,OAAO,QAAS,SAAQ,KAAK;CAAG;AAatC,SAAS,OAAO,CAAI,MAAc,EAAE,QAAiB,EAAE,IAAY;IACjE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,MAAM;QACjB,MAAM,IAAI,UAAU,CAClB,GAAG,IAAI,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjG,CAAC;IACJ,OAAO,QAAa,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,OAKpB;IACC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IACtC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,CAAC,KAAa,EAAgC,EAAE,CAC3D,MAAM,CAAC,KAAK,CAAC;SACV,KAAK,CAAC,SAAS,CAAC;SAChB,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3G,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,QAAQ;YAClB,MAAM,QAAQ,GAAG,OAAO,CAAW,WAAW,EAAE,QAAQ,EAAE,6BAA6B,CAAC,CAAC;YACzF,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE;oBACtC,UAAU,EAAE,KAAK,CAAC,KAAK;oBACvB,SAAS;oBACT,8CAA8C;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,gBAAgB;oBAC7D,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;iBACpC,CAAC,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACxC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,oCAAoC,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAC1E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAY,EAAE,CAAC;YACxE,CAAC;QACH,CAAC;QACD,IAAI;QACJ,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ;YAC1B,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,MAAM,IAAI,UAAU,CAAC,6BAA6B,MAAM,EAAE,CAAC,CAAC;YAC5F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC;YAC/B,IAAI,QAAQ,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YAC1E,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1D,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YAC/B,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,KAAK;YAClB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC5C,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ;YAChC,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/commands/serve.js

@@ -0,0 +1,110 @@
+// foreman serve: the run API on PORT and a Temporal worker that runs the factory's workflow (ADR 0067). With
+// FOREMAN_NATS_URL it also starts runs for work.received@v1 and passes gate.decided@v1 to the waiting runs. It runs
+// until SIGTERM or SIGINT.
+import { timingSafeEqual } from "node:crypto";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { UsageError } from "@opensoftware/cli";
+import { Client, Connection } from "@temporalio/client";
+import { NativeConnection, Worker } from "@temporalio/worker";
+import Fastify, {} from "fastify";
+import { readFactory } from "../adapters/factory.js";
+import { gatekeeper } from "../adapters/gatekeeper.js";
+import { openBus, SUBJECTS } from "../adapters/nats.js";
+import { isoNow } from "../domain/time.js";
+import { activities } from "../workflows/activities.js";
+import { Conflict, runs } from "./runs.js";
+const BUNDLE = fileURLToPath(new URL("../workflows.bundle.js", import.meta.url));
+const problem = (reply, status, title, detail) => reply.code(status).type("application/problem+json").send({ title, status, detail });
+/** Whether the request carries the token; compared in constant time. */
+function authorized(header, token) {
+    const [sent, wanted] = [Buffer.from(header ?? ""), Buffer.from(`Bearer ${token}`)];
+    return sent.length === wanted.length && timingSafeEqual(sent, wanted);
+}
+function api(work, token) {
+    const app = Fastify();
+    app.setErrorHandler((error, _request, reply) => {
+        if (error instanceof UsageError)
+            return problem(reply, 400, "Bad request", error.message);
+        if (error instanceof Conflict)
+            return problem(reply, 409, "The run ended", error.message);
+        return problem(reply, error.statusCode ?? 500, "The request failed", error.message);
+    });
+    app.addHook("onRequest", async (request, reply) => {
+        if (!authorized(request.headers.authorization, token))
+            return problem(reply, 401, "Unauthorized", "send Authorization: Bearer <FOREMAN_API_TOKEN>");
+    });
+    const unknown = (reply, runId) => problem(reply, 404, "No such run", `the server has no run ${runId}`);
+    app.post("/v1/runs", async (request, reply) => {
+        const { created, view } = await work.start(request.body);
+        return reply.code(created ? 201 : 200).send(view);
+    });
+    app.get("/v1/runs/:runId", async (request, reply) => {
+        const view = await work.view(request.params.runId);
+        return view ?? unknown(reply, request.params.runId);
+    });
+    app.post("/v1/runs/:runId/signals", async (request, reply) => {
+        const view = await work.signal(request.params.runId, request.body);
+        return view ? reply.code(202).send(view) : unknown(reply, request.params.runId);
+    });
+    return app;
+}
+/** Starts runs for work items from intake and hands gate decisions to the runs that wait for them. */
+function listen(bus, work) {
+    bus.subscribe(SUBJECTS.workReceived, async (event) => {
+        await work.start(event.data);
+    });
+    bus.subscribe(SUBJECTS.gateDecided, async (event) => {
+        const { data } = event;
+        await work.decided(data.workItemId, { gateId: data.gateId, state: data.decision });
+    });
+}
+export async function serve(env) {
+    const token = env.FOREMAN_API_TOKEN;
+    if (!token)
+        throw new UsageError("set FOREMAN_API_TOKEN: the token that callers of the API send");
+    const factoryPath = resolve(env.FOREMAN_FACTORY || "factory.yaml");
+    await readFactory(factoryPath);
+    const now = () => isoNow(env.OSF_NOW);
+    const warn = (text) => process.stderr.write(`foreman: ${text}\n`);
+    const address = env.FOREMAN_TEMPORAL_ADDRESS || "localhost:7233";
+    // Unset, the client and the worker use the namespace "default".
+    const namespace = env.FOREMAN_TEMPORAL_NAMESPACE;
+    const taskQueue = env.FOREMAN_TASK_QUEUE || "foreman";
+    const pollMs = Number(env.FOREMAN_POLL_MS || 1000);
+    const bus = env.FOREMAN_NATS_URL ? await openBus(env.FOREMAN_NATS_URL, warn) : undefined;
+    const client = new Client({ connection: await Connection.connect({ address }), namespace });
+    const work = runs({ client, taskQueue, factory: () => readFactory(factoryPath), now });
+    const worker = await Worker.create({
+        connection: await NativeConnection.connect({ address }),
+        namespace,
+        taskQueue,
+        workflowBundle: { codePath: BUNDLE },
+        activities: activities({
+            now,
+            bus,
+            gatekeeper: gatekeeper(env.FOREMAN_GATEKEEPER_URL, env.FOREMAN_GATEKEEPER_TOKEN),
+            harnesses: JSON.parse(env.FOREMAN_HARNESSES || "{}"),
+            sandboxes: JSON.parse(env.FOREMAN_SANDBOXES || "{}"),
+            data: resolve(env.OSF_DATA || ".foreman"),
+            pollMs,
+            steering: (runId) => work.steering(runId),
+            env,
+        }),
+        maxHeartbeatThrottleInterval: pollMs,
+        defaultHeartbeatThrottleInterval: pollMs,
+    });
+    const running = worker.run();
+    if (bus)
+        listen(bus, work);
+    const app = api(work, token);
+    const port = Number(env.PORT || 8080);
+    await app.listen({ port, host: "0.0.0.0" });
+    process.stdout.write(`foreman serves the run API on port ${port}, task queue ${taskQueue} at ${address}\n`);
+    // Temporal's runtime stops the worker on SIGTERM and SIGINT; the server stops with it.
+    await running;
+    await app.close();
+    await bus?.close();
+    return { lines: [] };
+}
+//# sourceMappingURL=serve.js.map

package/dist/commands/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,oHAAoH;AACpH,2BAA2B;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,OAAO,EAAE,EAAqB,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAY,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAa,IAAI,EAAE,MAAM,WAAW,CAAC;AAItD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAEjF,MAAM,OAAO,GAAG,CAAC,KAAmB,EAAE,MAAc,EAAE,KAAa,EAAE,MAAc,EAAE,EAAE,CACrF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAEtF,wEAAwE;AACxE,SAAS,UAAU,CAAC,MAA0B,EAAE,KAAa;IAC3D,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC;IACnF,OAAO,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,GAAG,CAAC,IAAU,EAAE,KAAa;IACpC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,eAAe,CAAC,CAAC,KAAsC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC9E,IAAI,KAAK,YAAY,UAAU;YAAE,OAAO,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1F,IAAI,KAAK,YAAY,QAAQ;YAAE,OAAO,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1F,OAAO,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,oBAAoB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAChD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC;YACnD,OAAO,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE,gDAAgD,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,KAAmB,EAAE,KAAa,EAAE,EAAE,CACrD,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,yBAAyB,KAAK,EAAE,CAAC,CAAC;IACvE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC5C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAgC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnD,OAAO,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAgC,yBAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sGAAsG;AACtG,SAAS,MAAM,CAAC,GAAQ,EAAE,IAAU;IAClC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACnD,MAAM,IAAI,CAAC,KAAK,CAAE,KAA6B,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAClD,MAAM,EAAE,IAAI,EAAE,GAAG,KAAoB,CAAC;QACtC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,GAAQ;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,UAAU,CAAC,+DAA+D,CAAC,CAAC;IAClG,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,cAAc,CAAC,CAAC;IACnE,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,GAAG,CAAC,wBAAwB,IAAI,gBAAgB,CAAC;IACjE,gEAAgE;IAChE,MAAM,SAAS,GAAG,GAAG,CAAC,0BAA0B,CAAC;IACjD,MAAM,SAAS,GAAG,GAAG,CAAC,kBAAkB,IAAI,SAAS,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;QACjC,UAAU,EAAE,MAAM,gBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;QACvD,SAAS;QACT,SAAS;QACT,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;QACpC,UAAU,EAAE,UAAU,CAAC;YACrB,GAAG;YACH,GAAG;YACH,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,sBAAsB,EAAE,GAAG,CAAC,wBAAwB,CAAC;YAChF,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAA2B;YAC9E,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAA2B;YAC9E,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,UAAU,CAAC;YACzC,MAAM;YACN,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YACzC,GAAG;SACJ,CAAC;QACF,4BAA4B,EAAE,MAAM;QACpC,gCAAgC,EAAE,MAAM;KACzC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,GAAG;QAAE,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3B,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;IACtC,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,IAAI,gBAAgB,SAAS,OAAO,OAAO,IAAI,CAAC,CAAC;IAC5G,uFAAuF;IACvF,MAAM,OAAO,CAAC;IACd,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IAClB,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC;IACnB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACvB,CAAC"}

package/dist/domain/definition.js

@@ -0,0 +1,45 @@
+/** The problems that only the foreman sees: two sandbox adapters, or a stage whose agent the factory does not declare. */
+export function stageProblems(factory) {
+    const adapters = Object.keys(factory.providers?.sandbox ?? {}).length;
+    const sandbox = adapters > 1 ? [{ path: "/providers/sandbox", message: `name one sandbox adapter, not ${adapters}` }] : [];
+    return sandbox.concat(stageAgentProblems(factory));
+}
+function stageAgentProblems(factory) {
+    return (factory.workflow ?? []).flatMap((stage, index) => {
+        const agent = agentOf(stage);
+        return factory.agents[agent]
+            ? []
+            : [{ path: `/workflow/${index}/${stage.agent ? "agent" : "stage"}`, message: `no agent "${agent}"` }];
+    });
+}
+/** A stage's agent defaults to the agent with the stage's name. */
+export const agentOf = (stage) => stage.agent ?? stage.stage;
+/** The definition of a checked factory, with the text of each prompt from `read`. */
+export function definitionOf(factory, read) {
+    return {
+        factory: factory.factory,
+        sandboxAdapter: Object.keys(factory.providers?.sandbox ?? {})[0] ?? "docker",
+        stages: (factory.workflow ?? []).map((stage) => {
+            const agent = agentOf(stage);
+            const declared = factory.agents[agent];
+            return {
+                stage: stage.stage,
+                agent,
+                harness: declared.harness,
+                prompt: read(declared.prompt),
+                ...(stage.gate ? { gate: stage.gate } : {}),
+                ...(declared.sandbox ? { sandbox: { ...declared.sandbox, secrets: secretsOf(declared.secrets ?? []) } } : {}),
+            };
+        }),
+    };
+}
+/** The variable of a secret reference: its name in upper case, every character outside A-Z and 0-9 as "_". */
+export const secretVariable = (reference) => reference
+    .slice(reference.indexOf("/") + 1)
+    .toUpperCase()
+    .replace(/[^A-Z0-9]/g, "_");
+/** The agent's secret references by their variables, as the sandbox spec holds them (ADR 0068). */
+function secretsOf(references) {
+    return Object.fromEntries(references.map((reference) => [secretVariable(reference), reference]));
+}
+//# sourceMappingURL=definition.js.map

package/dist/domain/definition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition.js","sourceRoot":"","sources":["../../src/domain/definition.ts"],"names":[],"mappings":"AA6BA,0HAA0H;AAC1H,MAAM,UAAU,aAAa,CAAC,OAA0B;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACtE,MAAM,OAAO,GACX,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,iCAAiC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7G,OAAO,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA0B;IACpD,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;YAC1B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,aAAa,KAAK,GAAG,EAAE,CAAC,CAAC;IAC1G,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,KAAwC,EAAU,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;AAExG,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,OAA0B,EAAE,IAA8B;IACrF,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ;QAC5E,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAwC,CAAC;YAC9E,OAAO;gBACL,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,KAAK;gBACL,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC7B,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9G,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,8GAA8G;AAC9G,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAU,EAAE,CAC1D,SAAS;KACN,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;KACjC,WAAW,EAAE;KACb,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;AAEhC,mGAAmG;AACnG,SAAS,SAAS,CAAC,UAAoB;IACrC,OAAO,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC"}

package/dist/domain/run.js

@@ -0,0 +1,147 @@
+// A run of the factory's workflow for one work item, without I/O (ADR 0067): its ID, its first view, the next step,
+// how each fact changes the view, and the events it publishes. The workflow asks for each step and applies each fact
+// through local activities, so this code runs in the worker's own thread, not in Temporal's sandbox.
+import { createHash } from "node:crypto";
+const ENDED = new Set(["complete", "failed", "cancelled"]);
+/** "run_" and 20 hex digits of the SHA-256 of the work item's ID: one run per work item. */
+export const runIdOf = (workItemId) => `run_${createHash("sha256").update(workItemId).digest("hex").slice(0, 20)}`;
+export function firstView(workItem, definition, version, startedAt) {
+    return {
+        runId: runIdOf(workItem.id),
+        workItem,
+        factory: definition.factory,
+        factoryVersion: version,
+        state: "running",
+        startedAt,
+        stages: definition.stages.map(({ stage, agent }) => ({ stage, agent, state: "pending" })),
+    };
+}
+export const hasEnded = (view) => ENDED.has(view.state);
+export function nextStep(view, definition) {
+    if (hasEnded(view))
+        return { kind: "end" };
+    // A run whose last stage succeeded is complete, so a run that goes on has a stage that did not succeed.
+    const index = view.stages.findIndex((stage) => stage.state !== "succeeded");
+    const stage = view.stages[index];
+    if (stage.state === "blocked" && stage.gateId)
+        return { kind: "await-gate", index, gateId: stage.gateId };
+    if (definition.stages[index]?.gate && !stage.gateId)
+        return { kind: "request-gate", index };
+    return { kind: "run-stage", index };
+}
+/** The view after the fact, at the time `at`. */
+export function apply(view, fact, at) {
+    const next = { ...view, stages: view.stages.map((stage) => ({ ...stage })) };
+    const end = (state) => ({ ...next, state, endedAt: at });
+    switch (fact.kind) {
+        case "gate":
+            return gate(next, fact, end);
+        case "stage-started": {
+            Object.assign(next.stages[fact.index], { state: "running", startedAt: at });
+            return next;
+        }
+        case "stage-ended": {
+            const state = stageStateOf(fact.stopReason);
+            const stage = next.stages[fact.index];
+            Object.assign(stage, { state, endedAt: at }, fact.sessionId ? { sessionId: fact.sessionId } : {});
+            if (state !== "succeeded")
+                return end(state === "cancelled" ? "cancelled" : "failed");
+            return fact.index === next.stages.length - 1 ? end("complete") : next;
+        }
+        case "cancelled":
+        case "error": {
+            const stopped = fact.kind === "cancelled" ? "cancelled" : "failed";
+            for (const stage of next.stages)
+                if (stage.state === "running" || stage.state === "blocked")
+                    Object.assign(stage, { state: stopped, endedAt: at });
+            return hasEnded(view) ? view : end(fact.kind === "cancelled" ? "cancelled" : "failed");
+        }
+    }
+}
+function gate(next, fact, end) {
+    const stage = next.stages[fact.index];
+    stage.gateId = fact.gateId;
+    if (fact.state === "pending") {
+        stage.state = "blocked";
+        return { ...next, state: "blocked" };
+    }
+    if (fact.state === "approved") {
+        stage.state = "pending";
+        return { ...next, state: "running" };
+    }
+    stage.state = "rejected";
+    return end("failed");
+}
+/** How a turn's stop reason ends its stage (harness port): only `end_turn` succeeds. */
+export function stageStateOf(stopReason) {
+    if (stopReason === "end_turn")
+        return "succeeded";
+    if (stopReason === "cancelled")
+        return "cancelled";
+    return "failed";
+}
+/** The prompt of a stage: the agent's prompt, then the work item. */
+export function promptOf(agentPrompt, workItem) {
+    const description = workItem.description ? `\n\n${workItem.description}` : "";
+    return `${agentPrompt.trimEnd()}\n\n# Work item ${workItem.id}\n\n${workItem.title}${description}\n`;
+}
+/** The signal in a request's body, or the problem with it as "<JSON Pointer>: <what is wrong>". */
+export function signalOf(body) {
+    const { type, message } = (typeof body === "object" && body !== null ? body : {});
+    if (type === "cancel")
+        return { type };
+    if (type !== "steer")
+        return `/type: must be "steer" or "cancel"`;
+    if (typeof message !== "string" || message === "")
+        return "/message: a steering message needs the text";
+    return { type, message };
+}
+/** The summary gatekeeper shows the approvers. */
+export const gateSummaryOf = (view, index) => `${view.workItem.title}: start the stage ${view.stages[index]?.stage}`;
+const SOURCE = "/osf/foreman";
+export function runStarted(view) {
+    return {
+        specversion: "1.0",
+        id: `${view.runId}.started`,
+        source: SOURCE,
+        type: "run.started@v1",
+        time: view.startedAt,
+        subject: view.runId,
+        datacontenttype: "application/json",
+        data: {
+            runId: view.runId,
+            workItemId: view.workItem.id,
+            factory: view.factory,
+            factoryVersion: view.factoryVersion,
+            stages: view.stages.map((stage) => stage.stage),
+            startedAt: view.startedAt,
+            requester: view.workItem.requester,
+            source: view.workItem.origin.source,
+        },
+    };
+}
+export function runCompleted(view) {
+    const endedAt = view.endedAt ?? view.startedAt;
+    const last = [...view.stages].reverse().find((stage) => stage.state !== "pending");
+    return {
+        specversion: "1.0",
+        id: `${view.runId}.completed`,
+        source: SOURCE,
+        type: "run.completed@v1",
+        time: endedAt,
+        subject: view.runId,
+        datacontenttype: "application/json",
+        data: {
+            runId: view.runId,
+            workItemId: view.workItem.id,
+            ...(last ? { stage: last.stage } : {}),
+            factoryVersion: view.factoryVersion,
+            outcome: view.state === "complete" ? "succeeded" : view.state === "cancelled" ? "cancelled" : "failed",
+            startedAt: view.startedAt,
+            endedAt,
+            requester: view.workItem.requester,
+            source: view.workItem.origin.source,
+        },
+    };
+}
+//# sourceMappingURL=run.js.map

package/dist/domain/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/domain/run.ts"],"names":[],"mappings":"AAAA,oHAAoH;AACpH,qHAAqH;AACrH,qGAAqG;AACrG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAqCzC,MAAM,KAAK,GAA0B,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAElF,4FAA4F;AAC5F,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,UAAkB,EAAU,EAAE,CACpD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAE9E,MAAM,UAAU,SAAS,CAAC,QAAkB,EAAE,UAAsB,EAAE,OAAe,EAAE,SAAiB;IACtG,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,QAAQ;QACR,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,cAAc,EAAE,OAAO;QACvB,KAAK,EAAE,SAAS;QAChB,SAAS;QACT,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;KAC1F,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAE1E,MAAM,UAAU,QAAQ,CAAC,IAAa,EAAE,UAAsB;IAC5D,IAAI,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC3C,wGAAwG;IACxG,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAc,CAAC;IAC9C,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAC1G,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAC5F,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AACtC,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,KAAK,CAAC,IAAa,EAAE,IAAU,EAAE,EAAU;IACzD,MAAM,IAAI,GAAY,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,GAAG,GAAG,CAAC,KAAe,EAAW,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5E,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/B,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAc,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;YACzF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAc,CAAC;YACnD,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAClG,IAAI,KAAK,KAAK,WAAW;gBAAE,OAAO,GAAG,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACtF,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,CAAC;QACD,KAAK,WAAW,CAAC;QACjB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,OAAO,GAAe,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC/E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM;gBAC7B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;oBACxD,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,IAAa,EAAE,IAAsC,EAAE,GAAiC;IACpG,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAc,CAAC;IACnD,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;QACxB,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAC9B,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;QACxB,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC;IACD,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC;IACzB,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC;AACvB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,IAAI,UAAU,KAAK,UAAU;QAAE,OAAO,WAAW,CAAC;IAClD,IAAI,UAAU,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC;IACnD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,QAAQ,CAAC,WAAmB,EAAE,QAAkB;IAC9D,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,mBAAmB,QAAQ,CAAC,EAAE,OAAO,QAAQ,CAAC,KAAK,GAAG,WAAW,IAAI,CAAC;AACvG,CAAC;AAID,mGAAmG;AACnG,MAAM,UAAU,QAAQ,CAAC,IAAa;IACpC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IAC7G,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,oCAAoC,CAAC;IAClE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,6CAA6C,CAAC;IACxG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAa,EAAE,KAAa,EAAU,EAAE,CACpE,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,qBAAqB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;AAEzE,MAAM,MAAM,GAAG,cAAc,CAAC;AAE9B,MAAM,UAAU,UAAU,CAAC,IAAa;IACtC,OAAO;QACL,WAAW,EAAE,KAAK;QAClB,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,UAAU;QAC3B,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,IAAI,CAAC,SAAS;QACpB,OAAO,EAAE,IAAI,CAAC,KAAK;QACnB,eAAe,EAAE,kBAAkB;QACnC,IAAI,EAAE;YACJ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;YAC/C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;YAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM;SACpC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC;IAC/C,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IACnF,OAAO;QACL,WAAW,EAAE,KAAK;QAClB,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,YAAY;QAC7B,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,IAAI,CAAC,KAAK;QACnB,eAAe,EAAE,kBAAkB;QACnC,IAAI,EAAE;YACJ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAC5B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,OAAO,EAAE,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;YACtG,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;YAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM;SACpC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/time.js

@@ -0,0 +1,3 @@
+// The time of the module: OSF_NOW, like 2026-01-01T00:00:00Z, when the testkit or a person fixes it, else the clock.
+export const isoNow = (fixed) => new Date(fixed ? Date.parse(fixed) : Date.now()).toISOString();
+//# sourceMappingURL=time.js.map

package/dist/domain/time.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.js","sourceRoot":"","sources":["../../src/domain/time.ts"],"names":[],"mappings":"AAAA,qHAAqH;AAErH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAyB,EAAU,EAAE,CAC1D,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC"}

package/dist/workflows/activities.js

@@ -0,0 +1,105 @@
+// The activities of a run (ADR 0067). `next` and `apply` are local activities around the domain, so a run's logic runs
+// in the worker's thread; the others reach outside: the sandbox, the harness, gatekeeper and NATS.
+import { mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { Context } from "@temporalio/activity";
+import { startTurn } from "../adapters/harness.js";
+import { SUBJECTS } from "../adapters/nats.js";
+import { createSandbox } from "../adapters/sandbox.js";
+import { apply, gateSummaryOf, nextStep, promptOf, runCompleted, runStarted, } from "../domain/run.js";
+/** The command line of an adapter by its name, as program and arguments. */
+const commandLine = (lines, name, otherwise) => (lines[name] ?? otherwise).split(" ");
+export function activities(deps) {
+    /** The turn's stop reason; meanwhile it sends the run's new steering messages and reports that the stage lives. */
+    async function untilDone(turn, runId, steered) {
+        const context = Context.current();
+        context.cancellationSignal.addEventListener("abort", () => turn.cancel());
+        let sent = steered;
+        const watch = setInterval(() => {
+            context.heartbeat();
+            deps.steering(runId).then((messages) => {
+                for (const message of messages.slice(sent))
+                    turn.steer(message);
+                sent = Math.max(sent, messages.length);
+            }, () => undefined);
+        }, deps.pollMs);
+        try {
+            return await turn.done;
+        }
+        finally {
+            clearInterval(watch);
+            await turn.close();
+        }
+    }
+    return {
+        async next(view, definition) {
+            return nextStep(view, definition);
+        },
+        async apply(view, fact) {
+            return apply(view, fact, deps.now());
+        },
+        async publishStarted(view) {
+            await deps.bus?.publish(SUBJECTS.runStarted, runStarted(view));
+        },
+        async publishCompleted(view) {
+            await deps.bus?.publish(SUBJECTS.runCompleted, runCompleted(view));
+        },
+        async requestGate(view, definition, index) {
+            const plan = definition.stages[index];
+            const origin = view.workItem.origin.url;
+            const gate = await deps.gatekeeper.request({
+                workItem: view.workItem.id,
+                stage: plan?.stage ?? "",
+                summary: gateSummaryOf(view, index),
+                ...(origin ? { links: [{ url: origin, title: "Origin" }] } : {}),
+                change: { factory: definition.factory, policy: plan?.gate?.policy, approvers: plan?.gate?.approvers ?? [] },
+            });
+            return { kind: "gate", index, gateId: gate.id, state: gate.state };
+        },
+        /** Runs the stage's agent, in a sandbox when it declares one; steering messages from the `steered`-th on are for it. */
+        async runStage(view, definition, index, steered) {
+            const plan = definition.stages[index];
+            if (!plan)
+                throw new Error(`no stage ${index}`);
+            const cwd = join(deps.data, "runs", view.runId);
+            mkdirSync(cwd, { recursive: true });
+            const attributes = {
+                "osf.run.id": view.runId,
+                "osf.work_item.id": view.workItem.id,
+                "osf.stage": plan.stage,
+                "osf.factory.version": view.factoryVersion,
+            };
+            const resource = Object.entries(attributes)
+                .map(([key, value]) => `${key}=${value}`)
+                .join(",");
+            const harness = commandLine(deps.harnesses, plan.harness, `npx -y @opensoftware/harness-${plan.harness} run`);
+            const adapter = definition.sandboxAdapter;
+            const sandbox = plan.sandbox
+                ? await createSandbox(commandLine(deps.sandboxes, adapter, `npx -y @opensoftware/sandbox-${adapter}`), { ...plan.sandbox, env: { OTEL_RESOURCE_ATTRIBUTES: resource } }, cwd, view.runId, deps.env)
+                : undefined;
+            try {
+                const prompt = promptOf(plan.prompt, view.workItem);
+                const turn = await startTurn(sandbox
+                    ? { command: sandbox.exec(harness), cwd, folder: await sandbox.copyIn(), env: deps.env, prompt }
+                    : {
+                        command: harness,
+                        cwd,
+                        folder: cwd,
+                        env: {
+                            ...deps.env,
+                            OSF_DATA: join(deps.data, "harness", plan.harness),
+                            OTEL_RESOURCE_ATTRIBUTES: resource,
+                        },
+                        prompt,
+                    });
+                const stopReason = await untilDone(turn, view.runId, steered);
+                await sandbox?.copyOut();
+                return { kind: "stage-ended", index, stopReason, sessionId: turn.sessionId };
+            }
+            finally {
+                await sandbox?.destroy();
+            }
+        },
+    };
+}
+//# sourceMappingURL=activities.js.map

package/dist/workflows/activities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activities.js","sourceRoot":"","sources":["../../src/workflows/activities.ts"],"names":[],"mappings":"AAAA,uHAAuH;AACvH,mGAAmG;AACnG,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE/C,OAAO,EAAoB,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAY,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EACL,KAAK,EAEL,aAAa,EACb,QAAQ,EACR,QAAQ,EAER,YAAY,EACZ,UAAU,GAEX,MAAM,kBAAkB,CAAC;AAqB1B,4EAA4E;AAC5E,MAAM,WAAW,GAAG,CAAC,KAA6B,EAAE,IAAY,EAAE,SAAiB,EAAY,EAAE,CAC/F,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAExC,MAAM,UAAU,UAAU,CAAC,IAAkB;IAC3C,mHAAmH;IACnH,KAAK,UAAU,SAAS,CAAC,IAAiB,EAAE,KAAa,EAAE,OAAe;QACxE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAClC,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1E,IAAI,IAAI,GAAG,OAAO,CAAC;QACnB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC7B,OAAO,CAAC,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CACvB,CAAC,QAAQ,EAAE,EAAE;gBACX,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAChE,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzC,CAAC,EACD,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACJ,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAChB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,IAAa,EAAE,UAAsB;YAC9C,OAAO,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAa,EAAE,IAAU;YACnC,OAAO,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,IAAa;YAChC,MAAM,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,IAAa;YAClC,MAAM,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,IAAa,EAAE,UAAsB,EAAE,KAAa;YACpE,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBACzC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAC1B,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE;gBACxB,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC;gBACnC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,MAAM,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,IAAI,EAAE,EAAE;aAC5G,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACrE,CAAC;QACD,wHAAwH;QACxH,KAAK,CAAC,QAAQ,CAAC,IAAa,EAAE,UAAsB,EAAE,KAAa,EAAE,OAAe;YAClF,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC;YAChD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAChD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,MAAM,UAAU,GAAG;gBACjB,YAAY,EAAE,IAAI,CAAC,KAAK;gBACxB,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACpC,WAAW,EAAE,IAAI,CAAC,KAAK;gBACvB,qBAAqB,EAAE,IAAI,CAAC,cAAc;aAC3C,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;iBACxC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;iBACxC,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,gCAAgC,IAAI,CAAC,OAAO,MAAM,CAAC,CAAC;YAC9G,MAAM,OAAO,GAAG,UAAU,CAAC,cAAc,CAAC;YAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO;gBAC1B,CAAC,CAAC,MAAM,aAAa,CACjB,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,gCAAgC,OAAO,EAAE,CAAC,EAC/E,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,wBAAwB,EAAE,QAAQ,EAAE,EAAE,EAChE,GAAG,EACH,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,GAAG,CACT;gBACH,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACpD,MAAM,IAAI,GAAG,MAAM,SAAS,CAC1B,OAAO;oBACL,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE;oBAChG,CAAC,CAAC;wBACE,OAAO,EAAE,OAAO;wBAChB,GAAG;wBACH,MAAM,EAAE,GAAG;wBACX,GAAG,EAAE;4BACH,GAAG,IAAI,CAAC,GAAG;4BACX,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC;4BAClD,wBAAwB,EAAE,QAAQ;yBACnC;wBACD,MAAM;qBACP,CACN,CAAC;gBACF,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC9D,MAAM,OAAO,EAAE,OAAO,EAAE,CAAC;gBACzB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/E,CAAC;oBAAS,CAAC;gBACT,MAAM,OAAO,EAAE,OAAO,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}