@panorama-ai/gateway 2.28.50 → 2.30.176

package/dist/managed-runtime.js

@@ -0,0 +1,224 @@
+import { randomUUID } from 'node:crypto';
+import { setTimeout as sleep } from 'node:timers/promises';
+import { resolveManagedGatewayRuntimeConfig, } from './managed-runtime/config.js';
+import { resolveManagedGatewayRuntimeDependencies, } from './managed-runtime/dependencies.js';
+import { executeManagedLinuxExecution } from './managed-runtime/execution-dispatcher.js';
+import { startHostHeartbeatLoop } from './managed-runtime/heartbeat.js';
+import { describeLinuxHostStopReason, readLinuxHostObservedState, } from './managed-runtime/host-state.js';
+import { MANAGED_GATEWAY_LOG_PREFIX } from './managed-runtime/runtime-utils.js';
+import { createWakeSignal } from './managed-runtime/wake-signal.js';
+export { buildManagedShellExecutionEnv } from './managed-runtime/shell-execution.js';
+export { resolveManagedGatewayRuntimeConfig } from './managed-runtime/config.js';
+export async function startManagedGatewayRuntime(config = resolveManagedGatewayRuntimeConfig(), dependencies = {}) {
+    const runtimeDependencies = resolveManagedGatewayRuntimeDependencies(dependencies);
+    let shutdownRequested = false;
+    let draining = false;
+    let reconciliationRequired = true;
+    let activeExecutionId = null;
+    let requestWakeSignal = null;
+    let fatalHeartbeatError = null;
+    const requestShutdown = (reason) => {
+        if (shutdownRequested) {
+            return;
+        }
+        shutdownRequested = true;
+        requestWakeSignal?.(reason);
+    };
+    const applyObservedHostState = (state, source) => {
+        const stopReason = describeLinuxHostStopReason(state, config.hostAttemptGeneration);
+        if (shutdownRequested) {
+            return;
+        }
+        if (stopReason) {
+            if (!draining) {
+                draining = true;
+                console.log(`${MANAGED_GATEWAY_LOG_PREFIX} draining due to host lifecycle signal`, {
+                    source,
+                    reason: stopReason,
+                    hostId: config.hostId,
+                    attemptGeneration: config.hostAttemptGeneration,
+                    status: state.status,
+                    runtimeState: state.runtimeState,
+                    desiredPowerState: state.desiredPowerState,
+                    allocationState: state.allocationState,
+                });
+                requestWakeSignal?.('host_drain_requested');
+            }
+            return;
+        }
+        if (draining) {
+            draining = false;
+            console.log(`${MANAGED_GATEWAY_LOG_PREFIX} host became runnable again; resuming dispatch`, {
+                source,
+                hostId: config.hostId,
+                attemptGeneration: config.hostAttemptGeneration,
+            });
+            requestWakeSignal?.('host_runnable_again');
+        }
+    };
+    const heartbeatHost = async () => {
+        const host = await runtimeDependencies.heartbeatLinuxHost({
+            controlUrl: config.hostControlUrl,
+            controlToken: config.hostControlToken,
+            runtimeId: config.runtimeId,
+            controlTimeoutMs: config.controlTimeoutMs,
+        });
+        const observedHostState = readLinuxHostObservedState(host);
+        applyObservedHostState(observedHostState, 'heartbeat');
+        if (!shutdownRequested &&
+            !draining &&
+            !activeExecutionId &&
+            requestWakeSignal &&
+            !describeLinuxHostStopReason(observedHostState, config.hostAttemptGeneration)) {
+            requestWakeSignal('heartbeat_tick');
+        }
+    };
+    const onSignal = (signal) => {
+        console.log(`${MANAGED_GATEWAY_LOG_PREFIX} received shutdown signal`, { signal });
+        requestShutdown('shutdown');
+    };
+    console.log(`${MANAGED_GATEWAY_LOG_PREFIX} starting managed gateway runtime`, {
+        agentId: config.agentId,
+        hostId: config.hostId,
+        attemptGeneration: config.hostAttemptGeneration,
+        runtimeId: config.runtimeId,
+    });
+    let stopHeartbeat = null;
+    let stopRealtimeWakeLoop = null;
+    let unsubscribeAuthStateChange = null;
+    const removeSignalHandlers = runtimeDependencies.registerSignalHandlers(onSignal);
+    try {
+        await heartbeatHost();
+        if (shutdownRequested) {
+            return;
+        }
+        const { requestWake, waitForWake } = createWakeSignal('startup');
+        requestWakeSignal = requestWake;
+        const realtimeClient = await runtimeDependencies.createRealtimeClient({
+            supabaseUrl: config.supabaseUrl,
+            supabaseAnonKey: config.supabaseAnonKey,
+            hostControlToken: config.hostControlToken,
+            agentId: config.agentId,
+            hostId: config.hostId,
+            hostAttemptGeneration: config.hostAttemptGeneration,
+            controlTimeoutMs: config.controlTimeoutMs,
+        });
+        unsubscribeAuthStateChange = realtimeClient.unsubscribeAuthStateChange;
+        stopRealtimeWakeLoop = runtimeDependencies.startRealtimeWakeLoop({
+            supabase: realtimeClient.supabase,
+            hostId: config.hostId,
+            hostAttemptGeneration: config.hostAttemptGeneration,
+            retryBackoffMs: config.retryBackoffMs,
+            onReconnectRequired() {
+                reconciliationRequired = true;
+            },
+            onHostStateObserved: applyObservedHostState,
+            requestWake,
+            shouldStop: () => shutdownRequested,
+        });
+        stopHeartbeat = startHostHeartbeatLoop({
+            intervalMs: config.heartbeatIntervalMs,
+            maxConsecutiveFailures: config.maxConsecutiveHeartbeatFailures,
+            heartbeatHost,
+            onFatalFailure: (error) => {
+                if (fatalHeartbeatError) {
+                    return;
+                }
+                fatalHeartbeatError = error;
+                console.error(`${MANAGED_GATEWAY_LOG_PREFIX} stopping after repeated heartbeat failures`, { error });
+                requestShutdown('heartbeat_failure');
+            },
+        });
+        while (!shutdownRequested) {
+            await waitForWake();
+            if (fatalHeartbeatError || shutdownRequested) {
+                break;
+            }
+            if (reconciliationRequired) {
+                try {
+                    const reconciliation = await runtimeDependencies.reconcileExecutionLifecycle({
+                        controlUrl: config.hostControlUrl,
+                        controlToken: config.hostControlToken,
+                        runtimeId: config.runtimeId,
+                        controlTimeoutMs: config.controlTimeoutMs,
+                    });
+                    reconciliationRequired = false;
+                    if (reconciliation.recoveredCount > 0 || reconciliation.requeuedCount > 0) {
+                        console.log(`${MANAGED_GATEWAY_LOG_PREFIX} reconciled stale managed executions`, reconciliation);
+                    }
+                }
+                catch (error) {
+                    console.error(`${MANAGED_GATEWAY_LOG_PREFIX} failed to reconcile execution lifecycle`, { error });
+                    await sleep(config.retryBackoffMs);
+                    requestWake('reconcile_retry');
+                    continue;
+                }
+            }
+            if (draining) {
+                continue;
+            }
+            while (!shutdownRequested && !draining) {
+                try {
+                    const claimToken = randomUUID();
+                    const execution = await runtimeDependencies.dispatchLinuxExecution({
+                        controlUrl: config.hostControlUrl,
+                        controlToken: config.hostControlToken,
+                        runtimeId: config.runtimeId,
+                        claimToken,
+                        controlTimeoutMs: config.controlTimeoutMs,
+                    });
+                    if (!execution?.id) {
+                        break;
+                    }
+                    console.log(`${MANAGED_GATEWAY_LOG_PREFIX} running managed execution`, {
+                        executionId: execution.id,
+                        agentId: execution.agent_id,
+                    });
+                    const outcome = await executeManagedLinuxExecution({
+                        config,
+                        execution,
+                        registerCancellation: () => undefined,
+                        onExecutionStarted(executionId) {
+                            activeExecutionId = executionId;
+                        },
+                        onExecutionFinished() {
+                            activeExecutionId = null;
+                        },
+                        dependencies: runtimeDependencies,
+                    });
+                    if (outcome.reconciliationRequired) {
+                        reconciliationRequired = true;
+                        requestWake(outcome.wakeReason ?? 'post_execution_reconcile');
+                        break;
+                    }
+                    if (reconciliationRequired) {
+                        requestWake('post_execution_reconcile');
+                        break;
+                    }
+                }
+                catch (error) {
+                    console.error(`${MANAGED_GATEWAY_LOG_PREFIX} failed to dispatch managed execution`, { error });
+                    reconciliationRequired = true;
+                    await sleep(config.retryBackoffMs);
+                    requestWake('dispatch_retry');
+                    break;
+                }
+            }
+        }
+    }
+    finally {
+        stopHeartbeat?.();
+        await stopRealtimeWakeLoop?.();
+        unsubscribeAuthStateChange?.();
+        removeSignalHandlers();
+        console.log(`${MANAGED_GATEWAY_LOG_PREFIX} stopped managed gateway runtime`, {
+            agentId: config.agentId,
+            hostId: config.hostId,
+            attemptGeneration: config.hostAttemptGeneration,
+        });
+    }
+    if (fatalHeartbeatError) {
+        throw fatalHeartbeatError;
+    }
+}
+//# sourceMappingURL=managed-runtime.js.map

package/dist/managed-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-runtime.js","sourceRoot":"","sources":["../src/managed-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EACL,kCAAkC,GAEnC,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACL,wCAAwC,GAEzC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAA;AACxF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,GAE3B,MAAM,iCAAiC,CAAA;AACxC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAA;AAEnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAA;AACpF,OAAO,EAAE,kCAAkC,EAAE,MAAM,6BAA6B,CAAA;AAIhF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,SAAsC,kCAAkC,EAAE,EAC1E,eAAkD,EAAE;IAEpD,MAAM,mBAAmB,GAAG,wCAAwC,CAAC,YAAY,CAAC,CAAA;IAClF,IAAI,iBAAiB,GAAG,KAAK,CAAA;IAC7B,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,sBAAsB,GAAG,IAAI,CAAA;IACjC,IAAI,iBAAiB,GAAkB,IAAI,CAAA;IAC3C,IAAI,iBAAiB,GAAsC,IAAI,CAAA;IAC/D,IAAI,mBAAmB,GAAiB,IAAI,CAAA;IAE5C,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,EAAE;QACzC,IAAI,iBAAiB,EAAE,CAAC;YACtB,OAAM;QACR,CAAC;QACD,iBAAiB,GAAG,IAAI,CAAA;QACxB,iBAAiB,EAAE,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC,CAAA;IAED,MAAM,sBAAsB,GAAG,CAAC,KAA6B,EAAE,MAAc,EAAE,EAAE;QAC/E,MAAM,UAAU,GAAG,2BAA2B,CAAC,KAAK,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAA;QACnF,IAAI,iBAAiB,EAAE,CAAC;YACtB,OAAM;QACR,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,IAAI,CAAA;gBACf,OAAO,CAAC,GAAG,CAAC,GAAG,0BAA0B,wCAAwC,EAAE;oBACjF,MAAM;oBACN,MAAM,EAAE,UAAU;oBAClB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,iBAAiB,EAAE,MAAM,CAAC,qBAAqB;oBAC/C,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;oBAC1C,eAAe,EAAE,KAAK,CAAC,eAAe;iBACvC,CAAC,CAAA;gBACF,iBAAiB,EAAE,CAAC,sBAAsB,CAAC,CAAA;YAC7C,CAAC;YACD,OAAM;QACR,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,GAAG,KAAK,CAAA;YAChB,OAAO,CAAC,GAAG,CAAC,GAAG,0BAA0B,gDAAgD,EAAE;gBACzF,MAAM;gBACN,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,iBAAiB,EAAE,MAAM,CAAC,qBAAqB;aAChD,CAAC,CAAA;YACF,iBAAiB,EAAE,CAAC,qBAAqB,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,KAAK,IAAI,EAAE;QAC/B,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,kBAAkB,CAAC;YACxD,UAAU,EAAE,MAAM,CAAC,cAAc;YACjC,YAAY,EAAE,MAAM,CAAC,gBAAgB;YACrC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SAC1C,CAAC,CAAA;QACF,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAA;QAC1D,sBAAsB,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAA;QAEtD,IACE,CAAC,iBAAiB;YAClB,CAAC,QAAQ;YACT,CAAC,iBAAiB;YAClB,iBAAiB;YACjB,CAAC,2BAA2B,CAAC,iBAAiB,EAAE,MAAM,CAAC,qBAAqB,CAAC,EAC7E,CAAC;YACD,iBAAiB,CAAC,gBAAgB,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,CAAC,MAAsB,EAAE,EAAE;QAC1C,OAAO,CAAC,GAAG,CAAC,GAAG,0BAA0B,2BAA2B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QACjF,eAAe,CAAC,UAAU,CAAC,CAAA;IAC7B,CAAC,CAAA;IAED,OAAO,CAAC,GAAG,CAAC,GAAG,0BAA0B,mCAAmC,EAAE;QAC5E,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,iBAAiB,EAAE,MAAM,CAAC,qBAAqB;QAC/C,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAA;IAEF,IAAI,aAAa,GAAwB,IAAI,CAAA;IAC7C,IAAI,oBAAoB,GAAiC,IAAI,CAAA;IAC7D,IAAI,0BAA0B,GAAwB,IAAI,CAAA;IAC1D,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAEjF,IAAI,CAAC;QACH,MAAM,aAAa,EAAE,CAAA;QACrB,IAAI,iBAAiB,EAAE,CAAC;YACtB,OAAM;QACR,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;QAChE,iBAAiB,GAAG,WAAW,CAAA;QAC/B,MAAM,cAAc,GAAG,MAAM,mBAAmB,CAAC,oBAAoB,CAAC;YACpE,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;YACnD,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SAC1C,CAAC,CAAA;QACF,0BAA0B,GAAG,cAAc,CAAC,0BAA0B,CAAA;QACtE,oBAAoB,GAAG,mBAAmB,CAAC,qBAAqB,CAAC;YAC/D,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;YACnD,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,mBAAmB;gBACjB,sBAAsB,GAAG,IAAI,CAAA;YAC/B,CAAC;YACD,mBAAmB,EAAE,sBAAsB;YAC3C,WAAW;YACX,UAAU,EAAE,GAAG,EAAE,CAAC,iBAAiB;SACpC,CAAC,CAAA;QAEF,aAAa,GAAG,sBAAsB,CAAC;YACrC,UAAU,EAAE,MAAM,CAAC,mBAAmB;YACtC,sBAAsB,EAAE,MAAM,CAAC,+BAA+B;YAC9D,aAAa;YACb,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE;gBACxB,IAAI,mBAAmB,EAAE,CAAC;oBACxB,OAAM;gBACR,CAAC;gBAED,mBAAmB,GAAG,KAAK,CAAA;gBAC3B,OAAO,CAAC,KAAK,CAAC,GAAG,0BAA0B,6CAA6C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;gBACpG,eAAe,CAAC,mBAAmB,CAAC,CAAA;YACtC,CAAC;SACF,CAAC,CAAA;QAEF,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC1B,MAAM,WAAW,EAAE,CAAA;YACnB,IAAI,mBAAmB,IAAI,iBAAiB,EAAE,CAAC;gBAC7C,MAAK;YACP,CAAC;YAED,IAAI,sBAAsB,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,MAAM,cAAc,GAAG,MAAM,mBAAmB,CAAC,2BAA2B,CAAC;wBAC3E,UAAU,EAAE,MAAM,CAAC,cAAc;wBACjC,YAAY,EAAE,MAAM,CAAC,gBAAgB;wBACrC,SAAS,EAAE,MAAM,CAAC,SAAS;wBAC3B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;qBAC1C,CAAC,CAAA;oBACF,sBAAsB,GAAG,KAAK,CAAA;oBAC9B,IAAI,cAAc,CAAC,cAAc,GAAG,CAAC,IAAI,cAAc,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;wBAC1E,OAAO,CAAC,GAAG,CAAC,GAAG,0BAA0B,sCAAsC,EAAE,cAAc,CAAC,CAAA;oBAClG,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,GAAG,0BAA0B,0CAA0C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;oBACjG,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;oBAClC,WAAW,CAAC,iBAAiB,CAAC,CAAA;oBAC9B,SAAQ;gBACV,CAAC;YACH,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACb,SAAQ;YACV,CAAC;YAED,OAAO,CAAC,iBAAiB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACvC,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,UAAU,EAAE,CAAA;oBAC/B,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,sBAAsB,CAAC;wBACjE,UAAU,EAAE,MAAM,CAAC,cAAc;wBACjC,YAAY,EAAE,MAAM,CAAC,gBAAgB;wBACrC,SAAS,EAAE,MAAM,CAAC,SAAS;wBAC3B,UAAU;wBACV,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;qBAC1C,CAAC,CAAA;oBAEF,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC;wBACnB,MAAK;oBACP,CAAC;oBAED,OAAO,CAAC,GAAG,CAAC,GAAG,0BAA0B,4BAA4B,EAAE;wBACrE,WAAW,EAAE,SAAS,CAAC,EAAE;wBACzB,OAAO,EAAE,SAAS,CAAC,QAAQ;qBAC5B,CAAC,CAAA;oBACF,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC;wBACjD,MAAM;wBACN,SAAS;wBACT,oBAAoB,EAAE,GAAG,EAAE,CAAC,SAAS;wBACrC,kBAAkB,CAAC,WAAW;4BAC5B,iBAAiB,GAAG,WAAW,CAAA;wBACjC,CAAC;wBACD,mBAAmB;4BACjB,iBAAiB,GAAG,IAAI,CAAA;wBAC1B,CAAC;wBACD,YAAY,EAAE,mBAAmB;qBAClC,CAAC,CAAA;oBAEF,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC;wBACnC,sBAAsB,GAAG,IAAI,CAAA;wBAC7B,WAAW,CAAC,OAAO,CAAC,UAAU,IAAI,0BAA0B,CAAC,CAAA;wBAC7D,MAAK;oBACP,CAAC;oBAED,IAAI,sBAAsB,EAAE,CAAC;wBAC3B,WAAW,CAAC,0BAA0B,CAAC,CAAA;wBACvC,MAAK;oBACP,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,GAAG,0BAA0B,uCAAuC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;oBAC9F,sBAAsB,GAAG,IAAI,CAAA;oBAC7B,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;oBAClC,WAAW,CAAC,gBAAgB,CAAC,CAAA;oBAC7B,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,aAAa,EAAE,EAAE,CAAA;QACjB,MAAM,oBAAoB,EAAE,EAAE,CAAA;QAC9B,0BAA0B,EAAE,EAAE,CAAA;QAC9B,oBAAoB,EAAE,CAAA;QACtB,OAAO,CAAC,GAAG,CAAC,GAAG,0BAA0B,kCAAkC,EAAE;YAC3E,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,iBAAiB,EAAE,MAAM,CAAC,qBAAqB;SAChD,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,mBAAmB,CAAA;IAC3B,CAAC;AACH,CAAC"}

package/dist/process-control.d.ts

@@ -0,0 +1,9 @@
+import type { ChildProcess } from 'node:child_process';
+export interface TerminationOptions {
+    graceMs: number;
+    reason: string;
+    onError?: (phase: 'sigterm' | 'sigkill', error: unknown) => void;
+}
+export declare function isChildProcessRunning(child: ChildProcess | undefined): boolean;
+export declare function requestChildTermination(child: ChildProcess | undefined, options: TerminationOptions): void;
+//# sourceMappingURL=process-control.d.ts.map

package/dist/process-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-control.d.ts","sourceRoot":"","sources":["../src/process-control.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAItD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;CACjE;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,CAG9E;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,YAAY,GAAG,SAAS,EAC/B,OAAO,EAAE,kBAAkB,GAC1B,IAAI,CAuBN"}

package/dist/process-control.js

@@ -0,0 +1,32 @@
+export function isChildProcessRunning(child) {
+    if (!child)
+        return false;
+    return child.exitCode === null && child.signalCode === null;
+}
+export function requestChildTermination(child, options) {
+    if (!child)
+        return;
+    if (!isChildProcessRunning(child))
+        return;
+    try {
+        child.kill('SIGTERM');
+    }
+    catch (error) {
+        options.onError?.('sigterm', error);
+        return;
+    }
+    const killTimer = setTimeout(() => {
+        if (!isChildProcessRunning(child))
+            return;
+        try {
+            child.kill('SIGKILL');
+        }
+        catch (error) {
+            options.onError?.('sigkill', error);
+        }
+    }, options.graceMs);
+    if (typeof killTimer.unref === 'function') {
+        killTimer.unref();
+    }
+}
+//# sourceMappingURL=process-control.js.map

package/dist/process-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-control.js","sourceRoot":"","sources":["../src/process-control.ts"],"names":[],"mappings":"AAUA,MAAM,UAAU,qBAAqB,CAAC,KAA+B;IACnE,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,OAAO,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAA;AAC7D,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,KAA+B,EAC/B,OAA2B;IAE3B,IAAI,CAAC,KAAK;QAAE,OAAM;IAClB,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;QAAE,OAAM;IAEzC,IAAI,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,SAAuB,CAAC,CAAA;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QACnC,OAAM;IACR,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;QAChC,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;YAAE,OAAM;QACzC,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,SAAuB,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IAEnB,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAC1C,SAAS,CAAC,KAAK,EAAE,CAAA;IACnB,CAAC;AACH,CAAC"}

package/dist/process-output-capture.d.ts

@@ -0,0 +1,21 @@
+export interface BoundedOutputCaptureSnapshot {
+    text: string;
+    observedBytes: number;
+    capturedBytes: number;
+    truncated: boolean;
+}
+export declare class BoundedOutputCapture {
+    private readonly maxBytes;
+    private readonly chunks;
+    private observedByteCount;
+    private capturedByteCount;
+    private wasTruncated;
+    constructor(maxBytes: number);
+    append(chunk: Buffer): void;
+    get observedBytes(): number;
+    get capturedBytes(): number;
+    get truncated(): boolean;
+    readText(): string;
+    snapshot(): BoundedOutputCaptureSnapshot;
+}
+//# sourceMappingURL=process-output-capture.d.ts.map

package/dist/process-output-capture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-output-capture.d.ts","sourceRoot":"","sources":["../src/process-output-capture.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAA;IACrB,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,qBAAa,oBAAoB;IAMnB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IALrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,iBAAiB,CAAI;IAC7B,OAAO,CAAC,iBAAiB,CAAI;IAC7B,OAAO,CAAC,YAAY,CAAQ;gBAEC,QAAQ,EAAE,MAAM;IAE7C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAoB3B,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,QAAQ,IAAI,MAAM;IAIlB,QAAQ,IAAI,4BAA4B;CAQzC"}

package/dist/process-output-capture.js

@@ -0,0 +1,47 @@
+export class BoundedOutputCapture {
+    maxBytes;
+    chunks = [];
+    observedByteCount = 0;
+    capturedByteCount = 0;
+    wasTruncated = false;
+    constructor(maxBytes) {
+        this.maxBytes = maxBytes;
+    }
+    append(chunk) {
+        this.observedByteCount += chunk.length;
+        if (this.capturedByteCount >= this.maxBytes) {
+            this.wasTruncated = true;
+            return;
+        }
+        const remainingBytes = this.maxBytes - this.capturedByteCount;
+        if (chunk.length > remainingBytes) {
+            this.chunks.push(Buffer.from(chunk.subarray(0, remainingBytes)));
+            this.capturedByteCount = this.maxBytes;
+            this.wasTruncated = true;
+            return;
+        }
+        this.chunks.push(Buffer.from(chunk));
+        this.capturedByteCount += chunk.length;
+    }
+    get observedBytes() {
+        return this.observedByteCount;
+    }
+    get capturedBytes() {
+        return this.capturedByteCount;
+    }
+    get truncated() {
+        return this.wasTruncated;
+    }
+    readText() {
+        return Buffer.concat(this.chunks, this.capturedByteCount).toString('utf8');
+    }
+    snapshot() {
+        return {
+            text: this.readText(),
+            observedBytes: this.observedByteCount,
+            capturedBytes: this.capturedByteCount,
+            truncated: this.wasTruncated,
+        };
+    }
+}
+//# sourceMappingURL=process-output-capture.js.map

package/dist/process-output-capture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-output-capture.js","sourceRoot":"","sources":["../src/process-output-capture.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,oBAAoB;IAMF;IALZ,MAAM,GAAa,EAAE,CAAA;IAC9B,iBAAiB,GAAG,CAAC,CAAA;IACrB,iBAAiB,GAAG,CAAC,CAAA;IACrB,YAAY,GAAG,KAAK,CAAA;IAE5B,YAA6B,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEjD,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC,MAAM,CAAA;QAEtC,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;YACxB,OAAM;QACR,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAA;QAC7D,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAA;YAChE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CAAA;YACtC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;YACxB,OAAM;QACR,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;QACpC,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC,MAAM,CAAA;IACxC,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,iBAAiB,CAAA;IAC/B,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,iBAAiB,CAAA;IAC/B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,YAAY,CAAA;IAC1B,CAAC;IAED,QAAQ;QACN,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC5E,CAAC;IAED,QAAQ;QACN,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,aAAa,EAAE,IAAI,CAAC,iBAAiB;YACrC,aAAa,EAAE,IAAI,CAAC,iBAAiB;YACrC,SAAS,EAAE,IAAI,CAAC,YAAY;SAC7B,CAAA;IACH,CAAC;CACF"}

package/dist/provider-runtime-utils.d.ts

@@ -0,0 +1,24 @@
+import { type ResolveProviderCommandOptions } from './cli-provider-commands.js';
+export interface ProviderChildProcessEnvOptions {
+    baseEnv?: NodeJS.ProcessEnv;
+    tmpDir?: string;
+    overrides?: NodeJS.ProcessEnv;
+}
+export interface GeminiProviderChildProcessEnvOptions extends ProviderChildProcessEnvOptions {
+    systemPromptPath?: string;
+    commandPath?: string;
+}
+export interface ParseProviderJsonFromTextOptions {
+    stripCodeFence?: boolean;
+    errorMessage?: string;
+}
+export declare function resolveClaudeProviderCommand(options?: ResolveProviderCommandOptions): string;
+export declare function resolveCodexProviderCommand(options?: ResolveProviderCommandOptions): string;
+export declare function resolveGeminiProviderCommand(options?: ResolveProviderCommandOptions): string;
+export declare function buildProviderChildProcessEnv(options?: ProviderChildProcessEnvOptions): NodeJS.ProcessEnv;
+export declare function withProviderPathEntries(current: string | undefined, entries: string[]): string;
+export declare function ensureNodeAndCommandPath(env: NodeJS.ProcessEnv, commandPath: string): void;
+export declare function buildGeminiProviderChildProcessEnv(options?: GeminiProviderChildProcessEnvOptions): NodeJS.ProcessEnv;
+export declare function stripProviderCodeFence(text: string): string;
+export declare function parseProviderJsonFromText(text: string, options?: ParseProviderJsonFromTextOptions): Record<string, unknown>;
+//# sourceMappingURL=provider-runtime-utils.d.ts.map

package/dist/provider-runtime-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-runtime-utils.d.ts","sourceRoot":"","sources":["../src/provider-runtime-utils.ts"],"names":[],"mappings":"AAGA,OAAO,EAIL,KAAK,6BAA6B,EACnC,MAAM,4BAA4B,CAAA;AAGnC,MAAM,WAAW,8BAA8B;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAC9B;AAED,MAAM,WAAW,oCAAqC,SAAQ,8BAA8B;IAC1F,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,gCAAgC;IAC/C,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,GAAE,6BAAkC,GAC1C,MAAM,CAER;AAED,wBAAgB,2BAA2B,CAAC,OAAO,GAAE,6BAAkC,GAAG,MAAM,CAE/F;AAED,wBAAgB,4BAA4B,CAAC,OAAO,GAAE,6BAAkC,GAAG,MAAM,CAEhG;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,GAAE,8BAAmC,GAC3C,MAAM,CAAC,UAAU,CAMnB;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAY9F;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAU1F;AAED,wBAAgB,kCAAkC,CAChD,OAAO,GAAE,oCAAyC,GACjD,MAAM,CAAC,UAAU,CAUnB;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM3D;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,gCAAqC,GAC7C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA+BzB"}

package/dist/provider-runtime-utils.js

@@ -0,0 +1,97 @@
+import path from 'node:path';
+import process from 'node:process';
+import { buildGatewayChildProcessEnv } from './child-process-env.js';
+import { resolveClaudeCommand, resolveCodexCommand, resolveGeminiCommand, } from './cli-provider-commands.js';
+import { resolveGatewayTmpDir } from './runtime-paths.js';
+export function resolveClaudeProviderCommand(options = {}) {
+    return resolveClaudeCommand(options);
+}
+export function resolveCodexProviderCommand(options = {}) {
+    return resolveCodexCommand(options);
+}
+export function resolveGeminiProviderCommand(options = {}) {
+    return resolveGeminiCommand(options);
+}
+export function buildProviderChildProcessEnv(options = {}) {
+    return buildGatewayChildProcessEnv({
+        baseEnv: options.baseEnv,
+        tmpDir: options.tmpDir ?? resolveGatewayTmpDir(),
+        overrides: options.overrides,
+    });
+}
+export function withProviderPathEntries(current, entries) {
+    const parts = (current ?? '')
+        .split(path.delimiter)
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+    const seen = new Set(parts);
+    for (const entry of entries) {
+        if (!entry || seen.has(entry))
+            continue;
+        parts.unshift(entry);
+        seen.add(entry);
+    }
+    return parts.join(path.delimiter);
+}
+export function ensureNodeAndCommandPath(env, commandPath) {
+    const entries = [];
+    const nodeDir = path.dirname(process.execPath);
+    if (nodeDir)
+        entries.push(nodeDir);
+    if (commandPath && path.isAbsolute(commandPath)) {
+        entries.push(path.dirname(commandPath));
+    }
+    if (entries.length > 0) {
+        env.PATH = withProviderPathEntries(env.PATH, entries);
+    }
+}
+export function buildGeminiProviderChildProcessEnv(options = {}) {
+    const env = buildProviderChildProcessEnv(options);
+    if (options.systemPromptPath) {
+        env.GEMINI_SYSTEM_MD = options.systemPromptPath;
+    }
+    const commandPath = options.commandPath ??
+        resolveGeminiProviderCommand({ env: options.baseEnv ?? process.env });
+    ensureNodeAndCommandPath(env, commandPath);
+    return env;
+}
+export function stripProviderCodeFence(text) {
+    const trimmed = text.trim();
+    if (trimmed.startsWith('```')) {
+        return trimmed.replace(/^```(?:json)?\n?/i, '').replace(/```$/i, '').trim();
+    }
+    return trimmed;
+}
+export function parseProviderJsonFromText(text, options = {}) {
+    const cleaned = options.stripCodeFence ? stripProviderCodeFence(text) : text.trim();
+    const tryParse = (value) => {
+        try {
+            return JSON.parse(value);
+        }
+        catch {
+            return null;
+        }
+    };
+    const direct = tryParse(cleaned);
+    if (direct)
+        return direct;
+    const lines = cleaned
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter(Boolean);
+    for (const line of lines) {
+        const parsed = tryParse(line);
+        if (parsed)
+            return parsed;
+    }
+    const firstBrace = cleaned.indexOf('{');
+    const lastBrace = cleaned.lastIndexOf('}');
+    if (firstBrace !== -1 && lastBrace > firstBrace) {
+        const slice = cleaned.slice(firstBrace, lastBrace + 1);
+        const parsed = tryParse(slice);
+        if (parsed)
+            return parsed;
+    }
+    throw new Error(options.errorMessage ?? 'Failed to parse JSON output');
+}
+//# sourceMappingURL=provider-runtime-utils.js.map

package/dist/provider-runtime-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-runtime-utils.js","sourceRoot":"","sources":["../src/provider-runtime-utils.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,OAAO,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AACpE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAkBzD,MAAM,UAAU,4BAA4B,CAC1C,UAAyC,EAAE;IAE3C,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,UAAyC,EAAE;IACrF,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAA;AACrC,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,UAAyC,EAAE;IACtF,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,UAA0C,EAAE;IAE5C,OAAO,2BAA2B,CAAC;QACjC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,oBAAoB,EAAE;QAChD,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAA2B,EAAE,OAAiB;IACpF,MAAM,KAAK,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;SAC1B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;SACrB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAA;IAClB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAQ;QACvC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACpB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACjB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AACnC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAsB,EAAE,WAAmB;IAClF,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9C,IAAI,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAClC,IAAI,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAA;IACzC,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACvD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,UAAgD,EAAE;IAElD,MAAM,GAAG,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAA;IACjD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,GAAG,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAA;IACjD,CAAC;IACD,MAAM,WAAW,GACf,OAAO,CAAC,WAAW;QACnB,4BAA4B,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IACvE,wBAAwB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IAC1C,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAC7E,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,IAAY,EACZ,UAA4C,EAAE;IAE9C,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IACnF,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAkC,EAAE;QACjE,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAA4B,CAAA;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAA;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;IAChC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IAEzB,MAAM,KAAK,GAAG,OAAO;SAClB,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAA;IAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC7B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;IAC3B,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAC1C,IAAI,UAAU,KAAK,CAAC,CAAC,IAAI,SAAS,GAAG,UAAU,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,GAAG,CAAC,CAAC,CAAA;QACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC9B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;IAC3B,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,IAAI,6BAA6B,CAAC,CAAA;AACxE,CAAC"}

package/dist/remote-shell-resource.d.ts

@@ -0,0 +1,30 @@
+import type { SupabaseClient } from '@supabase/supabase-js';
+import type { Database } from './database.types.js';
+import type { GatewayConfig } from './gateway-state.js';
+export interface RemoteShellResourceRow {
+    id: string;
+    team_id: string;
+    resource_type: string;
+    max_access_level: string | null;
+    metadata: unknown;
+}
+export interface RemoteShellResourceValidationOptions {
+    teamId: string;
+    gatewayId: string;
+    gatewayVmId?: string | null;
+    requiredAccess: 'read' | 'write';
+}
+export type RemoteShellResourceLogger = (message: string, data?: Record<string, unknown>) => void;
+export declare function validateRemoteShellResourceRow(resource: RemoteShellResourceRow | null, options: RemoteShellResourceValidationOptions): {
+    ok: true;
+} | {
+    ok: false;
+    message: string;
+};
+export declare function loadValidatedRemoteShellResource(supabase: SupabaseClient<Database>, config: GatewayConfig, resourceId: string, requiredAccess: 'read' | 'write', logError?: RemoteShellResourceLogger): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    message: string;
+}>;
+//# sourceMappingURL=remote-shell-resource.d.ts.map

package/dist/remote-shell-resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-shell-resource.d.ts","sourceRoot":"","sources":["../src/remote-shell-resource.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAEvD,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,oCAAoC;IACnD,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,cAAc,EAAE,MAAM,GAAG,OAAO,CAAA;CACjC;AAED,MAAM,MAAM,yBAAyB,GAAG,CACtC,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC3B,IAAI,CAAA;AAYT,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,sBAAsB,GAAG,IAAI,EACvC,OAAO,EAAE,oCAAoC,GAC5C;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CA0D/C;AAED,wBAAsB,gCAAgC,CACpD,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,EAClC,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GAAG,OAAO,EAChC,QAAQ,GAAE,yBAAoC,GAC7C,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAkDxD"}

package/dist/remote-shell-resource.js

@@ -0,0 +1,105 @@
+function isPlainObject(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+function normalizeOptionalString(value) {
+    if (typeof value !== 'string')
+        return null;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}
+export function validateRemoteShellResourceRow(resource, options) {
+    if (!resource) {
+        return { ok: false, message: 'Remote shell resource not found' };
+    }
+    if (resource.team_id !== options.teamId) {
+        return { ok: false, message: 'Remote shell resource belongs to another team' };
+    }
+    if (resource.resource_type !== 'remote_shell') {
+        return {
+            ok: false,
+            message: `Resource is not a remote shell target (found ${resource.resource_type})`,
+        };
+    }
+    if (options.requiredAccess === 'write' && resource.max_access_level === 'viewer') {
+        return {
+            ok: false,
+            message: 'Remote shell resource is configured for viewer access. Full access is required for this action.',
+        };
+    }
+    const metadata = isPlainObject(resource.metadata) ? resource.metadata : {};
+    const vmId = normalizeOptionalString(metadata.vm_id);
+    if (vmId) {
+        if (!options.gatewayVmId || options.gatewayVmId !== vmId) {
+            return {
+                ok: false,
+                message: 'Remote shell resource targets a different VM-backed gateway',
+            };
+        }
+    }
+    else {
+        const gatewayId = normalizeOptionalString(metadata.gateway_id);
+        if (!gatewayId) {
+            return {
+                ok: false,
+                message: 'Remote shell resource is missing metadata.gateway_id or metadata.vm_id',
+            };
+        }
+        if (gatewayId !== options.gatewayId) {
+            return {
+                ok: false,
+                message: 'Remote shell resource targets a different gateway',
+            };
+        }
+    }
+    if (metadata.full_control !== true) {
+        return {
+            ok: false,
+            message: 'Remote shell resource machine control is disabled',
+        };
+    }
+    return { ok: true };
+}
+export async function loadValidatedRemoteShellResource(supabase, config, resourceId, requiredAccess, logError = () => { }) {
+    const [{ data: resourceData, error: resourceError }, { data: gatewayData, error: gatewayError }] = await Promise.all([
+        supabase
+            .from('team_resources')
+            .select('id, team_id, resource_type, max_access_level, metadata')
+            .eq('id', resourceId)
+            .eq('team_id', config.teamId)
+            .maybeSingle(),
+        supabase
+            .from('team_gateways')
+            .select('vm_id')
+            .eq('id', config.gatewayId)
+            .eq('team_id', config.teamId)
+            .maybeSingle(),
+    ]);
+    if (resourceError) {
+        logError('Failed to load remote shell resource for gateway validation', {
+            resourceId,
+            gatewayId: config.gatewayId,
+            teamId: config.teamId,
+            error: resourceError.message,
+        });
+        return { ok: false, message: 'Failed to load remote shell resource' };
+    }
+    if (gatewayError) {
+        logError('Failed to load gateway identity for remote shell resource validation', {
+            resourceId,
+            gatewayId: config.gatewayId,
+            teamId: config.teamId,
+            error: gatewayError.message,
+        });
+        return { ok: false, message: 'Failed to load gateway identity for remote shell resource' };
+    }
+    if (!gatewayData) {
+        return { ok: false, message: 'Gateway identity is missing' };
+    }
+    return validateRemoteShellResourceRow(resourceData ?? null, {
+        teamId: config.teamId,
+        gatewayId: config.gatewayId,
+        gatewayVmId: typeof gatewayData.vm_id === 'string' ? gatewayData.vm_id : null,
+        requiredAccess,
+    });
+}
+//# sourceMappingURL=remote-shell-resource.js.map

package/dist/remote-shell-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-shell-resource.js","sourceRoot":"","sources":["../src/remote-shell-resource.ts"],"names":[],"mappings":"AAwBA,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AACtE,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;AAC5C,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,QAAuC,EACvC,OAA6C;IAE7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAA;IAClE,CAAC;IAED,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAA;IAChF,CAAC;IAED,IAAI,QAAQ,CAAC,aAAa,KAAK,cAAc,EAAE,CAAC;QAC9C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,gDAAgD,QAAQ,CAAC,aAAa,GAAG;SACnF,CAAA;IACH,CAAC;IAED,IAAI,OAAO,CAAC,cAAc,KAAK,OAAO,IAAI,QAAQ,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QACjF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EACL,iGAAiG;SACpG,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1E,MAAM,IAAI,GAAG,uBAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACpD,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YACzD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,6DAA6D;aACvE,CAAA;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,uBAAuB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,wEAAwE;aAClF,CAAA;QACH,CAAC;QAED,IAAI,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;YACpC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,mDAAmD;aAC7D,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,mDAAmD;SAC7D,CAAA;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,QAAkC,EAClC,MAAqB,EACrB,UAAkB,EAClB,cAAgC,EAChC,WAAsC,GAAG,EAAE,GAAE,CAAC;IAE9C,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,GAC9F,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,QAAQ;aACL,IAAI,CAAC,gBAAgB,CAAC;aACtB,MAAM,CAAC,wDAAwD,CAAC;aAChE,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC;aACpB,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;aAC5B,WAAW,EAAE;QAChB,QAAQ;aACL,IAAI,CAAC,eAAe,CAAC;aACrB,MAAM,CAAC,OAAO,CAAC;aACf,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC;aAC1B,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;aAC5B,WAAW,EAAE;KACjB,CAAC,CAAA;IAEJ,IAAI,aAAa,EAAE,CAAC;QAClB,QAAQ,CAAC,6DAA6D,EAAE;YACtE,UAAU;YACV,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,aAAa,CAAC,OAAO;SAC7B,CAAC,CAAA;QACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAA;IACvE,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,QAAQ,CAAC,sEAAsE,EAAE;YAC/E,UAAU;YACV,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,YAAY,CAAC,OAAO;SAC5B,CAAC,CAAA;QACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,2DAA2D,EAAE,CAAA;IAC5F,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAA;IAC9D,CAAC;IAED,OAAO,8BAA8B,CAClC,YAA8C,IAAI,IAAI,EACvD;QACE,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,OAAO,WAAW,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QAC7E,cAAc;KACf,CACF,CAAA;AACH,CAAC"}