@playcraft/cli 0.1.34 → 0.1.35-prod

package/dist/workspace-runtime/previews/output.js

@@ -1,36 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { chmod, lstat, mkdir, realpath, rename, rm, writeFile } from 'node:fs/promises';
-import { dirname, join, relative } from 'node:path';
-import { WORKSPACE_PLAYABLE_OUTPUT_PATH } from '@playcraft/common/cloud-workspace/runtime';
-/** Persist only validated, self-contained build bytes; unrelated delivery files are preserved. */
-export async function saveWorkspacePlayableOutput(root, bytes) {
-    const workspace = await realpath(root);
-    let directory = workspace;
-    for (const segment of dirname(WORKSPACE_PLAYABLE_OUTPUT_PATH).split('/')) {
-        directory = join(directory, segment);
-        const created = await mkdir(directory, { mode: 0o2775 }).then(() => true, error => {
-            if (error.code !== 'EEXIST')
-                throw error;
-            return false;
-        });
-        const stat = await lstat(directory);
-        if (!stat.isDirectory() || stat.isSymbolicLink() || relative(workspace, await realpath(directory)) !== relative(workspace, directory))
-            throw new Error('preview_build_failed');
-        if (created)
-            await chmod(directory, 0o2775);
-    }
-    const target = join(workspace, WORKSPACE_PLAYABLE_OUTPUT_PATH);
-    const temporary = join(directory, `.playable-${randomUUID()}.tmp`);
-    try {
-        await writeFile(temporary, bytes, { flag: 'wx', mode: 0o664 });
-        await chmod(temporary, 0o664);
-        const stat = await lstat(target).catch(error => { if (error.code === 'ENOENT')
-            return undefined; throw error; });
-        if (stat && (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1))
-            throw new Error('preview_build_failed');
-        await rename(temporary, target);
-    }
-    finally {
-        await rm(temporary, { force: true });
-    }
-}

package/dist/workspace-runtime/previews/publish.js

@@ -1,262 +0,0 @@
-import { createHash } from 'node:crypto';
-import { spawn } from 'node:child_process';
-import { platformEndpoint } from '@playcraft/common/cloud-workspace/runtime';
-import { constants } from 'node:fs';
-import { lstat, open, readdir, rm } from 'node:fs/promises';
-import { join } from 'node:path';
-import { PREVIEW_HTML_MAX_BYTES, PREVIEW_LOG_TAIL_MAX, WORKSPACE_ARTIFACT_OUTPUT_DIRECTORY, previewPublishResultSchema, previewReservationSchema, transitionOperation, } from '@playcraft/common/cloud-workspace/runtime';
-import { excludeFromGit, readDependencies, scheduleDependencyInstall, } from '../workspaces/dependencies.js';
-import { runDeveloperCommand } from '../workspaces/developer-command.js';
-import { revisionScope, workspaceRoot } from '../workspaces/registry.js';
-import { classifyPreviewOutput, findExternalLocalReferences } from './single-file.js';
-import { saveWorkspacePlayableOutput } from './output.js';
-const BUILD_TIMEOUT_MS = 10 * 60_000;
-/** Build output and the builder's own scratch folder live in the checkout, hidden from Git. */
-const OUTPUT_FOLDER = '.playcraft-preview-out';
-const BUILDER_TEMP_FOLDER = '.playcraft-temp';
-/**
- * The generic single-file build. `--mode full` keeps the builder from asking which stages to run.
- * Group-writable output lets the control user, a member of the development group, remove it.
- */
-const BUILD_COMMAND = 'umask 002 && playcraft build --mode full --platform playcraft --format html';
-class PreviewFailure extends Error {
-    code;
-    constructor(code) {
-        super(code);
-        this.code = code;
-    }
-}
-const running = new WeakMap();
-/**
- * Checks what can be checked before the operation is accepted. The build itself runs later in
- * `runPreviewPublish`; the dispatch request returns as soon as the operation is accepted.
- */
-export async function previewWorkspaceRoot(state, operation) {
-    if (!operation.workspaceId || !/^[A-Za-z0-9_-]+$/.test(operation.operationId)) {
-        throw new PreviewFailure('invalid_preview_publish');
-    }
-    if (operation.sessionId !== undefined) {
-        const session = state.journal.getSession(operation.sessionId);
-        if (!session || (state.config.workspaceMode === 'multi' && (session.workspaceId !== operation.workspaceId || (session.directoryName ?? 'basic') !== (operation.directoryName ?? 'basic')))) {
-            throw new PreviewFailure('session_workspace_mismatch');
-        }
-    }
-    return workspaceRoot(state, operation.workspaceId, operation.directoryName);
-}
-/** Tracks a background publish so tests and shutdown can wait for it. */
-export function trackPreviewPublish(state, task) {
-    const tasks = running.get(state) ?? new Set();
-    running.set(state, tasks);
-    const tracked = task.finally(() => tasks.delete(tracked));
-    tasks.add(tracked);
-}
-export async function settlePreviewPublishes(state) {
-    await Promise.all([...(running.get(state) ?? [])]);
-}
-/** A publish cut off by a restart has no build left running; it is closed rather than left accepted. */
-export async function recoverInterruptedPreviews(journal) {
-    for (const { scopeKey, operation } of journal.listOperations()) {
-        if (operation.kind !== 'preview.publish' || operation.status !== 'accepted')
-            continue;
-        await journal.putOperation(scopeKey, transitionOperation(operation, 'interrupted', { error: 'preview_interrupted' }));
-    }
-}
-export async function runPreviewPublish(state, operation, root) {
-    const workspaceId = operation.workspaceId;
-    const scope = operation.sessionId === undefined
-        ? {}
-        : { sessionId: operation.sessionId, clientRequestId: operation.clientRequestId };
-    const outputDir = join(root, OUTPUT_FOLDER, operation.operationId);
-    const output = { log: '' };
-    try {
-        await ensureDependencies(state, revisionScope(state, workspaceId, operation.directoryName) ?? workspaceId, root, output);
-        await excludeFromGit(root, `/${OUTPUT_FOLDER}/`);
-        await excludeFromGit(root, `/${BUILDER_TEMP_FOLDER}/`);
-        await excludeFromGit(root, `/${WORKSPACE_ARTIFACT_OUTPUT_DIRECTORY}/`);
-        await buildPreview(state, root, outputDir, operation.operationId, output);
-        const bytes = await readSingleHtml(outputDir);
-        if (bytes.byteLength > PREVIEW_HTML_MAX_BYTES)
-            throw new PreviewFailure('preview_not_single_file');
-        if (findExternalLocalReferences(bytes.toString('utf8')).length > 0) {
-            throw new PreviewFailure('preview_not_single_file');
-        }
-        await saveWorkspacePlayableOutput(root, bytes);
-        const contentDigest = createHash('sha256').update(bytes).digest('hex');
-        const contentMd5 = createHash('md5').update(bytes).digest('base64');
-        const source = await sourceRevision(root);
-        const reserved = previewReservationSchema.parse(await postControl(state, '/runtime/internal/preview-reservations', {
-            workspaceId,
-            directoryName: operation.directoryName ?? 'basic',
-            ...scope,
-            operationId: operation.operationId,
-            contentDigest,
-            contentMd5,
-            sizeBytes: bytes.byteLength,
-            gitHead: source.head,
-            dirty: source.dirty,
-            cliVersion: state.config.cliVersion,
-        }));
-        if (reserved.sessionId !== operation.sessionId)
-            throw new PreviewFailure('preview_scope_mismatch');
-        if (!reserved.alreadyUploaded) {
-            const uploaded = await fetch(reserved.uploadUrl, {
-                method: 'PUT',
-                redirect: 'error',
-                signal: AbortSignal.timeout(120_000),
-                headers: {
-                    'content-type': 'text/html; charset=utf-8',
-                    'content-md5': contentMd5,
-                    'content-length': String(bytes.byteLength),
-                },
-                body: new Uint8Array(bytes),
-            });
-            await uploaded.body?.cancel();
-            if (!uploaded.ok)
-                throw new PreviewFailure('preview_upload_failed');
-        }
-        const published = previewPublishResultSchema.parse(await postControl(state, '/runtime/internal/preview-completions', {
-            workspaceId,
-            directoryName: operation.directoryName ?? 'basic',
-            ...scope,
-            operationId: operation.operationId,
-            artifactId: reserved.artifactId,
-            expectedPublishRevision: reserved.expectedPublishRevision,
-            logTail: tail(output.log),
-        }));
-        if (published.sessionId !== operation.sessionId || published.previewId !== reserved.previewId ||
-            published.artifactId !== reserved.artifactId) {
-            throw new PreviewFailure('preview_scope_mismatch');
-        }
-        if (published.status === 'conflict')
-            throw new PreviewFailure('publish_conflict');
-        return published;
-    }
-    catch (error) {
-        const code = error instanceof PreviewFailure ? error.code : 'preview_build_failed';
-        if (code !== 'publish_conflict') {
-            await postControl(state, '/runtime/internal/preview-failures', {
-                workspaceId,
-                directoryName: operation.directoryName ?? 'basic',
-                ...scope,
-                operationId: operation.operationId,
-                error: code,
-                logTail: tail(output.log || (error instanceof Error ? error.message : '')),
-            }).catch(() => undefined);
-        }
-        throw new PreviewFailure(code);
-    }
-    finally {
-        await rm(outputDir, { recursive: true, force: true }).catch(() => undefined);
-    }
-}
-export function previewFailureCode(error) {
-    const code = error instanceof PreviewFailure
-        ? error.code
-        : error instanceof Error && /^[a-z_]+$/.test(error.message)
-            ? error.message
-            : 'preview_build_failed';
-    return code.slice(0, 256);
-}
-/**
- * Checks the install against the current manifest and lockfile before building, so a package
- * Codex added since the workspace opened is installed first. A running install is joined rather
- * than started twice; a failed one is retried once here.
- */
-async function ensureDependencies(state, workspaceId, root, output) {
-    await scheduleDependencyInstall(state, workspaceId, root);
-    const dependencies = readDependencies(state, workspaceId);
-    if (dependencies.status !== 'ready' && dependencies.status !== 'none') {
-        output.log = [dependencies.error, dependencies.logTail].filter(Boolean).join('\n');
-        throw new PreviewFailure('dependencies_not_ready');
-    }
-}
-async function buildPreview(state, root, outputDir, operationId, output) {
-    // Tests replace the build; the real one needs a project and the published CLI.
-    const planned = process.env.PLAYCRAFT_PREVIEW_BUILD_COMMAND || BUILD_COMMAND;
-    const outcome = await runDeveloperCommand(state, {
-        processId: `preview-${operationId}`,
-        cwd: root,
-        command: `${planned} --output ${shellQuote(outputDir)} .`,
-        timeoutMs: BUILD_TIMEOUT_MS,
-        onOutput: (chunk) => {
-            output.log = (output.log + String(chunk)).slice(-64 * 1024);
-        },
-    });
-    if (outcome.code !== 0)
-        throw new PreviewFailure('preview_build_failed');
-}
-/** Reads the one HTML file without following links, so the uploaded bytes are what was checked. */
-async function readSingleHtml(outputDir) {
-    const listed = await readdir(outputDir, { withFileTypes: true }).catch(() => {
-        throw new PreviewFailure('preview_not_single_file');
-    });
-    const entries = listed.map((entry) => ({
-        name: entry.name,
-        kind: entry.isSymbolicLink() ? 'symlink' : entry.isFile() ? 'file' : 'dir',
-    }));
-    const classified = classifyPreviewOutput(entries);
-    if (!classified.ok)
-        throw new PreviewFailure('preview_not_single_file');
-    const source = join(outputDir, classified.entry);
-    const stat = await lstat(source);
-    if (!stat.isFile())
-        throw new PreviewFailure('preview_not_single_file');
-    const handle = await open(source, constants.O_RDONLY | constants.O_NOFOLLOW);
-    try {
-        return await handle.readFile();
-    }
-    finally {
-        await handle.close();
-    }
-}
-async function sourceRevision(root) {
-    const head = await git(root, ['rev-parse', 'HEAD']);
-    const status = await git(root, ['status', '--porcelain']);
-    const revision = head.stdout.trim();
-    if (head.code !== 0 || !/^[0-9a-f]{7,64}$/i.test(revision))
-        return { dirty: true };
-    return { head: revision, dirty: status.code !== 0 || status.stdout.trim().length > 0 };
-}
-function git(cwd, args) {
-    return new Promise((resolve) => {
-        const child = spawn('git', args, { cwd, stdio: ['ignore', 'pipe', 'ignore'] });
-        let stdout = '';
-        child.stdout.on('data', (chunk) => {
-            stdout = (stdout + String(chunk)).slice(-8_000);
-        });
-        child.once('error', () => resolve({ code: null, stdout }));
-        child.once('close', (code) => resolve({ code, stdout }));
-    });
-}
-async function postControl(state, path, body) {
-    const endpoint = platformEndpoint(state.config.publicBaseUrl, path);
-    const response = await fetch(endpoint, {
-        method: 'POST',
-        redirect: 'error',
-        signal: AbortSignal.timeout(60_000),
-        headers: {
-            authorization: `Bearer ${state.config.controlToken}`,
-            'playcraft-env': state.config.environment,
-            'content-type': 'application/json',
-        },
-        body: JSON.stringify({
-            runtimeId: state.config.runtimeId,
-            generation: state.config.generation,
-            runtimeEpoch: state.runtimeEpoch,
-            ...body,
-        }),
-    });
-    const payload = (await response.json().catch(() => ({})));
-    if (!response.ok) {
-        const record = (payload && typeof payload === 'object' ? payload : {});
-        const reason = typeof record.reason === 'string' ? record.reason : typeof record.error === 'string' ? record.error : '';
-        throw new PreviewFailure(/^[a-z_]{1,64}$/.test(reason) ? reason : 'preview_upload_failed');
-    }
-    return payload;
-}
-function shellQuote(value) {
-    return `'${value.replace(/'/g, `'\\''`)}'`;
-}
-function tail(value) {
-    return value.slice(-PREVIEW_LOG_TAIL_MAX);
-}

package/dist/workspace-runtime/previews/single-file.js

@@ -1,43 +0,0 @@
-const LOCAL_ATTR = /<(?:script|img|link|source|video|audio|iframe)\b[^>]*?\b(?:src|href)\s*=\s*["']([^"']+)["']/gi;
-/** A CSS `url(`, not the tail of a name such as `createObjectURL(` or `getAudioURL(`. */
-const CSS_URL = /(?<![\w$.-])url\(\s*["']?([^"')]+)["']?\s*\)/gi;
-/** An inline script's body, kept apart from its tag so `<script src>` is still checked. */
-const SCRIPT_BODY = /(<script\b[^>]*>)[\s\S]*?(<\/script\s*>)/gi;
-/**
- * A reference the sealed document would load from the local build, not from the network or inline
- * data. Inline script code is not read: inlined libraries call functions named `…URL(` and build
- * `"url(" + src + ")"` strings at run time, and neither is a file the document loads.
- */
-export function findExternalLocalReferences(html) {
-    const markup = html.replace(SCRIPT_BODY, '$1$2');
-    const found = new Set();
-    for (const expression of [LOCAL_ATTR, CSS_URL]) {
-        expression.lastIndex = 0;
-        for (const match of markup.matchAll(expression)) {
-            const value = (match[1] ?? '').trim();
-            if (isLocalReference(value))
-                found.add(value);
-        }
-    }
-    return [...found];
-}
-export function classifyPreviewOutput(entries) {
-    if (entries.length !== 1)
-        return { ok: false };
-    const only = entries[0];
-    if (!only || only.kind !== 'file' || !only.name.toLowerCase().endsWith('.html'))
-        return { ok: false };
-    if (only.name.includes('/') || only.name.includes('\\') || only.name === '.' || only.name === '..') {
-        return { ok: false };
-    }
-    return { ok: true, entry: only.name };
-}
-function isLocalReference(value) {
-    if (!value || value.startsWith('#') || value.startsWith('data:') || value.startsWith('blob:'))
-        return false;
-    if (/^(https?:|mailto:|javascript:)/i.test(value))
-        return false;
-    if (value.startsWith('//'))
-        return false;
-    return true;
-}

package/dist/workspace-runtime/processes/managed-writes.js

@@ -1,69 +0,0 @@
-import { spawn } from 'node:child_process';
-import { setTimeout as delay } from 'node:timers/promises';
-export const MANAGED_WRITE_SOURCES = ['manual', 'agent', 'background'];
-const BACKGROUND_WRITER = `
-const fs = require('node:fs');
-const file = process.argv[1];
-if (!file) process.exit(1);
-fs.appendFileSync(file, 'background\\n');
-const timer = setInterval(() => {
-  try { fs.appendFileSync(file, 'x'); }
-  catch { clearInterval(timer); process.exit(0); }
-}, 200);
-`;
-/** `true` alive, `false` confirmed exited, `undefined` when the probe cannot tell. */
-export function probeProcess(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (error) {
-        if (error.code === 'ESRCH')
-            return false;
-        return undefined;
-    }
-}
-export function spawnBackgroundWriter(absolutePath) {
-    const child = spawn(process.execPath, ['-e', BACKGROUND_WRITER, absolutePath], {
-        detached: true,
-        stdio: 'ignore',
-    });
-    child.unref();
-    if (!child.pid)
-        throw new Error('background_write_failed');
-    return child.pid;
-}
-export async function stopBackgroundWriter(pid) {
-    signal(pid, 'SIGTERM');
-    if (await waitUntilStopped(pid, 2_000))
-        return true;
-    signal(pid, 'SIGKILL');
-    return waitUntilStopped(pid, 2_000);
-}
-function signal(pid, name) {
-    try {
-        process.kill(-pid, name);
-    }
-    catch (error) {
-        if (error.code !== 'ESRCH')
-            return;
-        try {
-            process.kill(pid, name);
-        }
-        catch {
-            /* already gone */
-        }
-    }
-}
-async function waitUntilStopped(pid, timeoutMs) {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-        const alive = probeProcess(pid);
-        if (alive === false)
-            return true;
-        if (alive === undefined)
-            return false;
-        await delay(50);
-    }
-    return probeProcess(pid) === false;
-}

package/dist/workspace-runtime/production/contracts.js

@@ -1,17 +0,0 @@
-import { z } from 'zod';
-export const productionStageNames = ['capture-source', 'prepare', 'generate', 'freeze', 'save', 'build', 'preview'];
-export const productionExecutionRequestSchema = z.object({
-    action: z.enum(['stage', 'stop', 'reconcile']),
-    task: z.object({ taskId: z.string().uuid(), attemptId: z.string().uuid(), batchId: z.string().uuid(), workspaceId: z.string().uuid(),
-        environment: z.string().min(1), userId: z.string().min(1), payload: z.record(z.unknown()), }).passthrough(),
-    lease: z.object({ taskId: z.string().uuid(), attemptId: z.string().uuid(), owner: z.string().min(1), fence: z.number().int().positive() }).strict(),
-    directoryName: z.string().regex(/^(?:basic|remix-[a-z0-9][a-z0-9-]{3,63})$/).default('basic'), generation: z.number().int().positive(), runtimeEpoch: z.number().int().nonnegative(),
-    callbackUrl: z.string().url(), runnerToken: z.string().min(1), payload: z.record(z.unknown()),
-    stage: z.enum(productionStageNames).optional(),
-    stages: z.array(z.object({ stage: z.enum(productionStageNames), requestId: z.string(), status: z.string(),
-        result: z.record(z.unknown()).optional(), payload: z.record(z.unknown()).optional() }).passthrough()).optional(),
-    source: z.object({ workspaceId: z.string().uuid(), generation: z.number().int().positive(), runtimeId: z.string().min(1) }).optional(),
-    model: z.object({ endpoint: z.string().url(), token: z.string().min(1), model: z.string().min(1) }).optional(),
-    git: z.object({ repositoryUrl: z.string().min(1), branchName: z.string().min(1), username: z.string().optional(), password: z.string().optional() }).optional(),
-    repairSnapshot: z.unknown().optional(), repairSource: z.unknown().optional(), repairCommitHash: z.string().optional(),
-}).strict();

package/dist/workspace-runtime/production/controller.js

@@ -1,207 +0,0 @@
-import { mkdir, readFile, readdir, rename, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
-import { randomUUID } from 'node:crypto';
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-import { hashOperationPayload } from '@playcraft/common/cloud-workspace/runtime';
-import { productionExecutionRequestSchema } from './contracts.js';
-import { executeProductionStage } from './stages.js';
-import { groupExited, stopProductionGroup } from './processes.js';
-import { workspaceDirectoryOccupied } from '../workspaces/directory-maintenance.js';
-import { settleDependencyInstalls } from '../workspaces/dependencies.js';
-import { verifyProductionLease } from './storage.js';
-const execute = promisify(execFile);
-const active = new WeakMap();
-const receiptsRoot = (state) => join(state.config.stateDir, 'production-receipts');
-const attemptPath = (state, id) => join(receiptsRoot(state), `${id}.attempt.json`);
-const receiptPath = (state, id, stage) => join(receiptsRoot(state), `${id}-${stage}.json`);
-async function read(path) {
-    try {
-        return JSON.parse(await readFile(path, 'utf8'));
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return undefined;
-        throw error;
-    }
-}
-async function write(state, path, value) {
-    await mkdir(receiptsRoot(state), { recursive: true, mode: 0o700 });
-    const temporary = `${path}.${randomUUID()}.tmp`;
-    await writeFile(temporary, JSON.stringify(value), { mode: 0o600 });
-    await rename(temporary, path);
-}
-export async function productionCapability(state) {
-    if (state.config.workspaceMode !== 'multi' || state.journal.destroyed())
-        throw new Error('production_executor_unavailable');
-    const command = process.env.PLAYCRAFT_PRODUCTION_CODEX_COMMAND ?? process.env.PLAYCRAFT_CODEX_COMMAND ?? 'codex';
-    const binary = command.endsWith('.mjs') || command.endsWith('.js') ? process.execPath : command;
-    await Promise.all([execute('git', ['--version']), execute('pnpm', ['--version']),
-        execute(binary, binary === process.execPath ? [command, '--version'] : ['--version'])]);
-    return { available: true, protocol: 1 };
-}
-export async function productionDirectoryBusy(state, workspaceId, directoryName = 'basic') {
-    if (!workspaceId)
-        return false;
-    const files = await readdir(receiptsRoot(state)).catch(error => {
-        if (error.code === 'ENOENT')
-            return [];
-        throw error;
-    });
-    for (const file of files.filter(value => value.endsWith('.attempt.json'))) {
-        const attempt = await read(join(receiptsRoot(state), file));
-        if (attempt && !attempt.stopped && attempt.workspaceId === workspaceId && attempt.directoryName === directoryName)
-            return true;
-    }
-    return false;
-}
-export async function executeSandboxProduction(state, raw) {
-    const input = productionExecutionRequestSchema.parse(raw);
-    if (input.task.environment !== state.config.environment || input.task.userId !== state.config.userId
-        || input.generation !== state.config.generation || input.runtimeEpoch !== state.runtimeEpoch
-        || input.lease.taskId !== input.task.taskId || input.lease.attemptId !== input.task.attemptId)
-        throw new Error('production_scope_mismatch');
-    return state.journal.exclusive(`directory:${input.task.workspaceId}:${input.directoryName}`, () => state.journal.exclusive(`production:${input.task.attemptId}`, async () => {
-        const path = attemptPath(state, input.task.attemptId);
-        let attempt = await read(path);
-        if (attempt && (attempt.taskId !== input.task.taskId || attempt.workspaceId !== input.task.workspaceId
-            || attempt.directoryName !== input.directoryName || attempt.fence > input.lease.fence
-            || (attempt.fence === input.lease.fence && attempt.owner !== input.lease.owner)))
-            throw new Error('production_scope_mismatch');
-        if (input.action !== 'stage')
-            return stopOrReconcile(state, input, attempt);
-        if (!input.stage)
-            throw new Error('invalid_production_stage');
-        if (attempt?.stopped || attempt?.cancelling)
-            return { status: 'failed', result: { error: 'production_execution_stopped' } };
-        const file = receiptPath(state, input.task.attemptId, input.stage);
-        const old = await read(file);
-        const payloadHash = hashOperationPayload(input.payload);
-        if (old) {
-            if (old.payloadHash !== payloadHash)
-                throw new Error('production_payload_conflict');
-            // Existing intent only reports evidence. It never authorizes a second native turn.
-            return { status: old.status, result: old.result };
-        }
-        if (active.get(state)?.has(input.task.attemptId))
-            throw new Error('production_stage_still_running');
-        await verifyProductionLease(input);
-        if (!attempt) {
-            if (input.stage === 'capture-source' || input.stage === 'prepare')
-                await settleDependencyInstalls(state);
-            if (state.journal.getWorkspace(input.task.workspaceId)?.directories?.some(directory => directory.directoryName === input.directoryName && directory.status === 'reclaimed'))
-                throw new Error('production_directory_reclaimed');
-            if (await workspaceDirectoryOccupied(state, input.task.workspaceId, input.directoryName))
-                throw new Error('production_directory_occupied');
-            attempt = { taskId: input.task.taskId, attemptId: input.task.attemptId, workspaceId: input.task.workspaceId,
-                directoryName: input.directoryName, owner: input.lease.owner, fence: input.lease.fence, stopped: false };
-        }
-        attempt.owner = input.lease.owner;
-        attempt.fence = input.lease.fence;
-        await write(state, path, attempt);
-        const receipt = { status: 'unknown', result: { error: 'production_stage_running' },
-            taskId: input.task.taskId, attemptId: input.task.attemptId, requestId: `${input.task.attemptId}:${input.stage}`,
-            stage: input.stage, workspaceId: input.task.workspaceId, directoryName: input.directoryName,
-            fence: input.lease.fence, payloadHash, startedAt: new Date().toISOString(), processes: [] };
-        await write(state, file, receipt);
-        const running = active.get(state) ?? new Map();
-        active.set(state, running);
-        const entry = { task: Promise.resolve(receipt), stops: [] };
-        entry.task = runStage(state, input, receipt, entry).finally(() => running.delete(input.task.attemptId));
-        running.set(input.task.attemptId, entry);
-        // Returning from the lock lets stop and reconciliation reach the in-flight native group.
-        return { status: 'unknown', result: { error: 'production_stage_running' } };
-    })).then(async (result) => {
-        const current = active.get(state)?.get(input.task.attemptId);
-        return input.action === 'stage' && current ? current.task : result;
-    });
-}
-async function runStage(state, input, receipt, running) {
-    const file = receiptPath(state, input.task.attemptId, input.stage);
-    let writes = Promise.resolve();
-    const recordProcess = async (process) => {
-        const at = receipt.processes.findIndex(value => value.pid === process.pid);
-        if (at === -1)
-            receipt.processes.push(process);
-        else
-            receipt.processes[at] = process;
-        writes = writes.then(() => write(state, file, receipt));
-        await writes;
-        const attempt = await read(attemptPath(state, input.task.attemptId));
-        if (attempt?.cancelling && !process.stopped) {
-            process.stopped = await stopProductionGroup(process);
-            throw new Error('production_execution_stopped');
-        }
-    };
-    try {
-        receipt.result = await executeProductionStage(state, input, recordProcess, stop => running.stops.push(stop));
-        await verifyProductionLease(input);
-        receipt.status = 'completed';
-    }
-    catch (error) {
-        const code = error instanceof Error && /^[a-z0-9_]+$/.test(error.message) ? error.message : 'production_stage_failed';
-        receipt.status = code.includes('unknown') || code.includes('unavailable') ? 'unknown' : 'failed';
-        receipt.result = { error: code };
-    }
-    if (receipt.processes.some(process => !process.stopped && !groupExited(process.pid))) {
-        receipt.status = 'unknown';
-        receipt.result = { error: 'production_stop_unconfirmed' };
-    }
-    receipt.finishedAt = new Date().toISOString();
-    await writes;
-    await write(state, file, receipt);
-    return { status: receipt.status, result: receipt.result };
-}
-async function attemptReceipts(state, attemptId) {
-    const files = await readdir(receiptsRoot(state)).catch(() => []);
-    const receipts = [];
-    for (const file of files.filter(value => value.startsWith(`${attemptId}-`) && value.endsWith('.json'))) {
-        const receipt = await read(join(receiptsRoot(state), file));
-        if (receipt)
-            receipts.push(receipt);
-    }
-    return receipts;
-}
-async function stopOrReconcile(state, input, old) {
-    const attempt = old ?? { taskId: input.task.taskId, attemptId: input.task.attemptId, workspaceId: input.task.workspaceId,
-        directoryName: input.directoryName, owner: input.lease.owner, fence: input.lease.fence, stopped: false };
-    attempt.owner = input.lease.owner;
-    attempt.fence = input.lease.fence;
-    attempt.cancelling = true;
-    await write(state, attemptPath(state, attempt.attemptId), attempt);
-    const running = active.get(state)?.get(attempt.attemptId);
-    await Promise.allSettled(running?.stops.map(stop => stop()) ?? []);
-    const receipts = await attemptReceipts(state, attempt.attemptId);
-    let groupsStopped = true;
-    for (const receipt of receipts) {
-        for (const process of receipt.processes) {
-            process.stopped = await stopProductionGroup(process);
-            if (!process.stopped)
-                groupsStopped = false;
-        }
-        await write(state, receiptPath(state, receipt.attemptId, receipt.stage), receipt);
-    }
-    if (running)
-        await Promise.race([running.task.catch(() => undefined), new Promise(resolve => setTimeout(resolve, 5000))]);
-    const dispatchStopped = !active.get(state)?.has(attempt.attemptId);
-    attempt.stopped = groupsStopped && dispatchStopped;
-    await write(state, attemptPath(state, attempt.attemptId), attempt);
-    const durable = await attemptReceipts(state, attempt.attemptId);
-    return { status: attempt.stopped ? 'completed' : 'unknown', result: {
-            executionStopped: attempt.stopped, managedWritesStopped: attempt.stopped,
-            receipts: Object.fromEntries(durable.map(receipt => [receipt.stage, { status: receipt.status, result: receipt.result }])),
-        } };
-}
-export async function sandboxProductionReceipt(state, operationId, identity) {
-    if (!/^[a-f0-9-]{36}:(capture-source|prepare|generate|freeze|save|build|preview)$/.test(operationId))
-        throw new Error('production_receipt_invalid');
-    const [attemptId, stage] = operationId.split(':');
-    const receipt = await read(receiptPath(state, attemptId, stage));
-    if (!receipt || receipt.taskId !== identity.taskId || receipt.attemptId !== identity.attemptId || receipt.workspaceId !== identity.workspaceId
-        || receipt.directoryName !== identity.directoryName || receipt.fence > identity.fence)
-        throw new Error('production_receipt_scope_mismatch');
-    const attempt = await read(attemptPath(state, identity.attemptId));
-    if (!attempt || attempt.owner !== identity.owner || attempt.fence !== identity.fence)
-        throw new Error('production_receipt_scope_mismatch');
-    return { status: receipt.status, result: receipt.result };
-}