@playcraft/cli 0.1.37-beta → 0.1.39-prod

package/dist/workspace-runtime/persistence/stopped-execution.js

@@ -1,77 +0,0 @@
-import { operationRecordSchema, transitionOperation } from '@playcraft/common/cloud-workspace/runtime';
-const STOP_BUCKET = 'stopped_execution_epochs';
-const ACTIVE_OPERATIONS = new Set(['queued', 'dispatched', 'accepted', 'uncertain']);
-/** Called only inside the journal writer transaction after authoritative process-stop evidence. */
-export function settleStoppedExecution(database, scope, pid, occurredAt, writer) {
-    const key = JSON.stringify([scope.runtimeId, scope.generation, scope.runtimeEpoch]);
-    if (!readRecord(database, STOP_BUCKET, key))
-        writeRecord(database, STOP_BUCKET, key, { ...scope, pid, occurredAt });
-    const events = [];
-    const stoppedSessions = new Set();
-    const rows = database.prepare(`SELECT scope_key, operation_json FROM operation_intents
-    WHERE json_extract(operation_json, '$.generation') = ? AND json_extract(operation_json, '$.runtimeEpoch') = ?
-      AND json_extract(operation_json, '$.kind') IN ('session.turn', 'session.review', 'session.compact')`)
-        .all(scope.generation, scope.runtimeEpoch);
-    for (const row of rows) {
-        const operation = operationRecordSchema.parse(JSON.parse(row.operation_json));
-        const binding = readRecord(database, 'operation_execution_scopes', JSON.stringify([row.scope_key, operation.operationId]));
-        const source = database.prepare('SELECT 1 FROM source_events WHERE runtime_id = ? AND generation = ? AND runtime_epoch = ? AND operation_id = ? LIMIT 1')
-            .get(scope.runtimeId, scope.generation, scope.runtimeEpoch, operation.operationId);
-        if ((!binding || binding.runtimeId !== scope.runtimeId || binding.generation !== scope.generation || binding.runtimeEpoch !== scope.runtimeEpoch) && !source)
-            continue;
-        if (operation.sessionId)
-            stoppedSessions.add(operation.sessionId);
-        const session = operation.sessionId ? readRecord(database, 'sessions', operation.sessionId) : undefined;
-        const appendTerminal = (threadId, turnId, subAgent) => {
-            const existing = database.prepare(`SELECT 1 FROM source_events WHERE runtime_id = ? AND generation = ? AND runtime_epoch = ?
-        AND thread_id = ? AND turn_id = ? AND type IN ('turn/completed', 'turn.completed', 'turn.interrupted', 'turn.failed') LIMIT 1`)
-                .get(scope.runtimeId, scope.generation, scope.runtimeEpoch, threadId, turnId);
-            if (existing)
-                return;
-            const payload = { sessionId: operation.sessionId, workspaceId: operation.workspaceId,
-                threadId, turnId, turn: { id: turnId, status: 'interrupted' }, reason: 'execution_group_stopped', subAgent };
-            events.push(...writer.allocate({ ...scope, type: 'turn.interrupted', payload, occurredAt,
-                sessionId: operation.sessionId, workspaceId: operation.workspaceId, operationId: operation.operationId, threadId, turnId }).committedEvents);
-        };
-        const children = database.prepare(`SELECT record_key, body_json FROM records WHERE bucket = 'native_subagent_turns'
-      AND json_extract(body_json, '$.operationScopeKey') = ?`).all(row.scope_key);
-        for (const child of children) {
-            const [threadId, turnId] = JSON.parse(child.record_key);
-            const link = readRecord(database, 'native_subagent_threads', threadId);
-            if (!link || link.sessionId !== operation.sessionId || link.workspaceId !== operation.workspaceId || link.rootThreadId !== operation.nativeThreadId)
-                continue;
-            const { sessionId: _, workspaceId: __, operationScopeKey: ___, operationConfirmed: ____, ...subAgent } = link;
-            appendTerminal(threadId, turnId, subAgent);
-        }
-        if (!ACTIVE_OPERATIONS.has(operation.status))
-            continue;
-        if (operation.nativeThreadId && operation.nativeTurnId)
-            appendTerminal(operation.nativeThreadId, operation.nativeTurnId);
-        writer.putOperation(row.scope_key, { ...transitionOperation(operation, 'interrupted', { error: 'execution_group_stopped' }), updatedAt: occurredAt });
-        if (session && session.threadId === operation.nativeThreadId &&
-            (session.activeTurnId === operation.nativeTurnId || (!session.activeTurnId && !operation.nativeTurnId && session.turnStatus === 'starting'))) {
-            writeRecord(database, 'sessions', operation.sessionId, { ...session, turnStatus: 'interrupted', turnBlock: undefined,
-                activeTurnId: undefined, recoverability: 'history_only' });
-        }
-    }
-    for (const row of database.prepare("SELECT record_key, body_json FROM records WHERE bucket = 'approvals'").all()) {
-        const approval = JSON.parse(row.body_json);
-        if (approval.status === 'pending' && approval.runtimeId === scope.runtimeId && approval.generation === scope.generation &&
-            approval.runtimeEpoch === scope.runtimeEpoch && stoppedSessions.has(String(approval.sessionId)))
-            writeRecord(database, 'approvals', row.record_key, { ...approval, status: 'expired' });
-    }
-    return events;
-}
-export function stoppedExecutionEpochs(database, runtimeId, generation) {
-    const rows = database.prepare(`SELECT body_json FROM records WHERE bucket = ?
-    AND json_extract(body_json, '$.runtimeId') = ? AND json_extract(body_json, '$.generation') = ?`).all(STOP_BUCKET, runtimeId, generation);
-    return rows.map(row => Number(JSON.parse(row.body_json).runtimeEpoch)).sort((a, b) => a - b);
-}
-function readRecord(database, bucket, key) {
-    const row = database.prepare('SELECT body_json FROM records WHERE bucket = ? AND record_key = ?').get(bucket, key);
-    return row ? JSON.parse(row.body_json) : undefined;
-}
-function writeRecord(database, bucket, key, value) {
-    database.prepare('INSERT INTO records (bucket, record_key, body_json) VALUES (?, ?, ?) ON CONFLICT(bucket, record_key) DO UPDATE SET body_json = excluded.body_json')
-        .run(bucket, key, JSON.stringify(value));
-}

package/dist/workspace-runtime/previews/output.js

@@ -1,36 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { chmod, lstat, mkdir, realpath, rename, rm, writeFile } from 'node:fs/promises';
-import { dirname, join, relative } from 'node:path';
-import { WORKSPACE_PLAYABLE_OUTPUT_PATH } from '@playcraft/common/cloud-workspace/runtime';
-/** Persist only validated, self-contained build bytes; unrelated delivery files are preserved. */
-export async function saveWorkspacePlayableOutput(root, bytes) {
-    const workspace = await realpath(root);
-    let directory = workspace;
-    for (const segment of dirname(WORKSPACE_PLAYABLE_OUTPUT_PATH).split('/')) {
-        directory = join(directory, segment);
-        const created = await mkdir(directory, { mode: 0o2775 }).then(() => true, error => {
-            if (error.code !== 'EEXIST')
-                throw error;
-            return false;
-        });
-        const stat = await lstat(directory);
-        if (!stat.isDirectory() || stat.isSymbolicLink() || relative(workspace, await realpath(directory)) !== relative(workspace, directory))
-            throw new Error('preview_build_failed');
-        if (created)
-            await chmod(directory, 0o2775);
-    }
-    const target = join(workspace, WORKSPACE_PLAYABLE_OUTPUT_PATH);
-    const temporary = join(directory, `.playable-${randomUUID()}.tmp`);
-    try {
-        await writeFile(temporary, bytes, { flag: 'wx', mode: 0o664 });
-        await chmod(temporary, 0o664);
-        const stat = await lstat(target).catch(error => { if (error.code === 'ENOENT')
-            return undefined; throw error; });
-        if (stat && (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1))
-            throw new Error('preview_build_failed');
-        await rename(temporary, target);
-    }
-    finally {
-        await rm(temporary, { force: true });
-    }
-}

package/dist/workspace-runtime/previews/publish.js

@@ -1,262 +0,0 @@
-import { createHash } from 'node:crypto';
-import { spawn } from 'node:child_process';
-import { platformEndpoint } from '@playcraft/common/cloud-workspace/runtime';
-import { constants } from 'node:fs';
-import { lstat, open, readdir, rm } from 'node:fs/promises';
-import { join } from 'node:path';
-import { PREVIEW_HTML_MAX_BYTES, PREVIEW_LOG_TAIL_MAX, WORKSPACE_ARTIFACT_OUTPUT_DIRECTORY, previewPublishResultSchema, previewReservationSchema, transitionOperation, } from '@playcraft/common/cloud-workspace/runtime';
-import { excludeFromGit, readDependencies, scheduleDependencyInstall, } from '../workspaces/dependencies.js';
-import { runDeveloperCommand } from '../workspaces/developer-command.js';
-import { revisionScope, workspaceRoot } from '../workspaces/registry.js';
-import { classifyPreviewOutput, findExternalLocalReferences } from './single-file.js';
-import { saveWorkspacePlayableOutput } from './output.js';
-const BUILD_TIMEOUT_MS = 10 * 60_000;
-/** Build output and the builder's own scratch folder live in the checkout, hidden from Git. */
-const OUTPUT_FOLDER = '.playcraft-preview-out';
-const BUILDER_TEMP_FOLDER = '.playcraft-temp';
-/**
- * The generic single-file build. `--mode full` keeps the builder from asking which stages to run.
- * Group-writable output lets the control user, a member of the development group, remove it.
- */
-const BUILD_COMMAND = 'umask 002 && playcraft build --mode full --platform playcraft --format html';
-class PreviewFailure extends Error {
-    code;
-    constructor(code) {
-        super(code);
-        this.code = code;
-    }
-}
-const running = new WeakMap();
-/**
- * Checks what can be checked before the operation is accepted. The build itself runs later in
- * `runPreviewPublish`; the dispatch request returns as soon as the operation is accepted.
- */
-export async function previewWorkspaceRoot(state, operation) {
-    if (!operation.workspaceId || !/^[A-Za-z0-9_-]+$/.test(operation.operationId)) {
-        throw new PreviewFailure('invalid_preview_publish');
-    }
-    if (operation.sessionId !== undefined) {
-        const session = state.journal.getSession(operation.sessionId);
-        if (!session || (state.config.workspaceMode === 'multi' && (session.workspaceId !== operation.workspaceId || (session.directoryName ?? 'basic') !== (operation.directoryName ?? 'basic')))) {
-            throw new PreviewFailure('session_workspace_mismatch');
-        }
-    }
-    return workspaceRoot(state, operation.workspaceId, operation.directoryName);
-}
-/** Tracks a background publish so tests and shutdown can wait for it. */
-export function trackPreviewPublish(state, task) {
-    const tasks = running.get(state) ?? new Set();
-    running.set(state, tasks);
-    const tracked = task.finally(() => tasks.delete(tracked));
-    tasks.add(tracked);
-}
-export async function settlePreviewPublishes(state) {
-    await Promise.all([...(running.get(state) ?? [])]);
-}
-/** A publish cut off by a restart has no build left running; it is closed rather than left accepted. */
-export async function recoverInterruptedPreviews(journal) {
-    for (const { scopeKey, operation } of journal.listOperations()) {
-        if (operation.kind !== 'preview.publish' || operation.status !== 'accepted')
-            continue;
-        await journal.putOperation(scopeKey, transitionOperation(operation, 'interrupted', { error: 'preview_interrupted' }));
-    }
-}
-export async function runPreviewPublish(state, operation, root) {
-    const workspaceId = operation.workspaceId;
-    const scope = operation.sessionId === undefined
-        ? {}
-        : { sessionId: operation.sessionId, clientRequestId: operation.clientRequestId };
-    const outputDir = join(root, OUTPUT_FOLDER, operation.operationId);
-    const output = { log: '' };
-    try {
-        await ensureDependencies(state, revisionScope(state, workspaceId, operation.directoryName) ?? workspaceId, root, output);
-        await excludeFromGit(root, `/${OUTPUT_FOLDER}/`);
-        await excludeFromGit(root, `/${BUILDER_TEMP_FOLDER}/`);
-        await excludeFromGit(root, `/${WORKSPACE_ARTIFACT_OUTPUT_DIRECTORY}/`);
-        await buildPreview(state, root, outputDir, operation.operationId, output);
-        const bytes = await readSingleHtml(outputDir);
-        if (bytes.byteLength > PREVIEW_HTML_MAX_BYTES)
-            throw new PreviewFailure('preview_not_single_file');
-        if (findExternalLocalReferences(bytes.toString('utf8')).length > 0) {
-            throw new PreviewFailure('preview_not_single_file');
-        }
-        await saveWorkspacePlayableOutput(root, bytes);
-        const contentDigest = createHash('sha256').update(bytes).digest('hex');
-        const contentMd5 = createHash('md5').update(bytes).digest('base64');
-        const source = await sourceRevision(root);
-        const reserved = previewReservationSchema.parse(await postControl(state, '/runtime/internal/preview-reservations', {
-            workspaceId,
-            directoryName: operation.directoryName ?? 'basic',
-            ...scope,
-            operationId: operation.operationId,
-            contentDigest,
-            contentMd5,
-            sizeBytes: bytes.byteLength,
-            gitHead: source.head,
-            dirty: source.dirty,
-            cliVersion: state.config.cliVersion,
-        }));
-        if (reserved.sessionId !== operation.sessionId)
-            throw new PreviewFailure('preview_scope_mismatch');
-        if (!reserved.alreadyUploaded) {
-            const uploaded = await fetch(reserved.uploadUrl, {
-                method: 'PUT',
-                redirect: 'error',
-                signal: AbortSignal.timeout(120_000),
-                headers: {
-                    'content-type': 'text/html; charset=utf-8',
-                    'content-md5': contentMd5,
-                    'content-length': String(bytes.byteLength),
-                },
-                body: new Uint8Array(bytes),
-            });
-            await uploaded.body?.cancel();
-            if (!uploaded.ok)
-                throw new PreviewFailure('preview_upload_failed');
-        }
-        const published = previewPublishResultSchema.parse(await postControl(state, '/runtime/internal/preview-completions', {
-            workspaceId,
-            directoryName: operation.directoryName ?? 'basic',
-            ...scope,
-            operationId: operation.operationId,
-            artifactId: reserved.artifactId,
-            expectedPublishRevision: reserved.expectedPublishRevision,
-            logTail: tail(output.log),
-        }));
-        if (published.sessionId !== operation.sessionId || published.previewId !== reserved.previewId ||
-            published.artifactId !== reserved.artifactId) {
-            throw new PreviewFailure('preview_scope_mismatch');
-        }
-        if (published.status === 'conflict')
-            throw new PreviewFailure('publish_conflict');
-        return published;
-    }
-    catch (error) {
-        const code = error instanceof PreviewFailure ? error.code : 'preview_build_failed';
-        if (code !== 'publish_conflict') {
-            await postControl(state, '/runtime/internal/preview-failures', {
-                workspaceId,
-                directoryName: operation.directoryName ?? 'basic',
-                ...scope,
-                operationId: operation.operationId,
-                error: code,
-                logTail: tail(output.log || (error instanceof Error ? error.message : '')),
-            }).catch(() => undefined);
-        }
-        throw new PreviewFailure(code);
-    }
-    finally {
-        await rm(outputDir, { recursive: true, force: true }).catch(() => undefined);
-    }
-}
-export function previewFailureCode(error) {
-    const code = error instanceof PreviewFailure
-        ? error.code
-        : error instanceof Error && /^[a-z_]+$/.test(error.message)
-            ? error.message
-            : 'preview_build_failed';
-    return code.slice(0, 256);
-}
-/**
- * Checks the install against the current manifest and lockfile before building, so a package
- * Codex added since the workspace opened is installed first. A running install is joined rather
- * than started twice; a failed one is retried once here.
- */
-async function ensureDependencies(state, workspaceId, root, output) {
-    await scheduleDependencyInstall(state, workspaceId, root);
-    const dependencies = readDependencies(state, workspaceId);
-    if (dependencies.status !== 'ready' && dependencies.status !== 'none') {
-        output.log = [dependencies.error, dependencies.logTail].filter(Boolean).join('\n');
-        throw new PreviewFailure('dependencies_not_ready');
-    }
-}
-async function buildPreview(state, root, outputDir, operationId, output) {
-    // Tests replace the build; the real one needs a project and the published CLI.
-    const planned = process.env.PLAYCRAFT_PREVIEW_BUILD_COMMAND || BUILD_COMMAND;
-    const outcome = await runDeveloperCommand(state, {
-        processId: `preview-${operationId}`,
-        cwd: root,
-        command: `${planned} --output ${shellQuote(outputDir)} .`,
-        timeoutMs: BUILD_TIMEOUT_MS,
-        onOutput: (chunk) => {
-            output.log = (output.log + String(chunk)).slice(-64 * 1024);
-        },
-    });
-    if (outcome.code !== 0)
-        throw new PreviewFailure('preview_build_failed');
-}
-/** Reads the one HTML file without following links, so the uploaded bytes are what was checked. */
-async function readSingleHtml(outputDir) {
-    const listed = await readdir(outputDir, { withFileTypes: true }).catch(() => {
-        throw new PreviewFailure('preview_not_single_file');
-    });
-    const entries = listed.map((entry) => ({
-        name: entry.name,
-        kind: entry.isSymbolicLink() ? 'symlink' : entry.isFile() ? 'file' : 'dir',
-    }));
-    const classified = classifyPreviewOutput(entries);
-    if (!classified.ok)
-        throw new PreviewFailure('preview_not_single_file');
-    const source = join(outputDir, classified.entry);
-    const stat = await lstat(source);
-    if (!stat.isFile())
-        throw new PreviewFailure('preview_not_single_file');
-    const handle = await open(source, constants.O_RDONLY | constants.O_NOFOLLOW);
-    try {
-        return await handle.readFile();
-    }
-    finally {
-        await handle.close();
-    }
-}
-async function sourceRevision(root) {
-    const head = await git(root, ['rev-parse', 'HEAD']);
-    const status = await git(root, ['status', '--porcelain']);
-    const revision = head.stdout.trim();
-    if (head.code !== 0 || !/^[0-9a-f]{7,64}$/i.test(revision))
-        return { dirty: true };
-    return { head: revision, dirty: status.code !== 0 || status.stdout.trim().length > 0 };
-}
-function git(cwd, args) {
-    return new Promise((resolve) => {
-        const child = spawn('git', args, { cwd, stdio: ['ignore', 'pipe', 'ignore'] });
-        let stdout = '';
-        child.stdout.on('data', (chunk) => {
-            stdout = (stdout + String(chunk)).slice(-8_000);
-        });
-        child.once('error', () => resolve({ code: null, stdout }));
-        child.once('close', (code) => resolve({ code, stdout }));
-    });
-}
-async function postControl(state, path, body) {
-    const endpoint = platformEndpoint(state.config.publicBaseUrl, path);
-    const response = await fetch(endpoint, {
-        method: 'POST',
-        redirect: 'error',
-        signal: AbortSignal.timeout(60_000),
-        headers: {
-            authorization: `Bearer ${state.config.controlToken}`,
-            'playcraft-env': state.config.environment,
-            'content-type': 'application/json',
-        },
-        body: JSON.stringify({
-            runtimeId: state.config.runtimeId,
-            generation: state.config.generation,
-            runtimeEpoch: state.runtimeEpoch,
-            ...body,
-        }),
-    });
-    const payload = (await response.json().catch(() => ({})));
-    if (!response.ok) {
-        const record = (payload && typeof payload === 'object' ? payload : {});
-        const reason = typeof record.reason === 'string' ? record.reason : typeof record.error === 'string' ? record.error : '';
-        throw new PreviewFailure(/^[a-z_]{1,64}$/.test(reason) ? reason : 'preview_upload_failed');
-    }
-    return payload;
-}
-function shellQuote(value) {
-    return `'${value.replace(/'/g, `'\\''`)}'`;
-}
-function tail(value) {
-    return value.slice(-PREVIEW_LOG_TAIL_MAX);
-}

package/dist/workspace-runtime/previews/single-file.js

@@ -1,43 +0,0 @@
-const LOCAL_ATTR = /<(?:script|img|link|source|video|audio|iframe)\b[^>]*?\b(?:src|href)\s*=\s*["']([^"']+)["']/gi;
-/** A CSS `url(`, not the tail of a name such as `createObjectURL(` or `getAudioURL(`. */
-const CSS_URL = /(?<![\w$.-])url\(\s*["']?([^"')]+)["']?\s*\)/gi;
-/** An inline script's body, kept apart from its tag so `<script src>` is still checked. */
-const SCRIPT_BODY = /(<script\b[^>]*>)[\s\S]*?(<\/script\s*>)/gi;
-/**
- * A reference the sealed document would load from the local build, not from the network or inline
- * data. Inline script code is not read: inlined libraries call functions named `…URL(` and build
- * `"url(" + src + ")"` strings at run time, and neither is a file the document loads.
- */
-export function findExternalLocalReferences(html) {
-    const markup = html.replace(SCRIPT_BODY, '$1$2');
-    const found = new Set();
-    for (const expression of [LOCAL_ATTR, CSS_URL]) {
-        expression.lastIndex = 0;
-        for (const match of markup.matchAll(expression)) {
-            const value = (match[1] ?? '').trim();
-            if (isLocalReference(value))
-                found.add(value);
-        }
-    }
-    return [...found];
-}
-export function classifyPreviewOutput(entries) {
-    if (entries.length !== 1)
-        return { ok: false };
-    const only = entries[0];
-    if (!only || only.kind !== 'file' || !only.name.toLowerCase().endsWith('.html'))
-        return { ok: false };
-    if (only.name.includes('/') || only.name.includes('\\') || only.name === '.' || only.name === '..') {
-        return { ok: false };
-    }
-    return { ok: true, entry: only.name };
-}
-function isLocalReference(value) {
-    if (!value || value.startsWith('#') || value.startsWith('data:') || value.startsWith('blob:'))
-        return false;
-    if (/^(https?:|mailto:|javascript:)/i.test(value))
-        return false;
-    if (value.startsWith('//'))
-        return false;
-    return true;
-}

package/dist/workspace-runtime/processes/managed-writes.js

@@ -1,69 +0,0 @@
-import { spawn } from 'node:child_process';
-import { setTimeout as delay } from 'node:timers/promises';
-export const MANAGED_WRITE_SOURCES = ['manual', 'agent', 'background'];
-const BACKGROUND_WRITER = `
-const fs = require('node:fs');
-const file = process.argv[1];
-if (!file) process.exit(1);
-fs.appendFileSync(file, 'background\\n');
-const timer = setInterval(() => {
-  try { fs.appendFileSync(file, 'x'); }
-  catch { clearInterval(timer); process.exit(0); }
-}, 200);
-`;
-/** `true` alive, `false` confirmed exited, `undefined` when the probe cannot tell. */
-export function probeProcess(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (error) {
-        if (error.code === 'ESRCH')
-            return false;
-        return undefined;
-    }
-}
-export function spawnBackgroundWriter(absolutePath) {
-    const child = spawn(process.execPath, ['-e', BACKGROUND_WRITER, absolutePath], {
-        detached: true,
-        stdio: 'ignore',
-    });
-    child.unref();
-    if (!child.pid)
-        throw new Error('background_write_failed');
-    return child.pid;
-}
-export async function stopBackgroundWriter(pid) {
-    signal(pid, 'SIGTERM');
-    if (await waitUntilStopped(pid, 2_000))
-        return true;
-    signal(pid, 'SIGKILL');
-    return waitUntilStopped(pid, 2_000);
-}
-function signal(pid, name) {
-    try {
-        process.kill(-pid, name);
-    }
-    catch (error) {
-        if (error.code !== 'ESRCH')
-            return;
-        try {
-            process.kill(pid, name);
-        }
-        catch {
-            /* already gone */
-        }
-    }
-}
-async function waitUntilStopped(pid, timeoutMs) {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-        const alive = probeProcess(pid);
-        if (alive === false)
-            return true;
-        if (alive === undefined)
-            return false;
-        await delay(50);
-    }
-    return probeProcess(pid) === false;
-}

package/dist/workspace-runtime/production/contracts.js

@@ -1,19 +0,0 @@
-import { z } from 'zod';
-import { workspacePreparationSchema } from '@playcraft/common/cloud-workspace/runtime';
-export const productionStageNames = ['capture-source', 'prepare', 'generate', 'freeze', 'save', 'build', 'preview'];
-export const productionExecutionRequestSchema = z.object({
-    action: z.enum(['stage', 'stop', 'reconcile']),
-    task: z.object({ taskId: z.string().uuid(), attemptId: z.string().uuid(), batchId: z.string().uuid(), workspaceId: z.string().uuid(),
-        environment: z.string().min(1), userId: z.string().min(1), payload: z.record(z.unknown()), }).passthrough(),
-    lease: z.object({ taskId: z.string().uuid(), attemptId: z.string().uuid(), owner: z.string().min(1), fence: z.number().int().positive() }).strict(),
-    directoryName: z.string().regex(/^(?:basic|remix-[a-z0-9][a-z0-9-]{3,63})$/).default('basic'), generation: z.number().int().positive(), runtimeEpoch: z.number().int().nonnegative(),
-    callbackUrl: z.string().url(), runnerToken: z.string().min(1), payload: z.record(z.unknown()),
-    stage: z.enum(productionStageNames).optional(),
-    stages: z.array(z.object({ stage: z.enum(productionStageNames), requestId: z.string(), status: z.string(),
-        result: z.record(z.unknown()).optional(), payload: z.record(z.unknown()).optional() }).passthrough()).optional(),
-    source: z.object({ workspaceId: z.string().uuid(), generation: z.number().int().positive(), runtimeId: z.string().min(1) }).optional(),
-    model: z.object({ endpoint: z.string().url(), token: z.string().min(1), model: z.string().min(1) }).optional(),
-    git: z.object({ repositoryUrl: z.string().min(1), branchName: z.string().min(1), username: z.string().optional(), password: z.string().optional() }).optional(),
-    repairSnapshot: z.unknown().optional(), repairSource: z.unknown().optional(), repairCommitHash: z.string().optional(),
-    repairPreparation: z.custom(value => workspacePreparationSchema.safeParse(value).success).optional(),
-}).strict();