@playcraft/cli 0.1.38-beta → 0.1.39-prod

package/dist/workspace-runtime/production/source-archive.js

@@ -1,137 +0,0 @@
-import { execFile } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import { lstat, mkdir, mkdtemp, readFile, readdir, rename, rm, writeFile } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
-import { promisify } from 'node:util';
-import { gzip, gunzip } from 'node:zlib';
-import { z } from 'zod';
-import { batchSourceSnapshotSchema } from '@playcraft/common/cloud-workspace/runtime';
-import { copyProductionSource } from './source-copy.js';
-const execute = promisify(execFile);
-const compress = promisify(gzip), decompress = promisify(gunzip);
-const hash = (body) => createHash('sha256').update(body).digest('hex');
-const base64 = z.string().refine(value => Buffer.from(value, 'base64').toString('base64') === value);
-const archiveSchema = z.object({
-    version: z.literal(1),
-    source: z.object({ batchId: z.string().uuid(), sourceWorkspaceId: z.string().uuid(), sourceDirectoryName: z.string(),
-        snapshotId: z.string(), commitHash: z.string(), checksum: z.string(), frozenAt: z.string() }).strict(),
-    bundle: base64,
-    artifacts: z.array(z.object({ path: z.string().regex(/^\.playcraft\/skill-artifacts\/[a-f0-9]{64}\.tar\.gz$/),
-        body: base64, mode: z.number().int().min(0).max(0o777) }).strict()),
-}).strict();
-async function git(root, ...args) {
-    return (await execute('git', ['-c', 'core.hooksPath=/dev/null', '-c', 'init.templateDir=', '-c', 'credential.helper=',
-        '-c', 'core.fsmonitor=false', '-C', root, ...args], { encoding: 'buffer', timeout: 90_000, maxBuffer: 64 * 1024 * 1024,
-        env: { PATH: process.env.PATH, HOME: dirname(root), GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1', GIT_TERMINAL_PROMPT: '0' } })).stdout;
-}
-function snapshotFromArchive(source, body) {
-    const archiveDigest = hash(body);
-    return batchSourceSnapshotSchema.parse({ ...source, archiveDigest,
-        objectKey: `workspaces/${source.sourceWorkspaceId}/batches/${source.batchId}/source/${archiveDigest}.json.gz` });
-}
-async function readArchive(body, expected) {
-    if (expected && hash(body) !== expected.archiveDigest)
-        throw new Error('production_source_archive_mismatch');
-    const archive = archiveSchema.parse(JSON.parse((await decompress(body, { maxOutputLength: 512 * 1024 * 1024 })).toString()));
-    const snapshot = snapshotFromArchive(archive.source, body);
-    if (expected && JSON.stringify(snapshot) !== JSON.stringify(batchSourceSnapshotSchema.parse(expected)))
-        throw new Error('production_source_archive_mismatch');
-    const paths = new Set();
-    for (const artifact of archive.artifacts) {
-        if (paths.has(artifact.path) || hash(Buffer.from(artifact.body, 'base64')) !== artifact.path.split('/').at(-1).slice(0, -7))
-            throw new Error('production_source_archive_mismatch');
-        paths.add(artifact.path);
-    }
-    return { archive, snapshot };
-}
-export async function cachedProductionSourceArchive(input) {
-    z.string().uuid().parse(input.batchId);
-    z.string().uuid().parse(input.sourceWorkspaceId);
-    const cache = join(input.cacheRoot, `${input.batchId}.json.gz`);
-    const cached = await readFile(cache).catch(error => { if (error.code !== 'ENOENT')
-        throw error; return undefined; });
-    if (cached) {
-        const { snapshot } = await readArchive(cached);
-        if (snapshot.batchId !== input.batchId || snapshot.sourceWorkspaceId !== input.sourceWorkspaceId
-            || snapshot.sourceDirectoryName !== input.sourceDirectoryName)
-            throw new Error('production_source_archive_mismatch');
-        return { snapshot, body: cached };
-    }
-    return undefined;
-}
-/** A source archive is raw input, so package and dependency locks are validated by each result later. */
-export async function captureProductionSourceArchive(input) {
-    const cached = await cachedProductionSourceArchive(input);
-    if (cached)
-        return cached;
-    await mkdir(input.cacheRoot, { recursive: true, mode: 0o700 });
-    const cache = join(input.cacheRoot, `${input.batchId}.json.gz`);
-    const temporary = await mkdtemp(join(input.cacheRoot, '.capture-'));
-    try {
-        const root = join(temporary, 'source');
-        const captured = await copyProductionSource({ source: input.source, destination: root,
-            branchName: 'source', repositoryUrl: 'https://snapshot.invalid/source.git' });
-        const bundle = join(temporary, 'source.bundle');
-        await git(root, 'bundle', 'create', bundle, 'HEAD');
-        const artifacts = [];
-        for (const name of (await readdir(join(root, '.playcraft/skill-artifacts')).catch(error => {
-            if (error.code !== 'ENOENT')
-                throw error;
-            return [];
-        })).sort()) {
-            if (!/^[a-f0-9]{64}\.tar\.gz$/.test(name))
-                continue;
-            const path = `.playcraft/skill-artifacts/${name}`, stat = await lstat(join(root, path));
-            if (!stat.isFile() || stat.isSymbolicLink())
-                throw new Error('production_source_path_invalid');
-            const body = await readFile(join(root, path));
-            if (hash(body) !== name.slice(0, -7))
-                throw new Error('production_source_archive_mismatch');
-            artifacts.push({ path, mode: stat.mode & 0o777, body: body.toString('base64') });
-        }
-        const archive = { version: 1, source: { batchId: input.batchId, sourceWorkspaceId: input.sourceWorkspaceId,
-                sourceDirectoryName: input.sourceDirectoryName, snapshotId: `${input.batchId}-source`, commitHash: captured.commitHash,
-                checksum: hash(await git(root, 'ls-tree', '-r', '--full-tree', '-z', captured.commitHash)),
-                frozenAt: new Date((await git(root, 'show', '-s', '--format=%cI', captured.commitHash)).toString().trim()).toISOString() },
-            bundle: (await readFile(bundle)).toString('base64'), artifacts };
-        const body = await compress(Buffer.from(JSON.stringify(archive)));
-        const snapshot = snapshotFromArchive(archive.source, body);
-        const staged = join(temporary, 'archive.json.gz');
-        await writeFile(staged, body, { mode: 0o600 });
-        await rename(staged, cache);
-        return { snapshot, body };
-    }
-    finally {
-        await rm(temporary, { recursive: true, force: true });
-    }
-}
-/** Restore only the captured root commit and its exact skill archives, independently of the live source. */
-export async function checkoutProductionSourceArchive(input) {
-    const { archive } = await readArchive(input.body, input.snapshot);
-    if (await lstat(input.destination).catch(() => undefined))
-        throw new Error('batch_snapshot_destination_exists');
-    await mkdir(dirname(input.destination), { recursive: true });
-    const temporary = await mkdtemp(join(dirname(input.destination), '.source-bundle-'));
-    try {
-        const bundle = join(temporary, 'source.bundle');
-        await writeFile(bundle, Buffer.from(archive.bundle, 'base64'), { mode: 0o600 });
-        await execute('git', ['-c', 'core.hooksPath=/dev/null', '-c', 'init.templateDir=', 'clone', '--no-checkout', '--', bundle, input.destination], {
-            timeout: 90_000, maxBuffer: 1024 * 1024,
-            env: { PATH: process.env.PATH, HOME: temporary, GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1', GIT_TERMINAL_PROMPT: '0' },
-        });
-        if (hash(await git(input.destination, 'ls-tree', '-r', '--full-tree', '-z', input.snapshot.commitHash)) !== input.snapshot.checksum)
-            throw new Error('production_source_archive_mismatch');
-        await git(input.destination, 'checkout', '--detach', input.snapshot.commitHash);
-        for (const artifact of archive.artifacts) {
-            await mkdir(dirname(join(input.destination, artifact.path)), { recursive: true });
-            await writeFile(join(input.destination, artifact.path), Buffer.from(artifact.body, 'base64'), { flag: 'wx', mode: artifact.mode });
-        }
-    }
-    catch (error) {
-        await rm(input.destination, { recursive: true, force: true });
-        throw error;
-    }
-    finally {
-        await rm(temporary, { recursive: true, force: true });
-    }
-}

package/dist/workspace-runtime/production/source-copy.js

@@ -1,91 +0,0 @@
-import { execFile } from 'node:child_process';
-import { createHash, randomUUID } from 'node:crypto';
-import { constants } from 'node:fs';
-import { lstat, mkdir, open, readdir, realpath, rename, rm, writeFile } from 'node:fs/promises';
-import { dirname, isAbsolute, join, relative } from 'node:path';
-import { promisify } from 'node:util';
-import { excludeFromGit } from '../workspaces/dependencies.js';
-const execute = promisify(execFile);
-const privateNames = new Set(['.git', 'node_modules', '.ssh', '.aws', '.azure', '.gnupg', '.codex', '.npm', '.pnpm-store',
-    '.config', '.npmrc', '.yarnrc', '.yarnrc.yml', '.netrc', '.git-credentials', 'credentials.json', 'credentials', 'secrets',
-    'id_rsa', 'id_ed25519', 'settings.local.json', '.playcraft.json', 'playcraft.config.json', '.playcraft-temp', '.playcraft-preview-out']);
-const engineering = (path) => !path.split('/').some(name => privateNames.has(name)
-    || /^\.env(?:$|\.)/.test(name) || /\.(?:pem|key|p12|pfx)$/.test(name)) && !path.startsWith('.playcraft/skills/');
-const inside = (root, path) => { const rel = relative(root, path); return rel !== '..' && !rel.startsWith('../') && !isAbsolute(rel); };
-const git = async (root, ...args) => (await execute('git', ['-c', 'core.hooksPath=/dev/null', '-c', 'credential.helper=',
-    '-c', 'core.fsmonitor=false', '-C', root, ...args], { timeout: 90_000, maxBuffer: 64 * 1024 * 1024,
-    env: { PATH: process.env.PATH, HOME: dirname(root), GIT_OPTIONAL_LOCKS: '0', GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1', GIT_TERMINAL_PROMPT: '0' } })).stdout;
-async function sourceFiles(root) {
-    const paths = new Set((await git(root, 'ls-files', '--cached', '--others', '--exclude-standard', '-z')).split('\0').filter(Boolean));
-    const artifacts = await readdir(join(root, '.playcraft/skill-artifacts')).catch(error => {
-        if (error.code === 'ENOENT')
-            return [];
-        throw error;
-    });
-    for (const name of artifacts)
-        if (/^[a-f0-9]{64}\.tar\.gz$/.test(name))
-            paths.add(`.playcraft/skill-artifacts/${name}`);
-    const files = new Map();
-    for (const path of [...paths].sort()) {
-        if (!engineering(path))
-            continue;
-        const full = join(root, path), stat = await lstat(full).catch(error => {
-            if (error.code === 'ENOENT')
-                return undefined;
-            throw error;
-        });
-        if (!stat)
-            continue;
-        if (!stat.isFile() || stat.isSymbolicLink() || !inside(root, await realpath(full)))
-            throw new Error('production_source_path_invalid');
-        const handle = await open(full, constants.O_RDONLY | constants.O_NOFOLLOW);
-        try {
-            files.set(path, { body: await handle.readFile(), mode: stat.mode & 0o777 });
-        }
-        finally {
-            await handle.close();
-        }
-    }
-    return files;
-}
-function digest(files) {
-    const hash = createHash('sha256');
-    for (const [path, file] of files)
-        hash.update(path).update('\0').update(String(file.mode)).update('\0').update(file.body).update('\0');
-    return hash.digest('hex');
-}
-/** Capture the selected working tree into a private branch; the source index, head and configuration are read only. */
-export async function copyProductionSource(input) {
-    const source = await realpath(input.source);
-    if (await lstat(input.destination).catch(() => undefined))
-        throw new Error('production_source_destination_exists');
-    const sourceHead = await git(source, 'rev-parse', '--verify', 'HEAD').catch(() => '');
-    const files = await sourceFiles(source), sourceDigest = digest(files);
-    const staging = join(dirname(input.destination), `.production-source-${randomUUID()}`);
-    try {
-        await mkdir(staging);
-        // An independent root commit also excludes credentials that existed only in source history.
-        await git(staging, '-c', 'init.templateDir=', 'init', '--initial-branch', input.branchName);
-        for (const [path, file] of files) {
-            await mkdir(dirname(join(staging, path)), { recursive: true });
-            await writeFile(join(staging, path), file.body, { mode: file.mode, flag: 'wx' });
-        }
-        if (sourceHead !== await git(source, 'rev-parse', '--verify', 'HEAD').catch(() => '') || sourceDigest !== digest(await sourceFiles(source)))
-            throw new Error('production_source_changed');
-        await git(staging, 'remote', 'add', 'origin', input.repositoryUrl);
-        await git(staging, 'config', 'user.name', 'PlayCraft');
-        await git(staging, 'config', 'user.email', 'playcraft@localhost');
-        await excludeFromGit(staging);
-        await excludeFromGit(staging, '/.env*');
-        for (const entry of ['/.playcraft.json', '/playcraft.config.json', '/.playcraft/skill-artifacts/', '/.playcraft/skills/', '/.playcraft-temp/'])
-            await excludeFromGit(staging, entry);
-        await git(staging, 'add', '-A', '.');
-        await git(staging, 'commit', '--allow-empty', '-m', 'Capture batch source in independent remix');
-        const commitHash = (await git(staging, 'rev-parse', 'HEAD')).trim();
-        await rename(staging, input.destination);
-        return { commitHash, sourceDigest };
-    }
-    finally {
-        await rm(staging, { recursive: true, force: true });
-    }
-}

package/dist/workspace-runtime/production/stages.js

@@ -1,334 +0,0 @@
-import { execFile } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import { lstat, mkdir, readFile, readdir, rm, writeFile } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
-import { promisify } from 'node:util';
-import { batchBaselineSnapshotSchema, batchSavedEvidenceSchema, batchSourceSnapshotSchema } from '@playcraft/common/cloud-workspace/runtime';
-import { checkoutBatchCommit, freezeBatchCommit } from '../workspaces/batch-commit.js';
-import { grantWorkspaceTraversal, openDirectoryToDevelopment } from '../workspaces/directory-access.js';
-import { registerWorkspaceDirectory } from '../workspaces/directories.js';
-import { workspaceContainerRoot, workspaceRoot, workspaceSessions } from '../workspaces/registry.js';
-import { excludeFromGit, settleDependencyInstalls } from '../workspaces/dependencies.js';
-import { resolveProductionDependencies, verifyProductionDependencyLocks } from './dependencies.js';
-import { productionLocalCommitCommand } from './save-command.js';
-import { productionOutputStore, verifyProductionLease } from './storage.js';
-import { runProductionCommand } from './processes.js';
-import { runProductionNative } from './native.js';
-import { classifyPreviewOutput, findExternalLocalReferences } from '../previews/single-file.js';
-import { copyProductionSource } from './source-copy.js';
-import { workspaceDirectoryOccupied } from '../workspaces/directory-maintenance.js';
-import { ensureWorkspaceSkills } from '../workspaces/skills.js';
-import { cachedProductionSourceArchive, captureProductionSourceArchive } from './source-archive.js';
-import { prepareWorkspaceCheckout } from '../workspaces/prepare.js';
-import { snapshotWorkspaceTree } from '../workspaces/git.js';
-import { requireProductionContentChanges } from './content-changes.js';
-const execute = promisify(execFile);
-const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
-const hash = (body) => createHash('sha256').update(body).digest('hex');
-const record = (value) => value && typeof value === 'object' ? value : {};
-export async function executeProductionStage(state, input, processRecord, track) {
-    const stage = input.stage;
-    const manifest = record(input.task.payload.manifest);
-    const directSource = manifest.executionMode === 'direct-source';
-    let cancelled = false;
-    let releaseWait;
-    if (stage === 'capture-source' && directSource)
-        track(async () => { cancelled = true; releaseWait?.(); });
-    await verifyProductionLease(input);
-    const store = productionOutputStore(input);
-    const workspaceId = input.task.workspaceId;
-    const resultId = String(input.payload.resultVersionId ?? input.task.payload.resultVersionId ?? input.task.attemptId);
-    const sourceDirectoryName = String(input.payload.sourceDirectoryName ?? input.task.payload.sourceDirectoryName ?? 'basic');
-    if (input.task.payload.sourceDirectoryName !== undefined && input.payload.sourceDirectoryName !== undefined
-        && input.task.payload.sourceDirectoryName !== input.payload.sourceDirectoryName)
-        throw new Error('production_source_directory_mismatch');
-    const previous = (name) => input.stages?.find(value => value.stage === name && value.status === 'completed')?.result;
-    const run = async (cwd, command, env, trusted = false) => {
-        const outcome = await runProductionCommand(state, { processId: `production-${input.task.attemptId}-${stage}`, cwd, command, env, trusted,
-            timeoutMs: 10 * 60_000, record: processRecord, track });
-        if (!outcome.stopped || typeof outcome.code !== 'number')
-            throw new Error('production_process_unknown');
-        if (outcome.code !== 0)
-            throw new Error(`production_${stage}_failed`);
-        return outcome.output;
-    };
-    const git = async (root, ...args) => (await execute('git', ['-c', 'core.hooksPath=/dev/null', '-c', 'core.fsmonitor=false', '-C', root, ...args], {
-        timeout: 20_000, maxBuffer: 1024 * 1024, env: { PATH: process.env.PATH, HOME: state.config.stateDir, GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1' },
-    })).stdout.trim();
-    if (stage === 'capture-source' && directSource) {
-        if (input.directoryName !== sourceDirectoryName
-            || String(input.payload.sourceWorkspaceId ?? input.task.payload.sourceWorkspaceId ?? workspaceId) !== workspaceId)
-            throw new Error('production_source_directory_mismatch');
-        const scope = { cacheRoot: join(state.config.stateDir, 'production-source-archives'), batchId: input.task.batchId,
-            sourceWorkspaceId: workspaceId, sourceDirectoryName };
-        const deadline = Date.now() + 30 * 60_000;
-        await settleDependencyInstalls(state);
-        let captured;
-        while (!captured) {
-            if (cancelled)
-                throw new Error('production_execution_stopped');
-            await verifyProductionLease(input);
-            captured = await state.journal.exclusive(`directory:${workspaceId}:${sourceDirectoryName}`, async () => {
-                const cached = await cachedProductionSourceArchive(scope);
-                if (cached)
-                    return cached;
-                if (await workspaceDirectoryOccupied(state, workspaceId, sourceDirectoryName, input.task.attemptId, true))
-                    return undefined;
-                if (cancelled)
-                    throw new Error('production_execution_stopped');
-                await verifyProductionLease(input);
-                return captureProductionSourceArchive({ ...scope, source: await workspaceRoot(state, workspaceId, sourceDirectoryName) });
-            });
-            if (captured)
-                break;
-            if (Date.now() >= deadline)
-                throw new Error('production_source_busy');
-            await new Promise(resolve => {
-                const timer = setTimeout(resolve, 1000);
-                releaseWait = () => { clearTimeout(timer); resolve(); };
-                if (cancelled)
-                    releaseWait();
-            });
-            releaseWait = undefined;
-        }
-        if (cancelled)
-            throw new Error('production_execution_stopped');
-        await verifyProductionLease(input);
-        await store.put(captured.snapshot.objectKey, captured.body);
-        return { sourceSnapshot: captured.snapshot };
-    }
-    if (stage === 'capture-source') {
-        if (input.directoryName === 'basic' || input.directoryName === sourceDirectoryName)
-            throw new Error('production_source_directory_mismatch');
-        const authority = record(input.payload.workspace);
-        if (authority.directoryName !== input.directoryName || authority.workspaceId !== workspaceId
-            || typeof authority.remixId !== 'string' || typeof authority.branchName !== 'string' || typeof authority.repositoryUrl !== 'string')
-            throw new Error('production_source_directory_mismatch');
-        const { remixId, branchName, repositoryUrl } = authority;
-        await settleDependencyInstalls(state);
-        return state.journal.exclusive(`directory:${workspaceId}:${sourceDirectoryName}`, async () => {
-            if (await workspaceDirectoryOccupied(state, workspaceId, sourceDirectoryName)
-                || workspaceSessions(state, workspaceId, sourceDirectoryName).some(session => session.turnBlock === 'uncertain' || ['starting', 'running', 'waiting_for_user'].includes(session.turnStatus ?? '')))
-                throw new Error('production_source_busy');
-            const source = await workspaceRoot(state, workspaceId, sourceDirectoryName);
-            const container = await workspaceContainerRoot(state, workspaceId);
-            const destination = join(container, input.directoryName);
-            const developmentGroup = (await lstat(state.config.workspaceRoot)).gid;
-            const snapshot = await copyProductionSource({ source, destination, branchName, repositoryUrl });
-            await ensureWorkspaceSkills(destination, join(state.config.stateDir, 'skill-artifacts'));
-            await openDirectoryToDevelopment(destination, developmentGroup);
-            await grantWorkspaceTraversal(container, developmentGroup);
-            await state.journal.exclusive(`workspace:${workspaceId}`, async () => {
-                const binding = state.journal.getWorkspace(workspaceId);
-                await state.journal.putWorkspace({ ...binding, directories: [...(binding.directories ?? []).filter(value => value.directoryName !== input.directoryName),
-                        { workspaceId, directoryName: input.directoryName, remixId, branchName, sourceCommit: snapshot.commitHash, status: 'ready' }] });
-            });
-            return { sourceSnapshot: snapshot, commitHash: snapshot.commitHash };
-        });
-    }
-    if (stage === 'prepare' && directSource) {
-        const snapshot = batchSourceSnapshotSchema.parse(input.payload.sourceSnapshot ?? manifest.sourceSnapshot);
-        const authority = record(input.payload.workspace);
-        if (input.directoryName === 'basic' || authority.directoryName !== input.directoryName || authority.workspaceId !== workspaceId
-            || typeof authority.remixId !== 'string' || typeof authority.branchName !== 'string'
-            || snapshot.batchId !== input.task.batchId || snapshot.sourceWorkspaceId !== workspaceId || snapshot.sourceDirectoryName !== sourceDirectoryName)
-            throw new Error('production_source_directory_mismatch');
-        const directory = { workspaceId, directoryName: input.directoryName,
-            remixId: authority.remixId, branchName: authority.branchName, sourceCommit: snapshot.commitHash };
-        const root = join(await workspaceContainerRoot(state, workspaceId), input.directoryName);
-        let exists = await lstat(root).catch(error => { if (error.code !== 'ENOENT')
-            throw error; return undefined; });
-        const binding = state.journal.getWorkspace(workspaceId);
-        const existing = binding.directories?.find(value => value.directoryName === input.directoryName);
-        const repair = (input.payload.repair ?? input.task.payload.repair) === true;
-        const repairCommitHash = input.payload.repairCommitHash;
-        if (!exists && repair && typeof repairCommitHash === 'string') {
-            if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(repairCommitHash)
-                || !input.repairPreparation || binding.targetKind === 'standalone')
-                throw new Error('workspace_recovery_required');
-            const { pendingFork: _fork, directories: _directories, ...base } = binding;
-            await state.journal.exclusive(`directory:${workspaceId}:${input.directoryName}`, async () => {
-                await prepareWorkspaceCheckout(state, { ...base, targetKind: 'remix', remixId: authority.remixId,
-                    branchName: authority.branchName }, input.repairPreparation, state.acceptedLeaseFence, input.directoryName, true);
-                if (await git(root, 'rev-parse', 'HEAD') !== repairCommitHash) {
-                    await rm(root, { recursive: true, force: true });
-                    throw new Error('production_repair_commit_mismatch');
-                }
-            });
-            exists = await lstat(root);
-        }
-        else if (!exists && existing && existing.status !== 'pending')
-            throw new Error('workspace_recovery_required');
-        await registerWorkspaceDirectory(state, directory, state.acceptedLeaseFence, undefined, { snapshot, body: exists ? undefined : await store.get(snapshot.objectKey) });
-    }
-    if (stage === 'prepare' && input.directoryName !== 'basic' && (input.payload.baseline ?? input.task.payload.baseline)) {
-        const baseline = record(input.payload.baseline ?? input.task.payload.baseline);
-        const authority = record(input.payload.workspace);
-        const sourceCommit = baseline.commitHash;
-        if (typeof sourceCommit !== 'string')
-            throw new Error('production_approved_commit_required');
-        const directory = { workspaceId, directoryName: input.directoryName,
-            remixId: String(authority.remixId), branchName: String(authority.branchName), sourceCommit };
-        await registerWorkspaceDirectory(state, directory, state.acceptedLeaseFence, sourceDirectoryName);
-    }
-    const root = await workspaceRoot(state, workspaceId, input.directoryName);
-    const variantChanges = async (commitHash) => {
-        if (!directSource || resultId === input.task.attemptId)
-            return undefined;
-        const source = batchSourceSnapshotSchema.parse(manifest.sourceSnapshot);
-        return requireProductionContentChanges(root, source.commitHash, commitHash);
-    };
-    if (stage === 'prepare') {
-        if (input.payload.repairCommitHash !== undefined && await git(root, 'rev-parse', 'HEAD') !== input.payload.repairCommitHash)
-            throw new Error('production_repair_commit_mismatch');
-        await settleDependencyInstalls(state);
-        if (!(await lstat(join(root, 'package.json')).catch(() => undefined)))
-            return { prepared: true, directoryName: input.directoryName, emptySource: true };
-        const policy = await resolveProductionDependencies(root).catch(error => {
-            const repairable = error instanceof SyntaxError || (error instanceof Error && [
-                'production_dependency_lock_required', 'production_dependency_locks_conflict',
-                'production_package_manager_declaration_invalid', 'production_package_manager_lock_mismatch',
-            ].includes(error.message));
-            if (directSource && repairable)
-                return undefined;
-            if (!(input.payload.baseline ?? input.task.payload.baseline) && error instanceof Error
-                && error.message === 'production_dependency_lock_required')
-                return undefined;
-            throw error;
-        });
-        if (!policy)
-            return { prepared: true, directoryName: input.directoryName, dependencyRepairRequired: true };
-        try {
-            await run(root, process.env.PLAYCRAFT_PRODUCTION_INSTALL_COMMAND ?? 'pnpm install --frozen-lockfile --store-dir /var/cache/playcraft/pnpm-store --ignore-scripts');
-        }
-        catch (error) {
-            if (directSource && error instanceof Error && error.message === 'production_prepare_failed')
-                return { prepared: true, directoryName: input.directoryName, dependencyRepairRequired: true };
-            throw error;
-        }
-        await verifyProductionDependencyLocks(root, policy);
-        return { prepared: true, directoryName: input.directoryName };
-    }
-    if (stage === 'generate') {
-        const beforeTree = await snapshotWorkspaceTree(root);
-        await runProductionNative(state, input, root, processRecord, track);
-        await resolveProductionDependencies(root);
-        const afterTree = await snapshotWorkspaceTree(root);
-        const changedPaths = await requireProductionContentChanges(root, beforeTree, afterTree);
-        await variantChanges(afterTree);
-        return { generated: true, changes: { beforeTree, afterTree, changedPaths } };
-    }
-    if (stage === 'save') {
-        const binding = state.journal.getWorkspace(workspaceId);
-        const branch = input.directoryName === 'basic' ? binding.branchName : binding.directories?.find(value => value.directoryName === input.directoryName)?.branchName;
-        if ((input.git && input.git.branchName !== branch) || await git(root, 'symbolic-ref', '--short', 'HEAD') !== branch)
-            throw new Error('production_git_binding_mismatch');
-        if (input.payload.saved !== undefined) {
-            const saved = batchSavedEvidenceSchema.parse(input.payload.saved);
-            if (input.task.kind !== 'retry' || saved.attemptId === input.task.attemptId || saved.workspaceId !== workspaceId
-                || saved.resultVersionId !== resultId || saved.commitHash !== saved.pushedCommitHash)
-                throw new Error('production_recovery_saved_identity_mismatch');
-            if (await git(root, 'rev-parse', 'HEAD') !== saved.commitHash)
-                throw new Error('production_repair_commit_mismatch');
-            const snapshot = await freezeBatchCommit({ source: { workspaceId, root }, commitHash: saved.commitHash, snapshotId: `${input.task.attemptId}-save` });
-            if (snapshot.checksum !== saved.sourceDigest)
-                throw new Error('production_recovery_source_mismatch');
-            if (await snapshotWorkspaceTree(root) !== await git(root, 'rev-parse', `${saved.commitHash}^{tree}`))
-                throw new Error('production_recovery_worktree_changed');
-            await variantChanges(snapshot.commitHash);
-            return { snapshot, saved: { ...saved, attemptId: input.task.attemptId } };
-        }
-        await run(root, 'chmod -R u+rwX,g+rwX .').catch(() => undefined);
-        await excludeFromGit(root);
-        await excludeFromGit(root, '/.env*');
-        await excludeFromGit(root, '/.playcraft-temp/');
-        await excludeFromGit(root, '/.playcraft-preview-out/');
-        await git(root, 'config', 'user.name', 'PlayCraft');
-        await git(root, 'config', 'user.email', 'playcraft@localhost');
-        const env = { GIT_TERMINAL_PROMPT: '0', GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1' };
-        await run(root, productionLocalCommitCommand(), env, true);
-        const commitHash = await git(root, 'rev-parse', 'HEAD');
-        const snapshot = await freezeBatchCommit({ source: { workspaceId, root }, commitHash, snapshotId: `${input.task.attemptId}-save` });
-        await variantChanges(snapshot.commitHash);
-        return { snapshot, saved: { attemptId: input.task.attemptId, resultVersionId: resultId, workspaceId, sourceDigest: snapshot.checksum, commitHash, pushedCommitHash: commitHash } };
-    }
-    if (stage === 'freeze') {
-        const saved = record(previous('save')?.saved);
-        if (typeof saved.commitHash !== 'string')
-            throw new Error('production_saved_commit_required');
-        const snapshot = await freezeBatchCommit({ source: { workspaceId, root }, commitHash: saved.commitHash, snapshotId: `${input.task.attemptId}-freeze` });
-        const baseline = batchBaselineSnapshotSchema.parse({ batchId: input.task.batchId, projectId: String(input.payload.projectId ?? input.task.payload.projectId),
-            snapshotId: snapshot.snapshotId, sourceWorkspaceId: snapshot.sourceWorkspaceId, commitHash: snapshot.commitHash, checksum: snapshot.checksum,
-            sourceVersion: snapshot.sourceVersion, engine: String(input.payload.engine ?? input.task.payload.engine), skillLockDigest: snapshot.skillLockDigest, frozenAt: snapshot.frozenAt });
-        return { snapshot, baseline };
-    }
-    if (stage === 'build') {
-        const saved = record(input.payload.saved ?? previous('save')?.saved);
-        const snapshot = (previous('freeze')?.snapshot ?? previous('save')?.snapshot);
-        if (!snapshot || snapshot.commitHash !== saved.commitHash || snapshot.checksum !== saved.sourceDigest)
-            throw new Error('production_saved_snapshot_mismatch');
-        await variantChanges(snapshot.commitHash);
-        const destination = join(root, '.playcraft-temp', `production-${input.task.attemptId}`);
-        const removeDestination = async () => {
-            try {
-                await rm(destination, { recursive: true, force: true });
-            }
-            catch {
-                await run(destination, 'chmod -R u+rwX,g+rwX .').catch(() => undefined);
-                await rm(destination, { recursive: true, force: true });
-            }
-        };
-        await excludeFromGit(root, '/.playcraft-temp/');
-        await removeDestination();
-        try {
-            await checkoutBatchCommit({ source: { workspaceId, root }, frozen: snapshot, destination });
-            await openDirectoryToDevelopment(destination, (await lstat(state.config.workspaceRoot)).gid);
-            const policy = await resolveProductionDependencies(destination);
-            await run(destination, process.env.PLAYCRAFT_PRODUCTION_INSTALL_COMMAND ?? 'pnpm install --frozen-lockfile --store-dir /var/cache/playcraft/pnpm-store --ignore-scripts');
-            await verifyProductionDependencyLocks(destination, policy);
-            const output = join(destination, '.production-html');
-            const command = process.env.PLAYCRAFT_PRODUCTION_BUILD_COMMAND ?? 'playcraft build --mode full --platform playcraft --format html';
-            await run(destination, `${command} --output ${quote(output)} .`);
-            await verifyProductionDependencyLocks(destination, policy);
-            const entries = await readdir(output, { withFileTypes: true });
-            const single = classifyPreviewOutput(entries.map(entry => ({ name: entry.name, kind: entry.isFile() ? 'file' : entry.isDirectory() ? 'dir' : 'symlink' })));
-            if (!single.ok)
-                throw new Error('production_preview_not_single_file');
-            const path = join(output, single.entry);
-            if (!(await lstat(path)).isFile())
-                throw new Error('production_preview_invalid');
-            const body = await readFile(path);
-            if (findExternalLocalReferences(body.toString()).length)
-                throw new Error('production_preview_external_reference');
-            const outputDigest = hash(body), outputKey = `workspaces/${workspaceId}/production/${input.task.attemptId}/${outputDigest}.html`;
-            await store.put(outputKey, body);
-            return { outputKey, outputDigest, build: { attemptId: input.task.attemptId, resultVersionId: resultId, workspaceId,
-                    sourceDigest: snapshot.checksum, commitHash: snapshot.commitHash, buildId: `${input.task.attemptId}-build`, succeeded: true } };
-        }
-        finally {
-            await removeDestination();
-        }
-    }
-    if (stage === 'preview') {
-        const built = previous('build');
-        if (typeof built?.outputKey !== 'string' || typeof built.outputDigest !== 'string')
-            throw new Error('production_build_required');
-        const body = await store.get(built.outputKey);
-        if (hash(body) !== built.outputDigest)
-            throw new Error('production_preview_digest_mismatch');
-        const previewPath = join(root, '.playcraft-temp', `${input.task.attemptId}.html`);
-        await mkdir(dirname(previewPath), { recursive: true });
-        await writeFile(previewPath, body);
-        try {
-            const browser = process.env.PLAYCRAFT_PRODUCTION_PREVIEW_COMMAND ?? 'chromium --headless --no-sandbox --disable-gpu --virtual-time-budget=1000 --dump-dom';
-            const opened = await run(root, `${browser} ${quote(`file://${previewPath}`)}`);
-            if (!/<\/?html[\s>]/i.test(opened))
-                throw new Error('production_preview_not_opened');
-            return { opened: true, outputDigest: built.outputDigest };
-        }
-        finally {
-            await rm(previewPath, { force: true });
-        }
-    }
-    throw new Error('invalid_production_stage');
-}

package/dist/workspace-runtime/production/storage.js

@@ -1,75 +0,0 @@
-const taskUrl = (input) => `${input.callbackUrl.replace(/\/+$/, '')}/internal/cloud-production/tasks/${input.task.taskId}`;
-async function objectFailure(response, input, operation) {
-    const value = await response.json().catch(() => undefined);
-    const body = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
-    const reason = [body.reason, body.code, body.message, body.error]
-        .find((value) => typeof value === 'string' && /^[a-z0-9_]{1,128}$/.test(value)
-        && !value.includes(input.runnerToken));
-    // Keep callback status and machine codes; never record its URL, headers, or response body.
-    try {
-        console.error(JSON.stringify({ event: 'production.object_transfer_failed', taskId: input.task.taskId,
-            attemptId: input.task.attemptId, workspaceId: input.task.workspaceId, directoryName: input.directoryName,
-            stage: input.stage, leaseFence: input.lease.fence, operation, status: response.status, reason }));
-    }
-    catch { /* Diagnostics must preserve the original failure. */ }
-    return new Error(operation === 'get'
-        ? response.status === 404 ? 'object_missing' : 'object_get_failed'
-        : response.status === 409 ? 'object_conflict' : 'object_put_failed');
-}
-/** Build output travels through the Runtime that leased the task; engineering files travel through Git. */
-export function productionOutputStore(input) {
-    const object = (key) => `${taskUrl(input)}/objects/${key.split('/').map(encodeURIComponent).join('/')}`;
-    const headers = { authorization: `Bearer ${input.runnerToken}`, 'x-playcraft-object-client': 'cli' };
-    return {
-        async get(key) {
-            const response = await fetch(object(key), { headers, redirect: 'error', signal: AbortSignal.timeout(60_000) });
-            if (!response.ok)
-                throw await objectFailure(response, input, 'get');
-            return Buffer.from(await response.arrayBuffer());
-        },
-        async put(key, body) {
-            const response = await fetch(object(key), { method: 'PUT', body: new Uint8Array(body), redirect: 'error', signal: AbortSignal.timeout(60_000),
-                headers: { ...headers, 'content-type': 'application/octet-stream' } });
-            if (!response.ok)
-                throw await objectFailure(response, input, 'put');
-        },
-    };
-}
-export async function verifyProductionLease(input) {
-    let status;
-    let reason;
-    try {
-        const response = await fetch(`${taskUrl(input)}/runner`, {
-            headers: { authorization: `Bearer ${input.runnerToken}` }, redirect: 'error', signal: AbortSignal.timeout(10_000),
-        });
-        status = response.status;
-        if (!response.ok) {
-            const value = await response.json().catch(() => undefined);
-            const body = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
-            reason = [body.reason, body.code, body.message, body.error]
-                .find((value) => typeof value === 'string' && /^[a-z0-9_]{1,128}$/.test(value)
-                && !value.includes(input.runnerToken));
-            throw new Error('production_lease_unavailable');
-        }
-        reason = 'production_lease_invalid_response';
-        const { task } = await response.json();
-        if (!task || task.taskId !== input.task.taskId || task.attemptId !== input.task.attemptId || task.leaseOwner !== input.lease.owner || task.leaseFence !== input.lease.fence || task.status !== 'running' || task.cancelRequested) {
-            reason = 'production_lease_mismatch';
-            throw new Error('production_lease_unavailable');
-        }
-    }
-    catch (error) {
-        const cause = error instanceof Error ? error.cause : undefined;
-        const causeCode = cause && typeof cause === 'object' && 'code' in cause && typeof cause.code === 'string'
-            && /^[A-Za-z0-9_]{1,64}$/.test(cause.code) ? cause.code : undefined;
-        // Callback diagnostics retain machine codes only; responses and credentials stay private.
-        try {
-            console.error(JSON.stringify({ event: 'production.lease_verification_failed', taskId: input.task.taskId,
-                attemptId: input.task.attemptId, workspaceId: input.task.workspaceId, directoryName: input.directoryName,
-                stage: input.stage, leaseFence: input.lease.fence, status, reason,
-                errorType: error instanceof Error && /^[A-Za-z0-9_]{1,64}$/.test(error.name) ? error.name : 'UnknownError', causeCode }));
-        }
-        catch { /* Diagnostics must preserve the original failure. */ }
-        throw error;
-    }
-}