@playcraft/common 0.0.56 → 0.0.58

package/dist/cloud-workspace/runtime/terminals.js

@@ -0,0 +1,62 @@
+import { z } from 'zod';
+import { workspaceRelativePathSchema } from './files.js';
+export const TERMINAL_STATUSES = ['active', 'destroyed'];
+export const terminalIdSchema = z.string().trim().min(1).max(128);
+export const terminalCreatePayloadSchema = z
+    .object({
+    terminalId: terminalIdSchema.optional(),
+    cwd: workspaceRelativePathSchema.optional(),
+})
+    .strict();
+export const terminalRecordSchema = z
+    .object({
+    terminalId: terminalIdSchema,
+    workspaceId: z.string().min(1).max(128),
+    environment: z.string().min(1).max(64),
+    userId: z.string().min(1).max(128),
+    runtimeId: z.string().min(1).max(128).optional(),
+    generation: z.number().int().nonnegative().optional(),
+    runtimeEpoch: z.number().int().nonnegative().optional(),
+    processIdentity: z.string().min(1).max(512),
+    cwd: z.string().max(512),
+    status: z.enum(TERMINAL_STATUSES),
+    createdAt: z.string().min(1),
+    destroyedAt: z.string().min(1).optional(),
+})
+    .strict();
+export function terminalProcessIdentity(workspaceId, terminalId, cwd = '') {
+    return cwd ? `term:${workspaceId}:${terminalId}|${cwd}` : `term:${workspaceId}:${terminalId}`;
+}
+export function parseTerminalProcessIdentity(value) {
+    const separator = value.indexOf('|');
+    const head = separator === -1 ? value : value.slice(0, separator);
+    const cwd = separator === -1 ? '' : value.slice(separator + 1);
+    const match = /^term:([^:]+):(.+)$/.exec(head);
+    return {
+        workspaceId: match?.[1],
+        terminalId: match?.[2],
+        cwd,
+    };
+}
+/** Client-chosen connection endpoints. Identity drafts persist leases without a display. */
+export const UNTRUSTED_DISPLAY_FIELDS = [
+    'displayUrl',
+    'vncUrl',
+    'websocketUrl',
+    'host',
+    'url',
+    'novnc',
+];
+export const desktopAccessPayloadSchema = z.object({}).strict();
+export const desktopLeaseRecordSchema = z
+    .object({
+    leaseId: z.string().min(1).max(128),
+    environment: z.string().min(1).max(64),
+    userId: z.string().min(1).max(128),
+    takeoverRevision: z.number().int().nonnegative(),
+    status: z.enum(['active', 'released']),
+    display: z.literal('not_started'),
+    expiresAt: z.string().min(1).optional(),
+})
+    .strict();
+//# sourceMappingURL=terminals.js.map

package/dist/cloud-workspace/runtime/terminals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminals.js","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/terminals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAEzD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAU,CAAC;AAGlE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAElE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACvC,GAAG,EAAE,2BAA2B,CAAC,QAAQ,EAAE;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,UAAU,EAAE,gBAAgB;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACrD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACvD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,UAAU,uBAAuB,CAAC,WAAmB,EAAE,UAAkB,EAAE,GAAG,GAAG,EAAE;IACvF,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,WAAW,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,WAAW,IAAI,UAAU,EAAE,CAAC;AAChG,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAa;IAKxD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,OAAO;QACL,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACvB,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACtB,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,YAAY;IACZ,QAAQ;IACR,cAAc;IACd,MAAM;IACN,KAAK;IACL,OAAO;CACC,CAAC;AAIX,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAIhE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAChD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/cloud-workspace/runtime/variant-workspace.d.ts

@@ -0,0 +1,221 @@
+import { z } from 'zod';
+export declare const variantWorkspacePayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    action: z.ZodLiteral<"clone">;
+    sourceBranch: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    action: z.ZodLiteral<"install">;
+    seedFiles: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        content: z.ZodString;
+        encoding: z.ZodDefault<z.ZodEnum<{
+            base64: "base64";
+            utf8: "utf8";
+        }>>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>], "action">;
+export declare const variantWorkspaceRequestSchema: z.ZodUnion<readonly [z.ZodObject<{
+    payload: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        action: z.ZodLiteral<"clone">;
+        sourceBranch: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        action: z.ZodLiteral<"install">;
+        seedFiles: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            content: z.ZodString;
+            encoding: z.ZodDefault<z.ZodEnum<{
+                base64: "base64";
+                utf8: "utf8";
+            }>>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>], "action">;
+    settledOnly: z.ZodDefault<z.ZodLiteral<false>>;
+    claim: z.ZodObject<{
+        action: z.ZodEnum<{
+            settled: "settled";
+            ensure_opencode: "ensure_opencode";
+            ensure_preview: "ensure_preview";
+            sync_model: "sync_model";
+        }>;
+        sessionId: z.ZodString;
+        requestId: z.ZodString;
+        writerEpoch: z.ZodNumber;
+        workspaceId: z.ZodString;
+        kind: z.ZodEnum<{
+            session: "session";
+            manager: "manager";
+            execution: "execution";
+        }>;
+        runId: z.ZodOptional<z.ZodString>;
+        executionId: z.ZodOptional<z.ZodString>;
+        issueId: z.ZodOptional<z.ZodString>;
+        claimToken: z.ZodOptional<z.ZodString>;
+        settledOnly: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>;
+    variantId: z.ZodString;
+    leaseToken: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    action: z.ZodEnum<{
+        install: "install";
+        clone: "clone";
+    }>;
+    inputHash: z.ZodString;
+    settledOnly: z.ZodLiteral<true>;
+    claim: z.ZodObject<{
+        action: z.ZodEnum<{
+            settled: "settled";
+            ensure_opencode: "ensure_opencode";
+            ensure_preview: "ensure_preview";
+            sync_model: "sync_model";
+        }>;
+        sessionId: z.ZodString;
+        requestId: z.ZodString;
+        writerEpoch: z.ZodNumber;
+        workspaceId: z.ZodString;
+        kind: z.ZodEnum<{
+            session: "session";
+            manager: "manager";
+            execution: "execution";
+        }>;
+        runId: z.ZodOptional<z.ZodString>;
+        executionId: z.ZodOptional<z.ZodString>;
+        issueId: z.ZodOptional<z.ZodString>;
+        claimToken: z.ZodOptional<z.ZodString>;
+        settledOnly: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>;
+    variantId: z.ZodString;
+    leaseToken: z.ZodString;
+}, z.core.$strict>]>;
+export declare const variantWorkspaceResponseSchema: z.ZodObject<{
+    requestId: z.ZodString;
+    operationId: z.ZodString;
+    inputHash: z.ZodString;
+    result: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        outcome: z.ZodLiteral<"running">;
+    }, z.core.$strict>, z.ZodObject<{
+        outcome: z.ZodLiteral<"uncertain">;
+        error: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        outcome: z.ZodLiteral<"settled">;
+        status: z.ZodEnum<{
+            failed: "failed";
+            completed: "completed";
+        }>;
+        error: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>], "outcome">;
+}, z.core.$strict>;
+export declare const variantWorkspaceIntentSchema: z.ZodObject<{
+    requestId: z.ZodString;
+    payload: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        action: z.ZodLiteral<"clone">;
+        sourceBranch: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        action: z.ZodLiteral<"install">;
+        seedFiles: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            content: z.ZodString;
+            encoding: z.ZodDefault<z.ZodEnum<{
+                base64: "base64";
+                utf8: "utf8";
+            }>>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>], "action">;
+    inputHash: z.ZodString;
+    receipt: z.ZodOptional<z.ZodObject<{
+        requestId: z.ZodString;
+        operationId: z.ZodString;
+        inputHash: z.ZodString;
+        result: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            outcome: z.ZodLiteral<"running">;
+        }, z.core.$strict>, z.ZodObject<{
+            outcome: z.ZodLiteral<"uncertain">;
+            error: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            outcome: z.ZodLiteral<"settled">;
+            status: z.ZodEnum<{
+                failed: "failed";
+                completed: "completed";
+            }>;
+            error: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>], "outcome">;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const variantWorkspaceIntentsSchema: z.ZodObject<{
+    clone: z.ZodOptional<z.ZodObject<{
+        requestId: z.ZodString;
+        payload: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            action: z.ZodLiteral<"clone">;
+            sourceBranch: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            action: z.ZodLiteral<"install">;
+            seedFiles: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                content: z.ZodString;
+                encoding: z.ZodDefault<z.ZodEnum<{
+                    base64: "base64";
+                    utf8: "utf8";
+                }>>;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>], "action">;
+        inputHash: z.ZodString;
+        receipt: z.ZodOptional<z.ZodObject<{
+            requestId: z.ZodString;
+            operationId: z.ZodString;
+            inputHash: z.ZodString;
+            result: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                outcome: z.ZodLiteral<"running">;
+            }, z.core.$strict>, z.ZodObject<{
+                outcome: z.ZodLiteral<"uncertain">;
+                error: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                outcome: z.ZodLiteral<"settled">;
+                status: z.ZodEnum<{
+                    failed: "failed";
+                    completed: "completed";
+                }>;
+                error: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>], "outcome">;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    install: z.ZodOptional<z.ZodObject<{
+        requestId: z.ZodString;
+        payload: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            action: z.ZodLiteral<"clone">;
+            sourceBranch: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            action: z.ZodLiteral<"install">;
+            seedFiles: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                content: z.ZodString;
+                encoding: z.ZodDefault<z.ZodEnum<{
+                    base64: "base64";
+                    utf8: "utf8";
+                }>>;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>], "action">;
+        inputHash: z.ZodString;
+        receipt: z.ZodOptional<z.ZodObject<{
+            requestId: z.ZodString;
+            operationId: z.ZodString;
+            inputHash: z.ZodString;
+            result: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                outcome: z.ZodLiteral<"running">;
+            }, z.core.$strict>, z.ZodObject<{
+                outcome: z.ZodLiteral<"uncertain">;
+                error: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                outcome: z.ZodLiteral<"settled">;
+                status: z.ZodEnum<{
+                    failed: "failed";
+                    completed: "completed";
+                }>;
+                error: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>], "outcome">;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type VariantWorkspacePayload = z.infer<typeof variantWorkspacePayloadSchema>;
+export type VariantWorkspaceRequest = z.infer<typeof variantWorkspaceRequestSchema>;
+export type VariantWorkspaceResponse = z.infer<typeof variantWorkspaceResponseSchema>;
+export type VariantWorkspaceIntent = z.infer<typeof variantWorkspaceIntentSchema>;
+export type VariantWorkspaceIntents = z.infer<typeof variantWorkspaceIntentsSchema>;
+//# sourceMappingURL=variant-workspace.d.ts.map

package/dist/cloud-workspace/runtime/variant-workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"variant-workspace.d.ts","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/variant-workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;8BAmBxC,CAAC;AAMH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAgBxC,CAAC;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;kBAiBhC,CAAC;AACZ,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAO9B,CAAC;AACZ,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAK/B,CAAC;AACZ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}

package/dist/cloud-workspace/runtime/variant-workspace.js

@@ -0,0 +1,75 @@
+import { z } from 'zod';
+import { agentConnectionRequestSchema } from './agent-connection.js';
+export const variantWorkspacePayloadSchema = z.discriminatedUnion('action', [
+    z.object({ action: z.literal('clone'), sourceBranch: z.string().min(1).max(512) }).strict(),
+    z
+        .object({
+        action: z.literal('install'),
+        seedFiles: z
+            .array(z
+            .object({
+            path: z.string().min(1).max(1000),
+            content: z.string().max(8 * 1024 * 1024),
+            encoding: z.enum(['utf8', 'base64']).default('utf8'),
+        })
+            .strict())
+            .max(100)
+            .default([]),
+    })
+        .strict(),
+]);
+const authority = {
+    claim: agentConnectionRequestSchema,
+    variantId: z.string().uuid(),
+    leaseToken: z.string().uuid(),
+};
+export const variantWorkspaceRequestSchema = z.union([
+    z
+        .object({
+        ...authority,
+        payload: variantWorkspacePayloadSchema,
+        settledOnly: z.literal(false).default(false),
+    })
+        .strict(),
+    z
+        .object({
+        ...authority,
+        action: z.enum(['clone', 'install']),
+        inputHash: z.string().regex(/^[a-f0-9]{64}$/),
+        settledOnly: z.literal(true),
+    })
+        .strict(),
+]);
+export const variantWorkspaceResponseSchema = z
+    .object({
+    requestId: z.string().uuid(),
+    operationId: z.string().uuid(),
+    inputHash: z.string().regex(/^[a-f0-9]{64}$/),
+    result: z.discriminatedUnion('outcome', [
+        z.object({ outcome: z.literal('running') }).strict(),
+        z.object({ outcome: z.literal('uncertain'), error: z.string().max(128) }).strict(),
+        z
+            .object({
+            outcome: z.literal('settled'),
+            status: z.enum(['completed', 'failed']),
+            error: z.string().max(128).optional(),
+        })
+            .strict(),
+    ]),
+})
+    .strict();
+export const variantWorkspaceIntentSchema = z
+    .object({
+    requestId: z.string().uuid(),
+    payload: variantWorkspacePayloadSchema,
+    inputHash: z.string().regex(/^[a-f0-9]{64}$/),
+    receipt: variantWorkspaceResponseSchema.optional(),
+})
+    .strict();
+export const variantWorkspaceIntentsSchema = z
+    .object({
+    clone: variantWorkspaceIntentSchema.optional(),
+    install: variantWorkspaceIntentSchema.optional(),
+})
+    .strict();
+//# sourceMappingURL=variant-workspace.js.map

package/dist/cloud-workspace/runtime/variant-workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"variant-workspace.js","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/variant-workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAErE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IAC1E,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3F,CAAC;SACE,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC5B,SAAS,EAAE,CAAC;aACT,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;YACxC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;SACrD,CAAC;aACD,MAAM,EAAE,CACZ;aACA,GAAG,CAAC,GAAG,CAAC;aACR,OAAO,CAAC,EAAE,CAAC;KACf,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AACH,MAAM,SAAS,GAAG;IAChB,KAAK,EAAE,4BAA4B;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;CAC9B,CAAC;AACF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC;IACnD,CAAC;SACE,MAAM,CAAC;QACN,GAAG,SAAS;QACZ,OAAO,EAAE,6BAA6B;QACtC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;KAC7C,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,GAAG,SAAS;QACZ,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAC7C,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;KAC7B,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;QACtC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QACpD,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QAClF,CAAC;aACE,MAAM,CAAC;YACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;YAC7B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACvC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;SACtC,CAAC;aACD,MAAM,EAAE;KACZ,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,OAAO,EAAE,6BAA6B;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC7C,OAAO,EAAE,8BAA8B,CAAC,QAAQ,EAAE;CACnD,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,KAAK,EAAE,4BAA4B,CAAC,QAAQ,EAAE;IAC9C,OAAO,EAAE,4BAA4B,CAAC,QAAQ,EAAE;CACjD,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/cloud-workspace/runtime/workspace-binding.d.ts

@@ -0,0 +1,84 @@
+import { z } from 'zod';
+/** Trusted control-plane registration; never merge this with a browser operation payload. */
+export declare const workspaceRegistrationSchema: z.ZodObject<{
+    workspaceId: z.ZodString;
+    projectId: z.ZodString;
+    targetKind: z.ZodEnum<{
+        main: "main";
+        remix: "remix";
+    }>;
+    remixId: z.ZodNullable<z.ZodString>;
+    repositoryUrl: z.ZodString;
+    branchName: z.ZodString;
+}, z.core.$strict>;
+export type WorkspaceRegistration = z.infer<typeof workspaceRegistrationSchema>;
+/** Ephemeral clone access, never part of a persisted Workspace binding or operation. */
+export declare const workspaceGitAccessSchema: z.ZodObject<{
+    username: z.ZodString;
+    password: z.ZodString;
+    issuedAt: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strict>;
+export type WorkspaceGitAccess = z.infer<typeof workspaceGitAccessSchema>;
+/** Controlled read entry. The canonical repository URL stays on the remote. */
+export declare const workspaceGitTransportSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"git-read-gateway-v1">;
+    cloneUrl: z.ZodString;
+}, z.core.$strict>;
+export type WorkspaceGitTransport = z.infer<typeof workspaceGitTransportSchema>;
+export declare const workspacePreparationSchema: z.ZodObject<{
+    mode: z.ZodLiteral<"clone">;
+    gitAccess: z.ZodOptional<z.ZodObject<{
+        username: z.ZodString;
+        password: z.ZodString;
+        issuedAt: z.ZodString;
+        expiresAt: z.ZodString;
+    }, z.core.$strict>>;
+    transport: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodLiteral<"git-read-gateway-v1">;
+        cloneUrl: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type WorkspacePreparation = z.infer<typeof workspacePreparationSchema>;
+export declare function parseWorkspaceGitGatewayOrigin(value: string): string;
+export declare function parseWorkspaceGitGatewayOrigins(value: string | undefined): string[];
+export type WorkspaceGitGatewayMatch = {
+    ok: true;
+    origin: string;
+    requestId: string;
+} | {
+    ok: false;
+    reason: 'capability_missing' | 'rejected';
+};
+/** Proxy mode is rejected when no allowlisted origin is configured. */
+export declare function matchWorkspaceGitGatewayCloneUrl(cloneUrl: string, allowedOrigins: readonly string[], repositoryUrl: string): WorkspaceGitGatewayMatch;
+export declare const workspaceRegistrationRequestSchema: z.ZodObject<{
+    binding: z.ZodObject<{
+        workspaceId: z.ZodString;
+        projectId: z.ZodString;
+        targetKind: z.ZodEnum<{
+            main: "main";
+            remix: "remix";
+        }>;
+        remixId: z.ZodNullable<z.ZodString>;
+        repositoryUrl: z.ZodString;
+        branchName: z.ZodString;
+    }, z.core.$strict>;
+    generation: z.ZodNumber;
+    runtimeEpoch: z.ZodNumber;
+    leaseFence: z.ZodNumber;
+    preparation: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodLiteral<"clone">;
+        gitAccess: z.ZodOptional<z.ZodObject<{
+            username: z.ZodString;
+            password: z.ZodString;
+            issuedAt: z.ZodString;
+            expiresAt: z.ZodString;
+        }, z.core.$strict>>;
+        transport: z.ZodOptional<z.ZodObject<{
+            kind: z.ZodLiteral<"git-read-gateway-v1">;
+            cloneUrl: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+//# sourceMappingURL=workspace-binding.d.ts.map

package/dist/cloud-workspace/runtime/workspace-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-binding.d.ts","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/workspace-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,6FAA6F;AAC7F,eAAO,MAAM,2BAA2B;;;;;;;;;;kBAUwC,CAAC;AAEjF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,wFAAwF;AACxF,eAAO,MAAM,wBAAwB;;;;;kBAmBjC,CAAC;AACL,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,+EAA+E;AAC/E,eAAO,MAAM,2BAA2B;;;kBAK7B,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;kBAO6C,CAAC;AACrF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAI9E,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAcpE;AAED,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAWnF;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,GAAG,UAAU,CAAA;CAAE,CAAC;AAE7D,uEAAuE;AACvE,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,aAAa,EAAE,MAAM,GACpB,wBAAwB,CAkC1B;AAED,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQpC,CAAC"}

package/dist/cloud-workspace/runtime/workspace-binding.js

@@ -0,0 +1,121 @@
+import { z } from 'zod';
+/** Trusted control-plane registration; never merge this with a browser operation payload. */
+export const workspaceRegistrationSchema = z
+    .object({
+    workspaceId: z.string().uuid(),
+    projectId: z.string().uuid(),
+    targetKind: z.enum(['main', 'remix']),
+    remixId: z.string().uuid().nullable(),
+    repositoryUrl: z.string().min(1).max(2048),
+    branchName: z.string().min(1).max(512),
+})
+    .strict()
+    .refine((value) => (value.targetKind === 'main') === (value.remixId === null));
+/** Ephemeral clone access, never part of a persisted Workspace binding or operation. */
+export const workspaceGitAccessSchema = z
+    .object({
+    username: z
+        .string()
+        .min(1)
+        .max(256)
+        .regex(/^[^:\r\n\0]+$/),
+    password: z
+        .string()
+        .min(1)
+        .max(8192)
+        .regex(/^[^\r\n\0]+$/),
+    issuedAt: z.string().datetime(),
+    expiresAt: z.string().datetime(),
+})
+    .strict()
+    .refine((value) => {
+    const lifetime = Date.parse(value.expiresAt) - Date.parse(value.issuedAt);
+    return lifetime > 0 && lifetime <= 15 * 60_000;
+});
+/** Controlled read entry. The canonical repository URL stays on the remote. */
+export const workspaceGitTransportSchema = z
+    .object({
+    kind: z.literal('git-read-gateway-v1'),
+    cloneUrl: z.string().min(1).max(2048),
+})
+    .strict();
+export const workspacePreparationSchema = z
+    .object({
+    mode: z.literal('clone'),
+    gitAccess: workspaceGitAccessSchema.optional(),
+    transport: workspaceGitTransportSchema.optional(),
+})
+    .strict()
+    .refine((value) => value.transport === undefined || value.gitAccess !== undefined);
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
+export function parseWorkspaceGitGatewayOrigin(value) {
+    const url = new URL(value);
+    if (url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        (url.pathname !== '/' && url.pathname !== '') ||
+        (url.protocol !== 'https:' &&
+            !(url.protocol === 'http:' && LOOPBACK_HOSTS.has(url.hostname)))) {
+        throw new Error('invalid_git_gateway_origin');
+    }
+    return url.origin;
+}
+export function parseWorkspaceGitGatewayOrigins(value) {
+    if (!value?.trim())
+        return [];
+    return [
+        ...new Set(value
+            .split(',')
+            .map((item) => item.trim())
+            .filter(Boolean)
+            .map((item) => parseWorkspaceGitGatewayOrigin(item))),
+    ];
+}
+/** Proxy mode is rejected when no allowlisted origin is configured. */
+export function matchWorkspaceGitGatewayCloneUrl(cloneUrl, allowedOrigins, repositoryUrl) {
+    if (allowedOrigins.length === 0)
+        return { ok: false, reason: 'capability_missing' };
+    let gateway;
+    let repository;
+    try {
+        gateway = new URL(cloneUrl);
+        repository = new URL(repositoryUrl);
+    }
+    catch {
+        return { ok: false, reason: 'rejected' };
+    }
+    const allowed = new Set();
+    for (const origin of allowedOrigins) {
+        try {
+            allowed.add(parseWorkspaceGitGatewayOrigin(origin));
+        }
+        catch {
+            return { ok: false, reason: 'rejected' };
+        }
+    }
+    const request = /^\/workspace-git\/([a-f0-9]{64})$/.exec(gateway.pathname);
+    if (!request ||
+        gateway.username ||
+        gateway.password ||
+        gateway.search ||
+        gateway.hash ||
+        gateway.href !== `${gateway.origin}${gateway.pathname}` ||
+        gateway.origin === repository.origin ||
+        !allowed.has(gateway.origin) ||
+        (gateway.protocol !== 'https:' &&
+            !(gateway.protocol === 'http:' && LOOPBACK_HOSTS.has(gateway.hostname)))) {
+        return { ok: false, reason: 'rejected' };
+    }
+    return { ok: true, origin: gateway.origin, requestId: request[1] };
+}
+export const workspaceRegistrationRequestSchema = z
+    .object({
+    binding: workspaceRegistrationSchema,
+    generation: z.number().int().nonnegative(),
+    runtimeEpoch: z.number().int().nonnegative(),
+    leaseFence: z.number().int().nonnegative(),
+    preparation: workspacePreparationSchema.optional(),
+})
+    .strict();
+//# sourceMappingURL=workspace-binding.js.map

package/dist/cloud-workspace/runtime/workspace-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-binding.js","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/workspace-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,6FAA6F;AAC7F,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACvC,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC;AAIjF,wFAAwF;AACxF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,eAAe,CAAC;IACzB,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,IAAI,CAAC;SACT,KAAK,CAAC,cAAc,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;IAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1E,OAAO,QAAQ,GAAG,CAAC,IAAI,QAAQ,IAAI,EAAE,GAAG,MAAM,CAAC;AACjD,CAAC,CAAC,CAAC;AAGL,+EAA+E;AAC/E,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;CACtC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxB,SAAS,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAC9C,SAAS,EAAE,2BAA2B,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;AAGrF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE,MAAM,UAAU,8BAA8B,CAAC,KAAa;IAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IACE,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,IAAI;QACR,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC;QAC7C,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACxB,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAClE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAAyB;IACvE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO;QACL,GAAG,IAAI,GAAG,CACR,KAAK;aACF,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CACvD;KACF,CAAC;AACJ,CAAC;AAMD,uEAAuE;AACvE,MAAM,UAAU,gCAAgC,CAC9C,QAAgB,EAChB,cAAiC,EACjC,aAAqB;IAErB,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACpF,IAAI,OAAY,CAAC;IACjB,IAAI,UAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,UAAU,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3E,IACE,CAAC,OAAO;QACR,OAAO,CAAC,QAAQ;QAChB,OAAO,CAAC,QAAQ;QAChB,OAAO,CAAC,MAAM;QACd,OAAO,CAAC,IAAI;QACZ,OAAO,CAAC,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE;QACvD,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;QACpC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5B,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAC5B,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAC1E,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC;KAChD,MAAM,CAAC;IACN,OAAO,EAAE,2BAA2B;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,WAAW,EAAE,0BAA0B,CAAC,QAAQ,EAAE;CACnD,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/database/postgres-adapter.js

@@ -2,7 +2,7 @@
 // 现有 backend 已有自己的数据库初始化逻辑；common 这里提供一个可选 adapter，
 // 方便后续统一数据访问层。
 //
-// Pool 参数对齐 `packages/backend/src/core/database/index.ts`：
+// Pool 参数对齐 `packages/backend-business-server/src/core/database/index.ts`：
 // - keepAlive：阻止云 LB (Load Balancer, 负载均衡) 静默 RST 空闲连接
 // - idleTimeoutMillis：Pool 自身主动回收空闲连接，远短于云 LB idle timeout
 // - statement_timeout / query_timeout：查询兜底，防止请求挂死

package/dist/database/postgres-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"postgres-adapter.js","sourceRoot":"","sources":["../../src/database/postgres-adapter.ts"],"names":[],"mappings":"AAAA,qBAAqB;AACrB,oDAAoD;AACpD,eAAe;AACf,EAAE;AACF,2DAA2D;AAC3D,uDAAuD;AACvD,2DAA2D;AAC3D,kDAAkD;AAElD,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAO1B,MAAM,UAAU,qBAAqB,CAAC,gBAAwB;IAC5D,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,gBAAgB;QAChB,GAAG,EAAE,EAAE;QACP,iBAAiB,EAAE,MAAM;QACzB,uBAAuB,EAAE,MAAM;QAC/B,SAAS,EAAE,IAAI;QACf,2BAA2B,EAAE,MAAM;QACnC,iBAAiB,EAAE,MAAM;QACzB,aAAa,EAAE,MAAM;KACtB,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"postgres-adapter.js","sourceRoot":"","sources":["../../src/database/postgres-adapter.ts"],"names":[],"mappings":"AAAA,qBAAqB;AACrB,oDAAoD;AACpD,eAAe;AACf,EAAE;AACF,2EAA2E;AAC3E,uDAAuD;AACvD,2DAA2D;AAC3D,kDAAkD;AAElD,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAO1B,MAAM,UAAU,qBAAqB,CAAC,gBAAwB;IAC5D,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,gBAAgB;QAChB,GAAG,EAAE,EAAE;QACP,iBAAiB,EAAE,MAAM;QACzB,uBAAuB,EAAE,MAAM;QAC/B,SAAS,EAAE,IAAI;QACf,2BAA2B,EAAE,MAAM;QACnC,iBAAiB,EAAE,MAAM;QACzB,aAAa,EAAE,MAAM;KACtB,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACtB,CAAC"}

package/dist/database/schema.d.ts

@@ -2,7 +2,7 @@
  * SQLite Schema for CLI Offline Mode
  *
  * ⚠️ 重要提示：
- * 此 schema 是 packages/backend/src/core/database/schema.ts（PostgreSQL）的简化版本。
+ * 此 schema 是 packages/backend-business-server/src/core/database/schema.ts（PostgreSQL）的简化版本。
  * 主要字段需要与 backend schema 保持同步，以确保项目导入/导出的兼容性。
  *
  * 主要差异：

package/dist/database/schema.js

@@ -3,7 +3,7 @@ import { sqliteTable, text, integer } from 'drizzle-orm/sqlite-core';
  * SQLite Schema for CLI Offline Mode
  *
  * ⚠️ 重要提示：
- * 此 schema 是 packages/backend/src/core/database/schema.ts（PostgreSQL）的简化版本。
+ * 此 schema 是 packages/backend-business-server/src/core/database/schema.ts（PostgreSQL）的简化版本。
  * 主要字段需要与 backend schema 保持同步，以确保项目导入/导出的兼容性。
  *
  * 主要差异：

package/dist/messenger/server.d.ts

@@ -25,13 +25,26 @@ export declare const MessengerMessageType: {
     readonly WHOISONLINE: "whoisonline";
     readonly FS: "fs";
 };
+/** 已通过 project.watch 校验的会话上下文，供 onMessage 判断消息的合法作用域 */
+export type MessengerSessionContext = {
+    userId: unknown;
+    role: unknown;
+    /** 已通过 onCheckProjectAccess 校验的 projectId；未 watch 过任何项目时为 undefined */
+    projectId: unknown;
+};
 export type MessengerServerOptions = {
     path?: string;
     onAuth?: (token: string | undefined) => Promise<any>;
+    /**
+     * 处理业务消息。
+     *
+     * `session` 是服务端持有的、已校验过的上下文——涉及项目作用域的转发请务必以它为准，
+     * 不要信任 `message.data` 里客户端自报的 projectId。
+     */
     onMessage?: (client: WebSocket, message: {
         name: string;
         data: any;
-    }) => void | Promise<void>;
+    }, session: MessengerSessionContext) => void | Promise<void>;
     /** 验证用户是否有项目访问权限，返回 false 时拒绝订阅 */
     onCheckProjectAccess?: (userId: unknown, projectId: string) => Promise<boolean>;
     /** 从后端获取项目真实权限，未设置时使用默认权限 */