@playcraft/common 0.1.39-prod → 0.1.40-beta

package/dist/cloud-workspace/runtime/events.d.ts

@@ -0,0 +1,107 @@
+import { z } from 'zod';
+export declare const EVENT_STREAM_KINDS: readonly ["session", "workspace", "runtime"];
+export type EventStreamKind = (typeof EVENT_STREAM_KINDS)[number];
+export declare const eventStreamKindSchema: z.ZodEnum<{
+    session: "session";
+    runtime: "runtime";
+    workspace: "workspace";
+}>;
+export declare const sourceEventIdSchema: z.ZodObject<{
+    runtimeId: z.ZodString;
+    generation: z.ZodNumber;
+    runtimeEpoch: z.ZodNumber;
+    sourceSequence: z.ZodNumber;
+}, z.core.$strict>;
+export type SourceEventId = z.infer<typeof sourceEventIdSchema>;
+export declare const publicEventCursorSchema: z.ZodObject<{
+    streamKind: z.ZodEnum<{
+        session: "session";
+        runtime: "runtime";
+        workspace: "workspace";
+    }>;
+    streamId: z.ZodString;
+    sequence: z.ZodNumber;
+}, z.core.$strict>;
+export type PublicEventCursor = z.infer<typeof publicEventCursorSchema>;
+export declare const pendingSourceEventSchema: z.ZodObject<{
+    source: z.ZodObject<{
+        runtimeId: z.ZodString;
+        generation: z.ZodNumber;
+        runtimeEpoch: z.ZodNumber;
+        sourceSequence: z.ZodNumber;
+    }, z.core.$strict>;
+    payloadHash: z.ZodString;
+    type: z.ZodString;
+    payload: z.ZodUnknown;
+    occurredAt: z.ZodString;
+}, z.core.$strict>;
+export type PendingSourceEvent = z.infer<typeof pendingSourceEventSchema>;
+export declare const sourceEventReceiptSchema: z.ZodObject<{
+    source: z.ZodObject<{
+        runtimeId: z.ZodString;
+        generation: z.ZodNumber;
+        runtimeEpoch: z.ZodNumber;
+        sourceSequence: z.ZodNumber;
+    }, z.core.$strict>;
+    payloadHash: z.ZodString;
+    publicCursor: z.ZodObject<{
+        streamKind: z.ZodEnum<{
+            session: "session";
+            runtime: "runtime";
+            workspace: "workspace";
+        }>;
+        streamId: z.ZodString;
+        sequence: z.ZodNumber;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type SourceEventReceipt = z.infer<typeof sourceEventReceiptSchema>;
+export declare function sourceEventKey(id: SourceEventId): string;
+export type EventDedupResult = {
+    action: 'accept';
+} | {
+    action: 'reuse';
+    receipt: SourceEventReceipt;
+} | {
+    action: 'reject';
+    code: 'source_payload_mismatch';
+};
+export declare function resolveSourceEvent(existing: SourceEventReceipt | undefined, payloadHash: string): EventDedupResult;
+export declare function nextSourceSequence(last: number): number;
+export declare const sourceEventBatchSchema: z.ZodObject<{
+    runtimeId: z.ZodString;
+    generation: z.ZodNumber;
+    runtimeEpoch: z.ZodNumber;
+    events: z.ZodArray<z.ZodObject<{
+        source: z.ZodObject<{
+            runtimeId: z.ZodString;
+            generation: z.ZodNumber;
+            runtimeEpoch: z.ZodNumber;
+            sourceSequence: z.ZodNumber;
+        }, z.core.$strict>;
+        payloadHash: z.ZodString;
+        type: z.ZodString;
+        payload: z.ZodUnknown;
+        occurredAt: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type SourceEventBatch = z.infer<typeof sourceEventBatchSchema>;
+export declare const publicEventSchema: z.ZodObject<{
+    streamKind: z.ZodEnum<{
+        session: "session";
+        runtime: "runtime";
+        workspace: "workspace";
+    }>;
+    streamId: z.ZodString;
+    sequence: z.ZodNumber;
+    type: z.ZodString;
+    payload: z.ZodUnknown;
+    occurredAt: z.ZodString;
+    source: z.ZodOptional<z.ZodObject<{
+        runtimeId: z.ZodString;
+        generation: z.ZodNumber;
+        runtimeEpoch: z.ZodNumber;
+        sourceSequence: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type PublicEvent = z.infer<typeof publicEventSchema>;
+//# sourceMappingURL=events.d.ts.map

package/dist/cloud-workspace/runtime/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,kBAAkB,8CAA+C,CAAC;AAC/E,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAClE,eAAO,MAAM,qBAAqB;;;;EAA6B,CAAC;AAEhE,eAAO,MAAM,mBAAmB;;;;;kBAOrB,CAAC;AAEZ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,uBAAuB;;;;;;;;kBAMzB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,wBAAwB;;;;;;;;;;;kBAQ1B,CAAC;AAEZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;kBAM1B,CAAC;AAEZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,wBAAgB,cAAc,CAAC,EAAE,EAAE,aAAa,GAAG,MAAM,CAExD;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,yBAAyB,CAAA;CAAE,CAAC;AAE1D,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,EACxC,WAAW,EAAE,MAAM,GAClB,gBAAgB,CAIlB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;kBAOxB,CAAC;AAEZ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;kBAUnB,CAAC;AAEZ,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/cloud-workspace/runtime/events.js

@@ -0,0 +1,70 @@
+import { z } from 'zod';
+export const EVENT_STREAM_KINDS = ['session', 'workspace', 'runtime'];
+export const eventStreamKindSchema = z.enum(EVENT_STREAM_KINDS);
+export const sourceEventIdSchema = z
+    .object({
+    runtimeId: z.string().min(1).max(128),
+    generation: z.number().int().nonnegative(),
+    runtimeEpoch: z.number().int().nonnegative(),
+    sourceSequence: z.number().int().positive(),
+})
+    .strict();
+export const publicEventCursorSchema = z
+    .object({
+    streamKind: eventStreamKindSchema,
+    streamId: z.string().min(1).max(128),
+    sequence: z.number().int().nonnegative(),
+})
+    .strict();
+export const pendingSourceEventSchema = z
+    .object({
+    source: sourceEventIdSchema,
+    payloadHash: z.string().length(64),
+    type: z.string().min(1).max(128),
+    payload: z.unknown(),
+    occurredAt: z.string().min(1),
+})
+    .strict();
+export const sourceEventReceiptSchema = z
+    .object({
+    source: sourceEventIdSchema,
+    payloadHash: z.string().length(64),
+    publicCursor: publicEventCursorSchema,
+})
+    .strict();
+export function sourceEventKey(id) {
+    return `${id.runtimeId}:${id.generation}:${id.runtimeEpoch}:${id.sourceSequence}`;
+}
+export function resolveSourceEvent(existing, payloadHash) {
+    if (!existing)
+        return { action: 'accept' };
+    if (existing.payloadHash === payloadHash)
+        return { action: 'reuse', receipt: existing };
+    return { action: 'reject', code: 'source_payload_mismatch' };
+}
+export function nextSourceSequence(last) {
+    if (!Number.isInteger(last) || last < 0) {
+        throw new Error('invalid_source_sequence');
+    }
+    return last + 1;
+}
+export const sourceEventBatchSchema = z
+    .object({
+    runtimeId: z.string().min(1).max(128),
+    generation: z.number().int().nonnegative(),
+    runtimeEpoch: z.number().int().nonnegative(),
+    events: z.array(pendingSourceEventSchema).min(1).max(100),
+})
+    .strict();
+export const publicEventSchema = z
+    .object({
+    streamKind: eventStreamKindSchema,
+    streamId: z.string().min(1).max(128),
+    sequence: z.number().int().positive(),
+    type: z.string().min(1).max(128),
+    payload: z.unknown(),
+    occurredAt: z.string().min(1),
+    source: sourceEventIdSchema.optional(),
+})
+    .strict();
+//# sourceMappingURL=events.js.map

package/dist/cloud-workspace/runtime/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAU,CAAC;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAEhE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC5C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,UAAU,EAAE,qBAAqB;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,MAAM,EAAE,mBAAmB;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,MAAM,EAAE,mBAAmB;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IAClC,YAAY,EAAE,uBAAuB;CACtC,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,UAAU,cAAc,CAAC,EAAiB;IAC9C,OAAO,GAAG,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,YAAY,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC;AACpF,CAAC;AAOD,MAAM,UAAU,kBAAkB,CAChC,QAAwC,EACxC,WAAmB;IAEnB,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC3C,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACxF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC5C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,UAAU,EAAE,qBAAqB;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,MAAM,EAAE,mBAAmB,CAAC,QAAQ,EAAE;CACvC,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/cloud-workspace/runtime/execution-grant.d.ts

@@ -0,0 +1,36 @@
+import { z } from 'zod';
+export declare const WORKSPACE_EXECUTION_KIND: "workspace-execution";
+export declare const WORKSPACE_EXECUTION_AUDIENCE: "playcraft-runtime";
+export declare const workspaceExecutionGrantClaimsSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"workspace-execution">;
+    credentialType: z.ZodLiteral<"workspace-execution">;
+    environment: z.ZodString;
+    userId: z.ZodString;
+    workspaceId: z.ZodString;
+    runtimeId: z.ZodString;
+    generation: z.ZodNumber;
+    runtimeEpoch: z.ZodNumber;
+    grantId: z.ZodString;
+    aud: z.ZodLiteral<"playcraft-runtime">;
+}, z.core.$strict>;
+export type WorkspaceExecutionGrantClaims = z.infer<typeof workspaceExecutionGrantClaimsSchema>;
+/** Persisted grant metadata. The JWT itself is never part of this record. */
+export declare const workspaceExecutionGrantRecordSchema: z.ZodObject<{
+    grantId: z.ZodString;
+    environment: z.ZodString;
+    userId: z.ZodString;
+    workspaceId: z.ZodString;
+    runtimeId: z.ZodString;
+    generation: z.ZodNumber;
+    runtimeEpoch: z.ZodNumber;
+    expiresAt: z.ZodString;
+    revokedAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type WorkspaceExecutionGrantRecord = z.infer<typeof workspaceExecutionGrantRecordSchema>;
+export declare const GRANT_CLIENT_FORBIDDEN_FIELDS: readonly ["token", "grantId", "kind", "credentialType", "aud", "expiresAt", "revokedAt", "runtimeId", "generation", "runtimeEpoch", "leaseFence", "rootPath", "workspaceRoot", "binding", "repositoryUrl", "branchName", "preparation", "gitAccess", "parentGrantId", "authzRevision", "scope", "modelConfigIds"];
+export declare function findForbiddenGrantFields(input: unknown): string[];
+export declare function parseWorkspaceExecutionGrantClaims(input: unknown): WorkspaceExecutionGrantClaims;
+export declare function newGrantId(): string;
+export declare function mintWorkspaceExecutionGrant(claims: WorkspaceExecutionGrantClaims, secret: string, expiresIn?: string | number): Promise<string>;
+export declare function verifyWorkspaceExecutionGrant(token: string, secret: string): Promise<WorkspaceExecutionGrantClaims>;
+//# sourceMappingURL=execution-grant.d.ts.map

package/dist/cloud-workspace/runtime/execution-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-grant.d.ts","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/execution-grant.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,wBAAwB,EAAG,qBAA8B,CAAC;AACvE,eAAO,MAAM,4BAA4B,EAAG,mBAA4B,CAAC;AAIzE,eAAO,MAAM,mCAAmC;;;;;;;;;;;kBAarC,CAAC;AAEZ,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,6EAA6E;AAC7E,eAAO,MAAM,mCAAmC;;;;;;;;;;kBAYrC,CAAC;AAEZ,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,eAAO,MAAM,6BAA6B,mTAuBhC,CAAC;AAEX,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAGjE;AAED,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,OAAO,GAAG,6BAA6B,CAEhG;AAED,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,6BAA6B,EACrC,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,MAAM,GAAG,MAAa,GAChC,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,wBAAsB,6BAA6B,CACjD,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,6BAA6B,CAAC,CAkBxC"}

package/dist/cloud-workspace/runtime/execution-grant.js

@@ -0,0 +1,102 @@
+import { randomUUID } from 'node:crypto';
+import { SignJWT, jwtVerify } from 'jose';
+import { z } from 'zod';
+import { generationSchema, runtimeEpochSchema } from './generations.js';
+export const WORKSPACE_EXECUTION_KIND = 'workspace-execution';
+export const WORKSPACE_EXECUTION_AUDIENCE = 'playcraft-runtime';
+const encoder = new TextEncoder();
+export const workspaceExecutionGrantClaimsSchema = z
+    .object({
+    kind: z.literal(WORKSPACE_EXECUTION_KIND),
+    credentialType: z.literal(WORKSPACE_EXECUTION_KIND),
+    environment: z.string().trim().min(1).max(64),
+    userId: z.string().trim().min(1).max(128),
+    workspaceId: z.string().trim().min(1).max(128),
+    runtimeId: z.string().trim().min(1).max(128),
+    generation: generationSchema,
+    runtimeEpoch: runtimeEpochSchema,
+    grantId: z.string().trim().min(1).max(128),
+    aud: z.literal(WORKSPACE_EXECUTION_AUDIENCE),
+})
+    .strict();
+/** Persisted grant metadata. The JWT itself is never part of this record. */
+export const workspaceExecutionGrantRecordSchema = z
+    .object({
+    grantId: z.string().trim().min(1).max(128),
+    environment: z.string().trim().min(1).max(64),
+    userId: z.string().trim().min(1).max(128),
+    workspaceId: z.string().trim().min(1).max(128),
+    runtimeId: z.string().trim().min(1).max(128),
+    generation: generationSchema,
+    runtimeEpoch: runtimeEpochSchema,
+    expiresAt: z.string().min(1),
+    revokedAt: z.string().min(1).optional(),
+})
+    .strict();
+export const GRANT_CLIENT_FORBIDDEN_FIELDS = [
+    'token',
+    'grantId',
+    'kind',
+    'credentialType',
+    'aud',
+    'expiresAt',
+    'revokedAt',
+    'runtimeId',
+    'generation',
+    'runtimeEpoch',
+    'leaseFence',
+    'rootPath',
+    'workspaceRoot',
+    'binding',
+    'repositoryUrl',
+    'branchName',
+    'preparation',
+    'gitAccess',
+    'parentGrantId',
+    'authzRevision',
+    'scope',
+    'modelConfigIds',
+];
+export function findForbiddenGrantFields(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return [];
+    return GRANT_CLIENT_FORBIDDEN_FIELDS.filter((field) => field in input);
+}
+export function parseWorkspaceExecutionGrantClaims(input) {
+    return workspaceExecutionGrantClaimsSchema.parse(input);
+}
+export function newGrantId() {
+    return `grant_${randomUUID()}`;
+}
+export async function mintWorkspaceExecutionGrant(claims, secret, expiresIn = '1h') {
+    parseWorkspaceExecutionGrantClaims(claims);
+    if (secret.length < 16)
+        throw new Error('grant_secret_required');
+    return new SignJWT(claims)
+        .setProtectedHeader({ alg: 'HS256' })
+        .setIssuedAt()
+        .setExpirationTime(expiresIn)
+        .setJti(claims.grantId)
+        .sign(encoder.encode(secret));
+}
+export async function verifyWorkspaceExecutionGrant(token, secret) {
+    if (secret.length < 16)
+        throw new Error('grant_secret_required');
+    const { payload } = await jwtVerify(token, encoder.encode(secret), {
+        algorithms: ['HS256'],
+        audience: WORKSPACE_EXECUTION_AUDIENCE,
+    });
+    return parseWorkspaceExecutionGrantClaims({
+        kind: payload.kind,
+        credentialType: payload.credentialType,
+        environment: payload.environment,
+        userId: payload.userId,
+        workspaceId: payload.workspaceId,
+        runtimeId: payload.runtimeId,
+        generation: payload.generation,
+        runtimeEpoch: payload.runtimeEpoch,
+        grantId: payload.grantId,
+        aud: payload.aud ?? WORKSPACE_EXECUTION_AUDIENCE,
+    });
+}
+//# sourceMappingURL=execution-grant.js.map

package/dist/cloud-workspace/runtime/execution-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-grant.js","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/execution-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAExE,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAA8B,CAAC;AACvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,mBAA4B,CAAC;AAEzE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC;IACzC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC5C,UAAU,EAAE,gBAAgB;IAC5B,YAAY,EAAE,kBAAkB;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,6EAA6E;AAC7E,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC5C,UAAU,EAAE,gBAAgB;IAC5B,YAAY,EAAE,kBAAkB;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,OAAO;IACP,SAAS;IACT,MAAM;IACN,gBAAgB;IAChB,KAAK;IACL,WAAW;IACX,WAAW;IACX,WAAW;IACX,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,UAAU;IACV,eAAe;IACf,SAAS;IACT,eAAe;IACf,YAAY;IACZ,aAAa;IACb,WAAW;IACX,eAAe;IACf,eAAe;IACf,OAAO;IACP,gBAAgB;CACR,CAAC;AAEX,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3E,OAAO,6BAA6B,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,KAAc;IAC/D,OAAO,mCAAmC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,SAAS,UAAU,EAAE,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAqC,EACrC,MAAc,EACd,YAA6B,IAAI;IAEjC,kCAAkC,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACjE,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;SACvB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,EAAE;SACb,iBAAiB,CAAC,SAAS,CAAC;SAC5B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SACtB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAa,EACb,MAAc;IAEd,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;QACjE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,4BAA4B;KACvC,CAAC,CAAC;IACH,OAAO,kCAAkC,CAAC;QACxC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,4BAA4B;KACjD,CAAC,CAAC;AACL,CAAC"}

package/dist/cloud-workspace/runtime/files-search.d.ts

@@ -0,0 +1,17 @@
+import { z } from 'zod';
+export declare const WORKSPACE_FILE_SEARCH_LIMIT = 100;
+export declare const workspaceFileSearchQuerySchema: z.ZodObject<{
+    query: z.ZodDefault<z.ZodString>;
+    limit: z.ZodDefault<z.ZodNumber>;
+    cursor: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type WorkspaceFileSearchQuery = z.input<typeof workspaceFileSearchQuerySchema>;
+export declare const workspaceFileSearchResultSchema: z.ZodObject<{
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+    }, z.core.$strict>>;
+    truncated: z.ZodBoolean;
+    nextCursor: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type WorkspaceFileSearchResult = z.infer<typeof workspaceFileSearchResultSchema>;
+//# sourceMappingURL=files-search.d.ts.map

package/dist/cloud-workspace/runtime/files-search.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files-search.d.ts","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/files-search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C,eAAO,MAAM,8BAA8B;;;;kBAIhC,CAAC;AAEZ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,eAAO,MAAM,+BAA+B;;;;;;kBAIjC,CAAC;AACZ,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC"}

package/dist/cloud-workspace/runtime/files-search.js

@@ -0,0 +1,14 @@
+import { z } from 'zod';
+import { workspaceRelativePathSchema } from './files.js';
+export const WORKSPACE_FILE_SEARCH_LIMIT = 100;
+export const workspaceFileSearchQuerySchema = z.object({
+    query: z.string().trim().max(256).default(''),
+    limit: z.number().int().min(1).max(WORKSPACE_FILE_SEARCH_LIMIT).default(WORKSPACE_FILE_SEARCH_LIMIT),
+    cursor: z.string().min(1).max(1024).optional(),
+}).strict();
+export const workspaceFileSearchResultSchema = z.object({
+    files: z.array(z.object({ path: workspaceRelativePathSchema }).strict()).max(WORKSPACE_FILE_SEARCH_LIMIT),
+    truncated: z.boolean(),
+    nextCursor: z.string().min(1).max(1024).optional(),
+}).strict();
+//# sourceMappingURL=files-search.js.map

package/dist/cloud-workspace/runtime/files-search.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files-search.js","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/files-search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAEzD,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAC/C,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC;IACpG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,2BAA2B,CAAC;IACzG,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC,MAAM,EAAE,CAAC"}

package/dist/cloud-workspace/runtime/files.d.ts

@@ -0,0 +1,75 @@
+import { z } from 'zod';
+export declare const WORKSPACE_RELATIVE_PATH_MAX = 512;
+export declare const WORKSPACE_FILE_CONTENT_MAX: number;
+export declare const workspaceRelativePathSchema: z.ZodString;
+export type WorkspaceRelativePath = z.infer<typeof workspaceRelativePathSchema>;
+export declare const MANAGED_WRITE_SOURCES: readonly ["manual", "agent", "background"];
+export type ManagedWriteSource = (typeof MANAGED_WRITE_SOURCES)[number];
+export declare const managedWriteSourceSchema: z.ZodEnum<{
+    background: "background";
+    manual: "manual";
+    agent: "agent";
+}>;
+export declare const fileWritePayloadSchema: z.ZodObject<{
+    path: z.ZodString;
+    content: z.ZodString;
+    expectedRevision: z.ZodOptional<z.ZodNumber>;
+    writer: z.ZodOptional<z.ZodEnum<{
+        background: "background";
+        manual: "manual";
+        agent: "agent";
+    }>>;
+    writeId: z.ZodOptional<z.ZodString>;
+    hold: z.ZodOptional<z.ZodBoolean>;
+    release: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type FileWritePayload = z.infer<typeof fileWritePayloadSchema>;
+export declare const workspaceFileRecordSchema: z.ZodObject<{
+    path: z.ZodString;
+    revision: z.ZodNumber;
+    contentHash: z.ZodString;
+    size: z.ZodNumber;
+}, z.core.$strict>;
+export type WorkspaceFileRecord = z.infer<typeof workspaceFileRecordSchema>;
+export declare const workspaceFileListSchema: z.ZodObject<{
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        revision: z.ZodNumber;
+        contentHash: z.ZodString;
+        size: z.ZodNumber;
+    }, z.core.$strict>>;
+    unreadablePaths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export type WorkspaceFileList = z.infer<typeof workspaceFileListSchema>;
+export declare const workspaceFileContentSchema: z.ZodObject<{
+    path: z.ZodString;
+    revision: z.ZodNumber;
+    contentHash: z.ZodString;
+    content: z.ZodString;
+}, z.core.$strict>;
+export type WorkspaceFileContent = z.infer<typeof workspaceFileContentSchema>;
+export declare function hashWorkspaceFileContent(content: string): string;
+export declare function isWorkspaceRelativePath(value: string): boolean;
+/**
+ * The project's packages, installed with pnpm in the background after the checkout is registered.
+ * `pending` means the workspace has not been checked yet; `none` means it has no package.json.
+ */
+export declare const WORKSPACE_DEPENDENCY_STATUSES: readonly ["pending", "none", "installing", "ready", "failed"];
+export type WorkspaceDependencyStatus = (typeof WORKSPACE_DEPENDENCY_STATUSES)[number];
+export declare const workspaceDependenciesSchema: z.ZodObject<{
+    workspaceId: z.ZodString;
+    status: z.ZodEnum<{
+        none: "none";
+        pending: "pending";
+        failed: "failed";
+        ready: "ready";
+        installing: "installing";
+    }>;
+    lockHash: z.ZodOptional<z.ZodString>;
+    startedAt: z.ZodOptional<z.ZodString>;
+    finishedAt: z.ZodOptional<z.ZodString>;
+    error: z.ZodOptional<z.ZodString>;
+    logTail: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type WorkspaceDependencies = z.infer<typeof workspaceDependenciesSchema>;
+//# sourceMappingURL=files.d.ts.map

package/dist/cloud-workspace/runtime/files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/files.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C,eAAO,MAAM,0BAA0B,QAAc,CAAC;AAEtD,eAAO,MAAM,2BAA2B,aAcpC,CAAC;AAEL,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,qBAAqB,4CAA6C,CAAC;AAChF,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AACxE,eAAO,MAAM,wBAAwB;;;;EAAgC,CAAC;AAEtE,eAAO,MAAM,sBAAsB;;;;;;;;;;;;kBAqB/B,CAAC;AAEL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,yBAAyB;;;;;kBAO3B,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,uBAAuB;;;;;;;;kBAKzB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,0BAA0B;;;;;kBAO5B,CAAC;AAEZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,+DAMhC,CAAC;AACX,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;kBAU7B,CAAC;AAEZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}

package/dist/cloud-workspace/runtime/files.js

@@ -0,0 +1,94 @@
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+export const WORKSPACE_RELATIVE_PATH_MAX = 512;
+export const WORKSPACE_FILE_CONTENT_MAX = 1024 * 1024;
+export const workspaceRelativePathSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(WORKSPACE_RELATIVE_PATH_MAX)
+    .superRefine((value, context) => {
+    if (value.includes('\0') || value.includes('\\') || value.startsWith('/') || value.includes(':')) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: 'invalid_workspace_path' });
+        return;
+    }
+    const segments = value.split('/');
+    if (segments.some((segment) => segment === '' || segment === '.' || segment === '..')) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: 'invalid_workspace_path' });
+    }
+});
+export const MANAGED_WRITE_SOURCES = ['manual', 'agent', 'background'];
+export const managedWriteSourceSchema = z.enum(MANAGED_WRITE_SOURCES);
+export const fileWritePayloadSchema = z
+    .object({
+    path: workspaceRelativePathSchema,
+    content: z.string().max(WORKSPACE_FILE_CONTENT_MAX),
+    expectedRevision: z.number().int().nonnegative().optional(),
+    writer: managedWriteSourceSchema.optional(),
+    writeId: z.string().trim().min(1).max(128).optional(),
+    hold: z.boolean().optional(),
+    release: z.boolean().optional(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if ((value.hold || value.release) && !value.writeId) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: 'write_id_required' });
+    }
+    if (value.hold && value.release) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: 'write_hold_conflict' });
+    }
+    if (value.writer === 'background' && value.hold !== true && value.release !== true) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: 'background_write_unmanaged' });
+    }
+});
+export const workspaceFileRecordSchema = z
+    .object({
+    path: workspaceRelativePathSchema,
+    revision: z.number().int().nonnegative(),
+    contentHash: z.string().length(64),
+    size: z.number().int().nonnegative(),
+})
+    .strict();
+export const workspaceFileListSchema = z
+    .object({
+    files: z.array(workspaceFileRecordSchema),
+    unreadablePaths: z.array(workspaceRelativePathSchema).optional(),
+})
+    .strict();
+export const workspaceFileContentSchema = z
+    .object({
+    path: workspaceRelativePathSchema,
+    revision: z.number().int().nonnegative(),
+    contentHash: z.string().length(64),
+    content: z.string().max(WORKSPACE_FILE_CONTENT_MAX),
+})
+    .strict();
+export function hashWorkspaceFileContent(content) {
+    return createHash('sha256').update(content, 'utf8').digest('hex');
+}
+export function isWorkspaceRelativePath(value) {
+    return workspaceRelativePathSchema.safeParse(value).success;
+}
+/**
+ * The project's packages, installed with pnpm in the background after the checkout is registered.
+ * `pending` means the workspace has not been checked yet; `none` means it has no package.json.
+ */
+export const WORKSPACE_DEPENDENCY_STATUSES = [
+    'pending',
+    'none',
+    'installing',
+    'ready',
+    'failed',
+];
+export const workspaceDependenciesSchema = z
+    .object({
+    workspaceId: z.string().min(1).max(128),
+    status: z.enum(WORKSPACE_DEPENDENCY_STATUSES),
+    lockHash: z.string().length(64).optional(),
+    startedAt: z.string().optional(),
+    finishedAt: z.string().optional(),
+    error: z.string().max(128).optional(),
+    logTail: z.string().max(8_000).optional(),
+})
+    .strict();
+//# sourceMappingURL=files.js.map

package/dist/cloud-workspace/runtime/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAC/C,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,2BAA2B,CAAC;KAChC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjG,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QACtF,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC,CAAC,CAAC;AAIL,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAU,CAAC;AAEhF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,IAAI,EAAE,2BAA2B;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,0BAA0B,CAAC;IACnD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC3D,MAAM,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACrD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACpD,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAChC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACnF,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC,CAAC,CAAC;AAIL,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,IAAI,EAAE,2BAA2B;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IACzC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,QAAQ,EAAE;CACjE,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,IAAI,EAAE,2BAA2B;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,0BAA0B,CAAC;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,OAAO,2BAA2B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,SAAS;IACT,MAAM;IACN,YAAY;IACZ,OAAO;IACP,QAAQ;CACA,CAAC;AAGX,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/cloud-workspace/runtime/generations.d.ts

@@ -0,0 +1,18 @@
+import { z } from 'zod';
+export declare const generationSchema: z.ZodNumber;
+export declare const runtimeEpochSchema: z.ZodNumber;
+export declare const leaseFenceSchema: z.ZodNumber;
+export declare const runtimeGenerationsSchema: z.ZodObject<{
+    generation: z.ZodNumber;
+    runtimeEpoch: z.ZodNumber;
+    leaseFence: z.ZodNumber;
+}, z.core.$strict>;
+export type RuntimeGenerations = z.infer<typeof runtimeGenerationsSchema>;
+/** Fields the browser client must not choose. Trusted config or server registration fills them.
+ *  Sandbox control HTTP still accepts dispatcher `leaseFence` and checks it separately. */
+export declare const UNTRUSTED_RUNTIME_FIELDS: readonly ["userId", "runtimeId", "generation", "runtimeEpoch", "leaseFence", "rootPath", "workspaceRoot"];
+export type UntrustedRuntimeField = (typeof UNTRUSTED_RUNTIME_FIELDS)[number];
+export declare function findUntrustedRuntimeFields(input: unknown): UntrustedRuntimeField[];
+export declare function assertTrustedGenerations(actual: RuntimeGenerations, expected: Pick<RuntimeGenerations, 'generation' | 'runtimeEpoch'>): 'ok' | 'generation_mismatch';
+export declare function assertLeaseFence(actual: number, acceptedFence: number): 'ok' | 'stale_lease';
+//# sourceMappingURL=generations.d.ts.map

package/dist/cloud-workspace/runtime/generations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generations.d.ts","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/generations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,gBAAgB,aAAiC,CAAC;AAC/D,eAAO,MAAM,kBAAkB,aAAiC,CAAC;AACjE,eAAO,MAAM,gBAAgB,aAAiC,CAAC;AAE/D,eAAO,MAAM,wBAAwB;;;;kBAM1B,CAAC;AAEZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;2FAC2F;AAC3F,eAAO,MAAM,wBAAwB,2GAQ3B,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,EAAE,CAGlF;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,kBAAkB,EAC1B,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,GAAG,cAAc,CAAC,GAChE,IAAI,GAAG,qBAAqB,CAK9B;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,aAAa,CAG5F"}

package/dist/cloud-workspace/runtime/generations.js

@@ -0,0 +1,39 @@
+import { z } from 'zod';
+export const generationSchema = z.number().int().nonnegative();
+export const runtimeEpochSchema = z.number().int().nonnegative();
+export const leaseFenceSchema = z.number().int().nonnegative();
+export const runtimeGenerationsSchema = z
+    .object({
+    generation: generationSchema,
+    runtimeEpoch: runtimeEpochSchema,
+    leaseFence: leaseFenceSchema,
+})
+    .strict();
+/** Fields the browser client must not choose. Trusted config or server registration fills them.
+ *  Sandbox control HTTP still accepts dispatcher `leaseFence` and checks it separately. */
+export const UNTRUSTED_RUNTIME_FIELDS = [
+    'userId',
+    'runtimeId',
+    'generation',
+    'runtimeEpoch',
+    'leaseFence',
+    'rootPath',
+    'workspaceRoot',
+];
+export function findUntrustedRuntimeFields(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return [];
+    return UNTRUSTED_RUNTIME_FIELDS.filter((field) => field in input);
+}
+export function assertTrustedGenerations(actual, expected) {
+    if (actual.generation !== expected.generation || actual.runtimeEpoch !== expected.runtimeEpoch) {
+        return 'generation_mismatch';
+    }
+    return 'ok';
+}
+export function assertLeaseFence(actual, acceptedFence) {
+    if (actual < acceptedFence)
+        return 'stale_lease';
+    return 'ok';
+}
+//# sourceMappingURL=generations.js.map

package/dist/cloud-workspace/runtime/generations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generations.js","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/generations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;AAC/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;AACjE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;AAE/D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,UAAU,EAAE,gBAAgB;IAC5B,YAAY,EAAE,kBAAkB;IAChC,UAAU,EAAE,gBAAgB;CAC7B,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;2FAC2F;AAC3F,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,UAAU;IACV,eAAe;CACP,CAAC;AAIX,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3E,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAA0B,EAC1B,QAAiE;IAEjE,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,IAAI,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC/F,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,aAAqB;IACpE,IAAI,MAAM,GAAG,aAAa;QAAE,OAAO,aAAa,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC"}