@playcraft/common 0.1.52 → 0.1.53-beta

package/dist/cloud-workspace/runtime/files.d.ts

@@ -0,0 +1,132 @@
+import { z } from 'zod';
+export declare const WORKSPACE_RELATIVE_PATH_MAX = 512;
+export declare const WORKSPACE_FILE_CONTENT_MAX: number;
+export declare const BINARY_WORKSPACE_FILE_MAX_BYTES: number;
+export declare const BINARY_WORKSPACE_FILE_BODY_MAX_BYTES: number;
+export declare const workspaceRelativePathSchema: z.ZodString;
+export type WorkspaceRelativePath = z.infer<typeof workspaceRelativePathSchema>;
+export declare const MANAGED_WRITE_SOURCES: readonly ["manual", "agent", "background"];
+export type ManagedWriteSource = (typeof MANAGED_WRITE_SOURCES)[number];
+export declare const managedWriteSourceSchema: z.ZodEnum<{
+    manual: "manual";
+    agent: "agent";
+    background: "background";
+}>;
+export declare const fileWritePayloadSchema: z.ZodObject<{
+    path: z.ZodString;
+    content: z.ZodString;
+    expectedRevision: z.ZodOptional<z.ZodNumber>;
+    writer: z.ZodOptional<z.ZodEnum<{
+        manual: "manual";
+        agent: "agent";
+        background: "background";
+    }>>;
+    writeId: z.ZodOptional<z.ZodString>;
+    hold: z.ZodOptional<z.ZodBoolean>;
+    release: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type FileWritePayload = z.infer<typeof fileWritePayloadSchema>;
+export declare const directoryCreatePayloadSchema: z.ZodObject<{
+    path: z.ZodString;
+}, z.core.$strict>;
+export type DirectoryCreatePayload = z.infer<typeof directoryCreatePayloadSchema>;
+export declare const WORKSPACE_ASSET_PROCESSING_TOOLS: readonly ["image.compress", "image.crop", "image.layers", "audio.edit", "model.pack", "model.screenshot", "texture.export", "batch.image", "batch.audio"];
+export type WorkspaceAssetProcessingTool = (typeof WORKSPACE_ASSET_PROCESSING_TOOLS)[number];
+export declare const workspaceAssetProcessingSchema: z.ZodObject<{
+    tool: z.ZodEnum<{
+        "image.compress": "image.compress";
+        "image.crop": "image.crop";
+        "image.layers": "image.layers";
+        "audio.edit": "audio.edit";
+        "model.pack": "model.pack";
+        "model.screenshot": "model.screenshot";
+        "texture.export": "texture.export";
+        "batch.image": "batch.image";
+        "batch.audio": "batch.audio";
+    }>;
+    sourcePath: z.ZodString;
+    sourceHash: z.ZodOptional<z.ZodString>;
+    batchId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type WorkspaceAssetProcessing = z.infer<typeof workspaceAssetProcessingSchema>;
+/** Explicit create/replace preconditions; the payload always describes raw file bytes. */
+export declare const fileBinaryWritePayloadSchema: z.ZodObject<{
+    path: z.ZodString;
+    contentBase64: z.ZodString;
+    expectedContentHash: z.ZodNullable<z.ZodString>;
+    expectedRevision: z.ZodOptional<z.ZodNumber>;
+    source: z.ZodOptional<z.ZodObject<{
+        path: z.ZodString;
+        contentHash: z.ZodString;
+    }, z.core.$strict>>;
+    processing: z.ZodOptional<z.ZodObject<{
+        tool: z.ZodEnum<{
+            "image.compress": "image.compress";
+            "image.crop": "image.crop";
+            "image.layers": "image.layers";
+            "audio.edit": "audio.edit";
+            "model.pack": "model.pack";
+            "model.screenshot": "model.screenshot";
+            "texture.export": "texture.export";
+            "batch.image": "batch.image";
+            "batch.audio": "batch.audio";
+        }>;
+        sourcePath: z.ZodString;
+        sourceHash: z.ZodOptional<z.ZodString>;
+        batchId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type FileBinaryWritePayload = z.infer<typeof fileBinaryWritePayloadSchema>;
+export declare const workspaceFileRecordSchema: z.ZodObject<{
+    path: z.ZodString;
+    revision: z.ZodNumber;
+    contentHash: z.ZodString;
+    size: z.ZodNumber;
+    modifiedAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type WorkspaceFileRecord = z.infer<typeof workspaceFileRecordSchema>;
+export declare const workspaceFileListSchema: z.ZodObject<{
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        revision: z.ZodNumber;
+        contentHash: z.ZodString;
+        size: z.ZodNumber;
+        modifiedAt: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    directories: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    directoryRevisions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+    unreadablePaths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export type WorkspaceFileList = z.infer<typeof workspaceFileListSchema>;
+export declare const workspaceFileContentSchema: z.ZodObject<{
+    path: z.ZodString;
+    revision: z.ZodNumber;
+    contentHash: z.ZodString;
+    content: z.ZodString;
+}, z.core.$strict>;
+export type WorkspaceFileContent = z.infer<typeof workspaceFileContentSchema>;
+export declare function hashWorkspaceFileContent(content: string): string;
+export declare function isWorkspaceRelativePath(value: string): boolean;
+/**
+ * The project's packages, installed with pnpm in the background after the checkout is registered.
+ * `pending` means the workspace has not been checked yet; `none` means it has no package.json.
+ */
+export declare const WORKSPACE_DEPENDENCY_STATUSES: readonly ["pending", "none", "installing", "ready", "failed"];
+export type WorkspaceDependencyStatus = (typeof WORKSPACE_DEPENDENCY_STATUSES)[number];
+export declare const workspaceDependenciesSchema: z.ZodObject<{
+    workspaceId: z.ZodString;
+    status: z.ZodEnum<{
+        pending: "pending";
+        ready: "ready";
+        failed: "failed";
+        none: "none";
+        installing: "installing";
+    }>;
+    lockHash: z.ZodOptional<z.ZodString>;
+    startedAt: z.ZodOptional<z.ZodString>;
+    finishedAt: z.ZodOptional<z.ZodString>;
+    error: z.ZodOptional<z.ZodString>;
+    logTail: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type WorkspaceDependencies = z.infer<typeof workspaceDependenciesSchema>;
+//# sourceMappingURL=files.d.ts.map

package/dist/cloud-workspace/runtime/files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/files.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAC/C,eAAO,MAAM,0BAA0B,QAAc,CAAC;AACtD,eAAO,MAAM,+BAA+B,QAAmB,CAAC;AAChE,eAAO,MAAM,oCAAoC,QAA4D,CAAC;AAE9G,eAAO,MAAM,2BAA2B,aAcpC,CAAC;AAEL,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,qBAAqB,4CAA6C,CAAC;AAChF,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AACxE,eAAO,MAAM,wBAAwB;;;;EAAgC,CAAC;AAEtE,eAAO,MAAM,sBAAsB;;;;;;;;;;;;kBAqB/B,CAAC;AAEL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,4BAA4B;;kBAE9B,CAAC;AAEZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,gCAAgC,2JAGnC,CAAC;AACX,MAAM,MAAM,4BAA4B,GAAG,CAAC,OAAO,gCAAgC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7F,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;kBAKhC,CAAC;AACZ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,0FAA0F;AAC1F,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;kBAcvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,yBAAyB;;;;;;kBAQ3B,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,uBAAuB;;;;;;;;;;;kBAOzB,CAAC;AAEZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,0BAA0B;;;;;kBAO5B,CAAC;AAEZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,+DAMhC,CAAC;AACX,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;kBAU7B,CAAC;AAEZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}

package/dist/cloud-workspace/runtime/files.js

@@ -0,0 +1,129 @@
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+import { isAttachmentBase64 } from './attachment-base64.js';
+export const WORKSPACE_RELATIVE_PATH_MAX = 512;
+export const WORKSPACE_FILE_CONTENT_MAX = 1024 * 1024;
+export const BINARY_WORKSPACE_FILE_MAX_BYTES = 32 * 1024 * 1024;
+export const BINARY_WORKSPACE_FILE_BODY_MAX_BYTES = 4 * Math.ceil(BINARY_WORKSPACE_FILE_MAX_BYTES / 3) + 8192;
+export const workspaceRelativePathSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(WORKSPACE_RELATIVE_PATH_MAX)
+    .superRefine((value, context) => {
+    if (value.includes('\0') || value.includes('\\') || value.startsWith('/') || value.includes(':')) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: 'invalid_workspace_path' });
+        return;
+    }
+    const segments = value.split('/');
+    if (segments.some((segment) => segment === '' || segment === '.' || segment === '..')) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: 'invalid_workspace_path' });
+    }
+});
+export const MANAGED_WRITE_SOURCES = ['manual', 'agent', 'background'];
+export const managedWriteSourceSchema = z.enum(MANAGED_WRITE_SOURCES);
+export const fileWritePayloadSchema = z
+    .object({
+    path: workspaceRelativePathSchema,
+    content: z.string().max(WORKSPACE_FILE_CONTENT_MAX),
+    expectedRevision: z.number().int().nonnegative().optional(),
+    writer: managedWriteSourceSchema.optional(),
+    writeId: z.string().trim().min(1).max(128).optional(),
+    hold: z.boolean().optional(),
+    release: z.boolean().optional(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if ((value.hold || value.release) && !value.writeId) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: 'write_id_required' });
+    }
+    if (value.hold && value.release) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: 'write_hold_conflict' });
+    }
+    if (value.writer === 'background' && value.hold !== true && value.release !== true) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: 'background_write_unmanaged' });
+    }
+});
+export const directoryCreatePayloadSchema = z.object({
+    path: workspaceRelativePathSchema,
+}).strict();
+export const WORKSPACE_ASSET_PROCESSING_TOOLS = [
+    'image.compress', 'image.crop', 'image.layers', 'audio.edit', 'model.pack',
+    'model.screenshot', 'texture.export', 'batch.image', 'batch.audio',
+];
+export const workspaceAssetProcessingSchema = z.object({
+    tool: z.enum(WORKSPACE_ASSET_PROCESSING_TOOLS),
+    sourcePath: workspaceRelativePathSchema,
+    sourceHash: z.string().regex(/^[a-f0-9]{64}$/).optional(),
+    batchId: z.string().regex(/^[a-zA-Z0-9_-]{1,128}$/).optional(),
+}).strict();
+/** Explicit create/replace preconditions; the payload always describes raw file bytes. */
+export const fileBinaryWritePayloadSchema = z.object({
+    path: workspaceRelativePathSchema,
+    contentBase64: z.string().max(4 * Math.ceil(BINARY_WORKSPACE_FILE_MAX_BYTES / 3))
+        .refine(isAttachmentBase64, 'invalid_binary_content')
+        .refine(value => Buffer.byteLength(value, 'base64') <= BINARY_WORKSPACE_FILE_MAX_BYTES, 'binary_file_too_large'),
+    expectedContentHash: z.string().regex(/^[a-f0-9]{64}$/).nullable(),
+    expectedRevision: z.number().int().nonnegative().optional(),
+    source: z.object({ path: workspaceRelativePathSchema, contentHash: z.string().regex(/^[a-f0-9]{64}$/) }).strict().optional(),
+    processing: workspaceAssetProcessingSchema.optional(),
+}).strict().superRefine((value, context) => {
+    if (value.processing && value.source && (value.processing.sourcePath !== value.source.path
+        || (value.processing.sourceHash !== undefined && value.processing.sourceHash !== value.source.contentHash))) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: 'processing_source_mismatch' });
+    }
+});
+export const workspaceFileRecordSchema = z
+    .object({
+    path: workspaceRelativePathSchema,
+    revision: z.number().int().nonnegative(),
+    contentHash: z.string().length(64),
+    size: z.number().int().nonnegative(),
+    modifiedAt: z.string().datetime().optional(),
+})
+    .strict();
+export const workspaceFileListSchema = z
+    .object({
+    files: z.array(workspaceFileRecordSchema),
+    directories: z.array(workspaceRelativePathSchema).optional(),
+    directoryRevisions: z.record(workspaceRelativePathSchema, z.number().int().nonnegative()).optional(),
+    unreadablePaths: z.array(workspaceRelativePathSchema).optional(),
+})
+    .strict();
+export const workspaceFileContentSchema = z
+    .object({
+    path: workspaceRelativePathSchema,
+    revision: z.number().int().nonnegative(),
+    contentHash: z.string().length(64),
+    content: z.string().max(WORKSPACE_FILE_CONTENT_MAX),
+})
+    .strict();
+export function hashWorkspaceFileContent(content) {
+    return createHash('sha256').update(content, 'utf8').digest('hex');
+}
+export function isWorkspaceRelativePath(value) {
+    return workspaceRelativePathSchema.safeParse(value).success;
+}
+/**
+ * The project's packages, installed with pnpm in the background after the checkout is registered.
+ * `pending` means the workspace has not been checked yet; `none` means it has no package.json.
+ */
+export const WORKSPACE_DEPENDENCY_STATUSES = [
+    'pending',
+    'none',
+    'installing',
+    'ready',
+    'failed',
+];
+export const workspaceDependenciesSchema = z
+    .object({
+    workspaceId: z.string().min(1).max(128),
+    status: z.enum(WORKSPACE_DEPENDENCY_STATUSES),
+    lockHash: z.string().length(64).optional(),
+    startedAt: z.string().optional(),
+    finishedAt: z.string().optional(),
+    error: z.string().max(128).optional(),
+    logTail: z.string().max(8_000).optional(),
+})
+    .strict();
+//# sourceMappingURL=files.js.map

package/dist/cloud-workspace/runtime/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAC/C,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,GAAG,IAAI,CAAC;AACtD,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAChE,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,+BAA+B,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;AAE9G,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,2BAA2B,CAAC;KAChC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjG,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QACtF,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC,CAAC,CAAC;AAIL,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAU,CAAC;AAEhF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,IAAI,EAAE,2BAA2B;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,0BAA0B,CAAC;IACnD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC3D,MAAM,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACrD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACpD,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAChC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACnF,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC,CAAC,CAAC;AAIL,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,2BAA2B;CAClC,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,gBAAgB,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY;IAC1E,kBAAkB,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa;CAC1D,CAAC;AAGX,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC;IAC9C,UAAU,EAAE,2BAA2B;IACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACzD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;CAC/D,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,0FAA0F;AAC1F,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,2BAA2B;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,+BAA+B,GAAG,CAAC,CAAC,CAAC;SAC9E,MAAM,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;SACpD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,+BAA+B,EAAE,uBAAuB,CAAC;IAClH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAClE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5H,UAAU,EAAE,8BAA8B,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACzC,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI;WACrF,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC9G,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,IAAI,EAAE,2BAA2B;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,QAAQ,EAAE;IAC5D,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpG,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,QAAQ,EAAE;CACjE,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,IAAI,EAAE,2BAA2B;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,0BAA0B,CAAC;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,OAAO,2BAA2B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,SAAS;IACT,MAAM;IACN,YAAY;IACZ,OAAO;IACP,QAAQ;CACA,CAAC;AAGX,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/cloud-workspace/runtime/generations.d.ts

@@ -0,0 +1,18 @@
+import { z } from 'zod';
+export declare const generationSchema: z.ZodNumber;
+export declare const runtimeEpochSchema: z.ZodNumber;
+export declare const leaseFenceSchema: z.ZodNumber;
+export declare const runtimeGenerationsSchema: z.ZodObject<{
+    generation: z.ZodNumber;
+    runtimeEpoch: z.ZodNumber;
+    leaseFence: z.ZodNumber;
+}, z.core.$strict>;
+export type RuntimeGenerations = z.infer<typeof runtimeGenerationsSchema>;
+/** Fields the browser client must not choose. Trusted config or server registration fills them.
+ *  Sandbox control HTTP still accepts dispatcher `leaseFence` and checks it separately. */
+export declare const UNTRUSTED_RUNTIME_FIELDS: readonly ["userId", "runtimeId", "generation", "runtimeEpoch", "leaseFence", "rootPath", "workspaceRoot"];
+export type UntrustedRuntimeField = (typeof UNTRUSTED_RUNTIME_FIELDS)[number];
+export declare function findUntrustedRuntimeFields(input: unknown): UntrustedRuntimeField[];
+export declare function assertTrustedGenerations(actual: RuntimeGenerations, expected: Pick<RuntimeGenerations, 'generation' | 'runtimeEpoch'>): 'ok' | 'generation_mismatch';
+export declare function assertLeaseFence(actual: number, acceptedFence: number): 'ok' | 'stale_lease';
+//# sourceMappingURL=generations.d.ts.map

package/dist/cloud-workspace/runtime/generations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generations.d.ts","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/generations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,gBAAgB,aAAiC,CAAC;AAC/D,eAAO,MAAM,kBAAkB,aAAiC,CAAC;AACjE,eAAO,MAAM,gBAAgB,aAAiC,CAAC;AAE/D,eAAO,MAAM,wBAAwB;;;;kBAM1B,CAAC;AAEZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;2FAC2F;AAC3F,eAAO,MAAM,wBAAwB,2GAQ3B,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,EAAE,CAGlF;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,kBAAkB,EAC1B,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,GAAG,cAAc,CAAC,GAChE,IAAI,GAAG,qBAAqB,CAK9B;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,aAAa,CAG5F"}

package/dist/cloud-workspace/runtime/generations.js

@@ -0,0 +1,39 @@
+import { z } from 'zod';
+export const generationSchema = z.number().int().nonnegative();
+export const runtimeEpochSchema = z.number().int().nonnegative();
+export const leaseFenceSchema = z.number().int().nonnegative();
+export const runtimeGenerationsSchema = z
+    .object({
+    generation: generationSchema,
+    runtimeEpoch: runtimeEpochSchema,
+    leaseFence: leaseFenceSchema,
+})
+    .strict();
+/** Fields the browser client must not choose. Trusted config or server registration fills them.
+ *  Sandbox control HTTP still accepts dispatcher `leaseFence` and checks it separately. */
+export const UNTRUSTED_RUNTIME_FIELDS = [
+    'userId',
+    'runtimeId',
+    'generation',
+    'runtimeEpoch',
+    'leaseFence',
+    'rootPath',
+    'workspaceRoot',
+];
+export function findUntrustedRuntimeFields(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return [];
+    return UNTRUSTED_RUNTIME_FIELDS.filter((field) => field in input);
+}
+export function assertTrustedGenerations(actual, expected) {
+    if (actual.generation !== expected.generation || actual.runtimeEpoch !== expected.runtimeEpoch) {
+        return 'generation_mismatch';
+    }
+    return 'ok';
+}
+export function assertLeaseFence(actual, acceptedFence) {
+    if (actual < acceptedFence)
+        return 'stale_lease';
+    return 'ok';
+}
+//# sourceMappingURL=generations.js.map

package/dist/cloud-workspace/runtime/generations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generations.js","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/generations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;AAC/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;AACjE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;AAE/D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,UAAU,EAAE,gBAAgB;IAC5B,YAAY,EAAE,kBAAkB;IAChC,UAAU,EAAE,gBAAgB;CAC7B,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;2FAC2F;AAC3F,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,UAAU;IACV,eAAe;CACP,CAAC;AAIX,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3E,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAA0B,EAC1B,QAAiE;IAEjE,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,IAAI,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC/F,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,aAAqB;IACpE,IAAI,MAAM,GAAG,aAAa;QAAE,OAAO,aAAa,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cloud-workspace/runtime/git-auth-mode.d.ts

@@ -0,0 +1,35 @@
+import { z } from 'zod';
+/** Authentication mode names mirror the external configuration/protocol values defined here. */
+export declare const WORKSPACE_GIT_AUTH_MODE: {
+    readonly LOCAL: "local";
+    readonly GATEWAY: "gateway";
+};
+export declare const workspaceGitAuthModeSchema: z.ZodEnum<{
+    readonly LOCAL: "local";
+    readonly GATEWAY: "gateway";
+}>;
+export type WorkspaceGitAuthMode = z.infer<typeof workspaceGitAuthModeSchema>;
+export declare const DEFAULT_WORKSPACE_GIT_AUTH_MODE: "gateway";
+export type WorkspaceGitAuthConfig = {
+    mode: WorkspaceGitAuthMode;
+    origin?: string;
+    token?: string;
+};
+/** Classify an explicit mode; missing values do not imply a mode or grant authorization. */
+export declare function isLocalWorkspaceGitAuthMode(mode: WorkspaceGitAuthMode | undefined): mode is typeof WORKSPACE_GIT_AUTH_MODE.LOCAL;
+export declare function isGatewayWorkspaceGitAuthMode(mode: WorkspaceGitAuthMode | undefined): mode is typeof WORKSPACE_GIT_AUTH_MODE.GATEWAY;
+/** Logical ownership is separate from authentication mode. Matches local and local-<hostname> owners. */
+export declare function isLocalWorkspaceGitEnvironment(environment: string | undefined): boolean;
+export declare function assertGitCredentialControlUrl(value: string): void;
+/** Backend startup guard. Logical environment and deployment runtime must both be local. */
+export declare function readWorkspaceGitAuthConfig(env: Record<string, string | undefined>, requireToken?: boolean): WorkspaceGitAuthConfig;
+/** Exact trusted origin and canonical repository path; loopback exists solely for isolated tests. */
+export declare function assertDirectGitRepository(repositoryUrl: string, origin: string): void;
+export declare const workspaceGitDirectAccessSchema: z.ZodObject<{
+    repositoryUrl: z.ZodString;
+    origin: z.ZodString;
+    username: z.ZodString;
+    password: z.ZodString;
+}, z.core.$strict>;
+export type WorkspaceGitDirectAccess = z.infer<typeof workspaceGitDirectAccessSchema>;
+//# sourceMappingURL=git-auth-mode.d.ts.map

package/dist/cloud-workspace/runtime/git-auth-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-auth-mode.d.ts","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/git-auth-mode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gGAAgG;AAChG,eAAO,MAAM,uBAAuB;;;CAG1B,CAAC;AACX,eAAO,MAAM,0BAA0B;;;EAAkC,CAAC;AAC1E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,eAAO,MAAM,+BAA+B,WAAkC,CAAC;AAC/E,MAAM,MAAM,sBAAsB,GAAG;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAErG,4FAA4F;AAC5F,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,IAAI,OAAO,uBAAuB,CAAC,KAAK,CAEhI;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,IAAI,OAAO,uBAAuB,CAAC,OAAO,CAEpI;AAED,yGAAyG;AACzG,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEvF;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAMjE;AAED,4FAA4F;AAC5F,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAAE,YAAY,UAAQ,GAAG,sBAAsB,CAkBhI;AAED,qGAAqG;AACrG,wBAAgB,yBAAyB,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAQrF;AAED,eAAO,MAAM,8BAA8B;;;;;kBAOzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}

package/dist/cloud-workspace/runtime/git-auth-mode.js

@@ -0,0 +1,73 @@
+import { z } from 'zod';
+/** Authentication mode names mirror the external configuration/protocol values defined here. */
+export const WORKSPACE_GIT_AUTH_MODE = {
+    LOCAL: 'local',
+    GATEWAY: 'gateway',
+};
+export const workspaceGitAuthModeSchema = z.enum(WORKSPACE_GIT_AUTH_MODE);
+export const DEFAULT_WORKSPACE_GIT_AUTH_MODE = WORKSPACE_GIT_AUTH_MODE.GATEWAY;
+/** Classify an explicit mode; missing values do not imply a mode or grant authorization. */
+export function isLocalWorkspaceGitAuthMode(mode) {
+    return mode === WORKSPACE_GIT_AUTH_MODE.LOCAL;
+}
+export function isGatewayWorkspaceGitAuthMode(mode) {
+    return mode === WORKSPACE_GIT_AUTH_MODE.GATEWAY;
+}
+/** Logical ownership is separate from authentication mode. Matches local and local-<hostname> owners. */
+export function isLocalWorkspaceGitEnvironment(environment) {
+    return environment !== undefined && /^local(?:-[a-zA-Z0-9][a-zA-Z0-9_-]*)?$/.test(environment);
+}
+export function assertGitCredentialControlUrl(value) {
+    const url = new URL(value);
+    if (url.username || url.password || url.search || url.hash
+        || !(url.protocol === 'https:' || (url.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(url.hostname)))) {
+        throw new Error('workspace_git_control_transport_rejected');
+    }
+}
+/** Backend startup guard. Logical environment and deployment runtime must both be local. */
+export function readWorkspaceGitAuthConfig(env, requireToken = false) {
+    const parsed = workspaceGitAuthModeSchema.safeParse(env.WORKSPACE_GIT_AUTH_MODE ?? DEFAULT_WORKSPACE_GIT_AUTH_MODE);
+    if (!parsed.success)
+        throw new Error('Invalid WORKSPACE_GIT_AUTH_MODE');
+    const mode = parsed.data;
+    if (isGatewayWorkspaceGitAuthMode(mode))
+        return { mode };
+    if (env.NODE_ENV !== 'development'
+        || !isLocalWorkspaceGitEnvironment(env.AGENT_OWNER_ENV || env.PLAYCRAFT_ENV)
+        || [env.AGENT_OWNER_ENV, env.PLAYCRAFT_ENV].some(value => value && !isLocalWorkspaceGitEnvironment(value))
+        || env.KUBERNETES_SERVICE_HOST || env.KUBERNETES_SERVICE_PORT) {
+        throw new Error('Direct workspace Git authentication requires local development outside Kubernetes');
+    }
+    const origin = env.WORKSPACE_GIT_GONGFENG_ORIGIN || 'https://git.tencent.com';
+    assertDirectGitRepository(`${origin}/validation/repository.git`, origin);
+    const token = requireToken ? env.GIT_TENCENT_PRIVATE_TOKEN : undefined;
+    if (requireToken && (!token || token.length > 8192 || /[\r\n\0:]/.test(token))) {
+        throw new Error('Invalid GIT_TENCENT_PRIVATE_TOKEN');
+    }
+    return { mode, origin, ...(token ? { token } : {}) };
+}
+/** Exact trusted origin and canonical repository path; loopback exists solely for isolated tests. */
+export function assertDirectGitRepository(repositoryUrl, origin) {
+    const url = new URL(repositoryUrl);
+    if (url.origin !== origin || url.href !== repositoryUrl || url.username || url.password || url.search || url.hash
+        || !/^\/[a-zA-Z0-9_-]+(?:\/[a-zA-Z0-9_.-]+)+\.git$/.test(url.pathname)
+        || url.pathname.split('/').some(part => part === '..' || part === '.')
+        || !(url.protocol === 'https:' || (url.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(url.hostname)))) {
+        throw new Error('workspace_git_direct_repository_rejected');
+    }
+}
+export const workspaceGitDirectAccessSchema = z.object({
+    repositoryUrl: z.string().min(1).max(2048),
+    origin: z.string().min(1).max(256),
+    username: z.string().min(1).max(256).regex(/^[^:\r\n\0]+$/),
+    password: z.string().min(1).max(8192).regex(/^[^\r\n\0]+$/),
+}).strict().refine(value => {
+    try {
+        assertDirectGitRepository(value.repositoryUrl, value.origin);
+        return true;
+    }
+    catch {
+        return false;
+    }
+});
+//# sourceMappingURL=git-auth-mode.js.map

package/dist/cloud-workspace/runtime/git-auth-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-auth-mode.js","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/git-auth-mode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gGAAgG;AAChG,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;CACV,CAAC;AACX,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AAE1E,MAAM,CAAC,MAAM,+BAA+B,GAAG,uBAAuB,CAAC,OAAO,CAAC;AAG/E,4FAA4F;AAC5F,MAAM,UAAU,2BAA2B,CAAC,IAAsC;IAChF,OAAO,IAAI,KAAK,uBAAuB,CAAC,KAAK,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,IAAsC;IAClF,OAAO,IAAI,KAAK,uBAAuB,CAAC,OAAO,CAAC;AAClD,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,8BAA8B,CAAC,WAA+B;IAC5E,OAAO,WAAW,KAAK,SAAS,IAAI,wCAAwC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAa;IACzD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;WACrD,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9H,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,0BAA0B,CAAC,GAAuC,EAAE,YAAY,GAAG,KAAK;IACtG,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,GAAG,CAAC,uBAAuB,IAAI,+BAA+B,CAAC,CAAC;IACpH,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,6BAA6B,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACzD,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa;WAC7B,CAAC,8BAA8B,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,aAAa,CAAC;WACzE,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;WACvG,GAAG,CAAC,uBAAuB,IAAI,GAAG,CAAC,uBAAuB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,6BAA6B,IAAI,yBAAyB,CAAC;IAC9E,yBAAyB,CAAC,GAAG,MAAM,4BAA4B,EAAE,MAAM,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,IAAI,YAAY,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,yBAAyB,CAAC,aAAqB,EAAE,MAAc;IAC7E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACnC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;WAC5G,CAAC,+CAA+C,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;WACnE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC;WACnE,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9H,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAC3D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;CAC5D,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;IACzB,IAAI,CAAC;QAAC,yBAAyB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC5G,CAAC,CAAC,CAAC"}

package/dist/cloud-workspace/runtime/git.d.ts

@@ -0,0 +1,147 @@
+import { z } from 'zod';
+/** One request names at most this many paths, for commits and index changes alike. */
+export declare const GIT_PATHS_MAX = 256;
+export declare const gitCommitPayloadSchema: z.ZodObject<{
+    message: z.ZodString;
+    paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    stagedOnly: z.ZodOptional<z.ZodLiteral<true>>;
+}, z.core.$strict>;
+export type GitCommitPayload = z.infer<typeof gitCommitPayloadSchema>;
+/**
+ * Paths for `git.stage`, `git.unstage` and `git.discard`. Discard only touches the work tree:
+ * tracked files return to their staged content and untracked files are deleted.
+ */
+export declare const gitPathsPayloadSchema: z.ZodObject<{
+    paths: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export type GitPathsPayload = z.infer<typeof gitPathsPayloadSchema>;
+export declare const gitPushPayloadSchema: z.ZodObject<{}, z.core.$strict>;
+export type GitPushPayload = z.infer<typeof gitPushPayloadSchema>;
+/** `git.pull`: fetch the bound branch from origin and merge it, as `git pull` does by default. */
+export declare const gitPullPayloadSchema: z.ZodObject<{}, z.core.$strict>;
+export type GitPullPayload = z.infer<typeof gitPullPayloadSchema>;
+/** `git.merge.abort`: return to the state before the merge that is in progress. */
+export declare const gitMergeAbortPayloadSchema: z.ZodObject<{}, z.core.$strict>;
+export type GitMergeAbortPayload = z.infer<typeof gitMergeAbortPayloadSchema>;
+/**
+ * `workspace.save`: commit everything that changed and push it. `trigger` only picks the commit
+ * message; a save started by the page's timer or after a change is `auto`.
+ */
+export declare const workspaceSavePayloadSchema: z.ZodObject<{
+    trigger: z.ZodOptional<z.ZodEnum<{
+        auto: "auto";
+        manual: "manual";
+    }>>;
+}, z.core.$strict>;
+export type WorkspaceSavePayload = z.infer<typeof workspaceSavePayloadSchema>;
+export declare const gitStatusEntrySchema: z.ZodObject<{
+    path: z.ZodString;
+    indexStatus: z.ZodString;
+    worktreeStatus: z.ZodString;
+    staged: z.ZodOptional<z.ZodObject<{
+        added: z.ZodNumber;
+        removed: z.ZodNumber;
+    }, z.core.$strict>>;
+    unstaged: z.ZodOptional<z.ZodObject<{
+        added: z.ZodNumber;
+        removed: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type GitStatusEntry = z.infer<typeof gitStatusEntrySchema>;
+export declare const gitStatusSchema: z.ZodObject<{
+    initialized: z.ZodBoolean;
+    branch: z.ZodString;
+    ahead: z.ZodNumber;
+    behind: z.ZodNumber;
+    hasUpstream: z.ZodBoolean;
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        indexStatus: z.ZodString;
+        worktreeStatus: z.ZodString;
+        staged: z.ZodOptional<z.ZodObject<{
+            added: z.ZodNumber;
+            removed: z.ZodNumber;
+        }, z.core.$strict>>;
+        unstaged: z.ZodOptional<z.ZodObject<{
+            added: z.ZodNumber;
+            removed: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    merging: z.ZodOptional<z.ZodBoolean>;
+    mergeMessage: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type GitStatus = z.infer<typeof gitStatusSchema>;
+export declare const gitDiffSchema: z.ZodObject<{
+    patch: z.ZodString;
+}, z.core.$strict>;
+export type GitDiff = z.infer<typeof gitDiffSchema>;
+export declare const gitCommitSummarySchema: z.ZodObject<{
+    sha: z.ZodString;
+    subject: z.ZodString;
+    committedAt: z.ZodString;
+}, z.core.$strict>;
+export type GitCommitSummary = z.infer<typeof gitCommitSummarySchema>;
+export declare const gitGraphSchema: z.ZodObject<{
+    commits: z.ZodArray<z.ZodObject<{
+        sha: z.ZodString;
+        subject: z.ZodString;
+        committedAt: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type GitGraph = z.infer<typeof gitGraphSchema>;
+/** A Git object id, SHA-1 or SHA-256. */
+export declare const gitObjectIdSchema: z.ZodString;
+/**
+ * `HEAD` is the last commit; `INDEX` is the staged content; during a merge conflict `MERGE_BASE`,
+ * `MERGE_OURS` and `MERGE_THEIRS` are the common ancestor, the current branch and the incoming
+ * side; an object id is a turn's snapshot tree.
+ */
+export declare const GIT_FILE_REFS: readonly ["HEAD", "INDEX", "MERGE_BASE", "MERGE_OURS", "MERGE_THEIRS"];
+export type GitFileRef = (typeof GIT_FILE_REFS)[number] | (string & {});
+export declare const gitFileRefSchema: z.ZodType<GitFileRef>;
+/** Published when an agent turn ends and its working directory differs from when it began. */
+export declare const TURN_FILES_CHANGED_EVENT = "turn.files.changed";
+/** A turn listing more files than this reports the first ones and marks itself truncated. */
+export declare const TURN_CHANGED_FILES_MAX = 500;
+export declare const turnFileChangeSchema: z.ZodObject<{
+    path: z.ZodString;
+    status: z.ZodEnum<{
+        added: "added";
+        modified: "modified";
+        deleted: "deleted";
+    }>;
+    added: z.ZodNumber;
+    removed: z.ZodNumber;
+    binary: z.ZodBoolean;
+}, z.core.$strict>;
+export type TurnFileChange = z.infer<typeof turnFileChangeSchema>;
+/** Snapshot trees taken just before a turn started and after it ended, with the files between them. */
+export declare const turnFilesChangedSchema: z.ZodObject<{
+    threadId: z.ZodString;
+    turnId: z.ZodString;
+    before: z.ZodString;
+    after: z.ZodString;
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        status: z.ZodEnum<{
+            added: "added";
+            modified: "modified";
+            deleted: "deleted";
+        }>;
+        added: z.ZodNumber;
+        removed: z.ZodNumber;
+        binary: z.ZodBoolean;
+    }, z.core.$strict>>;
+    truncated: z.ZodBoolean;
+}, z.core.$strip>;
+export type TurnFilesChanged = z.infer<typeof turnFilesChangedSchema>;
+/** One file as stored at a ref. A file absent there, or binary, carries no content. */
+export declare const gitFileContentSchema: z.ZodObject<{
+    path: z.ZodString;
+    ref: z.ZodType<GitFileRef, unknown, z.core.$ZodTypeInternals<GitFileRef, unknown>>;
+    exists: z.ZodBoolean;
+    binary: z.ZodBoolean;
+    content: z.ZodString;
+}, z.core.$strict>;
+export type GitFileContent = z.infer<typeof gitFileContentSchema>;
+//# sourceMappingURL=git.d.ts.map

package/dist/cloud-workspace/runtime/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../../src/cloud-workspace/runtime/git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,sFAAsF;AACtF,eAAO,MAAM,aAAa,MAAM,CAAC;AAEjC,eAAO,MAAM,sBAAsB;;;;kBAS/B,CAAC;AAEL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;GAGG;AACH,eAAO,MAAM,qBAAqB;;kBAIvB,CAAC;AAEZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,oBAAoB,iCAAwB,CAAC;AAE1D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,kGAAkG;AAClG,eAAO,MAAM,oBAAoB,iCAAwB,CAAC;AAE1D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,mFAAmF;AACnF,eAAO,MAAM,0BAA0B,iCAAwB,CAAC;AAEhE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;;kBAI5B,CAAC;AAEZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAS9E,eAAO,MAAM,oBAAoB;;;;;;;;;;;;kBAUtB,CAAC;AAEZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;kBAajB,CAAC;AAEZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,aAAa;;kBAIf,CAAC;AAEZ,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD,eAAO,MAAM,sBAAsB;;;;kBAMxB,CAAC;AAEZ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,cAAc;;;;;;kBAIhB,CAAC;AAEZ,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,yCAAyC;AACzC,eAAO,MAAM,iBAAiB,aAAsD,CAAC;AAErF;;;;GAIG;AACH,eAAO,MAAM,aAAa,wEAAyE,CAAC;AACpG,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AACxE,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAuD,CAAC;AAE3G,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAC7D,6FAA6F;AAC7F,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C,eAAO,MAAM,oBAAoB;;;;;;;;;;kBAStB,CAAC;AAEZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,uGAAuG;AACvG,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;iBAOjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,uFAAuF;AACvF,eAAO,MAAM,oBAAoB;;;;;;kBAQtB,CAAC;AAEZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}