@poe-platform/safe-bash 0.1.803 → 0.1.804

package/dist/remote-execution/deployment.js

@@ -1,131 +0,0 @@
-import { boundedTransfer } from './hosting-stream.js';
-import { hostingRequest } from './hosting-request.js';
-import { hostingOperation } from './hosting-operation.js';
-export function createRemoteExecutionRoute(options) {
-    options = { ...options, transferLimits: options.transferLimits ? { ...options.transferLimits } : undefined,
-        driver: { acquire: options.driver.acquire.bind(options.driver) } };
-    const limits = options.transferLimits;
-    if (limits && [limits.maxChunkBytes, limits.maxBytes, limits.maxWallClockMs].some(value => !Number.isSafeInteger(value) || value <= 0))
-        throw new RangeError('Positive transfer limits required');
-    return { async fetch(request) {
-            const url = new URL(request.url);
-            if (!url.pathname.startsWith('/v1/'))
-                return new Response(null, { status: 404 });
-            const requestSignal = AbortSignal.any([request.signal,
-                ...(limits ? [AbortSignal.timeout(Math.min(limits.maxWallClockMs, 2147483647))] : []),
-            ]);
-            const authenticated = await hostingOperation(requestSignal, () => options.authenticate(hostingRequest(request, request.url, { signal: requestSignal })));
-            // Authentication may return a borrowed credential record. Bind acquisition
-            // and transport expiry to its selected identity and lifetime.
-            const principal = authenticated && { namespaceId: authenticated.namespaceId, expiresAt: authenticated.expiresAt };
-            if (!principal || !principal.namespaceId || !Number.isFinite(principal.expiresAt) || principal.expiresAt <= (options.now ?? Date.now)())
-                return new Response(null, { status: 401, headers: { 'Cache-Control': 'no-store' } });
-            request.signal.throwIfAborted();
-            // Acquisition consumes the same credential and request lifetime as streaming.
-            // A resolver ignoring cancellation must never forward a late mutation.
-            const remaining = principal.expiresAt - (options.now ?? Date.now)();
-            const credentialSignal = AbortSignal.timeout(Math.min(Math.ceil(remaining), 2147483647));
-            const abort = new AbortController();
-            const signal = AbortSignal.any([requestSignal, credentialSignal, abort.signal]);
-            const endpoint = await hostingOperation(signal, () => options.driver.acquire(principal.namespaceId));
-            request.signal.throwIfAborted();
-            if (principal.expiresAt <= (options.now ?? Date.now)())
-                return new Response(null, { status: 401, headers: { 'Cache-Control': 'no-store' } });
-            // Do not buffer, transcode, retry mutations, rewrite range/epoch headers, or
-            // interpret native tool names. The media server also authenticates requests.
-            const body = request.body ? boundedTransfer(request.body, limits, signal, abort, false, !!limits) : null;
-            try {
-                const forwarded = hostingRequest(request, request.url, { body, signal });
-                const response = await hostingOperation(signal, () => endpoint.fetch(forwarded), response => response.body?.cancel(signal.reason));
-                if (signal.aborted)
-                    await response.body?.cancel(signal.reason).catch(() => { });
-                signal.throwIfAborted();
-                const output = response.body ? boundedTransfer(response.body, limits, signal, abort, !!limits) : null;
-                if (!output && limits)
-                    abort.abort(new Error('Transfer complete'));
-                return new Response(output, { status: response.status, statusText: response.statusText, headers: response.headers });
-            }
-            catch (error) {
-                abort.abort(error);
-                throw error;
-            }
-        } };
-}
-/** A provider supplies only declarative options and its SDK's container handle.
- * Native media execution stays behind the common server protocol. */
-export function createContainerExecutionDriver(config, resolve) {
-    // Capture operator selection before adapters or callers can mutate borrowed
-    // configuration. Give each SDK resolver its own lifecycle/transport options.
-    config = structuredClone(config);
-    if (!Number.isSafeInteger(config.port) || config.port < 1 || config.port > 65535 || typeof config.lifecycle?.sleepAfter !== 'string' || !config.lifecycle.sleepAfter.trim() || typeof config.lifecycle.keepAlive !== 'boolean')
-        throw new TypeError('Explicit container port and lifecycle required');
-    if (config.transport !== 'http' && config.transport !== 'rpc')
-        throw new TypeError('Explicit supported container transport required');
-    const timeouts = config.lifecycle.containerTimeouts;
-    if (timeouts && [timeouts.instanceGetTimeoutMS, timeouts.portReadyTimeoutMS].some(value => !Number.isSafeInteger(value) || value <= 0))
-        throw new TypeError('Positive container acquisition and readiness timeouts required');
-    const services = new Map();
-    const cleanups = new Map();
-    function service(namespaceId) {
-        if (!namespaceId)
-            throw new TypeError('Trusted namespace identity required');
-        let value = services.get(namespaceId);
-        if (!value) {
-            value = { container: resolve(namespaceId, structuredClone(config)), retired: false, abort: new AbortController(), pending: new Set() };
-            services.set(namespaceId, value);
-        }
-        return value;
-    }
-    return {
-        async acquire(namespaceId) {
-            await cleanups.get(namespaceId);
-            const entry = service(namespaceId);
-            if (entry.retired)
-                throw new Error('Container endpoint retired');
-            return { async fetch(request) {
-                    if (entry.retired)
-                        throw new Error('Container endpoint retired');
-                    request.signal.throwIfAborted();
-                    const forwarded = hostingRequest(request, request.url, { signal: AbortSignal.any([request.signal, entry.abort.signal]) });
-                    const response = await hostingOperation(forwarded.signal, () => {
-                        const pending = entry.container.containerFetch(forwarded, config.port);
-                        entry.pending.add(pending);
-                        void pending.then(() => entry.pending.delete(pending), () => entry.pending.delete(pending));
-                        return pending;
-                    }, response => response.body?.cancel(forwarded.signal.reason));
-                    // SDK cancellation is not a guarantee that an already-returned stream
-                    // retires. Guard binary delivery locally without retiring sibling requests
-                    // when a single consumer disconnects.
-                    const body = response.body ? boundedTransfer(response.body, undefined, forwarded.signal, entry.abort, false, false) : null;
-                    return new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers });
-                } };
-        },
-        async destroy(namespaceId) {
-            const pending = cleanups.get(namespaceId);
-            if (pending)
-                return pending;
-            const entry = service(namespaceId);
-            entry.retired = true;
-            // Cancel startup and active transports before SDK destruction can race a
-            // still-pending request that would otherwise start the container again.
-            entry.abort.abort(new Error('Container endpoint retired'));
-            // Retained endpoints must not restart an SDK container during or after
-            // cleanup. Failed cleanup stays quarantined for an explicit destroy retry.
-            const cleanup = Promise.resolve().then(async () => {
-                // Aborting the caller cannot prove an SDK startup has stopped. Destroy
-                // after every acquired call settles so a late startup cannot resurrect it.
-                // A stuck SDK leaves cleanup pending and reacquisition quarantined.
-                if (entry.pending.size)
-                    await Promise.allSettled([...entry.pending]);
-                await entry.container.destroy();
-            }).then(() => { services.delete(namespaceId); });
-            cleanups.set(namespaceId, cleanup);
-            try {
-                await cleanup;
-            }
-            finally {
-                cleanups.delete(namespaceId);
-            }
-        },
-    };
-}

package/dist/remote-execution/descriptors.js

@@ -1,267 +0,0 @@
-import { FsError } from "@poe-platform/safe-fs/contracts/errors";
-import { decodeFileOffset } from "@poe-platform/safe-fs/contracts/object";
-import { admitCanonicalMetadata } from './canonical-metadata.js';
-/** Invocation-local descriptor capabilities. Opaque handles never select server
- * fds. Canonical lease operations settle before acknowledgment; cleanup drains
- * cooperative work and never undoes completed writes. */
-export function createDescriptorMaterialization(options) {
-    options = { ...options };
-    for (const value of [options.maxHandles, options.maxIoBytes])
-        if (!Number.isSafeInteger(value) || value < 1)
-            throw new TypeError('Invalid descriptor bound');
-    const acquire = options.handles.acquire.bind(options.handles);
-    const records = new Map();
-    const identities = new Map();
-    const pending = new Set();
-    const controller = new AbortController();
-    const reads = new AbortController();
-    let acquiring = 0;
-    let closing = 0;
-    let disposal;
-    function admitted(signal, work, handle, closeAdmission = false, bytes) {
-        if (controller.signal.aborted)
-            return Promise.reject(new FsError('EBADF'));
-        const record = handle === undefined ? undefined : records.get(handle);
-        if (handle !== undefined && (!record || record.closing))
-            return Promise.reject(new FsError('EBADF'));
-        const combined = AbortSignal.any([signal, controller.signal]);
-        if (combined.aborted)
-            return Promise.reject(combined.reason);
-        // Match the shell lease's bounded pending work; close has reserved capacity
-        // so a full cursor queue cannot prevent its own retirement. Admission precedes
-        // retaining write bytes, including when a duplicate description is blocked.
-        if (record && !closeAdmission && record.pending >= 16)
-            return Promise.reject(new FsError('EAGAIN'));
-        const owned = bytes === undefined ? undefined : new Uint8Array(bytes);
-        // Closing consumes this handle's admission now, while its accepted work and
-        // duplicate descriptions retain their original cursor queue until drained.
-        if (record && closeAdmission) {
-            record.closing = true;
-        }
-        if (record)
-            record.pending++;
-        const predecessor = record?.order.tail;
-        const task = (async () => {
-            if (predecessor)
-                await predecessor;
-            // An admitted close has consumed ownership. Cancellation can reject before
-            // admission, but cannot strand that retain behind accepted cursor work.
-            // Disposal also drains this retirement instead of closing the lease twice.
-            if (!closeAdmission)
-                combined.throwIfAborted();
-            return work(combined, owned);
-        })();
-        if (record)
-            record.order.tail = task.catch(() => { });
-        pending.add(task);
-        void task.finally(() => { pending.delete(task); if (record)
-            record.pending--; }).catch(() => { });
-        // Publish the close's cursor barrier before cancellation listeners can
-        // synchronously admit work through an alias of this description.
-        if (record && closeAdmission)
-            record.reads.abort(new FsError('EBADF'));
-        return task;
-    }
-    function retained(handle, right) {
-        const record = records.get(handle);
-        if (!record || !record.rights.has(right))
-            throw new FsError('EBADF');
-        if (!(right === 'seek' ? record.lease.exact?.seek ?? record.lease.seek : record.lease[right]))
-            throw new FsError(right === 'seek' ? 'ESPIPE' : 'ENOTSUP');
-        return record.lease;
-    }
-    function bound(size) { if (!Number.isSafeInteger(size) || size < 0 || size > options.maxIoBytes)
-        throw new FsError('EINVAL'); }
-    return {
-        acquire(fd, rights, signal) {
-            return admitted(signal, async (combined) => {
-                if (!Number.isSafeInteger(fd) || fd < 0 || !Array.isArray(rights))
-                    throw new FsError('EINVAL');
-                // Rights are indexed admission data, not an iterable authority. A custom
-                // iterator or inherited slot must not manufacture a different capability.
-                const count = rights.length;
-                if (count > 4)
-                    throw new FsError('EINVAL');
-                const requested = Array.from({ length: count }, (_, index) => {
-                    if (!Object.hasOwn(rights, index))
-                        throw new FsError('EINVAL');
-                    return rights[index];
-                });
-                for (const right of requested)
-                    if (!['read', 'write', 'seek', 'stat'].includes(right))
-                        throw new FsError('EINVAL');
-                if (records.size + acquiring + closing >= options.maxHandles)
-                    throw new FsError('EMFILE');
-                acquiring++;
-                let lease;
-                let close;
-                try {
-                    // The provider borrows its own argument copy, never our admitted rights.
-                    lease = await acquire(fd, [...requested], combined);
-                    close = lease.close.bind(lease);
-                    combined.throwIfAborted();
-                    // Borrow the admitted open description's operations once. Binding their
-                    // receiver preserves its live cursor without permitting later substitution.
-                    const exact = requested.includes('seek') ? lease.exact : undefined;
-                    const exactSeek = exact?.seek;
-                    lease = Object.freeze({
-                        identity: lease.identity, position: lease.position, consumerClosed: lease.consumerClosed,
-                        read: requested.includes('read') ? lease.read?.bind(lease) : undefined,
-                        write: requested.includes('write') ? lease.write?.bind(lease) : undefined,
-                        seek: requested.includes('seek') ? lease.seek?.bind(lease) : undefined,
-                        exact: exactSeek === undefined ? undefined : Object.freeze({ seek: exactSeek.bind(exact) }),
-                        stat: requested.includes('stat') ? lease.stat?.bind(lease) : undefined, close,
-                    });
-                    if (typeof lease.identity !== 'object' || lease.identity === null)
-                        throw new FsError('ENOTSUP');
-                    if (lease.position !== undefined && (!Number.isSafeInteger(lease.position) || lease.position < 0))
-                        throw new FsError('ENOTSUP');
-                    for (const right of requested)
-                        if (typeof (right === 'seek' ? lease.exact?.seek ?? lease.seek : lease[right]) !== 'function')
-                            throw new FsError(right === 'seek' ? 'ESPIPE' : 'ENOTSUP');
-                    let order = identities.get(lease.identity);
-                    if (!order) {
-                        order = { object: crypto.randomUUID(), references: 0, tail: Promise.resolve() };
-                        identities.set(lease.identity, order);
-                    }
-                    order.references++;
-                    const handle = crypto.randomUUID();
-                    records.set(handle, { lease, rights: new Set(requested), closing: false, pending: 0, reads: new AbortController(), order });
-                    return { handle, object: order.object, ...(lease.position === undefined ? {} : { position: lease.position }) };
-                }
-                catch (error) {
-                    if (close) {
-                        try {
-                            await close();
-                        }
-                        catch (cleanup) {
-                            throw new AggregateError([error, cleanup], 'Descriptor acquisition cleanup failed', { cause: error });
-                        }
-                    }
-                    throw error;
-                }
-                finally {
-                    acquiring--;
-                }
-            });
-        },
-        read(handle, maxBytes, signal) {
-            return admitted(signal, async (combined) => {
-                bound(maxBytes);
-                const lease = retained(handle, 'read');
-                const readSignal = AbortSignal.any([combined, reads.signal, records.get(handle).reads.signal]);
-                readSignal.throwIfAborted();
-                const result = await lease.read(maxBytes, readSignal);
-                if (!result || typeof result !== 'object' || Array.isArray(result))
-                    throw new FsError('EIO', { syscall: 'read' });
-                const done = result.done;
-                if (done === true) {
-                    // A zero-byte request does not observe EOF on the caller's open
-                    // description. Refuse a broken lease receipt rather than retiring the
-                    // remote reader or silently manufacturing a successful upstream read.
-                    if (maxBytes === 0)
-                        throw new FsError('EIO', { syscall: 'read' });
-                    return { done: true, value: undefined };
-                }
-                if (done !== false && done !== undefined)
-                    throw new FsError('EIO', { syscall: 'read' });
-                // Validate and copy one observation of the upstream fragment. Reading an
-                // accessor again could transfer different bytes beyond the admitted bound.
-                const bytes = result.value;
-                if (!(bytes instanceof Uint8Array))
-                    throw new FsError('EIO', { syscall: 'read' });
-                const length = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Uint8Array.prototype), 'byteLength').get.call(bytes);
-                // The lease contract permits empty fragments only for zero-byte requests.
-                // A positive read must provide bytes or explicit EOF; silently forwarding
-                // an empty fragment would allow a remote consumer to invent EOF or spin.
-                if (length > maxBytes || (maxBytes > 0 && length === 0))
-                    throw new FsError('EIO', { syscall: 'read' });
-                return { done: false, value: new Uint8Array(bytes) };
-            }, handle);
-        },
-        write(handle, bytes, signal) {
-            if (!(bytes instanceof Uint8Array))
-                return Promise.reject(new FsError('EINVAL'));
-            const length = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Uint8Array.prototype), 'byteLength').get.call(bytes);
-            if (length > options.maxIoBytes)
-                return Promise.reject(new FsError('EINVAL'));
-            return admitted(signal, async (combined, owned) => {
-                const lease = retained(handle, 'write');
-                const writeSignal = lease.consumerClosed ? AbortSignal.any([combined, lease.consumerClosed]) : combined;
-                writeSignal.throwIfAborted();
-                const count = await lease.write(owned, writeSignal);
-                // A completed canonical write retains its receipt even when destination
-                // closure arrives before acknowledgment. Never turn settled progress into
-                // a failed write or attempt to undo it.
-                // A backend may transfer or change its borrowed carrier while settling.
-                // The admitted span remains the bound for its native progress receipt.
-                if (!Number.isSafeInteger(count) || count < 0 || count > length)
-                    throw new FsError('EIO', { syscall: 'write' });
-                return count;
-            }, handle, false, bytes);
-        },
-        seek(handle, position, signal) {
-            return admitted(signal, async (combined) => {
-                const lease = retained(handle, 'seek');
-                const offset = decodeFileOffset(position);
-                if (lease.exact) {
-                    await lease.exact.seek(offset, { signal: combined });
-                    return;
-                }
-                if (offset > BigInt(Number.MAX_SAFE_INTEGER))
-                    throw new FsError('ENOTSUP');
-                await lease.seek(Number(offset), combined);
-            }, handle);
-        },
-        stat(handle, signal) {
-            return admitted(signal, async (combined) => {
-                return admitCanonicalMetadata(await retained(handle, 'stat').stat(combined), 'stat');
-            }, handle);
-        },
-        close(handle, signal) {
-            return admitted(signal, async () => {
-                const record = records.get(handle);
-                if (!record)
-                    throw new FsError('EBADF');
-                records.delete(handle);
-                closing++;
-                // A close in flight still retains the canonical open description. An alias
-                // acquired meanwhile must share its identity and pending cursor queue.
-                try {
-                    await record.lease.close();
-                }
-                finally {
-                    closing--;
-                    if (--record.order.references === 0)
-                        identities.delete(record.lease.identity);
-                }
-            }, handle, true);
-        },
-        /** Retire read consumers before an outer callback barrier drains. Accepted
-         * writes keep their original signals and settle on the shared cursor queue. */
-        retireReads(handle) {
-            if (handle === undefined)
-                reads.abort(new FsError('EBADF'));
-            else
-                records.get(handle)?.reads.abort(new FsError('EBADF'));
-        },
-        dispose() {
-            if (disposal)
-                return disposal;
-            // Publish the shared barrier before canonical abort listeners can reenter.
-            // Admission closes synchronously below; retirement starts after publication.
-            disposal = Promise.resolve().then(async () => {
-                await Promise.allSettled([...pending]);
-                const closing = [...records.values()];
-                records.clear();
-                identities.clear();
-                const results = await Promise.allSettled(closing.map(record => Promise.resolve().then(() => record.lease.close())));
-                const failures = results.filter(result => result.status === 'rejected');
-                if (failures.length)
-                    throw new AggregateError(failures.map(result => result.reason), 'Descriptor cleanup failed');
-            });
-            controller.abort(new FsError('EBADF'));
-            return disposal;
-        },
-    };
-}