@poe-platform/safe-bash 0.1.803 → 0.1.804

package/dist/remote-execution/files.js

@@ -1,291 +0,0 @@
-import { UploadError } from './upload-protocol.js';
-import { admitOutputFreshness } from './output-freshness.js';
-export class FileListingError extends Error {
-    code;
-    constructor(code) {
-        super('Canonical directory listing admission failed');
-        this.code = code;
-        this.name = 'FileListingError';
-    }
-}
-/** Own indexed entries and primitive metadata, never backend iteration/JSON hooks.
- * The text listing profile refuses names that cannot be represented losslessly;
- * byte directory callbacks use their separately negotiated object profile. */
-export function admitFileListing(input, maxEntries, maxBytes) {
-    if (!Number.isSafeInteger(maxEntries) || maxEntries < 0 || !Number.isSafeInteger(maxBytes) || maxBytes < 2)
-        throw new TypeError('Invalid listing bound');
-    try {
-        if (!Array.isArray(input))
-            throw new FileListingError('EIO');
-        const count = input.length;
-        if (count > maxEntries)
-            throw new FileListingError('EFBIG');
-        const entries = [];
-        let remaining = maxBytes - 2;
-        for (let index = 0; index < count; index++) {
-            if (!Object.hasOwn(input, index))
-                throw new FileListingError('EIO');
-            const entry = input[index];
-            if (!entry || typeof entry !== 'object' || !Object.hasOwn(entry, 'name') || !Object.hasOwn(entry, 'type') || Object.keys(entry).some(key => key !== 'name' && key !== 'type'))
-                throw new FileListingError('EIO');
-            const name = entry.name;
-            const type = entry.type;
-            if (typeof name !== 'string' || !name || name === '.' || name === '..' || name.includes('/') || name.includes('\0') || !['file', 'directory', 'symlink', 'character', 'fifo', 'socket'].includes(type))
-                throw new FileListingError('EIO');
-            // UTF-16 length is a lower bound: admit before encoding retained metadata.
-            if (name.length > remaining)
-                throw new FileListingError('EFBIG');
-            if (new TextDecoder('utf-8', { ignoreBOM: true }).decode(new TextEncoder().encode(name)) !== name)
-                throw new FileListingError('EIO');
-            const owned = { name, type };
-            remaining -= new TextEncoder().encode(JSON.stringify(owned)).length + (index ? 1 : 0);
-            if (remaining < 0)
-                throw new FileListingError('EFBIG');
-            entries.push(owned);
-        }
-        // Structural metadata accessors may change the listing while it is copied.
-        // A prefix is not the complete canonical observation admitted above.
-        if (input.length !== count)
-            throw new FileListingError('EIO');
-        return entries;
-    }
-    catch (error) {
-        if (error instanceof FileListingError)
-            throw error;
-        throw new FileListingError('EIO');
-    }
-}
-export function encodeFileMetadata(stat) {
-    // Backend getters may expose changing native observations. Validate and encode
-    // one captured value per field, including exact bigint sizes and timestamps.
-    const { type, size, mode, uid, gid, atimeNs, mtimeNs, ctimeNs, allocatedBytes, nlink } = stat;
-    stat = { type, size, mode, uid, gid, atimeNs, mtimeNs, ctimeNs, allocatedBytes, nlink };
-    if (!['file', 'directory', 'symlink', 'character', 'fifo', 'socket'].includes(stat.type))
-        throw new TypeError('Invalid file type');
-    if (typeof stat.size !== 'bigint' || stat.size < 0n || stat.size > 9223372036854775807n)
-        throw new TypeError('File size is not representable');
-    const value = { type: stat.type, size: stat.size.toString() };
-    for (const key of ['mode', 'uid', 'gid'])
-        if (stat[key] !== undefined) {
-            if (!Number.isSafeInteger(stat[key]) || stat[key] < 0 || stat[key] > (key === 'mode' ? 65535 : 4294967295))
-                throw new TypeError('Invalid file metadata');
-            value[key] = stat[key];
-        }
-    for (const key of ['atimeNs', 'mtimeNs', 'ctimeNs'])
-        if (stat[key] !== undefined) {
-            if (typeof stat[key] !== 'bigint' || stat[key] < -9223372036854775808n || stat[key] > 9223372036854775807n)
-                throw new TypeError('Invalid file timestamp');
-            value[key] = stat[key].toString();
-        }
-    if (stat.allocatedBytes !== undefined) {
-        if (typeof stat.allocatedBytes !== 'bigint' || stat.allocatedBytes < 0n || stat.allocatedBytes > 9223372036854775807n)
-            throw new TypeError('Invalid allocated bytes');
-        value.allocatedBytes = stat.allocatedBytes.toString();
-    }
-    if (stat.nlink !== undefined) {
-        if (typeof stat.nlink !== 'bigint' || stat.nlink < 0n || stat.nlink > 9223372036854775807n)
-            throw new TypeError('Invalid link count');
-        value.nlink = stat.nlink.toString();
-    }
-    return value;
-}
-/** Server-local file handle ledger. Admission precedes acquisition and every read
- * is bounded. Caller supplies only already-authorized canonical namespace bindings. */
-export function createFileServer(options) {
-    options = { ...options, open: options.open.bind(options) };
-    for (const n of [options.maxHandles, options.maxFrameBytes])
-        if (!Number.isSafeInteger(n) || n < 1)
-            throw new TypeError('Invalid file bound');
-    const records = new Map();
-    let disposal;
-    const key = (scope) => JSON.stringify([scope.tenantId, scope.sessionId, scope.epoch, scope.invocationId]);
-    const guards = new WeakMap();
-    function assertGuard(r, guard) { if (guard && guards.get(guard) !== r)
-        throw new TypeError('Freshness binding belongs to another retained file'); }
-    function visible(scope, id) { const r = records.get(id); if (!r || r.scope !== key(scope))
-        throw new UploadError(404, 'Unknown retained file'); if (r.retiring)
-        throw new UploadError(410, 'File handle admission closed'); return r; }
-    async function admitted(r, signal, work) {
-        const combined = AbortSignal.any([signal, r.controller.signal]);
-        combined.throwIfAborted();
-        const task = (async () => { await r.acquired; combined.throwIfAborted(); const result = await work(combined); combined.throwIfAborted(); return result; })();
-        r.pending.add(task);
-        try {
-            return await task;
-        }
-        finally {
-            r.pending.delete(task);
-        }
-    }
-    async function close(scope, id) {
-        const r = records.get(id);
-        if (!r || r.scope !== key(scope))
-            throw new UploadError(404, 'Unknown retained file');
-        if (r.retiring)
-            return r.retiring;
-        // Canonical abort listeners can synchronously reenter retirement. Publish
-        // ownership before notifying them so the same retain is never closed twice.
-        r.retiring = (async () => { await r.acquired; await Promise.allSettled([...r.pending]); try {
-            await r.close?.();
-        }
-        finally {
-            records.delete(id);
-        } })();
-        r.controller.abort(new UploadError(410, 'File handle closed'));
-        return r.retiring;
-    }
-    async function open(scope, input, signal) {
-        signal.throwIfAborted();
-        if (disposal)
-            throw new UploadError(410, 'File server admission closed');
-        if (records.size >= options.maxHandles)
-            throw new UploadError(429, 'Retained file capacity');
-        const id = crypto.randomUUID();
-        let settle;
-        const acquired = new Promise(r => { settle = r; });
-        const record = { scope: key(scope), controller: new AbortController(), acquired, pending: new Set(), reading: false };
-        records.set(id, record);
-        try {
-            record.resource = await options.open({ ...scope }, { ...input }, AbortSignal.any([signal, record.controller.signal]));
-            const resource = record.resource;
-            // Own retirement before inspecting admission getters. Failed admission and
-            // overlapping disposal must release this retain through the acquired method.
-            record.close = resource.close.bind(resource);
-            // Pin authority operations while reads continue observing live retained bytes.
-            record.resource = Object.freeze({ identity: resource.identity, freshness: resource.freshness?.bind(resource),
-                stat: resource.stat.bind(resource), read: resource.read.bind(resource), close: record.close });
-            signal.throwIfAborted();
-            record.controller.signal.throwIfAborted();
-            return id;
-        }
-        catch (error) {
-            if (!record.retiring) {
-                try {
-                    await record.close?.();
-                }
-                catch (cleanup) {
-                    throw new AggregateError([error, cleanup], 'File acquisition cleanup failed', { cause: error });
-                }
-                finally {
-                    records.delete(id);
-                }
-            }
-            throw error;
-        }
-        finally {
-            settle();
-        }
-    }
-    async function freshness(scope, id, signal = new AbortController().signal) {
-        const r = visible(scope, id);
-        return admitted(r, signal, async (s) => {
-            const guard = await r.resource.freshness?.(s);
-            if (!guard)
-                return undefined;
-            const admitted = admitOutputFreshness(guard);
-            if (r.resource.identity === undefined || admitted.identity !== r.resource.identity)
-                throw new TypeError('Freshness identity does not match retained canonical object');
-            await admitted.assertCurrent(s);
-            guards.set(admitted, r);
-            return admitted;
-        });
-    }
-    async function stat(scope, id, signal = new AbortController().signal, guard) { const r = visible(scope, id); assertGuard(r, guard); return admitted(r, signal, async (s) => { await guard?.assertCurrent(s); const metadata = encodeFileMetadata(await r.resource.stat(s)); await guard?.assertCurrent(s); return metadata; }); }
-    function stream(scope, id, start, end, signal, guard) {
-        if (typeof start !== 'bigint' || typeof end !== 'bigint' || start < 0n || end < start || end > 9223372036854775807n)
-            throw new UploadError(416, 'Unrepresentable file range');
-        const r = visible(scope, id);
-        assertGuard(r, guard);
-        if (r.reading)
-            throw new UploadError(429, 'Retained file read already active');
-        signal.throwIfAborted();
-        r.reading = true;
-        const controller = new AbortController();
-        const combined = AbortSignal.any([signal, controller.signal, r.controller.signal]);
-        let target;
-        let released = false;
-        let pending;
-        const release = () => { if (!released) {
-            released = true;
-            r.reading = false;
-            combined.removeEventListener('abort', abort);
-        } };
-        const abort = () => { if (released)
-            return; target.error(combined.reason); if (pending)
-            void pending.finally(release).catch(() => { });
-        else
-            release(); };
-        return new ReadableStream({ start(c) { target = c; combined.addEventListener('abort', abort, { once: true }); if (combined.aborted)
-                abort(); }, async pull(c) {
-                pending = (async () => {
-                    try {
-                        combined.throwIfAborted();
-                        if (start === end) {
-                            // Empty outputs and EOF resumes still certify the admitted content version.
-                            // Keep validation in the retained lifetime so closure drains it as well.
-                            if (guard)
-                                await admitted(r, combined, s => guard.assertCurrent(s));
-                            combined.throwIfAborted();
-                            c.close();
-                            release();
-                            return;
-                        }
-                        const count = Number(end - start > BigInt(options.maxFrameBytes) ? BigInt(options.maxFrameBytes) : end - start);
-                        const bytes = await admitted(r, combined, async (s) => {
-                            await guard?.assertCurrent(s);
-                            const value = await r.resource.read(start, count, s);
-                            if (!(value instanceof Uint8Array))
-                                throw new UploadError(503, 'Invalid canonical read response');
-                            const span = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Uint8Array.prototype), 'byteLength').get.call(value);
-                            if (span > count)
-                                throw new UploadError(503, 'Invalid canonical read response');
-                            const bytes = new Uint8Array(value);
-                            await guard?.assertCurrent(s);
-                            return bytes;
-                        });
-                        if (!(bytes instanceof Uint8Array) || bytes.length > count)
-                            throw new UploadError(503, 'Invalid canonical read response');
-                        if (!bytes.length) {
-                            c.close();
-                            release();
-                            return;
-                        }
-                        start += BigInt(bytes.length);
-                        c.enqueue(new Uint8Array(bytes));
-                        if (start === end) {
-                            c.close();
-                            release();
-                        }
-                    }
-                    catch (error) {
-                        if (!released) {
-                            c.error(error);
-                            release();
-                        }
-                    }
-                })();
-                await pending;
-            }, async cancel(reason) { controller.abort(reason); await pending; release(); } }, { highWaterMark: 0 });
-    }
-    async function dispose(scope) {
-        const results = await Promise.allSettled([...records].filter(([, r]) => r.scope === key(scope)).map(([id]) => close(scope, id)));
-        const failures = results.filter(result => result.status === 'rejected');
-        if (failures.length === 1)
-            throw failures[0].reason;
-        if (failures.length)
-            throw new AggregateError(failures.map(result => result.reason), 'Retained file cleanup failed');
-    }
-    function disposeAll() {
-        disposal ??= Promise.resolve().then(async () => {
-            const results = await Promise.allSettled([...records].map(([id, r]) => { const [tenantId, sessionId, epoch, invocationId] = JSON.parse(r.scope); return close({ tenantId, sessionId, epoch, invocationId }, id); }));
-            const failures = results.filter(result => result.status === 'rejected');
-            if (failures.length === 1)
-                throw failures[0].reason;
-            if (failures.length)
-                throw new AggregateError(failures.map(result => result.reason), 'Retained file cleanup failed');
-        });
-        void disposal.catch(() => { });
-        return disposal;
-    }
-    return { open, stat, freshness, stream, close, dispose, disposeAll };
-}

package/dist/remote-execution/hosting-operation.js

@@ -1,26 +0,0 @@
-/** Abort the caller even when an SDK or trusted resolver ignores its signal.
- * Observe late results and failures without replaying the operation. */
-export async function hostingOperation(signal, operation, discard) {
-    signal.throwIfAborted();
-    let abort = () => { };
-    const cancelled = new Promise((_, reject) => {
-        abort = () => reject(signal.reason);
-        signal.addEventListener('abort', abort, { once: true });
-    });
-    const result = new Promise(resolve => { resolve(operation()); }).then(async (value) => {
-        if (signal.aborted) {
-            try {
-                await discard?.(value);
-            }
-            catch { /* Preserve the cancellation reason. */ }
-            signal.throwIfAborted();
-        }
-        return value;
-    });
-    try {
-        return await Promise.race([result, cancelled]);
-    }
-    finally {
-        signal.removeEventListener('abort', abort);
-    }
-}

package/dist/remote-execution/hosting-request.d.ts

@@ -1,4 +0,0 @@
-/** Construct from fields rather than Request(Request): Node's transfer proxy
- * eagerly pulls stdin while an asynchronous host prepares its endpoint. Keep
- * the original stream and its backpressure until the service consumes it. */
-export declare function hostingRequest(request: Request, url: string | URL, options: RequestInit): Request;

package/dist/remote-execution/hosting-request.js

@@ -1,12 +0,0 @@
-/** Construct from fields rather than Request(Request): Node's transfer proxy
- * eagerly pulls stdin while an asynchronous host prepares its endpoint. Keep
- * the original stream and its backpressure until the service consumes it. */
-export function hostingRequest(request, url, options) {
-    return new Request(url, {
-        method: request.method, headers: request.headers, body: request.body,
-        cache: request.cache, credentials: request.credentials, integrity: request.integrity,
-        keepalive: request.keepalive, mode: request.mode, redirect: request.redirect,
-        referrer: request.referrer, referrerPolicy: request.referrerPolicy,
-        signal: request.signal, duplex: 'half', ...options,
-    });
-}

package/dist/remote-execution/hosting-stream.d.ts

@@ -1,8 +0,0 @@
-export interface TransferLimits {
-    maxChunkBytes: number;
-    maxBytes: number;
-    maxWallClockMs: number;
-}
-/** One downstream pull grants one chunk. Never collect or split media bodies.
- * SDK/backend buffering is outside this queue and needs separate qualification. */
-export declare function boundedTransfer(body: ReadableStream<Uint8Array>, limits: TransferLimits | undefined, signal: AbortSignal, abort: AbortController, retireOnEnd?: boolean, abortOnError?: boolean): ReadableStream<Uint8Array>;

package/dist/remote-execution/hosting-stream.js

@@ -1,64 +0,0 @@
-/** One downstream pull grants one chunk. Never collect or split media bodies.
- * SDK/backend buffering is outside this queue and needs separate qualification. */
-export function boundedTransfer(body, limits, signal, abort, retireOnEnd = false, abortOnError = true) {
-    const reader = body.getReader();
-    let total = 0;
-    let finished = false;
-    let stop;
-    function finish(reason, cancel = false) {
-        if (finished)
-            return Promise.resolve();
-        finished = true;
-        signal.removeEventListener('abort', stop);
-        if (cancel)
-            return reader.cancel(reason).catch(() => { }).finally(() => reader.releaseLock());
-        reader.releaseLock();
-        return Promise.resolve();
-    }
-    return new ReadableStream({
-        start(controller) {
-            stop = () => { if (!finished) {
-                controller.error(signal.reason);
-                void finish(signal.reason, true);
-            } };
-            signal.addEventListener('abort', stop, { once: true });
-            if (signal.aborted)
-                stop();
-        },
-        async pull(controller) {
-            try {
-                signal.throwIfAborted();
-                const part = await reader.read();
-                if (finished)
-                    return;
-                if (part.done) {
-                    await finish();
-                    controller.close();
-                    if (retireOnEnd)
-                        abort.abort(new Error('Transfer complete'));
-                    return;
-                }
-                if (!(part.value instanceof Uint8Array))
-                    throw new TypeError('Transfer bytes required');
-                if (limits) {
-                    const length = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Uint8Array.prototype), 'byteLength').get.call(part.value);
-                    if (length > limits.maxChunkBytes || length > limits.maxBytes - total)
-                        throw new RangeError('Transfer byte limit');
-                    total += length;
-                }
-                controller.enqueue(part.value);
-            }
-            catch (error) {
-                if (!finished) {
-                    controller.error(error);
-                    const cleanup = finish(error, true);
-                    if (abortOnError)
-                        abort.abort(error);
-                    await cleanup;
-                }
-            }
-        },
-        async cancel(reason) { const cleanup = finish(reason, true); if (abortOnError)
-            abort.abort(reason); await cleanup; },
-    }, { highWaterMark: 0 });
-}

package/dist/remote-execution/index.js

@@ -1,18 +0,0 @@
-export { createEndpointAccess, EndpointCapabilityGap } from './endpoint.js';
-export { relayTransport } from './relay.js';
-export { createUploadClient } from './uploads.js';
-export { uploadDescriptor } from './upload-descriptor.js';
-export { UploadError } from './upload-protocol.js';
-export { createExecutionClient } from './materializations.js';
-export { captureJobSource, nativeArgvByteLimit, assertJobInvocation, assertNativeProcessView, createJobBinding, JobCallbackRecoveryError, JobEffectsError } from './job-binding.js';
-export { createClient, RemoteExecutionError, RemoteServiceError, UnrecoverableTransportError } from './client.js';
-export { binaryContentType, encodeFrame, decodeFrames } from './binary.js';
-export { executeRemoteProcess } from './process.js';
-export { connectHttpProcess } from './process-http.js';
-export { validateWire } from './wire-validation.js';
-export { createEffectStore } from './effects.js';
-export { inspectOutputTree, retrieveOutputs } from './output-retrieval.js';
-export { createRemoteExecutionRoute, createContainerExecutionDriver } from './deployment.js';
-export { hostingOperation } from './hosting-operation.js';
-export { createRestExecutionDriver } from './rest-driver.js';
-export { createModalExecutionDriver } from './modal-driver.js';

package/dist/remote-execution/invocation-admission.d.ts

@@ -1,3 +0,0 @@
-/** Cwd follows the shell's Unicode string contract, independently of the
- * negotiated byte filename/argv profile. Call after octet/size admission. */
-export declare function assertLogicalCwd(cwd: readonly number[]): void;

package/dist/remote-execution/invocation-admission.js

@@ -1,17 +0,0 @@
-/** Cwd follows the shell's Unicode string contract, independently of the
- * negotiated byte filename/argv profile. Call after octet/size admission. */
-export function assertLogicalCwd(cwd) {
-    if (cwd[0] !== 47)
-        throw new TypeError('Absolute logical cwd required');
-    // The process description is the admitted indexed array, not a caller's
-    // iterator (which can substitute names or acquire speculative dependencies).
-    const bytes = new Uint8Array(cwd.length);
-    for (let index = 0; index < bytes.length; index++)
-        bytes[index] = cwd[index];
-    try {
-        new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes);
-    }
-    catch {
-        throw new TypeError('Lossless Unicode logical cwd required');
-    }
-}