@promigence/sdk 0.1.0-beta.4 → 0.1.0-beta.6

package/dist/context.js

@@ -0,0 +1,588 @@
+import { lstatSync, readFileSync, readdirSync, readlinkSync } from "node:fs";
+import { join, relative, sep } from "node:path";
+import { InvalidArgumentError } from "./core.js";
+export const CONTEXT_TAR_PREFIX = "tar;base64,";
+export const CONTEXT_MAX_BYTES = 8 * 1024 * 1024;
+export const CONTEXT_SKIP = new Set([".git", "node_modules", "__pycache__", ".venv", ".DS_Store"]);
+const NAMED = 10;
+const SPACE = "\\t\\n\\v\\f\\r \\u0085\\u00a0\\u1680\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000";
+const TRIM = new RegExp(`^[${SPACE}]+|[${SPACE}]+$`, "gu");
+const goTrim = (s) => s.replace(TRIM, "");
+function goClean(p) {
+    if (p === "")
+        return ".";
+    const rooted = p.startsWith("/");
+    const out = [];
+    for (const seg of p.split("/")) {
+        if (seg === "" || seg === ".")
+            continue;
+        if (seg === "..") {
+            if (out.length > 0 && out[out.length - 1] !== "..")
+                out.pop();
+            else if (!rooted)
+                out.push("..");
+            continue;
+        }
+        out.push(seg);
+    }
+    const s = (rooted ? "/" : "") + out.join("/");
+    return s === "" ? "." : s;
+}
+function goDir(p) {
+    return goClean(p.slice(0, p.lastIndexOf("/") + 1));
+}
+function classChar(cps, i) {
+    let c = cps[i];
+    if (c === undefined || c === "-" || c === "]")
+        return undefined;
+    if (c === "\\") {
+        i += 1;
+        c = cps[i];
+        if (c === undefined)
+            return undefined;
+    }
+    if (i + 1 >= cps.length)
+        return undefined;
+    return { cp: c.codePointAt(0), next: i + 1 };
+}
+function readClass(cps, i) {
+    let neg = false;
+    if (cps[i] === "^") {
+        neg = true;
+        i += 1;
+    }
+    const ranges = [];
+    for (;;) {
+        if (cps[i] === "]" && ranges.length > 0)
+            return { neg, ranges, next: i + 1 };
+        const lo = classChar(cps, i);
+        if (!lo)
+            return "a `[...]` class is empty, is never closed, or has a `-` or `]` where a character belongs";
+        i = lo.next;
+        let hi = lo;
+        if (cps[i] === "-") {
+            const h = classChar(cps, i + 1);
+            if (!h)
+                return "a `[...]` class has a range with no end";
+            hi = h;
+            i = h.next;
+        }
+        if (hi.cp < lo.cp)
+            return "a `[...]` class has a range that runs backwards";
+        ranges.push([lo.cp, hi.cp]);
+    }
+}
+function compileRule(pattern, exclusion, line) {
+    const cps = [...pattern];
+    for (let i = 0; i < cps.length;) {
+        if (cps[i] === "\\") {
+            if (i + 1 >= cps.length)
+                return "it ends with a `\\` that escapes nothing";
+            i += 2;
+        }
+        else if (cps[i] === "[") {
+            const c = readClass(cps, i + 1);
+            if (typeof c === "string")
+                return c;
+            i = c.next;
+        }
+        else {
+            i += 1;
+        }
+    }
+    let kind = "exact";
+    const tokens = [];
+    let first = true;
+    for (let k = 0; k < cps.length;) {
+        const ch = cps[k++];
+        if (ch === "*") {
+            if (cps[k] === "*") {
+                k += 1;
+                if (cps[k] === "/")
+                    k += 1;
+                if (k >= cps.length) {
+                    if (kind === "exact")
+                        kind = "prefix";
+                    else {
+                        tokens.push({ t: "rest" });
+                        kind = "glob";
+                    }
+                }
+                else {
+                    tokens.push({ t: "dirs" });
+                    kind = "glob";
+                }
+                if (first)
+                    kind = "suffix";
+            }
+            else {
+                tokens.push({ t: "star" });
+                kind = "glob";
+            }
+        }
+        else if (ch === "?") {
+            tokens.push({ t: "one" });
+            kind = "glob";
+        }
+        else if (ch === "\\") {
+            tokens.push({ t: "lit", c: cps[k++] });
+            kind = "glob";
+        }
+        else if (ch === "[") {
+            const c = readClass(cps, k);
+            tokens.push({ t: "class", neg: c.neg, ranges: c.ranges });
+            k = c.next;
+            kind = "glob";
+        }
+        else if (ch === "]") {
+            tokens.push({ t: "lit", c: ch });
+            kind = "glob";
+        }
+        else {
+            tokens.push({ t: "lit", c: ch });
+        }
+        first = false;
+    }
+    return { line, exclusion, pattern, kind, tokens };
+}
+function globMatch(tokens, s) {
+    const memo = tokens.map(() => new Uint8Array(s.length + 1));
+    const go = (ti, si) => {
+        if (ti === tokens.length)
+            return si === s.length;
+        const row = memo[ti];
+        if (row[si])
+            return row[si] === 2;
+        const tok = tokens[ti];
+        let ok = false;
+        switch (tok.t) {
+            case "lit":
+                ok = s[si] === tok.c && go(ti + 1, si + 1);
+                break;
+            case "one":
+                ok = si < s.length && s[si] !== "/" && go(ti + 1, si + 1);
+                break;
+            case "class": {
+                const c = s[si];
+                if (c !== undefined) {
+                    const cp = c.codePointAt(0);
+                    const hit = tok.ranges.some(([lo, hi]) => lo <= cp && cp <= hi);
+                    ok = hit !== tok.neg && go(ti + 1, si + 1);
+                }
+                break;
+            }
+            case "star":
+                for (let j = si;; j++) {
+                    if (go(ti + 1, j)) {
+                        ok = true;
+                        break;
+                    }
+                    if (j >= s.length || s[j] === "/")
+                        break;
+                }
+                break;
+            case "rest":
+                for (let j = si;; j++) {
+                    if (go(ti + 1, j)) {
+                        ok = true;
+                        break;
+                    }
+                    if (j >= s.length || s[j] === "\n")
+                        break;
+                }
+                break;
+            case "dirs":
+                if (go(ti + 1, si)) {
+                    ok = true;
+                    break;
+                }
+                for (let j = si; j < s.length && s[j] !== "\n"; j++) {
+                    if (s[j] === "/" && go(ti + 1, j + 1)) {
+                        ok = true;
+                        break;
+                    }
+                }
+                break;
+        }
+        row[si] = ok ? 2 : 1;
+        return ok;
+    };
+    return go(0, 0);
+}
+function ruleMatches(r, path) {
+    switch (r.kind) {
+        case "exact":
+            return path === r.pattern;
+        case "prefix":
+            return path.startsWith(r.pattern.slice(0, -2));
+        case "suffix": {
+            const suffix = r.pattern.slice(2);
+            return path.endsWith(suffix) || (suffix.startsWith("/") && path === suffix.slice(1));
+        }
+        case "glob":
+            return globMatch(r.tokens, [...path]);
+    }
+}
+export function parseDockerignore(text, file = ".dockerignore") {
+    return readIgnore(text, file);
+}
+function readIgnore(text, file) {
+    const rules = [];
+    const lines = (text.startsWith("") ? text.slice(1) : text).split("\n");
+    lines.forEach((raw0, idx) => {
+        const raw = raw0.endsWith("\r") ? raw0.slice(0, -1) : raw0;
+        if (raw.startsWith("#"))
+            return;
+        let p = goTrim(raw);
+        if (p === "")
+            return;
+        const invert = p.startsWith("!");
+        if (invert)
+            p = goTrim(p.slice(1));
+        if (p !== "") {
+            p = goClean(p);
+            if (p.length > 1 && p.startsWith("/"))
+                p = p.slice(1);
+        }
+        let pat = goClean(goTrim((invert ? "!" : "") + p));
+        let exclusion = false;
+        const refuse = (why) => {
+            throw new InvalidArgumentError(`${file} line ${idx + 1} (${JSON.stringify(raw)}) is not a pattern the build can read: ${why}`, `Fix or remove that line of ${file}: the build refuses the whole file while it is there.`);
+        };
+        if (pat.startsWith("!")) {
+            if (pat.length === 1)
+                refuse("a `!` with no pattern after it");
+            exclusion = true;
+            pat = pat.slice(1);
+        }
+        const rule = compileRule(pat, exclusion, idx + 1);
+        if (typeof rule === "string")
+            refuse(rule);
+        else
+            rules.push(rule);
+    });
+    const exceptions = rules.some((r) => r.exclusion);
+    const plain = (r) => {
+        let s = r.pattern;
+        if (s.endsWith("/**"))
+            s = s.slice(0, -3);
+        if (s.endsWith("/*"))
+            s = s.slice(0, -2);
+        return s;
+    };
+    const onlyPlainExceptions = rules.every((r) => !r.exclusion || !/[*?[\\]/.test(plain(r)));
+    const step = (path, parent) => {
+        let matched = false;
+        const info = rules.map(() => false);
+        rules.forEach((r, i) => {
+            let m = parent !== undefined && parent.length > 0 ? parent[i] : false;
+            if (!m) {
+                if (r.exclusion !== matched)
+                    return;
+                m = ruleMatches(r, path);
+                if (!m && (parent === undefined || parent.length === 0)) {
+                    const dir = goDir(path);
+                    if (dir !== ".") {
+                        const dirs = dir.split("/");
+                        for (let k = 1; k <= dirs.length && !m; k++)
+                            m = ruleMatches(r, dirs.slice(0, k).join("/"));
+                    }
+                }
+            }
+            info[i] = m;
+            if (m)
+                matched = !r.exclusion;
+        });
+        return { ignored: matched, info };
+    };
+    return {
+        file,
+        patterns: rules.map((r) => (r.exclusion ? `!${r.pattern}` : r.pattern)),
+        exceptions,
+        sendsGit: rules.some((r) => r.exclusion && r.pattern === ".git"),
+        step,
+        ignored(path) {
+            const parts = path.split("/");
+            let info;
+            for (let k = 1; k < parts.length; k++)
+                info = step(parts.slice(0, k).join("/"), info).info;
+            return step(path, info).ignored;
+        },
+        mayHoldException(dir) {
+            if (!exceptions)
+                return false;
+            if (!onlyPlainExceptions)
+                return true;
+            return rules.some((r) => r.exclusion && `${plain(r)}/`.startsWith(`${dir}/`));
+        },
+    };
+}
+export function dockerignoreMatcher(text) {
+    const ig = readIgnore(text, ".dockerignore");
+    return ig.patterns.length > 0 ? { ignored: (rel) => ig.ignored(rel), exceptions: ig.exceptions } : undefined;
+}
+const SECRET_ALLOW = [
+    new RegExp("\\.(example|sample|template|dist|defaults)$", "i"),
+];
+const SECRET_DIRS = new Set([".aws", ".azure", ".gnupg", ".ssh"]);
+const SECRET_PATHS = [
+    new RegExp("(^|/)\\.docker/config\\.json$", "i"),
+    new RegExp("(^|/)\\.kube/config$", "i"),
+    new RegExp("(^|/)\\.config/gh/hosts\\.ya?ml$", "i"),
+    new RegExp("(^|/)\\.streamlit/secrets\\.toml$", "i"),
+];
+const SECRET_NAMES = [
+    new RegExp("^\\.env$", "i"),
+    new RegExp("^\\.env\\..+$", "i"),
+    new RegExp("\\.env$", "i"),
+    new RegExp("^\\.envrc$", "i"),
+    new RegExp("^\\.dev\\.vars$", "i"),
+    new RegExp("\\.(pem|key|p12|pfx|jks|keystore|ppk|p8)$", "i"),
+    new RegExp("^id_(rsa|ed25519|ecdsa|dsa)(?!.*\\.pub$)", "i"),
+    new RegExp("^\\.npmrc$", "i"),
+    new RegExp("^\\.yarnrc\\.yml$", "i"),
+    new RegExp("^\\.pypirc$", "i"),
+    new RegExp("^[._]netrc$", "i"),
+    new RegExp("^\\.git-credentials$", "i"),
+    new RegExp("^\\.pgpass$", "i"),
+    new RegExp("^\\.my\\.cnf$", "i"),
+    new RegExp("^\\.s3cfg$", "i"),
+    new RegExp("^\\.boto$", "i"),
+    new RegExp("^\\.dockercfg$", "i"),
+    new RegExp("^\\.vault-token$", "i"),
+    new RegExp("^\\.terraformrc$", "i"),
+    new RegExp("^terraform\\.rc$", "i"),
+    new RegExp("^\\.databrickscfg$", "i"),
+    new RegExp("^\\.htpasswd$", "i"),
+    new RegExp("^credentials$", "i"),
+    new RegExp("credentials.*\\.json$", "i"),
+    new RegExp("^service[-_]?account.*\\.json$", "i"),
+    new RegExp("adminsdk.*\\.json$", "i"),
+    new RegExp("^client_secret.*\\.json$", "i"),
+    new RegExp("(^|[-_.])key\\.json$", "i"),
+    new RegExp("^token\\.json$", "i"),
+    new RegExp("^auth\\.json$", "i"),
+    new RegExp("^rootkey\\.csv$", "i"),
+    new RegExp("^google-services\\.json$", "i"),
+    new RegExp("^googleservice-info\\.plist$", "i"),
+    new RegExp("^local\\.settings\\.json$", "i"),
+    new RegExp("^appsettings\\.[^.]+\\.json$", "i"),
+    new RegExp("^wp-config\\.php$", "i"),
+    new RegExp("\\.yml\\.enc$", "i"),
+    new RegExp("\\.tfstate$", "i"),
+    new RegExp("\\.tfstate\\..+$", "i"),
+    new RegExp("\\.tfvars(\\.json)?$", "i"),
+    new RegExp("kubeconfig", "i"),
+    new RegExp("^secrets\\.(ya?ml|toml|json)$", "i"),
+    new RegExp("^(.*[-_.])?(secrets?|credentials?|passw(or)?ds?|tokens?|(api|access|private|secret)[-_.]?keys?)([-_.][^/]*)?\\.(json|ya?ml|toml|txt|csv|ini|cfg|conf|properties|xml|plist)$", "i"),
+];
+export function secretLike(path) {
+    const parts = path.split("/").filter(Boolean);
+    const name = parts[parts.length - 1] ?? "";
+    if (parts.slice(0, -1).some((d) => SECRET_DIRS.has(d.toLowerCase())))
+        return true;
+    if (SECRET_PATHS.some((re) => re.test(path)))
+        return true;
+    if (SECRET_ALLOW.some((re) => re.test(name)))
+        return false;
+    return SECRET_NAMES.some((re) => re.test(name));
+}
+function namedList(items) {
+    const more = items.length > NAMED ? ` and ${items.length - NAMED} more` : "";
+    return items.slice(0, NAMED).join(", ") + more;
+}
+export function credentialRefusalMessage(hits) {
+    const one = hits.length === 1;
+    return `${hits.length} file${one ? " looks" : "s look"} like ${one ? "a credential" : "credentials"} and ${one ? "was" : "were"} not uploaded: ${namedList(hits)}; nothing was created`;
+}
+export const CREDENTIAL_CHECK_NOTE = "The check goes by file name and is best-effort: it cannot see what a file holds, so look over what you send.";
+function insidePath(p) {
+    return goClean(p.split(sep).join("/").replace(/^\.\/+/, ""));
+}
+function collect(dir, opts) {
+    const dockerfile = insidePath(opts.dockerfile ?? "Dockerfile");
+    const ownIgnore = `${dockerfile}.dockerignore`;
+    let ignore;
+    for (const name of [ownIgnore, ".dockerignore"]) {
+        let st;
+        try {
+            st = lstatSync(join(dir, name));
+        }
+        catch {
+            continue;
+        }
+        if (!st.isFile())
+            continue;
+        ignore = readIgnore(readFileSync(join(dir, name), "utf8"), name);
+        break;
+    }
+    const keep = new Set([dockerfile, ".dockerignore", ownIgnore, ...(opts.keep ?? []).map(insidePath)]);
+    const above = new Set();
+    for (const k of keep) {
+        const parts = k.split("/");
+        for (let i = 1; i < parts.length; i++)
+            above.add(parts.slice(0, i).join("/"));
+    }
+    const sendGit = ignore?.sendsGit ?? false;
+    const gitLeft = [];
+    const defaultLeft = [];
+    const setId = [];
+    const special = [];
+    let bytes = 0;
+    const walk = (abs, rel, parent) => {
+        const out = [];
+        for (const name of readdirSync(abs).sort()) {
+            const childAbs = join(abs, name);
+            const childRel = rel ? `${rel}/${name}` : name;
+            const st = lstatSync(childAbs);
+            const kept = keep.has(childRel);
+            const holdsKept = above.has(childRel);
+            if (name === ".git" && !sendGit && !kept && !holdsKept) {
+                gitLeft.push(childRel);
+                continue;
+            }
+            if (!ignore && CONTEXT_SKIP.has(name) && !kept && !holdsKept) {
+                defaultLeft.push(childRel);
+                continue;
+            }
+            let excluded = false;
+            let info;
+            if (ignore)
+                ({ ignored: excluded, info } = ignore.step(childRel, parent));
+            if (kept)
+                excluded = false;
+            const raw = st.mode & 0o7777;
+            const mode = raw & ~0o6000;
+            if (st.isDirectory()) {
+                if (excluded && !holdsKept && !ignore.mayHoldException(childRel))
+                    continue;
+                const inner = walk(childAbs, childRel, info);
+                if (!excluded || inner.length > 0) {
+                    if (raw !== mode)
+                        setId.push(childRel);
+                    out.push({ rel: childRel, abs: childAbs, kind: "dir", mode, size: 0 }, ...inner);
+                }
+                continue;
+            }
+            if (excluded)
+                continue;
+            if (st.isSymbolicLink()) {
+                out.push({ rel: childRel, abs: childAbs, kind: "link", mode: 0o777, size: 0, link: readlinkSync(childAbs) });
+            }
+            else if (st.isFile()) {
+                if (raw !== mode)
+                    setId.push(childRel);
+                bytes += st.size;
+                out.push({ rel: childRel, abs: childAbs, kind: "file", mode, size: st.size });
+            }
+            else {
+                special.push(childRel);
+            }
+        }
+        return out;
+    };
+    const entries = walk(dir, "", undefined);
+    const notes = [];
+    if (gitLeft.length > 0) {
+        notes.push(`Left out ${namedList(gitLeft)}: git history can hold credentials. To send it, add the line \`!.git\` to ${ignore?.file ?? ".dockerignore"}.`);
+    }
+    if (defaultLeft.length > 0) {
+        notes.push(`Left out ${namedList(defaultLeft)}: with no .dockerignore here, ${[...CONTEXT_SKIP].filter((n) => n !== ".git").join(", ")} are not sent. Add a .dockerignore to choose: with one, only what it lists is left out.`);
+    }
+    if (setId.length > 0) {
+        notes.push(`Cleared the set-user-ID or set-group-ID bit of ${namedList(setId.sort())}: a build context never carries one.`);
+    }
+    if (special.length > 0) {
+        notes.push(`Left out ${namedList(special)}: a socket, device or pipe; a build context holds only files, directories and links.`);
+    }
+    const secrets = entries.filter((e) => e.kind === "file" && secretLike(e.rel)).map((e) => e.rel);
+    return { entries, bytes, notes, secrets, ignore };
+}
+export function listContext(dir, opts = {}) {
+    const c = collect(dir, opts);
+    return {
+        paths: c.entries.map((e) => (e.kind === "dir" ? `${e.rel}/` : e.rel)).sort(),
+        files: c.entries.filter((e) => e.kind !== "dir").length,
+        bytes: c.bytes,
+        notes: c.notes,
+        secrets: c.secrets,
+        ignoreFile: c.ignore?.file ?? null,
+    };
+}
+export function packContext(dir, opts = {}) {
+    const max = opts.maxBytes ?? CONTEXT_MAX_BYTES;
+    const c = collect(dir, opts);
+    for (const n of c.notes)
+        opts.onNote?.(n);
+    if (c.bytes > max) {
+        const ig = c.ignore?.file;
+        throw new InvalidArgumentError(`the build context is over ${max} bytes${ig ? ` even without what its ${ig} excludes` : ""}`, `${ig ? `Exclude more in ${ig}` : "Add a .dockerignore"}, point --context at a smaller directory, or pass a git URL pinned to a full 40-character sha.`);
+    }
+    if (c.secrets.length > 0 && !opts.allowSecrets) {
+        throw new InvalidArgumentError(credentialRefusalMessage(c.secrets), `A snapshot keeps every file it holds, and every sandbox started from it has them. Exclude them in ${c.ignore?.file ?? ".dockerignore"}, pass the values as secrets, or pass { allowSecrets: true } if they are not real credentials. ${CREDENTIAL_CHECK_NOTE}`);
+    }
+    if (c.entries.length === 0) {
+        throw new InvalidArgumentError(`the build context ${JSON.stringify(dir)} is empty`, "Point --context at the directory holding your Dockerfile.");
+    }
+    return CONTEXT_TAR_PREFIX + tarOf(c.entries).toString("base64");
+}
+export function contextRelative(contextDir, dockerfilePath) {
+    const rel = relative(contextDir, dockerfilePath).split(sep).join("/");
+    if (!rel || rel.startsWith("..")) {
+        throw new InvalidArgumentError(`${JSON.stringify(dockerfilePath)} is not inside the context ${JSON.stringify(contextDir)}`, "Pass --context DIR with the Dockerfile underneath it.");
+    }
+    return rel;
+}
+function tarOf(entries) {
+    const out = [];
+    const named = entries.map((e) => ({ e, name: e.kind === "dir" ? `${e.rel}/` : e.rel }));
+    named.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    for (const { e, name: full } of named) {
+        const head = Buffer.alloc(512);
+        let name = full;
+        let prefix = "";
+        if (Buffer.byteLength(name) > 100) {
+            let cut = -1;
+            for (let i = name.indexOf("/"); i > 0 && i < name.length - 1; i = name.indexOf("/", i + 1)) {
+                if (Buffer.byteLength(name.slice(i + 1)) <= 100) {
+                    if (Buffer.byteLength(name.slice(0, i)) <= 155)
+                        cut = i;
+                    break;
+                }
+            }
+            if (cut < 0) {
+                throw new InvalidArgumentError(`the path ${JSON.stringify(e.rel)} is too long for a build context`, "Shorten the path or pass a git URL pinned to a full 40-character sha.");
+            }
+            prefix = name.slice(0, cut);
+            name = name.slice(cut + 1);
+        }
+        if (e.link !== undefined && Buffer.byteLength(e.link) > 100) {
+            throw new InvalidArgumentError(`the link ${JSON.stringify(e.rel)} points at a path too long for a build context`, "Shorten the link's target, or pass a git URL pinned to a full 40-character sha.");
+        }
+        const body = e.kind === "file" ? readFileSync(e.abs) : Buffer.alloc(0);
+        const put = (s, at, len) => { head.write(s.slice(0, len), at, len, "utf8"); };
+        const oct = (n, at, len) => { put(n.toString(8).padStart(len - 1, "0") + "\0", at, len); };
+        put(name, 0, 100);
+        oct(e.mode, 100, 8);
+        oct(0, 108, 8);
+        oct(0, 116, 8);
+        oct(body.length, 124, 12);
+        oct(0, 136, 12);
+        head.write("        ", 148, 8, "utf8");
+        head.write(e.kind === "dir" ? "5" : e.kind === "link" ? "2" : "0", 156, 1, "utf8");
+        if (e.link !== undefined)
+            put(e.link, 157, 100);
+        head.write("ustar\0", 257, 6, "binary");
+        head.write("00", 263, 2, "utf8");
+        put(prefix, 345, 155);
+        let sum = 0;
+        for (const b of head)
+            sum += b;
+        put(sum.toString(8).padStart(6, "0") + "\0 ", 148, 8);
+        out.push(head);
+        if (body.length > 0)
+            out.push(body, Buffer.alloc((512 - (body.length % 512)) % 512));
+    }
+    out.push(Buffer.alloc(1024));
+    return Buffer.concat(out);
+}

package/dist/core.d.ts

@@ -1,5 +1,5 @@
 /** Promigence SDK — constants, error hierarchy and shared types. */
-export declare const VERSION = "0.1.0-beta.4";
+export declare const VERSION = "0.1.0-beta.6";
 export declare const DOCS_URL = "https://promigence.ai";
 /** The error reference; each code is an anchor on it (the API's `docs` link has the same form). */
 export declare const ERRORS_DOCS_URL = "https://www.promigence.ai/docs/errors";

package/dist/core.js

@@ -1,5 +1,5 @@
 import { hintArg } from "./hint.js";
-export const VERSION = "0.1.0-beta.4";
+export const VERSION = "0.1.0-beta.6";
 export const DOCS_URL = "https://promigence.ai";
 export const ERRORS_DOCS_URL = "https://www.promigence.ai/docs/errors";
 export const DEFAULT_API_URL = "https://api.promigence.ai/v1";
@@ -209,6 +209,7 @@ export class NotReleasedError extends PromigenceError {
 export const EXIT_BY_CODE = {
     invalid_argument: 2, unsupported: 2, not_released: 1, task_failed: 4,
     env_failed: 3, snapshot_rejected: 6, build_failed: 3, snapshot_failed: 4,
+    not_connected: 7,
     fork_failed: 3, start_timeout: 3, readiness_failed: 3, verify_too_slow: 3,
     verify_each_failed: 3, toolchain_mismatch: 3, sandbox_unresponsive: 3, oom_within_tier: 3,
     disk_full_within_tier: 3, sandbox_interrupted: 3, integrity_mismatch: 3, egress_unavailable: 3,

package/dist/github.d.ts

@@ -93,6 +93,33 @@ export interface GithubUntracked {
     alias: string;
     untracked: boolean;
 }
+/**
+ * One request to connect a code host (`github` or `gitlab`), started by you, and how it ended.
+ * `state` is `pending` until it ends, then `connected`, `updated`, `already_connected`,
+ * `pending_provider_approval`, `declined`, `other_org`, `needs_admin`, `not_installer`,
+ * `wrong_user`, `expired` or `failed`; `message` says what happened and what to do next.
+ */
+export interface ConnectRequest {
+    request_id: string;
+    provider: string;
+    state: string;
+    account?: string;
+    message: string;
+    created_at: string;
+    finished_at?: string;
+}
+/**
+ * `POST /integrations/{github,gitlab}/requests`: a connection started for you in the console. Open
+ * `connect_url` in a browser signed in to the console as you; `request_id` says how it ends.
+ */
+export interface ConnectTicket {
+    /** Used once, by you only, within 5 minutes. */
+    ticket_id: string;
+    request_id: string;
+    /** The console page that starts it: it carries the ticket and nothing else. */
+    connect_url: string;
+    expires_at: string;
+}
 /** The prefix that names a connected repository in `repo`. */
 export declare const GITHUB_REPO_PREFIX = "github:";
 /**

package/dist/index.d.ts

@@ -22,6 +22,7 @@ export * from "./caller.js";
 export * from "./bundle.js";
 export * from "./blake3.js";
 export * from "./client.js";
+export * from "./context.js";
 export * from "./github.js";
 export * from "./gitlab.js";
 export * from "./sandbox.js";

package/dist/index.js

@@ -3,6 +3,7 @@ export * from "./caller.js";
 export * from "./bundle.js";
 export * from "./blake3.js";
 export * from "./client.js";
+export * from "./context.js";
 export * from "./github.js";
 export * from "./gitlab.js";
 export * from "./sandbox.js";