@reasonlayer/sdk 0.0.1-rc.3

package/node_modules/@reasonlayer/protocol/dist/runtime.d.ts

@@ -0,0 +1,67 @@
+export declare const FN: {
+    readonly orgsWhoami: "orgs:whoami";
+    readonly orgsBootstrapDev: "orgs:bootstrapDev";
+    readonly deploymentsGet: "deployments:get";
+    readonly deploymentsLatestFor: "deployments:latestFor";
+    readonly deploymentsDeleteWorkflow: "deployments:deleteWorkflow";
+    readonly workspacesStartSession: "workspaces:startSession";
+    readonly workspacesCheckout: "workspaces:checkout";
+    readonly workspacesMissingBlobs: "workspaces:missingBlobs";
+    readonly workspacesAvailableBundles: "workspaces:availableBundles";
+    readonly workspacesGenerateUploadUrl: "workspaces:generateUploadUrl";
+    readonly workspacesMirror: "workspaces:mirror";
+    readonly workspacesRecordCompile: "workspaces:recordCompile";
+    readonly workspacesRecordCompileError: "workspaces:recordCompileError";
+    readonly workspacesHeartbeat: "workspaces:heartbeat";
+    readonly workspacesEndSession: "workspaces:endSession";
+    readonly workspacesPublish: "workspaces:publish";
+    readonly workspacesRollback: "workspaces:rollback";
+    readonly workspacesStatus: "workspaces:status";
+    readonly workspacesListVersions: "workspaces:listVersions";
+    readonly testArtifactsGenerateUploadUrl: "testArtifacts:generateUploadUrl";
+    readonly testArtifactsCreate: "testArtifacts:create";
+    readonly secretsSet: "secrets:set";
+    readonly secretsList: "secrets:list";
+    readonly secretsRemove: "secrets:remove";
+    readonly variablesSet: "variables:set";
+    readonly variablesList: "variables:list";
+    readonly variablesRemove: "variables:remove";
+    readonly runsCreate: "runs:create";
+    readonly runsCreateTest: "runs:createTest";
+    readonly runsGet: "runs:get";
+    readonly runsInspect: "runs:inspect";
+    readonly runsList: "runs:list";
+    readonly runsCancel: "runs:cancel";
+    readonly runsCancelStep: "runs:cancelStep";
+    readonly runsRetry: "runs:retry";
+    readonly tasksClaimNextForRun: "tasks:claimNextForRun";
+    readonly tasksClaimDeviceNext: "tasks:claimDeviceNext";
+    readonly tasksClaimDispatched: "tasks:claimDispatched";
+    readonly tasksRecordSpawned: "tasks:recordSpawned";
+    readonly tasksHeartbeat: "tasks:heartbeat";
+    readonly tasksComplete: "tasks:complete";
+    readonly integrationsExecuteTaskAction: "integrations:executeTaskAction";
+    readonly transcriptsIngest: "transcripts:ingest";
+    readonly transcriptsList: "transcripts:list";
+    readonly approvalsList: "approvals:list";
+    readonly approvalsApprove: "approvals:approve";
+    readonly approvalsReject: "approvals:reject";
+    readonly triggersList: "triggers:list";
+    readonly triggersSetEnabled: "triggers:setEnabled";
+    readonly tokensCreate: "tokens:create";
+    readonly tokensList: "tokens:list";
+    readonly tokensRevoke: "tokens:revoke";
+    readonly devicesRegister: "devices:register";
+    readonly devicesList: "devices:list";
+    readonly devicesBindHandle: "devices:bindHandle";
+    readonly devicesUpdate: "devices:update";
+    readonly devicesRotateSecret: "devices:rotateSecret";
+    readonly devicesListProfiles: "devices:listProfiles";
+    readonly devicesCreateProfile: "devices:createProfile";
+    readonly devicesRequestProfileLogin: "devices:requestProfileLogin";
+    readonly devicesPendingProfileLogins: "devices:pendingProfileLogins";
+    readonly devicesCompleteProfileLogin: "devices:completeProfileLogin";
+};
+export type FnName = (typeof FN)[keyof typeof FN];
+export declare const LEASE_DEFAULT_MS = 30000;
+export declare const LEASE_FLOOR_MS = 1000;

package/node_modules/@reasonlayer/protocol/dist/runtime.js

@@ -0,0 +1,66 @@
+export const FN = {
+    orgsWhoami: "orgs:whoami",
+    orgsBootstrapDev: "orgs:bootstrapDev",
+    deploymentsGet: "deployments:get",
+    deploymentsLatestFor: "deployments:latestFor",
+    deploymentsDeleteWorkflow: "deployments:deleteWorkflow",
+    workspacesStartSession: "workspaces:startSession",
+    workspacesCheckout: "workspaces:checkout",
+    workspacesMissingBlobs: "workspaces:missingBlobs",
+    workspacesAvailableBundles: "workspaces:availableBundles",
+    workspacesGenerateUploadUrl: "workspaces:generateUploadUrl",
+    workspacesMirror: "workspaces:mirror",
+    workspacesRecordCompile: "workspaces:recordCompile",
+    workspacesRecordCompileError: "workspaces:recordCompileError",
+    workspacesHeartbeat: "workspaces:heartbeat",
+    workspacesEndSession: "workspaces:endSession",
+    workspacesPublish: "workspaces:publish",
+    workspacesRollback: "workspaces:rollback",
+    workspacesStatus: "workspaces:status",
+    workspacesListVersions: "workspaces:listVersions",
+    testArtifactsGenerateUploadUrl: "testArtifacts:generateUploadUrl",
+    testArtifactsCreate: "testArtifacts:create",
+    secretsSet: "secrets:set",
+    secretsList: "secrets:list",
+    secretsRemove: "secrets:remove",
+    variablesSet: "variables:set",
+    variablesList: "variables:list",
+    variablesRemove: "variables:remove",
+    runsCreate: "runs:create",
+    runsCreateTest: "runs:createTest",
+    runsGet: "runs:get",
+    runsInspect: "runs:inspect",
+    runsList: "runs:list",
+    runsCancel: "runs:cancel",
+    runsCancelStep: "runs:cancelStep",
+    runsRetry: "runs:retry",
+    tasksClaimNextForRun: "tasks:claimNextForRun",
+    tasksClaimDeviceNext: "tasks:claimDeviceNext",
+    tasksClaimDispatched: "tasks:claimDispatched",
+    tasksRecordSpawned: "tasks:recordSpawned",
+    tasksHeartbeat: "tasks:heartbeat",
+    tasksComplete: "tasks:complete",
+    integrationsExecuteTaskAction: "integrations:executeTaskAction",
+    transcriptsIngest: "transcripts:ingest",
+    transcriptsList: "transcripts:list",
+    approvalsList: "approvals:list",
+    approvalsApprove: "approvals:approve",
+    approvalsReject: "approvals:reject",
+    triggersList: "triggers:list",
+    triggersSetEnabled: "triggers:setEnabled",
+    tokensCreate: "tokens:create",
+    tokensList: "tokens:list",
+    tokensRevoke: "tokens:revoke",
+    devicesRegister: "devices:register",
+    devicesList: "devices:list",
+    devicesBindHandle: "devices:bindHandle",
+    devicesUpdate: "devices:update",
+    devicesRotateSecret: "devices:rotateSecret",
+    devicesListProfiles: "devices:listProfiles",
+    devicesCreateProfile: "devices:createProfile",
+    devicesRequestProfileLogin: "devices:requestProfileLogin",
+    devicesPendingProfileLogins: "devices:pendingProfileLogins",
+    devicesCompleteProfileLogin: "devices:completeProfileLogin",
+};
+export const LEASE_DEFAULT_MS = 30_000;
+export const LEASE_FLOOR_MS = 1_000;

package/node_modules/@reasonlayer/protocol/dist/scheduling.d.ts

@@ -0,0 +1,69 @@
+import type { ActionStepIR, AgentStepIR, CodeStepIR, MapChildStepIR, MapStepIR, ReviewStepIR, StepIR, WorkflowIR } from "./ir.js";
+import { type SelectorContext } from "./selector.js";
+export type InputStep = ActionStepIR | CodeStepIR | AgentStepIR | ReviewStepIR | MapChildStepIR;
+export interface MapExpansionItem {
+    key: string;
+    item: unknown;
+    childIndex: number;
+}
+export type StepRunStatus = "pending" | "running" | "succeeded" | "failed" | "skipped" | "canceled" | "expired";
+export interface StepRunState {
+    stepId: string;
+    status: StepRunStatus;
+    error?: string;
+}
+export type BlockingStepRunStatus = Exclude<StepRunStatus, "pending" | "running" | "succeeded"> | "missing";
+export interface DependencyBlocker {
+    stepId: string;
+    status: BlockingStepRunStatus;
+    error?: string;
+}
+export interface MapChildResult {
+    status: StepRunStatus;
+    output?: unknown;
+    childIndex?: number;
+    invocationKey?: string;
+    error?: string;
+}
+export type MapCollapseResult = {
+    ok: true;
+    output: unknown[];
+    childrenSucceeded: number;
+    childrenTotal: number;
+} | {
+    ok: false;
+    error: string;
+    childrenSucceeded: number;
+    childrenTotal: number;
+};
+export declare function stepDependencies(step: StepIR): string[];
+export declare function isTerminalStepRunStatus(status: StepRunStatus): boolean;
+export declare function readySteps(ir: WorkflowIR, args: {
+    outputs: Record<string, unknown>;
+    startedStepIds: Iterable<string>;
+}): StepIR[];
+export declare function dependencyBlockers(step: StepIR, args: {
+    outputs: Record<string, unknown>;
+    stepStates: ReadonlyMap<string, StepRunState>;
+}): DependencyBlocker[];
+export declare function doomedSteps(ir: WorkflowIR, args: {
+    outputs: Record<string, unknown>;
+    startedStepIds: Iterable<string>;
+    stepStates: ReadonlyMap<string, StepRunState>;
+}): Array<{
+    step: StepIR;
+    blockers: DependencyBlocker[];
+}>;
+export declare function workflowStepsComplete(ir: WorkflowIR, stepStates: ReadonlyMap<string, StepRunState>): boolean;
+export declare function workflowOutputReady(ir: WorkflowIR, args: {
+    outputs: Record<string, unknown>;
+    stepStates: ReadonlyMap<string, StepRunState>;
+}): boolean;
+export declare function workflowOutputBlockers(ir: WorkflowIR, args: {
+    outputs: Record<string, unknown>;
+    stepStates: ReadonlyMap<string, StepRunState>;
+}): DependencyBlocker[];
+export declare function expandMapStep(step: MapStepIR, context: SelectorContext): MapExpansionItem[];
+export declare function evaluateStepInput(step: InputStep, context: SelectorContext): unknown;
+export declare function evaluateWorkflowOutput(ir: WorkflowIR, context: SelectorContext): unknown;
+export declare function collapseMapChildren(children: MapChildResult[]): MapCollapseResult;

package/node_modules/@reasonlayer/protocol/dist/scheduling.js

@@ -0,0 +1,126 @@
+import { evaluateSelector, referencedStepIds, } from "./selector.js";
+const TERMINAL_STEP_STATUSES = new Set([
+    "succeeded",
+    "failed",
+    "skipped",
+    "canceled",
+    "expired",
+]);
+function unique(values) {
+    return Array.from(new Set(values));
+}
+export function stepDependencies(step) {
+    return step.kind === "map"
+        ? unique([...referencedStepIds(step.over), ...referencedStepIds(step.step.input)])
+        : unique(referencedStepIds(step.input));
+}
+export function isTerminalStepRunStatus(status) {
+    return TERMINAL_STEP_STATUSES.has(status);
+}
+function blockerStatusFor(status) {
+    switch (status) {
+        case "failed":
+        case "skipped":
+        case "canceled":
+        case "expired":
+            return status;
+        case "pending":
+        case "running":
+        case "succeeded":
+            return "missing";
+    }
+}
+export function readySteps(ir, args) {
+    const started = new Set(args.startedStepIds);
+    return Object.values(ir.steps).filter((step) => !started.has(step.id) &&
+        stepDependencies(step).every((dependency) => dependency in args.outputs));
+}
+export function dependencyBlockers(step, args) {
+    return stepDependencies(step).flatMap((dependency) => {
+        if (dependency in args.outputs)
+            return [];
+        const state = args.stepStates.get(dependency);
+        if (!state || !isTerminalStepRunStatus(state.status))
+            return [];
+        return [{
+                stepId: dependency,
+                status: blockerStatusFor(state.status),
+                ...(state.error !== undefined ? { error: state.error } : {}),
+            }];
+    });
+}
+export function doomedSteps(ir, args) {
+    const started = new Set(args.startedStepIds);
+    return Object.values(ir.steps).flatMap((step) => {
+        if (started.has(step.id))
+            return [];
+        const blockers = dependencyBlockers(step, args);
+        return blockers.length > 0 ? [{ step, blockers }] : [];
+    });
+}
+export function workflowStepsComplete(ir, stepStates) {
+    return Object.values(ir.steps).every((step) => {
+        const state = stepStates.get(step.id);
+        return state !== undefined && isTerminalStepRunStatus(state.status);
+    });
+}
+export function workflowOutputReady(ir, args) {
+    return workflowOutputBlockers(ir, args).length === 0;
+}
+export function workflowOutputBlockers(ir, args) {
+    return unique(referencedStepIds(ir.output)).flatMap((stepId) => {
+        const state = args.stepStates.get(stepId);
+        if (state?.status === "succeeded" && stepId in args.outputs)
+            return [];
+        if (!state)
+            return [{ stepId, status: "missing" }];
+        return [{
+                stepId,
+                status: blockerStatusFor(state.status),
+                ...(state.error !== undefined ? { error: state.error } : {}),
+            }];
+    });
+}
+export function expandMapStep(step, context) {
+    const over = evaluateSelector(step.over, context);
+    if (!Array.isArray(over)) {
+        throw new Error(`map step "${step.id}": over selector did not yield an array`);
+    }
+    const seen = new Set();
+    const items = [];
+    for (const item of over) {
+        const key = String(evaluateSelector(step.key, { ...context, mapItem: item }));
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        items.push({ key, item, childIndex: items.length });
+    }
+    return items;
+}
+export function evaluateStepInput(step, context) {
+    return evaluateSelector(step.input, context);
+}
+export function evaluateWorkflowOutput(ir, context) {
+    return evaluateSelector(ir.output, context);
+}
+export function collapseMapChildren(children) {
+    const survivors = children
+        .filter((child) => child.status === "succeeded")
+        .sort((a, b) => (a.childIndex ?? 0) - (b.childIndex ?? 0));
+    const childrenSucceeded = survivors.length;
+    const childrenTotal = children.length;
+    if (childrenSucceeded === 0 && childrenTotal > 0) {
+        return {
+            ok: false,
+            error: `all ${childrenTotal} map children failed`,
+            childrenSucceeded,
+            childrenTotal,
+        };
+    }
+    return {
+        ok: true,
+        output: survivors.map((child) => child.output),
+        childrenSucceeded,
+        childrenTotal,
+    };
+}

package/node_modules/@reasonlayer/protocol/dist/selector.d.ts

@@ -0,0 +1,23 @@
+/**
+ * SelectorIR evaluation — pure JS over JSON (spec §3.3: interpretation of
+ * data, safe in the engine). Shared by the engine interpreter and the SDK
+ * test kit so the two cannot drift.
+ */
+import type { SelectorIR } from "./ir.js";
+export interface SelectorContext {
+    input: unknown;
+    /** Outputs of completed steps, keyed by step id. */
+    stepOutputs: Record<string, unknown>;
+    /** Present only while evaluating a map child's selectors. */
+    mapItem?: unknown;
+    /** Resolved workflow-variable snapshot fixed at run creation. */
+    variables?: Record<string, unknown>;
+}
+export declare function getPath(value: unknown, path: readonly string[]): unknown;
+export declare class SelectorEvalError extends Error {
+}
+export declare function evaluateSelector(selector: SelectorIR, ctx: SelectorContext): unknown;
+/** Every step id a selector references — the dependency edge set for readiness. */
+export declare function referencedStepIds(selector: SelectorIR): string[];
+/** True if the selector (recursively) uses mapItem — only legal inside a map child. */
+export declare function usesMapItem(selector: SelectorIR): boolean;

package/node_modules/@reasonlayer/protocol/dist/selector.js

@@ -0,0 +1,77 @@
+/**
+ * SelectorIR evaluation — pure JS over JSON (spec §3.3: interpretation of
+ * data, safe in the engine). Shared by the engine interpreter and the SDK
+ * test kit so the two cannot drift.
+ */
+export function getPath(value, path) {
+    let current = value;
+    for (const key of path) {
+        if (current === null || current === undefined)
+            return undefined;
+        current = current[key];
+    }
+    return current;
+}
+export class SelectorEvalError extends Error {
+}
+export function evaluateSelector(selector, ctx) {
+    switch (selector.kind) {
+        case "input":
+            return getPath(ctx.input, selector.path);
+        case "step": {
+            if (!(selector.stepId in ctx.stepOutputs)) {
+                throw new SelectorEvalError(`selector references step "${selector.stepId}" which has no output yet`);
+            }
+            return getPath(ctx.stepOutputs[selector.stepId], selector.path);
+        }
+        case "variable": {
+            if (!ctx.variables || !Object.prototype.hasOwnProperty.call(ctx.variables, selector.name)) {
+                throw new SelectorEvalError(`selector references undeclared variable "${selector.name}"`);
+            }
+            return getPath(ctx.variables[selector.name], selector.path);
+        }
+        case "literal":
+            return selector.value;
+        case "object": {
+            const result = {};
+            for (const [key, field] of Object.entries(selector.fields)) {
+                result[key] = evaluateSelector(field, ctx);
+            }
+            return result;
+        }
+        case "array":
+            return selector.items.map((item) => evaluateSelector(item, ctx));
+        case "mapItem": {
+            if (!("mapItem" in ctx)) {
+                throw new SelectorEvalError("mapItem selector evaluated outside a map child");
+            }
+            return getPath(ctx.mapItem, selector.path);
+        }
+    }
+}
+/** Every step id a selector references — the dependency edge set for readiness. */
+export function referencedStepIds(selector) {
+    switch (selector.kind) {
+        case "step":
+            return [selector.stepId];
+        case "object":
+            return Object.values(selector.fields).flatMap(referencedStepIds);
+        case "array":
+            return selector.items.flatMap(referencedStepIds);
+        default:
+            return [];
+    }
+}
+/** True if the selector (recursively) uses mapItem — only legal inside a map child. */
+export function usesMapItem(selector) {
+    switch (selector.kind) {
+        case "mapItem":
+            return true;
+        case "object":
+            return Object.values(selector.fields).some(usesMapItem);
+        case "array":
+            return selector.items.some(usesMapItem);
+        default:
+            return false;
+    }
+}

package/node_modules/@reasonlayer/protocol/dist/tasks.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The task contract (spec §7.1). The task row in Convex is the protocol
+ * runners speak — not the workflow component. Cloud runners and device
+ * daemons claim and complete tasks through scoped credentials.
+ */
+import type { EnvironmentIR, HostIR } from "./ir.js";
+export type TaskKind = "code" | "agent" | "action";
+export type TaskStatus = "queued" | "dispatching" | "spawning" | "claimed" | "done" | "canceled" | "expired";
+/** Identifies one step execution attempt; carried by reporting credentials, not repeated per event (spec §8.1). */
+export interface StepLocator {
+    runId: string;
+    stepId: string;
+    invocationKey: string;
+    attempt: number;
+}
+interface TaskSpecBase extends StepLocator {
+    taskId: string;
+    orgId: string;
+    input: unknown;
+    /** JSON text because Convex values reject JSON Schema's `$schema` key. */
+    outputSchemaJsonText: string;
+    timeoutMs?: number;
+    host: HostIR;
+}
+interface BundleTaskSpecBase extends TaskSpecBase {
+    /** Download URL for the runner bundle that contains this step's export. */
+    bundleUrl: string | null;
+    /** Hex sha256 of the bundle bytes; runners verify after download. */
+    bundleSha256?: string;
+    /** The step id inside the bundle; map children use mapChildId(mapId). */
+    entryStepId: string;
+    moduleRef: string;
+    exportName: string;
+    /** Secrets injected only into the claim response; never persisted or logged. */
+    env: Record<string, string>;
+    environmentHash?: string;
+    environment?: EnvironmentIR;
+    templateAlias?: string;
+}
+export interface CodeTaskSpec extends BundleTaskSpecBase {
+    kind: "code";
+}
+export interface AgentTaskSpec extends BundleTaskSpecBase {
+    kind: "agent";
+    framework: "flue";
+    catalogTools: string[];
+}
+export interface ActionTaskSpec extends TaskSpecBase {
+    kind: "action";
+    /** Stable Reasonlayer catalog action id; provider details remain server-side. */
+    actionId: string;
+}
+export type TaskSpec = CodeTaskSpec | AgentTaskSpec | ActionTaskSpec;
+/** The terminal report a runner produces. */
+export type TaskResult = {
+    kind: "ok";
+    output: unknown;
+} | {
+    kind: "error";
+    message: string;
+    stack?: string;
+} | {
+    kind: "canceled";
+};
+/** What the engine's awaited task event resolves with (timeout comes from the sentinel, not the runner). */
+export type TaskEvent = TaskResult | {
+    kind: "timeout";
+};
+export {};

package/node_modules/@reasonlayer/protocol/dist/tasks.js

@@ -0,0 +1,6 @@
+/**
+ * The task contract (spec §7.1). The task row in Convex is the protocol
+ * runners speak — not the workflow component. Cloud runners and device
+ * daemons claim and complete tasks through scoped credentials.
+ */
+export {};

package/node_modules/@reasonlayer/protocol/dist/validate.d.ts

@@ -0,0 +1,6 @@
+/**
+ * JSON Schema validation shared by the Convex engine and SDK test kit. The
+ * validator uses no codegen, so it remains safe for Convex runtime code.
+ */
+import type { JsonSchema } from "./ir.js";
+export declare function validateAgainstSchema(value: unknown, schema: JsonSchema, what: string): void;

package/node_modules/@reasonlayer/protocol/dist/validate.js

@@ -0,0 +1,18 @@
+/**
+ * JSON Schema validation shared by the Convex engine and SDK test kit. The
+ * validator uses no codegen, so it remains safe for Convex runtime code.
+ */
+import { Validator } from "@cfworker/json-schema";
+export function validateAgainstSchema(value, schema, what) {
+    // @cfworker/json-schema annotates schemas while dereferencing them.
+    const mutableSchema = JSON.parse(JSON.stringify(schema));
+    const validator = new Validator(mutableSchema, "7", false);
+    const result = validator.validate(value);
+    if (!result.valid) {
+        const details = result.errors
+            .slice(0, 5)
+            .map((e) => `${e.instanceLocation}: ${e.error}`)
+            .join("; ");
+        throw new Error(`${what} does not match schema — ${details}`);
+    }
+}

package/node_modules/@reasonlayer/protocol/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@reasonlayer/protocol",
+  "version": "0.1.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "type": "module",
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run --passWithNoTests",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}

package/node_modules/@reasonlayer/runner/dist/environment-materializer.d.ts

@@ -0,0 +1,13 @@
+import { type EnvironmentIR } from "@reasonlayer/protocol";
+import { NodeSandboxApi } from "./sandbox-env.js";
+export interface MaterializedEnvironment {
+    prefix: string;
+    env: Record<string, string>;
+}
+export type EnvironmentExec = NodeSandboxApi["exec"];
+export interface EnvironmentMaterializerOptions {
+    /** Test seam; production uses NodeSandboxApi rooted at process.cwd(). */
+    exec?: EnvironmentExec;
+}
+export declare function materializeEnvironment(environment: EnvironmentIR, rootDir?: string, options?: EnvironmentMaterializerOptions): Promise<MaterializedEnvironment>;
+export declare function verifyEnvironmentBinaries(environment: EnvironmentIR, options?: EnvironmentMaterializerOptions): Promise<void>;

package/node_modules/@reasonlayer/runner/dist/environment-materializer.js

@@ -0,0 +1,92 @@
+import { constants } from "node:fs";
+import { access, mkdir, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { declaredEnvironmentExecutables, shellQuote, } from "@reasonlayer/protocol";
+import { NodeSandboxApi } from "./sandbox-env.js";
+function defaultExec() {
+    const api = new NodeSandboxApi({ cwd: process.cwd() });
+    return api.exec.bind(api);
+}
+function pathWith(...entries) {
+    return [...entries, process.env["PATH"] ?? ""].filter(Boolean).join(":");
+}
+async function exists(path) {
+    try {
+        await access(path, constants.F_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function materializeEnvironment(environment, rootDir = join(process.cwd(), ".rl", "environments"), options = {}) {
+    const prefix = join(rootDir, environment.envHash);
+    const readyFile = join(prefix, ".ready");
+    const binDir = join(prefix, "bin");
+    const venvDir = join(prefix, "venv");
+    const venvBinDir = join(venvDir, "bin");
+    const rootfsDir = join(prefix, "rootfs");
+    const exec = options.exec ?? defaultExec();
+    await mkdir(prefix, { recursive: true });
+    await mkdir(rootfsDir, { recursive: true });
+    if (!(await exists(readyFile))) {
+        await mkdir(binDir, { recursive: true });
+        if (environment.npm?.length) {
+            const result = await exec(`npm install --global --prefix ${shellQuote(prefix)} ${environment.npm.map(shellQuote).join(" ")}`, { timeoutMs: 10 * 60 * 1000 });
+            if (result.exitCode !== 0)
+                throw new Error(`npm environment install failed: ${result.stderr}`);
+        }
+        if (environment.pip?.length) {
+            const create = await exec(`python3 -m venv ${shellQuote(venvDir)}`, {
+                timeoutMs: 2 * 60 * 1000,
+            });
+            if (create.exitCode !== 0)
+                throw new Error(`python venv creation failed: ${create.stderr}`);
+            const install = await exec(`${shellQuote(join(venvBinDir, "pip"))} install ${environment.pip.map(shellQuote).join(" ")}`, { timeoutMs: 10 * 60 * 1000 });
+            if (install.exitCode !== 0)
+                throw new Error(`pip environment install failed: ${install.stderr}`);
+        }
+        for (const executable of declaredEnvironmentExecutables(environment)) {
+            const result = await exec(`command -v ${shellQuote(executable)}`, { timeoutMs: 10_000 });
+            if (result.exitCode !== 0) {
+                throw new Error(`declared executable "${executable}" is not installed locally`);
+            }
+        }
+        for (const file of environment.files ?? []) {
+            const localDest = join(rootfsDir, file.path.replace(/^\/+/, ""));
+            await mkdir(dirname(localDest), { recursive: true });
+            await writeFile(localDest, Buffer.from(file.contentBase64, "base64"));
+        }
+        const env = {
+            PATH: pathWith(binDir, venvBinDir),
+            RL_ENV_PREFIX: prefix,
+            RL_ENV_ROOTFS: rootfsDir,
+        };
+        for (const command of environment.setup ?? []) {
+            const result = await exec(command, { cwd: rootfsDir, env, timeoutMs: 10 * 60 * 1000 });
+            if (result.exitCode !== 0)
+                throw new Error(`environment setup failed: ${result.stderr}`);
+        }
+        await writeFile(readyFile, `${new Date().toISOString()}\n`);
+    }
+    return {
+        prefix,
+        env: {
+            PATH: pathWith(binDir, venvBinDir),
+            RL_ENV_PREFIX: prefix,
+            RL_ENV_ROOTFS: rootfsDir,
+        },
+    };
+}
+export async function verifyEnvironmentBinaries(environment, options = {}) {
+    const exec = options.exec ?? defaultExec();
+    const missing = [];
+    for (const executable of declaredEnvironmentExecutables(environment)) {
+        const result = await exec(`command -v ${shellQuote(executable)}`, { timeoutMs: 10_000 });
+        if (result.exitCode !== 0)
+            missing.push(executable);
+    }
+    if (missing.length > 0) {
+        throw new Error(`device is missing declared environment binaries: ${missing.join(", ")}`);
+    }
+}