@sema-agent/server 1.185.0

package/dist/audit.d.ts

@@ -0,0 +1,29 @@
+import type { Pool } from "mysql2/promise";
+import type { Pool as PgPool } from "pg";
+export interface SessionAudit {
+    sessionId: string;
+    createdAt: string;
+    floorEntryId: string | null;
+    thinkingLevel: string;
+    model: {
+        provider: string;
+        modelId: string;
+    } | null;
+    messages: unknown[];
+}
+export declare function buildSessionAudit(pool: Pool, sessionId: string): Promise<SessionAudit | undefined>;
+export declare function buildSessionAuditPg(pool: PgPool, sessionId: string): Promise<SessionAudit | undefined>;
+export declare function buildSessionAuditLocal(root: string, sessionId: string): Promise<SessionAudit | undefined>;
+export declare function windowMessages(messages: unknown[], opts: {
+    tail?: number;
+    before?: number;
+    limit?: number;
+}): {
+    messages: unknown[];
+    window: {
+        offset: number;
+        total: number;
+    };
+};
+export declare function truncateMessageBlobs(messages: unknown[], capBytes: number): unknown[];
+//# sourceMappingURL=audit.d.ts.map

package/dist/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,IAAI,CAAC;AAUzC,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAElB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAEpD,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAGD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAExG;AAKD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAE5G;AAMD,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAa/G;AAkCD,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,OAAO,EAAE,EACnB,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAWpE;AAMD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE,CA+BrF"}

package/dist/audit.js

@@ -0,0 +1,95 @@
+import { Session, FileSessionRepo, InMemorySessionStorage, boundedTail } from "@sema-agent/core";
+import { TiDBSessionStorage } from "./plugins/tidb-session-storage.js";
+import { PgSessionStorage } from "./plugins/pg-session-storage.js";
+export async function buildSessionAudit(pool, sessionId) {
+    return auditFromStorage(await TiDBSessionStorage.wake(pool, sessionId), sessionId);
+}
+export async function buildSessionAuditPg(pool, sessionId) {
+    return auditFromStorage(await PgSessionStorage.wake(pool, sessionId), sessionId);
+}
+export async function buildSessionAuditLocal(root, sessionId) {
+    const repo = new FileSessionRepo(root);
+    let entries;
+    try {
+        entries = await repo.exportEntries(sessionId);
+    }
+    catch (e) {
+        if (e.code === "not_found")
+            return undefined;
+        throw e;
+    }
+    const meta = (await repo.list()).find((m) => m.id === sessionId);
+    const { tail, floorEntryId } = boundedTail(entries);
+    const storage = new InMemorySessionStorage({ entries: tail, floorEntryId, ...(meta ? { metadata: meta } : {}) });
+    return auditFromStorage(storage, sessionId);
+}
+async function auditFromStorage(storage, sessionId) {
+    if (!storage)
+        return undefined;
+    const session = new Session(storage);
+    const meta = await session.getMetadata();
+    const ctx = await session.buildContext();
+    return {
+        sessionId,
+        createdAt: meta.createdAt,
+        floorEntryId: storage.getFloorId(),
+        thinkingLevel: ctx.thinkingLevel,
+        model: ctx.model,
+        messages: ctx.messages,
+    };
+}
+export function windowMessages(messages, opts) {
+    const total = messages.length;
+    if (opts.before !== undefined) {
+        const before = Math.max(0, Math.min(total, Math.floor(opts.before)));
+        const limit = Math.max(1, Math.floor(opts.limit ?? 50));
+        const offset = Math.max(0, before - limit);
+        return { messages: messages.slice(offset, before), window: { offset, total } };
+    }
+    const tail = Math.max(1, Math.floor(opts.tail ?? total));
+    const offset = Math.max(0, total - tail);
+    return { messages: messages.slice(offset), window: { offset, total } };
+}
+export function truncateMessageBlobs(messages, capBytes) {
+    const capStr = (s) => Buffer.byteLength(s, "utf8") > capBytes ? `${s.slice(0, capBytes)}…[truncated ${Buffer.byteLength(s, "utf8")} bytes total]` : undefined;
+    return messages.map((m) => {
+        if (m === null || typeof m !== "object")
+            return m;
+        const msg = m;
+        let touched = false;
+        let content = msg.content;
+        if (typeof content === "string") {
+            const t = capStr(content);
+            if (t !== undefined) {
+                content = t;
+                touched = true;
+            }
+        }
+        else if (Array.isArray(content)) {
+            const parts = content.map((p) => {
+                if (p === null || typeof p !== "object")
+                    return p;
+                const part = p;
+                const out = { ...part };
+                let pTouched = false;
+                for (const key of ["text", "content"]) {
+                    const v = part[key];
+                    if (typeof v === "string") {
+                        const t = capStr(v);
+                        if (t !== undefined) {
+                            out[key] = t;
+                            pTouched = true;
+                        }
+                    }
+                }
+                if (pTouched)
+                    touched = true;
+                return pTouched ? out : p;
+            });
+            if (touched)
+                content = parts;
+        }
+        return touched ? { ...msg, content, truncated: true } : m;
+    });
+}
+//# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGjG,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAoBnE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAU,EAAE,SAAiB;IACnE,OAAO,gBAAgB,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;AACrF,CAAC;AAKD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,SAAiB;IACvE,OAAO,gBAAgB,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;AACnF,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAY,EAAE,SAAiB;IAC1E,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAAuB,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,SAAS,CAAC;QACpE,MAAM,CAAC,CAAC;IACV,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;IACjE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,sBAAsB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACjH,OAAO,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAGD,KAAK,UAAU,gBAAgB,CAC7B,OAA4F,EAC5F,SAAiB;IAEjB,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;IACzC,OAAO;QACL,SAAS;QACT,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,YAAY,EAAE,OAAO,CAAC,UAAU,EAAE;QAClC,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC;AACJ,CAAC;AAeD,MAAM,UAAU,cAAc,CAC5B,QAAmB,EACnB,IAAwD;IAExD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;QAC3C,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC;IACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;AACzE,CAAC;AAMD,MAAM,UAAU,oBAAoB,CAAC,QAAmB,EAAE,QAAgB;IACxE,MAAM,MAAM,GAAG,CAAC,CAAS,EAAsB,EAAE,CAC/C,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,eAAe,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1I,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACxB,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,CAA4B,CAAC;QACzC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC1B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAAC,OAAO,GAAG,CAAC,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC;YAAC,CAAC;QACvD,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC9B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,OAAO,CAAC,CAAC;gBAClD,MAAM,IAAI,GAAG,CAA4B,CAAC;gBAC1C,MAAM,GAAG,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;gBACjD,IAAI,QAAQ,GAAG,KAAK,CAAC;gBACrB,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,CAAU,EAAE,CAAC;oBAC/C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;oBACpB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;wBAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;wBACpB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;4BAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;4BAAC,QAAQ,GAAG,IAAI,CAAC;wBAAC,CAAC;oBACzD,CAAC;gBACH,CAAC;gBACD,IAAI,QAAQ;oBAAE,OAAO,GAAG,IAAI,CAAC;gBAC7B,OAAO,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;YACH,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,CAAC;QAC/B,CAAC;QACD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth-bridge.d.ts

@@ -0,0 +1,29 @@
+import { type AuthBridgeErrorCode, type VerifiedIdentity } from "@sema-agent/registry-core/api/auth-bridge";
+import type { Logger } from "./observability/logger.js";
+import type { Metrics } from "./observability/metrics.js";
+export type { VerifiedIdentity } from "@sema-agent/registry-core/api/auth-bridge";
+export { looksLikeJwt } from "@sema-agent/registry-core/api/auth-bridge";
+export interface RegistryJwtVerifierOptions {
+    issuer: string;
+    jwksUrl?: string;
+    audience?: string;
+    clockSkewSec?: number;
+    jwksRefreshMinIntervalSec?: number;
+    offlineGraceSec?: number;
+    jwksTtlSec?: number;
+    logger?: Logger;
+    metrics?: Pick<Metrics, "inc" | "observe">;
+    fetchImpl?: typeof fetch;
+    nowMs?: () => number;
+}
+export type VerifyOutcome = {
+    ok: true;
+    identity: VerifiedIdentity;
+} | {
+    ok: false;
+    error: AuthBridgeErrorCode;
+};
+export declare function createRegistryJwtVerifier(opts: RegistryJwtVerifierOptions): {
+    verify: (bearer: string) => Promise<VerifyOutcome>;
+};
+//# sourceMappingURL=auth-bridge.d.ts.map

package/dist/auth-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-bridge.d.ts","sourceRoot":"","sources":["../src/auth-bridge.ts"],"names":[],"mappings":"AAYA,OAAO,EAWL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACtB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAE1D,YAAY,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAEzE,MAAM,WAAW,0BAA0B;IAEzC,MAAM,EAAE,MAAM,CAAC;IAEf,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,GAAG,SAAS,CAAC,CAAC;IAE3C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,aAAa,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,CAAC;AA6BjH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,0BAA0B,GAAG;IAAE,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAA;CAAE,CAwIlI"}

package/dist/auth-bridge.js

@@ -0,0 +1,145 @@
+import { createPublicKey, verify as cryptoVerify } from "node:crypto";
+import { AUTH_BRIDGE_ALGS, DEFAULT_CLOCK_SKEW_SEC, DEFAULT_JWKS_REFRESH_MIN_INTERVAL_SEC, DEFAULT_OFFLINE_GRACE_SEC, REGISTRY_JWKS_PATH, RegistryJwks, classifyTimeClaims, jwksWithinOfflineGrace, shouldForceJwksRefresh, toVerifiedIdentity, } from "@sema-agent/registry-core/api/auth-bridge";
+export { looksLikeJwt } from "@sema-agent/registry-core/api/auth-bridge";
+const DEFAULT_JWKS_TTL_SEC = 15 * 60;
+const MAX_JWKS_BYTES = 256 * 1024;
+const MAX_TOKEN_CHARS = 16 * 1024;
+const MAX_SEGMENT_BYTES = 64 * 1024;
+const B64URL_RE = /^[A-Za-z0-9_-]+$/;
+function b64urlJson(seg) {
+    if (seg.length > MAX_SEGMENT_BYTES || !B64URL_RE.test(seg))
+        return undefined;
+    try {
+        const parsed = JSON.parse(Buffer.from(seg, "base64url").toString("utf8"));
+        return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+const stripSlash = (s) => s.replace(/\/+$/, "");
+export function createRegistryJwtVerifier(opts) {
+    const issuer = stripSlash(opts.issuer);
+    const jwksUrl = opts.jwksUrl ?? `${issuer}${REGISTRY_JWKS_PATH}`;
+    const clockSkewSec = opts.clockSkewSec ?? DEFAULT_CLOCK_SKEW_SEC;
+    const refreshMin = opts.jwksRefreshMinIntervalSec ?? DEFAULT_JWKS_REFRESH_MIN_INTERVAL_SEC;
+    const offlineGraceSec = opts.offlineGraceSec ?? DEFAULT_OFFLINE_GRACE_SEC;
+    const jwksTtlSec = opts.jwksTtlSec ?? DEFAULT_JWKS_TTL_SEC;
+    const doFetch = opts.fetchImpl ?? fetch;
+    const now = opts.nowMs ?? Date.now;
+    const keys = new Map();
+    let lastFetchAttemptMs;
+    let lastFetchSuccessMs;
+    let inflight;
+    const fail = (error, kid) => {
+        opts.metrics?.inc("auth_bridge_verify_total", { outcome: error });
+        opts.logger?.warn?.("auth_bridge_rejected", { error, ...(kid ? { kid: kid.slice(0, 128) } : {}), iss: issuer });
+        return { ok: false, error };
+    };
+    async function refreshJwks() {
+        if (inflight)
+            return inflight;
+        inflight = (async () => {
+            lastFetchAttemptMs = now();
+            try {
+                const res = await doFetch(jwksUrl, { redirect: "error", signal: AbortSignal.timeout(10_000) });
+                if (!res.ok)
+                    throw new Error(`jwks HTTP ${res.status}`);
+                const cl = Number(res.headers.get("content-length"));
+                if (Number.isFinite(cl) && cl > MAX_JWKS_BYTES)
+                    throw new Error("jwks content-length too large");
+                const buf = Buffer.from(await res.arrayBuffer());
+                if (buf.byteLength > MAX_JWKS_BYTES)
+                    throw new Error("jwks body too large");
+                const doc = RegistryJwks.parse(JSON.parse(buf.toString("utf8")));
+                const next = new Map();
+                for (const k of doc.keys) {
+                    try {
+                        next.set(k.kid, createPublicKey({ key: { kty: "RSA", n: k.n, e: k.e }, format: "jwk" }));
+                    }
+                    catch {
+                        opts.logger?.warn?.("auth_bridge_jwk_unusable", { kid: k.kid.slice(0, 128), iss: issuer });
+                    }
+                }
+                keys.clear();
+                for (const [kid, key] of next)
+                    keys.set(kid, key);
+                lastFetchSuccessMs = now();
+            }
+            catch (e) {
+                opts.logger?.warn?.("auth_bridge_jwks_fetch_failed", { iss: issuer, error: String(e).slice(0, 200) });
+            }
+            finally {
+                inflight = undefined;
+            }
+        })();
+        return inflight;
+    }
+    async function verify(bearer) {
+        const t0 = now();
+        try {
+            return await verifyInner(bearer);
+        }
+        finally {
+            opts.metrics?.observe("auth_bridge_verify_seconds", (now() - t0) / 1000);
+        }
+    }
+    async function verifyInner(bearer) {
+        if (bearer.length > MAX_TOKEN_CHARS)
+            return fail("malformed");
+        const parts = bearer.split(".");
+        if (parts.length !== 3 || parts.some((p) => p.length === 0) || !B64URL_RE.test(parts[2]))
+            return fail("malformed");
+        const header = b64urlJson(parts[0]);
+        const payload = b64urlJson(parts[1]);
+        if (!header || !payload)
+            return fail("malformed");
+        if (header.alg !== AUTH_BRIDGE_ALGS[0])
+            return fail("malformed");
+        const kid = typeof header.kid === "string" ? header.kid : undefined;
+        if (!kid)
+            return fail("malformed");
+        const iss = typeof payload.iss === "string" ? stripSlash(payload.iss) : undefined;
+        if (iss !== issuer)
+            return fail("unknown_issuer", kid);
+        if (classifyTimeClaims(payload, Math.floor(now() / 1000), clockSkewSec) !== "ok")
+            return fail("expired", kid);
+        const snapshot = () => ({ cachedKids: [...keys.keys()], lastFetchAttemptMs, nowMs: now() });
+        if (keys.has(kid)) {
+            const ttlStale = lastFetchSuccessMs === undefined || now() - lastFetchSuccessMs > jwksTtlSec * 1000;
+            if (ttlStale && !inflight && (lastFetchAttemptMs === undefined || now() - lastFetchAttemptMs >= refreshMin * 1000)) {
+                void refreshJwks();
+            }
+        }
+        else {
+            if (inflight)
+                await inflight;
+            if (!keys.has(kid) && shouldForceJwksRefresh(kid, snapshot(), { jwksRefreshMinIntervalSec: refreshMin }))
+                await refreshJwks();
+        }
+        const key = keys.get(kid);
+        if (!key) {
+            const graceOk = lastFetchSuccessMs !== undefined && jwksWithinOfflineGrace({ lastFetchSuccessMs, nowMs: now() }, { offlineGraceSec });
+            return graceOk ? fail("invalid_signature", kid) : fail("jwks_unavailable", kid);
+        }
+        if (lastFetchSuccessMs !== undefined && !jwksWithinOfflineGrace({ lastFetchSuccessMs, nowMs: now() }, { offlineGraceSec })) {
+            return fail("jwks_unavailable", kid);
+        }
+        let sigOk = false;
+        try {
+            sigOk = cryptoVerify("RSA-SHA256", Buffer.from(`${parts[0]}.${parts[1]}`, "utf8"), key, Buffer.from(parts[2], "base64url"));
+        }
+        catch {
+            sigOk = false;
+        }
+        if (!sigOk)
+            return fail("invalid_signature", kid);
+        const mapped = toVerifiedIdentity(payload, opts.audience ? { audience: opts.audience } : undefined);
+        if (!mapped.ok)
+            return fail(mapped.error, kid);
+        opts.metrics?.inc("auth_bridge_verify_total", { outcome: "ok" });
+        return { ok: true, identity: mapped.identity };
+    }
+    return { verify };
+}
+//# sourceMappingURL=auth-bridge.js.map

package/dist/auth-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-bridge.js","sourceRoot":"","sources":["../src/auth-bridge.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,YAAY,EAAkB,MAAM,aAAa,CAAC;AACtF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,qCAAqC,EACrC,yBAAyB,EACzB,kBAAkB,EAClB,YAAY,EACZ,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,GAGnB,MAAM,2CAA2C,CAAC;AAKnD,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAuBzE,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,CAAC;AAErC,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC;AAElC,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAC;AAElC,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC;AAGpC,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,GAAG,CAAC,MAAM,GAAG,iBAAiB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACnF,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnI,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAMhE,MAAM,UAAU,yBAAyB,CAAC,IAAgC;IACxE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,GAAG,MAAM,GAAG,kBAAkB,EAAE,CAAC;IACjE,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,sBAAsB,CAAC;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,yBAAyB,IAAI,qCAAqC,CAAC;IAC3F,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,yBAAyB,CAAC;IAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,oBAAoB,CAAC;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IAGnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,IAAI,kBAAsC,CAAC;IAC3C,IAAI,kBAAsC,CAAC;IAC3C,IAAI,QAAmC,CAAC;IAExC,MAAM,IAAI,GAAG,CAAC,KAA0B,EAAE,GAAY,EAA6C,EAAE;QACnG,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,0BAA0B,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAElE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAChH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC,CAAC;IAEF,KAAK,UAAU,WAAW;QACxB,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;YACrB,kBAAkB,GAAG,GAAG,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC/F,IAAI,CAAC,GAAG,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBAGxD,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,cAAc;oBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;gBACjG,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;gBACjD,IAAI,GAAG,CAAC,UAAU,GAAG,cAAc;oBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBAC5E,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACjE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;gBAC1C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;oBACzB,IAAI,CAAC;wBAEH,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;oBAC3F,CAAC;oBAAC,MAAM,CAAC;wBACP,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,0BAA0B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC7F,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI;oBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAClD,kBAAkB,GAAG,GAAG,EAAE,CAAC;YAC7B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAEX,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,+BAA+B,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACxG,CAAC;oBAAS,CAAC;gBACT,QAAQ,GAAG,SAAS,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,MAAc;QAGlC,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,4BAA4B,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,MAAc;QACvC,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEhC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;QACpH,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;QAKlD,IAAI,MAAM,CAAC,GAAG,KAAK,gBAAgB,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;QAGnC,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QAGvD,IAAI,kBAAkB,CAAC,OAAyC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,YAAY,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAKhJ,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5F,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,kBAAkB,KAAK,SAAS,IAAI,GAAG,EAAE,GAAG,kBAAkB,GAAG,UAAU,GAAG,IAAI,CAAC;YACpG,IAAI,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,kBAAkB,KAAK,SAAS,IAAI,GAAG,EAAE,GAAG,kBAAkB,IAAI,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC;gBACnH,KAAK,WAAW,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,QAAQ;gBAAE,MAAM,QAAQ,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,sBAAsB,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,yBAAyB,EAAE,UAAU,EAAE,CAAC;gBAAE,MAAM,WAAW,EAAE,CAAC;QAChI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;YAIT,MAAM,OAAO,GAAG,kBAAkB,KAAK,SAAS,IAAI,sBAAsB,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;YACtI,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,kBAAkB,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;YAE3H,OAAO,IAAI,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;QAGD,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QAC/H,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,KAAK,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;QAGlD,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAA0E,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvK,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,0BAA0B,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IACjD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC"}

package/dist/bake-runner/main.d.ts

@@ -0,0 +1,20 @@
+import { type ImageApiClient, type ChildSpawner, type HostOps } from "./runner.js";
+interface RunnerEnv {
+    imageApiBase: string;
+    token: string;
+    runnerId: string;
+    recipeRef: string;
+    buildShPath: string;
+    recipeDir: string;
+    dataDir: string;
+    heartbeatMs: number;
+    idlePollMs: number;
+    minFreeGb: number;
+}
+declare function loadEnv(): RunnerEnv;
+declare function makeApiClient(env: RunnerEnv): ImageApiClient;
+declare function makeSpawner(): ChildSpawner;
+declare function makeHostOps(env: RunnerEnv): HostOps;
+declare function main(): Promise<void>;
+export { main, loadEnv, makeApiClient, makeSpawner, makeHostOps };
+//# sourceMappingURL=main.d.ts.map

package/dist/bake-runner/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/bake-runner/main.ts"],"names":[],"mappings":"AAaA,OAAO,EAEL,KAAK,cAAc,EAGnB,KAAK,YAAY,EAEjB,KAAK,OAAO,EAEb,MAAM,aAAa,CAAC;AAIrB,UAAU,SAAS;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iBAAS,OAAO,IAAI,SAAS,CAkB5B;AAID,iBAAS,aAAa,CAAC,GAAG,EAAE,SAAS,GAAG,cAAc,CAuDrD;AAID,iBAAS,WAAW,IAAI,YAAY,CA6BnC;AAuBD,iBAAS,WAAW,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAiD5C;AAeD,iBAAe,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAgCnC;AAYD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC"}

package/dist/bake-runner/main.js

@@ -0,0 +1,216 @@
+import { spawn, exec as execCb } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { promisify } from "node:util";
+import { createLogger } from "../observability/logger.js";
+import { BakeRunner, } from "./runner.js";
+const exec = promisify(execCb);
+function loadEnv() {
+    const need = (k) => {
+        const v = process.env[k];
+        if (!v)
+            throw new Error(`bake-runner: missing required env ${k}`);
+        return v;
+    };
+    return {
+        imageApiBase: need("IMAGE_API_BASE").replace(/\/+$/, ""),
+        token: need("BAKE_RUNNER_TOKEN"),
+        runnerId: process.env.BAKE_RUNNER_ID || `bake-runner-${process.env.HOSTNAME || "build-host"}`,
+        recipeRef: process.env.RECIPE_REF || "HEAD",
+        recipeDir: process.env.RECIPE_DIR || "/opt/recipes",
+        buildShPath: process.env.BUILD_SH_PATH || "e2b-template/dev-sandbox/build.sh",
+        dataDir: process.env.BAKE_DATA_DIR || "/data",
+        heartbeatMs: Number(process.env.BAKE_HEARTBEAT_MS || "30000"),
+        idlePollMs: Number(process.env.BAKE_IDLE_POLL_MS || "5000"),
+        minFreeGb: Number(process.env.IMAGE_BAKE_MIN_FREE_GB || "20"),
+    };
+}
+function makeApiClient(env) {
+    const auth = { authorization: `Bearer ${env.token}`, "content-type": "application/json" };
+    return {
+        async claimNext() {
+            const res = await fetch(`${env.imageApiBase}/v1/images/bakes/claim`, {
+                method: "POST",
+                headers: auth,
+                body: JSON.stringify({ runnerId: env.runnerId }),
+            });
+            if (res.status === 204 || res.status === 409)
+                return null;
+            if (!res.ok)
+                return null;
+            const c = (await res.json());
+            if (!c.bakeId || !Array.isArray(c.argv) || !c.ingestSecret)
+                return null;
+            return {
+                bakeId: c.bakeId,
+                argv: c.argv.map(String),
+                push: Boolean(c.push),
+                dryRun: Boolean(c.dryRun),
+                logs: Boolean(c.logs),
+                ingestSecret: c.ingestSecret,
+                profile: c.profile ?? null,
+                bands: Array.isArray(c.bands) ? c.bands.map(String) : null,
+            };
+        },
+        async ingest(bakeId, ingestSecret, frame) {
+            const res = await fetch(`${env.imageApiBase}/v1/images/bakes/${encodeURIComponent(bakeId)}/ingest`, {
+                method: "POST",
+                headers: { ...auth, "x-bake-ingest-secret": ingestSecret },
+                body: JSON.stringify(frame),
+            });
+            const body = res.ok ? (await res.json().catch(() => ({}))) : {};
+            return {
+                accepted: res.ok && body.accepted !== false,
+                cancelRequested: body.cancelRequested === true,
+                leaseValid: res.status !== 409,
+            };
+        },
+        async heartbeat(bakeId, ingestSecret) {
+            const res = await fetch(`${env.imageApiBase}/v1/images/bakes/${encodeURIComponent(bakeId)}/ingest`, {
+                method: "POST",
+                headers: { ...auth, "x-bake-ingest-secret": ingestSecret },
+                body: JSON.stringify({ event: "heartbeat" }),
+            });
+            const body = res.ok ? (await res.json().catch(() => ({}))) : {};
+            return {
+                accepted: res.ok,
+                cancelRequested: body.cancelRequested === true,
+                leaseValid: res.status !== 409,
+            };
+        },
+    };
+}
+function makeSpawner() {
+    return {
+        spawn(opts) {
+            const child = spawn(opts.argv[0], opts.argv.slice(1), {
+                cwd: opts.cwd,
+                detached: true,
+                stdio: ["ignore", "pipe", "pipe"],
+                env: process.env,
+            });
+            const pgid = child.pid ?? -1;
+            bufferLines(child.stdout, opts.onStdoutLine);
+            bufferLines(child.stderr, opts.onStderrLine);
+            const exited = new Promise((resolve) => {
+                child.on("exit", (code, signal) => resolve({ code, signal }));
+                child.on("error", () => resolve({ code: 127, signal: null }));
+            });
+            const handle = {
+                pgid,
+                exited,
+                killGroup(signal) {
+                    if (pgid > 0)
+                        process.kill(-pgid, signal);
+                },
+            };
+            return handle;
+        },
+    };
+}
+function bufferLines(stream, onLine) {
+    if (!stream)
+        return;
+    let buf = "";
+    stream.setEncoding("utf8");
+    stream.on("data", (chunk) => {
+        buf += chunk;
+        let idx = buf.indexOf("\n");
+        while (idx >= 0) {
+            onLine(buf.slice(0, idx));
+            buf = buf.slice(idx + 1);
+            idx = buf.indexOf("\n");
+        }
+    });
+    stream.on("end", () => {
+        if (buf.length > 0)
+            onLine(buf);
+    });
+}
+function makeHostOps(env) {
+    return {
+        async readManifest(path) {
+            return JSON.parse(await readFile(path, "utf8"));
+        },
+        async dfData() {
+            const { stdout } = await exec(`df -P -BG ${shellSafe(env.dataDir)}`);
+            return stdout;
+        },
+        async checkoutRecipe(ref) {
+            if (ref && ref !== "HEAD") {
+                const dir = shellSafe(env.recipeDir);
+                try {
+                    await exec(`git -C ${dir} fetch --depth 1 origin ${shellSafe(ref)} && ` +
+                        `git -C ${dir} checkout --quiet --detach FETCH_HEAD`);
+                }
+                catch {
+                    await exec(`git -C ${dir} fetch origin && git -C ${dir} checkout --quiet --detach ${shellSafe(ref)}`);
+                }
+            }
+            return env.recipeDir;
+        },
+        async dockerPushRetry(tag, attempts) {
+            for (let i = 0; i < attempts; i++) {
+                try {
+                    await exec(`docker push ${shellSafe(tag)}`);
+                    const { stdout } = await exec(`docker image inspect ${shellSafe(tag)} --format '{{index .RepoDigests 0}}'`);
+                    const repoDigest = stdout.trim();
+                    const digest = repoDigest.includes("@") ? repoDigest.slice(repoDigest.indexOf("@") + 1) : null;
+                    return { ok: true, digest };
+                }
+                catch {
+                    if (i < attempts - 1)
+                        await new Promise((r) => setTimeout(r, 2000 * (i + 1)));
+                }
+            }
+            return { ok: false, digest: null };
+        },
+    };
+}
+function shellSafe(s) {
+    return `'${s.replace(/'/g, "'\\''")}'`;
+}
+function makeClock() {
+    return {
+        now: () => Date.now(),
+        sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+    };
+}
+async function main() {
+    const env = loadEnv();
+    const log = createLogger(process.env.LOG_LEVEL || "info");
+    log.info("bake_runner_start", {
+        imageApiBase: env.imageApiBase,
+        runnerId: env.runnerId,
+        recipeRef: env.recipeRef,
+        heartbeatMs: env.heartbeatMs,
+        minFreeGb: env.minFreeGb,
+    });
+    const runner = new BakeRunner({
+        api: makeApiClient(env),
+        spawner: makeSpawner(),
+        host: makeHostOps(env),
+        clock: makeClock(),
+        log,
+        recipeRef: env.recipeRef,
+        buildShPath: env.buildShPath,
+        heartbeatMs: env.heartbeatMs,
+        idlePollMs: env.idlePollMs,
+        minFreeGb: env.minFreeGb,
+    });
+    const shutdown = (sig) => {
+        log.info("bake_runner_stop", { sig });
+        runner.stop();
+    };
+    process.on("SIGTERM", () => shutdown("SIGTERM"));
+    process.on("SIGINT", () => shutdown("SIGINT"));
+    await runner.loop();
+}
+const invokedDirectly = process.argv[1] !== undefined && /bake-runner[/\\]main\.(ts|js)$/.test(process.argv[1]);
+if (invokedDirectly) {
+    main().catch((err) => {
+        console.error(JSON.stringify({ ts: new Date().toISOString(), level: "error", msg: "bake_runner_fatal", err: String(err) }));
+        process.exit(1);
+    });
+}
+export { main, loadEnv, makeApiClient, makeSpawner, makeHostOps };
+//# sourceMappingURL=main.js.map

package/dist/bake-runner/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/bake-runner/main.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EACL,UAAU,GAQX,MAAM,aAAa,CAAC;AAErB,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;AAe/B,SAAS,OAAO;IACd,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE;QACjC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACxD,KAAK,EAAE,IAAI,CAAC,mBAAmB,CAAC;QAChC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,eAAe,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,YAAY,EAAE;QAC7F,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,MAAM;QAC3C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,cAAc;QACnD,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,mCAAmC;QAC7E,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO;QAC7C,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC;QAC7D,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,MAAM,CAAC;QAC3D,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,IAAI,CAAC;KAC9D,CAAC;AACJ,CAAC;AAID,SAAS,aAAa,CAAC,GAAc;IACnC,MAAM,IAAI,GAAG,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAE1F,OAAO;QAGL,KAAK,CAAC,SAAS;YACb,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,YAAY,wBAAwB,EAAE;gBACnE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;aACjD,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqC,CAAC;YACjE,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY;gBAAE,OAAO,IAAI,CAAC;YACxE,OAAO;gBACL,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,IAAI,EAAG,CAAC,CAAC,IAAkB,CAAC,GAAG,CAAC,MAAM,CAAC;gBACvC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;gBACrB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;gBACzB,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;gBACrB,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI;gBAC1B,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;aAC3D,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,YAAoB,EAAE,KAA8B;YAC/E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,YAAY,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,SAAS,EAAE;gBAClG,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,sBAAsB,EAAE,YAAY,EAAE;gBAC1D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;aAC5B,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,OAAO;gBACL,QAAQ,EAAE,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK;gBAC3C,eAAe,EAAE,IAAI,CAAC,eAAe,KAAK,IAAI;gBAC9C,UAAU,EAAE,GAAG,CAAC,MAAM,KAAK,GAAG;aAC/B,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,YAAoB;YAElD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,YAAY,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,SAAS,EAAE;gBAClG,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,sBAAsB,EAAE,YAAY,EAAE;gBAC1D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;aAC7C,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,OAAO;gBACL,QAAQ,EAAE,GAAG,CAAC,EAAE;gBAChB,eAAe,EAAE,IAAI,CAAC,eAAe,KAAK,IAAI;gBAC9C,UAAU,EAAE,GAAG,CAAC,MAAM,KAAK,GAAG;aAC/B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAID,SAAS,WAAW;IAClB,OAAO;QACL,KAAK,CAAC,IAAI;YAGR,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBACrD,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YAC7B,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC7C,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAI,OAAO,CAAiD,CAAC,OAAO,EAAE,EAAE;gBACrF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBAC9D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAChE,CAAC,CAAC,CAAC;YACH,MAAM,MAAM,GAAgB;gBAC1B,IAAI;gBACJ,MAAM;gBACN,SAAS,CAAC,MAAM;oBAEd,IAAI,IAAI,GAAG,CAAC;wBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC5C,CAAC;aACF,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAID,SAAS,WAAW,CAAC,MAAoC,EAAE,MAA8B;IACvF,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QAClC,GAAG,IAAI,KAAK,CAAC;QACb,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC1B,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YACzB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;QACpB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC;AAGD,SAAS,WAAW,CAAC,GAAc;IACjC,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,IAAY;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,KAAK,CAAC,MAAM;YACV,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACrE,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,GAAW;YAS9B,IAAI,GAAG,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,UAAU,GAAG,2BAA2B,SAAS,CAAC,GAAG,CAAC,MAAM;wBACrE,UAAU,GAAG,uCAAuC,CAAC,CAAC;gBAC1D,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,CAAC,UAAU,GAAG,2BAA2B,GAAG,8BAA8B,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxG,CAAC;YACH,CAAC;YAGD,OAAO,GAAG,CAAC,SAAS,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,GAAW,EAAE,QAAgB;YAIjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,eAAe,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,SAAS,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;oBAC5G,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;oBACjC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBAC/F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC;wBAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC;AAID,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACzC,CAAC;AAED,SAAS,SAAS;IAChB,OAAO;QACL,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACrB,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,GAAG,GAAG,YAAY,CAAE,OAAO,CAAC,GAAG,CAAC,SAAiD,IAAI,MAAM,CAAC,CAAC;IACnG,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE;QAC5B,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;QAC5B,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC;QACvB,OAAO,EAAE,WAAW,EAAE;QACtB,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC;QACtB,KAAK,EAAE,SAAS,EAAE;QAClB,GAAG;QACH,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAQ,EAAE;QACrC,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/C,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAGD,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAChH,IAAI,eAAe,EAAE,CAAC;IACpB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAEnB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5H,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC"}

package/dist/bake-runner/protocol.d.ts

@@ -0,0 +1,49 @@
+export type BuildShEvent = {
+    event: "resolved";
+    [k: string]: unknown;
+} | {
+    event: "state";
+    state: string;
+    [k: string]: unknown;
+} | {
+    event: "step";
+    step: string;
+    status: string;
+    [k: string]: unknown;
+} | {
+    event: "image";
+    tag?: string;
+    digest?: string;
+    localId?: string;
+    [k: string]: unknown;
+} | {
+    event: "manifest";
+    path?: string;
+    sha256?: string;
+    [k: string]: unknown;
+} | {
+    event: "done";
+    status: string;
+    [k: string]: unknown;
+} | {
+    event: string;
+    [k: string]: unknown;
+};
+export interface IngestFrame {
+    event: string;
+    lineOrd: number;
+    [k: string]: unknown;
+}
+export declare function parseBuildShLine(raw: string): BuildShEvent | null;
+export declare function lineToFrame(raw: string, lineOrd: number): IngestFrame;
+export declare function dockerBuildTickFrame(lineOrd: number, elapsedSec: number): IngestFrame;
+export declare function synthDoneFrame(lineOrd: number, kind: "cancelled" | "timeout", detail?: {
+    error?: string;
+}): IngestFrame;
+export declare function exitDoneFrame(lineOrd: number, exitCode: number, stderrTail: string): IngestFrame;
+export declare function lastLines(text: string, n: number): string;
+export declare function deadlineMsForProfile(profile: string, bands: string[] | null | undefined): number;
+export declare function parseDfFreeGb(dfOutput: string): number | null;
+export declare function manifestPathFromLine(doneLine: Record<string, unknown>, lastManifestPath: string | null): string | null;
+export declare function digestFromDoneLine(doneLine: Record<string, unknown>, lastImageDigest: string | null): string | null;
+//# sourceMappingURL=protocol.d.ts.map

package/dist/bake-runner/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/bake-runner/protocol.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,YAAY,GACpB;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GAC3C;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GACvD;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GACrE;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GACzF;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GAC3E;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GACvD;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAG5C,MAAM,WAAW,WAAW;IAE1B,KAAK,EAAE,MAAM,CAAC;IAEd,OAAO,EAAE,MAAM,CAAC;IAEhB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAOD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAajE;AAQD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,CAQrE;AAOD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAErF;AAOD,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,MAAM,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1B,WAAW,CAKb;AAQD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAShG;AAGD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAGzD;AAOD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAQhG;AAID,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW7D;AAID,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAItH;AAKD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAGnH"}