@sequenceholdings/studio-cli 0.1.12 → 0.1.18

package/dist/process/codegen.js

@@ -50,7 +50,16 @@ export function generateProcessFiles(process, bundle) {
             ? `  max_concurrent_runs: ${process.max_concurrent_runs},`
             : null,
         process.supervisor_retry !== undefined ? `  supervisor_retry: ${pretty(process.supervisor_retry, 1)},` : null,
-        process.run_as !== undefined ? `  run_as: { email: ${lit(process.run_as.email)} },` : null,
+        process.run_as !== undefined
+            ? `  run_as: { ${[
+                process.run_as.email !== undefined ? `email: ${lit(process.run_as.email)}` : null,
+                process.run_as.service_account !== undefined
+                    ? `service_account: ${lit(process.run_as.service_account)}`
+                    : null,
+            ]
+                .filter((f) => f !== null)
+                .join(', ')} },`
+            : null,
         Array.isArray(process.tags) && process.tags.length > 0
             ? `  tags: ${pretty(process.tags, 1)},`
             : null,
@@ -125,6 +134,7 @@ function emitNode(node, ctx) {
                 `  function: ${lit(String(m.registered_function_id))},`,
                 m.config !== undefined ? `  config: ${pretty(m.config, 1)},` : null,
                 m.limits !== undefined ? `  limits: ${pretty(m.limits, 1)},` : null,
+                runAsField(m.run_as),
                 bindings(m.bindings),
                 middleware(m.middleware),
                 mapper('input', m.input_mapper_source),
@@ -171,6 +181,8 @@ function emitNode(node, ctx) {
                 par.supervisor_retry !== undefined ? `  supervisor_retry: ${pretty(par.supervisor_retry, 1)},` : null,
                 bindings(m.bindings),
                 `  on_branch_error: ${lit(par.on_branch_error)},`,
+                // Only 'eager' is ever serialized (barrier is the omitted default).
+                par.join_mode === 'eager' ? `  join_mode: ${lit('eager')},` : null,
                 `  join: ${par.join_source},`,
                 mapper('input', m.input_mapper_source),
                 tail,
@@ -187,6 +199,7 @@ function emitNode(node, ctx) {
                 `  function: ${lit(String(m.function_id))},`,
                 m.version ? `  version: ${lit(String(m.version))},` : null,
                 m.limits !== undefined ? `  limits: ${pretty(m.limits, 1)},` : null,
+                runAsField(m.run_as),
                 bindings(m.bindings),
                 middleware(m.middleware),
                 mapper('input', m.input_mapper_source),
@@ -207,6 +220,13 @@ function emitEdges(edges) {
     const items = edges.map((e) => `{ id: ${lit(e.id)}, to: ${lit(e.to)} }`).join(', ');
     return `[${items}] as const`;
 }
+/** Per-node service-account override — `metadata.run_as.service_account`. */
+function runAsField(runAs) {
+    const sa = runAs?.service_account;
+    if (typeof sa !== 'string' || sa.length === 0)
+        return null;
+    return `  run_as: { service_account: ${lit(sa)} },`;
+}
 /** A mapper field whose value is a serialized `Function.toString()` string. */
 function mapper(field, source) {
     if (typeof source !== 'string' || source.length === 0)

package/dist/process/commands.d.ts

@@ -9,6 +9,25 @@ export interface ParsedArgs {
     flags: Record<string, string | true>;
 }
 export declare function parseArgs(rest: string[]): ParsedArgs;
+export type ProcessSourceSpec = {
+    kind: 'local';
+} | {
+    kind: 'git-service';
+    namespace: string;
+    name: string;
+    ref?: string;
+};
+/**
+ * Parse the process-apply source flags. `--repo processes/<name>` materializes
+ * from the platform git service; absent means local (cwd / LATTICE_PROCESSES_ROOT).
+ * `--git-url` is passed through to the underlying `resolveArtifactSource` when
+ * the repo flag is a full ns/name pair (future); today only git-service is
+ * supported.
+ *
+ * Process repos live exclusively in the `processes` namespace — other namespaces
+ * (artifacts, managed-functions) are rejected to avoid cross-kind accidents.
+ */
+export declare function parseProcessSourceSpec(flags: Record<string, string | true>): ProcessSourceSpec;
 export declare function initCommand(args: ParsedArgs): Promise<number>;
 export declare function lintCommand(args: ParsedArgs): Promise<number>;
 export declare function planCommand(args: ParsedArgs): Promise<number>;

package/dist/process/commands.js

@@ -11,16 +11,19 @@ import { fileURLToPath } from 'node:url';
 import { forEachSerializedNode, } from '@sequenceholdings/lattice/bundle';
 import { getJson, getJsonOr404, postJson, AtlasApiError } from '../atlas-client.js';
 import { generateProcessFiles } from './codegen.js';
-import { getAccessToken, NotLoggedInError } from '../auth.js';
+import { getAccessToken, getAccessTokenWithMode, NotLoggedInError, } from '../auth.js';
 import { readConfig, resolveEnvWithDiscovery } from '../config.js';
-import { buildBundleFromProcesses, summarizeBundle } from './build.js';
+import { finalizeCompiledBundle, summarizeBundle } from './build.js';
 import { buildResolveProcessPinFromEnv } from './resolve-process-pin.js';
 import { loadBundleForPublish } from './local-bundle.js';
-import { loadProcessDefinitions } from './discover.js';
-import { lintProcesses, formatLintResult } from './lint.js';
+import { findProcessRoot } from './discover.js';
+import { formatLintResult, lintSerializedAgentContracts, } from './lint.js';
 import { diffBundleAgainstActive, formatPlanDiff, } from './plan-diff.js';
-import { simulateProcess, formatSimulateResult } from './simulate.js';
+import { formatSimulateResult } from './simulate.js';
 import { buildAgentSchemaLoader } from './agent-loader.js';
+import { localGitMetadata, resolveArtifactSource, } from '@sequenceholdings/artifact-studio/source-resolver';
+import { prepareProcessBuildRoot } from './repo-install.js';
+import { compileProcessSourceIsolated, simulateProcessIsolated, } from './compiler-subprocess.js';
 export function parseArgs(rest) {
     const positional = [];
     const flags = {};
@@ -96,7 +99,7 @@ async function getEnvAndToken(args) {
     const env = await resolveEnvWithDiscovery({ requested });
     let token;
     try {
-        token = await getAccessToken();
+        token = await getAccessToken({ env: env.name, targetUrl: env.url });
     }
     catch (err) {
         if (err instanceof NotLoggedInError) {
@@ -106,6 +109,45 @@ async function getEnvAndToken(args) {
     }
     return { env, token };
 }
+async function getEnvAndAuth(args) {
+    const requested = typeof args.flags.env === 'string' ? args.flags.env : undefined;
+    const env = await resolveEnvWithDiscovery({ requested });
+    const auth = await getAccessTokenWithMode({ env: env.name, targetUrl: env.url });
+    return { authMode: auth.authMode, env, token: auth.token };
+}
+/**
+ * Parse the process-apply source flags. `--repo processes/<name>` materializes
+ * from the platform git service; absent means local (cwd / LATTICE_PROCESSES_ROOT).
+ * `--git-url` is passed through to the underlying `resolveArtifactSource` when
+ * the repo flag is a full ns/name pair (future); today only git-service is
+ * supported.
+ *
+ * Process repos live exclusively in the `processes` namespace — other namespaces
+ * (artifacts, managed-functions) are rejected to avoid cross-kind accidents.
+ */
+export function parseProcessSourceSpec(flags) {
+    const repo = typeof flags.repo === 'string' ? flags.repo : undefined;
+    const ref = typeof flags.ref === 'string' ? flags.ref : undefined;
+    if (flags.repo === true)
+        throw new Error('--repo requires a value: --repo processes/<name>');
+    if (flags.ref === true)
+        throw new Error('--ref requires a value.');
+    if (ref && !repo)
+        throw new Error('--ref only applies together with --repo.');
+    if (ref && ref.startsWith('-'))
+        throw new Error(`--ref must not start with "-" (got "${ref}").`);
+    if (!repo)
+        return { kind: 'local' };
+    const parts = repo.split('/');
+    if (parts.length !== 2 || !parts[0] || !parts[1]) {
+        throw new Error(`--repo must be "processes/<name>" (got "${repo}").`);
+    }
+    if (parts[0] !== 'processes') {
+        throw new Error(`Process deploys require the "processes" namespace — got "${parts[0]}". ` +
+            `Use --repo processes/<name>.`);
+    }
+    return { kind: 'git-service', namespace: parts[0], name: parts[1], ref };
+}
 // ---------------------------------------------------------------------------
 // init
 // ---------------------------------------------------------------------------
@@ -171,9 +213,11 @@ function slugify(value) {
 // lint
 // ---------------------------------------------------------------------------
 export async function lintCommand(args) {
-    const defs = await loadProcessDefinitions();
-    const loadAgentSchemaEdgeIdEnum = await tryBuildAgentLoader(args);
-    const result = await lintProcesses({ defs, loadAgentSchemaEdgeIdEnum });
+    const compiled = await compileLocalProcessSource();
+    const result = await lintCompiledProcessSource({
+        compiled,
+        loadAgentSchemaEdgeIdEnum: await tryBuildAgentLoader(args),
+    });
     const formatted = formatLintResult(result);
     if (formatted.text)
         console.log(formatted.text);
@@ -181,9 +225,29 @@ export async function lintCommand(args) {
         console.error(`\nlint FAILED — ${result.errors.length} error(s), ${result.warnings.length} warning(s)`);
         return 1;
     }
-    console.log(`\nlint ok — ${defs.length} process(es) checked, ${result.warnings.length} warning(s)`);
+    console.log(`\nlint ok — ${compiled.bundle.processes.length} process(es) checked, ${result.warnings.length} warning(s)`);
     return 0;
 }
+async function compileLocalProcessSource() {
+    const rootDir = await findProcessRoot();
+    return compileProcessSourceIsolated({
+        rootDir,
+        provenance: localGitMetadata(rootDir),
+    });
+}
+async function lintCompiledProcessSource({ compiled, loadAgentSchemaEdgeIdEnum, }) {
+    const agentLint = await lintSerializedAgentContracts({
+        bundle: compiled.bundle,
+        loadAgentSchemaEdgeIdEnum,
+        // The worker already performs source-local checks. The credential-owning
+        // parent only adds registry-dependent validation (or the offline warning).
+        includeStaticValidation: false,
+    });
+    return {
+        errors: [...compiled.lint.errors, ...agentLint.errors],
+        warnings: [...compiled.lint.warnings, ...agentLint.warnings],
+    };
+}
 async function tryBuildAgentLoader(args) {
     // Agent loader is only meaningful when we have a target env + token.
     // If either fails to resolve, skip the check; lint will emit a warning
@@ -199,23 +263,31 @@ async function tryBuildAgentLoader(args) {
 // ---------------------------------------------------------------------------
 // plan
 // ---------------------------------------------------------------------------
-async function buildBundleForPublish(args, defs) {
-    const hasSubprocess = defs.some((d) => d.process.nodes.some((n) => n.kind === 'subprocess'));
+async function buildBundleForPublish(args, compiled) {
+    let hasSubprocess = false;
+    for (const process of compiled.bundle.processes) {
+        forEachSerializedNode(process.nodes, (node) => {
+            if (node.kind === 'subprocess')
+                hasSubprocess = true;
+        });
+    }
+    if (!hasSubprocess)
+        return compiled.bundle;
     try {
         const { env, token } = await getEnvAndToken(args);
         const resolveProcessPin = buildResolveProcessPinFromEnv(env, token);
-        return await buildBundleFromProcesses(defs, { resolveProcessPin });
+        return await finalizeCompiledBundle({
+            bundle: compiled.bundle,
+            resolveProcessPin,
+        });
     }
     catch (err) {
-        if (hasSubprocess) {
-            throw new Error('subprocess nodes require -e <env> and `seq-studio login` to resolve child process versions', { cause: err });
-        }
-        return await buildBundleFromProcesses(defs);
+        throw new Error('subprocess nodes require -e <env> and `seq-studio login` to resolve child process versions', { cause: err });
     }
 }
 export async function planCommand(args) {
-    const defs = await loadProcessDefinitions();
-    const bundle = await buildBundleForPublish(args, defs);
+    const compiled = await compileLocalProcessSource();
+    const bundle = await buildBundleForPublish(args, compiled);
     const summary = summarizeBundle(bundle);
     console.log(JSON.stringify(summary, null, 2));
     const loadActiveProcess = await tryBuildActiveProcessLoader(args);
@@ -267,9 +339,11 @@ async function tryBuildActiveProcessLoader(args) {
 // test (CI wrapper)
 // ---------------------------------------------------------------------------
 export async function testCommand(args) {
-    const defs = await loadProcessDefinitions();
-    const loadAgentSchemaEdgeIdEnum = await tryBuildAgentLoader(args);
-    const lintResult = await lintProcesses({ defs, loadAgentSchemaEdgeIdEnum });
+    const compiled = await compileLocalProcessSource();
+    const lintResult = await lintCompiledProcessSource({
+        compiled,
+        loadAgentSchemaEdgeIdEnum: await tryBuildAgentLoader(args),
+    });
     const formattedLint = formatLintResult(lintResult);
     if (formattedLint.text)
         console.log(formattedLint.text);
@@ -277,8 +351,8 @@ export async function testCommand(args) {
         console.error(`\nlint FAILED — ${lintResult.errors.length} error(s), ${lintResult.warnings.length} warning(s)`);
         return 1;
     }
-    console.log(`\nlint ok — ${defs.length} process(es) checked, ${lintResult.warnings.length} warning(s)`);
-    const bundle = await buildBundleForPublish(args, defs);
+    console.log(`\nlint ok — ${compiled.bundle.processes.length} process(es) checked, ${lintResult.warnings.length} warning(s)`);
+    const bundle = await buildBundleForPublish(args, compiled);
     const offline = args.flags.offline === true;
     const loadActiveProcess = await tryBuildActiveProcessLoader(args);
     if (!loadActiveProcess) {
@@ -334,11 +408,41 @@ export function resolveOnlyIds({ only, knownIds, }) {
     return { ids };
 }
 export async function applyCommand(args) {
+    const spec = parseProcessSourceSpec(args.flags);
+    if (spec.kind === 'git-service') {
+        return applyFromRepo(args, spec);
+    }
+    return applyLocal(args);
+}
+async function applyLocal(args) {
+    const compiled = await compileLocalProcessSource();
     const { env, token } = await getEnvAndToken(args);
-    const defs = await loadProcessDefinitions();
+    return registerAndPromote({ args, env, token, compiled });
+}
+async function applyFromRepo(args, spec) {
+    const { authMode, env, token } = await getEnvAndAuth(args);
+    const source = await resolveArtifactSource({ kind: 'git-service', namespace: spec.namespace, name: spec.name, ref: spec.ref }, { authMode, baseUrl: env.url, token });
+    try {
+        await prepareProcessBuildRoot(source.dir);
+        const compiled = await compileProcessSourceIsolated({
+            rootDir: source.dir,
+            provenance: source.provenance,
+        });
+        return await registerAndPromote({
+            args,
+            env,
+            token,
+            compiled,
+        });
+    }
+    finally {
+        await source.cleanup();
+    }
+}
+async function registerAndPromote({ args, env, token, compiled, }) {
     const onlyResult = resolveOnlyIds({
         only: args.flags.only,
-        knownIds: new Set(defs.map((d) => d.process.id)),
+        knownIds: new Set(compiled.bundle.processes.map((process) => process.id)),
     });
     if (onlyResult.error) {
         console.error(onlyResult.error);
@@ -349,7 +453,10 @@ export async function applyCommand(args) {
     // again on POST /bundles; this is a local fast-fail so we don't ship
     // a bundle that will be rejected.
     const loadAgentSchemaEdgeIdEnum = buildAgentSchemaLoader({ baseUrl: env.url, token });
-    const lintResult = await lintProcesses({ defs, loadAgentSchemaEdgeIdEnum });
+    const lintResult = await lintCompiledProcessSource({
+        compiled,
+        loadAgentSchemaEdgeIdEnum,
+    });
     const formatted = formatLintResult(lintResult);
     if (formatted.text)
         console.log(formatted.text);
@@ -357,7 +464,7 @@ export async function applyCommand(args) {
         console.error('\napply FAILED — lint rejected the bundle');
         return 1;
     }
-    const bundle = await buildBundleForPublish(args, defs);
+    const bundle = await buildBundleForPublish(args, compiled);
     console.log(`[seq-studio] built bundle ${bundle.bundle_hash.slice(0, 12)} ` +
         `(${bundle.processes.length} process(es))`);
     // We send only the bundle. `created_by` (and `promoted_by` for the
@@ -506,8 +613,8 @@ export async function bundleCommand(args) {
     const sub = args.positional[0];
     switch (sub) {
         case 'build': {
-            const defs = await loadProcessDefinitions();
-            const bundle = await buildBundleForPublish(args, defs);
+            const compiled = await compileLocalProcessSource();
+            const bundle = await buildBundleForPublish(args, compiled);
             const out = typeof args.flags.out === 'string' ? resolve(args.flags.out) : null;
             if (out) {
                 await mkdir(dirname(out), { recursive: true });
@@ -642,14 +749,15 @@ export async function simulateCommand(args) {
         console.error('usage: seq-studio process simulate <process-id>');
         return 1;
     }
-    const defs = await loadProcessDefinitions();
-    const def = defs.find((d) => d.process.id === processId);
-    if (!def) {
-        console.error(`process "${processId}" not found in lattice process roots`);
+    const simulation = await simulateProcessIsolated({
+        rootDir: await findProcessRoot(),
+        processId,
+    });
+    if (simulation.kind === 'not-found') {
+        console.error(`process "${simulation.processId}" not found in lattice process roots`);
         return 1;
     }
-    const processesById = new Map(defs.map((d) => [d.process.id, d.process]));
-    const result = await simulateProcess({ process: def.process, processesById });
+    const result = simulation.result;
     console.log(formatSimulateResult(result));
     return result.status === 'failed' ? 1 : 0;
 }
@@ -668,7 +776,7 @@ export async function doctorCommand(args) {
         lines.push(`config: ok — default_env=${config.defaultEnv}, envs=${Object.keys(config.envs).join(',')}`);
         lines.push(`tier: ${config.tier}` +
             (config.tier === 'anonymous'
-                ? ' — authenticate and run `seq-studio envs refresh` to discover more environments'
+                ? ' — no environment catalog cached; run `seq-studio envs refresh` to discover more environments'
                 : ''));
     }
     const requested = typeof args.flags.env === 'string' ? args.flags.env : undefined;
@@ -685,7 +793,7 @@ export async function doctorCommand(args) {
     }
     let token = null;
     try {
-        token = await getAccessToken();
+        token = await getAccessToken({ env: env?.name, targetUrl: env?.url });
         lines.push('auth: ok — seqapi token present and not expired');
     }
     catch (err) {
@@ -749,9 +857,14 @@ export async function doctorCommand(args) {
             const currentTotal = current.total ?? current.items.length;
             if (currentTotal === 0 && env.name !== 'staging' && config?.envs.staging?.url) {
                 try {
+                    const stagingUrl = config.envs.staging.url;
+                    const stagingToken = await getAccessToken({
+                        env: 'staging',
+                        targetUrl: stagingUrl,
+                    });
                     const staging = await getJson({
-                        baseUrl: config.envs.staging.url,
-                        token,
+                        baseUrl: stagingUrl,
+                        token: stagingToken,
                         path: '/api/git-service/repos?limit=1&offset=0',
                     });
                     const stagingTotal = staging.total ?? staging.items.length;

package/dist/process/compiler-subprocess.d.ts

@@ -0,0 +1,29 @@
+import type { LatticeBundle } from '@sequenceholdings/lattice/bundle';
+import type { BuildBundleOptions } from './build.js';
+import type { LintResult } from './lint.js';
+import type { SimulateResult } from './simulate.js';
+export interface CompiledProcessSource {
+    bundle: LatticeBundle;
+    lint: LintResult;
+}
+export type IsolatedSimulation = {
+    kind: 'not-found';
+    processId: string;
+} | {
+    kind: 'result';
+    result: SimulateResult;
+};
+export declare function compileProcessSourceIsolated({ rootDir, provenance, workerPath, timeoutMs, sourceEnv, }: {
+    rootDir: string;
+    provenance?: NonNullable<BuildBundleOptions['provenance']>;
+    workerPath?: string;
+    timeoutMs?: number;
+    sourceEnv?: NodeJS.ProcessEnv;
+}): Promise<CompiledProcessSource>;
+export declare function simulateProcessIsolated({ rootDir, processId, workerPath, timeoutMs, sourceEnv, }: {
+    rootDir: string;
+    processId: string;
+    workerPath?: string;
+    timeoutMs?: number;
+    sourceEnv?: NodeJS.ProcessEnv;
+}): Promise<IsolatedSimulation>;

package/dist/process/compiler-subprocess.js

@@ -0,0 +1,99 @@
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createScrubbedChildEnv } from '@sequenceholdings/artifact-studio/child-environment';
+const MODULE_DIR = dirname(fileURLToPath(import.meta.url));
+const BUILT_WORKER_PATH = join(MODULE_DIR, 'compiler-worker.js');
+const DEFAULT_WORKER_PATH = existsSync(BUILT_WORKER_PATH)
+    ? BUILT_WORKER_PATH
+    : join(MODULE_DIR, 'compiler-worker.ts');
+const DEFAULT_TIMEOUT_MS = 2 * 60_000;
+const MAX_STDERR_BYTES = 1024 * 1024;
+export async function compileProcessSourceIsolated({ rootDir, provenance, workerPath = DEFAULT_WORKER_PATH, timeoutMs = DEFAULT_TIMEOUT_MS, sourceEnv, }) {
+    return runProcessWorker({
+        request: {
+            action: 'compile',
+            rootDir,
+            ...(provenance ? { provenance } : {}),
+        },
+        workerPath,
+        timeoutMs,
+        ...(sourceEnv ? { sourceEnv } : {}),
+    });
+}
+export async function simulateProcessIsolated({ rootDir, processId, workerPath = DEFAULT_WORKER_PATH, timeoutMs = DEFAULT_TIMEOUT_MS, sourceEnv, }) {
+    return runProcessWorker({
+        request: { action: 'simulate', rootDir, processId },
+        workerPath,
+        timeoutMs,
+        ...(sourceEnv ? { sourceEnv } : {}),
+    });
+}
+async function runProcessWorker({ request, workerPath, timeoutMs, sourceEnv, }) {
+    const scratch = await mkdtemp(join(tmpdir(), 'process-compiler-'));
+    const requestFile = join(scratch, 'request.json');
+    const outFile = join(scratch, 'result.json');
+    const homeDir = join(scratch, 'home');
+    try {
+        await mkdir(homeDir, { recursive: true });
+        await writeFile(requestFile, JSON.stringify(request), 'utf8');
+        await runWorker({
+            workerPath,
+            requestFile,
+            outFile,
+            homeDir,
+            timeoutMs,
+            ...(sourceEnv ? { sourceEnv } : {}),
+        });
+        return JSON.parse(await readFile(outFile, 'utf8'));
+    }
+    finally {
+        await rm(scratch, { recursive: true, force: true });
+    }
+}
+function runWorker({ workerPath, requestFile, outFile, homeDir, timeoutMs, sourceEnv, }) {
+    return new Promise((resolve, reject) => {
+        const workerArgs = workerPath.endsWith('.ts')
+            ? ['--import', 'tsx', workerPath, requestFile, outFile]
+            : [workerPath, requestFile, outFile];
+        const child = spawn(process.execPath, workerArgs, {
+            stdio: ['ignore', 'inherit', 'pipe'],
+            env: createScrubbedChildEnv({
+                homeDir,
+                ...(sourceEnv ? { source: sourceEnv } : {}),
+            }),
+        });
+        let stderr = '';
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill('SIGKILL');
+        }, timeoutMs);
+        child.stderr.on('data', (chunk) => {
+            if (stderr.length < MAX_STDERR_BYTES) {
+                stderr += chunk.toString().slice(0, MAX_STDERR_BYTES - stderr.length);
+            }
+        });
+        child.on('error', (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+        child.on('close', (code) => {
+            clearTimeout(timer);
+            if (timedOut) {
+                reject(new Error(`process compiler exceeded ${Math.round(timeoutMs / 1000)}s and was terminated`));
+                return;
+            }
+            if (code === 0) {
+                if (stderr.trim())
+                    process.stderr.write(stderr);
+                resolve();
+                return;
+            }
+            reject(new Error(stderr.trim() || `process compiler exited with code ${code ?? 'null'}`));
+        });
+    });
+}

package/dist/process/compiler-worker.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/process/compiler-worker.js

@@ -0,0 +1,38 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import { buildBundleFromProcesses } from './build.js';
+import { loadProcessDefinitions } from './discover.js';
+import { lintProcesses } from './lint.js';
+import { simulateProcess } from './simulate.js';
+async function main() {
+    const [requestFile, outFile] = process.argv.slice(2);
+    if (!requestFile || !outFile) {
+        process.stderr.write('usage: compiler-worker <request.json> <result.json>\n');
+        process.exitCode = 2;
+        return;
+    }
+    const request = JSON.parse(await readFile(requestFile, 'utf8'));
+    const defs = await loadProcessDefinitions(request.rootDir);
+    if (request.action === 'simulate') {
+        const process = defs.find((definition) => definition.process.id === request.processId)?.process;
+        if (!process) {
+            await writeFile(outFile, JSON.stringify({ kind: 'not-found', processId: request.processId }), 'utf8');
+            return;
+        }
+        const processesById = new Map(defs.map((definition) => [definition.process.id, definition.process]));
+        const result = await simulateProcess({ process, processesById });
+        await writeFile(outFile, JSON.stringify({ kind: 'result', result }), 'utf8');
+        return;
+    }
+    const lint = await lintProcesses({
+        defs,
+        suppressUnavailableAgentWarnings: true,
+    });
+    const bundle = await buildBundleFromProcesses(defs, {
+        ...(request.provenance ? { provenance: request.provenance } : {}),
+    });
+    await writeFile(outFile, JSON.stringify({ bundle, lint }), 'utf8');
+}
+main().catch((error) => {
+    process.stderr.write(`${error instanceof Error ? (error.stack ?? error.message) : String(error)}\n`);
+    process.exitCode = 1;
+});

package/dist/process/discover.d.ts

@@ -28,5 +28,8 @@ export declare function findProcessRoot(): Promise<string>;
  * Load every `<dir>/process.ts` under the configured root. Each module
  * must `export default defineProcess(...)`. Process ids must be unique
  * across the set — duplicates throw.
+ *
+ * @param explicitRoot  When supplied, overrides LATTICE_PROCESSES_ROOT and cwd.
+ *   Used by `--repo` deploys to point discovery at the materialized temp tree.
  */
-export declare function loadProcessDefinitions(): Promise<readonly LoadedProcess[]>;
+export declare function loadProcessDefinitions(explicitRoot?: string): Promise<readonly LoadedProcess[]>;

package/dist/process/discover.js

@@ -55,9 +55,12 @@ export async function findProcessRoot() {
  * Load every `<dir>/process.ts` under the configured root. Each module
  * must `export default defineProcess(...)`. Process ids must be unique
  * across the set — duplicates throw.
+ *
+ * @param explicitRoot  When supplied, overrides LATTICE_PROCESSES_ROOT and cwd.
+ *   Used by `--repo` deploys to point discovery at the materialized temp tree.
  */
-export async function loadProcessDefinitions() {
-    const root = await findProcessRoot();
+export async function loadProcessDefinitions(explicitRoot) {
+    const root = explicitRoot ?? (await findProcessRoot());
     const entries = await readdir(root);
     const found = [];
     const seenIds = new Set();

package/dist/process/lint.d.ts

@@ -9,6 +9,7 @@
  *   - Human timeout edge — if timeout is set and outgoing_edges.length > 0
  *     but on_timeout_edge_id is unset, warn
  */
+import { type LatticeBundle } from '@sequenceholdings/lattice/bundle';
 import type { ProcessDefinition } from '@sequenceholdings/lattice/define';
 export interface LintIssue {
     process_id: string;
@@ -31,8 +32,15 @@ export interface LintInput {
      * undefined and a warning is emitted instead of failing the build.
      */
     loadAgentSchemaEdgeIdEnum?: (agentId: string) => Promise<string[] | null | 'not-found'>;
+    /** A scrubbed worker can defer registry-backed agent checks to its parent. */
+    suppressUnavailableAgentWarnings?: boolean;
 }
 export declare function lintProcesses(input: LintInput): Promise<LintResult>;
+export declare function lintSerializedAgentContracts({ bundle, loadAgentSchemaEdgeIdEnum, includeStaticValidation, }: {
+    bundle: LatticeBundle;
+    loadAgentSchemaEdgeIdEnum?: LintInput['loadAgentSchemaEdgeIdEnum'];
+    includeStaticValidation?: boolean;
+}): Promise<LintResult>;
 export declare function formatLintResult(result: LintResult): {
     text: string;
     hasErrors: boolean;