@synopackageland/cli 0.5.3 → 0.6.1

package/dist/standalone/worker-contract.d.ts

@@ -1,189 +0,0 @@
-export { WorkerContractError } from "./worker-contract-json.js";
-export declare const WORKER_CONTRACT: {
-    readonly dataProtocol: 2;
-    readonly jobSchema: 1;
-    readonly registrySchema: 2;
-    readonly backgroundSchema: 2;
-    readonly productionAvailability: "unavailable";
-    readonly maxSafeInteger: number;
-    readonly maxControlBytes: 16384;
-    readonly maxInputBytes: 8192;
-    readonly maxSteps: 16;
-    readonly maxWorkers: 16;
-    readonly maxInertWorkerBytes: 1048576;
-    readonly maxChildren: 4;
-    readonly maxUIDChildren: 2;
-    readonly maxBackgroundChildren: 2;
-    readonly maxUIDBackgroundChildren: 1;
-    readonly maxPending: 16;
-    readonly maxUIDPending: 2;
-    readonly maxRetryAfterMs: 1000;
-    readonly maxAuthorityRecords: 256;
-    readonly maxSnapshotBytes: 1048576;
-    readonly maxExecutionKeys: 256;
-    readonly maxArtifactBytes: 16384;
-    readonly maxMutationControls: 256;
-    readonly maxProgressBytes: 1024;
-    readonly maxProgressPerSecond: 1;
-    readonly maxProgressPackets: 128;
-    readonly maxProgressRing: 32;
-    readonly maxStatusBytes: 16384;
-    readonly maxStatusJobs: 10;
-    readonly maxStatusConcurrent: 8;
-    readonly maxUIDStatusPerSecond: 2;
-    readonly intentTTLMS: 30000;
-    readonly defaultBackgroundTTLMS: 86400000;
-    readonly maxBackgroundTTLMS: 604800000;
-    readonly nativeProofFreshnessMS: 2000;
-    readonly drainMS: 2000;
-    readonly terminateGraceMS: 1000;
-};
-export type WorkerMode = "interactive" | "background";
-export type WorkerAction = "nas.files.list" | "nas.files.stat" | "nas.files.read" | "nas.files.read-stream";
-export type JobState = "pending" | "running" | "cancel-requested" | "draining" | "succeeded" | "failed" | "canceled" | "interrupted" | "cleanup-required";
-export type WorkerSafeReason = "invalid-request" | "incompatible" | "unsupported" | "replay" | "stale" | "expired" | "denied" | "unavailable" | "suspended" | "revoked" | "fenced" | "busy" | "limit-exceeded" | "canceled" | "timeout" | "partial" | "commit-uncertain" | "cleanup-required" | "internal";
-export interface WorkerInventory {
-    package: string;
-    version: string;
-    protocol: 2;
-    payloadDigest: string;
-    registryDigest: string;
-    dataAccess: "relaxed";
-}
-export interface WorkerLimits {
-    inputBytes: number;
-    steps: number;
-    totalMs: number;
-    idleMs: number;
-    metadataMs: number;
-    boundedMs: number;
-    boundedBytes: number;
-    streamBytes: number;
-    chunkBytes: number;
-    outstandingLeases: number;
-}
-export interface WorkerDescriptor {
-    registrySchema: 2;
-    workerId: string;
-    workerRevision: number;
-    kind: "sdk-read-plan";
-    handlerBinding: string;
-    inputSchemaDigest: string;
-    outputSchemaDigest: string;
-    actions: WorkerAction[];
-    modes: WorkerMode[];
-    checkpoints: ("before-step" | "before-chunk" | "before-result")[];
-    limits: WorkerLimits;
-}
-export type WorkerStep = {
-    action: "nas.files.list";
-    segments: string[];
-    limit: number;
-} | {
-    action: "nas.files.stat";
-    segments: string[];
-} | {
-    action: "nas.files.read" | "nas.files.read-stream";
-    segments: string[];
-    maxBytes: number;
-};
-export interface WorkerInput {
-    steps: WorkerStep[];
-}
-export interface WorkerRevisionRef {
-    id: string;
-    revision: number;
-}
-export interface WorkerBindingBase {
-    inventory: WorkerInventory;
-    jobSchema: 1;
-    epoch: string;
-    job: WorkerRevisionRef;
-    worker: WorkerRevisionRef;
-    parentGrant: WorkerRevisionRef;
-    approvalBinding: string;
-    capabilityDigest: string;
-    inputSchemaDigest: string;
-    inputDigest: string;
-}
-export type WorkerBinding = WorkerBindingBase & ({
-    mode: "interactive";
-    delegation?: never;
-} | {
-    mode: "background";
-    delegation: WorkerRevisionRef;
-});
-export interface WorkerPrincipal {
-    identityBasis: "uid-username";
-    uid: number;
-    username: string;
-}
-export type WorkerPrivateBinding = {
-    binding: WorkerBindingBase & {
-        mode: "interactive";
-        delegation?: never;
-    };
-    actor: WorkerPrincipal;
-    sessionRef: string;
-} | {
-    binding: WorkerBindingBase & {
-        mode: "background";
-        delegation: WorkerRevisionRef;
-    };
-    actor: WorkerPrincipal;
-    sessionRef?: never;
-};
-export interface WorkerIntent {
-    jobSchema: 1;
-    intentId: string;
-    intentRevision: number;
-    binding: WorkerPrivateBinding;
-    input: WorkerInput;
-    summaryDigest: string;
-    createdAt: number;
-    expiresAt: number;
-}
-export interface WorkerBackgroundRecord {
-    backgroundSchema: 2;
-    binding: Extract<WorkerPrivateBinding, {
-        sessionRef?: never;
-    }>;
-    issuer: WorkerPrincipal;
-    createdAt: number;
-    expiresAt: number;
-    notBefore: number;
-    state: "active" | "consumed" | "expired" | "revoked" | "suspended";
-    reason?: WorkerSafeReason;
-    executionKey?: string;
-}
-export interface WorkerProgress {
-    sequence: number;
-    phase: "starting" | "metadata" | "reading" | "finishing";
-    completedUnits: number;
-    totalUnits?: number;
-    bytesRead: number;
-    bytesWritten: number;
-}
-export interface WorkerJob {
-    binding: WorkerBinding;
-    state: JobState;
-    safeReason?: WorkerSafeReason;
-    progress: WorkerProgress;
-    acceptedAt: number;
-    startedAt?: number;
-    finishedAt?: number;
-    cancelRequested: boolean;
-    drained: boolean;
-    effectsUnknown: boolean;
-}
-export interface WorkerControl {
-    op: "jobs.submit" | "jobs.cancel" | "background.revoke";
-    binding: WorkerBinding;
-    intent: WorkerRevisionRef;
-    nonce: string;
-    ticket: string;
-}
-export declare function decodeWorkerInput(raw: string | Uint8Array): WorkerInput;
-export declare function workerInputDigest(input: WorkerInput, schemaDigest: string): string;
-export declare function decodeWorkerControl(raw: string | Uint8Array): WorkerControl;
-export declare function compareWorkerBinding(got: WorkerBinding, expected: WorkerBinding): void;

package/dist/standalone/worker-contract.js

@@ -1,175 +0,0 @@
-import { createHash } from "node:crypto";
-import { isDeepStrictEqual } from "node:util";
-import { fail, strictJSON, validUnicode } from "./worker-contract-json.js";
-export { WorkerContractError } from "./worker-contract-json.js";
-// M3 S0 only: no CLI command, runtime route, registry or execution is enabled.
-export const WORKER_CONTRACT = {
-    dataProtocol: 2, jobSchema: 1, registrySchema: 2, backgroundSchema: 2,
-    productionAvailability: "unavailable",
-    maxSafeInteger: Number.MAX_SAFE_INTEGER,
-    maxControlBytes: 16384, maxInputBytes: 8192, maxSteps: 16,
-    maxWorkers: 16, maxInertWorkerBytes: 1048576,
-    maxChildren: 4, maxUIDChildren: 2, maxBackgroundChildren: 2, maxUIDBackgroundChildren: 1,
-    maxPending: 16, maxUIDPending: 2, maxRetryAfterMs: 1000,
-    maxAuthorityRecords: 256, maxSnapshotBytes: 1048576,
-    maxExecutionKeys: 256, maxArtifactBytes: 16384, maxMutationControls: 256,
-    maxProgressBytes: 1024, maxProgressPerSecond: 1, maxProgressPackets: 128, maxProgressRing: 32,
-    maxStatusBytes: 16384, maxStatusJobs: 10, maxStatusConcurrent: 8, maxUIDStatusPerSecond: 2,
-    intentTTLMS: 30000, defaultBackgroundTTLMS: 86400000, maxBackgroundTTLMS: 604800000,
-    nativeProofFreshnessMS: 2000, drainMS: 2000, terminateGraceMS: 1000,
-};
-const digestPattern = /^[a-f0-9]{64}$/;
-const referencePattern = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
-const positive = (n) => typeof n === "number" && Number.isSafeInteger(n) && n > 0;
-function object(value, required, optional = []) {
-    if (typeof value !== "object" || value === null || Array.isArray(value))
-        return fail();
-    const o = value;
-    if (required.some(k => !Object.hasOwn(o, k)) || Object.keys(o).some(k => !required.includes(k) && !optional.includes(k)))
-        fail();
-    return o;
-}
-function stringValue(value) {
-    if (typeof value !== "string" || !validUnicode(value))
-        return fail();
-    return value;
-}
-function reference(value) {
-    const s = stringValue(value);
-    if (!referencePattern.test(s))
-        fail();
-    return s;
-}
-function digestValue(value) {
-    const s = stringValue(value);
-    if (!digestPattern.test(s))
-        fail();
-    return s;
-}
-function revisionRef(value, worker = false) {
-    const o = object(value, ["id", "revision"]);
-    if (!positive(o.revision))
-        fail();
-    return { id: worker ? reference(o.id) : digestValue(o.id), revision: o.revision };
-}
-function segments(value, root) {
-    if (!Array.isArray(value) || !root && value.length === 0)
-        return fail();
-    if (value.length > 32)
-        fail("limit-exceeded");
-    let bytes = 0;
-    return value.map((s, i) => {
-        const segment = stringValue(s);
-        const size = Buffer.byteLength(segment);
-        if (size > 255)
-            fail("limit-exceeded");
-        if (!segment || segment === "." || segment === ".." || /[/\\\x00]/.test(segment))
-            fail();
-        bytes += size + (i > 0 ? 1 : 0);
-        if (bytes > 4096)
-            fail("limit-exceeded");
-        return segment;
-    });
-}
-function validatedInput(value) {
-    const o = object(value, ["steps"]);
-    if (!Array.isArray(o.steps) || o.steps.length === 0)
-        return fail();
-    if (o.steps.length > WORKER_CONTRACT.maxSteps)
-        fail("limit-exceeded");
-    let bounded = 0, total = 0;
-    const steps = o.steps.map((value) => {
-        const s = object(value, ["action", "segments"], ["limit", "maxBytes"]);
-        switch (s.action) {
-            case "nas.files.list":
-                if (!positive(s.limit) || Object.hasOwn(s, "maxBytes"))
-                    return fail();
-                if (s.limit > 200)
-                    fail("limit-exceeded");
-                return { action: s.action, segments: segments(s.segments, true), limit: s.limit };
-            case "nas.files.stat":
-                if (Object.hasOwn(s, "limit") || Object.hasOwn(s, "maxBytes"))
-                    fail();
-                return { action: s.action, segments: segments(s.segments, true) };
-            case "nas.files.read":
-            case "nas.files.read-stream": {
-                if (!positive(s.maxBytes) || Object.hasOwn(s, "limit"))
-                    return fail();
-                const ceiling = s.action === "nas.files.read" ? 1 << 20 : 64 << 20;
-                if (s.maxBytes > ceiling)
-                    fail("limit-exceeded");
-                total += s.maxBytes;
-                if (s.action === "nas.files.read")
-                    bounded += s.maxBytes;
-                if (total > 64 << 20 || bounded > 1 << 20)
-                    fail("limit-exceeded");
-                return { action: s.action, segments: segments(s.segments, false), maxBytes: s.maxBytes };
-            }
-            default: return fail("unsupported");
-        }
-    });
-    const input = { steps };
-    if (encodeInput(input, "0".repeat(64)).byteLength > WORKER_CONTRACT.maxInputBytes)
-        fail("limit-exceeded");
-    return input;
-}
-export function decodeWorkerInput(raw) {
-    return validatedInput(strictJSON(raw, WORKER_CONTRACT.maxInputBytes));
-}
-// Identical to Go input v1: domain NUL, 32 schema bytes, big-endian counts,
-// length-prefixed UTF-8 strings, and one uint64 action parameter per step.
-function encodeInput(input, schemaDigest) {
-    const chunks = [Buffer.from("synopkgland/m3/input/v1\0"), Buffer.from(schemaDigest, "hex")];
-    const u32 = (n) => { const b = Buffer.alloc(4); b.writeUInt32BE(n); chunks.push(b); };
-    const text = (s) => { const b = Buffer.from(s); u32(b.byteLength); chunks.push(b); };
-    u32(input.steps.length);
-    for (const step of input.steps) {
-        text(step.action);
-        u32(step.segments.length);
-        for (const segment of step.segments)
-            text(segment);
-        const b = Buffer.alloc(8);
-        b.writeBigUInt64BE(BigInt("limit" in step ? step.limit : "maxBytes" in step ? step.maxBytes : 0));
-        chunks.push(b);
-    }
-    return Buffer.concat(chunks);
-}
-export function workerInputDigest(input, schemaDigest) {
-    digestValue(schemaDigest);
-    return createHash("sha256").update(encodeInput(validatedInput(input), schemaDigest)).digest("hex");
-}
-function validatedBinding(value) {
-    const b = object(value, ["inventory", "jobSchema", "epoch", "job", "worker", "parentGrant", "approvalBinding", "capabilityDigest", "inputSchemaDigest", "inputDigest", "mode"], ["delegation"]);
-    const i = object(b.inventory, ["package", "version", "protocol", "payloadDigest", "registryDigest", "dataAccess"]);
-    if (i.protocol !== 2 || b.jobSchema !== 1 || i.dataAccess !== "relaxed")
-        fail("incompatible");
-    const packageId = stringValue(i.package), version = stringValue(i.version);
-    if (!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(packageId) || !/^\d+(\.\d+){0,3}-\d{4}$/.test(version))
-        fail();
-    const base = {
-        inventory: { package: packageId, version, protocol: 2, payloadDigest: digestValue(i.payloadDigest), registryDigest: digestValue(i.registryDigest), dataAccess: "relaxed" },
-        jobSchema: 1, epoch: digestValue(b.epoch), job: revisionRef(b.job), worker: revisionRef(b.worker, true), parentGrant: revisionRef(b.parentGrant),
-        approvalBinding: digestValue(b.approvalBinding), capabilityDigest: digestValue(b.capabilityDigest), inputSchemaDigest: digestValue(b.inputSchemaDigest), inputDigest: digestValue(b.inputDigest),
-    };
-    if (b.mode === "interactive") {
-        if (Object.hasOwn(b, "delegation"))
-            fail();
-        return { ...base, mode: "interactive" };
-    }
-    if (b.mode === "background")
-        return { ...base, mode: "background", delegation: revisionRef(b.delegation) };
-    return fail("incompatible");
-}
-export function decodeWorkerControl(raw) {
-    const r = object(strictJSON(raw, WORKER_CONTRACT.maxControlBytes), ["op", "binding", "intent", "nonce", "ticket"]);
-    const binding = validatedBinding(r.binding);
-    if (r.op !== "jobs.submit" && r.op !== "jobs.cancel" && r.op !== "background.revoke")
-        fail("unsupported");
-    if (r.op === "background.revoke" && binding.mode !== "background")
-        fail("incompatible");
-    return { op: r.op, binding, intent: revisionRef(r.intent), nonce: digestValue(r.nonce), ticket: digestValue(r.ticket) };
-}
-export function compareWorkerBinding(got, expected) {
-    if (!isDeepStrictEqual(validatedBinding(got), validatedBinding(expected)))
-        fail("incompatible");
-}

package/dist/standalone/worker-registry.d.ts

@@ -1,40 +0,0 @@
-import { type WorkerAction, type WorkerDescriptor, type WorkerLimits, type WorkerMode, type WorkerSafeReason } from "./worker-contract.js";
-export interface SDKWorkerConfig {
-    kind: "sdk-read-plan";
-    workerRevision: number;
-    actions: WorkerAction[];
-    modes: WorkerMode[];
-    limits: WorkerLimits;
-}
-export interface SDKRegistry {
-    registrySchema: 2;
-    productionAvailability: "unavailable";
-    inert: {
-        id: string;
-        digest: string;
-    }[];
-    sdk: WorkerDescriptor[];
-}
-export interface WorkerSourceBindings {
-    handlerBinding: string;
-    inputSchemaDigest: string;
-    outputSchemaDigest: string;
-}
-export interface WorkerResult {
-    resultSchema: 1;
-    completedSteps: number;
-    entries: number;
-    bytesRead: number;
-    safeReason?: WorkerSafeReason;
-}
-/** Manifest metadata only; never accepts a source path or a caller-chosen digest. */
-export declare function parseSDKWorkers(value: unknown, inertIDs?: readonly string[]): Record<string, SDKWorkerConfig>;
-/** Must match jobcontract/bindings.go; filenames and exact source bytes are bound. */
-export declare function sourceWorkerBindings(backend: string): WorkerSourceBindings;
-export declare function buildWorkerRegistry(inert: readonly {
-    id: string;
-    digest: string;
-}[], sdkWorkers: Record<string, SDKWorkerConfig> | undefined, backend: string): string;
-/** Structural/artifact inspection only; the compiled Go consumer checks source bindings. */
-export declare function decodeSDKRegistry(raw: string | Uint8Array): SDKRegistry;
-export declare function decodeWorkerResult(raw: string | Uint8Array): WorkerResult;

package/dist/standalone/worker-registry.js

@@ -1,167 +0,0 @@
-import { createHash } from "node:crypto";
-import { lstatSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-import { inertWorkerRegistry } from "./helper-inventory.js";
-import { WORKER_CONTRACT } from "./worker-contract.js";
-import { fail, strictJSON } from "./worker-contract-json.js";
-const actions = ["nas.files.list", "nas.files.stat", "nas.files.read", "nas.files.read-stream"];
-const modes = ["interactive", "background"];
-const checkpoints = ["before-step", "before-chunk", "before-result"];
-const ceilings = {
-    inputBytes: 8192, steps: 16, totalMs: 120000, idleMs: 10000, metadataMs: 5000,
-    boundedMs: 10000, boundedBytes: 1048576, streamBytes: 67108864, chunkBytes: 65536, outstandingLeases: 1,
-};
-const idPattern = /^[a-z][a-z0-9_]{0,31}$/;
-const digestPattern = /^[a-f0-9]{64}$/;
-const asciiCompare = (a, b) => a < b ? -1 : a > b ? 1 : 0;
-function object(value, required, optional = []) {
-    if (typeof value !== "object" || value === null || Array.isArray(value))
-        return fail();
-    const o = value;
-    if (required.some(k => !Object.hasOwn(o, k)) || Object.keys(o).some(k => !required.includes(k) && !optional.includes(k)))
-        fail();
-    return o;
-}
-function bounded(value, max, min = 1) {
-    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < min)
-        return fail();
-    if (value > max)
-        fail("limit-exceeded");
-    return value;
-}
-function digest(value) {
-    if (typeof value !== "string" || !digestPattern.test(value))
-        return fail();
-    return value;
-}
-function subset(value, allowed) {
-    if (!Array.isArray(value) || !value.length || new Set(value).size !== value.length || value.some(v => !allowed.includes(v)))
-        return fail();
-    return allowed.filter(v => value.includes(v));
-}
-function limits(value, partial) {
-    const keys = Object.keys(ceilings);
-    const raw = object(value, partial ? [] : keys, partial ? keys : []);
-    const result = { ...ceilings };
-    for (const k of keys)
-        if (Object.hasOwn(raw, k))
-            result[k] = bounded(raw[k], ceilings[k]);
-    if (result.idleMs > result.totalMs || result.metadataMs > result.totalMs || result.boundedMs > result.totalMs || result.chunkBytes > result.streamBytes)
-        fail();
-    return result;
-}
-/** Manifest metadata only; never accepts a source path or a caller-chosen digest. */
-export function parseSDKWorkers(value, inertIDs = []) {
-    if (typeof value !== "object" || value === null || Array.isArray(value))
-        return fail();
-    const entries = Object.entries(value);
-    if (!entries.length || entries.length + inertIDs.length > WORKER_CONTRACT.maxWorkers)
-        fail("limit-exceeded");
-    return Object.fromEntries(entries.sort(([a], [b]) => asciiCompare(a, b)).map(([id, value]) => {
-        if (!idPattern.test(id) || inertIDs.includes(id))
-            fail();
-        const o = object(value, ["kind", "workerRevision", "actions", "modes"], ["limits"]);
-        if (o.kind !== "sdk-read-plan")
-            fail("unsupported");
-        return [id, {
-                kind: "sdk-read-plan", workerRevision: bounded(o.workerRevision, Number.MAX_SAFE_INTEGER),
-                actions: subset(o.actions, actions), modes: subset(o.modes, modes),
-                limits: limits(Object.hasOwn(o, "limits") ? o.limits : {}, true),
-            }];
-    }));
-}
-/** Must match jobcontract/bindings.go; filenames and exact source bytes are bound. */
-export function sourceWorkerBindings(backend) {
-    const hash = (kind, names, root = "internal/helper/jobcontract", version = 1) => {
-        const h = createHash("sha256").update(`synopkgland/m3/${kind}/source-v${version}\0`);
-        for (const name of names) {
-            const path = join(backend, root, name);
-            if (!lstatSync(path).isFile() || lstatSync(path).size > 1048576)
-                fail();
-            for (const b of [Buffer.from(name), readFileSync(path)]) {
-                const size = Buffer.alloc(4);
-                size.writeUInt32BE(b.length);
-                h.update(size).update(b);
-            }
-        }
-        return h.digest("hex");
-    };
-    return {
-        handlerBinding: hash("handler", ["jobcontract/stub.go", "sdk_job_child_linux.go", "sdk_job_process_linux.go", "sdk_job.go", "sdk_attach.go", "sdk_rpc.go", "sdk_session.go", "sdk_session_contract.go"], "internal/helper", 2),
-        inputSchemaDigest: hash("input", ["decode.go", "digest.go", "types.go", "validate.go"]),
-        outputSchemaDigest: hash("result", ["decode.go", "result.go", "types.go", "validate.go"]),
-    };
-}
-export function buildWorkerRegistry(inert, sdkWorkers, backend) {
-    // Do not even read new SDK files for legacy projects (including old templates).
-    if (sdkWorkers === undefined)
-        return inertWorkerRegistry(inert);
-    const configs = parseSDKWorkers(sdkWorkers, inert.map(w => w.id));
-    const bindings = sourceWorkerBindings(backend);
-    const registry = {
-        registrySchema: 2, productionAvailability: "unavailable",
-        inert: inert.map(({ id, digest }) => ({ id, digest })).sort((a, b) => asciiCompare(a.id, b.id)),
-        sdk: Object.entries(configs).map(([workerId, c]) => ({
-            registrySchema: 2, workerId, workerRevision: c.workerRevision, kind: c.kind,
-            ...bindings, actions: c.actions, modes: c.modes, checkpoints: [...checkpoints], limits: c.limits,
-        })),
-    };
-    const raw = JSON.stringify(registry);
-    decodeSDKRegistry(raw);
-    return raw;
-}
-/** Structural/artifact inspection only; the compiled Go consumer checks source bindings. */
-export function decodeSDKRegistry(raw) {
-    const r = object(strictJSON(raw, WORKER_CONTRACT.maxArtifactBytes), ["registrySchema", "productionAvailability", "inert", "sdk"]);
-    if (r.registrySchema !== 2 || r.productionAvailability !== "unavailable")
-        fail("incompatible");
-    if (!Array.isArray(r.inert) || !Array.isArray(r.sdk) || !r.sdk.length || r.inert.length + r.sdk.length > WORKER_CONTRACT.maxWorkers)
-        return fail();
-    const ids = new Set();
-    let previous = "";
-    const id = (value) => {
-        if (typeof value !== "string" || !idPattern.test(value) || value <= previous || ids.has(value))
-            return fail();
-        previous = value;
-        ids.add(value);
-        return value;
-    };
-    const inert = r.inert.map(value => {
-        const w = object(value, ["id", "digest"]);
-        return { id: id(w.id), digest: digest(w.digest) };
-    });
-    previous = "";
-    const sdk = r.sdk.map(value => {
-        const w = object(value, ["registrySchema", "workerId", "workerRevision", "kind", "handlerBinding", "inputSchemaDigest", "outputSchemaDigest", "actions", "modes", "checkpoints", "limits"]);
-        if (w.registrySchema !== 2 || w.kind !== "sdk-read-plan")
-            fail("incompatible");
-        if (JSON.stringify(w.checkpoints) !== JSON.stringify(checkpoints))
-            fail();
-        return {
-            registrySchema: 2, workerId: id(w.workerId), workerRevision: bounded(w.workerRevision, Number.MAX_SAFE_INTEGER), kind: "sdk-read-plan",
-            handlerBinding: digest(w.handlerBinding), inputSchemaDigest: digest(w.inputSchemaDigest), outputSchemaDigest: digest(w.outputSchemaDigest),
-            actions: subset(w.actions, actions), modes: subset(w.modes, modes), checkpoints: [...checkpoints], limits: limits(w.limits, false),
-        };
-    });
-    const result = { registrySchema: 2, productionAvailability: "unavailable", inert, sdk };
-    // One byte representation is compiled and approved; no aliases or reordering.
-    if (JSON.stringify(result) !== (typeof raw === "string" ? raw : Buffer.from(raw).toString("utf8")))
-        fail();
-    return result;
-}
-const safeReasons = ["invalid-request", "incompatible", "unsupported", "replay", "stale", "expired", "denied", "unavailable", "suspended", "revoked", "fenced", "busy", "limit-exceeded", "canceled", "timeout", "partial", "commit-uncertain", "cleanup-required", "internal"];
-export function decodeWorkerResult(raw) {
-    const r = object(strictJSON(raw, WORKER_CONTRACT.maxProgressBytes), ["resultSchema", "completedSteps", "entries", "bytesRead"], ["safeReason"]);
-    if (r.resultSchema !== 1)
-        fail("incompatible");
-    const result = {
-        resultSchema: 1, completedSteps: bounded(r.completedSteps, 16, 0),
-        entries: bounded(r.entries, 3200, 0), bytesRead: bounded(r.bytesRead, 67108864, 0),
-    };
-    if (Object.hasOwn(r, "safeReason")) {
-        if (!safeReasons.includes(r.safeReason))
-            fail();
-        result.safeReason = r.safeReason;
-    }
-    return result;
-}

package/dist/templates/_authorization/main.go

@@ -1,104 +0,0 @@
-// CLI-owned root bootstrap: accepts only compiled fixed operations. The native
-// task copies and pins this executable before it can run with root authority.
-package main
-
-import (
-	"crypto/sha256"
-	"encoding/base64"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"os/exec"
-)
-
-var inventoryBase64 string
-
-type inventory struct {
-	Schema     int    `json:"schema"`
-	Package    string `json:"package"`
-	Version    string `json:"version"`
-	Operations []struct {
-		Name string `json:"name"`
-		Body string `json:"body"`
-	} `json:"operations"`
-	Files []struct {
-		Path string `json:"path"`
-		Size int64  `json:"size"`
-		Hash string `json:"sha256"`
-	} `json:"files"`
-}
-
-func run(args []string) error {
-	if os.Geteuid() != 0 || len(args) != 1 {
-		return errors.New("root and one fixed operation required")
-	}
-	var i inventory
-	raw, decode := base64.StdEncoding.DecodeString(inventoryBase64)
-	if decode != nil || json.Unmarshal(raw, &i) != nil || i.Schema != 2 || len(i.Operations) == 0 {
-		return errors.New("invalid compiled inventory")
-	}
-	var body string
-	for _, op := range i.Operations {
-		if op.Name == args[0] {
-			body = op.Body
-		}
-	}
-	if body == "" {
-		return errors.New("unknown operation")
-	}
-	// Disable/teardown/repair retain an escape path when UI payload is corrupt;
-	// they still execute only compiled, hash-pinned cleanup code.
-	cleanup := args[0] == "helper_disable" || args[0] == "helper_teardown" || args[0] == "helper_repair" || args[0] == "helper_purge"
-	if !cleanup {
-		if e := verifyFiles("/var/packages/"+i.Package+"/target", raw); e != nil {
-			return e
-		}
-	}
-	cmd := exec.Command("/bin/sh", "-eu", "-c", body)
-	cmd.Env = []string{"PATH=/usr/sbin:/usr/bin:/sbin:/bin"}
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-	return cmd.Run()
-}
-func verifyFiles(dir string, raw []byte) error {
-	var i inventory
-	if json.Unmarshal(raw, &i) != nil || i.Schema != 2 {
-		return errors.New("invalid inventory")
-	}
-	root, e := os.OpenRoot(dir)
-	if e != nil {
-		return e
-	}
-	defer root.Close()
-	for _, p := range i.Files {
-		if p.Size < 0 || p.Size > 64<<20 {
-			return errors.New("invalid size")
-		}
-		f, e := root.Open(p.Path)
-		if e != nil {
-			return e
-		}
-		st, e := f.Stat()
-		if e != nil || !st.Mode().IsRegular() || st.Size() != p.Size {
-			f.Close()
-			return errors.New("untrusted payload")
-		}
-		h := sha256.New()
-		_, e = io.Copy(h, io.LimitReader(f, p.Size+1))
-		f.Close()
-		if e != nil || hex.EncodeToString(h.Sum(nil)) != p.Hash {
-			return errors.New("untrusted payload")
-		}
-	}
-	return nil
-}
-
-func main() {
-	if e := run(os.Args[1:]); e != nil {
-		fmt.Fprintln(os.Stderr, "authorization bootstrap refused:", e)
-		os.Exit(1)
-	}
-}