@tokenfactory/acc-runner 0.44.8 → 0.44.10

package/dist/secure-execution/index.js

@@ -0,0 +1,6 @@
+export { confinedCwd } from "./confinement.js";
+export { commandDigest, SecureExecutionEngine } from "./engine.js";
+export { NodePtyFactory } from "./node-pty.js";
+export { SupabaseAutoLeaseVerifier, MemoryCompletionOutbox, bindIssuedAutoLease } from "./auto-lease.js";
+export { assertAutoExecutionPolicy } from "./command-policy.js";
+//# sourceMappingURL=index.js.map

package/dist/secure-execution/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/secure-execution/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACzG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/secure-execution/node-pty.d.ts

@@ -0,0 +1,11 @@
+import type { PtyFactory, PtyProcess } from "./types.js";
+/** Production adapter; tests inject a deterministic PtyFactory. */
+export declare class NodePtyFactory implements PtyFactory {
+    spawn(file: string, args: string[], options: {
+        cwd: string;
+        env: Record<string, string>;
+        cols: number;
+        rows: number;
+    }): PtyProcess;
+}
+//# sourceMappingURL=node-pty.d.ts.map

package/dist/secure-execution/node-pty.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-pty.d.ts","sourceRoot":"","sources":["../../src/secure-execution/node-pty.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAKzD,mEAAmE;AACnE,qBAAa,cAAe,YAAW,UAAU;IAC/C,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,UAAU;CAqBnI"}

package/dist/secure-execution/node-pty.js

@@ -0,0 +1,27 @@
+import { createRequire } from "node:module";
+const require = createRequire(import.meta.url);
+/** Production adapter; tests inject a deterministic PtyFactory. */
+export class NodePtyFactory {
+    spawn(file, args, options) {
+        // Resolve lazily so importing the bounded console does not load a native
+        // addon. Packaged runners include node-pty; stripped test installs can still
+        // exercise every policy through an injected PtyFactory.
+        const nodePty = require("node-pty");
+        const child = nodePty.spawn(file, args, {
+            cwd: options.cwd,
+            env: options.env,
+            cols: options.cols,
+            rows: options.rows,
+            name: options.env.TERM ?? "xterm-256color",
+        });
+        return {
+            get pid() { return child.pid; },
+            write: (data) => child.write(data),
+            resize: (cols, rows) => child.resize(cols, rows),
+            kill: (signal) => child.kill(signal),
+            onData: (callback) => child.onData(callback),
+            onExit: (callback) => child.onExit(callback),
+        };
+    }
+}
+//# sourceMappingURL=node-pty.js.map

package/dist/secure-execution/node-pty.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-pty.js","sourceRoot":"","sources":["../../src/secure-execution/node-pty.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAI5C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,mEAAmE;AACnE,MAAM,OAAO,cAAc;IACzB,KAAK,CAAC,IAAY,EAAE,IAAc,EAAE,OAAiF;QACnH,yEAAyE;QACzE,6EAA6E;QAC7E,wDAAwD;QACxD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAkB,CAAC;QACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE;YACtC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,gBAAgB;SAC3C,CAAC,CAAC;QACH,OAAO;YACL,IAAI,GAAG,KAAK,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/B,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;YAClC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;YAChD,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;YACpC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC5C,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;SAC7C,CAAC;IACJ,CAAC;CACF"}

package/dist/secure-execution/types.d.ts

@@ -0,0 +1,176 @@
+export type ExecutionMode = "human" | "auto";
+export type ExecutionTermination = "exited" | "cancelled" | "expired" | "output_limit" | "resource_limit" | "quarantined" | "policy_denied";
+export interface AutoExecutionLease {
+    leaseId: string;
+    leaseToken?: string;
+    issueReceiptId?: string;
+    orgId?: string;
+    userId?: string;
+    profileId?: string;
+    runnerId: string;
+    repo: string;
+    paths?: string[];
+    commandClass?: string;
+    networkDestinations?: string[];
+    commandDigest: string;
+    expiresAt: string;
+    nonce?: string;
+    limits?: Pick<ExecutionLimits, "wallMs" | "outputBytes" | "cpuSeconds" | "memoryMb">;
+}
+export interface AutoLeaseVerifier {
+    verify(lease: AutoExecutionLease, context: AutoLeaseVerificationContext): Promise<AutoLeaseVerdict>;
+}
+export interface AutoLeaseVerificationContext {
+    runnerId: string;
+    orgId?: string;
+    userId?: string;
+    repo: string;
+    paths: string[];
+    commandClass?: string;
+    commandDigest: string;
+    destinations: NetworkDestination[];
+    limits: ExecutionLimits;
+    now: Date;
+}
+export interface AutoLeaseVerdict {
+    valid: boolean;
+    reason?: string;
+    consumeReceiptId?: string;
+    profileId?: string;
+}
+export interface SecretProvider {
+    resolve(names: readonly string[], context: {
+        repo: string;
+        sessionId: string;
+    }): Promise<Record<string, string>>;
+}
+export interface NetworkDestination {
+    host: string;
+    port: number;
+    protocol: "tcp" | "udp" | "https";
+}
+export interface DestinationPolicy {
+    authorize(destinations: readonly NetworkDestination[], context: {
+        repo: string;
+        mode: ExecutionMode;
+    }): Promise<{
+        allowed: boolean;
+        reason?: string;
+    }>;
+    /** Install the runtime egress boundary for a spawned AUTO process. Merely
+     * authorizing a list is insufficient: AUTO fails closed without this hook. */
+    activate?(pid: number, destinations: readonly NetworkDestination[], context: {
+        repo: string;
+        mode: ExecutionMode;
+    }): Promise<{
+        dispose(): void;
+    }>;
+}
+export interface ExecutionLimits {
+    wallMs: number;
+    outputBytes: number;
+    inputBytes: number;
+    maxCols: number;
+    maxRows: number;
+    cpuSeconds: number;
+    memoryMb: number;
+}
+export interface ResourceController {
+    attach(pid: number, limits: Pick<ExecutionLimits, "cpuSeconds" | "memoryMb">, onExceeded: () => void): Promise<{
+        dispose(): void;
+    }>;
+}
+export interface SecureExecutionRequest {
+    sessionId: string;
+    runnerId: string;
+    repo: string;
+    orgId?: string;
+    userId?: string;
+    repoRoot: string;
+    cwd?: string;
+    paths?: string[];
+    commandClass?: string;
+    command: string;
+    mode: ExecutionMode;
+    autoLease?: AutoExecutionLease;
+    secretNames?: string[];
+    destinations?: NetworkDestination[];
+    env?: Record<string, string>;
+    limits?: Partial<ExecutionLimits>;
+}
+export interface AutoCompletionRecord {
+    idempotencyKey: string;
+    leaseId: string;
+    issueReceiptId?: string;
+    consumeReceiptId?: string;
+    profileId?: string;
+    execution: ExecutionReceipt;
+}
+export interface AutoCompletionReporter {
+    report(record: AutoCompletionRecord): Promise<void>;
+}
+export interface AutoCompletionRetrySink {
+    enqueue(record: AutoCompletionRecord): Promise<void>;
+}
+export interface ExecutionFrame {
+    sequence: number;
+    stream: "pty" | "system";
+    content: string;
+    bytes: number;
+    at: string;
+}
+export interface ExecutionReceipt {
+    sessionId: string;
+    repo: string;
+    commandDigest: string;
+    mode: ExecutionMode;
+    cwd: string;
+    startedAt: string;
+    finishedAt: string;
+    exitCode: number | null;
+    termination: ExecutionTermination;
+    outputBytes: number;
+    secretNames: string[];
+    destinations: NetworkDestination[];
+}
+export interface ProvenanceSink {
+    record(event: "execution.started" | "execution.finished" | "execution.denied", payload: Record<string, unknown>): Promise<void>;
+}
+export interface QuarantineSource {
+    current(): Promise<{
+        quarantined: boolean;
+        reason?: string;
+    }>;
+}
+export interface PtyProcess {
+    readonly pid: number;
+    write(data: string): void;
+    resize(cols: number, rows: number): void;
+    kill(signal?: string): void;
+    onData(callback: (data: string) => void): {
+        dispose(): void;
+    };
+    onExit(callback: (event: {
+        exitCode: number;
+        signal?: number;
+    }) => void): {
+        dispose(): void;
+    };
+}
+export interface PtyFactory {
+    spawn(file: string, args: string[], options: {
+        cwd: string;
+        env: Record<string, string>;
+        cols: number;
+        rows: number;
+    }): PtyProcess;
+}
+export interface SecureExecutionSession {
+    readonly id: string;
+    write(data: string): void;
+    resize(cols: number, rows: number): void;
+    cancel(): void;
+    reconnect(afterSequence?: number): ExecutionFrame[];
+    wait(): Promise<ExecutionReceipt>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/secure-execution/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/secure-execution/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,CAAC;AAC7C,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,cAAc,GAAG,gBAAgB,GAAG,aAAa,GAAG,eAAe,CAAC;AAE5I,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,UAAU,CAAC,CAAC;CACtF;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACrG;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,kBAAkB,EAAE,CAAC;IACnC,MAAM,EAAE,eAAe,CAAC;IACxB,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClH;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,EAAE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,aAAa,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvJ;kFAC8E;IAC9E,QAAQ,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,kBAAkB,EAAE,EAAE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,aAAa,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,IAAI,IAAI,CAAA;KAAE,CAAC,CAAC;CACnJ;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,GAAG,UAAU,CAAC,EAAE,UAAU,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC;QAAE,OAAO,IAAI,IAAI,CAAA;KAAE,CAAC,CAAC;CACrI;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,gBAAgB,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,KAAK,GAAG,QAAQ,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,aAAa,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,oBAAoB,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,kBAAkB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,KAAK,EAAE,mBAAmB,GAAG,oBAAoB,GAAG,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjI;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,IAAI,OAAO,CAAC;QAAE,WAAW,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG;QAAE,OAAO,IAAI,IAAI,CAAA;KAAE,CAAC;IAC9D,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG;QAAE,OAAO,IAAI,IAAI,CAAA;KAAE,CAAC;CAC/F;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,UAAU,CAAC;CACpI;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,MAAM,IAAI,IAAI,CAAC;IACf,SAAS,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,cAAc,EAAE,CAAC;IACpD,IAAI,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACnC"}

package/dist/secure-execution/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/secure-execution/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/secure-execution/types.ts"],"names":[],"mappings":""}

package/dist/staging-migrations/command.d.ts

@@ -0,0 +1,2 @@
+export declare function applyApprovedStagingMigrationCommand(planId: string): Promise<void>;
+//# sourceMappingURL=command.d.ts.map

package/dist/staging-migrations/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/staging-migrations/command.ts"],"names":[],"mappings":"AAWA,wBAAsB,oCAAoC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8CxF"}

package/dist/staging-migrations/command.js

@@ -0,0 +1,58 @@
+import { loadConfig } from "../config.js";
+import { getTokenProvider } from "../token-provider.js";
+import { createRunnerClient } from "../supabase.js";
+import { resolveMachineRepoPath } from "../machine-console/index.js";
+import { executeApprovedStagingPlan } from "./executor.js";
+import { PgStagingTarget } from "./pg-target.js";
+function rpcError(error, fallback) {
+    throw new Error(error?.message ?? fallback);
+}
+export async function applyApprovedStagingMigrationCommand(planId) {
+    const cfg = loadConfig();
+    const session = await getTokenProvider().load();
+    if (!session?.runner_id)
+        throw new Error("runner login required");
+    const sb = createRunnerClient(cfg, session.access_token, session.realtime_config);
+    const claimed = await sb.rpc("claim_staging_migration_plan", { p_plan_id: planId });
+    if (claimed.error)
+        rpcError(claimed.error, "could not claim staging migration plan");
+    const payload = claimed.data;
+    if (!payload.plan || !payload.credential_profile_ref || !Array.isArray(payload.items))
+        throw new Error("invalid migration claim receipt");
+    const plan = {
+        ...payload.plan,
+        credential_profile_ref: payload.credential_profile_ref,
+        items: payload.items,
+    };
+    const repoRoot = resolveMachineRepoPath(cfg, plan.repo);
+    const target = new PgStagingTarget(plan.credential_profile_ref);
+    const receipts = {
+        item: async (ordinal, status, errorCode) => {
+            const result = await sb.rpc("record_staging_migration_item", {
+                p_plan_id: plan.id,
+                p_ordinal: ordinal,
+                p_status: status,
+                p_error_code: errorCode ?? null,
+            });
+            if (result.error)
+                rpcError(result.error, "could not record migration item receipt");
+        },
+        complete: async (succeeded, failureCode) => {
+            const result = await sb.rpc("complete_staging_migration_plan", {
+                p_plan_id: plan.id,
+                p_succeeded: succeeded,
+                p_failure_code: failureCode ?? null,
+            });
+            if (result.error)
+                rpcError(result.error, "could not record migration completion receipt");
+        },
+    };
+    await target.connect();
+    try {
+        await executeApprovedStagingPlan(plan, repoRoot, target, receipts);
+    }
+    finally {
+        await target.close();
+    }
+}
+//# sourceMappingURL=command.js.map

package/dist/staging-migrations/command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../../src/staging-migrations/command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAA8B,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,SAAS,QAAQ,CAAC,KAAkC,EAAE,QAAgB;IACpE,MAAM,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,IAAI,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,MAAc;IACvE,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,MAAM,gBAAgB,EAAE,CAAC,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAClE,MAAM,EAAE,GAAG,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,8BAA8B,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,KAAK;QAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,wCAAwC,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,OAAO,CAAC,IAIvB,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,sBAAsB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG;QACX,GAAG,OAAO,CAAC,IAAI;QACf,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,KAAK,EAAE,OAAO,CAAC,KAAK;KACe,CAAC;IACtC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG;QACf,IAAI,EAAE,KAAK,EAAE,OAAe,EAAE,MAAwC,EAAE,SAAkB,EAAE,EAAE;YAC5F,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,+BAA+B,EAAE;gBAC3D,SAAS,EAAE,IAAI,CAAC,EAAE;gBAClB,SAAS,EAAE,OAAO;gBAClB,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,SAAS,IAAI,IAAI;aAChC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,KAAK;gBAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,yCAAyC,CAAC,CAAC;QACtF,CAAC;QACD,QAAQ,EAAE,KAAK,EAAE,SAAkB,EAAE,WAAoB,EAAE,EAAE;YAC3D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,iCAAiC,EAAE;gBAC7D,SAAS,EAAE,IAAI,CAAC,EAAE;gBAClB,WAAW,EAAE,SAAS;gBACtB,cAAc,EAAE,WAAW,IAAI,IAAI;aACpC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,KAAK;gBAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,+CAA+C,CAAC,CAAC;QAC5F,CAAC;KACF,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,0BAA0B,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrE,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/staging-migrations/executor.d.ts

@@ -0,0 +1,49 @@
+export interface ApprovedMigrationItem {
+    ordinal: number;
+    seq: string;
+    slug: string;
+    path: string;
+    sha: string;
+    status: "pending" | "skipped" | "applied" | "failed";
+}
+export interface ApprovedMigrationPlan {
+    id: string;
+    repo: string;
+    commit_sha: string;
+    staging_project_ref: string;
+    credential_profile_ref: string;
+    ledger_head_seq: string | null;
+    plan_hash: string;
+    items: ApprovedMigrationItem[];
+}
+export interface StagingTarget {
+    projectRef(): Promise<string>;
+    tryAdvisoryLock(key: string): Promise<boolean>;
+    unlockAdvisory(key: string): Promise<void>;
+    ledgerHead(): Promise<string | null>;
+    ledger(seq: string): Promise<{
+        slug: string;
+        sha: string;
+    } | null>;
+    apply(sql: string): Promise<void>;
+}
+export interface MigrationExecutionHooks {
+    /** Observed between files; a migration already handed to Postgres is never interrupted. */
+    cancelled?: () => Promise<boolean>;
+    heartbeat?: (event: "lock_acquired" | "item_started" | "item_finished") => Promise<void>;
+}
+export declare class StagingMigrationCancelledError extends Error {
+    constructor();
+}
+export interface MigrationReceiptSink {
+    item(ordinal: number, status: "skipped" | "applied" | "failed", errorCode?: string): Promise<void>;
+    complete(succeeded: boolean, failureCode?: string): Promise<void>;
+}
+export declare function canonicalPlanHash(plan: Pick<ApprovedMigrationPlan, "repo" | "commit_sha" | "staging_project_ref" | "ledger_head_seq" | "items">): string;
+/**
+ * Applies only the exact files named by an approved plan. Each migration file
+ * owns its transaction; execution stops at the first failure and can be safely
+ * resumed because already-ledgered items are hash checked then skipped.
+ */
+export declare function executeApprovedStagingPlan(plan: ApprovedMigrationPlan, repoRoot: string, target: StagingTarget, receipts: MigrationReceiptSink, hooks?: MigrationExecutionHooks): Promise<void>;
+//# sourceMappingURL=executor.d.ts.map

package/dist/staging-migrations/executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/staging-migrations/executor.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;CACtD;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,qBAAqB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,UAAU,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACnE,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,2FAA2F;IAC3F,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,GAAG,cAAc,GAAG,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1F;AAED,qBAAa,8BAA+B,SAAQ,KAAK;;CAIxD;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CACF,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,EACxC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,IAAI,CACR,qBAAqB,EACrB,MAAM,GAAG,YAAY,GAAG,qBAAqB,GAAG,iBAAiB,GAAG,OAAO,CAC5E,GACA,MAAM,CAeR;AA4BD;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,qBAAqB,EAC3B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,oBAAoB,EAC9B,KAAK,GAAE,uBAA4B,GAClC,OAAO,CAAC,IAAI,CAAC,CA2Df"}

package/dist/staging-migrations/executor.js

@@ -0,0 +1,125 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { isSha256Digest } from "../commit-sha.js";
+export class StagingMigrationCancelledError extends Error {
+    constructor() {
+        super("staging_migration_cancelled");
+    }
+}
+export function canonicalPlanHash(plan) {
+    const value = JSON.stringify({
+        repo: plan.repo.toLowerCase(),
+        commitSha: plan.commit_sha.toLowerCase(),
+        stagingProjectRef: plan.staging_project_ref,
+        ledgerHeadSeq: plan.ledger_head_seq,
+        items: plan.items.map(({ ordinal, seq, slug, path: migrationPath, sha }) => ({
+            ordinal,
+            seq,
+            slug,
+            path: migrationPath,
+            sha,
+        })),
+    });
+    return createHash("sha256").update(value).digest("hex");
+}
+function assertPlan(plan) {
+    if (plan.staging_project_ref === "ctknjrtevjrzwpuojghx")
+        throw new Error("production_target_forbidden");
+    if (!/^[a-z0-9]{20}$/.test(plan.staging_project_ref))
+        throw new Error("staging_project_pin_invalid");
+    if (plan.items.length === 0 || canonicalPlanHash(plan) !== plan.plan_hash)
+        throw new Error("plan_hash_mismatch");
+    let previous = plan.ledger_head_seq ? Number(plan.ledger_head_seq) : null;
+    for (const [index, item] of plan.items.entries()) {
+        const expectedPath = `supabase/migrations/${item.seq}_${item.slug}.sql`;
+        if (item.ordinal !== index || item.path !== expectedPath || !isSha256Digest(item.sha)) {
+            throw new Error("plan_item_invalid");
+        }
+        if (previous !== null && Number(item.seq) !== previous + 1)
+            throw new Error("plan_not_contiguous");
+        previous = Number(item.seq);
+    }
+}
+function fileInsideRepo(repoRoot, migrationPath) {
+    const root = path.resolve(repoRoot);
+    const resolved = path.resolve(root, migrationPath);
+    if (!resolved.startsWith(`${root}${path.sep}`))
+        throw new Error("migration_path_escape");
+    return resolved;
+}
+/**
+ * Applies only the exact files named by an approved plan. Each migration file
+ * owns its transaction; execution stops at the first failure and can be safely
+ * resumed because already-ledgered items are hash checked then skipped.
+ */
+export async function executeApprovedStagingPlan(plan, repoRoot, target, receipts, hooks = {}) {
+    const lockKey = `acc:staging-migrations:${plan.staging_project_ref}`;
+    let locked = false;
+    try {
+        assertPlan(plan);
+        if ((await target.projectRef()) !== plan.staging_project_ref)
+            throw new Error("staging_project_pin_mismatch");
+        if (!(await target.tryAdvisoryLock(lockKey)))
+            throw new Error("staging_migration_lock_busy");
+        locked = true;
+        const head = await target.ledgerHead();
+        const resumableHeads = new Set([plan.ledger_head_seq, ...plan.items.map((item) => item.seq)]);
+        if (!resumableHeads.has(head))
+            throw new Error("ledger_head_mismatch");
+        await hooks.heartbeat?.("lock_acquired");
+    }
+    catch (error) {
+        if (locked)
+            await target.unlockAdvisory(lockKey).catch(() => undefined);
+        await receipts.complete(false, error.message);
+        throw error;
+    }
+    try {
+        for (const item of plan.items) {
+            if (await hooks.cancelled?.())
+                throw new StagingMigrationCancelledError();
+            if (item.status === "applied" || item.status === "skipped")
+                continue;
+            await hooks.heartbeat?.("item_started");
+            const existing = await target.ledger(item.seq);
+            if (existing) {
+                if (existing.slug !== item.slug || existing.sha !== item.sha)
+                    throw new Error(`ledger_drift_${item.seq}`);
+                await receipts.item(item.ordinal, "skipped");
+                await hooks.heartbeat?.("item_finished");
+                continue;
+            }
+            const sql = await readFile(fileInsideRepo(repoRoot, item.path), "utf8");
+            const sha = createHash("sha256").update(sql).digest("hex");
+            if (sha !== item.sha)
+                throw new Error(`file_hash_mismatch_${item.seq}`);
+            try {
+                await target.apply(sql);
+                const recorded = await target.ledger(item.seq);
+                if (!recorded || recorded.slug !== item.slug || recorded.sha !== item.sha) {
+                    throw new Error(`ledger_receipt_missing_${item.seq}`);
+                }
+                await receipts.item(item.ordinal, "applied");
+                await hooks.heartbeat?.("item_finished");
+            }
+            catch (error) {
+                await receipts.item(item.ordinal, "failed", error.message);
+                throw error;
+            }
+        }
+        await receipts.complete(true);
+    }
+    catch (error) {
+        // A control-plane cancellation owns the terminal state. Its completion RPC
+        // intentionally rejects, so do not overwrite it with a second transition.
+        if (!(error instanceof StagingMigrationCancelledError)) {
+            await receipts.complete(false, error.message);
+        }
+        throw error;
+    }
+    finally {
+        await target.unlockAdvisory(lockKey);
+    }
+}
+//# sourceMappingURL=executor.js.map

package/dist/staging-migrations/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../src/staging-migrations/executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAqClD,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD;QACE,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACvC,CAAC;CACF;AAWD,MAAM,UAAU,iBAAiB,CAC/B,IAGC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3B,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAC7B,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE;QACxC,iBAAiB,EAAE,IAAI,CAAC,mBAAmB;QAC3C,aAAa,EAAE,IAAI,CAAC,eAAe;QACnC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,OAAO;YACP,GAAG;YACH,IAAI;YACJ,IAAI,EAAE,aAAa;YACnB,GAAG;SACJ,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,IAA2B;IAC7C,IAAI,IAAI,CAAC,mBAAmB,KAAK,sBAAsB;QACrD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS;QACvE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,IAAI,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,MAAM,YAAY,GAAG,uBAAuB,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,MAAM,CAAC;QACxE,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,GAAG,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,aAAqB;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACzF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAA2B,EAC3B,QAAgB,EAChB,MAAqB,EACrB,QAA8B,EAC9B,QAAiC,EAAE;IAEnC,MAAM,OAAO,GAAG,0BAA0B,IAAI,CAAC,mBAAmB,EAAE,CAAC;IACrE,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,CAAC;QACjB,IAAI,CAAC,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,IAAI,CAAC,mBAAmB;YAC1D,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC7F,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9F,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC,eAAe,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxE,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE;gBAAE,MAAM,IAAI,8BAA8B,EAAE,CAAC;YAC1E,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAS;YACrE,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC,CAAC;YACxC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;oBAC1D,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC9C,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;gBAC7C,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC,eAAe,CAAC,CAAC;gBACzC,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YACxE,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,GAAG,KAAK,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACxB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC/C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC1E,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBACxD,CAAC;gBACD,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;gBAC7C,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC,eAAe,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;gBACtE,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,CAAC,CAAC,KAAK,YAAY,8BAA8B,CAAC,EAAE,CAAC;YACvD,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;AACH,CAAC"}

package/dist/staging-migrations/pg-target.d.ts

@@ -0,0 +1,20 @@
+import type { StagingTarget } from "./executor.js";
+export declare function credentialEnvName(profileRef: string): string;
+export declare function projectRefFromUrl(value: string): string;
+export declare class PgStagingTarget implements StagingTarget {
+    private readonly client;
+    private readonly pinnedRef;
+    constructor(profileRef: string, env?: NodeJS.ProcessEnv);
+    connect(): Promise<void>;
+    close(): Promise<void>;
+    projectRef(): Promise<string>;
+    tryAdvisoryLock(key: string): Promise<boolean>;
+    unlockAdvisory(key: string): Promise<void>;
+    ledger(seq: string): Promise<{
+        slug: string;
+        sha: string;
+    } | null>;
+    ledgerHead(): Promise<string | null>;
+    apply(sql: string): Promise<void>;
+}
+//# sourceMappingURL=pg-target.d.ts.map

package/dist/staging-migrations/pg-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pg-target.d.ts","sourceRoot":"","sources":["../../src/staging-migrations/pg-target.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUvD;AAED,qBAAa,eAAgB,YAAW,aAAa;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,UAAU,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB;IAW9D,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAGxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAGtB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAG7B,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO9C,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAG1C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAOlE,UAAU,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAMpC,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGxC"}

package/dist/staging-migrations/pg-target.js

@@ -0,0 +1,63 @@
+import { Client } from "pg";
+export function credentialEnvName(profileRef) {
+    if (!/^[A-Za-z0-9_.-]{1,80}$/.test(profileRef))
+        throw new Error("credential_profile_ref_invalid");
+    return `ACC_DB_PROFILE_${profileRef.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_URL`;
+}
+export function projectRefFromUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error("credential_profile_url_invalid");
+    }
+    const match = `${url.hostname}${url.pathname}`.match(/\b([a-z0-9]{20})\b/);
+    if (!match)
+        throw new Error("credential_profile_project_ref_missing");
+    return match[1];
+}
+export class PgStagingTarget {
+    client;
+    pinnedRef;
+    constructor(profileRef, env = process.env) {
+        const value = env[credentialEnvName(profileRef)];
+        if (!value)
+            throw new Error("credential_profile_not_configured");
+        this.pinnedRef = projectRefFromUrl(value);
+        if (this.pinnedRef === "ctknjrtevjrzwpuojghx")
+            throw new Error("production_target_forbidden");
+        this.client = new Client({
+            connectionString: value,
+            application_name: "acc-staging-migration-executor",
+        });
+    }
+    async connect() {
+        await this.client.connect();
+    }
+    async close() {
+        await this.client.end();
+    }
+    async projectRef() {
+        return this.pinnedRef;
+    }
+    async tryAdvisoryLock(key) {
+        const result = await this.client.query("select pg_try_advisory_lock(hashtextextended($1, 0)) as locked", [key]);
+        return result.rows[0]?.locked === true;
+    }
+    async unlockAdvisory(key) {
+        await this.client.query("select pg_advisory_unlock(hashtextextended($1, 0))", [key]);
+    }
+    async ledger(seq) {
+        const result = await this.client.query("select slug, sha from acc.applied_migrations where seq = $1", [seq]);
+        return result.rows[0] ?? null;
+    }
+    async ledgerHead() {
+        const result = await this.client.query("select seq from acc.applied_migrations order by seq::integer desc limit 1");
+        return result.rows[0]?.seq ?? null;
+    }
+    async apply(sql) {
+        await this.client.query(sql);
+    }
+}
+//# sourceMappingURL=pg-target.js.map

package/dist/staging-migrations/pg-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pg-target.js","sourceRoot":"","sources":["../../src/staging-migrations/pg-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAG5B,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAClG,OAAO,kBAAkB,UAAU,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC3E,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACtE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,OAAO,eAAe;IACT,MAAM,CAAS;IACf,SAAS,CAAS;IAEnC,YAAY,UAAkB,EAAE,MAAyB,OAAO,CAAC,GAAG;QAClE,MAAM,KAAK,GAAG,GAAG,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,SAAS,KAAK,sBAAsB;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC9F,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC;YACvB,gBAAgB,EAAE,KAAK;YACvB,gBAAgB,EAAE,gCAAgC;SACnD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;IACD,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IAC1B,CAAC;IACD,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,GAAW;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CACpC,gEAAgE,EAChE,CAAC,GAAG,CAAC,CACN,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,CAAC;IACD,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oDAAoD,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CACpC,6DAA6D,EAC7D,CAAC,GAAG,CAAC,CACN,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAChC,CAAC;IACD,KAAK,CAAC,UAAU;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CACpC,2EAA2E,CAC5E,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC;IACrC,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,GAAW;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/dist/staging-migrations/profiles.d.ts

@@ -0,0 +1,5 @@
+export declare function configuredStagingMigrationProfiles(env?: NodeJS.ProcessEnv): string[];
+export declare function stagingMigrationCaps(env?: NodeJS.ProcessEnv): Record<string, unknown>;
+/** Explicit opt-in: credentials alone never make a runner claim migrations. */
+export declare function stagingMigrationServiceEnabled(env?: NodeJS.ProcessEnv): boolean;
+//# sourceMappingURL=profiles.d.ts.map

package/dist/staging-migrations/profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../src/staging-migrations/profiles.ts"],"names":[],"mappings":"AASA,wBAAgB,kCAAkC,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,EAAE,CAUjG;AAED,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGlG;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAE5F"}