@viewportai/daemon 0.20.1 → 0.22.0

package/dist/workflows/checkout-node.js

@@ -0,0 +1,181 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { allowedRepositories, workflowAuthorityContract, workflowAuthorityContractDigest, } from './workflow-authority-contract.js';
+import { cleanChildProcessEnv } from '../security/child-env.js';
+export function checkoutAuthorityDenial(run, nodeId, node) {
+    const contract = workflowAuthorityContract(run);
+    if (!contract)
+        return null;
+    const repository = normalizeRepository(node.repository);
+    const allowed = allowedRepositories(run);
+    if (allowed.length > 0 && !allowed.includes(repository)) {
+        return {
+            schema: 'viewport.workflow_authority_denial/v1',
+            reason: 'repository_not_allowed',
+            runId: run.id,
+            nodeId,
+            repository,
+            detail: `Checkout node references repository ${repository}, which is outside workflow repo authority.`,
+            contractDigest: workflowAuthorityContractDigest(run),
+            allowed,
+        };
+    }
+    if (node.path && !isPathWithin(path.resolve(run.directoryPath, node.path), run.directoryPath)) {
+        return {
+            schema: 'viewport.workflow_authority_denial/v1',
+            reason: 'checkout_path_outside_run_worktree',
+            runId: run.id,
+            nodeId,
+            repository,
+            detail: `Checkout path ${node.path} is outside the run worktree.`,
+            contractDigest: workflowAuthorityContractDigest(run),
+            allowed,
+        };
+    }
+    const remoteRepository = repositoryFromRemote(node.remote);
+    if (remoteRepository && remoteRepository !== repository) {
+        return {
+            schema: 'viewport.workflow_authority_denial/v1',
+            reason: 'repository_not_allowed',
+            runId: run.id,
+            nodeId,
+            repository: remoteRepository,
+            detail: `Checkout remote references repository ${remoteRepository}, but the node declares ${repository}.`,
+            contractDigest: workflowAuthorityContractDigest(run),
+            allowed: [repository],
+        };
+    }
+    return null;
+}
+export async function executeCheckoutNode(run, node, credential) {
+    const repository = normalizeRepository(node.repository);
+    if (!repository) {
+        throw new Error('Checkout node repository is required.');
+    }
+    const credentialMode = node.credentialMode ?? 'runner_local';
+    if (credentialMode === 'run_scoped_grant' && !credential?.secret) {
+        throw new Error(`Run-scoped checkout grant ${node.credentialRef ?? '(missing credentialRef)'} was not materialized for this run.`);
+    }
+    const destination = checkoutDestination(run.directoryPath, run.id, repository, node.path);
+    await fs.mkdir(path.dirname(destination), { recursive: true });
+    const remote = node.remote ?? `https://github.com/${repository}.git`;
+    const credentialEnv = credential?.secret
+        ? await checkoutCredentialEnv(run.directoryPath, credential.secret)
+        : nonInteractiveGitEnv();
+    await git(['clone', remote, destination], run.directoryPath, credentialEnv, 45_000);
+    if (node.ref) {
+        await git(['checkout', node.ref], destination);
+    }
+    if (node.branch) {
+        await git(['checkout', '-B', node.branch], destination);
+    }
+    const commit = (await git(['rev-parse', 'HEAD'], destination)).trim();
+    return {
+        repository,
+        remote: redactedRemote(remote),
+        path: destination,
+        sourceCategory: 'operating_repo',
+        readWriteMode: 'read_write',
+        ref: node.ref ?? null,
+        branch: node.branch ?? null,
+        commit,
+        credentialMode,
+        credentialRef: node.credentialRef ?? null,
+    };
+}
+function checkoutDestination(root, runId, repository, configuredPath) {
+    const safeRepo = repository.replace(/[^a-z0-9_.-]+/gi, '__');
+    const safeRun = runId.replace(/[^a-z0-9_.-]+/gi, '__');
+    const candidate = configuredPath
+        ? path.resolve(root, configuredPath)
+        : path.join(root, '.viewport', 'workspace', 'runs', safeRun, 'repos', 'operating', safeRepo);
+    if (!isPathWithin(candidate, root)) {
+        throw new Error('Checkout path is outside the run worktree.');
+    }
+    return candidate;
+}
+function repositoryFromRemote(remote) {
+    if (!remote)
+        return null;
+    const github = remote.match(/(?:git@github\.com:|https:\/\/github\.com\/)([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)(?:\.git)?/i);
+    return github ? normalizeRepository(github[1]) : null;
+}
+function normalizeRepository(value) {
+    if (!value)
+        return '';
+    return value
+        .trim()
+        .replace(/^https:\/\/github\.com\//i, '')
+        .replace(/^git@github\.com:/i, '')
+        .replace(/^github\.com\//i, '')
+        .replace(/\.git$/i, '')
+        .toLowerCase();
+}
+function redactedRemote(remote) {
+    return remote
+        .replace(/(https:\/\/)([^/@]+)@github\.com\//i, '$1[redacted]@github.com/')
+        .replace(/(gh[ps]_[A-Za-z0-9_]+)/g, '[redacted-token]');
+}
+function isPathWithin(candidate, root) {
+    const relative = path.relative(path.resolve(root), path.resolve(candidate));
+    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+async function checkoutCredentialEnv(root, secret) {
+    const directory = path.join(root, '.viewport', 'credential-helpers');
+    await fs.mkdir(directory, { recursive: true });
+    const helperPath = path.join(directory, `git-askpass-${Date.now()}-${Math.random().toString(16).slice(2)}.sh`);
+    const script = [
+        '#!/bin/sh',
+        'case "$1" in',
+        '  *Username*) printf "%s\\n" "x-access-token" ;;',
+        '  *) printf "%s\\n" "$VIEWPORT_GIT_TOKEN" ;;',
+        'esac',
+        '',
+    ].join('\n');
+    await fs.writeFile(helperPath, script, { mode: 0o700 });
+    return nonInteractiveGitEnv({
+        GIT_ASKPASS: helperPath,
+        VIEWPORT_GIT_TOKEN: secret,
+    });
+}
+function nonInteractiveGitEnv(overrides = {}) {
+    return cleanChildProcessEnv({
+        GIT_TERMINAL_PROMPT: '0',
+        GIT_SSH_COMMAND: 'ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new',
+        // Some git builds ignore GIT_ASKPASS without DISPLAY/SSH_ASKPASS on macOS.
+        DISPLAY: process.env['DISPLAY'] ?? ':0',
+        TMPDIR: process.env['TMPDIR'] ?? os.tmpdir(),
+        ...overrides,
+    });
+}
+async function git(args, cwd, env = nonInteractiveGitEnv(), timeoutMs = 30_000) {
+    return new Promise((resolve, reject) => {
+        const child = spawn('git', args, { cwd, env, stdio: ['ignore', 'pipe', 'pipe'] });
+        const stdout = [];
+        const stderr = [];
+        const timeout = setTimeout(() => {
+            child.kill('SIGTERM');
+            setTimeout(() => child.kill('SIGKILL'), 2_000).unref();
+            reject(new Error(`git ${args[0] ?? 'command'} timed out after ${timeoutMs}ms`));
+        }, timeoutMs);
+        timeout.unref();
+        child.stdout.on('data', (chunk) => stdout.push(Buffer.from(chunk)));
+        child.stderr.on('data', (chunk) => stderr.push(Buffer.from(chunk)));
+        child.once('error', (error) => {
+            clearTimeout(timeout);
+            reject(error);
+        });
+        child.once('close', (code) => {
+            clearTimeout(timeout);
+            if (code === 0) {
+                resolve(Buffer.concat(stdout).toString('utf8'));
+                return;
+            }
+            const detail = Buffer.concat(stderr).toString('utf8').trim();
+            reject(new Error(detail || `git ${args[0] ?? 'command'} failed with ${code}`));
+        });
+    });
+}
+//# sourceMappingURL=checkout-node.js.map

package/dist/workflows/checkout-node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkout-node.js","sourceRoot":"","sources":["../../src/workflows/checkout-node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,+BAA+B,GAEhC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAoBhE,MAAM,UAAU,uBAAuB,CACrC,GAAsB,EACtB,MAAc,EACd,IAA0B;IAE1B,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,MAAM,EAAE,uCAAuC;YAC/C,MAAM,EAAE,wBAAwB;YAChC,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,MAAM;YACN,UAAU;YACV,MAAM,EAAE,uCAAuC,UAAU,6CAA6C;YACtG,cAAc,EAAE,+BAA+B,CAAC,GAAG,CAAC;YACpD,OAAO;SACR,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9F,OAAO;YACL,MAAM,EAAE,uCAAuC;YAC/C,MAAM,EAAE,oCAAoC;YAC5C,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,MAAM;YACN,UAAU;YACV,MAAM,EAAE,iBAAiB,IAAI,CAAC,IAAI,+BAA+B;YACjE,cAAc,EAAE,+BAA+B,CAAC,GAAG,CAAC;YACpD,OAAO;SACR,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,gBAAgB,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;QACxD,OAAO;YACL,MAAM,EAAE,uCAAuC;YAC/C,MAAM,EAAE,wBAAwB;YAChC,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,MAAM;YACN,UAAU,EAAE,gBAAgB;YAC5B,MAAM,EAAE,yCAAyC,gBAAgB,2BAA2B,UAAU,GAAG;YACzG,cAAc,EAAE,+BAA+B,CAAC,GAAG,CAAC;YACpD,OAAO,EAAE,CAAC,UAAU,CAAC;SACtB,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAsB,EACtB,IAA0B,EAC1B,UAAuC;IAEvC,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC;IAC7D,IAAI,cAAc,KAAK,kBAAkB,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,CAAC,aAAa,IAAI,yBAAyB,qCAAqC,CAClH,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1F,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,sBAAsB,UAAU,MAAM,CAAC;IACrE,MAAM,aAAa,GAAG,UAAU,EAAE,MAAM;QACtC,CAAC,CAAC,MAAM,qBAAqB,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC;QACnE,CAAC,CAAC,oBAAoB,EAAE,CAAC;IAC3B,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IAEpF,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAEtE,OAAO;QACL,UAAU;QACV,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;QAC9B,IAAI,EAAE,WAAW;QACjB,cAAc,EAAE,gBAAgB;QAChC,aAAa,EAAE,YAAY;QAC3B,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QAC3B,MAAM;QACN,cAAc;QACd,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAAY,EACZ,KAAa,EACb,UAAkB,EAClB,cAAuB;IAEvB,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,cAAc;QAC9B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC;QACpC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC/F,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,oBAAoB,CAAC,MAA0B;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CACzB,2FAA2F,CAC5F,CAAC;IACF,OAAO,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAyB;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK;SACT,IAAI,EAAE;SACN,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC;SACxC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;SACjC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;SAC9B,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,WAAW,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,MAAM;SACV,OAAO,CAAC,qCAAqC,EAAE,0BAA0B,CAAC;SAC1E,OAAO,CAAC,yBAAyB,EAAE,kBAAkB,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB,EAAE,IAAY;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5E,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,IAAY,EAAE,MAAc;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,oBAAoB,CAAC,CAAC;IACrE,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1B,SAAS,EACT,eAAe,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CACtE,CAAC;IACF,MAAM,MAAM,GAAG;QACb,WAAW;QACX,cAAc;QACd,kDAAkD;QAClD,8CAA8C;QAC9C,MAAM;QACN,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAExD,OAAO,oBAAoB,CAAC;QAC1B,WAAW,EAAE,UAAU;QACvB,kBAAkB,EAAE,MAAM;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAC3B,YAAgD,EAAE;IAElD,OAAO,oBAAoB,CAAC;QAC1B,mBAAmB,EAAE,GAAG;QACxB,eAAe,EAAE,0DAA0D;QAC3E,2EAA2E;QAC3E,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI;QACvC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE;QAC5C,GAAG,SAAS;KACb,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,GAAG,CAChB,IAAc,EACd,GAAW,EACX,MAAyB,oBAAoB,EAAE,EAC/C,SAAS,GAAG,MAAM;IAElB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAClF,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,oBAAoB,SAAS,IAAI,CAAC,CAAC,CAAC;QAClF,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YAC3B,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,gBAAgB,IAAI,EAAE,CAAC,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/workflows/context-node-resolver.d.ts

@@ -1,3 +1,50 @@
-import type { WorkflowContextNode, WorkflowRunRecord } from './types.js';
+import type { WorkflowPlatformContextClient } from './platform-context-client.js';
+import type { WorkflowContext, WorkflowContextDefaults, WorkflowContextNode, WorkflowNodeContextEnvelope, WorkflowRunRecord } from './types.js';
+export interface NodeContextSelection {
+    promptBlock: string | null;
+    briefing: {
+        schema: 'viewport.context_briefing/v1';
+        nodeId: string;
+        selectedSources: Array<Record<string, unknown>>;
+        topEntries: Array<Record<string, unknown>>;
+        freshness: Array<Record<string, unknown>>;
+        confidence: Array<Record<string, unknown>>;
+        securityClassification: Array<Record<string, unknown>>;
+        whySelected: Array<Record<string, unknown>>;
+        retrievalCaps: Record<string, unknown>;
+        excludedSensitiveSources: string[];
+        writeTargets: unknown[];
+    };
+    basis: {
+        schema: 'viewport.node_context_basis/v1';
+        nodeId: string;
+        mode: 'workflow_default' | 'node_envelope' | 'none';
+        query: string | null;
+        maxItems: number | null;
+        writeTargets: unknown[];
+        refs: Array<{
+            ref: string;
+            as: string | null;
+            required: boolean;
+            refresh: string;
+            maxItems: number | null;
+        }>;
+        excludedRefs: string[];
+        selectedItems: Array<Record<string, unknown>>;
+        skipped: Array<{
+            providerId: string;
+            reason: string;
+        }>;
+    };
+}
 export declare function executeContextNode(run: WorkflowRunRecord, nodeId: string, node: WorkflowContextNode): Promise<void>;
+export declare function resolvePromptNodeContext(input: {
+    run: WorkflowRunRecord;
+    nodeId: string;
+    workflowContext?: WorkflowContext | WorkflowContextDefaults;
+    nodeContext?: WorkflowNodeContextEnvelope;
+    prompt: string;
+    platformContextClient?: WorkflowPlatformContextClient;
+}): Promise<NodeContextSelection>;
+export declare function sanitizeContextQueryForReceipt(query: string | null): string | null;
 //# sourceMappingURL=context-node-resolver.d.ts.map

package/dist/workflows/context-node-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context-node-resolver.d.ts","sourceRoot":"","sources":["../../src/workflows/context-node-resolver.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,mBAAmB,EAEnB,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAepB,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,iBAAiB,EACtB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,IAAI,CAAC,CAkFf"}
+{"version":3,"file":"context-node-resolver.d.ts","sourceRoot":"","sources":["../../src/workflows/context-node-resolver.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAEV,6BAA6B,EAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EACV,eAAe,EACf,uBAAuB,EACvB,mBAAmB,EAEnB,2BAA2B,EAC3B,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAiBpB,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE;QACR,MAAM,EAAE,8BAA8B,CAAC;QACvC,MAAM,EAAE,MAAM,CAAC;QACf,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAChD,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1C,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACvD,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvC,wBAAwB,EAAE,MAAM,EAAE,CAAC;QACnC,YAAY,EAAE,OAAO,EAAE,CAAC;KACzB,CAAC;IACF,KAAK,EAAE;QACL,MAAM,EAAE,gCAAgC,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,kBAAkB,GAAG,eAAe,GAAG,MAAM,CAAC;QACpD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,YAAY,EAAE,OAAO,EAAE,CAAC;QACxB,IAAI,EAAE,KAAK,CAAC;YACV,GAAG,EAAE,MAAM,CAAC;YACZ,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;YAClB,QAAQ,EAAE,OAAO,CAAC;YAClB,OAAO,EAAE,MAAM,CAAC;YAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;SACzB,CAAC,CAAC;QACH,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9C,OAAO,EAAE,KAAK,CAAC;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACxD,CAAC;CACH;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,iBAAiB,EACtB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,IAAI,CAAC,CA2Ff;AAED,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,GAAG,EAAE,iBAAiB,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,eAAe,GAAG,uBAAuB,CAAC;IAC5D,WAAW,CAAC,EAAE,2BAA2B,CAAC;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;CACvD,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA4IhC;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAgBlF"}