@w3kits-com/plugin-opendesign 0.1.8 → 0.1.9

package/dist/__w3kits/webcontainer-runtime/apps/daemon/dist/critique/adapter-degraded.d.ts

@@ -0,0 +1,69 @@
+/**
+ * In-memory registry of adapters the conformance harness has marked
+ * `critique:degraded` (Phase 10). Tracks (adapterId -> { reason, expiresAtMs })
+ * with a per-entry TTL so a flaky adapter is sidelined automatically until
+ * the next nightly cycle without operator action.
+ *
+ * v1 scope: process-local Map. The orchestrator and adapter routing both
+ * sit inside the same daemon process, so a daemon-life-scoped store is
+ * sufficient to gate routing decisions. Persisting to SQLite (so the
+ * mark survives a daemon restart) is a Phase 15 follow-up because it
+ * needs a schema migration that should land alongside the rollout-flag
+ * wiring rather than ahead of it. The plan's `markDegraded(id, reason, ttlMs)`
+ * + `isDegraded(id)` contract is preserved so the upgrade is drop-in
+ * (the same call sites keep working when the storage layer swaps).
+ */
+import type { DegradedReason } from '@open-design/contracts/critique';
+export type DegradedSource = 'conformance' | 'orchestrator' | 'manual';
+export interface DegradedEntry {
+    adapterId: string;
+    reason: DegradedReason;
+    source: DegradedSource;
+    /** Epoch milliseconds; reads after this are treated as cleared. */
+    expiresAtMs: number;
+    markedAtMs: number;
+}
+export interface DegradedClock {
+    now(): number;
+}
+/** Default TTL the plan specifies for adapter-level marks (24h). */
+export declare const ADAPTER_DEGRADED_DEFAULT_TTL_MS: number;
+/**
+ * Mark an adapter as degraded for `ttlMs` from now. Subsequent calls
+ * for the same adapter overwrite the existing entry, so a worse
+ * reason or a renewed TTL during the same window takes precedence.
+ */
+export declare function markDegraded(adapterId: string, reason: DegradedReason, ttlMs?: number, source?: DegradedSource): DegradedEntry;
+/**
+ * `true` when the adapter has an unexpired degraded mark. Reads after
+ * the entry's TTL transparently clear the mark so the caller doesn't
+ * have to evict separately.
+ */
+export declare function isDegraded(adapterId: string): boolean;
+/**
+ * Read the full entry (or `null` if not degraded). Same TTL-eviction
+ * semantics as `isDegraded`. Useful for surfacing the reason on
+ * operator dashboards.
+ */
+export declare function getDegradedEntry(adapterId: string): DegradedEntry | null;
+/**
+ * Explicitly clear a degraded mark (operator-initiated remediation).
+ * Returns `true` if a mark was actually removed.
+ */
+export declare function clearDegraded(adapterId: string): boolean;
+/**
+ * Snapshot the current degraded-adapter table (post-TTL eviction).
+ * Used by the `/api/metrics/critique` Prometheus exporter from
+ * Phase 12.
+ */
+export declare function listDegraded(): DegradedEntry[];
+/**
+ * Test-only hook to inject a deterministic clock. Production code never
+ * calls this; vitest cases that exercise TTL boundaries do.
+ */
+export declare function __setDegradedClockForTests(next: DegradedClock | null): void;
+/**
+ * Test-only hook to drop the table between cases without exposing the
+ * map directly.
+ */
+export declare function __resetDegradedRegistryForTests(): void;

package/dist/__w3kits/webcontainer-runtime/apps/daemon/dist/critique/adapter-degraded.js

@@ -0,0 +1,110 @@
+/**
+ * In-memory registry of adapters the conformance harness has marked
+ * `critique:degraded` (Phase 10). Tracks (adapterId -> { reason, expiresAtMs })
+ * with a per-entry TTL so a flaky adapter is sidelined automatically until
+ * the next nightly cycle without operator action.
+ *
+ * v1 scope: process-local Map. The orchestrator and adapter routing both
+ * sit inside the same daemon process, so a daemon-life-scoped store is
+ * sufficient to gate routing decisions. Persisting to SQLite (so the
+ * mark survives a daemon restart) is a Phase 15 follow-up because it
+ * needs a schema migration that should land alongside the rollout-flag
+ * wiring rather than ahead of it. The plan's `markDegraded(id, reason, ttlMs)`
+ * + `isDegraded(id)` contract is preserved so the upgrade is drop-in
+ * (the same call sites keep working when the storage layer swaps).
+ */
+import { critiqueDegradedTotal } from '../metrics/index.js';
+const realClock = { now: () => Date.now() };
+const store = new Map();
+let clock = realClock;
+/** Default TTL the plan specifies for adapter-level marks (24h). */
+export const ADAPTER_DEGRADED_DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
+/**
+ * Mark an adapter as degraded for `ttlMs` from now. Subsequent calls
+ * for the same adapter overwrite the existing entry, so a worse
+ * reason or a renewed TTL during the same window takes precedence.
+ */
+export function markDegraded(adapterId, reason, ttlMs = ADAPTER_DEGRADED_DEFAULT_TTL_MS, source = 'conformance') {
+    if (!adapterId) {
+        throw new Error('markDegraded: adapterId is required');
+    }
+    if (!Number.isFinite(ttlMs) || ttlMs <= 0) {
+        throw new Error('markDegraded: ttlMs must be a positive finite number');
+    }
+    const markedAtMs = clock.now();
+    const entry = {
+        adapterId,
+        reason,
+        source,
+        markedAtMs,
+        expiresAtMs: markedAtMs + ttlMs,
+    };
+    store.set(adapterId, entry);
+    // Phase 12: every degraded mark increments the Prometheus counter so
+    // the dashboard's "adapter health" panel reflects the same rate the
+    // orchestrator and conformance harness observe. Bump is unconditional
+    // (every call records, including overwrites of a still-live entry)
+    // because the dashboard rate query divides over the time window, not
+    // over distinct adapters.
+    critiqueDegradedTotal.inc({ reason, adapter: adapterId });
+    return entry;
+}
+/**
+ * `true` when the adapter has an unexpired degraded mark. Reads after
+ * the entry's TTL transparently clear the mark so the caller doesn't
+ * have to evict separately.
+ */
+export function isDegraded(adapterId) {
+    return Boolean(getDegradedEntry(adapterId));
+}
+/**
+ * Read the full entry (or `null` if not degraded). Same TTL-eviction
+ * semantics as `isDegraded`. Useful for surfacing the reason on
+ * operator dashboards.
+ */
+export function getDegradedEntry(adapterId) {
+    const entry = store.get(adapterId);
+    if (!entry)
+        return null;
+    if (clock.now() >= entry.expiresAtMs) {
+        store.delete(adapterId);
+        return null;
+    }
+    return entry;
+}
+/**
+ * Explicitly clear a degraded mark (operator-initiated remediation).
+ * Returns `true` if a mark was actually removed.
+ */
+export function clearDegraded(adapterId) {
+    return store.delete(adapterId);
+}
+/**
+ * Snapshot the current degraded-adapter table (post-TTL eviction).
+ * Used by the `/api/metrics/critique` Prometheus exporter from
+ * Phase 12.
+ */
+export function listDegraded() {
+    const out = [];
+    for (const id of Array.from(store.keys())) {
+        const entry = getDegradedEntry(id);
+        if (entry)
+            out.push(entry);
+    }
+    return out;
+}
+/**
+ * Test-only hook to inject a deterministic clock. Production code never
+ * calls this; vitest cases that exercise TTL boundaries do.
+ */
+export function __setDegradedClockForTests(next) {
+    clock = next ?? realClock;
+}
+/**
+ * Test-only hook to drop the table between cases without exposing the
+ * map directly.
+ */
+export function __resetDegradedRegistryForTests() {
+    store.clear();
+}
+//# sourceMappingURL=adapter-degraded.js.map

package/dist/__w3kits/webcontainer-runtime/apps/daemon/dist/critique/adapter-degraded.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-degraded.js","sourceRoot":"","sources":["../../src/critique/adapter-degraded.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAiB5D,MAAM,SAAS,GAAkB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAE3D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;AAC/C,IAAI,KAAK,GAAkB,SAAS,CAAC;AAErC,oEAAoE;AACpE,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnE;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,SAAiB,EACjB,MAAsB,EACtB,QAAgB,+BAA+B,EAC/C,SAAyB,aAAa;IAEtC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAkB;QAC3B,SAAS;QACT,MAAM;QACN,MAAM;QACN,UAAU;QACV,WAAW,EAAE,UAAU,GAAG,KAAK;KAChC,CAAC;IACF,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5B,qEAAqE;IACrE,oEAAoE;IACpE,sEAAsE;IACtE,mEAAmE;IACnE,qEAAqE;IACrE,0BAA0B;IAC1B,qBAAqB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,OAAO,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,KAAK,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACrC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,OAAO,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAA0B;IACnE,KAAK,GAAG,IAAI,IAAI,SAAS,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B;IAC7C,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC"}

package/dist/__w3kits/webcontainer-runtime/apps/daemon/dist/critique/artifact-handler.d.ts

@@ -0,0 +1,24 @@
+import type { Request, Response } from 'express';
+import type Database from 'better-sqlite3';
+/**
+ * GET /api/projects/:projectId/critique/:runId/artifact
+ *
+ * Streams the bytes the orchestrator wrote for the run's SHIP `<ARTIFACT>`
+ * block, with the mime type derived from the file extension on disk. This
+ * is the daemon-resolved logical handle the web layer fetches; clients
+ * never receive a raw filesystem path. Cross-project leak guard mirrors
+ * the interrupt handler: a request against project p1 must not surface a
+ * runId that belongs to p2.
+ *
+ * Status semantics:
+ *   200 — happy path; body is the artifact bytes with the right mime.
+ *   400 — projectId/runId missing or whitespace-only.
+ *   404 — run not found, cross-project leak, no artifact persisted, or
+ *         the on-disk file disappeared (bytes never made it to the row).
+ *
+ * @see specs/current/critique-theater.md § rerun endpoint (Task 6.2)
+ */
+export declare function handleCritiqueArtifact(db: Database.Database, options: {
+    artifactsRoot: string;
+    responseCapBytes?: number;
+}): (req: Request, res: Response) => Promise<void>;

package/dist/__w3kits/webcontainer-runtime/apps/daemon/dist/critique/artifact-handler.js

@@ -0,0 +1,195 @@
+import { promises as fs, constants as fsConstants } from 'node:fs';
+import * as path from 'node:path';
+import { getCritiqueRun } from './persistence.js';
+import { mimeForExtension } from './artifact-writer.js';
+/** HTTP status codes used by the artifact endpoint. */
+const HTTP_BAD_REQUEST = 400;
+const HTTP_NOT_FOUND = 404;
+const HTTP_OK = 200;
+/**
+ * Default response size cap when the caller doesn't pass one. Used as the
+ * floor: an instance with `OD_CRITIQUE_PARSER_MAX_BLOCK_BYTES` raised above
+ * this value gets the larger cap so every artifact the orchestrator + writer
+ * accepted is retrievable. Codex P2 on PR #1085: hard-coding 4 MiB here
+ * while the writer accepted up to `cfg.parserMaxBlockBytes` made accepted
+ * rows unretrievable in raised-limit deployments.
+ */
+const DEFAULT_RESPONSE_SIZE_CAP_BYTES = 4 * 1024 * 1024;
+/**
+ * GET /api/projects/:projectId/critique/:runId/artifact
+ *
+ * Streams the bytes the orchestrator wrote for the run's SHIP `<ARTIFACT>`
+ * block, with the mime type derived from the file extension on disk. This
+ * is the daemon-resolved logical handle the web layer fetches; clients
+ * never receive a raw filesystem path. Cross-project leak guard mirrors
+ * the interrupt handler: a request against project p1 must not surface a
+ * runId that belongs to p2.
+ *
+ * Status semantics:
+ *   200 — happy path; body is the artifact bytes with the right mime.
+ *   400 — projectId/runId missing or whitespace-only.
+ *   404 — run not found, cross-project leak, no artifact persisted, or
+ *         the on-disk file disappeared (bytes never made it to the row).
+ *
+ * @see specs/current/critique-theater.md § rerun endpoint (Task 6.2)
+ */
+export function handleCritiqueArtifact(db, options) {
+    const artifactsRoot = path.resolve(options.artifactsRoot);
+    // Honor the configured cap as-is when it's a positive finite number.
+    // The earlier `Math.max(DEFAULT, configured)` shape made the read-time
+    // size guard diverge from the writer's policy: a deployment that lowered
+    // OD_CRITIQUE_PARSER_MAX_BLOCK_BYTES below 4 MiB would still stream
+    // tampered files up to 4 MiB even though writeShipArtifact would have
+    // refused them. Mirror the writer's policy exactly so what the writer
+    // accepts is what the endpoint serves, and only fall back to the
+    // default when the option is absent or invalid (mrcfps follow-up on
+    // PR #1085).
+    const responseCapBytes = Number.isFinite(options.responseCapBytes) && options.responseCapBytes > 0
+        ? options.responseCapBytes
+        : DEFAULT_RESPONSE_SIZE_CAP_BYTES;
+    return async function critiqueArtifactHandler(req, res) {
+        const projectId = typeof req.params['projectId'] === 'string'
+            ? req.params['projectId'].trim()
+            : '';
+        const runId = typeof req.params['runId'] === 'string'
+            ? req.params['runId'].trim()
+            : '';
+        if (!projectId || !runId) {
+            res
+                .status(HTTP_BAD_REQUEST)
+                .json({ error: { code: 'BAD_REQUEST', message: 'projectId and runId are required' } });
+            return;
+        }
+        const row = getCritiqueRun(db, runId);
+        // Cross-project leak guard: a request against project p1 must not
+        // reveal that runId actually lives in p2. 404 (not 403) so the
+        // existence of other projects' runs is not leaked.
+        if (row === null || row.projectId !== projectId) {
+            res
+                .status(HTTP_NOT_FOUND)
+                .json({ error: { code: 'NOT_FOUND', message: 'critique run not found' } });
+            return;
+        }
+        if (row.artifactPath === null) {
+            // Either the run is still running, the orchestrator failed to write
+            // the artifact (size, fs error, agent shipped no body), or the row
+            // pre-dates artifact persistence and hasn't been backfilled. All
+            // three are observable as 404 from the client's perspective.
+            res
+                .status(HTTP_NOT_FOUND)
+                .json({
+                error: {
+                    code: 'NOT_FOUND',
+                    message: 'critique run has no persisted artifact',
+                    currentStatus: row.status,
+                },
+            });
+            return;
+        }
+        // Path-traversal guard: the row's artifactPath must resolve INSIDE
+        // the configured artifacts root. Refusing anything else means a
+        // tampered DB row cannot leak arbitrary files off disk through this
+        // endpoint. Symlinks are not followed: the orchestrator writes
+        // through the writer module which never produces symlinks, so any
+        // symlink found here is suspicious.
+        const resolvedArtifactPath = path.resolve(row.artifactPath);
+        const relToRoot = path.relative(artifactsRoot, resolvedArtifactPath);
+        if (relToRoot.startsWith('..')
+            || path.isAbsolute(relToRoot)
+            || relToRoot === '') {
+            res
+                .status(HTTP_NOT_FOUND)
+                .json({ error: { code: 'NOT_FOUND', message: 'critique artifact not found' } });
+            return;
+        }
+        // Open the file once and stream from the resulting fd. The earlier
+        // shape did `lstat(path) → validate → createReadStream(path)`, which
+        // left a time-of-check / time-of-use window where a local actor with
+        // write access to the critique-artifacts directory could swap in a
+        // symlink or a larger file between the validation and the reopen.
+        // Opening once with O_NOFOLLOW (where the platform supports it) and
+        // stat'ing the open fd via fileHandle.stat() means the size and
+        // file-type checks describe the exact bytes we are about to stream
+        // (mrcfps follow-up on PR #1085).
+        //
+        // O_NOFOLLOW is a POSIX flag; on Windows the constant resolves to
+        // undefined and the open fall-through behaves like a normal read.
+        // The path-traversal guard above plus the orchestrator never writing
+        // through symlinks make Windows still safe in practice.
+        const noFollowFlag = typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0;
+        const openFlags = fsConstants.O_RDONLY | noFollowFlag;
+        let fileHandle;
+        try {
+            fileHandle = await fs.open(resolvedArtifactPath, openFlags);
+        }
+        catch {
+            // ELOOP from O_NOFOLLOW (symlink), ENOENT (vanished), EACCES, etc.
+            res
+                .status(HTTP_NOT_FOUND)
+                .json({ error: { code: 'NOT_FOUND', message: 'critique artifact not found' } });
+            return;
+        }
+        try {
+            const stat = await fileHandle.stat();
+            if (!stat.isFile()) {
+                await fileHandle.close();
+                res
+                    .status(HTTP_NOT_FOUND)
+                    .json({ error: { code: 'NOT_FOUND', message: 'critique artifact not found' } });
+                return;
+            }
+            if (stat.size > responseCapBytes) {
+                await fileHandle.close();
+                res
+                    .status(HTTP_NOT_FOUND)
+                    .json({
+                    error: { code: 'NOT_FOUND', message: 'critique artifact exceeds response cap' },
+                });
+                return;
+            }
+            const ext = path.extname(resolvedArtifactPath);
+            const contentType = mimeForExtension(ext);
+            res.status(HTTP_OK);
+            res.setHeader('Content-Type', contentType);
+            res.setHeader('Content-Length', String(stat.size));
+            res.setHeader('X-Content-Type-Options', 'nosniff');
+            // Prevent SVG / HTML artifacts from running scripts when fetched
+            // directly. The web layer renders the bytes inside a sandboxed iframe
+            // for HTML; this CSP is a defense-in-depth header for clients that
+            // dereference the URL outside that sandbox.
+            if (contentType === 'image/svg+xml' || contentType === 'text/html') {
+                res.setHeader('Content-Security-Policy', "default-src 'none'; img-src data:; style-src 'unsafe-inline'");
+            }
+            // Artifacts are content-addressed by runId; the row never re-points
+            // to a different file once written, so a long cache lifetime is safe.
+            res.setHeader('Cache-Control', 'private, max-age=3600');
+            // createReadStream({ autoClose: true }) is the FileHandle method that
+            // closes the underlying fd when the stream ends or errors, so we do
+            // not double-close after handing the fd to the stream.
+            const stream = fileHandle.createReadStream({ autoClose: true });
+            stream.on('error', () => {
+                if (!res.headersSent) {
+                    res.status(HTTP_NOT_FOUND).end();
+                }
+                else {
+                    res.destroy();
+                }
+            });
+            stream.pipe(res);
+        }
+        catch (err) {
+            // Anything thrown after the open succeeded but before the stream is
+            // wired up: close the fd so it does not leak, then surface 404.
+            await fileHandle.close().catch(() => { });
+            if (!res.headersSent) {
+                res
+                    .status(HTTP_NOT_FOUND)
+                    .json({ error: { code: 'NOT_FOUND', message: 'critique artifact not found' } });
+            }
+            else {
+                res.destroy(err instanceof Error ? err : undefined);
+            }
+        }
+    };
+}
+//# sourceMappingURL=artifact-handler.js.map

package/dist/__w3kits/webcontainer-runtime/apps/daemon/dist/critique/artifact-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-handler.js","sourceRoot":"","sources":["../../src/critique/artifact-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,uDAAuD;AACvD,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,OAAO,GAAG,GAAG,CAAC;AAEpB;;;;;;;GAOG;AACH,MAAM,+BAA+B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAExD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CACpC,EAAqB,EACrB,OAA6D;IAE7D,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1D,qEAAqE;IACrE,uEAAuE;IACvE,yEAAyE;IACzE,oEAAoE;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,iEAAiE;IACjE,oEAAoE;IACpE,aAAa;IACb,MAAM,gBAAgB,GACpB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,gBAAiB,GAAG,CAAC;QACxE,CAAC,CAAC,OAAO,CAAC,gBAAiB;QAC3B,CAAC,CAAC,+BAA+B,CAAC;IAEtC,OAAO,KAAK,UAAU,uBAAuB,CAAC,GAAY,EAAE,GAAa;QACvE,MAAM,SAAS,GACb,OAAO,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,QAAQ;YACzC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE;YAChC,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,KAAK,GACT,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ;YACrC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE;YAC5B,CAAC,CAAC,EAAE,CAAC;QAET,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;YACzB,GAAG;iBACA,MAAM,CAAC,gBAAgB,CAAC;iBACxB,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,kCAAkC,EAAE,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAEtC,kEAAkE;QAClE,+DAA+D;QAC/D,mDAAmD;QACnD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAChD,GAAG;iBACA,MAAM,CAAC,cAAc,CAAC;iBACtB,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,wBAAwB,EAAE,EAAE,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC9B,oEAAoE;YACpE,mEAAmE;YACnE,iEAAiE;YACjE,6DAA6D;YAC7D,GAAG;iBACA,MAAM,CAAC,cAAc,CAAC;iBACtB,IAAI,CAAC;gBACJ,KAAK,EAAE;oBACL,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,wCAAwC;oBACjD,aAAa,EAAE,GAAG,CAAC,MAAM;iBAC1B;aACF,CAAC,CAAC;YACL,OAAO;QACT,CAAC;QAED,mEAAmE;QACnE,gEAAgE;QAChE,oEAAoE;QACpE,+DAA+D;QAC/D,kEAAkE;QAClE,oCAAoC;QACpC,MAAM,oBAAoB,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC;QACrE,IACE,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;eACvB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;eAC1B,SAAS,KAAK,EAAE,EACnB,CAAC;YACD,GAAG;iBACA,MAAM,CAAC,cAAc,CAAC;iBACtB,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,6BAA6B,EAAE,EAAE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,mEAAmE;QACnE,qEAAqE;QACrE,qEAAqE;QACrE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,gEAAgE;QAChE,mEAAmE;QACnE,kCAAkC;QAClC,EAAE;QACF,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,wDAAwD;QACxD,MAAM,YAAY,GAChB,OAAO,WAAW,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,GAAG,YAAY,CAAC;QACtD,IAAI,UAA+C,CAAC;QACpD,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,GAAG;iBACA,MAAM,CAAC,cAAc,CAAC;iBACtB,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,6BAA6B,EAAE,EAAE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnB,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;gBACzB,GAAG;qBACA,MAAM,CAAC,cAAc,CAAC;qBACtB,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,6BAA6B,EAAE,EAAE,CAAC,CAAC;gBAClF,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,GAAG,gBAAgB,EAAE,CAAC;gBACjC,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;gBACzB,GAAG;qBACA,MAAM,CAAC,cAAc,CAAC;qBACtB,IAAI,CAAC;oBACJ,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,wCAAwC,EAAE;iBAChF,CAAC,CAAC;gBACL,OAAO;YACT,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;YAC/C,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAE1C,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACpB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;YACnD,iEAAiE;YACjE,sEAAsE;YACtE,mEAAmE;YACnE,4CAA4C;YAC5C,IAAI,WAAW,KAAK,eAAe,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;gBACnE,GAAG,CAAC,SAAS,CACX,yBAAyB,EACzB,8DAA8D,CAC/D,CAAC;YACJ,CAAC;YACD,oEAAoE;YACpE,sEAAsE;YACtE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;YAExD,sEAAsE;YACtE,oEAAoE;YACpE,uDAAuD;YACvD,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACtB,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,EAAE,CAAC;gBACnC,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,OAAO,EAAE,CAAC;gBAChB,CAAC;YACH,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,gEAAgE;YAChE,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG;qBACA,MAAM,CAAC,cAAc,CAAC;qBACtB,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,6BAA6B,EAAE,EAAE,CAAC,CAAC;YACpF,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,OAAO,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/__w3kits/webcontainer-runtime/apps/daemon/dist/critique/artifact-writer.d.ts

@@ -0,0 +1,79 @@
+/** Result of a successful artifact write. All paths are absolute. */
+export interface WriteShipArtifactResult {
+    /** Resolved mime type (input mime if it was on the allowlist, else the
+     *  binary fallback). The artifact endpoint serves this as Content-Type. */
+    mime: string;
+    /** Lowercase extension WITHOUT the leading dot. */
+    extension: string;
+    /** Absolute path to the file the daemon just wrote. */
+    absPath: string;
+    /** Filename within the artifact directory (no parent components). */
+    filename: string;
+    /** UTF-8 byte length of the body that was written. */
+    sizeBytes: number;
+}
+/**
+ * Errors thrown by `writeShipArtifact`. The orchestrator distinguishes these
+ * from generic Node fs errors so it can map an oversize body to the same
+ * `degraded` outcome a parser-side OversizeBlockError would produce, and a
+ * filesystem failure to `failed`.
+ */
+export declare class ArtifactTooLargeError extends Error {
+    readonly sizeBytes: number;
+    readonly maxBytes: number;
+    readonly code: "ARTIFACT_TOO_LARGE";
+    constructor(sizeBytes: number, maxBytes: number);
+}
+export declare class ArtifactEmptyError extends Error {
+    readonly code: "ARTIFACT_EMPTY";
+    constructor();
+}
+export interface WriteShipArtifactOptions {
+    /** Hard cap on the body size in UTF-8 bytes; defaults to 1 MiB. The
+     *  orchestrator passes `cfg.parserMaxBlockBytes` so the on-disk limit
+     *  matches the parser's in-memory limit. */
+    maxBytes?: number;
+}
+/**
+ * Resolve the canonical mime + filename for a SHIP artifact body and write
+ * it to `<dir>/artifact.<ext>` atomically (write to a sibling tmp file, then
+ * rename). The caller is expected to pass a directory that already exists;
+ * the orchestrator builds it as `<artifactsDir>/<projectId>/<runId>` at
+ * run-start, so creation is the orchestrator's responsibility, not this
+ * module's.
+ *
+ * `mime` is matched case-insensitively and trimmed of a `; charset=…`
+ * suffix before the extension lookup, so `text/html; charset=utf-8` and
+ * `Text/HTML` both resolve to the `html` extension.
+ */
+export declare function writeShipArtifact(dir: string, body: string, mime: string, options?: WriteShipArtifactOptions): Promise<WriteShipArtifactResult>;
+/**
+ * Look up the on-disk extension for a mime that has already been
+ * canonicalized via `canonicalizeMime`. Exported so the artifact-fetch
+ * endpoint can reverse the lookup and so the parser's golden tests can
+ * assert mime → ext mappings without re-deriving them inline.
+ */
+export declare function extensionForMime(canonicalMime: string): string;
+/**
+ * Look up the canonical mime for a known extension. Used by the
+ * artifact-fetch endpoint when the row only stores the path; the path
+ * extension is the source of truth on read because the row was written by
+ * `writeShipArtifact` which derives the extension from the mime in the
+ * first place. Falls back to `application/octet-stream` so the response
+ * header is always something a browser can refuse to render as HTML.
+ */
+export declare function mimeForExtension(extension: string): string;
+/** Visible-for-testing: the canonical allowlist + the fallbacks. */
+export declare const ARTIFACT_WRITER_INTERNALS: {
+    ARTIFACT_MIME_EXTENSIONS: {
+        readonly 'text/html': "html";
+        readonly 'text/css': "css";
+        readonly 'text/markdown': "md";
+        readonly 'text/plain': "txt";
+        readonly 'application/json': "json";
+        readonly 'image/svg+xml': "svg";
+    };
+    FALLBACK_MIME: string;
+    FALLBACK_EXTENSION: string;
+    DEFAULT_MAX_BYTES: number;
+};

package/dist/__w3kits/webcontainer-runtime/apps/daemon/dist/critique/artifact-writer.js

@@ -0,0 +1,142 @@
+import * as path from 'node:path';
+import { promises as fs } from 'node:fs';
+/**
+ * Allowlist of artifact mime types the agent is expected to ship under v1.
+ * The web layer's preview surface knows how to render each of these inline,
+ * and the daemon's `Content-Type` response header for the artifact-fetch
+ * endpoint is taken straight from this map. Unknown mimes fall through to
+ * the binary sink (see `extensionForMime`) so an experimenting agent can
+ * still ship something, but the file is named `.bin` and the response
+ * header degrades to `application/octet-stream` so downstream consumers
+ * cannot misinterpret raw bytes as a known type.
+ *
+ * The allowlist is intentionally narrow; expand it through this constant
+ * (and the matching tests) rather than guessing from the mime string.
+ */
+const ARTIFACT_MIME_EXTENSIONS = {
+    'text/html': 'html',
+    'text/css': 'css',
+    'text/markdown': 'md',
+    'text/plain': 'txt',
+    'application/json': 'json',
+    'image/svg+xml': 'svg',
+};
+const FALLBACK_MIME = 'application/octet-stream';
+const FALLBACK_EXTENSION = 'bin';
+/**
+ * Errors thrown by `writeShipArtifact`. The orchestrator distinguishes these
+ * from generic Node fs errors so it can map an oversize body to the same
+ * `degraded` outcome a parser-side OversizeBlockError would produce, and a
+ * filesystem failure to `failed`.
+ */
+export class ArtifactTooLargeError extends Error {
+    sizeBytes;
+    maxBytes;
+    code = 'ARTIFACT_TOO_LARGE';
+    constructor(sizeBytes, maxBytes) {
+        super(`<ARTIFACT> body of ${sizeBytes} bytes exceeded artifact-writer cap of ${maxBytes} bytes`);
+        this.sizeBytes = sizeBytes;
+        this.maxBytes = maxBytes;
+    }
+}
+export class ArtifactEmptyError extends Error {
+    code = 'ARTIFACT_EMPTY';
+    constructor() {
+        super('<ARTIFACT> body is empty after CDATA strip; refusing to write a zero-byte file');
+    }
+}
+/** Default body cap when the orchestrator doesn't pass one. 1 MiB is the
+ *  same ballpark as the parser's default block cap; any artifact larger than
+ *  this is a strong signal the agent is misbehaving. */
+const DEFAULT_MAX_BYTES = 1024 * 1024;
+/**
+ * Resolve the canonical mime + filename for a SHIP artifact body and write
+ * it to `<dir>/artifact.<ext>` atomically (write to a sibling tmp file, then
+ * rename). The caller is expected to pass a directory that already exists;
+ * the orchestrator builds it as `<artifactsDir>/<projectId>/<runId>` at
+ * run-start, so creation is the orchestrator's responsibility, not this
+ * module's.
+ *
+ * `mime` is matched case-insensitively and trimmed of a `; charset=…`
+ * suffix before the extension lookup, so `text/html; charset=utf-8` and
+ * `Text/HTML` both resolve to the `html` extension.
+ */
+export async function writeShipArtifact(dir, body, mime, options = {}) {
+    const maxBytes = options.maxBytes ?? DEFAULT_MAX_BYTES;
+    const sizeBytes = Buffer.byteLength(body, 'utf8');
+    if (sizeBytes === 0) {
+        throw new ArtifactEmptyError();
+    }
+    if (sizeBytes > maxBytes) {
+        throw new ArtifactTooLargeError(sizeBytes, maxBytes);
+    }
+    const resolvedMime = canonicalizeMime(mime);
+    const extension = extensionForMime(resolvedMime);
+    const filename = `artifact.${extension}`;
+    const absPath = path.join(dir, filename);
+    // Atomic write: render to a sibling tmp file then rename. A naive write
+    // could leave a half-written file under `artifact.<ext>` if the daemon
+    // crashes mid-write; the rename is observed atomically on POSIX and is
+    // good enough on Windows for the local-only daemon use case.
+    const tmpPath = `${absPath}.tmp.${process.pid}.${Date.now()}`;
+    await fs.writeFile(tmpPath, body, { encoding: 'utf8' });
+    try {
+        await fs.rename(tmpPath, absPath);
+    }
+    catch (err) {
+        // Best-effort cleanup of the tmp file; never let cleanup mask the
+        // original rename error.
+        await fs.unlink(tmpPath).catch(() => { });
+        throw err;
+    }
+    return { mime: resolvedMime, extension, absPath, filename, sizeBytes };
+}
+/**
+ * Look up the on-disk extension for a mime that has already been
+ * canonicalized via `canonicalizeMime`. Exported so the artifact-fetch
+ * endpoint can reverse the lookup and so the parser's golden tests can
+ * assert mime → ext mappings without re-deriving them inline.
+ */
+export function extensionForMime(canonicalMime) {
+    const known = ARTIFACT_MIME_EXTENSIONS[canonicalMime];
+    return known ?? FALLBACK_EXTENSION;
+}
+/**
+ * Look up the canonical mime for a known extension. Used by the
+ * artifact-fetch endpoint when the row only stores the path; the path
+ * extension is the source of truth on read because the row was written by
+ * `writeShipArtifact` which derives the extension from the mime in the
+ * first place. Falls back to `application/octet-stream` so the response
+ * header is always something a browser can refuse to render as HTML.
+ */
+export function mimeForExtension(extension) {
+    const lower = extension.toLowerCase().replace(/^\./, '');
+    for (const [mime, ext] of Object.entries(ARTIFACT_MIME_EXTENSIONS)) {
+        if (ext === lower)
+            return mime;
+    }
+    return FALLBACK_MIME;
+}
+/**
+ * Reduce an `<ARTIFACT mime="…">` attribute value to the canonical lookup
+ * key: lowercased, with any `; charset=…` parameters stripped. Returns the
+ * binary fallback for empty / unknown / malformed inputs so the rest of the
+ * pipeline never has to guard for `mime === ''`.
+ */
+function canonicalizeMime(raw) {
+    const head = (raw ?? '').split(';')[0]?.trim().toLowerCase();
+    if (!head)
+        return FALLBACK_MIME;
+    if (Object.prototype.hasOwnProperty.call(ARTIFACT_MIME_EXTENSIONS, head)) {
+        return head;
+    }
+    return FALLBACK_MIME;
+}
+/** Visible-for-testing: the canonical allowlist + the fallbacks. */
+export const ARTIFACT_WRITER_INTERNALS = {
+    ARTIFACT_MIME_EXTENSIONS,
+    FALLBACK_MIME,
+    FALLBACK_EXTENSION,
+    DEFAULT_MAX_BYTES,
+};
+//# sourceMappingURL=artifact-writer.js.map

package/dist/__w3kits/webcontainer-runtime/apps/daemon/dist/critique/artifact-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-writer.js","sourceRoot":"","sources":["../../src/critique/artifact-writer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AAEzC;;;;;;;;;;;;GAYG;AACH,MAAM,wBAAwB,GAAG;IAC/B,WAAW,EAAE,MAAM;IACnB,UAAU,EAAE,KAAK;IACjB,eAAe,EAAE,IAAI;IACrB,YAAY,EAAE,KAAK;IACnB,kBAAkB,EAAE,MAAM;IAC1B,eAAe,EAAE,KAAK;CACmB,CAAC;AAE5C,MAAM,aAAa,GAAG,0BAA0B,CAAC;AACjD,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAiBjC;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAEzB;IAA4B;IADxC,IAAI,GAAG,oBAA6B,CAAC;IAC9C,YAAqB,SAAiB,EAAW,QAAgB;QAC/D,KAAK,CACH,sBAAsB,SAAS,0CAA0C,QAAQ,QAAQ,CAC1F,CAAC;QAHiB,cAAS,GAAT,SAAS,CAAQ;QAAW,aAAQ,GAAR,QAAQ,CAAQ;IAIjE,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,GAAG,gBAAyB,CAAC;IAC1C;QACE,KAAK,CAAC,gFAAgF,CAAC,CAAC;IAC1F,CAAC;CACF;AASD;;wDAEwD;AACxD,MAAM,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,IAAY,EACZ,IAAY,EACZ,UAAoC,EAAE;IAEtC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,kBAAkB,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,SAAS,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,qBAAqB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,YAAY,SAAS,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAEzC,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,OAAO,GAAG,GAAG,OAAO,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC9D,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kEAAkE;QAClE,yBAAyB;QACzB,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzC,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,aAAqB;IACpD,MAAM,KAAK,GAAI,wBAAmD,CAAC,aAAa,CAAC,CAAC;IAClF,OAAO,KAAK,IAAI,kBAAkB,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,EAAE,CAAC;QACnE,IAAI,GAAG,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;IACjC,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7D,IAAI,CAAC,IAAI;QAAE,OAAO,aAAa,CAAC;IAChC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,wBAAwB,EAAE,IAAI,CAAC,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,wBAAwB;IACxB,aAAa;IACb,kBAAkB;IAClB,iBAAiB;CAClB,CAAC"}

package/dist/__w3kits/webcontainer-runtime/apps/daemon/dist/critique/config.d.ts

@@ -0,0 +1,10 @@
+import type { CritiqueConfig } from '@open-design/contracts/critique';
+/**
+ * Load CritiqueConfig from process.env. Keys map 1:1 to OD_CRITIQUE_*.
+ * Missing values fall back to defaultCritiqueConfig(). Invalid values
+ * (non-numeric, negative, out-of-range) throw RangeError so misconfig
+ * surfaces at boot, never silently.
+ *
+ * @see specs/current/critique-theater.md § Configuration (env vars)
+ */
+export declare function loadCritiqueConfigFromEnv(env?: NodeJS.ProcessEnv): CritiqueConfig;