akm-cli 0.9.2-alpha.4 → 0.9.2

package/dist/tasks/runtime-v3.js

@@ -1,281 +0,0 @@
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at https://mozilla.org/MPL/2.0/.
-/**
- * Pure task-v3 runtime projection.
- *
- * This is the only bridge from authored task-v3 source into executable work.
- * It performs all source/config/asset reads before the task runner reserves a
- * durable attempt and returns immutable snapshots. In particular, script work
- * contains frozen bytes and their digest, never a path that can be reread when
- * a delayed or resumed dispatch begins.
- */
-import { createHash } from "node:crypto";
-import fs from "node:fs";
-import path from "node:path";
-import { prepareCommandInvocation, } from "../commands/command/command-execution.js";
-import { makeBundleRef, parseBundleRef } from "../core/asset/asset-ref.js";
-import { ConfigError, NotFoundError, UsageError } from "../core/errors.js";
-import { DURATION_UNITS, parseDuration } from "../core/time.js";
-import { captureFrozenDirectoryIdentity } from "../execution/directory-identity.js";
-import { isPortableExecutionAgentSelector } from "../execution/source.js";
-import { requireAuthorizedExecutionPlan } from "../integrations/agent/execution-cascade.js";
-import { lowerResolvedExecutionRequest } from "../integrations/agent/execution-lowering.js";
-import { resolveAssetPath } from "../sources/resolve.js";
-import { detectSecretShapedParams } from "../workflows/exec/param-secrets.js";
-import { compileWorkflowPlan } from "../workflows/ir/compile.js";
-import { compileWorkflowSource } from "../workflows/source-ir/compile.js";
-import { isInferredSecretName } from "./log-redaction.js";
-import { isBunStandaloneMain } from "./resolve-akm-bin.js";
-import { SCHEDULED_TASK_CONTEXT_KEYS } from "./scheduler-invocation.js";
-const SCRIPT_INTERPRETERS = Object.freeze({
-    ".sh": "sh",
-    ".ts": "bun",
-    ".js": "bun",
-    ".ps1": "powershell",
-    ".cmd": "cmd",
-    ".bat": "cmd",
-    ".py": "python",
-    ".rb": "ruby",
-    ".go": "go",
-    ".pl": "perl",
-    ".php": "php",
-    ".lua": "lua",
-    ".r": "rscript",
-    ".swift": "swift",
-    ".kt": "kotlin",
-    ".kts": "kotlin",
-});
-function own(value, key) {
-    return value !== undefined && Object.hasOwn(value, key);
-}
-function environmentSnapshot(environment) {
-    const out = Object.create(null);
-    for (const key of Object.keys(environment ?? {}).sort()) {
-        const raw = environment?.[key];
-        if (raw === undefined)
-            continue;
-        const value = String(raw);
-        if (isInferredSecretName(key) || detectSecretShapedParams({ [key]: value }).length > 0) {
-            throw new UsageError(`Task v3 env.${key} is a secret-shaped literal env value. Store credentials in a secret/env binding rather than durable task source.`, "INVALID_FLAG_VALUE");
-        }
-        Object.defineProperty(out, key, { value, enumerable: true, configurable: false, writable: false });
-    }
-    return Object.freeze(out);
-}
-/** Merge source env with the authoritative, closed scheduler directory context. */
-function commandEnvironmentSnapshot(environment, schedulerContext) {
-    const out = Object.create(null);
-    for (const key of Object.keys(environment)) {
-        Object.defineProperty(out, key, { value: environment[key], enumerable: true, configurable: true, writable: true });
-    }
-    for (const key of SCHEDULED_TASK_CONTEXT_KEYS) {
-        const value = schedulerContext?.[key];
-        if (!value)
-            continue;
-        Object.defineProperty(out, key, { value, enumerable: true, configurable: true, writable: true });
-    }
-    return Object.freeze(out);
-}
-function normalizeTimeout(value) {
-    if (value === undefined || value === null || typeof value === "number")
-        return value;
-    const parsed = parseDuration(value, DURATION_UNITS);
-    if (parsed === null)
-        throw new UsageError(`Invalid task timeout ${JSON.stringify(value)}.`, "INVALID_FLAG_VALUE");
-    return parsed;
-}
-function qualifyOwnedRef(ref, context) {
-    const parsed = parseBundleRef(ref);
-    const bundle = parsed.bundle ?? context.bundleName;
-    return { parsed, qualified: makeBundleRef(bundle, parsed.conceptId) };
-}
-function currentExecutionValues(document, context, environment) {
-    const akm = document.akm;
-    const agent = akm?.agent;
-    return Object.freeze({
-        ...(own(akm, "agent")
-            ? {
-                agent: typeof agent === "string" && isPortableExecutionAgentSelector(agent)
-                    ? qualifyOwnedRef(agent, context).qualified
-                    : agent,
-            }
-            : {}),
-        ...(own(akm, "engine") ? { engine: akm?.engine } : {}),
-        ...(own(akm, "model") ? { model: akm?.model } : {}),
-        ...(own(akm, "inference") ? { inference: akm?.inference } : {}),
-        ...(own(akm, "outputSchema") ? { outputSchema: akm?.outputSchema } : {}),
-        ...(own(akm, "tools") ? { tools: akm?.tools } : {}),
-        ...(own(akm, "timeout") ? { timeout: akm?.timeout } : {}),
-        workspace: context.bundleRoot,
-        environment,
-    });
-}
-function base(document, context, environment) {
-    const timeoutMs = normalizeTimeout(document.akm?.timeout);
-    return Object.freeze({
-        taskId: context.taskId,
-        taskRef: context.taskRef,
-        enabled: document.akm?.enabled !== false,
-        environment,
-        ...(timeoutMs !== undefined ? { timeoutMs } : {}),
-        redact: Object.freeze([...(document.akm?.redact ?? [])]),
-    });
-}
-async function resolvedOwnedAsset(qualified, type, context) {
-    const parsed = parseBundleRef(qualified);
-    const prefix = `${type}s/`;
-    const name = parsed.conceptId.slice(prefix.length);
-    if (context.resolveAsset) {
-        const resolved = await context.resolveAsset({ bundle: parsed.bundle, type, name, ref: qualified });
-        return typeof resolved === "string"
-            ? Object.freeze({ file: resolved, bundleRoot: context.bundleRoot })
-            : Object.freeze({ file: resolved.file, bundleRoot: resolved.bundleRoot });
-    }
-    if (parsed.bundle !== context.bundleName) {
-        throw new NotFoundError(`Task target ${JSON.stringify(qualified)} names bundle ${JSON.stringify(parsed.bundle)}, but no bundle resolver was provided.`, "ASSET_NOT_FOUND");
-    }
-    return Object.freeze({
-        file: await resolveAssetPath(context.bundleRoot, type, name),
-        bundleRoot: context.bundleRoot,
-    });
-}
-function scriptInterpreter(extension, ref) {
-    const interpreter = SCRIPT_INTERPRETERS[extension];
-    if (!interpreter) {
-        throw new UsageError(`Task v3 script target ${JSON.stringify(ref)} has no closed runtime interpreter for extension ${JSON.stringify(extension)}.`, "INVALID_FLAG_VALUE");
-    }
-    if (interpreter !== "bun")
-        return interpreter;
-    if (!process.versions.bun) {
-        throw new UsageError(`Task v3 script target ${JSON.stringify(ref)} requires Bun for ${extension} execution, but this runtime cannot provide it.`, "INVALID_FLAG_VALUE");
-    }
-    return isBunStandaloneMain() ? "bun-standalone" : "bun";
-}
-function captureDirectoryIdentity(bundleRoot, workingDirectory) {
-    try {
-        return captureFrozenDirectoryIdentity(bundleRoot, workingDirectory);
-    }
-    catch (cause) {
-        if (cause instanceof UsageError)
-            throw cause;
-        throw new UsageError(`Task working directory ${JSON.stringify(workingDirectory ?? ".")} cannot be physically verified: ${cause instanceof Error ? cause.message : String(cause)}`, "INVALID_FLAG_VALUE");
-    }
-}
-function defaultTaskShell(platform) {
-    return platform === "win32" ? "powershell" : "sh";
-}
-function validatePreparedCommand(invocation, context) {
-    const request = requireAuthorizedExecutionPlan(invocation.plan);
-    if (!request.engine.name) {
-        throw new ConfigError(`Task ${JSON.stringify(context.taskRef)} has no resolved execution engine. Configure defaults.engine or akm.engine before running it.`, "INVALID_CONFIG_FILE");
-    }
-    // Lowering is pure. Running it before the durable-attempt boundary proves
-    // the selected target is transport-projectable; dispatch repeats the same
-    // deterministic projection from this frozen request/config snapshot.
-    lowerResolvedExecutionRequest(request, invocation.config);
-    return invocation;
-}
-function validateWorkflowRuntimeSource(file, workspaceRoot, readFile) {
-    const source = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(readFile(file, workspaceRoot));
-    const compiled = compileWorkflowSource(source, { path: file, workspaceRoot });
-    if (!compiled.ok) {
-        const detail = compiled.errors.map((error) => `${error.path}:${error.line}: ${error.message}`).join("; ");
-        throw new UsageError(`Task workflow target is not projectable: ${detail}`, "INVALID_FLAG_VALUE");
-    }
-    const planned = compileWorkflowPlan(compiled.ir, path.basename(file, path.extname(file)));
-    if (!planned.ok) {
-        const detail = planned.errors.map((error) => `${file}:${error.line}: ${error.message}`).join("; ");
-        throw new UsageError(`Task workflow target is not projectable: ${detail}`, "INVALID_FLAG_VALUE");
-    }
-}
-/** Project one canonical task-v3 source into immutable executable work. */
-export async function prepareTaskV3Execution(document, context) {
-    const environment = environmentSnapshot(document.env);
-    const commandEnvironment = commandEnvironmentSnapshot(environment, context.schedulerContext);
-    const common = base(document, context, environment);
-    if (document.target.kind === "run") {
-        const cwdIdentity = captureDirectoryIdentity(context.bundleRoot, document.target.workingDirectory);
-        return Object.freeze({
-            ...common,
-            kind: "shell",
-            command: document.target.run,
-            shell: document.target.shell ?? defaultTaskShell(context.platform ?? process.platform),
-            cwd: cwdIdentity.realCwd,
-            cwdIdentity,
-        });
-    }
-    const target = document.target.uses;
-    if (target.kind === "github-action") {
-        throw new UsageError(`GitHub action ${JSON.stringify(target.ref)} is recognized but remote action acquisition is unsupported in 0.9.2.`, "INVALID_FLAG_VALUE");
-    }
-    if (target.kind === "builtin-command") {
-        const command = document.target.command;
-        if (!command)
-            throw new Error("invariant: parsed built-in command target has no command action");
-        const action = command.kind === "stored"
-            ? {
-                ref: qualifyOwnedRef(command.ref, context).qualified,
-                ...(command.arguments !== undefined ? { arguments: command.arguments } : {}),
-            }
-            : { content: command.content, ...(command.arguments !== undefined ? { arguments: command.arguments } : {}) };
-        const invocation = validatePreparedCommand(await (context.prepareCommand ?? prepareCommandInvocation)({
-            action,
-            config: context.config,
-            invocationKind: "task",
-            current: currentExecutionValues(document, context, commandEnvironment),
-            ...(context.commandSourceLoader ? { sourceLoader: context.commandSourceLoader } : {}),
-        }), context);
-        return Object.freeze({ ...common, kind: "command", invocation });
-    }
-    const { qualified } = qualifyOwnedRef(target.ref, context);
-    if (target.kind === "command") {
-        if (document.target.with !== undefined) {
-            throw new UsageError("Task v3 command refs do not accept with; use akm/command with {ref, arguments} for portable arguments.", "INVALID_FLAG_VALUE");
-        }
-        const invocation = validatePreparedCommand(await (context.prepareCommand ?? prepareCommandInvocation)({
-            action: { ref: qualified },
-            config: context.config,
-            invocationKind: "task",
-            current: currentExecutionValues(document, context, commandEnvironment),
-            ...(context.commandSourceLoader ? { sourceLoader: context.commandSourceLoader } : {}),
-        }), context);
-        return Object.freeze({ ...common, kind: "command", invocation });
-    }
-    if (target.kind === "workflow") {
-        if (Object.keys(environment).length > 0) {
-            throw new UsageError("Task v3 workflow env cannot be consumed by the durable workflow runtime in 0.9.2; remove env or use a command target.", "INVALID_FLAG_VALUE");
-        }
-        const resolved = await resolvedOwnedAsset(qualified, "workflow", context);
-        validateWorkflowRuntimeSource(resolved.file, resolved.bundleRoot, context.readFile ?? ((targetPath) => fs.readFileSync(targetPath)));
-        return Object.freeze({
-            ...common,
-            kind: "workflow",
-            ref: qualified,
-            params: Object.freeze({ ...(document.target.with ?? {}) }),
-            ...(document.akm?.maxSteps !== undefined ? { maxSteps: document.akm.maxSteps } : {}),
-            ...(document.akm?.maxRetries !== undefined ? { maxRetries: document.akm.maxRetries } : {}),
-        });
-    }
-    if (document.target.with !== undefined) {
-        throw new UsageError("Task v3 script refs do not accept with.", "INVALID_FLAG_VALUE");
-    }
-    const resolved = await resolvedOwnedAsset(qualified, "script", context);
-    const file = resolved.file;
-    const extension = path.extname(file).toLowerCase();
-    const raw = (context.readFile ?? ((targetPath) => fs.readFileSync(targetPath)))(file, resolved.bundleRoot);
-    const bytes = Uint8Array.from(raw);
-    const cwdIdentity = captureDirectoryIdentity(resolved.bundleRoot);
-    return Object.freeze({
-        ...common,
-        kind: "script",
-        sourceRef: qualified,
-        interpreter: scriptInterpreter(extension, qualified),
-        extension,
-        bytesBase64: Buffer.from(bytes).toString("base64"),
-        byteLength: bytes.byteLength,
-        sha256: createHash("sha256").update(bytes).digest("hex"),
-        cwd: cwdIdentity.realCwd,
-        cwdIdentity,
-    });
-}