apphx 2.0.1 → 2.1.0

package/dist/notify.js

@@ -0,0 +1,267 @@
+import { toError } from "./schemas.js";
+import { connect } from "node:net";
+import { connect as connect$1 } from "node:tls";
+// src/notify.ts
+function replyFrom(lines) {
+	const status = Number(lines.at(-1)?.slice(0, 3));
+	if (!Number.isInteger(status)) throw new Error(`SMTP server sent an unreadable reply: ${JSON.stringify(lines)}`);
+	return {
+		code: status,
+		lines
+	};
+}
+function readReply(connection, buffer) {
+	return new Promise((resolve, reject) => {
+		let current = buffer;
+		const complete = [];
+		const onData = (chunk) => {
+			current += chunk.toString("utf8");
+			const lines = current.split("\r\n");
+			current = lines.pop() ?? "";
+			while (lines.length) {
+				const line = lines.shift();
+				complete.push(line);
+				if (line.length < 4 || line[3] !== "-") {
+					cleanup();
+					try {
+						resolve({
+							result: replyFrom(complete),
+							rest: current
+						});
+					} catch (cause) {
+						reject(cause);
+					}
+					return;
+				}
+			}
+		};
+		const onError = (error) => {
+			cleanup();
+			reject(error);
+		};
+		const onClose = () => {
+			cleanup();
+			reject(/* @__PURE__ */ new Error("SMTP connection closed while reading a reply"));
+		};
+		const cleanup = () => {
+			connection.removeListener("data", onData);
+			connection.removeListener("error", onError);
+			connection.removeListener("close", onClose);
+		};
+		connection.on("data", onData);
+		connection.on("error", onError);
+		connection.on("close", onClose);
+	});
+}
+function expect(result, allowed, context) {
+	if (!allowed.includes(result.code)) throw new Error(`SMTP ${context} failed (${result.code}): ${result.lines.join(" ")}`);
+}
+async function command(connection, text, allowed, context, buffer) {
+	if (text !== null) connection.write(`${text}\r\n`);
+	const { result, rest } = await readReply(connection, buffer);
+	expect(result, allowed, context);
+	return {
+		rest,
+		result
+	};
+}
+async function connectSocket(options) {
+	if (options.secure) {
+		const socket = connect$1({
+			host: options.host,
+			port: options.port,
+			servername: options.host,
+			rejectUnauthorized: true
+		});
+		socket.setTimeout(options.timeoutMs, () => socket.destroy(/* @__PURE__ */ new Error(`SMTP TLS handshake timed out after ${options.timeoutMs}ms`)));
+		return await new Promise((resolve, reject) => {
+			socket.once("secureConnect", () => resolve(socket));
+			socket.once("error", reject);
+			socket.once("close", () => reject(/* @__PURE__ */ new Error("SMTP TLS connection closed before the handshake completed")));
+		});
+	}
+	const socket = connect({
+		host: options.host,
+		port: options.port
+	});
+	socket.setTimeout(options.timeoutMs, () => socket.destroy(/* @__PURE__ */ new Error(`SMTP connection timed out after ${options.timeoutMs}ms`)));
+	return await new Promise((resolve, reject) => {
+		socket.once("connect", () => resolve(socket));
+		socket.once("error", reject);
+	});
+}
+async function upgradeTls(socket, options) {
+	const upgraded = connect$1({
+		socket,
+		servername: options.host,
+		rejectUnauthorized: true
+	});
+	await new Promise((resolve, reject) => {
+		upgraded.once("secureConnect", () => resolve());
+		upgraded.once("error", reject);
+	});
+	return upgraded;
+}
+/** Minimal SMTP client: EHLO, optional STARTTLS, AUTH PLAIN, MAIL/RCPT/DATA, QUIT. */
+async function sendMail(options, envelope) {
+	let connection = await connectSocket(options);
+	try {
+		let buffer = "";
+		const greeting = await readReply(connection, buffer);
+		buffer = greeting.rest;
+		expect(greeting.result, [220], "greeting");
+		let ehlo = await command(connection, "EHLO apphx", [250], "EHLO", buffer);
+		buffer = ehlo.rest;
+		const capabilities = ehlo.result.lines.join(" ").toUpperCase();
+		if (!options.secure && capabilities.includes("STARTTLS")) {
+			buffer = (await command(connection, "STARTTLS", [220], "STARTTLS", buffer)).rest;
+			connection = await upgradeTls(connection, options);
+			ehlo = await command(connection, "EHLO apphx", [250], "EHLO", buffer);
+			buffer = ehlo.rest;
+		}
+		if (options.user) {
+			if (options.password === void 0) throw new Error("SMTP user is configured without a resolvable password; set the configured passwordEnv in the host environment");
+			const payload = Buffer.from(`\0${options.user}\0${options.password}`, "utf8").toString("base64");
+			buffer = (await command(connection, "AUTH PLAIN", [334], "AUTH challenge", buffer)).rest;
+			buffer = (await command(connection, payload, [235], "AUTH", buffer)).rest;
+		}
+		buffer = (await command(connection, `MAIL FROM:<${envelope.from}>`, [250], "MAIL FROM", buffer)).rest;
+		buffer = (await command(connection, `RCPT TO:<${envelope.to}>`, [250, 251], "RCPT TO", buffer)).rest;
+		buffer = (await command(connection, "DATA", [354], "DATA", buffer)).rest;
+		const dotStuffed = `${[
+			`From: ${envelope.from}`,
+			`To: ${envelope.to}`,
+			`Subject: ${envelope.subject}`,
+			"MIME-Version: 1.0",
+			"Content-Type: text/plain; charset=utf-8",
+			`Message-ID: <${Date.now().toString(36)}-${Buffer.from(envelope.to).toString("hex").slice(0, 12)}@apphx.local>`
+		].join("\r\n")}\r\n\r\n${envelope.body}`.replace(/\r?\n/g, "\r\n").replace(/^\./gm, "..");
+		const accepted = await new Promise((resolve, reject) => {
+			let current = "";
+			const onData = (chunk) => {
+				current += chunk.toString("utf8");
+				const end = current.indexOf("\r\n");
+				if (end === -1) return;
+				connection.removeListener("data", onData);
+				const line = current.slice(0, end + 2);
+				const status = Number(line.slice(0, 3));
+				if (!Number.isInteger(status)) {
+					reject(/* @__PURE__ */ new Error(`SMTP DATA got an unreadable reply: ${JSON.stringify(line)}`));
+					return;
+				}
+				resolve({
+					code: status,
+					lines: [line.trim()]
+				});
+			};
+			connection.on("data", onData);
+			connection.write(`${dotStuffed}\r\n.\r\n`);
+		});
+		expect(accepted, [250], "DATA acceptance");
+		const queued = accepted.lines.join(" ").match(/queued as (?:<)?([^ >]+)/i);
+		await command(connection, "QUIT", [221], "QUIT", buffer).catch(() => {});
+		return { messageId: queued?.[1] ?? null };
+	} finally {
+		connection.destroy();
+	}
+}
+function template(value, job) {
+	return value.replaceAll("{product}", job.spec.id).replaceAll("{name}", job.spec.name).replaceAll("{version}", job.spec.version).replaceAll("{platform}", job.spec.platform).replaceAll("{channel}", job.spec.channel).replaceAll("{status}", job.status).replaceAll("{artifact}", job.artifact ? `${job.artifact.kind} ${job.artifact.digest}` : "none");
+}
+function notifyConfig(config) {
+	if (!config.notify) throw Object.assign(/* @__PURE__ */ new Error("No notify configuration; add notify.email (from, to, smtpHost, smtpPort) to the control configuration before notifying"), { code: "SETUP_REQUIRED" });
+	return config.notify.email;
+}
+async function notifyJob(store, config, id) {
+	const email = notifyConfig(config);
+	const job = store.transition(id, (current) => {
+		if (current.status !== "built" || !current.artifact) throw new Error("Email notification requires a built task with a recorded artifact; packaging runs after the verification and review gates, so only gate-passed tasks are notified");
+		if (current.notifiedAt) return {};
+		if (current.notifySendingAt) throw new Error("Notification already in flight for this task; retry after the current send settles");
+		return { notifySendingAt: (/* @__PURE__ */ new Date()).toISOString() };
+	});
+	if (job.notifiedAt) return {
+		id,
+		notifiedTo: job.notifiedTo ?? null,
+		messageId: null,
+		error: null
+	};
+	const to = job.spec.authorEmail ?? email.to;
+	const password = email.passwordEnv ? process.env[email.passwordEnv] : void 0;
+	const subject = template(email.subject ?? "[apphx] {name} v{version} packaged", job);
+	const body = template(email.body ?? `The local packaging pipeline finished for {name} {version} ({platform}/{channel}).\n\nArtifact: {artifact}\nStatus: {status}\n\nVerification and independent review gates passed; this email is a local notification. Store upload, submission and review remain manual human work outside this tool.`, job);
+	try {
+		const { messageId } = await sendMail({
+			host: email.smtpHost,
+			port: email.smtpPort,
+			secure: email.secure,
+			user: email.user,
+			password,
+			timeoutMs: email.timeoutMs
+		}, {
+			from: email.from,
+			to,
+			subject,
+			body
+		});
+		store.update(id, {
+			notifiedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			notifiedTo: to,
+			notifySendingAt: null,
+			notifyError: null
+		});
+		store.event(id, {
+			notified: true,
+			notifiedTo: to,
+			messageId
+		});
+		return {
+			id,
+			notifiedTo: to,
+			messageId,
+			error: null
+		};
+	} catch (cause) {
+		const error = toError(cause).message;
+		store.update(id, {
+			notifyError: error,
+			notifySendingAt: null
+		});
+		store.event(id, {
+			notified: false,
+			notifiedTo: to,
+			error
+		});
+		throw new Error(`Email notification failed for ${to}: ${error}`);
+	}
+}
+async function notifyBuiltJobs(store, config) {
+	notifyConfig(config);
+	const outcomes = [];
+	for (const job of store.list()) {
+		if (job.status !== "built" || !job.artifact) continue;
+		if (job.notifiedAt) {
+			outcomes.push({
+				id: job.id,
+				notifiedTo: job.notifiedTo ?? null,
+				messageId: null,
+				error: null
+			});
+			continue;
+		}
+		try {
+			outcomes.push(await notifyJob(store, config, job.id));
+		} catch (cause) {
+			outcomes.push({
+				id: job.id,
+				notifiedTo: job.spec.authorEmail ?? config.notify.email.to,
+				messageId: null,
+				error: toError(cause).message
+			});
+		}
+	}
+	return outcomes;
+}
+export { notifyBuiltJobs, notifyJob, sendMail };
+
+//# sourceMappingURL=notify.js.map

package/dist/notify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify.js","names":["tlsConnect"],"sources":["../src/notify.ts"],"sourcesContent":["import { connect, type Socket } from 'node:net';\nimport { connect as tlsConnect, type TLSSocket } from 'node:tls';\nimport { toError, type Config, type Job } from './schemas.js';\nimport type { Store } from './store.js';\n\ntype Connection = Socket | TLSSocket;\n\ninterface SmtpResult { code: number; lines: string[] }\n\nfunction replyFrom(lines: string[]): SmtpResult {\n  const status = Number(lines.at(-1)?.slice(0, 3));\n  if (!Number.isInteger(status)) throw new Error(`SMTP server sent an unreadable reply: ${JSON.stringify(lines)}`);\n  return { code: status, lines };\n}\n\nfunction readReply(connection: Connection, buffer: string): Promise<{ result: SmtpResult; rest: string }> {\n  return new Promise((resolve, reject) => {\n    let current = buffer;\n    const complete: string[] = [];\n    const onData = (chunk: Buffer): void => {\n      current += chunk.toString('utf8');\n      const lines = current.split('\\r\\n');\n      current = lines.pop() ?? '';\n      while (lines.length) {\n        const line = lines.shift()!;\n        complete.push(line);\n        if (line.length < 4 || line[3] !== '-') {\n          cleanup();\n          try { resolve({ result: replyFrom(complete), rest: current }); } catch (cause) { reject(cause); }\n          return;\n        }\n      }\n    };\n    const onError = (error: Error): void => { cleanup(); reject(error); };\n    const onClose = (): void => { cleanup(); reject(new Error('SMTP connection closed while reading a reply')); };\n    const cleanup = (): void => {\n      connection.removeListener('data', onData);\n      connection.removeListener('error', onError);\n      connection.removeListener('close', onClose);\n    };\n    connection.on('data', onData);\n    connection.on('error', onError);\n    connection.on('close', onClose);\n  });\n}\n\nfunction expect(result: SmtpResult, allowed: number[], context: string): void {\n  if (!allowed.includes(result.code)) throw new Error(`SMTP ${context} failed (${result.code}): ${result.lines.join(' ')}`);\n}\n\nasync function command(connection: Connection, text: string | null, allowed: number[], context: string, buffer: string): Promise<{ rest: string; result: SmtpResult }> {\n  if (text !== null) connection.write(`${text}\\r\\n`);\n  const { result, rest } = await readReply(connection, buffer);\n  expect(result, allowed, context);\n  return { rest, result };\n}\n\ninterface SmtpOptions {\n  host: string; port: number; secure: boolean; user?: string; password?: string; timeoutMs: number;\n}\n\nasync function connectSocket(options: SmtpOptions): Promise<Connection> {\n  if (options.secure) {\n    const socket = tlsConnect({ host: options.host, port: options.port, servername: options.host, rejectUnauthorized: true });\n    socket.setTimeout(options.timeoutMs, () => socket.destroy(new Error(`SMTP TLS handshake timed out after ${options.timeoutMs}ms`)));\n    return await new Promise<Connection>((resolve, reject) => {\n      socket.once('secureConnect', () => resolve(socket));\n      socket.once('error', reject);\n      socket.once('close', () => reject(new Error('SMTP TLS connection closed before the handshake completed')));\n    });\n  }\n  const socket = connect({ host: options.host, port: options.port });\n  socket.setTimeout(options.timeoutMs, () => socket.destroy(new Error(`SMTP connection timed out after ${options.timeoutMs}ms`)));\n  return await new Promise<Connection>((resolve, reject) => {\n    socket.once('connect', () => resolve(socket));\n    socket.once('error', reject);\n  });\n}\n\nasync function upgradeTls(socket: Connection, options: SmtpOptions): Promise<TLSSocket> {\n  const upgraded = tlsConnect({ socket, servername: options.host, rejectUnauthorized: true });\n  await new Promise<void>((resolve, reject) => {\n    upgraded.once('secureConnect', () => resolve());\n    upgraded.once('error', reject);\n  });\n  return upgraded;\n}\n\n/** Minimal SMTP client: EHLO, optional STARTTLS, AUTH PLAIN, MAIL/RCPT/DATA, QUIT. */\nexport async function sendMail(options: SmtpOptions, envelope: { from: string; to: string; subject: string; body: string }): Promise<{ messageId: string | null }> {\n  let connection = await connectSocket(options);\n  try {\n    let buffer = '';\n    const greeting = await readReply(connection, buffer);\n    buffer = greeting.rest;\n    expect(greeting.result, [220], 'greeting');\n    let ehlo = await command(connection, 'EHLO apphx', [250], 'EHLO', buffer);\n    buffer = ehlo.rest;\n    const capabilities = ehlo.result.lines.join(' ').toUpperCase();\n    if (!options.secure && capabilities.includes('STARTTLS')) {\n      buffer = (await command(connection, 'STARTTLS', [220], 'STARTTLS', buffer)).rest;\n      connection = await upgradeTls(connection, options);\n      ehlo = await command(connection, 'EHLO apphx', [250], 'EHLO', buffer);\n      buffer = ehlo.rest;\n    }\n    if (options.user) {\n      if (options.password === undefined) throw new Error('SMTP user is configured without a resolvable password; set the configured passwordEnv in the host environment');\n      const payload = Buffer.from(`\\0${options.user}\\0${options.password}`, 'utf8').toString('base64');\n      buffer = (await command(connection, 'AUTH PLAIN', [334], 'AUTH challenge', buffer)).rest;\n      buffer = (await command(connection, payload, [235], 'AUTH', buffer)).rest;\n    }\n    buffer = (await command(connection, `MAIL FROM:<${envelope.from}>`, [250], 'MAIL FROM', buffer)).rest;\n    buffer = (await command(connection, `RCPT TO:<${envelope.to}>`, [250, 251], 'RCPT TO', buffer)).rest;\n    buffer = (await command(connection, 'DATA', [354], 'DATA', buffer)).rest;\n    const headers = [\n      `From: ${envelope.from}`,\n      `To: ${envelope.to}`,\n      `Subject: ${envelope.subject}`,\n      'MIME-Version: 1.0',\n      'Content-Type: text/plain; charset=utf-8',\n      `Message-ID: <${Date.now().toString(36)}-${Buffer.from(envelope.to).toString('hex').slice(0, 12)}@apphx.local>`,\n    ].join('\\r\\n');\n    const dotStuffed = `${headers}\\r\\n\\r\\n${envelope.body}`.replace(/\\r?\\n/g, '\\r\\n').replace(/^\\./gm, '..');\n    const accepted = await new Promise<SmtpResult>((resolve, reject) => {\n      let current = '';\n      const onData = (chunk: Buffer): void => {\n        current += chunk.toString('utf8');\n        const end = current.indexOf('\\r\\n');\n        if (end === -1) return;\n        connection.removeListener('data', onData);\n        const line = current.slice(0, end + 2);\n        const status = Number(line.slice(0, 3));\n        if (!Number.isInteger(status)) { reject(new Error(`SMTP DATA got an unreadable reply: ${JSON.stringify(line)}`)); return; }\n        resolve({ code: status, lines: [line.trim()] });\n      };\n      connection.on('data', onData);\n      connection.write(`${dotStuffed}\\r\\n.\\r\\n`);\n    });\n    expect(accepted, [250], 'DATA acceptance');\n    const queued = accepted.lines.join(' ').match(/queued as (?:<)?([^ >]+)/i);\n    await command(connection, 'QUIT', [221], 'QUIT', buffer).catch(() => {});\n    return { messageId: queued?.[1] ?? null };\n  } finally {\n    connection.destroy();\n  }\n}\n\nfunction template(value: string, job: Job): string {\n  return value\n    .replaceAll('{product}', job.spec.id)\n    .replaceAll('{name}', job.spec.name)\n    .replaceAll('{version}', job.spec.version)\n    .replaceAll('{platform}', job.spec.platform)\n    .replaceAll('{channel}', job.spec.channel)\n    .replaceAll('{status}', job.status)\n    .replaceAll('{artifact}', job.artifact ? `${job.artifact.kind} ${job.artifact.digest}` : 'none');\n}\n\nexport type NotifyOutcome = { id: string; notifiedTo: string | null; messageId: string | null; error: string | null };\n\nfunction notifyConfig(config: Config) {\n  if (!config.notify) throw Object.assign(new Error('No notify configuration; add notify.email (from, to, smtpHost, smtpPort) to the control configuration before notifying'), { code: 'SETUP_REQUIRED' });\n  return config.notify.email;\n}\n\nexport async function notifyJob(store: Store, config: Config, id: string): Promise<NotifyOutcome> {\n  const email = notifyConfig(config);\n  // Claim the send first so concurrent notifiers cannot double-send; the claim\n  // is released on success (notifiedAt) or failure (notifyError).\n  const job = store.transition(id, current => {\n    if (current.status !== 'built' || !current.artifact) throw new Error('Email notification requires a built task with a recorded artifact; packaging runs after the verification and review gates, so only gate-passed tasks are notified');\n    if (current.notifiedAt) return {};\n    if (current.notifySendingAt) throw new Error('Notification already in flight for this task; retry after the current send settles');\n    return { notifySendingAt: new Date().toISOString() };\n  });\n  if (job.notifiedAt) return { id, notifiedTo: job.notifiedTo ?? null, messageId: null, error: null };\n  const to = job.spec.authorEmail ?? email.to;\n  const password = email.passwordEnv ? process.env[email.passwordEnv] : undefined;\n  const subject = template(email.subject ?? '[apphx] {name} v{version} packaged', job);\n  const body = template(email.body ?? `The local packaging pipeline finished for {name} {version} ({platform}/{channel}).\\n\\nArtifact: {artifact}\\nStatus: {status}\\n\\nVerification and independent review gates passed; this email is a local notification. Store upload, submission and review remain manual human work outside this tool.`, job);\n  try {\n    const { messageId } = await sendMail({ host: email.smtpHost, port: email.smtpPort, secure: email.secure, user: email.user, password, timeoutMs: email.timeoutMs }, { from: email.from, to, subject, body });\n    store.update(id, { notifiedAt: new Date().toISOString(), notifiedTo: to, notifySendingAt: null, notifyError: null });\n    store.event(id, { notified: true, notifiedTo: to, messageId });\n    return { id, notifiedTo: to, messageId, error: null };\n  } catch (cause) {\n    const error = toError(cause).message;\n    store.update(id, { notifyError: error, notifySendingAt: null });\n    store.event(id, { notified: false, notifiedTo: to, error });\n    throw new Error(`Email notification failed for ${to}: ${error}`);\n  }\n}\n\nexport async function notifyBuiltJobs(store: Store, config: Config): Promise<NotifyOutcome[]> {\n  notifyConfig(config);\n  const outcomes: NotifyOutcome[] = [];\n  for (const job of store.list()) {\n    if (job.status !== 'built' || !job.artifact) continue;\n    if (job.notifiedAt) { outcomes.push({ id: job.id, notifiedTo: job.notifiedTo ?? null, messageId: null, error: null }); continue; }\n    try { outcomes.push(await notifyJob(store, config, job.id)); }\n    catch (cause) { outcomes.push({ id: job.id, notifiedTo: job.spec.authorEmail ?? config.notify!.email.to, messageId: null, error: toError(cause).message }); }\n  }\n  return outcomes;\n}\n"],"mappings":";;;;AASA,SAAS,UAAU,OAA6B;CAC9C,MAAM,SAAS,OAAO,MAAM,GAAG,EAAE,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC;CAC/C,IAAI,CAAC,OAAO,UAAU,MAAM,GAAG,MAAM,IAAI,MAAM,yCAAyC,KAAK,UAAU,KAAK,GAAG;CAC/G,OAAO;EAAE,MAAM;EAAQ;CAAM;AAC/B;AAEA,SAAS,UAAU,YAAwB,QAA+D;CACxG,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,IAAI,UAAU;EACd,MAAM,WAAqB,CAAC;EAC5B,MAAM,UAAU,UAAwB;GACtC,WAAW,MAAM,SAAS,MAAM;GAChC,MAAM,QAAQ,QAAQ,MAAM,MAAM;GAClC,UAAU,MAAM,IAAI,KAAK;GACzB,OAAO,MAAM,QAAQ;IACnB,MAAM,OAAO,MAAM,MAAM;IACzB,SAAS,KAAK,IAAI;IAClB,IAAI,KAAK,SAAS,KAAK,KAAK,OAAO,KAAK;KACtC,QAAQ;KACR,IAAI;MAAE,QAAQ;OAAE,QAAQ,UAAU,QAAQ;OAAG,MAAM;MAAQ,CAAC;KAAG,SAAS,OAAO;MAAE,OAAO,KAAK;KAAG;KAChG;IACF;GACF;EACF;EACA,MAAM,WAAW,UAAuB;GAAE,QAAQ;GAAG,OAAO,KAAK;EAAG;EACpE,MAAM,gBAAsB;GAAE,QAAQ;GAAG,uBAAO,IAAI,MAAM,8CAA8C,CAAC;EAAG;EAC5G,MAAM,gBAAsB;GAC1B,WAAW,eAAe,QAAQ,MAAM;GACxC,WAAW,eAAe,SAAS,OAAO;GAC1C,WAAW,eAAe,SAAS,OAAO;EAC5C;EACA,WAAW,GAAG,QAAQ,MAAM;EAC5B,WAAW,GAAG,SAAS,OAAO;EAC9B,WAAW,GAAG,SAAS,OAAO;CAChC,CAAC;AACH;AAEA,SAAS,OAAO,QAAoB,SAAmB,SAAuB;CAC5E,IAAI,CAAC,QAAQ,SAAS,OAAO,IAAI,GAAG,MAAM,IAAI,MAAM,QAAQ,QAAQ,WAAW,OAAO,KAAK,KAAK,OAAO,MAAM,KAAK,GAAG,GAAG;AAC1H;AAEA,eAAe,QAAQ,YAAwB,MAAqB,SAAmB,SAAiB,QAA+D;CACrK,IAAI,SAAS,MAAM,WAAW,MAAM,GAAG,KAAK,KAAK;CACjD,MAAM,EAAE,QAAQ,SAAS,MAAM,UAAU,YAAY,MAAM;CAC3D,OAAO,QAAQ,SAAS,OAAO;CAC/B,OAAO;EAAE;EAAM;CAAO;AACxB;AAMA,eAAe,cAAc,SAA2C;CACtE,IAAI,QAAQ,QAAQ;EAClB,MAAM,SAASA,UAAW;GAAE,MAAM,QAAQ;GAAM,MAAM,QAAQ;GAAM,YAAY,QAAQ;GAAM,oBAAoB;EAAK,CAAC;EACxH,OAAO,WAAW,QAAQ,iBAAiB,OAAO,wBAAQ,IAAI,MAAM,sCAAsC,QAAQ,UAAU,GAAG,CAAC,CAAC;EACjI,OAAO,MAAM,IAAI,SAAqB,SAAS,WAAW;GACxD,OAAO,KAAK,uBAAuB,QAAQ,MAAM,CAAC;GAClD,OAAO,KAAK,SAAS,MAAM;GAC3B,OAAO,KAAK,eAAe,uBAAO,IAAI,MAAM,2DAA2D,CAAC,CAAC;EAC3G,CAAC;CACH;CACA,MAAM,SAAS,QAAQ;EAAE,MAAM,QAAQ;EAAM,MAAM,QAAQ;CAAK,CAAC;CACjE,OAAO,WAAW,QAAQ,iBAAiB,OAAO,wBAAQ,IAAI,MAAM,mCAAmC,QAAQ,UAAU,GAAG,CAAC,CAAC;CAC9H,OAAO,MAAM,IAAI,SAAqB,SAAS,WAAW;EACxD,OAAO,KAAK,iBAAiB,QAAQ,MAAM,CAAC;EAC5C,OAAO,KAAK,SAAS,MAAM;CAC7B,CAAC;AACH;AAEA,eAAe,WAAW,QAAoB,SAA0C;CACtF,MAAM,WAAWA,UAAW;EAAE;EAAQ,YAAY,QAAQ;EAAM,oBAAoB;CAAK,CAAC;CAC1F,MAAM,IAAI,SAAe,SAAS,WAAW;EAC3C,SAAS,KAAK,uBAAuB,QAAQ,CAAC;EAC9C,SAAS,KAAK,SAAS,MAAM;CAC/B,CAAC;CACD,OAAO;AACT;;AAGA,eAAsB,SAAS,SAAsB,UAA8G;CACjK,IAAI,aAAa,MAAM,cAAc,OAAO;CAC5C,IAAI;EACF,IAAI,SAAS;EACb,MAAM,WAAW,MAAM,UAAU,YAAY,MAAM;EACnD,SAAS,SAAS;EAClB,OAAO,SAAS,QAAQ,CAAC,GAAG,GAAG,UAAU;EACzC,IAAI,OAAO,MAAM,QAAQ,YAAY,cAAc,CAAC,GAAG,GAAG,QAAQ,MAAM;EACxE,SAAS,KAAK;EACd,MAAM,eAAe,KAAK,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY;EAC7D,IAAI,CAAC,QAAQ,UAAU,aAAa,SAAS,UAAU,GAAG;GACxD,UAAU,MAAM,QAAQ,YAAY,YAAY,CAAC,GAAG,GAAG,YAAY,MAAM,EAAA,CAAG;GAC5E,aAAa,MAAM,WAAW,YAAY,OAAO;GACjD,OAAO,MAAM,QAAQ,YAAY,cAAc,CAAC,GAAG,GAAG,QAAQ,MAAM;GACpE,SAAS,KAAK;EAChB;EACA,IAAI,QAAQ,MAAM;GAChB,IAAI,QAAQ,aAAa,KAAA,GAAW,MAAM,IAAI,MAAM,+GAA+G;GACnK,MAAM,UAAU,OAAO,KAAK,KAAK,QAAQ,KAAK,IAAI,QAAQ,YAAY,MAAM,CAAC,CAAC,SAAS,QAAQ;GAC/F,UAAU,MAAM,QAAQ,YAAY,cAAc,CAAC,GAAG,GAAG,kBAAkB,MAAM,EAAA,CAAG;GACpF,UAAU,MAAM,QAAQ,YAAY,SAAS,CAAC,GAAG,GAAG,QAAQ,MAAM,EAAA,CAAG;EACvE;EACA,UAAU,MAAM,QAAQ,YAAY,cAAc,SAAS,KAAK,IAAI,CAAC,GAAG,GAAG,aAAa,MAAM,EAAA,CAAG;EACjG,UAAU,MAAM,QAAQ,YAAY,YAAY,SAAS,GAAG,IAAI,CAAC,KAAK,GAAG,GAAG,WAAW,MAAM,EAAA,CAAG;EAChG,UAAU,MAAM,QAAQ,YAAY,QAAQ,CAAC,GAAG,GAAG,QAAQ,MAAM,EAAA,CAAG;EASpE,MAAM,aAAa,GARH;GACd,SAAS,SAAS;GAClB,OAAO,SAAS;GAChB,YAAY,SAAS;GACrB;GACA;GACA,gBAAgB,KAAK,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,GAAG,OAAO,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE;EACnG,CAAC,CAAC,KAAK,MACqB,EAAE,UAAU,SAAS,OAAO,QAAQ,UAAU,MAAM,CAAC,CAAC,QAAQ,SAAS,IAAI;EACvG,MAAM,WAAW,MAAM,IAAI,SAAqB,SAAS,WAAW;GAClE,IAAI,UAAU;GACd,MAAM,UAAU,UAAwB;IACtC,WAAW,MAAM,SAAS,MAAM;IAChC,MAAM,MAAM,QAAQ,QAAQ,MAAM;IAClC,IAAI,QAAQ,IAAI;IAChB,WAAW,eAAe,QAAQ,MAAM;IACxC,MAAM,OAAO,QAAQ,MAAM,GAAG,MAAM,CAAC;IACrC,MAAM,SAAS,OAAO,KAAK,MAAM,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO,UAAU,MAAM,GAAG;KAAE,uBAAO,IAAI,MAAM,sCAAsC,KAAK,UAAU,IAAI,GAAG,CAAC;KAAG;IAAQ;IAC1H,QAAQ;KAAE,MAAM;KAAQ,OAAO,CAAC,KAAK,KAAK,CAAC;IAAE,CAAC;GAChD;GACA,WAAW,GAAG,QAAQ,MAAM;GAC5B,WAAW,MAAM,GAAG,WAAW,UAAU;EAC3C,CAAC;EACD,OAAO,UAAU,CAAC,GAAG,GAAG,iBAAiB;EACzC,MAAM,SAAS,SAAS,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,2BAA2B;EACzE,MAAM,QAAQ,YAAY,QAAQ,CAAC,GAAG,GAAG,QAAQ,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;EACvE,OAAO,EAAE,WAAW,SAAS,MAAM,KAAK;CAC1C,UAAU;EACR,WAAW,QAAQ;CACrB;AACF;AAEA,SAAS,SAAS,OAAe,KAAkB;CACjD,OAAO,MACJ,WAAW,aAAa,IAAI,KAAK,EAAE,CAAC,CACpC,WAAW,UAAU,IAAI,KAAK,IAAI,CAAC,CACnC,WAAW,aAAa,IAAI,KAAK,OAAO,CAAC,CACzC,WAAW,cAAc,IAAI,KAAK,QAAQ,CAAC,CAC3C,WAAW,aAAa,IAAI,KAAK,OAAO,CAAC,CACzC,WAAW,YAAY,IAAI,MAAM,CAAC,CAClC,WAAW,cAAc,IAAI,WAAW,GAAG,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,WAAW,MAAM;AACnG;AAIA,SAAS,aAAa,QAAgB;CACpC,IAAI,CAAC,OAAO,QAAQ,MAAM,OAAO,uBAAO,IAAI,MAAM,wHAAwH,GAAG,EAAE,MAAM,iBAAiB,CAAC;CACvM,OAAO,OAAO,OAAO;AACvB;AAEA,eAAsB,UAAU,OAAc,QAAgB,IAAoC;CAChG,MAAM,QAAQ,aAAa,MAAM;CAGjC,MAAM,MAAM,MAAM,WAAW,KAAI,YAAW;EAC1C,IAAI,QAAQ,WAAW,WAAW,CAAC,QAAQ,UAAU,MAAM,IAAI,MAAM,mKAAmK;EACxO,IAAI,QAAQ,YAAY,OAAO,CAAC;EAChC,IAAI,QAAQ,iBAAiB,MAAM,IAAI,MAAM,oFAAoF;EACjI,OAAO,EAAE,kCAAiB,IAAI,KAAK,EAAA,CAAE,YAAY,EAAE;CACrD,CAAC;CACD,IAAI,IAAI,YAAY,OAAO;EAAE;EAAI,YAAY,IAAI,cAAc;EAAM,WAAW;EAAM,OAAO;CAAK;CAClG,MAAM,KAAK,IAAI,KAAK,eAAe,MAAM;CACzC,MAAM,WAAW,MAAM,cAAc,QAAQ,IAAI,MAAM,eAAe,KAAA;CACtE,MAAM,UAAU,SAAS,MAAM,WAAW,sCAAsC,GAAG;CACnF,MAAM,OAAO,SAAS,MAAM,QAAQ,ySAAyS,GAAG;CAChV,IAAI;EACF,MAAM,EAAE,cAAc,MAAM,SAAS;GAAE,MAAM,MAAM;GAAU,MAAM,MAAM;GAAU,QAAQ,MAAM;GAAQ,MAAM,MAAM;GAAM;GAAU,WAAW,MAAM;EAAU,GAAG;GAAE,MAAM,MAAM;GAAM;GAAI;GAAS;EAAK,CAAC;EAC1M,MAAM,OAAO,IAAI;GAAE,6BAAY,IAAI,KAAK,EAAA,CAAE,YAAY;GAAG,YAAY;GAAI,iBAAiB;GAAM,aAAa;EAAK,CAAC;EACnH,MAAM,MAAM,IAAI;GAAE,UAAU;GAAM,YAAY;GAAI;EAAU,CAAC;EAC7D,OAAO;GAAE;GAAI,YAAY;GAAI;GAAW,OAAO;EAAK;CACtD,SAAS,OAAO;EACd,MAAM,QAAQ,QAAQ,KAAK,CAAC,CAAC;EAC7B,MAAM,OAAO,IAAI;GAAE,aAAa;GAAO,iBAAiB;EAAK,CAAC;EAC9D,MAAM,MAAM,IAAI;GAAE,UAAU;GAAO,YAAY;GAAI;EAAM,CAAC;EAC1D,MAAM,IAAI,MAAM,iCAAiC,GAAG,IAAI,OAAO;CACjE;AACF;AAEA,eAAsB,gBAAgB,OAAc,QAA0C;CAC5F,aAAa,MAAM;CACnB,MAAM,WAA4B,CAAC;CACnC,KAAK,MAAM,OAAO,MAAM,KAAK,GAAG;EAC9B,IAAI,IAAI,WAAW,WAAW,CAAC,IAAI,UAAU;EAC7C,IAAI,IAAI,YAAY;GAAE,SAAS,KAAK;IAAE,IAAI,IAAI;IAAI,YAAY,IAAI,cAAc;IAAM,WAAW;IAAM,OAAO;GAAK,CAAC;GAAG;EAAU;EACjI,IAAI;GAAE,SAAS,KAAK,MAAM,UAAU,OAAO,QAAQ,IAAI,EAAE,CAAC;EAAG,SACtD,OAAO;GAAE,SAAS,KAAK;IAAE,IAAI,IAAI;IAAI,YAAY,IAAI,KAAK,eAAe,OAAO,OAAQ,MAAM;IAAI,WAAW;IAAM,OAAO,QAAQ,KAAK,CAAC,CAAC;GAAQ,CAAC;EAAG;CAC9J;CACA,OAAO;AACT"}

package/dist/runner.js

@@ -13,7 +13,7 @@ import { parseResearch, researchPrompt, reviewInstructions } from "./policy.js";
 import { assertProject, buildInstructions } from "./project-profiles.js";
 import { validateMacOSArtifact } from "./macos.js";
 import { invalidateVerification } from "./proof.js";
-import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createHash, randomUUID } from "node:crypto";
@@ -25,6 +25,15 @@ function requireDependencyProof(job) {
 function taskPrompt(job) {
 	return `You are the native host of an embedded multi-stack app Harness. Use your own context, tools and native delegation in ${projectDirectory(job)}; never launch another coding-agent CLI. Preserve the requested framework and existing architecture. Implement only this product. Never hide functionality from users or reviewers. Do not upload, submit, push, read publisher credentials or change factory state. Remote build commands belong only to the explicitly authorized Harness packaging profile, not host turns. The workspace is not a security sandbox. Complete real implementations, not placeholders.\nImmutable product requirements:\n${JSON.stringify(job.spec, null, 2)}\nPrevious verification/review failure (repair the mechanism, never weaken acceptance):\n${job.feedback ?? job.error ?? "none"}\nPersisted execution logs:\n${JSON.stringify(job.logs.slice(-3))}\nContinue existing work. Only actual deterministic checks performed by the Harness establish verification; host claims do not.\n`;
 }
+const DEFAULT_ROLES = {
+	research: ["product-analyst"],
+	build: ["developer"],
+	review: [
+		"architect-review",
+		"qa-engineer",
+		"acceptance-reviewer"
+	]
+};
 function contextDigest(job) {
 	return createHash("sha256").update(JSON.stringify({
 		spec: job.spec,
@@ -83,15 +92,18 @@ function hostAction(store, job) {
 		environment.FLUTTER_ROOT = job.config.toolchain.flutterSdk;
 		environment.PATH = `${join(job.config.toolchain.flutterSdk, "bin")}${process.env.PATH ? `${delimiter}${process.env.PATH}` : ""}`;
 	}
+	const role = [...job.config.roles?.[turn.stage] ?? DEFAULT_ROLES[turn.stage]];
+	const prompt = `${taskPrompt(job)}${instruction}\nTurn roles (adopt every role through your native delegation, with independent contexts where the skill requires them): ${JSON.stringify(role)}`;
 	return {
 		job,
 		action: "host",
 		turn: {
 			id: turn.id,
 			stage: turn.stage,
-			prompt: taskPrompt(job) + instruction,
+			prompt,
 			cwd: projectDirectory(job),
-			environment: Object.fromEntries(Object.entries(environment).filter((entry) => entry[1] !== void 0))
+			environment: Object.fromEntries(Object.entries(environment).filter((entry) => entry[1] !== void 0)),
+			role
 		}
 	};
 }
@@ -216,6 +228,51 @@ async function nextTurn(store, id, options = {}) {
 		store.release();
 	}
 }
+/**
+* Pick the earliest-due actionable task in the whole queue for a host loop:
+* the first job (ordered by priority lane, then next_at, then insertion) whose
+* `next` returns a host turn or a deterministic step. Jobs that are deferred, stopped or still
+* owned by another execution are skipped; jobs whose persisted turn context no
+* longer matches are surfaced in `pendingErrors` instead of silently blocking
+* the queue. `idle` reports the earliest future due time plus a status summary
+* so the host can audit whether the queue is truly finished or merely blocked,
+* and knows when to wake again. Does not hold the queue worker lock across
+* calls; each host claim stays transactional inside `nextTurn`.
+*/
+async function nextQueueTurn(store, options = {}) {
+	const pendingErrors = [];
+	const rank = (job) => job.spec.priority === "P0" ? 0 : job.spec.priority === "P2" ? 2 : 1;
+	const jobs = [...store.list()].sort((left, right) => rank(left) - rank(right) || left.nextAt - right.nextAt);
+	for (const job of jobs) try {
+		const action = await nextTurn(store, job.id, options);
+		if (action.action === "host" || action.action === "step") return action;
+	} catch (cause) {
+		pendingErrors.push({
+			id: job.id,
+			error: toError(cause).message
+		});
+	}
+	const summary = {
+		total: jobs.length,
+		built: 0,
+		failed: 0,
+		blocked: 0,
+		waiting: 0,
+		queued: 0,
+		running: 0
+	};
+	for (const job of jobs) {
+		const status = job.status;
+		if (status === "built" || status === "failed" || status === "blocked" || status === "waiting" || status === "queued" || status === "running") summary[status] += 1;
+	}
+	const due = jobs.map((job) => job.nextAt).filter((nextAt) => nextAt > Date.now());
+	return {
+		action: "idle",
+		nextAt: due.length ? Math.min(...due) : null,
+		pendingErrors,
+		summary
+	};
+}
 function completeTurn(store, id, turnId, result, options = {}) {
 	return store.transition(id, (job) => {
 		if (!job.turn || job.turn.id !== turnId || job.turn.stage !== job.stage || job.status !== "running") throw new Error("Stale, replayed or wrong-phase host turn; use next to inspect the active token");
@@ -505,25 +562,67 @@ async function executeStep(store, job, { signal } = {}) {
 		if (job.stage === "obfuscate") {
 			const obfuscation = job.config.obfuscation;
 			if (!obfuscation) throw Object.assign(/* @__PURE__ */ new Error("Obfuscation stage requires config.obfuscation"), { code: "SETUP_REQUIRED" });
-			const expanded = expandArgv(obfuscation.command, environment);
-			const bundled = fileURLToPath(new URL("./vendor/obfuscator/dist/cli.js", import.meta.url));
-			const argv = [
-				...expanded[0] === "obfuscator" && existsSync(bundled) ? [
+			const obfuscationBase = {
+				digest: sourceDigest(job.workspace, true, job.spec.framework, job.spec.project?.directory),
+				path: projectDirectory(job)
+			};
+			let configPath = obfuscation.configPath;
+			let snapshot;
+			if (!configPath) {
+				const directory = join(config.stateDir, "obfuscation");
+				mkdirSync(directory, {
+					recursive: true,
+					mode: 448
+				});
+				snapshot = join(directory, `${job.id}-${Date.now()}.json`);
+				writeFileSync(snapshot, `${JSON.stringify(obfuscation.options ?? {}, null, 2)}\n`, { mode: 384 });
+				configPath = snapshot;
+			}
+			try {
+				const expanded = expandArgv(obfuscation.command, environment);
+				const bundled = fileURLToPath(new URL("./vendor/obfuscator/dist/cli.js", import.meta.url));
+				const resolved = expanded[0] === "obfuscator" && existsSync(bundled) ? [
 					process.execPath,
 					bundled,
 					...expanded.slice(1)
-				] : expanded,
-				"--project",
-				projectDirectory(job),
-				"--config",
-				obfuscation.configPath,
-				"--framework",
-				job.spec.framework,
-				...obfuscation.seed ? ["--seed", obfuscation.seed] : []
-			];
-			const result = await trackedRun(argv, {}, { readableFiles: [obfuscation.configPath] });
-			if (result.code !== 0) throw new Error(`Obfuscation failed (${result.code}) ${JSON.stringify(argv)}:\n${result.stderr.slice(-5e3)}\n${result.stdout.slice(-5e3)}`);
-			return next(store, job, "verify");
+				] : expanded;
+				const argv = [
+					...resolved,
+					"--project",
+					projectDirectory(job),
+					"--config",
+					configPath,
+					"--framework",
+					job.spec.framework,
+					...obfuscation.seed ? ["--seed", obfuscation.seed] : []
+				];
+				const result = await trackedRun(argv, {}, { readableFiles: [configPath] });
+				if (result.code !== 0) throw new Error(`Obfuscation failed (${result.code}) ${JSON.stringify(argv)}:\n${result.stderr.slice(-5e3)}\n${result.stdout.slice(-5e3)}`);
+				let report;
+				try {
+					const parsed = JSON.parse(result.stdout);
+					if (parsed && typeof parsed === "object") {
+						const value = parsed;
+						const skipped = value.skipped && typeof value.skipped === "object" ? value.skipped : {};
+						if (Number.isSafeInteger(value.changedFiles) && value.transforms && typeof value.transforms === "object" && !Array.isArray(value.transforms)) report = {
+							changedFiles: value.changedFiles,
+							transforms: Object.fromEntries(Object.entries(value.transforms).filter(([key, count]) => typeof key === "string" && Number.isSafeInteger(count))),
+							skipped: {
+								generated: Number.isSafeInteger(skipped.generated) ? skipped.generated : 0,
+								unsupported: Number.isSafeInteger(skipped.unsupported) ? skipped.unsupported : 0
+							}
+						};
+					}
+				} catch {}
+				if (!report && resolved[0] === process.execPath && resolved[1] === bundled) throw new Error("Bundled obfuscator produced no valid report; the transformed workspace cannot be evidenced");
+				return next(store, job, "verify", {
+					obfuscationBase,
+					obfuscationDigest: sourceDigest(job.workspace, true, job.spec.framework, job.spec.project?.directory),
+					...report ? { obfuscationReport: report } : {}
+				});
+			} finally {
+				if (snapshot) rmSync(snapshot, { force: true });
+			}
 		}
 		if (job.stage === "package") {
 			requireReviewProof(job);
@@ -699,6 +798,6 @@ async function executeStep(store, job, { signal } = {}) {
 		});
 	}
 }
-export { abandonTurn, completeTurn, executeStep, nextTurn };
+export { abandonTurn, completeTurn, executeStep, nextQueueTurn, nextTurn };
 
 //# sourceMappingURL=runner.js.map