cursedbelt 2.7.0 → 3.0.0

package/dist/server/drivers/executionDriver.d.ts

@@ -1,216 +0,0 @@
-/**
- * `ExecutionDriver` (03 §7.1) — whitelisted, tracked, jailed OS execution.
- *
- * The whole point of this module is what it *refuses*: the driver never accepts
- * an argv string. A caller names a `commandId` that must already exist in
- * `cc-manifest.json`'s `commands` table, and named parameters interpolate into
- * fixed template slots only after passing that command's Zod arg schema. There
- * is no shell, no string concatenation, and therefore no place for
- * `; rm -rf ~` to land (ruling H-2).
- *
- * It is also the reason `exec` lives on `DevMixinContext` and nowhere else
- * (J3-4): handing OS execution to a public-facing media or knowledge route is a
- * privilege escalation waiting for a bug, so the type system — not a code
- * review — is what keeps it out of them.
- *
- * Local profile spawns through `Bun.spawn` and registers every child PID in the
- * tracker, with `SIGINT`/`SIGTERM`/`exit` hooks that sweep-kill the whole set.
- * That sweep is why a crashed dev server can no longer leave a zombie squatting
- * the port it claimed.
- */
-import { z } from 'zod';
-import type { JobBroker } from './jobBroker';
-/** A command's declaration in `cc-manifest.json` — the ONLY executable vocabulary. */
-export interface ManifestCommand {
-    id: string;
-    /**
-     * Fixed argv template. `{paramName}` slots are replaced by validated args;
-     * every other element is a literal. The first element is the executable.
-     */
-    argv: readonly string[];
-    /**
-     * Per-parameter value schema. A param absent from here can never reach argv
-     * even if the caller supplies it, and a present param's VALUE must satisfy its
-     * schema before interpolation.
-     *
-     * This is not belt-and-braces on top of "we use argv arrays, so there is no
-     * shell". It is defense in depth for the case the array assumption stops
-     * holding — a command that later gains `sh -c`, or an interpreter that does
-     * its own splitting. Refusing `1; rm -rf /` at the boundary means the jail
-     * does not depend on every downstream executable being well behaved.
-     */
-    argSchema?: Readonly<Record<string, z.ZodType<string>>>;
-    /** Working-directory root. The resolved cwd must stay inside it. */
-    cwdRoot: string;
-    /** Wall-clock ceiling for this command class; saas enforces it in the sandbox too. */
-    timeoutMs?: number;
-}
-/**
- * The default value grammar for a command parameter that declares no schema of
- * its own: no shell metacharacters, no newlines, no leading dash (which would
- * let a value masquerade as a flag).
- */
-export declare const SAFE_ARG: RegExp;
-export declare const safeArgSchema: () => z.ZodType<string>;
-export interface ExecTask {
-    /** Key into `cc-manifest.json` `commands` — the ONLY selector. */
-    commandId: string;
-    /** Named params validated against the command's declared param set. */
-    args: Record<string, string>;
-    tenantId: string;
-    instanceId: string;
-    /** Optional cwd; must resolve inside the command's `cwdRoot`. */
-    cwd?: string;
-}
-export interface ExecHandle {
-    handleId: string;
-    commandId: string;
-    pid: number;
-    startedAt: number;
-}
-export type ExecState = 'running' | 'exited' | 'killed' | 'failed';
-export interface ExecStatus {
-    handleId: string;
-    state: ExecState;
-    exitCode: number | null;
-    startedAt: number;
-    endedAt: number | null;
-}
-/** A status plus the command it came from — what a run LIST needs and a status poll does not. */
-export interface ExecRun extends ExecStatus {
-    commandId: string;
-}
-/**
- * One runnable command, as a UI may see it (03 §1e — the `pipelines` surface).
- *
- * Deliberately NOT the {@link ManifestCommand}: `argv` and `cwdRoot` are host
- * filesystem detail, and the `pipelines` feature is not privileged (the catalog
- * gates only `configEditor`/`dbAdmin` on `infra:write`). A surface that lists
- * runnable pipelines needs the id and the parameters it must collect — the
- * absolute path of the binary is neither needed nor a member's business.
- *
- * `params` is derived from the argv TEMPLATE, not from `argSchema`: a slot in the
- * template is a value the caller must supply, while a schema entry with no slot
- * can never reach argv at all. Listing the schema keys would ask for parameters
- * the command silently ignores.
- */
-export interface PipelineCommand {
-    id: string;
-    /** Slot names in argv order — exactly the args `run` requires. */
-    params: readonly string[];
-    timeoutMs?: number;
-}
-export interface ExecutionDriver {
-    run(task: ExecTask): Promise<ExecHandle>;
-    kill(handleId: string): Promise<void>;
-    status(handleId: string): Promise<ExecStatus>;
-    /**
-     * The whitelist, as a UI vocabulary (03 §1e).
-     *
-     * This is not in tension with {@link notWhitelisted}'s refusal to name the
-     * whitelist in an ERROR: that error rides to whoever sent a rejected request,
-     * including an unauthenticated one. This method is called by the `pipelines`
-     * route, which composes only when the feature is on and is behind the mixin's
-     * session guard — an authenticated caller of a dev surface that exists to run
-     * these commands. Enumerating them to a request that was refused is
-     * reconnaissance; enumerating them to the operator's own console is the point.
-     */
-    commands(): readonly PipelineCommand[];
-    /** Every run this driver has dispatched, newest first — the `pipelines` run log. */
-    runs(): readonly ExecRun[];
-    /** Every PID this driver still owns — the sweep set (and what V7.14 asserts on). */
-    trackedPids(): readonly number[];
-    /** Kill every tracked child. Idempotent; runs on signal hooks and at shutdown. */
-    sweep(): void;
-}
-export declare const EXEC_COMMAND_NOT_WHITELISTED = "EXEC_COMMAND_NOT_WHITELISTED";
-/** An argument that failed its declared schema, or a parameter the command never declared. */
-export declare const EXEC_ARG_REJECTED = "EXEC_ARG_REJECTED";
-export declare const EXEC_CWD_ESCAPE = "EXEC_CWD_ESCAPE";
-export declare const EXEC_HANDLE_UNKNOWN = "EXEC_HANDLE_UNKNOWN";
-/**
- * The declared parameter names of a command — the argv slots, in template order.
- * Shared by both drivers so the two whitelists can never describe themselves
- * differently.
- */
-export declare const commandParams: (command: ManifestCommand) => readonly string[];
-export declare const EXEC_COMMAND_UNRUNNABLE = "EXEC_COMMAND_UNRUNNABLE";
-/**
- * Refuse a whitelist holding a command that could never run (law #3 — boot loud
- * on wiring).
- *
- * `buildArgv` fills a `{slot}` from `argSchema` and from nowhere else: a value
- * for an undeclared parameter is rejected on the way in, and a slot with no
- * value throws `requires parameter`. So an argv slot with no matching
- * `argSchema` entry is a command that returns 400 for EVERY possible call — an
- * authoring mistake that, until this check, stayed invisible until someone
- * clicked Run and got a refusal that read like their own fault.
- *
- * It also makes `commands()` honest: the `pipelines` surface renders one input
- * per argv slot, and a slot nothing can satisfy would be a form that cannot be
- * completed. Found while building that surface (03 §1e).
- */
-export declare function assertRunnableCommands(commands: Readonly<Record<string, ManifestCommand>>): void;
-/**
- * Build the concrete argv from a command template and validated args.
- *
- * A slot is only ever an ENTIRE argv element — `{path}` is substituted, but
- * `--file={path}` is not treated as a slot at all. That restriction is
- * deliberate: partial interpolation is how quoting bugs and argument splitting
- * creep back in. A command that needs `--file=X` declares `['--file', '{path}']`.
- */
-export declare function buildArgv(command: ManifestCommand, args: Record<string, string>): string[];
-/**
- * Resolve a task's cwd, refusing anything outside the command's declared root.
- * Compared on normalized, separator-terminated prefixes so `/srv/app-evil` can
- * never pass as a child of `/srv/app`.
- */
-export declare function resolveCwd(command: ManifestCommand, requested: string | undefined): string;
-/** The spawn seam — `Bun.spawn` in production, a fake in tests and V7 probes. */
-export interface SpawnedProcess {
-    pid: number;
-    exited: Promise<number>;
-    kill(signal?: number | NodeJS.Signals): void;
-}
-export type SpawnFn = (argv: string[], options: {
-    cwd: string;
-    timeoutMs?: number;
-}) => SpawnedProcess;
-export interface LocalExecutionDriverOptions {
-    /** The whitelist, keyed by command id (`cc-manifest.json` → `commands`). */
-    commands: Readonly<Record<string, ManifestCommand>>;
-    spawn?: SpawnFn;
-    /** Install process-signal sweep hooks. Default true; tests pass false. */
-    installSignalHooks?: boolean;
-}
-/**
- * Local profile driver: `Bun.spawn` + the process tracker.
- *
- * Every child is registered before its first tick and deregistered only when it
- * actually exits, so the sweep set is always a superset of what is alive. The
- * signal hooks are registered once per driver and removed by `dispose()`.
- */
-export declare function createLocalExecutionDriver(options: LocalExecutionDriverOptions): ExecutionDriver & {
-    dispose(): void;
-};
-export interface SandboxCeilings {
-    memoryMb: number;
-    vcpu: number;
-    wallClockMs: number;
-}
-/** Hard ceilings per command class (03 §7.1) — a runaway job cannot eat a node. */
-export declare const DEFAULT_SANDBOX_CEILINGS: SandboxCeilings;
-export interface SaasExecutionDriverOptions {
-    commands: Readonly<Record<string, ManifestCommand>>;
-    broker: JobBroker;
-    ceilings?: Partial<SandboxCeilings>;
-}
-/**
- * SaaS profile driver: the same whitelist check, then dispatch through the
- * JobBroker into a non-privileged sandboxed worker (gVisor-class isolation) with
- * hard ceilings. No child process is ever spawned in the API process, so
- * `trackedPids` is legitimately empty here — the sweep contract belongs to the
- * worker tier.
- */
-export declare function createSaasExecutionDriver(options: SaasExecutionDriverOptions): ExecutionDriver;
-//# sourceMappingURL=executionDriver.d.ts.map

package/dist/server/drivers/executionDriver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"executionDriver.d.ts","sourceRoot":"","sources":["../../../src/server/drivers/executionDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,sFAAsF;AACtF,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX;;;OAGG;IACH,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxD,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,eAAO,MAAM,QAAQ,QAA8C,CAAC;AAEpE,eAAO,MAAM,aAAa,QAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CACqD,CAAC;AAEvG,MAAM,WAAW,QAAQ;IACvB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEnE,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,SAAS,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,iGAAiG;AACjG,MAAM,WAAW,OAAQ,SAAQ,UAAU;IACzC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,kEAAkE;IAClE,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,QAAQ,IAAI,SAAS,eAAe,EAAE,CAAC;IACvC,oFAAoF;IACpF,IAAI,IAAI,SAAS,OAAO,EAAE,CAAC;IAC3B,oFAAoF;IACpF,WAAW,IAAI,SAAS,MAAM,EAAE,CAAC;IACjC,kFAAkF;IAClF,KAAK,IAAI,IAAI,CAAC;CACf;AAID,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAC3E,8FAA8F;AAC9F,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AACrD,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAmBzD;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,eAAe,KAAG,SAAS,MAAM,EAIpE,CAAC;AAUL,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,GAAG,IAAI,CAehG;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAiD1F;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAW1F;AAYD,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;CAC9C;AAED,MAAM,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,cAAc,CAAC;AAcvG,MAAM,WAAW,2BAA2B;IAC1C,4EAA4E;IAC5E,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACpD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0EAA0E;IAC1E,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,2BAA2B,GAAG,eAAe,GAAG;IAClG,OAAO,IAAI,IAAI,CAAC;CACjB,CAmIA;AAID,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,EAAE,eAIrC,CAAC;AAEH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACpD,MAAM,EAAE,SAAS,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;CACrC;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,0BAA0B,GAAG,eAAe,CA4E9F"}

package/dist/server/drivers/executionDriver.js

@@ -1,382 +0,0 @@
-/**
- * `ExecutionDriver` (03 §7.1) — whitelisted, tracked, jailed OS execution.
- *
- * The whole point of this module is what it *refuses*: the driver never accepts
- * an argv string. A caller names a `commandId` that must already exist in
- * `cc-manifest.json`'s `commands` table, and named parameters interpolate into
- * fixed template slots only after passing that command's Zod arg schema. There
- * is no shell, no string concatenation, and therefore no place for
- * `; rm -rf ~` to land (ruling H-2).
- *
- * It is also the reason `exec` lives on `DevMixinContext` and nowhere else
- * (J3-4): handing OS execution to a public-facing media or knowledge route is a
- * privilege escalation waiting for a bug, so the type system — not a code
- * review — is what keeps it out of them.
- *
- * Local profile spawns through `Bun.spawn` and registers every child PID in the
- * tracker, with `SIGINT`/`SIGTERM`/`exit` hooks that sweep-kill the whole set.
- * That sweep is why a crashed dev server can no longer leave a zombie squatting
- * the port it claimed.
- */
-import { z } from 'zod';
-import { AppError } from '../errors';
-/**
- * The default value grammar for a command parameter that declares no schema of
- * its own: no shell metacharacters, no newlines, no leading dash (which would
- * let a value masquerade as a flag).
- */
-export const SAFE_ARG = /^[A-Za-z0-9_./:@=+][A-Za-z0-9_./:@=+ -]*$/;
-export const safeArgSchema = () => z.string().min(1).max(4096).regex(SAFE_ARG, 'contains characters not allowed in a command argument');
-/* ------------------------------------------------------------------ errors */
-export const EXEC_COMMAND_NOT_WHITELISTED = 'EXEC_COMMAND_NOT_WHITELISTED';
-/** An argument that failed its declared schema, or a parameter the command never declared. */
-export const EXEC_ARG_REJECTED = 'EXEC_ARG_REJECTED';
-export const EXEC_CWD_ESCAPE = 'EXEC_CWD_ESCAPE';
-export const EXEC_HANDLE_UNKNOWN = 'EXEC_HANDLE_UNKNOWN';
-const notWhitelisted = (commandId, known) => new AppError(`Command '${commandId}' is not declared in cc-manifest.json commands.`, {
-    code: EXEC_COMMAND_NOT_WHITELISTED,
-    status: 400,
-    // Report the SIZE of the whitelist, never its contents: this error rides
-    // to the caller in the response envelope, and enumerating every runnable
-    // command id back to a rejected request is free reconnaissance (§3.2).
-    context: { commandId, whitelistedCount: known.length },
-});
-/* ------------------------------------------------------- argv construction */
-const SLOT_RE = /^\{([a-zA-Z][a-zA-Z0-9_]*)\}$/;
-/**
- * The declared parameter names of a command — the argv slots, in template order.
- * Shared by both drivers so the two whitelists can never describe themselves
- * differently.
- */
-export const commandParams = (command) => command.argv.flatMap((element) => {
-    const match = SLOT_RE.exec(element);
-    return match?.[1] ? [match[1]] : [];
-});
-/** Project a whitelist into the UI vocabulary. One definition, both drivers. */
-const describeCommands = (commands) => Object.values(commands).map((command) => ({
-    id: command.id,
-    params: commandParams(command),
-    ...(command.timeoutMs === undefined ? {} : { timeoutMs: command.timeoutMs }),
-}));
-export const EXEC_COMMAND_UNRUNNABLE = 'EXEC_COMMAND_UNRUNNABLE';
-/**
- * Refuse a whitelist holding a command that could never run (law #3 — boot loud
- * on wiring).
- *
- * `buildArgv` fills a `{slot}` from `argSchema` and from nowhere else: a value
- * for an undeclared parameter is rejected on the way in, and a slot with no
- * value throws `requires parameter`. So an argv slot with no matching
- * `argSchema` entry is a command that returns 400 for EVERY possible call — an
- * authoring mistake that, until this check, stayed invisible until someone
- * clicked Run and got a refusal that read like their own fault.
- *
- * It also makes `commands()` honest: the `pipelines` surface renders one input
- * per argv slot, and a slot nothing can satisfy would be a form that cannot be
- * completed. Found while building that surface (03 §1e).
- */
-export function assertRunnableCommands(commands) {
-    for (const command of Object.values(commands)) {
-        const declared = new Set(Object.keys(command.argSchema ?? {}));
-        const orphans = commandParams(command).filter((param) => !declared.has(param));
-        if (orphans.length === 0)
-            continue;
-        throw new AppError(`Command '${command.id}' interpolates ${orphans.map((p) => `'${p}'`).join(', ')} but declares no argSchema for ${orphans.length === 1 ? 'it' : 'them'}, so every run of it would be refused.`, {
-            code: EXEC_COMMAND_UNRUNNABLE,
-            status: 500,
-            isOperational: false,
-            context: { commandId: command.id, params: orphans },
-        });
-    }
-}
-/**
- * Build the concrete argv from a command template and validated args.
- *
- * A slot is only ever an ENTIRE argv element — `{path}` is substituted, but
- * `--file={path}` is not treated as a slot at all. That restriction is
- * deliberate: partial interpolation is how quoting bugs and argument splitting
- * creep back in. A command that needs `--file=X` declares `['--file', '{path}']`.
- */
-export function buildArgv(command, args) {
-    const schema = command.argSchema ?? {};
-    const declared = new Set(Object.keys(schema));
-    for (const key of Object.keys(args)) {
-        if (!declared.has(key))
-            throw new AppError(`Command '${command.id}' does not declare a parameter '${key}'.`, {
-                code: EXEC_ARG_REJECTED,
-                status: 400,
-                context: { commandId: command.id, param: key, declared: [...declared] },
-            });
-    }
-    // Validate every declared param BEFORE any interpolation, so a rejected value
-    // never reaches a partially-built argv.
-    const validated = {};
-    for (const [name, valueSchema] of Object.entries(schema)) {
-        const raw = args[name];
-        if (raw === undefined)
-            continue;
-        const parsed = valueSchema.safeParse(raw);
-        if (!parsed.success)
-            throw new AppError(`Parameter '${name}' of command '${command.id}' failed its argument schema.`, {
-                code: EXEC_ARG_REJECTED,
-                status: 400,
-                context: {
-                    commandId: command.id,
-                    param: name,
-                    issues: parsed.error.issues.map((i) => i.message),
-                },
-            });
-        validated[name] = parsed.data;
-    }
-    return command.argv.map((element) => {
-        const slot = SLOT_RE.exec(element);
-        if (!slot)
-            return element; // literal — never touched
-        const name = slot[1];
-        const value = validated[name];
-        if (value === undefined)
-            throw new AppError(`Command '${command.id}' requires parameter '${name}'.`, {
-                code: EXEC_ARG_REJECTED,
-                status: 400,
-                context: { commandId: command.id, param: name },
-            });
-        return value;
-    });
-}
-/**
- * Resolve a task's cwd, refusing anything outside the command's declared root.
- * Compared on normalized, separator-terminated prefixes so `/srv/app-evil` can
- * never pass as a child of `/srv/app`.
- */
-export function resolveCwd(command, requested) {
-    const root = command.cwdRoot.replace(/\/+$/, '');
-    if (requested === undefined)
-        return root;
-    const normalized = requested.replace(/\/+$/, '');
-    if (normalized !== root && !normalized.startsWith(`${root}/`))
-        throw new AppError(`cwd '${requested}' escapes command root '${command.cwdRoot}'.`, {
-            code: EXEC_CWD_ESCAPE,
-            status: 400,
-            context: { commandId: command.id, cwd: requested, cwdRoot: command.cwdRoot },
-        });
-    return normalized;
-}
-const bunSpawn = (argv, options) => {
-    if (typeof Bun === 'undefined')
-        throw new AppError('The local ExecutionDriver requires the Bun runtime.', {
-            code: 'EXEC_RUNTIME_UNAVAILABLE',
-            status: 500,
-        });
-    // `cmd` is an argv ARRAY — there is no shell between us and the executable,
-    // which is what makes the whitelist meaningful rather than decorative.
-    const child = Bun.spawn({ cmd: argv, cwd: options.cwd, stdout: 'pipe', stderr: 'pipe' });
-    return { pid: child.pid, exited: child.exited, kill: (signal) => child.kill(signal) };
-};
-/**
- * Local profile driver: `Bun.spawn` + the process tracker.
- *
- * Every child is registered before its first tick and deregistered only when it
- * actually exits, so the sweep set is always a superset of what is alive. The
- * signal hooks are registered once per driver and removed by `dispose()`.
- */
-export function createLocalExecutionDriver(options) {
-    assertRunnableCommands(options.commands);
-    const spawn = options.spawn ?? bunSpawn;
-    const children = new Map();
-    let sequence = 0;
-    const sweep = () => {
-        for (const child of children.values()) {
-            if (child.state !== 'running')
-                continue;
-            try {
-                child.kill();
-            }
-            catch {
-                // A child that died between the check and the kill is the success case.
-            }
-            child.state = 'killed';
-            child.endedAt = Date.now();
-        }
-    };
-    const hooks = [];
-    if (options.installSignalHooks !== false && typeof process !== 'undefined') {
-        for (const signal of ['SIGINT', 'SIGTERM', 'exit']) {
-            const handler = () => sweep();
-            hooks.push([signal, handler]);
-            process.on(signal, handler);
-        }
-    }
-    const resolveCommand = (commandId) => {
-        const command = options.commands[commandId];
-        if (!command)
-            throw notWhitelisted(commandId, Object.keys(options.commands));
-        return command;
-    };
-    return {
-        async run(task) {
-            const command = resolveCommand(task.commandId);
-            const argv = buildArgv(command, task.args);
-            const cwd = resolveCwd(command, task.cwd);
-            const process_ = spawn(argv, { cwd, timeoutMs: command.timeoutMs });
-            sequence += 1;
-            const handle = {
-                handleId: `exec_${sequence}_${process_.pid}`,
-                commandId: command.id,
-                pid: process_.pid,
-                startedAt: Date.now(),
-            };
-            const tracked = {
-                handle,
-                state: 'running',
-                exitCode: null,
-                endedAt: null,
-                kill: () => process_.kill(),
-            };
-            children.set(handle.handleId, tracked);
-            void process_.exited.then((code) => {
-                if (tracked.state === 'running')
-                    tracked.state = code === 0 ? 'exited' : 'failed';
-                tracked.exitCode = code;
-                tracked.endedAt ??= Date.now();
-            }, () => {
-                tracked.state = 'failed';
-                tracked.endedAt ??= Date.now();
-            });
-            return handle;
-        },
-        async kill(handleId) {
-            const child = children.get(handleId);
-            if (!child)
-                throw new AppError(`No execution handle '${handleId}'.`, {
-                    code: EXEC_HANDLE_UNKNOWN,
-                    status: 404,
-                    context: { handleId },
-                });
-            if (child.state !== 'running')
-                return; // idempotent
-            child.kill();
-            child.state = 'killed';
-            child.endedAt = Date.now();
-        },
-        async status(handleId) {
-            const child = children.get(handleId);
-            if (!child)
-                throw new AppError(`No execution handle '${handleId}'.`, {
-                    code: EXEC_HANDLE_UNKNOWN,
-                    status: 404,
-                    context: { handleId },
-                });
-            return {
-                handleId,
-                state: child.state,
-                exitCode: child.exitCode,
-                startedAt: child.handle.startedAt,
-                endedAt: child.endedAt,
-            };
-        },
-        commands: () => describeCommands(options.commands),
-        // Newest first: a run log is read from the top, and the tracker is insertion
-        // ordered by `startedAt` already.
-        runs: () => [...children.values()]
-            .map((child) => ({
-            handleId: child.handle.handleId,
-            commandId: child.handle.commandId,
-            state: child.state,
-            exitCode: child.exitCode,
-            startedAt: child.handle.startedAt,
-            endedAt: child.endedAt,
-        }))
-            .reverse(),
-        trackedPids: () => [...children.values()].filter((c) => c.state === 'running').map((c) => c.handle.pid),
-        sweep,
-        dispose() {
-            sweep();
-            if (typeof process !== 'undefined')
-                for (const [signal, handler] of hooks.splice(0))
-                    process.off(signal, handler);
-        },
-    };
-}
-/** Hard ceilings per command class (03 §7.1) — a runaway job cannot eat a node. */
-export const DEFAULT_SANDBOX_CEILINGS = Object.freeze({
-    memoryMb: 512,
-    vcpu: 2,
-    wallClockMs: 15 * 60 * 1000,
-});
-/**
- * SaaS profile driver: the same whitelist check, then dispatch through the
- * JobBroker into a non-privileged sandboxed worker (gVisor-class isolation) with
- * hard ceilings. No child process is ever spawned in the API process, so
- * `trackedPids` is legitimately empty here — the sweep contract belongs to the
- * worker tier.
- */
-export function createSaasExecutionDriver(options) {
-    assertRunnableCommands(options.commands);
-    const ceilings = { ...DEFAULT_SANDBOX_CEILINGS, ...options.ceilings };
-    const dispatched = new Map();
-    const resolveCommand = (commandId) => {
-        const command = options.commands[commandId];
-        if (!command)
-            throw notWhitelisted(commandId, Object.keys(options.commands));
-        return command;
-    };
-    return {
-        async run(task) {
-            const command = resolveCommand(task.commandId);
-            const argv = buildArgv(command, task.args);
-            const cwd = resolveCwd(command, task.cwd);
-            const jobId = await options.broker.enqueue({
-                kind: 'exec',
-                tenantId: task.tenantId,
-                instanceId: task.instanceId,
-                payload: { argv, cwd, ceilings, commandId: command.id },
-            });
-            const handle = { handleId: jobId, commandId: command.id, pid: -1, startedAt: Date.now() };
-            dispatched.set(jobId, {
-                handleId: jobId,
-                commandId: command.id,
-                state: 'running',
-                exitCode: null,
-                startedAt: handle.startedAt,
-                endedAt: null,
-            });
-            options.broker.onComplete(jobId, (result) => {
-                dispatched.set(jobId, {
-                    handleId: jobId,
-                    commandId: command.id,
-                    state: result.ok ? 'exited' : 'failed',
-                    exitCode: result.ok ? 0 : 1,
-                    startedAt: handle.startedAt,
-                    endedAt: Date.now(),
-                });
-            });
-            return handle;
-        },
-        async kill(handleId) {
-            await options.broker.cancel(handleId);
-            const current = dispatched.get(handleId);
-            if (current)
-                dispatched.set(handleId, { ...current, state: 'killed', endedAt: Date.now() });
-        },
-        async status(handleId) {
-            const status = dispatched.get(handleId);
-            if (!status)
-                throw new AppError(`No execution handle '${handleId}'.`, {
-                    code: EXEC_HANDLE_UNKNOWN,
-                    status: 404,
-                    context: { handleId },
-                });
-            return status;
-        },
-        commands: () => describeCommands(options.commands),
-        // Newest first, same contract as local. The run log is the API node's own
-        // dispatch record — a run this node never dispatched is the worker tier's,
-        // and reading it belongs to the `orchestration` surface (the job store),
-        // which is a different question than "what did I start".
-        runs: () => [...dispatched.values()].reverse(),
-        trackedPids: () => [],
-        sweep: () => {
-            // Sandboxed workers own their own process lifetime; there is nothing local to sweep.
-        },
-    };
-}
-//# sourceMappingURL=executionDriver.js.map

package/dist/server/drivers/executionDriver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"executionDriver.js","sourceRoot":"","sources":["../../../src/server/drivers/executionDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AA6BrC;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,2CAA2C,CAAC;AAEpE,MAAM,CAAC,MAAM,aAAa,GAAG,GAAsB,EAAE,CACnD,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,uDAAuD,CAAC,CAAC;AAgFvG,+EAA+E;AAE/E,MAAM,CAAC,MAAM,4BAA4B,GAAG,8BAA8B,CAAC;AAC3E,8FAA8F;AAC9F,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AACrD,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AACjD,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAE,KAAwB,EAAY,EAAE,CAC/E,IAAI,QAAQ,CACV,YAAY,SAAS,iDAAiD,EACtE;IACE,IAAI,EAAE,4BAA4B;IAClC,MAAM,EAAE,GAAG;IACX,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,OAAO,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,CAAC,MAAM,EAAE;CACvD,CACF,CAAC;AAEJ,+EAA+E;AAE/E,MAAM,OAAO,GAAG,+BAA+B,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAwB,EAAqB,EAAE,CAC3E,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtC,CAAC,CAAC,CAAC;AAEL,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,CAAC,QAAmD,EAA8B,EAAE,CAC3G,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxC,EAAE,EAAE,OAAO,CAAC,EAAE;IACd,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC;IAC9B,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;CAC7E,CAAC,CAAC,CAAC;AAEN,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAEjE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAmD;IACxF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,MAAM,IAAI,QAAQ,CAChB,YAAY,OAAO,CAAC,EAAE,kBAAkB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,wCAAwC,EAC7L;YACE,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,GAAG;YACX,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;SACpD,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,OAAwB,EAAE,IAA4B;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YACpB,MAAM,IAAI,QAAQ,CAAC,YAAY,OAAO,CAAC,EAAE,mCAAmC,GAAG,IAAI,EAAE;gBACnF,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE;aACxE,CAAC,CAAC;IACP,CAAC;IAED,8EAA8E;IAC9E,wCAAwC;IACxC,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS;QAChC,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,OAAO;YACjB,MAAM,IAAI,QAAQ,CAChB,cAAc,IAAI,iBAAiB,OAAO,CAAC,EAAE,+BAA+B,EAC5E;gBACE,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,SAAS,EAAE,OAAO,CAAC,EAAE;oBACrB,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;iBAClD;aACF,CACF,CAAC;QACJ,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;IAChC,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO,OAAO,CAAC,CAAC,0BAA0B;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,KAAK,KAAK,SAAS;YACrB,MAAM,IAAI,QAAQ,CAAC,YAAY,OAAO,CAAC,EAAE,yBAAyB,IAAI,IAAI,EAAE;gBAC1E,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;aAChD,CAAC,CAAC;QACL,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAAwB,EAAE,SAA6B;IAChF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,UAAU,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC;QAC3D,MAAM,IAAI,QAAQ,CAAC,QAAQ,SAAS,2BAA2B,OAAO,CAAC,OAAO,IAAI,EAAE;YAClF,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;SAC7E,CAAC,CAAC;IACL,OAAO,UAAU,CAAC;AACpB,CAAC;AAqBD,MAAM,QAAQ,GAAY,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAC1C,IAAI,OAAO,GAAG,KAAK,WAAW;QAC5B,MAAM,IAAI,QAAQ,CAAC,qDAAqD,EAAE;YACxE,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACzF,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;AACxF,CAAC,CAAC;AAUF;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAoC;IAG7E,sBAAsB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IACjD,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,SAAS;YACxC,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,CAAC;YAAC,MAAM,CAAC;gBACP,wEAAwE;YAC1E,CAAC;YACD,KAAK,CAAC,KAAK,GAAG,QAAQ,CAAC;YACvB,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAiD,EAAE,CAAC;IAC/D,IAAI,OAAO,CAAC,kBAAkB,KAAK,KAAK,IAAI,OAAO,OAAO,KAAK,WAAW,EAAE,CAAC;QAC3E,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAU,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9B,OAAO,CAAC,EAAE,CAAC,MAAwB,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAmB,EAAE;QAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO;YAAE,MAAM,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7E,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAc;YACtB,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAE1C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;YACpE,QAAQ,IAAI,CAAC,CAAC;YACd,MAAM,MAAM,GAAe;gBACzB,QAAQ,EAAE,QAAQ,QAAQ,IAAI,QAAQ,CAAC,GAAG,EAAE;gBAC5C,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC;YAEF,MAAM,OAAO,GAAiB;gBAC5B,MAAM;gBACN,KAAK,EAAE,SAAS;gBAChB,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE;aAC5B,CAAC;YACF,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAEvC,KAAK,QAAQ,CAAC,MAAM,CAAC,IAAI,CACvB,CAAC,IAAI,EAAE,EAAE;gBACP,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;oBAAE,OAAO,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAClF,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACxB,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACjC,CAAC,EACD,GAAG,EAAE;gBACH,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC;gBACzB,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACjC,CAAC,CACF,CAAC;YAEF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,QAAgB;YACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBACR,MAAM,IAAI,QAAQ,CAAC,wBAAwB,QAAQ,IAAI,EAAE;oBACvD,IAAI,EAAE,mBAAmB;oBACzB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,QAAQ,EAAE;iBACtB,CAAC,CAAC;YACL,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,CAAC,aAAa;YACpD,KAAK,CAAC,IAAI,EAAE,CAAC;YACb,KAAK,CAAC,KAAK,GAAG,QAAQ,CAAC;YACvB,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,QAAgB;YAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBACR,MAAM,IAAI,QAAQ,CAAC,wBAAwB,QAAQ,IAAI,EAAE;oBACvD,IAAI,EAAE,mBAAmB;oBACzB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,QAAQ,EAAE;iBACtB,CAAC,CAAC;YACL,OAAO;gBACL,QAAQ;gBACR,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;gBACjC,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC;QACJ,CAAC;QAED,QAAQ,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC;QAElD,6EAA6E;QAC7E,kCAAkC;QAClC,IAAI,EAAE,GAAG,EAAE,CACT,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;aACnB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACf,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;YAC/B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;YACjC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;YACjC,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;aACF,OAAO,EAAE;QAEd,WAAW,EAAE,GAAG,EAAE,CAChB,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAEtF,KAAK;QAEL,OAAO;YACL,KAAK,EAAE,CAAC;YACR,IAAI,OAAO,OAAO,KAAK,WAAW;gBAChC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;oBAAE,OAAO,CAAC,GAAG,CAAC,MAAwB,EAAE,OAAO,CAAC,CAAC;QACpG,CAAC;KACF,CAAC;AACJ,CAAC;AAUD,mFAAmF;AACnF,MAAM,CAAC,MAAM,wBAAwB,GAAoB,MAAM,CAAC,MAAM,CAAC;IACrE,QAAQ,EAAE,GAAG;IACb,IAAI,EAAE,CAAC;IACP,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC5B,CAAC,CAAC;AAQH;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAmC;IAC3E,sBAAsB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAoB,EAAE,GAAG,wBAAwB,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IACvF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmB,CAAC;IAE9C,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAmB,EAAE;QAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO;YAAE,MAAM,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7E,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAc;YACtB,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAE1C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;gBACzC,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE;aACxD,CAAC,CAAC;YAEH,MAAM,MAAM,GAAe,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtG,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE;gBACpB,QAAQ,EAAE,KAAK;gBACf,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,KAAK,EAAE,SAAS;gBAChB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;gBAC1C,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE;oBACpB,QAAQ,EAAE,KAAK;oBACf,SAAS,EAAE,OAAO,CAAC,EAAE;oBACrB,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;oBACtC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;iBACpB,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,QAAgB;YACzB,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,OAAO;gBAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC9F,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,QAAgB;YAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM;gBACT,MAAM,IAAI,QAAQ,CAAC,wBAAwB,QAAQ,IAAI,EAAE;oBACvD,IAAI,EAAE,mBAAmB;oBACzB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,QAAQ,EAAE;iBACtB,CAAC,CAAC;YACL,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,QAAQ,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC;QAElD,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,yDAAyD;QACzD,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;QAE9C,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE;QACrB,KAAK,EAAE,GAAG,EAAE;YACV,qFAAqF;QACvF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/drivers/index.d.ts

@@ -1,21 +0,0 @@
-/**
- * Execution & cognition drivers (03 §7) — the profile-switchable server seams
- * the engine mixins are handed, never construct.
- *
- * `ExecutionDriver` is deliberately absent from the general `MixinContext` and
- * present only on `DevMixinContext` (J3-4): OS execution is a DevStudio power,
- * and the type system is what keeps it out of a public-facing media route.
- */
-export { assertRunnableCommands, buildArgv, commandParams, createLocalExecutionDriver, createSaasExecutionDriver, DEFAULT_SANDBOX_CEILINGS, EXEC_ARG_REJECTED, EXEC_COMMAND_NOT_WHITELISTED, EXEC_COMMAND_UNRUNNABLE, EXEC_CWD_ESCAPE, EXEC_HANDLE_UNKNOWN, type ExecHandle, type ExecRun, type ExecState, type ExecStatus, type ExecTask, type ExecutionDriver, type LocalExecutionDriverOptions, type ManifestCommand, type PipelineCommand, resolveCwd, SAFE_ARG, safeArgSchema, type SaasExecutionDriverOptions, type SandboxCeilings, type SpawnFn, type SpawnedProcess, } from './executionDriver';
-export { AI_CAPABILITY_UNSUPPORTED, AI_DRIVER_UNAVAILABLE, AI_SCHEMA_VIOLATION, type AudioReq, type CognitiveDriver, type CognitiveGateway, type CognitiveGatewayOptions, type CognitiveProvider, createCognitiveGateway, DATA_BLOCK_PREAMBLE, type EmbedReq, type ImageReq, type ImageRes, type ModelConfig, type ProviderRequest, type ProviderResponse, renderUserDataBlocks, type StructuredReq, type TextReq, type TextRes, type TranscriptRes, } from './cognitiveGateway';
-export { ANTHROPIC_DEFAULT_ENDPOINT, ANTHROPIC_STRUCTURED_TOOL, ANTHROPIC_VERSION, type AnthropicDriverOptions, AUDIO_OBJECT_MISSING, AI_PROVIDER_HTTP, AI_PROVIDER_MALFORMED, attachTokens, buildOllamaMessages, type BuildWorkflowInput, COMFYUI_DEFAULT_ENDPOINT, type ComfyWorkflow, type ComfyuiDriverOptions, createAnthropicDriver, createComfyuiDriver, createOllamaDriver, createOpenAiDriver, createOpenclawDriver, createProviderDriver, defaultTextToImageWorkflow, type DriverFactoryDeps, type DriverTransportOptions, type FetchLike, OLLAMA_DEFAULT_ENDPOINT, type OllamaDriverOptions, OPENAI_DEFAULT_ENDPOINT, OPENAI_JSON_DIRECTIVE, type OpenAiDriverOptions, OPENCLAW_DEFAULT_ENDPOINT, type OpenclawDriverOptions, PROVIDER_DEFAULT_ENDPOINT, type ProviderCredentials, providerHttpError, readUsage, trimEndpoint, withDeadline, } from './providers';
-export { createLocalJobBroker, type JobBroker, type JobHandler, type JobHandlerContext, type JobId, type JobResult, type JobSpec, type LocalJobBroker, type LocalJobBrokerOptions, requeueStalledJobs, } from './jobBroker';
-export { type AwaitCompletionOptions, awaitRecordedCompletion, createMemoryJobResultStore, createSqliteJobResultStore, createStatementJobResultStore, JOB_RESULT_PAGE, JOB_RESULTS_DDL, JOB_RESULTS_INDEX, JOB_RESULTS_TABLE, type JobResultQuery, type JobResultStore, recordWorkerResult, type RecordedJobResult, UNSCOPED_TENANT, } from './jobResults';
-export { createSaasJobBroker, type LeaseControl, type LeasedJob, type LeaseOptions, type LeaseProcessor, type SaasJobBroker, type SaasJobBrokerOptions, type SaasQueueBackend, type SaasQueuePayload, } from './saasJobBroker';
-export { JOB_HANDLER_UNREGISTERED, runSaasJobWorker, type SaasJobWorker, type SaasJobWorkerOptions, } from './saasJobWorker';
-export { type BullmqAdapterDeps, type BullmqJobLike, type BullmqQueueEventsLike, type BullmqQueueLike, type BullmqWorkerLike, createBullmqQueueAdapter, } from './bullmqQueueAdapter';
-export { createPgJobResultStore, createPooledControlExecutor, createPgRevocationStore, ensureSaasControlPlaneSchema, REVOCATIONS_DDL, REVOCATIONS_INDEX, REVOCATIONS_TABLE, SAAS_CONTROL_PLANE_DDL, } from './pooledControlStores';
-export { assertRetainDays, describeRetentionWindow, ensureRetentionPolicySchema, readRetentionPolicy, RETENTION_MAX_DAYS, RETENTION_MIN_DAYS, RETENTION_OFF, RETENTION_POLICY_DDL, RETENTION_POLICY_DEFAULTS, RETENTION_POLICY_TABLE, RETENTION_RECOMMENDED_METER_DAYS, RETENTION_SUBJECTS, setRetentionWindow, type RetentionSubject, type RetentionWindow, type RetentionWindows, } from './retentionPolicy';
-export { assertSiteCopyWrite, clearSiteCopyValue, ensureSiteCopySchema, platformAdminTenant, readSiteCopyEntries, readSiteCopyOverrides, setPlatformAdminTenant, setSiteCopyValue, SITE_COPY_DDL, SITE_COPY_TABLE, type SiteCopyEntry, } from './siteCopy';
-export { createPgIdentityStore, ensureSaasIdentitySchema, SAAS_IDENTITY_DDL } from './pooledIdentityStore';
-//# sourceMappingURL=index.d.ts.map