orizu 0.5.19 → 0.5.21

package/dist/hosted-runtime-assets.d.ts

@@ -0,0 +1,186 @@
+/**
+ * In-sandbox runtime assets for the hosted bootstrap (ALI-925, per ADR-005).
+ *
+ * Ports the DESIGN — not the code — of OpenInspect's
+ * `sandbox_runtime/credentials/git_credential_helper.py` into a self-contained
+ * script asset that Orizu writes into the sandbox and registers as a git
+ * `credential.helper`. On every git op git spawns the script; the script mints a
+ * fresh, downscoped, audited token from Orizu's per-repo broker
+ * (`POST /api/cli/workspaces/{id}/repo-token`) and hands it to git, caching to a
+ * 0600 run-scoped file with an expiry-refresh buffer. It NEVER echoes the token
+ * and reads the bearer only from a run-scoped 0600 file (G3): the bearer is
+ * never baked into git config, the clone URL, or any long-lived file.
+ *
+ * Deliberately self-contained (no `orizu` package import) so it works even when
+ * the CLI-install step fails — the credential path must not depend on it. The
+ * script is emitted as CommonJS (`.cjs`) so it runs unchanged under both `node`
+ * (>=18, for global `fetch`) and `bun`, whichever the sandbox image ships.
+ *
+ * The boot context is split so no secret lands in a value git persists:
+ *   - `boot.json`  — non-secret config + the PATHS of the bearer/cache files;
+ *   - `<bearer>`   — the Orizu bearer, 0600, run-scoped, reaped at teardown;
+ *   - `<cache>`    — the minted repo token, 0600, written by the script itself.
+ * git config holds only `credential.helper = !<runtime> <script> <boot.json>`.
+ */
+export declare const HELPER_SCRIPT_BASENAME = "orizu-git-credential-helper.cjs";
+export declare const BOOT_CONTEXT_BASENAME = "boot.json";
+export declare const BEARER_BASENAME = "bearer";
+export declare const REPO_CRED_CACHE_BASENAME = "repo-cred.json";
+/** Refresh a cached token this long before its stated expiry (5 minutes). */
+export declare const DEFAULT_CACHE_REFRESH_BUFFER_MS: number;
+/** Customer setup hook path, relative to the repo root (mirrors OpenInspect's
+ *  `.openinspect/setup.sh` — fresh-boot only, non-fatal, output captured). */
+export declare const SETUP_HOOK_RELATIVE_PATH = ".orizu/setup.sh";
+/**
+ * The git author identity for hosted-agent commits. Bootstrap configures it
+ * repo-LOCAL in the sandbox clone (never --global) so agent `git commit` works
+ * out of the box — the sandbox has no ambient identity and commits died with
+ * "Author identity unknown" (ALI-1036, found live in QA-3). The loop uses the
+ * same identity for run-event attribution; keep them identical.
+ */
+export declare const AGENT_GIT_IDENTITY: {
+    readonly name: "Orizu Agent";
+    readonly email: "agent@orizu.ai";
+};
+/**
+ * Standing preamble wrapped around every hosted task prompt so a NATURAL task
+ * ("review X and update the readme") runs unattended with zero magic words. The
+ * agent is told to work autonomously (never block on the human), commit as it
+ * goes, and treat Orizu — not the repo — as the home for production pointers and
+ * run metadata. An end-of-run auto-harvest (ALI-1036, `harvestWorkspace`) is the
+ * safety net for anything left uncommitted; the preamble names it so the agent
+ * knows partial work is preserved.
+ */
+export declare const HOSTED_TASK_PREAMBLE: string;
+/** Delimiter separating the standing preamble from the verbatim user task. */
+export declare const HOSTED_TASK_DELIMITER = "--- YOUR TASK ---";
+/**
+ * Compose the full hosted prompt: the standing preamble, a clear delimiter, then
+ * the user's task VERBATIM beneath it. Passing an empty preamble yields the task
+ * unchanged (an explicit opt-out for tests / callers that scaffold elsewhere).
+ */
+export declare function composeHostedTaskPrompt(task: string, preamble?: string): string;
+/**
+ * Absolute path of the marker the pre-baked hosted-runtime image writes at build
+ * time (see packages/cli/hosted-runtime-image/Dockerfile). Its presence — plus
+ * the boot-context `prebaked` flag — tells the runtime the CLI + OpenCode are
+ * already on PATH, so the from-scratch install steps must be SKIPPED (they would
+ * otherwise fail under G5 default-deny egress).
+ */
+export declare const PREBAKED_MARKER_PATH = "/opt/orizu/prebaked.json";
+/**
+ * The schema of `/opt/orizu/prebaked.json`. Records the exact versions baked into
+ * the image so a run (and audit) can tell WHICH runtime it booted on. `builtFor`
+ * is a constant guard so a stray same-named file from another toolchain is not
+ * mistaken for our marker.
+ */
+export interface PrebakedMarker {
+    cliVersion: string;
+    opencodeVersion: string;
+    claudeSdkVersion: string;
+    /**
+     * Braintrust eval tooling pins (ALI-1048) — OPTIONAL because pre-ALI-1048
+     * markers do not carry them (older snapshots stay valid). Py = the PyPI
+     * `braintrust` package (Highlight's python eval harness), Npm = the npm
+     * `braintrust` package (TS SDK + `bt` CLI).
+     */
+    braintrustPyVersion?: string;
+    braintrustNpmVersion?: string;
+    builtFor: 'vercel-sandbox';
+}
+/**
+ * Parse + validate a pre-baked marker file's contents. Returns the typed marker
+ * when the JSON is well-formed AND carries the expected `builtFor` guard with
+ * string version fields; returns null otherwise (missing file → caller passes an
+ * empty/whitespace string; malformed JSON; wrong shape). Never throws, so a
+ * belt-and-braces filesystem probe can call it on best-effort file reads.
+ */
+export declare function parsePrebakedMarker(raw: string): PrebakedMarker | null;
+/**
+ * The non-secret boot context the helper script reads. Paths are ABSOLUTE so
+ * the helper resolves them regardless of git's cwd at invocation time.
+ */
+export interface HostedBootContext {
+    apiBaseUrl: string;
+    workspaceId: string;
+    sessionId: string;
+    runId: string;
+    sessionBranch: string;
+    repoFullName: string;
+    /** VCS host the helper will serve credentials for (default github.com). */
+    host: string;
+    /** Absolute path to the 0600 file holding the Orizu bearer. */
+    bearerFile: string;
+    /** Absolute path to the 0600 minted-token cache the script maintains. */
+    cacheFile: string;
+    /**
+     * PULL MODE (ALI-1057, DO-path hosted agent): the coordinator agent-token URL.
+     * When SET, the helper GETs a FRESH short-lived Orizu bearer here per mint —
+     * `Authorization: Bearer <boot secret read from bootSecretFile>` — instead of
+     * reading the host-written 0600 `bearerFile`. Everything downstream (POST the
+     * repo-token broker with that bearer → serve the GitHub x-access-token to git)
+     * is byte-identical to the operator/file path. When UNSET the helper stays in
+     * file mode and reads `bearerFile` exactly as before. This is the ONLY DO-path
+     * difference: the bearer SOURCE is HTTP, not a 0600 file.
+     */
+    agentTokenUrl?: string;
+    /**
+     * PULL MODE: absolute path to the 0600 file holding the durable BOOT SECRET —
+     * the sandbox's bootstrap identity, used to authenticate the agent-token GET.
+     * Required when `agentTokenUrl` is set; ignored in file mode.
+     */
+    bootSecretFile?: string;
+    /**
+     * Broker purpose vocabulary, INJECTABLE so a later slice can flip the whole
+     * script from write/read to session_write/session_read without editing it. The
+     * helper POSTs `primary` first and falls back to `fallback` ONLY on a 403
+     * (unauthorized-for-primary). A 400 is treated as vocabulary drift and fails
+     * loudly — it means the broker does not recognise the requested purpose.
+     */
+    tokenPurposes: {
+        primary: string;
+        fallback: string;
+    };
+    /**
+     * Hosts (lowercased) for which the helper may serve credentials over plain
+     * HTTP instead of HTTPS. Production leaves this UNSET → https-only. The
+     * local-sim rehearsal sets it to the loopback git server's host so the
+     * clone-through-helper path can be proven without TLS. Secure by default.
+     */
+    insecureHttpHosts?: readonly string[];
+    /** Refresh buffer in ms (overridable so tests can force a refresh). */
+    cacheBufferMs: number;
+}
+export declare function serializeBootContext(ctx: HostedBootContext): string;
+/**
+ * The opaque git-password rule, as a pattern SOURCE string.
+ *
+ * ALI-1285: the Artifacts contract declares the credential opaque
+ * (`plaintext: string`), so only transport-usable shape is enforced — bounded,
+ * no whitespace, no control characters, at least 16 characters. Mirrors
+ * `workers/artifacts-runtime/contracts.ts` GIT_PASSWORD.
+ *
+ * It is kept as a SOURCE STRING, not a regex literal, because the rendered
+ * credential helper must embed the identical rule. A regex literal written
+ * inline in the renderer's template has its escapes consumed by the OUTER
+ * template literal before emission, which silently produced
+ * `[^s<NUL>-<US><DEL>]` — rejecting every credential containing `s` while
+ * accepting spaces and NBSP. Emitting via `JSON.stringify` of this constant
+ * makes the two layers provably identical, and
+ * `test/cli/hosted-credential-helper.test.ts` asserts that at the RENDERED
+ * layer by executing the emitted validator.
+ */
+export declare const HOSTED_OPAQUE_GIT_PASSWORD_SOURCE = "^[^\\s\\u0000-\\u001f\\u007f]{16,1024}$";
+export declare const HOSTED_OPAQUE_GIT_PASSWORD: RegExp;
+/**
+ * The git credential-helper script, as a self-contained CommonJS source string.
+ * Implements the `get` action (mint/emit); `store`/`erase` are no-ops because
+ * the broker owns credential truth and the script never persists what git hands
+ * back. Diagnostics go to stderr only — stdout is reserved for git's protocol.
+ *
+ * NOTE: this is a rendered ARTIFACT, exercised end-to-end as a subprocess in
+ * `test/cli/hosted-credential-helper.test.ts`; that subprocess test is the
+ * source of truth for its behavior.
+ */
+export declare function renderCredentialHelperScript(): string;
+//# sourceMappingURL=hosted-runtime-assets.d.ts.map

package/dist/hosted-runtime-assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-runtime-assets.d.ts","sourceRoot":"","sources":["../src/hosted-runtime-assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,eAAO,MAAM,sBAAsB,oCAAoC,CAAA;AACvE,eAAO,MAAM,qBAAqB,cAAc,CAAA;AAChD,eAAO,MAAM,eAAe,WAAW,CAAA;AACvC,eAAO,MAAM,wBAAwB,mBAAmB,CAAA;AAExD,6EAA6E;AAC7E,eAAO,MAAM,+BAA+B,QAAgB,CAAA;AAE5D;8EAC8E;AAC9E,eAAO,MAAM,wBAAwB,oBAAoB,CAAA;AAEzD;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB;;;CAA4D,CAAA;AAI3F;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,QAK6C,CAAA;AAE9E,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,sBAAsB,CAAA;AAExD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA6B,GAAG,MAAM,CAGrG;AAID;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,6BAA6B,CAAA;AAE9D;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,EAAE,gBAAgB,CAAA;CAC3B;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAwBtE;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAA;IACZ,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,aAAa,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IACpD;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,uEAAuE;IACvE,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAEnE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iCAAiC,4CACH,CAAA;AAE3C,eAAO,MAAM,0BAA0B,QAEtC,CAAA;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,IAAI,MAAM,CAsQrD"}

package/dist/hosted-session-cli.d.ts

@@ -0,0 +1,258 @@
+/**
+ * `orizu session start --hosted` — host-side driver for a CLI-triggered hosted
+ * agent session (ALI-928 / P3.5, per ADR-005). Also the thin dispatch home for
+ * the in-sandbox `orizu internal hosted-loop` (delegated to `hosted-loop.ts`).
+ *
+ * A human runs this with their NORMAL login. `startHostedSession` then:
+ *   (a) opens a workspace session (its own session branch is cut server-side);
+ *   (b) mints a session-scoped AGENT token (the sandbox's Orizu bearer);
+ *   (c) starts a workbench run WITH THE AGENT BEARER (actor_type='agent');
+ *   (d) creates the sandbox via a SandboxProvider (timeout from --duration,
+ *       default 60m, cap 24h — never Vercel's 5m default);
+ *   (e) bootstraps the sandbox (agent bearer in a 0600 file; broker purposes
+ *       session_write/session_read chosen from bearerKind='agent');
+ *   (f) launches the hosted-loop DETACHED so the CLI can exit;
+ *   (g) READINESS-GATES on the loop's first event (bounded); on failure it
+ *       destroys the sandbox + exits non-zero. Detached mode then prints when the
+ *       sandbox self-terminates (it lives to --duration; session-end reaping is
+ *       G6/ALI-1007). Attached (--tail) mode rotates + keeps the box alive +
+ *       streams the tail, and REAPS the sandbox when the run terminates.
+ *
+ * TOKEN TTL vs LONG SESSIONS (decided): while attached (--tail), the CLI
+ * re-mints the agent token before expiry (default 55m) and ATOMICALLY overwrites
+ * the 0600 bearer file (temp + mv). Rotation keeps BOTH git ops and event
+ * recording alive: the in-sandbox credential helper reads the bearer per-op, AND
+ * the loop's RunEventSink resolves it per request (bearer PROVIDER + a one-shot
+ * re-resolve-and-retry on 401/403). Each rotation also extendTimeout()s the
+ * sandbox by the rotation interval (bounded by the 24h cap). A failed mint
+ * fast-retries (60s) and gives up loudly before expiry. If the host disconnects,
+ * tokens expire within the TTL (≤60m) and the loop finishes 'failed' cleanly; the
+ * sandbox timeout is independent (configurable to 24h). Documented in the
+ * secrets-policy doc §8 + the command help.
+ *
+ * Everything the command needs (provider, fetch, repo resolution, loop launch)
+ * is injectable, so the whole flow runs in-process against fakes in the
+ * local-sim end-to-end test.
+ */
+import { type SandboxEgressPolicy, type SandboxProvider, type SandboxSession } from './sandbox-provider.js';
+import { type HostedFetch, type HostedRuntimePaths } from './hosted-bootstrap.js';
+import { DEFAULT_HOSTED_MODEL, type HostedLoopContext } from './hosted-loop.js';
+import { type StartIntentIdGenerator } from './start-intent.js';
+export { DEFAULT_HOSTED_MODEL };
+export declare const DEFAULT_DURATION_MINUTES = 60;
+export declare const MAX_DURATION_MINUTES: number;
+export declare const DEFAULT_ROTATION_INTERVAL_MS: number;
+/** After a mint failure, retry the rotation on this short interval (not the full
+ *  55m) so a transient outage does not silently ride the token to expiry. */
+export declare const ROTATION_FAST_RETRY_MS: number;
+export declare const DEFAULT_AGENT_TOKEN_TTL_MINUTES = 60;
+/** Readiness gate: how long to poll the run's events for the loop's first event
+ *  before declaring the detached launch a failure. */
+export declare const DEFAULT_READINESS_TIMEOUT_MS: number;
+export declare const DEFAULT_READINESS_POLL_MS = 500;
+/** Must match the coordinator Worker's session-start request ceiling. */
+export declare const MAX_HOSTED_START_BODY_BYTES: number;
+/** Non-secret placeholder OpenCode uses to form requests; the firewall proxy
+ *  overrides the real Anthropic header (model-key brokering). NEVER a real key. */
+export declare const ANTHROPIC_DUMMY_KEY = "sk-ant-orizu-proxy-broker-placeholder";
+/** The broker currently drains repository lifecycle work once per minute. A
+ * durable provider `waiting` response can therefore cost a full cron period;
+ * use the server-advertised cadence and retain a five-minute resume window. */
+export declare const REPOSITORY_PROVISIONING_RETRY_MS = 60000;
+export declare const REPOSITORY_PROVISIONING_MAX_WAIT_MS: number;
+/** Backward-compatible names for existing operator-path callers/tests. */
+export declare const OPERATOR_REPOSITORY_PENDING_RETRY_MS = 60000;
+/** @deprecated The runtime is delay-budgeted, not retry-counted. This retains
+ * the old exported symbol as the maximum count implied by the 1s wire floor. */
+export declare const OPERATOR_REPOSITORY_PENDING_MAX_RETRIES: number;
+/** A bounded repository wait exhausted without losing the immutable hosted
+ * start identity. Both server- and operator-provisioned paths expose the same
+ * structured recovery contract. */
+export declare class HostedSessionRepositoryPendingError extends Error {
+    readonly sessionId: string;
+    readonly startIntentId: string;
+    readonly resumeCommand: string;
+    constructor(input: {
+        readonly sessionId: string;
+        readonly startIntentId: string;
+        readonly resumeCommand: string;
+    });
+}
+/** Base-relative fetch (base already applied) — the host-side human fetcher. */
+export type HostFetcher = (path: string, init?: RequestInit) => Promise<Response>;
+/** Build a base-relative fetcher that authenticates with a specific bearer
+ *  (used for the AGENT-bearer run-start against the absolute API base). */
+export declare function bearerFetcher(apiBaseUrl: string, bearer: string, rawFetch: HostedFetch): HostFetcher;
+export interface LaunchLoopParams {
+    session: SandboxSession;
+    context: HostedLoopContext;
+    /** Sandbox-relative + absolute paths for the run-scoped loop files. */
+    taskRel: string;
+    contextRel: string;
+    contextAbs: string;
+    logRel: string;
+    taskPrompt: string;
+    /** Agent bearer, handed through so an injected in-process launcher can run
+     *  the loop without re-reading the 0600 file. */
+    bearer: string;
+}
+export interface RepoResolution {
+    repoFullName: string;
+    cloneUrl: string;
+}
+export interface StartHostedSessionOptions {
+    /** Host-side human fetcher (base-relative, authed with the human login). */
+    fetcher: HostFetcher;
+    /** Absolute Orizu API base — baked into the sandbox boot context. */
+    apiBaseUrl: string;
+    provider: SandboxProvider;
+    workspaceId: string;
+    task: string;
+    projectSlug?: string | null;
+    /** Immutable response-loss identity. Supply both fields to resume the exact
+     * pending repository; omitting both creates a fresh UUIDv4 intent. */
+    startIntentId?: string;
+    reconcileSessionId?: string;
+    model?: string;
+    reasoningEffort?: string;
+    /** Sandbox session length (minutes); default 60, hard-capped at 24h. */
+    durationMinutes?: number;
+    runtime?: string;
+    /**
+     * Pre-baked custom VCR image ref (ALI-1017), e.g. 'orizu-hosted-runtime:v1'.
+     * When set, it is passed to `Sandbox.create({ image })` AND flips the `prebaked`
+     * flag on BOTH the bootstrap and the loop together — so the sandbox image and
+     * the install-skip decision can never disagree. When unset, the from-scratch
+     * install path runs (local-sim / base runtime). Default: env ORIZU_HOSTED_IMAGE.
+     */
+    hostedImage?: string;
+    /**
+     * Pre-baked Vercel Sandbox SNAPSHOT id (ALI-1017, zero-Docker path). Parallel to
+     * `hostedImage`: when set it is passed to `Sandbox.create({ source:{ type:'snapshot' }})`
+     * AND flips the `prebaked` flag on bootstrap + loop together. Mutually exclusive
+     * with `hostedImage` — both set is a hard error. Default: env ORIZU_HOSTED_SNAPSHOT.
+     */
+    hostedSnapshot?: string;
+    title?: string;
+    /** Attach: rotate the bearer + stream the run tail until it terminates. */
+    tail?: boolean;
+    /** Host-side model key; injected at the firewall proxy, never into the sandbox. */
+    modelApiKey?: string;
+    /** @deprecated The credential-helper host is derived from the resolved clone
+     *  URL. Kept only as a source-compatible no-op for older library callers. */
+    host?: string;
+    /** Loopback hosts the helper may serve over plain HTTP (rehearsal only). */
+    insecureHttpHosts?: readonly string[];
+    rawFetch?: HostedFetch;
+    resolveRepo?: (workspaceId: string) => Promise<RepoResolution>;
+    launchLoop?: (params: LaunchLoopParams) => Promise<void>;
+    /** Build the sandbox egress policy from the resolved inputs. Default: G5
+     *  `buildEgressPolicy` — DEFAULT-DENY base allowlist (Orizu API + model provider
+     *  + git) with the model-key broker composed on, plus the per-team additive
+     *  domains. Injectable for tests. */
+    buildEgressPolicy?: (input: {
+        modelApiKey?: string;
+        extraDomains: readonly string[];
+        repositoryHost: string;
+    }) => SandboxEgressPolicy | undefined;
+    /** Resolve the per-team ADDITIVE egress domains for this workspace's team
+     *  (base hosts are code-owned and always present). Default: no extra domains —
+     *  the production CLI injects a route-backed resolver. */
+    resolveExtraEgressDomains?: (workspaceId: string) => Promise<readonly string[]>;
+    /** Injectable bounded wait used while the server prepares an Artifacts fork. */
+    repositorySleep?: (ms: number) => Promise<void>;
+    /** Injectable UUIDv4 generator; one value is replayed for every retry. */
+    generateStartIntentId?: StartIntentIdGenerator;
+    rotationIntervalMs?: number;
+    agentTokenTtlMinutes?: number;
+    now?: () => number;
+    /** Readiness gate bound (ms); default 30s. */
+    readinessTimeoutMs?: number;
+    /** Readiness poll interval (ms); default 500ms. */
+    readinessPollMs?: number;
+    /** Test seam: override the readiness probe entirely (resolves ready/not). */
+    waitForReady?: (params: ReadinessParams) => Promise<boolean>;
+    logLine?: (line: string) => void;
+    onTailEvent?: (event: Record<string, unknown>) => void;
+    /** Test hook: the live sandbox + its run-scoped paths, after a successful
+     *  bootstrap (used by the e2e for residue-sweep + bearer-file inspection). */
+    onSandboxReady?: (info: {
+        session: SandboxSession;
+        paths: HostedRuntimePaths;
+    }) => void;
+    /** Await the tail loop when attached (tests pass a bounded tailer). */
+    tailImpl?: (params: TailParams) => Promise<void>;
+}
+export interface TailParams {
+    fetcher: HostFetcher;
+    runId: string;
+    onEvent?: (event: Record<string, unknown>) => void;
+}
+export interface ReadinessParams {
+    fetcher: HostFetcher;
+    runId: string;
+    timeoutMs: number;
+    pollMs: number;
+    now: () => number;
+    sleep: (ms: number) => Promise<void>;
+    log: (line: string) => void;
+}
+export interface StartHostedSessionResult {
+    ok: boolean;
+    sessionId: string;
+    runId: string;
+    sandboxId: string;
+    repoFullName: string;
+    sessionBranch: string;
+    agentUserId: string | null;
+    bootstrapOk: boolean;
+    error: string | null;
+}
+export declare function repositoryResolutionFromMint(minted: Record<string, unknown>): RepoResolution;
+export declare function startHostedSession(opts: StartHostedSessionOptions): Promise<StartHostedSessionResult>;
+export interface HostedCommandIo {
+    print: (line: string) => void;
+    printErr?: (line: string) => void;
+    json?: boolean;
+}
+/** Printed on EVERY `--operator` use (founder-locked: deprecate NOW, remove
+ *  after Phase 6 validation). Loud on purpose. */
+export declare const OPERATOR_DEPRECATION_WARNING: string;
+/**
+ * Default hosted path (ALI-1055 cutover): POST the server's hosted-sessions
+ * route and let the Durable Object coordinator own the sandbox lifetime. The
+ * CLI never reads VERCEL_* or a model key on this path — the server holds them.
+ */
+/** Bounded reconcile of a start that the coordinator reported still-in-flight
+ *  (R7 P4). Each retry re-pokes the SAME session by its returned sessionId, so
+ *  a race that momentarily answers start_pending never spawns a duplicate.
+ *
+ *  R8 P2 — the retry budget must OUTLIVE a stale start lease. If a start-lease
+ *  owner crashed WITHOUT running its release, the lease lingers until its TTL
+ *  (the coordinator's START_LEASE_TTL_MS = 3 × CALLBACK_TIMEOUT_MS = 30s), and
+ *  every duplicate poke sees it and answers start_pending. So the CLI's OWN
+ *  cumulative backoff (independent of server-side watch time) must exceed that
+ *  TTL plus margin, so the CLI keeps polling until the lease expires and a
+ *  retry then wins — rather than giving up while the crashed owner's lease
+ *  still lingers. COORDINATOR_START_LEASE_TTL_MS mirrors the worker constant
+ *  and is pinned to it by a contract test in the CLI suite. */
+export declare const COORDINATOR_START_LEASE_TTL_MS = 30000;
+export declare const HOSTED_START_PENDING_RETRY_MS = 2000;
+export declare const HOSTED_START_PENDING_MAX_RETRIES: number;
+export declare function startHostedViaServer(args: readonly string[], workspaceId: string, task: string, tail: boolean, io: HostedCommandIo, fetcher?: HostFetcher, sleep?: (ms: number) => Promise<void>, generateStartIntentId?: StartIntentIdGenerator): Promise<number>;
+/** Test seams for `hostedCommand` dispatch (server default vs operator hatch). */
+export interface HostedCommandDeps {
+    startViaServer?: typeof startHostedViaServer;
+    startViaOperator?: (args: string[], workspaceId: string, task: string, tail: boolean, io: HostedCommandIo) => Promise<number>;
+}
+/**
+ * Dispatch `orizu internal hosted-loop` (in-sandbox) and `orizu session start
+ * --hosted` (host-side). Kept out of index.ts so the CLI entrypoint stays a thin
+ * dispatcher (ALI-976 ratchet).
+ *
+ * ALI-1055 cutover: the DEFAULT is the server path (POST /api/cli/hosted-sessions
+ * → DO coordinator). `--operator` keeps the old client-provisioned flow as a
+ * DEPRECATED escape hatch (loud warning on every use; removal after Phase 6).
+ */
+export declare function hostedCommand(args: string[], io: HostedCommandIo, deps?: HostedCommandDeps): Promise<number>;
+//# sourceMappingURL=hosted-session-cli.d.ts.map

package/dist/hosted-session-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-session-cli.d.ts","sourceRoot":"","sources":["../src/hosted-session-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAA;AAK9B,OAAO,EAAE,oBAAoB,EAAqB,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAMlG,OAAO,EAKL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAA;AAQ1B,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAC/B,eAAO,MAAM,wBAAwB,KAAK,CAAA;AAC1C,eAAO,MAAM,oBAAoB,QAAU,CAAA;AAC3C,eAAO,MAAM,4BAA4B,QAAiB,CAAA;AAC1D;6EAC6E;AAC7E,eAAO,MAAM,sBAAsB,QAAY,CAAA;AAC/C,eAAO,MAAM,+BAA+B,KAAK,CAAA;AACjD;sDACsD;AACtD,eAAO,MAAM,4BAA4B,QAAY,CAAA;AACrD,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAC5C,yEAAyE;AACzE,eAAO,MAAM,2BAA2B,QAAa,CAAA;AAMrD;mFACmF;AACnF,eAAO,MAAM,mBAAmB,0CAA0C,CAAA;AAK1E;;+EAE+E;AAC/E,eAAO,MAAM,gCAAgC,QAAS,CAAA;AACtD,eAAO,MAAM,mCAAmC,QAAa,CAAA;AAC7D,0EAA0E;AAC1E,eAAO,MAAM,oCAAoC,QACf,CAAA;AAClC;gFACgF;AAChF,eAAO,MAAM,uCAAuC,QACP,CAAA;AAE7C;;mCAEmC;AACnC,qBAAa,mCAAoC,SAAQ,KAAK;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;gBAElB,KAAK,EAAE;QACjB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;QAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAC/B;CAUF;AAID,gFAAgF;AAChF,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEjF;2EAC2E;AAC3E,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,WAAW,GACpB,WAAW,CAOb;AAkJD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,cAAc,CAAA;IACvB,OAAO,EAAE,iBAAiB,CAAA;IAC1B,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB;qDACiD;IACjD,MAAM,EAAE,MAAM,CAAA;CACf;AAeD,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,yBAAyB;IACxC,4EAA4E;IAC5E,OAAO,EAAE,WAAW,CAAA;IACpB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,eAAe,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B;0EACsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,wEAAwE;IACxE,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,2EAA2E;IAC3E,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;iFAC6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,4EAA4E;IAC5E,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAErC,QAAQ,CAAC,EAAE,WAAW,CAAA;IACtB,WAAW,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAA;IAC9D,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACxD;;;yCAGqC;IACrC,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC1B,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;QAC/B,cAAc,EAAE,MAAM,CAAA;KACvB,KAAK,mBAAmB,GAAG,SAAS,CAAA;IACrC;;8DAE0D;IAC1D,yBAAyB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;IAC/E,gFAAgF;IAChF,eAAe,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C,0EAA0E;IAC1E,qBAAqB,CAAC,EAAE,sBAAsB,CAAA;IAC9C,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,8CAA8C;IAC9C,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,mDAAmD;IACnD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5D,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAChC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IACtD;kFAC8E;IAC9E,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,cAAc,CAAC;QAAC,KAAK,EAAE,kBAAkB,CAAA;KAAE,KAAK,IAAI,CAAA;IACvF,uEAAuE;IACvE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACjD;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,WAAW,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;CACnD;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,WAAW,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,MAAM,CAAA;IACjB,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACpC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAC5B;AAmDD,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,OAAO,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,WAAW,EAAE,OAAO,CAAA;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,cAAc,CAiDhB;AAoDD,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CA0dnC;AAID,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AA4ID;kDACkD;AAClD,eAAO,MAAM,4BAA4B,QAGkC,CAAA;AAE3E;;;;GAIG;AACH;;;;;;;;;;;;+DAY+D;AAC/D,eAAO,MAAM,8BAA8B,QAAS,CAAA;AACpD,eAAO,MAAM,6BAA6B,OAAQ,CAAA;AAElD,eAAO,MAAM,gCAAgC,QAE5C,CAAA;AAiCD,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,EAAE,EAAE,eAAe,EACnB,OAAO,GAAE,WAAqD,EAC9D,KAAK,GAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAyD,EAC5F,qBAAqB,CAAC,EAAE,sBAAsB,GAC7C,OAAO,CAAC,MAAM,CAAC,CAkPjB;AAED,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,OAAO,oBAAoB,CAAA;IAC5C,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,eAAe,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC9H;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,EAAE,eAAe,EACnB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAkLjB"}

package/dist/hosted-skill-staging.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Shared orizu-cli skill staging (ALI-1044 / ALI-1059).
+ *
+ * BOTH hosted boot paths must stage the vendored `orizu-cli` skill into the
+ * cloned workspace so the agent discovers the Orizu workflows: the OPERATOR path
+ * (hosted-bootstrap.ts) and the DO path (hosted-boot.ts). Before ALI-1059 only the
+ * operator path did — the DO path (the default; `--operator` is deprecated) booted
+ * an authenticated CLI that never found the skill. This module is the ONE
+ * implementation of the resolution chain and the `.git/info/exclude` append; each
+ * path adapts its own exec seam and records the outcome its own way (a run-event
+ * sink vs. a boot log).
+ *
+ * Resolution chain (unchanged from the original operator-path block), preferring:
+ *   (1) $ORIZU_SKILL_SOURCE_DIR  — explicit override (also honored by the CLI's
+ *       skill-installer; the local-sim rehearsal sets it),
+ *   (2) `orizu skills path`      — the packaged vendor/skills/orizu-cli of the
+ *       globally-installed CLI (the production path),
+ *   (3) `$(npm root -g)/orizu/vendor/skills/orizu-cli` — belt fallback.
+ * Then SYMLINK it under `<workspaceDir>/.claude/skills/orizu-cli`, falling back to
+ * a copy if the symlink cannot be created. Resolved paths stay in shell vars
+ * (never interpolated), so they cannot inject into the command.
+ *
+ * HARVEST-SAFE (ALI-1051): the script appends `/.claude/skills/` to the repo-LOCAL
+ * `.git/info/exclude` so auto-harvest's `git add -A` cannot sweep the staged
+ * symlink into the session branch (hosted-harvest.ts also excludes it by pathspec,
+ * belt-and-braces).
+ */
+export interface SkillStageExecResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}
+/**
+ * Runs a POSIX shell command string, returning its exit code + captured output.
+ * The operator path adapts `SandboxSession.exec`; the DO path adapts its
+ * `BootExec` via `sh -c`. Kept as an injected seam so both callers — and tests —
+ * share one script and one output parser.
+ */
+export type SkillStageExec = (command: string) => Promise<SkillStageExecResult>;
+export interface StageOrizuSkillOptions {
+    /**
+     * Directory the session branch is cloned into (ABSOLUTE on the DO path,
+     * sandbox-root RELATIVE on the operator path). The skill is staged under
+     * `<workspaceDir>/.claude/skills/orizu-cli`.
+     */
+    workspaceDir: string;
+    exec: SkillStageExec;
+}
+export interface StageOrizuSkillResult {
+    ok: boolean;
+    method: 'symlink' | 'copy' | null;
+    /** `<workspaceDir>/.claude/skills/orizu-cli`. */
+    dest: string;
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}
+/** The exact staging script — exported for tests that assert its shape. */
+export declare function renderStageOrizuSkillScript(workspaceDir: string): string;
+/**
+ * Stage the orizu-cli skill into `<workspaceDir>/.claude/skills/orizu-cli`.
+ * Non-throwing (except via the injected exec): resolves to a structured result
+ * both callers record their own way. A malformed `workspaceDir` returns a non-ok
+ * result rather than throwing, so staging stays non-fatal to the boot.
+ *
+ * TRUSTED-DIR CONTRACT: `workspaceDir` must be a trusted, internally-constructed
+ * non-traversal directory. The shell-safety guard blocks injection metacharacters
+ * but deliberately does not reject `..` or a leading `-` — do not pass untrusted
+ * input here. Idempotent: safe to re-invoke (e.g. ALI-1060 resume/retry) — the
+ * `.git/info/exclude` line is appended only when absent.
+ */
+export declare function stageOrizuSkill(opts: StageOrizuSkillOptions): Promise<StageOrizuSkillResult>;
+//# sourceMappingURL=hosted-skill-staging.d.ts.map

package/dist/hosted-skill-staging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-skill-staging.d.ts","sourceRoot":"","sources":["../src/hosted-skill-staging.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAA;AAE/E,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,cAAc,CAAA;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI,CAAA;IACjC,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AAUD,2EAA2E;AAC3E,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAmBxE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAqBlG"}

package/dist/http.d.ts

@@ -0,0 +1,8 @@
+import { GlobalFlags } from './global-flags.js';
+export declare function setGlobalFlags(flags: GlobalFlags): void;
+export declare function resolveBaseUrl(flags?: GlobalFlags): string;
+export declare function resolveLoginBaseUrl(flags?: GlobalFlags): string;
+export declare function getBaseUrl(): string;
+export declare function assertSecureTokenTransport(baseUrl: string): void;
+export declare function authedFetch(path: string, init?: RequestInit): Promise<Response>;
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAMA,OAAO,EAAkB,WAAW,EAAoB,MAAM,mBAAmB,CAAA;AAKjF,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,QAEhD;AAED,wBAAgB,cAAc,CAAC,KAAK,GAAE,WAA0B,GAAG,MAAM,CAiBxE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,GAAE,WAA0B,GAAG,MAAM,CAY7E;AAED,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAWD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,QAmBzD;AA8CD,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,qBAkDrE"}

package/dist/index.d.ts

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+export { loadInstructionSet } from './instruction-set-loader.js';
+export { parseJsonResponse, sanitizeTerminalText } from './json-response.js';
+export declare function normalizeSlugInput(slug: string): string;
+export declare function expandHomePath(path: string): string;
+export declare function createCodeChallenge(verifier: string): string;
+export declare function validateBrowserUrl(url: string, expectedOrigin?: string): URL;
+export declare function formatTerminalLink(url: string): string;
+export declare function readRunnerManifest(runnerDir: string): {
+    command: string[];
+    supports_body_kind?: string[];
+};
+export declare const RUNNER_TIMEOUT_MS = 120000;
+export declare const RUNNER_OUTPUT_MAX_BYTES: number;
+export declare const RUNNER_ENV_ALLOWLIST: Set<string>;
+export declare function runnerSubprocessEnv(inputPath: string, outputPath: string, instructionSetDir?: string): NodeJS.ProcessEnv;
+export declare function materializeRunnerVersion(runnerVersionId: string): Promise<{
+    runnerDir: string;
+    cleanup: () => void;
+}>;
+export declare function main(rawArgs?: string[]): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AA2FgF,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AA8BhJ,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAgU5E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAUD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOnD;AAyBD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAcD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,GAAG,CAqB5E;AA6BD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgBtD;AA+jKD,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CA0B1G;AAED,eAAO,MAAM,iBAAiB,SAAU,CAAA;AACxC,eAAO,MAAM,uBAAuB,QAAkB,CAAA;AACtD,eAAO,MAAM,oBAAoB,aAgB/B,CAAA;AAEF,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAaxH;AAWD,wBAAsB,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,CAAC,CA6B3H;AA0LD,wBAAsB,IAAI,CAAC,OAAO,WAAwB,iBA0gBzD"}