orizu 0.5.20 → 0.5.21

package/dist/hosted-run-event-sink.d.ts

@@ -0,0 +1,222 @@
+/**
+ * RunEventSink — the RunAPI event bridge (ALI-926 / P3.4, interface 2 of
+ * ADR-005's swappability contract; the full realization of audit §4b).
+ *
+ * This is the transport half that `bridge.py`'s WebSocket client is NOT: it maps
+ * normalized `HarnessEvent`s onto Orizu's append-only, client-sequenced
+ * `workbench_run_events` and terminal PATCH. It extends the seed
+ * `createBootstrapRunEventSink` (`hosted-bootstrap.ts`) into the complete bridge:
+ * kind-to-event-type mapping, token coalescing, monotonic client-sequenced
+ * allocation (gaps tolerated on an ambiguous append failure, but NEVER a content
+ * swap at a committed sequence — see the P2-4 burn rule in `postEvent`),
+ * critical-event delivery guarantees, terminal-via-PATCH, reconnect/resume, and
+ * the "Orizu records win" disagreement rule. A retried POST is an idempotent 200
+ * ONLY for a content-identical replay (same eventId, same sequence, same
+ * payload); a burned sequence after an ambiguous error leaves a server-visible
+ * gap, which is acceptable.
+ *
+ * ── Disagreement rule (Orizu records win) ────────────────────────────────────
+ * Orizu's RunAPI is the source of truth; the OpenCode-side session state is a
+ * cache/UX layer. If the harness reports state that CONTRADICTS a terminal Orizu
+ * run status — e.g. it keeps streaming parts after the run was finished — the
+ * sink REFUSES to append: once `finish()` succeeds the sink is SEALED, and any
+ * later `append()` throws `RunTerminalError` locally rather than POSTing. The
+ * sink never un-terminates a run and never invents a new one. A run-gone/terminal
+ * signal from the server (append 404/410, or a persistent terminal-status 409 on
+ * the finish PATCH) is likewise accepted as truth, sealing the sink. Note the
+ * narrow classifications: a 403 is NOT "terminal" — it is a `RunAuthError`
+ * (revoked bearer or lost access) that does not seal, and a 409 whose run is
+ * still running does NOT report success. The harness is a subordinate producer;
+ * the server record wins every disagreement.
+ *
+ * ── Artifact-ref decision (transcript/summary) ───────────────────────────────
+ * The audit points at `lib/primitive-artifact-writer.server.ts`, but that is
+ * server-only Supabase/object-store code the sandbox cannot import, and the
+ * CLI's existing artifact write paths (`orizu runners/prompts/... push`) are all
+ * PROJECT-scoped versioned-primitive uploads — there is NO run-scoped artifact
+ * write path today. Per ADR-003 (do not invent a new storage convention), a
+ * transcript is recorded as a BOUNDED-TAIL run event (`agent_transcript`,
+ * `TRANSCRIPT_TAIL_MAX_CHARS`) appended BEFORE the terminal PATCH (a post-terminal
+ * append would be refused by the seal). TODO(P3.6/ALI-928): when a run-scoped
+ * artifact-ref CLI path lands, swap the tail event for a real object ref.
+ */
+import type { HarnessEvent, HarnessEventKind } from './hosted-harness.js';
+export type HostedFetch = (url: string, init?: RequestInit) => Promise<Response>;
+export declare const EGRESS_ALLOWED_EVENT_TYPE = "egress_allowed";
+export declare const EGRESS_BLOCKED_EVENT_TYPE = "egress_blocked";
+/** The RunAPI event type a harness kind maps to, or null if it is not appendable
+ *  (terminal kinds route through the PATCH; deferred kinds have no mapping yet). */
+export declare function eventTypeForKind(kind: HarnessEventKind): string | null;
+export declare const AGENT_TOKEN_EVENT_TYPE = "agent_token";
+export declare const AGENT_TRANSCRIPT_EVENT_TYPE = "agent_transcript";
+/** Bounded tail size for the transcript stopgap (see artifact-ref decision). */
+export declare const TRANSCRIPT_TAIL_MAX_CHARS = 16384;
+export declare const CREDENTIAL_ROTATED_EVENT_TYPE = "credential_rotated";
+export declare const CREDENTIAL_MINT_FAILED_EVENT_TYPE = "credential_mint_failed";
+export type TerminalStatus = 'succeeded' | 'failed' | 'cancelled';
+export interface FinishOptions {
+    summary?: Record<string, unknown>;
+    evidence?: Record<string, unknown>;
+    /** Full agent transcript; stored as a bounded-tail `agent_transcript` event
+     *  BEFORE the terminal PATCH (see the artifact-ref decision docblock). */
+    transcript?: string;
+}
+export interface RunEventSink {
+    /** Map + coalesce + POST a harness event. Owns per-run monotonic sequence.
+     *  Terminal kinds are rejected (they must go through `finish`). */
+    append(event: HarnessEvent): Promise<void>;
+    /** Force-flush any coalesced token snapshots (also runs on every structural
+     *  event and on `finish`). Exposed so callers can flush on a timer if desired. */
+    flushTokens(): Promise<void>;
+    /** Terminal transition via PATCH; records the transcript tail first, then CAS. */
+    finish(status: TerminalStatus, opts?: FinishOptions): Promise<void>;
+    /** True once a terminal transition has landed and the sink is sealed. */
+    readonly sealed: boolean;
+    /** The next sequence the sink will attempt to allocate (test/resume aid). */
+    readonly nextSequence: number;
+    /** Events the sink has confirmed appended, in order (redacted payloads). */
+    readonly recorded: readonly AppendedRunEvent[];
+}
+export interface AppendedRunEvent {
+    eventId: string;
+    sequence: number;
+    eventType: string;
+    payload: Record<string, unknown>;
+}
+/** Raised when an append is attempted against a run the sink knows is terminal. */
+export declare class RunTerminalError extends Error {
+    constructor(message: string);
+}
+/** Raised when a critical event (or the terminal PATCH) is undeliverable after
+ *  the bounded retry budget — the caller MUST treat the run as compromised. */
+export declare class CriticalDeliveryError extends Error {
+    constructor(message: string);
+}
+/**
+ * Raised when `finish()` itself is undeliverable (ALI-1065 finding 2): a
+ * CriticalDeliveryError thrown WHILE DELIVERING A TERMINAL TRANSITION, carrying
+ * the intended status + finish options so the caller can retry the delivery
+ * with the ORIGINAL outcome. Before this, the error surfaced as a bare
+ * CriticalDeliveryError and the loop's generic catch re-finished the run
+ * 'failed' — a ~1s transport blip on the SUCCESS terminal recorded a succeeded
+ * run as failed. Subclasses CriticalDeliveryError so existing classification
+ * (drop-vs-surface) is unchanged.
+ */
+export declare class TerminalDeliveryError extends CriticalDeliveryError {
+    readonly intendedStatus: TerminalStatus;
+    readonly finishOptions: FinishOptions | undefined;
+    constructor(message: string, intendedStatus: TerminalStatus, finishOptions?: FinishOptions);
+}
+/**
+ * Raised on a 403 from the RunAPI. Named for what a 403 actually is — NOT "the
+ * run is terminal" (that is 404/410). A 403 means the caller may no longer write
+ * this run: the session bearer was revoked, OR the agent lost access to the run
+ * (e.g. its session was reassigned). The write definitely did not land, so the
+ * sink does NOT seal and does NOT burn the sequence; the caller decides whether
+ * to re-authenticate or abandon the run.
+ */
+export declare class RunAuthError extends Error {
+    constructor(message: string);
+}
+export interface CreateRunEventSinkOptions {
+    apiBaseUrl: string;
+    runId: string;
+    /**
+     * The Orizu bearer, EITHER a fixed string OR a provider resolved per request.
+     * A provider (e.g. one that reads the rotated 0600 bearer file) lets the sink
+     * pick up a host-side token rotation without being rebuilt: every request
+     * resolves the current value, and on a 401/403 the sink re-resolves ONCE and
+     * retries before classifying the failure (fresh token after rotation).
+     */
+    bearer: string | (() => string);
+    fetchImpl?: HostedFetch;
+    /**
+     * Verbatim secrets to strip from every payload before it leaves the sandbox.
+     *
+     * THIS IS THE REDACTION GUARANTEE. Exact-match on these values is the control
+     * we rely on — ANY secret that is present in the sandbox (the run bearer is
+     * added automatically; also pass every minted repo token, model-provider API
+     * key, and any credential a customer setup step injects) MUST appear in this
+     * list. Whatever is here is scrubbed wherever it appears, even mid-string and
+     * regardless of its shape. The token-shape patterns in `secret-redaction.ts`
+     * are only defense-in-depth for credentials no one declared; never treat a
+     * shape match as the primary safeguard.
+     */
+    redactSecretsList?: readonly string[];
+    now?: () => number;
+    /** First sequence to allocate (resume sets this to server cursor + 1). */
+    startSequence?: number;
+    /** eventId namespace; deterministic ids `<prefix>:<sequence>` make a replayed
+     *  event an idempotent 200 (never a 409 same-sequence-different-eventId). */
+    eventIdPrefix?: string;
+    /** Bounded retry budget for critical deliveries (append critical + finish). */
+    maxCriticalAttempts?: number;
+    /**
+     * Bounded retry budget for NON-critical appends (agent_tool_call, agent_step_*,
+     * token snapshots) before the event is DROPPED. Retries only on transient
+     * network/5xx failures; on exhaustion the event is dropped (never thrown), so a
+     * single bad POST in a multi-hour run never fails the whole run (ALI-1061).
+     * Default 3.
+     */
+    maxNonCriticalAttempts?: number;
+    /** Injectable backoff sleep (tests pass a no-op to avoid real delays). */
+    sleepImpl?: (ms: number) => Promise<void>;
+    /** Local diagnostic sink for disagreement-rule logs (never throws). */
+    onDiagnostic?: (message: string) => void;
+}
+export declare function createRunEventSink(options: CreateRunEventSinkOptions): RunEventSink;
+export interface ResumeRunEventSinkOptions extends Omit<CreateRunEventSinkOptions, 'startSequence'> {
+    /** Page size for the cursor tail while discovering the latest sequence. */
+    pageSize?: number;
+}
+/**
+ * Rebuild a sink after a restart WITHOUT losing run continuity (acceptance:
+ * "reconnect/resume without losing run continuity"). Walks the events GET
+ * cursor tail to the end to learn the server's latest sequence, then returns a
+ * fresh sink whose first allocation is `latest + 1`.
+ *
+ * ── QUIESCE PRECONDITION (single-writer handoff) ─────────────────────────────
+ * This is safe ONLY when the predecessor sink has FULLY STOPPED before resume
+ * runs — the RunAPI is single-writer-per-run (see the events route), and resume
+ * assumes it is the sole writer while it reads the tail and picks the next
+ * sequence. It does NOT coordinate with a live predecessor. If a still-in-flight
+ * commit from a not-yet-dead sink lands AFTER we read the cursor, that sink and
+ * this one can both target the same next sequence. We do not claim "no
+ * collision": deterministic eventIds (`<runId>:<sequence>`) make an identical
+ * replay an idempotent 200, but two DIFFERENT payloads racing one sequence is a
+ * real conflict — bounded, not eliminated, by the P2-4 burn rule (the loser
+ * burns its candidate and advances rather than swapping committed content).
+ * Callers MUST ensure the predecessor is quiesced; treat overlap as a bug.
+ *
+ * ── STUCK-RUNNING RECOVERY (out of scope here) ───────────────────────────────
+ * If a sink crashes BETWEEN its last append and finish(), the run is left with
+ * status='running' server-side and no terminal event — resume can continue
+ * appending, but nothing in THIS module will time out and finalize an abandoned
+ * run whose writer never came back. A server-side watchdog owns that recovery
+ * (G6 / ALI-1007); it is deliberately not implemented in the sandbox client.
+ */
+export declare function resumeRunEventSink(options: ResumeRunEventSinkOptions): Promise<RunEventSink>;
+export interface DrainOptions {
+    /** Transcript captured by the caller, stored on the terminal transition. */
+    transcript?: string;
+    summary?: Record<string, unknown>;
+    evidence?: Record<string, unknown>;
+    /**
+     * Hook invoked AFTER the stream yields its terminal event but BEFORE `finish()`
+     * seals the sink, on EVERY terminal path (success, failure, abnormal end). Used
+     * by the loop's end-of-run auto-harvest (ALI-1036) so `work_persisted` /
+     * `work_none` / `work_persist_failed` can still be appended while the sink is
+     * writable. Its own failure must never change the run's terminal status — the
+     * hook itself is responsible for swallowing errors.
+     */
+    beforeFinish?: () => Promise<void>;
+}
+/**
+ * Consume a harness `runPrompt` stream into a sink: structural events are
+ * appended (with token coalescing), and the single terminal event
+ * (`execution_complete` / `error`) is routed to `finish()` — NEVER appended.
+ * This is the event bridge's happy-path driver; the terminal event decides the
+ * run's final status.
+ */
+export declare function drainHarnessToSink(events: AsyncIterable<HarnessEvent>, sink: RunEventSink, opts?: DrainOptions): Promise<TerminalStatus>;
+//# sourceMappingURL=hosted-run-event-sink.d.ts.map

package/dist/hosted-run-event-sink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-run-event-sink.d.ts","sourceRoot":"","sources":["../src/hosted-run-event-sink.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAIzE,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAUhF,eAAO,MAAM,yBAAyB,mBAAmB,CAAA;AACzD,eAAO,MAAM,yBAAyB,mBAAmB,CAAA;AA8BzD;oFACoF;AACpF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAEtE;AAED,eAAO,MAAM,sBAAsB,gBAAgB,CAAA;AACnD,eAAO,MAAM,2BAA2B,qBAAqB,CAAA;AAC7D,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,QAAS,CAAA;AAY/C,eAAO,MAAM,6BAA6B,uBAAuB,CAAA;AACjE,eAAO,MAAM,iCAAiC,2BAA2B,CAAA;AAEzE,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAA;AAEjE,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC;8EAC0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B;uEACmE;IACnE,MAAM,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C;sFACkF;IAClF,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5B,kFAAkF;IAClF,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAA;CAC/C;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAED,mFAAmF;AACnF,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAED;+EAC+E;AAC/E,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;GASG;AACH,qBAAa,qBAAsB,SAAQ,qBAAqB;IAC9D,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;IACvC,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAA;gBACrC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,CAAC,EAAE,aAAa;CAM3F;AAED;;;;;;;GAOG;AACH,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI5B;AAQD,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAA;IAC/B,SAAS,CAAC,EAAE,WAAW,CAAA;IACvB;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;iFAC6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,0EAA0E;IAC1E,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC,uEAAuE;IACvE,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CACzC;AAkBD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,YAAY,CAwUnF;AAID,MAAM,WAAW,yBAA0B,SAAQ,IAAI,CAAC,yBAAyB,EAAE,eAAe,CAAC;IACjG,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,YAAY,CAAC,CAyBvB;AAID,MAAM,WAAW,YAAY;IAC3B,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CACnC;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,aAAa,CAAC,YAAY,CAAC,EACnC,IAAI,EAAE,YAAY,EAClB,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,cAAc,CAAC,CAoFzB"}

package/dist/hosted-runtime-assets.d.ts

@@ -0,0 +1,186 @@
+/**
+ * In-sandbox runtime assets for the hosted bootstrap (ALI-925, per ADR-005).
+ *
+ * Ports the DESIGN — not the code — of OpenInspect's
+ * `sandbox_runtime/credentials/git_credential_helper.py` into a self-contained
+ * script asset that Orizu writes into the sandbox and registers as a git
+ * `credential.helper`. On every git op git spawns the script; the script mints a
+ * fresh, downscoped, audited token from Orizu's per-repo broker
+ * (`POST /api/cli/workspaces/{id}/repo-token`) and hands it to git, caching to a
+ * 0600 run-scoped file with an expiry-refresh buffer. It NEVER echoes the token
+ * and reads the bearer only from a run-scoped 0600 file (G3): the bearer is
+ * never baked into git config, the clone URL, or any long-lived file.
+ *
+ * Deliberately self-contained (no `orizu` package import) so it works even when
+ * the CLI-install step fails — the credential path must not depend on it. The
+ * script is emitted as CommonJS (`.cjs`) so it runs unchanged under both `node`
+ * (>=18, for global `fetch`) and `bun`, whichever the sandbox image ships.
+ *
+ * The boot context is split so no secret lands in a value git persists:
+ *   - `boot.json`  — non-secret config + the PATHS of the bearer/cache files;
+ *   - `<bearer>`   — the Orizu bearer, 0600, run-scoped, reaped at teardown;
+ *   - `<cache>`    — the minted repo token, 0600, written by the script itself.
+ * git config holds only `credential.helper = !<runtime> <script> <boot.json>`.
+ */
+export declare const HELPER_SCRIPT_BASENAME = "orizu-git-credential-helper.cjs";
+export declare const BOOT_CONTEXT_BASENAME = "boot.json";
+export declare const BEARER_BASENAME = "bearer";
+export declare const REPO_CRED_CACHE_BASENAME = "repo-cred.json";
+/** Refresh a cached token this long before its stated expiry (5 minutes). */
+export declare const DEFAULT_CACHE_REFRESH_BUFFER_MS: number;
+/** Customer setup hook path, relative to the repo root (mirrors OpenInspect's
+ *  `.openinspect/setup.sh` — fresh-boot only, non-fatal, output captured). */
+export declare const SETUP_HOOK_RELATIVE_PATH = ".orizu/setup.sh";
+/**
+ * The git author identity for hosted-agent commits. Bootstrap configures it
+ * repo-LOCAL in the sandbox clone (never --global) so agent `git commit` works
+ * out of the box — the sandbox has no ambient identity and commits died with
+ * "Author identity unknown" (ALI-1036, found live in QA-3). The loop uses the
+ * same identity for run-event attribution; keep them identical.
+ */
+export declare const AGENT_GIT_IDENTITY: {
+    readonly name: "Orizu Agent";
+    readonly email: "agent@orizu.ai";
+};
+/**
+ * Standing preamble wrapped around every hosted task prompt so a NATURAL task
+ * ("review X and update the readme") runs unattended with zero magic words. The
+ * agent is told to work autonomously (never block on the human), commit as it
+ * goes, and treat Orizu — not the repo — as the home for production pointers and
+ * run metadata. An end-of-run auto-harvest (ALI-1036, `harvestWorkspace`) is the
+ * safety net for anything left uncommitted; the preamble names it so the agent
+ * knows partial work is preserved.
+ */
+export declare const HOSTED_TASK_PREAMBLE: string;
+/** Delimiter separating the standing preamble from the verbatim user task. */
+export declare const HOSTED_TASK_DELIMITER = "--- YOUR TASK ---";
+/**
+ * Compose the full hosted prompt: the standing preamble, a clear delimiter, then
+ * the user's task VERBATIM beneath it. Passing an empty preamble yields the task
+ * unchanged (an explicit opt-out for tests / callers that scaffold elsewhere).
+ */
+export declare function composeHostedTaskPrompt(task: string, preamble?: string): string;
+/**
+ * Absolute path of the marker the pre-baked hosted-runtime image writes at build
+ * time (see packages/cli/hosted-runtime-image/Dockerfile). Its presence — plus
+ * the boot-context `prebaked` flag — tells the runtime the CLI + OpenCode are
+ * already on PATH, so the from-scratch install steps must be SKIPPED (they would
+ * otherwise fail under G5 default-deny egress).
+ */
+export declare const PREBAKED_MARKER_PATH = "/opt/orizu/prebaked.json";
+/**
+ * The schema of `/opt/orizu/prebaked.json`. Records the exact versions baked into
+ * the image so a run (and audit) can tell WHICH runtime it booted on. `builtFor`
+ * is a constant guard so a stray same-named file from another toolchain is not
+ * mistaken for our marker.
+ */
+export interface PrebakedMarker {
+    cliVersion: string;
+    opencodeVersion: string;
+    claudeSdkVersion: string;
+    /**
+     * Braintrust eval tooling pins (ALI-1048) — OPTIONAL because pre-ALI-1048
+     * markers do not carry them (older snapshots stay valid). Py = the PyPI
+     * `braintrust` package (Highlight's python eval harness), Npm = the npm
+     * `braintrust` package (TS SDK + `bt` CLI).
+     */
+    braintrustPyVersion?: string;
+    braintrustNpmVersion?: string;
+    builtFor: 'vercel-sandbox';
+}
+/**
+ * Parse + validate a pre-baked marker file's contents. Returns the typed marker
+ * when the JSON is well-formed AND carries the expected `builtFor` guard with
+ * string version fields; returns null otherwise (missing file → caller passes an
+ * empty/whitespace string; malformed JSON; wrong shape). Never throws, so a
+ * belt-and-braces filesystem probe can call it on best-effort file reads.
+ */
+export declare function parsePrebakedMarker(raw: string): PrebakedMarker | null;
+/**
+ * The non-secret boot context the helper script reads. Paths are ABSOLUTE so
+ * the helper resolves them regardless of git's cwd at invocation time.
+ */
+export interface HostedBootContext {
+    apiBaseUrl: string;
+    workspaceId: string;
+    sessionId: string;
+    runId: string;
+    sessionBranch: string;
+    repoFullName: string;
+    /** VCS host the helper will serve credentials for (default github.com). */
+    host: string;
+    /** Absolute path to the 0600 file holding the Orizu bearer. */
+    bearerFile: string;
+    /** Absolute path to the 0600 minted-token cache the script maintains. */
+    cacheFile: string;
+    /**
+     * PULL MODE (ALI-1057, DO-path hosted agent): the coordinator agent-token URL.
+     * When SET, the helper GETs a FRESH short-lived Orizu bearer here per mint —
+     * `Authorization: Bearer <boot secret read from bootSecretFile>` — instead of
+     * reading the host-written 0600 `bearerFile`. Everything downstream (POST the
+     * repo-token broker with that bearer → serve the GitHub x-access-token to git)
+     * is byte-identical to the operator/file path. When UNSET the helper stays in
+     * file mode and reads `bearerFile` exactly as before. This is the ONLY DO-path
+     * difference: the bearer SOURCE is HTTP, not a 0600 file.
+     */
+    agentTokenUrl?: string;
+    /**
+     * PULL MODE: absolute path to the 0600 file holding the durable BOOT SECRET —
+     * the sandbox's bootstrap identity, used to authenticate the agent-token GET.
+     * Required when `agentTokenUrl` is set; ignored in file mode.
+     */
+    bootSecretFile?: string;
+    /**
+     * Broker purpose vocabulary, INJECTABLE so a later slice can flip the whole
+     * script from write/read to session_write/session_read without editing it. The
+     * helper POSTs `primary` first and falls back to `fallback` ONLY on a 403
+     * (unauthorized-for-primary). A 400 is treated as vocabulary drift and fails
+     * loudly — it means the broker does not recognise the requested purpose.
+     */
+    tokenPurposes: {
+        primary: string;
+        fallback: string;
+    };
+    /**
+     * Hosts (lowercased) for which the helper may serve credentials over plain
+     * HTTP instead of HTTPS. Production leaves this UNSET → https-only. The
+     * local-sim rehearsal sets it to the loopback git server's host so the
+     * clone-through-helper path can be proven without TLS. Secure by default.
+     */
+    insecureHttpHosts?: readonly string[];
+    /** Refresh buffer in ms (overridable so tests can force a refresh). */
+    cacheBufferMs: number;
+}
+export declare function serializeBootContext(ctx: HostedBootContext): string;
+/**
+ * The opaque git-password rule, as a pattern SOURCE string.
+ *
+ * ALI-1285: the Artifacts contract declares the credential opaque
+ * (`plaintext: string`), so only transport-usable shape is enforced — bounded,
+ * no whitespace, no control characters, at least 16 characters. Mirrors
+ * `workers/artifacts-runtime/contracts.ts` GIT_PASSWORD.
+ *
+ * It is kept as a SOURCE STRING, not a regex literal, because the rendered
+ * credential helper must embed the identical rule. A regex literal written
+ * inline in the renderer's template has its escapes consumed by the OUTER
+ * template literal before emission, which silently produced
+ * `[^s<NUL>-<US><DEL>]` — rejecting every credential containing `s` while
+ * accepting spaces and NBSP. Emitting via `JSON.stringify` of this constant
+ * makes the two layers provably identical, and
+ * `test/cli/hosted-credential-helper.test.ts` asserts that at the RENDERED
+ * layer by executing the emitted validator.
+ */
+export declare const HOSTED_OPAQUE_GIT_PASSWORD_SOURCE = "^[^\\s\\u0000-\\u001f\\u007f]{16,1024}$";
+export declare const HOSTED_OPAQUE_GIT_PASSWORD: RegExp;
+/**
+ * The git credential-helper script, as a self-contained CommonJS source string.
+ * Implements the `get` action (mint/emit); `store`/`erase` are no-ops because
+ * the broker owns credential truth and the script never persists what git hands
+ * back. Diagnostics go to stderr only — stdout is reserved for git's protocol.
+ *
+ * NOTE: this is a rendered ARTIFACT, exercised end-to-end as a subprocess in
+ * `test/cli/hosted-credential-helper.test.ts`; that subprocess test is the
+ * source of truth for its behavior.
+ */
+export declare function renderCredentialHelperScript(): string;
+//# sourceMappingURL=hosted-runtime-assets.d.ts.map

package/dist/hosted-runtime-assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-runtime-assets.d.ts","sourceRoot":"","sources":["../src/hosted-runtime-assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,eAAO,MAAM,sBAAsB,oCAAoC,CAAA;AACvE,eAAO,MAAM,qBAAqB,cAAc,CAAA;AAChD,eAAO,MAAM,eAAe,WAAW,CAAA;AACvC,eAAO,MAAM,wBAAwB,mBAAmB,CAAA;AAExD,6EAA6E;AAC7E,eAAO,MAAM,+BAA+B,QAAgB,CAAA;AAE5D;8EAC8E;AAC9E,eAAO,MAAM,wBAAwB,oBAAoB,CAAA;AAEzD;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB;;;CAA4D,CAAA;AAI3F;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,QAK6C,CAAA;AAE9E,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,sBAAsB,CAAA;AAExD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA6B,GAAG,MAAM,CAGrG;AAID;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,6BAA6B,CAAA;AAE9D;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,EAAE,gBAAgB,CAAA;CAC3B;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAwBtE;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAA;IACZ,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,aAAa,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IACpD;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,uEAAuE;IACvE,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAEnE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iCAAiC,4CACH,CAAA;AAE3C,eAAO,MAAM,0BAA0B,QAEtC,CAAA;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,IAAI,MAAM,CAsQrD"}