ugly-app 0.1.240 → 0.1.241

package/dist/cli/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/cli/build.ts"],"names":[],"mappings":"AAIA,wBAAgB,QAAQ,IAAI,IAAI,CA+C/B"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/cli/build.ts"],"names":[],"mappings":"AAIA,wBAAgB,QAAQ,IAAI,IAAI,CAsE/B"}

package/dist/cli/build.js

@@ -33,6 +33,25 @@ export const buildId = '${buildId}';
         fs.mkdirSync(serverOutDir, { recursive: true });
         execSync(`npx esbuild server/index.ts --bundle --platform=node --format=esm --outfile=dist/server/index.mjs --external:ugly-app --external:ugly-app/*`, { stdio: 'inherit', cwd: process.cwd() });
     }
+    // Bundle task.ts if it exists (for cron/worker/GPU tasks)
+    const taskEntry = path.join(process.cwd(), 'server', 'task.ts');
+    if (fs.existsSync(taskEntry)) {
+        console.log('[Build] Bundling server/task.ts...');
+        const tasksOutDir = path.join(distDir, 'tasks');
+        fs.mkdirSync(tasksOutDir, { recursive: true });
+        // Externalize allowlisted packages — they'll be installed on the task host
+        const externals = [
+            'ugly-app', 'ugly-app/*',
+            'three', '@types/three', 'jsdom', 'gl',
+            '@ffmpeg-installer/ffmpeg', 'fluent-ffmpeg', 'sharp',
+            '@anthropic-ai/sdk', 'openai',
+            'zod', 'date-fns', 'lodash',
+            'mediasoup', 'mediasoup-client',
+        ];
+        const externalFlags = externals.map(e => `--external:${e}`).join(' ');
+        execSync(`npx esbuild server/task.ts --bundle --platform=node --format=esm --outfile=dist/tasks/task.js ${externalFlags}`, { stdio: 'inherit', cwd: process.cwd() });
+        console.log('[Build] Task bundle: dist/tasks/task.js');
+    }
     // Run tsc for typecheck
     console.log('[Build] Running tsc...');
     execSync('npx tsc --noEmit', { stdio: 'inherit', cwd: process.cwd() });

package/dist/cli/build.js.map

@@ -1 +1 @@
-{"version":3,"file":"build.js","sourceRoot":"","sources":["../../src/cli/build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,MAAM,UAAU,QAAQ;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAEnC,wBAAwB;IACxB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrE,MAAM,gBAAgB,GAAG;0BACD,OAAO;CAChC,CAAC;IAEA,4BAA4B;IAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;IAE3C,8BAA8B;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACvC,CAAC;IAED,iBAAiB;IACjB,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7C,QAAQ,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAErE,oFAAoF;IACpF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACnE,MAAM,oBAAoB,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAC9F,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClD,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,QAAQ,CACN,6IAA6I,EAC7I,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CACzC,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAEvE,OAAO,CAAC,GAAG,CAAC,2BAA2B,OAAO,GAAG,CAAC,CAAC;AACrD,CAAC"}
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../src/cli/build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,MAAM,UAAU,QAAQ;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAEnC,wBAAwB;IACxB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrE,MAAM,gBAAgB,GAAG;0BACD,OAAO;CAChC,CAAC;IAEA,4BAA4B;IAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;IAE3C,8BAA8B;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACvC,CAAC;IAED,iBAAiB;IACjB,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7C,QAAQ,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAErE,oFAAoF;IACpF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACnE,MAAM,oBAAoB,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAC9F,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClD,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,QAAQ,CACN,6IAA6I,EAC7I,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CACzC,CAAC;IACJ,CAAC;IAED,0DAA0D;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAChE,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,2EAA2E;QAC3E,MAAM,SAAS,GAAG;YAChB,UAAU,EAAE,YAAY;YACxB,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI;YACtC,0BAA0B,EAAE,eAAe,EAAE,OAAO;YACpD,mBAAmB,EAAE,QAAQ;YAC7B,KAAK,EAAE,UAAU,EAAE,QAAQ;YAC3B,WAAW,EAAE,kBAAkB;SAChC,CAAC;QACF,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtE,QAAQ,CACN,iGAAiG,aAAa,EAAE,EAChH,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CACzC,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;IACzD,CAAC;IAED,wBAAwB;IACxB,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAEvE,OAAO,CAAC,GAAG,CAAC,2BAA2B,OAAO,GAAG,CAAC,CAAC;AACrD,CAAC"}

package/dist/cli/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.1.240";
+export declare const CLI_VERSION = "0.1.241";
 //# sourceMappingURL=version.d.ts.map

package/dist/cli/version.js

@@ -1,3 +1,3 @@
 // Auto-generated by prebuild — do not edit manually
-export const CLI_VERSION = "0.1.240";
+export const CLI_VERSION = "0.1.241";
 //# sourceMappingURL=version.js.map

package/dist/worker/TaskContext.d.ts

@@ -0,0 +1,59 @@
+/**
+ * TaskContext — the execution environment for project task bundles.
+ *
+ * Every project's `task.js` exports an `execute(ctx, data)` function.
+ * The platform creates a TaskContext scoped to the project's own DB and R2,
+ * then calls execute(). The project never needs DB credentials or R2 keys
+ * — the platform provides them through this interface.
+ *
+ * ```typescript
+ * // server/task.ts (project source)
+ * import type { TaskContext } from 'ugly-app/worker';
+ *
+ * export async function execute(ctx: TaskContext, data: { taskName: string }) {
+ *   switch (data.taskName) {
+ *     case 'dailyCleanup':
+ *       const old = await ctx.db.find('todo', { done: true, updated: { $lt: daysAgo(30) } });
+ *       for (const doc of old) await ctx.db.deleteDoc('todo', doc._id);
+ *       break;
+ *   }
+ * }
+ * ```
+ */
+export interface TaskContext {
+    db: TaskDB;
+    r2: TaskStorage;
+    tempR2: TaskTempStorage;
+    taskId: string;
+    taskName: string;
+    projectId: string;
+    working(): void;
+    log(message: string, data?: Record<string, unknown>): void;
+}
+export interface TaskDB {
+    find(collection: string, query: Record<string, unknown>): Promise<Record<string, unknown>[]>;
+    getDoc(collection: string, id: string): Promise<Record<string, unknown> | null>;
+    setDoc(collection: string, doc: Record<string, unknown>): Promise<void>;
+    setDocFields(collection: string, id: string, fields: Record<string, unknown>): Promise<void>;
+    deleteDoc(collection: string, id: string): Promise<void>;
+    deleteMany(collection: string, ids: string[]): Promise<void>;
+    count(collection: string, query: Record<string, unknown>): Promise<number>;
+}
+export interface TaskStorage {
+    get(key: string): Promise<Buffer | null>;
+    getJSON<T = unknown>(key: string): Promise<T | null>;
+    put(key: string, data: Buffer | string, opts?: {
+        contentType?: string;
+    }): Promise<string>;
+    delete(key: string): Promise<void>;
+    list(prefix: string): Promise<string[]>;
+}
+export interface TaskTempStorage {
+    get(key: string): Promise<Buffer | null>;
+    put(key: string, data: Buffer): Promise<string>;
+}
+/**
+ * The function signature that every project's task.js must export.
+ */
+export type TaskExecuteFn = (ctx: TaskContext, data: Record<string, unknown>) => Promise<unknown>;
+//# sourceMappingURL=TaskContext.d.ts.map

package/dist/worker/TaskContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TaskContext.d.ts","sourceRoot":"","sources":["../../src/worker/TaskContext.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,WAAW;IAE1B,EAAE,EAAE,MAAM,CAAC;IAGX,EAAE,EAAE,WAAW,CAAC;IAGhB,MAAM,EAAE,eAAe,CAAC;IAGxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAGlB,OAAO,IAAI,IAAI,CAAC;IAGhB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5D;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7F,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAChF,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7F,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5E;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACrD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1F,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACjD;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,OAAO,CAAC,CAAC"}

package/dist/worker/TaskContext.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=TaskContext.js.map

package/dist/worker/TaskContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TaskContext.js","sourceRoot":"","sources":["../../src/worker/TaskContext.ts"],"names":[],"mappings":""}

package/dist/worker/TaskHost.d.ts

@@ -0,0 +1,74 @@
+import type { TaskDB, TaskStorage, TaskTempStorage } from './TaskContext.js';
+/**
+ * NPM packages that task bundles are allowed to install.
+ * Any package not on this list is rejected.
+ */
+export declare const ALLOWED_PACKAGES: readonly ["three", "@types/three", "jsdom", "gl", "@ffmpeg-installer/ffmpeg", "fluent-ffmpeg", "sharp", "@anthropic-ai/sdk", "openai", "zod", "date-fns", "lodash", "mediasoup", "mediasoup-client", "ugly-app"];
+/**
+ * Configuration for the task host.
+ */
+export interface TaskHostConfig {
+    /**
+     * Factory to create a scoped DB proxy for a project.
+     * The proxy restricts access to the project's own PostgreSQL user/database.
+     */
+    createDbProxy(projectId: string): TaskDB;
+    /**
+     * Factory to create a scoped R2 proxy for a project.
+     * Restricts access to the project's own R2 bucket.
+     */
+    createR2Proxy(projectId: string): TaskStorage;
+    /**
+     * Factory to create a temp R2 proxy for a project.
+     */
+    createTempR2Proxy(projectId: string): TaskTempStorage;
+    /**
+     * Fetch a task bundle from R2 by URL.
+     * Returns the JavaScript source code as a string.
+     */
+    fetchBundle(codeUrl: string): Promise<string>;
+    /** Working directory for task bundles. Default: os.tmpdir()/ugly-tasks/ */
+    workDir?: string;
+}
+/**
+ * TaskHost — loads project task.js bundles from R2, caches warm processes,
+ * and executes tasks with scoped DB/R2 access.
+ */
+export declare class TaskHost {
+    private config;
+    private cleanupTimer;
+    private baseWorkDir;
+    constructor(config: TaskHostConfig);
+    /**
+     * Execute a task using a cached or freshly loaded task bundle.
+     */
+    execute(opts: {
+        codeUrl: string;
+        projectId: string;
+        taskId: string;
+        taskName: string;
+        data?: Record<string, unknown>;
+        timeoutMs?: number;
+    }): Promise<unknown>;
+    /**
+     * Get a cached process for this code URL, or create one.
+     */
+    private getOrCreateProcess;
+    /**
+     * Install only allowlisted packages from a package.json.
+     */
+    private installAllowedPackages;
+    /**
+     * Evict idle processes (no invocation for IDLE_TIMEOUT_MS).
+     */
+    private cleanupIdle;
+    /**
+     * Invalidate a cached process (e.g., when buildId changes).
+     */
+    invalidate(codeUrl: string): void;
+    /**
+     * Shutdown — clean up all processes and timers.
+     */
+    shutdown(): Promise<void>;
+}
+//# sourceMappingURL=TaskHost.d.ts.map

package/dist/worker/TaskHost.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TaskHost.d.ts","sourceRoot":"","sources":["../../src/worker/TaskHost.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAe,MAAM,EAAE,WAAW,EAAE,eAAe,EAAiB,MAAM,kBAAkB,CAAC;AAIzG;;;GAGG;AACH,eAAO,MAAM,gBAAgB,kNAanB,CAAC;AAgBX;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAEzC;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,CAAC;IAE9C;;OAEG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,CAAC;IAEtD;;;OAGG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9C,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,YAAY,CAA+C;IACnE,OAAO,CAAC,WAAW,CAAS;gBAEhB,MAAM,EAAE,cAAc;IASlC;;OAEG;IACG,OAAO,CAAC,IAAI,EAAE;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,OAAO,CAAC;IAiCpB;;OAEG;YACW,kBAAkB;IA4ChC;;OAEG;YACW,sBAAsB;IA+BpC;;OAEG;IACH,OAAO,CAAC,WAAW;IAcnB;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAWjC;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAYhC"}

package/dist/worker/TaskHost.js

@@ -0,0 +1,187 @@
+import path from 'path';
+import fs from 'fs';
+import os from 'os';
+/* eslint-disable @typescript-eslint/no-explicit-any */
+/**
+ * NPM packages that task bundles are allowed to install.
+ * Any package not on this list is rejected.
+ */
+export const ALLOWED_PACKAGES = [
+    // Rendering
+    'three', '@types/three', 'jsdom', 'gl',
+    // Video/Audio
+    '@ffmpeg-installer/ffmpeg', 'fluent-ffmpeg', 'sharp',
+    // AI
+    '@anthropic-ai/sdk', 'openai',
+    // Data
+    'zod', 'date-fns', 'lodash',
+    // WebRTC
+    'mediasoup', 'mediasoup-client',
+    // Framework
+    'ugly-app',
+];
+const ALLOWED_SET = new Set(ALLOWED_PACKAGES);
+const processCache = new Map();
+const IDLE_TIMEOUT_MS = 15 * 60 * 1000; // 15 minutes
+/**
+ * TaskHost — loads project task.js bundles from R2, caches warm processes,
+ * and executes tasks with scoped DB/R2 access.
+ */
+export class TaskHost {
+    config;
+    cleanupTimer = null;
+    baseWorkDir;
+    constructor(config) {
+        this.config = config;
+        this.baseWorkDir = config.workDir ?? path.join(os.tmpdir(), 'ugly-tasks');
+        fs.mkdirSync(this.baseWorkDir, { recursive: true });
+        // Periodic cleanup of idle processes
+        this.cleanupTimer = setInterval(() => this.cleanupIdle(), 60_000);
+    }
+    /**
+     * Execute a task using a cached or freshly loaded task bundle.
+     */
+    async execute(opts) {
+        const { codeUrl, projectId, taskId, taskName, data = {} } = opts;
+        // Get or create warm process
+        const proc = await this.getOrCreateProcess(codeUrl);
+        proc.lastUsed = Date.now();
+        // Create scoped TaskContext
+        const ctx = {
+            db: this.config.createDbProxy(projectId),
+            r2: this.config.createR2Proxy(projectId),
+            tempR2: this.config.createTempR2Proxy(projectId),
+            taskId,
+            taskName,
+            projectId,
+            working: () => { },
+            log: (message, logData) => {
+                console.log(`[Task:${projectId}/${taskName}] ${message}`, logData ?? '');
+            },
+        };
+        // Execute with timeout
+        const timeoutMs = opts.timeoutMs ?? 300_000; // 5 min default
+        const result = await Promise.race([
+            proc.executeFn(ctx, { taskName, ...data }),
+            new Promise((_, reject) => setTimeout(() => reject(new Error(`Task ${taskName} timed out after ${timeoutMs}ms`)), timeoutMs)),
+        ]);
+        return result;
+    }
+    /**
+     * Get a cached process for this code URL, or create one.
+     */
+    async getOrCreateProcess(codeUrl) {
+        const cached = processCache.get(codeUrl);
+        if (cached)
+            return cached;
+        // Fetch bundle
+        const source = await this.config.fetchBundle(codeUrl);
+        // Create working directory for this bundle
+        const hash = codeUrl.replace(/[^a-zA-Z0-9]/g, '_').slice(-64);
+        const workDir = path.join(this.baseWorkDir, hash);
+        fs.mkdirSync(workDir, { recursive: true });
+        // Write bundle to disk
+        const bundlePath = path.join(workDir, 'task.mjs');
+        fs.writeFileSync(bundlePath, source, 'utf-8');
+        // Install allowlisted packages if package.json exists alongside bundle
+        const pkgJsonUrl = codeUrl.replace(/task\.js$/, 'package.json');
+        try {
+            const pkgSource = await this.config.fetchBundle(pkgJsonUrl);
+            const pkg = JSON.parse(pkgSource);
+            await this.installAllowedPackages(workDir, pkg);
+        }
+        catch {
+            // No package.json — bundle is self-contained
+        }
+        // Dynamic import the module
+        const mod = await import(bundlePath);
+        if (typeof mod.execute !== 'function') {
+            throw new Error(`Task bundle at ${codeUrl} does not export an execute() function`);
+        }
+        const proc = {
+            codeUrl,
+            executeFn: mod.execute,
+            lastUsed: Date.now(),
+            workDir,
+        };
+        processCache.set(codeUrl, proc);
+        console.log(`[TaskHost] Loaded bundle: ${codeUrl}`);
+        return proc;
+    }
+    /**
+     * Install only allowlisted packages from a package.json.
+     */
+    async installAllowedPackages(workDir, pkg) {
+        if (!pkg.dependencies)
+            return;
+        const filtered = {};
+        for (const [name, version] of Object.entries(pkg.dependencies)) {
+            if (ALLOWED_SET.has(name)) {
+                filtered[name] = version;
+            }
+            else {
+                console.warn(`[TaskHost] Package "${name}" not in allowlist — skipped`);
+            }
+        }
+        if (Object.keys(filtered).length === 0)
+            return;
+        // Write filtered package.json
+        fs.writeFileSync(path.join(workDir, 'package.json'), JSON.stringify({ dependencies: filtered }, null, 2));
+        // Install
+        const { execSync } = await import('child_process');
+        execSync('npm install --production --ignore-scripts', {
+            cwd: workDir,
+            stdio: 'pipe',
+            timeout: 120_000,
+        });
+        console.log(`[TaskHost] Installed ${Object.keys(filtered).length} allowlisted packages`);
+    }
+    /**
+     * Evict idle processes (no invocation for IDLE_TIMEOUT_MS).
+     */
+    cleanupIdle() {
+        const now = Date.now();
+        for (const [url, proc] of processCache) {
+            if (now - proc.lastUsed > IDLE_TIMEOUT_MS) {
+                processCache.delete(url);
+                // Clean up work directory
+                try {
+                    fs.rmSync(proc.workDir, { recursive: true, force: true });
+                }
+                catch { /* ignore */ }
+                console.log(`[TaskHost] Evicted idle process: ${url}`);
+            }
+        }
+    }
+    /**
+     * Invalidate a cached process (e.g., when buildId changes).
+     */
+    invalidate(codeUrl) {
+        const proc = processCache.get(codeUrl);
+        if (proc) {
+            processCache.delete(codeUrl);
+            try {
+                fs.rmSync(proc.workDir, { recursive: true, force: true });
+            }
+            catch { /* ignore */ }
+            console.log(`[TaskHost] Invalidated: ${codeUrl}`);
+        }
+    }
+    /**
+     * Shutdown — clean up all processes and timers.
+     */
+    async shutdown() {
+        if (this.cleanupTimer) {
+            clearInterval(this.cleanupTimer);
+            this.cleanupTimer = null;
+        }
+        for (const [url, proc] of processCache) {
+            processCache.delete(url);
+            try {
+                fs.rmSync(proc.workDir, { recursive: true, force: true });
+            }
+            catch { /* ignore */ }
+        }
+    }
+}
+//# sourceMappingURL=TaskHost.js.map

package/dist/worker/TaskHost.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TaskHost.js","sourceRoot":"","sources":["../../src/worker/TaskHost.ts"],"names":[],"mappings":"AACA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,IAAI,CAAC;AAGpB,uDAAuD;AAEvD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,YAAY;IACZ,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI;IACtC,cAAc;IACd,0BAA0B,EAAE,eAAe,EAAE,OAAO;IACpD,KAAK;IACL,mBAAmB,EAAE,QAAQ;IAC7B,OAAO;IACP,KAAK,EAAE,UAAU,EAAE,QAAQ;IAC3B,SAAS;IACT,WAAW,EAAE,kBAAkB;IAC/B,YAAY;IACZ,UAAU;CACF,CAAC;AAEX,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,gBAAgB,CAAC,CAAC;AAWtD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAyB,CAAC;AACtD,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa;AAiCrD;;;GAGG;AACH,MAAM,OAAO,QAAQ;IACX,MAAM,CAAiB;IACvB,YAAY,GAA0C,IAAI,CAAC;IAC3D,WAAW,CAAS;IAE5B,YAAY,MAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC;QAC1E,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpD,qCAAqC;QACrC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,IAOb;QACC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC;QAEjE,6BAA6B;QAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE3B,4BAA4B;QAC5B,MAAM,GAAG,GAAgB;YACvB,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC;YACxC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC;YACxC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC;YAChD,MAAM;YACN,QAAQ;YACR,SAAS;YACT,OAAO,EAAE,GAAG,EAAE,GAAiD,CAAC;YAChE,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;gBACxB,OAAO,CAAC,GAAG,CAAC,SAAS,SAAS,IAAI,QAAQ,KAAK,OAAO,EAAE,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;YAC3E,CAAC;SACF,CAAC;QAEF,uBAAuB;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,gBAAgB;QAC7D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAChC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CACxB,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,QAAQ,oBAAoB,SAAS,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAClG;SACF,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB,CAAC,OAAe;QAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,eAAe;QACf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAEtD,2CAA2C;QAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAClD,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE3C,uBAAuB;QACvB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAClD,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAE9C,uEAAuE;QACvE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAClC,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;QAC/C,CAAC;QAED,4BAA4B;QAC5B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAgC,CAAC;QACpE,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,kBAAkB,OAAO,wCAAwC,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,IAAI,GAAkB;YAC1B,OAAO;YACP,SAAS,EAAE,GAAG,CAAC,OAAO;YACtB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;YACpB,OAAO;SACR,CAAC;QAEF,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB,CAAC,OAAe,EAAE,GAA8C;QAClG,IAAI,CAAC,GAAG,CAAC,YAAY;YAAE,OAAO;QAE9B,MAAM,QAAQ,GAA2B,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/D,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,uBAAuB,IAAI,8BAA8B,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE/C,8BAA8B;QAC9B,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAClC,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CACpD,CAAC;QAEF,UAAU;QACV,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QACnD,QAAQ,CAAC,2CAA2C,EAAE;YACpD,GAAG,EAAE,OAAO;YACZ,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,uBAAuB,CAAC,CAAC;IAC3F,CAAC;IAED;;OAEG;IACK,WAAW;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC;YACvC,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG,eAAe,EAAE,CAAC;gBAC1C,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACzB,0BAA0B;gBAC1B,IAAI,CAAC;oBACH,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5D,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBACxB,OAAO,CAAC,GAAG,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAAe;QACxB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,IAAI,EAAE,CAAC;YACT,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACjC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC;YACvC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;CACF"}

package/dist/worker/index.d.ts

@@ -0,0 +1,3 @@
+export type { TaskContext, TaskDB, TaskStorage, TaskTempStorage, TaskExecuteFn, } from './TaskContext.js';
+export { TaskHost, ALLOWED_PACKAGES, type TaskHostConfig, } from './TaskHost.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/worker/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/worker/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,WAAW,EACX,MAAM,EACN,WAAW,EACX,eAAe,EACf,aAAa,GACd,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,QAAQ,EACR,gBAAgB,EAChB,KAAK,cAAc,GACpB,MAAM,eAAe,CAAC"}

package/dist/worker/index.js

@@ -0,0 +1,2 @@
+export { TaskHost, ALLOWED_PACKAGES, } from './TaskHost.js';
+//# sourceMappingURL=index.js.map

package/dist/worker/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/worker/index.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,QAAQ,EACR,gBAAgB,GAEjB,MAAM,eAAe,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ugly-app",
-  "version": "0.1.240",
+  "version": "0.1.241",
   "type": "module",
   "main": "./dist/server/index.js",
   "exports": {
@@ -16,6 +16,7 @@
       "default": "./dist/webrtc/index.js"
     },
     "./webrtc/server": "./dist/webrtc/server/index.js",
+    "./worker": "./dist/worker/index.js",
     "./vite": "./dist/vite/index.js",
     "./eslint": "./dist/eslint/index.js"
   },

package/src/cli/build.ts

@@ -44,6 +44,29 @@ export const buildId = '${buildId}';
     );
   }
 
+  // Bundle task.ts if it exists (for cron/worker/GPU tasks)
+  const taskEntry = path.join(process.cwd(), 'server', 'task.ts');
+  if (fs.existsSync(taskEntry)) {
+    console.log('[Build] Bundling server/task.ts...');
+    const tasksOutDir = path.join(distDir, 'tasks');
+    fs.mkdirSync(tasksOutDir, { recursive: true });
+    // Externalize allowlisted packages — they'll be installed on the task host
+    const externals = [
+      'ugly-app', 'ugly-app/*',
+      'three', '@types/three', 'jsdom', 'gl',
+      '@ffmpeg-installer/ffmpeg', 'fluent-ffmpeg', 'sharp',
+      '@anthropic-ai/sdk', 'openai',
+      'zod', 'date-fns', 'lodash',
+      'mediasoup', 'mediasoup-client',
+    ];
+    const externalFlags = externals.map(e => `--external:${e}`).join(' ');
+    execSync(
+      `npx esbuild server/task.ts --bundle --platform=node --format=esm --outfile=dist/tasks/task.js ${externalFlags}`,
+      { stdio: 'inherit', cwd: process.cwd() },
+    );
+    console.log('[Build] Task bundle: dist/tasks/task.js');
+  }
+
   // Run tsc for typecheck
   console.log('[Build] Running tsc...');
   execSync('npx tsc --noEmit', { stdio: 'inherit', cwd: process.cwd() });

package/src/cli/version.ts

@@ -1,2 +1,2 @@
 // Auto-generated by prebuild — do not edit manually
-export const CLI_VERSION = "0.1.240";
+export const CLI_VERSION = "0.1.241";

package/src/worker/TaskContext.ts

@@ -0,0 +1,74 @@
+/**
+ * TaskContext — the execution environment for project task bundles.
+ *
+ * Every project's `task.js` exports an `execute(ctx, data)` function.
+ * The platform creates a TaskContext scoped to the project's own DB and R2,
+ * then calls execute(). The project never needs DB credentials or R2 keys
+ * — the platform provides them through this interface.
+ *
+ * ```typescript
+ * // server/task.ts (project source)
+ * import type { TaskContext } from 'ugly-app/worker';
+ *
+ * export async function execute(ctx: TaskContext, data: { taskName: string }) {
+ *   switch (data.taskName) {
+ *     case 'dailyCleanup':
+ *       const old = await ctx.db.find('todo', { done: true, updated: { $lt: daysAgo(30) } });
+ *       for (const doc of old) await ctx.db.deleteDoc('todo', doc._id);
+ *       break;
+ *   }
+ * }
+ * ```
+ */
+export interface TaskContext {
+  // ─── Database — project's isolated PostgreSQL ────────────────────────
+  db: TaskDB;
+
+  // ─── R2 storage — project's own bucket (ugly-{projectId}) ───────────
+  r2: TaskStorage;
+
+  // ─── Temp R2 — for large intermediate blobs (auto-cleaned) ──────────
+  tempR2: TaskTempStorage;
+
+  // ─── Task metadata ──────────────────────────────────────────────────
+  taskId: string;
+  taskName: string;
+  projectId: string;
+
+  // ─── For long-running tasks: extend ack deadline ────────────────────
+  working(): void;
+
+  // ─── Logging ────────────────────────────────────────────────────────
+  log(message: string, data?: Record<string, unknown>): void;
+}
+
+export interface TaskDB {
+  find(collection: string, query: Record<string, unknown>): Promise<Record<string, unknown>[]>;
+  getDoc(collection: string, id: string): Promise<Record<string, unknown> | null>;
+  setDoc(collection: string, doc: Record<string, unknown>): Promise<void>;
+  setDocFields(collection: string, id: string, fields: Record<string, unknown>): Promise<void>;
+  deleteDoc(collection: string, id: string): Promise<void>;
+  deleteMany(collection: string, ids: string[]): Promise<void>;
+  count(collection: string, query: Record<string, unknown>): Promise<number>;
+}
+
+export interface TaskStorage {
+  get(key: string): Promise<Buffer | null>;
+  getJSON<T = unknown>(key: string): Promise<T | null>;
+  put(key: string, data: Buffer | string, opts?: { contentType?: string }): Promise<string>;
+  delete(key: string): Promise<void>;
+  list(prefix: string): Promise<string[]>;
+}
+
+export interface TaskTempStorage {
+  get(key: string): Promise<Buffer | null>;
+  put(key: string, data: Buffer): Promise<string>;
+}
+
+/**
+ * The function signature that every project's task.js must export.
+ */
+export type TaskExecuteFn = (
+  ctx: TaskContext,
+  data: Record<string, unknown>,
+) => Promise<unknown>;

package/src/worker/TaskHost.ts

@@ -0,0 +1,261 @@
+import { createRequire } from 'module';
+import path from 'path';
+import fs from 'fs';
+import os from 'os';
+import type { TaskContext, TaskDB, TaskStorage, TaskTempStorage, TaskExecuteFn } from './TaskContext.js';
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+/**
+ * NPM packages that task bundles are allowed to install.
+ * Any package not on this list is rejected.
+ */
+export const ALLOWED_PACKAGES = [
+  // Rendering
+  'three', '@types/three', 'jsdom', 'gl',
+  // Video/Audio
+  '@ffmpeg-installer/ffmpeg', 'fluent-ffmpeg', 'sharp',
+  // AI
+  '@anthropic-ai/sdk', 'openai',
+  // Data
+  'zod', 'date-fns', 'lodash',
+  // WebRTC
+  'mediasoup', 'mediasoup-client',
+  // Framework
+  'ugly-app',
+] as const;
+
+const ALLOWED_SET = new Set<string>(ALLOWED_PACKAGES);
+
+// ─── Warm process cache ────────────────────────────────────────────────────
+
+interface CachedProcess {
+  codeUrl: string;
+  executeFn: TaskExecuteFn;
+  lastUsed: number;
+  workDir: string;
+}
+
+const processCache = new Map<string, CachedProcess>();
+const IDLE_TIMEOUT_MS = 15 * 60 * 1000; // 15 minutes
+
+/**
+ * Configuration for the task host.
+ */
+export interface TaskHostConfig {
+  /**
+   * Factory to create a scoped DB proxy for a project.
+   * The proxy restricts access to the project's own PostgreSQL user/database.
+   */
+  createDbProxy(projectId: string): TaskDB;
+
+  /**
+   * Factory to create a scoped R2 proxy for a project.
+   * Restricts access to the project's own R2 bucket.
+   */
+  createR2Proxy(projectId: string): TaskStorage;
+
+  /**
+   * Factory to create a temp R2 proxy for a project.
+   */
+  createTempR2Proxy(projectId: string): TaskTempStorage;
+
+  /**
+   * Fetch a task bundle from R2 by URL.
+   * Returns the JavaScript source code as a string.
+   */
+  fetchBundle(codeUrl: string): Promise<string>;
+
+  /** Working directory for task bundles. Default: os.tmpdir()/ugly-tasks/ */
+  workDir?: string;
+}
+
+/**
+ * TaskHost — loads project task.js bundles from R2, caches warm processes,
+ * and executes tasks with scoped DB/R2 access.
+ */
+export class TaskHost {
+  private config: TaskHostConfig;
+  private cleanupTimer: ReturnType<typeof setInterval> | null = null;
+  private baseWorkDir: string;
+
+  constructor(config: TaskHostConfig) {
+    this.config = config;
+    this.baseWorkDir = config.workDir ?? path.join(os.tmpdir(), 'ugly-tasks');
+    fs.mkdirSync(this.baseWorkDir, { recursive: true });
+
+    // Periodic cleanup of idle processes
+    this.cleanupTimer = setInterval(() => this.cleanupIdle(), 60_000);
+  }
+
+  /**
+   * Execute a task using a cached or freshly loaded task bundle.
+   */
+  async execute(opts: {
+    codeUrl: string;
+    projectId: string;
+    taskId: string;
+    taskName: string;
+    data?: Record<string, unknown>;
+    timeoutMs?: number;
+  }): Promise<unknown> {
+    const { codeUrl, projectId, taskId, taskName, data = {} } = opts;
+
+    // Get or create warm process
+    const proc = await this.getOrCreateProcess(codeUrl);
+    proc.lastUsed = Date.now();
+
+    // Create scoped TaskContext
+    const ctx: TaskContext = {
+      db: this.config.createDbProxy(projectId),
+      r2: this.config.createR2Proxy(projectId),
+      tempR2: this.config.createTempR2Proxy(projectId),
+      taskId,
+      taskName,
+      projectId,
+      working: () => { /* extend deadline — platform manages this */ },
+      log: (message, logData) => {
+        console.log(`[Task:${projectId}/${taskName}] ${message}`, logData ?? '');
+      },
+    };
+
+    // Execute with timeout
+    const timeoutMs = opts.timeoutMs ?? 300_000; // 5 min default
+    const result = await Promise.race([
+      proc.executeFn(ctx, { taskName, ...data }),
+      new Promise((_, reject) =>
+        setTimeout(() => reject(new Error(`Task ${taskName} timed out after ${timeoutMs}ms`)), timeoutMs),
+      ),
+    ]);
+
+    return result;
+  }
+
+  /**
+   * Get a cached process for this code URL, or create one.
+   */
+  private async getOrCreateProcess(codeUrl: string): Promise<CachedProcess> {
+    const cached = processCache.get(codeUrl);
+    if (cached) return cached;
+
+    // Fetch bundle
+    const source = await this.config.fetchBundle(codeUrl);
+
+    // Create working directory for this bundle
+    const hash = codeUrl.replace(/[^a-zA-Z0-9]/g, '_').slice(-64);
+    const workDir = path.join(this.baseWorkDir, hash);
+    fs.mkdirSync(workDir, { recursive: true });
+
+    // Write bundle to disk
+    const bundlePath = path.join(workDir, 'task.mjs');
+    fs.writeFileSync(bundlePath, source, 'utf-8');
+
+    // Install allowlisted packages if package.json exists alongside bundle
+    const pkgJsonUrl = codeUrl.replace(/task\.js$/, 'package.json');
+    try {
+      const pkgSource = await this.config.fetchBundle(pkgJsonUrl);
+      const pkg = JSON.parse(pkgSource);
+      await this.installAllowedPackages(workDir, pkg);
+    } catch {
+      // No package.json — bundle is self-contained
+    }
+
+    // Dynamic import the module
+    const mod = await import(bundlePath) as { execute?: TaskExecuteFn };
+    if (typeof mod.execute !== 'function') {
+      throw new Error(`Task bundle at ${codeUrl} does not export an execute() function`);
+    }
+
+    const proc: CachedProcess = {
+      codeUrl,
+      executeFn: mod.execute,
+      lastUsed: Date.now(),
+      workDir,
+    };
+
+    processCache.set(codeUrl, proc);
+    console.log(`[TaskHost] Loaded bundle: ${codeUrl}`);
+    return proc;
+  }
+
+  /**
+   * Install only allowlisted packages from a package.json.
+   */
+  private async installAllowedPackages(workDir: string, pkg: { dependencies?: Record<string, string> }): Promise<void> {
+    if (!pkg.dependencies) return;
+
+    const filtered: Record<string, string> = {};
+    for (const [name, version] of Object.entries(pkg.dependencies)) {
+      if (ALLOWED_SET.has(name)) {
+        filtered[name] = version;
+      } else {
+        console.warn(`[TaskHost] Package "${name}" not in allowlist — skipped`);
+      }
+    }
+
+    if (Object.keys(filtered).length === 0) return;
+
+    // Write filtered package.json
+    fs.writeFileSync(
+      path.join(workDir, 'package.json'),
+      JSON.stringify({ dependencies: filtered }, null, 2),
+    );
+
+    // Install
+    const { execSync } = await import('child_process');
+    execSync('npm install --production --ignore-scripts', {
+      cwd: workDir,
+      stdio: 'pipe',
+      timeout: 120_000,
+    });
+
+    console.log(`[TaskHost] Installed ${Object.keys(filtered).length} allowlisted packages`);
+  }
+
+  /**
+   * Evict idle processes (no invocation for IDLE_TIMEOUT_MS).
+   */
+  private cleanupIdle(): void {
+    const now = Date.now();
+    for (const [url, proc] of processCache) {
+      if (now - proc.lastUsed > IDLE_TIMEOUT_MS) {
+        processCache.delete(url);
+        // Clean up work directory
+        try {
+          fs.rmSync(proc.workDir, { recursive: true, force: true });
+        } catch { /* ignore */ }
+        console.log(`[TaskHost] Evicted idle process: ${url}`);
+      }
+    }
+  }
+
+  /**
+   * Invalidate a cached process (e.g., when buildId changes).
+   */
+  invalidate(codeUrl: string): void {
+    const proc = processCache.get(codeUrl);
+    if (proc) {
+      processCache.delete(codeUrl);
+      try {
+        fs.rmSync(proc.workDir, { recursive: true, force: true });
+      } catch { /* ignore */ }
+      console.log(`[TaskHost] Invalidated: ${codeUrl}`);
+    }
+  }
+
+  /**
+   * Shutdown — clean up all processes and timers.
+   */
+  async shutdown(): Promise<void> {
+    if (this.cleanupTimer) {
+      clearInterval(this.cleanupTimer);
+      this.cleanupTimer = null;
+    }
+    for (const [url, proc] of processCache) {
+      processCache.delete(url);
+      try {
+        fs.rmSync(proc.workDir, { recursive: true, force: true });
+      } catch { /* ignore */ }
+    }
+  }
+}

package/src/worker/index.ts

@@ -0,0 +1,13 @@
+export type {
+  TaskContext,
+  TaskDB,
+  TaskStorage,
+  TaskTempStorage,
+  TaskExecuteFn,
+} from './TaskContext.js';
+
+export {
+  TaskHost,
+  ALLOWED_PACKAGES,
+  type TaskHostConfig,
+} from './TaskHost.js';