workspai 0.74.0 → 0.75.1

package/dist/{chunk-3WHE7V4M.js → chunk-NLRZFIC6.js}

@@ -1,4 +1,4 @@
-import {a}from'./chunk-GR6442P7.js';import {a as a$1}from'./chunk-AFIFZTOY.js';import {t}from'./chunk-ODK4LCEL.js';import {k as k$1,t as t$1,q as q$1,w}from'./chunk-VQZ5PI5J.js';import z from'crypto';import Y from'os';import l from'path';import {once}from'events';import {createWriteStream,createReadStream}from'fs';import*as Q from'readline';import {Transform,Readable}from'stream';import {pipeline}from'stream/promises';import {lookup}from'dns/promises';import T from'net';import p from'fs-extra';import*as ee from'yauzl';import*as te from'yazl';var qe="workspai-workspace-archive-capabilities-v1",q="workspai-workspace-archive-manifest-v1",k="workspai-workspace-archive-operation-result-v1";var K="contracts/workspace-archive-manifest.v1.json",Z="contracts/workspace-archive-operation-result.v1.json",Ke={archiveCompression:{signature:"--archive-compression <mode>",description:"Archive compression: store (default) or deflate",appliesTo:["export"]},maxDownloadSize:{signature:"--max-download-size <size>",description:"Maximum remote archive download size (secure default: 5gb)",appliesTo:["inspect","verify","doctor","hydrate","import"]},maxExpandedSize:{signature:"--max-expanded-size <size>",description:"Maximum expanded archive payload size (secure default: 20gb)",appliesTo:["inspect","verify","doctor","hydrate","import"]},downloadTimeoutMs:{signature:"--download-timeout-ms <ms>",description:"Remote archive download timeout in milliseconds; 0 disables it",appliesTo:["inspect","verify","doctor","hydrate","import"]},allowPrivateNetwork:{signature:"--allow-private-network",description:"Allow archive downloads from loopback/private networks (unsafe for untrusted input)",appliesTo:["inspect","verify","doctor","hydrate","import"]}};var A=".workspai/archive-manifest.json",R=".rapidkit/archive-manifest.json",de="workspai.workspace.archive",ye=300*1e3,ve=5*1024*1024*1024,we=20*1024*1024*1024,J=2e5,ge=5*1024*1024*1024,ke=1e3,M=5,Ee=64*1024*1024;function Ae(r){let t=r.toLowerCase().split("%")[0];if(T.isIPv4(t)){let e=t.split(".").map(Number);return e[0]===0||e[0]===10||e[0]===127||e[0]===169&&e[1]===254||e[0]===172&&e[1]>=16&&e[1]<=31||e[0]===192&&e[1]===168||e[0]===100&&e[1]>=64&&e[1]<=127||e[0]>=224}return T.isIPv6(t)?t==="::"||t==="::1"||t.startsWith("fc")||t.startsWith("fd")||/^fe[89ab]/.test(t)||t.startsWith("ff")||t.startsWith("::ffff:127.")||t.startsWith("::ffff:10.")||t.startsWith("::ffff:192.168."):true}async function X(r,t){let e=new URL(r);if(e.protocol!=="https:"&&e.protocol!=="http:")throw new Error(`Workspace archive URL protocol is not supported: ${e.protocol}`);if(e.protocol!=="https:"&&!t)throw new Error("Remote workspace archives require HTTPS unless private-network access is explicitly enabled.");if(e.username||e.password)throw new Error("Workspace archive URL must not contain embedded credentials.");if(t)return e;let i=e.hostname.replace(/^\[|\]$/g,"").toLowerCase();if(i==="localhost"||i.endsWith(".localhost"))throw new Error("Workspace archive URL resolves to a private or local network address.");let a=T.isIP(i)?[{address:i}]:await lookup(i,{all:true,verbatim:true});if(a.length===0||a.some(({address:s})=>Ae(s)))throw new Error("Workspace archive URL resolves to a private or local network address.");return e}async function Pe(r,t,e){let i=await X(r,e);for(let a=0;a<=M;a+=1){let s=await fetch(i,{signal:t,redirect:"manual",credentials:"omit"});if(![301,302,303,307,308].includes(s.status))return s;let n=s.headers.get("location");if(await s.body?.cancel(),!n)throw new Error("Workspace archive redirect is missing a Location header.");if(a===M)throw new Error(`Workspace archive download exceeded ${M} redirects.`);i=await X(new URL(n,i).href,e);}throw new Error("Workspace archive redirect policy failed.")}var We=new Set(["__pycache__",".venv","venv","node_modules",".git","dist","build","target",".pytest_cache",".mypy_cache",".ruff_cache","htmlcov",".next",".turbo",".cache"]),be=new Set([".DS_Store","Thumbs.db",".coverage","npm-debug.log","yarn-error.log","pnpm-debug.log","workspace-link.local.json","imported-projects.json","workspace-registry.v1.json"]),Se=[/^\.env$/i,/^\.env\.(?!example$|sample$|template$).+/i,/^.*\.pem$/i,/^.*\.key$/i,/^id_rsa$/i,/^id_ed25519$/i];function _(r){return r.replace(/\\/g,"/")}function re(r){return r.trim().replace(/\.workspai-archive\.zip$/i,"").replace(/\.rapidkit-archive\.zip$/i,"").replace(/\.zip$/i,"").trim().toLowerCase().replace(/[^a-z0-9._-]+/g,"-").replace(/-+/g,"-").replace(/^[-_.]+|[-_.]+$/g,"").slice(0,64)||"imported-workspace"}function ie(r){let t=_(r).trim();if(!t||t.startsWith("/")||t.startsWith("~")||/^[a-zA-Z]:\//.test(t)||t.includes("\0"))return  false;let e=t.split("/").filter(Boolean);return e.length>0&&!e.some(i=>i===".."||i===".")}function ae(r){if(!ie(r))throw new Error(`Archive contains an unsafe path: ${r}`)}function Re(r,t){let e=l.relative(t,r);return e===""||!!e&&!e.startsWith("..")&&!l.isAbsolute(e)}function _e(r,t$1){let e=_(r),i=e.split("/").filter(Boolean);if(i.some((n,o)=>(n===".workspai"||n===".rapidkit")&&["cache","reports"].includes(i[o+1]||""))||i.some(n=>We.has(n)||a(n)))return  true;let s=i[i.length-1]||"";return e===t.workspaceContract||e===".rapidkit/workspace.contract.json"||be.has(s)||/\.(?:workspai|rapidkit)-archive\.zip$/i.test(s)||!t$1?.includeEnv&&Se.some(n=>n.test(s))?true:s.endsWith(".pyc")||s.endsWith(".log")}async function Ce(r){for(let t of [l.join(r,".workspai","workspace.contract.json"),l.join(r,".rapidkit","workspace.contract.json")])if(await p.pathExists(t))try{return await p.readJson(t)}catch(e){throw new Error(`Workspace contract could not be inspected safely for archive portability: ${t}: ${e instanceof Error?e.message:String(e)}`)}return null}function xe(r){return (r?.projects??[]).filter(t=>typeof t.externalPath=="string"||typeof t.relativePath=="string"&&t.relativePath.startsWith("external/")).map(t=>({name:t.slug||t.relativePath||"external-project",relationship:["adopted","linked","imported","managed","restored"].includes(String(t.relationship))?t.relationship:"adopted",included:false,requiredAction:"relink"})).sort((t,e)=>t.name.localeCompare(e.name))}function Oe(r){if(r)return {...r,workspace:{...r.workspace},projects:r.projects.filter(t=>typeof t.externalPath!="string"&&!t.relativePath.startsWith("external/")).map(({externalPath:t,...e})=>({...e,modules:[...e.modules],ports:e.ports.map(i=>({...i})),contracts:{owns:[...e.contracts.owns],apis:e.contracts.apis.map(i=>({...i})),publishes:[...e.contracts.publishes],consumes:[...e.contracts.consumes],dependsOn:[...e.contracts.dependsOn],env:[...e.contracts.env]}}))}}async function*se(r,t,e){let i=(await p.readdir(t,{withFileTypes:true})).sort((a,s)=>a.name.localeCompare(s.name));for(let a of i){let s=l.join(t,a.name),n=_(l.relative(r,s));if(!(!n||_e(n,e))){if(a.isDirectory()){yield*se(r,s,e);continue}a.isFile()&&(yield {relativePath:n,fullPath:s});}}}async function ze(r){for(let t of t$1(r,"workspace.json"))try{let e=await p.readJson(t);if(typeof e.workspace_name=="string"&&e.workspace_name.trim())return e.workspace_name.trim();if(typeof e.name=="string"&&e.name.trim())return e.name.trim()}catch{}return l.basename(l.resolve(r))}async function Ne(r){let t=await p.stat(r.fullPath),e=z.createHash("sha256"),i=0;for await(let s of createReadStream(r.fullPath)){let n=Buffer.isBuffer(s)?s:Buffer.from(s);i+=n.length,e.update(n);}let a=await p.stat(r.fullPath);if(t.size!==a.size||t.mtimeMs!==a.mtimeMs||i!==a.size)throw new Error(`Workspace file changed while preparing archive: ${r.relativePath}`);return {...r,size:i,mtimeMs:a.mtimeMs,sha256:e.digest("hex")}}async function E(r,t){r.write(t)||await once(r,"drain");}async function ne(r){await new Promise((t,e)=>{r.once("error",e),r.end(t);});}async function*O(r){let t=Q.createInterface({input:createReadStream(r),crlfDelay:1/0});for await(let e of t){let i=e.trim();i&&(yield JSON.parse(i));}}async function Me(r){let t=createWriteStream(r.manifestPath,{flags:"wx"});try{await E(t,`{
+import {a}from'./chunk-GR6442P7.js';import {a as a$1}from'./chunk-AFIFZTOY.js';import {k as k$1,t as t$1,q as q$1,w}from'./chunk-VQZ5PI5J.js';import {t}from'./chunk-ODK4LCEL.js';import z from'crypto';import Y from'os';import l from'path';import {once}from'events';import {createWriteStream,createReadStream}from'fs';import*as Q from'readline';import {Transform,Readable}from'stream';import {pipeline}from'stream/promises';import {lookup}from'dns/promises';import T from'net';import p from'fs-extra';import*as ee from'yauzl';import*as te from'yazl';var qe="workspai-workspace-archive-capabilities-v1",q="workspai-workspace-archive-manifest-v1",k="workspai-workspace-archive-operation-result-v1";var K="contracts/workspace-archive-manifest.v1.json",Z="contracts/workspace-archive-operation-result.v1.json",Ke={archiveCompression:{signature:"--archive-compression <mode>",description:"Archive compression: store (default) or deflate",appliesTo:["export"]},maxDownloadSize:{signature:"--max-download-size <size>",description:"Maximum remote archive download size (secure default: 5gb)",appliesTo:["inspect","verify","doctor","hydrate","import"]},maxExpandedSize:{signature:"--max-expanded-size <size>",description:"Maximum expanded archive payload size (secure default: 20gb)",appliesTo:["inspect","verify","doctor","hydrate","import"]},downloadTimeoutMs:{signature:"--download-timeout-ms <ms>",description:"Remote archive download timeout in milliseconds; 0 disables it",appliesTo:["inspect","verify","doctor","hydrate","import"]},allowPrivateNetwork:{signature:"--allow-private-network",description:"Allow archive downloads from loopback/private networks (unsafe for untrusted input)",appliesTo:["inspect","verify","doctor","hydrate","import"]}};var A=".workspai/archive-manifest.json",R=".rapidkit/archive-manifest.json",de="workspai.workspace.archive",ye=300*1e3,ve=5*1024*1024*1024,we=20*1024*1024*1024,J=2e5,ge=5*1024*1024*1024,ke=1e3,M=5,Ee=64*1024*1024;function Ae(r){let t=r.toLowerCase().split("%")[0];if(T.isIPv4(t)){let e=t.split(".").map(Number);return e[0]===0||e[0]===10||e[0]===127||e[0]===169&&e[1]===254||e[0]===172&&e[1]>=16&&e[1]<=31||e[0]===192&&e[1]===168||e[0]===100&&e[1]>=64&&e[1]<=127||e[0]>=224}return T.isIPv6(t)?t==="::"||t==="::1"||t.startsWith("fc")||t.startsWith("fd")||/^fe[89ab]/.test(t)||t.startsWith("ff")||t.startsWith("::ffff:127.")||t.startsWith("::ffff:10.")||t.startsWith("::ffff:192.168."):true}async function X(r,t){let e=new URL(r);if(e.protocol!=="https:"&&e.protocol!=="http:")throw new Error(`Workspace archive URL protocol is not supported: ${e.protocol}`);if(e.protocol!=="https:"&&!t)throw new Error("Remote workspace archives require HTTPS unless private-network access is explicitly enabled.");if(e.username||e.password)throw new Error("Workspace archive URL must not contain embedded credentials.");if(t)return e;let i=e.hostname.replace(/^\[|\]$/g,"").toLowerCase();if(i==="localhost"||i.endsWith(".localhost"))throw new Error("Workspace archive URL resolves to a private or local network address.");let a=T.isIP(i)?[{address:i}]:await lookup(i,{all:true,verbatim:true});if(a.length===0||a.some(({address:s})=>Ae(s)))throw new Error("Workspace archive URL resolves to a private or local network address.");return e}async function Pe(r,t,e){let i=await X(r,e);for(let a=0;a<=M;a+=1){let s=await fetch(i,{signal:t,redirect:"manual",credentials:"omit"});if(![301,302,303,307,308].includes(s.status))return s;let n=s.headers.get("location");if(await s.body?.cancel(),!n)throw new Error("Workspace archive redirect is missing a Location header.");if(a===M)throw new Error(`Workspace archive download exceeded ${M} redirects.`);i=await X(new URL(n,i).href,e);}throw new Error("Workspace archive redirect policy failed.")}var We=new Set(["__pycache__",".venv","venv","node_modules",".git","dist","build","target",".pytest_cache",".mypy_cache",".ruff_cache","htmlcov",".next",".turbo",".cache"]),be=new Set([".DS_Store","Thumbs.db",".coverage","npm-debug.log","yarn-error.log","pnpm-debug.log","workspace-link.local.json","imported-projects.json","workspace-registry.v1.json"]),Se=[/^\.env$/i,/^\.env\.(?!example$|sample$|template$).+/i,/^.*\.pem$/i,/^.*\.key$/i,/^id_rsa$/i,/^id_ed25519$/i];function _(r){return r.replace(/\\/g,"/")}function re(r){return r.trim().replace(/\.workspai-archive\.zip$/i,"").replace(/\.rapidkit-archive\.zip$/i,"").replace(/\.zip$/i,"").trim().toLowerCase().replace(/[^a-z0-9._-]+/g,"-").replace(/-+/g,"-").replace(/^[-_.]+|[-_.]+$/g,"").slice(0,64)||"imported-workspace"}function ie(r){let t=_(r).trim();if(!t||t.startsWith("/")||t.startsWith("~")||/^[a-zA-Z]:\//.test(t)||t.includes("\0"))return  false;let e=t.split("/").filter(Boolean);return e.length>0&&!e.some(i=>i===".."||i===".")}function ae(r){if(!ie(r))throw new Error(`Archive contains an unsafe path: ${r}`)}function Re(r,t){let e=l.relative(t,r);return e===""||!!e&&!e.startsWith("..")&&!l.isAbsolute(e)}function _e(r,t$1){let e=_(r),i=e.split("/").filter(Boolean);if(i.some((n,o)=>(n===".workspai"||n===".rapidkit")&&["cache","reports"].includes(i[o+1]||""))||i.some(n=>We.has(n)||a(n)))return  true;let s=i[i.length-1]||"";return e===t.workspaceContract||e===".rapidkit/workspace.contract.json"||be.has(s)||/\.(?:workspai|rapidkit)-archive\.zip$/i.test(s)||!t$1?.includeEnv&&Se.some(n=>n.test(s))?true:s.endsWith(".pyc")||s.endsWith(".log")}async function Ce(r){for(let t of [l.join(r,".workspai","workspace.contract.json"),l.join(r,".rapidkit","workspace.contract.json")])if(await p.pathExists(t))try{return await p.readJson(t)}catch(e){throw new Error(`Workspace contract could not be inspected safely for archive portability: ${t}: ${e instanceof Error?e.message:String(e)}`)}return null}function xe(r){return (r?.projects??[]).filter(t=>typeof t.externalPath=="string"||typeof t.relativePath=="string"&&t.relativePath.startsWith("external/")).map(t=>({name:t.slug||t.relativePath||"external-project",relationship:["adopted","linked","imported","managed","restored"].includes(String(t.relationship))?t.relationship:"adopted",included:false,requiredAction:"relink"})).sort((t,e)=>t.name.localeCompare(e.name))}function Oe(r){if(r)return {...r,workspace:{...r.workspace},projects:r.projects.filter(t=>typeof t.externalPath!="string"&&!t.relativePath.startsWith("external/")).map(({externalPath:t,...e})=>({...e,modules:[...e.modules],ports:e.ports.map(i=>({...i})),contracts:{owns:[...e.contracts.owns],apis:e.contracts.apis.map(i=>({...i})),publishes:[...e.contracts.publishes],consumes:[...e.contracts.consumes],dependsOn:[...e.contracts.dependsOn],env:[...e.contracts.env]}}))}}async function*se(r,t,e){let i=(await p.readdir(t,{withFileTypes:true})).sort((a,s)=>a.name.localeCompare(s.name));for(let a of i){let s=l.join(t,a.name),n=_(l.relative(r,s));if(!(!n||_e(n,e))){if(a.isDirectory()){yield*se(r,s,e);continue}a.isFile()&&(yield {relativePath:n,fullPath:s});}}}async function ze(r){for(let t of t$1(r,"workspace.json"))try{let e=await p.readJson(t);if(typeof e.workspace_name=="string"&&e.workspace_name.trim())return e.workspace_name.trim();if(typeof e.name=="string"&&e.name.trim())return e.name.trim()}catch{}return l.basename(l.resolve(r))}async function Ne(r){let t=await p.stat(r.fullPath),e=z.createHash("sha256"),i=0;for await(let s of createReadStream(r.fullPath)){let n=Buffer.isBuffer(s)?s:Buffer.from(s);i+=n.length,e.update(n);}let a=await p.stat(r.fullPath);if(t.size!==a.size||t.mtimeMs!==a.mtimeMs||i!==a.size)throw new Error(`Workspace file changed while preparing archive: ${r.relativePath}`);return {...r,size:i,mtimeMs:a.mtimeMs,sha256:e.digest("hex")}}async function E(r,t){r.write(t)||await once(r,"drain");}async function ne(r){await new Promise((t,e)=>{r.once("error",e),r.end(t);});}async function*O(r){let t=Q.createInterface({input:createReadStream(r),crlfDelay:1/0});for await(let e of t){let i=e.trim();i&&(yield JSON.parse(i));}}async function Me(r){let t=createWriteStream(r.manifestPath,{flags:"wx"});try{await E(t,`{
 `);for(let[i,a]of Object.entries(r.manifestBase))await E(t,`  ${JSON.stringify(i)}: ${JSON.stringify(a,null,2)},
 `);await E(t,`  "files": [
 `);let e=true;for await(let i of O(r.spoolPath)){let{mtimeMs:a,...s}=i;await E(t,`${e?"":`,