@abelxiaoxing/cadence 1.8.3 → 2.0.0

package/src/workspace-io-worker.mjs

@@ -1,1312 +0,0 @@
-// Generated by scripts/build-workspace-io.mjs; edit workspace-io-entry.mjs and its source modules.
-// src/workspace-io-entry.mjs
-import { parentPort, workerData } from "node:worker_threads";
-
-// src/artifact-store.ts
-import { createHash, randomUUID } from "node:crypto";
-import {
-  chmodSync,
-  closeSync as closeSync2,
-  constants as constants2,
-  copyFileSync,
-  fsyncSync as fsyncSync2,
-  lstatSync,
-  mkdirSync,
-  openSync as openSync2,
-  readFileSync,
-  renameSync,
-  unlinkSync,
-  writeFileSync
-} from "node:fs";
-import path from "node:path";
-
-// src/directory-sync.ts
-import { closeSync, constants, fstatSync, fsyncSync, openSync } from "node:fs";
-function syncDirectory(directory) {
-  const descriptor = openSync(directory, constants.O_RDONLY);
-  try {
-    try {
-      fsyncSync(descriptor);
-      return "synced";
-    } catch (error) {
-      const failure = error;
-      if (process.platform === "win32" && failure?.code === "EPERM" && failure.syscall === "fsync" && fstatSync(descriptor).isDirectory()) {
-        return "unsupported-directory-barrier";
-      }
-      throw error;
-    }
-  } finally {
-    closeSync(descriptor);
-  }
-}
-
-// src/artifact-store.ts
-var SHA256 = /^[a-f0-9]{64}$/u;
-function digest(bytes) {
-  return createHash("sha256").update(bytes).digest("hex");
-}
-function requireHash(hash) {
-  if (!SHA256.test(hash))
-    throw new Error("artifact-hash-invalid");
-}
-function ensureDirectory(directory) {
-  const stat = lstatSync(directory, { throwIfNoEntry: false });
-  if (stat) {
-    if (stat.isSymbolicLink() || !stat.isDirectory()) {
-      throw new Error("artifact-store-path-unsafe");
-    }
-    chmodSync(directory, 448);
-    return;
-  }
-  let cursor = path.dirname(directory);
-  while (cursor !== path.dirname(cursor)) {
-    const ancestor = lstatSync(cursor, { throwIfNoEntry: false });
-    if (ancestor) {
-      if (ancestor.isSymbolicLink() || !ancestor.isDirectory()) {
-        throw new Error("artifact-store-path-unsafe");
-      }
-      break;
-    }
-    cursor = path.dirname(cursor);
-  }
-  mkdirSync(directory, { recursive: true, mode: 448 });
-  const created = lstatSync(directory);
-  if (created.isSymbolicLink() || !created.isDirectory()) {
-    throw new Error("artifact-store-path-unsafe");
-  }
-  chmodSync(directory, 448);
-}
-function writeAtomic(target, bytes) {
-  const directory = path.dirname(target);
-  ensureDirectory(directory);
-  const temporary = path.join(directory, `.${path.basename(target)}.${process.pid}.${randomUUID()}.tmp`);
-  const descriptor = openSync2(temporary, constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY, 384);
-  try {
-    writeFileSync(descriptor, bytes);
-    fsyncSync2(descriptor);
-  } finally {
-    closeSync2(descriptor);
-  }
-  try {
-    renameSync(temporary, target);
-    chmodSync(target, 384);
-    syncDirectory(directory);
-  } catch (error) {
-    try {
-      unlinkSync(temporary);
-    } catch {}
-    throw error;
-  }
-}
-
-class ArtifactStore {
-  root;
-  #blobs;
-  #references;
-  constructor(root) {
-    if (!path.isAbsolute(root))
-      throw new Error("artifact-store-root-invalid");
-    this.root = path.resolve(root);
-    this.#blobs = path.join(this.root, "blobs");
-    this.#references = path.join(this.root, "references");
-    ensureDirectory(this.root);
-    ensureDirectory(this.#blobs);
-    ensureDirectory(this.#references);
-  }
-  #blobPath(hash) {
-    requireHash(hash);
-    return path.join(this.#blobs, hash.slice(0, 2), hash);
-  }
-  #referencePath(hash) {
-    requireHash(hash);
-    return path.join(this.#references, hash.slice(0, 2), `${hash}.ref`);
-  }
-  put(input) {
-    if (!(input instanceof Uint8Array))
-      throw new Error("artifact-bytes-invalid");
-    const bytes = Buffer.from(input);
-    const hash = digest(bytes);
-    const target = this.#blobPath(hash);
-    const existing = lstatSync(target, { throwIfNoEntry: false });
-    if (existing) {
-      if (existing.isSymbolicLink() || !existing.isFile()) {
-        throw new Error("artifact-store-path-unsafe");
-      }
-      const current = readFileSync(target);
-      if (current.length !== bytes.length || digest(current) !== hash) {
-        throw new Error("artifact-integrity-invalid");
-      }
-    } else {
-      writeAtomic(target, bytes);
-      const stored = readFileSync(target);
-      if (stored.length !== bytes.length || digest(stored) !== hash) {
-        throw new Error("artifact-integrity-invalid");
-      }
-    }
-    return Object.freeze({ hash, bytes: bytes.length });
-  }
-  read(hash) {
-    const target = this.#blobPath(hash);
-    const stat = lstatSync(target, { throwIfNoEntry: false });
-    if (!stat?.isFile() || stat.isSymbolicLink()) {
-      throw new Error("artifact-unavailable");
-    }
-    const bytes = readFileSync(target);
-    if (digest(bytes) !== hash)
-      throw new Error("artifact-integrity-invalid");
-    return Buffer.from(bytes);
-  }
-  copyVerified(hash, destination) {
-    const source = this.#blobPath(hash);
-    const stat = lstatSync(source, { throwIfNoEntry: false });
-    if (!stat?.isFile() || stat.isSymbolicLink())
-      throw new Error("artifact-unavailable");
-    copyFileSync(source, destination, constants2.COPYFILE_EXCL | constants2.COPYFILE_FICLONE);
-    const bytes = readFileSync(destination);
-    if (digest(bytes) !== hash)
-      throw new Error("artifact-integrity-invalid");
-    return bytes.byteLength;
-  }
-  referenceCount(hash) {
-    requireHash(hash);
-    const referencePath = this.#referencePath(hash);
-    const stat = lstatSync(referencePath, { throwIfNoEntry: false });
-    if (!stat)
-      return 0;
-    if (!stat.isFile() || stat.isSymbolicLink()) {
-      throw new Error("artifact-reference-invalid");
-    }
-    const raw = readFileSync(referencePath, "utf8");
-    if (!/^(?:0|[1-9][0-9]*)\n$/u.test(raw)) {
-      throw new Error("artifact-reference-invalid");
-    }
-    const count = Number(raw.trim());
-    if (!Number.isSafeInteger(count))
-      throw new Error("artifact-reference-invalid");
-    return count;
-  }
-  #setReferenceCount(hash, count) {
-    if (!Number.isSafeInteger(count) || count < 0) {
-      throw new Error("artifact-reference-invalid");
-    }
-    writeAtomic(this.#referencePath(hash), Buffer.from(`${count}
-`));
-    return count;
-  }
-  retain(hash) {
-    this.read(hash);
-    const current = this.referenceCount(hash);
-    if (current === Number.MAX_SAFE_INTEGER) {
-      throw new Error("artifact-reference-overflow");
-    }
-    return this.#setReferenceCount(hash, current + 1);
-  }
-  release(hash) {
-    this.read(hash);
-    const current = this.referenceCount(hash);
-    if (current === 0)
-      throw new Error("artifact-reference-underflow");
-    return this.#setReferenceCount(hash, current - 1);
-  }
-}
-
-// src/remove-path.ts
-import { lstatSync as lstatSync2, readdirSync, rmdirSync, rmSync, unlinkSync as unlinkSync2 } from "node:fs";
-import path2 from "node:path";
-function removePathSync(target, options = {}) {
-  if (process.platform !== "win32") {
-    rmSync(target, options);
-    return;
-  }
-  let stat;
-  try {
-    stat = lstatSync2(target);
-  } catch (error) {
-    if (options.force && error.code === "ENOENT")
-      return;
-    throw error;
-  }
-  if (stat.isDirectory() && !stat.isSymbolicLink()) {
-    if (!options.recursive)
-      throw Object.assign(new Error("Path is a directory"), {
-        code: "ERR_FS_EISDIR"
-      });
-    for (const name of readdirSync(target))
-      removePathSync(path2.join(target, name), options);
-    rmdirSync(target);
-  } else
-    unlinkSync2(target);
-}
-
-// src/verification-environment-io.ts
-import {
-  constants as constants3,
-  cpSync,
-  lstatSync as lstatSync3,
-  mkdirSync as mkdirSync2,
-  readdirSync as readdirSync2,
-  readlinkSync,
-  realpathSync,
-  symlinkSync,
-  writeFileSync as writeFileSync2
-} from "node:fs";
-import path3 from "node:path";
-var CACHES = [".vite", ".vite-temp"];
-function within(root, candidate) {
-  const relative = path3.relative(root, candidate);
-  return relative !== ".." && !relative.startsWith(`..${path3.sep}`) && !path3.isAbsolute(relative);
-}
-function prepareVerificationEnvironmentIo(root, dependencyOwner, runnerBindings, profile, environment, checkCancelled, privateRoot) {
-  const cleanup = () => removePathSync(privateRoot, { recursive: true, force: true });
-  try {
-    const local = profile.mode !== "isolated";
-    const native = profile.mode === "host-trusted";
-    if (local && realpathSync(root) === realpathSync(dependencyOwner))
-      throw new Error("trusted-candidate-required");
-    const mounts = [
-      { source: privateRoot, target: "/cadence", writable: true }
-    ];
-    for (const directory of [
-      "home",
-      "cache",
-      "tmp",
-      "reports",
-      "dependencies"
-    ]) {
-      mkdirSync2(path3.join(privateRoot, directory), { mode: 448 });
-    }
-    if (native) {
-      mkdirSync2(path3.join(privateRoot, "home/AppData/Roaming"), {
-        recursive: true
-      });
-      mkdirSync2(path3.join(privateRoot, "home/AppData/Local"), {
-        recursive: true
-      });
-    }
-    writeFileSync2(path3.join(privateRoot, "home/user.npmrc"), "");
-    writeFileSync2(path3.join(privateRoot, "home/global.npmrc"), "");
-    const dependencies = path3.join(dependencyOwner, "node_modules");
-    const stat = lstatSync3(dependencies, { throwIfNoEntry: false });
-    if (stat && !native) {
-      const target = path3.join(root, "node_modules");
-      const targetStat = lstatSync3(target, { throwIfNoEntry: false });
-      if (!stat.isDirectory() || stat.isSymbolicLink() || targetStat && (!targetStat.isDirectory() || targetStat.isSymbolicLink())) {
-        throw new Error("dependency-path-unsafe");
-      }
-      if (!targetStat)
-        mkdirSync2(target, { mode: 448 });
-      const view = path3.join(privateRoot, "dependencies");
-      mounts.push({ source: view, target: "/workspace/node_modules" });
-      const entries = readdirSync2(dependencies);
-      if (entries.length > 20000)
-        throw new Error("dependency-view-too-large");
-      const canonical = realpathSync(dependencies);
-      let viewEntries = 0;
-      const projectEntry = (name) => {
-        checkCancelled();
-        if (++viewEntries > 20000)
-          throw new Error("dependency-view-too-large");
-        if (CACHES.includes(name))
-          return;
-        const source = path3.join(dependencies, name);
-        const placeholder = path3.join(view, name);
-        const entry = lstatSync3(source);
-        if (entry.isSymbolicLink()) {
-          const resolved = realpathSync(source);
-          if (within(canonical, resolved)) {
-            symlinkSync(path3.relative(path3.dirname(source), resolved), placeholder);
-          } else if (within(realpathSync(dependencyOwner), resolved)) {
-            const relative = path3.relative(realpathSync(dependencyOwner), resolved);
-            const candidate = path3.join(root, relative);
-            if (!lstatSync3(candidate, { throwIfNoEntry: false }))
-              throw new Error("workspace-dependency-missing");
-            symlinkSync(local ? candidate : `/workspace/${relative.split(path3.sep).join("/")}`, placeholder);
-          } else
-            throw new Error("dependency-path-unsafe");
-        } else if (entry.isDirectory() && name.startsWith("@") && !name.includes(path3.sep)) {
-          mkdirSync2(placeholder);
-          for (const child of readdirSync2(source))
-            projectEntry(path3.join(name, child));
-        } else {
-          if (entry.isDirectory())
-            mkdirSync2(placeholder);
-          else if (entry.isFile())
-            writeFileSync2(placeholder, "");
-          else
-            throw new Error("dependency-path-unsafe");
-          mounts.push({
-            source,
-            target: `/workspace/node_modules/${name.split(path3.sep).join("/")}`
-          });
-        }
-      };
-      for (const name of entries)
-        projectEntry(name);
-      for (const cache of CACHES) {
-        mkdirSync2(path3.join(view, cache));
-        const source = path3.join(privateRoot, "cache", cache);
-        mkdirSync2(source);
-        mounts.push({
-          source,
-          target: `/workspace/node_modules/${cache}`,
-          writable: true
-        });
-      }
-    }
-    if (local && stat && !native) {
-      const copyEntry = (name) => {
-        checkCancelled();
-        const source = path3.join(dependencies, name);
-        const destination = path3.join(root, "node_modules", name);
-        if (CACHES.includes(name)) {
-          mkdirSync2(destination, { recursive: true });
-          return;
-        }
-        removeEntry(destination, checkCancelled);
-        const stat2 = lstatSync3(source);
-        if (stat2.isSymbolicLink()) {
-          const resolved = realpathSync(source);
-          const translated = within(canonicalRoot(dependencyOwner), resolved) ? path3.join(root, path3.relative(canonicalRoot(dependencyOwner), resolved)) : resolved;
-          symlinkSync(translated, destination);
-        } else if (stat2.isDirectory() && name.startsWith("@") && !name.includes(path3.sep)) {
-          mkdirSync2(destination);
-          for (const child of readdirSync2(source))
-            copyEntry(path3.join(name, child));
-        } else
-          cpSync(source, destination, {
-            recursive: true,
-            filter: () => {
-              checkCancelled();
-              return true;
-            },
-            mode: constants3.COPYFILE_FICLONE,
-            verbatimSymlinks: true
-          });
-      };
-      for (const name of readdirSync2(path3.join(privateRoot, "dependencies")))
-        copyEntry(name);
-    }
-    if (native && stat) {
-      const target = path3.join(root, "node_modules");
-      const targetStat = lstatSync3(target, { throwIfNoEntry: false });
-      if (!stat.isDirectory() || stat.isSymbolicLink() || targetStat && (!targetStat.isDirectory() || targetStat.isSymbolicLink()))
-        throw new Error("dependency-path-unsafe");
-      const owner = realpathSync(dependencyOwner);
-      let count = 0;
-      const copy = (source, destination) => {
-        checkCancelled();
-        if (++count > 500000)
-          throw new Error("dependency-view-too-large");
-        const entry = lstatSync3(source);
-        if (entry.isSymbolicLink()) {
-          const resolved = realpathSync(source);
-          if (!within(owner, resolved))
-            throw new Error("dependency-path-unsafe");
-          const candidate = path3.join(root, path3.relative(owner, resolved));
-          if (!within(realpathSync(dependencies), resolved) && !lstatSync3(candidate, { throwIfNoEntry: false }))
-            throw new Error("workspace-dependency-missing");
-          const linked = lstatSync3(resolved);
-          if (linked.isDirectory()) {
-            symlinkSync(candidate, destination, process.platform === "win32" ? "junction" : "dir");
-          } else if (linked.isFile()) {
-            const file = within(realpathSync(dependencies), resolved) ? resolved : candidate;
-            cpSync(file, destination, { mode: constants3.COPYFILE_FICLONE });
-          } else
-            throw new Error("dependency-path-unsafe");
-        } else if (entry.isDirectory()) {
-          mkdirSync2(destination, { recursive: true });
-          for (const name of readdirSync2(source)) {
-            if (source === dependencies && CACHES.includes(name)) {
-              mkdirSync2(path3.join(destination, name));
-              continue;
-            }
-            copy(path3.join(source, name), path3.join(destination, name));
-          }
-        } else if (entry.isFile())
-          cpSync(source, destination, { mode: constants3.COPYFILE_FICLONE });
-        else
-          throw new Error("dependency-path-unsafe");
-      };
-      removeEntry(target, checkCancelled);
-      copy(dependencies, target);
-    }
-    const sources = new Map;
-    const bindings = runnerBindings.map((binding) => {
-      if (native) {
-        const translate2 = (value) => path3.isAbsolute(value) && within(dependencyOwner, value) ? path3.join(root, path3.relative(dependencyOwner, value)) : value;
-        return {
-          ...binding,
-          executablePath: translate2(binding.executablePath),
-          ...binding.fixedArgs ? { fixedArgs: binding.fixedArgs.map(translate2) } : {}
-        };
-      }
-      if (local || !binding.mountSource)
-        return { ...binding };
-      const source = path3.resolve(binding.mountSource);
-      const stat2 = lstatSync3(source);
-      const executable = realpathSync(binding.executablePath);
-      if (!stat2.isDirectory() || stat2.isSymbolicLink() || !within(source, executable)) {
-        throw new Error("runner-mount-unavailable");
-      }
-      let target = sources.get(source);
-      if (!target) {
-        target = `/cadence-runners/${sources.size}`;
-        sources.set(source, target);
-        mounts.push({ source, target });
-      }
-      const translate = (file) => path3.posix.join(target, ...path3.relative(source, file).split(path3.sep));
-      return {
-        ...binding,
-        executablePath: translate(lstatSync3(binding.executablePath).isSymbolicLink() && !path3.isAbsolute(readlinkSync(binding.executablePath)) ? binding.executablePath : executable),
-        ...binding.fixedArgs ? {
-          fixedArgs: binding.fixedArgs.map((arg) => path3.isAbsolute(arg) && within(source, arg) ? translate(arg) : arg)
-        } : {}
-      };
-    });
-    checkCancelled();
-    return {
-      privateRoot,
-      mounts: native ? [] : mounts,
-      bindings,
-      reportRoot: local ? privateRoot : "/cadence",
-      environment: {
-        ...local ? Object.fromEntries(profile.inheritEnvironment.flatMap((name) => environment[name] === undefined ? [] : [[name, environment[name] ?? ""]])) : {},
-        ...native ? Object.fromEntries(Object.entries(environment).filter(([key]) => ["SYSTEMROOT", "WINDIR", "COMSPEC", "PATHEXT"].includes(key.toUpperCase()))) : {},
-        ...native ? {
-          USERPROFILE: path3.join(privateRoot, "home"),
-          APPDATA: path3.join(privateRoot, "home", "AppData", "Roaming"),
-          LOCALAPPDATA: path3.join(privateRoot, "home", "AppData", "Local"),
-          TEMP: path3.join(privateRoot, "tmp"),
-          TMP: path3.join(privateRoot, "tmp")
-        } : {},
-        CI: "1",
-        HOME: local ? path3.join(privateRoot, "home") : "/cadence/home",
-        XDG_CACHE_HOME: local ? path3.join(privateRoot, "cache") : "/cadence/cache",
-        TMPDIR: local ? path3.join(privateRoot, "tmp") : "/cadence/tmp",
-        npm_config_cache: local ? path3.join(privateRoot, "cache/npm") : "/cadence/cache/npm",
-        npm_config_userconfig: local ? path3.join(privateRoot, "home/user.npmrc") : "/cadence/home/user.npmrc",
-        npm_config_globalconfig: local ? path3.join(privateRoot, "home/global.npmrc") : "/cadence/home/global.npmrc",
-        PATH: [
-          ...new Set([
-            ...bindings.filter((binding) => binding.mountSource),
-            ...bindings.filter((binding) => !binding.mountSource)
-          ].map((binding) => (local ? path3 : path3.posix).dirname(binding.executablePath))),
-          ...local ? (environment.PATH ?? "").split(path3.delimiter) : [],
-          ...native ? [] : ["/usr/local/bin", "/usr/bin", "/bin"]
-        ].join(local ? path3.delimiter : ":")
-      }
-    };
-  } catch (error) {
-    cleanup();
-    throw error;
-  }
-}
-function canonicalRoot(root) {
-  return realpathSync(root);
-}
-function removeEntry(file, checkCancelled) {
-  checkCancelled();
-  const stat = lstatSync3(file, { throwIfNoEntry: false });
-  if (!stat)
-    return;
-  if (stat.isDirectory() && !stat.isSymbolicLink())
-    for (const name of readdirSync2(file))
-      removeEntry(path3.join(file, name), checkCancelled);
-  removePathSync(file, {
-    recursive: stat.isDirectory() && !stat.isSymbolicLink(),
-    force: true
-  });
-}
-
-// src/verification-identity.ts
-import { createHash as createHash2 } from "node:crypto";
-import {
-  closeSync as closeSync3,
-  constants as constants4,
-  fstatSync as fstatSync2,
-  lstatSync as lstatSync4,
-  openSync as openSync3,
-  readdirSync as readdirSync3,
-  readlinkSync as readlinkSync2,
-  readSync
-} from "node:fs";
-import path4 from "node:path";
-function verificationEnvironmentDigest(roots, checkCancelled = () => {}) {
-  const digest2 = createHash2("sha256");
-  let entries = 0;
-  let bytes = 0;
-  const started = Date.now();
-  const buffer = Buffer.alloc(256 * 1024);
-  const visit = (file, relative, dependencyRoot) => {
-    checkCancelled();
-    if (++entries > 500000 || Date.now() - started > 60000)
-      throw new Error("verification-environment-limit");
-    const stat = lstatSync4(file, { throwIfNoEntry: false });
-    digest2.update(JSON.stringify([relative, stat ? stat.mode & 511 : null]));
-    if (!stat) {
-      digest2.update("absent");
-      return;
-    }
-    if (stat.isSymbolicLink()) {
-      digest2.update(JSON.stringify(["link", readlinkSync2(file)]));
-      return;
-    }
-    if (stat.isDirectory()) {
-      digest2.update("directory");
-      for (const name of readdirSync3(file).sort()) {
-        if (dependencyRoot && [".vite", ".vite-temp"].includes(name))
-          continue;
-        visit(path4.join(file, name), `${relative}/${name}`, false);
-      }
-      return;
-    }
-    if (!stat.isFile())
-      throw new Error("verification-environment-unsafe");
-    const fd = openSync3(file, constants4.O_RDONLY | constants4.O_NOFOLLOW);
-    try {
-      const before = fstatSync2(fd);
-      if (before.ino !== stat.ino || before.dev !== stat.dev)
-        throw new Error("verification-environment-changed");
-      const content = createHash2("sha256");
-      for (;; ) {
-        const count = readSync(fd, buffer, 0, buffer.length, null);
-        if (count === 0)
-          break;
-        checkCancelled();
-        bytes += count;
-        if (bytes > 16 * 1024 ** 3 || Date.now() - started > 60000)
-          throw new Error("verification-environment-limit");
-        content.update(buffer.subarray(0, count));
-      }
-      const after = fstatSync2(fd);
-      if (before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs)
-        throw new Error("verification-environment-changed");
-      digest2.update(JSON.stringify(["file", content.digest("hex")]));
-    } finally {
-      closeSync3(fd);
-    }
-  };
-  for (const root of [...new Set(roots)].sort())
-    visit(root, root, path4.basename(root) === "node_modules");
-  return digest2.digest("hex");
-}
-
-// src/workspace-store.ts
-import { execFile, execFileSync } from "node:child_process";
-import { createHash as createHash3, randomUUID as randomUUID2 } from "node:crypto";
-import {
-  chmodSync as chmodSync2,
-  closeSync as closeSync4,
-  constants as constants5,
-  fsyncSync as fsyncSync3,
-  lstatSync as lstatSync6,
-  mkdirSync as mkdirSync3,
-  openSync as openSync4,
-  readFileSync as readFileSync2,
-  renameSync as renameSync2,
-  unlinkSync as unlinkSync3,
-  writeFileSync as writeFileSync3
-} from "node:fs";
-import path6 from "node:path";
-import { promisify } from "node:util";
-
-// src/canonical.ts
-function compareCanonicalStrings(left, right) {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
-
-// src/control-contracts.ts
-var CONTROL_SCHEMA_PROPERTIES = {
-  command: {
-    type: "string",
-    enum: ["start", "status", "resume", "rebind", "cancel", "discard"]
-  },
-  stage: { type: "string", enum: ["abel-implement"] },
-  change: { type: "string" },
-  operationId: { type: "string" },
-  deliveryRevision: { type: "integer", minimum: 1 },
-  receiptHash: { type: "string" },
-  routeId: { type: "string" },
-  recovery: {
-    type: "object",
-    additionalProperties: false,
-    properties: {
-      incidentKey: { type: "string", pattern: "^[a-f0-9]{64}$" },
-      failureSequence: { type: "integer", minimum: 1 },
-      reason: {
-        type: "string",
-        enum: ["parent-directed-retry", "route-changed", "context-extended"]
-      }
-    },
-    required: ["incidentKey", "failureSequence", "reason"]
-  }
-};
-var commandSchema = (command, fields) => ({
-  type: "object",
-  properties: {
-    command: { type: "string", enum: [command] },
-    ...Object.fromEntries(fields.map((field) => [field, CONTROL_SCHEMA_PROPERTIES[field]]))
-  },
-  required: ["command", ...fields],
-  additionalProperties: false
-});
-var CONTROL_COMMAND_PARAMETERS = {
-  type: "object",
-  properties: CONTROL_SCHEMA_PROPERTIES,
-  required: ["command", "stage", "change"],
-  anyOf: [
-    commandSchema("start", ["stage", "change", "operationId"]),
-    commandSchema("status", ["stage", "change"]),
-    commandSchema("resume", ["stage", "change", "operationId"]),
-    commandSchema("resume", ["stage", "change", "operationId", "recovery"]),
-    commandSchema("resume", [
-      "stage",
-      "change",
-      "operationId",
-      "deliveryRevision",
-      "receiptHash",
-      "recovery"
-    ]),
-    commandSchema("resume", [
-      "stage",
-      "change",
-      "operationId",
-      "deliveryRevision",
-      "receiptHash"
-    ]),
-    commandSchema("rebind", ["stage", "change", "operationId", "routeId"]),
-    commandSchema("cancel", ["stage", "change", "operationId"]),
-    commandSchema("discard", ["stage", "change", "operationId"])
-  ],
-  additionalProperties: false
-};
-var CONTROL_TOOL_FIELDS = new Set([
-  "command",
-  "stage",
-  "change",
-  "operationId",
-  "deliveryRevision",
-  "receiptHash",
-  "routeId",
-  "recovery"
-]);
-var COMMAND_FIELDS = Object.freeze({
-  start: new Set(["command", "stage", "change", "operationId"]),
-  status: new Set(["command", "stage", "change"]),
-  resume: new Set([
-    "command",
-    "stage",
-    "change",
-    "operationId",
-    "deliveryRevision",
-    "receiptHash",
-    "recovery"
-  ]),
-  rebind: new Set(["command", "stage", "change", "operationId", "routeId"]),
-  cancel: new Set(["command", "stage", "change", "operationId"]),
-  discard: new Set(["command", "stage", "change", "operationId"])
-});
-// src/contracts.ts
-var LIMITS = {
-  maxActiveChildSessions: 4,
-  maxEnvelopeBytes: 64 * 1024,
-  phaseTimeoutMs: 20 * 60 * 1000,
-  maxCompleteResultBytes: 64 * 1024
-};
-var VERIFICATION_LIMITS = Object.freeze({
-  minSteps: 1,
-  maxSteps: 8,
-  minTestFiles: 1,
-  maxTestFiles: 64
-});
-var NONCANONICAL = /(^|\/)\.\.(\/|$)|(^|\/)\/|^\//;
-var RELATIVE_PATH_PATTERN = String.raw`^(?:\.|(?!/)(?![a-zA-Z]:/)(?!\./)(?![\s\S]*\.\.)(?![\s\S]*[\\\u0000])(?![\s\S]*//)(?![\s\S]*/\.(?:/|$))(?![\s\S]*/$)[\s\S]+)$`;
-function isValidRelativePath(p) {
-  return typeof p === "string" && p.length > 0 && p.length <= 512 && !NONCANONICAL.test(p) && !p.startsWith("/") && !/^[a-z]:\//iu.test(p) && (p === "." || !p.startsWith("./") && !p.endsWith("/") && !p.split("/").includes(".")) && !p.includes("..") && !p.includes("\\") && !p.includes("\x00");
-}
-
-// src/safe-path.ts
-import { lstatSync as lstatSync5 } from "node:fs";
-import path5 from "node:path";
-function observeSafePath(root, relative) {
-  if (!isValidRelativePath(relative)) {
-    return { kind: "unsafe", reason: "invalid-path" };
-  }
-  try {
-    const resolvedRoot = path5.resolve(root);
-    const rootStat = lstatSync5(resolvedRoot, { throwIfNoEntry: false });
-    if (!rootStat?.isDirectory() || rootStat.isSymbolicLink()) {
-      return { kind: "unsafe", reason: "root-unavailable" };
-    }
-    if (relative === ".")
-      return { kind: "directory" };
-    let current = resolvedRoot;
-    const parts = relative.split("/");
-    for (const [index, part] of parts.entries()) {
-      current = path5.join(current, part);
-      if (!current.startsWith(`${resolvedRoot}${path5.sep}`)) {
-        return { kind: "unsafe", reason: "invalid-path" };
-      }
-      const stat = lstatSync5(current, { throwIfNoEntry: false });
-      if (!stat)
-        return { kind: "absent" };
-      if (stat.isSymbolicLink()) {
-        return { kind: "unsafe", reason: "symlink" };
-      }
-      if (index < parts.length - 1) {
-        if (!stat.isDirectory()) {
-          return { kind: "unsafe", reason: "parent-not-directory" };
-        }
-        continue;
-      }
-      if (stat.isFile())
-        return { kind: "file" };
-      if (stat.isDirectory())
-        return { kind: "directory" };
-      return { kind: "unsafe", reason: "special-file" };
-    }
-  } catch {
-    return { kind: "unsafe", reason: "path-unavailable" };
-  }
-  return { kind: "unsafe", reason: "invalid-path" };
-}
-
-// src/workspace-io.ts
-import { Worker } from "node:worker_threads";
-async function runWorkspaceIo(input) {
-  input.signal?.throwIfAborted();
-  const cancelled = new SharedArrayBuffer(4);
-  const flag = new Int32Array(cancelled);
-  const started = performance.now();
-  const worker = new Worker(new URL("./workspace-io-worker.mjs", import.meta.url), {
-    workerData: {
-      root: input.root,
-      artifactRoot: input.artifactRoot,
-      operation: input.operation,
-      args: input.args,
-      cancelled
-    },
-    execArgv: []
-  });
-  const abort = () => {
-    Atomics.store(flag, 0, 1);
-    worker.postMessage("cancel");
-  };
-  input.signal?.addEventListener("abort", abort, { once: true });
-  if (input.signal?.aborted)
-    abort();
-  try {
-    return await new Promise((resolve, reject) => {
-      let message;
-      let failure;
-      worker.once("message", (value) => {
-        message = value;
-      });
-      worker.once("error", (error) => {
-        failure = error;
-      });
-      worker.once("exit", (code) => {
-        try {
-          input.onMetrics?.({
-            operation: input.operation,
-            elapsedMs: performance.now() - started,
-            files: message?.files ?? 0,
-            bytes: message?.bytes ?? 0
-          });
-        } catch {}
-        if (input.signal?.aborted)
-          reject(input.signal.reason);
-        else if (failure || code !== 0 || !message)
-          reject(new Error("workspace-io-unavailable"));
-        else if (!message.ok)
-          reject(new Error(message.error ?? "workspace-io-failed"));
-        else
-          resolve(message.result);
-      });
-    });
-  } finally {
-    input.signal?.removeEventListener("abort", abort);
-  }
-}
-
-// src/workspace-store.ts
-var SHA2562 = /^[a-f0-9]{64}$/u;
-function hash(...values) {
-  const digest2 = createHash3("sha256");
-  for (const value of values) {
-    const bytes = typeof value === "string" ? Buffer.from(value) : value;
-    digest2.update(`${bytes.byteLength}:`);
-    digest2.update(bytes);
-  }
-  return digest2.digest("hex");
-}
-function stableEntries(entries) {
-  return Object.fromEntries(Object.entries(entries).sort(([left], [right]) => compareCanonicalStrings(left, right)).map(([relative, entry]) => [relative, { ...entry }]));
-}
-function manifestHash(entries) {
-  return hash("cadence-workspace-manifest", JSON.stringify(stableEntries(entries)));
-}
-function revisionId(parentRevisionId, manifest) {
-  return hash("cadence-workspace-revision", parentRevisionId ?? "", manifest);
-}
-function ensureDirectory2(directory) {
-  const stat = lstatSync6(directory, { throwIfNoEntry: false });
-  if (stat) {
-    if (stat.isSymbolicLink() || !stat.isDirectory()) {
-      throw new Error("unsafe-workspace-path");
-    }
-    chmodSync2(directory, 448);
-    return;
-  }
-  let cursor = path6.dirname(directory);
-  while (cursor !== path6.dirname(cursor)) {
-    const ancestor = lstatSync6(cursor, { throwIfNoEntry: false });
-    if (ancestor) {
-      if (ancestor.isSymbolicLink() || !ancestor.isDirectory()) {
-        throw new Error("unsafe-workspace-path");
-      }
-      break;
-    }
-    cursor = path6.dirname(cursor);
-  }
-  mkdirSync3(directory, { recursive: true, mode: 448 });
-  const created = lstatSync6(directory);
-  if (created.isSymbolicLink() || !created.isDirectory()) {
-    throw new Error("unsafe-workspace-path");
-  }
-  chmodSync2(directory, 448);
-}
-function writeAtomic2(target, bytes) {
-  const directory = path6.dirname(target);
-  ensureDirectory2(directory);
-  const temporary = path6.join(directory, `.${path6.basename(target)}.${process.pid}.${randomUUID2()}.tmp`);
-  const descriptor = openSync4(temporary, constants5.O_CREAT | constants5.O_EXCL | constants5.O_WRONLY, 384);
-  try {
-    writeFileSync3(descriptor, bytes);
-    fsyncSync3(descriptor);
-  } finally {
-    closeSync4(descriptor);
-  }
-  try {
-    renameSync2(temporary, target);
-    chmodSync2(target, 384);
-    syncDirectory(directory);
-  } catch (error) {
-    try {
-      unlinkSync3(temporary);
-    } catch {}
-    throw error;
-  }
-}
-function requireSafeRelative(relative) {
-  if (!isValidRelativePath(relative) || relative === ".") {
-    throw new Error("unsafe-workspace-path");
-  }
-}
-function isExcluded(relative, excluded) {
-  return excluded.some((entry) => relative === entry || relative.startsWith(`${entry}/`));
-}
-function parseNullSeparated(bytes) {
-  const decoded = bytes.toString("utf8");
-  if (!Buffer.from(decoded, "utf8").equals(bytes)) {
-    throw new Error("unsafe-workspace-path");
-  }
-  return decoded.split("\x00").filter((entry) => entry.length > 0);
-}
-function sameEntry(left, right) {
-  if (!left || !right)
-    return left === right;
-  if (left.kind !== right.kind)
-    return false;
-  return left.kind === "absent" || right.kind === "file" && left.hash === right.hash && left.bytes === right.bytes && left.mode === right.mode;
-}
-function requireMode(mode) {
-  if (!Number.isInteger(mode) || mode < 0 || mode > 511) {
-    throw new Error("workspace-file-mode-invalid");
-  }
-  return mode;
-}
-function requireRevisionShape(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("workspace-revision-invalid");
-  }
-  const candidate = value;
-  if (typeof candidate.revisionId !== "string" || !SHA2562.test(candidate.revisionId) || candidate.parentRevisionId !== null && (typeof candidate.parentRevisionId !== "string" || !SHA2562.test(candidate.parentRevisionId)) || typeof candidate.manifestHash !== "string" || !SHA2562.test(candidate.manifestHash) || !candidate.entries || typeof candidate.entries !== "object" || Array.isArray(candidate.entries)) {
-    throw new Error("workspace-revision-invalid");
-  }
-  for (const [relative, entry] of Object.entries(candidate.entries)) {
-    requireSafeRelative(relative);
-    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
-      throw new Error("workspace-revision-invalid");
-    }
-    if (entry.kind === "absent") {
-      if (Object.keys(entry).length !== 1) {
-        throw new Error("workspace-revision-invalid");
-      }
-      continue;
-    }
-    const file = entry;
-    if (file.kind !== "file" || !SHA2562.test(file.hash) || !Number.isSafeInteger(file.bytes) || file.bytes < 0 || Object.keys(file).length !== 4) {
-      throw new Error("workspace-revision-invalid");
-    }
-    requireMode(file.mode);
-  }
-  return candidate;
-}
-
-class WorkspaceStore {
-  root;
-  #revisions;
-  #artifacts;
-  #checkCancelled;
-  #onMetrics;
-  constructor(root, artifacts, options = {}) {
-    this.#checkCancelled = options.checkCancelled ?? (() => {});
-    this.#onMetrics = options.onMetrics;
-    if (!path6.isAbsolute(root))
-      throw new Error("workspace-store-root-invalid");
-    this.root = path6.resolve(root);
-    this.#revisions = path6.join(this.root, "revisions");
-    this.#artifacts = artifacts;
-    ensureDirectory2(this.root);
-    ensureDirectory2(this.#revisions);
-  }
-  #revisionPath(id) {
-    if (!SHA2562.test(id))
-      throw new Error("workspace-revision-id-invalid");
-    return path6.join(this.#revisions, id.slice(0, 2), `${id}.json`);
-  }
-  #storeRevision(parentRevisionId, rawEntries) {
-    const entries = stableEntries(rawEntries);
-    const manifest = manifestHash(entries);
-    const id = revisionId(parentRevisionId, manifest);
-    const revision = {
-      revisionId: id,
-      parentRevisionId,
-      manifestHash: manifest,
-      entries
-    };
-    const target = this.#revisionPath(id);
-    const existing = lstatSync6(target, { throwIfNoEntry: false });
-    if (existing) {
-      const stored = this.getRevision(id);
-      if (JSON.stringify(stored) !== JSON.stringify(revision)) {
-        throw new Error("workspace-revision-conflict");
-      }
-      return stored;
-    }
-    writeAtomic2(target, Buffer.from(`${JSON.stringify(revision)}
-`));
-    const inherited = parentRevisionId ? this.getRevision(parentRevisionId).entries : {};
-    for (const [relative, entry] of Object.entries(entries)) {
-      if (entry.kind === "file" && !sameEntry(entry, inherited[relative]))
-        this.#artifacts.retain(entry.hash);
-    }
-    return structuredClone(revision);
-  }
-  #isAncestor(ancestorId, revision) {
-    let cursor = revision;
-    const visited = new Set;
-    while (cursor) {
-      if (cursor.revisionId === ancestorId)
-        return true;
-      if (visited.has(cursor.revisionId)) {
-        throw new Error("workspace-revision-cycle");
-      }
-      visited.add(cursor.revisionId);
-      cursor = cursor.parentRevisionId ? this.getRevision(cursor.parentRevisionId) : null;
-    }
-    return false;
-  }
-  captureBaseline(input) {
-    const consumerRoot = path6.resolve(input.consumerRoot);
-    const rootStat = lstatSync6(consumerRoot, { throwIfNoEntry: false });
-    if (!rootStat?.isDirectory() || rootStat.isSymbolicLink()) {
-      throw new Error("unsafe-workspace-path");
-    }
-    const excluded = [".git", "node_modules", ...input.excludedPaths ?? []];
-    for (const relative of excluded)
-      requireSafeRelative(relative);
-    return this.#captureBaselineFiles(input, this.#trackedFiles(input), consumerRoot, excluded);
-  }
-  #trackedFiles(input) {
-    const timeout = input.gitTimeoutMs ?? 30000;
-    if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 30000)
-      throw new Error("workspace-git-timeout-invalid");
-    const consumerRoot = path6.resolve(input.consumerRoot);
-    let tracked;
-    try {
-      tracked = parseNullSeparated(execFileSync("git", ["ls-files", "-z", "--cached"], {
-        cwd: consumerRoot,
-        maxBuffer: 32 * 1024 * 1024,
-        timeout,
-        killSignal: "SIGKILL"
-      }));
-    } catch (error) {
-      if (error instanceof Error && error.message === "unsafe-workspace-path") {
-        throw error;
-      }
-      throw new Error("workspace-git-baseline-unavailable");
-    }
-    return tracked;
-  }
-  #captureBaselineFiles(input, tracked, consumerRoot, excluded) {
-    const approved = input.approvedUntracked ?? [];
-    const absent = input.absent ?? [];
-    const selected = [...new Set([...tracked, ...approved])].sort();
-    const entries = {};
-    for (const relative of selected) {
-      this.#checkCancelled();
-      requireSafeRelative(relative);
-      if (isExcluded(relative, excluded))
-        continue;
-      const observation = observeSafePath(consumerRoot, relative);
-      if (observation.kind === "absent") {
-        entries[relative] = { kind: "absent" };
-        continue;
-      }
-      if (observation.kind !== "file")
-        throw new Error("unsafe-workspace-path");
-      const absolute = path6.join(consumerRoot, ...relative.split("/"));
-      const bytes = readFileSync2(absolute);
-      const artifact = this.#artifacts.put(bytes);
-      const stat = lstatSync6(absolute);
-      entries[relative] = {
-        kind: "file",
-        hash: artifact.hash,
-        bytes: artifact.bytes,
-        mode: requireMode(stat.mode & 511)
-      };
-    }
-    for (const relative of [...new Set(absent)].sort()) {
-      requireSafeRelative(relative);
-      if (isExcluded(relative, excluded))
-        throw new Error("unsafe-workspace-path");
-      if (observeSafePath(consumerRoot, relative).kind !== "absent") {
-        throw new Error("workspace-path-not-absent");
-      }
-      entries[relative] = { kind: "absent" };
-    }
-    return this.#storeRevision(null, entries);
-  }
-  getRevision(id) {
-    const target = this.#revisionPath(id);
-    const stat = lstatSync6(target, { throwIfNoEntry: false });
-    if (!stat?.isFile() || stat.isSymbolicLink()) {
-      throw new Error("workspace-revision-unavailable");
-    }
-    let parsed;
-    try {
-      parsed = JSON.parse(readFileSync2(target, "utf8"));
-    } catch {
-      throw new Error("workspace-revision-invalid");
-    }
-    const revision = requireRevisionShape(parsed);
-    if (revision.revisionId !== id || manifestHash(revision.entries) !== revision.manifestHash && hash("cadence-workspace-manifest", JSON.stringify(revision.entries)) !== revision.manifestHash || revisionId(revision.parentRevisionId, revision.manifestHash) !== id) {
-      throw new Error("workspace-revision-integrity-invalid");
-    }
-    return structuredClone(revision);
-  }
-  createRevision(input) {
-    const parent = this.getRevision(input.parentRevisionId);
-    const entries = stableEntries(parent.entries);
-    for (const [relative, change] of Object.entries(input.changes).sort(([left], [right]) => compareCanonicalStrings(left, right))) {
-      requireSafeRelative(relative);
-      if (change === null || typeof change === "object" && "kind" in change && change.kind === "absent") {
-        entries[relative] = { kind: "absent" };
-        continue;
-      }
-      const descriptor = change instanceof Uint8Array ? {
-        kind: "file",
-        bytes: change,
-        mode: entries[relative]?.kind === "file" ? entries[relative].mode : 420
-      } : change;
-      if (descriptor?.kind !== "file" || !(descriptor.bytes instanceof Uint8Array)) {
-        throw new Error("workspace-change-invalid");
-      }
-      const artifact = this.#artifacts.put(descriptor.bytes);
-      entries[relative] = {
-        kind: "file",
-        hash: artifact.hash,
-        bytes: artifact.bytes,
-        mode: requireMode(descriptor.mode ?? 420)
-      };
-    }
-    return this.#storeRevision(parent.revisionId, entries);
-  }
-  mergeRevision(input) {
-    const base = this.getRevision(input.baseRevisionId);
-    const current = this.getRevision(input.currentRevisionId);
-    const candidate = this.getRevision(input.candidateRevisionId);
-    if (candidate.parentRevisionId !== base.revisionId || !this.#isAncestor(base.revisionId, current)) {
-      throw new Error("workspace-revision-base-invalid");
-    }
-    const boundPaths = [...new Set(input.boundPaths)];
-    for (const relative of boundPaths) {
-      requireSafeRelative(relative);
-      if (!sameEntry(base.entries[relative], current.entries[relative])) {
-        throw new Error("workspace-revision-stale");
-      }
-    }
-    const allPaths = new Set([
-      ...Object.keys(base.entries),
-      ...Object.keys(candidate.entries)
-    ]);
-    const delta = [...allPaths].filter((relative) => !sameEntry(base.entries[relative], candidate.entries[relative]));
-    for (const relative of delta) {
-      if (!sameEntry(base.entries[relative], current.entries[relative])) {
-        throw new Error("workspace-revision-stale");
-      }
-    }
-    const merged = stableEntries(current.entries);
-    for (const relative of delta.sort()) {
-      const entry = candidate.entries[relative];
-      if (entry)
-        merged[relative] = { ...entry };
-      else
-        delete merged[relative];
-    }
-    return this.#storeRevision(current.revisionId, merged);
-  }
-  materialize(revisionIdValue, destination) {
-    const revision = this.getRevision(revisionIdValue);
-    const root = path6.resolve(destination);
-    ensureDirectory2(root);
-    for (const [relative, entry] of Object.entries(revision.entries)) {
-      this.#checkCancelled();
-      requireSafeRelative(relative);
-      const observation = observeSafePath(root, relative);
-      if (entry.kind === "absent") {
-        const segments2 = relative.split("/");
-        const supersededByFileAncestor = segments2.slice(0, -1).some((_segment, index) => revision.entries[segments2.slice(0, index + 1).join("/")]?.kind === "file");
-        if (supersededByFileAncestor)
-          continue;
-        if (observation.kind !== "absent") {
-          throw new Error("workspace-materialize-conflict");
-        }
-        continue;
-      }
-      const segments = relative.split("/");
-      let parent = root;
-      for (const segment of segments.slice(0, -1)) {
-        parent = path6.join(parent, segment);
-        ensureDirectory2(parent);
-      }
-      const target = path6.join(root, ...segments);
-      if (observation.kind !== "absent") {
-        throw new Error("workspace-materialize-conflict");
-      }
-      const bytes = this.#artifacts.copyVerified(entry.hash, target);
-      if (bytes !== entry.bytes)
-        throw new Error("workspace-revision-integrity-invalid");
-      chmodSync2(target, entry.mode);
-    }
-  }
-  async captureBaselineWithGit(input, signal) {
-    signal?.throwIfAborted();
-    const consumerRoot = path6.resolve(input.consumerRoot);
-    const stat = lstatSync6(consumerRoot, { throwIfNoEntry: false });
-    if (!stat?.isDirectory() || stat.isSymbolicLink())
-      throw new Error("unsafe-workspace-path");
-    const excluded = [".git", "node_modules", ...input.excludedPaths ?? []];
-    for (const relative of excluded)
-      requireSafeRelative(relative);
-    const timeout = input.gitTimeoutMs ?? 30000;
-    if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 30000)
-      throw new Error("workspace-git-timeout-invalid");
-    let tracked;
-    try {
-      const { stdout } = await promisify(execFile)("git", ["ls-files", "-z", "--cached"], {
-        cwd: consumerRoot,
-        encoding: "buffer",
-        maxBuffer: 32 * 1024 * 1024,
-        timeout,
-        killSignal: "SIGKILL",
-        signal
-      });
-      tracked = parseNullSeparated(stdout);
-    } catch (error) {
-      signal?.throwIfAborted();
-      if (error instanceof Error && error.message === "unsafe-workspace-path")
-        throw error;
-      throw new Error("workspace-git-baseline-unavailable");
-    }
-    this.#checkCancelled();
-    return this.#captureBaselineFiles(input, tracked, consumerRoot, excluded);
-  }
-  captureBaselineAsync(input, signal) {
-    return runWorkspaceIo({
-      root: this.root,
-      artifactRoot: this.#artifacts.root,
-      operation: "captureBaseline",
-      args: [input],
-      signal,
-      onMetrics: this.#onMetrics
-    });
-  }
-  materializeAsync(revisionId2, destination, signal) {
-    return runWorkspaceIo({
-      root: this.root,
-      artifactRoot: this.#artifacts.root,
-      operation: "materialize",
-      args: [revisionId2, destination],
-      signal,
-      onMetrics: this.#onMetrics
-    });
-  }
-}
-
-// src/workspace-io-entry.mjs
-var controller = new AbortController;
-var flag = new Int32Array(workerData.cancelled);
-parentPort.on("message", () => controller.abort(new Error("cancelled")));
-var checkCancelled = () => {
-  if (Atomics.load(flag, 0))
-    throw new Error("cancelled");
-};
-try {
-  if (workerData.operation === "prepareVerification") {
-    const [root, owner, bindings, profile, environment, scratch] = workerData.args;
-    const result = prepareVerificationEnvironmentIo(root, owner, bindings, profile, environment, checkCancelled, scratch);
-    parentPort.postMessage({ ok: true, result, files: 0, bytes: 0 });
-  } else if (workerData.operation === "cleanupVerification") {
-    removePathSync(workerData.args[0], { recursive: true, force: true });
-    parentPort.postMessage({ ok: true, files: 0, bytes: 0 });
-  } else if (workerData.operation === "verificationIdentity") {
-    const result = verificationEnvironmentDigest(workerData.args[0], checkCancelled);
-    parentPort.postMessage({ ok: true, result, files: 0, bytes: 0 });
-  } else {
-    const artifacts = new ArtifactStore(workerData.artifactRoot);
-    const store = new WorkspaceStore(workerData.root, artifacts, {
-      checkCancelled
-    });
-    let result;
-    let revision;
-    checkCancelled();
-    if (workerData.operation === "captureBaseline") {
-      revision = await store.captureBaselineWithGit(workerData.args[0], controller.signal);
-      result = revision;
-    } else if (workerData.operation === "materialize") {
-      revision = store.getRevision(workerData.args[0]);
-      store.materialize(workerData.args[0], workerData.args[1]);
-    } else {
-      throw new Error("workspace-io-operation-invalid");
-    }
-    const files = Object.values(revision.entries).filter((entry) => entry.kind === "file");
-    parentPort.postMessage({
-      ok: true,
-      result,
-      files: files.length,
-      bytes: files.reduce((sum, entry) => sum + entry.bytes, 0)
-    });
-  }
-} catch (error) {
-  parentPort.postMessage({
-    ok: false,
-    error: error instanceof Error ? error.message : "workspace-io-failed",
-    files: 0,
-    bytes: 0
-  });
-} finally {
-  parentPort.close();
-}