@ansible-flow/node 0.0.0-stage → 0.86.0

package/dist/chunks/chunk-LGUG2Q7Z.js

@@ -0,0 +1,191 @@
+import {
+  followRunFile,
+  putRunFile,
+  removeRunDir,
+  syncWorkspace
+} from "./chunk-RETJPSKL.js";
+import {
+  keepRun,
+  runsDir
+} from "./chunk-4FHPTGI4.js";
+import {
+  tailFile
+} from "./chunk-SSZNBJZQ.js";
+import {
+  stopStarted
+} from "./chunk-JDPN3LTT.js";
+import {
+  appendAudit
+} from "./chunk-NTZRNEZM.js";
+import {
+  KEEP_RUNS,
+  dropVars,
+  pruneRuns
+} from "./chunk-SUV3VHKR.js";
+import {
+  startProcess
+} from "./chunk-I6FIOP7G.js";
+
+// src/node/run/runFlow.ts
+import { existsSync } from "node:fs";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { nodeDesigns } from "@ansible-flow/core/flow/semantic";
+import { runProcess, splitInputs } from "@ansible-flow/core/run/command";
+import { createSummarizer, summarizeRun } from "@ansible-flow/core/run/events";
+import { redactLine, redactText, secretValues } from "@ansible-flow/core/run/redact";
+var LIVE_MS = 500;
+var STALL_MS = 2e4;
+async function runFlow(request, hooks) {
+  const { id, mode, doc, code, startedAt, vaultPassword, partial } = request;
+  const fail = (error) => {
+    const run = { id, mode, state: "error", startedAt, error };
+    hooks.report(run);
+    return run;
+  };
+  const runDir = join(runsDir(request.storage, doc.flow.id), id);
+  await mkdir(runDir, { recursive: true });
+  const { plain, secret } = splitInputs(request.inputs);
+  const secrets = Object.keys(secret).length > 0;
+  await writeFile(join(runDir, "vars.json"), JSON.stringify(plain, null, 2), "utf8");
+  await pruneRuns(request.storage, doc.flow.id, request.keepRuns ?? KEEP_RUNS).catch(
+    () => void 0
+  );
+  const remote = request.env.kind === "ssh" ? request.env : void 0;
+  if (remote) {
+    const failed = await syncWorkspace(
+      remote,
+      { root: request.root, probe: request.probeDir },
+      request.syncAlso ?? []
+    ) ?? await putRunFile(remote, runDir, "vars.json", JSON.stringify(plain, null, 2));
+    if (failed) return fail(failed);
+  }
+  const spec = runProcess(
+    request.env,
+    { root: request.root, probe: request.probeDir },
+    {
+      playbook: request.playbook,
+      inventory: request.inventory,
+      check: mode === "check",
+      runDir,
+      vault: vaultPassword !== void 0,
+      secrets,
+      hasConfig: existsSync(join(request.root, "ansible.cfg")),
+      callbacks: request.callbacks
+    },
+    `afd-run-${id.toLowerCase()}`
+  );
+  if (request.audit)
+    await appendAudit(request.storage, { event: "launch", run: id, ...request.audit });
+  const running = {
+    id,
+    mode,
+    state: "running",
+    startedAt,
+    environment: request.environment,
+    source: "local",
+    flowVersion: doc.flow.version,
+    design: nodeDesigns(doc),
+    ...partial ? { partial } : {}
+  };
+  hooks.report(running);
+  const env = { ...spec.env };
+  if (spec.env.WSLENV && process.env.WSLENV)
+    env.WSLENV = `${process.env.WSLENV}:${spec.env.WSLENV}`;
+  if (vaultPassword !== void 0) env.AFD_VAULT_PASSWORD = vaultPassword;
+  if (secrets) env.AFD_SECRET_VARS = JSON.stringify(secret);
+  const t0 = Date.now();
+  const hidden = secretValues(vaultPassword ? { ...secret, "": vaultPassword } : secret);
+  const live = createSummarizer(code.routes);
+  const eventsFile = join(runDir, "events.jsonl");
+  const following = remote ? followRunFile(remote, runDir, "events.jsonl", eventsFile) : void 0;
+  let lastEvent = Date.now();
+  let changed = false;
+  let quiet = false;
+  const tail = tailFile(eventsFile, (lines) => {
+    for (const line of lines) live.push(redactLine(line, hidden));
+    lastEvent = Date.now();
+    changed = true;
+    quiet = false;
+  });
+  const ticker = setInterval(() => {
+    if (hooks.watchQuiet && !quiet && Date.now() - lastEvent > STALL_MS) {
+      quiet = true;
+      changed = true;
+      hooks.quiet?.();
+    }
+    if (!changed) return;
+    changed = false;
+    hooks.report({
+      ...running,
+      summary: live.summary({ partial: true }),
+      ...quiet ? { quiet } : {}
+    });
+  }, LIVE_MS);
+  let stopped = false;
+  const execute = hooks.execute ?? ((s, e) => startProcess(s, e, hooks.log ?? (() => {
+  })));
+  let execution;
+  try {
+    execution = await execute(spec, env, () => stopped);
+  } catch {
+    execution = { exit: Promise.resolve(void 0), terminate: () => void 0 };
+  }
+  const stop = async () => {
+    stopped = true;
+    await stopStarted(spec);
+    execution.terminate();
+  };
+  const onAbort = () => void stop();
+  if (request.signal?.aborted) onAbort();
+  else request.signal?.addEventListener("abort", onAbort, { once: true });
+  const release = hooks.started?.(stop);
+  const rc = await execution.exit;
+  release?.();
+  request.signal?.removeEventListener("abort", onAbort);
+  clearInterval(ticker);
+  await following?.stop();
+  await tail.stop();
+  if (remote) await removeRunDir(remote, runDir);
+  await dropVars(runDir).catch(() => void 0);
+  await hooks.ended?.();
+  let text = "";
+  try {
+    text = await readFile(eventsFile, "utf8");
+    if (hidden.length > 0) {
+      text = redactText(text, hidden);
+      await writeFile(eventsFile, text, "utf8");
+    }
+  } catch {
+  }
+  const summary = summarizeRun(text, code.routes);
+  hooks.finished?.({ stopped, rc, events: !!text.trim(), summary });
+  const done = {
+    ...running,
+    state: rc === void 0 || stopped ? "error" : "done",
+    finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    rc,
+    summary,
+    error: stopped ? "Stopped by the user" : rc === void 0 ? "The run could not be started" : text ? void 0 : "The run produced no events",
+    ...stopped ? { errorCode: "cancelled" } : {}
+  };
+  if (request.audit)
+    await appendAudit(request.storage, {
+      event: "finish",
+      run: id,
+      rc,
+      ms: Date.now() - t0,
+      hosts: summary.hosts.length,
+      failed: Object.keys(summary.outcome).length + summary.failures.length
+    });
+  await keepRun(runDir, done);
+  hooks.report(done);
+  return done;
+}
+
+export {
+  LIVE_MS,
+  STALL_MS,
+  runFlow
+};
+//# sourceMappingURL=chunk-LGUG2Q7Z.js.map

package/dist/chunks/chunk-LGUG2Q7Z.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/node/run/runFlow.ts"],
+  "sourcesContent": ["// One run of a flow's generated code (AFD-271): what the extension's local run and a server's run\n// have in common. The caller has generated the code, resolved the environment, collected the\n// inputs and asked whatever it asks; from there this writes the run's folder, starts\n// ansible-playbook, follows its events into a view of the run, redacts and keeps the result.\n//\n// What differs between hosts is given as hooks: how the process is started (a VS Code terminal\n// task, or a plain child process), who is told that the run went quiet, what is cleaned up.\nimport { existsSync } from 'node:fs';\nimport { mkdir, readFile, writeFile } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport type { GenerateResult } from '../../core/engine/types';\nimport { nodeDesigns } from '../../core/flow/semantic';\nimport type { FlowDocument } from '../../core/flow/types';\nimport type { RunView } from '../../core/protocol';\nimport { type ProcessSpec, runProcess, splitInputs } from '../../core/run/command';\nimport type { Environment } from '../../core/run/environment';\nimport { createSummarizer, type RunSummary, summarizeRun } from '../../core/run/events';\nimport { redactLine, redactText, secretValues } from '../../core/run/redact';\nimport { followRunFile, putRunFile, removeRunDir, syncWorkspace } from '../ssh/remote';\nimport { appendAudit } from './audit';\nimport { type Execution, startProcess } from './exec';\nimport { keepRun, runsDir } from './pastRuns';\nimport { stopStarted } from './stop';\nimport { dropVars, KEEP_RUNS, pruneRuns } from './storage';\nimport { tailFile } from './tail';\n\n/** How often a live run updates its view, at most (AFD-81). */\nexport const LIVE_MS = 500;\n/** No new events for this long: the run may wait for input. */\nexport const STALL_MS = 20_000;\n\nexport interface RunFlowRequest {\n  /** The run's id (`stamp()`), which names its folder. */\n  id: string;\n  startedAt: string;\n  mode: 'check' | 'real';\n  doc: FlowDocument;\n  /** The code that runs: its routes map the events back to nodes. */\n  code: GenerateResult;\n  env: Environment;\n  /** The environment's name for people (\"afd-ee:2.19 (docker)\"). */\n  environment: string;\n  /** Repository root on this machine. */\n  root: string;\n  /** Folder with afd_probe/ and callback_plugins/afd_events.py. */\n  probeDir: string;\n  /** The playbook to run, relative to `root`, with forward slashes. */\n  playbook: string;\n  inventory?: string;\n  /** Where runs are kept: `<storage>/runs/<flow id>/<run id>/`, and the audit log. */\n  storage: string;\n  /** How many runs of the flow to keep (default `KEEP_RUNS`). */\n  keepRuns?: number;\n  /** Flow input values. Secret ones never reach a file. */\n  inputs: Record<string, unknown>;\n  vaultPassword?: string;\n  /** The repository's own callbacks, kept running beside the run's (`repositoryCallbacks`). */\n  callbacks?: { enabled: string[]; paths: string[] };\n  /** AFD-244: the run is of a part of the flow; its code is in a folder of its own. */\n  partial?: RunView['partial'];\n  /** AFD-247: paths the SSH copy needs that Git does not list (a partial run's folder). */\n  syncAlso?: string[];\n  /** What the audit log says about the launch, besides the run's id. Never input values. */\n  audit?: Record<string, unknown>;\n  /** Stops the run when it aborts. */\n  signal?: AbortSignal;\n}\n\nexport interface RunFlowHooks {\n  /** The run's view: when it starts, as it goes (at most every `LIVE_MS`), and when it ends. */\n  report(run: RunView): void;\n  /**\n   * Starts the process. Default: a child process whose output goes to `log`. `stopping` says the\n   * run is being stopped, for a host whose process may end without an exit code then.\n   */\n  execute?(\n    spec: ProcessSpec,\n    env: Record<string, string>,\n    stopping: () => boolean,\n  ): Execution | Promise<Execution>;\n  /** The default process's output, line by line. */\n  log?(line: string): void;\n  /** The run started; `stop` ends it. Returns what to call when the run has ended. */\n  started?(stop: () => Promise<void>): (() => void) | undefined;\n  /** Whether to watch for a run gone quiet (no event for `STALL_MS`). */\n  watchQuiet?: boolean;\n  /** The run went quiet. */\n  quiet?(): void;\n  /** The process ended; before its events are read. */\n  ended?(): Promise<void>;\n  /** How the run ended, before it is kept and reported. */\n  finished?(end: {\n    stopped: boolean;\n    rc: number | undefined;\n    events: boolean;\n    summary: RunSummary;\n  }): void;\n}\n\n/** Runs the flow's code and resolves with the finished run (also reported). Never rejects. */\nexport async function runFlow(request: RunFlowRequest, hooks: RunFlowHooks): Promise<RunView> {\n  const { id, mode, doc, code, startedAt, vaultPassword, partial } = request;\n  const fail = (error: string): RunView => {\n    const run: RunView = { id, mode, state: 'error', startedAt, error };\n    hooks.report(run);\n    return run;\n  };\n\n  const runDir = join(runsDir(request.storage, doc.flow.id), id);\n  await mkdir(runDir, { recursive: true });\n  // Secret inputs travel in an environment variable only; vars.json goes when the run ends.\n  const { plain, secret } = splitInputs(request.inputs);\n  const secrets = Object.keys(secret).length > 0;\n  await writeFile(join(runDir, 'vars.json'), JSON.stringify(plain, null, 2), 'utf8');\n  await pruneRuns(request.storage, doc.flow.id, request.keepRuns ?? KEEP_RUNS).catch(\n    () => undefined,\n  );\n  // AFD-247: an SSH host runs a copy of the repository: brought up to date now, with the code just\n  // generated, and the inputs.\n  const remote = request.env.kind === 'ssh' ? request.env : undefined;\n  if (remote) {\n    const failed =\n      (await syncWorkspace(\n        remote,\n        { root: request.root, probe: request.probeDir },\n        request.syncAlso ?? [],\n      )) ?? (await putRunFile(remote, runDir, 'vars.json', JSON.stringify(plain, null, 2)));\n    if (failed) return fail(failed);\n  }\n  const spec = runProcess(\n    request.env,\n    { root: request.root, probe: request.probeDir },\n    {\n      playbook: request.playbook,\n      inventory: request.inventory,\n      check: mode === 'check',\n      runDir,\n      vault: vaultPassword !== undefined,\n      secrets,\n      hasConfig: existsSync(join(request.root, 'ansible.cfg')),\n      callbacks: request.callbacks,\n    },\n    `afd-run-${id.toLowerCase()}`,\n  );\n\n  if (request.audit)\n    await appendAudit(request.storage, { event: 'launch', run: id, ...request.audit });\n  const running: RunView = {\n    id,\n    mode,\n    state: 'running',\n    startedAt,\n    environment: request.environment,\n    source: 'local',\n    flowVersion: doc.flow.version,\n    design: nodeDesigns(doc),\n    ...(partial ? { partial } : {}),\n  };\n  hooks.report(running);\n\n  const env: Record<string, string> = { ...spec.env };\n  // AFD-75: names WSL should take from Windows join the ones already set, if any.\n  if (spec.env.WSLENV && process.env.WSLENV)\n    env.WSLENV = `${process.env.WSLENV}:${spec.env.WSLENV}`;\n  if (vaultPassword !== undefined) env.AFD_VAULT_PASSWORD = vaultPassword;\n  if (secrets) env.AFD_SECRET_VARS = JSON.stringify(secret);\n\n  const t0 = Date.now();\n  // The events as they come: a partial summary at most every LIVE_MS, secrets out.\n  // AFD-138: the vault password too, if a task prints it.\n  const hidden = secretValues(vaultPassword ? { ...secret, '': vaultPassword } : secret);\n  const live = createSummarizer(code.routes);\n  const eventsFile = join(runDir, 'events.jsonl');\n  // AFD-247: the events are written on the host; they are followed into the file here.\n  const following = remote ? followRunFile(remote, runDir, 'events.jsonl', eventsFile) : undefined;\n  let lastEvent = Date.now();\n  let changed = false;\n  let quiet = false;\n  const tail = tailFile(eventsFile, (lines) => {\n    for (const line of lines) live.push(redactLine(line, hidden));\n    lastEvent = Date.now();\n    changed = true;\n    quiet = false;\n  });\n  const ticker = setInterval(() => {\n    if (hooks.watchQuiet && !quiet && Date.now() - lastEvent > STALL_MS) {\n      quiet = true;\n      changed = true;\n      hooks.quiet?.();\n    }\n    if (!changed) return;\n    changed = false;\n    hooks.report({\n      ...running,\n      summary: live.summary({ partial: true }),\n      ...(quiet ? { quiet } : {}),\n    });\n  }, LIVE_MS);\n\n  // Stopping ends the process; the run then ends as stopped, not as an error.\n  let stopped = false;\n  const execute = hooks.execute ?? ((s, e) => startProcess(s, e, hooks.log ?? (() => {})));\n  let execution: Execution;\n  try {\n    execution = await execute(spec, env, () => stopped);\n  } catch {\n    execution = { exit: Promise.resolve(undefined), terminate: () => undefined };\n  }\n  const stop = async () => {\n    stopped = true;\n    // AFD-131: the container first, so the playbook stops changing hosts and writing events\n    // before the redaction pass below reads them; the process then ends by itself.\n    await stopStarted(spec);\n    execution.terminate();\n  };\n  const onAbort = () => void stop();\n  if (request.signal?.aborted) onAbort();\n  else request.signal?.addEventListener('abort', onAbort, { once: true });\n  const release = hooks.started?.(stop);\n  const rc = await execution.exit;\n  release?.();\n  request.signal?.removeEventListener('abort', onAbort);\n  clearInterval(ticker);\n  await following?.stop();\n  await tail.stop();\n  if (remote) await removeRunDir(remote, runDir);\n\n  await dropVars(runDir).catch(() => undefined);\n  await hooks.ended?.();\n  let text = '';\n  try {\n    text = await readFile(eventsFile, 'utf8');\n    // The kept events hold no secret input value either (the output now comes with them).\n    if (hidden.length > 0) {\n      text = redactText(text, hidden);\n      await writeFile(eventsFile, text, 'utf8');\n    }\n  } catch {}\n  const summary = summarizeRun(text, code.routes);\n  hooks.finished?.({ stopped, rc, events: !!text.trim(), summary });\n  const done: RunView = {\n    ...running,\n    state: rc === undefined || stopped ? 'error' : 'done',\n    finishedAt: new Date().toISOString(),\n    rc,\n    summary,\n    error: stopped\n      ? 'Stopped by the user'\n      : rc === undefined\n        ? 'The run could not be started'\n        : text\n          ? undefined\n          : 'The run produced no events',\n    ...(stopped ? { errorCode: 'cancelled' as const } : {}),\n  };\n  if (request.audit)\n    await appendAudit(request.storage, {\n      event: 'finish',\n      run: id,\n      rc,\n      ms: Date.now() - t0,\n      hosts: summary.hosts.length,\n      failed: Object.keys(summary.outcome).length + summary.failures.length,\n    });\n  // AFD-245: kept with its events, so the run can be shown again later.\n  await keepRun(runDir, done);\n  hooks.report(done);\n  return done;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA,SAAS,kBAAkB;AAC3B,SAAS,OAAO,UAAU,iBAAiB;AAC3C,SAAS,YAAY;AAErB,SAAS,mBAAmB;AAG5B,SAA2B,YAAY,mBAAmB;AAE1D,SAAS,kBAAmC,oBAAoB;AAChE,SAAS,YAAY,YAAY,oBAAoB;AAU9C,IAAM,UAAU;AAEhB,IAAM,WAAW;AAuExB,eAAsB,QAAQ,SAAyB,OAAuC;AAC5F,QAAM,EAAE,IAAI,MAAM,KAAK,MAAM,WAAW,eAAe,QAAQ,IAAI;AACnE,QAAM,OAAO,CAAC,UAA2B;AACvC,UAAM,MAAe,EAAE,IAAI,MAAM,OAAO,SAAS,WAAW,MAAM;AAClE,UAAM,OAAO,GAAG;AAChB,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,KAAK,QAAQ,QAAQ,SAAS,IAAI,KAAK,EAAE,GAAG,EAAE;AAC7D,QAAM,MAAM,QAAQ,EAAE,WAAW,KAAK,CAAC;AAEvC,QAAM,EAAE,OAAO,OAAO,IAAI,YAAY,QAAQ,MAAM;AACpD,QAAM,UAAU,OAAO,KAAK,MAAM,EAAE,SAAS;AAC7C,QAAM,UAAU,KAAK,QAAQ,WAAW,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,GAAG,MAAM;AACjF,QAAM,UAAU,QAAQ,SAAS,IAAI,KAAK,IAAI,QAAQ,YAAY,SAAS,EAAE;AAAA,IAC3E,MAAM;AAAA,EACR;AAGA,QAAM,SAAS,QAAQ,IAAI,SAAS,QAAQ,QAAQ,MAAM;AAC1D,MAAI,QAAQ;AACV,UAAM,SACH,MAAM;AAAA,MACL;AAAA,MACA,EAAE,MAAM,QAAQ,MAAM,OAAO,QAAQ,SAAS;AAAA,MAC9C,QAAQ,YAAY,CAAC;AAAA,IACvB,KAAO,MAAM,WAAW,QAAQ,QAAQ,aAAa,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AACrF,QAAI,OAAQ,QAAO,KAAK,MAAM;AAAA,EAChC;AACA,QAAM,OAAO;AAAA,IACX,QAAQ;AAAA,IACR,EAAE,MAAM,QAAQ,MAAM,OAAO,QAAQ,SAAS;AAAA,IAC9C;AAAA,MACE,UAAU,QAAQ;AAAA,MAClB,WAAW,QAAQ;AAAA,MACnB,OAAO,SAAS;AAAA,MAChB;AAAA,MACA,OAAO,kBAAkB;AAAA,MACzB;AAAA,MACA,WAAW,WAAW,KAAK,QAAQ,MAAM,aAAa,CAAC;AAAA,MACvD,WAAW,QAAQ;AAAA,IACrB;AAAA,IACA,WAAW,GAAG,YAAY,CAAC;AAAA,EAC7B;AAEA,MAAI,QAAQ;AACV,UAAM,YAAY,QAAQ,SAAS,EAAE,OAAO,UAAU,KAAK,IAAI,GAAG,QAAQ,MAAM,CAAC;AACnF,QAAM,UAAmB;AAAA,IACvB;AAAA,IACA;AAAA,IACA,OAAO;AAAA,IACP;AAAA,IACA,aAAa,QAAQ;AAAA,IACrB,QAAQ;AAAA,IACR,aAAa,IAAI,KAAK;AAAA,IACtB,QAAQ,YAAY,GAAG;AAAA,IACvB,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/B;AACA,QAAM,OAAO,OAAO;AAEpB,QAAM,MAA8B,EAAE,GAAG,KAAK,IAAI;AAElD,MAAI,KAAK,IAAI,UAAU,QAAQ,IAAI;AACjC,QAAI,SAAS,GAAG,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,MAAM;AACvD,MAAI,kBAAkB,OAAW,KAAI,qBAAqB;AAC1D,MAAI,QAAS,KAAI,kBAAkB,KAAK,UAAU,MAAM;AAExD,QAAM,KAAK,KAAK,IAAI;AAGpB,QAAM,SAAS,aAAa,gBAAgB,EAAE,GAAG,QAAQ,IAAI,cAAc,IAAI,MAAM;AACrF,QAAM,OAAO,iBAAiB,KAAK,MAAM;AACzC,QAAM,aAAa,KAAK,QAAQ,cAAc;AAE9C,QAAM,YAAY,SAAS,cAAc,QAAQ,QAAQ,gBAAgB,UAAU,IAAI;AACvF,MAAI,YAAY,KAAK,IAAI;AACzB,MAAI,UAAU;AACd,MAAI,QAAQ;AACZ,QAAM,OAAO,SAAS,YAAY,CAAC,UAAU;AAC3C,eAAW,QAAQ,MAAO,MAAK,KAAK,WAAW,MAAM,MAAM,CAAC;AAC5D,gBAAY,KAAK,IAAI;AACrB,cAAU;AACV,YAAQ;AAAA,EACV,CAAC;AACD,QAAM,SAAS,YAAY,MAAM;AAC/B,QAAI,MAAM,cAAc,CAAC,SAAS,KAAK,IAAI,IAAI,YAAY,UAAU;AACnE,cAAQ;AACR,gBAAU;AACV,YAAM,QAAQ;AAAA,IAChB;AACA,QAAI,CAAC,QAAS;AACd,cAAU;AACV,UAAM,OAAO;AAAA,MACX,GAAG;AAAA,MACH,SAAS,KAAK,QAAQ,EAAE,SAAS,KAAK,CAAC;AAAA,MACvC,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IAC3B,CAAC;AAAA,EACH,GAAG,OAAO;AAGV,MAAI,UAAU;AACd,QAAM,UAAU,MAAM,YAAY,CAAC,GAAG,MAAM,aAAa,GAAG,GAAG,MAAM,QAAQ,MAAM;AAAA,EAAC,EAAE;AACtF,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,QAAQ,MAAM,KAAK,MAAM,OAAO;AAAA,EACpD,QAAQ;AACN,gBAAY,EAAE,MAAM,QAAQ,QAAQ,MAAS,GAAG,WAAW,MAAM,OAAU;AAAA,EAC7E;AACA,QAAM,OAAO,YAAY;AACvB,cAAU;AAGV,UAAM,YAAY,IAAI;AACtB,cAAU,UAAU;AAAA,EACtB;AACA,QAAM,UAAU,MAAM,KAAK,KAAK;AAChC,MAAI,QAAQ,QAAQ,QAAS,SAAQ;AAAA,MAChC,SAAQ,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACtE,QAAM,UAAU,MAAM,UAAU,IAAI;AACpC,QAAM,KAAK,MAAM,UAAU;AAC3B,YAAU;AACV,UAAQ,QAAQ,oBAAoB,SAAS,OAAO;AACpD,gBAAc,MAAM;AACpB,QAAM,WAAW,KAAK;AACtB,QAAM,KAAK,KAAK;AAChB,MAAI,OAAQ,OAAM,aAAa,QAAQ,MAAM;AAE7C,QAAM,SAAS,MAAM,EAAE,MAAM,MAAM,MAAS;AAC5C,QAAM,MAAM,QAAQ;AACpB,MAAI,OAAO;AACX,MAAI;AACF,WAAO,MAAM,SAAS,YAAY,MAAM;AAExC,QAAI,OAAO,SAAS,GAAG;AACrB,aAAO,WAAW,MAAM,MAAM;AAC9B,YAAM,UAAU,YAAY,MAAM,MAAM;AAAA,IAC1C;AAAA,EACF,QAAQ;AAAA,EAAC;AACT,QAAM,UAAU,aAAa,MAAM,KAAK,MAAM;AAC9C,QAAM,WAAW,EAAE,SAAS,IAAI,QAAQ,CAAC,CAAC,KAAK,KAAK,GAAG,QAAQ,CAAC;AAChE,QAAM,OAAgB;AAAA,IACpB,GAAG;AAAA,IACH,OAAO,OAAO,UAAa,UAAU,UAAU;AAAA,IAC/C,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,IACnC;AAAA,IACA;AAAA,IACA,OAAO,UACH,wBACA,OAAO,SACL,iCACA,OACE,SACA;AAAA,IACR,GAAI,UAAU,EAAE,WAAW,YAAqB,IAAI,CAAC;AAAA,EACvD;AACA,MAAI,QAAQ;AACV,UAAM,YAAY,QAAQ,SAAS;AAAA,MACjC,OAAO;AAAA,MACP,KAAK;AAAA,MACL;AAAA,MACA,IAAI,KAAK,IAAI,IAAI;AAAA,MACjB,OAAO,QAAQ,MAAM;AAAA,MACrB,QAAQ,OAAO,KAAK,QAAQ,OAAO,EAAE,SAAS,QAAQ,SAAS;AAAA,IACjE,CAAC;AAEH,QAAM,QAAQ,QAAQ,IAAI;AAC1B,QAAM,OAAO,IAAI;AACjB,SAAO;AACT;",
+  "names": []
+}

package/dist/chunks/chunk-NTZRNEZM.js

@@ -0,0 +1,25 @@
+import {
+  rotateLog
+} from "./chunk-SUV3VHKR.js";
+
+// src/node/run/audit.ts
+import { appendFile, mkdir } from "node:fs/promises";
+import { join } from "node:path";
+var AUDIT_ROTATE_BYTES = 1024 * 1024;
+var AUDIT_OLD_FILES = 2;
+function auditFile(storage) {
+  return join(storage, "audit.jsonl");
+}
+async function appendAudit(storage, entry) {
+  await mkdir(storage, { recursive: true });
+  await rotateLog(auditFile(storage), AUDIT_ROTATE_BYTES, AUDIT_OLD_FILES);
+  const line = `${JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), ...entry })}
+`;
+  await appendFile(auditFile(storage), line, "utf8");
+}
+
+export {
+  auditFile,
+  appendAudit
+};
+//# sourceMappingURL=chunk-NTZRNEZM.js.map

package/dist/chunks/chunk-NTZRNEZM.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/node/run/audit.ts"],
+  "sourcesContent": ["// Local audit log of run launches (decision 18): one JSON object per line in a storage folder. No\n// secrets: input values and passwords are never written here. The log rotates at 1 MB and keeps\n// two older files (AFD-29).\nimport { appendFile, mkdir } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { rotateLog } from './storage';\n\n/** Size at which audit.jsonl moves to audit.1.jsonl; audit.1 and audit.2 are kept. */\nconst AUDIT_ROTATE_BYTES = 1024 * 1024;\nconst AUDIT_OLD_FILES = 2;\n\nexport function auditFile(storage: string): string {\n  return join(storage, 'audit.jsonl');\n}\n\nexport async function appendAudit(storage: string, entry: Record<string, unknown>): Promise<void> {\n  await mkdir(storage, { recursive: true });\n  await rotateLog(auditFile(storage), AUDIT_ROTATE_BYTES, AUDIT_OLD_FILES);\n  const line = `${JSON.stringify({ ts: new Date().toISOString(), ...entry })}\\n`;\n  await appendFile(auditFile(storage), line, 'utf8');\n}\n"],
+  "mappings": ";;;;;AAGA,SAAS,YAAY,aAAa;AAClC,SAAS,YAAY;AAIrB,IAAM,qBAAqB,OAAO;AAClC,IAAM,kBAAkB;AAEjB,SAAS,UAAU,SAAyB;AACjD,SAAO,KAAK,SAAS,aAAa;AACpC;AAEA,eAAsB,YAAY,SAAiB,OAA+C;AAChG,QAAM,MAAM,SAAS,EAAE,WAAW,KAAK,CAAC;AACxC,QAAM,UAAU,UAAU,OAAO,GAAG,oBAAoB,eAAe;AACvE,QAAM,OAAO,GAAG,KAAK,UAAU,EAAE,KAAI,oBAAI,KAAK,GAAE,YAAY,GAAG,GAAG,MAAM,CAAC,CAAC;AAAA;AAC1E,QAAM,WAAW,UAAU,OAAO,GAAG,MAAM,MAAM;AACnD;",
+  "names": []
+}

package/dist/chunks/chunk-RETJPSKL.js

@@ -0,0 +1,123 @@
+import {
+  syncFolder
+} from "./chunk-THNSGAKN.js";
+import {
+  pipe,
+  run,
+  sshWhy,
+  tarExe
+} from "./chunk-FG53MLUX.js";
+
+// src/node/ssh/remote.ts
+import { spawn } from "node:child_process";
+import { appendFileSync, mkdirSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import {
+  checkCommand,
+  fetchDirCommand,
+  followCommand,
+  openDirCommand,
+  parseHostFacts,
+  readFileCommand,
+  remotePaths,
+  removeCommand,
+  writeFileCommand
+} from "@ansible-flow/core/run/ssh";
+async function syncWorkspace(env, paths, include = []) {
+  for (const [from, into] of [
+    [paths.probe, "probe"],
+    [paths.root, "repo"]
+  ]) {
+    const r = await syncFolder(env, from, into, into === "repo" ? include : []);
+    if (!r.ok) return r.error;
+  }
+  return void 0;
+}
+async function putRunFile(env, runDir, name, text) {
+  const there = remotePaths(env, runDir).run;
+  const r = await run(writeFileCommand(env, `${there}/${name}`, !!env.container), { input: text });
+  return r.code === 0 ? void 0 : `Could not write ${name} on ${env.host}: ${sshWhy(r.stderr)}`;
+}
+function followRunFile(env, runDir, name, local) {
+  const there = `${remotePaths(env, runDir).run}/${name}`;
+  mkdirSync(dirname(local), { recursive: true });
+  writeFileSync(local, "");
+  const c = followCommand(env, there);
+  let proc;
+  try {
+    proc = spawn(c.command, c.args, { stdio: ["ignore", "pipe", "ignore"], windowsHide: true });
+    proc.stdout?.on("data", (d) => {
+      try {
+        appendFileSync(local, d);
+      } catch {
+      }
+    });
+    proc.on("error", () => void 0);
+  } catch {
+    proc = void 0;
+  }
+  return {
+    async stop() {
+      proc?.kill();
+      const whole = await run(readFileCommand(env, there), { binary: true, timeoutMs: 6e4 });
+      if (whole.code === 0 && whole.out.length > 0) {
+        try {
+          writeFileSync(local, whole.out);
+        } catch {
+        }
+      }
+    }
+  };
+}
+async function putRunFolder(env, runDir, events) {
+  const there = remotePaths(env, runDir).run;
+  const r = await syncFolder(env, runDir, there.slice(env.dir.length + 1));
+  if (!r.ok) return r.error;
+  if (!events) return void 0;
+  const made = await run(openDirCommand(env, `${remotePaths(env, runDir).run}/${events}`));
+  return made.code === 0 ? void 0 : `Could not prepare the run on ${env.host}: ${sshWhy(made.stderr)}`;
+}
+async function fetchRunFile(env, runDir, name, local) {
+  const whole = await run(readFileCommand(env, `${remotePaths(env, runDir).run}/${name}`), {
+    binary: true,
+    timeoutMs: 6e4
+  });
+  if (whole.code !== 0) return;
+  mkdirSync(dirname(local), { recursive: true });
+  writeFileSync(local, whole.out);
+}
+async function removeRunDir(env, runDir) {
+  const there = remotePaths(env, runDir).run;
+  if (there) await run(removeCommand(env, there), { timeoutMs: 3e4 });
+}
+async function fetchCache(env, localCache) {
+  mkdirSync(localCache, { recursive: true });
+  const r = await pipe(
+    fetchDirCommand(env, remotePaths(env).cache),
+    { command: tarExe(), args: ["-xf", "-", "-C", localCache] },
+    { timeoutMs: 6e5 }
+  );
+  return r.from === 0 && r.to === 0 ? void 0 : `Could not fetch the catalog from ${env.host}: ${sshWhy(r.stderr)}`;
+}
+async function hostFacts(host) {
+  const r = await run(checkCommand(host), { timeoutMs: 3e4 });
+  if (r.code !== 0) return { error: `Could not connect to ${host}: ${sshWhy(r.stderr)}` };
+  return { facts: parseHostFacts(r.stdout) };
+}
+async function copyFile(env, content, remotePath) {
+  const r = await run(writeFileCommand(env, remotePath), { input: content });
+  return r.code === 0 ? void 0 : `Could not copy the file to ${env.host}: ${sshWhy(r.stderr)}`;
+}
+
+export {
+  syncWorkspace,
+  putRunFile,
+  followRunFile,
+  putRunFolder,
+  fetchRunFile,
+  removeRunDir,
+  fetchCache,
+  hostFacts,
+  copyFile
+};
+//# sourceMappingURL=chunk-RETJPSKL.js.map

package/dist/chunks/chunk-RETJPSKL.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/node/ssh/remote.ts"],
+  "sourcesContent": ["// AFD-247: what a run on an SSH host needs around the run itself: its inputs put there, its\n// events followed as they are written, the folder removed after, the catalog's dumps fetched, and\n// a look at what the host has.\nimport { type ChildProcess, spawn } from 'node:child_process';\nimport { appendFileSync, mkdirSync, writeFileSync } from 'node:fs';\nimport { dirname } from 'node:path';\nimport type { Environment } from '../../core/run/environment';\nimport {\n  checkCommand,\n  fetchDirCommand,\n  followCommand,\n  type HostFacts,\n  openDirCommand,\n  parseHostFacts,\n  readFileCommand,\n  remotePaths,\n  removeCommand,\n  writeFileCommand,\n} from '../../core/run/ssh';\nimport { pipe, run, sshWhy, tarExe } from './exec';\nimport { syncFolder } from './sync';\n\nexport type SshEnv = Extract<Environment, { kind: 'ssh' }>;\n\n/** The repository and the probe on the host, as they are here now. */\nexport async function syncWorkspace(\n  env: SshEnv,\n  paths: { root: string; probe: string },\n  /** Folders of the repository copied whatever .gitignore says. */\n  include: readonly string[] = [],\n): Promise<string | undefined> {\n  for (const [from, into] of [\n    [paths.probe, 'probe'],\n    [paths.root, 'repo'],\n  ] as const) {\n    const r = await syncFolder(env, from, into, into === 'repo' ? include : []);\n    if (!r.ok) return r.error;\n  }\n  return undefined;\n}\n\n/** Puts a file of the run folder on the host (its inputs, a generated config). */\nexport async function putRunFile(\n  env: SshEnv,\n  runDir: string,\n  name: string,\n  text: string,\n): Promise<string | undefined> {\n  const there = remotePaths(env, runDir).run;\n  // A container's own user writes the events beside it.\n  const r = await run(writeFileCommand(env, `${there}/${name}`, !!env.container), { input: text });\n  return r.code === 0 ? undefined : `Could not write ${name} on ${env.host}: ${sshWhy(r.stderr)}`;\n}\n\n/**\n * Follows a file of the run folder on the host into the same file here, so what reads the local\n * one (the live summary on the canvas) sees the run as it goes. `stop` ends the following and\n * then writes the whole file once more: nothing the last moments wrote is lost.\n */\nexport function followRunFile(\n  env: SshEnv,\n  runDir: string,\n  name: string,\n  local: string,\n): { stop(): Promise<void> } {\n  const there = `${remotePaths(env, runDir).run}/${name}`;\n  mkdirSync(dirname(local), { recursive: true });\n  writeFileSync(local, '');\n  const c = followCommand(env, there);\n  let proc: ChildProcess | undefined;\n  try {\n    proc = spawn(c.command, c.args, { stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true });\n    proc.stdout?.on('data', (d: Buffer) => {\n      try {\n        appendFileSync(local, d);\n      } catch {\n        // The run folder went away (pruned): the final read below has nowhere to write either.\n      }\n    });\n    proc.on('error', () => undefined);\n  } catch {\n    proc = undefined;\n  }\n  return {\n    async stop() {\n      proc?.kill();\n      const whole = await run(readFileCommand(env, there), { binary: true, timeoutMs: 60_000 });\n      if (whole.code === 0 && whole.out.length > 0) {\n        try {\n          writeFileSync(local, whole.out);\n        } catch {\n          // As above.\n        }\n      }\n    },\n  };\n}\n\n/**\n * AFD-247: a scenario's folder (its build of the flow, inventory and vars) on the host, as the\n * run folder `runDir`. `events`: a folder in it for an image's own user to write the events to.\n */\nexport async function putRunFolder(\n  env: SshEnv,\n  runDir: string,\n  events?: string,\n): Promise<string | undefined> {\n  const there = remotePaths(env, runDir).run as string;\n  const r = await syncFolder(env, runDir, there.slice(env.dir.length + 1));\n  if (!r.ok) return r.error;\n  if (!events) return undefined;\n  const made = await run(openDirCommand(env, `${remotePaths(env, runDir).run}/${events}`));\n  return made.code === 0\n    ? undefined\n    : `Could not prepare the run on ${env.host}: ${sshWhy(made.stderr)}`;\n}\n\n/** A file of the run folder on the host, read whole into the same file here. */\nexport async function fetchRunFile(\n  env: SshEnv,\n  runDir: string,\n  name: string,\n  local: string,\n): Promise<void> {\n  const whole = await run(readFileCommand(env, `${remotePaths(env, runDir).run}/${name}`), {\n    binary: true,\n    timeoutMs: 60_000,\n  });\n  if (whole.code !== 0) return;\n  mkdirSync(dirname(local), { recursive: true });\n  writeFileSync(local, whole.out);\n}\n\n/** Removes the run's folder on the host (its inputs are not kept there). */\nexport async function removeRunDir(env: SshEnv, runDir: string): Promise<void> {\n  const there = remotePaths(env, runDir).run;\n  if (there) await run(removeCommand(env, there), { timeoutMs: 30_000 });\n}\n\n/** Brings the catalog dumps the probe wrote on the host into the cache here. */\nexport async function fetchCache(env: SshEnv, localCache: string): Promise<string | undefined> {\n  mkdirSync(localCache, { recursive: true });\n  const r = await pipe(\n    fetchDirCommand(env, remotePaths(env).cache),\n    { command: tarExe(), args: ['-xf', '-', '-C', localCache] },\n    { timeoutMs: 600_000 },\n  );\n  return r.from === 0 && r.to === 0\n    ? undefined\n    : `Could not fetch the catalog from ${env.host}: ${sshWhy(r.stderr)}`;\n}\n\n/** What the host has; an error when it cannot be reached. */\nexport async function hostFacts(host: string): Promise<{ facts?: HostFacts; error?: string }> {\n  const r = await run(checkCommand(host), { timeoutMs: 30_000 });\n  if (r.code !== 0) return { error: `Could not connect to ${host}: ${sshWhy(r.stderr)}` };\n  return { facts: parseHostFacts(r.stdout) };\n}\n\n/** Copies one file to the host, readable by the account alone (a vault password file). */\nexport async function copyFile(\n  env: Pick<SshEnv, 'host' | 'dir'>,\n  content: Buffer,\n  remotePath: string,\n): Promise<string | undefined> {\n  const r = await run(writeFileCommand(env, remotePath), { input: content });\n  return r.code === 0 ? undefined : `Could not copy the file to ${env.host}: ${sshWhy(r.stderr)}`;\n}\n"],
+  "mappings": ";;;;;;;;;;;AAGA,SAA4B,aAAa;AACzC,SAAS,gBAAgB,WAAW,qBAAqB;AACzD,SAAS,eAAe;AAExB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOP,eAAsB,cACpB,KACA,OAEA,UAA6B,CAAC,GACD;AAC7B,aAAW,CAAC,MAAM,IAAI,KAAK;AAAA,IACzB,CAAC,MAAM,OAAO,OAAO;AAAA,IACrB,CAAC,MAAM,MAAM,MAAM;AAAA,EACrB,GAAY;AACV,UAAM,IAAI,MAAM,WAAW,KAAK,MAAM,MAAM,SAAS,SAAS,UAAU,CAAC,CAAC;AAC1E,QAAI,CAAC,EAAE,GAAI,QAAO,EAAE;AAAA,EACtB;AACA,SAAO;AACT;AAGA,eAAsB,WACpB,KACA,QACA,MACA,MAC6B;AAC7B,QAAM,QAAQ,YAAY,KAAK,MAAM,EAAE;AAEvC,QAAM,IAAI,MAAM,IAAI,iBAAiB,KAAK,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,SAAS,GAAG,EAAE,OAAO,KAAK,CAAC;AAC/F,SAAO,EAAE,SAAS,IAAI,SAAY,mBAAmB,IAAI,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,MAAM,CAAC;AAC/F;AAOO,SAAS,cACd,KACA,QACA,MACA,OAC2B;AAC3B,QAAM,QAAQ,GAAG,YAAY,KAAK,MAAM,EAAE,GAAG,IAAI,IAAI;AACrD,YAAU,QAAQ,KAAK,GAAG,EAAE,WAAW,KAAK,CAAC;AAC7C,gBAAc,OAAO,EAAE;AACvB,QAAM,IAAI,cAAc,KAAK,KAAK;AAClC,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,QAAQ,QAAQ,GAAG,aAAa,KAAK,CAAC;AAC1F,SAAK,QAAQ,GAAG,QAAQ,CAAC,MAAc;AACrC,UAAI;AACF,uBAAe,OAAO,CAAC;AAAA,MACzB,QAAQ;AAAA,MAER;AAAA,IACF,CAAC;AACD,SAAK,GAAG,SAAS,MAAM,MAAS;AAAA,EAClC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,MAAM,OAAO;AACX,YAAM,KAAK;AACX,YAAM,QAAQ,MAAM,IAAI,gBAAgB,KAAK,KAAK,GAAG,EAAE,QAAQ,MAAM,WAAW,IAAO,CAAC;AACxF,UAAI,MAAM,SAAS,KAAK,MAAM,IAAI,SAAS,GAAG;AAC5C,YAAI;AACF,wBAAc,OAAO,MAAM,GAAG;AAAA,QAChC,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAMA,eAAsB,aACpB,KACA,QACA,QAC6B;AAC7B,QAAM,QAAQ,YAAY,KAAK,MAAM,EAAE;AACvC,QAAM,IAAI,MAAM,WAAW,KAAK,QAAQ,MAAM,MAAM,IAAI,IAAI,SAAS,CAAC,CAAC;AACvE,MAAI,CAAC,EAAE,GAAI,QAAO,EAAE;AACpB,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,OAAO,MAAM,IAAI,eAAe,KAAK,GAAG,YAAY,KAAK,MAAM,EAAE,GAAG,IAAI,MAAM,EAAE,CAAC;AACvF,SAAO,KAAK,SAAS,IACjB,SACA,gCAAgC,IAAI,IAAI,KAAK,OAAO,KAAK,MAAM,CAAC;AACtE;AAGA,eAAsB,aACpB,KACA,QACA,MACA,OACe;AACf,QAAM,QAAQ,MAAM,IAAI,gBAAgB,KAAK,GAAG,YAAY,KAAK,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,GAAG;AAAA,IACvF,QAAQ;AAAA,IACR,WAAW;AAAA,EACb,CAAC;AACD,MAAI,MAAM,SAAS,EAAG;AACtB,YAAU,QAAQ,KAAK,GAAG,EAAE,WAAW,KAAK,CAAC;AAC7C,gBAAc,OAAO,MAAM,GAAG;AAChC;AAGA,eAAsB,aAAa,KAAa,QAA+B;AAC7E,QAAM,QAAQ,YAAY,KAAK,MAAM,EAAE;AACvC,MAAI,MAAO,OAAM,IAAI,cAAc,KAAK,KAAK,GAAG,EAAE,WAAW,IAAO,CAAC;AACvE;AAGA,eAAsB,WAAW,KAAa,YAAiD;AAC7F,YAAU,YAAY,EAAE,WAAW,KAAK,CAAC;AACzC,QAAM,IAAI,MAAM;AAAA,IACd,gBAAgB,KAAK,YAAY,GAAG,EAAE,KAAK;AAAA,IAC3C,EAAE,SAAS,OAAO,GAAG,MAAM,CAAC,OAAO,KAAK,MAAM,UAAU,EAAE;AAAA,IAC1D,EAAE,WAAW,IAAQ;AAAA,EACvB;AACA,SAAO,EAAE,SAAS,KAAK,EAAE,OAAO,IAC5B,SACA,oCAAoC,IAAI,IAAI,KAAK,OAAO,EAAE,MAAM,CAAC;AACvE;AAGA,eAAsB,UAAU,MAA8D;AAC5F,QAAM,IAAI,MAAM,IAAI,aAAa,IAAI,GAAG,EAAE,WAAW,IAAO,CAAC;AAC7D,MAAI,EAAE,SAAS,EAAG,QAAO,EAAE,OAAO,wBAAwB,IAAI,KAAK,OAAO,EAAE,MAAM,CAAC,GAAG;AACtF,SAAO,EAAE,OAAO,eAAe,EAAE,MAAM,EAAE;AAC3C;AAGA,eAAsB,SACpB,KACA,SACA,YAC6B;AAC7B,QAAM,IAAI,MAAM,IAAI,iBAAiB,KAAK,UAAU,GAAG,EAAE,OAAO,QAAQ,CAAC;AACzE,SAAO,EAAE,SAAS,IAAI,SAAY,8BAA8B,IAAI,IAAI,KAAK,OAAO,EAAE,MAAM,CAAC;AAC/F;",
+  "names": []
+}

package/dist/chunks/chunk-SSZNBJZQ.js

@@ -0,0 +1,52 @@
+// src/node/run/tail.ts
+import { open, stat } from "node:fs/promises";
+import { splitLines } from "@ansible-flow/core/run/events";
+function tailFile(path, onLines, intervalMs = 250) {
+  let offset = 0;
+  let carry = "";
+  let decoder = new TextDecoder();
+  let busy = Promise.resolve();
+  const read = async () => {
+    let size;
+    try {
+      size = (await stat(path)).size;
+    } catch {
+      return;
+    }
+    if (size < offset) {
+      offset = 0;
+      carry = "";
+      decoder = new TextDecoder();
+    }
+    if (size === offset) return;
+    const fh = await open(path, "r");
+    try {
+      const buf = Buffer.alloc(size - offset);
+      const { bytesRead } = await fh.read(buf, 0, buf.length, offset);
+      offset += bytesRead;
+      const r = splitLines(carry, decoder.decode(buf.subarray(0, bytesRead), { stream: true }));
+      carry = r.carry;
+      if (r.lines.length > 0) onLines(r.lines);
+    } finally {
+      await fh.close();
+    }
+  };
+  const tick = () => {
+    busy = busy.then(read).catch(() => void 0);
+    return busy;
+  };
+  const timer = setInterval(tick, intervalMs);
+  return {
+    async stop() {
+      clearInterval(timer);
+      await tick();
+      if (carry.trim()) onLines([carry]);
+      carry = "";
+    }
+  };
+}
+
+export {
+  tailFile
+};
+//# sourceMappingURL=chunk-SSZNBJZQ.js.map

package/dist/chunks/chunk-SSZNBJZQ.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/node/run/tail.ts"],
+  "sourcesContent": ["// AFD-81: events.jsonl read while the run writes it. Polling, not fs.watch: change events do not\n// reach a file on a Docker bind mount or under /mnt in WSL reliably on Windows.\nimport { open, stat } from 'node:fs/promises';\nimport { splitLines } from '../../core/run/events';\n\nexport interface Tail {\n  /** One last read; a final line without a line break counts too. */\n  stop(): Promise<void>;\n}\n\nexport function tailFile(path: string, onLines: (lines: string[]) => void, intervalMs = 250): Tail {\n  let offset = 0;\n  let carry = '';\n  // A UTF-8 character cut between two reads waits for its other bytes.\n  let decoder = new TextDecoder();\n  let busy: Promise<void> = Promise.resolve();\n  const read = async () => {\n    let size: number;\n    try {\n      size = (await stat(path)).size;\n    } catch {\n      return; // not written yet\n    }\n    if (size < offset) {\n      // Written again from the start.\n      offset = 0;\n      carry = '';\n      decoder = new TextDecoder();\n    }\n    if (size === offset) return;\n    const fh = await open(path, 'r');\n    try {\n      const buf = Buffer.alloc(size - offset);\n      const { bytesRead } = await fh.read(buf, 0, buf.length, offset);\n      offset += bytesRead;\n      const r = splitLines(carry, decoder.decode(buf.subarray(0, bytesRead), { stream: true }));\n      carry = r.carry;\n      if (r.lines.length > 0) onLines(r.lines);\n    } finally {\n      await fh.close();\n    }\n  };\n  const tick = () => {\n    busy = busy.then(read).catch(() => undefined);\n    return busy;\n  };\n  const timer = setInterval(tick, intervalMs);\n  return {\n    async stop() {\n      clearInterval(timer);\n      await tick();\n      if (carry.trim()) onLines([carry]);\n      carry = '';\n    },\n  };\n}\n"],
+  "mappings": ";AAEA,SAAS,MAAM,YAAY;AAC3B,SAAS,kBAAkB;AAOpB,SAAS,SAAS,MAAc,SAAoC,aAAa,KAAW;AACjG,MAAI,SAAS;AACb,MAAI,QAAQ;AAEZ,MAAI,UAAU,IAAI,YAAY;AAC9B,MAAI,OAAsB,QAAQ,QAAQ;AAC1C,QAAM,OAAO,YAAY;AACvB,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,KAAK,IAAI,GAAG;AAAA,IAC5B,QAAQ;AACN;AAAA,IACF;AACA,QAAI,OAAO,QAAQ;AAEjB,eAAS;AACT,cAAQ;AACR,gBAAU,IAAI,YAAY;AAAA,IAC5B;AACA,QAAI,SAAS,OAAQ;AACrB,UAAM,KAAK,MAAM,KAAK,MAAM,GAAG;AAC/B,QAAI;AACF,YAAM,MAAM,OAAO,MAAM,OAAO,MAAM;AACtC,YAAM,EAAE,UAAU,IAAI,MAAM,GAAG,KAAK,KAAK,GAAG,IAAI,QAAQ,MAAM;AAC9D,gBAAU;AACV,YAAM,IAAI,WAAW,OAAO,QAAQ,OAAO,IAAI,SAAS,GAAG,SAAS,GAAG,EAAE,QAAQ,KAAK,CAAC,CAAC;AACxF,cAAQ,EAAE;AACV,UAAI,EAAE,MAAM,SAAS,EAAG,SAAQ,EAAE,KAAK;AAAA,IACzC,UAAE;AACA,YAAM,GAAG,MAAM;AAAA,IACjB;AAAA,EACF;AACA,QAAM,OAAO,MAAM;AACjB,WAAO,KAAK,KAAK,IAAI,EAAE,MAAM,MAAM,MAAS;AAC5C,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,YAAY,MAAM,UAAU;AAC1C,SAAO;AAAA,IACL,MAAM,OAAO;AACX,oBAAc,KAAK;AACnB,YAAM,KAAK;AACX,UAAI,MAAM,KAAK,EAAG,SAAQ,CAAC,KAAK,CAAC;AACjC,cAAQ;AAAA,IACV;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/chunks/chunk-SUV3VHKR.js

@@ -0,0 +1,52 @@
+// src/node/run/storage.ts
+import { readdir, rename, rm, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { isFileId } from "@ansible-flow/core/flow/ids";
+var KEEP_RUNS = 30;
+async function children(dir) {
+  try {
+    return (await readdir(dir, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return [];
+  }
+}
+async function dropVars(runDir) {
+  await rm(join(runDir, "vars.json"), { force: true });
+}
+async function pruneRuns(storage, flowId, keep) {
+  if (!isFileId(flowId)) return;
+  const n = Number.isInteger(keep) && keep >= 1 ? keep : KEEP_RUNS;
+  const dir = join(storage, "runs", flowId);
+  const old = (await children(dir)).sort().slice(0, -n);
+  for (const run of old) await rm(join(dir, run), { recursive: true, force: true });
+}
+async function sweepRuns(storage, keep) {
+  const root = join(storage, "runs");
+  for (const flow of await children(root)) {
+    for (const run of await children(join(root, flow)))
+      await rm(join(root, flow, run, "vars.json"), { force: true });
+    await pruneRuns(storage, flow, keep);
+  }
+}
+async function rotateLog(file, limit, old) {
+  let size = 0;
+  try {
+    size = (await stat(file)).size;
+  } catch {
+    return;
+  }
+  if (size < limit) return;
+  const nth = (n) => file.replace(/\.jsonl$/, `.${n}.jsonl`);
+  await rm(nth(old), { force: true });
+  for (let n = old - 1; n >= 1; n--) await rename(nth(n), nth(n + 1)).catch(() => void 0);
+  await rename(file, nth(1));
+}
+
+export {
+  KEEP_RUNS,
+  dropVars,
+  pruneRuns,
+  sweepRuns,
+  rotateLog
+};
+//# sourceMappingURL=chunk-SUV3VHKR.js.map

package/dist/chunks/chunk-SUV3VHKR.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/node/run/storage.ts"],
+  "sourcesContent": ["// What runs leave in global storage (AFD-29): `runs/<flow>/<run>/` keeps the events of the newest\n// runs only, and vars.json never outlives its run. Secret inputs never reach this folder at all.\n// No vscode import: paths are plain folders, so unit tests use a temporary one.\nimport { readdir, rename, rm, stat } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { isFileId } from '../../core/flow/ids';\n\n/** Run folders kept per flow when `afd.runs.keep` is not set. */\nexport const KEEP_RUNS = 30;\n\nasync function children(dir: string): Promise<string[]> {\n  try {\n    return (await readdir(dir, { withFileTypes: true }))\n      .filter((e) => e.isDirectory())\n      .map((e) => e.name);\n  } catch {\n    return [];\n  }\n}\n\n/** Removes a run's vars.json once ansible-playbook is done with it. */\nexport async function dropVars(runDir: string): Promise<void> {\n  await rm(join(runDir, 'vars.json'), { force: true });\n}\n\n/** Keeps the newest `keep` run folders of a flow (run ids are sortable time stamps). */\nexport async function pruneRuns(storage: string, flowId: string, keep: number): Promise<void> {\n  // A flow ID that is not a ULID never names a folder here (AFD-133): the delete below is recursive.\n  if (!isFileId(flowId)) return;\n  const n = Number.isInteger(keep) && keep >= 1 ? keep : KEEP_RUNS;\n  const dir = join(storage, 'runs', flowId);\n  const old = (await children(dir)).sort().slice(0, -n);\n  for (const run of old) await rm(join(dir, run), { recursive: true, force: true });\n}\n\n/**\n * At startup, when no run is going: removes the vars.json files earlier versions left behind (they\n * held every input, secrets included) and applies the retention to every flow.\n */\nexport async function sweepRuns(storage: string, keep: number): Promise<void> {\n  const root = join(storage, 'runs');\n  for (const flow of await children(root)) {\n    for (const run of await children(join(root, flow)))\n      await rm(join(root, flow, run, 'vars.json'), { force: true });\n    await pruneRuns(storage, flow, keep);\n  }\n}\n\n/**\n * Rotates `<name>.jsonl` once it reaches `limit` bytes: it becomes `<name>.1.jsonl`, the older ones\n * move up, and only `old` of them are kept.\n */\nexport async function rotateLog(file: string, limit: number, old: number): Promise<void> {\n  let size = 0;\n  try {\n    size = (await stat(file)).size;\n  } catch {\n    return;\n  }\n  if (size < limit) return;\n  const nth = (n: number) => file.replace(/\\.jsonl$/, `.${n}.jsonl`);\n  await rm(nth(old), { force: true });\n  for (let n = old - 1; n >= 1; n--) await rename(nth(n), nth(n + 1)).catch(() => undefined);\n  await rename(file, nth(1));\n}\n"],
+  "mappings": ";AAGA,SAAS,SAAS,QAAQ,IAAI,YAAY;AAC1C,SAAS,YAAY;AACrB,SAAS,gBAAgB;AAGlB,IAAM,YAAY;AAEzB,eAAe,SAAS,KAAgC;AACtD,MAAI;AACF,YAAQ,MAAM,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC,GAC/C,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,EAC7B,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,EACtB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAGA,eAAsB,SAAS,QAA+B;AAC5D,QAAM,GAAG,KAAK,QAAQ,WAAW,GAAG,EAAE,OAAO,KAAK,CAAC;AACrD;AAGA,eAAsB,UAAU,SAAiB,QAAgB,MAA6B;AAE5F,MAAI,CAAC,SAAS,MAAM,EAAG;AACvB,QAAM,IAAI,OAAO,UAAU,IAAI,KAAK,QAAQ,IAAI,OAAO;AACvD,QAAM,MAAM,KAAK,SAAS,QAAQ,MAAM;AACxC,QAAM,OAAO,MAAM,SAAS,GAAG,GAAG,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC;AACpD,aAAW,OAAO,IAAK,OAAM,GAAG,KAAK,KAAK,GAAG,GAAG,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAClF;AAMA,eAAsB,UAAU,SAAiB,MAA6B;AAC5E,QAAM,OAAO,KAAK,SAAS,MAAM;AACjC,aAAW,QAAQ,MAAM,SAAS,IAAI,GAAG;AACvC,eAAW,OAAO,MAAM,SAAS,KAAK,MAAM,IAAI,CAAC;AAC/C,YAAM,GAAG,KAAK,MAAM,MAAM,KAAK,WAAW,GAAG,EAAE,OAAO,KAAK,CAAC;AAC9D,UAAM,UAAU,SAAS,MAAM,IAAI;AAAA,EACrC;AACF;AAMA,eAAsB,UAAU,MAAc,OAAe,KAA4B;AACvF,MAAI,OAAO;AACX,MAAI;AACF,YAAQ,MAAM,KAAK,IAAI,GAAG;AAAA,EAC5B,QAAQ;AACN;AAAA,EACF;AACA,MAAI,OAAO,MAAO;AAClB,QAAM,MAAM,CAAC,MAAc,KAAK,QAAQ,YAAY,IAAI,CAAC,QAAQ;AACjE,QAAM,GAAG,IAAI,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AAClC,WAAS,IAAI,MAAM,GAAG,KAAK,GAAG,IAAK,OAAM,OAAO,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,EAAE,MAAM,MAAM,MAAS;AACzF,QAAM,OAAO,MAAM,IAAI,CAAC,CAAC;AAC3B;",
+  "names": []
+}