@fluado/enmetu 0.0.0-stage → 0.2.0

package/dist/daemon/daemon.js

@@ -0,0 +1,277 @@
+import { PreflightError } from '../contracts/errors.js';
+import { EXIT } from '../contracts/exitCode.js';
+import { errorMessage } from '../core/errors/errorMessage.js';
+import { resumeHint } from '../core/halt/resumeHint.js';
+const SECOND_SIGNAL_EXIT = 130;
+/**
+ * A copy of the first stop signal arriving within this window is the same
+ * stop, not a second one (Decision 91): a forwarding parent's copy arrives
+ * within milliseconds, a person's deliberate second Ctrl-C takes longer.
+ */
+export const DUPLICATE_SIGNAL_WINDOW_MS = 500;
+/**
+ * Service: the daemon lifecycle of design 1.16, steps 1 to 10. Steps 2 to 10
+ * run inside a try/finally that releases the lock on every exit path,
+ * including a throw; the final line is logged after the release, so STOPPED
+ * means the lock is gone.
+ */
+export class Daemon {
+    settings;
+    lock;
+    halt;
+    recovery;
+    preflight;
+    hookInstaller;
+    watcher;
+    scheduler;
+    processHost;
+    logger;
+    state;
+    clock;
+    constructor(settings, lock, halt, recovery, preflight, hookInstaller, watcher, scheduler, processHost, logger, 
+    /** Lifecycle events for state.json, recorded while the lock is held (design 12.1). */
+    state, 
+    /** Tells a copy of the first stop signal from a second one (Decision 91). */
+    clock) {
+        this.settings = settings;
+        this.lock = lock;
+        this.halt = halt;
+        this.recovery = recovery;
+        this.preflight = preflight;
+        this.hookInstaller = hookInstaller;
+        this.watcher = watcher;
+        this.scheduler = scheduler;
+        this.processHost = processHost;
+        this.logger = logger;
+        this.state = state;
+        this.clock = clock;
+    }
+    async run() {
+        // --- Step 1: one instance per worktree (D13) ---
+        const acquisition = await this.lock.acquire();
+        if (acquisition.kind !== 'acquired') {
+            // Nothing was acquired, so there is nothing to release.
+            this.logger.log(lockedEntry(acquisition));
+            return EXIT.LOCKED;
+        }
+        if (acquisition.tookOverStale) {
+            this.logger.log({
+                level: 'WARN',
+                code: 'LOCK_STALE_TAKEN',
+                message: 'took over the lock of an enmetu instance that is no longer running',
+            });
+        }
+        // state.json is written only between acquire and release: before, it
+        // would overwrite a live instance's record; after, it would race the
+        // next instance (design 12.1).
+        let finish;
+        try {
+            await this.recordStarted();
+            try {
+                finish = await this.runLocked();
+            }
+            catch (error) {
+                await this.state.record({
+                    type: 'stopped',
+                    message: `stopped by an unexpected error: ${errorMessage(error)}`,
+                });
+                throw error;
+            }
+            await this.state.record(finish.event);
+        }
+        finally {
+            await this.lock.release();
+        }
+        this.logger.log(finish.entry);
+        return finish.exitCode;
+    }
+    /** The holder is this process; its identity is what stateLiveness compares. */
+    async recordStarted() {
+        const holder = await this.lock.inspect();
+        // Not expected right after acquire; without an identity the record would
+        // name no instance, so status judges the run unrecorded instead.
+        if (!holder) {
+            return;
+        }
+        await this.state.record({
+            type: 'started',
+            instance: {
+                pid: holder.pid,
+                hostname: holder.hostname,
+                startedAt: holder.startedAt,
+            },
+        });
+    }
+    /** Steps 2 to 10, with the lock held. */
+    async runLocked() {
+        // --- Step 2: a persisted halt refuses the start (D3, Decision 12) ---
+        const record = await this.halt.read();
+        if (record !== null) {
+            return halted({ type: 'halted', code: record.code, message: record.message }, `${record.code}: ${record.message}. ${resumeHint(record.code)}`);
+        }
+        // --- Step 3: recovery from a crash before anything else touches git ---
+        const recovery = await this.recovery.recover();
+        if (recovery.kind === 'halted') {
+            return halted({
+                type: 'halted',
+                code: recovery.code,
+                message: `recovery halted with ${recovery.code}; enmetu status shows why`,
+            }, `recovery halted with ${recovery.code}; enmetu status shows why. ${resumeHint(recovery.code)}`);
+        }
+        // A recovered start needs no line here: recovery logged RECOVERED per action.
+        // --- Step 4: eligibility (Decision 28) ---
+        let upstream;
+        try {
+            upstream = await this.preflight.check();
+        }
+        catch (error) {
+            if (!(error instanceof PreflightError)) {
+                throw error;
+            }
+            return {
+                exitCode: EXIT.NOT_ELIGIBLE,
+                event: {
+                    type: 'stopped',
+                    message: `not eligible: ${error.code}: ${error.message}`,
+                },
+                entry: {
+                    level: 'ERROR',
+                    code: 'NOT_ELIGIBLE',
+                    message: `${error.code}: ${error.message}`,
+                    cycleId: error.cycleId,
+                },
+            };
+        }
+        // --- Step 5: the pre-commit hook; never stops the start ---
+        const hookEntry = hookLogEntry(await this.hookInstaller.ensure());
+        if (hookEntry !== null) {
+            this.logger.log(hookEntry);
+        }
+        // --- Step 6: STARTED ---
+        const { root, quietMs, pollMs } = this.settings;
+        this.logger.log({
+            level: 'INFO',
+            code: 'STARTED',
+            message: `${root} on ${upstream.branchRef}, upstream ${upstream.remote} ${upstream.remoteRef}, quiet ${quietMs} ms, poll ${pollMs} ms`,
+        });
+        // --- Step 7: the first signal stops after the running cycle, a second exits at once ---
+        let first = null;
+        const unsubscribe = this.processHost.onStopSignal((signal) => {
+            const at = this.clock.now();
+            if (first !== null) {
+                if (signal === first.signal &&
+                    at - first.at < DUPLICATE_SIGNAL_WINDOW_MS) {
+                    // The same signal twice in a moment is one stop delivered twice:
+                    // a Ctrl-C or a group kill reaches enmetu directly and again
+                    // through a parent that forwards it (npm exec, npx), Decision 91.
+                    return;
+                }
+                // A crash-equivalent: the journal and the memento make it recoverable (Decision 29).
+                this.processHost.exitNow(SECOND_SIGNAL_EXIT);
+                return;
+            }
+            first = { signal, at };
+            this.logger.log({
+                level: 'INFO',
+                code: 'STOPPING',
+                message: `${signal} received; stopping after the running cycle (a second signal exits at once)`,
+            });
+            this.scheduler.stop();
+        });
+        try {
+            // --- Step 8: the watcher triggers cycles; losing it leaves the poll (Decision 21) ---
+            this.watcher.start({
+                // A closure, never the unbound method: the watcher calls it detached.
+                onChange: () => this.scheduler.notifyChange(),
+                onFailure: (detail) => {
+                    this.logger.log({
+                        level: 'WARN',
+                        code: 'WATCHER_FAILED',
+                        message: `${detail}; changes are now picked up by the poll every ${pollMs} ms`,
+                    });
+                    this.watcher.close();
+                },
+            });
+            // --- Step 9: cycles until stopped or halted ---
+            const end = await this.scheduler.run();
+            // --- Step 10: the final line follows the lock release in run() ---
+            if (end === 'halted') {
+                // The marker names the code, so this line gives the hint the next start
+                // and status give; it is gone only if a person already resumed.
+                const record = await this.halt.read();
+                const code = record === null ? '' : `${record.code}; `;
+                // No marker means a person already resumed: no halt stands, so the
+                // record says stopped rather than naming a code that no longer holds.
+                const event = record === null
+                    ? {
+                        type: 'stopped',
+                        message: 'stopped; the halt was already cleared',
+                    }
+                    : { type: 'halted', code: record.code, message: record.message };
+                return halted(event, `${code}enmetu status shows why. ${resumeHint(record?.code ?? null)}`);
+            }
+            return {
+                exitCode: EXIT.OK,
+                event: { type: 'stopped', message: 'stopped' },
+                entry: { level: 'INFO', code: 'STOPPED', message: 'stopped' },
+            };
+        }
+        finally {
+            this.watcher.close();
+            unsubscribe();
+        }
+    }
+}
+function halted(event, message) {
+    return {
+        exitCode: EXIT.HALTED,
+        event,
+        entry: { level: 'ERROR', code: 'HALTED', message },
+    };
+}
+function lockedEntry(acquisition) {
+    if (acquisition.kind === 'held') {
+        const { pid, hostname, startedAt } = acquisition.holder;
+        return {
+            level: 'ERROR',
+            code: 'LOCKED',
+            message: `another enmetu runs on this worktree: pid ${pid} on ${hostname} since ${startedAt}`,
+        };
+    }
+    return {
+        level: 'ERROR',
+        code: 'LOCKED',
+        message: `the lock file ${acquisition.path} cannot be read; delete it if no enmetu runs on this worktree`,
+    };
+}
+function hookLogEntry(result) {
+    switch (result.kind) {
+        case 'installed':
+            return {
+                level: 'INFO',
+                code: 'HOOK_INSTALLED',
+                message: 'installed the pre-commit hook',
+            };
+        case 'updated':
+            return {
+                level: 'INFO',
+                code: 'HOOK_UPDATED',
+                message: 'updated the pre-commit hook',
+            };
+        case 'skipped':
+            return {
+                level: 'WARN',
+                code: 'HOOK_SKIPPED',
+                message: `${result.reason}: ${result.instruction}`,
+            };
+        case 'failed':
+            return {
+                level: 'WARN',
+                code: 'HOOK_FAILED',
+                message: `the pre-commit hook could not be written: ${result.detail}`,
+            };
+        case 'unchanged':
+        case 'disabled':
+            return null;
+    }
+}

package/dist/enmetuInstances.d.ts

@@ -0,0 +1,65 @@
+import type { HookCommandDeps } from './cli/commands/hookCommand.js';
+import type { ResumeCommandDeps } from './cli/commands/resumeCommand.js';
+import type { RunCommandDeps } from './cli/commands/runCommand.js';
+import type { StatusCommandDeps } from './cli/commands/statusCommand.js';
+import type { EnmetuConfig } from './contracts/config.js';
+import type { IDaemon } from './contracts/IDaemon.js';
+import type { IHookInstaller } from './contracts/IHookInstaller.js';
+import type { IProcessHost } from './contracts/IProcessHost.js';
+import type { IRepositoryLocator, RepositoryPaths } from './contracts/IRepositoryLocator.js';
+import type { Runtime } from './contracts/runtime.js';
+import type { ReadStateDeps } from './library/readStateController.js';
+import { type RecoveryDeps } from './recovery/recoveryController.js';
+import { type SyncCycleDeps } from './sync/syncCycleController.js';
+export declare function createLocator(runtime: Runtime): IRepositoryLocator;
+/**
+ * Real git through a halt-guarded writer, for one repository (EN-06). The
+ * quarantine and the integrate closure (over integrateUpstreamController) are
+ * built on that same guarded writer, so every write the cycle can reach
+ * honours the halt.
+ */
+export declare function createSyncCycleDeps(paths: RepositoryPaths, config: EnmetuConfig, runtime: Runtime): SyncCycleDeps;
+export declare function createRecoveryDeps(paths: RepositoryPaths, config: EnmetuConfig, runtime: Runtime): RecoveryDeps;
+/**
+ * The daemon with IRecovery, IPreflight and ISyncCycle bound into closures over
+ * their controllers. Recovery, preflight, hook installer and cycle share one
+ * set of repository parts, so one halt store guards every writer. processHost
+ * defaults to the operating system's signals; the library passes
+ * RequestedStopProcessHost so a host program's process is left alone.
+ */
+export declare function createDaemon(paths: RepositoryPaths, config: EnmetuConfig, runtime: Runtime, processHost?: IProcessHost | undefined): IDaemon;
+/**
+ * The daemon's hook installer for one repository (design 13.1): it records
+ * Runtime.execPath, resolved through the PATH enmetu was started with when it
+ * is a bare name, and Runtime.cliPath.
+ */
+export declare function createHookInstaller(paths: RepositoryPaths, config: EnmetuConfig, runtime: Runtime): IHookInstaller;
+export declare function createRunDeps(runtime: Runtime): RunCommandDeps;
+/**
+ * Status reads only; its quarantine still sits on the guarded writer, so even
+ * a mistaken write from status would honour the halt.
+ */
+export declare function createStatusDeps(runtime: Runtime): StatusCommandDeps;
+/** Resume gets the unguarded facade: it fetches and moves the verified ref while the marker still exists. */
+export declare function createResumeDeps(runtime: Runtime): ResumeCommandDeps;
+/**
+ * The hook's reader runs git with Runtime.env, which carries the
+ * GIT_INDEX_FILE git set for the hook, so `commit -a` and a partial commit
+ * are checked against the index being committed.
+ */
+export declare function createHookCheckDeps(runtime: Runtime): HookCommandDeps;
+/** What the library entry needs to run enmetu in-process (design 12.5). */
+export interface EmbeddedRun {
+    /** runCommand's deps; the daemon gets RequestedStopProcessHost over NodeProcessAdapter. */
+    readonly deps: RunCommandDeps;
+    /** Stops the daemon after the running cycle, like the first SIGTERM. */
+    requestStop(): void;
+}
+/**
+ * runCommand's deps with one process host shared by the daemon and its lock:
+ * the lock still records this process's pid and hostname, while stops come
+ * from requestStop() instead of the host program's signals.
+ */
+export declare function createEmbeddedRunDeps(runtime: Runtime): EmbeddedRun;
+/** The library's state read: the state file and the instance lock, nothing else (design 12.5). */
+export declare function createReadStateDeps(runtime: Runtime): ReadStateDeps;

package/dist/enmetuInstances.js

@@ -0,0 +1,332 @@
+import { randomUUID } from 'node:crypto';
+import { join } from 'node:path';
+import { SystemClockAdapter } from './adapters/clock/systemClockAdapter.js';
+import { NodeFileSystemAdapter } from './adapters/fs/nodeFileSystemAdapter.js';
+import { GitFacade } from './adapters/git/gitFacade.js';
+import { GitLocatorFacade } from './adapters/git/gitLocatorFacade.js';
+import { GitProcessAdapter } from './adapters/git/gitProcessAdapter.js';
+import { NullLogger } from './adapters/log/nullLogger.js';
+import { StderrLoggerAdapter } from './adapters/log/stderrLoggerAdapter.js';
+import { NodeProcessAdapter } from './adapters/process/nodeProcessAdapter.js';
+import { FsWatchAdapter, nodeWatch } from './adapters/watch/fsWatchAdapter.js';
+import { commitLocalChangesController, } from './commit/commitLocalChangesController.js';
+import { GitIndexLock } from './commit/gitIndexLock.js';
+import { DEFAULT_CONFIG } from './core/config/parseConfig.js';
+import { Daemon } from './daemon/daemon.js';
+import { HaltGuardGitWriter } from './halt/haltGuardGitWriter.js';
+import { HaltStore } from './halt/haltStore.js';
+import { NullHookInstaller } from './hooks/nullHookInstaller.js';
+import { PreCommitHookInstaller } from './hooks/preCommitHookInstaller.js';
+import { RequestedStopProcessHost } from './library/requestedStopProcessHost.js';
+import { InstanceLock } from './lock/instanceLock.js';
+import { repositoryPreflight } from './preflight/repositoryPreflight.js';
+import { PathQuarantine } from './quarantine/pathQuarantine.js';
+import { OperationJournal } from './recovery/operationJournal.js';
+import { recoveryController, } from './recovery/recoveryController.js';
+import { StateFileStore } from './state/stateFileStore.js';
+import { StateRecorder } from './state/stateRecorder.js';
+import { StateRecordingSyncCycle } from './state/stateRecordingSyncCycle.js';
+import { HookAbortingSyncScheduler } from './sync/hookAbortingSyncScheduler.js';
+import { integrateUpstreamController, } from './sync/integrateUpstreamController.js';
+import { syncCycleController, } from './sync/syncCycleController.js';
+import { SyncCycleRunner } from './sync/syncCycleRunner.js';
+import { SyncScheduler } from './sync/syncScheduler.js';
+/**
+ * Factory (composition root): the only production file that calls new on a
+ * concrete class or imports an adapter. Every writer the daemon uses is
+ * wrapped in HaltGuardGitWriter; resume's writer is not, because resume owns
+ * the halt and moves the verified ref before it clears the marker.
+ */
+/** The git binary on PATH; the base environment comes from Runtime.env. */
+const GIT_BINARY = 'git';
+/** Decision 23: recovery and the preflight have fixed cycle ids. */
+const RECOVERY_CYCLE_ID = 'recovery';
+const PREFLIGHT_CYCLE_ID = 'startup';
+/**
+ * Commands that run before or without the config (locate, status, resume,
+ * hook) use the default git timeout; only run reads enmetu.config.json.
+ */
+const UNCONFIGURED_GIT_TIMEOUT_MS = DEFAULT_CONFIG.gitTimeoutMs;
+export function createLocator(runtime) {
+    return new GitLocatorFacade((cwd) => new GitProcessAdapter({
+        cwd,
+        baseEnv: runtime.env,
+        timeoutMs: UNCONFIGURED_GIT_TIMEOUT_MS,
+        gitBinary: GIT_BINARY,
+    }));
+}
+/**
+ * Real git through a halt-guarded writer, for one repository (EN-06). The
+ * quarantine and the integrate closure (over integrateUpstreamController) are
+ * built on that same guarded writer, so every write the cycle can reach
+ * honours the halt.
+ */
+export function createSyncCycleDeps(paths, config, runtime) {
+    const parts = guardedRepositoryParts(paths, config.gitTimeoutMs, runtime);
+    return syncCycleDepsOf(parts, commitOf(parts, paths, config, runtime, undefined));
+}
+export function createRecoveryDeps(paths, config, runtime) {
+    return recoveryDepsOf(guardedRepositoryParts(paths, config.gitTimeoutMs, runtime));
+}
+/**
+ * The daemon with IRecovery, IPreflight and ISyncCycle bound into closures over
+ * their controllers. Recovery, preflight, hook installer and cycle share one
+ * set of repository parts, so one halt store guards every writer. processHost
+ * defaults to the operating system's signals; the library passes
+ * RequestedStopProcessHost so a host program's process is left alone.
+ */
+export function createDaemon(paths, config, runtime, processHost) {
+    const parts = guardedRepositoryParts(paths, config.gitTimeoutMs, runtime);
+    const host = processHost ?? new NodeProcessAdapter();
+    // One recorder for the daemon's lifecycle events, the Decorator's cycle
+    // ends and the rebase abort's orphaned commits, so all build on the same
+    // in-memory record (design 12.1, 14.15).
+    const recorder = new StateRecorder(new StateFileStore(parts.fs, paths.stateDir), parts.clock, parts.logger, config.stateHistory);
+    const state = recorder;
+    const recoveryDeps = recoveryDepsOf(parts, recorder);
+    const recovery = {
+        recover: () => recoveryController({ cycleId: RECOVERY_CYCLE_ID }, recoveryDeps),
+    };
+    const preflight = {
+        check: () => repositoryPreflight({ cycleId: PREFLIGHT_CYCLE_ID }, { git: parts.git }),
+    };
+    // Aborted by the first stop request, so a running repository hook ends at
+    // once instead of holding the stop for up to hookTimeoutMs (Decision 92).
+    const hookStop = new AbortController();
+    const cycleDeps = syncCycleDepsOf(parts, commitOf(parts, paths, config, runtime, hookStop.signal), recorder);
+    const cycle = new StateRecordingSyncCycle({ run: (input) => syncCycleController(input, cycleDeps) }, state, parts.git);
+    const hookInstaller = hookInstallerOf(parts, paths, config, runtime);
+    const scheduler = new HookAbortingSyncScheduler(new SyncScheduler(new SyncCycleRunner(cycle, parts.logger), parts.clock, {
+        quietMs: config.quietMs,
+        maxDelayMs: config.maxDelayMs,
+        pollMs: config.pollMs,
+    }), hookStop);
+    return new Daemon({ root: paths.root, quietMs: config.quietMs, pollMs: config.pollMs }, lockFor(paths, parts.fs, host, parts.clock), parts.halt, recovery, preflight, hookInstaller, new FsWatchAdapter(paths.root, nodeWatch), scheduler, host, parts.logger, state, parts.clock);
+}
+/**
+ * The daemon's hook installer for one repository (design 13.1): it records
+ * Runtime.execPath, resolved through the PATH enmetu was started with when it
+ * is a bare name, and Runtime.cliPath.
+ */
+export function createHookInstaller(paths, config, runtime) {
+    return hookInstallerOf(guardedRepositoryParts(paths, config.gitTimeoutMs, runtime), paths, config, runtime);
+}
+// Null Object: the daemon has no branch for installHook (section 2).
+function hookInstallerOf(parts, paths, config, runtime) {
+    return config.installHook
+        ? new PreCommitHookInstaller(parts.git, parts.fs, paths.hooksDir, { nodePath: runtime.execPath, cliPath: runtime.cliPath }, runtime.env.PATH)
+        : new NullHookInstaller();
+}
+export function createRunDeps(runtime) {
+    return {
+        locator: createLocator(runtime),
+        fs: new NodeFileSystemAdapter(),
+        logger: new StderrLoggerAdapter(runtime.stderr, new SystemClockAdapter()),
+        createDaemon: (paths, config) => createDaemon(paths, config, runtime),
+    };
+}
+/**
+ * Status reads only; its quarantine still sits on the guarded writer, so even
+ * a mistaken write from status would honour the halt.
+ */
+export function createStatusDeps(runtime) {
+    return {
+        locator: createLocator(runtime),
+        openSources: (paths) => {
+            const parts = guardedRepositoryParts(paths, UNCONFIGURED_GIT_TIMEOUT_MS, runtime);
+            return {
+                lock: lockFor(paths, parts.fs, new NodeProcessAdapter(), parts.clock),
+                halt: parts.halt,
+                journal: parts.journal,
+                quarantine: parts.quarantine,
+                git: parts.git,
+                state: new StateFileStore(parts.fs, paths.stateDir),
+            };
+        },
+        stdout: runtime.stdout,
+    };
+}
+/** Resume gets the unguarded facade: it fetches and moves the verified ref while the marker still exists. */
+export function createResumeDeps(runtime) {
+    return {
+        locator: createLocator(runtime),
+        openSources: (paths) => {
+            const fs = new NodeFileSystemAdapter();
+            const facade = facadeFor(paths, UNCONFIGURED_GIT_TIMEOUT_MS, runtime, fs);
+            return {
+                lock: lockFor(paths, fs, new NodeProcessAdapter(), new SystemClockAdapter()),
+                halt: new HaltStore(fs, paths.stateDir),
+                git: facade,
+                writer: facade,
+            };
+        },
+        stdout: runtime.stdout,
+    };
+}
+/**
+ * The hook's reader runs git with Runtime.env, which carries the
+ * GIT_INDEX_FILE git set for the hook, so `commit -a` and a partial commit
+ * are checked against the index being committed.
+ */
+export function createHookCheckDeps(runtime) {
+    const fs = new NodeFileSystemAdapter();
+    return {
+        locator: createLocator(runtime),
+        fs,
+        openGit: (paths) => facadeFor(paths, UNCONFIGURED_GIT_TIMEOUT_MS, runtime, fs),
+        stderr: runtime.stderr,
+    };
+}
+/**
+ * Real git for one repository with every write behind the halt Decorator
+ * (D3). A store or facade is never shared across repositories.
+ */
+function guardedRepositoryParts(paths, gitTimeoutMs, runtime) {
+    const fs = new NodeFileSystemAdapter();
+    const clock = new SystemClockAdapter();
+    const facade = facadeFor(paths, gitTimeoutMs, runtime, fs);
+    const halt = new HaltStore(fs, paths.stateDir);
+    const writer = new HaltGuardGitWriter(facade, halt);
+    return {
+        fs,
+        git: facade,
+        writer,
+        halt,
+        journal: new OperationJournal(fs, paths.stateDir),
+        quarantine: new PathQuarantine(facade, writer, fs, {
+            root: paths.root,
+            stateDir: paths.stateDir,
+        }),
+        logger: new StderrLoggerAdapter(runtime.stderr, clock),
+        clock,
+        indexLock: new GitIndexLock(fs, new NodeProcessAdapter(), paths.gitDir, paths.stateDir),
+    };
+}
+function syncCycleDepsOf(parts, commit, orphans) {
+    const integrateDeps = {
+        git: parts.git,
+        writer: parts.writer,
+        halt: parts.halt,
+        journal: parts.journal,
+        quarantine: parts.quarantine,
+        logger: parts.logger,
+        clock: parts.clock,
+        orphans,
+    };
+    return {
+        git: parts.git,
+        writer: parts.writer,
+        halt: parts.halt,
+        quarantine: parts.quarantine,
+        integrate: (input) => integrateUpstreamController(input, integrateDeps),
+        commit,
+        logger: parts.logger,
+        clock: parts.clock,
+    };
+}
+function recoveryDepsOf(parts, orphans) {
+    return {
+        git: parts.git,
+        writer: parts.writer,
+        journal: parts.journal,
+        quarantine: parts.quarantine,
+        halt: parts.halt,
+        logger: parts.logger,
+        clock: parts.clock,
+        indexLock: parts.indexLock,
+        orphans,
+    };
+}
+function facadeFor(paths, gitTimeoutMs, runtime, fs) {
+    return new GitFacade(new GitProcessAdapter({
+        cwd: paths.root,
+        baseEnv: runtime.env,
+        timeoutMs: gitTimeoutMs,
+        gitBinary: GIT_BINARY,
+    }), fs, paths.gitDir);
+}
+/** A fresh random token per process: release() removes only the lock this process wrote. */
+function lockFor(paths, fs, processHost, clock) {
+    return new InstanceLock(fs, processHost, clock, paths.stateDir, randomUUID());
+}
+/** The commit index of design 12.7, under the state directory, never committed. */
+const COMMIT_INDEX_FILE = 'commit-index';
+/**
+ * The commit step bound into a closure (design 12.7): a second facade whose
+ * runner sets GIT_INDEX_FILE to the commit index, its writer behind the same
+ * halt Decorator, a real-index facade for post-commit and post-index-change,
+ * both facades with the hook timeout and the daemon's hook stop signal
+ * (undefined outside the daemon), the index lock and the NullLogger for the
+ * residue build.
+ */
+function commitOf(parts, paths, config, runtime, hookStop) {
+    const commitIndexPath = join(paths.stateDir, COMMIT_INDEX_FILE);
+    const commitFacade = new GitFacade(new GitProcessAdapter({
+        cwd: paths.root,
+        baseEnv: runtime.env,
+        timeoutMs: config.gitTimeoutMs,
+        gitBinary: GIT_BINARY,
+        indexFile: commitIndexPath,
+    }), parts.fs, paths.gitDir, config.hookTimeoutMs, hookStop);
+    const realHooks = new GitFacade(new GitProcessAdapter({
+        cwd: paths.root,
+        baseEnv: runtime.env,
+        timeoutMs: config.gitTimeoutMs,
+        gitBinary: GIT_BINARY,
+    }), parts.fs, paths.gitDir, config.hookTimeoutMs, hookStop);
+    const deps = {
+        git: parts.git,
+        writer: parts.writer,
+        commitIndex: {
+            reader: commitFacade,
+            writer: new HaltGuardGitWriter(commitFacade, parts.halt),
+            committer: commitFacade,
+            path: commitIndexPath,
+        },
+        realHooks,
+        indexLock: parts.indexLock,
+        fs: parts.fs,
+        logger: parts.logger,
+        residueLogger: new NullLogger(),
+        clock: parts.clock,
+        settings: {
+            commitSubject: config.commitSubject,
+            skipJsonCheck: config.skipJsonCheck,
+            partialStagingWaitMs: config.partialStagingWaitMs,
+            commitHooks: config.commitHooks,
+            realIndex: join(paths.gitDir, 'index'),
+            root: paths.root,
+        },
+    };
+    return (input) => commitLocalChangesController(input, deps);
+}
+/**
+ * runCommand's deps with one process host shared by the daemon and its lock:
+ * the lock still records this process's pid and hostname, while stops come
+ * from requestStop() instead of the host program's signals.
+ */
+export function createEmbeddedRunDeps(runtime) {
+    const processHost = new RequestedStopProcessHost(new NodeProcessAdapter());
+    return {
+        deps: {
+            locator: createLocator(runtime),
+            fs: new NodeFileSystemAdapter(),
+            logger: new StderrLoggerAdapter(runtime.stderr, new SystemClockAdapter()),
+            createDaemon: (paths, config) => createDaemon(paths, config, runtime, processHost),
+        },
+        requestStop: () => processHost.requestStop(),
+    };
+}
+/** The library's state read: the state file and the instance lock, nothing else (design 12.5). */
+export function createReadStateDeps(runtime) {
+    return {
+        locator: createLocator(runtime),
+        openSources: (paths) => {
+            const fs = new NodeFileSystemAdapter();
+            return {
+                state: new StateFileStore(fs, paths.stateDir),
+                lock: lockFor(paths, fs, new NodeProcessAdapter(), new SystemClockAdapter()),
+            };
+        },
+    };
+}