@indigoai-us/hq-cloud 6.14.50 → 6.15.1

package/src/bin/sync-runner-company.ts

@@ -1,695 +0,0 @@
-import * as fs from "fs";
-import * as path from "path";
-import {
-  computePersonalVaultPaths,
-  readCloudBackedSlugsFromManifest,
-} from "../personal-vault.js";
-import type { SyncOptions, SyncProgressEvent, SyncResult } from "../cli/sync.js";
-import type { ShareOptions, ShareResult } from "../cli/share.js";
-import type { ConflictStrategy } from "../cli/conflict.js";
-import type { UploadAuthor } from "../s3.js";
-import type { VaultServiceConfig } from "../index.js";
-import { resolvePullScope, type PullScope } from "../sync/pull-scope.js";
-import {
-  emitCloudTelemetry,
-  type CloudTelemetryClient,
-  type TelemetryClaims,
-} from "../telemetry-events.js";
-import {
-  coalescePrefixes,
-  pathToScopePrefix,
-  toScopePrefixEntries,
-  type ScopePrefixEntry,
-  type ScopePrefixInput,
-} from "../prefix-coalesce.js";
-import { describeError } from "../lib/describe-error.js";
-import { isTransientNetworkError } from "../lib/net-errors.js";
-import { VaultAuthError } from "../vault-client.js";
-import type {
-  DeletePropagationPolicy,
-  Direction,
-  RunnerEvent,
-  VaultClientSurface,
-} from "./sync-runner.js";
-import type { RunnerTarget } from "./sync-runner-planning.js";
-import {
-  createCompanyState,
-  type CompanyState,
-} from "./sync-runner-rollup.js";
-
-export interface CompanyFanoutResult {
-  stateByCompany: Map<string, CompanyState>;
-  errors: Array<{ company: string; message: string }>;
-  companyFailures: Array<{ company: string; message: string }>;
-  transientCompanies: Array<{ company: string; message: string }>;
-  meaningfulOutcomeCount: number;
-  allConflicts: Array<{
-    company: string;
-    path: string;
-    direction: "pull" | "push";
-  }>;
-  pushPathResults: Array<{
-    relativePath: string;
-    status: "accepted" | "refused";
-    operation: "delete" | "tombstone";
-    reason?: string;
-  }>;
-}
-
-export async function executeCompanyFanout(options: {
-  plan: RunnerTarget[];
-  direction: Direction;
-  hqRoot: string;
-  onConflict: ConflictStrategy;
-  client: VaultClientSurface;
-  vaultConfig: VaultServiceConfig;
-  uploadAuthor?: UploadAuthor;
-  operationLockAlreadyHeld?: boolean;
-  syncFn: (options: SyncOptions) => Promise<SyncResult>;
-  shareFn: (options: ShareOptions) => Promise<ShareResult>;
-  resolveDeletePolicy: () => DeletePropagationPolicy;
-  emit: (event: RunnerEvent) => void;
-  scopePaths?: string[];
-  deleteScopePaths?: string[];
-  telemetryClient?: CloudTelemetryClient | null;
-  telemetryClaims?: TelemetryClaims | null;
-  telemetrySessionId?: string;
-  /**
-   * Ensure a company's local directory exists (recursive mkdir). Injected so
-   * tests don't touch a developer's filesystem. Defaults to `fs.mkdirSync(dir,
-   * { recursive: true })`. Called after a completed non-personal pull leg so a
-   * company a member can SEE is materialized locally even when zero files were
-   * shared with them (see the ensure block below).
-   */
-  ensureCompanyDir?: (dir: string) => void;
-}): Promise<CompanyFanoutResult> {
-  const ensureCompanyDir =
-    options.ensureCompanyDir ??
-    ((dir: string) => {
-      fs.mkdirSync(dir, { recursive: true });
-    });
-  const doPush =
-    options.direction === "push" || options.direction === "both";
-  const doPull =
-    options.direction === "pull" || options.direction === "both";
-  const errors: Array<{ company: string; message: string }> = [];
-  const companyFailures: Array<{ company: string; message: string }> = [];
-  const transientCompanies: Array<{ company: string; message: string }> = [];
-  const allConflicts: Array<{
-    company: string;
-    path: string;
-    direction: "pull" | "push";
-  }> = [];
-  const stateByCompany = new Map<string, CompanyState>();
-  let meaningfulOutcomeCount = 0;
-  const pushPathResults: CompanyFanoutResult["pushPathResults"] = [];
-
-  for (const target of options.plan) {
-    const companyLabel = target.slug;
-    const state = createCompanyState(companyLabel);
-    stateByCompany.set(companyLabel, state);
-
-    let activePhase: "pull" | "push" = doPush && !doPull ? "push" : "pull";
-    let companyHadTransferError = false;
-    const tagAndEmit = (event: SyncProgressEvent): void => {
-      if (event.type === "plan") {
-        options.emit({
-          type: "plan",
-          company: companyLabel,
-          filesToDownload: event.filesToDownload,
-          bytesToDownload: event.bytesToDownload,
-          filesToUpload: event.filesToUpload,
-          bytesToUpload: event.bytesToUpload,
-          filesToSkip: event.filesToSkip,
-          filesToConflict: event.filesToConflict,
-          filesToDelete: event.filesToDelete,
-        });
-      } else if (event.type === "progress") {
-        if (activePhase === "push") {
-          state.filesUploaded += 1;
-          state.bytesUploaded += event.bytes;
-        } else {
-          state.filesDownloaded += 1;
-          state.bytesDownloaded += event.bytes;
-        }
-        options.emit({
-          type: "progress",
-          company: companyLabel,
-          path: event.path,
-          bytes: event.bytes,
-          direction: activePhase === "push" ? "up" : "down",
-          ...(event.message ? { message: event.message } : {}),
-          ...(event.deleted ? { deleted: event.deleted } : {}),
-        });
-      } else if (event.type === "conflict") {
-        options.emit({
-          type: "conflict",
-          company: companyLabel,
-          path: event.path,
-          direction: event.direction,
-          resolution: event.resolution,
-        });
-      } else if (event.type === "error") {
-        companyHadTransferError = true;
-        errors.push({
-          company: companyLabel,
-          message: event.path
-            ? `${event.path}: ${event.message}`
-            : event.message,
-        });
-        options.emit({
-          type: "error",
-          company: companyLabel,
-          path: event.path,
-          message: event.message,
-        });
-      } else if (event.type === "new-files") {
-        options.emit({
-          type: "new-files",
-          company: companyLabel,
-          files: event.files,
-        });
-      } else if (event.type === "scope-excluded") {
-        options.emit({
-          type: "scope-excluded",
-          company: companyLabel,
-          count: event.count,
-          samplePaths: event.samplePaths,
-        });
-      } else if (event.type === "scope-materialization-gap") {
-        options.emit({
-          type: "scope-materialization-gap",
-          company: companyLabel,
-          count: event.count,
-          samplePaths: event.samplePaths,
-          syncMode: event.syncMode,
-        });
-      } else if (event.type === "ignore-excluded") {
-        options.emit({
-          type: "ignore-excluded",
-          company: companyLabel,
-          count: event.count,
-          totalExcluded: event.totalExcluded,
-          samplePaths: event.samplePaths,
-        });
-      } else if (event.type === "skip-invalid-scoped-key") {
-        options.emit({
-          type: "skip-invalid-scoped-key",
-          company: companyLabel,
-          path: event.path,
-          ...(event.errorCode ? { errorCode: event.errorCode } : {}),
-        });
-      } else if (event.type === "skip-junk-key-spelling") {
-        options.emit({
-          type: "skip-junk-key-spelling",
-          company: companyLabel,
-          path: event.path,
-          journaledKey: event.journaledKey,
-        });
-      } else if (event.type === "not-shipped") {
-        options.emit({
-          type: "not-shipped",
-          company: companyLabel,
-          reason: event.reason,
-          count: event.count,
-          samplePaths: event.samplePaths,
-        });
-      }
-    };
-
-    try {
-      let pushResult: ShareResult = {
-        filesUploaded: 0,
-        bytesUploaded: 0,
-        filesSkipped: 0,
-        filesDeleted: 0,
-        filesTombstoned: 0,
-        filesRefusedStale: 0,
-        filesRefusedStalePaths: [],
-        filesSuppressedByTombstone: 0,
-        filesExcludedByPolicy: 0,
-        filesExcludedByScope: 0,
-        filesExcludedByIgnore: 0,
-        unreachablePaths: [],
-        linkedSubtreesNotShipped: [],
-        conflictPaths: [],
-        aborted: false,
-      };
-      let pullResult: SyncResult = {
-        filesDownloaded: 0,
-        bytesDownloaded: 0,
-        filesSkipped: 0,
-        conflicts: 0,
-        conflictPaths: [],
-        aborted: false,
-        newFiles: [],
-        newFilesCount: 0,
-        filesExcludedByPolicy: 0,
-        filesTombstoned: 0,
-        filesOutOfScope: 0,
-        scopeOrphansRemoved: 0,
-        scopeOrphansBlocked: 0,
-        changedPaths: [],
-      };
-
-      // Local (non-cloud) companies always sync to the personal vault.
-      // Cloud-backed signals (union):
-      //   1. Membership fanout: every non-personal target in the run plan
-      //      is a company the operator has an active Membership for.
-      //   2. companies/manifest.yaml cloud_uid: full-HQ agent boxes often
-      //      run `--personal` alone (no company fanout), so (1) is empty
-      //      even when indigo is cloud-backed. Manifest cloud_uid is the
-      //      durable routing signal — exclude + decommission those slugs
-      //      so multi-GB team trees never re-enter the agent personal vault.
-      // Those slugs are excluded from the personal push (no double-
-      // bucketing) and decommissioned from the personal vault if a stale
-      // pre-promotion copy lingers — this is how a company "becoming
-      // cloud-true" is handled.
-      const teamSyncedSlugs = new Set(
-        options.plan
-          .filter((p) => p.personalMode !== true)
-          .map((p) => p.slug),
-      );
-      if (target.personalMode === true) {
-        for (const slug of readCloudBackedSlugsFromManifest(options.hqRoot)) {
-          teamSyncedSlugs.add(slug);
-        }
-      }
-
-      const scope: PullScope =
-        target.personalMode === true
-          ? // Personal vault: single-owner, no multi-tenant sessions ACL problem,
-            // so preserve its existing full-pull behavior — no session exclusion.
-            // (The sessions push-only contract is a company-vault concern; US-006.)
-            { syncMode: "all", excludePrefixes: [] }
-          : await resolvePullScope(
-              options.client,
-              target.uid,
-              target.slug,
-              options.hqRoot,
-            );
-
-      if (doPush) {
-        activePhase = "push";
-        const pushPrefixSet = effectivePushPrefixSet(
-          scope.prefixSet,
-          options.scopePaths ?? [],
-        );
-        const pushPaths =
-          target.personalMode === true
-            ? computePersonalVaultPaths(options.hqRoot, { teamSyncedSlugs })
-            : [path.join(options.hqRoot, "companies", target.slug)];
-        const decommissionPrefixes =
-          target.personalMode === true
-            ? Array.from(teamSyncedSlugs).map((slug) => `companies/${slug}`)
-            : undefined;
-        pushResult = await options.shareFn({
-          paths: pushPaths,
-          company: target.uid,
-          vaultConfig: options.vaultConfig,
-          hqRoot: options.hqRoot,
-          onConflict: options.onConflict,
-          skipUnchanged: true,
-          propagateDeletes: true,
-          propagateDeletePolicy: options.resolveDeletePolicy(),
-          // `pushPaths` are INTERNAL walk roots (the company folder / the
-          // personal-vault dirs), never user input, so an unreachable entry
-          // here is a benign race — a directory removed between the scan and
-          // the push — and must not fail an unattended background sync. Record
-          // + report it (`not-shipped` event, `ShareResult.unreachablePaths`)
-          // and carry on. The interactive `hq sync push <path>` keeps the
-          // default "error" policy, which is where a user-typed path that
-          // silently ships nothing is a real bug (feedback_a51cb63d ask #2).
-          unreachablePathPolicy: "warn",
-          onEvent: tagAndEmit,
-          ...(options.uploadAuthor ? { author: options.uploadAuthor } : {}),
-          ...(target.personalMode !== undefined
-            ? { personalMode: target.personalMode }
-            : {}),
-          ...(target.journalSlug !== undefined
-            ? { journalSlug: target.journalSlug }
-            : {}),
-          ...(decommissionPrefixes && decommissionPrefixes.length > 0
-            ? { decommissionPrefixes }
-            : {}),
-          ...(pushPrefixSet !== undefined
-            ? { prefixSet: pushPrefixSet }
-            : {}),
-          ...(options.deleteScopePaths?.length
-            ? { deleteScopeRoots: options.deleteScopePaths }
-            : {}),
-        });
-        for (const result of pushResult.pathResults ?? []) {
-          pushPathResults.push({
-            relativePath:
-              target.personalMode === true
-                ? result.path
-                : `companies/${target.slug}/${result.path}`,
-            status: result.status,
-            operation: result.operation,
-            ...(result.reason ? { reason: result.reason } : {}),
-          });
-        }
-      }
-
-      if (doPull && !pushResult.aborted) {
-        activePhase = "pull";
-        const pullScope: PullScope = scope;
-        pullResult = await options.syncFn({
-          company: target.uid,
-          vaultConfig: options.vaultConfig,
-          hqRoot: options.hqRoot,
-          onConflict: options.onConflict,
-          syncMode: pullScope.syncMode,
-          scopeShrinkPolicy: "auto-recover",
-          ...(options.uploadAuthor?.userSub !== undefined
-            ? { callerSub: options.uploadAuthor.userSub }
-            : {}),
-          ...(options.telemetryClaims ? { telemetryClaims: options.telemetryClaims } : {}),
-          ...(pullScope.prefixSet !== undefined
-            ? { prefixSet: pullScope.prefixSet }
-            : {}),
-          // Push-only exclusions (US-006: sessions/). Subtracted from the pull's
-          // download filter in EVERY mode — including 'all' — but NOT fed into
-          // scope-shrink, so locally-authored / pinned sessions are never
-          // orphaned. Guarded like prefixSet: only threaded when non-empty
-          // (personal-vault legs carry [] and keep their full-pull behavior).
-          ...(pullScope.excludePrefixes.length > 0
-            ? { excludePrefixes: pullScope.excludePrefixes }
-            : {}),
-          ...(target.personalMode !== undefined
-            ? { personalMode: target.personalMode }
-            : {}),
-          ...(target.journalSlug !== undefined
-            ? { journalSlug: target.journalSlug }
-            : {}),
-          ...(target.personalMode === true ? { teamSyncedSlugs } : {}),
-          ...(options.operationLockAlreadyHeld
-            ? { operationLockAlreadyHeld: true }
-            : {}),
-          skipReindex: true,
-          onEvent: tagAndEmit,
-        });
-      }
-
-      const seenConflictPaths = new Set<string>();
-      const mergedConflictPaths: string[] = [];
-      for (const p of [
-        ...pullResult.conflictPaths,
-        ...pushResult.conflictPaths,
-      ]) {
-        if (seenConflictPaths.has(p)) continue;
-        seenConflictPaths.add(p);
-        mergedConflictPaths.push(p);
-      }
-      const aborted = pullResult.aborted || pushResult.aborted;
-
-      state.filesDownloaded = pullResult.filesDownloaded;
-      state.bytesDownloaded = pullResult.bytesDownloaded;
-      state.filesTombstoned = pullResult.filesTombstoned;
-      state.scopeOrphansRemoved = pullResult.scopeOrphansRemoved;
-      state.changedPaths = normalizePullChangedPaths(
-        target,
-        pullResult.changedPaths,
-      );
-      state.filesUploaded = pushResult.filesUploaded;
-      state.bytesUploaded = pushResult.bytesUploaded;
-      state.status = companyHadTransferError
-        ? "errored"
-        : aborted
-          ? "aborted"
-          : "complete";
-
-      // Materialize the company directory even when the pull downloaded zero
-      // files. A member who can SEE a company should have it appear locally —
-      // `companies/<slug>/` on disk plus a manifest entry — whether or not
-      // anything has been shared with them yet. Without this, a company with no
-      // shared files (e.g. an agency-created client account, or a member on
-      // shared-mode with no grants) never gets a local directory, so the
-      // post-fanout reconciler (which gates on the directory existing) skips it
-      // and HQ "doesn't know about" a company the person is plainly a member
-      // of. Only on a clean pull leg for a real company; best-effort, mirroring
-      // the reconciler's own non-fatal posture — a mkdir failure just leaves
-      // the slug unmaterialized exactly as before.
-      if (
-        doPull &&
-        target.personalMode !== true &&
-        state.status === "complete"
-      ) {
-        try {
-          ensureCompanyDir(
-            path.join(options.hqRoot, "companies", target.slug),
-          );
-        } catch (err) {
-          // Best-effort: a mkdir failure just leaves this slug unmaterialized,
-          // exactly as before this change. Never fail the (successful) pull
-          // over it — but never swallow it silently either.
-          console.warn(
-            "[sync-runner-company] ensure company directory failed (non-fatal)",
-            {
-              slug: target.slug,
-              err: err instanceof Error ? err.message : String(err),
-            },
-          );
-        }
-      }
-
-      options.emit({
-        type: "complete",
-        company: companyLabel,
-        filesDownloaded: pullResult.filesDownloaded,
-        bytesDownloaded: pullResult.bytesDownloaded,
-        filesUploaded: pushResult.filesUploaded,
-        bytesUploaded: pushResult.bytesUploaded,
-        filesSkipped: pullResult.filesSkipped + pushResult.filesSkipped,
-        filesTombstoned:
-          pushResult.filesTombstoned + pullResult.filesTombstoned,
-        filesRefusedStale: pushResult.filesRefusedStale,
-        filesRefusedStalePaths: pushResult.filesRefusedStalePaths,
-        filesExcludedByPolicy:
-          pushResult.filesExcludedByPolicy +
-          pullResult.filesExcludedByPolicy,
-        conflicts: mergedConflictPaths.length,
-        conflictPaths: mergedConflictPaths,
-        aborted,
-        newFiles: pullResult.newFiles,
-        newFilesCount: pullResult.newFilesCount,
-        filesOutOfScope: pullResult.filesOutOfScope,
-        scopeOrphansRemoved: pullResult.scopeOrphansRemoved,
-        scopeOrphansBlocked: pullResult.scopeOrphansBlocked,
-      });
-      const tombstonedCount =
-        pushResult.filesTombstoned + pullResult.filesTombstoned;
-      const hasMeaningfulOutcome =
-        state.status !== "complete" ||
-        pullResult.filesDownloaded > 0 ||
-        pushResult.filesUploaded > 0 ||
-        pushResult.filesDeleted > 0 ||
-        tombstonedCount > 0 ||
-        pullResult.scopeOrphansRemoved > 0 ||
-        mergedConflictPaths.length > 0 ||
-        pushResult.filesRefusedStale > 0 ||
-        pullResult.scopeOrphansBlocked > 0;
-      if (hasMeaningfulOutcome) {
-        meaningfulOutcomeCount += 1;
-        void emitCloudTelemetry(
-          options.telemetryClient,
-          {
-            eventName: "company_sync_leg_completed",
-            source: "sync-runner",
-            ...(target.personalMode !== true ? { companyUid: target.uid } : {}),
-            ...(options.telemetrySessionId
-              ? { sessionId: options.telemetrySessionId }
-              : {}),
-            properties: {
-              direction: options.direction,
-              status: state.status,
-              filesDownloaded: pullResult.filesDownloaded,
-              bytesDownloaded: pullResult.bytesDownloaded,
-              filesUploaded: pushResult.filesUploaded,
-              bytesUploaded: pushResult.bytesUploaded,
-              deletedCount: pushResult.filesDeleted,
-              tombstonedCount,
-              scopeOrphansRemovedCount: pullResult.scopeOrphansRemoved,
-              refusedStaleCount: pushResult.filesRefusedStale,
-              scopeOrphansBlockedCount: pullResult.scopeOrphansBlocked,
-              conflictCount: mergedConflictPaths.length,
-              newFilesCount: pullResult.newFilesCount,
-            },
-          },
-          { claims: options.telemetryClaims },
-        );
-      }
-      for (const p of pullResult.conflictPaths) {
-        allConflicts.push({
-          company: companyLabel,
-          path: p,
-          direction: "pull",
-        });
-      }
-      for (const p of pushResult.conflictPaths) {
-        allConflicts.push({
-          company: companyLabel,
-          path: p,
-          direction: "push",
-        });
-      }
-    } catch (err) {
-      // Auth is a run-level terminal condition, not a per-company transfer
-      // error. Stop the fanout immediately so the caller can clear the stale
-      // session and emit one auth-error event for manual and watch consumers.
-      if (err instanceof VaultAuthError) throw err;
-      const message = describeError(err);
-      const transientNetwork = isTransientNetworkError(err);
-      // A prior path-level error is deterministic and must continue to win in
-      // the all-complete status and telemetry even if the leg later encounters
-      // a retryable transport failure.
-      const transientOnly = transientNetwork && !companyHadTransferError;
-      if (transientNetwork) {
-        transientCompanies.push({ company: companyLabel, message });
-        if (transientOnly) state.status = "transient-network";
-      } else {
-        errors.push({ company: companyLabel, message });
-        companyFailures.push({ company: companyLabel, message });
-      }
-      meaningfulOutcomeCount += 1;
-      options.emit({
-        type: "complete",
-        company: companyLabel,
-        filesDownloaded: state.filesDownloaded,
-        bytesDownloaded: state.bytesDownloaded,
-        filesUploaded: state.filesUploaded,
-        bytesUploaded: state.bytesUploaded,
-        filesSkipped: 0,
-        filesTombstoned: 0,
-        filesRefusedStale: 0,
-        filesRefusedStalePaths: [],
-        filesExcludedByPolicy: 0,
-        conflicts: 0,
-        conflictPaths: [],
-        aborted: true,
-        newFiles: [],
-        newFilesCount: 0,
-        filesOutOfScope: 0,
-        scopeOrphansRemoved: 0,
-        scopeOrphansBlocked: 0,
-        changedPaths: [],
-      });
-      if (transientNetwork) {
-        // This is deliberately not an error event: a retryable transport blip
-        // must remain visible without being miscounted as a deterministic
-        // company failure (and therefore an exit-2/Sentry error). The complete
-        // event above still reports aborted:true and the pass exits 75.
-        options.emit({
-          type: "transient-network",
-          company: companyLabel,
-          path: "(company)",
-          message,
-        });
-      } else {
-        options.emit({
-          type: "error",
-          company: companyLabel,
-          path: "(company)",
-          message,
-        });
-      }
-      void emitCloudTelemetry(
-        options.telemetryClient,
-        {
-          eventName: "company_sync_leg_completed",
-          source: "sync-runner",
-          ...(target.personalMode !== true ? { companyUid: target.uid } : {}),
-          ...(options.telemetrySessionId
-            ? { sessionId: options.telemetrySessionId }
-            : {}),
-          properties: {
-            direction: options.direction,
-            status: transientOnly ? "transient-network" : "errored",
-            filesDownloaded: state.filesDownloaded,
-            bytesDownloaded: state.bytesDownloaded,
-            filesUploaded: state.filesUploaded,
-            bytesUploaded: state.bytesUploaded,
-            deletedCount: 0,
-            tombstonedCount: 0,
-            scopeOrphansRemovedCount: 0,
-            refusedStaleCount: 0,
-            scopeOrphansBlockedCount: 0,
-            conflictCount: 0,
-            newFilesCount: 0,
-          },
-        },
-        { claims: options.telemetryClaims },
-      );
-    }
-  }
-
-  return {
-    stateByCompany,
-    errors,
-    companyFailures,
-    transientCompanies,
-    meaningfulOutcomeCount,
-    allConflicts,
-    pushPathResults,
-  };
-}
-
-function effectivePushPrefixSet(
-  aclPrefixSet: readonly ScopePrefixInput[] | undefined,
-  scopePaths: readonly string[],
-): string[] | undefined {
-  if (scopePaths.length === 0) {
-    return aclPrefixSet === undefined
-      ? undefined
-      : coalescePrefixes(aclPrefixSet);
-  }
-
-  const requested = scopePaths.flatMap((p) => [
-    pathToScopePrefix(p),
-    pathToScopePrefix(p.endsWith("/") ? p : p + "/"),
-  ]);
-  if (aclPrefixSet === undefined) {
-    return coalescePrefixes(requested);
-  }
-
-  const aclEntries = toScopePrefixEntries(aclPrefixSet);
-  const requestedEntries = toScopePrefixEntries(requested);
-  const intersection: ScopePrefixEntry[] = [];
-  for (const requestedEntry of requestedEntries) {
-    for (const aclEntry of aclEntries) {
-      if (entryCoversEntry(aclEntry, requestedEntry)) {
-        intersection.push(requestedEntry);
-      } else if (entryCoversEntry(requestedEntry, aclEntry)) {
-        intersection.push(aclEntry);
-      }
-    }
-  }
-  return coalescePrefixes(intersection);
-}
-
-function entryCoversEntry(
-  entry: ScopePrefixEntry,
-  candidate: ScopePrefixEntry,
-): boolean {
-  if (entry.prefix === "") return true;
-  if (entry.match === "prefix") {
-    return (
-      candidate.prefix === entry.prefix ||
-      candidate.prefix.startsWith(entry.prefix)
-    );
-  }
-  return candidate.match === "exact" && candidate.prefix === entry.prefix;
-}
-
-function normalizePullChangedPaths(
-  target: RunnerTarget,
-  changedPaths: string[] | undefined,
-): string[] {
-  const paths = changedPaths ?? [];
-  return paths.map((p) => {
-    const normalized = p.split(path.sep).join("/");
-    if (target.personalMode === true) return normalized;
-    return `companies/${target.slug}/${normalized}`;
-  });
-}