@invarn/cibuild 2.9.4 → 2.9.7

package/dist/src/yaml/steps/cache.js

@@ -1,1027 +0,0 @@
-/**
- * Cache step implementations (cache-pull and cache-push)
- */
-import { BaseStepExecutor } from './base.js';
-/**
- * Files that together define a Gradle/KMM build graph. Hashing these catches
- * module additions/removals, plugin changes, and version-catalog bumps — things
- * that invalidate reusability of the `~/.gradle/caches` contents across branches.
- * Source file edits do NOT affect this hash; Gradle's task cache inside the
- * tarball handles source-level reuse.
- */
-const GRADLE_FINGERPRINT = [
-    'settings.gradle',
-    'settings.gradle.kts',
-    'build.gradle',
-    'build.gradle.kts',
-    'libs.versions.toml',
-    'gradle-wrapper.properties',
-];
-export const CACHE_PRESETS = {
-    ios: { lockfile: 'Podfile.lock', keyPrefix: 'pods', paths: ['Pods'], fallback: 'spm' },
-    cocoapods: { lockfile: 'Podfile.lock', keyPrefix: 'pods', paths: ['Pods'] },
-    carthage: { lockfile: 'Cartfile.resolved', keyPrefix: 'carthage', paths: ['Carthage'] },
-    spm: { lockfile: 'Package.resolved', keyPrefix: 'spm', paths: ['~/Library/Developer/Xcode/DerivedData/*/SourcePackages'] },
-    gradle: { fingerprint: GRADLE_FINGERPRINT, keyPrefix: 'gradle', paths: ['~/.gradle/caches', '~/.gradle/wrapper/dists'] },
-    kmm: { fingerprint: GRADLE_FINGERPRINT, keyPrefix: 'kmm', paths: ['~/.gradle/caches', '~/.gradle/wrapper/dists', '~/.konan'] },
-    npm: { lockfile: 'package-lock.json', keyPrefix: 'npm', paths: ['node_modules'] },
-    yarn: { lockfile: 'yarn.lock', keyPrefix: 'yarn', paths: ['node_modules'] },
-    dart: { lockfile: 'pubspec.lock', keyPrefix: 'dart', paths: ['.dart_tool', '.pub-cache'] },
-};
-/**
- * Emits bash that derives a stable short project id from the git remote URL
- * (with embedded credentials stripped, so token rotations don't churn the key).
- * Sets $__ci_proj to an 8-char hex. Falls back to "no-remote" if no git remote.
- */
-function emitProjectScopeCommands() {
-    return [
-        '__ci_git_remote=$(git config --get remote.origin.url 2>/dev/null | sed -E "s#(://)[^@/]+@#\\1#" || echo "no-remote")',
-        // `shasum` is Perl-provided and is not guaranteed on a slim Linux image;
-        // `sha256sum` is coreutils and is absent from macOS. Both print
-        // `<hex>  -`, so either yields the same 8-char project id — which is what
-        // keeps this byte-identical to `deriveProjectId` in the runner.
-        '__ci_sha256() { if command -v shasum >/dev/null 2>&1; then shasum -a 256; else sha256sum; fi; }',
-        '__ci_proj=$(printf "%s" "${__ci_git_remote:-no-remote}" | __ci_sha256 | cut -c1-8)',
-    ];
-}
-/**
- * Emits bash that discovers fingerprint filenames across the repo, sorts them,
- * and hashes their concatenated names+contents into CACHE_KEY.
- * Key format: <keyPrefix>-<projectId>-<fingerprint>, so tarballs are scoped
- * per-repo and fallback globbing can't cross-contaminate between projects.
- * Used by presets (Gradle, KMM) where no single lockfile captures the build graph.
- */
-function emitFingerprintKeyCommands(preset) {
-    const fp = preset.fingerprint ?? [];
-    const escape = (s) => s.replace(/'/g, "'\\''");
-    const nameArgs = fp
-        .map((n, i) => `${i === 0 ? '' : '-o '}-name '${escape(n)}'`)
-        .join(' ');
-    return [
-        `__ci_fp_files=$(find . -type f \\( ${nameArgs} \\) \\`,
-        `  -not -path '*/build/*' \\`,
-        `  -not -path '*/.gradle/*' \\`,
-        `  -not -path '*/node_modules/*' \\`,
-        `  -not -path '*/DerivedData/*' \\`,
-        `  2>/dev/null | LC_ALL=C sort)`,
-        `if [ -n "$__ci_fp_files" ]; then`,
-        `  CHECKSUM=$(echo "$__ci_fp_files" | xargs shasum -a 256 2>/dev/null | shasum -a 256 | cut -c1-16)`,
-        `  CACHE_KEY="${escape(preset.keyPrefix)}-\${__ci_proj}-\${CHECKSUM}"`,
-        `else`,
-        `  echo "Warning: no fingerprint files found, using fallback cache key"`,
-        `  CACHE_KEY="${escape(preset.keyPrefix)}-\${__ci_proj}-no-fingerprint"`,
-        `fi`,
-    ];
-}
-/**
- * Resolves a preset with its fallback chain into a flat list of
- * {lockfile, keyPrefix, paths} entries to try in order at runtime.
- */
-function resolvePresetChain(technology) {
-    const chain = [];
-    let current = technology;
-    const visited = new Set();
-    while (current && !visited.has(current)) {
-        visited.add(current);
-        const preset = CACHE_PRESETS[current];
-        if (!preset)
-            break;
-        chain.push(preset);
-        current = preset.fallback;
-    }
-    return chain;
-}
-/**
- * Resolves the `identifier:pattern` shorthand a `cache_paths` entry may use
- * (`derived_data:MyApp-*`, `builds:nightly`) into a real path. Anything else is
- * returned unchanged.
- *
- * Shared because the two sides used to disagree: `cache-push` resolved these
- * and `cache-pull` did not, so the classification below would have put a
- * `derived_data:` entry in the project-relative class on the way out and the
- * absolute class on the way in.
- */
-function resolveCachePathIdentifier(path, config) {
-    if (!path.includes(':'))
-        return path;
-    const [identifier, pattern] = path.split(':', 2);
-    switch (identifier) {
-        case 'derived_data':
-            return `${config.paths.derivedDataDir}/${pattern}`;
-        case 'builds':
-            return `${config.paths.buildsDir}/${pattern}`;
-        default:
-            return path;
-    }
-}
-/**
- * Splits `cache_paths` into the two classes that decide where a member has to
- * be extracted to.
- *
- * `cache-push` archives whatever `PATHS_TO_CACHE` holds. A `~`- or `/`-rooted
- * entry is expanded to an absolute path and tar stores it with the leading `/`
- * stripped (`/home/builder/.gradle/caches` -> `home/builder/.gradle/caches`),
- * which round-trips through `-C /`. A project-relative entry (`Pods`,
- * `.gradle`, `node_modules`) is stored as-is, relative to the step's working
- * directory — and `-C /` then tries to create it at the root of the
- * filesystem, which the build user cannot do.
- *
- * So the class is decided by the declared form, not by anything in the tarball,
- * and both steps can compute it from the same input.
- */
-function classifyCachePaths(paths, config) {
-    const absolute = [];
-    const relative = [];
-    for (const raw of paths) {
-        const path = resolveCachePathIdentifier(raw, config);
-        if (path.startsWith('~') || path.startsWith('/')) {
-            absolute.push(path);
-        }
-        else {
-            relative.push(path);
-        }
-    }
-    return { absolute, relative };
-}
-/**
- * Emits `__ci_cache_extract`, which every restore path pipes its tar stream
- * into, plus the two member lists it reads.
- *
- * **The defect it closes.** Every restore used one `tar -xf - -C /`. For a
- * `cache_paths` that mixes the two classes — which every Gradle/Android
- * pipeline does, including the one the README ships — the absolute half landed
- * (that *was* the warmth) and the relative half could not, so tar exited
- * non-zero, the compound condition went false, and a build that had just been
- * restored reported `CACHE_SOURCE=cold`. Worse, a pipeline whose paths are
- * *entirely* project-relative (`Pods`, `Podfile.lock`, `node_modules`) had
- * every member fail: those caches were written on every build and had never
- * restored anything. Measured on GNU tar 1.35 and bsdtar 3.5.3 alike.
- *
- * On the filesystem transport the same failure was not a mis-report at all —
- * the extraction is a bare command there, so under `set -e -o pipefail` it
- * ended the step.
- *
- * **Cost.** A restore with no project-relative paths keeps today's single
- * streaming pass and stages nothing, so the shape that already worked pays
- * nothing. The mixed and all-relative shapes stage the tar and read it twice,
- * which is the price of extracting two roots from one stream.
- *
- * Written for bash 3.2 — macOS ships it, and the generated script says
- * `#!/bin/bash`.
- */
-function emitCacheExtractHelper(paths, config, indent = '') {
-    const { absolute, relative } = classifyCachePaths(paths, config);
-    const lit = (s) => `'${s.replace(/'/g, "'\\''")}'`;
-    const out = [
-        // Captured before anything can cd: project-relative members are recorded
-        // against the step's working directory, so that is where they go back.
-        `${indent}__ci_cache_root="$PWD"`,
-        `${indent}__ci_cache_abs=()`,
-        `${indent}__ci_cache_rel=()`,
-    ];
-    for (const p of absolute) {
-        // Expanded at runtime — `~` means ${CIBUILD_USER_HOME:-$HOME}, which the
-        // generator cannot know. The leading `/` is stripped to match how tar
-        // recorded the member.
-        out.push(`${indent}__ci_p=${lit(p)}`);
-        out.push(`${indent}__ci_p="\${__ci_p/#~/\${CIBUILD_USER_HOME:-$HOME}}"`);
-        out.push(`${indent}__ci_cache_abs+=("\${__ci_p#/}")`);
-    }
-    for (const p of relative) {
-        out.push(`${indent}__ci_cache_rel+=(${lit(p)})`);
-    }
-    out.push(`${indent}__ci_cache_extract() {`, 
-    // Nothing project-relative: the archive is entirely absolute-derived and
-    // one streaming pass is both correct and cheapest.
-    `${indent}  if [ \${#__ci_cache_rel[@]} -eq 0 ]; then`, `${indent}    tar -xf - -C /`, `${indent}    return`, `${indent}  fi`, `${indent}  local __t="\${TMPDIR:-/tmp}/cibuild-cache-extract.$$.tar"`, `${indent}  local __rc=0 __top __c __is_rel __p`, `${indent}  local __abs_ops __rel_ops`, `${indent}  cat > "$__t" || { rm -f "$__t"; return 1; }`, 
-    // The split is decided on the archive's own top-level names, not by
-    // `--exclude`. tar's exclude patterns are unanchored: `--exclude=.gradle`
-    // also matches `home/builder/.gradle`, so excluding the project-relative
-    // half from the pass that targets `/` silently dropped the absolute half
-    // too whenever the two shared a component name — which the canonical
-    // Gradle shape (`~/.gradle/caches` plus `.gradle`) always does.
-    `${indent}  __top=$(tar -tf "$__t" 2>/dev/null | sed -e 's|^\\./||' -e 's|/.*||' | grep -v '^$' | sort -u) || __rc=$?`, `${indent}  if [ "$__rc" -ne 0 ]; then rm -f "$__t"; return "$__rc"; fi`, `${indent}  __abs_ops=()`, `${indent}  __rel_ops=()`, 
-    // Read rather than word-split: a cached path may contain spaces
-    // (`derived_data:My App-*`). Process substitution keeps the loop in this
-    // shell, so the arrays it fills survive it.
-    `${indent}  while IFS= read -r __c; do`, `${indent}    __is_rel=0`, `${indent}    for __p in "\${__ci_cache_rel[@]}"; do`, `${indent}      case "$__p" in "$__c"|"$__c"/*) __is_rel=1 ;; esac`, `${indent}    done`, 
-    // A name claimed by both classes resolves to `/`, which is what it did
-    // before this existed. It needs a project directory named after a
-    // filesystem root while also caching an absolute path under it.
-    `${indent}    if [ "$__is_rel" -eq 1 ]; then __rel_ops+=("$__c"); else __abs_ops+=("$__c"); fi`, `${indent}  done < <(printf '%s\\n' "$__top")`, `${indent}  if [ \${#__abs_ops[@]} -gt 0 ]; then`, `${indent}    tar -xf "$__t" -C / "\${__abs_ops[@]}" || __rc=$?`, `${indent}  fi`, `${indent}  if [ "$__rc" -eq 0 ] && [ \${#__rel_ops[@]} -gt 0 ]; then`, `${indent}    tar -xf "$__t" -C "$__ci_cache_root" "\${__rel_ops[@]}" || __rc=$?`, `${indent}  fi`, `${indent}  rm -f "$__t"`, `${indent}  return "$__rc"`, `${indent}}`);
-    return out;
-}
-/** The token `%{http_code}` is reported under; see `daemonCurl`. */
-const DAEMON_STATUS_TOKEN = 'ci_http_status';
-/**
- * Emits the `curl` invocation the cache steps talk to the daemon with. The
- * bearer token is per-build and only present on the Invarn runner, so it is
- * expanded conditionally and the same script works without one.
- *
- * Every request also reports the HTTP status it got, on **stderr** — the
- * response body is the tarball and goes to stdout, so a status written there
- * would corrupt it. `%{stderr}` is curl 7.63+ (2018); an older curl prints the
- * token literally instead of a number, which the reader below tolerates.
- *
- * `-f`, not `--fail-with-body`: on the pull side the error body would be piped
- * straight into `zstd`. The status is what distinguishes the answers anyway,
- * and it now arrives without the body.
- */
-function daemonCurl(args) {
-    return `curl -fsS -w '%{stderr}${DAEMON_STATUS_TOKEN}=%{http_code}\\n' \${CIBUILD_CACHE_TOKEN:+-H "Authorization: Bearer $CIBUILD_CACHE_TOKEN"} ${args}`;
-}
-/**
- * Emitted once inside a daemon pull branch, before the first fetch: a file for
- * curl's stderr, and the reader that turns it into one line — or into nothing
- * at all when the daemon simply had no such entry.
- *
- * `{ curl | zstd | tar; } 2>/dev/null` used to swallow curl's message
- * entirely, so a 401, a 400, a 503, a 500 and a daemon that was not listening
- * all printed the same `No cache found for key: …` as an empty cache. That is
- * the same class as the push-side defect: the instrument reported the normal
- * case for every abnormal one.
- *
- * **A miss stays quiet and a failure gets loud.** A cold cache is the normal
- * case and must not start printing errors; the point is only that a broken
- * daemon stops looking like one.
- */
-function emitDaemonPullDiagnostics(indent = '') {
-    return [
-        `${indent}__ci_cache_diag="\${TMPDIR:-/tmp}/cibuild-cache-pull.$$.diag"`,
-        `${indent}__ci_cache_daemon_said() {`,
-        `${indent}  local __said=''`,
-        `${indent}  if [ -s "$__ci_cache_diag" ]; then`,
-        `${indent}    __said=$(tr '\\n' ' ' < "$__ci_cache_diag")`,
-        `${indent}  fi`,
-        `${indent}  case "$__said" in`,
-        // 404 is the daemon's answer for `cache_miss` and `no_cache_for_scope` —
-        // an empty cache, which is normal. The second pattern reads curl's own
-        // English for a curl too old to honour `%{stderr}`, so neither reader
-        // failing alone can turn a cold cache noisy.
-        `${indent}    *${DAEMON_STATUS_TOKEN}=404*|*'error: 404'*) __said='' ;;`,
-        `${indent}  esac`,
-        // Always exits 0. A non-zero return would be the assignment's status at
-        // every call site, and under errexit that ends the step on a cache miss.
-        `${indent}  printf '%s' "\${__said:0:300}"`,
-        `${indent}}`,
-    ];
-}
-/**
- * The `else` arm of a daemon fetch: says why it did not restore, unless the
- * daemon simply had no such entry. Never fatal — a build that cannot read a
- * cache still builds, it just builds cold.
- */
-function emitDaemonPullFailureDiagnosis(indent, what) {
-    return [
-        `${indent}__ci_cache_why=$(__ci_cache_daemon_said)`,
-        `${indent}if [ -n "$__ci_cache_why" ]; then`,
-        `${indent}  echo "Warning: cache-pull could not restore ${what} from the daemon — $__ci_cache_why"`,
-        `${indent}fi`,
-    ];
-}
-/**
- * The same request, keeping the response body when the daemon refuses.
- *
- * `-f` throws the body away, so a rejection reached the log as an exit code
- * and nothing else. The daemon distinguishes `invalid_cache_key` (400), a
- * retryable `cache_busy` (503) and an auth failure (401); all three arrived
- * as the same `curl: (22)` line under the same warning, which is how a
- * one-line bug stayed open behind it. Push only — on the pull side the body
- * would be piped into `zstd`.
- *
- * `--fail-with-body` is curl 7.76+ (2021); every runner image is well past
- * it. An older curl rejects the option and the step still degrades to
- * today's behaviour, with the reason in the message.
- */
-function daemonCurlKeepingErrorBody(args) {
-    return `curl --fail-with-body -sS \${CIBUILD_CACHE_TOKEN:+-H "Authorization: Bearer $CIBUILD_CACHE_TOKEN"} ${args}`;
-}
-/**
- * The daemon half of `cache-push`, shared by both step forms.
- *
- * Shared because it did not used to be. The two forms carried byte-identical
- * copies of this block, and the explicit-key one reached it without ever
- * assigning the `CACHE_KEY` it interpolates — the preset form assigned it,
- * the other only assigned `CACHE_FILE`. There is no `set -u`, so the PUT went
- * to `<daemon>/cache/.tar.zst`, the daemon answered 400, and the step
- * reported success. Every curated Invarn template uses the explicit-key form,
- * so nothing was ever stored by any of them. One definition cannot diverge
- * from itself.
- *
- * The failure message names the stage that failed, which took a second fix.
- * `$( … 2>&1 )` captured curl's stdout, and `--fail-with-body` writes the
- * daemon's response body there on success as well as on refusal — so when the
- * *middle* stage died (no `zstd` on the image), pipefail took the else branch
- * and printed the daemon's **success** body as the reason the upload failed:
- *
- *     Warning: failed to upload cache to the daemon — {"ok":true}
- *
- * No stream separates those two cases, because the body is on stdout either
- * way; only the stage's exit status does. Hence `PIPESTATUS` rather than the
- * pull side's diag-file split — the file is still here, but it is the daemon's
- * answer, and it is quoted only when curl is what refused. A rejection's
- * reason still reaches the log, which `cache-wire-test.sh` asserts.
- */
-function emitDaemonPushCommands() {
-    return [
-        // curl's own stdout and stderr, kept out of the pipeline's status. Mirrors
-        // the pull side's `$__ci_cache_diag`.
-        '    __ci_push_out="${TMPDIR:-/tmp}/cibuild-cache-push.$$.out"',
-        `    if tar -cf - "\${PATHS_TO_CACHE[@]}" 2>/dev/null | zstd -3 | ${daemonCurlKeepingErrorBody('-T - "$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"')} >"$__ci_push_out" 2>&1; then`,
-        '      echo "Cache created successfully"',
-        '    else',
-        // Read first, before anything else in this branch: PIPESTATUS holds the
-        // last pipeline's statuses and the next command replaces it.
-        '      __ci_push_rc=("${PIPESTATUS[@]}")',
-        // Never fatal: a build that produced good output should not be failed by
-        // a cache upload, and the next build simply misses. Saying *why* costs
-        // nothing and is the difference between a warning and a diagnosis.
-        '      __ci_push_msg=""',
-        '      if [ "${__ci_push_rc[2]}" != 0 ]; then',
-        // The daemon refused, so the daemon's own answer is the reason —
-        // `invalid_cache_key`, `cache_busy`, `empty_body`, an auth failure.
-        // `[ -s ]` guards the substitution: an assignment whose command
-        // substitution fails is a non-zero statement, and under errexit that ends
-        // the step.
-        '        if [ -s "$__ci_push_out" ]; then',
-        "          __ci_push_msg=$(tr '\\n' ' ' < \"$__ci_push_out\")",
-        '        fi',
-        '      elif [ "${__ci_push_rc[1]}" = 127 ]; then',
-        // curl was happy — it uploaded whatever reached it, which was nothing.
-        // 127 is the shell failing to find the command, and zstd itself never
-        // exits 127, so this is unambiguous and worth saying outright.
-        '        __ci_push_msg="zstd is not installed on this image, so nothing was uploaded"',
-        '      else',
-        '        __ci_push_msg="nothing was uploaded — tar exited ${__ci_push_rc[0]}, zstd exited ${__ci_push_rc[1]}"',
-        '      fi',
-        '      __ci_push_msg=${__ci_push_msg:0:300}',
-        '      if [ -n "$__ci_push_msg" ]; then',
-        '        echo "Warning: failed to upload cache to the daemon — $__ci_push_msg"',
-        '      else',
-        '        echo "Warning: failed to upload cache to the daemon"',
-        '      fi',
-        '    fi',
-        '    rm -f "$__ci_push_out"',
-    ];
-}
-/**
- * Restores a cache through the daemon rather than a shared directory.
- *
- * Two requests, mirroring the directory-based flow it replaces: the exact key
- * first, then — on a miss — the scope's newest tarball. The daemon resolves
- * each from its own disk or a tailnet peer, so a hit here covers what used to
- * be separate "local" and "peer" branches; which one it was is recorded in the
- * daemon's own host-side log, where the fleet-wide view already lives.
- *
- * The 30-day age cap is preserved: the daemon dates the fallback with
- * `mtimeMs`, standing in for the `stat` the guest can no longer perform.
- */
-function emitDaemonPullCommands() {
-    return [
-        'echo "Cache daemon: $CIBUILD_CACHE_DAEMON"',
-        ...emitDaemonPullDiagnostics(),
-        // Exact key. zstd's and tar's stderr is silenced — a miss is the normal
-        // case and they both editorialise about it; pipefail still carries the
-        // exit status. curl's own stderr is kept, in the file the diagnostics
-        // above read: it is the only thing that knows *why*.
-        `if { ${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst" 2>"$__ci_cache_diag"')} | zstd -dc | __ci_cache_extract; } 2>/dev/null; then`,
-        '  echo "Cache found (daemon), extracting..."',
-        '  echo "CACHE_SOURCE=daemon CACHE_KEY=$CACHE_KEY"',
-        'else',
-        // Said before the fallback is attempted, so the reason names the request
-        // it belongs to rather than whichever request happened to fail last.
-        ...emitDaemonPullFailureDiagnosis('  ', '$CACHE_KEY'),
-        // Scope fallback: the newest tarball for this <keyPrefix>-<projectId>.
-        // Gradle/Xcode re-hash their inputs on top of the warm directory, hitting
-        // the unchanged work and rebuilding only what actually moved.
-        '  __ci_fb_scope="${CACHE_KEY%-*}"',
-        `  __ci_fb_json=$(${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/scope/$__ci_fb_scope/latest"')} 2>/dev/null || true)`,
-        // Parse without a JSON tool: the guest image is not guaranteed to ship jq.
-        `  __ci_fb_key=$(printf '%s' "$__ci_fb_json" | sed -n 's/.*"key"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p')`,
-        `  __ci_fb_mtime=$(printf '%s' "$__ci_fb_json" | sed -n 's/.*"mtimeMs"[[:space:]]*:[[:space:]]*\\([0-9]*\\).*/\\1/p')`,
-        '  if [ -n "$__ci_fb_key" ] && [ -n "$__ci_fb_mtime" ]; then',
-        '    __ci_fb_age_days=$(( ($(date +%s) - __ci_fb_mtime / 1000) / 86400 ))',
-        // Age cap: a fallback older than 30d likely carries obsolete toolchain
-        // installs or cache entries from a pre-wrapper-bump world. Go cold rather
-        // than seed from ancient state. Exact-key hits are unaffected.
-        '    if [ "$__ci_fb_age_days" -le 30 ]; then',
-        '      echo "Cache fallback (daemon): using prior tarball $__ci_fb_key (${__ci_fb_age_days}d old)"',
-        `      if { ${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/$__ci_fb_key.tar.zst" 2>"$__ci_cache_diag"')} | zstd -dc | __ci_cache_extract; } 2>/dev/null; then`,
-        '        echo "CACHE_SOURCE=fallback_daemon CACHE_KEY=$CACHE_KEY FALLBACK_KEY=$__ci_fb_key"',
-        '      else',
-        '        echo "Cache fallback $__ci_fb_key could not be fetched — going cold"',
-        ...emitDaemonPullFailureDiagnosis('        ', '$__ci_fb_key'),
-        '        echo "CACHE_SOURCE=cold CACHE_KEY=$CACHE_KEY"',
-        '      fi',
-        '    else',
-        '      echo "Cache fallback candidate $__ci_fb_key is ${__ci_fb_age_days}d old, exceeds 30d cap — going cold"',
-        '      echo "CACHE_SOURCE=cold CACHE_KEY=$CACHE_KEY FALLBACK_REJECTED=$__ci_fb_key"',
-        '    fi',
-        '  else',
-        '    echo "No cache found for key: $CACHE_KEY"',
-        '    echo "CACHE_SOURCE=cold CACHE_KEY=$CACHE_KEY"',
-        '  fi',
-        'fi',
-        'rm -f "$__ci_cache_diag"',
-    ];
-}
-/**
- * Cache pull step executor
- * Restores cached files from cache directory
- */
-export class CachePullStepExecutor extends BaseStepExecutor {
-    async execute(inputs, env, config) {
-        const stepName = 'cache-pull';
-        if (config.local) {
-            const script = this.createBashScriptFromCommands(['echo "⏭️  Cache pull skipped (local mode)"'], stepName);
-            return this.createScriptStep(script, stepName);
-        }
-        // Check for technology preset
-        const technology = this.getInput(inputs, 'technology', '').trim();
-        if (technology) {
-            return this.executeWithPreset(technology, inputs, config);
-        }
-        // Get cache key - optional (skip if not provided)
-        const cacheKey = this.getInput(inputs, 'cache_key', '');
-        // Skip if no cache key provided
-        if (!cacheKey || cacheKey.trim() === '') {
-            const commands = [];
-            commands.push('# Cache Pull - Skipped');
-            commands.push('echo "⏭️  Cache pull skipped: no cache_key configured"');
-            const script = this.createBashScriptFromCommands(commands, stepName);
-            return this.createScriptStep(script, stepName);
-        }
-        // Get cache paths - defaults to empty array (can be string or array)
-        const cachePathsInput = this.getInput(inputs, 'cache_paths', []);
-        // Normalize to array (handle single string input)
-        const cachePaths = Array.isArray(cachePathsInput)
-            ? cachePathsInput
-            : (typeof cachePathsInput === 'string' && cachePathsInput.trim() !== '')
-                ? [cachePathsInput]
-                : [];
-        // Get debug mode flag
-        const isDebugMode = this.getInput(inputs, 'is_debug_mode', false);
-        const commands = [];
-        commands.push('# Cache Pull');
-        // Create cache directory if it doesn't exist
-        commands.push('');
-        commands.push('# Ensure cache directory exists');
-        commands.push(`CACHE_DIR="${this.escapeBash(config.paths.cacheDir)}"`);
-        // Only the filesystem transport needs the directory to exist. Over the
-        // daemon the cache lives on the host, and on a runner this path is no
-        // longer mounted into the VM — an unconditional mkdir would abort the
-        // whole step under errexit.
-        commands.push('[ -n "$CIBUILD_CACHE_DAEMON" ] || mkdir -p "$CACHE_DIR"');
-        // Project scope: an explicit `cache_key` is author-written and carries no
-        // repo identity, so two projects that happen to write the same key (e.g.
-        // `gradle-{{checksum "gradle/wrapper/gradle-wrapper.properties"}}`, which
-        // depends only on the Gradle version) would share one tarball on a shared
-        // runner. Prefixing the project id keeps each repo's cache its own.
-        //
-        // The id goes at the FRONT, deliberately. The preset path spells its key
-        // `<keyPrefix>-<projectId>-<checksum>`, and that middle-segment shape is
-        // load-bearing elsewhere: it is how a scope is recovered from a tarball
-        // filename. An explicit key is author-written and must stay outside the
-        // scope model, so it must not be able to imitate that shape by accident.
-        commands.push('');
-        commands.push(...emitProjectScopeCommands());
-        // Generate cache file name based on cache key
-        commands.push('');
-        commands.push('# Generate cache file path');
-        commands.push(`CACHE_KEY="\${__ci_proj}-${this.escapeBash(cacheKey)}"`);
-        commands.push('CACHE_FILE="$CACHE_DIR/$CACHE_KEY.tar.zst"');
-        commands.push('echo "Cache key: $CACHE_KEY"');
-        if (isDebugMode) {
-            commands.push('echo "Debug mode enabled"');
-            commands.push('echo "Cache file: $CACHE_FILE"');
-        }
-        // Peer cache directory
-        const peerCacheDir = config.paths.peerCacheDir || '';
-        if (peerCacheDir) {
-            commands.push('');
-            commands.push(`PEER_CACHE_DIR="${this.escapeBash(peerCacheDir)}"`);
-            commands.push('PEER_CACHE_FILE="$PEER_CACHE_DIR/$CACHE_KEY.tar.zst"');
-        }
-        // Where each class of member is restored to. Emitted before every
-        // transport, because all of them extract.
-        commands.push('');
-        commands.push('# Restore roots');
-        commands.push(...emitCacheExtractHelper(cachePaths, config));
-        // Check if cache file exists
-        commands.push('');
-        commands.push('# Check if cache exists');
-        // Transport split — see the preset path. An explicit-key step has no scope
-        // to fall back to, so the daemon side is the exact key or nothing.
-        commands.push('if [ -n "$CIBUILD_CACHE_DAEMON" ]; then');
-        commands.push(...emitDaemonPullDiagnostics('  '));
-        commands.push(`  if { ${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst" 2>"$__ci_cache_diag"')} | zstd -dc | __ci_cache_extract; } 2>/dev/null; then`);
-        commands.push('    echo "Cache found (daemon), extracting..."');
-        commands.push('    echo "CACHE_SOURCE=daemon"');
-        commands.push('  else');
-        commands.push(...emitDaemonPullFailureDiagnosis('    ', '$CACHE_KEY'));
-        commands.push('    echo "No cache found for key: $CACHE_KEY"');
-        commands.push('    echo "CACHE_SOURCE=cold"');
-        commands.push('  fi');
-        commands.push('  rm -f "$__ci_cache_diag"');
-        commands.push('else');
-        commands.push('if [ -f "$CACHE_FILE" ]; then');
-        commands.push('  echo "Cache found (local), extracting..."');
-        if (isDebugMode) {
-            commands.push('  echo "Cache file size: $(du -h "$CACHE_FILE" | cut -f1)"');
-        }
-        commands.push('  zstd -dc "$CACHE_FILE" | __ci_cache_extract');
-        commands.push('  echo "CACHE_SOURCE=local"');
-        // Peer fallback
-        if (peerCacheDir) {
-            commands.push('elif [ -f "$PEER_CACHE_FILE" ] 2>/dev/null; then');
-            commands.push('  echo "Cache found (peer), extracting..."');
-            commands.push('  tee "$CACHE_FILE.tmp" < "$PEER_CACHE_FILE" | zstd -dc | __ci_cache_extract');
-            commands.push('  mv "$CACHE_FILE.tmp" "$CACHE_FILE"');
-            commands.push('  echo "CACHE_SOURCE=peer"');
-        }
-        commands.push('else');
-        commands.push('  echo "No cache found for key: $CACHE_KEY"');
-        commands.push('  echo "CACHE_SOURCE=cold"');
-        commands.push('fi');
-        // Closes the daemon/filesystem transport split.
-        commands.push('fi');
-        const script = this.createBashScriptFromCommands(commands, stepName);
-        return this.createScriptStep(script, stepName);
-    }
-    async executeWithPreset(technology, inputs, config) {
-        const stepName = 'cache-pull';
-        const chain = resolvePresetChain(technology);
-        if (chain.length === 0) {
-            const supported = Object.keys(CACHE_PRESETS).join(', ');
-            throw new Error(`Unknown cache technology '${technology}'. Supported: ${supported}`);
-        }
-        const isDebugMode = this.getInput(inputs, 'is_debug_mode', false);
-        const commands = [];
-        commands.push(`# Cache Pull (${technology})`);
-        commands.push(`echo "Restoring ${technology} cache..."`);
-        commands.push('');
-        // Compute cache key from lockfile checksum at runtime
-        // If technology has a fallback chain, try each lockfile in order
-        commands.push(`CACHE_DIR="${this.escapeBash(config.paths.cacheDir)}"`);
-        // Only the filesystem transport needs the directory to exist. Over the
-        // daemon the cache lives on the host, and on a runner this path is no
-        // longer mounted into the VM — an unconditional mkdir would abort the
-        // whole step under errexit.
-        commands.push('[ -n "$CIBUILD_CACHE_DAEMON" ] || mkdir -p "$CACHE_DIR"');
-        commands.push('');
-        // Helper: resolve lockfile path — checks exact path first, then searches
-        // recursively (handles SPM Package.resolved inside .xcodeproj/.xcworkspace)
-        commands.push('__ci_find_lockfile() {');
-        commands.push('  if [ -f "$1" ]; then echo "$1"; return; fi');
-        commands.push('  find . -name "$(basename "$1")" -not -path "*/DerivedData/*" -not -path "*/.build/*" 2>/dev/null | head -1');
-        commands.push('}');
-        commands.push('');
-        // Project scope: include a stable short hash of the git remote in every
-        // cache key so different repos on the same runner don't share tarballs
-        // (prevents fallback cross-contamination across projects).
-        commands.push(...emitProjectScopeCommands());
-        commands.push('');
-        if (chain.length === 1 && chain[0].fingerprint && chain[0].fingerprint.length > 0) {
-            commands.push(...emitFingerprintKeyCommands(chain[0]));
-        }
-        else if (chain.length === 1) {
-            const preset = chain[0];
-            commands.push(`LOCKFILE=$(__ci_find_lockfile "${this.escapeBash(preset.lockfile)}")`);
-            commands.push('if [ -n "$LOCKFILE" ] && [ -f "$LOCKFILE" ]; then');
-            commands.push(`  CHECKSUM=$(shasum -a 256 "$LOCKFILE" | cut -d ' ' -f1 | head -c 16)`);
-            commands.push(`  CACHE_KEY="${this.escapeBash(preset.keyPrefix)}-\${__ci_proj}-\${CHECKSUM}"`);
-            commands.push('else');
-            commands.push(`  echo "Warning: ${this.escapeBash(preset.lockfile)} not found, using fallback cache key"`);
-            commands.push(`  CACHE_KEY="${this.escapeBash(preset.keyPrefix)}-\${__ci_proj}-no-lockfile"`);
-            commands.push('fi');
-        }
-        else {
-            // Fallback chain: probe every lockfile up front, then branch on the
-            // results. The probes must precede the if/elif — emitting a probe
-            // inside a prior preset's `then` body (the old shape) meant the
-            // second lockfile was only checked when the FIRST one was found, so
-            // an SPM project with no Podfile.lock never reached the Package.resolved
-            // branch and fell through to `<first>-no-lockfile`.
-            for (let i = 0; i < chain.length; i++) {
-                commands.push(`__ci_lockfile_${i}=$(__ci_find_lockfile "${this.escapeBash(chain[i].lockfile)}")`);
-            }
-            for (let i = 0; i < chain.length; i++) {
-                const preset = chain[i];
-                const cond = i === 0 ? 'if' : 'elif';
-                commands.push(`${cond} [ -n "$__ci_lockfile_${i}" ] && [ -f "$__ci_lockfile_${i}" ]; then`);
-                commands.push(`  LOCKFILE="$__ci_lockfile_${i}"`);
-                commands.push(`  CHECKSUM=$(shasum -a 256 "$LOCKFILE" | cut -d ' ' -f1 | head -c 16)`);
-                commands.push(`  CACHE_KEY="${this.escapeBash(preset.keyPrefix)}-\${__ci_proj}-\${CHECKSUM}"`);
-                if (isDebugMode) {
-                    commands.push(`  echo "Detected: ${this.escapeBash(preset.keyPrefix)} (lockfile: $LOCKFILE)"`);
-                }
-            }
-            commands.push('else');
-            commands.push(`  echo "Warning: no lockfile found, using fallback cache key"`);
-            commands.push(`  CACHE_KEY="${this.escapeBash(chain[0].keyPrefix)}-\${__ci_proj}-no-lockfile"`);
-            commands.push('fi');
-        }
-        commands.push('');
-        if (isDebugMode) {
-            commands.push('echo "Cache key: $CACHE_KEY"');
-        }
-        commands.push('CACHE_FILE="$CACHE_DIR/$CACHE_KEY.tar.zst"');
-        commands.push('');
-        // Where each class of member is restored to. Every path below extracts, so
-        // this is emitted once, above the transport split. `allPaths` is the same
-        // union cache-push archives from, which is what keeps the two sides
-        // agreeing about which class a path is in.
-        commands.push('# Restore roots');
-        commands.push(...emitCacheExtractHelper([...new Set(chain.flatMap(p => p.paths))], config));
-        commands.push('');
-        // Transport split. On a runner the cache lives on the host and is reached
-        // over HTTP; standalone, it is a directory on this machine. The daemon URL
-        // is the switch, so the same generated script serves both.
-        commands.push('if [ -n "$CIBUILD_CACHE_DAEMON" ]; then');
-        commands.push(...emitDaemonPullCommands());
-        commands.push('else');
-        // Peer cache directory — set from config, empty string disables peer lookup
-        const peerCacheDir = config.paths.peerCacheDir || '';
-        if (peerCacheDir) {
-            commands.push(`PEER_CACHE_DIR="${this.escapeBash(peerCacheDir)}"`);
-            commands.push('PEER_CACHE_FILE="$PEER_CACHE_DIR/$CACHE_KEY.tar.zst"');
-            commands.push('');
-        }
-        // 1. Local hit
-        commands.push('if [ -f "$CACHE_FILE" ]; then');
-        commands.push('  echo "Cache found (local), extracting..."');
-        if (isDebugMode) {
-            commands.push('  echo "Cache file size: $(du -h "$CACHE_FILE" | cut -f1)"');
-        }
-        commands.push('  zstd -dc "$CACHE_FILE" | __ci_cache_extract');
-        // LRU bump: lift this tarball to the top of `ls -t` so retention's age
-        // cap counts last-used time, not last-written. Without this, a tarball
-        // hit daily would still be reaped on its 31st day from creation.
-        commands.push('  touch "$CACHE_FILE"');
-        commands.push('  echo "CACHE_SOURCE=local CACHE_KEY=$CACHE_KEY"');
-        // 2. Peer hit — tee to warm local cache while extracting in one pass
-        if (peerCacheDir) {
-            commands.push('elif [ -f "$PEER_CACHE_FILE" ] 2>/dev/null; then');
-            commands.push('  echo "Cache found (peer), extracting..."');
-            if (isDebugMode) {
-                commands.push('  echo "Peer cache file size: $(du -h "$PEER_CACHE_FILE" | cut -f1)"');
-            }
-            // Single NFS read: tee forks the stream to local cache file AND decompression
-            commands.push('  tee "$CACHE_FILE.tmp" < "$PEER_CACHE_FILE" | zstd -dc | __ci_cache_extract');
-            commands.push('  mv "$CACHE_FILE.tmp" "$CACHE_FILE"');
-            commands.push('  echo "CACHE_SOURCE=peer CACHE_KEY=$CACHE_KEY"');
-        }
-        // 3. Fallback — no exact-key tarball, try the newest prior tarball scoped
-        // to the same <keyPrefix>-<projectId> (so fallback stays within this repo
-        // and doesn't pick up a different KMM project's cache). Gradle will
-        // re-hash task inputs on top of the warm ~/.gradle/caches directory,
-        // hitting the unchanged tasks and recompiling only what actually changed.
-        // Deliberately does NOT warm $CACHE_FILE — that way cache-push still runs
-        // and creates a fresh tarball under the new key for future exact hits.
-        commands.push('else');
-        commands.push('  __ci_fb_scope="${CACHE_KEY%-*}"');
-        // `|| true` defuses pipefail+errexit when ls finds no matches: bare
-        // assignment would abort the whole cache-pull step silently on an empty
-        // cache dir, flipping any cold miss into a non-zero exit.
-        commands.push('  __ci_fb=$(ls -t "$CACHE_DIR"/"$__ci_fb_scope"-*.tar.zst 2>/dev/null | head -1 || true)');
-        if (peerCacheDir) {
-            commands.push('  if [ -z "$__ci_fb" ] || [ ! -f "$__ci_fb" ]; then');
-            commands.push('    __ci_fb=$(ls -t "$PEER_CACHE_DIR"/"$__ci_fb_scope"-*.tar.zst 2>/dev/null | head -1 || true)');
-            commands.push('    __ci_fb_src=peer');
-            commands.push('  else');
-            commands.push('    __ci_fb_src=local');
-            commands.push('  fi');
-        }
-        else {
-            commands.push('  __ci_fb_src=local');
-        }
-        commands.push('  if [ -n "$__ci_fb" ] && [ -f "$__ci_fb" ]; then');
-        commands.push('    __ci_fb_key=$(basename "$__ci_fb" .tar.zst)');
-        // Age cap: a fallback older than 30d likely carries obsolete .konan
-        // installs or Gradle entries from a pre-wrapper-bump world. Go cold
-        // rather than seed from ancient state. Exact-key hits are unaffected.
-        commands.push('    __ci_fb_age_days=$(( ($(date +%s) - $(stat -f %m "$__ci_fb")) / 86400 ))');
-        commands.push('    if [ "$__ci_fb_age_days" -le 30 ]; then');
-        commands.push('      echo "Cache fallback ($__ci_fb_src): using prior tarball $__ci_fb_key (${__ci_fb_age_days}d old)"');
-        if (isDebugMode) {
-            commands.push('      echo "Fallback size: $(du -h "$__ci_fb" | cut -f1)"');
-        }
-        commands.push('      zstd -dc "$__ci_fb" | __ci_cache_extract');
-        // LRU bump for the fallback tarball — we restored from it, so it earns
-        // its place at the top of the retention sort even if the exact-key
-        // tarball is the one that gets created in this run's cache-push.
-        commands.push('      touch "$__ci_fb"');
-        commands.push('      echo "CACHE_SOURCE=fallback_$__ci_fb_src CACHE_KEY=$CACHE_KEY FALLBACK_KEY=$__ci_fb_key"');
-        commands.push('    else');
-        commands.push('      echo "Cache fallback candidate $__ci_fb_key is ${__ci_fb_age_days}d old, exceeds 30d cap — going cold"');
-        commands.push('      echo "CACHE_SOURCE=cold CACHE_KEY=$CACHE_KEY FALLBACK_REJECTED=$__ci_fb_key"');
-        commands.push('    fi');
-        commands.push('  else');
-        // 4. Cold miss — no exact key, no fallback candidate
-        commands.push('    echo "No cache found for key: $CACHE_KEY"');
-        commands.push('    echo "CACHE_SOURCE=cold CACHE_KEY=$CACHE_KEY"');
-        commands.push('  fi');
-        commands.push('fi');
-        // Closes the daemon/filesystem transport split.
-        commands.push('fi');
-        if (isDebugMode) {
-            commands.push('echo "Restored paths:"');
-            const allPaths = [...new Set(chain.flatMap(p => p.paths))];
-            for (const p of allPaths) {
-                commands.push(`EXPANDED="${this.escapeBash(p)}"`);
-                commands.push('EXPANDED="${EXPANDED/#~/${CIBUILD_USER_HOME:-$HOME}}"');
-                commands.push('if [ -e "$EXPANDED" ]; then');
-                commands.push('  echo "  ✓ $EXPANDED"');
-                commands.push('else');
-                commands.push('  echo "  ✗ $EXPANDED (not found)"');
-                commands.push('fi');
-            }
-        }
-        const script = this.createBashScriptFromCommands(commands, stepName);
-        return this.createScriptStep(script, stepName);
-    }
-}
-/**
- * Cache push step executor
- * Saves files to cache directory
- */
-export class CachePushStepExecutor extends BaseStepExecutor {
-    async execute(inputs, env, config) {
-        const stepName = 'cache-push';
-        if (config.local) {
-            const script = this.createBashScriptFromCommands(['echo "⏭️  Cache push skipped (local mode)"'], stepName);
-            return this.createScriptStep(script, stepName);
-        }
-        // Check for technology preset
-        const technology = this.getInput(inputs, 'technology', '').trim();
-        if (technology) {
-            return this.executeWithPreset(technology, inputs, config);
-        }
-        // Get cache key - optional (skip if not provided)
-        const cacheKey = this.getInput(inputs, 'cache_key', '');
-        // Skip if no cache key provided
-        if (!cacheKey || cacheKey.trim() === '') {
-            const commands = [];
-            commands.push('# Cache Push - Skipped');
-            commands.push('echo "⏭️  Cache push skipped: no cache_key configured"');
-            const script = this.createBashScriptFromCommands(commands, stepName);
-            return this.createScriptStep(script, stepName);
-        }
-        // Get cache paths - required (can be string or array)
-        const cachePathsInput = this.getInput(inputs, 'cache_paths', []);
-        // Normalize to array (handle single string input)
-        const cachePaths = Array.isArray(cachePathsInput)
-            ? cachePathsInput
-            : (typeof cachePathsInput === 'string' && cachePathsInput.trim() !== '')
-                ? [cachePathsInput]
-                : [];
-        if (cachePaths.length === 0) {
-            throw new Error(`Missing or empty 'cache_paths' for step '${stepName}'`);
-        }
-        // Get debug mode flag
-        const isDebugMode = this.getInput(inputs, 'is_debug_mode', false);
-        // Get ignore check flag
-        const ignoreCheckOnPaths = this.getInput(inputs, 'ignore_check_on_paths', false);
-        const commands = [];
-        commands.push('# Cache Push');
-        // Create cache directory if it doesn't exist
-        commands.push('');
-        commands.push('# Ensure cache directory exists');
-        commands.push(`CACHE_DIR="${this.escapeBash(config.paths.cacheDir)}"`);
-        // Only the filesystem transport needs the directory to exist. Over the
-        // daemon the cache lives on the host, and on a runner this path is no
-        // longer mounted into the VM — an unconditional mkdir would abort the
-        // whole step under errexit.
-        commands.push('[ -n "$CIBUILD_CACHE_DAEMON" ] || mkdir -p "$CACHE_DIR"');
-        // Project scope — must match the pull side exactly, or a push writes a
-        // tarball no pull can ever find. See the note there for why an explicit
-        // key needs the repo identity prefixed.
-        commands.push('');
-        commands.push(...emitProjectScopeCommands());
-        // Generate cache file name based on cache key
-        commands.push('');
-        commands.push('# Generate cache file path');
-        // CACHE_KEY first, CACHE_FILE derived from it — exactly as the pull side
-        // does. This step used to set only CACHE_FILE while the daemon URL below
-        // interpolated `$CACHE_KEY`; see emitDaemonPushCommands.
-        commands.push(`CACHE_KEY="\${__ci_proj}-${this.escapeBash(cacheKey)}"`);
-        commands.push('CACHE_FILE="$CACHE_DIR/$CACHE_KEY.tar.zst"');
-        commands.push('echo "Cache key: $CACHE_KEY"');
-        if (isDebugMode) {
-            commands.push('echo "Debug mode enabled"');
-            commands.push('echo "Cache file: $CACHE_FILE"');
-        }
-        // Check which paths exist
-        commands.push('');
-        commands.push('# Check which paths exist');
-        commands.push('PATHS_TO_CACHE=()');
-        for (const path of cachePaths) {
-            // Resolve path identifiers (e.g., "derived_data:pattern" -> "~/Library/.../DerivedData/pattern").
-            // Shared with cache-pull's member classification: if only one side
-            // resolved these, the two would disagree about which restore root the
-            // path belongs to.
-            const resolvedPath = resolveCachePathIdentifier(path, config);
-            // Expand tilde by using parameter expansion
-            commands.push(`EXPANDED_PATH="${this.escapeBash(resolvedPath)}"`);
-            commands.push('EXPANDED_PATH="${EXPANDED_PATH/#~/${CIBUILD_USER_HOME:-$HOME}}"');
-            commands.push('');
-            commands.push('# Expand glob patterns and check each match');
-            commands.push('FOUND_MATCH=false');
-            commands.push('shopt -s nullglob');
-            commands.push('for path_match in $EXPANDED_PATH; do');
-            commands.push('  if [ -e "$path_match" ]; then');
-            commands.push('    PATHS_TO_CACHE+=("$path_match")');
-            commands.push('    FOUND_MATCH=true');
-            if (isDebugMode) {
-                commands.push('    echo "Found: $path_match"');
-            }
-            commands.push('  fi');
-            commands.push('done');
-            commands.push('shopt -u nullglob');
-            commands.push('');
-            commands.push('if [ "$FOUND_MATCH" = false ]; then');
-            if (isDebugMode) {
-                commands.push(`  echo "Not found: $EXPANDED_PATH"`);
-            }
-            if (!ignoreCheckOnPaths) {
-                commands.push(`  echo "Warning: Path does not exist: $EXPANDED_PATH"`);
-            }
-            commands.push('fi');
-        }
-        // Create cache if we have paths
-        commands.push('');
-        commands.push('# Skip if cache already exists for this key');
-        // Over the daemon there is no local file to test, so the "already up to
-        // date" shortcut can't apply — the daemon's PUT is an idempotent overwrite
-        // under the same key, which gets the same outcome.
-        commands.push('if [ -z "$CIBUILD_CACHE_DAEMON" ] && [ -f "$CACHE_FILE" ]; then');
-        commands.push('  echo "Cache already up to date for key: $CACHE_KEY"');
-        commands.push('elif [ ${#PATHS_TO_CACHE[@]} -gt 0 ]; then');
-        commands.push('  echo "Caching ${#PATHS_TO_CACHE[@]} path(s)..."');
-        if (isDebugMode) {
-            commands.push('  echo "Paths to cache:"');
-            commands.push('  printf "  %s\\n" "${PATHS_TO_CACHE[@]}"');
-        }
-        // Transport split — see the preset path.
-        commands.push('  if [ -n "$CIBUILD_CACHE_DAEMON" ]; then');
-        commands.push(...emitDaemonPushCommands());
-        commands.push('  else');
-        // Atomic write into a per-process-unique temp (CBR-12). The "runs serialized
-        // per runner" assumption behind a fixed "$CACHE_FILE.tmp" is false with two VM
-        // slots and collides with the host cache daemon mutating this VirtioFS-shared
-        // dir; a unique name (PID + $RANDOM) removes the clash. The atomic mv is kept,
-        // and a failed compress/mv removes its own temp (no orphan) and stays non-fatal.
-        commands.push('  CACHE_TMP="$CACHE_FILE.$$.$RANDOM.tmp"');
-        commands.push('  tar -cf - "${PATHS_TO_CACHE[@]}" 2>/dev/null | zstd -3 > "$CACHE_TMP" && mv "$CACHE_TMP" "$CACHE_FILE" || rm -f "$CACHE_TMP"');
-        commands.push('  if [ -f "$CACHE_FILE" ]; then');
-        commands.push('    echo "Cache created successfully"');
-        if (isDebugMode) {
-            commands.push('    echo "Cache size: $(du -h "$CACHE_FILE" | cut -f1)"');
-        }
-        commands.push('  else');
-        commands.push('    echo "Warning: Failed to create cache file"');
-        commands.push('  fi');
-        // Closes the daemon/filesystem transport split.
-        commands.push('  fi');
-        commands.push('else');
-        commands.push('  echo "No paths to cache"');
-        commands.push('fi');
-        const script = this.createBashScriptFromCommands(commands, stepName);
-        return this.createScriptStep(script, stepName);
-    }
-    async executeWithPreset(technology, inputs, config) {
-        const stepName = 'cache-push';
-        const chain = resolvePresetChain(technology);
-        if (chain.length === 0) {
-            const supported = Object.keys(CACHE_PRESETS).join(', ');
-            throw new Error(`Unknown cache technology '${technology}'. Supported: ${supported}`);
-        }
-        const isDebugMode = this.getInput(inputs, 'is_debug_mode', false);
-        const commands = [];
-        commands.push(`# Cache Push (${technology})`);
-        commands.push(`echo "Saving ${technology} cache..."`);
-        commands.push('');
-        // Compute cache key from lockfile checksum at runtime
-        commands.push(`CACHE_DIR="${this.escapeBash(config.paths.cacheDir)}"`);
-        // Only the filesystem transport needs the directory to exist. Over the
-        // daemon the cache lives on the host, and on a runner this path is no
-        // longer mounted into the VM — an unconditional mkdir would abort the
-        // whole step under errexit.
-        commands.push('[ -n "$CIBUILD_CACHE_DAEMON" ] || mkdir -p "$CACHE_DIR"');
-        commands.push('');
-        commands.push('__ci_find_lockfile() {');
-        commands.push('  if [ -f "$1" ]; then echo "$1"; return; fi');
-        commands.push('  find . -name "$(basename "$1")" -not -path "*/DerivedData/*" -not -path "*/.build/*" 2>/dev/null | head -1');
-        commands.push('}');
-        commands.push('');
-        // Project scope: include a stable short hash of the git remote in every
-        // cache key so different repos on the same runner don't share tarballs.
-        commands.push(...emitProjectScopeCommands());
-        commands.push('');
-        if (chain.length === 1 && chain[0].fingerprint && chain[0].fingerprint.length > 0) {
-            commands.push(...emitFingerprintKeyCommands(chain[0]));
-        }
-        else if (chain.length === 1) {
-            const preset = chain[0];
-            commands.push(`LOCKFILE=$(__ci_find_lockfile "${this.escapeBash(preset.lockfile)}")`);
-            commands.push('if [ -n "$LOCKFILE" ] && [ -f "$LOCKFILE" ]; then');
-            commands.push(`  CHECKSUM=$(shasum -a 256 "$LOCKFILE" | cut -d ' ' -f1 | head -c 16)`);
-            commands.push(`  CACHE_KEY="${this.escapeBash(preset.keyPrefix)}-\${__ci_proj}-\${CHECKSUM}"`);
-            commands.push('else');
-            commands.push(`  echo "Warning: ${this.escapeBash(preset.lockfile)} not found, using fallback cache key"`);
-            commands.push(`  CACHE_KEY="${this.escapeBash(preset.keyPrefix)}-\${__ci_proj}-no-lockfile"`);
-            commands.push('fi');
-        }
-        else {
-            // Fallback chain: probe every lockfile up front, then branch — same
-            // fix as cache-pull. A probe nested in a prior preset's `then` body
-            // only ran when the first lockfile was found, so push wrote the
-            // `<first>-no-lockfile` key for SPM projects, mismatching what a
-            // correct pull would look for.
-            for (let i = 0; i < chain.length; i++) {
-                commands.push(`__ci_lockfile_${i}=$(__ci_find_lockfile "${this.escapeBash(chain[i].lockfile)}")`);
-            }
-            for (let i = 0; i < chain.length; i++) {
-                const preset = chain[i];
-                const cond = i === 0 ? 'if' : 'elif';
-                commands.push(`${cond} [ -n "$__ci_lockfile_${i}" ] && [ -f "$__ci_lockfile_${i}" ]; then`);
-                commands.push(`  LOCKFILE="$__ci_lockfile_${i}"`);
-                commands.push(`  CHECKSUM=$(shasum -a 256 "$LOCKFILE" | cut -d ' ' -f1 | head -c 16)`);
-                commands.push(`  CACHE_KEY="${this.escapeBash(preset.keyPrefix)}-\${__ci_proj}-\${CHECKSUM}"`);
-            }
-            commands.push('else');
-            commands.push(`  echo "Warning: no lockfile found, using fallback cache key"`);
-            commands.push(`  CACHE_KEY="${this.escapeBash(chain[0].keyPrefix)}-\${__ci_proj}-no-lockfile"`);
-            commands.push('fi');
-        }
-        commands.push('');
-        if (isDebugMode) {
-            commands.push('echo "Cache key: $CACHE_KEY"');
-        }
-        commands.push('CACHE_FILE="$CACHE_DIR/$CACHE_KEY.tar.zst"');
-        commands.push('');
-        // Collect paths to cache — use all paths from all presets in the chain,
-        // only archiving the ones that actually exist on disk
-        commands.push('# Collect paths to cache');
-        commands.push('PATHS_TO_CACHE=()');
-        const allPaths = [...new Set(chain.flatMap(p => p.paths))];
-        for (const p of allPaths) {
-            commands.push(`EXPANDED="${this.escapeBash(p)}"`);
-            commands.push('EXPANDED="${EXPANDED/#~/${CIBUILD_USER_HOME:-$HOME}}"');
-            commands.push('if [ -e "$EXPANDED" ]; then');
-            commands.push('  PATHS_TO_CACHE+=("$EXPANDED")');
-            if (isDebugMode) {
-                commands.push('  echo "Found: $EXPANDED"');
-            }
-            commands.push('else');
-            commands.push(`  echo "Warning: Path does not exist: $EXPANDED"`);
-            commands.push('fi');
-        }
-        commands.push('');
-        // Always re-archive on success: ~/.gradle/caches and friends are
-        // write-through accumulators — same fingerprint key does NOT imply
-        // unchanged contents (Gradle's build-cache-1 keeps appending task
-        // outputs as sources change). Skipping here would freeze the tarball
-        // at first-mint and let it drift further from current state on every
-        // build. Atomic .tmp + mv overwrites any prior tarball under this key.
-        commands.push('if [ ${#PATHS_TO_CACHE[@]} -gt 0 ]; then');
-        commands.push('  echo "Caching ${#PATHS_TO_CACHE[@]} path(s)..."');
-        // Transport split, mirroring cache-pull. Over the daemon the tarball is
-        // streamed straight out as the PUT body — nothing is staged on the guest,
-        // so there is no temp file to collide or orphan, and the daemon does the
-        // atomic temp+rename on the host side where the cache actually lives.
-        commands.push('  if [ -n "$CIBUILD_CACHE_DAEMON" ]; then');
-        commands.push(...emitDaemonPushCommands());
-        commands.push('  else');
-        // Per-process-unique temp (CBR-12). The old fixed "$CACHE_FILE.tmp" assumed
-        // a single serialized writer — false with two VM slots, and it collides with
-        // the host cache daemon mutating this VirtioFS-shared dir, which (a) made the
-        // guest's own .tmp transiently vanish at `mv` (silent clobber, masked by
-        // `|| true`) and (b) dropped VirtioFS off its async fast path. A unique name
-        // removes the collision; the atomic mv into place is preserved, and a failed
-        // compress/mv removes its own temp (no orphan) while staying non-fatal.
-        commands.push('  CACHE_TMP="$CACHE_FILE.$$.$RANDOM.tmp"');
-        commands.push('  tar -cf - "${PATHS_TO_CACHE[@]}" 2>/dev/null | zstd -3 > "$CACHE_TMP" && mv "$CACHE_TMP" "$CACHE_FILE" || rm -f "$CACHE_TMP"');
-        commands.push('  if [ -f "$CACHE_FILE" ]; then');
-        commands.push('    echo "Cache created successfully"');
-        if (isDebugMode) {
-            commands.push('    echo "Cache size: $(du -h "$CACHE_FILE" | cut -f1)"');
-        }
-        // Retention is no longer applied here (ADR 0002 / CBR-6). It moved into the
-        // long-lived peer cache daemon, which owns ~/cache and — unlike the guest —
-        // knows (via the manager) which scopes this runner OWNS and must never evict.
-        // A guest-side prune would have to run blind to ownership and could reap the
-        // fleet's single durable copy, so the daemon owns the whole policy now.
-        commands.push('  else');
-        commands.push('    echo "Warning: Failed to create cache file"');
-        commands.push('  fi');
-        // Closes the daemon/filesystem transport split.
-        commands.push('  fi');
-        commands.push('else');
-        commands.push('  echo "No paths to cache"');
-        commands.push('fi');
-        const script = this.createBashScriptFromCommands(commands, stepName);
-        return this.createScriptStep(script, stepName);
-    }
-}
-//# sourceMappingURL=cache.js.map