@joshuafolkken/kit 1.3099.0 → 1.3125.0

package/dist/commands/chunk-FDSSBZC7.js

@@ -0,0 +1,75 @@
+import {
+  lane_ledger_write
+} from "./chunk-V56NLG7I.js";
+
+// scripts/lane/lane-hand-back-hold.ts
+import {
+  closeSync,
+  constants,
+  openSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeSync
+} from "node:fs";
+var MARK_SUFFIX = ".hand-back";
+var MARK_FILE_MODE = 384;
+var MARK_ENCODING = "utf8";
+var { O_CREAT, O_NOFOLLOW, O_TRUNC, O_WRONLY } = constants;
+var WRITE_FLAGS = O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW;
+function mark_of(ledger) {
+  return `${ledger}${MARK_SUFFIX}`;
+}
+async function destination(ledger) {
+  const resolved = ledger ?? await lane_ledger_write.target();
+  return resolved === void 0 ? void 0 : mark_of(resolved);
+}
+function write(path, reason) {
+  const descriptor = openSync(path, WRITE_FLAGS, MARK_FILE_MODE);
+  try {
+    writeSync(descriptor, reason);
+  } finally {
+    closeSync(descriptor);
+  }
+}
+async function mark(reason, ledger) {
+  try {
+    const path = await destination(ledger);
+    if (path !== void 0) write(path, reason);
+  } catch {
+  }
+}
+async function clear(ledger) {
+  try {
+    const path = await destination(ledger);
+    if (path !== void 0) rmSync(path, { force: true });
+  } catch {
+  }
+}
+function read(ledger) {
+  try {
+    return readFileSync(mark_of(ledger), MARK_ENCODING);
+  } catch {
+    return void 0;
+  }
+}
+function take(ledger) {
+  const taken = `${mark_of(ledger)}.${String(process.pid)}`;
+  try {
+    renameSync(mark_of(ledger), taken);
+  } catch {
+    return void 0;
+  }
+  try {
+    return readFileSync(taken, MARK_ENCODING);
+  } catch {
+    return void 0;
+  } finally {
+    rmSync(taken, { force: true });
+  }
+}
+var lane_hand_back_hold = { clear, mark, read, take };
+
+export {
+  lane_hand_back_hold
+};

package/dist/commands/chunk-FFLZPLWC.js

@@ -0,0 +1,59 @@
+import {
+  epic_parse
+} from "./chunk-VDGNXSP3.js";
+import {
+  git_gh_command
+} from "./chunk-VJNE7W7O.js";
+import {
+  session_cite
+} from "./chunk-22DVQCP6.js";
+import {
+  poll
+} from "./chunk-SBGTCT2C.js";
+import {
+  parse_json_object_or_undefined
+} from "./chunk-NAZ753DE.js";
+
+// scripts/lib/settled-together.ts
+async function settled_together(first, second) {
+  const [result, other] = await Promise.allSettled([first, second]);
+  if (result.status === "rejected") throw result.reason;
+  if (other.status === "rejected") throw other.reason;
+}
+
+// scripts/followup/git-followup-issue-close.ts
+import { z } from "zod";
+var CLOSE_WAIT = { attempts: 3, interval_ms: 2e3 };
+var CLOSE_RECOVERY = "gh api -X PATCH repos/{owner}/{repo}/issues/<N> -f state=closed";
+var state_read_schema = z.object({ state: z.string().optional() });
+async function is_issue_closed(issue_number) {
+  const raw = await git_gh_command.issue_get_state_and_relations(issue_number);
+  const parsed = raw === void 0 ? void 0 : parse_json_object_or_undefined(raw, state_read_schema);
+  return epic_parse.is_state_closed(parsed?.state);
+}
+var FOLLOWUP_CLOSER = "pnpm josh followup";
+function build_close_comment(pr_url, closer = FOLLOWUP_CLOSER) {
+  return `Closed by \`${closer}\`: ${pr_url ?? "the merged pull request"} merged, but GitHub did not apply its \`closes #N\` keyword (joshuafolkken/kit#2770).`;
+}
+async function ensure_issue_closed(input, wait = CLOSE_WAIT) {
+  const { issue_number } = input;
+  const is_done = issue_number === void 0 || await poll.poll_until(async () => await is_issue_closed(issue_number), wait);
+  if (is_done) return;
+  console.warn(
+    `\u26A0\uFE0F  Issue ${session_cite.issue(issue_number)} is still open after the merge \u2014 closing it.`
+  );
+  const comment = build_close_comment(input.pr_url, input.closer);
+  if (!await git_gh_command.issue_close(issue_number, comment)) {
+    throw new Error(`gh api could not close issue ${session_cite.issue(issue_number)}`);
+  }
+}
+var git_followup_issue_close = {
+  ensure_issue_closed,
+  build_close_comment,
+  CLOSE_RECOVERY
+};
+
+export {
+  settled_together,
+  git_followup_issue_close
+};

package/dist/commands/chunk-FHLV5BII.js

@@ -0,0 +1,170 @@
+import {
+  backlog_drive_unit
+} from "./chunk-I2HHXZVG.js";
+import {
+  run_event_setup
+} from "./chunk-WEEJU3EH.js";
+import {
+  run_carry
+} from "./chunk-JSJS3OT7.js";
+import {
+  agent_session_environment
+} from "./chunk-HHBC6QZE.js";
+import {
+  issue_number_shape
+} from "./chunk-G75GWNNY.js";
+import {
+  cli_flags
+} from "./chunk-2FE3C4PH.js";
+import {
+  MS_PER_MINUTE
+} from "./chunk-WPAQUMHC.js";
+
+// scripts/backlog/backlog-drive-retrospective-unit.ts
+function brief_of(owner) {
+  return [
+    "Run the backlogrun retrospective as the run parent would: `pnpm josh doc:read retrospective.md`;",
+    "its digest is `pnpm josh retrospective`.",
+    `Close with \`pnpm josh run:carry --retrospective --summary "<result>" --owner ${owner}\`:`,
+    "the run record is held by that process, not this session.",
+    "Nobody answers this session: a question for a person ends it, written as the final message."
+  ].join(" ");
+}
+var LOG_LABEL = "retrospective";
+function request_of(ports, git_directory, owner) {
+  const log = backlog_drive_unit.log_path(git_directory, LOG_LABEL, ports.now());
+  return backlog_drive_unit.request_of(brief_of(owner), ports, log);
+}
+function production_ports() {
+  return {
+    repository_directory: run_carry.repository_directory,
+    emit: run_event_setup.emit,
+    launch_attached: backlog_drive_unit.launch_attached,
+    is_marked: (git_directory) => run_carry.retrospective_done_of(run_carry.read_carry(run_carry.carry_path(git_directory))),
+    environment: process.env,
+    cwd: process.cwd(),
+    now: () => Date.now()
+  };
+}
+async function run(owner, ports = production_ports()) {
+  const git_directory = await ports.repository_directory();
+  if (git_directory === void 0) return false;
+  const request = request_of(ports, git_directory, owner);
+  if (request === void 0) return false;
+  await ports.emit(run_event_setup.STAGE.RETROSPECTIVE);
+  await ports.launch_attached(request);
+  return ports.is_marked(git_directory);
+}
+var backlog_drive_retrospective_unit = { brief_of, run };
+
+// scripts/backlog/backlog-drive-args.ts
+var LIST_SEPARATOR = ",";
+var USAGE = "Usage: josh backlog:drive [--owner <pid>] [--active <ISO-8601>] [--max <n>] [--idle <minutes>] [--only] [--exclude <n>[,<n>...]] [--await <n>[,<n>...]] [--window <minutes>] [--stopped <n>]";
+var OPTIONS = {
+  active: { type: "string" },
+  await: { type: "string" },
+  exclude: { type: "string" },
+  idle: { type: "string" },
+  max: { type: "string" },
+  only: { type: "boolean" },
+  owner: { type: "string" },
+  stopped: { type: "string" },
+  "triage-owed": { type: "boolean" },
+  "triage-pid": { type: "string" },
+  "triage-start": { type: "string" },
+  window: { type: "string" }
+};
+var START_SPACE = " ";
+var START_SPACE_TOKEN = "_";
+function beside_session(values) {
+  const pid = cli_flags.to_count(values["triage-pid"]);
+  if (pid === void 0) return {};
+  const start = values["triage-start"]?.split(START_SPACE_TOKEN).join(START_SPACE);
+  return start === void 0 ? { triage_pid: pid } : { triage_pid: pid, triage_start: start };
+}
+function triage_flags(values) {
+  const owed = values["triage-owed"] === true ? { is_triage_owed: true } : {};
+  return { ...owed, ...beside_session(values) };
+}
+function read_values(argv) {
+  return cli_flags.parse_or_undefined({ args: [...argv], options: OPTIONS, strict: true })?.values;
+}
+function to_issues(raw) {
+  if (raw === void 0) return [];
+  const issues = raw.split(LIST_SEPARATOR);
+  return issues.some((issue) => !issue_number_shape.is_issue_number(issue)) ? void 0 : issues;
+}
+function forwarded_of(values) {
+  const pairs = ["max", "idle"].filter((name) => values[name] !== void 0);
+  if (pairs.some((name) => cli_flags.to_count(values[name]) === void 0)) return void 0;
+  return pairs.flatMap((name) => [`--${name}`, values[name] ?? ""]);
+}
+function window_of(raw) {
+  return raw === void 0 ? void 0 : Number(raw) * MS_PER_MINUTE;
+}
+function is_count_or_absent(raw) {
+  return raw === void 0 || cli_flags.to_count(raw) !== void 0;
+}
+function is_valid_single(values) {
+  const is_valid_stopped = values.stopped === void 0 || issue_number_shape.ISSUE_NUMBER_PATTERN.test(values.stopped);
+  const is_valid_counts = is_count_or_absent(values.window) && is_count_or_absent(values["triage-pid"]);
+  return is_valid_stopped && is_valid_counts;
+}
+function owner_of(values) {
+  const owner = values?.owner ?? agent_session_environment.own_session_pid()?.toString();
+  return cli_flags.to_count(owner) === void 0 ? void 0 : owner;
+}
+function to_context(values, owner) {
+  if (!is_valid_single(values)) return void 0;
+  const forwarded = forwarded_of(values);
+  const exclude = to_issues(values.exclude);
+  const awaited = to_issues(values.await);
+  if (forwarded === void 0 || exclude === void 0 || awaited === void 0) return void 0;
+  const window_ms = window_of(values.window);
+  return {
+    owner,
+    active: values.active,
+    forwarded,
+    exclude,
+    awaited,
+    window_ms,
+    window: values.window,
+    is_only: values.only === true,
+    stopped: values.stopped,
+    ...triage_flags(values)
+  };
+}
+function parse(argv) {
+  const values = read_values(argv);
+  const owner = owner_of(values);
+  return values === void 0 || owner === void 0 ? void 0 : to_context(values, owner);
+}
+function beside_flags(pid, start) {
+  if (pid === void 0) return [];
+  const named = ["--triage-pid", String(pid)];
+  if (start === void 0) return named;
+  return [...named, "--triage-start", start.split(START_SPACE).join(START_SPACE_TOKEN)];
+}
+function triage_line_flags(state) {
+  const owed = state.is_triage_owed === true ? ["--triage-owed"] : [];
+  return [...owed, ...beside_flags(state.triage_pid, state.triage_start)];
+}
+function resume_line(state, context) {
+  const exclude = [.../* @__PURE__ */ new Set([...context.exclude, ...state.exclude])];
+  const flags = ["--owner", context.owner, "--active", state.active, ...context.forwarded];
+  if (exclude.length > 0) flags.push("--exclude", exclude.join(LIST_SEPARATOR));
+  if (context.window !== void 0) flags.push("--window", context.window);
+  if (state.stopped_by !== void 0) flags.push("--stopped", state.stopped_by);
+  return `resume: ${[...flags, ...triage_line_flags(state)].join(" ")}`;
+}
+var backlog_drive_args = {
+  USAGE,
+  beside_flags,
+  parse,
+  resume_line
+};
+
+export {
+  backlog_drive_retrospective_unit,
+  backlog_drive_args
+};

package/dist/commands/chunk-FITTCICF.js

@@ -0,0 +1,247 @@
+import {
+  git_common_directory
+} from "./chunk-MT6TRLFD.js";
+import {
+  PROJECT_ROOT
+} from "./chunk-3CCGKX7Y.js";
+
+// scripts/security/security-audit-logic.ts
+import path from "node:path";
+var BINARY_NAME = "osv-scanner";
+var LOCKFILE_PATH = "pnpm-lock.yaml";
+var MANAGED_TOOL_SEGMENTS = ["node_modules", ".cache", "josh-tools"];
+var WINDOWS_PLATFORM = "win32";
+var WINDOWS_BINARY_SUFFIX = ".exe";
+var INSTALL_INSTRUCTIONS = [
+  "",
+  "Install options:",
+  "  Managed: pnpm josh audit:provision",
+  "  macOS:  brew install osv-scanner",
+  "  Go:     go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest",
+  '  Docker: docker run --rm -v "$PWD:/src" ghcr.io/google/osv-scanner --lockfile=/src/pnpm-lock.yaml',
+  "",
+  "Docs: https://google.github.io/osv-scanner/"
+].join("\n");
+function build_scanner_arguments(lockfile_path) {
+  return [`--lockfile=${lockfile_path}`];
+}
+function build_managed_binary_path(project_root, platform) {
+  const suffix = platform === WINDOWS_PLATFORM ? WINDOWS_BINARY_SUFFIX : "";
+  return path.join(project_root, ...MANAGED_TOOL_SEGMENTS, `${BINARY_NAME}${suffix}`);
+}
+function format_missing_binary_error(binary_name) {
+  return `${binary_name} is not installed.
+${INSTALL_INSTRUCTIONS}`;
+}
+var security_audit_logic = {
+  BINARY_NAME,
+  LOCKFILE_PATH,
+  build_managed_binary_path,
+  build_scanner_arguments,
+  format_missing_binary_error
+};
+
+// scripts/security/security-audit-provision-logic.ts
+var SCANNER_VERSION = "2.6.0";
+var MINIMUM_SCANNER_VERSION = SCANNER_VERSION;
+var RELEASE_BASE_URL = "https://github.com/google/osv-scanner/releases/download";
+var WINDOWS_PLATFORM2 = "win32";
+var WINDOWS_ASSET_SUFFIX = ".exe";
+var SESSION_DOWNLOAD_TIMEOUT_MS = 6e4;
+var FORCED_DOWNLOAD_TIMEOUT_MS = 6e5;
+function build_download_timeout(is_forced) {
+  return is_forced ? FORCED_DOWNLOAD_TIMEOUT_MS : SESSION_DOWNLOAD_TIMEOUT_MS;
+}
+var MS_PER_HOUR = 36e5;
+var HOURS_BEFORE_RETRY = 6;
+var RETRY_INTERVAL_MS = HOURS_BEFORE_RETRY * MS_PER_HOUR;
+var PLATFORM_NAMES = {
+  darwin: "darwin",
+  linux: "linux",
+  win32: "windows"
+};
+var ARCHITECTURE_NAMES = {
+  arm64: "arm64",
+  x64: "amd64"
+};
+var ASSET_CHECKSUMS = {
+  "osv-scanner_darwin_amd64": "60c5296637e977b28eeda5c7f13573e447659a632922737f94d11fa7e30ad6ca",
+  "osv-scanner_darwin_arm64": "98c460dcd37de25819babd757d04542045b6243113e209edcd4d89fedb0256b4",
+  "osv-scanner_linux_amd64": "ca69b3d3cd08f889a49dc0a383122f71cc528b83803671df5fd874d97485b108",
+  "osv-scanner_linux_arm64": "2c71403eb443d05891c4f268c3ad771cf4f16e5443463fd7851ef8f454d3c7e4",
+  "osv-scanner_windows_amd64.exe": "e0ed7644118b717b028c249ee9d3515024e55e8510747ca08906eb96765354d6",
+  "osv-scanner_windows_arm64.exe": "ca1379da0e408279ef2c85cde0846a903495738a91c7b065a208048437c1686c"
+};
+function build_asset_name(platform, architecture) {
+  const platform_name = PLATFORM_NAMES[platform];
+  const architecture_name = ARCHITECTURE_NAMES[architecture];
+  if (platform_name === void 0 || architecture_name === void 0) return void 0;
+  const suffix = platform === WINDOWS_PLATFORM2 ? WINDOWS_ASSET_SUFFIX : "";
+  return `${security_audit_logic.BINARY_NAME}_${platform_name}_${architecture_name}${suffix}`;
+}
+function build_download_url(asset_name) {
+  return `${RELEASE_BASE_URL}/v${SCANNER_VERSION}/${asset_name}`;
+}
+function resolve_asset(platform, architecture) {
+  const name = build_asset_name(platform, architecture);
+  if (name === void 0) return void 0;
+  const sha256 = ASSET_CHECKSUMS[name];
+  if (sha256 === void 0) return void 0;
+  return { name, sha256, url: build_download_url(name) };
+}
+function format_already_present(location) {
+  return `osv-scanner is already available (${location}); nothing to provision.`;
+}
+function format_unsupported_platform(platform, architecture) {
+  return `No pinned osv-scanner build for ${platform}/${architecture}; install it manually to run the pre-push audit.`;
+}
+function format_download_failure(url, reason) {
+  return `Could not fetch osv-scanner from ${url}: ${reason}. Run \`pnpm josh audit:provision --force\` to retry with a longer timeout; until then the pre-push audit will report the missing binary.`;
+}
+function format_checksum_mismatch(asset_name, expected, actual) {
+  return `Checksum mismatch for ${asset_name}: expected ${expected}, got ${actual}. Nothing was installed.`;
+}
+function format_installed(target_path) {
+  return `Installed osv-scanner v${SCANNER_VERSION} at ${target_path}.`;
+}
+function format_recent_failure() {
+  return `A previous attempt to provision osv-scanner failed less than ${String(HOURS_BEFORE_RETRY)} hours ago; not retrying at session start. Run \`pnpm josh audit:provision --force\` to try again now.`;
+}
+function format_provision_error(reason) {
+  return `Could not provision osv-scanner: ${reason}. The pre-push audit will report the missing binary.`;
+}
+var SCANNER_VERSION_PATTERN = /osv-scanner version:\s*(\d+\.\d+\.\d+)/u;
+function parse_scanner_version(version_output) {
+  return SCANNER_VERSION_PATTERN.exec(version_output)?.[1];
+}
+function to_version_parts(version) {
+  return version.split(".").map(Number);
+}
+function compare_versions(left, right) {
+  const left_parts = to_version_parts(left);
+  const right_parts = to_version_parts(right);
+  const length = Math.max(left_parts.length, right_parts.length);
+  for (let index = 0; index < length; index += 1) {
+    const difference = (left_parts[index] ?? 0) - (right_parts[index] ?? 0);
+    if (difference !== 0) return difference;
+  }
+  return 0;
+}
+function meets_version_floor(version) {
+  return compare_versions(version, MINIMUM_SCANNER_VERSION) >= 0;
+}
+function format_below_floor(version) {
+  return `osv-scanner ${version} is below the required v${MINIMUM_SCANNER_VERSION}; older builds parse only part of pnpm-lock.yaml, so a clean result here is not proof the lockfile is clean. Run \`pnpm josh audit:provision --force\` to install v${SCANNER_VERSION}.`;
+}
+var security_audit_provision_logic = {
+  RETRY_INTERVAL_MS,
+  SESSION_DOWNLOAD_TIMEOUT_MS,
+  SCANNER_VERSION,
+  MINIMUM_SCANNER_VERSION,
+  build_asset_name,
+  build_download_timeout,
+  build_download_url,
+  format_already_present,
+  format_below_floor,
+  format_checksum_mismatch,
+  format_download_failure,
+  format_installed,
+  format_provision_error,
+  format_recent_failure,
+  format_unsupported_platform,
+  meets_version_floor,
+  parse_scanner_version,
+  resolve_asset
+};
+
+// scripts/security/security-audit.ts
+import { accessSync, constants, statSync } from "node:fs";
+import path2 from "node:path";
+import { execaSync } from "execa";
+var FAILURE_EXIT_CODE = 1;
+var GIT_DIRECTORY_NAME = ".git";
+var UNKNOWN_VERSION = "unknown";
+function is_binary_available(binary_name) {
+  const result = execaSync(binary_name, ["--version"], { stdio: "ignore", reject: false });
+  return result.exitCode !== void 0;
+}
+function scanner_version(binary_or_path) {
+  const result = execaSync(binary_or_path, ["--version"], { reject: false });
+  if (result.exitCode === void 0) return void 0;
+  return security_audit_provision_logic.parse_scanner_version(result.stdout);
+}
+function meets_floor(binary_or_path) {
+  const version = scanner_version(binary_or_path);
+  return version !== void 0 && security_audit_provision_logic.meets_version_floor(version);
+}
+function is_executable_file(candidate_path) {
+  try {
+    accessSync(candidate_path, constants.X_OK);
+    const stats = statSync(candidate_path);
+    return stats.isFile() && stats.size > 0;
+  } catch {
+    return false;
+  }
+}
+function managed_root(project_root) {
+  const common = git_common_directory.repository(project_root);
+  if (common === void 0 || path2.basename(common) !== GIT_DIRECTORY_NAME) return project_root;
+  return path2.dirname(common);
+}
+function managed_binary_path(project_root, platform) {
+  return security_audit_logic.build_managed_binary_path(managed_root(project_root), platform);
+}
+function managed_scanner(project_root, platform) {
+  const managed_path = managed_binary_path(project_root, platform);
+  return is_executable_file(managed_path) && meets_floor(managed_path) ? managed_path : void 0;
+}
+function resolve_scanner(project_root, platform) {
+  const { BINARY_NAME: BINARY_NAME2 } = security_audit_logic;
+  const has_path_binary = is_binary_available(BINARY_NAME2);
+  if (has_path_binary && meets_floor(BINARY_NAME2)) {
+    return { path: BINARY_NAME2, is_below_floor: false };
+  }
+  const managed = managed_scanner(project_root, platform);
+  if (managed !== void 0) return { path: managed, is_below_floor: false };
+  return has_path_binary ? { path: BINARY_NAME2, is_below_floor: true } : void 0;
+}
+var FORWARDED_OUTPUT = ["inherit", "pipe"];
+function run_scanner(scanner_path) {
+  const { LOCKFILE_PATH: LOCKFILE_PATH2, build_scanner_arguments: build_scanner_arguments2 } = security_audit_logic;
+  const result = execaSync(scanner_path, [...build_scanner_arguments2(LOCKFILE_PATH2)], {
+    stdin: "inherit",
+    stdout: FORWARDED_OUTPUT,
+    stderr: FORWARDED_OUTPUT,
+    reject: false
+  });
+  return result.exitCode ?? FAILURE_EXIT_CODE;
+}
+function warn_below_floor(scanner_path) {
+  const version = scanner_version(scanner_path) ?? UNKNOWN_VERSION;
+  console.warn(security_audit_provision_logic.format_below_floor(version));
+}
+function run() {
+  const { BINARY_NAME: BINARY_NAME2, format_missing_binary_error: format_missing_binary_error2 } = security_audit_logic;
+  const choice = resolve_scanner(PROJECT_ROOT, process.platform);
+  if (choice === void 0) {
+    console.error(format_missing_binary_error2(BINARY_NAME2));
+    return FAILURE_EXIT_CODE;
+  }
+  if (choice.is_below_floor) warn_below_floor(choice.path);
+  return run_scanner(choice.path);
+}
+var security_audit = {
+  is_binary_available,
+  is_executable_file,
+  managed_binary_path,
+  meets_floor,
+  resolve_scanner,
+  run,
+  run_scanner
+};
+
+export {
+  security_audit_logic,
+  security_audit_provision_logic,
+  security_audit
+};