@limrun/api 0.33.4 → 0.34.0

package/rbe-bep.mjs

@@ -1,219 +0,0 @@
-/**
- * Parses Bazel's Build Event Protocol (BEP, the `--build_event_json_file`
- * newline-delimited JSON) to find a built target's top-level `.ipa` and its
- * content-addressed (CAS) digest.
- *
- * A remotely-executed output carries a `bytestream://<host>[/<instance>]/blobs/
- * <hash>/<size>` URI in its BEP `file` entry regardless of whether Bazel also
- * downloads the bytes (`--remote_download_outputs`), because the URI names the
- * output's CAS identity, not its local availability. `lim xcode rbe install`
- * reads that digest and hands it to the instance, which fetches the blob from
- * its own RBE cache and installs it — no round-trip. The generated bazelrc sets
- * `--remote_download_outputs=minimal` to skip the (unneeded) local download by
- * default; overriding it (e.g. `--remote_download_outputs=toplevel` on the command
- * line) to materialize the .ipa locally does not affect this parser.
- *
- * A fully-cached rebuild (0 actions executed) still emits the bytestream URI and
- * reproduces the same digest, so the auto-install watcher can rely on this parser
- * after a no-op or revert (e.g. `git stash`) rebuild. Verified empirically.
- */
-export class RbeBepError extends Error {
-    constructor(kind, message) {
-        super(message);
-        this.name = 'RbeBepError';
-        this.kind = kind;
-    }
-    /**
-     * True when re-reading the same (completed) BEP cannot help — the build was
-     * produced with flags the instance cache can't use (local download or a
-     * non-SHA256 digest). The watcher logs these once instead of retrying.
-     */
-    get terminal() {
-        return this.kind === 'local-only' || this.kind === 'non-sha256';
-    }
-}
-/** A SHA-256 digest is exactly 64 lowercase hex chars; the instance CAS is keyed by it. */
-const SHA256_HEX = /^[0-9a-f]{64}$/;
-/**
- * Extracts (digestFunction, hash, size) from a Bazel/REAPI bytestream blob URI:
- * `bytestream://…/blobs/[<digest_function>/]<hash>/<size>`. The digest-function
- * segment is OMITTED for functions inferable from hash length (SHA-256 among
- * them) and PRESENT otherwise — notably BLAKE3, whose 256-bit output is also 64
- * hex chars and so cannot be told apart from SHA-256 by length. Capturing the
- * function lets the caller reject a non-SHA256 build (e.g. Bazel 9's BLAKE3
- * default) with the right guidance instead of misreading the URI.
- */
-function parseBytestreamDigest(uri) {
-    // Anchor on the /blobs/[func/]<hash>/<size> tail (tolerating an instance-name
-    // prefix). The optional function group only matches a real function segment:
-    // for the SHA-256 form (`/blobs/<hash>/<size>`) it backtracks to absent, and
-    // for `/blobs/blake3/<hash>/<size>` the non-hex 'l'/'k' force it to be captured
-    // as the function rather than the hash.
-    const m = uri.match(/\/blobs\/(?:([a-z0-9_]+)\/)?([0-9a-fA-F]+)\/(\d+)(?:$|\/)/);
-    if (!m || m[2] === undefined || m[3] === undefined)
-        return null;
-    return {
-        ...(m[1] !== undefined ? { digestFunction: m[1] } : {}),
-        hash: m[2].toLowerCase(),
-        sizeBytes: Number(m[3]),
-    };
-}
-/**
- * Canonicalizes a Bazel target label to the `//pkg:name` form BEP records.
- * Bazel expands the `//pkg` shorthand to `//pkg:<basename(pkg)>` in its
- * targetCompleted events, so `install //App` must match BEP's `//App:App`.
- */
-function canonicalizeLabel(label) {
-    if (label.includes(':'))
-        return label;
-    // Strip trailing slashes with a linear scan rather than a regex: `/\/+$/`
-    // backtracks quadratically on a label of many trailing slashes (CodeQL ReDoS).
-    let end = label.length;
-    while (end > 0 && label[end - 1] === '/')
-        end--;
-    const pkg = label.slice(0, end);
-    const name = pkg.split('/').pop() ?? '';
-    return name ? `${pkg}:${name}` : pkg;
-}
-/** Parses the BEP stream into events, ignoring partial/garbled lines. */
-function parseEvents(bepJson) {
-    const events = [];
-    for (const line of bepJson.split('\n')) {
-        const trimmed = line.trim();
-        if (!trimmed)
-            continue;
-        try {
-            events.push(JSON.parse(trimmed));
-        }
-        catch {
-            // Ignore partial/garbled lines (BEP is flushed incrementally).
-        }
-    }
-    return events;
-}
-/**
- * Inspects a BEP stream for build completion. The watcher reads the BEP on every
- * change but only acts once `complete` is true (the stream is fully flushed) and
- * `success` is true (the build did not fail). `invocationId` lets the watcher act
- * once per build even when consecutive builds reproduce the same .ipa digest
- * (e.g. a `git stash` revert that rebuilds to an earlier digest).
- */
-export function inspectBuildCompletion(bepJson) {
-    let complete = false;
-    let sawFinished = false;
-    let success = false;
-    let invocationId;
-    for (const e of parseEvents(bepJson)) {
-        if (e.started?.uuid)
-            invocationId = e.started.uuid;
-        if (e.id?.buildFinished !== undefined || e.finished !== undefined) {
-            sawFinished = true;
-            // proto3 JSON omits zero-valued scalars, so a SUCCESS exit code serializes
-            // as `{name:"SUCCESS"}` with `code` omitted — checking `code === 0` would be
-            // a dead branch. Trust overallSuccess (present=true on success, omitted on
-            // failure) and fall back to the exit code's symbolic name.
-            success = e.finished?.overallSuccess === true || e.finished?.exitCode?.name === 'SUCCESS';
-        }
-        if (e.lastMessage === true)
-            complete = true;
-    }
-    return {
-        complete,
-        success: sawFinished && success,
-        ...(invocationId !== undefined ? { invocationId } : {}),
-    };
-}
-/** Indexes namedSetOfFiles events by id for transitive fileset resolution. */
-function indexNamedSets(events) {
-    const namedSets = new Map();
-    for (const e of events) {
-        const id = e.id?.namedSet?.id;
-        if (id && e.namedSetOfFiles)
-            namedSets.set(id, e.namedSetOfFiles);
-    }
-    return namedSets;
-}
-/**
- * Resolves the top-level `.ipa` CAS digest for one successful target's
- * `completed` event, walking its default output group's filesets transitively.
- * Throws a typed RbeBepError when no .ipa is present, it was materialized
- * locally (`file://`), or it carries a non-SHA256 (e.g. BLAKE3) digest.
- */
-function resolveIpaDigest(label, completed, namedSets) {
-    // Default output group -> the fileSet (namedSetOfFiles) ids holding its outputs.
-    const rootFileSetIds = (completed.outputGroup ?? [])
-        .filter((og) => og.name === 'default' || !og.name)
-        .flatMap((og) => (og.fileSets ?? []).map((fs) => fs.id))
-        .filter((id) => !!id);
-    if (rootFileSetIds.length === 0) {
-        throw new RbeBepError('no-output', `Build of ${label} reported no default output files.`);
-    }
-    const seen = new Set();
-    const queue = [...rootFileSetIds];
-    // Set to the name of an .ipa that was seen but had no bytestream digest (its
-    // output was downloaded locally) — distinguishes that case from "no .ipa at all".
-    let localOnlyIpa;
-    while (queue.length > 0) {
-        const id = queue.shift();
-        if (seen.has(id))
-            continue;
-        seen.add(id);
-        const set = namedSets.get(id);
-        if (!set)
-            continue;
-        for (const f of set.files ?? []) {
-            if (!f.name || !f.name.endsWith('.ipa'))
-                continue;
-            const digest = f.uri ? parseBytestreamDigest(f.uri) : null;
-            if (digest) {
-                // The instance cache is keyed by SHA-256. Reject any other digest
-                // function — Bazel 9 defaults to BLAKE3, whose URI carries an explicit
-                // `blake3` function segment (and whose 64-hex hash is indistinguishable
-                // from SHA-256 by length, so the hash form alone can't catch it). Surface
-                // it here with the fix rather than letting it fail later as a cryptic
-                // server cache miss.
-                const isSha256 = digest.digestFunction === undefined ?
-                    SHA256_HEX.test(digest.hash)
-                    : digest.digestFunction === 'sha256';
-                if (!isSha256) {
-                    const got = digest.digestFunction ?? `${digest.hash.length} hex chars`;
-                    throw new RbeBepError('non-sha256', `Built ${f.name} with a non-SHA256 digest (${got}; Bazel 9 defaults to BLAKE3). The instance ` +
-                        `cache is keyed by SHA-256 — rebuild with --digest_function=sha256, e.g. ` +
-                        `\`bazelisk --digest_function=sha256 build --config=limrun ${label}\`.`);
-                }
-                return { hash: digest.hash, sizeBytes: digest.sizeBytes, ipaName: f.name };
-            }
-            localOnlyIpa = f.name;
-        }
-        for (const nested of set.fileSets ?? []) {
-            if (nested.id)
-                queue.push(nested.id);
-        }
-    }
-    if (localOnlyIpa) {
-        throw new RbeBepError('local-only', `Found ${label}'s .ipa (${localOnlyIpa}) but it has no remote (bytestream) digest — it was ` +
-            `built locally, not remotely executed. Ensure you built with --config=limrun so the .ipa is ` +
-            `produced in the instance's cache.`);
-    }
-    throw new RbeBepError('no-ipa', `No .ipa output found for ${label} in the build event log.`);
-}
-/**
- * Finds the `.ipa` produced for `label` in a BEP stream and returns its CAS
- * digest. Throws a typed RbeBepError when the target/.ipa is absent, its output
- * was materialized locally (a `file://` URI) instead of left in CAS, or it was
- * built with a non-SHA256 digest the instance cache cannot resolve.
- */
-export function parseTopLevelIpaDigest(bepJson, label) {
-    const canonical = canonicalizeLabel(label);
-    const events = parseEvents(bepJson);
-    // The successful TargetComplete for the requested label (matched against the
-    // canonical //pkg:name form Bazel records, so `//App` matches `//App:App`).
-    const completed = events.find((e) => e.id?.targetCompleted?.label === canonical && e.completed?.success)
-        ?.completed;
-    if (!completed) {
-        throw new RbeBepError('no-build', `No successful build of ${label} found in the build event log. ` +
-            `Build it first with --config=limrun (e.g. \`bazelisk --digest_function=sha256 build --config=limrun ${label}\`).`);
-    }
-    return resolveIpaDigest(label, completed, indexNamedSets(events));
-}
-//# sourceMappingURL=rbe-bep.mjs.map

package/rbe-bep.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"rbe-bep.mjs","sourceRoot":"","sources":["src/rbe-bep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA0CH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAEpC,YAAY,IAAqB,EAAE,OAAe;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC;IAClE,CAAC;CACF;AAED,2FAA2F;AAC3F,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAEpC;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAC5B,GAAW;IAEX,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,gFAAgF;IAChF,wCAAwC;IACxC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACjF,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO;QACL,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;QACxB,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACxB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,0EAA0E;IAC1E,+EAA+E;IAC/E,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IACxC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AACvC,CAAC;AAED,yEAAyE;AACzE,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAa,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAiBD;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,YAAgC,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI;YAAE,YAAY,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACnD,IAAI,CAAC,CAAC,EAAE,EAAE,aAAa,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClE,WAAW,GAAG,IAAI,CAAC;YACnB,2EAA2E;YAC3E,6EAA6E;YAC7E,2EAA2E;YAC3E,2DAA2D;YAC3D,OAAO,GAAG,CAAC,CAAC,QAAQ,EAAE,cAAc,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,KAAK,SAAS,CAAC;QAC5F,CAAC;QACD,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI;YAAE,QAAQ,GAAG,IAAI,CAAC;IAC9C,CAAC;IACD,OAAO;QACL,QAAQ;QACR,OAAO,EAAE,WAAW,IAAI,OAAO;QAC/B,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,cAAc,CAAC,MAAkB;IACxC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC9B,IAAI,EAAE,IAAI,CAAC,CAAC,eAAe;YAAE,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CACvB,KAAa,EACb,SAA6C,EAC7C,SAAgE;IAEhE,iFAAiF;IACjF,MAAM,cAAc,GAAG,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,CAAC;SACjD,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;SACjD,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;SACvD,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,YAAY,KAAK,oCAAoC,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC;IAClC,6EAA6E;IAC7E,kFAAkF;IAClF,IAAI,YAAgC,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,SAAS;YAClD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC3D,IAAI,MAAM,EAAE,CAAC;gBACX,kEAAkE;gBAClE,uEAAuE;gBACvE,wEAAwE;gBACxE,0EAA0E;gBAC1E,sEAAsE;gBACtE,qBAAqB;gBACrB,MAAM,QAAQ,GACZ,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC;oBACnC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBAC9B,CAAC,CAAC,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC;gBACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC;oBACvE,MAAM,IAAI,WAAW,CACnB,YAAY,EACZ,SAAS,CAAC,CAAC,IAAI,8BAA8B,GAAG,8CAA8C;wBAC5F,0EAA0E;wBAC1E,6DAA6D,KAAK,KAAK,CAC1E,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7E,CAAC;YACD,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC;QACxB,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,IAAI,WAAW,CACnB,YAAY,EACZ,SAAS,KAAK,YAAY,YAAY,sDAAsD;YAC1F,6FAA6F;YAC7F,mCAAmC,CACtC,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,WAAW,CAAC,QAAQ,EAAE,4BAA4B,KAAK,0BAA0B,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,KAAa;IACnE,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAEpC,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC;QACtG,EAAE,SAAS,CAAC;IACd,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CACnB,UAAU,EACV,0BAA0B,KAAK,iCAAiC;YAC9D,uGAAuG,KAAK,MAAM,CACrH,CAAC;IACJ,CAAC;IAED,OAAO,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC"}

package/src/rbe-bep.ts

@@ -1,292 +0,0 @@
-/**
- * Parses Bazel's Build Event Protocol (BEP, the `--build_event_json_file`
- * newline-delimited JSON) to find a built target's top-level `.ipa` and its
- * content-addressed (CAS) digest.
- *
- * A remotely-executed output carries a `bytestream://<host>[/<instance>]/blobs/
- * <hash>/<size>` URI in its BEP `file` entry regardless of whether Bazel also
- * downloads the bytes (`--remote_download_outputs`), because the URI names the
- * output's CAS identity, not its local availability. `lim xcode rbe install`
- * reads that digest and hands it to the instance, which fetches the blob from
- * its own RBE cache and installs it — no round-trip. The generated bazelrc sets
- * `--remote_download_outputs=minimal` to skip the (unneeded) local download by
- * default; overriding it (e.g. `--remote_download_outputs=toplevel` on the command
- * line) to materialize the .ipa locally does not affect this parser.
- *
- * A fully-cached rebuild (0 actions executed) still emits the bytestream URI and
- * reproduces the same digest, so the auto-install watcher can rely on this parser
- * after a no-op or revert (e.g. `git stash`) rebuild. Verified empirically.
- */
-
-export type BepIpaDigest = {
-  /** Lowercase hex SHA-256 of the .ipa blob. */
-  hash: string;
-  /** Size of the .ipa blob in bytes. */
-  sizeBytes: number;
-  /** The .ipa file name as Bazel reported it (e.g. "App/App.ipa"). */
-  ipaName: string;
-};
-
-type BepEvent = {
-  id?: {
-    targetCompleted?: { label?: string };
-    namedSet?: { id?: string };
-    buildFinished?: unknown;
-  };
-  started?: { uuid?: string };
-  finished?: { overallSuccess?: boolean; exitCode?: { name?: string; code?: number } };
-  /** Bazel sets this on the final BEP event once the stream is fully flushed. */
-  lastMessage?: boolean;
-  completed?: {
-    success?: boolean;
-    outputGroup?: Array<{ name?: string; fileSets?: Array<{ id?: string }> }>;
-  };
-  namedSetOfFiles?: {
-    files?: Array<{ name?: string; uri?: string }>;
-    fileSets?: Array<{ id?: string }>;
-  };
-};
-
-/**
- * Why a BEP could not yield an .ipa digest for a label.
- *
- * `terminal` failures will not resolve by re-reading the same completed BEP
- * (the build used the wrong flags); `no-build` / `no-output` / `no-ipa` are
- * transient while the build is still flushing and become terminal only once
- * the build is confirmed complete. The watcher uses this to decide whether to
- * retry the read or to log-once and give up.
- */
-export type RbeBepErrorKind = 'no-build' | 'no-output' | 'no-ipa' | 'local-only' | 'non-sha256';
-
-export class RbeBepError extends Error {
-  readonly kind: RbeBepErrorKind;
-  constructor(kind: RbeBepErrorKind, message: string) {
-    super(message);
-    this.name = 'RbeBepError';
-    this.kind = kind;
-  }
-
-  /**
-   * True when re-reading the same (completed) BEP cannot help — the build was
-   * produced with flags the instance cache can't use (local download or a
-   * non-SHA256 digest). The watcher logs these once instead of retrying.
-   */
-  get terminal(): boolean {
-    return this.kind === 'local-only' || this.kind === 'non-sha256';
-  }
-}
-
-/** A SHA-256 digest is exactly 64 lowercase hex chars; the instance CAS is keyed by it. */
-const SHA256_HEX = /^[0-9a-f]{64}$/;
-
-/**
- * Extracts (digestFunction, hash, size) from a Bazel/REAPI bytestream blob URI:
- * `bytestream://…/blobs/[<digest_function>/]<hash>/<size>`. The digest-function
- * segment is OMITTED for functions inferable from hash length (SHA-256 among
- * them) and PRESENT otherwise — notably BLAKE3, whose 256-bit output is also 64
- * hex chars and so cannot be told apart from SHA-256 by length. Capturing the
- * function lets the caller reject a non-SHA256 build (e.g. Bazel 9's BLAKE3
- * default) with the right guidance instead of misreading the URI.
- */
-function parseBytestreamDigest(
-  uri: string,
-): { digestFunction?: string; hash: string; sizeBytes: number } | null {
-  // Anchor on the /blobs/[func/]<hash>/<size> tail (tolerating an instance-name
-  // prefix). The optional function group only matches a real function segment:
-  // for the SHA-256 form (`/blobs/<hash>/<size>`) it backtracks to absent, and
-  // for `/blobs/blake3/<hash>/<size>` the non-hex 'l'/'k' force it to be captured
-  // as the function rather than the hash.
-  const m = uri.match(/\/blobs\/(?:([a-z0-9_]+)\/)?([0-9a-fA-F]+)\/(\d+)(?:$|\/)/);
-  if (!m || m[2] === undefined || m[3] === undefined) return null;
-  return {
-    ...(m[1] !== undefined ? { digestFunction: m[1] } : {}),
-    hash: m[2].toLowerCase(),
-    sizeBytes: Number(m[3]),
-  };
-}
-
-/**
- * Canonicalizes a Bazel target label to the `//pkg:name` form BEP records.
- * Bazel expands the `//pkg` shorthand to `//pkg:<basename(pkg)>` in its
- * targetCompleted events, so `install //App` must match BEP's `//App:App`.
- */
-function canonicalizeLabel(label: string): string {
-  if (label.includes(':')) return label;
-  // Strip trailing slashes with a linear scan rather than a regex: `/\/+$/`
-  // backtracks quadratically on a label of many trailing slashes (CodeQL ReDoS).
-  let end = label.length;
-  while (end > 0 && label[end - 1] === '/') end--;
-  const pkg = label.slice(0, end);
-  const name = pkg.split('/').pop() ?? '';
-  return name ? `${pkg}:${name}` : pkg;
-}
-
-/** Parses the BEP stream into events, ignoring partial/garbled lines. */
-function parseEvents(bepJson: string): BepEvent[] {
-  const events: BepEvent[] = [];
-  for (const line of bepJson.split('\n')) {
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    try {
-      events.push(JSON.parse(trimmed) as BepEvent);
-    } catch {
-      // Ignore partial/garbled lines (BEP is flushed incrementally).
-    }
-  }
-  return events;
-}
-
-export type BepCompletion = {
-  /**
-   * True once Bazel has flushed the terminal event (`lastMessage`), so every
-   * earlier event — including the .ipa's namedSetOfFiles — is durably on disk.
-   * Gate the digest read on this, NOT on the presence of `buildFinished`:
-   * `buildFinished` is followed by `buildToolLogs` and `buildMetrics`
-   * (the `lastMessage` carrier), so it is not the last line.
-   */
-  complete: boolean;
-  /** Whether the build itself succeeded (overallSuccess / exit code 0). */
-  success: boolean;
-  /** Bazel's invocation UUID — distinguishes one build from the next. */
-  invocationId?: string;
-};
-
-/**
- * Inspects a BEP stream for build completion. The watcher reads the BEP on every
- * change but only acts once `complete` is true (the stream is fully flushed) and
- * `success` is true (the build did not fail). `invocationId` lets the watcher act
- * once per build even when consecutive builds reproduce the same .ipa digest
- * (e.g. a `git stash` revert that rebuilds to an earlier digest).
- */
-export function inspectBuildCompletion(bepJson: string): BepCompletion {
-  let complete = false;
-  let sawFinished = false;
-  let success = false;
-  let invocationId: string | undefined;
-  for (const e of parseEvents(bepJson)) {
-    if (e.started?.uuid) invocationId = e.started.uuid;
-    if (e.id?.buildFinished !== undefined || e.finished !== undefined) {
-      sawFinished = true;
-      // proto3 JSON omits zero-valued scalars, so a SUCCESS exit code serializes
-      // as `{name:"SUCCESS"}` with `code` omitted — checking `code === 0` would be
-      // a dead branch. Trust overallSuccess (present=true on success, omitted on
-      // failure) and fall back to the exit code's symbolic name.
-      success = e.finished?.overallSuccess === true || e.finished?.exitCode?.name === 'SUCCESS';
-    }
-    if (e.lastMessage === true) complete = true;
-  }
-  return {
-    complete,
-    success: sawFinished && success,
-    ...(invocationId !== undefined ? { invocationId } : {}),
-  };
-}
-
-/** Indexes namedSetOfFiles events by id for transitive fileset resolution. */
-function indexNamedSets(events: BepEvent[]): Map<string, NonNullable<BepEvent['namedSetOfFiles']>> {
-  const namedSets = new Map<string, NonNullable<BepEvent['namedSetOfFiles']>>();
-  for (const e of events) {
-    const id = e.id?.namedSet?.id;
-    if (id && e.namedSetOfFiles) namedSets.set(id, e.namedSetOfFiles);
-  }
-  return namedSets;
-}
-
-/**
- * Resolves the top-level `.ipa` CAS digest for one successful target's
- * `completed` event, walking its default output group's filesets transitively.
- * Throws a typed RbeBepError when no .ipa is present, it was materialized
- * locally (`file://`), or it carries a non-SHA256 (e.g. BLAKE3) digest.
- */
-function resolveIpaDigest(
-  label: string,
-  completed: NonNullable<BepEvent['completed']>,
-  namedSets: Map<string, NonNullable<BepEvent['namedSetOfFiles']>>,
-): BepIpaDigest {
-  // Default output group -> the fileSet (namedSetOfFiles) ids holding its outputs.
-  const rootFileSetIds = (completed.outputGroup ?? [])
-    .filter((og) => og.name === 'default' || !og.name)
-    .flatMap((og) => (og.fileSets ?? []).map((fs) => fs.id))
-    .filter((id): id is string => !!id);
-  if (rootFileSetIds.length === 0) {
-    throw new RbeBepError('no-output', `Build of ${label} reported no default output files.`);
-  }
-
-  const seen = new Set<string>();
-  const queue = [...rootFileSetIds];
-  // Set to the name of an .ipa that was seen but had no bytestream digest (its
-  // output was downloaded locally) — distinguishes that case from "no .ipa at all".
-  let localOnlyIpa: string | undefined;
-  while (queue.length > 0) {
-    const id = queue.shift()!;
-    if (seen.has(id)) continue;
-    seen.add(id);
-    const set = namedSets.get(id);
-    if (!set) continue;
-    for (const f of set.files ?? []) {
-      if (!f.name || !f.name.endsWith('.ipa')) continue;
-      const digest = f.uri ? parseBytestreamDigest(f.uri) : null;
-      if (digest) {
-        // The instance cache is keyed by SHA-256. Reject any other digest
-        // function — Bazel 9 defaults to BLAKE3, whose URI carries an explicit
-        // `blake3` function segment (and whose 64-hex hash is indistinguishable
-        // from SHA-256 by length, so the hash form alone can't catch it). Surface
-        // it here with the fix rather than letting it fail later as a cryptic
-        // server cache miss.
-        const isSha256 =
-          digest.digestFunction === undefined ?
-            SHA256_HEX.test(digest.hash)
-          : digest.digestFunction === 'sha256';
-        if (!isSha256) {
-          const got = digest.digestFunction ?? `${digest.hash.length} hex chars`;
-          throw new RbeBepError(
-            'non-sha256',
-            `Built ${f.name} with a non-SHA256 digest (${got}; Bazel 9 defaults to BLAKE3). The instance ` +
-              `cache is keyed by SHA-256 — rebuild with --digest_function=sha256, e.g. ` +
-              `\`bazelisk --digest_function=sha256 build --config=limrun ${label}\`.`,
-          );
-        }
-        return { hash: digest.hash, sizeBytes: digest.sizeBytes, ipaName: f.name };
-      }
-      localOnlyIpa = f.name;
-    }
-    for (const nested of set.fileSets ?? []) {
-      if (nested.id) queue.push(nested.id);
-    }
-  }
-
-  if (localOnlyIpa) {
-    throw new RbeBepError(
-      'local-only',
-      `Found ${label}'s .ipa (${localOnlyIpa}) but it has no remote (bytestream) digest — it was ` +
-        `built locally, not remotely executed. Ensure you built with --config=limrun so the .ipa is ` +
-        `produced in the instance's cache.`,
-    );
-  }
-  throw new RbeBepError('no-ipa', `No .ipa output found for ${label} in the build event log.`);
-}
-
-/**
- * Finds the `.ipa` produced for `label` in a BEP stream and returns its CAS
- * digest. Throws a typed RbeBepError when the target/.ipa is absent, its output
- * was materialized locally (a `file://` URI) instead of left in CAS, or it was
- * built with a non-SHA256 digest the instance cache cannot resolve.
- */
-export function parseTopLevelIpaDigest(bepJson: string, label: string): BepIpaDigest {
-  const canonical = canonicalizeLabel(label);
-  const events = parseEvents(bepJson);
-
-  // The successful TargetComplete for the requested label (matched against the
-  // canonical //pkg:name form Bazel records, so `//App` matches `//App:App`).
-  const completed = events.find((e) => e.id?.targetCompleted?.label === canonical && e.completed?.success)
-    ?.completed;
-  if (!completed) {
-    throw new RbeBepError(
-      'no-build',
-      `No successful build of ${label} found in the build event log. ` +
-        `Build it first with --config=limrun (e.g. \`bazelisk --digest_function=sha256 build --config=limrun ${label}\`).`,
-    );
-  }
-
-  return resolveIpaDigest(label, completed, indexNamedSets(events));
-}