@nurix/nustack 0.10.0-dev.10

package/dist/lib/git-sync/inbound/content_decision.js

@@ -0,0 +1,148 @@
+import { createHash } from "node:crypto";
+import { lstatSync, readFileSync, readlinkSync } from "node:fs";
+import path from "node:path";
+import { runGit } from "../core/git_runner.js";
+function sha256(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+function readHeadState(repo, targetPath) {
+    const result = runGit(repo.repositoryRoot, ["ls-tree", "HEAD", "--", targetPath], {
+        allowFailure: true,
+    });
+    const line = result.stdout.split("\n").find((entry) => entry.trim().length > 0);
+    if (result.exitCode !== 0 || !line)
+        return { absent: true };
+    const [meta] = line.split("\t");
+    const parts = (meta ?? "").split(/\s+/);
+    const mode = parts[0] ?? "";
+    const type = parts[1] ?? "";
+    const blobSha = parts[2] ?? "";
+    if (type !== "blob" || blobSha.length === 0)
+        return { absent: true };
+    const contentResult = runGit(repo.repositoryRoot, ["cat-file", "blob", blobSha], {
+        allowFailure: true,
+    });
+    const contentSha256 = sha256(Buffer.from(contentResult.stdout, "utf8"));
+    return { blobSha, mode, contentSha256 };
+}
+function readIndexEntries(repo, targetPath) {
+    const result = runGit(repo.repositoryRoot, ["ls-files", "--stage", "--", targetPath], {
+        allowFailure: true,
+    });
+    const entries = [];
+    for (const line of result.stdout.split("\n")) {
+        if (line.trim().length === 0)
+            continue;
+        const [meta] = line.split("\t");
+        const parts = (meta ?? "").split(/\s+/);
+        const mode = parts[0] ?? "";
+        const blobSha = parts[1] ?? "";
+        const stage = Number.parseInt(parts[2] ?? "0", 10);
+        if (blobSha.length > 0)
+            entries.push({ mode, blobSha, stage: Number.isFinite(stage) ? stage : 0 });
+    }
+    return entries;
+}
+function readWorkingState(repo, targetPath) {
+    const abs = path.join(repo.repositoryRoot, targetPath);
+    let stat;
+    try {
+        stat = lstatSync(abs);
+    }
+    catch {
+        return { absent: true };
+    }
+    if (stat.isSymbolicLink()) {
+        const link = readlinkSync(abs);
+        return { type: "symlink", contentSha256: sha256(Buffer.from(link, "utf8")) };
+    }
+    if (!stat.isFile())
+        return { absent: true };
+    const bytes = readFileSync(abs);
+    const blobResult = runGit(repo.repositoryRoot, ["hash-object", "--", targetPath], {
+        allowFailure: true,
+    });
+    return { type: "file", blobSha: blobResult.stdout.trim(), contentSha256: sha256(bytes) };
+}
+export function readTargetState(repo, targetPath) {
+    return {
+        path: targetPath,
+        head: readHeadState(repo, targetPath),
+        index: readIndexEntries(repo, targetPath),
+        working: readWorkingState(repo, targetPath),
+    };
+}
+function baseOf(target) {
+    return "sha256" in target.base ? { sha256: target.base.sha256 } : { absent: true };
+}
+function stageZeroBlob(index) {
+    const stageZero = index.filter((entry) => entry.stage === 0);
+    return stageZero.length === 1 ? stageZero[0].blobSha : null;
+}
+export function classifyTarget(state, target) {
+    const { head, working } = state;
+    const base = baseOf(target);
+    const decide = (classification, divergence) => ({ path: target.path, classification, ...(divergence ? { divergence } : {}) });
+    if (state.index.some((entry) => entry.stage !== 0) || state.index.length > 1) {
+        return decide("decision_required", "base_untrusted");
+    }
+    const headBlob = "absent" in head ? null : head.blobSha;
+    const headContentSha256 = "absent" in head ? null : head.contentSha256;
+    if (!("absent" in head) && !("absent" in working) && working.type === "symlink") {
+        return decide("decision_required", "type_changed");
+    }
+    const indexBlob = stageZeroBlob(state.index);
+    const indexClean = headBlob === null ? indexBlob === null : indexBlob === headBlob;
+    if (!indexClean)
+        return decide("decision_required", "staged_differently");
+    if ("absent" in head && !("absent" in working)) {
+        if ("absent" in base &&
+            target.operation === "upsert" &&
+            working.type === "file" &&
+            target.targetSha256 !== null &&
+            working.contentSha256 === target.targetSha256) {
+            return decide("already_equal");
+        }
+        return decide("decision_required", "untracked_at_path");
+    }
+    if (!("absent" in head) && "absent" in working) {
+        if (target.operation === "delete")
+            return decide("already_equal");
+        return decide("decision_required", "deleted_or_renamed");
+    }
+    if (!("absent" in head) && !("absent" in working)) {
+        const workingBlob = working.type === "file" ? working.blobSha : null;
+        if (workingBlob !== headBlob)
+            return decide("decision_required", "dirty");
+    }
+    if (target.operation === "delete") {
+        if ("absent" in head)
+            return decide("already_equal");
+        if ("sha256" in base && headContentSha256 === base.sha256)
+            return decide("automatic");
+        return decide("decision_required", "committed_away_from_base");
+    }
+    if (headContentSha256 !== null && target.targetSha256 !== null && headContentSha256 === target.targetSha256) {
+        return decide("already_equal");
+    }
+    if ("absent" in base) {
+        if ("absent" in head)
+            return decide("automatic");
+        return decide("decision_required", "committed_away_from_base");
+    }
+    if (headContentSha256 !== null && headContentSha256 === base.sha256)
+        return decide("automatic");
+    return decide("decision_required", "committed_away_from_base");
+}
+export function decideHandoffContent(repo, targets) {
+    const decisions = targets.map((target) => classifyTarget(readTargetState(repo, target.path), target));
+    const divergent = decisions
+        .filter((decision) => decision.classification === "decision_required")
+        .map((decision) => ({ path: decision.path, divergence: decision.divergence }));
+    if (divergent.length > 0)
+        return { kind: "decision_required", targets: decisions, divergent };
+    if (decisions.every((decision) => decision.classification === "already_equal")) {
+        return { kind: "no_op", targets: decisions };
+    }
+    return { kind: "automatic", targets: decisions };
+}

package/dist/lib/git-sync/inbound/download.js

@@ -0,0 +1,223 @@
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { readFile } from "node:fs/promises";
+import { cacheDir } from "../../local_store/paths.js";
+import { mkdirSecure, writeFileSecure } from "../../secure_file.js";
+import { normalizeRepositoryPath, safeJoin, findCaseFoldCollisions, findUnicodeCollisions, } from "../core/path_normalizer.js";
+import { fetchHandoffManifest, downloadTargetContent, fetchSyncWhitelist, } from "../../nustack_client.js";
+const SYNC_PROTOCOL_VERSION = "nustack.dev/v2";
+const reject = (code, detail) => ({ ok: false, kind: "rejected", code, detail });
+const technical = (reason) => ({ ok: false, kind: "technical", reason });
+function sha256(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+function sortKeys(value) {
+    if (Array.isArray(value))
+        return value.map(sortKeys);
+    if (value && typeof value === "object") {
+        const source = value;
+        const out = {};
+        for (const key of Object.keys(source).sort())
+            out[key] = sortKeys(source[key]);
+        return out;
+    }
+    return value;
+}
+function recomputeManifestHash(manifest) {
+    const core = {
+        schemaVersion: 1,
+        handoffId: manifest.handoffId,
+        workspaceId: manifest.workspaceId,
+        documentSetVersionId: manifest.documentSetVersionId,
+        toolkit: {
+            name: manifest.toolkit.name,
+            version: manifest.toolkit.version,
+            rendererVersion: manifest.toolkit.rendererVersion,
+        },
+        targets: manifest.targets.map((target) => ({
+            path: target.path,
+            operation: target.operation,
+            targetSha256: target.targetSha256,
+            byteSize: target.byteSize,
+            ...(target.baseAbsent ? { baseAbsent: true } : { baseSha256: target.baseSha256 }),
+        })),
+    };
+    return createHash("sha256").update(JSON.stringify(sortKeys(core))).digest("hex");
+}
+function toolkitTechnicalWait(binding, manifest) {
+    if (!binding.etnaProfileJson)
+        return null;
+    let profile;
+    try {
+        profile = JSON.parse(binding.etnaProfileJson);
+    }
+    catch {
+        return null;
+    }
+    if (profile.rendererVersion && profile.rendererVersion !== manifest.toolkit.rendererVersion)
+        return "renderer_incompatible";
+    if (profile.name && profile.name !== manifest.toolkit.name)
+        return "harness_incompatible";
+    if (profile.version && profile.version !== manifest.toolkit.version)
+        return "harness_incompatible";
+    return null;
+}
+function crossWorkspaceMarker(body, workspaceId) {
+    if (!body.startsWith("---\n"))
+        return false;
+    const secondLineEnd = body.indexOf("\n", 4);
+    const secondLine = secondLineEnd === -1 ? body.slice(4) : body.slice(4, secondLineEnd);
+    if (secondLine.trim() !== "nustack:")
+        return false;
+    const fence = body.indexOf("\n---", 4);
+    const block = body.slice(0, fence === -1 ? body.length : fence);
+    const match = /\n\s*workspace_id:\s*(\S+)/.exec(block);
+    return match !== null && match[1] !== workspaceId;
+}
+function isUnsupportedMedia(bytes) {
+    for (const byte of bytes)
+        if (byte === 0)
+            return true;
+    const text = new TextDecoder("utf-8", { fatal: false }).decode(bytes);
+    const reencoded = new TextEncoder().encode(text);
+    if (reencoded.byteLength !== bytes.byteLength)
+        return true;
+    for (let i = 0; i < bytes.length; i++)
+        if (bytes[i] !== reencoded[i])
+            return true;
+    return false;
+}
+function eligibleEntry(targetPath, whitelist) {
+    for (const entry of whitelist.entries) {
+        if (entry.direction !== "bidirectional" && entry.direction !== "cloud_to_local")
+            continue;
+        if (entry.kind === "exact" ? entry.pattern === targetPath : globMatch(entry.pattern, targetPath)) {
+            return entry;
+        }
+    }
+    return null;
+}
+function globMatch(pattern, target) {
+    return matchSegments(pattern.split("/"), 0, target.split("/"), 0);
+}
+function matchSegments(pattern, pi, target, ti) {
+    if (pi === pattern.length)
+        return ti === target.length;
+    if (pattern[pi] === "**") {
+        for (let k = ti; k <= target.length; k++)
+            if (matchSegments(pattern, pi + 1, target, k))
+                return true;
+        return false;
+    }
+    if (ti === target.length)
+        return false;
+    if (segmentMatch(pattern[pi], target[ti]))
+        return matchSegments(pattern, pi + 1, target, ti + 1);
+    return false;
+}
+function segmentMatch(pattern, segment) {
+    if (!pattern.includes("*"))
+        return pattern === segment;
+    const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*");
+    return new RegExp(`^${escaped}$`).test(segment);
+}
+function blobCachePath(contentSha256) {
+    return path.join(cacheDir(), "blobs", contentSha256);
+}
+function normalizeBase(target) {
+    const hasSha = typeof target.baseSha256 === "string";
+    const hasAbsent = target.baseAbsent === true;
+    if (hasSha === hasAbsent)
+        return null;
+    return hasSha ? { sha256: target.baseSha256 } : { absent: true };
+}
+export async function downloadHandoff(deps, binding, handoffId) {
+    const fetchManifest = deps.fetchManifest ?? fetchHandoffManifest;
+    const downloadContent = deps.downloadContent ?? downloadTargetContent;
+    const fetchWhitelist = deps.fetchWhitelist ?? fetchSyncWhitelist;
+    const manifest = await fetchManifest(deps.baseUrl, deps.accessToken, { handoffId, bindingId: binding.id });
+    if (manifest.workspaceId !== binding.workspaceId)
+        return reject("workspace_mismatch", "manifest Workspace does not match the binding");
+    if (recomputeManifestHash(manifest) !== manifest.manifestSha256) {
+        return reject("manifest_hash", "manifest hash does not verify");
+    }
+    const toolkitWait = toolkitTechnicalWait(binding, manifest);
+    if (toolkitWait)
+        return technical(toolkitWait);
+    let whitelist = deps.cachedWhitelist ?? (await fetchWhitelist(deps.baseUrl, deps.accessToken, binding.id));
+    if (whitelist.protocolVersion !== SYNC_PROTOCOL_VERSION)
+        return technical("protocol_incompatible");
+    const normalizedTargets = [];
+    const seenPaths = new Set();
+    for (const target of manifest.targets) {
+        const normalized = normalizeRepositoryPath(target.path);
+        if (!normalized.ok) {
+            return normalized.code === "protected_path"
+                ? reject("protected_path", `target rejected: ${normalized.code}`)
+                : reject("invalid_path", `target rejected: ${normalized.code}`);
+        }
+        const canonical = normalized.path;
+        if (seenPaths.has(canonical))
+            return reject("operation_not_unique", "two operations target the same path");
+        seenPaths.add(canonical);
+        const base = normalizeBase(target);
+        if (base === null)
+            return reject("base_semantics", "target base is not exactly baseSha256 xor baseAbsent");
+        if (safeJoin(binding.repositoryRoot, canonical).ok === false) {
+            return reject("symlink_escape", "target path escapes the repository root or a symlink");
+        }
+        normalizedTargets.push({
+            path: canonical,
+            operation: target.operation,
+            targetSha256: target.targetSha256,
+            byteSize: target.byteSize,
+            base,
+            contentUrl: target.contentUrl,
+        });
+    }
+    const paths = normalizedTargets.map((target) => target.path);
+    if (findCaseFoldCollisions(paths).length > 0)
+        return reject("case_collision", "targets collide by case fold");
+    if (findUnicodeCollisions(paths).length > 0)
+        return reject("unicode_collision", "targets collide by Unicode normalization");
+    let refetched = false;
+    for (const target of normalizedTargets) {
+        let entry = eligibleEntry(target.path, whitelist);
+        if (!entry && !refetched) {
+            whitelist = await fetchWhitelist(deps.baseUrl, deps.accessToken, binding.id);
+            refetched = true;
+            entry = eligibleEntry(target.path, whitelist);
+        }
+        if (!entry)
+            return technical("whitelist_incompatible");
+        if (target.byteSize > entry.maxBytes)
+            return reject("byte_limit", "target exceeds the whitelist byte limit");
+    }
+    for (const target of normalizedTargets) {
+        if (target.operation === "delete")
+            continue;
+        if (!target.contentUrl || target.targetSha256 === null) {
+            return reject("missing_body", "upsert target has no content URL");
+        }
+        const bytes = await downloadContent(deps.baseUrl, deps.accessToken, target.contentUrl);
+        if (isUnsupportedMedia(bytes))
+            return reject("media_type", "target body is not valid UTF-8 text");
+        if (bytes.byteLength !== target.byteSize)
+            return reject("size_mismatch", "downloaded body size does not match the manifest");
+        const actualSha256 = sha256(bytes);
+        if (actualSha256 !== target.targetSha256)
+            return reject("hash_mismatch", "downloaded body hash does not match the manifest");
+        if (crossWorkspaceMarker(new TextDecoder().decode(bytes), binding.workspaceId)) {
+            return reject("cross_workspace_marker", "target body declares a foreign Workspace id");
+        }
+        const blobPath = blobCachePath(actualSha256);
+        await mkdirSecure(path.dirname(blobPath));
+        await writeFileSecure(blobPath, new TextDecoder().decode(bytes));
+        target.contentSha256 = actualSha256;
+        target.blobPath = blobPath;
+    }
+    return { ok: true, manifest, targets: normalizedTargets, whitelist };
+}
+export async function readCachedBlob(contentSha256) {
+    return readFile(blobCachePath(contentSha256));
+}

package/dist/lib/git-sync/inbound/event_sync.js

@@ -0,0 +1,133 @@
+import { getBindingById, updateBindingCursor } from "../../local_store/bindings.js";
+import { hasCloudOriginForHandoff } from "../../local_store/commit_origins.js";
+import { cacheWorkspaceEvents, listCachedWorkspaceEvents, pruneWorkspaceEvents, } from "../../local_store/workspace_events_cache.js";
+import { getApplication, upsertApplication, transitionApplicationState, listApplicationsForBinding, } from "../../local_store/handoff_applications.js";
+import { fetchBindingEvents, acknowledgeBindingCursor } from "../../nustack_client.js";
+const PENDING_STATES = new Set([
+    "received",
+    "evaluating",
+    "technical_wait",
+    "decision_required",
+    "approved",
+    "applying",
+]);
+const EVENTS_PAGE_LIMIT = 500;
+function supersedeOlderApplications(store, bindingId, newerHandoffId) {
+    const flipped = [];
+    const pending = listApplicationsForBinding(store, bindingId, ["received", "evaluating", "decision_required"]);
+    for (const application of pending) {
+        if (application.handoffId === newerHandoffId)
+            continue;
+        upsertApplication(store, {
+            handoffId: application.handoffId,
+            bindingId,
+            supersededByHandoffId: newerHandoffId,
+        });
+        transitionApplicationState(store, application.handoffId, bindingId, "superseded");
+        flipped.push(application.handoffId);
+    }
+    return flipped;
+}
+function handoffIdOf(event) {
+    return event.type === "version.created" && event.entity.kind === "workspace_document_version" ? event.entity.id : null;
+}
+export async function syncBindingEvents(store, deps, bindingId) {
+    const binding = getBindingById(store, bindingId);
+    if (!binding)
+        throw new Error(`No binding "${bindingId}" on this machine.`);
+    const fetchEvents = deps.fetchEvents ?? fetchBindingEvents;
+    const result = {
+        createdHandoffs: [],
+        supersededHandoffs: [],
+        acknowledgedOwnOrigin: [],
+        highestSequence: binding.lastAppliedWorkspaceSequence,
+    };
+    let after = binding.lastAppliedWorkspaceSequence;
+    for (;;) {
+        const events = await fetchEvents(deps.baseUrl, deps.accessToken, {
+            bindingId,
+            after,
+            limit: EVENTS_PAGE_LIMIT,
+        });
+        if (events.length === 0)
+            break;
+        cacheWorkspaceEvents(store, bindingId, events.map((event) => ({
+            workspaceSequence: event.sequence,
+            eventType: event.type,
+            payloadJson: JSON.stringify({ entity: event.entity, payload: event.payload }),
+        })));
+        const ordered = [...events].sort((a, b) => a.sequence - b.sequence);
+        for (const event of ordered) {
+            const handoffId = handoffIdOf(event);
+            if (handoffId === null)
+                continue;
+            result.supersededHandoffs.push(...supersedeOlderApplications(store, bindingId, handoffId));
+            const existing = getApplication(store, handoffId, bindingId);
+            if (existing)
+                continue;
+            upsertApplication(store, { handoffId, bindingId });
+            if (hasCloudOriginForHandoff(store, handoffId)) {
+                transitionApplicationState(store, handoffId, bindingId, "evaluating");
+                transitionApplicationState(store, handoffId, bindingId, "no_op");
+                result.acknowledgedOwnOrigin.push(handoffId);
+            }
+            else {
+                result.createdHandoffs.push(handoffId);
+            }
+        }
+        const highest = ordered[ordered.length - 1].sequence;
+        result.highestSequence = Math.max(result.highestSequence, highest);
+        after = highest;
+        if (events.length < EVENTS_PAGE_LIMIT)
+            break;
+    }
+    pruneWorkspaceEvents(store, bindingId);
+    return result;
+}
+function cachedHandoffId(eventType, payloadJson) {
+    if (eventType !== "version.created" || !payloadJson)
+        return null;
+    try {
+        const parsed = JSON.parse(payloadJson);
+        return typeof parsed.entity?.id === "string" ? parsed.entity.id : null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function advanceContiguousCursor(store, deps, bindingId) {
+    const binding = getBindingById(store, bindingId);
+    if (!binding)
+        throw new Error(`No binding "${bindingId}" on this machine.`);
+    const acknowledgeCursor = deps.acknowledgeCursor ?? acknowledgeBindingCursor;
+    let cursor = binding.lastAppliedWorkspaceSequence;
+    for (const event of listCachedWorkspaceEvents(store, bindingId)) {
+        if (event.workspaceSequence <= cursor)
+            continue;
+        const handoffId = cachedHandoffId(event.eventType, event.payloadJson);
+        if (handoffId !== null) {
+            const application = getApplication(store, handoffId, bindingId);
+            if (!application || PENDING_STATES.has(application.state))
+                break;
+        }
+        cursor = event.workspaceSequence;
+    }
+    if (cursor > binding.lastAppliedWorkspaceSequence) {
+        updateBindingCursor(store, bindingId, { lastAppliedWorkspaceSequence: cursor });
+        try {
+            await acknowledgeCursor(deps.baseUrl, deps.accessToken, { bindingId, lastAppliedSequence: cursor });
+        }
+        catch {
+        }
+    }
+    return cursor;
+}
+export function pendingApplications(store, bindingId) {
+    return listApplicationsForBinding(store, bindingId, [
+        "received",
+        "evaluating",
+        "technical_wait",
+        "decision_required",
+        "approved",
+    ]);
+}

package/dist/lib/git-sync/inbound/index.js

@@ -0,0 +1,10 @@
+export { runInboundReconciliation, reconcileInboundBinding, createInboundApplier, registerInboundApplier, retryApplication, } from "./applier.js";
+export { approveHandoff, serializeDecisionEvidence, toDownloadBinding, APPROVAL_RECOVERY_NOTE, } from "./approval.js";
+export { undoHandoff } from "./undo.js";
+export { COMMIT_NOTIFICATION_COPY, renderCommitNotification, listUnacknowledgedNotifications, acknowledgeNotification, postResultReport, } from "./notification.js";
+export { syncBindingEvents, advanceContiguousCursor, pendingApplications, } from "./event_sync.js";
+export { downloadHandoff, readCachedBlob, } from "./download.js";
+export { decideHandoffContent, classifyTarget, readTargetState, } from "./content_decision.js";
+export { computeStateFingerprint } from "./state_fingerprint.js";
+export { evaluateRepositoryTechnicalWait, } from "./technical_wait.js";
+export { applyCommit, finalizeCommitted, buildCommitMessage, NUSTACK_SYNC_IDENTITY, } from "./apply_commit.js";

package/dist/lib/git-sync/inbound/notification.js

@@ -0,0 +1,39 @@
+import { listApplicationsForBinding, upsertApplication, } from "../../local_store/handoff_applications.js";
+import { reportApplicationResult } from "../../nustack_client.js";
+export const COMMIT_NOTIFICATION_COPY = "A new NuStack sync change arrived and was committed on your behalf. NuStack did not push it.";
+export function renderCommitNotification(application, changedPaths) {
+    const lines = [COMMIT_NOTIFICATION_COPY];
+    if (application.generatedCommitId)
+        lines.push(`  commit: ${application.generatedCommitId.slice(0, 12)}`);
+    if (changedPaths.length > 0)
+        lines.push(`  changed: ${changedPaths.join(", ")}`);
+    lines.push(`  View: nustack workspace sync pending    Undo: nustack workspace sync undo ${application.handoffId}`);
+    if (application.recoveryBundleId) {
+        lines.push(`  Recovery bundle ${application.recoveryBundleId} holds your pre-approval content until it expires.`);
+    }
+    return lines;
+}
+export function listUnacknowledgedNotifications(store, bindingId) {
+    return listApplicationsForBinding(store, bindingId, ["committed", "reverted", "revert_conflict"]).filter((application) => application.notificationState === "unacknowledged");
+}
+export function acknowledgeNotification(store, handoffId, bindingId) {
+    upsertApplication(store, { handoffId, bindingId, notificationState: "acknowledged" });
+}
+export async function postResultReport(deps, binding, input) {
+    const reportResult = deps.reportResult ?? reportApplicationResult;
+    try {
+        await reportResult(deps.baseUrl, deps.accessToken, {
+            bindingId: binding.id,
+            handoffId: input.handoffId,
+            idempotencyKey: `result:${binding.id}:${input.handoffId}`,
+            commitId: input.commitId,
+            status: input.status,
+            manifestHash: input.manifestHash,
+            affectedPaths: input.affectedPaths,
+        });
+        return { delivered: true };
+    }
+    catch {
+        return { delivered: false };
+    }
+}

package/dist/lib/git-sync/inbound/state_fingerprint.js

@@ -0,0 +1,32 @@
+import { createHash } from "node:crypto";
+import { readHeadCommit } from "../core/repository.js";
+import { readGitOperationState } from "../core/operation_state.js";
+import { readTargetState } from "./content_decision.js";
+function projectTargetState(state) {
+    return {
+        path: state.path,
+        head: "absent" in state.head
+            ? { absent: true }
+            : { blobSha: state.head.blobSha, mode: state.head.mode, contentSha256: state.head.contentSha256 },
+        index: [...state.index]
+            .sort((a, b) => (a.stage === b.stage ? a.blobSha.localeCompare(b.blobSha) : a.stage - b.stage))
+            .map((entry) => ({ mode: entry.mode, blobSha: entry.blobSha, stage: entry.stage })),
+        working: "absent" in state.working
+            ? { absent: true }
+            : state.working.type === "symlink"
+                ? { type: "symlink", contentSha256: state.working.contentSha256 }
+                : { type: "file", blobSha: state.working.blobSha, contentSha256: state.working.contentSha256 },
+    };
+}
+export function computeStateFingerprint(repo, targetPaths, manifestSha256) {
+    const payload = {
+        head: readHeadCommit(repo) ?? null,
+        operationState: readGitOperationState(repo).kind,
+        manifestSha256,
+        targets: [...targetPaths]
+            .sort()
+            .map((targetPath) => projectTargetState(readTargetState(repo, targetPath))),
+    };
+    const hex = createHash("sha256").update(JSON.stringify(payload)).digest("hex");
+    return `sha256:${hex}`;
+}

package/dist/lib/git-sync/inbound/technical_wait.js

@@ -0,0 +1,39 @@
+import { readSymbolicBranch } from "../core/repository.js";
+import { readGitOperationState } from "../core/operation_state.js";
+function operationReason(kind) {
+    switch (kind) {
+        case "merge":
+            return "merge_in_progress";
+        case "rebase":
+            return "rebase_in_progress";
+        case "cherry_pick":
+            return "cherry_pick_in_progress";
+        case "revert":
+            return "revert_in_progress";
+        case "bisect":
+            return "bisect_in_progress";
+        case "index_locked":
+            return "index_locked";
+        case "normal":
+            return null;
+    }
+}
+export function evaluateRepositoryTechnicalWait(repo, boundBranch) {
+    let operationKind;
+    let branch;
+    try {
+        operationKind = readGitOperationState(repo).kind;
+        branch = readSymbolicBranch(repo);
+    }
+    catch {
+        return { wait: true, reason: "repository_integrity" };
+    }
+    const opReason = operationReason(operationKind);
+    if (opReason)
+        return { wait: true, reason: opReason };
+    if (branch === null)
+        return { wait: true, reason: "detached_head" };
+    if (branch !== boundBranch)
+        return { wait: true, reason: "other_branch_checked_out" };
+    return { wait: false };
+}