@outerlayer/cli 0.2.0 → 0.4.0

package/dist/chunk-5Y3QQRUH.js

@@ -0,0 +1,300 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { parseSize, MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-F6GFZXZ3.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-AUFG23AA.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
+import { hostname } from 'os';
+import { join } from 'path';
+
+createRequire(import.meta.url);
+var BUILTIN_CONTAINER = "builtin:container";
+var BUILTIN_PROCESS = "builtin:process";
+var BUILTIN_VM = "builtin:vm";
+function isBuiltinContainer(hook) {
+  return hook === BUILTIN_CONTAINER;
+}
+function isBuiltinProcess(hook) {
+  return hook === BUILTIN_PROCESS;
+}
+function isBuiltinVm(hook) {
+  return hook === BUILTIN_VM;
+}
+function builtinKind(hook) {
+  return isBuiltinContainer(hook) ? "container" : isBuiltinProcess(hook) ? "process" : isBuiltinVm(hook) ? "vm" : "own";
+}
+var RUNNER_QUEUES = ["implement", "amend"];
+var RunnerConfigError = class extends Error {
+};
+var DEFAULT_CONCURRENCY = 1;
+var DEFAULT_POLL_SECONDS = 60;
+var DEFAULT_TIME_LIMIT_MINUTES = 480;
+var DEFAULT_IDLE_LIMIT_MINUTES = 30;
+var DEFAULT_BUILD = { memory: "8g", cpus: 4, pids: 4096, disk: "40g", variables: [] };
+var BUILD_KEYS = ["memory", "cpus", "pids", "disk", "variables", "destinations", "allowHosts"];
+var VARIABLE_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,254}$/;
+var MAX_VARIABLES = 100;
+function defaultRunnerConfigPath(home = homeFromEnv()) {
+  return join(home, ".outerlayer", "config.json");
+}
+function fail(configPath, key, reason) {
+  throw new RunnerConfigError(`${configPath}: ${key} ${reason}`);
+}
+function readConfigFile(configPath) {
+  if (!existsSync(configPath)) return {};
+  const text = readFileSync(configPath, "utf8");
+  try {
+    return JSON.parse(text);
+  } catch (err) {
+    throw new RunnerConfigError(
+      `${configPath}: is not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+function hasRunnerBlock(configPath) {
+  try {
+    const runner = readConfigFile(configPath).runner;
+    return typeof runner === "object" && runner !== null;
+  } catch {
+    return false;
+  }
+}
+function runnerVmOf(configPath) {
+  try {
+    const vm = readConfigFile(configPath).runnerVm;
+    return typeof vm?.instance === "string" && typeof vm.since === "string" ? { instance: vm.instance, since: vm.since } : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var RUNNER_KEYS = [
+  "host",
+  "queues",
+  "concurrency",
+  "pollSeconds",
+  "timeLimitMinutes",
+  "idleLimitMinutes",
+  "commands",
+  "hooks",
+  "build",
+  "autoUpdate"
+];
+function runnerNumbers() {
+  return [
+    { key: "concurrency", min: 1 },
+    // Below five seconds a runner is asking the gateway a question it has
+    // just been answered. Above one day the gateway refuses every heartbeat
+    // this runner sends (`POST /v1/hosts/heartbeat` caps `pollSeconds` at
+    // 86400), so the host would poll and never appear in `GET /v1/hosts`.
+    { key: "pollSeconds", min: 5, max: 86400 },
+    // A build's item key expires 24 hours after its lease was created, and
+    // the time limit is counted from job start, after the claim and the
+    // provision hook. The runner still syncs and releases once the limit
+    // fires, so the ceiling leaves two hours of the key's life for the
+    // provision hook, the final sync and the release.
+    { key: "timeLimitMinutes", min: 1, max: 1320 },
+    { key: "idleLimitMinutes", min: 1 }
+  ];
+}
+function nearestKey(unknown, accepted) {
+  const lower = unknown.toLowerCase();
+  let best;
+  for (const key of accepted) {
+    const distance = editDistance(lower, key.toLowerCase());
+    if (distance <= Math.max(1, Math.floor(key.length / 4)) && (!best || distance < best.distance)) {
+      best = { key, distance };
+    }
+  }
+  return best?.key;
+}
+function editDistance(a, b) {
+  const rows = Array.from({ length: a.length + 1 }, (_unused, i) => [i, ...Array(b.length).fill(0)]);
+  for (let j = 0; j <= b.length; j++) rows[0][j] = j;
+  for (let i = 1; i <= a.length; i++) {
+    for (let j = 1; j <= b.length; j++) {
+      rows[i][j] = Math.min(
+        rows[i - 1][j] + 1,
+        rows[i][j - 1] + 1,
+        rows[i - 1][j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1)
+      );
+    }
+  }
+  return rows[a.length][b.length];
+}
+function checkHooks(config, env = process.env) {
+  const named = [
+    ["runner.hooks.provision", config.hooks.provision],
+    ["runner.hooks.cleanup", config.hooks.cleanup],
+    ["runner.hooks.report", config.hooks.report]
+  ];
+  for (const [key, path] of named) {
+    if (path === void 0) continue;
+    if (isBuiltinContainer(path) || isBuiltinProcess(path) || isBuiltinVm(path)) continue;
+    if (path.includes("$") || path.startsWith("~")) {
+      return `${key}: ${path} \u2014 hooks are executable paths, not shell lines; $HOME and ~ are not expanded`;
+    }
+    if (!existsSync(path)) return `${key}: ${path} does not exist`;
+    if (!statSync(path).isFile()) return `${key}: ${path} is not a file`;
+    try {
+      accessSync(path, constants.X_OK);
+    } catch {
+      return `${key}: ${path} is not executable`;
+    }
+  }
+  return checkDestinationVariables(config, env);
+}
+function checkDestinationVariables(config, env) {
+  const destinations = config.build?.destinations ?? [];
+  for (const [index, destination] of destinations.entries()) {
+    for (const name of destination.header.variables) {
+      if (env[name] === void 0 || env[name] === "") {
+        return `runner.build.destinations[${index}].header: ${name} is not set in the runner's environment`;
+      }
+    }
+  }
+  return void 0;
+}
+function loadRunnerConfig(configPath) {
+  const config = readConfigFile(configPath);
+  if (!config.url || !config.apiKey || !config.appId) {
+    fail(configPath, "url/apiKey/appId", "missing \u2014 pipe a factory key into `outerlayer login` for this config file first; a runner uses a factory key, never a person's login");
+  }
+  const runner = config.runner;
+  if (!runner) {
+    fail(configPath, "runner", "block is missing");
+  }
+  for (const key of Object.keys(runner)) {
+    if (RUNNER_KEYS.includes(key)) continue;
+    const near = nearestKey(key, RUNNER_KEYS);
+    fail(configPath, `runner.${key}`, near ? `is not a key this block accepts; did you mean ${near}?` : "is not a key this block accepts");
+  }
+  for (const { key, min, max = Number.POSITIVE_INFINITY } of runnerNumbers()) {
+    const value = runner[key];
+    if (value === void 0) continue;
+    if (typeof value !== "number" || !Number.isInteger(value) || value < min) {
+      fail(configPath, `runner.${key}`, `must be a whole number of at least ${min}`);
+    }
+    if (value > max) {
+      fail(configPath, `runner.${key}`, `must be at most ${max}`);
+    }
+  }
+  if (runner.autoUpdate !== void 0 && typeof runner.autoUpdate !== "boolean") {
+    fail(configPath, "runner.autoUpdate", "must be true or false");
+  }
+  const queues = runner.queues && runner.queues.length > 0 ? runner.queues : [...RUNNER_QUEUES];
+  for (const queue of queues) {
+    if (!RUNNER_QUEUES.includes(queue)) {
+      fail(configPath, "runner.queues", `names an unknown queue "${queue}" \u2014 must be implement or amend`);
+    }
+    if (!runner.commands?.[queue]) {
+      fail(configPath, `runner.commands.${queue}`, "is required for an enabled queue");
+    }
+  }
+  if (!runner.hooks?.provision) fail(configPath, "runner.hooks.provision", "is required");
+  if (!runner.hooks?.cleanup) fail(configPath, "runner.hooks.cleanup", "is required");
+  checkBuiltinHooks(configPath, runner.hooks);
+  const build = resolveBuild(configPath, runner.build);
+  if (config.scrub?.literals !== void 0 && !Array.isArray(config.scrub.literals)) {
+    fail(configPath, "scrub.literals", "must be a list of strings");
+  }
+  if (config.scrub?.patterns !== void 0 && !Array.isArray(config.scrub.patterns)) {
+    fail(configPath, "scrub.patterns", "must be a list of {label, pattern} entries");
+  }
+  return {
+    configPath,
+    url: config.url,
+    apiKey: config.apiKey,
+    appId: config.appId,
+    repos: config.repos,
+    scrub: config.scrub,
+    host: runner.host ?? hostname(),
+    queues,
+    concurrency: runner.concurrency ?? DEFAULT_CONCURRENCY,
+    pollSeconds: runner.pollSeconds ?? DEFAULT_POLL_SECONDS,
+    timeLimitMinutes: runner.timeLimitMinutes ?? DEFAULT_TIME_LIMIT_MINUTES,
+    idleLimitMinutes: runner.idleLimitMinutes ?? DEFAULT_IDLE_LIMIT_MINUTES,
+    commands: runner.commands ?? {},
+    hooks: {
+      provision: runner.hooks.provision,
+      cleanup: runner.hooks.cleanup,
+      report: runner.hooks.report
+    },
+    build,
+    // A host with executables of its own for provision and cleanup chose
+    // its own environment, and an update could change what its hooks run
+    // under; it opts in. The built-in hooks are the runner's own. Provision
+    // and cleanup are built-in together or not at all (checkBuiltinHooks), so
+    // provision alone tells which.
+    autoUpdate: runner.autoUpdate ?? builtinKind(runner.hooks.provision) !== "own"
+  };
+}
+function checkBuiltinHooks(configPath, hooks) {
+  for (const key of ["provision", "cleanup", "report"]) {
+    const value = hooks[key];
+    if (value === void 0 || !value.startsWith("builtin:")) continue;
+    if (key === "report") fail(configPath, "runner.hooks.report", `cannot be ${value}: the report hook stays an executable`);
+    if (!isBuiltinContainer(value) && !isBuiltinProcess(value) && !isBuiltinVm(value)) {
+      fail(configPath, `runner.hooks.${key}`, `names an unknown built-in hook "${value}"; the ones that exist are ${BUILTIN_CONTAINER}, ${BUILTIN_PROCESS} and ${BUILTIN_VM}`);
+    }
+  }
+  const provision = hooks.provision;
+  const cleanup = hooks.cleanup;
+  if (isBuiltinContainer(provision) !== isBuiltinContainer(cleanup) || isBuiltinProcess(provision) !== isBuiltinProcess(cleanup) || isBuiltinVm(provision) !== isBuiltinVm(cleanup)) {
+    fail(configPath, "runner.hooks", `provision and cleanup must both be ${BUILTIN_CONTAINER}, both be ${BUILTIN_PROCESS}, both be ${BUILTIN_VM}, or neither`);
+  }
+}
+function resolveBuild(configPath, block) {
+  if (block === void 0) return { ...DEFAULT_BUILD, variables: [] };
+  if (typeof block !== "object" || block === null || Array.isArray(block)) fail(configPath, "runner.build", "must be an object");
+  const given = block;
+  for (const key of Object.keys(given)) {
+    if (BUILD_KEYS.includes(key)) continue;
+    const near = nearestKey(key, BUILD_KEYS);
+    fail(configPath, `runner.build.${key}`, near ? `is not a key this block accepts; did you mean ${near}?` : "is not a key this block accepts");
+  }
+  for (const key of ["memory", "disk"]) {
+    const value = given[key];
+    if (value === void 0) continue;
+    if (typeof value !== "string" || parseSize(value) === void 0) fail(configPath, `runner.build.${key}`, 'must be a size such as "8g" or "512m"');
+  }
+  if (given.cpus !== void 0 && (typeof given.cpus !== "number" || !Number.isFinite(given.cpus) || given.cpus <= 0)) {
+    fail(configPath, "runner.build.cpus", "must be a number above 0");
+  }
+  if (given.pids !== void 0 && (typeof given.pids !== "number" || !Number.isInteger(given.pids) || given.pids < 1)) {
+    fail(configPath, "runner.build.pids", "must be a whole number of at least 1");
+  }
+  const variables = [];
+  if (given.variables !== void 0) {
+    if (!Array.isArray(given.variables)) fail(configPath, "runner.build.variables", "must be a list of variable names");
+    if (given.variables.length > MAX_VARIABLES) fail(configPath, "runner.build.variables", `names ${given.variables.length} variables; a release records at most ${MAX_VARIABLES}`);
+    for (const name of given.variables) {
+      if (typeof name !== "string" || !VARIABLE_NAME.test(name)) fail(configPath, "runner.build.variables", `names ${JSON.stringify(name)}, which is not a variable name`);
+      if (isRefusedInConfig(name)) fail(configPath, "runner.build.variables", `names ${name}, which the runner sets itself`);
+      if (!variables.includes(name)) variables.push(name);
+    }
+  }
+  const destinations = given.destinations === void 0 ? [] : resolveDestinations(given.destinations, variables, isReservedVariable, (key, reason) => fail(configPath, key, reason));
+  let allowHosts;
+  if (given.allowHosts !== void 0) {
+    if (!Array.isArray(given.allowHosts)) fail(configPath, "runner.build.allowHosts", "must be a list of host names");
+    if (given.allowHosts.length > MAX_ALLOW_HOSTS) fail(configPath, "runner.build.allowHosts", `names ${given.allowHosts.length} hosts; at most ${MAX_ALLOW_HOSTS}`);
+    allowHosts = [];
+    for (const entry of given.allowHosts) {
+      const problem = allowHostProblem(entry);
+      if (problem !== void 0) fail(configPath, "runner.build.allowHosts", `names ${JSON.stringify(entry)}, which ${problem}`);
+      const host = entry.toLowerCase();
+      if (!allowHosts.includes(host)) allowHosts.push(host);
+    }
+  }
+  return {
+    memory: given.memory ?? DEFAULT_BUILD.memory,
+    cpus: given.cpus ?? DEFAULT_BUILD.cpus,
+    pids: given.pids ?? DEFAULT_BUILD.pids,
+    disk: given.disk ?? DEFAULT_BUILD.disk,
+    variables,
+    ...destinations.length === 0 ? {} : { destinations },
+    ...allowHosts === void 0 ? {} : { allowHosts }
+  };
+}
+
+export { RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, runnerVmOf };

package/dist/chunk-6Y63SXFO.js

@@ -0,0 +1,383 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-G7FSV7JX.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { mkdirSync, appendFileSync, writeFileSync, renameSync, existsSync, unlinkSync, readdirSync, readFileSync } from 'fs';
+import { join, dirname } from 'path';
+
+createRequire(import.meta.url);
+function artifactsSpoolPath(home = homeFromEnv()) {
+  return join(home, ".outerlayer", "spool", "artifacts.jsonl");
+}
+function artifactBlobsDir(home = homeFromEnv()) {
+  return join(home, ".outerlayer", "spool", "artifact-blobs");
+}
+function artifactsStatePath(home = homeFromEnv()) {
+  return join(home, ".outerlayer", "spool", "artifacts.state.json");
+}
+var ARTIFACT_RETRY_MAX_AGE_MS = 14 * 24 * 60 * 60 * 1e3;
+function appendArtifactRecord(record, home = homeFromEnv()) {
+  const path = artifactsSpoolPath(home);
+  mkdirSync(dirname(path), { recursive: true });
+  appendFileSync(path, JSON.stringify(record) + "\n");
+}
+function appendArtifactTombstone(artifactId, home = homeFromEnv(), now = () => /* @__PURE__ */ new Date()) {
+  const path = artifactsSpoolPath(home);
+  mkdirSync(dirname(path), { recursive: true });
+  const record = { rec: "artifact-tombstone", artifactId, t: now().toISOString() };
+  appendFileSync(path, JSON.stringify(record) + "\n");
+}
+function walkArtifactSpoolLines(home, visit) {
+  let buf;
+  try {
+    buf = readFileSync(artifactsSpoolPath(home));
+  } catch {
+    return;
+  }
+  let pos = 0;
+  while (pos < buf.length) {
+    const nl = buf.indexOf(10, pos);
+    const textEnd = nl === -1 ? buf.length : nl;
+    const text = buf.subarray(pos, textEnd).toString("utf8").trim();
+    if (text) visit(text, pos);
+    if (nl === -1) break;
+    pos = nl + 1;
+  }
+}
+function isArtifactTombstoned(artifactId, home = homeFromEnv()) {
+  let found = false;
+  walkArtifactSpoolLines(home, (text) => {
+    if (found) return;
+    try {
+      const parsed = ArtifactTombstoneRecordSchema.safeParse(JSON.parse(text));
+      if (parsed.success && parsed.data.artifactId === artifactId) found = true;
+    } catch {
+    }
+  });
+  return found;
+}
+var KNOWN_SPOOL_RECORD_TYPES = /* @__PURE__ */ new Set(["artifact", "artifact-tombstone"]);
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+var MAX_DISPLAYED_REC_TYPE_LENGTH = 100;
+var CONTROL_CHAR_PATTERN = new RegExp(
+  `[${String.fromCharCode(0)}-${String.fromCharCode(31)}${String.fromCharCode(127)}-${String.fromCharCode(159)}]`,
+  "g"
+);
+function sanitizeTerminal(text) {
+  return text.replace(CONTROL_CHAR_PATTERN, "");
+}
+function sanitizeRecType(rec) {
+  const stripped = sanitizeTerminal(rec);
+  return stripped.length > MAX_DISPLAYED_REC_TYPE_LENGTH ? `${stripped.slice(0, MAX_DISPLAYED_REC_TYPE_LENGTH)}\u2026` : stripped;
+}
+function readUnknownRecordEnvelope(json) {
+  if (typeof json !== "object" || json === null) return void 0;
+  const rec = json.rec;
+  const t = json.t;
+  if (typeof rec !== "string" || typeof t !== "string") return void 0;
+  const shaRaw = json.sha256;
+  const sha256 = typeof shaRaw === "string" && SHA256_HEX.test(shaRaw) ? shaRaw : void 0;
+  return { rec, t, sha256 };
+}
+function classifySpoolLine(text) {
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    return { kind: "skipped", reason: "not valid JSON" };
+  }
+  const tombstone = ArtifactTombstoneRecordSchema.safeParse(json);
+  if (tombstone.success) return { kind: "tombstone", artifactId: tombstone.data.artifactId };
+  const parsed = ArtifactSpoolRecordSchema.safeParse(json);
+  if (parsed.success) return { kind: "record", record: parsed.data };
+  const envelope = readUnknownRecordEnvelope(json);
+  if (envelope !== void 0 && !KNOWN_SPOOL_RECORD_TYPES.has(envelope.rec)) {
+    const sanitizedRecType = sanitizeRecType(envelope.rec);
+    const recType = sanitizedRecType === "" ? "(empty)" : `"${sanitizedRecType}"`;
+    return {
+      kind: "held",
+      reason: `unrecognized record type ${recType} \u2014 this build's schemas do not recognize it`,
+      ...envelope.sha256 !== void 0 ? { sha256: envelope.sha256 } : {}
+    };
+  }
+  const issue = parsed.error.issues[0];
+  const issueDetail = issue ? ` (${issue.path.length > 0 ? `${issue.path.join(".")}: ` : ""}${sanitizeTerminal(issue.message)})` : "";
+  return { kind: "skipped", reason: `does not match the artifact spool record shape${issueDetail}` };
+}
+function legacySidecarPaths(home) {
+  const dir = join(home, ".outerlayer", "spool");
+  return [
+    join(dir, "artifacts.watermark"),
+    join(dir, "artifacts.uploaded.json"),
+    join(dir, "artifacts.dropped.json"),
+    join(dir, "artifacts.held-offsets.json"),
+    join(dir, "artifacts.pending-first-seen.json")
+  ];
+}
+function readLegacySidecars(home) {
+  const dir = join(home, ".outerlayer", "spool");
+  let watermark = 0;
+  try {
+    const n = parseInt(readFileSync(join(dir, "artifacts.watermark"), "utf8").trim(), 10);
+    if (Number.isFinite(n) && n >= 0) watermark = n;
+  } catch {
+  }
+  const readIdSet = (name) => {
+    try {
+      const raw = JSON.parse(readFileSync(join(dir, name), "utf8"));
+      return new Set(Array.isArray(raw) ? raw.filter((v) => typeof v === "string") : []);
+    } catch {
+      return /* @__PURE__ */ new Set();
+    }
+  };
+  let pendingFirstSeen = {};
+  try {
+    const raw = JSON.parse(readFileSync(join(dir, "artifacts.pending-first-seen.json"), "utf8"));
+    if (raw !== null && typeof raw === "object" && !Array.isArray(raw)) {
+      const out = {};
+      for (const [key, value] of Object.entries(raw)) {
+        if (typeof value === "string") out[key] = value;
+      }
+      pendingFirstSeen = out;
+    }
+  } catch {
+  }
+  return {
+    watermark,
+    uploadedIds: readIdSet("artifacts.uploaded.json"),
+    droppedIds: readIdSet("artifacts.dropped.json"),
+    pendingFirstSeen
+  };
+}
+function computeMigratedState(home) {
+  const legacy = readLegacySidecars(home);
+  const state = /* @__PURE__ */ new Map();
+  const tombstoned = /* @__PURE__ */ new Set();
+  const rawRecords = [];
+  walkArtifactSpoolLines(home, (text, offset) => {
+    const classified = classifySpoolLine(text);
+    if (classified.kind === "tombstone") {
+      tombstoned.add(classified.artifactId);
+    } else if (classified.kind === "record") {
+      rawRecords.push({
+        artifactId: classified.record.artifactId,
+        offset,
+        sha256: classified.record.sha256,
+        t: classified.record.t
+      });
+    }
+  });
+  const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+  for (const { artifactId, offset, sha256, t } of rawRecords) {
+    if (offset >= legacy.watermark) continue;
+    if (legacy.uploadedIds.has(artifactId)) {
+      state.set(artifactId, { state: "uploaded", attempts: 1, firstSeen: t || nowIso, sha256, reachedServer: true });
+      continue;
+    }
+    if (legacy.droppedIds.has(artifactId)) {
+      state.set(artifactId, {
+        state: "dropped",
+        attempts: 1,
+        firstSeen: legacy.pendingFirstSeen[artifactId] ?? t ?? nowIso,
+        sha256,
+        reachedServer: false
+      });
+      continue;
+    }
+    if (tombstoned.has(artifactId)) continue;
+    state.set(artifactId, { state: "dropped", attempts: 1, firstSeen: t || nowIso, sha256, reachedServer: true });
+  }
+  return state;
+}
+function readPersistedArtifactSpoolState(home) {
+  let raw;
+  try {
+    raw = readFileSync(artifactsStatePath(home), "utf8");
+  } catch {
+    return { state: /* @__PURE__ */ new Map(), corrupt: false };
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    const records = parsed !== null && typeof parsed === "object" && Array.isArray(parsed.records) ? parsed.records : void 0;
+    if (records === void 0) return { state: /* @__PURE__ */ new Map(), corrupt: true };
+    const state = /* @__PURE__ */ new Map();
+    for (const entry of records) {
+      if (entry === null || typeof entry !== "object") continue;
+      const e = entry;
+      if (typeof e.artifactId !== "string") continue;
+      if (e.state !== "pending" && e.state !== "uploaded" && e.state !== "held" && e.state !== "dropped") continue;
+      state.set(e.artifactId, {
+        state: e.state,
+        attempts: typeof e.attempts === "number" && Number.isFinite(e.attempts) ? e.attempts : 0,
+        firstSeen: typeof e.firstSeen === "string" ? e.firstSeen : (/* @__PURE__ */ new Date(0)).toISOString(),
+        sha256: typeof e.sha256 === "string" ? e.sha256 : "",
+        reachedServer: e.reachedServer === true
+      });
+    }
+    return { state, corrupt: false };
+  } catch {
+    return { state: /* @__PURE__ */ new Map(), corrupt: true };
+  }
+}
+var ARTIFACT_STATE_RESOLVED_CAP = 5e3;
+function writeArtifactSpoolState(state, home = homeFromEnv()) {
+  try {
+    const path = artifactsStatePath(home);
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.tmp`;
+    const pending = [];
+    const resolved = [];
+    for (const pair of state.entries()) {
+      (pair[1].state === "uploaded" || pair[1].state === "dropped" ? resolved : pending).push(pair);
+    }
+    const cappedResolved = resolved.length > ARTIFACT_STATE_RESOLVED_CAP ? resolved.slice(-ARTIFACT_STATE_RESOLVED_CAP) : resolved;
+    const records = [...pending, ...cappedResolved].map(([artifactId, entry]) => ({ artifactId, ...entry }));
+    writeFileSync(tmp, JSON.stringify({ version: 1, records }));
+    renameSync(tmp, path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function migrateLegacyArtifactSidecars(home = homeFromEnv()) {
+  if (existsSync(artifactsStatePath(home))) return;
+  const paths = legacySidecarPaths(home);
+  if (!paths.some((p) => existsSync(p))) return;
+  writeArtifactSpoolState(computeMigratedState(home), home);
+  for (const p of paths) {
+    try {
+      unlinkSync(p);
+    } catch {
+    }
+  }
+}
+function readEffectiveArtifactSpoolState(home = homeFromEnv()) {
+  const { state: persisted, corrupt } = existsSync(artifactsStatePath(home)) ? readPersistedArtifactSpoolState(home) : { state: computeMigratedState(home), corrupt: false };
+  const state = new Map(persisted);
+  const tombstonedIds = /* @__PURE__ */ new Set();
+  walkArtifactSpoolLines(home, (text) => {
+    const classified = classifySpoolLine(text);
+    if (classified.kind === "tombstone") tombstonedIds.add(classified.artifactId);
+  });
+  if (tombstonedIds.size > 0) {
+    walkArtifactSpoolLines(home, (text) => {
+      const classified = classifySpoolLine(text);
+      if (classified.kind !== "record") return;
+      const { record } = classified;
+      if (!tombstonedIds.has(record.artifactId)) return;
+      const existing = state.get(record.artifactId);
+      if (existing === void 0 || existing.state === "held" || existing.state === "pending") {
+        state.set(record.artifactId, {
+          state: "dropped",
+          attempts: existing?.attempts ?? 0,
+          firstSeen: existing?.firstSeen ?? record.t,
+          sha256: record.sha256,
+          reachedServer: false
+        });
+      }
+    });
+  }
+  return { state, corrupt };
+}
+function planArtifactUpload(opts = {}) {
+  const home = opts.home ?? homeFromEnv();
+  const { state: effective, corrupt } = readEffectiveArtifactSpoolState(home);
+  const state = new Map(effective);
+  const candidates = [];
+  const skipped = [];
+  const held = [];
+  const tombstonedIds = /* @__PURE__ */ new Set();
+  walkArtifactSpoolLines(home, (text) => {
+    const classified = classifySpoolLine(text);
+    if (classified.kind === "tombstone") tombstonedIds.add(classified.artifactId);
+  });
+  walkArtifactSpoolLines(home, (text, offset) => {
+    const classified = classifySpoolLine(text);
+    if (classified.kind === "tombstone") return;
+    if (classified.kind === "skipped") {
+      skipped.push({ offset, reason: classified.reason });
+      return;
+    }
+    if (classified.kind === "held") {
+      held.push({ offset, reason: classified.reason, ...classified.sha256 !== void 0 ? { sha256: classified.sha256 } : {} });
+      return;
+    }
+    const { record } = classified;
+    if (tombstonedIds.has(record.artifactId)) return;
+    const existing = state.get(record.artifactId);
+    if (existing === void 0 || existing.state === "held" || existing.state === "pending") {
+      candidates.push({ record });
+    }
+  });
+  return { candidates, state, skipped, held, corrupt };
+}
+function neededArtifactShas(home, finalState) {
+  const needed = /* @__PURE__ */ new Set();
+  walkArtifactSpoolLines(home, (text) => {
+    const classified = classifySpoolLine(text);
+    if (classified.kind === "held") {
+      if (classified.sha256 !== void 0) needed.add(classified.sha256);
+      return;
+    }
+    if (classified.kind !== "record") return;
+    const entry = finalState.get(classified.record.artifactId);
+    if (entry === void 0 || entry.state === "held" || entry.state === "pending") needed.add(classified.record.sha256);
+  });
+  return needed;
+}
+function reclaimUnneededArtifactBlobs(home, neededShas) {
+  let names;
+  try {
+    names = readdirSync(artifactBlobsDir(home));
+  } catch {
+    return 0;
+  }
+  let reclaimed = 0;
+  for (const name of names) {
+    if (!SHA256_HEX.test(name) || neededShas.has(name)) continue;
+    try {
+      unlinkSync(join(artifactBlobsDir(home), name));
+      reclaimed += 1;
+    } catch {
+    }
+  }
+  return reclaimed;
+}
+function localArtifactIds(home = homeFromEnv()) {
+  const ids = /* @__PURE__ */ new Set();
+  walkArtifactSpoolLines(home, (text) => {
+    const classified = classifySpoolLine(text);
+    if (classified.kind === "record") ids.add(classified.record.artifactId);
+  });
+  return ids;
+}
+function findPendingArtifactRecord(artifactId, home = homeFromEnv()) {
+  let found;
+  walkArtifactSpoolLines(home, (text) => {
+    if (found !== void 0) return;
+    const classified = classifySpoolLine(text);
+    if (classified.kind === "record" && classified.record.artifactId === artifactId) found = classified.record;
+  });
+  if (found === void 0) return void 0;
+  const { state } = readEffectiveArtifactSpoolState(home);
+  const entry = state.get(artifactId);
+  if (entry !== void 0 && entry.state !== "held" && entry.state !== "pending") return void 0;
+  return { record: found };
+}
+function resolveArtifactTurnIndex(turns, filename) {
+  let found;
+  for (const turn of turns) {
+    for (const call of turn.toolCalls ?? []) {
+      const haystack = [
+        call.name,
+        typeof call.input === "string" ? call.input : call.input === void 0 ? "" : JSON.stringify(call.input),
+        typeof call.output === "string" ? call.output : call.output === void 0 ? "" : JSON.stringify(call.output),
+        call.file ?? ""
+      ].join("\n");
+      if (haystack.includes("emit artifact") && haystack.includes(filename)) found = turn.index;
+    }
+  }
+  return found;
+}
+
+export { ARTIFACT_RETRY_MAX_AGE_MS, appendArtifactRecord, appendArtifactTombstone, artifactBlobsDir, artifactsSpoolPath, artifactsStatePath, findPendingArtifactRecord, isArtifactTombstoned, localArtifactIds, migrateLegacyArtifactSidecars, neededArtifactShas, planArtifactUpload, readEffectiveArtifactSpoolState, reclaimUnneededArtifactBlobs, resolveArtifactTurnIndex, sanitizeTerminal, writeArtifactSpoolState };