@ricsam/r5d-worker 0.0.137 → 0.0.139

package/dist/cjs/recovery-output-window.cjs

@@ -1,77 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var recovery_output_window_exports = {};
-__export(recovery_output_window_exports, {
-  WorkerOutputWindow: () => WorkerOutputWindow
-});
-module.exports = __toCommonJS(recovery_output_window_exports);
-const keyOf = (runId, stream) => `${runId}:${stream}`;
-class WorkerOutputWindow {
-  constructor(windowBytes = 1024 * 1024) {
-    this.windowBytes = windowBytes;
-  }
-  windowBytes;
-  sent = /* @__PURE__ */ new Map();
-  acknowledged = /* @__PURE__ */ new Map();
-  outstanding = 0;
-  reset(cursors) {
-    this.sent.clear();
-    this.acknowledged.clear();
-    this.outstanding = 0;
-    for (const cursor of cursors) {
-      for (const stream of ["stdout", "stderr"]) {
-        const offset = stream === "stdout" ? cursor.stdoutBytes : cursor.stderrBytes;
-        this.sent.set(keyOf(cursor.runId, stream), offset);
-        this.acknowledged.set(keyOf(cursor.runId, stream), offset);
-      }
-    }
-  }
-  send(frame, send, bufferedAmount = 0) {
-    const key = keyOf(frame.runId, frame.stream);
-    const sent = this.sent.get(key) ?? 0;
-    const bytes = Buffer.from(frame.data, "utf8");
-    const end = frame.offset + bytes.length;
-    if (end <= sent) return true;
-    if (frame.offset > sent) return false;
-    let cursor = sent;
-    while (cursor < end) {
-      let count = Math.min(end - cursor, 64 * 1024, this.windowBytes - this.outstanding);
-      while (count > 0 && ((bytes[cursor - frame.offset + count] ?? 0) & 192) === 128) count -= 1;
-      if (count <= 0 || bufferedAmount >= this.windowBytes) return false;
-      const data = bytes.subarray(cursor - frame.offset, cursor - frame.offset + count).toString("utf8");
-      if (!send({ ...frame, offset: cursor, data })) return false;
-      cursor += count;
-      this.sent.set(key, cursor);
-      this.outstanding += count;
-    }
-    return true;
-  }
-  acknowledge(runId, stream, offset) {
-    if (!Number.isSafeInteger(offset) || offset < 0) return;
-    const key = keyOf(runId, stream);
-    const previous = this.acknowledged.get(key) ?? 0;
-    const next = Math.max(previous, Math.min(this.sent.get(key) ?? 0, offset));
-    this.acknowledged.set(key, next);
-    this.outstanding = Math.max(0, this.outstanding - (next - previous));
-  }
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  WorkerOutputWindow
-});

package/dist/cjs/recovery-protocol.cjs

@@ -1,31 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var recovery_protocol_exports = {};
-__export(recovery_protocol_exports, {
-  WORKER_RECOVERY_TIMEOUT_MS: () => WORKER_RECOVERY_TIMEOUT_MS,
-  WORKER_RESUMABLE_PROTOCOL: () => WORKER_RESUMABLE_PROTOCOL
-});
-module.exports = __toCommonJS(recovery_protocol_exports);
-const WORKER_RESUMABLE_PROTOCOL = 1;
-const WORKER_RECOVERY_TIMEOUT_MS = 5 * 60 * 1e3;
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  WORKER_RECOVERY_TIMEOUT_MS,
-  WORKER_RESUMABLE_PROTOCOL
-});

package/dist/cjs/recovery-store.cjs

@@ -1,252 +0,0 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var recovery_store_exports = {};
-__export(recovery_store_exports, {
-  WorkerRecoveryStore: () => WorkerRecoveryStore,
-  workerOperationDigest: () => workerOperationDigest
-});
-module.exports = __toCommonJS(recovery_store_exports);
-var import_bun_sqlite = require("bun:sqlite");
-var import_node_fs = __toESM(require("node:fs"), 1);
-var import_node_path = __toESM(require("node:path"), 1);
-var import_node_crypto = require("node:crypto");
-function workerOperationDigest(message) {
-  const canonical = (value) => {
-    if (Array.isArray(value)) return value.map(canonical);
-    if (value && typeof value === "object")
-      return Object.fromEntries(
-        Object.entries(value).filter(([, item]) => item !== void 0).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => [key, canonical(item)])
-      );
-    return value;
-  };
-  const { requestId: _requestId, ...identity } = message;
-  return (0, import_node_crypto.createHash)("sha256").update(JSON.stringify(canonical(identity))).digest("hex");
-}
-class WorkerRecoveryStore {
-  db;
-  ledgerId;
-  constructor(filename) {
-    import_node_fs.default.mkdirSync(import_node_path.default.dirname(filename), { recursive: true, mode: 448 });
-    this.db = new import_bun_sqlite.Database(filename, { create: true });
-    import_node_fs.default.chmodSync(filename, 384);
-    this.db.exec(`PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL;
-      CREATE TABLE IF NOT EXISTS metadata (key TEXT PRIMARY KEY, value TEXT NOT NULL);
-      CREATE TABLE IF NOT EXISTS operations (request_id TEXT PRIMARY KEY, run_id TEXT, session_id TEXT, request_type TEXT NOT NULL, digest TEXT NOT NULL, state TEXT NOT NULL, response TEXT);
-      CREATE UNIQUE INDEX IF NOT EXISTS operation_run_start ON operations(run_id) WHERE request_type='exec_start';
-      CREATE INDEX IF NOT EXISTS operation_run_state ON operations(run_id,state);
-      CREATE TABLE IF NOT EXISTS aliases (request_id TEXT PRIMARY KEY, operation_id TEXT NOT NULL);
-      CREATE TABLE IF NOT EXISTS streams (run_id TEXT NOT NULL, stream TEXT NOT NULL, bytes INTEGER NOT NULL DEFAULT 0, acknowledged INTEGER NOT NULL DEFAULT 0, PRIMARY KEY(run_id, stream));
-      CREATE TABLE IF NOT EXISTS output (run_id TEXT NOT NULL, stream TEXT NOT NULL, offset INTEGER NOT NULL, bytes INTEGER NOT NULL, data TEXT NOT NULL, PRIMARY KEY(run_id, stream, offset));
-      CREATE TABLE IF NOT EXISTS terminals (run_id TEXT PRIMARY KEY, message TEXT NOT NULL);
-      CREATE TABLE IF NOT EXISTS cancelled_requests (request_id TEXT PRIMARY KEY);
-    `);
-    this.db.run("INSERT OR IGNORE INTO metadata(key,value) VALUES ('ledgerId',?)", [crypto.randomUUID()]);
-    this.ledgerId = this.db.query("SELECT value FROM metadata WHERE key='ledgerId'").get().value;
-    this.db.run("UPDATE operations SET state='unknown' WHERE state IN ('accepted','preparing','running')");
-  }
-  close() {
-    this.db.close();
-  }
-  /**
-   * Run several store operations as one durable commit (one FULL fsync).
-   * Operations that open their own transaction nest as savepoints. A throw
-   * rolls the whole group back; callers treat that as a journal failure.
-   */
-  batch(operations) {
-    return this.db.transaction(operations)();
-  }
-  row(requestId) {
-    return this.db.query("SELECT * FROM operations WHERE request_id=? OR request_id=(SELECT operation_id FROM aliases WHERE request_id=?)").get(requestId, requestId);
-  }
-  admit(message) {
-    const digest = workerOperationDigest(message);
-    let existing = this.row(message.requestId);
-    if (!existing && message.type === "exec_start" && typeof message.runId === "string")
-      existing = this.db.query("SELECT * FROM operations WHERE run_id=? AND request_type='exec_start'").get(message.runId);
-    if (existing) {
-      if (existing.digest !== digest) return "conflict";
-      this.db.run("INSERT OR IGNORE INTO aliases(request_id, operation_id) VALUES (?,?)", [message.requestId, existing.request_id]);
-      return existing.state === "unknown" ? "unknown" : "duplicate";
-    }
-    this.db.run("INSERT INTO operations(request_id, run_id, session_id, request_type, digest, state) VALUES (?,?,?,?,?,'accepted')", [
-      message.requestId,
-      typeof message.runId === "string" ? message.runId : null,
-      typeof message.sessionId === "string" ? message.sessionId : null,
-      message.type,
-      digest
-    ]);
-    return "new";
-  }
-  isUnknown(requestId) {
-    return this.row(requestId)?.state === "unknown";
-  }
-  /**
-   * Re-admit an operation whose crash outcome is unknown so it can run again
-   * and record a result. Only a branch deletion qualifies: it is idempotent
-   * for its exact incarnation (durable tombstone plus incarnation preflight),
-   * so a rerun converges on the same outcome. Every other unknown operation
-   * keeps the no-replay invariant.
-   */
-  readmitUnknownBranchDeletion(requestId) {
-    const row = this.row(requestId);
-    if (!row || row.state !== "unknown" || row.request_type !== "delete_project_branch") return false;
-    this.db.run("UPDATE operations SET state='accepted', response=NULL WHERE request_id=?", [row.request_id]);
-    return true;
-  }
-  unknown(requestId) {
-    const row = this.row(requestId);
-    if (row) this.db.run("UPDATE operations SET state='unknown' WHERE request_id=?", [row.request_id]);
-  }
-  unknownRun(runId) {
-    this.db.run("UPDATE operations SET state='unknown' WHERE run_id=? AND request_type IN ('exec_start','exec')", [runId]);
-  }
-  record(message) {
-    if (message.type === "exec_output" && typeof message.runId === "string" && (message.stream === "stdout" || message.stream === "stderr") && typeof message.data === "string") {
-      const runId = message.runId, stream = message.stream, data = message.data;
-      const offset = this.db.transaction(() => {
-        this.db.run("INSERT OR IGNORE INTO streams(run_id, stream) VALUES (?,?)", [runId, stream]);
-        const offset2 = this.db.query("SELECT bytes FROM streams WHERE run_id=? AND stream=?").get(runId, stream).bytes;
-        const bytes = Buffer.byteLength(data);
-        if (bytes) {
-          this.db.run("INSERT INTO output(run_id, stream, offset, bytes, data) VALUES (?,?,?,?,?)", [runId, stream, offset2, bytes, data]);
-          this.db.run("UPDATE streams SET bytes=bytes+? WHERE run_id=? AND stream=?", [bytes, runId, stream]);
-        }
-        return offset2;
-      })();
-      return { ...message, offset };
-    }
-    if ((message.type === "exec_exit" || message.type === "exec_error") && typeof message.runId === "string") {
-      const terminal = { ...message, ...this.lengths(message.runId) };
-      this.db.transaction(() => {
-        this.db.run("INSERT OR REPLACE INTO terminals(run_id,message) VALUES (?,?)", [message.runId, JSON.stringify(terminal)]);
-        this.db.run("UPDATE operations SET state='completed' WHERE run_id=? AND request_type='exec_start'", [message.runId]);
-      })();
-      return terminal;
-    }
-    if (typeof message.requestId === "string") {
-      const row = this.row(message.requestId);
-      if (row) {
-        const state = message.type === "exec_accepted" || message.type === "operation_queued" ? "preparing" : message.type === "exec_started" ? "running" : message.type === "operation_received" ? "accepted" : "completed";
-        if (message.type !== "operation_received")
-          this.db.run("UPDATE operations SET state=?, response=? WHERE request_id=?", [state, JSON.stringify(message), row.request_id]);
-      }
-    }
-    return message;
-  }
-  operations() {
-    return this.db.query(
-      "SELECT * FROM operations WHERE response IS NOT NULL OR state!='completed' UNION ALL SELECT aliases.request_id,operations.run_id,operations.session_id,operations.request_type,operations.digest,operations.state,operations.response FROM aliases JOIN operations ON operations.request_id=aliases.operation_id WHERE aliases.request_id!=operations.request_id AND (response IS NOT NULL OR state!='completed')"
-    ).all().map((row) => ({
-      requestId: row.request_id,
-      requestType: row.request_type,
-      state: row.state,
-      ...row.run_id ? { runId: row.run_id } : {},
-      ...row.session_id ? { sessionId: row.session_id } : {}
-    }));
-  }
-  response(requestId) {
-    const row = this.row(requestId);
-    return row?.response && row.state !== "unknown" ? { ...JSON.parse(row.response), requestId } : void 0;
-  }
-  responses(requestIds) {
-    const ids = /* @__PURE__ */ new Set([...requestIds, ...this.operations().map((operation) => operation.requestId)]);
-    return [...ids].flatMap((requestId) => {
-      const response = this.response(requestId);
-      return response ? [response] : [];
-    });
-  }
-  lengths(runId) {
-    const result = { stdoutBytes: 0, stderrBytes: 0 };
-    for (const row of this.db.query("SELECT stream,bytes FROM streams WHERE run_id=?").all(runId))
-      result[row.stream === "stdout" ? "stdoutBytes" : "stderrBytes"] = row.bytes;
-    return result;
-  }
-  outputCursors() {
-    const cursors = /* @__PURE__ */ new Map();
-    for (const stream of this.db.query("SELECT run_id,stream,acknowledged FROM streams").all()) {
-      const cursor = cursors.get(stream.run_id) ?? { runId: stream.run_id, stdoutBytes: 0, stderrBytes: 0 };
-      cursor[stream.stream === "stdout" ? "stdoutBytes" : "stderrBytes"] = stream.acknowledged;
-      cursors.set(stream.run_id, cursor);
-    }
-    return [...cursors.values()];
-  }
-  *output(offsets = []) {
-    const cursors = new Map(offsets.map((offset) => [offset.runId, offset]));
-    const pendingStreamFilter = offsets.length === 0 ? "bytes>acknowledged AND " : "";
-    for (const stream of this.db.query(`SELECT * FROM streams WHERE ${pendingStreamFilter}NOT EXISTS (SELECT 1 FROM operations WHERE operations.run_id=streams.run_id AND operations.state='unknown') ORDER BY rowid`).all()) {
-      const supplied = cursors.get(stream.run_id);
-      const cursor = supplied ? stream.stream === "stdout" ? supplied.stdoutBytes : supplied.stderrBytes : stream.acknowledged;
-      if (cursor >= stream.bytes) continue;
-      const firstOffset = this.db.query("SELECT MAX(offset) AS offset FROM output WHERE run_id=? AND stream=? AND offset<=?").get(stream.run_id, stream.stream, cursor)?.offset ?? 0;
-      let nextChunk = firstOffset;
-      while (true) {
-        const row = this.db.query("SELECT offset,data FROM output WHERE run_id=? AND stream=? AND offset>=? AND offset<? AND offset+bytes>? ORDER BY offset LIMIT 1").get(stream.run_id, stream.stream, nextChunk, stream.bytes, cursor);
-        if (!row) break;
-        nextChunk = row.offset + 1;
-        yield { type: "exec_output", runId: stream.run_id, stream: stream.stream, offset: row.offset, data: row.data };
-      }
-    }
-  }
-  terminals() {
-    return this.db.query(
-      "SELECT message FROM terminals WHERE NOT EXISTS (SELECT 1 FROM operations WHERE operations.run_id=terminals.run_id AND operations.state='unknown')"
-    ).all().map((row) => JSON.parse(row.message));
-  }
-  acknowledgeOutput(runId, stream, offset) {
-    if (!Number.isSafeInteger(offset) || offset < 0) return;
-    this.db.run("UPDATE streams SET acknowledged=MAX(acknowledged,MIN(bytes,?)) WHERE run_id=? AND stream=?", [offset, runId, stream]);
-  }
-  acknowledgeResult(requestId) {
-    const row = this.row(requestId);
-    if (row && row.request_type !== "exec_start")
-      this.db.run("UPDATE operations SET response=NULL WHERE request_id=? AND state='completed'", [row.request_id]);
-  }
-  acknowledgeTerminal(runId) {
-    this.db.transaction(() => {
-      this.db.run("DELETE FROM terminals WHERE run_id=?", [runId]);
-      this.db.run("DELETE FROM output WHERE run_id=?", [runId]);
-      this.db.run("UPDATE streams SET acknowledged=bytes WHERE run_id=?", [runId]);
-      this.db.run("UPDATE operations SET response=NULL WHERE run_id=? AND request_type='exec_start' AND state='completed'", [runId]);
-    })();
-  }
-  cancelSession(sessionId) {
-    this.db.run("INSERT OR IGNORE INTO cancelled_requests SELECT request_id FROM operations WHERE session_id=? AND state!='completed'", [
-      sessionId
-    ]);
-  }
-  isRequestCancelled(requestId) {
-    const row = this.row(requestId);
-    return !!row && this.db.query("SELECT request_id FROM cancelled_requests WHERE request_id=?").get(row.request_id) !== null;
-  }
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  WorkerRecoveryStore,
-  workerOperationDigest
-});

package/dist/cjs/registry-auth.cjs

@@ -1,310 +0,0 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var registry_auth_exports = {};
-__export(registry_auth_exports, {
-  APP_MANAGED_GITHUB_REGISTRY: () => APP_MANAGED_GITHUB_REGISTRY,
-  RegistryAuthConfigurationError: () => RegistryAuthConfigurationError,
-  configureGitHubRegistryAuthFiles: () => configureGitHubRegistryAuthFiles,
-  planGitHubRegistryAuthFiles: () => planGitHubRegistryAuthFiles,
-  preparePrivateAuthFileGeneration: () => preparePrivateAuthFileGeneration,
-  registryAuthHasAppManagedGitHubCredential: () => registryAuthHasAppManagedGitHubCredential,
-  registryAuthTestHarness: () => registryAuthTestHarness,
-  updateGitHubRegistryAuthFile: () => updateGitHubRegistryAuthFile
-});
-module.exports = __toCommonJS(registry_auth_exports);
-var import_node_fs = __toESM(require("node:fs"), 1);
-var import_node_path = __toESM(require("node:path"), 1);
-const APP_MANAGED_GITHUB_REGISTRY = "ghcr.io";
-class RegistryAuthConfigurationError extends Error {
-  constructor(cause) {
-    super("Could not authoritatively configure GitHub registry authentication", { cause });
-    this.name = "RegistryAuthConfigurationError";
-  }
-}
-function isJsonObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function lstatIfExists(filePath) {
-  try {
-    return import_node_fs.default.lstatSync(filePath);
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-}
-function readRegistryAuthConfig(filePath) {
-  const stat = lstatIfExists(filePath);
-  if (!stat) return null;
-  if (stat.isSymbolicLink() || !stat.isFile()) throw new Error(`Registry auth config must be a regular file: ${filePath}`);
-  let parsed;
-  try {
-    parsed = JSON.parse(import_node_fs.default.readFileSync(filePath, "utf8"));
-  } catch (error) {
-    throw new Error(`Registry auth config is not valid JSON: ${filePath}`, { cause: error });
-  }
-  if (!isJsonObject(parsed)) throw new Error(`Registry auth config must contain a JSON object: ${filePath}`);
-  return parsed;
-}
-function registryAuthHasAppManagedGitHubCredential(filePath) {
-  const config = readRegistryAuthConfig(filePath);
-  if (!config) return false;
-  if (config.auths === void 0) return false;
-  if (!isJsonObject(config.auths)) throw new Error(`Registry auth config has an invalid auths object: ${filePath}`);
-  return Object.prototype.hasOwnProperty.call(config.auths, APP_MANAGED_GITHUB_REGISTRY);
-}
-function fsyncDirectory(directory, dependencies = {
-  platform: process.platform,
-  open: (target) => import_node_fs.default.openSync(target, "r"),
-  fsync: import_node_fs.default.fsyncSync,
-  close: import_node_fs.default.closeSync
-}) {
-  if (dependencies.platform === "win32") return;
-  const descriptor = dependencies.open(directory);
-  try {
-    dependencies.fsync(descriptor);
-  } finally {
-    dependencies.close(descriptor);
-  }
-}
-function ensurePrivateParentDirectory(filePath) {
-  const directory = import_node_path.default.dirname(filePath);
-  let existingAncestor = directory;
-  while (!lstatIfExists(existingAncestor)) {
-    const parent = import_node_path.default.dirname(existingAncestor);
-    if (parent === existingAncestor) throw new Error(`Registry auth parent has no existing ancestor: ${directory}`);
-    existingAncestor = parent;
-  }
-  const ancestorStat = lstatIfExists(existingAncestor);
-  if (!ancestorStat || ancestorStat.isSymbolicLink() || !ancestorStat.isDirectory()) {
-    throw new Error(`Registry auth parent must descend from a real directory: ${directory}`);
-  }
-  import_node_fs.default.mkdirSync(directory, { recursive: true, mode: 448 });
-  let current = directory;
-  while (true) {
-    const stat = lstatIfExists(current);
-    if (!stat || stat.isSymbolicLink() || !stat.isDirectory()) {
-      throw new Error(`Registry auth parent must be a real directory: ${current}`);
-    }
-    fsyncDirectory(current);
-    if (current === existingAncestor) break;
-    current = import_node_path.default.dirname(current);
-  }
-}
-function stagePrivateFile(filePath, content) {
-  ensurePrivateParentDirectory(filePath);
-  const temporaryPath = import_node_path.default.join(import_node_path.default.dirname(filePath), `.${import_node_path.default.basename(filePath)}.r5d-auth.${process.pid}.${crypto.randomUUID()}.tmp`);
-  let descriptor;
-  try {
-    descriptor = import_node_fs.default.openSync(temporaryPath, "wx", 384);
-    import_node_fs.default.writeFileSync(descriptor, content, "utf8");
-    import_node_fs.default.fsyncSync(descriptor);
-    import_node_fs.default.closeSync(descriptor);
-    descriptor = void 0;
-    import_node_fs.default.chmodSync(temporaryPath, 384);
-    return { filePath, temporaryPath };
-  } catch (error) {
-    if (descriptor !== void 0) import_node_fs.default.closeSync(descriptor);
-    import_node_fs.default.rmSync(temporaryPath, { force: true });
-    throw error;
-  }
-}
-function commitStagedPrivateFile(staged, beforeRename) {
-  beforeRename?.();
-  import_node_fs.default.renameSync(staged.temporaryPath, staged.filePath);
-  import_node_fs.default.chmodSync(staged.filePath, 384);
-  fsyncDirectory(import_node_path.default.dirname(staged.filePath));
-}
-function discardStagedPrivateFile(staged) {
-  import_node_fs.default.rmSync(staged.temporaryPath, { force: true });
-}
-function cleanupAbandonedStagedFiles(filePath) {
-  const directory = import_node_path.default.dirname(filePath);
-  const prefix = `.${import_node_path.default.basename(filePath)}.r5d-auth.`;
-  let entries;
-  try {
-    entries = import_node_fs.default.readdirSync(directory);
-  } catch (error) {
-    if (error.code === "ENOENT") return;
-    throw error;
-  }
-  let removed = false;
-  for (const name of entries) {
-    if (!name.startsWith(prefix) || !name.endsWith(".tmp")) continue;
-    const candidate = import_node_path.default.join(directory, name);
-    const stat = import_node_fs.default.lstatSync(candidate);
-    if (stat.isSymbolicLink() || !stat.isFile()) {
-      throw new Error(`Registry auth staging artifact must be a regular file: ${candidate}`);
-    }
-    import_node_fs.default.rmSync(candidate);
-    removed = true;
-  }
-  if (removed) fsyncDirectory(directory);
-}
-function atomicReplacePrivateFile(filePath, content, beforeRename) {
-  const staged = stagePrivateFile(filePath, content);
-  try {
-    commitStagedPrivateFile(staged, beforeRename);
-  } finally {
-    discardStagedPrivateFile(staged);
-  }
-}
-function preparePrivateAuthFileGeneration(updates) {
-  try {
-    const desiredByPath = /* @__PURE__ */ new Map();
-    for (const update of updates) {
-      const filePath = import_node_path.default.resolve(update.filePath);
-      const existing = desiredByPath.get(filePath);
-      const desired = { content: update.content, allowSymlinkRemoval: update.allowSymlinkRemoval === true };
-      if (existing && (existing.content !== desired.content || existing.allowSymlinkRemoval !== desired.allowSymlinkRemoval)) {
-        throw new Error(`Conflicting desired auth content for ${filePath}`);
-      }
-      desiredByPath.set(filePath, desired);
-    }
-    const changes = [];
-    const stagedFiles = [];
-    try {
-      for (const [filePath, desired] of desiredByPath) {
-        const { content, allowSymlinkRemoval } = desired;
-        cleanupAbandonedStagedFiles(filePath);
-        const status = lstatIfExists(filePath);
-        if (status && (status.isSymbolicLink() ? !(content === null && allowSymlinkRemoval) : !status.isFile())) {
-          throw new Error(`Private auth target must be a regular file: ${filePath}`);
-        }
-        const unchanged = content === null ? !status : Boolean(status && import_node_fs.default.readFileSync(filePath, "utf8") === content && (status.mode & 511) === 384);
-        if (unchanged) continue;
-        if (content === null) {
-          changes.push({ filePath, content });
-          continue;
-        }
-        const staged = stagePrivateFile(filePath, content);
-        stagedFiles.push(staged);
-        changes.push({ filePath, content, staged });
-      }
-    } catch (error) {
-      for (const staged of stagedFiles) discardStagedPrivateFile(staged);
-      throw error;
-    }
-    let finished = false;
-    const discard = () => {
-      for (const staged of stagedFiles) discardStagedPrivateFile(staged);
-    };
-    return {
-      changed: changes.length > 0,
-      commit(beforeMutation) {
-        if (finished) throw new Error("Private auth generation has already been finalized");
-        finished = true;
-        try {
-          changes.forEach((change, index) => {
-            beforeMutation?.(change.filePath, index);
-            if (change.content === null) {
-              import_node_fs.default.unlinkSync(change.filePath);
-              fsyncDirectory(import_node_path.default.dirname(change.filePath));
-              return;
-            }
-            if (!change.staged) throw new Error(`Private auth replacement was not staged: ${change.filePath}`);
-            commitStagedPrivateFile(change.staged);
-          });
-        } catch (error) {
-          throw error instanceof RegistryAuthConfigurationError ? error : new RegistryAuthConfigurationError(error);
-        } finally {
-          discard();
-        }
-      },
-      discard() {
-        if (finished) return;
-        finished = true;
-        discard();
-      }
-    };
-  } catch (error) {
-    throw error instanceof RegistryAuthConfigurationError ? error : new RegistryAuthConfigurationError(error);
-  }
-}
-function registryAuthFileContent(filePath, credential) {
-  if (credential && credential.registry !== APP_MANAGED_GITHUB_REGISTRY) {
-    throw new Error(`Unsupported app-managed registry: ${credential.registry}`);
-  }
-  const existing = readRegistryAuthConfig(filePath);
-  if (!existing && !credential) return null;
-  const config = { ...existing ?? {} };
-  const existingAuths = config.auths;
-  if (existingAuths !== void 0 && !isJsonObject(existingAuths)) {
-    throw new Error(`Registry auth config has an invalid auths object: ${filePath}`);
-  }
-  const auths = { ...existingAuths ?? {} };
-  delete auths[APP_MANAGED_GITHUB_REGISTRY];
-  if (credential) {
-    auths[APP_MANAGED_GITHUB_REGISTRY] = {
-      username: credential.username,
-      password: credential.token,
-      auth: Buffer.from(`${credential.username}:${credential.token}`).toString("base64")
-    };
-  }
-  config.auths = auths;
-  return `${JSON.stringify(config, null, 2)}
-`;
-}
-function configureGitHubRegistryAuthFilesWithHook(filePaths, credential, beforeRename) {
-  try {
-    const prepared = preparePrivateAuthFileGeneration(planGitHubRegistryAuthFiles(filePaths, credential));
-    prepared.commit(beforeRename);
-  } catch (error) {
-    throw error instanceof RegistryAuthConfigurationError ? error : new RegistryAuthConfigurationError(error);
-  }
-}
-function planGitHubRegistryAuthFiles(filePaths, credential) {
-  const uniquePaths = [...new Set(filePaths.map((filePath) => import_node_path.default.resolve(filePath)))];
-  return uniquePaths.map((filePath) => ({ filePath, content: registryAuthFileContent(filePath, credential) }));
-}
-function updateGitHubRegistryAuthFile(filePath, credential) {
-  configureGitHubRegistryAuthFilesWithHook([filePath], credential);
-}
-function configureGitHubRegistryAuthFiles(filePaths, credential) {
-  configureGitHubRegistryAuthFilesWithHook(filePaths, credential);
-}
-const registryAuthTestHarness = {
-  fsyncDirectory,
-  atomicReplacePrivateFile(filePath, content, beforeRename) {
-    atomicReplacePrivateFile(filePath, content, beforeRename);
-  },
-  configureFiles(filePaths, credential, beforeRename) {
-    configureGitHubRegistryAuthFilesWithHook(filePaths, credential, beforeRename);
-  }
-};
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  APP_MANAGED_GITHUB_REGISTRY,
-  RegistryAuthConfigurationError,
-  configureGitHubRegistryAuthFiles,
-  planGitHubRegistryAuthFiles,
-  preparePrivateAuthFileGeneration,
-  registryAuthHasAppManagedGitHubCredential,
-  registryAuthTestHarness,
-  updateGitHubRegistryAuthFile
-});