@ricsam/r5d-worker 0.0.137 → 0.0.139

package/dist/mjs/recovery-output-window.mjs

@@ -1,53 +0,0 @@
-const keyOf = (runId, stream) => `${runId}:${stream}`;
-class WorkerOutputWindow {
-  constructor(windowBytes = 1024 * 1024) {
-    this.windowBytes = windowBytes;
-  }
-  windowBytes;
-  sent = /* @__PURE__ */ new Map();
-  acknowledged = /* @__PURE__ */ new Map();
-  outstanding = 0;
-  reset(cursors) {
-    this.sent.clear();
-    this.acknowledged.clear();
-    this.outstanding = 0;
-    for (const cursor of cursors) {
-      for (const stream of ["stdout", "stderr"]) {
-        const offset = stream === "stdout" ? cursor.stdoutBytes : cursor.stderrBytes;
-        this.sent.set(keyOf(cursor.runId, stream), offset);
-        this.acknowledged.set(keyOf(cursor.runId, stream), offset);
-      }
-    }
-  }
-  send(frame, send, bufferedAmount = 0) {
-    const key = keyOf(frame.runId, frame.stream);
-    const sent = this.sent.get(key) ?? 0;
-    const bytes = Buffer.from(frame.data, "utf8");
-    const end = frame.offset + bytes.length;
-    if (end <= sent) return true;
-    if (frame.offset > sent) return false;
-    let cursor = sent;
-    while (cursor < end) {
-      let count = Math.min(end - cursor, 64 * 1024, this.windowBytes - this.outstanding);
-      while (count > 0 && ((bytes[cursor - frame.offset + count] ?? 0) & 192) === 128) count -= 1;
-      if (count <= 0 || bufferedAmount >= this.windowBytes) return false;
-      const data = bytes.subarray(cursor - frame.offset, cursor - frame.offset + count).toString("utf8");
-      if (!send({ ...frame, offset: cursor, data })) return false;
-      cursor += count;
-      this.sent.set(key, cursor);
-      this.outstanding += count;
-    }
-    return true;
-  }
-  acknowledge(runId, stream, offset) {
-    if (!Number.isSafeInteger(offset) || offset < 0) return;
-    const key = keyOf(runId, stream);
-    const previous = this.acknowledged.get(key) ?? 0;
-    const next = Math.max(previous, Math.min(this.sent.get(key) ?? 0, offset));
-    this.acknowledged.set(key, next);
-    this.outstanding = Math.max(0, this.outstanding - (next - previous));
-  }
-}
-export {
-  WorkerOutputWindow
-};

package/dist/mjs/recovery-protocol.mjs

@@ -1,6 +0,0 @@
-const WORKER_RESUMABLE_PROTOCOL = 1;
-const WORKER_RECOVERY_TIMEOUT_MS = 5 * 60 * 1e3;
-export {
-  WORKER_RECOVERY_TIMEOUT_MS,
-  WORKER_RESUMABLE_PROTOCOL
-};

package/dist/mjs/recovery-store.mjs

@@ -1,217 +0,0 @@
-import { Database } from "bun:sqlite";
-import fs from "node:fs";
-import path from "node:path";
-import { createHash } from "node:crypto";
-function workerOperationDigest(message) {
-  const canonical = (value) => {
-    if (Array.isArray(value)) return value.map(canonical);
-    if (value && typeof value === "object")
-      return Object.fromEntries(
-        Object.entries(value).filter(([, item]) => item !== void 0).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => [key, canonical(item)])
-      );
-    return value;
-  };
-  const { requestId: _requestId, ...identity } = message;
-  return createHash("sha256").update(JSON.stringify(canonical(identity))).digest("hex");
-}
-class WorkerRecoveryStore {
-  db;
-  ledgerId;
-  constructor(filename) {
-    fs.mkdirSync(path.dirname(filename), { recursive: true, mode: 448 });
-    this.db = new Database(filename, { create: true });
-    fs.chmodSync(filename, 384);
-    this.db.exec(`PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL;
-      CREATE TABLE IF NOT EXISTS metadata (key TEXT PRIMARY KEY, value TEXT NOT NULL);
-      CREATE TABLE IF NOT EXISTS operations (request_id TEXT PRIMARY KEY, run_id TEXT, session_id TEXT, request_type TEXT NOT NULL, digest TEXT NOT NULL, state TEXT NOT NULL, response TEXT);
-      CREATE UNIQUE INDEX IF NOT EXISTS operation_run_start ON operations(run_id) WHERE request_type='exec_start';
-      CREATE INDEX IF NOT EXISTS operation_run_state ON operations(run_id,state);
-      CREATE TABLE IF NOT EXISTS aliases (request_id TEXT PRIMARY KEY, operation_id TEXT NOT NULL);
-      CREATE TABLE IF NOT EXISTS streams (run_id TEXT NOT NULL, stream TEXT NOT NULL, bytes INTEGER NOT NULL DEFAULT 0, acknowledged INTEGER NOT NULL DEFAULT 0, PRIMARY KEY(run_id, stream));
-      CREATE TABLE IF NOT EXISTS output (run_id TEXT NOT NULL, stream TEXT NOT NULL, offset INTEGER NOT NULL, bytes INTEGER NOT NULL, data TEXT NOT NULL, PRIMARY KEY(run_id, stream, offset));
-      CREATE TABLE IF NOT EXISTS terminals (run_id TEXT PRIMARY KEY, message TEXT NOT NULL);
-      CREATE TABLE IF NOT EXISTS cancelled_requests (request_id TEXT PRIMARY KEY);
-    `);
-    this.db.run("INSERT OR IGNORE INTO metadata(key,value) VALUES ('ledgerId',?)", [crypto.randomUUID()]);
-    this.ledgerId = this.db.query("SELECT value FROM metadata WHERE key='ledgerId'").get().value;
-    this.db.run("UPDATE operations SET state='unknown' WHERE state IN ('accepted','preparing','running')");
-  }
-  close() {
-    this.db.close();
-  }
-  /**
-   * Run several store operations as one durable commit (one FULL fsync).
-   * Operations that open their own transaction nest as savepoints. A throw
-   * rolls the whole group back; callers treat that as a journal failure.
-   */
-  batch(operations) {
-    return this.db.transaction(operations)();
-  }
-  row(requestId) {
-    return this.db.query("SELECT * FROM operations WHERE request_id=? OR request_id=(SELECT operation_id FROM aliases WHERE request_id=?)").get(requestId, requestId);
-  }
-  admit(message) {
-    const digest = workerOperationDigest(message);
-    let existing = this.row(message.requestId);
-    if (!existing && message.type === "exec_start" && typeof message.runId === "string")
-      existing = this.db.query("SELECT * FROM operations WHERE run_id=? AND request_type='exec_start'").get(message.runId);
-    if (existing) {
-      if (existing.digest !== digest) return "conflict";
-      this.db.run("INSERT OR IGNORE INTO aliases(request_id, operation_id) VALUES (?,?)", [message.requestId, existing.request_id]);
-      return existing.state === "unknown" ? "unknown" : "duplicate";
-    }
-    this.db.run("INSERT INTO operations(request_id, run_id, session_id, request_type, digest, state) VALUES (?,?,?,?,?,'accepted')", [
-      message.requestId,
-      typeof message.runId === "string" ? message.runId : null,
-      typeof message.sessionId === "string" ? message.sessionId : null,
-      message.type,
-      digest
-    ]);
-    return "new";
-  }
-  isUnknown(requestId) {
-    return this.row(requestId)?.state === "unknown";
-  }
-  /**
-   * Re-admit an operation whose crash outcome is unknown so it can run again
-   * and record a result. Only a branch deletion qualifies: it is idempotent
-   * for its exact incarnation (durable tombstone plus incarnation preflight),
-   * so a rerun converges on the same outcome. Every other unknown operation
-   * keeps the no-replay invariant.
-   */
-  readmitUnknownBranchDeletion(requestId) {
-    const row = this.row(requestId);
-    if (!row || row.state !== "unknown" || row.request_type !== "delete_project_branch") return false;
-    this.db.run("UPDATE operations SET state='accepted', response=NULL WHERE request_id=?", [row.request_id]);
-    return true;
-  }
-  unknown(requestId) {
-    const row = this.row(requestId);
-    if (row) this.db.run("UPDATE operations SET state='unknown' WHERE request_id=?", [row.request_id]);
-  }
-  unknownRun(runId) {
-    this.db.run("UPDATE operations SET state='unknown' WHERE run_id=? AND request_type IN ('exec_start','exec')", [runId]);
-  }
-  record(message) {
-    if (message.type === "exec_output" && typeof message.runId === "string" && (message.stream === "stdout" || message.stream === "stderr") && typeof message.data === "string") {
-      const runId = message.runId, stream = message.stream, data = message.data;
-      const offset = this.db.transaction(() => {
-        this.db.run("INSERT OR IGNORE INTO streams(run_id, stream) VALUES (?,?)", [runId, stream]);
-        const offset2 = this.db.query("SELECT bytes FROM streams WHERE run_id=? AND stream=?").get(runId, stream).bytes;
-        const bytes = Buffer.byteLength(data);
-        if (bytes) {
-          this.db.run("INSERT INTO output(run_id, stream, offset, bytes, data) VALUES (?,?,?,?,?)", [runId, stream, offset2, bytes, data]);
-          this.db.run("UPDATE streams SET bytes=bytes+? WHERE run_id=? AND stream=?", [bytes, runId, stream]);
-        }
-        return offset2;
-      })();
-      return { ...message, offset };
-    }
-    if ((message.type === "exec_exit" || message.type === "exec_error") && typeof message.runId === "string") {
-      const terminal = { ...message, ...this.lengths(message.runId) };
-      this.db.transaction(() => {
-        this.db.run("INSERT OR REPLACE INTO terminals(run_id,message) VALUES (?,?)", [message.runId, JSON.stringify(terminal)]);
-        this.db.run("UPDATE operations SET state='completed' WHERE run_id=? AND request_type='exec_start'", [message.runId]);
-      })();
-      return terminal;
-    }
-    if (typeof message.requestId === "string") {
-      const row = this.row(message.requestId);
-      if (row) {
-        const state = message.type === "exec_accepted" || message.type === "operation_queued" ? "preparing" : message.type === "exec_started" ? "running" : message.type === "operation_received" ? "accepted" : "completed";
-        if (message.type !== "operation_received")
-          this.db.run("UPDATE operations SET state=?, response=? WHERE request_id=?", [state, JSON.stringify(message), row.request_id]);
-      }
-    }
-    return message;
-  }
-  operations() {
-    return this.db.query(
-      "SELECT * FROM operations WHERE response IS NOT NULL OR state!='completed' UNION ALL SELECT aliases.request_id,operations.run_id,operations.session_id,operations.request_type,operations.digest,operations.state,operations.response FROM aliases JOIN operations ON operations.request_id=aliases.operation_id WHERE aliases.request_id!=operations.request_id AND (response IS NOT NULL OR state!='completed')"
-    ).all().map((row) => ({
-      requestId: row.request_id,
-      requestType: row.request_type,
-      state: row.state,
-      ...row.run_id ? { runId: row.run_id } : {},
-      ...row.session_id ? { sessionId: row.session_id } : {}
-    }));
-  }
-  response(requestId) {
-    const row = this.row(requestId);
-    return row?.response && row.state !== "unknown" ? { ...JSON.parse(row.response), requestId } : void 0;
-  }
-  responses(requestIds) {
-    const ids = /* @__PURE__ */ new Set([...requestIds, ...this.operations().map((operation) => operation.requestId)]);
-    return [...ids].flatMap((requestId) => {
-      const response = this.response(requestId);
-      return response ? [response] : [];
-    });
-  }
-  lengths(runId) {
-    const result = { stdoutBytes: 0, stderrBytes: 0 };
-    for (const row of this.db.query("SELECT stream,bytes FROM streams WHERE run_id=?").all(runId))
-      result[row.stream === "stdout" ? "stdoutBytes" : "stderrBytes"] = row.bytes;
-    return result;
-  }
-  outputCursors() {
-    const cursors = /* @__PURE__ */ new Map();
-    for (const stream of this.db.query("SELECT run_id,stream,acknowledged FROM streams").all()) {
-      const cursor = cursors.get(stream.run_id) ?? { runId: stream.run_id, stdoutBytes: 0, stderrBytes: 0 };
-      cursor[stream.stream === "stdout" ? "stdoutBytes" : "stderrBytes"] = stream.acknowledged;
-      cursors.set(stream.run_id, cursor);
-    }
-    return [...cursors.values()];
-  }
-  *output(offsets = []) {
-    const cursors = new Map(offsets.map((offset) => [offset.runId, offset]));
-    const pendingStreamFilter = offsets.length === 0 ? "bytes>acknowledged AND " : "";
-    for (const stream of this.db.query(`SELECT * FROM streams WHERE ${pendingStreamFilter}NOT EXISTS (SELECT 1 FROM operations WHERE operations.run_id=streams.run_id AND operations.state='unknown') ORDER BY rowid`).all()) {
-      const supplied = cursors.get(stream.run_id);
-      const cursor = supplied ? stream.stream === "stdout" ? supplied.stdoutBytes : supplied.stderrBytes : stream.acknowledged;
-      if (cursor >= stream.bytes) continue;
-      const firstOffset = this.db.query("SELECT MAX(offset) AS offset FROM output WHERE run_id=? AND stream=? AND offset<=?").get(stream.run_id, stream.stream, cursor)?.offset ?? 0;
-      let nextChunk = firstOffset;
-      while (true) {
-        const row = this.db.query("SELECT offset,data FROM output WHERE run_id=? AND stream=? AND offset>=? AND offset<? AND offset+bytes>? ORDER BY offset LIMIT 1").get(stream.run_id, stream.stream, nextChunk, stream.bytes, cursor);
-        if (!row) break;
-        nextChunk = row.offset + 1;
-        yield { type: "exec_output", runId: stream.run_id, stream: stream.stream, offset: row.offset, data: row.data };
-      }
-    }
-  }
-  terminals() {
-    return this.db.query(
-      "SELECT message FROM terminals WHERE NOT EXISTS (SELECT 1 FROM operations WHERE operations.run_id=terminals.run_id AND operations.state='unknown')"
-    ).all().map((row) => JSON.parse(row.message));
-  }
-  acknowledgeOutput(runId, stream, offset) {
-    if (!Number.isSafeInteger(offset) || offset < 0) return;
-    this.db.run("UPDATE streams SET acknowledged=MAX(acknowledged,MIN(bytes,?)) WHERE run_id=? AND stream=?", [offset, runId, stream]);
-  }
-  acknowledgeResult(requestId) {
-    const row = this.row(requestId);
-    if (row && row.request_type !== "exec_start")
-      this.db.run("UPDATE operations SET response=NULL WHERE request_id=? AND state='completed'", [row.request_id]);
-  }
-  acknowledgeTerminal(runId) {
-    this.db.transaction(() => {
-      this.db.run("DELETE FROM terminals WHERE run_id=?", [runId]);
-      this.db.run("DELETE FROM output WHERE run_id=?", [runId]);
-      this.db.run("UPDATE streams SET acknowledged=bytes WHERE run_id=?", [runId]);
-      this.db.run("UPDATE operations SET response=NULL WHERE run_id=? AND request_type='exec_start' AND state='completed'", [runId]);
-    })();
-  }
-  cancelSession(sessionId) {
-    this.db.run("INSERT OR IGNORE INTO cancelled_requests SELECT request_id FROM operations WHERE session_id=? AND state!='completed'", [
-      sessionId
-    ]);
-  }
-  isRequestCancelled(requestId) {
-    const row = this.row(requestId);
-    return !!row && this.db.query("SELECT request_id FROM cancelled_requests WHERE request_id=?").get(row.request_id) !== null;
-  }
-}
-export {
-  WorkerRecoveryStore,
-  workerOperationDigest
-};

package/dist/mjs/registry-auth.mjs

@@ -1,269 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-const APP_MANAGED_GITHUB_REGISTRY = "ghcr.io";
-class RegistryAuthConfigurationError extends Error {
-  constructor(cause) {
-    super("Could not authoritatively configure GitHub registry authentication", { cause });
-    this.name = "RegistryAuthConfigurationError";
-  }
-}
-function isJsonObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function lstatIfExists(filePath) {
-  try {
-    return fs.lstatSync(filePath);
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-}
-function readRegistryAuthConfig(filePath) {
-  const stat = lstatIfExists(filePath);
-  if (!stat) return null;
-  if (stat.isSymbolicLink() || !stat.isFile()) throw new Error(`Registry auth config must be a regular file: ${filePath}`);
-  let parsed;
-  try {
-    parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
-  } catch (error) {
-    throw new Error(`Registry auth config is not valid JSON: ${filePath}`, { cause: error });
-  }
-  if (!isJsonObject(parsed)) throw new Error(`Registry auth config must contain a JSON object: ${filePath}`);
-  return parsed;
-}
-function registryAuthHasAppManagedGitHubCredential(filePath) {
-  const config = readRegistryAuthConfig(filePath);
-  if (!config) return false;
-  if (config.auths === void 0) return false;
-  if (!isJsonObject(config.auths)) throw new Error(`Registry auth config has an invalid auths object: ${filePath}`);
-  return Object.prototype.hasOwnProperty.call(config.auths, APP_MANAGED_GITHUB_REGISTRY);
-}
-function fsyncDirectory(directory, dependencies = {
-  platform: process.platform,
-  open: (target) => fs.openSync(target, "r"),
-  fsync: fs.fsyncSync,
-  close: fs.closeSync
-}) {
-  if (dependencies.platform === "win32") return;
-  const descriptor = dependencies.open(directory);
-  try {
-    dependencies.fsync(descriptor);
-  } finally {
-    dependencies.close(descriptor);
-  }
-}
-function ensurePrivateParentDirectory(filePath) {
-  const directory = path.dirname(filePath);
-  let existingAncestor = directory;
-  while (!lstatIfExists(existingAncestor)) {
-    const parent = path.dirname(existingAncestor);
-    if (parent === existingAncestor) throw new Error(`Registry auth parent has no existing ancestor: ${directory}`);
-    existingAncestor = parent;
-  }
-  const ancestorStat = lstatIfExists(existingAncestor);
-  if (!ancestorStat || ancestorStat.isSymbolicLink() || !ancestorStat.isDirectory()) {
-    throw new Error(`Registry auth parent must descend from a real directory: ${directory}`);
-  }
-  fs.mkdirSync(directory, { recursive: true, mode: 448 });
-  let current = directory;
-  while (true) {
-    const stat = lstatIfExists(current);
-    if (!stat || stat.isSymbolicLink() || !stat.isDirectory()) {
-      throw new Error(`Registry auth parent must be a real directory: ${current}`);
-    }
-    fsyncDirectory(current);
-    if (current === existingAncestor) break;
-    current = path.dirname(current);
-  }
-}
-function stagePrivateFile(filePath, content) {
-  ensurePrivateParentDirectory(filePath);
-  const temporaryPath = path.join(path.dirname(filePath), `.${path.basename(filePath)}.r5d-auth.${process.pid}.${crypto.randomUUID()}.tmp`);
-  let descriptor;
-  try {
-    descriptor = fs.openSync(temporaryPath, "wx", 384);
-    fs.writeFileSync(descriptor, content, "utf8");
-    fs.fsyncSync(descriptor);
-    fs.closeSync(descriptor);
-    descriptor = void 0;
-    fs.chmodSync(temporaryPath, 384);
-    return { filePath, temporaryPath };
-  } catch (error) {
-    if (descriptor !== void 0) fs.closeSync(descriptor);
-    fs.rmSync(temporaryPath, { force: true });
-    throw error;
-  }
-}
-function commitStagedPrivateFile(staged, beforeRename) {
-  beforeRename?.();
-  fs.renameSync(staged.temporaryPath, staged.filePath);
-  fs.chmodSync(staged.filePath, 384);
-  fsyncDirectory(path.dirname(staged.filePath));
-}
-function discardStagedPrivateFile(staged) {
-  fs.rmSync(staged.temporaryPath, { force: true });
-}
-function cleanupAbandonedStagedFiles(filePath) {
-  const directory = path.dirname(filePath);
-  const prefix = `.${path.basename(filePath)}.r5d-auth.`;
-  let entries;
-  try {
-    entries = fs.readdirSync(directory);
-  } catch (error) {
-    if (error.code === "ENOENT") return;
-    throw error;
-  }
-  let removed = false;
-  for (const name of entries) {
-    if (!name.startsWith(prefix) || !name.endsWith(".tmp")) continue;
-    const candidate = path.join(directory, name);
-    const stat = fs.lstatSync(candidate);
-    if (stat.isSymbolicLink() || !stat.isFile()) {
-      throw new Error(`Registry auth staging artifact must be a regular file: ${candidate}`);
-    }
-    fs.rmSync(candidate);
-    removed = true;
-  }
-  if (removed) fsyncDirectory(directory);
-}
-function atomicReplacePrivateFile(filePath, content, beforeRename) {
-  const staged = stagePrivateFile(filePath, content);
-  try {
-    commitStagedPrivateFile(staged, beforeRename);
-  } finally {
-    discardStagedPrivateFile(staged);
-  }
-}
-function preparePrivateAuthFileGeneration(updates) {
-  try {
-    const desiredByPath = /* @__PURE__ */ new Map();
-    for (const update of updates) {
-      const filePath = path.resolve(update.filePath);
-      const existing = desiredByPath.get(filePath);
-      const desired = { content: update.content, allowSymlinkRemoval: update.allowSymlinkRemoval === true };
-      if (existing && (existing.content !== desired.content || existing.allowSymlinkRemoval !== desired.allowSymlinkRemoval)) {
-        throw new Error(`Conflicting desired auth content for ${filePath}`);
-      }
-      desiredByPath.set(filePath, desired);
-    }
-    const changes = [];
-    const stagedFiles = [];
-    try {
-      for (const [filePath, desired] of desiredByPath) {
-        const { content, allowSymlinkRemoval } = desired;
-        cleanupAbandonedStagedFiles(filePath);
-        const status = lstatIfExists(filePath);
-        if (status && (status.isSymbolicLink() ? !(content === null && allowSymlinkRemoval) : !status.isFile())) {
-          throw new Error(`Private auth target must be a regular file: ${filePath}`);
-        }
-        const unchanged = content === null ? !status : Boolean(status && fs.readFileSync(filePath, "utf8") === content && (status.mode & 511) === 384);
-        if (unchanged) continue;
-        if (content === null) {
-          changes.push({ filePath, content });
-          continue;
-        }
-        const staged = stagePrivateFile(filePath, content);
-        stagedFiles.push(staged);
-        changes.push({ filePath, content, staged });
-      }
-    } catch (error) {
-      for (const staged of stagedFiles) discardStagedPrivateFile(staged);
-      throw error;
-    }
-    let finished = false;
-    const discard = () => {
-      for (const staged of stagedFiles) discardStagedPrivateFile(staged);
-    };
-    return {
-      changed: changes.length > 0,
-      commit(beforeMutation) {
-        if (finished) throw new Error("Private auth generation has already been finalized");
-        finished = true;
-        try {
-          changes.forEach((change, index) => {
-            beforeMutation?.(change.filePath, index);
-            if (change.content === null) {
-              fs.unlinkSync(change.filePath);
-              fsyncDirectory(path.dirname(change.filePath));
-              return;
-            }
-            if (!change.staged) throw new Error(`Private auth replacement was not staged: ${change.filePath}`);
-            commitStagedPrivateFile(change.staged);
-          });
-        } catch (error) {
-          throw error instanceof RegistryAuthConfigurationError ? error : new RegistryAuthConfigurationError(error);
-        } finally {
-          discard();
-        }
-      },
-      discard() {
-        if (finished) return;
-        finished = true;
-        discard();
-      }
-    };
-  } catch (error) {
-    throw error instanceof RegistryAuthConfigurationError ? error : new RegistryAuthConfigurationError(error);
-  }
-}
-function registryAuthFileContent(filePath, credential) {
-  if (credential && credential.registry !== APP_MANAGED_GITHUB_REGISTRY) {
-    throw new Error(`Unsupported app-managed registry: ${credential.registry}`);
-  }
-  const existing = readRegistryAuthConfig(filePath);
-  if (!existing && !credential) return null;
-  const config = { ...existing ?? {} };
-  const existingAuths = config.auths;
-  if (existingAuths !== void 0 && !isJsonObject(existingAuths)) {
-    throw new Error(`Registry auth config has an invalid auths object: ${filePath}`);
-  }
-  const auths = { ...existingAuths ?? {} };
-  delete auths[APP_MANAGED_GITHUB_REGISTRY];
-  if (credential) {
-    auths[APP_MANAGED_GITHUB_REGISTRY] = {
-      username: credential.username,
-      password: credential.token,
-      auth: Buffer.from(`${credential.username}:${credential.token}`).toString("base64")
-    };
-  }
-  config.auths = auths;
-  return `${JSON.stringify(config, null, 2)}
-`;
-}
-function configureGitHubRegistryAuthFilesWithHook(filePaths, credential, beforeRename) {
-  try {
-    const prepared = preparePrivateAuthFileGeneration(planGitHubRegistryAuthFiles(filePaths, credential));
-    prepared.commit(beforeRename);
-  } catch (error) {
-    throw error instanceof RegistryAuthConfigurationError ? error : new RegistryAuthConfigurationError(error);
-  }
-}
-function planGitHubRegistryAuthFiles(filePaths, credential) {
-  const uniquePaths = [...new Set(filePaths.map((filePath) => path.resolve(filePath)))];
-  return uniquePaths.map((filePath) => ({ filePath, content: registryAuthFileContent(filePath, credential) }));
-}
-function updateGitHubRegistryAuthFile(filePath, credential) {
-  configureGitHubRegistryAuthFilesWithHook([filePath], credential);
-}
-function configureGitHubRegistryAuthFiles(filePaths, credential) {
-  configureGitHubRegistryAuthFilesWithHook(filePaths, credential);
-}
-const registryAuthTestHarness = {
-  fsyncDirectory,
-  atomicReplacePrivateFile(filePath, content, beforeRename) {
-    atomicReplacePrivateFile(filePath, content, beforeRename);
-  },
-  configureFiles(filePaths, credential, beforeRename) {
-    configureGitHubRegistryAuthFilesWithHook(filePaths, credential, beforeRename);
-  }
-};
-export {
-  APP_MANAGED_GITHUB_REGISTRY,
-  RegistryAuthConfigurationError,
-  configureGitHubRegistryAuthFiles,
-  planGitHubRegistryAuthFiles,
-  preparePrivateAuthFileGeneration,
-  registryAuthHasAppManagedGitHubCredential,
-  registryAuthTestHarness,
-  updateGitHubRegistryAuthFile
-};

package/dist/mjs/repository-transition-policy.mjs

@@ -1,22 +0,0 @@
-function assertRepositoryTransitionState(project) {
-  if (project.repositoryTransitionId !== null && (typeof project.repositoryTransitionId !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(project.repositoryTransitionId)) || typeof project.executionDisabled !== "boolean" || typeof project.mirrorWritesDisabled !== "boolean") {
-    throw new Error(`Project ${project.projectId} has invalid repository transition state`);
-  }
-}
-function assertRepositoryExecutionEnabled(project) {
-  if (project.executionDisabled) {
-    throw new Error(`Project ${project.projectId} execution is disabled while its repository connection is transitioning`);
-  }
-}
-function repositoryMirrorWritesAllowed(project) {
-  return project?.executionDisabled !== true && project?.mirrorWritesDisabled !== true;
-}
-function enabledRepositoryTransitionRequiresReseed(input) {
-  return !input.project.executionDisabled && (!input.lastEnabled.known || input.lastEnabled.transitionId !== input.project.repositoryTransitionId);
-}
-export {
-  assertRepositoryExecutionEnabled,
-  assertRepositoryTransitionState,
-  enabledRepositoryTransitionRequiresReseed,
-  repositoryMirrorWritesAllowed
-};

package/dist/mjs/runtime-version.mjs

@@ -1,54 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-const WORKER_PACKAGE_NAME = "@ricsam/r5d-worker";
-function readVersionFile(filePath) {
-  try {
-    const version = fs.readFileSync(filePath, "utf8").trim();
-    return version || null;
-  } catch {
-    return null;
-  }
-}
-function readInstalledPackageVersion(packageJsonPath) {
-  try {
-    const parsed = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
-    if (parsed.name === WORKER_PACKAGE_NAME && typeof parsed.version === "string" && parsed.version.trim()) {
-      return parsed.version.trim();
-    }
-  } catch {
-    return null;
-  }
-  return null;
-}
-function resolveEntrypointPath(entrypoint) {
-  const resolved = path.resolve(entrypoint);
-  try {
-    return fs.realpathSync.native(resolved);
-  } catch {
-    return resolved;
-  }
-}
-function readWorkerVersion() {
-  const entrypoint = process.argv[1] ? resolveEntrypointPath(process.argv[1]) : null;
-  let current = entrypoint ? path.dirname(entrypoint) : process.cwd();
-  for (let index = 0; index < 12; index += 1) {
-    const packageVersion = readInstalledPackageVersion(path.join(current, "package.json"));
-    if (packageVersion) {
-      return packageVersion;
-    }
-    const sourceVersion = readVersionFile(path.join(current, "VERSION.txt"));
-    if (sourceVersion && path.basename(current) === "packages") {
-      return sourceVersion;
-    }
-    const parent = path.dirname(current);
-    if (parent === current) {
-      break;
-    }
-    current = parent;
-  }
-  return "unknown";
-}
-const WORKER_RUNTIME_VERSION = readWorkerVersion();
-export {
-  WORKER_RUNTIME_VERSION
-};

package/dist/mjs/session-file-mutations.mjs

@@ -1,37 +0,0 @@
-class SessionFileMutationTracker {
-  inFlight = /* @__PURE__ */ new Map();
-  /** Register a started mutation; it is forgotten when it settles, however it settles. */
-  track(sessionId, mutation) {
-    let mutations = this.inFlight.get(sessionId);
-    if (!mutations) {
-      mutations = /* @__PURE__ */ new Set();
-      this.inFlight.set(sessionId, mutations);
-    }
-    mutations.add(mutation);
-    const forget = () => {
-      const current = this.inFlight.get(sessionId);
-      if (!current) return;
-      current.delete(mutation);
-      if (current.size === 0) this.inFlight.delete(sessionId);
-    };
-    mutation.then(forget, forget);
-    return mutation;
-  }
-  count(sessionId) {
-    return this.inFlight.get(sessionId)?.size ?? 0;
-  }
-  /**
-   * Resolves once every mutation tracked for the session at the time of the
-   * call has settled. Mutations started later are not joined: the session's
-   * cancellation marker, recorded before this is awaited, makes their
-   * admission recheck refuse them.
-   */
-  settled(sessionId) {
-    const pending = [...this.inFlight.get(sessionId) ?? []];
-    if (pending.length === 0) return Promise.resolve();
-    return Promise.allSettled(pending).then(() => void 0);
-  }
-}
-export {
-  SessionFileMutationTracker
-};