@ricsam/r5d-worker 0.0.78 → 0.0.79

package/dist/mjs/registry-auth.mjs

@@ -0,0 +1,269 @@
+import fs from "node:fs";
+import path from "node:path";
+const APP_MANAGED_GITHUB_REGISTRY = "ghcr.io";
+class RegistryAuthConfigurationError extends Error {
+  constructor(cause) {
+    super("Could not authoritatively configure GitHub registry authentication", { cause });
+    this.name = "RegistryAuthConfigurationError";
+  }
+}
+function isJsonObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function lstatIfExists(filePath) {
+  try {
+    return fs.lstatSync(filePath);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+function readRegistryAuthConfig(filePath) {
+  const stat = lstatIfExists(filePath);
+  if (!stat) return null;
+  if (stat.isSymbolicLink() || !stat.isFile()) throw new Error(`Registry auth config must be a regular file: ${filePath}`);
+  let parsed;
+  try {
+    parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
+  } catch (error) {
+    throw new Error(`Registry auth config is not valid JSON: ${filePath}`, { cause: error });
+  }
+  if (!isJsonObject(parsed)) throw new Error(`Registry auth config must contain a JSON object: ${filePath}`);
+  return parsed;
+}
+function registryAuthHasAppManagedGitHubCredential(filePath) {
+  const config = readRegistryAuthConfig(filePath);
+  if (!config) return false;
+  if (config.auths === void 0) return false;
+  if (!isJsonObject(config.auths)) throw new Error(`Registry auth config has an invalid auths object: ${filePath}`);
+  return Object.prototype.hasOwnProperty.call(config.auths, APP_MANAGED_GITHUB_REGISTRY);
+}
+function fsyncDirectory(directory, dependencies = {
+  platform: process.platform,
+  open: (target) => fs.openSync(target, "r"),
+  fsync: fs.fsyncSync,
+  close: fs.closeSync
+}) {
+  if (dependencies.platform === "win32") return;
+  const descriptor = dependencies.open(directory);
+  try {
+    dependencies.fsync(descriptor);
+  } finally {
+    dependencies.close(descriptor);
+  }
+}
+function ensurePrivateParentDirectory(filePath) {
+  const directory = path.dirname(filePath);
+  let existingAncestor = directory;
+  while (!lstatIfExists(existingAncestor)) {
+    const parent = path.dirname(existingAncestor);
+    if (parent === existingAncestor) throw new Error(`Registry auth parent has no existing ancestor: ${directory}`);
+    existingAncestor = parent;
+  }
+  const ancestorStat = lstatIfExists(existingAncestor);
+  if (!ancestorStat || ancestorStat.isSymbolicLink() || !ancestorStat.isDirectory()) {
+    throw new Error(`Registry auth parent must descend from a real directory: ${directory}`);
+  }
+  fs.mkdirSync(directory, { recursive: true, mode: 448 });
+  let current = directory;
+  while (true) {
+    const stat = lstatIfExists(current);
+    if (!stat || stat.isSymbolicLink() || !stat.isDirectory()) {
+      throw new Error(`Registry auth parent must be a real directory: ${current}`);
+    }
+    fsyncDirectory(current);
+    if (current === existingAncestor) break;
+    current = path.dirname(current);
+  }
+}
+function stagePrivateFile(filePath, content) {
+  ensurePrivateParentDirectory(filePath);
+  const temporaryPath = path.join(path.dirname(filePath), `.${path.basename(filePath)}.r5d-auth.${process.pid}.${crypto.randomUUID()}.tmp`);
+  let descriptor;
+  try {
+    descriptor = fs.openSync(temporaryPath, "wx", 384);
+    fs.writeFileSync(descriptor, content, "utf8");
+    fs.fsyncSync(descriptor);
+    fs.closeSync(descriptor);
+    descriptor = void 0;
+    fs.chmodSync(temporaryPath, 384);
+    return { filePath, temporaryPath };
+  } catch (error) {
+    if (descriptor !== void 0) fs.closeSync(descriptor);
+    fs.rmSync(temporaryPath, { force: true });
+    throw error;
+  }
+}
+function commitStagedPrivateFile(staged, beforeRename) {
+  beforeRename?.();
+  fs.renameSync(staged.temporaryPath, staged.filePath);
+  fs.chmodSync(staged.filePath, 384);
+  fsyncDirectory(path.dirname(staged.filePath));
+}
+function discardStagedPrivateFile(staged) {
+  fs.rmSync(staged.temporaryPath, { force: true });
+}
+function cleanupAbandonedStagedFiles(filePath) {
+  const directory = path.dirname(filePath);
+  const prefix = `.${path.basename(filePath)}.r5d-auth.`;
+  let entries;
+  try {
+    entries = fs.readdirSync(directory);
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw error;
+  }
+  let removed = false;
+  for (const name of entries) {
+    if (!name.startsWith(prefix) || !name.endsWith(".tmp")) continue;
+    const candidate = path.join(directory, name);
+    const stat = fs.lstatSync(candidate);
+    if (stat.isSymbolicLink() || !stat.isFile()) {
+      throw new Error(`Registry auth staging artifact must be a regular file: ${candidate}`);
+    }
+    fs.rmSync(candidate);
+    removed = true;
+  }
+  if (removed) fsyncDirectory(directory);
+}
+function atomicReplacePrivateFile(filePath, content, beforeRename) {
+  const staged = stagePrivateFile(filePath, content);
+  try {
+    commitStagedPrivateFile(staged, beforeRename);
+  } finally {
+    discardStagedPrivateFile(staged);
+  }
+}
+function preparePrivateAuthFileGeneration(updates) {
+  try {
+    const desiredByPath = /* @__PURE__ */ new Map();
+    for (const update of updates) {
+      const filePath = path.resolve(update.filePath);
+      const existing = desiredByPath.get(filePath);
+      const desired = { content: update.content, allowSymlinkRemoval: update.allowSymlinkRemoval === true };
+      if (existing && (existing.content !== desired.content || existing.allowSymlinkRemoval !== desired.allowSymlinkRemoval)) {
+        throw new Error(`Conflicting desired auth content for ${filePath}`);
+      }
+      desiredByPath.set(filePath, desired);
+    }
+    const changes = [];
+    const stagedFiles = [];
+    try {
+      for (const [filePath, desired] of desiredByPath) {
+        const { content, allowSymlinkRemoval } = desired;
+        cleanupAbandonedStagedFiles(filePath);
+        const status = lstatIfExists(filePath);
+        if (status && (status.isSymbolicLink() ? !(content === null && allowSymlinkRemoval) : !status.isFile())) {
+          throw new Error(`Private auth target must be a regular file: ${filePath}`);
+        }
+        const unchanged = content === null ? !status : Boolean(status && fs.readFileSync(filePath, "utf8") === content && (status.mode & 511) === 384);
+        if (unchanged) continue;
+        if (content === null) {
+          changes.push({ filePath, content });
+          continue;
+        }
+        const staged = stagePrivateFile(filePath, content);
+        stagedFiles.push(staged);
+        changes.push({ filePath, content, staged });
+      }
+    } catch (error) {
+      for (const staged of stagedFiles) discardStagedPrivateFile(staged);
+      throw error;
+    }
+    let finished = false;
+    const discard = () => {
+      for (const staged of stagedFiles) discardStagedPrivateFile(staged);
+    };
+    return {
+      changed: changes.length > 0,
+      commit(beforeMutation) {
+        if (finished) throw new Error("Private auth generation has already been finalized");
+        finished = true;
+        try {
+          changes.forEach((change, index) => {
+            beforeMutation?.(change.filePath, index);
+            if (change.content === null) {
+              fs.unlinkSync(change.filePath);
+              fsyncDirectory(path.dirname(change.filePath));
+              return;
+            }
+            if (!change.staged) throw new Error(`Private auth replacement was not staged: ${change.filePath}`);
+            commitStagedPrivateFile(change.staged);
+          });
+        } catch (error) {
+          throw error instanceof RegistryAuthConfigurationError ? error : new RegistryAuthConfigurationError(error);
+        } finally {
+          discard();
+        }
+      },
+      discard() {
+        if (finished) return;
+        finished = true;
+        discard();
+      }
+    };
+  } catch (error) {
+    throw error instanceof RegistryAuthConfigurationError ? error : new RegistryAuthConfigurationError(error);
+  }
+}
+function registryAuthFileContent(filePath, credential) {
+  if (credential && credential.registry !== APP_MANAGED_GITHUB_REGISTRY) {
+    throw new Error(`Unsupported app-managed registry: ${credential.registry}`);
+  }
+  const existing = readRegistryAuthConfig(filePath);
+  if (!existing && !credential) return null;
+  const config = { ...existing ?? {} };
+  const existingAuths = config.auths;
+  if (existingAuths !== void 0 && !isJsonObject(existingAuths)) {
+    throw new Error(`Registry auth config has an invalid auths object: ${filePath}`);
+  }
+  const auths = { ...existingAuths ?? {} };
+  delete auths[APP_MANAGED_GITHUB_REGISTRY];
+  if (credential) {
+    auths[APP_MANAGED_GITHUB_REGISTRY] = {
+      username: credential.username,
+      password: credential.token,
+      auth: Buffer.from(`${credential.username}:${credential.token}`).toString("base64")
+    };
+  }
+  config.auths = auths;
+  return `${JSON.stringify(config, null, 2)}
+`;
+}
+function configureGitHubRegistryAuthFilesWithHook(filePaths, credential, beforeRename) {
+  try {
+    const prepared = preparePrivateAuthFileGeneration(planGitHubRegistryAuthFiles(filePaths, credential));
+    prepared.commit(beforeRename);
+  } catch (error) {
+    throw error instanceof RegistryAuthConfigurationError ? error : new RegistryAuthConfigurationError(error);
+  }
+}
+function planGitHubRegistryAuthFiles(filePaths, credential) {
+  const uniquePaths = [...new Set(filePaths.map((filePath) => path.resolve(filePath)))];
+  return uniquePaths.map((filePath) => ({ filePath, content: registryAuthFileContent(filePath, credential) }));
+}
+function updateGitHubRegistryAuthFile(filePath, credential) {
+  configureGitHubRegistryAuthFilesWithHook([filePath], credential);
+}
+function configureGitHubRegistryAuthFiles(filePaths, credential) {
+  configureGitHubRegistryAuthFilesWithHook(filePaths, credential);
+}
+const registryAuthTestHarness = {
+  fsyncDirectory,
+  atomicReplacePrivateFile(filePath, content, beforeRename) {
+    atomicReplacePrivateFile(filePath, content, beforeRename);
+  },
+  configureFiles(filePaths, credential, beforeRename) {
+    configureGitHubRegistryAuthFilesWithHook(filePaths, credential, beforeRename);
+  }
+};
+export {
+  APP_MANAGED_GITHUB_REGISTRY,
+  RegistryAuthConfigurationError,
+  configureGitHubRegistryAuthFiles,
+  planGitHubRegistryAuthFiles,
+  preparePrivateAuthFileGeneration,
+  registryAuthHasAppManagedGitHubCredential,
+  registryAuthTestHarness,
+  updateGitHubRegistryAuthFile
+};

package/dist/mjs/repository-transition-policy.mjs

@@ -0,0 +1,22 @@
+function assertRepositoryTransitionState(project) {
+  if (project.repositoryTransitionId !== null && (typeof project.repositoryTransitionId !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(project.repositoryTransitionId)) || typeof project.executionDisabled !== "boolean" || typeof project.mirrorWritesDisabled !== "boolean") {
+    throw new Error(`Project ${project.projectId} has invalid repository transition state`);
+  }
+}
+function assertRepositoryExecutionEnabled(project) {
+  if (project.executionDisabled) {
+    throw new Error(`Project ${project.projectId} execution is disabled while its repository connection is transitioning`);
+  }
+}
+function repositoryMirrorWritesAllowed(project) {
+  return project?.executionDisabled !== true && project?.mirrorWritesDisabled !== true;
+}
+function enabledRepositoryTransitionRequiresReseed(input) {
+  return !input.project.executionDisabled && (!input.lastEnabled.known || input.lastEnabled.transitionId !== input.project.repositoryTransitionId);
+}
+export {
+  assertRepositoryExecutionEnabled,
+  assertRepositoryTransitionState,
+  enabledRepositoryTransitionRequiresReseed,
+  repositoryMirrorWritesAllowed
+};

package/dist/mjs/supervisor.mjs

@@ -1,17 +1,30 @@
+import { constants as osConstants } from "node:os";
+import { terminateProcessTree } from "./process-tree.mjs";
 const WORKER_RUNTIME_ENV = "R5D_WORKER_INTERNAL_RUNTIME";
 const WORKER_RELOAD_EXIT_CODE = 75;
 const WORKER_RECONNECT_EXIT_CODE = 76;
+const WORKER_CREDENTIAL_RESTART_EXIT_CODE = 77;
 const WORKER_RECONNECT_DELAY_MS = 2e3;
+const SUPERVISOR_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
 function defaultRuntimeSpawner(argv, options) {
   return Bun.spawn(argv, options);
 }
 function defaultRuntimeDelay(delayMs) {
   return new Promise((resolve) => setTimeout(resolve, delayMs));
 }
+async function defaultRuntimeReaper(runtime) {
+  await terminateProcessTree(runtime);
+}
 function isRetryableWorkerServerStatus(status) {
   return status === 408 || status === 429 || status >= 500;
 }
-async function superviseWorkerRuntime(argv, env = process.env, spawnRuntime = defaultRuntimeSpawner, waitBeforeReconnect = defaultRuntimeDelay) {
+function signalExitCode(signal) {
+  return 128 + (osSignalNumber(signal) ?? 1);
+}
+function osSignalNumber(signal) {
+  return osConstants.signals[signal];
+}
+async function superviseWorkerRuntime(argv, env = process.env, spawnRuntime = defaultRuntimeSpawner, waitBeforeReconnect = defaultRuntimeDelay, reapCredentialRuntime = defaultRuntimeReaper) {
   if (!process.argv[1]) {
     throw new Error("Cannot locate the r5d-worker entrypoint");
   }
@@ -20,26 +33,63 @@ async function superviseWorkerRuntime(argv, env = process.env, spawnRuntime = de
       stdin: "inherit",
       stdout: "inherit",
       stderr: "inherit",
+      detached: true,
       env: {
         ...env,
         [WORKER_RUNTIME_ENV]: "1"
       }
     });
-    const exitCode = await runtime.exited;
-    if (exitCode === WORKER_RELOAD_EXIT_CODE) {
-      process.stdout.write("[r5d-worker] activating updated worker runtime\n");
-      continue;
-    }
-    if (exitCode === WORKER_RECONNECT_EXIT_CODE) {
-      process.stderr.write(`[r5d-worker] reconnecting in ${WORKER_RECONNECT_DELAY_MS}ms
+    let receivedSignal;
+    let resolveSignal;
+    const signalReceived = new Promise((resolve) => {
+      resolveSignal = resolve;
+    });
+    const handlers = SUPERVISOR_SIGNALS.map((signal) => {
+      const handler = () => {
+        if (receivedSignal) return;
+        receivedSignal = signal;
+        resolveSignal?.(signal);
+      };
+      process.on(signal, handler);
+      return { signal, handler };
+    });
+    try {
+      const outcome = await Promise.race([
+        runtime.exited.then((exitCode2) => ({ type: "exit", exitCode: exitCode2 })),
+        signalReceived.then((signal) => ({ type: "signal", signal }))
+      ]);
+      try {
+        await reapCredentialRuntime(runtime);
+      } catch (error) {
+        process.stderr.write(
+          `[r5d-worker] runtime restart/exit aborted because process-group reaping failed: ${error instanceof Error ? error.message : String(error)}
+`
+        );
+        return 1;
+      }
+      if (outcome.type === "signal" || receivedSignal) {
+        return signalExitCode(outcome.type === "signal" ? outcome.signal : receivedSignal);
+      }
+      const { exitCode } = outcome;
+      if (exitCode === WORKER_RELOAD_EXIT_CODE) {
+        process.stdout.write("[r5d-worker] activating updated worker runtime\n");
+        continue;
+      }
+      if (exitCode === WORKER_RECONNECT_EXIT_CODE) {
+        process.stderr.write(`[r5d-worker] reconnecting in ${WORKER_RECONNECT_DELAY_MS}ms
 `);
-      await waitBeforeReconnect(WORKER_RECONNECT_DELAY_MS);
-      continue;
+        await waitBeforeReconnect(WORKER_RECONNECT_DELAY_MS);
+        if (receivedSignal) return signalExitCode(receivedSignal);
+        continue;
+      }
+      return exitCode;
+    } finally {
+      for (const { signal, handler } of handlers) process.off(signal, handler);
     }
-    return exitCode;
   }
 }
 export {
+  WORKER_CREDENTIAL_RESTART_EXIT_CODE,
   WORKER_RECONNECT_DELAY_MS,
   WORKER_RECONNECT_EXIT_CODE,
   WORKER_RELOAD_EXIT_CODE,