@ricsam/r5d-worker 0.0.78 → 0.0.80

package/dist/cjs/registry-auth.cjs

@@ -0,0 +1,310 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var registry_auth_exports = {};
+__export(registry_auth_exports, {
+  APP_MANAGED_GITHUB_REGISTRY: () => APP_MANAGED_GITHUB_REGISTRY,
+  RegistryAuthConfigurationError: () => RegistryAuthConfigurationError,
+  configureGitHubRegistryAuthFiles: () => configureGitHubRegistryAuthFiles,
+  planGitHubRegistryAuthFiles: () => planGitHubRegistryAuthFiles,
+  preparePrivateAuthFileGeneration: () => preparePrivateAuthFileGeneration,
+  registryAuthHasAppManagedGitHubCredential: () => registryAuthHasAppManagedGitHubCredential,
+  registryAuthTestHarness: () => registryAuthTestHarness,
+  updateGitHubRegistryAuthFile: () => updateGitHubRegistryAuthFile
+});
+module.exports = __toCommonJS(registry_auth_exports);
+var import_node_fs = __toESM(require("node:fs"), 1);
+var import_node_path = __toESM(require("node:path"), 1);
+const APP_MANAGED_GITHUB_REGISTRY = "ghcr.io";
+class RegistryAuthConfigurationError extends Error {
+  constructor(cause) {
+    super("Could not authoritatively configure GitHub registry authentication", { cause });
+    this.name = "RegistryAuthConfigurationError";
+  }
+}
+function isJsonObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function lstatIfExists(filePath) {
+  try {
+    return import_node_fs.default.lstatSync(filePath);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+function readRegistryAuthConfig(filePath) {
+  const stat = lstatIfExists(filePath);
+  if (!stat) return null;
+  if (stat.isSymbolicLink() || !stat.isFile()) throw new Error(`Registry auth config must be a regular file: ${filePath}`);
+  let parsed;
+  try {
+    parsed = JSON.parse(import_node_fs.default.readFileSync(filePath, "utf8"));
+  } catch (error) {
+    throw new Error(`Registry auth config is not valid JSON: ${filePath}`, { cause: error });
+  }
+  if (!isJsonObject(parsed)) throw new Error(`Registry auth config must contain a JSON object: ${filePath}`);
+  return parsed;
+}
+function registryAuthHasAppManagedGitHubCredential(filePath) {
+  const config = readRegistryAuthConfig(filePath);
+  if (!config) return false;
+  if (config.auths === void 0) return false;
+  if (!isJsonObject(config.auths)) throw new Error(`Registry auth config has an invalid auths object: ${filePath}`);
+  return Object.prototype.hasOwnProperty.call(config.auths, APP_MANAGED_GITHUB_REGISTRY);
+}
+function fsyncDirectory(directory, dependencies = {
+  platform: process.platform,
+  open: (target) => import_node_fs.default.openSync(target, "r"),
+  fsync: import_node_fs.default.fsyncSync,
+  close: import_node_fs.default.closeSync
+}) {
+  if (dependencies.platform === "win32") return;
+  const descriptor = dependencies.open(directory);
+  try {
+    dependencies.fsync(descriptor);
+  } finally {
+    dependencies.close(descriptor);
+  }
+}
+function ensurePrivateParentDirectory(filePath) {
+  const directory = import_node_path.default.dirname(filePath);
+  let existingAncestor = directory;
+  while (!lstatIfExists(existingAncestor)) {
+    const parent = import_node_path.default.dirname(existingAncestor);
+    if (parent === existingAncestor) throw new Error(`Registry auth parent has no existing ancestor: ${directory}`);
+    existingAncestor = parent;
+  }
+  const ancestorStat = lstatIfExists(existingAncestor);
+  if (!ancestorStat || ancestorStat.isSymbolicLink() || !ancestorStat.isDirectory()) {
+    throw new Error(`Registry auth parent must descend from a real directory: ${directory}`);
+  }
+  import_node_fs.default.mkdirSync(directory, { recursive: true, mode: 448 });
+  let current = directory;
+  while (true) {
+    const stat = lstatIfExists(current);
+    if (!stat || stat.isSymbolicLink() || !stat.isDirectory()) {
+      throw new Error(`Registry auth parent must be a real directory: ${current}`);
+    }
+    fsyncDirectory(current);
+    if (current === existingAncestor) break;
+    current = import_node_path.default.dirname(current);
+  }
+}
+function stagePrivateFile(filePath, content) {
+  ensurePrivateParentDirectory(filePath);
+  const temporaryPath = import_node_path.default.join(import_node_path.default.dirname(filePath), `.${import_node_path.default.basename(filePath)}.r5d-auth.${process.pid}.${crypto.randomUUID()}.tmp`);
+  let descriptor;
+  try {
+    descriptor = import_node_fs.default.openSync(temporaryPath, "wx", 384);
+    import_node_fs.default.writeFileSync(descriptor, content, "utf8");
+    import_node_fs.default.fsyncSync(descriptor);
+    import_node_fs.default.closeSync(descriptor);
+    descriptor = void 0;
+    import_node_fs.default.chmodSync(temporaryPath, 384);
+    return { filePath, temporaryPath };
+  } catch (error) {
+    if (descriptor !== void 0) import_node_fs.default.closeSync(descriptor);
+    import_node_fs.default.rmSync(temporaryPath, { force: true });
+    throw error;
+  }
+}
+function commitStagedPrivateFile(staged, beforeRename) {
+  beforeRename?.();
+  import_node_fs.default.renameSync(staged.temporaryPath, staged.filePath);
+  import_node_fs.default.chmodSync(staged.filePath, 384);
+  fsyncDirectory(import_node_path.default.dirname(staged.filePath));
+}
+function discardStagedPrivateFile(staged) {
+  import_node_fs.default.rmSync(staged.temporaryPath, { force: true });
+}
+function cleanupAbandonedStagedFiles(filePath) {
+  const directory = import_node_path.default.dirname(filePath);
+  const prefix = `.${import_node_path.default.basename(filePath)}.r5d-auth.`;
+  let entries;
+  try {
+    entries = import_node_fs.default.readdirSync(directory);
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw error;
+  }
+  let removed = false;
+  for (const name of entries) {
+    if (!name.startsWith(prefix) || !name.endsWith(".tmp")) continue;
+    const candidate = import_node_path.default.join(directory, name);
+    const stat = import_node_fs.default.lstatSync(candidate);
+    if (stat.isSymbolicLink() || !stat.isFile()) {
+      throw new Error(`Registry auth staging artifact must be a regular file: ${candidate}`);
+    }
+    import_node_fs.default.rmSync(candidate);
+    removed = true;
+  }
+  if (removed) fsyncDirectory(directory);
+}
+function atomicReplacePrivateFile(filePath, content, beforeRename) {
+  const staged = stagePrivateFile(filePath, content);
+  try {
+    commitStagedPrivateFile(staged, beforeRename);
+  } finally {
+    discardStagedPrivateFile(staged);
+  }
+}
+function preparePrivateAuthFileGeneration(updates) {
+  try {
+    const desiredByPath = /* @__PURE__ */ new Map();
+    for (const update of updates) {
+      const filePath = import_node_path.default.resolve(update.filePath);
+      const existing = desiredByPath.get(filePath);
+      const desired = { content: update.content, allowSymlinkRemoval: update.allowSymlinkRemoval === true };
+      if (existing && (existing.content !== desired.content || existing.allowSymlinkRemoval !== desired.allowSymlinkRemoval)) {
+        throw new Error(`Conflicting desired auth content for ${filePath}`);
+      }
+      desiredByPath.set(filePath, desired);
+    }
+    const changes = [];
+    const stagedFiles = [];
+    try {
+      for (const [filePath, desired] of desiredByPath) {
+        const { content, allowSymlinkRemoval } = desired;
+        cleanupAbandonedStagedFiles(filePath);
+        const status = lstatIfExists(filePath);
+        if (status && (status.isSymbolicLink() ? !(content === null && allowSymlinkRemoval) : !status.isFile())) {
+          throw new Error(`Private auth target must be a regular file: ${filePath}`);
+        }
+        const unchanged = content === null ? !status : Boolean(status && import_node_fs.default.readFileSync(filePath, "utf8") === content && (status.mode & 511) === 384);
+        if (unchanged) continue;
+        if (content === null) {
+          changes.push({ filePath, content });
+          continue;
+        }
+        const staged = stagePrivateFile(filePath, content);
+        stagedFiles.push(staged);
+        changes.push({ filePath, content, staged });
+      }
+    } catch (error) {
+      for (const staged of stagedFiles) discardStagedPrivateFile(staged);
+      throw error;
+    }
+    let finished = false;
+    const discard = () => {
+      for (const staged of stagedFiles) discardStagedPrivateFile(staged);
+    };
+    return {
+      changed: changes.length > 0,
+      commit(beforeMutation) {
+        if (finished) throw new Error("Private auth generation has already been finalized");
+        finished = true;
+        try {
+          changes.forEach((change, index) => {
+            beforeMutation?.(change.filePath, index);
+            if (change.content === null) {
+              import_node_fs.default.unlinkSync(change.filePath);
+              fsyncDirectory(import_node_path.default.dirname(change.filePath));
+              return;
+            }
+            if (!change.staged) throw new Error(`Private auth replacement was not staged: ${change.filePath}`);
+            commitStagedPrivateFile(change.staged);
+          });
+        } catch (error) {
+          throw error instanceof RegistryAuthConfigurationError ? error : new RegistryAuthConfigurationError(error);
+        } finally {
+          discard();
+        }
+      },
+      discard() {
+        if (finished) return;
+        finished = true;
+        discard();
+      }
+    };
+  } catch (error) {
+    throw error instanceof RegistryAuthConfigurationError ? error : new RegistryAuthConfigurationError(error);
+  }
+}
+function registryAuthFileContent(filePath, credential) {
+  if (credential && credential.registry !== APP_MANAGED_GITHUB_REGISTRY) {
+    throw new Error(`Unsupported app-managed registry: ${credential.registry}`);
+  }
+  const existing = readRegistryAuthConfig(filePath);
+  if (!existing && !credential) return null;
+  const config = { ...existing ?? {} };
+  const existingAuths = config.auths;
+  if (existingAuths !== void 0 && !isJsonObject(existingAuths)) {
+    throw new Error(`Registry auth config has an invalid auths object: ${filePath}`);
+  }
+  const auths = { ...existingAuths ?? {} };
+  delete auths[APP_MANAGED_GITHUB_REGISTRY];
+  if (credential) {
+    auths[APP_MANAGED_GITHUB_REGISTRY] = {
+      username: credential.username,
+      password: credential.token,
+      auth: Buffer.from(`${credential.username}:${credential.token}`).toString("base64")
+    };
+  }
+  config.auths = auths;
+  return `${JSON.stringify(config, null, 2)}
+`;
+}
+function configureGitHubRegistryAuthFilesWithHook(filePaths, credential, beforeRename) {
+  try {
+    const prepared = preparePrivateAuthFileGeneration(planGitHubRegistryAuthFiles(filePaths, credential));
+    prepared.commit(beforeRename);
+  } catch (error) {
+    throw error instanceof RegistryAuthConfigurationError ? error : new RegistryAuthConfigurationError(error);
+  }
+}
+function planGitHubRegistryAuthFiles(filePaths, credential) {
+  const uniquePaths = [...new Set(filePaths.map((filePath) => import_node_path.default.resolve(filePath)))];
+  return uniquePaths.map((filePath) => ({ filePath, content: registryAuthFileContent(filePath, credential) }));
+}
+function updateGitHubRegistryAuthFile(filePath, credential) {
+  configureGitHubRegistryAuthFilesWithHook([filePath], credential);
+}
+function configureGitHubRegistryAuthFiles(filePaths, credential) {
+  configureGitHubRegistryAuthFilesWithHook(filePaths, credential);
+}
+const registryAuthTestHarness = {
+  fsyncDirectory,
+  atomicReplacePrivateFile(filePath, content, beforeRename) {
+    atomicReplacePrivateFile(filePath, content, beforeRename);
+  },
+  configureFiles(filePaths, credential, beforeRename) {
+    configureGitHubRegistryAuthFilesWithHook(filePaths, credential, beforeRename);
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  APP_MANAGED_GITHUB_REGISTRY,
+  RegistryAuthConfigurationError,
+  configureGitHubRegistryAuthFiles,
+  planGitHubRegistryAuthFiles,
+  preparePrivateAuthFileGeneration,
+  registryAuthHasAppManagedGitHubCredential,
+  registryAuthTestHarness,
+  updateGitHubRegistryAuthFile
+});

package/dist/cjs/repository-transition-policy.cjs

@@ -0,0 +1,49 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var repository_transition_policy_exports = {};
+__export(repository_transition_policy_exports, {
+  assertRepositoryExecutionEnabled: () => assertRepositoryExecutionEnabled,
+  assertRepositoryTransitionState: () => assertRepositoryTransitionState,
+  enabledRepositoryTransitionRequiresReseed: () => enabledRepositoryTransitionRequiresReseed,
+  repositoryMirrorWritesAllowed: () => repositoryMirrorWritesAllowed
+});
+module.exports = __toCommonJS(repository_transition_policy_exports);
+function assertRepositoryTransitionState(project) {
+  if (project.repositoryTransitionId !== null && (typeof project.repositoryTransitionId !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(project.repositoryTransitionId)) || typeof project.executionDisabled !== "boolean" || typeof project.mirrorWritesDisabled !== "boolean") {
+    throw new Error(`Project ${project.projectId} has invalid repository transition state`);
+  }
+}
+function assertRepositoryExecutionEnabled(project) {
+  if (project.executionDisabled) {
+    throw new Error(`Project ${project.projectId} execution is disabled while its repository connection is transitioning`);
+  }
+}
+function repositoryMirrorWritesAllowed(project) {
+  return project?.executionDisabled !== true && project?.mirrorWritesDisabled !== true;
+}
+function enabledRepositoryTransitionRequiresReseed(input) {
+  return !input.project.executionDisabled && (!input.lastEnabled.known || input.lastEnabled.transitionId !== input.project.repositoryTransitionId);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  assertRepositoryExecutionEnabled,
+  assertRepositoryTransitionState,
+  enabledRepositoryTransitionRequiresReseed,
+  repositoryMirrorWritesAllowed
+});

package/dist/cjs/supervisor.cjs

@@ -18,6 +18,7 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var supervisor_exports = {};
 __export(supervisor_exports, {
+  WORKER_CREDENTIAL_RESTART_EXIT_CODE: () => WORKER_CREDENTIAL_RESTART_EXIT_CODE,
   WORKER_RECONNECT_DELAY_MS: () => WORKER_RECONNECT_DELAY_MS,
   WORKER_RECONNECT_EXIT_CODE: () => WORKER_RECONNECT_EXIT_CODE,
   WORKER_RELOAD_EXIT_CODE: () => WORKER_RELOAD_EXIT_CODE,
@@ -26,20 +27,33 @@ __export(supervisor_exports, {
   superviseWorkerRuntime: () => superviseWorkerRuntime
 });
 module.exports = __toCommonJS(supervisor_exports);
+var import_node_os = require("node:os");
+var import_process_tree = require("./process-tree.cjs");
 const WORKER_RUNTIME_ENV = "R5D_WORKER_INTERNAL_RUNTIME";
 const WORKER_RELOAD_EXIT_CODE = 75;
 const WORKER_RECONNECT_EXIT_CODE = 76;
+const WORKER_CREDENTIAL_RESTART_EXIT_CODE = 77;
 const WORKER_RECONNECT_DELAY_MS = 2e3;
+const SUPERVISOR_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
 function defaultRuntimeSpawner(argv, options) {
   return Bun.spawn(argv, options);
 }
 function defaultRuntimeDelay(delayMs) {
   return new Promise((resolve) => setTimeout(resolve, delayMs));
 }
+async function defaultRuntimeReaper(runtime) {
+  await (0, import_process_tree.terminateProcessTree)(runtime);
+}
 function isRetryableWorkerServerStatus(status) {
   return status === 408 || status === 429 || status >= 500;
 }
-async function superviseWorkerRuntime(argv, env = process.env, spawnRuntime = defaultRuntimeSpawner, waitBeforeReconnect = defaultRuntimeDelay) {
+function signalExitCode(signal) {
+  return 128 + (osSignalNumber(signal) ?? 1);
+}
+function osSignalNumber(signal) {
+  return import_node_os.constants.signals[signal];
+}
+async function superviseWorkerRuntime(argv, env = process.env, spawnRuntime = defaultRuntimeSpawner, waitBeforeReconnect = defaultRuntimeDelay, reapCredentialRuntime = defaultRuntimeReaper) {
   if (!process.argv[1]) {
     throw new Error("Cannot locate the r5d-worker entrypoint");
   }
@@ -48,27 +62,64 @@ async function superviseWorkerRuntime(argv, env = process.env, spawnRuntime = de
       stdin: "inherit",
       stdout: "inherit",
       stderr: "inherit",
+      detached: true,
       env: {
         ...env,
         [WORKER_RUNTIME_ENV]: "1"
       }
     });
-    const exitCode = await runtime.exited;
-    if (exitCode === WORKER_RELOAD_EXIT_CODE) {
-      process.stdout.write("[r5d-worker] activating updated worker runtime\n");
-      continue;
-    }
-    if (exitCode === WORKER_RECONNECT_EXIT_CODE) {
-      process.stderr.write(`[r5d-worker] reconnecting in ${WORKER_RECONNECT_DELAY_MS}ms
+    let receivedSignal;
+    let resolveSignal;
+    const signalReceived = new Promise((resolve) => {
+      resolveSignal = resolve;
+    });
+    const handlers = SUPERVISOR_SIGNALS.map((signal) => {
+      const handler = () => {
+        if (receivedSignal) return;
+        receivedSignal = signal;
+        resolveSignal?.(signal);
+      };
+      process.on(signal, handler);
+      return { signal, handler };
+    });
+    try {
+      const outcome = await Promise.race([
+        runtime.exited.then((exitCode2) => ({ type: "exit", exitCode: exitCode2 })),
+        signalReceived.then((signal) => ({ type: "signal", signal }))
+      ]);
+      try {
+        await reapCredentialRuntime(runtime);
+      } catch (error) {
+        process.stderr.write(
+          `[r5d-worker] runtime restart/exit aborted because process-group reaping failed: ${error instanceof Error ? error.message : String(error)}
+`
+        );
+        return 1;
+      }
+      if (outcome.type === "signal" || receivedSignal) {
+        return signalExitCode(outcome.type === "signal" ? outcome.signal : receivedSignal);
+      }
+      const { exitCode } = outcome;
+      if (exitCode === WORKER_RELOAD_EXIT_CODE) {
+        process.stdout.write("[r5d-worker] activating updated worker runtime\n");
+        continue;
+      }
+      if (exitCode === WORKER_RECONNECT_EXIT_CODE) {
+        process.stderr.write(`[r5d-worker] reconnecting in ${WORKER_RECONNECT_DELAY_MS}ms
 `);
-      await waitBeforeReconnect(WORKER_RECONNECT_DELAY_MS);
-      continue;
+        await waitBeforeReconnect(WORKER_RECONNECT_DELAY_MS);
+        if (receivedSignal) return signalExitCode(receivedSignal);
+        continue;
+      }
+      return exitCode;
+    } finally {
+      for (const { signal, handler } of handlers) process.off(signal, handler);
     }
-    return exitCode;
   }
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  WORKER_CREDENTIAL_RESTART_EXIT_CODE,
   WORKER_RECONNECT_DELAY_MS,
   WORKER_RECONNECT_EXIT_CODE,
   WORKER_RELOAD_EXIT_CODE,