@secureci/cli 0.5.1 → 0.7.0

package/dist/runner/expression.js

@@ -8,6 +8,7 @@ exports.withImplicitSuccess = withImplicitSuccess;
 exports.evaluateCondition = evaluateCondition;
 exports.ifEvaluationError = ifEvaluationError;
 exports.validateExpression = validateExpression;
+exports.expressionDataFlow = expressionDataFlow;
 const logger_1 = require("../utils/logger");
 const hash_files_1 = require("./hash-files");
 function createContext(env = {}, inputs = {}, secrets = {}, github = {}, matrix = {}) {
@@ -205,6 +206,50 @@ function star(target) {
     }
     return new FilteredArray([]);
 }
+/**
+ * Data-flow analysis value (see expressionDataFlow): which context data
+ * may end up in a value, instead of the value itself.
+ */
+class Flow {
+    constructor(
+    /** Context paths whose value may be (part of) this value. */
+    values = [], 
+    /** Context paths whose whole subtree may be (part of) it. */
+    trees = []) {
+        this.values = values;
+        this.trees = trees;
+    }
+    /** Everything any of the items carry; non-Flow items carry nothing. */
+    static union(...items) {
+        const flows = items.filter((i) => i instanceof Flow);
+        return new Flow(flows.flatMap((f) => f.values), flows.flatMap((f) => f.trees));
+    }
+    member(key) {
+        return new Flow(this.values.map((p) => [...p, key]), this.trees);
+    }
+}
+/** Functions whose result never carries their arguments' text. */
+const OPAQUE_FUNCTIONS = new Set([
+    'success',
+    'failure',
+    'always',
+    'cancelled',
+    'contains',
+    'startswith',
+    'endswith',
+    'hashfiles'
+]);
+/** The data flow of a function call's result, given its arguments' flows. */
+function flowCall(name, args) {
+    const lower = name.toLowerCase();
+    if (OPAQUE_FUNCTIONS.has(lower))
+        return false;
+    const all = Flow.union(...args);
+    if (lower === 'tojson')
+        return new Flow([], [...all.values, ...all.trees]);
+    // format, join, fromJSON - and, conservatively, anything else.
+    return all;
+}
 function stepsContext(ctx) {
     const steps = {};
     for (const [id, info] of Object.entries(ctx.steps)) {
@@ -341,12 +386,18 @@ function callFunction(name, rawArgs, ctx) {
             throw new Error(`Unrecognized function: '${name}'`);
     }
 }
+/** The `*` filter in `x.*` / `x[*]`, as opposed to a `'*'` key. */
+const STAR = Symbol('*');
 class Parser {
-    /** With a scope, only check names and syntax; nothing is evaluated. */
-    constructor(tokens, ctx, scope) {
+    /**
+     * With a scope, only check names and syntax; with `flow`, compute data
+     * flow (Flow values) instead. Either way nothing is evaluated.
+     */
+    constructor(tokens, ctx, scope, flow = false) {
         this.tokens = tokens;
         this.ctx = ctx;
         this.scope = scope;
+        this.flow = flow;
         this.pos = 0;
     }
     peek() {
@@ -378,7 +429,11 @@ class Parser {
         while (this.isOp('||')) {
             this.next();
             const right = this.parseAnd();
-            left = toBoolean(unwrap(left)) ? left : right;
+            left = this.flow
+                ? Flow.union(left, right)
+                : toBoolean(unwrap(left))
+                    ? left
+                    : right;
         }
         return left;
     }
@@ -387,7 +442,11 @@ class Parser {
         while (this.isOp('&&')) {
             this.next();
             const right = this.parseEquality();
-            left = toBoolean(unwrap(left)) ? right : left;
+            left = this.flow
+                ? Flow.union(left, right)
+                : toBoolean(unwrap(left))
+                    ? right
+                    : left;
         }
         return left;
     }
@@ -433,10 +492,10 @@ class Parser {
                 this.next();
                 const part = this.next();
                 if (part.type === 'star') {
-                    value = star(value);
+                    value = this.access(value, STAR);
                 }
                 else if (part.type === 'ident') {
-                    value = member(value, part.value);
+                    value = this.access(value, part.value);
                 }
                 else {
                     throw new Error('Expected property name after .');
@@ -446,11 +505,11 @@ class Parser {
                 this.next();
                 if (this.peek().type === 'star') {
                     this.next();
-                    value = star(value);
+                    value = this.access(value, STAR);
                 }
                 else {
                     const key = unwrap(this.parseOr());
-                    value = member(value, typeof key === 'number' ? key : toText(key));
+                    value = this.access(value, typeof key === 'number' || key instanceof Flow ? key : toText(key));
                 }
                 this.expect('rbracket');
             }
@@ -459,6 +518,18 @@ class Parser {
             }
         }
     }
+    /** `value.key`, `value[key]`, or `value.*` / `value[*]` for STAR. */
+    access(value, key) {
+        if (this.flow) {
+            if (!(value instanceof Flow))
+                return undefined;
+            // `.*` and a computed key (`x[matrix.field]`) may be any key.
+            return value.member(key === STAR || key instanceof Flow ? '*' : String(key).toLowerCase());
+        }
+        if (key === STAR)
+            return star(value);
+        return member(value, key);
+    }
     parsePrimary() {
         const tok = this.next();
         switch (tok.type) {
@@ -493,6 +564,8 @@ class Parser {
                         checkCall(tok.value, args.length, this.scope.functions);
                         return undefined;
                     }
+                    if (this.flow)
+                        return flowCall(tok.value, args);
                     return callFunction(tok.value, args, this.ctx);
                 }
                 if (this.scope) {
@@ -501,6 +574,8 @@ class Parser {
                     }
                     return undefined;
                 }
+                if (this.flow)
+                    return new Flow([[lower]]);
                 return rootContext(lower, this.ctx);
             }
             default:
@@ -673,4 +748,27 @@ function validateExpression(expr, location) {
         return error instanceof Error ? error.message : String(error);
     }
 }
+/**
+ * Static data-flow analysis of one expression (with or without its `${{ }}`
+ * wrapper), without evaluating it: which context data can reach the
+ * result. Comparisons, `!` and functions returning a boolean or hash
+ * (contains, startsWith, endsWith, status functions, hashFiles) carry no
+ * data; `||`/`&&` carry both operands (they return one of them); format,
+ * join and fromJSON carry their arguments; toJSON carries its argument's
+ * whole subtree. Returns undefined for a syntax error.
+ */
+function expressionDataFlow(expr) {
+    let trimmed = expr.trim();
+    const wrapped = trimmed.match(/^\$\{\{([\s\S]*)\}\}$/);
+    if (wrapped)
+        trimmed = wrapped[1].trim();
+    try {
+        const result = new Parser(tokenize(trimmed), createContext(), undefined, true).parse();
+        const flow = Flow.union(result);
+        return { values: flow.values, trees: flow.trees };
+    }
+    catch {
+        return undefined;
+    }
+}
 //# sourceMappingURL=expression.js.map

package/dist/runner/job-plan.js

@@ -6,6 +6,11 @@ exports.isTruthySetting = isTruthySetting;
 exports.numberSetting = numberSetting;
 exports.matrixValue = matrixValue;
 exports.expandMatrix = expandMatrix;
+exports.parseMatrixFilter = parseMatrixFilter;
+exports.matrixValueText = matrixValueText;
+exports.filterMatrix = filterMatrix;
+exports.noMatrixMatchMessage = noMatrixMatchMessage;
+exports.unknownMatrixKeys = unknownMatrixKeys;
 exports.topologicalJobOrder = topologicalJobOrder;
 const logger_1 = require("../utils/logger");
 const expression_1 = require("./expression");
@@ -25,7 +30,7 @@ function sameValue(a, b) {
 /** `key: value, ...` for a matrix combination's job label. */
 function matrixLabel(values) {
     return Object.entries(values)
-        .map(([k, v]) => `${k}: ${v && typeof v === 'object' ? JSON.stringify(v) : v}`)
+        .map(([k, v]) => `${k}: ${matrixValueText(v)}`)
         .join(', ');
 }
 /** A boolean setting that may be an expression (`continue-on-error`). */
@@ -97,6 +102,58 @@ function expandMatrix(rawMatrix, ctx) {
     combinations.push(...added);
     return combinations.length ? combinations : [{}];
 }
+/**
+ * Parse repeatable `--matrix key:value` arguments. Splits on the first `:`
+ * only, so values may contain colons (`image:node:20-alpine`).
+ */
+function parseMatrixFilter(pairs) {
+    const filter = {};
+    for (const pair of pairs === undefined ? [] : [pairs].flat()) {
+        const separator = pair.indexOf(':');
+        if (separator <= 0) {
+            throw new Error(`Invalid --matrix argument "${pair}": expected key:value`);
+        }
+        const key = pair.slice(0, separator);
+        const value = pair.slice(separator + 1);
+        const values = (filter[key] ?? (filter[key] = []));
+        if (!values.includes(value))
+            values.push(value);
+    }
+    return filter;
+}
+/** A matrix value as text, the way it appears in the job name. */
+function matrixValueText(value) {
+    return value && typeof value === 'object'
+        ? JSON.stringify(value)
+        : String(value);
+}
+/**
+ * Keep the combinations whose value for every filter key the matrix
+ * defines is one of the accepted values (compared as text). Keys the
+ * matrix doesn't define don't apply, so jobs without a matrix are
+ * unaffected; a combination lacking an applied key doesn't match.
+ */
+function filterMatrix(combinations, filter) {
+    const keys = Object.keys(filter).filter((key) => combinations.some((combo) => key in combo));
+    const matches = combinations
+        .map((values, index) => ({ index, values }))
+        .filter(({ values }) => keys.every((key) => key in values && filter[key].includes(matrixValueText(values[key]))));
+    return { keys, matches };
+}
+/** The warning for a matrix job none of whose combinations match. */
+function noMatrixMatchMessage(jobId, filter, combinations) {
+    const wanted = Object.entries(filter)
+        .flatMap(([key, values]) => values.map((value) => `${key}:${value}`))
+        .join(', ');
+    return [
+        `No matrix combination of job "${jobId}" matches --matrix ${wanted}; skipping it. Available combinations:`,
+        ...combinations.map((combo) => `  ${matrixLabel(combo)}`)
+    ].join('\n');
+}
+/** Filter keys that no expanded matrix defined. */
+function unknownMatrixKeys(filter, definedKeys) {
+    return Object.keys(filter).filter((key) => !definedKeys.has(key));
+}
 /**
  * Order job IDs so dependencies (via `needs`) run before dependents, using
  * Kahn's algorithm. Falls back to declaration order (with a warning) if a

package/dist/runner/job-runtime.js

@@ -95,12 +95,11 @@ function containerPathPrefix(runtime) {
 }
 /**
  * Create the per-run scratch directory holding the event payload
- * (`$GITHUB_EVENT_PATH`) and `$RUNNER_TEMP`.
+ * (`$GITHUB_EVENT_PATH`) and each job's `$RUNNER_TEMP`.
  */
 function createRunDir() {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'secureci-run-'));
     fs.writeFileSync(path.join(dir, 'event.json'), '{}');
-    fs.mkdirSync(path.join(dir, 'tmp'));
     return dir;
 }
 /** The `runner` context, derived from the runner env. */
@@ -134,7 +133,8 @@ function createJobRuntime(github, runDir, defaults = {}) {
         runnerEnv: (0, runner_env_1.buildRunnerEnv)(github, {
             workspace: process.cwd(),
             eventPath,
-            tempDir: path.join(runDir, 'tmp'),
+            // Per job, so concurrent jobs don't share $RUNNER_TEMP.
+            tempDir: fs.mkdtempSync(path.join(runDir, 'tmp-')),
             toolCache: path.join(homeDir, '.secureci', 'toolcache')
         }),
         eventPath,

package/dist/runner/node-action.js

@@ -45,11 +45,14 @@ const container_runtime_1 = require("./container-runtime");
 const runner_env_1 = require("./runner-env");
 const job_runtime_1 = require("./job-runtime");
 const job_container_1 = require("./job-container");
+const node_binary_1 = require("./node-binary");
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 /**
  * Execute a JavaScript action (`runs.using: node*`): `pre` (if any) and
  * `main` now, with `post` queued on the job runtime to run at job end.
- * Scripts run with the CLI's own Node binary, in the workspace, with the
+ * Scripts run with the CLI's own Node binary (in the standalone binary:
+ * `node` from the step's PATH; in a job container: the image's `node`),
+ * in the workspace, with the
  * runner's default env, the caller's env, `INPUT_*`, `STATE_*` and the
  * file-command variables. Note: GitHub runs every `pre` at job start;
  * here it runs immediately before its own `main`.
@@ -134,8 +137,13 @@ async function executeNodeAction(action, actionPath, step, actionInputs, callerC
                         : `node exited with code ${result.exitCode}`
             };
         }
+        const hostPath = (0, runner_env_1.prependPath)(runtime.path, callerCtx.env.PATH ?? process.env.PATH);
+        const node = (0, node_binary_1.hostNodeBinary)({ sea: (0, node_binary_1.isSea)(), pathEnv: hostPath });
+        if ('error' in node) {
+            return { success: false, stdout: '', stderr: '', error: node.error };
+        }
         try {
-            const { stdout, stderr } = await execFileAsync(process.execPath, [path.join(actionDir, script)], {
+            const { stdout, stderr } = await execFileAsync(node.path, [path.join(actionDir, script)], {
                 cwd: process.cwd(),
                 maxBuffer: 64 * 1024 * 1024,
                 timeout: limit.ms,
@@ -148,7 +156,7 @@ async function executeNodeAction(action, actionPath, step, actionInputs, callerC
                     ...inputEnv,
                     ...stateEnv,
                     GITHUB_ACTION_PATH: actionDir,
-                    PATH: (0, runner_env_1.prependPath)(runtime.path, callerCtx.env.PATH ?? process.env.PATH),
+                    PATH: hostPath,
                     ...(0, job_runtime_1.fileCommandEnv)(files)
                 }
             });

package/dist/runner/node-binary.js

@@ -0,0 +1,108 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NODE_ON_PATH_REQUIRED = void 0;
+exports.isSea = isSea;
+exports.findOnPath = findOnPath;
+exports.hostNodeBinary = hostNodeBinary;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+exports.NODE_ON_PATH_REQUIRED = 'JavaScript actions need Node.js on PATH when using the standalone binary. Install Node.js (or add a setup-node step), or install the CLI with npm.';
+/**
+ * Whether the CLI is running as a Node.js single executable application
+ * (the standalone binary). `node:sea` only exists on Node 20.12+/21.7+;
+ * older versions can't be a SEA, so a missing module means "no".
+ */
+function isSea(
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+load = () => require('node:sea')) {
+    try {
+        return load().isSea();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The first executable `name` in `pathEnv` (like `command -v`). On Windows
+ * the separator is `;` and each PATHEXT extension is tried too. `exclude`
+ * skips one file (the standalone binary itself).
+ */
+function findOnPath(name, pathEnv, { platform = process.platform, pathExt = process.env.PATHEXT, exclude } = {}) {
+    if (!pathEnv)
+        return undefined;
+    const windows = platform === 'win32';
+    const exts = windows
+        ? ['', ...(pathExt || '.COM;.EXE;.BAT;.CMD').split(';').filter(Boolean)]
+        : [''];
+    for (const dir of pathEnv.split(windows ? ';' : ':')) {
+        if (!dir)
+            continue;
+        for (const ext of exts) {
+            const candidate = path.join(dir, name + ext);
+            if (exclude && path.resolve(candidate) === path.resolve(exclude)) {
+                continue;
+            }
+            if (isExecutableFile(candidate, windows))
+                return candidate;
+        }
+    }
+    return undefined;
+}
+function isExecutableFile(file, windows) {
+    try {
+        if (!fs.statSync(file).isFile())
+            return false;
+        if (!windows)
+            fs.accessSync(file, fs.constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The `node` that runs JavaScript actions on the host. Normally the CLI's
+ * own Node binary; inside the standalone binary `process.execPath` is the
+ * CLI itself, so use `node` from the step's PATH instead (which also picks
+ * up a Node.js that setup-node added to the job's PATH).
+ */
+function hostNodeBinary({ sea = isSea(), execPath = process.execPath, pathEnv, platform = process.platform }) {
+    if (!sea)
+        return { path: execPath };
+    const node = findOnPath('node', pathEnv, { platform, exclude: execPath });
+    return node ? { path: node } : { error: exports.NODE_ON_PATH_REQUIRED };
+}
+//# sourceMappingURL=node-binary.js.map

package/dist/runner/scheduler.js

@@ -0,0 +1,207 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Slots = void 0;
+exports.defaultParallelism = defaultParallelism;
+exports.parseParallel = parseParallel;
+exports.runMatrix = runMatrix;
+exports.runJobGraph = runJobGraph;
+const os = __importStar(require("os"));
+/** A FIFO counting semaphore: at most `limit` holders at a time. */
+class Slots {
+    constructor(limit) {
+        this.active = 0;
+        this.waiting = [];
+        this.limit = Math.max(1, Math.floor(limit) || 1);
+    }
+    /** Wait for a free slot; call the returned function to free it. */
+    async acquire() {
+        if (this.active < this.limit) {
+            this.active++;
+        }
+        else {
+            // The releasing holder hands its slot straight to us.
+            await new Promise((resolve) => this.waiting.push(resolve));
+        }
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            const next = this.waiting.shift();
+            if (next)
+                next();
+            else
+                this.active--;
+        };
+    }
+}
+exports.Slots = Slots;
+/** The machine's CPU count (the default for `--parallel`), at least 1. */
+function defaultParallelism(osApi = os) {
+    const n = osApi.availableParallelism
+        ? osApi.availableParallelism()
+        : (osApi.cpus?.().length ?? 1);
+    return Math.max(1, n);
+}
+/** Parse `--parallel` / config `parallel`. Throws unless a positive integer. */
+function parseParallel(raw) {
+    const n = typeof raw === 'number' ? raw : raw.trim() ? Number(raw) : NaN;
+    if (!Number.isInteger(n) || n < 1) {
+        throw new Error(`Invalid value "${raw}" for parallel. Must be a positive integer.`);
+    }
+    return n;
+}
+/**
+ * Run `count` matrix combinations, at most `maxParallel` at once and each
+ * holding one of the global `slots` while it runs. With fail-fast, a
+ * failure (not allowed by continue-on-error) aborts the signals of the
+ * combinations in progress and starts no more, as GitHub cancels the rest
+ * of the matrix. Returns each combination's outcome by index, or
+ * undefined for one that never started.
+ */
+async function runMatrix(count, run, options) {
+    const outcomes = new Array(count).fill(undefined);
+    const local = new Slots(options.maxParallel ?? count);
+    const controllers = new Map();
+    let stopped = options.signal?.aborted ?? false;
+    let finished = 0;
+    const onParentAbort = () => {
+        stopped = true;
+        for (const controller of controllers.values())
+            controller.abort();
+    };
+    options.signal?.addEventListener('abort', onParentAbort);
+    const runOne = async (index) => {
+        const releaseLocal = await local.acquire();
+        try {
+            if (stopped)
+                return;
+            const releaseGlobal = options.slots
+                ? await options.slots.acquire()
+                : undefined;
+            try {
+                if (stopped)
+                    return;
+                const controller = new AbortController();
+                controllers.set(index, controller);
+                try {
+                    const outcome = await run(index, controller.signal);
+                    outcomes[index] = outcome;
+                    finished++;
+                    if (options.failFast &&
+                        !stopped &&
+                        outcome.result === 'failure' &&
+                        !outcome.allowedFailure) {
+                        stopped = true;
+                        if (finished < count)
+                            options.onFailFast?.();
+                        for (const other of controllers.values()) {
+                            if (other !== controller)
+                                other.abort();
+                        }
+                    }
+                }
+                finally {
+                    controllers.delete(index);
+                }
+            }
+            finally {
+                releaseGlobal?.();
+            }
+        }
+        finally {
+            releaseLocal();
+        }
+    };
+    try {
+        const settled = await Promise.allSettled(Array.from({ length: count }, (_, i) => runOne(i)));
+        const failed = settled.find((s) => s.status === 'rejected');
+        if (failed)
+            throw failed.reason;
+        return outcomes;
+    }
+    finally {
+        options.signal?.removeEventListener('abort', onParentAbort);
+    }
+}
+/** A job not started because another job threw. */
+class SkippedJob extends Error {
+}
+/**
+ * Run the jobs of a workflow. `order` is a topological order of the job
+ * ids; a job waits only for its `needs:` that come earlier in it (so a
+ * cycle, or an unknown job, doesn't deadlock) and gets their results.
+ * Serially, jobs run one after another in `order`; otherwise each starts
+ * as soon as its dependencies are done. If a job throws, no further jobs
+ * start, running ones finish, and the first error is rethrown.
+ */
+async function runJobGraph(order, needsOf, runJob, concurrent) {
+    const results = new Map();
+    const position = new Map(order.map((id, i) => [id, i]));
+    const depsOf = (id) => needsOf(id).filter((dep) => (position.get(dep) ?? Infinity) < position.get(id));
+    const needsFor = (id) => Object.fromEntries(depsOf(id).map((dep) => [dep, results.get(dep)]));
+    if (!concurrent) {
+        for (const id of order) {
+            results.set(id, await runJob(id, needsFor(id)));
+        }
+        return results;
+    }
+    let broken = false;
+    const done = new Map();
+    for (const id of order) {
+        const deps = depsOf(id).map((dep) => done.get(dep));
+        done.set(id, Promise.all(deps).then(async () => {
+            if (broken)
+                throw new SkippedJob();
+            try {
+                results.set(id, await runJob(id, needsFor(id)));
+            }
+            catch (error) {
+                broken = true;
+                throw error;
+            }
+        }, () => {
+            throw new SkippedJob();
+        }));
+    }
+    const settled = await Promise.allSettled(done.values());
+    // The first job that failed itself, not one that never started.
+    const firstError = settled.find((s) => s.status === 'rejected' && !(s.reason instanceof SkippedJob));
+    if (firstError)
+        throw firstError.reason;
+    return results;
+}
+//# sourceMappingURL=scheduler.js.map