@smoothbricks/cli 0.10.1 → 0.10.3

package/dist/github-ci/outputs.js

@@ -0,0 +1,649 @@
+import * as _assertGuard_1 from "typia/lib/internal/_assertGuard";
+import * as _accessExpressionAsString_1 from "typia/lib/internal/_accessExpressionAsString";
+import { createHash } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { copyFile, lstat, mkdir, readdir, readFile, writeFile } from 'node:fs/promises';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
+import { isRecord } from '@smoothbricks/validation';
+import typia from 'typia';
+import { readProjectTargets } from '../nx/index.js';
+const parseManifest = (() => {
+    const _ao0 = (input, _path, _exceptionable = true) => (1 === input.version || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.json.createAssertParse",
+        path: _path + ".version",
+        expected: "1",
+        value: input.version
+    }, _errorFactory)) && ("string" === typeof input.sourceSha || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.json.createAssertParse",
+        path: _path + ".sourceSha",
+        expected: "string",
+        value: input.sourceSha
+    }, _errorFactory)) && ((Array.isArray(input.files) || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.json.createAssertParse",
+        path: _path + ".files",
+        expected: "Array<CollectedOutputFile>",
+        value: input.files
+    }, _errorFactory)) && input.files.every((elem, _index2) => ("object" === typeof elem && null !== elem || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.json.createAssertParse",
+        path: _path + ".files[" + _index2 + "]",
+        expected: "CollectedOutputFile",
+        value: elem
+    }, _errorFactory)) && _ao1(elem, _path + ".files[" + _index2 + "]", true && _exceptionable) || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.json.createAssertParse",
+        path: _path + ".files[" + _index2 + "]",
+        expected: "CollectedOutputFile",
+        value: elem
+    }, _errorFactory)) || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.json.createAssertParse",
+        path: _path + ".files",
+        expected: "Array<CollectedOutputFile>",
+        value: input.files
+    }, _errorFactory));
+    const _ao1 = (input, _path, _exceptionable = true) => ("string" === typeof input.project || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.json.createAssertParse",
+        path: _path + ".project",
+        expected: "string",
+        value: input.project
+    }, _errorFactory)) && ("string" === typeof input.target || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.json.createAssertParse",
+        path: _path + ".target",
+        expected: "string",
+        value: input.target
+    }, _errorFactory)) && ("string" === typeof input.output || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.json.createAssertParse",
+        path: _path + ".output",
+        expected: "string",
+        value: input.output
+    }, _errorFactory)) && ("string" === typeof input.path || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.json.createAssertParse",
+        path: _path + ".path",
+        expected: "string",
+        value: input.path
+    }, _errorFactory)) && ("number" === typeof input.size || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.json.createAssertParse",
+        path: _path + ".size",
+        expected: "number",
+        value: input.size
+    }, _errorFactory)) && ("string" === typeof input.sha256 || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.json.createAssertParse",
+        path: _path + ".sha256",
+        expected: "string",
+        value: input.sha256
+    }, _errorFactory));
+    const _io0 = input => 1 === input.version && "string" === typeof input.sourceSha && (Array.isArray(input.files) && input.files.every(elem => "object" === typeof elem && null !== elem && _io1(elem)));
+    const _io1 = input => "string" === typeof input.project && "string" === typeof input.target && "string" === typeof input.output && "string" === typeof input.path && "number" === typeof input.size && "string" === typeof input.sha256;
+    const __is = input => "object" === typeof input && null !== input && _io0(input);
+    let _errorFactory;
+    const __assert = (input, errorFactory) => {
+        if (false === __is(input)) {
+            _errorFactory = errorFactory;
+            ((input, _path, _exceptionable = true) => ("object" === typeof input && null !== input || _assertGuard_1._assertGuard(true, {
+                method: "typia.json.createAssertParse",
+                path: _path + "",
+                expected: "CollectedOutputsManifest",
+                value: input
+            }, _errorFactory)) && _ao0(input, _path + "", true) || _assertGuard_1._assertGuard(true, {
+                method: "typia.json.createAssertParse",
+                path: _path + "",
+                expected: "CollectedOutputsManifest",
+                value: input
+            }, _errorFactory))(input, "$input", true);
+        }
+        return input;
+    };
+    return (input, errorFactory) => __assert(JSON.parse(input), errorFactory);
+})();
+const assertExactManifest = (() => {
+    const _ao0 = (input, _path, _exceptionable = true) => (1 === input.version || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.createAssertEquals",
+        path: _path + ".version",
+        expected: "1",
+        value: input.version
+    }, _errorFactory)) && ("string" === typeof input.sourceSha || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.createAssertEquals",
+        path: _path + ".sourceSha",
+        expected: "string",
+        value: input.sourceSha
+    }, _errorFactory)) && ((Array.isArray(input.files) || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.createAssertEquals",
+        path: _path + ".files",
+        expected: "Array<CollectedOutputFile>",
+        value: input.files
+    }, _errorFactory)) && input.files.every((elem, _index2) => ("object" === typeof elem && null !== elem || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.createAssertEquals",
+        path: _path + ".files[" + _index2 + "]",
+        expected: "CollectedOutputFile",
+        value: elem
+    }, _errorFactory)) && _ao1(elem, _path + ".files[" + _index2 + "]", true && _exceptionable) || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.createAssertEquals",
+        path: _path + ".files[" + _index2 + "]",
+        expected: "CollectedOutputFile",
+        value: elem
+    }, _errorFactory)) || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.createAssertEquals",
+        path: _path + ".files",
+        expected: "Array<CollectedOutputFile>",
+        value: input.files
+    }, _errorFactory)) && (3 === Object.keys(input).length || (false === _exceptionable || Object.keys(input).every(key => {
+        if (["version", "sourceSha", "files"].some(prop => key === prop))
+            return true;
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return _assertGuard_1._assertGuard(_exceptionable, {
+            method: "typia.createAssertEquals",
+            path: _path + _accessExpressionAsString_1._accessExpressionAsString(key),
+            expected: "undefined",
+            value: value
+        }, _errorFactory);
+    })));
+    const _ao1 = (input, _path, _exceptionable = true) => ("string" === typeof input.project || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.createAssertEquals",
+        path: _path + ".project",
+        expected: "string",
+        value: input.project
+    }, _errorFactory)) && ("string" === typeof input.target || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.createAssertEquals",
+        path: _path + ".target",
+        expected: "string",
+        value: input.target
+    }, _errorFactory)) && ("string" === typeof input.output || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.createAssertEquals",
+        path: _path + ".output",
+        expected: "string",
+        value: input.output
+    }, _errorFactory)) && ("string" === typeof input.path || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.createAssertEquals",
+        path: _path + ".path",
+        expected: "string",
+        value: input.path
+    }, _errorFactory)) && ("number" === typeof input.size || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.createAssertEquals",
+        path: _path + ".size",
+        expected: "number",
+        value: input.size
+    }, _errorFactory)) && ("string" === typeof input.sha256 || _assertGuard_1._assertGuard(_exceptionable, {
+        method: "typia.createAssertEquals",
+        path: _path + ".sha256",
+        expected: "string",
+        value: input.sha256
+    }, _errorFactory)) && (6 === Object.keys(input).length || (false === _exceptionable || Object.keys(input).every(key => {
+        if (["project", "target", "output", "path", "size", "sha256"].some(prop => key === prop))
+            return true;
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return _assertGuard_1._assertGuard(_exceptionable, {
+            method: "typia.createAssertEquals",
+            path: _path + _accessExpressionAsString_1._accessExpressionAsString(key),
+            expected: "undefined",
+            value: value
+        }, _errorFactory);
+    })));
+    const _io0 = (input, _exceptionable = true) => 1 === input.version && "string" === typeof input.sourceSha && (Array.isArray(input.files) && input.files.every((elem, _index1) => "object" === typeof elem && null !== elem && _io1(elem, true && _exceptionable))) && (3 === Object.keys(input).length || Object.keys(input).every(key => {
+        if (["version", "sourceSha", "files"].some(prop => key === prop))
+            return true;
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return false;
+    }));
+    const _io1 = (input, _exceptionable = true) => "string" === typeof input.project && "string" === typeof input.target && "string" === typeof input.output && "string" === typeof input.path && "number" === typeof input.size && "string" === typeof input.sha256 && (6 === Object.keys(input).length || Object.keys(input).every(key => {
+        if (["project", "target", "output", "path", "size", "sha256"].some(prop => key === prop))
+            return true;
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return false;
+    }));
+    const __is = (input, _exceptionable = true) => "object" === typeof input && null !== input && _io0(input, true);
+    let _errorFactory;
+    return (input, errorFactory) => {
+        if (false === __is(input)) {
+            _errorFactory = errorFactory;
+            ((input, _path, _exceptionable = true) => ("object" === typeof input && null !== input || _assertGuard_1._assertGuard(true, {
+                method: "typia.createAssertEquals",
+                path: _path + "",
+                expected: "CollectedOutputsManifest",
+                value: input
+            }, _errorFactory)) && _ao0(input, _path + "", true) || _assertGuard_1._assertGuard(true, {
+                method: "typia.createAssertEquals",
+                path: _path + "",
+                expected: "CollectedOutputsManifest",
+                value: input
+            }, _errorFactory))(input, "$input", true);
+        }
+        return input;
+    };
+})();
+const GLOB_MAGIC = /[*?{[]/;
+const GIT_SHA = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i;
+export async function collectNxOutputs(root, destination, runs, sourceSha) {
+    assertGitSha(sourceSha, 'Collected output source SHA');
+    const pending = [];
+    const claimedPaths = new Map();
+    for (const run of runs) {
+        for (const project of run.projects) {
+            const outputs = project.targetOutputs?.get(run.target);
+            if (!outputs || outputs.length === 0) {
+                throw new Error(`Nx target ${project.project}:${run.target} declares no outputs.`);
+            }
+            for (const declaredOutput of outputs) {
+                const output = resolveDeclaredOutput(declaredOutput, project);
+                const matchedFiles = await filesMatchingOutput(root, output);
+                if (matchedFiles.length === 0) {
+                    throw new Error(`Declared output ${declaredOutput} for ${project.project}:${run.target} is missing.`);
+                }
+                for (const path of matchedFiles) {
+                    const claimed = claimedPaths.get(path);
+                    if (claimed) {
+                        if (claimed.project === project.project &&
+                            targetTransitivelyDependsOn(project, run.target, claimed.target, new Set())) {
+                            continue;
+                        }
+                        throw new Error(`Output collision: ${path} is declared by more than one project target or output.`);
+                    }
+                    claimedPaths.set(path, { project: project.project, target: run.target });
+                    const source = resolveWorkspacePath(root, path, 'output file');
+                    const stat = await lstat(source);
+                    if (!stat.isFile() || stat.isSymbolicLink()) {
+                        throw new Error(`Output file must be a regular file: ${path}`);
+                    }
+                    pending.push({
+                        project: project.project,
+                        target: run.target,
+                        output: declaredOutput,
+                        path,
+                        size: stat.size,
+                        sha256: await sha256File(source),
+                        source,
+                    });
+                }
+            }
+        }
+    }
+    pending.sort((left, right) => left.path.localeCompare(right.path));
+    await requireEmptyDestination(destination);
+    const workspace = resolve(destination, 'workspace');
+    await mkdir(workspace);
+    for (const file of pending) {
+        const staged = await prepareSafeOutputPath(workspace, file.path, 'staged output file');
+        await copyFile(file.source, staged);
+    }
+    const manifest = {
+        version: 1,
+        sourceSha,
+        files: pending.map(({ source: _source, ...file }) => file),
+    };
+    await writeFile(resolve(destination, 'manifest.json'), `${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
+    return manifest;
+}
+export async function applyCollectedOutputs(root, directories, expectedSourceSha, projects) {
+    if (directories.length === 0) {
+        throw new Error('At least one collected output directory is required.');
+    }
+    assertGitSha(expectedSourceSha, 'Expected source SHA');
+    const resolvedProjects = projects ?? (await readProjectTargets(root));
+    const projectsByName = new Map(resolvedProjects.map((project) => [project.project, project]));
+    const overlays = [];
+    const claimedPaths = new Set();
+    for (const directory of directories) {
+        const manifestPath = resolve(directory, 'manifest.json');
+        let manifest;
+        try {
+            manifest = assertExactManifest(parseManifest(await readFile(manifestPath, 'utf8')));
+        }
+        catch (error) {
+            throw new Error(`Invalid collected output manifest ${manifestPath}.`, { cause: error });
+        }
+        assertGitSha(manifest.sourceSha, `Manifest source SHA in ${manifestPath}`);
+        if (manifest.sourceSha !== expectedSourceSha) {
+            throw new Error(`Source SHA mismatch in ${manifestPath}: expected ${expectedSourceSha}, received ${manifest.sourceSha}.`);
+        }
+        const workspace = resolve(directory, 'workspace');
+        const declaredPaths = new Set();
+        for (const file of manifest.files) {
+            assertExactManifestName(file.project, 'Manifest project');
+            assertExactManifestName(file.target, 'Manifest target');
+            const project = projectsByName.get(file.project);
+            if (!project) {
+                throw new Error(`Manifest references unknown Nx project ${file.project}.`);
+            }
+            if (!project.targets.includes(file.target)) {
+                throw new Error(`Manifest references unknown Nx target ${file.project}:${file.target}.`);
+            }
+            const declaredOutputs = project.targetOutputs?.get(file.target) ?? [];
+            if (!declaredOutputs.includes(file.output)) {
+                throw new Error(`Manifest output ${file.output} is not declared by Nx target ${file.project}:${file.target}.`);
+            }
+            const path = validateWorkspaceRelativePath(file.path, 'manifest file path');
+            const output = resolveDeclaredOutput(file.output, project);
+            if (!outputContainsPath(output, path)) {
+                throw new Error(`Manifest file ${path} is not contained by declared output ${file.output}.`);
+            }
+            if (declaredPaths.has(path)) {
+                throw new Error(`Manifest contains a duplicate output file: ${path}`);
+            }
+            if (claimedPaths.has(path)) {
+                throw new Error(`Output collision across collected trees: ${path}`);
+            }
+            declaredPaths.add(path);
+            claimedPaths.add(path);
+            const source = resolveWorkspacePath(workspace, path, 'staged output file');
+            let stat;
+            try {
+                stat = await lstat(source);
+            }
+            catch (error) {
+                throw new Error(`Staged output file is missing: ${path}`, { cause: error });
+            }
+            if (!stat.isFile() || stat.isSymbolicLink()) {
+                throw new Error(`Staged output must be a regular file: ${path}`);
+            }
+            if (stat.size !== file.size) {
+                throw new Error(`Size mismatch for staged output ${path}: expected ${file.size}, received ${stat.size}.`);
+            }
+            const checksum = await sha256File(source);
+            if (checksum !== file.sha256) {
+                throw new Error(`SHA-256 mismatch for staged output ${path}.`);
+            }
+            overlays.push({ source, destination: path });
+        }
+        let workspaceStat;
+        try {
+            workspaceStat = await lstat(workspace);
+        }
+        catch (error) {
+            // Artifact transports omit empty directories, so an empty manifest is the complete transferable contract.
+            if (manifest.files.length === 0 && isMissingPathError(error)) {
+                continue;
+            }
+            throw new Error(`Collected output workspace is missing: ${workspace}`, { cause: error });
+        }
+        if (workspaceStat.isSymbolicLink() || !workspaceStat.isDirectory()) {
+            throw new Error(`Collected output workspace must be a real directory: ${workspace}`);
+        }
+        const stagedFiles = await listRegularFiles(workspace);
+        for (const stagedFile of stagedFiles) {
+            const path = workspaceRelativePath(workspace, stagedFile, 'staged output file');
+            if (!declaredPaths.has(path)) {
+                throw new Error(`Undeclared staged output file: ${path}`);
+            }
+        }
+    }
+    for (const overlay of overlays) {
+        const destination = await prepareSafeOutputPath(root, overlay.destination, 'workspace output file');
+        await copyFile(overlay.source, destination);
+    }
+}
+export function resolveDeclaredOutput(declaredOutput, project) {
+    if (!project.root) {
+        throw new Error(`Nx project ${project.project} is missing its resolved root.`);
+    }
+    const substituted = declaredOutput
+        .replaceAll('{workspaceRoot}/', '')
+        .replaceAll('{workspaceRoot}', '.')
+        .replaceAll('{projectRoot}/', `${project.root}/`)
+        .replaceAll('{projectRoot}', project.root);
+    if (hasUnsupportedOutputBraces(substituted)) {
+        throw new Error(`Unsupported Nx output placeholder in ${project.project}:${declaredOutput}`);
+    }
+    return validateWorkspaceRelativePattern(substituted, `output for ${project.project}`);
+}
+function hasUnsupportedOutputBraces(value) {
+    let cursor = 0;
+    while (cursor < value.length) {
+        const character = value.charCodeAt(cursor);
+        if (character === 0x7d) {
+            return true;
+        }
+        if (character !== 0x7b) {
+            cursor += 1;
+            continue;
+        }
+        let hasAlternative = false;
+        cursor += 1;
+        while (cursor < value.length && value.charCodeAt(cursor) !== 0x7d) {
+            const inner = value.charCodeAt(cursor);
+            if (inner === 0x7b) {
+                return true;
+            }
+            hasAlternative ||= inner === 0x2c;
+            cursor += 1;
+        }
+        if (cursor === value.length || !hasAlternative) {
+            return true;
+        }
+        cursor += 1;
+    }
+    return false;
+}
+function targetTransitivelyDependsOn(project, target, candidate, visited) {
+    if (visited.has(target)) {
+        return false;
+    }
+    visited.add(target);
+    for (const dependency of project.targetDependencies?.get(target) ?? []) {
+        if (dependency.startsWith('^')) {
+            continue;
+        }
+        const targets = GLOB_MAGIC.test(dependency)
+            ? project.targets.filter((entry) => new Bun.Glob(dependency).match(entry))
+            : [dependency];
+        if (targets.includes(candidate) ||
+            targets.some((dependencyTarget) => targetTransitivelyDependsOn(project, dependencyTarget, candidate, visited))) {
+            return true;
+        }
+    }
+    return false;
+}
+async function filesMatchingOutput(root, output) {
+    if (!GLOB_MAGIC.test(output)) {
+        const path = resolveWorkspacePath(root, output, 'declared output');
+        try {
+            await assertNoSymlinkTraversal(root, output, 'declared output');
+            const stat = await lstat(path);
+            if (stat.isSymbolicLink()) {
+                throw new Error(`Declared output must not be a symbolic link: ${output}`);
+            }
+            if (stat.isFile()) {
+                return [output];
+            }
+            if (stat.isDirectory()) {
+                return (await listRegularFiles(path)).map((file) => workspaceRelativePath(root, file, 'output file')).sort();
+            }
+            return [];
+        }
+        catch (error) {
+            if (isMissingPathError(error)) {
+                return [];
+            }
+            throw error;
+        }
+    }
+    const globBase = output.slice(0, output.search(GLOB_MAGIC)).replace(/\/+$/, '');
+    if (globBase) {
+        try {
+            await assertNoSymlinkTraversal(root, globBase, 'declared output');
+        }
+        catch (error) {
+            if (isMissingPathError(error)) {
+                return [];
+            }
+            throw error;
+        }
+    }
+    const files = new Set();
+    for await (const match of new Bun.Glob(output).scan({
+        cwd: root,
+        dot: true,
+        followSymlinks: false,
+        onlyFiles: false,
+    })) {
+        const path = resolveWorkspacePath(root, match, 'globbed output');
+        await assertNoSymlinkTraversal(root, match, 'globbed output');
+        const stat = await lstat(path);
+        if (stat.isSymbolicLink()) {
+            throw new Error(`Declared output must not contain a symbolic link: ${match}`);
+        }
+        if (stat.isFile()) {
+            files.add(validateWorkspaceRelativePath(match, 'globbed output'));
+        }
+        else if (stat.isDirectory()) {
+            for (const file of await listRegularFiles(path)) {
+                files.add(workspaceRelativePath(root, file, 'output file'));
+            }
+        }
+    }
+    return [...files].sort((left, right) => left.localeCompare(right));
+}
+async function listRegularFiles(directory) {
+    let entries;
+    try {
+        entries = await readdir(directory, { withFileTypes: true });
+    }
+    catch (error) {
+        if (isMissingPathError(error)) {
+            return [];
+        }
+        throw error;
+    }
+    entries.sort((left, right) => left.name.localeCompare(right.name));
+    const files = [];
+    for (const entry of entries) {
+        const path = resolve(directory, entry.name);
+        if (entry.isSymbolicLink()) {
+            throw new Error(`Collected outputs must not contain symbolic links: ${path}`);
+        }
+        if (entry.isDirectory()) {
+            files.push(...(await listRegularFiles(path)));
+        }
+        else if (entry.isFile()) {
+            files.push(path);
+        }
+        else {
+            throw new Error(`Collected outputs must contain only regular files: ${path}`);
+        }
+    }
+    return files;
+}
+function assertExactManifestName(value, description) {
+    if (!value || GLOB_MAGIC.test(value)) {
+        throw new Error(`${description} must be an exact Nx name: ${value}`);
+    }
+}
+function validateWorkspaceRelativePattern(value, description) {
+    const normalized = value
+        .replaceAll('\\', '/')
+        .replace(/^\.\//, '')
+        .replace(/\/{2,}/g, '/');
+    if (!normalized || normalized === '.' || isAbsolute(normalized) || normalized.split('/').includes('..')) {
+        throw new Error(`${description} escapes the workspace: ${value}`);
+    }
+    return normalized;
+}
+function validateWorkspaceRelativePath(value, description) {
+    const normalized = validateWorkspaceRelativePattern(value, description);
+    if (GLOB_MAGIC.test(normalized)) {
+        throw new Error(`${description} must not contain glob syntax: ${value}`);
+    }
+    return normalized;
+}
+function resolveWorkspacePath(root, path, description) {
+    const validated = validateWorkspaceRelativePath(path, description);
+    const resolvedRoot = resolve(root);
+    const resolvedPath = resolve(resolvedRoot, ...validated.split('/'));
+    const fromRoot = relative(resolvedRoot, resolvedPath);
+    if (fromRoot === '..' || fromRoot.startsWith(`..${sep}`) || isAbsolute(fromRoot)) {
+        throw new Error(`${description} escapes the workspace: ${path}`);
+    }
+    return resolvedPath;
+}
+function workspaceRelativePath(root, path, description) {
+    return validateWorkspaceRelativePath(relative(resolve(root), resolve(path)).replaceAll(sep, '/'), description);
+}
+function outputContainsPath(output, path) {
+    return GLOB_MAGIC.test(output) ? new Bun.Glob(output).match(path) : path === output || path.startsWith(`${output}/`);
+}
+async function requireEmptyDestination(destination) {
+    try {
+        const stat = await lstat(destination);
+        if (stat.isSymbolicLink() || !stat.isDirectory()) {
+            throw new Error(`Output collection path must be a real directory: ${destination}`);
+        }
+        const entries = await readdir(destination);
+        if (entries.length > 0) {
+            throw new Error(`Output collection directory must be empty: ${destination}`);
+        }
+    }
+    catch (error) {
+        if (!isMissingPathError(error)) {
+            throw error;
+        }
+        await mkdir(destination, { recursive: true });
+    }
+}
+async function assertNoSymlinkTraversal(root, path, description) {
+    const validated = validateWorkspaceRelativePath(path, description);
+    let current = resolve(root);
+    const rootStat = await lstat(current);
+    if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
+        throw new Error(`${description} root must be a real directory: ${current}`);
+    }
+    for (const segment of validated.split('/')) {
+        current = resolve(current, segment);
+        const stat = await lstat(current);
+        if (stat.isSymbolicLink()) {
+            throw new Error(`${description} must not traverse a symbolic link: ${path}`);
+        }
+    }
+}
+async function prepareSafeOutputPath(root, path, description) {
+    const validated = validateWorkspaceRelativePath(path, description);
+    const resolvedRoot = resolve(root);
+    const rootStat = await lstat(resolvedRoot);
+    if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
+        throw new Error(`${description} root must be a real directory: ${resolvedRoot}`);
+    }
+    let current = resolvedRoot;
+    const segments = validated.split('/');
+    for (const [index, segment] of segments.entries()) {
+        current = resolve(current, segment);
+        const isDestination = index === segments.length - 1;
+        try {
+            const stat = await lstat(current);
+            if (stat.isSymbolicLink()) {
+                throw new Error(`${description} must not traverse a symbolic link: ${path}`);
+            }
+            if (isDestination ? !stat.isFile() : !stat.isDirectory()) {
+                throw new Error(`${description} has an invalid existing path component: ${path}`);
+            }
+        }
+        catch (error) {
+            if (!isMissingPathError(error)) {
+                throw error;
+            }
+            if (!isDestination) {
+                await mkdir(current);
+            }
+        }
+    }
+    return current;
+}
+function assertGitSha(value, description) {
+    if (!GIT_SHA.test(value)) {
+        throw new Error(`${description} must be a 40- or 64-character hexadecimal Git SHA.`);
+    }
+}
+function isMissingPathError(error) {
+    return isRecord(error) && error.code === 'ENOENT';
+}
+function sha256File(path) {
+    return new Promise((resolveHash, reject) => {
+        const hash = createHash('sha256');
+        const stream = createReadStream(path);
+        stream.on('data', (chunk) => hash.update(chunk));
+        stream.on('error', reject);
+        stream.on('end', () => resolveHash(hash.digest('hex')));
+    });
+}

package/dist/lib/conflict-markers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conflict-markers.d.ts","sourceRoot":"","sources":["../../src/lib/conflict-markers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,gDAAgD,CAAC;AAIrF,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAStD;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,CACP,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,MAAM,EAAO,GACvB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAW9B;AAED,uFAAuF;AACvF,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,IAAI,EAAE,iBAAiB,EAAE;gBAAzB,IAAI,EAAE,iBAAiB,EAAE,EAClC,OAAO,EAAE,MAAM;CAKlB;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKlH;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAkB9B;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,EAAE,CA2BhE;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAElE"}
+{"version":3,"file":"conflict-markers.d.ts","sourceRoot":"","sources":["../../src/lib/conflict-markers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,gDAAgD,CAAC;AAIrF,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAStD;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,CACP,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,MAAM,EAAO,GACvB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAW9B;AAED,uFAAuF;AACvF,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,IAAI,EAAE,iBAAiB,EAAE;IADpC,YACW,IAAI,EAAE,iBAAiB,EAAE,EAClC,OAAO,EAAE,MAAM,EAIhB;CACF;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKlH;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAkB9B;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,EAAE,CA2BhE;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAElE"}

package/dist/lib/workspace.d.ts

@@ -30,7 +30,7 @@ export interface RepositoryInfo {
     type: string;
     url: string;
 }
-export declare const workspaceDependencyFields: readonly ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"];
+export declare const workspaceDependencyFields: readonly ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
 export declare function listPublicPackages(root: string): PackageInfo[];
 export declare function listReleasePackages(root: string, rootPackage?: PackageInfo | null): PackageInfo[];
 export declare function rootRepositoryInfo(root: string): RepositoryInfo | null;

package/dist/lib/workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../src/lib/workspace.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,WAAY,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED,eAAO,MAAM,yBAAyB,0FAK5B,CAAC;AAEX,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAE9D;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,WAAW,qBAA8C,GACxD,WAAW,EAAE,CAWf;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAGtE;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG3D;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,GAAG,IAAI,CAE7E;AAED,wBAAgB,cAAc,CAAC,cAAc,EAAE,cAAc,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAGxF;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAMhE;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,EAAE,CAMrF;AAwDD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CASlE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAG3D;AAgBD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAiBhE;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,GAAG,IAAI,CAc1F;AAOD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAGtE;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAKhE;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,cAAc,GAAG,IAAI,CAalF;AAED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAErF;AA4BD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD"}
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../src/lib/workspace.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,WAAY,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED,eAAO,MAAM,yBAAyB,YACpC,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,CACd,CAAC;AAEX,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAE9D;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,WAAW,qBAA8C,GACxD,WAAW,EAAE,CAWf;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAGtE;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG3D;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,WAAW,GAAG,cAAc,GAAG,IAAI,CAE7E;AAED,wBAAgB,cAAc,CAAC,cAAc,EAAE,cAAc,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAGxF;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAMhE;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,EAAE,CAMrF;AAwDD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CASlE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAG3D;AAgBD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAiBhE;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,GAAG,IAAI,CAc1F;AAOD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAGtE;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAKhE;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,cAAc,GAAG,IAAI,CAalF;AAED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAErF;AA4BD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD"}