@smoothbricks/nx-cache-server 0.0.0-stage → 0.1.1

package/dist/server/nx-cache-server.js

@@ -0,0 +1,710 @@
+#!/usr/bin/env bun
+// @bun
+
+// src/config.ts
+var DEFAULT_HOST = "127.0.0.1";
+var DEFAULT_PORT = 8765;
+var DEFAULT_MAX_BYTES = 1024 * 1024 * 1024;
+var DEFAULT_CAP_BYTES = 10 * 1024 * 1024 * 1024;
+var MAX_PORT = 65535;
+var LABEL = /^[a-z0-9][a-z0-9-]{0,31}$/;
+var TOKEN_SOURCES = [
+  ["NX_CACHE_SERVER_WRITE_TOKENS", "write"],
+  ["NX_CACHE_SERVER_READ_TOKENS", "read"]
+];
+function cacheServerConfigFromEnv(env) {
+  const problems = [];
+  const directory = readDirectory(env, problems);
+  const port = readInteger(env, "NX_CACHE_SERVER_PORT", DEFAULT_PORT, 0, MAX_PORT, problems);
+  const maxBytes = readInteger(env, "NX_CACHE_SERVER_MAX_BYTES", DEFAULT_MAX_BYTES, 1, Number.MAX_SAFE_INTEGER, problems);
+  const capBytes = readInteger(env, "NX_CACHE_SERVER_CAP_BYTES", DEFAULT_CAP_BYTES, 1, Number.MAX_SAFE_INTEGER, problems);
+  if (maxBytes !== undefined && capBytes !== undefined && maxBytes > capBytes) {
+    problems.push("NX_CACHE_SERVER_MAX_BYTES must not exceed NX_CACHE_SERVER_CAP_BYTES.");
+  }
+  const principals = readPrincipals(env, problems);
+  const configuredHost = env.NX_CACHE_SERVER_HOST?.trim();
+  const host = configuredHost === undefined || configuredHost === "" ? DEFAULT_HOST : configuredHost;
+  if (problems.length > 0 || directory === undefined || port === undefined || maxBytes === undefined || capBytes === undefined || principals === undefined) {
+    return { ok: false, problems };
+  }
+  return { ok: true, config: { directory, host, port, maxBytes, capBytes, principals } };
+}
+function readDirectory(env, problems) {
+  const raw = env.NX_CACHE_SERVER_DIR?.trim();
+  if (raw === undefined || raw === "") {
+    problems.push("NX_CACHE_SERVER_DIR is not set. Name the directory that holds cache entries; there is no default because a wrong guess would start an empty cache that looks healthy.");
+    return;
+  }
+  if (!raw.startsWith("/")) {
+    problems.push(`NX_CACHE_SERVER_DIR=${JSON.stringify(raw)} must be an absolute path: a supervisor starts this process, and its working directory is not the operator's.`);
+    return;
+  }
+  return raw;
+}
+function readInteger(env, name, fallback, min, max, problems) {
+  const raw = env[name]?.trim();
+  if (raw === undefined || raw === "")
+    return fallback;
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value < min || value > max) {
+    problems.push(`${name}=${JSON.stringify(raw)} must be an integer between ${min} and ${max}.`);
+    return;
+  }
+  return value;
+}
+function readPrincipals(env, problems) {
+  const principals = [];
+  const labels = new Set;
+  const secrets = new Set;
+  for (const [envName, capability] of TOKEN_SOURCES) {
+    const raw = env[envName];
+    if (raw === undefined)
+      continue;
+    const entries = raw.split(",");
+    entries.forEach((rawEntry, index) => {
+      const entry = rawEntry.trim();
+      if (entry === "")
+        return;
+      const at = `${envName} entry ${index + 1}`;
+      const colon = entry.indexOf(":");
+      if (colon < 1) {
+        problems.push(`${at} is not "label:secret". Every token carries a label so an audit line can name the principal that published an artifact without printing the token.`);
+        return;
+      }
+      const label = entry.slice(0, colon);
+      const secret = entry.slice(colon + 1);
+      if (!LABEL.test(label)) {
+        problems.push(`${at} label ${JSON.stringify(label)} must match ${LABEL.source} \u2014 lowercase, digits and dashes.`);
+        return;
+      }
+      if (secret === "") {
+        problems.push(`${at} (label ${label}) has an empty secret.`);
+        return;
+      }
+      if (labels.has(label)) {
+        problems.push(`${at} reuses label ${label}. One label names one principal, or the audit log lies.`);
+        return;
+      }
+      if (secrets.has(secret)) {
+        problems.push(`${at} (label ${label}) repeats a secret already configured for another principal. One secret maps to exactly one label and one capability.`);
+        return;
+      }
+      labels.add(label);
+      secrets.add(secret);
+      principals.push({ label, bearer: `Bearer ${secret}`, capability });
+    });
+  }
+  if (principals.length === 0) {
+    problems.push('No tokens configured. Set NX_CACHE_SERVER_WRITE_TOKENS and/or NX_CACHE_SERVER_READ_TOKENS to comma-separated "label:secret" entries; the write list may publish artifacts, the read list may only fetch them.');
+    return;
+  }
+  return principals;
+}
+
+// src/log.ts
+var PROGRAM = "nx-cache-server";
+var BARE_VALUE = /^[\w.:@/+-]+$/;
+function logLine(fields) {
+  console.error(`${PROGRAM} ${fields}`);
+}
+function logValue(value) {
+  return BARE_VALUE.test(value) ? value : JSON.stringify(value);
+}
+
+// src/gc.ts
+import { lstat, readdir as readdir2, readFile, rename, rm, utimes } from "fs/promises";
+import { join as join2 } from "path";
+
+// src/store.ts
+import { link, mkdir, open as open2, readdir, unlink } from "fs/promises";
+import { join } from "path";
+import { Readable } from "stream";
+
+// src/root-lease.ts
+import { dlopen, read } from "bun:ffi";
+import { open } from "fs/promises";
+import { getSystemErrorName } from "util";
+var LOCK_EX = 2;
+var LOCK_NB = 4;
+function flockErrno(fd, flock, errnoLocation) {
+  if (flock(fd, LOCK_EX | LOCK_NB) === 0)
+    return 0;
+  const location = errnoLocation();
+  if (!location)
+    throw new Error("root lease: libc returned a null errno location");
+  const errno = read.i32(location, 0);
+  if (errno === 0)
+    throw new Error("root lease: flock failed but errno is 0; refusing to treat the lock as held");
+  return errno;
+}
+function lockErrno(fd) {
+  if (process.platform === "darwin") {
+    const libc = dlopen("libc.dylib", {
+      flock: { args: ["i32", "i32"], returns: "i32" },
+      __error: { args: [], returns: "ptr" }
+    });
+    try {
+      return flockErrno(fd, libc.symbols.flock, libc.symbols.__error);
+    } finally {
+      libc.close();
+    }
+  }
+  if (process.platform === "linux") {
+    const libc = dlopen("libc.so.6", {
+      flock: { args: ["i32", "i32"], returns: "i32" },
+      __errno_location: { args: [], returns: "ptr" }
+    });
+    try {
+      return flockErrno(fd, libc.symbols.flock, libc.symbols.__errno_location);
+    } finally {
+      libc.close();
+    }
+  }
+  throw new Error(`root lease is unsupported on platform ${process.platform}`);
+}
+async function tryAcquireRootLease(path) {
+  const handle = await open(path, "a", 384);
+  let owned = false;
+  try {
+    const errno = lockErrno(handle.fd);
+    if (errno === 0) {
+      owned = true;
+      return handle;
+    }
+    if (errno === (process.platform === "darwin" ? 35 : 11))
+      return;
+    throw new Error(`flock ${path} failed: ${getSystemErrorName(-errno)}`);
+  } finally {
+    if (!owned)
+      await handle.close();
+  }
+}
+
+// src/store.ts
+var STAGING = ".staging";
+var CACHE_KEY = /^[A-Za-z0-9_-]{1,128}$/;
+var ALREADY_STORED = { kind: "exists", stagingRetained: false };
+function isCacheKey(candidate) {
+  return CACHE_KEY.test(candidate);
+}
+function entryPath(store, key) {
+  return join(store.directory, key);
+}
+async function openCacheStore(directory) {
+  await mkdir(directory, { recursive: true });
+  const lockPath = join(directory, ".owner.lock");
+  const lease = await tryAcquireRootLease(lockPath);
+  if (!lease)
+    return { ok: false, kind: "store-locked", path: lockPath };
+  try {
+    const staging = join(directory, STAGING);
+    await mkdir(staging, { recursive: true });
+    const abandoned = await readdir(staging);
+    for (const name of abandoned) {
+      await unlink(join(staging, name));
+    }
+    return {
+      ok: true,
+      store: { directory, staging, reclaimedStagingFiles: abandoned.length, close: () => lease.close() }
+    };
+  } catch (failure) {
+    await lease.close();
+    throw failure;
+  }
+}
+var MISSING = { kind: "missing" };
+async function readEntry(store, key) {
+  try {
+    const file = await open2(entryPath(store, key), "r");
+    try {
+      const stats = await file.stat();
+      if (!stats.isFile() || stats.size === 0) {
+        await file.close();
+        return MISSING;
+      }
+      if (stats.atimeMs <= stats.mtimeMs) {
+        await file.utimes((stats.mtimeMs + 1) / 1000, stats.mtimeMs / 1000);
+      }
+      return {
+        kind: "found",
+        bytes: stats.size,
+        body: Readable.toWeb(file.createReadStream({ autoClose: true }))
+      };
+    } catch (cause) {
+      await file.close();
+      return { kind: "failed", reason: describe(cause) };
+    }
+  } catch (cause) {
+    return errnoOf(cause) === "ENOENT" ? MISSING : { kind: "failed", reason: describe(cause) };
+  }
+}
+async function stageEntry(store, key, body, declaredBytes) {
+  const staged = join(store.staging, `${key}.${crypto.randomUUID()}`);
+  let bytes;
+  try {
+    bytes = await Bun.write(staged, new Response(body));
+  } catch (cause) {
+    const stagingRetained = !await discard(staged);
+    return { kind: "failed", reason: describe(cause), stagingRetained };
+  }
+  if (bytes !== declaredBytes) {
+    const stagingRetained = !await discard(staged);
+    return { kind: "incomplete", bytes, stagingRetained };
+  }
+  return { kind: "ready", key, stagedPath: staged, bytes };
+}
+async function publishEntry(store, upload) {
+  try {
+    await link(upload.stagedPath, entryPath(store, upload.key));
+  } catch (cause) {
+    const stagingRetained = !await discard(upload.stagedPath);
+    if (errnoOf(cause) === "EEXIST") {
+      return stagingRetained ? { kind: "exists", stagingRetained } : ALREADY_STORED;
+    }
+    return { kind: "failed", reason: describe(cause), stagingRetained };
+  }
+  const stagingRetained = !await discard(upload.stagedPath);
+  return { kind: "stored", bytes: upload.bytes, stagingRetained };
+}
+async function discard(staged) {
+  try {
+    await unlink(staged);
+    return true;
+  } catch (cause) {
+    if (errnoOf(cause) === "ENOENT")
+      return true;
+    logLine(`ev=staging.leaked path=${logValue(staged)} reason=${logValue(describe(cause))}`);
+    return false;
+  }
+}
+function errnoOf(cause) {
+  if (typeof cause !== "object" || cause === null || !("code" in cause))
+    return;
+  const { code } = cause;
+  return typeof code === "string" ? code : undefined;
+}
+function describe(cause) {
+  if (cause instanceof Error) {
+    const errno = errnoOf(cause);
+    return errno === undefined ? cause.message : `${errno}: ${cause.message}`;
+  }
+  return String(cause);
+}
+
+// src/gc.ts
+function insertionOrder(entries) {
+  return [...entries].sort((a, b) => a.mtimeMs - b.mtimeMs || (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+}
+async function sweep(store, capBytes, hand, protectedPath) {
+  const ring = insertionOrder(await store.list());
+  const usedBefore = ring.reduce((sum, e) => sum + e.size, 0);
+  let used = usedBefore;
+  let deleted = 0;
+  let cleared = 0;
+  let cursor = hand;
+  if (used > capBytes && ring.length > 0) {
+    const start = ring.findIndex((e) => e.mtimeMs >= hand);
+    const order = start < 0 ? ring : [...ring.slice(start), ...ring.slice(0, start)];
+    for (let round = 0;round < 2 && used > capBytes; round++) {
+      for (const entry of order) {
+        if (used <= capBytes)
+          break;
+        if (entry.path === protectedPath)
+          continue;
+        const visited = entry.atimeMs > entry.mtimeMs;
+        if (round === 1 && !visited)
+          continue;
+        if (round === 0 && visited) {
+          await store.clearVisited(entry);
+          cleared++;
+        } else {
+          await store.evict(entry);
+          used -= entry.size;
+          deleted++;
+          cursor = entry.mtimeMs;
+        }
+      }
+    }
+  }
+  return { usedBefore, usedAfter: used, deleted, cleared, hand: cursor };
+}
+function directoryStore(entries) {
+  return {
+    async list() {
+      const names = await readdir2(entries);
+      const out = [];
+      for (const name of names) {
+        if (!isCacheKey(name))
+          continue;
+        const path = join2(entries, name);
+        const s = await lstat(path);
+        if (s.isFile())
+          out.push({
+            path,
+            mtimeMs: s.mtimeMs,
+            atimeMs: s.atimeMs,
+            size: s.size
+          });
+      }
+      return out;
+    },
+    async clearVisited(entry) {
+      await utimes(entry.path, entry.mtimeMs / 1000, entry.mtimeMs / 1000);
+    },
+    async evict(entry) {
+      await rm(entry.path, { force: true });
+    }
+  };
+}
+async function sweepDirectory(store, capBytes, protectedKey) {
+  const entries = store.directory;
+  const handFile = join2(entries, "..", "sieve.hand");
+  const temporary = `${handFile}.tmp`;
+  try {
+    let hand = 0;
+    try {
+      const text = (await readFile(handFile, "utf8")).trim();
+      hand = Number(text);
+      if (text === "" || !Number.isFinite(hand) || hand < 0) {
+        return { ok: false, reason: `Invalid SIEVE cursor in ${handFile}.` };
+      }
+    } catch (cause) {
+      if (errnoOf(cause) !== "ENOENT")
+        return { ok: false, reason: describe(cause) };
+    }
+    const protectedPath = protectedKey === undefined ? undefined : entryPath(store, protectedKey);
+    const outcome = await sweep(directoryStore(entries), capBytes, hand, protectedPath);
+    await Bun.write(temporary, `${outcome.hand}
+`);
+    await rename(temporary, handFile);
+    logLine(`ev=gc used_before=${outcome.usedBefore} used_after=${outcome.usedAfter} cap=${capBytes} deleted=${outcome.deleted} cleared=${outcome.cleared} hand=${outcome.hand}`);
+    return { ok: true, outcome };
+  } catch (cause) {
+    const reason = describe(cause);
+    logLine(`ev=gc.failed reason=${logValue(reason)}`);
+    return { ok: false, reason };
+  }
+}
+if (false) {}
+
+// src/server.ts
+var CACHE_ROUTE = "/v1/cache/:hash";
+var OCTET_STREAM = {
+  "content-type": "application/octet-stream"
+};
+var PLAIN = {
+  "content-type": "text/plain"
+};
+var PLAIN_UNAUTHENTICATED = {
+  "content-type": "text/plain",
+  "www-authenticate": "Bearer"
+};
+var MISS_BODY = `No cache entry for that key.
+`;
+var FRAMING_CEILING = Number.MAX_SAFE_INTEGER;
+async function startCacheServer(config) {
+  let opened;
+  try {
+    opened = await openCacheStore(config.directory);
+  } catch (cause) {
+    return { ok: false, stage: "store", directory: config.directory, reason: describe(cause) };
+  }
+  if (!opened.ok) {
+    return {
+      ok: false,
+      stage: "store-locked",
+      directory: config.directory,
+      path: opened.path,
+      reason: `EWOULDBLOCK: another process holds the store lock at ${opened.path}`
+    };
+  }
+  const store = opened.store;
+  const initial = await sweepDirectory(store, config.capBytes);
+  if (!initial.ok) {
+    await store.close();
+    return { ok: false, stage: "gc", directory: config.directory, reason: initial.reason };
+  }
+  const admission = { reservedBytes: 0 };
+  let publishing = Promise.resolve();
+  function publish(upload) {
+    const next = publishing.then(async () => {
+      const outcome = await publishEntry(store, upload);
+      if (outcome.kind !== "stored")
+        return outcome;
+      const retained = await sweepDirectory(store, config.capBytes, upload.key);
+      return retained.ok ? outcome : {
+        kind: "failed",
+        reason: retained.reason,
+        stagingRetained: outcome.stagingRetained
+      };
+    });
+    publishing = next.then(() => {});
+    return next;
+  }
+  try {
+    const server = Bun.serve({
+      hostname: config.host,
+      port: config.port,
+      maxRequestBodySize: FRAMING_CEILING,
+      routes: {
+        [CACHE_ROUTE]: {
+          GET: (request) => handleGet(store, config, request),
+          PUT: (request) => handlePut(store, config, request, admission, publish)
+        }
+      },
+      fetch(request) {
+        const { pathname } = new URL(request.url);
+        logLine(`ev=unrouted method=${logValue(request.method)} path=${logValue(pathname)} status=404`);
+        return new Response(`This server serves /v1/cache/<hash> only (GET, PUT). A path with a doubled slash means NX_SELF_HOSTED_REMOTE_CACHE_SERVER carries a trailing slash.
+`, { status: 404, headers: PLAIN });
+      },
+      error(failure) {
+        logLine(`ev=server.error status=500 reason=${logValue(String(failure.message ?? failure))}`);
+        return new Response(`The cache server failed to handle that request; see its log.
+`, {
+          status: 500,
+          headers: PLAIN
+        });
+      }
+    });
+    const principals = config.principals.map((principal) => `${principal.label}:${principal.capability}`).join(",");
+    logLine(`ev=listening origin=${server.url.origin} dir=${logValue(config.directory)} principals=${principals} max_bytes=${config.maxBytes} cap_bytes=${config.capBytes} reclaimed_staging=${store.reclaimedStagingFiles}`);
+    return {
+      ok: true,
+      server: {
+        origin: server.url.origin,
+        port: server.port ?? config.port,
+        reclaimedStagingFiles: store.reclaimedStagingFiles,
+        async stop() {
+          await server.stop(false);
+          await publishing;
+          await store.close();
+        }
+      }
+    };
+  } catch (cause) {
+    await store.close();
+    return { ok: false, stage: "listen", directory: config.directory, reason: describe(cause) };
+  }
+}
+async function handleGet(store, config, request) {
+  const startedNs = Bun.nanoseconds();
+  const key = request.params.hash;
+  const principal = authorize(config.principals, request.headers.get("authorization"));
+  if (principal === undefined) {
+    record("get", key, undefined, 401, 0, startedNs, "unauthenticated");
+    return unauthenticated();
+  }
+  if (!isCacheKey(key)) {
+    record("get", key, principal, 404, 0, startedNs, "invalid-key");
+    return new Response(MISS_BODY, { status: 404, headers: PLAIN });
+  }
+  const entry = await readEntry(store, key);
+  switch (entry.kind) {
+    case "missing":
+      record("get", key, principal, 404, 0, startedNs, "miss");
+      return new Response(MISS_BODY, { status: 404, headers: PLAIN });
+    case "failed":
+      record("get", key, principal, 500, 0, startedNs, entry.reason);
+      return new Response(`The cache server could not read that artifact; see its log.
+`, {
+        status: 500,
+        headers: PLAIN
+      });
+    case "found":
+      record("get", key, principal, 200, entry.bytes, startedNs, undefined);
+      return new Response(entry.body, { status: 200, headers: OCTET_STREAM });
+  }
+}
+async function handlePut(store, config, request, admission, publish) {
+  const startedNs = Bun.nanoseconds();
+  const key = request.params.hash;
+  const principal = authorize(config.principals, request.headers.get("authorization"));
+  if (principal === undefined) {
+    record("put", key, undefined, 401, 0, startedNs, "unauthenticated");
+    return unauthenticated();
+  }
+  if (principal.capability !== "write") {
+    record("put", key, principal, 403, 0, startedNs, "read-only-token");
+    return new Response(`This token may read the cache but not publish into it.
+`, { status: 403, headers: PLAIN });
+  }
+  if (!isCacheKey(key)) {
+    record("put", key, principal, 400, 0, startedNs, "invalid-key");
+    return new Response(`A cache key is 1-128 characters of [A-Za-z0-9_-].
+`, {
+      status: 400,
+      headers: PLAIN
+    });
+  }
+  const header = request.headers.get("content-length");
+  if (header === null) {
+    record("put", key, principal, 411, 0, startedNs, "no-declared-length");
+    return new Response(`A cache artifact must arrive with a content-length.
+`, { status: 411, headers: PLAIN });
+  }
+  const declared = Number(header);
+  if (!Number.isInteger(declared) || declared < 1) {
+    record("put", key, principal, 400, 0, startedNs, "bad-declared-length");
+    return new Response(`content-length must be a positive integer.
+`, {
+      status: 400,
+      headers: PLAIN
+    });
+  }
+  if (declared > config.maxBytes) {
+    record("put", key, principal, 403, declared, startedNs, "over-max-bytes");
+    return new Response(`This artifact exceeds the server's ${config.maxBytes}-byte limit.
+`, {
+      status: 403,
+      headers: PLAIN
+    });
+  }
+  if (declared > config.capBytes - admission.reservedBytes) {
+    record("put", key, principal, 403, declared, startedNs, "staging-capacity");
+    return new Response(`The staging byte budget is full; nothing was stored.
+`, {
+      status: 403,
+      headers: PLAIN
+    });
+  }
+  admission.reservedBytes += declared;
+  logLine(`ev=staging.reserved key=${logValue(key)} declared_bytes=${declared} reserved_bytes=${admission.reservedBytes} cap=${config.capBytes}`);
+  let stagingRetained = false;
+  try {
+    const staged = await stageEntry(store, key, request.body, declared);
+    if (staged.kind !== "ready") {
+      stagingRetained = staged.stagingRetained;
+      if (staged.kind === "incomplete") {
+        record("put", key, principal, 400, staged.bytes, startedNs, "body-shorter-than-declared");
+        return new Response(`That body ended after ${staged.bytes} of the ${declared} bytes it declared; nothing was stored.
+`, { status: 400, headers: PLAIN });
+      }
+      record("put", key, principal, 500, 0, startedNs, staged.reason);
+      return new Response(`The cache server could not stage that artifact; see its log.
+`, {
+        status: 500,
+        headers: PLAIN
+      });
+    }
+    const outcome = await publish(staged);
+    stagingRetained = outcome.stagingRetained;
+    if (outcome.kind === "stored") {
+      record("put", key, principal, 200, outcome.bytes, startedNs, undefined);
+      return new Response(`stored
+`, { status: 200, headers: PLAIN });
+    }
+    if (outcome.kind === "exists") {
+      record("put", key, principal, 409, 0, startedNs, "already-stored");
+      return new Response(`That key already holds an artifact; a cache entry is never replaced.
+`, {
+        status: 409,
+        headers: PLAIN
+      });
+    }
+    record("put", key, principal, 500, 0, startedNs, outcome.reason);
+    return new Response(`The cache server could not publish or retain that artifact; see its log.
+`, {
+      status: 500,
+      headers: PLAIN
+    });
+  } finally {
+    if (stagingRetained) {
+      logLine(`ev=staging.reservation-retained key=${logValue(key)} declared_bytes=${declared} reserved_bytes=${admission.reservedBytes} reason=cleanup-failed`);
+    } else {
+      admission.reservedBytes -= declared;
+      logLine(`ev=staging.released key=${logValue(key)} declared_bytes=${declared} reserved_bytes=${admission.reservedBytes}`);
+    }
+  }
+}
+function authorize(principals, header) {
+  if (header === null)
+    return;
+  let authorized;
+  for (const principal of principals) {
+    if (secretEquals(header, principal.bearer))
+      authorized = principal;
+  }
+  return authorized;
+}
+function secretEquals(received, expected) {
+  if (received.length !== expected.length)
+    return false;
+  let difference = 0;
+  for (let index = 0;index < expected.length; index += 1) {
+    difference |= received.charCodeAt(index) ^ expected.charCodeAt(index);
+  }
+  return difference === 0;
+}
+function unauthenticated() {
+  return new Response("Missing or unknown bearer token. Send `Authorization: Bearer <token>` with a token this server was started with (NX_CACHE_SERVER_WRITE_TOKENS or NX_CACHE_SERVER_READ_TOKENS); nx sends the one in NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN.\n", { status: 401, headers: PLAIN_UNAUTHENTICATED });
+}
+function record(event, key, principal, status, bytes, startedNs, reason) {
+  const microseconds = Math.round((Bun.nanoseconds() - startedNs) / 1000);
+  const attribution = principal === undefined ? "-" : principal.label;
+  const because = reason === undefined ? "" : ` reason=${logValue(reason)}`;
+  logLine(`ev=${event} key=${logValue(key)} principal=${attribution} status=${status} bytes=${bytes} us=${microseconds}${because}`);
+}
+
+// src/main.ts
+var exitOnStdinEof = false;
+var argumentProblems = [];
+for (let position = 2;position < Bun.argv.length; position++) {
+  if (Bun.argv[position] === "--exit-on-stdin-eof") {
+    exitOnStdinEof = true;
+  } else {
+    argumentProblems.push(`argument ${position - 1} is unsupported; the only supported argument is --exit-on-stdin-eof`);
+  }
+}
+if (argumentProblems.length > 0) {
+  console.log(JSON.stringify({ kind: "failed", stage: "config", problems: argumentProblems }));
+  console.error("nx-cache-server refuses to start:");
+  for (const problem of argumentProblems) {
+    console.error(`  - ${problem}`);
+  }
+  process.exit(2);
+}
+var configured = cacheServerConfigFromEnv(Bun.env);
+if (!configured.ok) {
+  console.log(JSON.stringify({ kind: "failed", stage: "config", problems: configured.problems }));
+  console.error("nx-cache-server refuses to start:");
+  for (const problem of configured.problems) {
+    console.error(`  - ${problem}`);
+  }
+  process.exit(2);
+}
+var started = await startCacheServer(configured.config);
+if (!started.ok) {
+  console.log(JSON.stringify({ kind: "failed", ...started }));
+  console.error(`nx-cache-server ${started.stage} failed in ${started.directory}: ${started.reason}`);
+  process.exit(1);
+}
+var running = started.server;
+console.log(JSON.stringify({
+  kind: "ready",
+  origin: running.origin,
+  port: running.port,
+  reclaimedStagingFiles: running.reclaimedStagingFiles
+}));
+var stopping = false;
+function stop(fields, exitCode = 0) {
+  if (stopping)
+    return;
+  stopping = true;
+  logLine(`ev=stopping ${fields}`);
+  running.stop().then(() => process.exit(exitCode), (failure) => {
+    logLine(`ev=stop.failed reason=${logValue(describe(failure))}`);
+    process.exit(1);
+  });
+}
+for (const signal of ["SIGINT", "SIGTERM"]) {
+  process.on(signal, () => stop(`signal=${signal}`));
+}
+if (exitOnStdinEof) {
+  process.stdin.once("end", () => stop("reason=supervisor-eof"));
+  process.stdin.once("error", (failure) => {
+    logLine(`ev=supervisor.error reason=${logValue(describe(failure))}`);
+    stop("reason=supervisor-error", 1);
+  });
+  process.stdin.resume();
+}