@stim-cli/core 1.20.1 → 1.21.0

package/dist/{core-CzCQ9yWY.mjs → core-DisO3hs1.mjs}

@@ -1,9 +1,11 @@
-import { S as quotedPath, _ as releaseClaim, r as ClaimRefusedError, x as tryAcquireClaim } from "./ownership-claim-O31Y5iIb.mjs";
+import { C as quotedPath, S as tryAcquireClaim, _ as releaseClaim, r as ClaimRefusedError, x as sleepSync } from "./ownership-claim-DHUs_Dir.mjs";
 import fs, { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path, { basename, dirname, join } from "node:path";
-import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { mkdir, rm } from "node:fs/promises";
 import { spawnSync } from "node:child_process";
 import { connect, createServer, isIP } from "node:net";
 //#region dir-lock.ts
@@ -11,9 +13,6 @@ const DEFAULT_LOCK_WAIT_MS = 12e3;
 const DEFAULT_LOCK_POLL_MS = 25;
 const lockDepths = /* @__PURE__ */ new Map();
 const OWNER_MARKER = /^\.stim-claim-[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/;
-function sleepSync(ms) {
-	Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
 /**
 * Whether Windows refused a call on the lock directory because another process is removing it at that
 * moment. NTFS answers ERROR_ACCESS_DENIED, which Node reports as EPERM, until that removal completes,
@@ -90,57 +89,42 @@ function takeLockDirectory(lockPath, claim) {
 	}
 	return marker;
 }
-function acquireDirLock(lockPath, { waitMs, pollMs, ensureParent }) {
+function prepareDirLock(lockPath, ensureParent) {
 	ensureParent?.();
 	statSync(dirname(lockPath));
-	const deadline = Date.now() + waitMs;
-	let claim;
+}
+function attemptDirLock(lockPath, pending) {
+	if (!pending.claim) {
+		const attempt = tryAcquireClaim({
+			root: `${lockPath}.claims`,
+			mode: "exclusive",
+			label: "directory lock"
+		});
+		pending.claim = attempt.acquired;
+		if (attempt.pending) releaseClaim(attempt.pending);
+	}
+	if (!pending.claim) return null;
+	const marker = takeLockDirectory(lockPath, pending.claim);
+	return marker ? {
+		claim: pending.claim,
+		marker
+	} : null;
+}
+function dirLockTimeout(lockPath, claim) {
+	const error = /* @__PURE__ */ new Error(`Timed out waiting for the lock at ${lockPath}. ` + (claim ? `No current Stim holds it: the directory is empty, or an older Stim version holds or left it. If no older Stim is running, remove it and run the command again:\n  rm -rf ${quotedPath(lockPath)}` : "Another Stim process is holding it; wait for that command to finish and run the command again."));
+	error.code = "STIM_LOCK_TIMEOUT";
+	error.lockPath = lockPath;
+	return error;
+}
+function nestedDirLock(lockPath, fn) {
+	lockDepths.set(lockPath, (lockDepths.get(lockPath) ?? 0) + 1);
 	try {
-		for (;;) {
-			if (!claim) {
-				const attempt = tryAcquireClaim({
-					root: `${lockPath}.claims`,
-					mode: "exclusive",
-					label: "directory lock"
-				});
-				claim = attempt.acquired;
-				if (attempt.pending) releaseClaim(attempt.pending);
-			}
-			if (claim) {
-				const marker = takeLockDirectory(lockPath, claim);
-				if (marker) return {
-					claim,
-					marker
-				};
-			}
-			if (Date.now() >= deadline) {
-				const error = /* @__PURE__ */ new Error(`Timed out waiting for the lock at ${lockPath}. ` + (claim ? `No current Stim holds it: the directory is empty, or an older Stim version holds or left it. If no older Stim is running, remove it and run the command again:\n  rm -rf ${quotedPath(lockPath)}` : "Another Stim process is holding it; wait for that command to finish and run the command again."));
-				error.code = "STIM_LOCK_TIMEOUT";
-				error.lockPath = lockPath;
-				throw error;
-			}
-			sleepSync(pollMs);
-		}
-	} catch (error) {
-		releaseClaim(claim);
-		throw error;
+		return fn();
+	} finally {
+		lockDepths.set(lockPath, (lockDepths.get(lockPath) ?? 1) - 1);
 	}
 }
-function withDirLock(lockPath, fn, { waitMs = DEFAULT_LOCK_WAIT_MS, pollMs = DEFAULT_LOCK_POLL_MS, ensureParent } = {}) {
-	const depth = lockDepths.get(lockPath) || 0;
-	if (depth > 0) {
-		lockDepths.set(lockPath, depth + 1);
-		try {
-			return fn();
-		} finally {
-			lockDepths.set(lockPath, (lockDepths.get(lockPath) ?? 1) - 1);
-		}
-	}
-	const { claim, marker } = acquireDirLock(lockPath, {
-		waitMs,
-		pollMs,
-		ensureParent
-	});
+function holdDirLock(lockPath, { claim, marker }, fn) {
 	lockDepths.set(lockPath, 1);
 	try {
 		return fn();
@@ -152,6 +136,52 @@ function withDirLock(lockPath, fn, { waitMs = DEFAULT_LOCK_WAIT_MS, pollMs = DEF
 		releaseClaim(claim);
 	}
 }
+function withDirLock(lockPath, fn, { waitMs = DEFAULT_LOCK_WAIT_MS, pollMs = DEFAULT_LOCK_POLL_MS, ensureParent } = {}) {
+	if ((lockDepths.get(lockPath) || 0) > 0) return nestedDirLock(lockPath, fn);
+	prepareDirLock(lockPath, ensureParent);
+	const deadline = Date.now() + waitMs;
+	const pending = {};
+	let held;
+	try {
+		while (!(held = attemptDirLock(lockPath, pending))) {
+			if (Date.now() >= deadline) throw dirLockTimeout(lockPath, pending.claim);
+			sleepSync(pollMs);
+		}
+	} catch (error) {
+		releaseClaim(pending.claim);
+		throw error;
+	}
+	return holdDirLock(lockPath, held, fn);
+}
+/**
+* `withDirLock` that waits for a contended lock on a timer instead of blocking the thread. `fn` still runs
+* synchronously: nothing awaits between taking the lock, running `fn` and releasing the lock, so the held
+* transaction and reentrant nesting behave exactly as with `withDirLock`.
+* An optional signal cancels acquisition; it cannot interrupt the synchronous transaction.
+*/
+async function withDirLockAsync(lockPath, fn, { waitMs = DEFAULT_LOCK_WAIT_MS, pollMs = DEFAULT_LOCK_POLL_MS, ensureParent, signal } = {}) {
+	signal?.throwIfAborted();
+	if ((lockDepths.get(lockPath) || 0) > 0) return nestedDirLock(lockPath, fn);
+	prepareDirLock(lockPath, ensureParent);
+	const deadline = Date.now() + waitMs;
+	const pending = {};
+	let held;
+	try {
+		while (!(held = attemptDirLock(lockPath, pending))) {
+			if (Date.now() >= deadline) throw dirLockTimeout(lockPath, pending.claim);
+			releaseClaim(pending.claim);
+			pending.claim = void 0;
+			await setTimeout$1(pollMs, void 0, { signal });
+		}
+	} catch (error) {
+		releaseClaim(pending.claim);
+		throw error;
+	}
+	return holdDirLock(lockPath, held, () => {
+		signal?.throwIfAborted();
+		return fn();
+	});
+}
 //#endregion
 //#region state/json-file.ts
 const readScope = new AsyncLocalStorage();
@@ -195,12 +225,94 @@ function readJsonObject(path) {
 	}
 }
 //#endregion
+//#region context.ts
+const ambient = new AsyncLocalStorage();
+/**
+* Runs `fn` with `context` reachable through `ambientContext()`, including after an `await` inside it. A temporary
+* bridge for call sites that are not passed a context yet: `configDir()`, `runId()` and the exec wrapper's base
+* environment.
+*/
+function withAmbientContext(context, fn) {
+	return ambient.run(context, fn);
+}
+/** The context set by `withAmbientContext`, for call sites that are not passed one yet. */
+function ambientContext() {
+	return ambient.getStore();
+}
+/** Writes `text` to the ambient context's output, or to the process stream outside one. */
+function ambientWrite(stream, text) {
+	const context = ambient.getStore();
+	if (context) context.output(stream, text);
+	else process[stream].write(text);
+}
+/** The environment of the ambient context, or `process.env` outside one. */
+function ambientEnv() {
+	return ambient.getStore()?.env ?? process.env;
+}
+//#endregion
 //#region macos-resources.ts
 /** Whether a resource destination is a contained, non-empty path under Contents/Resources. */
 function validMacosResourceDestination(value) {
 	return typeof value === "string" && value.length > 0 && value.length <= 1024 && !value.includes("\0") && !value.includes("\\") && !/^[A-Za-z]:/.test(value) && value.split("/").every((part) => part !== "" && part !== "." && part !== "..");
 }
 //#endregion
+//#region systemd-unit.ts
+const ESCAPES = {
+	"\\": "\\\\",
+	"\"": "\\\"",
+	"\n": "\\n",
+	"	": "\\t",
+	"\r": "\\r"
+};
+const UNESCAPES = {
+	n: "\n",
+	t: "	",
+	r: "\r"
+};
+/**
+* One double-quoted word as systemd.syntax(7) reads it: C escapes inside the quotes, `%` doubled because unit files
+* expand specifiers, and in `ExecStart=` `$` doubled because systemd expands variables in command lines.
+*/
+function quoteUnitWord(value, exec) {
+	return `"${value.replace(/[\\"\n\t\r%$]/g, (char) => char === "%" ? "%%" : char === "$" ? exec ? "$$" : "$" : ESCAPES[char] ?? char)}"`;
+}
+/** The words of a unit value `quoteUnitWord` wrote, or null when the value is not in that form. */
+function unitWords(line, exec) {
+	const out = [];
+	const pattern = /\s*(?:"((?:[^"\\]|\\.)*)"|([^\s"]+))/y;
+	let index = 0;
+	while (index < line.length && line.slice(index).trim()) {
+		pattern.lastIndex = index;
+		const match = pattern.exec(line);
+		if (!match) return null;
+		index = pattern.lastIndex;
+		const raw = match[1] ?? match[2] ?? "";
+		out.push(raw.replace(/\\(.)|%%|\$\$/g, (whole, escaped) => escaped !== void 0 ? UNESCAPES[escaped] ?? escaped : whole === "%%" ? "%" : exec ? "$" : whole));
+	}
+	return out;
+}
+/** The `key=value` lines of a unit file with the section each is in, skipping comments and blank lines. */
+function unitLines(text) {
+	let section = "";
+	const out = [];
+	for (const line of text.split("\n")) {
+		const trimmed = line.trim();
+		if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith(";")) continue;
+		const header = /^\[(.+)\]$/.exec(trimmed)?.[1];
+		if (header) {
+			section = header;
+			continue;
+		}
+		const equals = trimmed.indexOf("=");
+		if (equals > 0) out.push({
+			section,
+			key: trimmed.slice(0, equals).trim(),
+			value: trimmed.slice(equals + 1).trim()
+		});
+	}
+	return out;
+}
+//#endregion
 //#region artifact-store.ts
 function artifactIn(dir) {
 	if (!existsSync(dir)) return null;
@@ -298,6 +410,68 @@ function storeArtifact(dest, buildPath, { runFile, overwrite = false, writeMetad
 	return artifactIn(dest);
 }
 //#endregion
+//#region artifact-store-async.ts
+/** Awaits copying before atomic publication; cancellation before publication preserves the previous entry. */
+async function storeArtifactAsync(dest, buildPath, { runFile, overwrite = false, writeMetadata, onRenameError, signal }) {
+	signal?.throwIfAborted();
+	const existing = artifactIn(dest);
+	if (existing && !overwrite) return existing;
+	const token = randomUUID();
+	const staging = `${dest}.staging-${token}`;
+	const replaced = `${dest}.replaced-${token}`;
+	const target = join(staging, basename(buildPath));
+	await mkdir(staging, { recursive: true });
+	try {
+		signal?.throwIfAborted();
+		try {
+			await runFile("cp", [
+				"-c",
+				"-R",
+				buildPath,
+				target
+			]);
+		} catch {
+			signal?.throwIfAborted();
+			await rm(target, {
+				recursive: true,
+				force: true
+			});
+			signal?.throwIfAborted();
+			await runFile("cp", [
+				"-R",
+				buildPath,
+				target
+			]);
+		}
+		signal?.throwIfAborted();
+		await writeMetadata?.(staging);
+		signal?.throwIfAborted();
+		const published = artifactIn(dest);
+		if (published && !overwrite) return published;
+		mkdirSync(dirname(dest), { recursive: true });
+		if (existsSync(dest)) renameSync(dest, replaced);
+		try {
+			renameSync(staging, dest);
+		} catch (error) {
+			try {
+				renameSync(replaced, dest);
+			} catch {}
+			if (!onRenameError) throw error;
+			await onRenameError(staging);
+		}
+		return artifactIn(dest);
+	} finally {
+		await rm(staging, {
+			recursive: true,
+			force: true
+		});
+		await rm(replaced, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+//#endregion
 //#region compiled-helper.ts
 const RECENT_MS = 6e5;
 const pruned = /* @__PURE__ */ new Set();
@@ -343,9 +517,9 @@ function pruneCompiledHelpers(dir, currentName, name, runningPaths = runningExec
 * Returns `<dir>/<name>-<hash>`, compiling it with `compile` first when it is missing. The hash covers `version` and
 * each input's name and bytes, so a changed source or compiler builds a new helper beside the old one. `compile`
 * writes to a private temporary path that is renamed into place, so concurrent builders never expose a partial file.
-* Pruning is best effort and keeps this helper, the newest previous build, helpers modified in the last ten minutes and running helpers. It runs after a build and on the first call per process.
+* Pruning is best effort and keeps this helper, the newest previous build, helpers modified in the last ten minutes and running helpers. It runs after a build and on the first call per process unless `prune` is false.
 */
-async function compiledHelper({ dir, name, inputs, version, compile }) {
+async function compiledHelper({ dir, name, inputs, version, compile, prune = true }) {
 	const hash = createHash("sha256").update(version);
 	for (const input of inputs) hash.update(basename(input)).update(readFileSync(input));
 	const helper = join(dir, `${name}-${hash.digest("hex").slice(0, 16)}`);
@@ -363,8 +537,10 @@ async function compiledHelper({ dir, name, inputs, version, compile }) {
 			rmSync(output, { force: true });
 		}
 	}
-	if (built || !pruned.has(`${dir}/${name}`)) pruneCompiledHelpers(dir, basename(helper), name);
-	pruned.add(`${dir}/${name}`);
+	if (prune) {
+		if (built || !pruned.has(`${dir}/${name}`)) pruneCompiledHelpers(dir, basename(helper), name);
+		pruned.add(`${dir}/${name}`);
+	}
 	return helper;
 }
 //#endregion
@@ -462,7 +638,7 @@ function createMetroBridge({ gatewayPort, peer, secret }) {
 //#region index.ts
 const warnedRelative = /* @__PURE__ */ new Set();
 function absoluteEnvPath(name) {
-	const value = process.env[name];
+	const value = ambientEnv()[name];
 	if (!value) return null;
 	if (path.isAbsolute(value)) return value;
 	if (!warnedRelative.has(name)) {
@@ -472,7 +648,7 @@ function absoluteEnvPath(name) {
 	return null;
 }
 function configDir() {
-	return absoluteEnvPath("STIM_HOME") || path.join(os.homedir(), ".stim");
+	return ambientContext()?.home ?? (absoluteEnvPath("STIM_HOME") || path.join(os.homedir(), ".stim"));
 }
 /** Creates `dir` and its missing parents owner-only, and narrows an existing `dir` that grants group or other access when the filesystem and owner allow it. */
 function ensurePrivateDir(dir) {
@@ -629,8 +805,29 @@ function updateCacheManifest(file, mutate) {
 		return next;
 	}, { ensureParent: () => fs.mkdirSync(parent, { recursive: true }) });
 }
+function realOrResolved(dir) {
+	try {
+		return fs.realpathSync(dir);
+	} catch {
+		return path.resolve(dir);
+	}
+}
+function cacheDirRefusal(dir) {
+	if (!path.isAbsolute(dir)) return `${dir} is not an absolute path`;
+	const target = realOrResolved(dir);
+	if (path.dirname(target) === target) return `${dir} is a filesystem root`;
+	const guarded = [
+		os.homedir(),
+		os.tmpdir(),
+		configDir()
+	].find((held) => {
+		const inside = path.relative(target, realOrResolved(held));
+		return inside !== ".." && !inside.startsWith(`..${path.sep}`) && !path.isAbsolute(inside);
+	});
+	return guarded ? `${dir} is or contains ${guarded}` : null;
+}
 function registerCache({ dir, name, prune, note, entriesDepth, layout, replaces = [] }) {
-	if (!path.isAbsolute(dir)) return;
+	if (cacheDirRefusal(dir)) return;
 	try {
 		updateCacheManifest(path.join(configDir(), "caches.json"), (caches) => {
 			const others = caches.filter((cache) => cache.dir !== dir && !replaces.some((match) => matchesCache(cache, match)));
@@ -639,7 +836,7 @@ function registerCache({ dir, name, prune, note, entriesDepth, layout, replaces
 				name,
 				prune,
 				note,
-				registeredBy: process.cwd()
+				registeredBy: ambientContext()?.cwd ?? process.cwd()
 			};
 			if (entriesDepth) record.entriesDepth = entriesDepth;
 			if (layout) record.layout = layout;
@@ -657,4 +854,4 @@ function matchesCache(cache, match) {
 	return match.layout === void 0 || cache.layout === match.layout;
 }
 //#endregion
-export { storeArtifact as A, workspaceSlug as C, compiledHelper as D, createMetroGateway as E, readStateFile as F, withStateReadCache as I, withDirLock as L, isJsonObject as M, readJsonFile as N, artifactIn as O, readJsonObject as P, workspaceName as S, createMetroBridge as T, sharedStoreRoot as _, buildCacheRoot as a, workspaceId as b, cachePathSetting as c, hostSimulatorArch as d, metroCacheRoot as f, rotatedLogPath as g, rotateLog as h, buildCacheKey as i, validMacosResourceDestination as j, resolveArtifact as k, configDir as l, registerCache as m, METRO_NAMED_CACHE_LAYOUT as n, cacheManifestLockPath as o, readCacheManifest as p, STORE_ROOT_TAG as r, cacheNameSegment as s, LOG_ROTATE_BYTES as t, ensurePrivateDir as u, tagSharedStore as v, workspaceStateDir as w, workspaceLogDir as x, updateCacheManifest as y };
+export { artifactIn as A, withAmbientContext as B, workspaceName as C, createMetroGateway as D, createMetroBridge as E, unitWords as F, withStateReadCache as G, readJsonFile as H, validMacosResourceDestination as I, withDirLock as K, ambientContext as L, storeArtifact as M, quoteUnitWord as N, compiledHelper as O, unitLines as P, ambientEnv as R, workspaceLogDir as S, workspaceStateDir as T, readJsonObject as U, isJsonObject as V, readStateFile as W, rotatedLogPath as _, buildCacheRoot as a, updateCacheManifest as b, cacheNameSegment as c, ensurePrivateDir as d, hostSimulatorArch as f, rotateLog as g, registerCache as h, buildCacheKey as i, resolveArtifact as j, storeArtifactAsync as k, cachePathSetting as l, readCacheManifest as m, METRO_NAMED_CACHE_LAYOUT as n, cacheDirRefusal as o, metroCacheRoot as p, withDirLockAsync as q, STORE_ROOT_TAG as r, cacheManifestLockPath as s, LOG_ROTATE_BYTES as t, configDir as u, sharedStoreRoot as v, workspaceSlug as w, workspaceId as x, tagSharedStore as y, ambientWrite as z };