@stringsync/splates 0.0.60 → 1.13.3

package/vendor/@stringsync/splates-server/tunnel/setup.d.ts

@@ -0,0 +1,123 @@
+import { type Logger } from "../../../core/log/index.js";
+import { z } from "zod";
+import type { Creds } from "../creds";
+import { CloudflareApi } from "./cloudflare-api";
+import { type SavedTunnel } from "./saved";
+/** The part of a project's creds a tunnel is made with, which the Setup page fills from the device's store alone. */
+export type TunnelCreds = Pick<Creds, "credentials" | "request" | "save">;
+/** What `splates tunnel setup` is asked to make, and what it runs with. */
+export interface SetupOptions {
+    /** The public host name, in a zone of the account. */
+    host: string;
+    /** Who Access lets in, comma separated. */
+    email: string;
+    /** What the tunnel, the Access application and its policy are called. */
+    name: string;
+    /**
+     * The Zero Trust team to make, as in `<team>.cloudflareaccess.com`, when
+     * the account has none yet; "" to use the one it has.
+     */
+    team: string;
+    /** Where the API token is read from, or requested, and the tunnel's token saved. */
+    creds: TunnelCreds;
+    /** The task asking, for the request to name; null outside any. */
+    task: string | null;
+    /** Where what it made is saved for `splates server`. */
+    saved: SavedTunnel;
+    log: Logger;
+    fetch?: typeof fetch;
+}
+/**
+ * Makes everything that carries `host` to `splates server` behind Cloudflare
+ * Access, through the API alone, with the API token the person pasted as
+ * `API_TOKEN`: the Zero Trust organization when the account has none, a
+ * tunnel and its token, the DNS record routing `host` to it, and an Access
+ * application letting in only `email`. What already exists by name is
+ * reused, and changed only where it differs, so running it again is safe,
+ * like `splates init`. Saves what it made, so a bare `splates server` runs it.
+ *
+ * Without the API token, it requests one with instructions for making it,
+ * and refuses with `requested`, to run again once it is saved.
+ */
+export declare function tunnelSetup(opts: SetupOptions): Promise<void>;
+/** What the API token has to be allowed, as the dashboard names each. */
+export declare const TOKEN_PERMISSIONS: string[];
+/** Where an API token is made. */
+export declare const TOKENS_PAGE = "https://dash.cloudflare.com/profile/api-tokens";
+/** How to make the API token, as its request shows on the Creds page. */
+export declare function tokenInstructions(host: string): string;
+/** How long a sign-in through Access lasts before it asks again. */
+export declare const SESSION = "24h";
+/** What the Access application in front of every slot, `*.<zone>`, is called. */
+export declare const SLOTS_APP = "splates-slots";
+/**
+ * The Service Auth policy on the Access application called `name` that
+ * lets in each joined worker's service token, beside the people's policy.
+ */
+export declare function workersPolicy(name: string): string;
+declare const Zone: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    account: z.ZodObject<{
+        id: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+declare const Tunnel: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+}, z.core.$strip>;
+export declare const Include: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+export declare const Policy: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    decision: z.ZodString;
+    include: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export declare const App: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodDefault<z.ZodString>;
+    domain: z.ZodOptional<z.ZodString>;
+    session_duration: z.ZodOptional<z.ZodString>;
+    aud: z.ZodString;
+    policies: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+/**
+ * The Cloudflare account `splates tunnel` works in, through the API with the
+ * token kept as `API_TOKEN`, reporting what it makes to `log`.
+ */
+export declare class CloudflareTunnels {
+    readonly api: CloudflareApi;
+    private readonly log;
+    private constructor();
+    /** The account `api` reaches, for a caller holding the API token already. */
+    static over(api: CloudflareApi, log: Logger): CloudflareTunnels;
+    /**
+     * Opens the account with the token kept as `API_TOKEN`. Without it,
+     * requests it with instructions for making it, and refuses with
+     * `requested`, to run again once it is saved.
+     */
+    static open(creds: TunnelCreds, host: string, task: string | null, log: Logger, fetch?: typeof globalThis.fetch): Promise<CloudflareTunnels>;
+    /** The zone serving `host`: the longest of its suffixes the account has. */
+    findZone(host: string): Promise<z.infer<typeof Zone>>;
+    /**
+     * The tunnel called `name`, made when there is none. Configured locally, so
+     * `cloudflared` carries the host to whichever port `splates server` bound, which
+     * its `--url` says, rather than to one the dashboard pins.
+     */
+    ensureTunnel(account: string, name: string): Promise<z.infer<typeof Tunnel>>;
+    /**
+     * The proxied CNAME routing `host` to the tunnel. One already pointing at
+     * another tunnel is moved to this one; any other record for `host` is someone
+     * else's, and refused rather than replaced.
+     */
+    ensureRoute(zone: string, host: string, tunnel: string): Promise<void>;
+    /**
+     * The self-hosted Access application in front of `host`, guarded by
+     * `policies` alone, in order, and its AUD tag, which Cloudflare assigns
+     * when it is made.
+     */
+    ensureApp(account: string, name: string, host: string, policies: string[]): Promise<string>;
+}
+export {};

package/vendor/@stringsync/splates-server/tunnel/tunnel.d.ts

@@ -0,0 +1,38 @@
+import type { AsyncResource } from "../../../core/disposable/index.js";
+import type { Logger } from "../../../core/log/index.js";
+import type { Ps } from "../../../core/system/index.js";
+import { type AccessConfig } from "./access";
+import type { TunnelProvider } from "./provider";
+import type { SavedTunnel } from "./saved";
+/** The tunnel `splates server` runs to reach the page from elsewhere. */
+export interface TunnelConfig {
+    /** The public hostname the tunnel carries to the page. */
+    host: string;
+    provider: TunnelProvider;
+}
+/**
+ * The tunnel `--tunnel` and `--tunnel-name` ask for, or null when no host is
+ * given, run by `custom`, the provider `splates.config.ts` names, or else by
+ * `cloudflared`. Refused without `access`, so a tunnel never exposes the page
+ * to anyone Cloudflare Access has not let in.
+ */
+export declare function tunnelConfig(host: string, name: string, access: AccessConfig | null, custom: TunnelProvider | null, ps: Ps): TunnelConfig | null;
+/** `host`, lowercased, refused unless it is a host name. */
+export declare function hostName(host: string): string;
+/**
+ * The tunnel `splates tunnel setup` saved, and the Access application in front
+ * of it, which a bare `splates server` runs; null when none was saved. One whose
+ * token the secret store cannot give is logged and left off, never fatal: the
+ * page still answers on this machine.
+ */
+export declare function savedTunnelConfig(saved: SavedTunnel, ps: Ps, log: Logger): Promise<{
+    access: AccessConfig;
+    tunnel: TunnelConfig;
+} | null>;
+/**
+ * Starts `tunnel` carrying its host to `url`, once the page listens. A provider
+ * that is not ready, or that cannot start, is logged and skipped, never fatal:
+ * the page still answers on this machine. The run is what to dispose of with
+ * the server, or null when there is none.
+ */
+export declare function startTunnel(tunnel: TunnelConfig, url: string, log: Logger): Promise<AsyncResource | null>;

package/vendor/@stringsync/splates-server/workers/admin.d.ts

@@ -0,0 +1,37 @@
+import type { Logger } from "../../../core/log/index.js";
+import type { Fs, Ps } from "../../../core/system/index.js";
+/** How a `splates worker` command reaches the running `splates server`. */
+export interface ServerCallOptions {
+    /** The `splates server` to ask; empty for the one this agent runs under. */
+    dev: string;
+    log: Logger;
+    fs?: Fs;
+    ps: Ps;
+    send?: typeof fetch;
+}
+/**
+ * Asks the running `splates server` at `path`, failing with what it said
+ * when it cannot be reached or refuses.
+ */
+export declare function callServer(path: string, opts: ServerCallOptions & {
+    method?: string;
+    body?: unknown;
+}): Promise<unknown>;
+/** `splates worker drain <id>`: takes no new agents on it, or takes them again with `undo`. */
+export declare function drainWorker(opts: ServerCallOptions & {
+    id: string;
+    undo: boolean;
+}): Promise<void>;
+/**
+ * `splates worker remove <id>`: revokes its key and forgets it, once the
+ * agents on it end, or at once with `force`, ending them. This machine's
+ * own only stops taking agents, until `splates worker drain local --undo`.
+ */
+export declare function removeWorker(opts: ServerCallOptions & {
+    id: string;
+    force: boolean;
+}): Promise<void>;
+/** Pauses or resumes automatic starts, as the Queue page's Pause control does. */
+export declare function setQueuePaused(opts: ServerCallOptions & {
+    paused: boolean;
+}): Promise<void>;

package/vendor/@stringsync/splates-server/workers/call-host.d.ts

@@ -0,0 +1,68 @@
+import type { Resource } from "../../../core/disposable/index.js";
+import { z } from "zod";
+import type { WorkerChannel } from "./channel";
+import type { WorkerMachine } from "./machine";
+/** The most of a file one read answers with, once the server gives a limit. */
+export declare const READ_PART: number;
+/**
+ * Answers a server's calls on the machine a task runs on, each request
+ * a message on a `calls` channel and each answer one back, in whatever order
+ * they finish. A read's bytes go as base64.
+ */
+export declare class WorkerCallHost implements Resource {
+    private readonly channel;
+    private readonly machine;
+    private readonly unlisten;
+    constructor(channel: WorkerChannel, machine: WorkerMachine);
+    /** Stops answering, leaving the channel to whoever closes it. */
+    dispose(): void;
+    private answer;
+    private call;
+    private reply;
+}
+/** A question a server asks on a `calls` channel, answered by its id. */
+export declare const CallRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    id: z.ZodNumber;
+    method: z.ZodLiteral<"git">;
+    cwd: z.ZodString;
+    args: z.ZodArray<z.ZodString>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    chunked: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>, z.ZodObject<{
+    id: z.ZodNumber;
+    method: z.ZodLiteral<"processes">;
+}, z.core.$strip>, z.ZodObject<{
+    id: z.ZodNumber;
+    method: z.ZodLiteral<"listening">;
+}, z.core.$strip>, z.ZodObject<{
+    id: z.ZodNumber;
+    method: z.ZodLiteral<"exists">;
+    path: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    id: z.ZodNumber;
+    method: z.ZodLiteral<"scratch">;
+    agent: z.ZodString;
+    cwd: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    id: z.ZodNumber;
+    method: z.ZodLiteral<"read">;
+    path: z.ZodString;
+    from: z.ZodNumber;
+    limit: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>], "method">;
+export type CallRequest = z.infer<typeof CallRequest>;
+/** How a worker answers: `{ id, result }`, or `{ id, error }` saying what went wrong. */
+export declare const CallAnswer: z.ZodUnion<readonly [z.ZodObject<{
+    id: z.ZodNumber;
+    part: z.ZodEnum<{
+        stderr: "stderr";
+        stdout: "stdout";
+    }>;
+    text: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    id: z.ZodNumber;
+    result: z.ZodUnknown;
+}, z.core.$strip>, z.ZodObject<{
+    id: z.ZodNumber;
+    error: z.ZodString;
+}, z.core.$strip>]>;

package/vendor/@stringsync/splates-server/workers/channel.d.ts

@@ -0,0 +1,90 @@
+import type { Resource } from "../../../core/disposable/index.js";
+import { type Eventful } from "../../../core/events/index.js";
+import { type Json } from "./protocol";
+/** What a `WorkerChannel` hears from the other end, each with its seq. */
+export interface WorkerChannelEvents extends Record<string, unknown> {
+    data: {
+        bytes: Uint8Array;
+        seq: number;
+    };
+    message: {
+        body: Json;
+        seq: number;
+    };
+    /** Both ends have closed it, whichever closed first. */
+    close: undefined;
+}
+/** What a channel needs of the session it runs over. */
+export interface WorkerChannelLink {
+    /** Sends a frame in the channel's next seq, and says whether there is room for more. */
+    send(channel: number, frame: {
+        type: "message";
+        body: Json;
+    } | {
+        type: "data";
+        bytes: Uint8Array;
+    } | {
+        type: "close";
+    }): boolean;
+    ack(channel: number, seq: number): void;
+    /** Both ends have said close, so the session can forget the channel. */
+    done(channel: number): void;
+}
+/**
+ * One stream between a server and a worker, such as an agent's stdio or
+ * a PTY: bytes as `data`, and JSON as `message` for what is not bytes (a
+ * resize, an exit code). Its frames survive a reconnect. Disposing it closes
+ * it at both ends, and each hears `close` once both have.
+ */
+export declare class WorkerChannel implements Eventful<WorkerChannelEvents>, Resource {
+    readonly kind: string;
+    readonly params: Json;
+    private readonly link;
+    private readonly dispatcher;
+    readonly events: import("../../../core/events/index.js").Events<WorkerChannelEvents>;
+    private sentClose;
+    private heardClose;
+    private _id;
+    constructor(id: number, kind: string, params: Json, link: WorkerChannelLink);
+    /**
+     * What both ends know it by. One opened before a resumed session's
+     * handshake takes its last id then (`renumber`).
+     */
+    get id(): number;
+    /** Gives it `id` in place of the one it was opened on, before anything is sent on it. */
+    renumber(id: number): void;
+    get closed(): boolean;
+    /**
+     * Returns `false` once the session holds as many unacked bytes as it is
+     * allowed: stop reading whatever feeds this until the session's `drain`.
+     */
+    write(bytes: Uint8Array): boolean;
+    /** As `write`, for JSON. */
+    send(body: Json): boolean;
+    /** Says this end holds everything up to `seq`, for a session that acks by hand. */
+    ack(seq: number): void;
+    dispose(): void;
+    /**
+     * Ends it here without a word to the other end, which no longer knows it,
+     * as a server started again does not; this end hears `close`.
+     */
+    drop(): void;
+    /**
+     * Hands the channel what the other end sent; the session calls it. Says
+     * whether anyone heard it, since a frame nobody heard is the session's to ack.
+     */
+    receive(frame: {
+        type: "message";
+        body: Json;
+        seq: number;
+    } | {
+        type: "data";
+        bytes: Uint8Array;
+        seq: number;
+    } | {
+        type: "close";
+        seq: number;
+    }): boolean;
+    private finishIfDone;
+    private assertOpen;
+}

package/vendor/@stringsync/splates-server/workers/connection.d.ts

@@ -0,0 +1,24 @@
+import { Disposer, type Resource } from "../../../core/disposable/index.js";
+import type { Duration } from "../../../core/time/index.js";
+import type { Negotiated } from "./protocol";
+import type { WorkerSocket } from "./socket";
+/**
+ * One socket's worth of a `WorkerSession`: what goes when the socket does,
+ * while the session's channels and unacked frames stay for the next one.
+ */
+export declare class WorkerConnection implements Resource {
+    readonly socket: WorkerSocket;
+    heard: Duration;
+    readonly resources: Disposer;
+    /** Settles with the handshake, or with why the socket went first. */
+    readonly settled: {
+        promise: Promise<Negotiated>;
+        resolve: (value?: PromiseLike<Negotiated> | Negotiated | undefined) => void;
+        reject: (reason?: any) => void;
+    };
+    /** Past the handshake, so channel frames flow. */
+    live: boolean;
+    ackFlush: Resource | undefined;
+    constructor(socket: WorkerSocket, heard: Duration);
+    dispose(): void;
+}

package/vendor/@stringsync/splates-server/workers/coordinator-state.d.ts

@@ -0,0 +1,44 @@
+import { z } from "zod";
+import type { Document } from "../storage";
+import type { KeptShell } from "../terminal";
+/** What `coordinator.json` holds. */
+declare const Kept: z.ZodObject<{
+    session: z.ZodString;
+    protocol: z.ZodDefault<z.ZodString>;
+    roots: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    terminals: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        handle: z.ZodObject<{
+            worker: z.ZodString;
+            channel: z.ZodNumber;
+        }, z.core.$strip>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+/**
+ * What one `splates server` keeps across its own restarts, in
+ * `~/.splates/coordinator.json`: the session id its workers know it by, so a
+ * worker finds the next run unchanged and keeps every agent it runs for it,
+ * and the roots of the projects whose agents it let go of at its last
+ * restart, for the next run to serve before the worker joins and take them
+ * back, and the shells it let go of, for the next run to take back too.
+ */
+export declare class CoordinatorState {
+    private readonly document;
+    /** What this server's worker sessions answer as, the same across restarts. */
+    readonly session: string;
+    /** The worker protocol the last run spoke; this run's on a fresh start. */
+    readonly protocol: string;
+    /** The projects with agents on the worker at the last restart; none after a fresh start. */
+    readonly roots: string[];
+    /** The pages' shells on the worker at the last restart, by key. */
+    readonly terminals: KeptShell[];
+    private constructor();
+    /**
+     * Reads what the last run kept in `document`, or starts afresh with a session
+     * of its own, written there so the next run answers as the same.
+     */
+    static open(document: Document<z.input<typeof Kept>>): Promise<CoordinatorState>;
+    /** Keeps `roots` as the projects whose agents, and `terminals` as the shells, the next run takes back. */
+    write(roots: string[], terminals: KeptShell[]): Promise<void>;
+}
+export {};

package/vendor/@stringsync/splates-server/workers/daemon.d.ts

@@ -0,0 +1,128 @@
+import type { AsyncResource } from "../../../core/disposable/index.js";
+import type { Logger } from "../../../core/log/index.js";
+import type { Fs, Ps } from "../../../core/system/index.js";
+import { type Clock, Duration, type Timer } from "../../../core/time/index.js";
+import { WorkerSession, type WorkerSessionOptions } from "./session";
+import type { WorkerSocket } from "./socket";
+/** How a worker reaches its server, dialed afresh after each drop. */
+export interface WorkerDialer {
+    /** Where it dials, for the log. */
+    readonly where: string;
+    dial(): Promise<WorkerSocket>;
+    /**
+     * The server's public key to check on each dial, and the key to send
+     * once it has proved itself; absent for a server not checked.
+     */
+    readonly verify?: {
+        coordinator: string;
+        key: string;
+    };
+}
+/** The channels a worker serves, which it says it can in its hello. */
+export declare const WORKER_CAPABILITIES: string[];
+/**
+ * `splates worker run`: a worker that dials out to its server and keeps
+ * dialing, waiting longer after each failure, and runs what it is asked to
+ * on this machine: processes, PTYs and calls. What it runs outlives a
+ * dropped link, since the session replays what the server missed.
+ */
+export declare class WorkerDaemon implements AsyncResource {
+    private readonly dialer;
+    private readonly opts;
+    readonly session: WorkerSession;
+    private readonly hosts;
+    /** The agents and terminals among `hosts`. */
+    private running;
+    private readonly timer;
+    private readonly backoff;
+    private readonly machine;
+    private readonly orphanBound;
+    private readonly clock;
+    private orphaned;
+    /** The bound passed awake: what the server left ends once a redial fails. */
+    private due;
+    private waiting;
+    private stopped;
+    constructor(dialer: WorkerDialer, opts: WorkerDaemonOptions);
+    /**
+     * Dials and serves until disposed, until the server refuses this
+     * worker, or until it asks this one to restart on its build, resolving
+     * with why it stopped: a refusal names that build too, from a
+     * server that says it.
+     */
+    run(): Promise<WorkerEnded>;
+    /**
+     * Asks the server on `socket` to sign a nonce of this worker's
+     * choosing, answering why its signature does not hold under `publicKey`,
+     * or null once it does. Nothing of this worker's key has been sent.
+     */
+    private coordinatorProves;
+    /**
+     * Tells the server this worker's machine is going, as a spot
+     * reclaim's notice says, so its agents carry on elsewhere at once;
+     * answers whether it was told.
+     */
+    leaving(reason: string): boolean;
+    /** Stops dialing and everything this worker runs, and hangs up. */
+    disposeAsync(): Promise<void>;
+    /**
+     * Starts the bound on a lost coordinator. A restart returns in seconds
+     * and takes its channels back; one that does not return within the bound
+     * is gone, and what it left would burn its slot and tokens for good. The
+     * bound counts only time awake, and what it left ends only once a redial
+     * past it fails, so a machine waking from a long sleep reaches its
+     * server before judging it gone.
+     */
+    private orphan;
+    /** Ends what a server gone past the bound left. */
+    private endOrphaned;
+    /** Cuts short the wait between dials, to dial now. */
+    private redial;
+    private serve;
+    private sleep;
+}
+/**
+ * Why `WorkerDaemon.run` stopped: disposed; refused, for speaking another
+ * protocol, with the server's build when it says one; or asked to
+ * restart on the server's build.
+ */
+export type WorkerEnded = {
+    stopped: true;
+} | {
+    refused: string;
+    update?: string;
+} | {
+    update: string;
+};
+/**
+ * Somewhere in the latter half of `wait`, so workers a server's restart
+ * dropped together do not all redial at the same moment.
+ */
+export declare function jittered(wait: Duration, random: () => number): Duration;
+/** Who a `WorkerDaemon` is and what it runs on. */
+export interface WorkerDaemonOptions {
+    /** Stays the same across restarts, so the server resumes its session. */
+    id: string;
+    ps: Ps;
+    fs: Fs;
+    log: Logger;
+    /** The shortest and longest wait between dials. */
+    backoff?: {
+        min: Duration;
+        max: Duration;
+    };
+    /** Spreads each wait between dials, as `Math.random` by default. */
+    random?: () => number;
+    /**
+     * How long, awake, the server's session may stay lost before every
+     * channel it held ends, once a redial past it fails; ten minutes by
+     * default.
+     */
+    orphanBound?: Duration;
+    /** How long a server has to sign the nonce a worker challenges it with; ten seconds by default. */
+    proofWithin?: Duration;
+    /** Paces the session, as `WorkerSession` takes it. */
+    session?: Omit<WorkerSessionOptions, "timer" | "clock" | "capabilities">;
+    timer?: Timer;
+    clock?: Clock;
+}

package/vendor/@stringsync/splates-server/workers/darwin-footprint.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The physical footprint of process `pid` in bytes, as Activity Monitor's
+ * Memory column and `footprint` count it, or null when it cannot be read, as
+ * for another user's process. Resident size counts shared and reclaimable
+ * pages too, which overstates a Bun or Node process several times over.
+ */
+export declare function darwinFootprint(pid: number): number | null;

package/vendor/@stringsync/splates-server/workers/darwin-temperature.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The hottest CPU die sensor on an Apple Silicon Mac, in °C, or null when
+ * none answers. macOS has no public API for these, and `powermetrics` needs
+ * sudo, so this asks IOKit's private HID event system the way macmon and
+ * Stats do, which any user may.
+ */
+export declare function darwinTemperature(): number | null;

package/vendor/@stringsync/splates-server/workers/frame-too-large.d.ts

@@ -0,0 +1,5 @@
+/** A frame the far end could never take, refused at send rather than replayed for ever. */
+export declare class FrameTooLarge extends Error {
+    readonly bytes: number;
+    constructor(bytes: number);
+}

package/vendor/@stringsync/splates-server/workers/git.d.ts

@@ -0,0 +1,11 @@
+import { Git } from "../git";
+import type { Author } from "../git-identity";
+import type { WorkerMachine } from "./machine";
+/**
+ * Git on the worker a checkout is on, rooted at `root`: what `Watch` runs
+ * around an agent's commands, and what the server reads a task's
+ * branch through when its checkout is a worker's clone. Commits there are
+ * signed as the author `identity` names, the server's, when the
+ * worker has none.
+ */
+export declare function workerGit(root: string, machine: WorkerMachine, identity?: Author | null): Git;

package/vendor/@stringsync/splates-server/workers/gone.d.ts

@@ -0,0 +1,36 @@
+import type { Resource } from "../../../core/disposable/index.js";
+import type { Logger } from "../../../core/log/index.js";
+import { type Clock, Duration, type Timer } from "../../../core/time/index.js";
+import type { Scheduler } from "./scheduler";
+/** How long a worker may be away before its agents carry on elsewhere. */
+export declare const GONE_AFTER: Duration;
+/**
+ * Frees the places held on a worker that has been away `after`, as a
+ * machine turned off or carried off is, so each agent there carries on
+ * elsewhere from what its task last pushed, as when the worker is removed.
+ * One that comes back in time takes its agents back up as before. This
+ * machine's own worker is never let go of: it goes with the server.
+ */
+export declare class GoneWorkers implements Resource {
+    private readonly opts;
+    /** Since when each worker away is known to be, by id. */
+    private readonly away;
+    private readonly look;
+    constructor(opts: GoneWorkersOptions);
+    /** Frees each worker away past the bound that holds an agent. */
+    private check;
+    dispose(): void;
+}
+/** What `GoneWorkers` watches. */
+export interface GoneWorkersOptions {
+    /** Each worker but this machine's own, and whether it is connected now. */
+    workers: () => {
+        id: string;
+        connected: boolean;
+    }[];
+    scheduler: Pick<Scheduler, "held" | "release">;
+    timer: Timer;
+    clock: Clock;
+    log: Logger;
+    after?: Duration;
+}

package/vendor/@stringsync/splates-server/workers/identity.d.ts

@@ -0,0 +1,30 @@
+import type { SecretStore } from "../../../core/creds/index.js";
+/** What the server's signing key is kept as, with its other creds. */
+export declare const COORDINATOR_SIGNING_KEY = "SPLATES_COORDINATOR_SIGNING_KEY";
+/** A fresh nonce for a worker to challenge a server with. */
+export declare function challengeNonce(): string;
+/**
+ * Whether `signature` is `publicKey`'s signature over `nonce` and
+ * `session`, as `CoordinatorIdentity.prove` makes it. False for a key or
+ * signature that cannot be read.
+ */
+export declare function proofHolds(publicKey: string, nonce: string, session: string, signature: string): boolean;
+/**
+ * The Ed25519 key a server proves itself to its workers with. Cloudflare
+ * serves one certificate for every connector of a tunnel, so a stolen tunnel
+ * token lets an impostor answer for the server's host; only the holder
+ * of this key can sign a worker's nonce. Its public half is in each join
+ * token, which a worker keeps beside its own key.
+ */
+export declare class CoordinatorIdentity {
+    private readonly privateKey;
+    /** The public key, SPKI as base64url, as a join token carries it. */
+    readonly publicKey: string;
+    private constructor();
+    /** A key kept nowhere, for a server with no store. */
+    static generate(): CoordinatorIdentity;
+    /** The key kept in `store`, made and kept there at the first start. */
+    static open(store: SecretStore): Promise<CoordinatorIdentity>;
+    /** Its signature over a worker's `nonce` and the `session` it answers as. */
+    prove(nonce: string, session: string): string;
+}