@tomflow/proflow-platform-cli 0.1.13 → 0.1.15

package/dist/src/lifecycle/service-process.js

@@ -1,356 +0,0 @@
-import { execFile, spawn } from "node:child_process";
-import { mkdir, open, readFile, rm } from "node:fs/promises";
-import { createRequire } from "node:module";
-import { dirname, join, resolve } from "node:path";
-import { pathToFileURL } from "node:url";
-import { promisify } from "node:util";
-import { serviceProcessBindingSchema, } from "@tomflow/proflow-module-contract";
-import { writeJsonAtomic } from "../persistence/atomic.js";
-const execFileAsync = promisify(execFile);
-function base(module) {
-    return {
-        contract: "deployment.result.v1",
-        ok: true,
-        status: "SUCCEEDED",
-        moduleRef: module.moduleRef,
-        moduleVersion: module.moduleVersion,
-    };
-}
-function actionRequired(module, action, description, checks = []) {
-    return {
-        ...base(module),
-        ok: false,
-        status: "ACTION_REQUIRED",
-        actionRequired: { action, description },
-        checks,
-    };
-}
-function failed(module, message) {
-    return {
-        ...base(module),
-        ok: false,
-        status: "FAILED",
-        error: { code: "COMMAND_FAILED", message, retryable: true },
-    };
-}
-function serviceDir(paths, moduleRef) {
-    return join(paths.runtime, "services", moduleRef);
-}
-function recordPath(paths, moduleRef) {
-    return join(serviceDir(paths, moduleRef), "process.json");
-}
-async function readRecord(paths, moduleRef) {
-    try {
-        const raw = JSON.parse(await readFile(recordPath(paths, moduleRef), "utf8"));
-        if (typeof raw !== "object" || raw === null)
-            return undefined;
-        const value = raw;
-        if (value.contract !== "deployment.service-process-state.v1" ||
-            typeof value.pid !== "number" ||
-            typeof value.moduleRef !== "string" ||
-            typeof value.packageName !== "string" ||
-            typeof value.moduleVersion !== "string" ||
-            typeof value.binPath !== "string" ||
-            typeof value.configPath !== "string" ||
-            typeof value.stdoutPath !== "string" ||
-            typeof value.stderrPath !== "string" ||
-            typeof value.startedAt !== "string")
-            return undefined;
-        return value;
-    }
-    catch {
-        return undefined;
-    }
-}
-function recordIdentityMatchesModule(record, module) {
-    return (record.moduleRef === module.moduleRef &&
-        record.packageName === module.packageName);
-}
-function recordVersionMatchesModule(record, module) {
-    return record.moduleVersion === module.moduleVersion;
-}
-function isAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-async function isOwnedProcess(record) {
-    if (!isAlive(record.pid))
-        return false;
-    try {
-        let commandLine;
-        if (process.platform === "win32") {
-            const result = await execFileAsync("powershell.exe", [
-                "-NoProfile",
-                "-Command",
-                `(Get-CimInstance Win32_Process -Filter "ProcessId = ${record.pid}").CommandLine`,
-            ], { encoding: "utf8" });
-            commandLine = result.stdout;
-        }
-        else {
-            const result = await execFileAsync("ps", ["-p", String(record.pid), "-o", "command="], { encoding: "utf8" });
-            commandLine = result.stdout;
-        }
-        return (commandLine.includes(record.binPath) &&
-            commandLine.includes(record.configPath));
-    }
-    catch {
-        return false;
-    }
-}
-async function removeRecord(paths, moduleRef) {
-    await rm(recordPath(paths, moduleRef), { force: true });
-}
-async function resolvePackageRoot(workspaceRoot, module) {
-    if (module.source.type === "workspace") {
-        if (!module.source.path)
-            throw new Error(`workspace source missing path for ${module.packageName}`);
-        return module.source.path;
-    }
-    if (module.source.type !== "installed") {
-        throw new Error(`registry bootstrap target ${module.packageName} has no local package root`);
-    }
-    const require = createRequire(pathToFileURL(join(workspaceRoot, "package.json")));
-    const artifact = require.resolve(`${module.packageName}/deployment/descriptor`);
-    let current = dirname(artifact);
-    for (;;) {
-        try {
-            const parsed = JSON.parse(await readFile(join(current, "package.json"), "utf8"));
-            if (parsed.name === module.packageName)
-                return current;
-        }
-        catch {
-            // keep walking upward
-        }
-        const parent = dirname(current);
-        if (parent === current)
-            throw new Error(`package root not found for ${module.packageName}`);
-        current = parent;
-    }
-}
-async function resolveOwnedBin(workspaceRoot, module, binding) {
-    const packageRoot = await resolvePackageRoot(workspaceRoot, module);
-    const manifest = JSON.parse(await readFile(join(packageRoot, "package.json"), "utf8"));
-    const relative = typeof manifest.bin === "string"
-        ? manifest.bin
-        : manifest.bin?.[binding.bin];
-    if (typeof relative !== "string")
-        throw new Error(`package ${module.packageName} does not own bin ${binding.bin}`);
-    const target = resolve(packageRoot, relative);
-    const root = resolve(packageRoot);
-    if (target !== root && !target.startsWith(`${root}/`))
-        throw new Error(`service bin escapes package root: ${relative}`);
-    return target;
-}
-export async function managedServiceStatus(paths, module) {
-    const record = await readRecord(paths, module.moduleRef);
-    if (!record || !(await isOwnedProcess(record))) {
-        if (record)
-            await removeRecord(paths, module.moduleRef);
-        return {
-            result: actionRequired(module, "start-service", "Service process is not running", [
-                {
-                    id: "service-process-live",
-                    status: "FAIL",
-                    message: "No live managed service process",
-                },
-            ]),
-            observedEffects: [],
-        };
-    }
-    if (!recordIdentityMatchesModule(record, module)) {
-        return {
-            result: failed(module, "managed service state identity does not match the current module"),
-            observedEffects: [],
-        };
-    }
-    if (!recordVersionMatchesModule(record, module)) {
-        return {
-            result: actionRequired(module, "restart-service", `Managed service process is still running package version ${record.moduleVersion}; restart is required for ${module.moduleVersion}`, [
-                {
-                    id: "service-process-version",
-                    status: "FAIL",
-                    message: `Running ${record.moduleVersion}, installed ${module.moduleVersion}`,
-                },
-            ]),
-            observedEffects: [],
-        };
-    }
-    return {
-        result: {
-            ...base(module),
-            data: { state: "RUNNING", pid: record.pid, startedAt: record.startedAt },
-            checks: [
-                {
-                    id: "service-process-live",
-                    status: "PASS",
-                    message: `Managed service process ${record.pid} is alive`,
-                },
-            ],
-        },
-        observedEffects: [],
-    };
-}
-async function waitForStartupStability(pid, milliseconds = 500) {
-    const deadline = Date.now() + milliseconds;
-    while (Date.now() < deadline) {
-        if (!isAlive(pid))
-            return false;
-        await new Promise((resolveWait) => setTimeout(resolveWait, 50));
-    }
-    return isAlive(pid);
-}
-export async function startManagedService(paths, module, rawBinding) {
-    const existing = await readRecord(paths, module.moduleRef);
-    if (existing && (await isOwnedProcess(existing))) {
-        if (!recordIdentityMatchesModule(existing, module)) {
-            return {
-                result: failed(module, "managed service state identity does not match the current module"),
-                observedEffects: [],
-            };
-        }
-        return managedServiceStatus(paths, module);
-    }
-    if (existing)
-        await removeRecord(paths, module.moduleRef);
-    const binding = serviceProcessBindingSchema.parse(rawBinding);
-    let binPath;
-    try {
-        binPath = await resolveOwnedBin(paths.root, module, binding);
-    }
-    catch (error) {
-        return {
-            result: failed(module, error instanceof Error ? error.message : String(error)),
-            observedEffects: [],
-        };
-    }
-    const dir = serviceDir(paths, module.moduleRef);
-    const configPath = join(dir, "config.json");
-    const stdoutPath = join(paths.logsDeployment, `${module.moduleRef}.stdout.log`);
-    const stderrPath = join(paths.logsDeployment, `${module.moduleRef}.stderr.log`);
-    await writeJsonAtomic(configPath, binding.config, 0o600);
-    await mkdir(paths.logsDeployment, { recursive: true });
-    const stdout = await open(stdoutPath, "a");
-    const stderr = await open(stderrPath, "a");
-    try {
-        const child = spawn(process.execPath, [binPath, binding.startCommand, configPath], {
-            cwd: paths.root,
-            detached: true,
-            env: process.env,
-            stdio: ["ignore", stdout.fd, stderr.fd],
-        });
-        await new Promise((resolveSpawn, rejectSpawn) => {
-            child.once("spawn", resolveSpawn);
-            child.once("error", rejectSpawn);
-        });
-        if (child.pid === undefined)
-            return {
-                result: failed(module, "service process spawned without pid"),
-                observedEffects: [],
-            };
-        const pid = child.pid;
-        if (!(await waitForStartupStability(pid))) {
-            return {
-                result: failed(module, `service process ${pid} exited during startup stabilization`),
-                observedEffects: [],
-            };
-        }
-        child.unref();
-        const record = {
-            contract: "deployment.service-process-state.v1",
-            moduleRef: module.moduleRef,
-            packageName: module.packageName,
-            moduleVersion: module.moduleVersion,
-            pid,
-            startedAt: new Date().toISOString(),
-            binPath,
-            configPath,
-            stdoutPath,
-            stderrPath,
-        };
-        await writeJsonAtomic(recordPath(paths, module.moduleRef), record, 0o600);
-        const observed = await managedServiceStatus(paths, module);
-        if (observed.result.status !== "SUCCEEDED") {
-            await removeRecord(paths, module.moduleRef);
-            try {
-                process.kill(pid, "SIGTERM");
-            }
-            catch {
-                // process already exited between observations
-            }
-            return {
-                result: failed(module, `service process ${pid} could not be observed as the owned RUNNING process after spawn`),
-                observedEffects: [],
-            };
-        }
-        return {
-            ...observed,
-            observedEffects: ["Manage the declared service process"],
-        };
-    }
-    catch (error) {
-        return {
-            result: failed(module, error instanceof Error ? error.message : String(error)),
-            observedEffects: [],
-        };
-    }
-    finally {
-        await Promise.all([stdout.close(), stderr.close()]);
-    }
-}
-async function waitForExit(pid, timeoutMs = 2_000) {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-        if (!isAlive(pid))
-            return true;
-        await new Promise((resolveWait) => setTimeout(resolveWait, 50));
-    }
-    return !isAlive(pid);
-}
-export async function stopManagedService(paths, module) {
-    const record = await readRecord(paths, module.moduleRef);
-    if (!record || !(await isOwnedProcess(record))) {
-        if (record)
-            await removeRecord(paths, module.moduleRef);
-        return {
-            result: { ...base(module), data: { state: "STOPPED" } },
-            observedEffects: [],
-        };
-    }
-    if (!recordIdentityMatchesModule(record, module)) {
-        return {
-            result: failed(module, "managed service state identity does not match the current module"),
-            observedEffects: [],
-        };
-    }
-    try {
-        process.kill(record.pid, "SIGTERM");
-        if (!(await waitForExit(record.pid))) {
-            return {
-                result: failed(module, `service process ${record.pid} did not stop after SIGTERM`),
-                observedEffects: [],
-            };
-        }
-        await removeRecord(paths, module.moduleRef);
-        return {
-            result: { ...base(module), data: { state: "STOPPED", pid: record.pid } },
-            observedEffects: ["Manage the declared service process"],
-        };
-    }
-    catch (error) {
-        return {
-            result: failed(module, error instanceof Error ? error.message : String(error)),
-            observedEffects: [],
-        };
-    }
-}
-export async function restartManagedService(paths, module, binding) {
-    const stopped = await stopManagedService(paths, module);
-    if (stopped.result.status === "FAILED")
-        return stopped;
-    return startManagedService(paths, module, binding);
-}

package/dist/src/manifest/index.d.ts

@@ -1,2 +0,0 @@
-export type { ManifestConfig, ManifestDeps, ManifestModule, ManifestPendingAction, ManifestVerification, PlatformManifest, } from "./manifest.ts";
-export { buildManifest, MANIFEST_CONTRACT } from "./manifest.ts";

package/dist/src/manifest/index.js

@@ -1 +0,0 @@
-export { buildManifest, MANIFEST_CONTRACT } from "./manifest.js";

package/dist/src/manifest/manifest.d.ts

@@ -1,61 +0,0 @@
-import type { ModuleOperationResult } from "@tomflow/proflow-module-contract";
-import type { PlatformState, ResolvedModule, VerificationRecord } from "../contracts.ts";
-import type { ModuleCatalog } from "../modules.ts";
-import type { WorkspacePaths } from "../paths.ts";
-export declare const MANIFEST_CONTRACT = "proflow.manifest.v1";
-export interface ManifestModule {
-    moduleRef: string;
-    packageName: string;
-    moduleVersion: string;
-    kind: ResolvedModule["kind"];
-    source: ResolvedModule["source"];
-    provides: ResolvedModule["provides"];
-    requires: ResolvedModule["requires"];
-    runtimeObserved: boolean;
-    runtimeStatus?: ModuleOperationResult["status"];
-    runtimeResourceVersion?: string;
-    resourceIdentity?: string;
-}
-export interface ManifestVerification {
-    moduleRef: string;
-    historyCount: number;
-    latest?: VerificationRecord;
-    lastPassAt?: string;
-    lastFailAt?: string;
-}
-export interface ManifestConfig {
-    moduleRef: string;
-    values: Record<string, string>;
-    secretRefs: string[];
-    missing: string[];
-}
-export interface ManifestPendingAction {
-    moduleRef?: string;
-    action: string;
-    description?: string;
-}
-export interface PlatformManifest {
-    contract: typeof MANIFEST_CONTRACT;
-    observedAt: string;
-    status: PlatformState;
-    modules: ManifestModule[];
-    verification: ManifestVerification[];
-    config: ManifestConfig[];
-    pendingActions: ManifestPendingAction[];
-}
-export interface ManifestDeps {
-    catalog: ModuleCatalog;
-    modules: readonly ResolvedModule[];
-    paths: WorkspacePaths;
-    config?: Record<string, Record<string, string>>;
-    now?: Date;
-}
-/**
- * Dynamically composes the platform manifest from current reality: the resolved
- * module set, module/adapter versions, external resource identity/version, live
- * runtime status (via `statusModules`, never persisted state), provides/requires,
- * secret-redacted config readiness, verification history summary, pending
- * ACTION_REQUIRED, and the aggregated platform status. Every composition carries
- * an explicit `observedAt` freshness timestamp.
- */
-export declare function buildManifest(deps: ManifestDeps): Promise<PlatformManifest>;

package/dist/src/manifest/manifest.js

@@ -1,167 +0,0 @@
-import { statusModules } from "../lifecycle/index.js";
-import { loadConfig, loadDeploymentState, loadVerificationHistory, } from "../persistence/index.js";
-import { clearCompletedPendingActions } from "../persistence/state.js";
-import { resolveModuleConfig } from "../preflight/index.js";
-import { assessPlatformReady, } from "../ready/index.js";
-import { redactSecretValues } from "../security/index.js";
-import { configFingerprint } from "../verification/index.js";
-export const MANIFEST_CONTRACT = "proflow.manifest.v1";
-function compareRef(a, b) {
-    return a < b ? -1 : a > b ? 1 : 0;
-}
-function lastVerifiedAt(records, result) {
-    for (let i = records.length - 1; i >= 0; i -= 1) {
-        const record = records[i];
-        if (record !== undefined && record.result === result) {
-            return record.verifiedAt;
-        }
-    }
-    return undefined;
-}
-/**
- * Dynamically composes the platform manifest from current reality: the resolved
- * module set, module/adapter versions, external resource identity/version, live
- * runtime status (via `statusModules`, never persisted state), provides/requires,
- * secret-redacted config readiness, verification history summary, pending
- * ACTION_REQUIRED, and the aggregated platform status. Every composition carries
- * an explicit `observedAt` freshness timestamp.
- */
-export async function buildManifest(deps) {
-    const observedAt = (deps.now ?? new Date()).toISOString();
-    const modules = [...deps.modules].sort((a, b) => compareRef(a.moduleRef, b.moduleRef));
-    const statusResults = await statusModules(deps.catalog, modules);
-    const statusByRef = new Map(statusResults.map((run) => [run.moduleRef, run]));
-    const manifestModules = [];
-    const verification = [];
-    const configEntries = [];
-    const allRecords = [];
-    const pendingActions = [];
-    const blockingActions = [];
-    const resources = [];
-    const currentVerifiedModuleRefs = new Set();
-    const materializedConfig = {};
-    for (const module of modules) {
-        // materialized config current reality (never caller-supplied intent)
-        const persisted = await loadConfig(deps.paths, module.moduleRef);
-        if (persisted !== undefined) {
-            materializedConfig[module.moduleRef] = {
-                ...persisted.publicValues,
-                ...persisted.secretValues,
-            };
-        }
-        // live runtime status — current reality, not persisted state
-        const run = statusByRef.get(module.moduleRef);
-        let runtimeObserved = false;
-        let runtimeStatus;
-        let runtimeResourceVersion;
-        if (run !== undefined &&
-            run.status === "EXECUTED" &&
-            run.result !== undefined) {
-            runtimeObserved = true;
-            runtimeStatus = run.result.status;
-            if (run.result.resourceVersion !== undefined) {
-                runtimeResourceVersion = run.result.resourceVersion;
-            }
-            if (run.result.status === "ACTION_REQUIRED" &&
-                run.result.actionRequired !== undefined) {
-                const action = {
-                    moduleRef: module.moduleRef,
-                    action: run.result.actionRequired.action,
-                    description: run.result.actionRequired.description,
-                };
-                pendingActions.push(action);
-                blockingActions.push(action);
-            }
-        }
-        // external resource identity/version
-        let resourceIdentity;
-        if (module.kind === "external-resource") {
-            const secretRefs = module.configSlots
-                .filter((slot) => slot.type === "secretRef")
-                .map((slot) => slot.key);
-            resourceIdentity = configFingerprint(persisted?.publicValues ?? {}, secretRefs);
-            resources.push({
-                moduleRef: module.moduleRef,
-                ...(resourceIdentity !== undefined ? { resourceIdentity } : {}),
-                ...(runtimeResourceVersion !== undefined
-                    ? { resourceVersion: runtimeResourceVersion }
-                    : {}),
-            });
-        }
-        manifestModules.push({
-            moduleRef: module.moduleRef,
-            packageName: module.packageName,
-            moduleVersion: module.moduleVersion,
-            kind: module.kind,
-            source: module.source,
-            provides: module.provides,
-            requires: module.requires,
-            runtimeObserved,
-            ...(runtimeStatus !== undefined ? { runtimeStatus } : {}),
-            ...(runtimeResourceVersion !== undefined
-                ? { runtimeResourceVersion }
-                : {}),
-            ...(resourceIdentity !== undefined ? { resourceIdentity } : {}),
-        });
-        // verification history summary
-        const history = await loadVerificationHistory(deps.paths, module.moduleRef);
-        allRecords.push(...history);
-        const latest = history[history.length - 1];
-        if (latest?.result === "PASS" &&
-            latest.moduleVersion === module.moduleVersion) {
-            currentVerifiedModuleRefs.add(module.moduleRef);
-        }
-        const lastPassAt = lastVerifiedAt(history, "PASS");
-        const lastFailAt = lastVerifiedAt(history, "FAIL");
-        verification.push({
-            moduleRef: module.moduleRef,
-            historyCount: history.length,
-            ...(latest !== undefined ? { latest } : {}),
-            ...(lastPassAt !== undefined ? { lastPassAt } : {}),
-            ...(lastFailAt !== undefined ? { lastFailAt } : {}),
-        });
-        // config readiness, secret-redacted, from materialized current reality
-        const resolved = resolveModuleConfig(module, materializedConfig[module.moduleRef]);
-        configEntries.push({
-            moduleRef: module.moduleRef,
-            values: redactSecretValues(resolved.values, resolved.secretRefs),
-            secretRefs: [...resolved.secretRefs],
-            missing: resolved.missing,
-        });
-    }
-    // persisted pending ACTION_REQUIRED blocks readiness unless its plan is COMPLETE
-    const deploymentState = await loadDeploymentState(deps.paths);
-    if (deploymentState !== undefined) {
-        for (const pending of clearCompletedPendingActions(deploymentState)
-            .pendingActions) {
-            if (currentVerifiedModuleRefs.has(pending.moduleRef))
-                continue;
-            const action = {
-                moduleRef: pending.moduleRef,
-                action: pending.action,
-                ...(pending.description !== undefined
-                    ? { description: pending.description }
-                    : {}),
-            };
-            blockingActions.push(action);
-            pendingActions.push(action);
-        }
-    }
-    const { state } = assessPlatformReady({
-        modules,
-        status: statusResults,
-        verification: allRecords,
-        config: materializedConfig,
-        blockingActions,
-        resources,
-    });
-    return {
-        contract: MANIFEST_CONTRACT,
-        observedAt,
-        status: state,
-        modules: manifestModules,
-        verification,
-        config: configEntries,
-        pendingActions,
-    };
-}

package/dist/src/observer/deployment-summary.d.ts

@@ -1,31 +0,0 @@
-import type { PlatformState } from "../contracts.ts";
-import { type WorkspacePaths } from "../paths.ts";
-export type DeploymentObserverSource = "status" | "verify" | "doctor";
-export type DeploymentObserverModuleStatus = "SUCCEEDED" | "BLOCKED" | "ACTION_REQUIRED" | "FAILED";
-export interface DeploymentObserverSummary {
-    contract: "proflow.deployment-observer-summary.v1";
-    scope: "PLATFORM";
-    source: DeploymentObserverSource;
-    state: PlatformState;
-    selectedModuleCount: number;
-    totalModuleCount: number;
-    observedModuleCount: number;
-    blockingModuleCount: number;
-    modules: readonly {
-        moduleRef: string;
-        status: DeploymentObserverModuleStatus;
-    }[];
-    observedAt: string;
-    freshUntil: string;
-}
-export declare const DEPLOYMENT_OBSERVER_SUMMARY_TTL_MS = 60000;
-export declare function writeDeploymentObserverSummary(input: {
-    paths: WorkspacePaths;
-    source: DeploymentObserverSource;
-    selectedModuleCount: number;
-    totalModuleCount: number;
-    modules: readonly {
-        moduleRef: string;
-        status: DeploymentObserverModuleStatus;
-    }[];
-}): Promise<DeploymentObserverSummary>;

package/dist/src/observer/deployment-summary.js

@@ -1,34 +0,0 @@
-import { join } from "node:path";
-import { atomicWrite } from "../paths.js";
-function stateOf(statuses) {
-    if (statuses.includes("FAILED") || statuses.includes("BLOCKED"))
-        return "NOT_READY";
-    if (statuses.includes("ACTION_REQUIRED"))
-        return "ACTION_REQUIRED";
-    return statuses.length === 0 ? "NOT_READY" : "READY";
-}
-export const DEPLOYMENT_OBSERVER_SUMMARY_TTL_MS = 60_000;
-export async function writeDeploymentObserverSummary(input) {
-    const modules = [...input.modules].sort((a, b) => a.moduleRef.localeCompare(b.moduleRef));
-    const observedAt = new Date();
-    const isCompletePlatformObservation = input.selectedModuleCount === input.totalModuleCount &&
-        modules.length === input.totalModuleCount;
-    const summary = {
-        contract: "proflow.deployment-observer-summary.v1",
-        scope: "PLATFORM",
-        source: input.source,
-        state: isCompletePlatformObservation
-            ? stateOf(modules.map((item) => item.status))
-            : "NOT_READY",
-        selectedModuleCount: input.selectedModuleCount,
-        totalModuleCount: input.totalModuleCount,
-        observedModuleCount: modules.length,
-        blockingModuleCount: modules.filter((item) => item.status !== "SUCCEEDED")
-            .length,
-        modules,
-        observedAt: observedAt.toISOString(),
-        freshUntil: new Date(observedAt.getTime() + DEPLOYMENT_OBSERVER_SUMMARY_TTL_MS).toISOString(),
-    };
-    await atomicWrite(join(input.paths.deployment, "observer-summary.json"), `${JSON.stringify(summary, null, 2)}\n`);
-    return summary;
-}

package/dist/src/persistence/atomic.d.ts

@@ -1,2 +0,0 @@
-export declare function writeFileAtomic(file: string, content: string, mode?: number): Promise<void>;
-export declare function writeJsonAtomic(file: string, value: unknown, mode?: number): Promise<void>;

package/dist/src/persistence/atomic.js

@@ -1,16 +0,0 @@
-import { randomBytes } from "node:crypto";
-import { chmod, mkdir, rename, writeFile } from "node:fs/promises";
-import { dirname } from "node:path";
-// Mode-aware atomic write: bounded write to a temp sibling, then rename into
-// place. This is an enhancement of paths.atomicWrite that pins an explicit file
-// mode (e.g. 0o600 for secret-bearing materialization) independent of umask.
-export async function writeFileAtomic(file, content, mode = 0o644) {
-    await mkdir(dirname(file), { recursive: true });
-    const tmp = `${file}.tmp-${randomBytes(6).toString("hex")}`;
-    await writeFile(tmp, content, { encoding: "utf8", mode });
-    await chmod(tmp, mode);
-    await rename(tmp, file);
-}
-export async function writeJsonAtomic(file, value, mode = 0o644) {
-    await writeFileAtomic(file, `${JSON.stringify(value, null, 2)}\n`, mode);
-}

package/dist/src/persistence/effective-config.d.ts

@@ -1,3 +0,0 @@
-import type { ResolvedModule } from "../contracts.ts";
-import type { WorkspacePaths } from "../paths.ts";
-export declare function mergeEffectiveConfig(paths: WorkspacePaths, modules: readonly ResolvedModule[], provided: Record<string, Record<string, string>>): Promise<Record<string, Record<string, string>>>;