@xemahq/xema 0.59.1 → 0.60.1

package/edition/develop-image-probe.mjs

@@ -1,120 +0,0 @@
-// develop-image-probe — learn EARLY which develop images are not built yet.
-//
-// The develop seal verifies every subject's platforms, and only after it has
-// read all of them can it say which coordinates are absent. A develop edition
-// whose producer CI has not finished therefore failed minutes after the
-// content hashes were known. This probe asks the registry one cheap question
-// per subject — does `<developImageRef>:<contentHash>` resolve to a
-// hash-verified manifest — as soon as that subject's hash exists, in parallel
-// with the hashing of the rest, and `settle()` refuses with ONE error naming
-// every missing coordinate. It verifies existence only: the platform check, the
-// digest decision and the size bounds stay in the seal, which still runs. `settle()` also answers the digest each
-// present coordinate resolved to (`<kind>:<id>` -> digest), for a caller that records it (develop image-record).
-
-import { RefusalError } from './collected-refusals.mjs';
-import { developImageRef } from './develop-image-coordinate.mjs';
-import { editionsRoot } from './edition-workspace.mjs';
-import { loadRegistryCredentialDeclarations, splitImageRef } from './registry-credentials.mjs';
-import { isNotPublishedYet } from './seal-image-digests.mjs';
-import { registryClientsFor } from './verify-image-platforms.mjs';
-
-const DEFAULT_PROBE_CONCURRENCY = 6;
-
-/** One subject's line in the "not built yet" refusal of `channel` (develop unless named). */
-export function notBuiltYetMessage(subject, channel = 'develop') {
-  return (
-    `${subject.repo}@${subject.sourceCommit} ${channel} image ` +
-    `${subject.imageRef}:${subject.contentHash} not built yet`
-  );
-}
-
-/** The ONE refusal naming every subject of `channel` (develop unless named) whose coordinate is absent. */
-export function notBuiltYetError(distributionId, missingSubjects, channel = 'develop') {
-  return new RefusalError(
-    `${missingSubjects.length} ${channel} image(s) of "${distributionId}" are not built yet ` +
-      "(the producer's CI is not green or still running):\n  " +
-      missingSubjects.map((subject) => notBuiltYetMessage(subject, channel)).join('\n  '),
-  );
-}
-
-/**
- * @param {object} request
- * @param {string} request.distributionId the edition (named in the refusal)
- * @returns {{ observe(subject: object): void, settle(): Promise<Map<string, string>> }}
- *   `observe` takes a subject with `repo`, `sourceCommit`, `imageRef` (release ref) and `contentHash`
- *   and starts its probe; `settle` waits for all of them and throws when any is absent or unreadable.
- */
-export function createDevelopImageProbe({
-  distributionId,
-  distributionsRoot = editionsRoot(),
-  env = process.env,
-  fetchImpl = globalThis.fetch,
-  run = null,
-  concurrency = DEFAULT_PROBE_CONCURRENCY,
-  progress = null,
-}) {
-  const declarations = loadRegistryCredentialDeclarations(distributionsRoot);
-  const clients = new Map();
-  const outcomes = [];
-  const waiting = [];
-  let active = 0;
-
-  function clientFor(subject) {
-    const { authority } = splitImageRef(subject.imageRef);
-    if (!clients.has(authority)) {
-      for (const [key, client] of registryClientsFor([subject], { declarations, env, fetchImpl, run })) {
-        clients.set(key, client);
-      }
-    }
-    return clients.get(authority);
-  }
-
-  async function probeOne(subject) {
-    const startedAt = Date.now();
-    const { repository } = splitImageRef(subject.imageRef);
-    try {
-      const { digest } = await clientFor(subject).getManifestByTag(repository, subject.contentHash);
-      progress?.(`[probe] ${subject.kind}:${subject.id} present ${Date.now() - startedAt}ms`);
-      return { subject, digest };
-    } catch (error) {
-      progress?.(`[probe] ${subject.kind}:${subject.id} ${isNotPublishedYet(error) ? 'ABSENT' : 'FAILED'} ${Date.now() - startedAt}ms`);
-      return { subject, error };
-    }
-  }
-
-  function next() {
-    const start = waiting.shift();
-    if (start !== undefined) {start();}
-  }
-
-  function schedule(subject) {
-    return new Promise((resolve) => {
-      const start = () => {
-        active += 1;
-        probeOne(subject).then((outcome) => {
-          active -= 1;
-          next();
-          resolve(outcome);
-        });
-      };
-      if (active < concurrency) {start();} else {waiting.push(start);}
-    });
-  }
-
-  return {
-    observe(subject) {
-      const developSubject = { ...subject, imageRef: developImageRef(subject.imageRef) };
-      // Credentials resolve here, on the first subject of each registry, so a missing token stops the run now.
-      clientFor(developSubject);
-      outcomes.push(schedule(developSubject));
-    },
-    async settle() {
-      const settled = await Promise.all(outcomes);
-      const aborting = settled.find(({ error }) => error !== undefined && !isNotPublishedYet(error));
-      if (aborting) {throw aborting.error;}
-      const missing = settled.filter(({ error }) => error !== undefined).map(({ subject }) => subject);
-      if (missing.length > 0) {throw notBuiltYetError(distributionId, missing);}
-      return new Map(settled.map(({ subject, digest }) => [`${subject.kind}:${subject.id}`, digest]));
-    },
-  };
-}

package/edition/develop-image-record.mjs

@@ -1,194 +0,0 @@
-// develop-image-record — the body of `xema edition develop image-record <id> --selection <file> --pins <file> --out <file>`.
-//
-// Writes the edition's image build record (images-from-record.mjs, the file `resolve --images-from` reads) from the
-// records `select-records` selected. Its subjects are per-edition (`<kind>:<id>`), so they come from the checked-out
-// snapshot, which select-records cannot know: the subjects are enumerated as `coverage` enumerates them
-// (resolveDevelopSnapshot, then resolveImages on the normal hashing path, no recorded images).
-//
-//   a first-party subject of a currentResolution member (develop-current-resolution.mjs) is probed as resolve probes it
-//   (createDevelopImageProbe): the digest `<develop repository>:<contentHash>` resolves to goes in `images`, with the
-//   computed hash and the snapshot's source commit.
-//   every other first-party subject takes the selection's image named by its develop repository: digest and hash from
-//   the selection, source commit the one selection.pins names for the repository, which must be the snapshot's. It goes
-//   in `satellites`. Several subjects may share one image.
-//   a third-party subject is ignored: it keeps its pinned seal at resolve.
-//
-// Each entry's platforms are read from the registry BY DIGEST (resolvePublishedPlatforms: the index's runnable
-// children, attestations skipped, each proven by its image config; or the single manifest's config). Every problem is
-// collected and refused at once (ImageBuildRecordError); nothing is written then. The output passes parseImageBuildRecord.
-
-
-import { writeOnce } from './customer-edition-verbs.mjs';
-import { keepsCurrentResolution } from './develop-current-resolution.mjs';
-import { DEVELOP_EDITION_STEPS, resolveDevelopSnapshot } from './develop-edition-resolve.mjs';
-import { developGraphMembers } from './develop-graph.mjs';
-import { developImageRef } from './develop-image-coordinate.mjs';
-import { createDevelopImageProbe } from './develop-image-probe.mjs';
-import { parseSelectionPins } from './develop-selection-pins.mjs';
-import { editionsRoot } from './edition-workspace.mjs';
-import { firstPartySources } from './first-party-source-ids.mjs';
-import { ImageBuildRecordError, parseImageBuildRecord, requireImageBuildRecordKernel, subjectKeyOf } from './images-from-record.mjs';
-import { loadKernelDistributionSchemas } from './lib.mjs';
-import { loadRegistryCredentialDeclarations, splitImageRef } from './registry-credentials.mjs';
-import { readStrictJsonFile } from './strict-json.mjs';
-import { compareStrings } from './string-order.mjs';
-import { registryClientsFor, resolvePublishedPlatforms } from './verify-image-platforms.mjs';
-
-const SELECTION_REQUIRED = Object.freeze(['pins', 'snapshot', 'images', 'behind']);
-const IMAGE_TEXT_KEYS = Object.freeze(['name', 'digest', 'contentHash', 'member']);
-const isPlainObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
-
-/**
- * A selection `select-records` wrote, checked strictly: its four sections are present and shaped, each image names its
- * owning `member`, and `pins` and `currentResolution` pass the one selection-pins validation (40-hex pins, and
- * `currentResolution` exactly what the graph members declare).
- *
- * @param {unknown} document
- * @param {readonly {repo: string}[]} members the develop graph
- * @param {string} source the file, named in the refusal
- */
-export function parseSelection(document, members, source) {
-  if (!isPlainObject(document)) {throw new ImageBuildRecordError(`selection ${source} must be a JSON object`);}
-  const problems = SELECTION_REQUIRED.filter((key) => document[key] === undefined).map((key) => `has no "${key}"`);
-  for (const key of ['snapshot', 'behind']) {
-    if (document[key] !== undefined && !isPlainObject(document[key])) {problems.push(`"${key}" must be an object`);}
-  }
-  if (document.images !== undefined && !Array.isArray(document.images)) {problems.push('"images" must be an array');}
-  (Array.isArray(document.images) ? document.images : []).forEach((image, index) => {
-    for (const key of IMAGE_TEXT_KEYS) {
-      if (!isPlainObject(image) || typeof image[key] !== 'string') {problems.push(`images[${index}].${key} must be a string`);}
-    }
-    if (isPlainObject(image) && image.members !== undefined && !Array.isArray(image.members)) {problems.push(`images[${index}].members must be an array`);}
-  });
-  if (problems.length > 0) {throw new ImageBuildRecordError(`selection ${source} is refused:\n  ${problems.join('\n  ')}`);}
-  parseSelectionPins(document, source, '--selection', members);
-  return document;
-}
-
-const platformOf = ({ platform }) => ({ os: platform.os, architecture: platform.architecture, ...(platform.variant === undefined ? {} : { variant: platform.variant }) });
-
-/** A cached reader of the platforms a develop image serves, read by digest through one registry client per authority. */
-export function createPlatformReader(clientFor) {
-  const cache = new Map();
-  return (repository, digest) => {
-    const key = `${repository}@${digest}`;
-    if (!cache.has(key)) {
-      const { authority, repository: path } = splitImageRef(repository);
-      cache.set(key, resolvePublishedPlatforms({ client: clientFor(authority), repository: path, digest, coordinate: key })
-        .then(({ platforms }) => platforms.map(platformOf)));
-    }
-    return cache.get(key);
-  };
-}
-
-/**
- * @param {object} request
- * @param {string} request.id the edition
- * @param {object} request.pins the snapshot pins
- * @param {object} request.selection a parsed selection
- * @param {object} request.steps resolve steps (tests replace them)
- * @param {Function} [request.resolveSnapshot] ({id, pins, steps}) => {inputs, lock}; replaced by tests
- * @param {Function} request.createProbe ({distributionId}) => the develop image probe
- * @param {(repository: string, digest: string) => Promise<object[]>} request.platformsOf
- * @param {object} request.declaredSources `firstPartySources`
- * @param {Function} [request.loadKernel] the kernel loader (tests replace it)
- * @returns {Promise<{schemaVersion: 1, images: object[], satellites: object[]}>}
- */
-export async function buildImageRecord({ id, pins, selection, steps = DEVELOP_EDITION_STEPS, resolveSnapshot = resolveDevelopSnapshot, createProbe, platformsOf, declaredSources, loadKernel = loadKernelDistributionSchemas }) {
-  const kernel = requireImageBuildRecordKernel(await loadKernel());
-  const { inputs, lock } = await resolveSnapshot({ id, pins, steps });
-  const probe = createProbe({ distributionId: id });
-  const isFirstParty = (subject) => Object.hasOwn(declaredSources, subject.repo);
-  const { imageLock } = await steps.resolveImages(id, {
-    inputs,
-    lock,
-    onSubjectHashed: (subject) => {
-      if (isFirstParty(subject) && keepsCurrentResolution(declaredSources[subject.repo])) {probe.observe(subject);}
-    },
-  });
-  const probed = await probe.settle();
-  const problems = [];
-  const built = [];
-  const satellites = [];
-  for (const subject of imageLock.subjects.filter(isFirstParty)) {
-    const key = subjectKeyOf(subject);
-    const repository = developImageRef(subject.imageRef);
-    if (keepsCurrentResolution(declaredSources[subject.repo])) {
-      built.push({ subject: key, repository, contentHash: subject.contentHash, digest: probed.get(key), sourceSha: subject.sourceCommit });
-      continue;
-    }
-    const image = selection.images.find(({ name }) => name === repository);
-    if (image === undefined) {
-      problems.push(`${key} (${subject.repo}): the selection has no image ${repository}`);
-      continue;
-    }
-    if (image.member !== subject.repo) {
-      problems.push(`${key} (${subject.repo}): the selection's image ${repository} belongs to member ${image.member}, not ${subject.repo}`);
-      continue;
-    }
-    const selected = selection.pins[image.member];
-    if (selected !== subject.sourceCommit) {
-      problems.push(`${key} (${subject.repo}): the selection pins ${selected}, not ${subject.sourceCommit}, the commit the snapshot pins`);
-      continue;
-    }
-    // The subject's COMPUTED hash is the one recorded: the heads path's probe already finds dev/<image>:<computed hash>, so
-    // producer CI and this CLI agree on the hash, and a selected hash that differs is a real mismatch, never overwritten.
-    if (image.contentHash !== subject.contentHash) {
-      problems.push(`${key} (${subject.repo}): the selection's content hash ${image.contentHash} is not the computed ${subject.contentHash}`);
-      continue;
-    }
-    // A composed image's members[{service, key}] are the build record's own, copied unchanged and never recomputed; the kernel's
-    // ImageBuildRecord parse refuses them on any other entry.
-    satellites.push({ subject: key, repository, contentHash: subject.contentHash, digest: image.digest, sourceSha: selected, ...(image.members === undefined ? {} : { members: image.members }) });
-  }
-  const withPlatforms = async (entries) => {
-    const out = [];
-    for (const entry of entries) {
-      try {
-        out.push({ ...entry, platforms: await platformsOf(entry.repository, entry.digest) });
-      } catch (error) {
-        problems.push(`${entry.subject}: the platforms of ${entry.repository}@${entry.digest} could not be read: ${error.message}`);
-      }
-    }
-    return out.sort((a, b) => compareStrings(a.subject, b.subject));
-  };
-  const record = { schemaVersion: kernel.IMAGE_BUILD_RECORD_SCHEMA_VERSION, images: await withPlatforms(built), satellites: await withPlatforms(satellites) };
-  if (problems.length > 0) {
-    throw new ImageBuildRecordError(`the image build record of "${id}" cannot be written (${problems.length} problem(s)):\n  ${problems.join('\n  ')}`);
-  }
-  return parseImageBuildRecord(record, 'develop image-record', { loadKernel: async () => kernel });
-}
-
-/** The `image-record` verb. Writes `--out` once, only after every subject is covered. */
-export async function runImageRecord({
-  id,
-  options,
-  env = process.env,
-  steps = DEVELOP_EDITION_STEPS,
-  members = developGraphMembers(),
-  declaredSources = firstPartySources('enumerating the first-party image subjects'),
-  createProbe = (request) => createDevelopImageProbe({ ...request, env }),
-  resolveSnapshot,
-  clientFor,
-  write = writeOnce,
-}) {
-  const selection = parseSelection(readStrictJsonFile(options['--selection']), members, options['--selection']);
-  const declarations = clientFor === undefined ? loadRegistryCredentialDeclarations(editionsRoot()) : null;
-  const clients = new Map();
-  const registryClient = clientFor ?? ((authority) => {
-    if (!clients.has(authority)) {clients.set(authority, registryClientsFor([{ imageRef: `${authority}/x` }], { declarations, env }).get(authority));}
-    return clients.get(authority);
-  });
-  const record = await buildImageRecord({
-    id,
-    pins: readStrictJsonFile(options['--pins']),
-    selection,
-    steps,
-    ...(resolveSnapshot === undefined ? {} : { resolveSnapshot }),
-    createProbe,
-    platformsOf: createPlatformReader(registryClient),
-    declaredSources,
-  });
-  write(options['--out'], record);
-  return record;
-}

package/edition/develop-record-ancestry.mjs

@@ -1,144 +0,0 @@
-// develop-record-ancestry — which verified record commit is the newest COMMIT on develop.
-//
-// "Newest" is the commit that equals or descends from every other candidate's commit, never the highest run:
-// a re-run of an old commit carries a higher run number and must lose. History comes from git alone: one bare
-// scratch repository per member, fetched blobless from the member's own URL through the same hold and credential
-// environment freeze uses (`withSourceGitEnv`; no token on argv, none beyond the workspace's). Candidates are
-// compared with each other only, never with a published pin.
-//
-// With a published commit for the member, the records may not take it backwards: behind or equal keeps the published
-// commit (its own record must then exist), ahead selects the records' commit, otherwise the run is refused.
-//
-// The result also carries develop's head (`git rev-parse refs/heads/develop`) and `behind`, the commits the selected
-// one trails that head by (`git rev-list --count <selected>..refs/heads/develop`), both from the same fetch.
-//
-// Refusals (`RecordRefused`): a commit absent from the fetched develop history, two commits that are not
-// ancestor-related. Operational (plain Error): git cannot be spawned, a fetch fails, or merge-base answers
-// anything but 0 (ancestor) or 1 (not an ancestor), or rev-parse or rev-list fails or answers a non-number.
-
-import { spawnSync } from 'node:child_process';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { withSourceGitEnv } from './git-source-auth.mjs';
-import { RecordRefused } from './record-refused.mjs';
-
-const DEVELOP_REF = 'refs/heads/develop';
-/** The tag a published pin carries in a RecordCommitNotOnDevelopError. */
-export const PUBLISHED_PIN_TAG = 'published pin';
-// One external call to a git remote; a fetch that exceeds it fails naming the member, never a verdict.
-const GIT_CALL_TIMEOUT_MS = 300_000;
-const GIT_MAX_OUTPUT_BYTES = 8 * 1024 * 1024;
-
-export class IncomparableRecordCommitsError extends RecordRefused {
-  constructor(repo, first, second, context) {
-    super(repo, `record commits ${first.commit} (${first.tags.join(', ')}) and ${second.commit} (${second.tags.join(', ')}) are not ancestor-related on develop`, context);
-    this.name = 'IncomparableRecordCommitsError';
-  }
-}
-
-export class RecordCommitNotOnDevelopError extends RecordRefused {
-  constructor(repo, commit, tags, context) {
-    super(repo, `record commit ${commit} (${tags.join(', ')}) is not in the fetched develop history`, context);
-    this.name = 'RecordCommitNotOnDevelopError';
-    this.commit = commit;
-    this.tags = tags;
-  }
-}
-
-export class DivergedFromPublishedError extends RecordRefused {
-  constructor(repo, selected, published, context) {
-    super(repo, `the newest record commit ${selected} and the published commit ${published} are not ancestor-related on develop`, context);
-    this.name = 'DivergedFromPublishedError';
-  }
-}
-
-/** The published commit is newer than every record, and none of its own survives among the candidates. */
-export class PublishedRecordMissingError extends RecordRefused {
-  constructor(repo, published) {
-    super(repo, `no verified build record exists for the published commit ${published}; it is newer than every candidate record`);
-    this.name = 'PublishedRecordMissingError';
-  }
-}
-
-/** `{ status, stdout, stderr }` of one git run; a git that could not be spawned or timed out throws. */
-export function defaultRunGit(args, { cwd, env }) {
-  const result = spawnSync('git', args, { cwd, env, encoding: 'utf8', timeout: GIT_CALL_TIMEOUT_MS, maxBuffer: GIT_MAX_OUTPUT_BYTES });
-  if (result.error !== undefined || result.status === null) {
-    throw new Error(`git ${args[0]} could not run: ${result.error?.message ?? `killed by ${result.signal}`}`);
-  }
-  return { status: result.status, stdout: result.stdout, stderr: result.stderr };
-}
-
-/**
- * @param {object} request
- * @param {{repo: string, repositoryUrl: string}} request.member
- * @param {{commit: string, tag: string}[]} request.candidates verified records' commits with their tags
- * @param {string} [request.published] the commit already published for this member: kept when the records are not ahead of it
- * @param {object} request.workspace the workspace config the source hold reads
- * @param {object} request.env
- * @param {Function} [request.runGit] (args, {cwd, env}) => {status, stdout, stderr}; replaced by tests
- * @param {string} [request.context] the verb its errors name (`select-records` by default)
- * @returns {{commit: string, head: string, behind: number}} the selected commit, develop's head in the same fetch, and
- *   how many commits the selected one is behind that head (0 when it is the head)
- */
-export function newestCommitOnDevelop({ member, candidates, published, workspace, env, runGit = defaultRunGit, context = 'select-records' }) {
-  const byCommit = new Map();
-  for (const { commit, tag } of candidates) {
-    byCommit.set(commit, [...(byCommit.get(commit) ?? []), tag]);
-  }
-  const commits = [...byCommit].map(([commit, tags]) => ({ commit, tags }));
-  const scratch = mkdtempSync(join(tmpdir(), 'xema-select-history-'));
-  try {
-    return withSourceGitEnv({ name: member.repo, url: member.repositoryUrl }, { workspace, env }, (gitEnv) => {
-      const git = (args, extraEnv = {}) => runGit(args, { cwd: scratch, env: { ...gitEnv, ...extraEnv } });
-      const init = git(['init', '--bare', '--quiet']);
-      if (init.status !== 0) {throw new Error(`${context}: ${member.repo}: git init failed: ${init.stderr.trim()}`);}
-      const fetched = git(['fetch', '--quiet', '--filter=blob:none', '--no-tags', member.repositoryUrl, `+${DEVELOP_REF}:${DEVELOP_REF}`]);
-      if (fetched.status !== 0) {
-        throw new Error(`${context}: ${member.repo}: git fetch of develop from ${member.repositoryUrl} failed (exit ${fetched.status}): ${fetched.stderr.trim()}`);
-      }
-      // 0 = ancestor (or equal), 1 = not; anything else is git failing, never a verdict
-      const isAncestor = (older, newer) => {
-        const result = git(['merge-base', '--is-ancestor', older, newer]);
-        if (result.status === 0) {return true;}
-        if (result.status === 1) {return false;}
-        throw new Error(`${context}: ${member.repo}: git merge-base ${older} ${newer} failed (exit ${result.status}): ${result.stderr.trim()}`);
-      };
-      const assertOnDevelop = (commit, tags) => {
-        // no lazy fetch: a commit the develop fetch did not bring is not on develop
-        const known = git(['cat-file', '-e', `${commit}^{commit}`], { GIT_NO_LAZY_FETCH: '1' });
-        if (known.status !== 0 || !isAncestor(commit, DEVELOP_REF)) {throw new RecordCommitNotOnDevelopError(member.repo, commit, tags, context);}
-      };
-      for (const { commit, tags } of commits) {assertOnDevelop(commit, tags);}
-      let selected = commits[0];
-      for (const other of commits.slice(1)) {
-        if (isAncestor(other.commit, selected.commit)) {continue;}
-        if (!isAncestor(selected.commit, other.commit)) {throw new IncomparableRecordCommitsError(member.repo, selected, other, context);}
-        selected = other;
-      }
-      // develop's head and the chosen commit's distance from it, read in the same scratch the choice was made in
-      const withDistance = (commit) => {
-        const headResult = git(['rev-parse', DEVELOP_REF]);
-        const head = headResult.stdout.trim();
-        if (headResult.status !== 0 || !/^[0-9a-f]{40}$/.test(head)) {
-          throw new Error(`${context}: ${member.repo}: git rev-parse ${DEVELOP_REF} failed (exit ${headResult.status}): ${headResult.stderr.trim() || head}`);
-        }
-        const counted = git(['rev-list', '--count', `${commit}..${DEVELOP_REF}`]);
-        const behind = Number(counted.stdout.trim());
-        if (counted.status !== 0 || !/^\d+$/.test(counted.stdout.trim())) {
-          throw new Error(`${context}: ${member.repo}: git rev-list --count ${commit}..${DEVELOP_REF} failed (exit ${counted.status}): ${counted.stderr.trim() || counted.stdout.trim()}`);
-        }
-        return { commit, head, behind };
-      };
-      if (published === undefined) {return withDistance(selected.commit);}
-      assertOnDevelop(published, [PUBLISHED_PIN_TAG]);
-      if (isAncestor(selected.commit, published)) {return withDistance(published);} // equal, or the records are behind it
-      if (isAncestor(published, selected.commit)) {return withDistance(selected.commit);}
-      throw new DivergedFromPublishedError(member.repo, selected.commit, published, context);
-    });
-  } finally {
-    rmSync(scratch, { recursive: true, force: true });
-  }
-}