canopycms 0.0.68-int.98 → 0.1.0

package/dist/worker/cms-worker.d.ts

@@ -1,7 +1,15 @@
 import { type GitHubAuthConfig } from './github-auth.js';
+import { type GitHubGateway } from './github-gateway.js';
+import type { WorkerStatusReport } from '../types.js';
 export { PermanentTaskError, isPermanentTaskFailure } from './task-runner.js';
 export { workerLog, workerLogWarn, workerLogError, installWorkerLogger } from './log.js';
-export { normalizeGitHubAppPrivateKey, DEFAULT_GIT_TOKEN_MINT_TIMEOUT_MS, DEFAULT_GITHUB_TOKEN_REFRESH_MIN_INTERVAL_MS, type GitHubAppAuth, type GitHubAuthConfig, } from './github-auth.js';
+export { resolveWorkerGitHubAuth, normalizeGitHubAppPrivateKey, DEFAULT_GIT_TOKEN_MINT_TIMEOUT_MS, DEFAULT_GITHUB_TOKEN_REFRESH_MIN_INTERVAL_MS, type GitHubAppAuth, type GitHubAuthConfig, } from './github-auth.js';
+export { createLocalGitHubGateway, type GitHubGateway, type GitHubGatewayHealth, type LocalGitHubGatewayOptions, } from './github-gateway.js';
+export { serveGitHubGateway, connectGitHubGateway, type GitHubGatewayClientOptions, type GitHubGatewayListen, type GitHubGatewayServer, type GitHubGatewayServerOptions, } from './github-gateway-http.js';
+export { GitHubGatewayUnreachableError } from './github-gateway-wire.js';
+export { GatewayInstance, type GatewayInstanceOptions } from './gateway-instance.js';
+export { gatewayLog, gatewayLogWarn, gatewayLogError, registerSecretText, registerPrivateKey, redactEgress, } from './gateway-egress.js';
+export { assertSelfChecks, gatewaySelfChecks, workerSelfChecks, type SelfCheckEnvironment, type SelfCheckName, type SelfCheckResult, } from './self-checks.js';
 /**
  * Auth cache refresh function type; adopters supply their auth-plugin-specific
  * implementation (for Clerk, refreshClerkCache from
@@ -17,6 +25,21 @@ export type AuthCacheRefresher = () => Promise<void>;
 export interface CmsWorkerConfig extends GitHubAuthConfig {
     /** Path to workspace root on EFS (e.g., /mnt/efs) */
     workspacePath: string;
+    /**
+     * A directory only this worker can write, never on the shared filesystem: it holds the private
+     * GitHub mirror, the one repository any git command carrying the credential runs in
+     * (worker/github-mirror.ts). The AWS worker passes systemd's `StateDirectory=`. Default: a
+     * directory under `os.tmpdir()`, which the worker refuses unless it owns it and no one else can
+     * write to it.
+     */
+    stateDirectory?: string;
+    /**
+     * A GitHub gateway to use instead of building the in-process one: a client of a gateway another
+     * process serves (`connectGitHubGateway`), which holds the credential, the protected set and the
+     * mirror. Exclusive with `githubToken`, `githubAppAuth`, `refreshGitHubToken` and
+     * `protectedBranches`, which configure the in-process one.
+     */
+    githubGateway?: GitHubGateway;
     /** GitHub owner (e.g., 'acme') */
     githubOwner: string;
     /** GitHub repo name (e.g., 'site') */
@@ -29,8 +52,14 @@ export interface CmsWorkerConfig extends GitHubAuthConfig {
     gitSyncInterval?: number;
     /** Auth cache refresh interval in ms (default: 15 * 60 * 1000) */
     authCacheRefreshInterval?: number;
-    /** Base branch name (default: 'main') */
+    /** Base branch name (default: detected at start(); see `resolveBaseBranch`) */
     baseBranch?: string;
+    /**
+     * Branches the worker never pushes, deletes or opens a pull request from, beside the configured
+     * base branch and GitHub's default branch: exact names, or globs in which `*` matches any run of
+     * characters (`release/*`), which never match a settings branch. See worker/branch-policy.ts.
+     */
+    protectedBranches?: readonly string[];
     /**
      * Names THIS worker's own settings branch
      * (`canopycms-settings-{deploymentName}`, default 'prod' — ProdStrategy's
@@ -56,13 +85,36 @@ export interface CmsWorkerConfig extends GitHubAuthConfig {
     maxRetries?: number;
     /** Content root directory name relative to repo root (default: 'content') */
     contentRoot?: string;
+    /**
+     * Longest the git sync holds the base branch for content naming entry schemas the serving
+     * editor does not define, before advancing anyway (default: 30 minutes). See worker/schema-gate.ts.
+     */
+    schemaHoldMaxMs?: number;
     /**
      * Worker lock staleness TTL in ms (default 60000, minimum 2000). The holder
      * refreshes the heartbeat at half this interval; a lock whose heartbeat is
      * older than this is abandoned and taken over by the next worker to start.
      */
     lockStaleMs?: number;
+    /**
+     * How long `stop()` waits for in-flight work before aborting it, in ms
+     * (default {@link DEFAULT_DRAIN_DEADLINE_MS}). An entrypoint's process
+     * manager must allow this plus {@link ABORT_GRACE_MS} before it kills the
+     * process.
+     */
+    drainDeadlineMs?: number;
 }
+/**
+ * The default `taskTimeoutMs`. Exported because a split worker's gateway client passes it as its
+ * `fetchInactivityMs` and the gateway uses it as its `timeoutMs`, as the in-process gateway does.
+ */
+export declare const DEFAULT_TASK_TIMEOUT = 60000;
+/**
+ * 90s fits inside an EC2 spot interruption's two-minute notice with room to
+ * exit, and exceeds the default task timeout, so a task already running when
+ * the drain begins normally finishes or times out on its own.
+ */
+export declare const DEFAULT_DRAIN_DEADLINE_MS = 90000;
 /**
  * CMS Worker daemon: the operations Lambda, which has no internet, cannot
  * perform -- draining the task queue, syncing the bare repo with GitHub,
@@ -72,28 +124,68 @@ export interface CmsWorkerConfig extends GitHubAuthConfig {
  * Auth-agnostic (no specific auth provider) and cloud-agnostic (git/Octokit
  * directly, no AWS SDK dependency).
  */
+/** Why a worker stopped itself; see {@link CmsWorker.selfStopped}. */
+export interface WorkerSelfStop {
+    reason: string;
+}
+/**
+ * Record a worker that failed before {@link CmsWorker.start} as `lastFatalError` (phase
+ * `startup`), so System health and the API's not-ready answer say why. For an entrypoint's own
+ * boot steps (its environment, its secrets); start() records its own failures.
+ *
+ * Writes under the worker lock like every status write, and writes nothing while the lock looks
+ * held (fresher than twice `lockStaleMs`, see recordLockLoss): its holder owns the file. Never
+ * throws, since its caller is already exiting.
+ */
+export declare function recordWorkerStartupFailure(options: {
+    workspacePath: string;
+    error: unknown;
+    lockStaleMs?: number;
+    /**
+     * Write nothing when the file is a failed start's own record (its `lastFatalError` was written
+     * by the worker that wrote the file) and this accepts that record: for a failure that only says
+     * the recorded cause is still in the way (the GitHub gateway unreachable while it restarts after
+     * its own fatal error), which must not replace that cause. A record a later worker carried
+     * forward is never kept: that worker got past it.
+     */
+    keepRecordedFatal?: (recorded: NonNullable<WorkerStatusReport['lastFatalError']>) => boolean;
+}): Promise<void>;
 export declare class CmsWorker {
     private config;
-    private octokit;
+    private gateway?;
     private taskDir;
     private remoteGitPath;
+    private stateDirectory;
     private contentBranchesPath;
-    private baseBranch;
-    private sanitizedBaseBranch;
+    private resolvedBaseBranch?;
     private settingsBranchResolved?;
     private activeTimeouts;
     private running;
     private activeOperations;
+    private stopping;
+    private drainDeadlineMs;
+    private shutdownController;
     private maxTasksPerCycle;
     private taskTimeoutMs;
     private maxRetries;
     private lockFilePath;
     private lockStaleMs;
+    private schemaHoldMaxMs;
     private releaseLockFn;
     private contentRoot;
     private log;
     private statusReport?;
-    private githubAuth?;
+    private warnedDivergences;
+    private lockLostMessage?;
+    private statusWriterAtLock?;
+    private settleSelfStopped;
+    /**
+     * Settles once the worker has stopped for a reason it chose itself (its lock was
+     * compromised), after the drain and its record in worker-status.json. Never settles for a
+     * stop() the entrypoint asked for. Nothing else ends the process, so an entrypoint exits
+     * non-zero on it and its process manager starts a fresh worker.
+     */
+    readonly selfStopped: Promise<WorkerSelfStop>;
     constructor(config: CmsWorkerConfig);
     /**
      * This worker's self-reported status object, initialized on first use.
@@ -114,12 +206,12 @@ export declare class CmsWorker {
      * as foreign and never pushes it.
      *
      * DEFERRED out of the constructor deliberately, which is the whole point of
-     * the method existing: canopycms-cdk/worker/index.ts constructs the worker
-     * before calling start(), so a throw during `new CmsWorker(...)` lands BEFORE
-     * the only code that writes `lastFatalError` -- start()'s catch. Under
-     * systemd `Type=simple` + `Restart=always` with no cfn-signal, that is an
-     * invisible ~5s crash-loop that `cdk deploy` reports as success while the
-     * admin panel shows the worker 'absent' with no fatal error to explain it.
+     * the method existing: an entrypoint constructs the worker before calling
+     * start(), so a throw during `new CmsWorker(...)` lands BEFORE start()'s
+     * catch, which records `lastFatalError` for every entrypoint. Only one that
+     * calls `recordWorkerStartupFailure` (canopycms-cdk/worker/run.ts does) would
+     * record it otherwise; under systemd `Restart=always` the rest crash-loop
+     * every ~5s with System health showing the worker 'absent' and no reason.
      *
      * Lazy rather than start()-only so unit tests driving pushSettingsBranches()
      * still see the value, exactly as ensureStatusReport() above. Idempotent: the
@@ -133,12 +225,46 @@ export declare class CmsWorker {
      * Built FRESH on every call, with instance-backed members as functions rather
      * than copied values. See WorkerContext's INVARIANT: a context that captured
      * any of them at construction time would hand the extracted code the pre-test
-     * value, which for `buildGitHubUrl` means a test's push going to github.com
-     * for real instead of its local fixture repo.
+     * value, which for the GitHub gateway means a test's push going to
+     * github.com for real instead of its local fixture repo.
      */
     private ctx;
+    /**
+     * Take the worker lock, provision, run the first sync, then schedule the
+     * loops. All of it is tracked as an operation, so a stop() that lands
+     * mid-startup -- during the lock acquisition, a first-boot clone, the first
+     * sync -- drains it before releasing the lock, and start() then resolves
+     * without scheduling anything.
+     */
     start(): Promise<void>;
-    stop(): Promise<void>;
+    private startUnderLock;
+    /**
+     * Drain, then release the worker lock. Idempotent: a second call returns the
+     * first call's promise.
+     *
+     * 1. Stop taking work: no loop starts another iteration, and none claims
+     *    another task or starts another sync stage or branch rebase (each checks
+     *    `isDraining()` at its boundaries).
+     * 2. Wait up to the deadline (`drainDeadlineMs`, or `deadlineMs` for this
+     *    call) for what is already in flight, startup included.
+     * 3. At the deadline, abort it through `shutdownSignal()`: a task's git push
+     *    and GitHub calls are killed and the task is released to pending with no
+     *    retry spent; a sync's bundle, unbundle, ref update and settings push
+     *    are killed. The gateway's GitHub fetches and mirror maintenance run on
+     *    (safeinsights/canopycms#907). A branch rebase
+     *    is never aborted, because a rebase killed mid-branch is recovered
+     *    lossily; anything still unsettled after a short grace is abandoned to
+     *    the process exit.
+     * 4. Record `lastShutdown` in worker-status.json -- only while this worker
+     *    still holds the lock, or after a compromise that started this stop once
+     *    it has retaken it (recordLockLoss) -- and release the lock. Release comes last, so a successor starts
+     *    only once this worker's work has settled or been abandoned.
+     */
+    stop(options?: {
+        reason?: string;
+        deadlineMs?: number;
+    }): Promise<void>;
+    private drainAndStop;
     /**
      * Acquire the cross-host worker lock (DEP-C2).
      *
@@ -163,19 +289,63 @@ export declare class CmsWorker {
      */
     private acquireLock;
     private releaseLock;
+    /**
+     * Record a lock compromise in worker-status.json, under the lock: retake it, waiting out its
+     * staleness window, and write only if that succeeds and the file is still this worker's (or
+     * the one it took the lock from). A worker that took the lock over keeps it fresh, or has
+     * written the file since, and owns it, so nothing is written. A heartbeat this worker merely
+     * failed to refresh (an EFS hiccup) goes stale, and the record lands where the restarted
+     * worker carries `lastShutdown` forward. The restart waits for it: 65 s at the default `lockStaleMs`.
+     */
+    private recordLockLoss;
+    /** Register `operation` as in flight under `label` until it settles. */
+    private trackOperation;
     /**
      * Run `fn` repeatedly, the next invocation starting `interval` ms after the
      * previous one COMPLETES. setTimeout chaining rather than setInterval, so
      * executions cannot overlap when one runs longer than the interval.
      */
     private scheduleLoop;
+    private get baseBranch();
+    private get sanitizedBaseBranch();
+    private requireBaseBranch;
+    private setBaseBranch;
+    /**
+     * An unconfigured base branch is the one remote.git's HEAD names, which is what the Lambda
+     * reads too (GitManager.detectBaseBranch); before remote.git exists, it is GitHub's default
+     * branch, which the clone then records as that HEAD. So it is too when remote.git has no branch
+     * outside the settings namespace: no base branch is there for HEAD to name, and ensureRemoteGit
+     * replaces it from GitHub unless something in it is at stake. Never assumes 'main'.
+     */
+    private resolveBaseBranch;
+    /**
+     * Warn when the base branch is outside the gateway's protected set: it was detected from
+     * remote.git rather than configured, and is not GitHub's default branch at boot. Only the
+     * worker's own check (`pushBranchToGitHub`) then stops a push to it. A warning, not a refusal, so
+     * a change of GitHub's default branch cannot stop the worker booting.
+     */
+    private warnIfBaseUnprotected;
+    /**
+     * Check remote.git's config at boot. A refusal is never a case for replacement: it reports that
+     * something wrote there, and listing the refs a replacement would lose means running git under
+     * that config. The message says so, so System health does not read it as a routine failure.
+     */
+    private assertRemoteGitConfig;
+    /** Whether the bare repo at `gitDir` has a branch that is not a settings branch. */
+    private hasContentBranch;
+    /**
+     * Point remote.git's HEAD at the base branch this worker uses, so a Lambda left to detect it
+     * (GitManager.detectBaseBranch) reads the same name. Only the worker writes it, at boot under
+     * the worker lock, and in a fresh clone before it is renamed into place, so no Lambda reads the
+     * clone's GitHub-default HEAD first; a Lambda reads it once per process.
+     */
+    private recordBaseBranchInRemoteHead;
     /**
      * Whether the bare repo at `gitDir` has a local `refs/heads/<baseBranch>`.
      *
-     * Explicit `--git-dir` rather than `simpleGit({ baseDir })`, so this also
+     * The repository is named outright (sharedRepoGit's GIT_DIR), so this also
      * works where `safe.bareRepository=explicit` refuses cwd-based discovery of
-     * bare repos but expressly allows `--git-dir` (same pattern as
-     * GitManager.bareRemoteHasBranch).
+     * bare repos.
      *
      * Deliberately omits `--quiet`: simple-git treats a task as failed only when
      * the process exits non-zero AND writes to stderr, so a silent-on-failure
@@ -191,8 +361,8 @@ export declare class CmsWorker {
      * `git clone https://x-access-token:<token>@github.com/...` records that URL
      * verbatim as `remote.origin.url`, and for `remote.git` that config lives on
      * shared EFS. The security model in docs/deploying-to-aws.md -- a compromised
-     * Lambda can read/write EFS content but cannot push to GitHub, secrets stay
-     * on the worker -- is false while that string is there: the Lambda could read
+     * Lambda can read/write EFS content but cannot reach the GitHub credential,
+     * which stays off EFS -- is false while that string is there: the Lambda could read
      * the token off EFS and, with no egress of its own, exfiltrate it by writing
      * it into branch content the worker then pushes to GitHub.
      *
@@ -204,96 +374,63 @@ export declare class CmsWorker {
      */
     private scrubPersistedRemote;
     /**
-     * Ensure the remote.git bare repo exists, cloning it from GitHub on first
-     * run.
-     *
-     * Empty-remote guard: simple-git's bare clone of an EMPTY GitHub repo (no
-     * commits, or a base branch never pushed) exits 0 and produces a refs-less
-     * bare repo whose HEAD points at an unborn branch. `fs.stat` cannot tell that
-     * from a healthy clone, so left unchecked it silently poisons remote.git —
-     * every later branch operation breaks and the fs.stat short-circuit means it
-     * never heals. The base branch is therefore verified right after cloning AND
-     * on the already-exists fast path, since a previous run can have left a
-     * poisoned remote.git behind.
+     * Best-effort: without these settings remote.git still works, and a boot that
+     * cannot write its own config has a louder problem to report elsewhere.
      */
-    private ensureRemoteGit;
-    processTaskQueue(): Promise<void>;
-    private executeTask;
-    private updateBranchMetadata;
-    private pushBranchToGitHub;
+    private applyRemoteGitConfig;
     /**
-     * Resolve which GitHub credential this worker uses, once, and build the
-     * Octokit client from it.
+     * Ensure the remote.git bare repo exists, seeding it from GitHub on first run.
      *
-     * DEFERRED out of the constructor deliberately, exactly as
-     * `ensureSettingsBranch()` is and for the reason that method records:
-     * `resolveWorkerGitHubAuth` throws for a half-configured credential (both
-     * set, neither set, an unusable mint timeout or refresh interval), and a
-     * throw during `new CmsWorker(...)` lands BEFORE the only code that writes
-     * `lastFatalError` — start()'s catch.
+     * Seeded through the GitHub gateway: it fetches from GitHub, and a fresh bare repo takes its
+     * branches from the bundle it answers with (worker/github-transfer.ts), so no git command run
+     * against remote.git ever carries the credential, and no token-bearing URL is ever written to
+     * EFS.
      *
-     * Idempotent, and it does NOT replace an `octokit` a test has already
-     * assigned onto the instance — see the field's comment.
+     * Empty-remote guard: a remote.git with no base branch (one cloned from an EMPTY GitHub repo,
+     * or with a base branch never pushed) is one `fs.stat` cannot tell from a healthy one, so left
+     * unchecked it silently poisons remote.git and the stat short-circuit means it never heals. The
+     * seed refuses a GitHub without the base branch, and the base branch is verified right after
+     * seeding AND on the already-exists fast path, where a poisoned remote.git is replaced
+     * (`replacePoisonedRemoteGit`).
      */
-    private ensureGitHubAuth;
+    private ensureRemoteGit;
     /**
-     * The Octokit client, built on first use. Every read goes through here rather
-     * than touching the field, which the constructor does not populate: a method
-     * reached without start() would otherwise see `undefined`.
-     * `rebaseActiveBranches()` is exactly that case — apps/test-app's e2e route
-     * calls it directly, and its `pollMergeState` dispatch reads `ctx.octokit()`.
+     * Replace an existing remote.git that has no base branch with a fresh seed from GitHub, but only
+     * when every ref in it names a commit a GitHub branch contains, so replacing it loses no commit;
+     * a branch name GitHub lacks, such as a merged branch deleted there, goes. Otherwise refuse,
+     * naming the refs at stake: unpushed work such as a settings branch.
+     *
+     * The refs are checked against the replacement itself, once it is seeded: a ref's commit counts
+     * as on GitHub only when the seed holds it, reachable from a branch GitHub had, so the decision
+     * follows exactly what would replace remote.git, whatever the gateway fetches meanwhile. They are
+     * listed again just before the swap, since the Lambda can push into remote.git while the seed
+     * runs. The swap is two renames, so the name remote.git resolves to the old repo,
+     * the new one, or for an instant nothing, never a half-built or half-deleted one.
      */
-    private octokitClient;
+    private replacePoisonedRemoteGit;
     /**
-     * The single seam through which every git-over-HTTPS credential reaches a git
-     * command. The only other consumer is Octokit, built from the same resolution
-     * by `ensureGitHubAuth()` above.
-     *
-     * Async because under GitHub App auth `resolveGitToken` mints an installation
-     * token lasting about an hour. NOTHING may cache what this returns — a URL
-     * built from an installation token goes stale with it — and resolving per use
-     * is cheap, since `@octokit/auth-app` answers from its own cache until the
-     * token is near expiry.
-     *
-     * A mint failure propagates AS THROWN, carrying the `.status` that
-     * `isPermanentTaskFailure` classifies on — see github-auth.ts.
-     *
-     * Do NOT add a parallel token accessor alongside it. Every instance-backed
-     * WorkerContext member stays a function precisely so tests can replace it
-     * through the instance (worker-context.ts's INVARIANT); a second credential
-     * path would be one nothing stubs.
+     * Seed a new bare repo from GitHub at `<remote.git>.cloning`, verified and configured, and
+     * return its path for the caller to rename into place. `check` runs on the seeded repo, given
+     * GitHub's branches as the seed holds them, and its throw stops the seed. Throws with the
+     * staging directory gone.
      */
-    private buildGitHubUrl;
+    private seedRemoteGitStaging;
+    processTaskQueue(): Promise<void>;
+    private executeTask;
+    private updateBranchMetadata;
+    private pushBranchToGitHub;
     /**
-     * Prove the GitHub App credential works before anything depends on it.
-     *
-     * Without this the first failure comes out of `ensureRemoteGit`'s bare clone
-     * below, whose catch blames the repository ("may be empty, or the base branch
-     * may not exist") and sends an operator holding a bad private key looking for
-     * a problem that does not exist. Called from start()'s try, so the failure is
-     * also recorded as `lastFatalError` and reaches the admin panel. No-op on the
-     * token path: a PAT is a literal, so the first real request checks everything
-     * this could.
-     *
-     * FATAL UNLESS THE FAILURE POSITIVELY LOOKS TRANSIENT. Both halves are
-     * load-bearing. Not always fatal, because the two credential paths must
-     * degrade alike: on the token path a GitHub 502 during boot is absorbed (a
-     * warm `remote.git` short-circuits `ensureRemoteGit`, `Promise.allSettled`
-     * swallows the initial `syncGit`) so the worker starts and its loops retry,
-     * while rethrowing every error class would make the App path exit and systemd
-     * crash-loop it until GitHub recovered — each iteration telling the operator
-     * to check their private key.
-     *
-     * But fail CLOSED, via `isTransientAuthFailure` rather than the inverse of
-     * `isPermanentTaskFailure`: that classifier defaults a status-less error to
-     * transient, which is right on the task path (bounded by `maxRetries`) and
-     * wrong here (bounded by nothing). A key that never reaches GitHub at all —
-     * the wrong type, or too mangled to sign with — fails locally and
-     * status-lessly, so defaulting to transient would boot a worker with a dead
-     * credential, record no `lastFatalError`, and show healthy in the admin panel
-     * while every task and every sync failed.
+     * The worker's GitHub gateway, created on first use: inside start()'s try, or wherever a test
+     * entry point first reaches it. Creating it resolves the credential, which throws for a
+     * half-configured one (both set, neither set, an unusable mint timeout or refresh interval) --
+     * never in the constructor, for the reason `ensureSettingsBranch()` gives. Keeps a gateway a
+     * test installed.
      */
-    private preflightGitHubAppAuth;
+    private github;
+    /** What worker/github-transfer.ts needs, for the seeds that run before the loops' context. */
+    private transferContext;
+    /** What the in-process gateway is built from; test-utils/worker-gateway.ts builds from it too. */
+    private localGitHubGatewayOptions;
     /**
      * The workspace directory for a branch named by its GIT REF name -- the form
      * task payloads carry (`context.branch.name`), not the directory form.
@@ -332,49 +469,6 @@ export declare class CmsWorker {
     protected afterRebaseCompletedForTesting(): Promise<void>;
     private rebaseActiveBranches;
     syncGit(): Promise<void>;
-    /**
-     * `syncGit`, plus "the credential may have rotated" on the way out.
-     *
-     * One of `refreshGitHubCredential`'s two call sites, and the one that works
-     * when nobody is publishing: it fetches from GitHub every `gitSyncInterval`
-     * whether or not anyone is editing, so a credential that has stopped working
-     * surfaces here even with no push queued for days.
-     *
-     * The SYNC failure is what propagates to `scheduleLoop`'s catch;
-     * `refreshGitHubCredential` never throws, so nothing it does can replace it.
-     */
-    private syncGitWithCredentialRefresh;
-    /**
-     * Re-read the GitHub credential, because an operation using it just failed.
-     *
-     * **Two call sites, each covering what the other cannot.** The git-sync loop
-     * (`syncGitWithCredentialRefresh`) notices a dead credential when nobody is
-     * publishing. `processTaskQueue`'s per-task catch is what saves a publish: a
-     * push task spends its retry budget on a 5s/10s/20s backoff, well inside one
-     * 5-minute sync interval, so with the sync loop as the only trigger a publish
-     * meeting a rotated token fails permanently while the working one is already
-     * in the secret store. Every consumer reaches the credential through
-     * `ensureGitHubAuth()`, which reads it per use, so a refresh from either site
-     * repairs all of them for their NEXT use — but not an attempt already failed.
-     *
-     * NOT gated on the error looking auth-shaped, at either site: a `git
-     * fetch`/`push` rejected for a dead token throws a plain simple-git error
-     * (exit 128, no HTTP `.status`) that `isPermanentTaskFailure` reads as
-     * transient, so a gate keyed on it would never fire. Two floors bound the
-     * cost instead — core's `refreshGitHubTokenMinIntervalMs` (default 60s,
-     * enforced by `refreshCredential` in github-auth.ts) and whatever floor the
-     * provider keeps (the AWS one reads at most once per five minutes) — and both
-     * call sites share both, so a read issued by one throttles the other. On the
-     * GitHub App path the refresh is a no-op.
-     *
-     * **Never throws**: both callers are already reporting the failure that must
-     * reach the log. **Bounded by `taskTimeoutMs`**, because the task loop awaits
-     * it and a read that never settled would stop every publish queued behind it
-     * (an adopter's provider may have no bound at all; the AWS one can take 87s
-     * for one `getSecret`). A losing read is not cancelled and may land later, but
-     * `refreshCredential` discards a result older than one already applied.
-     */
-    private refreshGitHubCredential;
     private pushSettingsBranches;
     private refreshBaseBranchWorkspace;
     private cleanupTrashedBranchDirs;