dorfl 0.0.0 → 0.1.0

package/dist/registry.d.ts

@@ -0,0 +1,172 @@
+import { type ArbiterInitResult } from './arbiter.js';
+/**
+ * The **registry** primitive (ADR `command-surface-and-journeys` §1): the
+ * registered set of targets IS the set of hub mirrors on disk under
+ * `<workspacesDir>/repos/<key>.git`. There is NO `roots` and NO `remotes` config
+ * field — discovery is "enumerate the mirror folders". This module is that
+ * enumeration plus the `remote add/rm` mutators; it reuses the `repo-mirror`
+ * hub primitive (`ensureMirror`/`encodeRepoKey`/`mirrorPath`) and the `arbiter`
+ * provisioner (`arbiterInit` for `--local`) — it does NOT duplicate them.
+ *
+ * The `remote ls` view reads each mirror's `origin` URL with `git -C <mirror>
+ * remote get-url origin` (the key encoding is LOSSY — it drops scheme/transport
+ * — so the URL is NOT reconstructible from the key) and derives the transport
+ * from that URL's scheme.
+ */
+/** A registered hub mirror's self-description (the `remote ls` row). */
+export interface RegisteredMirror {
+    /** The hierarchical hub key (`host/org/name`), as `encodeRepoKey` produces. */
+    key: string;
+    /** Absolute path to the bare hub mirror (`<workspacesDir>/repos/<key>.git`). */
+    path: string;
+    /**
+     * The mirror's `origin` URL (`git -C <path> remote get-url origin`), or
+     * `undefined` if it cannot be read (a malformed mirror).
+     */
+    originUrl?: string;
+    /** The transport derived from `originUrl`'s scheme. */
+    transport: Transport;
+    /**
+     * The trailing `org/name` of the key — the project identity the transport
+     * guard keys on (siblings under different transports share this tail).
+     */
+    projectId: string;
+}
+/**
+ * The transport a mirror's origin uses, derived from its URL scheme:
+ * `local-bare` (`file://` or a plain filesystem path to a bare repo) vs
+ * `remote-host` (`git@`/`https`/`http`/`ssh`). `unknown` when no origin URL
+ * could be read.
+ */
+export type Transport = 'local-bare' | 'remote-host' | 'unknown';
+/** Inputs to the registry enumeration / mutators. */
+export interface RegistryOptions {
+    /** The execution working area (config `workspacesDir`, default `~/.dorfl`). */
+    workspacesDir: string;
+    env?: NodeJS.ProcessEnv;
+}
+/** Raised when a registry operation cannot proceed safely. */
+export declare class RegistryError extends Error {
+}
+/**
+ * Derive the transport from a remote URL's scheme. `file://` (and a plain
+ * absolute path to a bare repo) ⇒ `local-bare`; `git@`/`https`/`http`/`ssh`
+ * (anything with a host) ⇒ `remote-host`. This is the same scheme split
+ * `encodeRepoKey` deliberately collapses away from the KEY — here we keep it for
+ * the transport guard + `remote ls`.
+ */
+export declare function transportForUrl(url: string): Transport;
+/** The trailing `org/name` of a hub key (the project identity for the guard). */
+export declare function projectIdFromKey(key: string): string;
+/**
+ * Enumerate the registered hub mirrors (the registry). Walks the bare mirror
+ * folders under `<workspacesDir>/repos/<key>.git` — which exist hierarchically
+ * (`host/org/name.git`), so a leaf `*.git` directory holding a git repo IS a
+ * mirror. Reads each one's `origin` URL + transport (the key is lossy). Sorted
+ * by key. This is the SINGLE "list registered mirrors" primitive that both
+ * `remote ls` AND `scan`/`status` discovery consume.
+ */
+export declare function listMirrors(options: RegistryOptions): RegisteredMirror[];
+/** The result of `remote add`. */
+export interface RemoteAddResult {
+    /** The hub key the target was registered under. */
+    key: string;
+    /** Absolute path to the (existing or just-created) hub mirror. */
+    mirrorPath: string;
+    /** The origin URL the mirror tracks. */
+    url: string;
+    /** The transport derived from `url`. */
+    transport: Transport;
+    /** True iff the mirror did not exist and was just created. */
+    created: boolean;
+    /**
+     * The provisioned local bare arbiter, when `--local` provisioned one (it
+     * absorbs `arbiter init`). Absent for a plain remote add.
+     */
+    arbiter?: ArbiterInitResult;
+}
+/** Inputs to {@link remoteAdd}. */
+export interface RemoteAddOptions extends RegistryOptions {
+    /**
+     * The target to register. For a plain (remote) add this is the arbiter URL.
+     * For `--local` it is the WORKING REPO whose `--bare` arbiter is provisioned
+     * (the old `arbiter init` input).
+     */
+    target: string;
+    /**
+     * Provision a LOCAL `--bare` arbiter from `target` (a working repo) and
+     * register ITS mirror — absorbing `arbiter init`. The arbiter is provisioned
+     * under `arbitersDir` (precious DATA, ADR §7), never `~/.dorfl`.
+     */
+    local?: boolean;
+    /** Where local `--bare` arbiters are provisioned (config `arbitersDir`). Required for `--local`. */
+    arbitersDir?: string;
+    /** The arbiter remote name to wire in the working repo on `--local`. */
+    arbiterRemote?: string;
+    /**
+     * Override the project-identity POLICY block: REPLACE this project's existing
+     * mirror (re-link remote ↔ `--bare` arbiter deliberately) even though a sibling
+     * mirror for the same project (same `projectIdFromKey` tail) already exists
+     * under a different key. `force` overrides the POLICY block ONLY — it NEVER
+     * overrides the DATA-LOSS block: if any worktree of the mirror being replaced
+     * holds un-pushed work (dirty tree OR a `work/*` tip not reachable on the
+     * arbiter — the full `gc.ts` clean-AND-reachable predicate), `force` still
+     * REFUSES, because replacing would strand that work.
+     */
+    force?: boolean;
+    /** Sink for human-readable progress notes. */
+    note?: (message: string) => void;
+}
+/**
+ * Raised when `--force` cannot REPLACE a project's mirror because a worktree of
+ * the mirror being replaced still holds un-pushed work (a DATA-LOSS block,
+ * distinct from the POLICY block `--force` overrides). The reason names each
+ * unsafe worktree so the human can rescue the work before re-running.
+ */
+export declare class ReplaceWouldStrandWorkError extends RegistryError {
+}
+/**
+ * Register a target by creating its hub mirror (the `ensureMirror` primitive).
+ * Idempotent: an existing mirror is fetched + reused, not clobbered. With
+ * `--local`, first provisions a `--bare` arbiter from the working repo
+ * (`arbiterInit`, absorbing `arbiter init`) and registers THAT arbiter's mirror.
+ *
+ * Project-identity guard (anti-stranding, ADR §1 +
+ * `work/notes/observations/hub-mirror-key-ignores-transport.md`): if a sibling mirror
+ * for the SAME project (same `projectIdFromKey` tail) already exists under a
+ * DIFFERENT key (a transport mismatch OR a same-transport path/host collision),
+ * refuse by default — registering the project under a second key would fork the
+ * mirror and risk stranding un-pushed `work/<slug>` work on the other mirror.
+ *
+ * `--force` REPLACES the existing mirror(s) for the project (so you can re-link
+ * a project's mirror from a remote to a `--bare` arbiter, or vice-versa,
+ * deliberately) — but `--force` overrides the POLICY block ONLY, NEVER the
+ * DATA-LOSS block: if any worktree of the mirror being replaced still holds
+ * un-pushed work (the full `gc.ts` clean-AND-reachable per-worktree predicate),
+ * the replace REFUSES with {@link ReplaceWouldStrandWorkError}. (An identical
+ * key is the idempotent reuse case, NOT a conflict — it is the same mirror.)
+ */
+export declare function remoteAdd(options: RemoteAddOptions): RemoteAddResult;
+/** The result of `remote rm`. */
+export interface RemoteRmResult {
+    /** The hub key that was removed. */
+    key: string;
+    /** Absolute path to the deleted mirror. */
+    path: string;
+    /** True iff a mirror existed and was deleted (false ⇒ nothing matched). */
+    removed: boolean;
+}
+/** Inputs to {@link remoteRm}. */
+export interface RemoteRmOptions extends RegistryOptions {
+    /** The mirror to delete, by hub KEY (`host/org/name`) or by its origin URL. */
+    target: string;
+}
+/**
+ * Delete a hub mirror by key or origin URL — the ONLY mirror deleter (`gc`
+ * NEVER reaps mirrors). Resolves `target` first as a literal key, then by
+ * encoding it as a URL (so both `remote rm <key>` and `remote rm <url>` work),
+ * and finally by matching any registered mirror's origin URL. Removes the bare
+ * mirror directory (a self-contained `<key>.git` folder under `repos/`).
+ */
+export declare function remoteRm(options: RemoteRmOptions): RemoteRmResult;
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AASA,OAAO,EAAc,KAAK,iBAAiB,EAAC,MAAM,cAAc,CAAC;AAQjE;;;;;;;;;;;;;GAaG;AAEH,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAChC,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,SAAS,EAAE,SAAS,CAAC;IACrB;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,aAAa,GAAG,SAAS,CAAC;AAEjE,qDAAqD;AACrD,MAAM,WAAW,eAAe;IAC/B,+EAA+E;IAC/E,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB;AAED,8DAA8D;AAC9D,qBAAa,aAAc,SAAQ,KAAK;CAAG;AAO3C;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAUtD;AAED,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAKpD;AAsBD;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,gBAAgB,EAAE,CAuCxE;AAQD,kCAAkC;AAClC,MAAM,WAAW,eAAe;IAC/B,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,UAAU,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,SAAS,EAAE,SAAS,CAAC;IACrB,8DAA8D;IAC9D,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,mCAAmC;AACnC,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACxD;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oGAAoG;IACpG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8CAA8C;IAC9C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,SAAQ,aAAa;CAAG;AAEjE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,eAAe,CAiHpE;AA0DD,iCAAiC;AACjC,MAAM,WAAW,cAAc;IAC9B,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,OAAO,EAAE,OAAO,CAAC;CACjB;AAED,kCAAkC;AAClC,MAAM,WAAW,eAAgB,SAAQ,eAAe;IACvD,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,cAAc,CAsBjE"}

package/dist/registry.js

@@ -0,0 +1,296 @@
+import { existsSync, readdirSync, rmSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { run } from './git.js';
+import { encodeRepoKey, ensureMirror, mirrorPath, readOriginUrl, } from './repo-mirror.js';
+import { arbiterInit } from './arbiter.js';
+import { discoverJobs, evaluateDeletionSafety, RETAIN_REASON_TEXT, } from './gc.js';
+/** Raised when a registry operation cannot proceed safely. */
+export class RegistryError extends Error {
+}
+/** The `repos/` directory under `workspacesDir` that holds the hub mirrors. */
+function reposDir(workspacesDir) {
+    return join(workspacesDir, 'repos');
+}
+/**
+ * Derive the transport from a remote URL's scheme. `file://` (and a plain
+ * absolute path to a bare repo) ⇒ `local-bare`; `git@`/`https`/`http`/`ssh`
+ * (anything with a host) ⇒ `remote-host`. This is the same scheme split
+ * `encodeRepoKey` deliberately collapses away from the KEY — here we keep it for
+ * the transport guard + `remote ls`.
+ */
+export function transportForUrl(url) {
+    const trimmed = url.trim();
+    if (trimmed === '') {
+        return 'unknown';
+    }
+    if (trimmed.startsWith('file://') || trimmed.startsWith('/')) {
+        return 'local-bare';
+    }
+    // scp-like ssh (`git@host:org/repo`) or any `scheme://host/...` is a remote host.
+    return 'remote-host';
+}
+/** The trailing `org/name` of a hub key (the project identity for the guard). */
+export function projectIdFromKey(key) {
+    const segments = key.split('/').filter((s) => s.length > 0);
+    // Keep the last two segments (`org/name`); fall back to the whole key when a
+    // degenerate key has fewer than two segments.
+    return segments.slice(-2).join('/');
+}
+/**
+ * The on-disk hub-key for an arbiter URL is encoded WITH a `.git` directory
+ * suffix; the mirror folder is `<key>.git`. Recover the hub key from a folder
+ * name by stripping that trailing `.git`.
+ */
+function keyFromMirrorDir(name) {
+    return name.endsWith('.git') ? name.slice(0, -'.git'.length) : name;
+}
+/** True iff `path` is (or contains) an initialised git repository. */
+function pathHoldsGitRepo(path, env) {
+    if (!existsSync(path)) {
+        return false;
+    }
+    return run('git', ['rev-parse', '--git-dir'], path, { env }).status === 0;
+}
+/**
+ * Enumerate the registered hub mirrors (the registry). Walks the bare mirror
+ * folders under `<workspacesDir>/repos/<key>.git` — which exist hierarchically
+ * (`host/org/name.git`), so a leaf `*.git` directory holding a git repo IS a
+ * mirror. Reads each one's `origin` URL + transport (the key is lossy). Sorted
+ * by key. This is the SINGLE "list registered mirrors" primitive that both
+ * `remote ls` AND `scan`/`status` discovery consume.
+ */
+export function listMirrors(options) {
+    const root = reposDir(options.workspacesDir);
+    if (!existsSync(root)) {
+        return [];
+    }
+    const mirrors = [];
+    // Walk for `*.git` leaf directories that hold a git repo (the hub mirrors).
+    const stack = [root];
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (!entry.isDirectory()) {
+                continue;
+            }
+            const full = join(dir, entry.name);
+            if (entry.name.endsWith('.git') && pathHoldsGitRepo(full, options.env)) {
+                const key = relKey(root, full);
+                const originUrl = readOriginUrl(full, options.env);
+                mirrors.push({
+                    key,
+                    path: full,
+                    originUrl,
+                    transport: originUrl === undefined ? 'unknown' : transportForUrl(originUrl),
+                    projectId: projectIdFromKey(key),
+                });
+                continue;
+            }
+            // Descend into intermediate (non-`.git`) directories.
+            stack.push(full);
+        }
+    }
+    return mirrors.sort((a, b) => a.key.localeCompare(b.key));
+}
+/** The hub key for a mirror dir relative to `<workspacesDir>/repos/`. */
+function relKey(reposRoot, mirrorPathAbs) {
+    const rel = mirrorPathAbs.slice(reposRoot.length).replace(/^[/\\]+/, '');
+    return keyFromMirrorDir(rel.split('\\').join('/'));
+}
+/**
+ * Raised when `--force` cannot REPLACE a project's mirror because a worktree of
+ * the mirror being replaced still holds un-pushed work (a DATA-LOSS block,
+ * distinct from the POLICY block `--force` overrides). The reason names each
+ * unsafe worktree so the human can rescue the work before re-running.
+ */
+export class ReplaceWouldStrandWorkError extends RegistryError {
+}
+/**
+ * Register a target by creating its hub mirror (the `ensureMirror` primitive).
+ * Idempotent: an existing mirror is fetched + reused, not clobbered. With
+ * `--local`, first provisions a `--bare` arbiter from the working repo
+ * (`arbiterInit`, absorbing `arbiter init`) and registers THAT arbiter's mirror.
+ *
+ * Project-identity guard (anti-stranding, ADR §1 +
+ * `work/notes/observations/hub-mirror-key-ignores-transport.md`): if a sibling mirror
+ * for the SAME project (same `projectIdFromKey` tail) already exists under a
+ * DIFFERENT key (a transport mismatch OR a same-transport path/host collision),
+ * refuse by default — registering the project under a second key would fork the
+ * mirror and risk stranding un-pushed `work/<slug>` work on the other mirror.
+ *
+ * `--force` REPLACES the existing mirror(s) for the project (so you can re-link
+ * a project's mirror from a remote to a `--bare` arbiter, or vice-versa,
+ * deliberately) — but `--force` overrides the POLICY block ONLY, NEVER the
+ * DATA-LOSS block: if any worktree of the mirror being replaced still holds
+ * un-pushed work (the full `gc.ts` clean-AND-reachable per-worktree predicate),
+ * the replace REFUSES with {@link ReplaceWouldStrandWorkError}. (An identical
+ * key is the idempotent reuse case, NOT a conflict — it is the same mirror.)
+ */
+export function remoteAdd(options) {
+    const env = options.env;
+    const note = options.note ?? (() => { });
+    let url;
+    let arbiter;
+    if (options.local) {
+        if (!options.arbitersDir || options.arbitersDir.trim() === '') {
+            throw new RegistryError('remote add --local requires `arbitersDir` (the CLI passes the resolved config).');
+        }
+        // Provision (or locate) the local bare arbiter from the working repo, then
+        // register ITS file:// URL. This absorbs `arbiter init`.
+        arbiter = arbiterInit({
+            repo: options.target,
+            arbitersDir: options.arbitersDir,
+            remote: options.arbiterRemote,
+            env,
+            note,
+        });
+        url = arbiter.url;
+    }
+    else {
+        url = options.target.trim();
+        if (url === '') {
+            throw new RegistryError('remote add requires a target URL.');
+        }
+    }
+    const transport = transportForUrl(url);
+    const key = encodeRepoKey(url);
+    const projectId = projectIdFromKey(key);
+    const destPath = mirrorPath(options.workspacesDir, url);
+    // Project-identity guard: a sibling mirror for the SAME project under a
+    // DIFFERENT key (same `projectIdFromKey` tail) risks stranding un-pushed work.
+    // An identical key is the idempotent reuse case, NOT a conflict (same mirror).
+    const siblings = listMirrors({
+        workspacesDir: options.workspacesDir,
+        env,
+    }).filter((m) => m.projectId === projectId && m.key !== key);
+    if (siblings.length > 0) {
+        if (!options.force) {
+            // POLICY block (default): refuse the project-identity collision. Name the
+            // existing mirror(s) + transport(s) so the human sees WHAT collides.
+            const existing = siblings[0];
+            throw new RegistryError(`refusing: project '${projectId}' is already registered (mirror ` +
+                `${existing.key}, transport '${existing.transport}', origin ` +
+                `${existing.originUrl ?? '(unknown)'}). Registering it under a second ` +
+                `key (${key}, transport '${transport}') would fork the mirror and risk ` +
+                'stranding un-pushed work on the other mirror. Re-run with --force to ' +
+                'REPLACE the existing mirror (force replaces the mirror, but still ' +
+                'refuses if un-pushed work would be lost).');
+        }
+        // --force REPLACE path: force overrides the POLICY block, NEVER the
+        // DATA-LOSS block. Before replacing, run the FULL per-worktree predicate
+        // (gc.ts's clean-AND-reachable) across EVERY worktree of the sibling
+        // mirror(s) — committed-but-unpushed work lives in the mirror's refs, but
+        // UNCOMMITTED (dirty) work is only on disk, invisible to a refs-only check.
+        // A single dirty-or-unreachable worktree BLOCKS the replace.
+        const unsafe = unsafeWorktreesForMirrors(options.workspacesDir, new Set(siblings.map((m) => m.key)), env);
+        if (unsafe.length > 0) {
+            const details = unsafe
+                .map((u) => `  - ${u.slug} (${u.dir}): ${u.reasonText}`)
+                .join('\n');
+            throw new ReplaceWouldStrandWorkError(`refusing --force replace of project '${projectId}': the mirror being ` +
+                `replaced has worktree(s) with un-pushed work that would be stranded.\n` +
+                `${details}\n` +
+                '--force overrides the registration POLICY, never the DATA-LOSS guard. ' +
+                'Push/merge or gc --force each worktree above, then re-run.');
+        }
+        // Safe to replace: every sibling worktree is provably clean + reachable.
+        // Delete the sibling mirror(s) so the project re-links onto the new key.
+        for (const sibling of siblings) {
+            remoteRm({
+                target: sibling.key,
+                workspacesDir: options.workspacesDir,
+                env,
+            });
+            note(`replaced: removed prior mirror '${sibling.key}' for '${projectId}'.`);
+        }
+    }
+    const result = ensureMirror({ url, workspacesDir: options.workspacesDir, env });
+    if (result.created) {
+        note(`registered '${key}' (created hub mirror at ${result.path}).`);
+    }
+    else {
+        note(`'${key}' already registered (fetched existing mirror at ${result.path}).`);
+    }
+    return {
+        key,
+        mirrorPath: result.path,
+        url: result.url,
+        transport,
+        created: result.created,
+        ...(arbiter ? { arbiter } : {}),
+    };
+}
+/**
+ * Enumerate the worktrees of the mirror(s) identified by `mirrorKeys` and run
+ * `gc.ts`'s FULL clean-AND-reachable per-worktree predicate
+ * ({@link evaluateDeletionSafety}) in each, returning the ones that are NOT
+ * provably safe (a dirty tree OR a `work/*` tip not reachable on the arbiter).
+ *
+ * Worktrees are discovered via {@link discoverJobs} (which walks
+ * `<workspacesDir>/work/*` for `.dorfl-job.json` records, each carrying
+ * the mirror `repoKey`), so a job is attributed to its mirror by KEY. This is
+ * the DATA-LOSS guard the `--force` replace path consults: replacing a mirror
+ * that still has un-pushed work would strand it, so `--force` proceeds ONLY when
+ * this returns empty (every worktree clean + reachable).
+ */
+function unsafeWorktreesForMirrors(workspacesDir, mirrorKeys, env) {
+    const unsafe = [];
+    for (const job of discoverJobs(workspacesDir)) {
+        if (!jobBelongsToMirror(job, mirrorKeys)) {
+            continue;
+        }
+        const verdict = evaluateDeletionSafety({
+            dir: job.dir,
+            branch: job.branch,
+            env,
+        });
+        if (!verdict.safe) {
+            const reason = verdict.reason ?? 'unmerged-commits';
+            unsafe.push({
+                dir: job.dir,
+                slug: job.slug,
+                reasonText: RETAIN_REASON_TEXT[reason],
+            });
+        }
+    }
+    return unsafe;
+}
+/** True iff `job`'s record attributes it to one of `mirrorKeys`. */
+function jobBelongsToMirror(job, mirrorKeys) {
+    const key = job.record?.repoKey;
+    return key !== undefined && mirrorKeys.has(key);
+}
+/**
+ * Delete a hub mirror by key or origin URL — the ONLY mirror deleter (`gc`
+ * NEVER reaps mirrors). Resolves `target` first as a literal key, then by
+ * encoding it as a URL (so both `remote rm <key>` and `remote rm <url>` work),
+ * and finally by matching any registered mirror's origin URL. Removes the bare
+ * mirror directory (a self-contained `<key>.git` folder under `repos/`).
+ */
+export function remoteRm(options) {
+    const env = options.env;
+    const target = options.target.trim();
+    const mirrors = listMirrors({ workspacesDir: options.workspacesDir, env });
+    // Resolve the mirror to delete: by literal key, by URL→key, or by origin URL.
+    const byKey = mirrors.find((m) => m.key === target);
+    const urlKey = target === '' ? undefined : encodeRepoKey(target);
+    const byUrlKey = urlKey !== undefined ? mirrors.find((m) => m.key === urlKey) : undefined;
+    const byOrigin = mirrors.find((m) => m.originUrl === target);
+    const match = byKey ?? byUrlKey ?? byOrigin;
+    if (match === undefined) {
+        return { key: target, path: '', removed: false };
+    }
+    // Guard: only remove a self-contained bare mirror directory under repos/.
+    if (existsSync(match.path) && statSync(match.path).isDirectory()) {
+        rmSync(match.path, { recursive: true, force: true });
+    }
+    return { key: match.key, path: match.path, removed: true };
+}
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAClE,OAAO,EAAC,IAAI,EAAC,MAAM,WAAW,CAAC;AAC/B,OAAO,EAAC,GAAG,EAAC,MAAM,UAAU,CAAC;AAC7B,OAAO,EACN,aAAa,EACb,YAAY,EACZ,UAAU,EACV,aAAa,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAC,WAAW,EAAyB,MAAM,cAAc,CAAC;AACjE,OAAO,EACN,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,GAElB,MAAM,SAAS,CAAC;AAoDjB,8DAA8D;AAC9D,MAAM,OAAO,aAAc,SAAQ,KAAK;CAAG;AAE3C,+EAA+E;AAC/E,SAAS,QAAQ,CAAC,aAAqB;IACtC,OAAO,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,OAAO,YAAY,CAAC;IACrB,CAAC;IACD,kFAAkF;IAClF,OAAO,aAAa,CAAC;AACtB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC3C,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5D,6EAA6E;IAC7E,8CAA8C;IAC9C,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC;AAED,sEAAsE;AACtE,SAAS,gBAAgB,CACxB,IAAY,EACZ,GAAkC;IAElC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,EAAC,GAAG,EAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,OAAwB;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACX,CAAC;IACD,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,4EAA4E;IAC5E,MAAM,KAAK,GAAa,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QACzB,IAAI,OAAmC,CAAC;QACxC,IAAI,CAAC;YACJ,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAC,aAAa,EAAE,IAAI,EAAC,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACR,SAAS;QACV,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC1B,SAAS;YACV,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC/B,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnD,OAAO,CAAC,IAAI,CAAC;oBACZ,GAAG;oBACH,IAAI,EAAE,IAAI;oBACV,SAAS;oBACT,SAAS,EACR,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC;oBACjE,SAAS,EAAE,gBAAgB,CAAC,GAAG,CAAC;iBAChC,CAAC,CAAC;gBACH,SAAS;YACV,CAAC;YACD,sDAAsD;YACtD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,yEAAyE;AACzE,SAAS,MAAM,CAAC,SAAiB,EAAE,aAAqB;IACvD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACzE,OAAO,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC;AAsDD;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,aAAa;CAAG;AAEjE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,SAAS,CAAC,OAAyB;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAExC,IAAI,GAAW,CAAC;IAChB,IAAI,OAAsC,CAAC;IAC3C,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/D,MAAM,IAAI,aAAa,CACtB,iFAAiF,CACjF,CAAC;QACH,CAAC;QACD,2EAA2E;QAC3E,yDAAyD;QACzD,OAAO,GAAG,WAAW,CAAC;YACrB,IAAI,EAAE,OAAO,CAAC,MAAM;YACpB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,GAAG;YACH,IAAI;SACJ,CAAC,CAAC;QACH,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACnB,CAAC;SAAM,CAAC;QACP,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,aAAa,CAAC,mCAAmC,CAAC,CAAC;QAC9D,CAAC;IACF,CAAC;IAED,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAExD,wEAAwE;IACxE,+EAA+E;IAC/E,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,WAAW,CAAC;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,GAAG;KACH,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAE7D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACpB,0EAA0E;YAC1E,qEAAqE;YACrE,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,IAAI,aAAa,CACtB,sBAAsB,SAAS,kCAAkC;gBAChE,GAAG,QAAQ,CAAC,GAAG,gBAAgB,QAAQ,CAAC,SAAS,YAAY;gBAC7D,GAAG,QAAQ,CAAC,SAAS,IAAI,WAAW,mCAAmC;gBACvE,QAAQ,GAAG,gBAAgB,SAAS,oCAAoC;gBACxE,uEAAuE;gBACvE,oEAAoE;gBACpE,2CAA2C,CAC5C,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,yEAAyE;QACzE,qEAAqE;QACrE,0EAA0E;QAC1E,4EAA4E;QAC5E,6DAA6D;QAC7D,MAAM,MAAM,GAAG,yBAAyB,CACvC,OAAO,CAAC,aAAa,EACrB,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EACnC,GAAG,CACH,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,MAAM;iBACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,UAAU,EAAE,CAAC;iBACvD,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,MAAM,IAAI,2BAA2B,CACpC,wCAAwC,SAAS,sBAAsB;gBACtE,wEAAwE;gBACxE,GAAG,OAAO,IAAI;gBACd,wEAAwE;gBACxE,4DAA4D,CAC7D,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAChC,QAAQ,CAAC;gBACR,MAAM,EAAE,OAAO,CAAC,GAAG;gBACnB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,GAAG;aACH,CAAC,CAAC;YACH,IAAI,CACH,mCAAmC,OAAO,CAAC,GAAG,UAAU,SAAS,IAAI,CACrE,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,EAAC,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,GAAG,EAAC,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC,eAAe,GAAG,4BAA4B,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACP,IAAI,CACH,IAAI,GAAG,oDAAoD,MAAM,CAAC,IAAI,IAAI,CAC1E,CAAC;IACH,CAAC;IAED,OAAO;QACN,GAAG;QACH,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,SAAS;QACT,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAC,OAAO,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7B,CAAC;AACH,CAAC;AAYD;;;;;;;;;;;;GAYG;AACH,SAAS,yBAAyB,CACjC,aAAqB,EACrB,UAAuB,EACvB,GAAkC;IAElC,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC;YAC1C,SAAS;QACV,CAAC;QACD,MAAM,OAAO,GAAG,sBAAsB,CAAC;YACtC,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG;SACH,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC;gBACX,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,UAAU,EAAE,kBAAkB,CAAC,MAAM,CAAC;aACtC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,oEAAoE;AACpE,SAAS,kBAAkB,CAAC,GAAU,EAAE,UAAuB;IAC9D,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC;IAChC,OAAO,GAAG,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACjD,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAwB;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAC,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,GAAG,EAAC,CAAC,CAAC;IAEzE,8EAA8E;IAC9E,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjE,MAAM,QAAQ,GACb,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,KAAK,IAAI,QAAQ,IAAI,QAAQ,CAAC;IAE5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAC,CAAC;IAChD,CAAC;IAED,0EAA0E;IAC1E,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,EAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAC,CAAC;AAC1D,CAAC"}