engineering-memory 1.11.14 → 1.11.16

package/runtime/dist/src/runtime/worktree-preparation.js

@@ -0,0 +1,901 @@
+import { execFile } from 'node:child_process';
+import { constants } from 'node:fs';
+import { chmod, link, lstat, mkdtemp, open, readFile, realpath, rm, rmdir } from 'node:fs/promises';
+import { dirname, isAbsolute, relative, resolve, sep, posix, win32, parse } from 'node:path';
+import { promisify } from 'node:util';
+import { assertManagedPath, ensureManagedDirectory } from '../utilities/files.js';
+import { WorktreeFileIssue, WorktreeFileStatus, } from './worktree-readiness-types.js';
+import { parseGradleSigning } from './worktree-gradle.js';
+const execute = promisify(execFile);
+export async function worktreeGit(repoRoot, args, input) {
+    const running = execute('git', [args[0] === 'check-ignore' ? '--no-literal-pathspecs' : '--literal-pathspecs', ...args], {
+        cwd: repoRoot,
+        windowsHide: true,
+        timeout: 15000,
+        maxBuffer: 4 * 1024 * 1024,
+    });
+    running.child.stdin?.end(input);
+    return (await running).stdout;
+}
+export function localRelativePath(path) {
+    const normalized = path.replaceAll('\\', '/');
+    if (!normalized ||
+        normalized.length > 500 ||
+        normalized.startsWith('/') ||
+        /[\x00-\x1f\x7f<>:"|?*]/.test(normalized) ||
+        normalized
+            .split('/')
+            .some((part) => !part ||
+            part === '.' ||
+            part === '..' ||
+            /[. ]$/.test(part) ||
+            /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(part)))
+        throw new Error('Unsafe local path');
+    return normalized;
+}
+function within(root, path) {
+    const result = relative(root, path).split(sep).join('/');
+    return localRelativePath(result);
+}
+function identity(stat) {
+    return [stat.dev, stat.ino, stat.size, stat.mtimeMs, stat.ctimeMs].join(':');
+}
+async function localFile(root, path) {
+    const target = await assertManagedPath(root, resolve(root, localRelativePath(path)), true);
+    let stat;
+    try {
+        stat = await lstat(target);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > 4 * 1024 * 1024)
+        throw new Error('Unsafe local file');
+    const handle = await open(target, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        if (identity(await handle.stat()) !== identity(stat))
+            throw new Error('Local file changed');
+        const content = await handle.readFile();
+        if (content.length > 4 * 1024 * 1024 || identity(await handle.stat()) !== identity(stat))
+            throw new Error('Local file changed');
+        await assertManagedPath(root, target, false);
+        if (identity(await lstat(target)) !== identity(stat))
+            throw new Error('Local file changed');
+        return { root, path, content, identity: identity(stat) };
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function assertWorktreeInputs(plan) {
+    if ((await worktreeGit(plan.repoRoot, ['rev-parse', 'HEAD'])).trim() !== plan.head)
+        throw new Error('Consumer source changed');
+    for (const source of [...plan.consumers, ...plan.files.flatMap((file) => file.sources)]) {
+        const current = await localFile(source.root, source.path);
+        if (!current || current.identity !== source.identity || !current.content.equals(source.content))
+            throw new Error('Local source changed');
+    }
+}
+export async function assertIgnoredTarget(repoRoot, path) {
+    localRelativePath(path);
+    if ((await worktreeGit(repoRoot, ['ls-files', '-z', '--', path])).length ||
+        (await worktreeGit(repoRoot, ['ls-tree', '-z', 'HEAD', '--', path])).length)
+        throw new Error('Runtime target is tracked');
+    const ignored = await worktreeGit(repoRoot, ['check-ignore', '-z', '--stdin'], path + '\0');
+    if (ignored !== path + '\0')
+        throw new Error('Runtime target is not ignored');
+    const segments = path.split('/');
+    let parent = repoRoot;
+    for (const segment of segments.slice(0, -1)) {
+        parent = resolve(parent, segment);
+        try {
+            await lstat(resolve(parent, '.git'));
+            throw new Error('Nested repository');
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+}
+function decodeProperty(value) {
+    return value.replace(/\\(u[0-9a-fA-F]{4}|u[^\s]*|[\s\S])/g, (_all, escaped) => {
+        if (escaped[0] === 'u') {
+            if (!/^u[0-9a-fA-F]{4}$/.test(escaped))
+                throw new Error('Invalid properties escape');
+            return String.fromCharCode(parseInt(escaped.slice(1), 16));
+        }
+        return { t: '\t', r: '\r', n: '\n', f: '\f' }[escaped] ?? escaped;
+    });
+}
+function properties(content) {
+    const text = content.toString('latin1');
+    const result = new Map();
+    let cursor = 0;
+    while (cursor < text.length) {
+        const start = cursor;
+        let logical = '';
+        let continued = false;
+        do {
+            const ending = /\r\n|\r|\n/g;
+            ending.lastIndex = cursor;
+            const match = ending.exec(text);
+            let line = text.slice(cursor, match?.index ?? text.length);
+            cursor = match ? match.index + match[0].length : text.length;
+            if (!continued && /^[ \t\f]*[#!]/.test(line)) {
+                logical = '';
+                break;
+            }
+            if (continued)
+                line = line.replace(/^[ \t\f]+/, '');
+            const trailing = /\\+$/.exec(line)?.[0].length ?? 0;
+            continued = trailing % 2 === 1;
+            logical += continued ? line.slice(0, -1) : line;
+        } while (continued && cursor < text.length);
+        if (continued)
+            throw new Error('Incomplete properties continuation');
+        const match = /^[ \t\f]*((?:\\.|[^\s:=\\])+)[ \t\f]*(?:[:=][ \t\f]*)?(.*)$/.exec(logical);
+        if (!match || /^[ \t\f]*[#!]/.test(logical))
+            continue;
+        const name = decodeProperty(match[1]);
+        if (result.has(name))
+            throw new Error('Ambiguous duplicate property');
+        result.set(name, { value: decodeProperty(match[2]), start, end: cursor });
+    }
+    return result;
+}
+function propertyValue(value) {
+    return value
+        .split('')
+        .map((character) => {
+        const code = character.charCodeAt(0);
+        return code < 0x20 || code > 0x7e
+            ? '\\u' + code.toString(16).padStart(4, '0')
+            : /[\\:=#! ]/.test(character)
+                ? '\\' + character
+                : character;
+    })
+        .join('');
+}
+function unsupportedEnvironment() {
+    throw new Error('Unsupported environment loader');
+}
+function environmentTokens(text) {
+    const tokens = [];
+    let cursor = 0;
+    while (cursor < text.length) {
+        if (/\s/.test(text[cursor])) {
+            cursor++;
+        }
+        else if (text.startsWith('//', cursor)) {
+            while (cursor < text.length && !/[\r\n]/.test(text[cursor]))
+                cursor++;
+        }
+        else if (text.startsWith('/*', cursor)) {
+            const end = text.indexOf('*/', cursor + 2);
+            if (end < 0)
+                unsupportedEnvironment();
+            cursor = end + 2;
+        }
+        else if (['"', "'", '\x60'].includes(text[cursor])) {
+            const quote = text[cursor++];
+            const start = cursor;
+            let escaped = false;
+            while (cursor < text.length && text[cursor] !== quote) {
+                if (quote === '\x60' && text.startsWith('$' + '{', cursor))
+                    unsupportedEnvironment();
+                if (text[cursor++] === '\\') {
+                    escaped = true;
+                    cursor++;
+                }
+            }
+            if (cursor >= text.length)
+                unsupportedEnvironment();
+            tokens.push({ text: '', literal: escaped ? undefined : text.slice(start, cursor) });
+            cursor++;
+        }
+        else {
+            if (text[cursor] === '/')
+                unsupportedEnvironment();
+            const word = /^[A-Za-z_$][\w$]*/.exec(text.slice(cursor))?.[0];
+            tokens.push({ text: word ?? text[cursor] });
+            cursor += word?.length ?? 1;
+        }
+    }
+    return tokens;
+}
+function environmentObject(tokens, start) {
+    if (tokens[start]?.text !== '{')
+        unsupportedEnvironment();
+    const fields = new Map();
+    let cursor = start + 1;
+    while (tokens[cursor]?.text !== '}') {
+        const key = tokens[cursor]?.literal ?? tokens[cursor]?.text;
+        if (!key ||
+            !/^[A-Za-z_$][\w$]*$/.test(key) ||
+            fields.has(key) ||
+            tokens[cursor + 1]?.text !== ':')
+            unsupportedEnvironment();
+        cursor += 2;
+        const begin = cursor;
+        const closing = [];
+        while (cursor < tokens.length) {
+            const token = tokens[cursor].text;
+            if (!closing.length && [',', '}'].includes(token))
+                break;
+            if (['(', '[', '{'].includes(token))
+                closing.push({ '(': ')', '[': ']', '{': '}' }[token]);
+            else if ([')', ']', '}'].includes(token) && closing.pop() !== token)
+                unsupportedEnvironment();
+            cursor++;
+        }
+        if (cursor === begin || cursor === tokens.length || closing.length)
+            unsupportedEnvironment();
+        fields.set(key, tokens.slice(begin, cursor));
+        if (tokens[cursor]?.text === ',')
+            cursor++;
+    }
+    return { fields, end: cursor + 1 };
+}
+function environmentArguments(tokens, open) {
+    if (tokens[open + 1]?.text === ')')
+        return new Map();
+    const { fields, end } = environmentObject(tokens, open + 1);
+    const close = tokens[end]?.text === ',' ? end + 1 : end;
+    if (tokens[close]?.text !== ')')
+        unsupportedEnvironment();
+    return fields;
+}
+function environmentImports(tokens, module) {
+    const names = new Map();
+    for (let index = 0; index < tokens.length; index++) {
+        if (tokens[index]?.text !== 'import' ||
+            tokens[index + 1]?.text === 'type' ||
+            tokens[index + 1]?.literal !== undefined ||
+            tokens[index + 1]?.text === '(')
+            continue;
+        let end = index + 1;
+        while (end < tokens.length && !['from', ';'].includes(tokens[end].text))
+            end++;
+        if (tokens[end]?.text !== 'from' || tokens[end + 1]?.literal !== module)
+            continue;
+        const specifier = tokens.slice(index + 1, end);
+        if (specifier.length === 1 && specifier[0]?.text)
+            names.set(specifier[0].text, 'default');
+        else if (specifier.length === 3 && specifier[0]?.text === '*' && specifier[1]?.text === 'as')
+            names.set(specifier[2].text, '*');
+        else if (specifier[0]?.text === '{' && specifier.at(-1)?.text === '}') {
+            for (let offset = 1; offset < specifier.length - 1;) {
+                const exported = specifier[offset++]?.text;
+                let alias = exported;
+                if (specifier[offset]?.text === 'as') {
+                    alias = specifier[offset + 1]?.text;
+                    offset += 2;
+                }
+                if (!exported || !alias || names.has(alias))
+                    unsupportedEnvironment();
+                names.set(alias, exported);
+                if (specifier[offset]?.text === ',')
+                    offset++;
+                else if (specifier[offset]?.text !== '}')
+                    unsupportedEnvironment();
+            }
+        }
+        else
+            unsupportedEnvironment();
+    }
+    return names;
+}
+function literalEnvironmentValue(tokens) {
+    if (tokens?.length !== 1 || tokens[0]?.literal === undefined)
+        unsupportedEnvironment();
+    return tokens[0].literal;
+}
+function loaderEnvironmentFiles(text) {
+    const tokens = environmentTokens(text);
+    const nest = environmentImports(tokens, '@nestjs/config');
+    const dotenv = environmentImports(tokens, 'dotenv');
+    const files = [];
+    for (let index = 0; index < tokens.length; index++) {
+        const token = tokens[index].text;
+        if (token === 'require' &&
+            tokens[index + 1]?.text === '(' &&
+            tokens[index + 2]?.literal === 'dotenv' &&
+            tokens[index + 3]?.text === ')' &&
+            tokens[index - 1]?.text === '=' &&
+            ['const', 'let', 'var'].includes(tokens[index - 3]?.text ?? '')) {
+            dotenv.set(tokens[index - 2].text, '*');
+        }
+    }
+    for (let index = 0; index < tokens.length; index++) {
+        const token = tokens[index].text;
+        if (tokens[index - 1]?.text === '.')
+            continue;
+        if ((token === 'import' && tokens[index + 1]?.literal === 'dotenv/config') ||
+            (token === 'require' &&
+                tokens[index + 1]?.text === '(' &&
+                tokens[index + 2]?.literal === 'dotenv/config' &&
+                tokens[index + 3]?.text === ')')) {
+            files.push({ name: '.env', required: false });
+            continue;
+        }
+        let field;
+        let open;
+        if (nest.get(token) === 'ConfigModule' &&
+            tokens[index + 1]?.text === '.' &&
+            tokens[index + 2]?.text === 'forRoot' &&
+            tokens[index + 3]?.text === '(') {
+            field = 'envFilePath';
+            open = index + 3;
+        }
+        else if (['default', '*'].includes(dotenv.get(token) ?? '') &&
+            tokens[index + 1]?.text === '.' &&
+            tokens[index + 2]?.text === 'config' &&
+            tokens[index + 3]?.text === '(') {
+            field = 'path';
+            open = index + 3;
+        }
+        else if (dotenv.get(token) === 'config' && tokens[index + 1]?.text === '(') {
+            field = 'path';
+            open = index + 1;
+        }
+        else if (token === 'require' &&
+            tokens[index + 1]?.text === '(' &&
+            tokens[index + 2]?.literal === 'dotenv' &&
+            tokens[index + 3]?.text === ')' &&
+            tokens[index + 4]?.text === '.' &&
+            tokens[index + 5]?.text === 'config' &&
+            tokens[index + 6]?.text === '(') {
+            field = 'path';
+            open = index + 6;
+        }
+        else
+            continue;
+        const options = environmentArguments(tokens, open);
+        const ignored = options.get('ignoreEnvFile');
+        if (field === 'envFilePath' && ignored) {
+            if (ignored.length !== 1 || !['true', 'false'].includes(ignored[0].text))
+                unsupportedEnvironment();
+            if (ignored[0].text === 'true')
+                continue;
+        }
+        const selected = options.get(field);
+        const name = selected ? literalEnvironmentValue(selected) : '.env';
+        if (!/^(?:[^/]+\/)*\.env(?:\.local|\.development(?:\.local)?)?$/.test(name))
+            unsupportedEnvironment();
+        files.push({ name, required: Boolean(selected) });
+    }
+    return files;
+}
+function viteEnvironmentDirectory(text) {
+    const tokens = environmentTokens(text);
+    const imports = environmentImports(tokens, 'vite');
+    const exports = tokens.flatMap((token, index) => token.text === 'export' && tokens[index + 1]?.text === 'default'
+        ? [index + 2]
+        : token.text === 'module' &&
+            tokens[index + 1]?.text === '.' &&
+            tokens[index + 2]?.text === 'exports' &&
+            tokens[index + 3]?.text === '='
+            ? [index + 4]
+            : []);
+    if (exports.length !== 1)
+        unsupportedEnvironment();
+    let start = exports[0];
+    const wrapped = imports.get(tokens[start]?.text ?? '') === 'defineConfig';
+    if (wrapped) {
+        if (tokens[start + 1]?.text !== '(')
+            unsupportedEnvironment();
+        start += 2;
+    }
+    const { fields, end } = environmentObject(tokens, start);
+    let next = end;
+    if (wrapped) {
+        if (tokens[next]?.text === ',')
+            next++;
+        if (tokens[next++]?.text !== ')')
+            unsupportedEnvironment();
+    }
+    if (tokens[next]?.text === ';')
+        next++;
+    if (next !== tokens.length)
+        unsupportedEnvironment();
+    const envDir = fields.get('envDir');
+    if (envDir?.length === 1 && envDir[0]?.text === 'false')
+        return null;
+    const root = fields.has('root') ? literalEnvironmentValue(fields.get('root')) : '.';
+    const directory = envDir ? literalEnvironmentValue(envDir) : '.';
+    if ([root, directory].some((path) => isAbsolute(path) || win32.isAbsolute(path) || path.includes('\\')))
+        unsupportedEnvironment();
+    return posix.join(root, directory);
+}
+export async function planWorktreeFiles(sourceRoot, mainRoot, repoRoot, previousPaths, pinnedSources = {}) {
+    const plan = {
+        repoRoot,
+        head: (await worktreeGit(repoRoot, ['rev-parse', 'HEAD'])).trim(),
+        files: [],
+        consumers: [],
+        sources: { ...pinnedSources },
+        problems: [],
+        previousPaths,
+        externalDependencies: 0,
+    };
+    const problem = (path, reason) => {
+        if (!plan.problems.some((item) => item.path === path && item.reason === reason))
+            plan.problems.push({ path, reason });
+    };
+    const common = async (root) => {
+        const value = (await worktreeGit(root, ['rev-parse', '--path-format=absolute', '--git-common-dir'])).trim();
+        const canonical = await realpath(value);
+        return process.platform === 'win32' ? canonical.toLowerCase() : canonical;
+    };
+    const targetCommon = await common(repoRoot);
+    if ((await common(sourceRoot)) !== targetCommon || (await common(mainRoot)) !== targetCommon)
+        throw new Error('Runtime source is another clone');
+    const tracked = (await worktreeGit(repoRoot, ['ls-files', '-z'])).split('\0').filter(Boolean);
+    const supported = tracked.filter((path) => /(?:^|\/)(?:build|settings)\.gradle(?:\.kts)?$/.test(path) ||
+        /(?:^|\/)(?:package\.json|.*\.config\.[cm]?[jt]s|.*\.module\.ts)$/.test(path));
+    if (supported.length > 250)
+        throw new Error('Too many runtime consumers');
+    const consumers = new Map();
+    for (const path of supported) {
+        const file = await localFile(repoRoot, path);
+        if (!file || file.content.length > 256 * 1024)
+            throw new Error('Consumer unavailable');
+        plan.consumers.push(file);
+        consumers.set(path, file.content.toString('utf8'));
+    }
+    const choose = async (path, required) => {
+        localRelativePath(path);
+        const pinned = plan.sources[path];
+        const roots = pinned ? [pinned] : [...new Set([sourceRoot, mainRoot])];
+        for (const root of roots) {
+            if (root !== sourceRoot && root !== mainRoot)
+                throw new Error('Unknown runtime source');
+            const file = await localFile(root, path);
+            if (file) {
+                plan.sources[path] = root;
+                return file;
+            }
+        }
+        if (required || pinned)
+            problem(path, WorktreeFileIssue.Missing);
+        return null;
+    };
+    const add = async (file, content = file.content, dependencies = []) => {
+        await assertIgnoredTarget(repoRoot, file.path);
+        const existing = plan.files.find((item) => item.path === file.path);
+        if (existing && !existing.content.equals(content)) {
+            problem(file.path, WorktreeFileIssue.Conflict);
+            return;
+        }
+        if (existing)
+            existing.sources.push(...dependencies);
+        else
+            plan.files.push({ path: file.path, content, sources: [file, ...dependencies] });
+    };
+    const simple = async (path, required) => {
+        try {
+            const file = await choose(path, required);
+            if (file)
+                await add(file);
+        }
+        catch {
+            problem(path, WorktreeFileIssue.Unsafe);
+        }
+    };
+    const androidRoots = new Set();
+    for (const [buildPath, text] of consumers) {
+        if (!/(?:^|\/)build\.gradle(?:\.kts)?$/.test(buildPath))
+            continue;
+        const module = posix.dirname(buildPath);
+        const roots = tracked
+            .filter((path) => /(?:^|\/)settings\.gradle(?:\.kts)?$/.test(path) &&
+            (module === posix.dirname(path) ||
+                module.startsWith(posix.dirname(path) + '/') ||
+                posix.dirname(path) === '.'))
+            .map(posix.dirname)
+            .sort((a, b) => b.length - a.length);
+        const android = roots[0] ?? (buildPath.startsWith('android/') ? 'android' : '.');
+        if (/com\.android\.|com\.android\b|flutter|storeFile/.test(text))
+            androidRoots.add(android);
+        if (/com\.google\.gms\.google-services/.test(text))
+            await simple(posix.join(module, 'google-services.json'), true);
+        let signing;
+        try {
+            signing = parseGradleSigning(text);
+        }
+        catch {
+            problem(buildPath, WorktreeFileIssue.Unsupported);
+            continue;
+        }
+        if (!signing)
+            continue;
+        let path;
+        try {
+            path = within(repoRoot, resolve(repoRoot, signing.propertiesRoot ? android : module, signing.propertiesPath));
+        }
+        catch {
+            problem(buildPath, WorktreeFileIssue.Unsafe);
+            continue;
+        }
+        try {
+            const file = await choose(path, true);
+            if (!file)
+                continue;
+            const field = properties(file.content).get('storeFile');
+            if (!field?.value) {
+                problem(path, WorktreeFileIssue.Missing);
+                continue;
+            }
+            const base = signing.keyRoot ? android : module;
+            const absolute = isAbsolute(field.value) || win32.isAbsolute(field.value);
+            const keyPath = absolute
+                ? resolve(field.value)
+                : resolve(file.root, base, field.value.replaceAll('\\', '/'));
+            let keyRelative;
+            try {
+                keyRelative = within(file.root, keyPath);
+            }
+            catch {
+                const fromRoot = relative(file.root, keyPath);
+                if (!fromRoot.startsWith('..' + sep) && !isAbsolute(fromRoot))
+                    throw new Error('Unsafe key reference');
+                if (keyPath.startsWith('\\\\') ||
+                    (process.platform === 'win32' && !/^[A-Za-z]:[\\/]/.test(keyPath)))
+                    throw new Error('Unsupported external key reference');
+                localRelativePath(relative(parse(keyPath).root, keyPath).split(sep).join('/'));
+                const external = await lstat(keyPath);
+                if (!external.isFile() || external.isSymbolicLink())
+                    throw new Error('External key unavailable');
+                let output = file.content;
+                if (!absolute) {
+                    const text = file.content.toString('latin1');
+                    const ending = text.slice(field.start, field.end).endsWith('\r\n') ? '\r\n' : '\n';
+                    output = Buffer.from(text.slice(0, field.start) +
+                        'storeFile=' +
+                        propertyValue(keyPath.replaceAll('\\', '/')) +
+                        ending +
+                        text.slice(field.end), 'latin1');
+                }
+                await add(file, output);
+                plan.externalDependencies++;
+                continue;
+            }
+            const key = await localFile(file.root, keyRelative);
+            if (!key) {
+                problem(keyRelative, WorktreeFileIssue.Missing);
+                continue;
+            }
+            if (file.root !== sourceRoot && (await localFile(sourceRoot, keyRelative))) {
+                problem(path, WorktreeFileIssue.Conflict);
+                continue;
+            }
+            let output = file.content;
+            if (absolute) {
+                const text = file.content.toString('latin1');
+                const ending = text.slice(field.start, field.end).endsWith('\r\n') ? '\r\n' : '\n';
+                output = Buffer.from(text.slice(0, field.start) +
+                    'storeFile=' +
+                    propertyValue(resolve(repoRoot, keyRelative).replaceAll('\\', '/')) +
+                    ending +
+                    text.slice(field.end), 'latin1');
+            }
+            await assertIgnoredTarget(repoRoot, path);
+            await add(key);
+            await add(file, output, [key]);
+        }
+        catch {
+            problem(path, WorktreeFileIssue.Unsafe);
+        }
+    }
+    for (const root of androidRoots)
+        await simple(posix.join(root, 'local.properties'), false);
+    const packageRoots = tracked
+        .filter((path) => posix.basename(path) === 'package.json')
+        .map(posix.dirname);
+    for (const [path, text] of consumers) {
+        if (posix.basename(path) !== 'package.json')
+            continue;
+        let manifest;
+        try {
+            manifest = JSON.parse(text);
+        }
+        catch {
+            continue;
+        }
+        const dependencies = { ...manifest.dependencies, ...manifest.devDependencies };
+        const root = posix.dirname(path);
+        const belongs = (name) => {
+            const owner = packageRoots
+                .filter((candidate) => candidate === '.' || name.startsWith(candidate + '/'))
+                .sort((a, b) => (b === '.' ? 0 : b.length) - (a === '.' ? 0 : a.length))[0];
+            return owner === root;
+        };
+        const loaders = [...consumers].filter(([name]) => /\.[cm]?[jt]s$/.test(name) && belongs(name));
+        const selected = [];
+        try {
+            if (dependencies.vite) {
+                const configs = loaders.filter(([name]) => posix.dirname(name) === root && /^vite\.config\./.test(posix.basename(name)));
+                if (configs.length > 1)
+                    unsupportedEnvironment();
+                for (const script of Object.values(manifest.scripts ?? {})) {
+                    const args = script.trim().split(/\s+/);
+                    const vite = args.indexOf('vite');
+                    if (vite < 0)
+                        continue;
+                    const tail = args.slice(vite + 1);
+                    if (tail.some((arg) => /^(?:--(?:config|mode)|-c)(?:=|$)/.test(arg)) ||
+                        tail
+                            .filter((arg) => !arg.startsWith('-'))
+                            .some((arg) => !['dev', 'serve', 'build', 'preview'].includes(arg)))
+                        unsupportedEnvironment();
+                }
+                const directory = configs.length ? viteEnvironmentDirectory(configs[0][1]) : '.';
+                if (directory !== null) {
+                    for (const name of ['.env', '.env.local', '.env.development', '.env.development.local'])
+                        selected.push({ name: posix.join(directory, name), required: false });
+                }
+            }
+            else if (dependencies.next) {
+                for (const name of ['.env', '.env.local', '.env.development', '.env.development.local'])
+                    selected.push({ name, required: false });
+            }
+            else if (dependencies.dotenv || dependencies['@nestjs/config']) {
+                for (const [, content] of loaders)
+                    selected.push(...loaderEnvironmentFiles(content));
+            }
+            const paths = selected.map((file) => ({
+                path: within(repoRoot, resolve(repoRoot, root, file.name)),
+                required: file.required,
+            }));
+            for (const file of paths)
+                await simple(file.path, file.required);
+        }
+        catch {
+            problem(path, WorktreeFileIssue.Unsupported);
+        }
+    }
+    if (plan.files.length > 100 ||
+        plan.files.reduce((sum, file) => sum + file.content.length, 0) > 16 * 1024 * 1024)
+        throw new Error('Local preparation limit exceeded');
+    const ignored = (await worktreeGit(repoRoot, [
+        '--no-literal-pathspecs',
+        'ls-files',
+        '--others',
+        '--ignored',
+        '--exclude-standard',
+        '-z',
+        '--',
+        ':(glob)**/key.properties',
+        ':(glob)**/local.properties',
+        ':(glob)**/*.jks',
+        ':(glob)**/*.keystore',
+        ':(glob)**/google-services.json',
+        ':(glob)**/.env',
+        ':(glob)**/.env.local',
+        ':(glob)**/.env.development',
+        ':(glob)**/.env.development.local',
+        ':(exclude,glob)**/node_modules/**',
+        ':(exclude,glob)**/build/**',
+        ':(exclude,glob)**/.gradle/**',
+        ':(exclude,glob)**/.dart_tool/**',
+    ]))
+        .split('\0')
+        .filter(Boolean);
+    for (const path of new Set([...previousPaths, ...ignored])) {
+        if (plan.files.some((file) => file.path === path))
+            continue;
+        try {
+            if (await localFile(repoRoot, path))
+                problem(path, WorktreeFileIssue.Stale);
+        }
+        catch {
+            problem(path, WorktreeFileIssue.Unsafe);
+        }
+    }
+    const ordered = [];
+    const ordering = new Set();
+    const order = (file) => {
+        if (ordered.includes(file))
+            return;
+        if (ordering.has(file.path))
+            throw new Error('Cyclic runtime dependency');
+        ordering.add(file.path);
+        for (const source of file.sources) {
+            const dependency = plan.files.find((item) => item.path === source.path && item !== file);
+            if (dependency)
+                order(dependency);
+        }
+        ordering.delete(file.path);
+        ordered.push(file);
+    };
+    plan.files.forEach(order);
+    plan.files = ordered;
+    return plan;
+}
+export async function createWorktreeStage(plan) {
+    const parent = dirname(plan.repoRoot);
+    await assertManagedPath(parent, parent, false);
+    const directory = await mkdtemp(resolve(parent, 'em-local-'));
+    const info = await lstat(directory);
+    return {
+        directory,
+        repoRoot: plan.repoRoot,
+        count: plan.files.length,
+        identity: [info.dev, info.ino].join(':'),
+        plan,
+    };
+}
+async function assertStage(stage, missing = false) {
+    if (dirname(stage.directory) !== dirname(stage.repoRoot) ||
+        !/^em-local-[A-Za-z0-9]+$/.test(stage.directory.slice(dirname(stage.directory).length + 1)) ||
+        !Number.isInteger(stage.count) ||
+        stage.count < 0 ||
+        stage.count > 100)
+        throw new Error('Unknown runtime staging directory');
+    const directory = await assertManagedPath(dirname(stage.repoRoot), stage.directory, missing);
+    let info;
+    try {
+        info = await lstat(directory);
+    }
+    catch (error) {
+        if (missing && error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+    if (!info.isDirectory() ||
+        info.isSymbolicLink() ||
+        [info.dev, info.ino].join(':') !== stage.identity)
+        throw new Error('Runtime staging directory changed');
+    return directory;
+}
+export async function stageWorktreeFiles(stage) {
+    const directory = (await assertStage(stage));
+    if (process.platform === 'win32') {
+        const account = await execute('whoami.exe', ['/user', '/fo', 'csv', '/nh'], {
+            timeout: 10000,
+            windowsHide: true,
+            maxBuffer: 8192,
+        });
+        const sid = /S-1-5-\d+(?:-\d+)+/.exec(account.stdout)?.[0];
+        if (!sid)
+            throw new Error('Local file access could not be restricted');
+        await execute('icacls.exe', [directory, '/inheritance:r', '/grant:r', '*' + sid + ':(OI)(CI)F'], {
+            timeout: 10000,
+            windowsHide: true,
+            maxBuffer: 8192,
+        });
+    }
+    else
+        await chmod(directory, 0o700);
+    for (const [index, file] of stage.plan.files.entries()) {
+        const handle = await open(resolve(directory, String(index)), 'wx', 0o600);
+        try {
+            await handle.writeFile(file.content);
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    await assertWorktreeInputs(stage.plan);
+}
+export async function discardStagedWorktreeFiles(stage) {
+    const directory = await assertStage(stage, true);
+    if (!directory)
+        return;
+    for (let index = 0; index < stage.count; index++) {
+        const path = await assertManagedPath(directory, resolve(directory, String(index)), true);
+        await rm(path, { force: true });
+    }
+    await rmdir(directory);
+}
+export async function publishWorktreeFiles(stage) {
+    const { plan } = stage;
+    const result = {
+        status: WorktreeFileStatus.Attention,
+        copied: 0,
+        unchanged: 0,
+        problems: [...plan.problems],
+        externalDependencies: plan.externalDependencies,
+    };
+    const fail = (path, reason) => {
+        result.problems.push({ path, reason });
+    };
+    try {
+        await assertStage(stage);
+        for (const [index, file] of plan.files.entries()) {
+            const staged = await localFile(stage.directory, String(index));
+            if (!staged?.content.equals(file.content))
+                throw new Error('Staged runtime file changed');
+        }
+        await assertWorktreeInputs(plan);
+    }
+    catch {
+        fail('.', WorktreeFileIssue.SourceChanged);
+        return result;
+    }
+    const parents = new Map();
+    const exists = new Set();
+    for (const file of plan.files) {
+        try {
+            await assertIgnoredTarget(plan.repoRoot, file.path);
+            const target = await assertManagedPath(plan.repoRoot, resolve(plan.repoRoot, file.path), true);
+            await ensureManagedDirectory(plan.repoRoot, dirname(target));
+            const segments = file.path.split('/').slice(0, -1);
+            let parent = plan.repoRoot;
+            for (const segment of ['', ...segments]) {
+                if (segment)
+                    parent = resolve(parent, segment);
+                const stat = await lstat(parent);
+                parents.set(parent, [stat.dev, stat.ino].join(':'));
+            }
+            try {
+                const stat = await lstat(target);
+                if (!stat.isFile() ||
+                    stat.isSymbolicLink() ||
+                    stat.size > 4 * 1024 * 1024 ||
+                    !(await readFile(target)).equals(file.content)) {
+                    fail(file.path, WorktreeFileIssue.Conflict);
+                }
+                else
+                    exists.add(file.path);
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+        catch {
+            fail(file.path, WorktreeFileIssue.Unsafe);
+        }
+    }
+    if (result.problems.length)
+        return result;
+    for (const [index, file] of plan.files.entries()) {
+        try {
+            for (const [parent, expected] of parents) {
+                await assertManagedPath(plan.repoRoot, parent, false);
+                const stat = await lstat(parent);
+                if ([stat.dev, stat.ino].join(':') !== expected)
+                    throw new Error('Runtime parent changed');
+            }
+            await assertIgnoredTarget(plan.repoRoot, file.path);
+            const target = await assertManagedPath(plan.repoRoot, resolve(plan.repoRoot, file.path), true);
+            if (exists.has(file.path)) {
+                if (!(await readFile(target)).equals(file.content))
+                    throw new Error('Runtime target changed');
+                result.unchanged++;
+                continue;
+            }
+            const source = await assertManagedPath(stage.directory, resolve(stage.directory, String(index)), false);
+            const bytes = await localFile(stage.directory, String(index));
+            if (!bytes?.content.equals(file.content))
+                throw new Error('Staged runtime file changed');
+            await link(source, target);
+            await assertManagedPath(plan.repoRoot, target, false);
+            const [published, staged] = await Promise.all([lstat(target), lstat(source)]);
+            if (published.ino !== staged.ino ||
+                published.dev !== staged.dev ||
+                !(await readFile(target)).equals(file.content))
+                throw new Error('Runtime target changed');
+            result.copied++;
+        }
+        catch {
+            fail(file.path, WorktreeFileIssue.Failed);
+            return result;
+        }
+    }
+    try {
+        await assertWorktreeInputs(plan);
+    }
+    catch {
+        fail('.', WorktreeFileIssue.SourceChanged);
+        return result;
+    }
+    result.status = plan.files.length ? WorktreeFileStatus.Prepared : WorktreeFileStatus.NotNeeded;
+    return result;
+}
+//# sourceMappingURL=worktree-preparation.js.map