harnery 0.45.1 → 0.46.0

package/dist/lib/browser/windows-chrome.js

@@ -359,6 +359,48 @@ export function stopWindowsChromeProfile(profileWindows, closeSeconds = 15) {
     }
     return parseStopOutput(result.stdout, profileWindows);
 }
+/**
+ * PowerShell that lists the Chrome processes running on the profile matched
+ * by `$Pattern` and prints their ids as a JSON array. It never closes them.
+ */
+export function runningScript() {
+    return [
+        "param([string]$Pattern)",
+        "$ErrorActionPreference = 'Stop'",
+        PROFILE_PROCESS_FUNCTION,
+        "$ids = @(Get-ProfileChrome | ForEach-Object { [int]$_.ProcessId })",
+        "[Console]::Out.Write((ConvertTo-Json -Compress -InputObject $ids))",
+    ].join("\r\n");
+}
+/** Parse the running script's stdout into process ids. */
+export function parseRunningOutput(stdout) {
+    const trimmed = stdout.trim();
+    if (!trimmed)
+        return [];
+    const parsed = JSON.parse(trimmed);
+    if (parsed === null)
+        return [];
+    return (Array.isArray(parsed) ? parsed : [parsed]).map(Number);
+}
+/**
+ * Ids of the Chrome processes running on `profileWindows`, for callers that
+ * must leave an open profile alone. Throws when the check cannot run.
+ */
+export function windowsChromeProfileProcesses(profileWindows) {
+    const result = runPowerShellScript("profile-running", runningScript(), ["-Pattern", profileCommandLinePattern(profileWindows)], 30_000);
+    if (result.status !== 0) {
+        throw new Error(`Checking for Chrome on ${profileWindows} failed: ${(result.stderr || result.stdout || result.error?.message || "no output").trim().slice(0, 400)}`);
+    }
+    return parseRunningOutput(result.stdout);
+}
+/** Linux form of a drive-letter Windows path (`C:\x` becomes `/mnt/c/x`). */
+export function windowsPathToWsl(windowsPath) {
+    const match = /^([A-Za-z]):\\(.*)$/.exec(windowsPath);
+    if (!match)
+        throw new Error(`Not a drive-letter path: ${windowsPath}`);
+    const rest = (match[2] ?? "").replace(/\\+/g, "/").replace(/\/+$/, "");
+    return `/mnt/${match[1].toLowerCase()}${rest ? `/${rest}` : ""}`;
+}
 /** Windows form of a `/mnt/<drive>/...` path. */
 export function wslPathToWindows(linuxPath) {
     const match = /^\/mnt\/([a-z])\/(.*)$/.exec(linuxPath);

package/dist/lib/browser/windows-login-sync.d.ts

@@ -0,0 +1,110 @@
+import type { Cookie } from "../cookies/client.js";
+import type { WindowsChromeHarvest } from "./windows-chrome.js";
+/**
+ * Keep the shared cookie store current with the WSL sign-in profile.
+ *
+ * Under WSL, `browse --login` signs in through the Windows host's Chrome on a
+ * dedicated profile and copies that site's cookies into the cookie store when
+ * the window closes. People also keep that profile open as an ordinary
+ * browser and sign in to other sites there later. Nothing copies those
+ * sign-ins when the window is closed outside a waiting `--login` run, so a
+ * later headless run would show the site signed out.
+ *
+ * Before a headless run, this module compares the profile's cookie database
+ * modification time with the time recorded at the last copy for the run's
+ * domain. When the profile changed and no Chrome is running on it, the
+ * domain's cookies are read (the same headless read `--login` uses) and
+ * merged into the store. A profile that is open is never touched. A small
+ * owner-only state file next to the store records, per domain, the database
+ * time and a fingerprint of the cookies last read. When a read returns the
+ * same cookies as last time, nothing is merged, so cookies a headless run
+ * refreshed in the store are not replaced with the profile's older copies.
+ */
+export interface DomainSyncRecord {
+    /** When the profile's cookies for the domain were last read. */
+    syncedAt: string;
+    /** Cookie database modification time right after that read. */
+    cookieDbMtimeMs: number;
+    /** SHA-256 over the cookies read, so an unchanged read merges nothing. */
+    fingerprint: string;
+    /** Number of cookies read. */
+    cookies: number;
+}
+export interface LoginSyncState {
+    version: 1;
+    domains: Record<string, DomainSyncRecord>;
+}
+/** The sync-state file for a cookie store: `<store>.login-sync.json`, beside it. */
+export declare function loginSyncStatePath(storePath: string): string;
+export declare function readLoginSyncState(statePath: string): LoginSyncState;
+/** Write the state file owner-only, replacing it atomically. */
+export declare function writeLoginSyncState(statePath: string, state: LoginSyncState): void;
+/** Order-independent fingerprint of a cookie set. Values are hashed, never stored. */
+export declare function cookieFingerprint(cookies: Cookie[]): string;
+export type LoginSyncDecision = 
+/** No cookie database: the profile has never been used. */
+"no-profile"
+/** The database has not changed since the last read for this domain. */
+ | "current"
+/** The database is newer, but Chrome is open on the profile. */
+ | "open"
+/** The database is newer (or the read is forced) and the profile is closed. */
+ | "sync";
+/**
+ * Decide what to do before reading. `running` is consulted only when the
+ * database is newer, since checking for Chrome costs a PowerShell call.
+ */
+export declare function decideLoginSync(input: {
+    cookieDbMtimeMs: number | undefined;
+    record: DomainSyncRecord | undefined;
+    running: () => boolean;
+    force?: boolean;
+}): LoginSyncDecision;
+export interface LoginSyncDeps {
+    /** Newest modification time of the profile's cookie database, or `undefined`. */
+    cookieDbMtimeMs: () => number | undefined;
+    /** Ids of Chrome processes running on the profile. */
+    profileProcesses: () => number[];
+    /** Read the profile's cookies for `domain`; the profile must be closed. */
+    harvest: (domain: string) => WindowsChromeHarvest;
+    now?: () => Date;
+}
+export interface LoginSyncResult {
+    status: "no-profile" | "current" | "open" | "busy" | "synced" | "unchanged";
+    domain: string;
+    /** Cookies read from the profile (0 when nothing was read). */
+    cookies: number;
+    /** Cookies merged into the store (0 unless `synced`). */
+    merged: number;
+    sessionCookies: number;
+    /** Cookie names merged, sorted. Never values. */
+    names: string[];
+    /** Chrome process ids on the profile when `open`. */
+    processes: number[];
+}
+/**
+ * Copy the profile's cookies for `domain` into the store when the profile
+ * changed since the last copy and is closed. `force` skips the time check
+ * and merges whatever is read. Throws only on read failures; the caller
+ * decides whether that is a warning.
+ */
+export declare function syncLoginCookies(input: {
+    domain: string;
+    storePath: string;
+    deps: LoginSyncDeps;
+    force?: boolean;
+}): LoginSyncResult;
+/**
+ * Record a read that happened elsewhere (the `--login` flow), so the next
+ * headless run does not read the same cookies again.
+ */
+export declare function recordLoginSync(input: {
+    domain: string;
+    storePath: string;
+    cookies: Cookie[];
+    cookieDbMtimeMs: number | undefined;
+    now?: Date;
+}): void;
+/** Newest mtime among a profile's cookie database locations, or `undefined`. */
+export declare function profileCookieDbMtimeMs(profileLinux: string, stat?: (path: string) => number | undefined): number | undefined;
+//# sourceMappingURL=windows-login-sync.d.ts.map

package/dist/lib/browser/windows-login-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows-login-sync.d.ts","sourceRoot":"","sources":["../../../src/lib/browser/windows-login-sync.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,eAAe,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C;AAED,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,CAUpE;AAED,gEAAgE;AAChE,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAKlF;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAK3D;AAED,MAAM,MAAM,iBAAiB;AAC3B,2DAA2D;AACzD,YAAY;AACd,wEAAwE;GACtE,SAAS;AACX,gEAAgE;GAC9D,MAAM;AACR,+EAA+E;GAC7E,MAAM,CAAC;AAEX;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,MAAM,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACrC,OAAO,EAAE,MAAM,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,iBAAiB,CAKpB;AAED,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,eAAe,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC1C,sDAAsD;IACtD,gBAAgB,EAAE,MAAM,MAAM,EAAE,CAAC;IACjC,2EAA2E;IAC3E,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,oBAAoB,CAAC;IAClD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,WAAW,CAAC;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,qDAAqD;IACrD,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,eAAe,CA2DlB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,IAAI,CAUP;AAED,gFAAgF;AAChF,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,EACpB,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAuB,GACvD,MAAM,GAAG,SAAS,CAQpB"}

package/dist/lib/browser/windows-login-sync.js

@@ -0,0 +1,171 @@
+import { createHash } from "node:crypto";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { CookieJar, mergeCookies } from "../cookies/index.js";
+/** The sync-state file for a cookie store: `<store>.login-sync.json`, beside it. */
+export function loginSyncStatePath(storePath) {
+    const name = basename(storePath).replace(/\.json$/i, "");
+    return join(dirname(storePath), `${name}.login-sync.json`);
+}
+export function readLoginSyncState(statePath) {
+    try {
+        const parsed = JSON.parse(readFileSync(statePath, "utf8"));
+        if (parsed && parsed.version === 1 && parsed.domains && typeof parsed.domains === "object") {
+            return { version: 1, domains: parsed.domains };
+        }
+    }
+    catch {
+        // Missing or unreadable state means nothing has been copied yet.
+    }
+    return { version: 1, domains: {} };
+}
+/** Write the state file owner-only, replacing it atomically. */
+export function writeLoginSyncState(statePath, state) {
+    mkdirSync(dirname(statePath), { recursive: true, mode: 0o700 });
+    const tmp = `${statePath}.${process.pid}.tmp`;
+    writeFileSync(tmp, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
+    renameSync(tmp, statePath);
+}
+/** Order-independent fingerprint of a cookie set. Values are hashed, never stored. */
+export function cookieFingerprint(cookies) {
+    const rows = cookies
+        .map((c) => JSON.stringify([c.name, c.domain, c.path, c.value, c.expires]))
+        .sort();
+    return createHash("sha256").update(rows.join("\n")).digest("hex");
+}
+/**
+ * Decide what to do before reading. `running` is consulted only when the
+ * database is newer, since checking for Chrome costs a PowerShell call.
+ */
+export function decideLoginSync(input) {
+    if (input.cookieDbMtimeMs === undefined)
+        return "no-profile";
+    if (!input.force && input.record && input.cookieDbMtimeMs <= input.record.cookieDbMtimeMs)
+        return "current";
+    return input.running() ? "open" : "sync";
+}
+/**
+ * Copy the profile's cookies for `domain` into the store when the profile
+ * changed since the last copy and is closed. `force` skips the time check
+ * and merges whatever is read. Throws only on read failures; the caller
+ * decides whether that is a warning.
+ */
+export function syncLoginCookies(input) {
+    const { domain, storePath, deps } = input;
+    const base = {
+        status: "current",
+        domain,
+        cookies: 0,
+        merged: 0,
+        sessionCookies: 0,
+        names: [],
+        processes: [],
+    };
+    const statePath = loginSyncStatePath(storePath);
+    const state = readLoginSyncState(statePath);
+    const record = state.domains[domain];
+    let processes = [];
+    const decision = decideLoginSync({
+        cookieDbMtimeMs: deps.cookieDbMtimeMs(),
+        record,
+        force: input.force,
+        running: () => {
+            processes = deps.profileProcesses();
+            return processes.length > 0;
+        },
+    });
+    if (decision === "no-profile")
+        return { ...base, status: "no-profile" };
+    if (decision === "current")
+        return base;
+    if (decision === "open")
+        return { ...base, status: "open", processes };
+    const release = acquireSyncLock(statePath);
+    if (!release)
+        return { ...base, status: "busy" };
+    try {
+        const { cookies } = deps.harvest(domain);
+        const fingerprint = cookieFingerprint(cookies);
+        const changed = input.force || !record || record.fingerprint !== fingerprint;
+        let merged = [];
+        if (changed && cookies.length > 0) {
+            const jar = new CookieJar({ path: storePath, source: "harn-browse" });
+            jar.save(mergeCookies(jar.load(), cookies));
+            merged = cookies;
+        }
+        const after = readLoginSyncState(statePath);
+        after.domains[domain] = {
+            syncedAt: (deps.now?.() ?? new Date()).toISOString(),
+            cookieDbMtimeMs: deps.cookieDbMtimeMs() ?? 0,
+            fingerprint,
+            cookies: cookies.length,
+        };
+        writeLoginSyncState(statePath, after);
+        return {
+            ...base,
+            status: merged.length > 0 ? "synced" : "unchanged",
+            cookies: cookies.length,
+            merged: merged.length,
+            sessionCookies: merged.filter((c) => c.expires <= 0).length,
+            names: [...new Set(merged.map((c) => c.name))].sort(),
+        };
+    }
+    finally {
+        release();
+    }
+}
+/**
+ * Record a read that happened elsewhere (the `--login` flow), so the next
+ * headless run does not read the same cookies again.
+ */
+export function recordLoginSync(input) {
+    const statePath = loginSyncStatePath(input.storePath);
+    const state = readLoginSyncState(statePath);
+    state.domains[input.domain] = {
+        syncedAt: (input.now ?? new Date()).toISOString(),
+        cookieDbMtimeMs: input.cookieDbMtimeMs ?? 0,
+        fingerprint: cookieFingerprint(input.cookies),
+        cookies: input.cookies.length,
+    };
+    writeLoginSyncState(statePath, state);
+}
+/** Newest mtime among a profile's cookie database locations, or `undefined`. */
+export function profileCookieDbMtimeMs(profileLinux, stat = fileMtimeMs) {
+    const times = [
+        join(profileLinux, "Default", "Network", "Cookies"),
+        join(profileLinux, "Default", "Cookies"),
+    ]
+        .map((path) => stat(path))
+        .filter((t) => t !== undefined);
+    return times.length > 0 ? Math.max(...times) : undefined;
+}
+function fileMtimeMs(path) {
+    try {
+        return statSync(path).mtimeMs;
+    }
+    catch {
+        return undefined;
+    }
+}
+const LOCK_STALE_MS = 3 * 60_000;
+/**
+ * One read at a time: a second headless Chrome on the profile would refuse
+ * to start. A lock older than three minutes is treated as abandoned.
+ */
+function acquireSyncLock(statePath) {
+    const lockPath = `${statePath}.lock`;
+    mkdirSync(dirname(lockPath), { recursive: true, mode: 0o700 });
+    for (let attempt = 0; attempt < 2; attempt++) {
+        try {
+            closeSync(openSync(lockPath, "wx", 0o600));
+            return () => rmSync(lockPath, { force: true });
+        }
+        catch {
+            const age = existsSync(lockPath) ? Date.now() - (fileMtimeMs(lockPath) ?? 0) : 0;
+            if (age < LOCK_STALE_MS)
+                return null;
+            rmSync(lockPath, { force: true });
+        }
+    }
+    return null;
+}

package/dist/lib/cookies/client.d.ts

@@ -71,9 +71,9 @@ export declare class CookieJar {
     private stamp;
     private update;
     /**
-     * Read + filter helper. Drops expired cookies. Optional domain filter
-     * uses the same `domainMatches` logic Playwright/CDP do (leading dot
-     * means subdomain match).
+     * Read + filter helper. Drops expired cookies. The optional domain filter
+     * uses `domainMatches` (equal host or any subdomain); it is a query, not a
+     * delivery rule. `header(url)` uses the stricter `cookieSendsToHost`.
      */
     list(filter?: {
         domain?: string;
@@ -129,12 +129,37 @@ export declare class CookieJar {
  * `(name, domain, path)` triple replace older ones. Pure; caller must save.
  */
 export declare function mergeCookies(store: CookieStore, incoming: Cookie[]): CookieStore;
-/** RFC 6265 domain match. Leading dot in cookie domain means subdomain match. */
+/**
+ * Filter-style domain match used by `list({ domain })` and `clear({ domain })`:
+ * a cookie domain "matches" a hostname when they are equal or the hostname is
+ * a subdomain of it, whether or not the cookie is host-only. Never use this to
+ * decide whether a cookie may be SENT to a host; use `cookieSendsToHost`.
+ */
 export declare function domainMatches(cookieDomain: string, hostname: string): boolean;
+/**
+ * RFC 6265 delivery rule. A cookie domain with a leading dot is a domain
+ * cookie and goes to the domain and every subdomain. A cookie domain without
+ * one is host-only (how CDP, Playwright and `Set-Cookie` without `Domain`
+ * record it) and goes to that exact host and nowhere else.
+ */
+export declare function cookieSendsToHost(cookieDomain: string, hostname: string): boolean;
+/**
+ * Cookie-prefix rules (RFC 6265bis). `__Secure-` needs Secure; `__Host-` also
+ * needs Path=/ and no Domain attribute, which a jar records as a host-only
+ * domain (no leading dot). Browsers refuse a violating cookie, so the jar
+ * never stores one and the browser injector never hands one to Chromium.
+ */
+export declare function violatesCookiePrefix(cookie: Pick<Cookie, "name" | "domain" | "path" | "secure">): boolean;
+/** True for hosts a browser treats as a secure context without TLS. */
+export declare function isLoopbackHost(hostname: string): boolean;
 /** RFC 6265 path match. */
 export declare function pathMatches(cookiePath: string, urlPath: string): boolean;
 /** `expires <= 0` is a session cookie / no expiry; otherwise compare to now. */
 export declare function isExpired(cookie: Cookie): boolean;
-/** Cookies that should be sent with a request to `url`. */
+/**
+ * Cookies that should be sent with a request to `url`: exact-host delivery for
+ * host-only cookies, domain delivery for dotted ones, then path and Secure.
+ * Secure cookies go over HTTPS and to loopback hosts, as in browsers.
+ */
 export declare function matchingCookies(store: CookieStore, url: string): Cookie[];
 //# sourceMappingURL=client.d.ts.map

package/dist/lib/cookies/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/lib/cookies/client.ts"],"names":[],"mappings":"AAcA;;;;;;;;;GASG;AAEH,4EAA4E;AAC5E,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjD;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAUzC;AA6ID,qBAAa,SAAS;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,IAAI,EAAE,gBAAgB;IAKlC,MAAM,IAAI,OAAO;IAIjB,IAAI,IAAI,WAAW;IAiBnB;;;OAGG;IACH,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI;IAI9B,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,KAAK;IAQb,OAAO,CAAC,MAAM;IAQd;;;;OAIG;IACH,IAAI,CAAC,MAAM,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,MAAM,EAAE;IAShD;;;OAGG;IACH,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW;IAIhC,wEAAwE;IACxE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,GAAE,WAAW,EAAO,GAAG,WAAW;IAUlE;;;;OAIG;IACH,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IA2BlF;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAM3B;;;;;;;;OAQG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE;IAoB7E,wEAAwE;IACxE,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE;IAW3C,yEAAyE;IACzE,IAAI,IAAI,UAAU;CAgCnB;AAMD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,WAAW,CAMhF;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAK7E;AAED,2BAA2B;AAC3B,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAKxE;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGjD;AAED,2DAA2D;AAC3D,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAUzE"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/lib/cookies/client.ts"],"names":[],"mappings":"AAcA;;;;;;;;;GASG;AAEH,4EAA4E;AAC5E,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjD;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAUzC;AA6ID,qBAAa,SAAS;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,IAAI,EAAE,gBAAgB;IAKlC,MAAM,IAAI,OAAO;IAIjB,IAAI,IAAI,WAAW;IAiBnB;;;OAGG;IACH,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI;IAI9B,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,KAAK;IAQb,OAAO,CAAC,MAAM;IAQd;;;;OAIG;IACH,IAAI,CAAC,MAAM,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,MAAM,EAAE;IAShD;;;OAGG;IACH,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW;IAIhC,wEAAwE;IACxE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,GAAE,WAAW,EAAO,GAAG,WAAW;IAUlE;;;;OAIG;IACH,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IA2BlF;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAM3B;;;;;;;;OAQG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE;IAoB7E,wEAAwE;IACxE,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE;IAW3C,yEAAyE;IACzE,IAAI,IAAI,UAAU;CAgCnB;AAMD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,WAAW,CAMhF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAM7E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAIjF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC,GAC1D,OAAO,CAST;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQxD;AAED,2BAA2B;AAC3B,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAKxE;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGjD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAUzE"}

package/dist/lib/cookies/client.js

@@ -189,9 +189,9 @@ export class CookieJar {
         });
     }
     /**
-     * Read + filter helper. Drops expired cookies. Optional domain filter
-     * uses the same `domainMatches` logic Playwright/CDP do (leading dot
-     * means subdomain match).
+     * Read + filter helper. Drops expired cookies. The optional domain filter
+     * uses `domainMatches` (equal host or any subdomain); it is a query, not a
+     * delivery rule. `header(url)` uses the stricter `cookieSendsToHost`.
      */
     list(filter = {}) {
         const store = this.load();
@@ -349,15 +349,56 @@ export function mergeCookies(store, incoming) {
         map.set(key(c), c);
     return { ...store, cookies: Array.from(map.values()) };
 }
-/** RFC 6265 domain match. Leading dot in cookie domain means subdomain match. */
+/**
+ * Filter-style domain match used by `list({ domain })` and `clear({ domain })`:
+ * a cookie domain "matches" a hostname when they are equal or the hostname is
+ * a subdomain of it, whether or not the cookie is host-only. Never use this to
+ * decide whether a cookie may be SENT to a host; use `cookieSendsToHost`.
+ */
 export function domainMatches(cookieDomain, hostname) {
-    const cd = cookieDomain.startsWith(".") ? cookieDomain.slice(1) : cookieDomain;
-    if (hostname === cd)
+    const cd = (cookieDomain.startsWith(".") ? cookieDomain.slice(1) : cookieDomain).toLowerCase();
+    const host = hostname.toLowerCase();
+    if (host === cd)
         return true;
-    if (hostname.endsWith(`.${cd}`))
+    if (host.endsWith(`.${cd}`))
         return true;
     return false;
 }
+/**
+ * RFC 6265 delivery rule. A cookie domain with a leading dot is a domain
+ * cookie and goes to the domain and every subdomain. A cookie domain without
+ * one is host-only (how CDP, Playwright and `Set-Cookie` without `Domain`
+ * record it) and goes to that exact host and nowhere else.
+ */
+export function cookieSendsToHost(cookieDomain, hostname) {
+    const host = hostname.toLowerCase();
+    if (cookieDomain.startsWith("."))
+        return domainMatches(cookieDomain, host);
+    return cookieDomain.toLowerCase() === host;
+}
+/**
+ * Cookie-prefix rules (RFC 6265bis). `__Secure-` needs Secure; `__Host-` also
+ * needs Path=/ and no Domain attribute, which a jar records as a host-only
+ * domain (no leading dot). Browsers refuse a violating cookie, so the jar
+ * never stores one and the browser injector never hands one to Chromium.
+ */
+export function violatesCookiePrefix(cookie) {
+    if (cookie.name.startsWith("__Secure-") && !cookie.secure)
+        return true;
+    if (cookie.name.startsWith("__Host-") &&
+        (!cookie.secure || cookie.domain.startsWith(".") || cookie.path !== "/")) {
+        return true;
+    }
+    return false;
+}
+/** True for hosts a browser treats as a secure context without TLS. */
+export function isLoopbackHost(hostname) {
+    const host = hostname.toLowerCase();
+    return (host === "localhost" ||
+        host.endsWith(".localhost") ||
+        host === "[::1]" ||
+        /^127(?:\.\d{1,3}){3}$/.test(host));
+}
 /** RFC 6265 path match. */
 export function pathMatches(cookiePath, urlPath) {
     if (urlPath === cookiePath)
@@ -374,14 +415,18 @@ export function isExpired(cookie) {
         return false;
     return cookie.expires < Date.now() / 1000;
 }
-/** Cookies that should be sent with a request to `url`. */
+/**
+ * Cookies that should be sent with a request to `url`: exact-host delivery for
+ * host-only cookies, domain delivery for dotted ones, then path and Secure.
+ * Secure cookies go over HTTPS and to loopback hosts, as in browsers.
+ */
 export function matchingCookies(store, url) {
     const parsed = new URL(url);
-    const isSecure = parsed.protocol === "https:";
+    const isSecure = parsed.protocol === "https:" || isLoopbackHost(parsed.hostname);
     return store.cookies.filter((c) => {
         if (isExpired(c))
             return false;
-        if (!domainMatches(c.domain, parsed.hostname))
+        if (!cookieSendsToHost(c.domain, parsed.hostname))
             return false;
         if (!pathMatches(c.path, parsed.pathname))
             return false;

package/dist/lib/cookies/index.d.ts

@@ -1,3 +1,3 @@
-export { type Cookie, CookieJar, type CookieJarOptions, type CookieStore, CookieStoreParseError, domainMatches, type InfoResult, isExpired, matchingCookies, mergeCookies, type OriginEntry, pathMatches, } from "./client.js";
+export { type Cookie, CookieJar, type CookieJarOptions, type CookieStore, CookieStoreParseError, cookieSendsToHost, domainMatches, type InfoResult, isExpired, isLoopbackHost, matchingCookies, mergeCookies, type OriginEntry, pathMatches, violatesCookiePrefix, } from "./client.js";
 export { applyExtraCookies, type ExtraCookies } from "./extra.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/cookies/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/cookies/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,MAAM,EACX,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,qBAAqB,EACrB,aAAa,EACb,KAAK,UAAU,EACf,SAAS,EACT,eAAe,EACf,YAAY,EACZ,KAAK,WAAW,EAChB,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/cookies/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,MAAM,EACX,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,KAAK,UAAU,EACf,SAAS,EACT,cAAc,EACd,eAAe,EACf,YAAY,EACZ,KAAK,WAAW,EAChB,WAAW,EACX,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC"}

package/dist/lib/cookies/index.js

@@ -1,2 +1,2 @@
-export { CookieJar, CookieStoreParseError, domainMatches, isExpired, matchingCookies, mergeCookies, pathMatches, } from "./client.js";
+export { CookieJar, CookieStoreParseError, cookieSendsToHost, domainMatches, isExpired, isLoopbackHost, matchingCookies, mergeCookies, pathMatches, violatesCookiePrefix, } from "./client.js";
 export { applyExtraCookies } from "./extra.js";

package/dist/lib/docs-metadata-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docs-metadata-sync.d.ts","sourceRoot":"","sources":["../../src/lib/docs-metadata-sync.ts"],"names":[],"mappings":"AAYA,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B,GAAG,IAAI,CAGP;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IACtD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAqFD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAkKhC"}
+{"version":3,"file":"docs-metadata-sync.d.ts","sourceRoot":"","sources":["../../src/lib/docs-metadata-sync.ts"],"names":[],"mappings":"AAYA,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B,GAAG,IAAI,CAGP;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IACtD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAgHD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAiLhC"}

package/dist/lib/docs-metadata-sync.js

@@ -81,6 +81,30 @@ function addDays(value, days) {
     date.setUTCDate(date.getUTCDate() + days);
     return date.toISOString().replace(".000Z", "Z");
 }
+/** Allowance for clock skew between machines before a timestamp counts as future. */
+const FUTURE_SKEW_MS = 10 * 60 * 1000;
+/** Lifecycle timestamps record events that already happened, so none may be later than now. */
+const PAST_TIMESTAMP_FIELDS = [
+    "created_at",
+    "updated_at",
+    "status_changed_at",
+    "resolved_at",
+    "reviewed_at",
+];
+function inFuture(value, now) {
+    if (typeof value !== "string")
+        return false;
+    const time = Date.parse(value);
+    return Number.isFinite(time) && time > Date.parse(now) + FUTURE_SKEW_MS;
+}
+/**
+ * While a status is unchanged its status_changed_at is pinned to the committed
+ * value. A committed value later than now cannot be true, so a correction to a
+ * time that has already passed is accepted instead of being reverted.
+ */
+function correctsFutureStatusTime(committed, current, now) {
+    return inFuture(committed, now) && typeof current === "string" && !inFuture(current, now);
+}
 export async function runDocsMetadataSync(opts) {
     if (opts.cached && !opts.check) {
         throw new Error("--cached requires --check because Git index validation is read-only");
@@ -133,7 +157,8 @@ export async function runDocsMetadataSync(opts) {
             }
             if (!statusChanged &&
                 beforeV2 &&
-                current.data.status_changed_at !== beforeV2.status_changed_at) {
+                current.data.status_changed_at !== beforeV2.status_changed_at &&
+                !correctsFutureStatusTime(beforeV2.status_changed_at, current.data.status_changed_at, now)) {
                 expected.status_changed_at = beforeV2.status_changed_at;
                 fields.push("status_changed_at");
             }
@@ -164,6 +189,19 @@ export async function runDocsMetadataSync(opts) {
                 continue;
             }
             if (opts.check) {
+                const future = PAST_TIMESTAMP_FIELDS.filter((field) => inFuture(current.data[field], now));
+                if (future.length > 0) {
+                    rows.push({
+                        repo: target.name,
+                        path,
+                        status: "invalid",
+                        fields: [...future],
+                        message: future
+                            .map((field) => `${field}: cannot be later than the current time`)
+                            .join("; "),
+                    });
+                    continue;
+                }
                 const validation = validateDocsMetadataV2(current.data);
                 if (!validation.valid) {
                     rows.push({
@@ -196,7 +234,8 @@ export async function runDocsMetadataSync(opts) {
                 }
                 if (beforeV2 &&
                     !statusChanged &&
-                    current.data.status_changed_at !== beforeV2.status_changed_at) {
+                    current.data.status_changed_at !== beforeV2.status_changed_at &&
+                    !correctsFutureStatusTime(beforeV2.status_changed_at, current.data.status_changed_at, now)) {
                     drift.push("status_changed_at");
                 }
                 if (opts.reviewed &&

package/dist/lib/durable-job.d.ts

@@ -25,6 +25,14 @@ export interface DurableJobDocument {
     /** Directory the wrapped command runs in. */
     cwd: string;
     created_at: string;
+    /**
+     * Wait while Linux memory pressure is above this before queueing, as the
+     * foreground run does. The client resolves it from the resource's project config at launch.
+     */
+    defer_on_pressure?: {
+        psi_full_avg10: number;
+        max_wait_seconds: number;
+    };
 }
 export interface DurableJobStatus {
     schema_version: number;

package/dist/lib/durable-job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"durable-job.d.ts","sourceRoot":"","sources":["../../src/lib/durable-job.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C,sEAAsE;AACtE,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C;iDACiD;AACjD,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAEtD,eAAO,MAAM,6BAA6B,aAAa,CAAC;AACxD,eAAO,MAAM,2BAA2B,gBAAgB,CAAC;AACzD,eAAO,MAAM,wBAAwB,YAAY,CAAC;AAIlD,wEAAwE;AACxE,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;AAE/E,qEAAqE;AACrE,MAAM,MAAM,uBAAuB,GAAG,eAAe,GAAG,MAAM,CAAC;AAI/D,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,uBAAuB,CAAC;IAC/B,mEAAmE;IACnE,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACpC,qEAAqE;IACrE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GACtC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACpC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAChC,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAgBD,iEAAiE;AACjE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,uDAAuD;AACvD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAIhE;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEjD;AAQD,2CAA2C;AAC3C,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAKnF;AAED,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAK7E;AAMD,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAyBzE;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAkCrE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,cAAmB,GAAG,wBAAwB,CAyF/F;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAAmB,GAAG,mBAAmB,EAAE,CAmCvF;AAED;kEACkE;AAClE,wBAAgB,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAK5D;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAO/C"}
+{"version":3,"file":"durable-job.d.ts","sourceRoot":"","sources":["../../src/lib/durable-job.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C,sEAAsE;AACtE,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C;iDACiD;AACjD,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAEtD,eAAO,MAAM,6BAA6B,aAAa,CAAC;AACxD,eAAO,MAAM,2BAA2B,gBAAgB,CAAC;AACzD,eAAO,MAAM,wBAAwB,YAAY,CAAC;AAIlD,wEAAwE;AACxE,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;AAE/E,qEAAqE;AACrE,MAAM,MAAM,uBAAuB,GAAG,eAAe,GAAG,MAAM,CAAC;AAI/D,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,iBAAiB,CAAC,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1E;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,uBAAuB,CAAC;IAC/B,mEAAmE;IACnE,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACpC,qEAAqE;IACrE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GACtC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACpC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAChC,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAgBD,iEAAiE;AACjE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,uDAAuD;AACvD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAIhE;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEjD;AAQD,2CAA2C;AAC3C,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAKnF;AAED,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAK7E;AAMD,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CA0BzE;AAWD,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAkCrE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,cAAmB,GAAG,wBAAwB,CAyF/F;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,cAAmB,GAAG,mBAAmB,EAAE,CAmCvF;AAED;kEACkE;AAClE,wBAAgB,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAK5D;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAO/C"}

package/dist/lib/durable-job.js

@@ -101,8 +101,18 @@ export function readJobDocument(jobDir) {
             : [],
         cwd: typeof parsed.cwd === "string" ? parsed.cwd : "",
         created_at: typeof parsed.created_at === "string" ? parsed.created_at : "",
+        ...readDeferOnPressure(parsed.defer_on_pressure),
     };
 }
+function readDeferOnPressure(value) {
+    if (!isRecord(value))
+        return {};
+    const threshold = value.psi_full_avg10;
+    const maxWait = value.max_wait_seconds;
+    return typeof threshold === "number" && typeof maxWait === "number" && maxWait > 0
+        ? { defer_on_pressure: { psi_full_avg10: threshold, max_wait_seconds: maxWait } }
+        : {};
+}
 /** Read the status document, or null when it is missing or unusable. */
 export function readJobStatus(jobDir) {
     const path = join(resolve(jobDir), DURABLE_JOB_STATUS_FILENAME);