instar 1.3.1674 → 1.3.1676

package/dist/core/JobCoverageMonitor.d.ts

@@ -0,0 +1,84 @@
+import type { JobDefinition } from './types.js';
+import type { MachineIdentityManager } from './MachineIdentity.js';
+import { type PeerEndpointKind } from '../server/peerUrlGuard.js';
+import { type PoolPeerTarget, type RopeResultRecorder } from '../server/poolPeerFetch.js';
+import { JobCoverageStore, type JobCoverageEntry } from './JobCoverage.js';
+export interface JobCoverageMonitorOptions {
+    stateDir: string;
+    jobsFile: string;
+    projectDir: string;
+    port: number;
+    onCatalogRepair?: () => void;
+    reconcileDefaults?: (jobsFile: string, port: number) => string[];
+    authToken: string;
+    identityManager: MachineIdentityManager;
+    isAwake: () => boolean;
+    peerUrls: () => Array<PoolPeerTarget & {
+        kind: PeerEndpointKind;
+    }>;
+    recordRopeResult?: RopeResultRecorder;
+    onPortableCandidate?: (peer: PoolPeerTarget & {
+        kind: PeerEndpointKind;
+    }, job: JobCoverageEntry, generation: string) => Promise<void>;
+    portableGaps?: () => string[];
+    alert: (conditionKey: string, title: string, summary: string) => Promise<void>;
+    clearAlert?: (conditionKey: string) => void;
+    now?: () => number;
+}
+/** Reads only the installed catalog. Scheduler-less standby still has a catalog. */
+export declare function readJobCoverageCatalog(jobsFile: string): {
+    jobs: JobDefinition[];
+    complete: boolean;
+};
+export declare class JobCoverageMonitor {
+    readonly store: JobCoverageStore;
+    private readonly options;
+    private timer;
+    private firstTimer;
+    private inFlight;
+    private stopped;
+    private failures;
+    private readonly failureFile;
+    private readonly portableCursorFile;
+    private portableCursors;
+    private readonly auditFile;
+    private readonly alertFile;
+    private reconciled;
+    constructor(options: JobCoverageMonitorOptions);
+    localSnapshot(nonce: string): import("./JobCoverage.js").SignedJobCoverage;
+    start(): void;
+    stop(): void;
+    poll(): Promise<void>;
+    checkPromotionCoverage(): Promise<void>;
+    private markPeerFailure;
+    private readFailures;
+    private writeFailures;
+    private audit;
+    private readAlertState;
+    private writeAlertState;
+    view(): {
+        selfMachineId: string;
+        localComplete: boolean;
+        peers: ({
+            machineId: string;
+            status: "fresh" | "incomplete" | "stale" | "unavailable";
+            observedAt: string;
+            ageMs: number;
+            jobCount: number;
+            complete: boolean;
+            failureCount: number;
+            reason: string | null;
+        } | {
+            machineId: string;
+            status: string;
+            observedAt: null;
+            ageMs: null;
+            jobCount: null;
+            complete: boolean;
+            failureCount: number;
+            reason: string | null;
+        })[];
+        differences: import("./JobCoverage.js").JobCoverageDifference[];
+    };
+}
+//# sourceMappingURL=JobCoverageMonitor.d.ts.map

package/dist/core/JobCoverageMonitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JobCoverageMonitor.d.ts","sourceRoot":"","sources":["../../src/core/JobCoverageMonitor.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEnE,OAAO,EAAkC,KAAK,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClG,OAAO,EAAiB,KAAK,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAMzG,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAA2G,MAAM,kBAAkB,CAAC;AAEpL,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,sBAAsB,CAAC;IACxC,OAAO,EAAE,MAAM,OAAO,CAAC;IACvB,QAAQ,EAAE,MAAM,KAAK,CAAC,cAAc,GAAG;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;IACnE,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IACtC,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,cAAc,GAAG;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtI,YAAY,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IAC9B,KAAK,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAWrG;AAsBD,qBAAa,kBAAkB;IAC7B,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD,OAAO,CAAC,KAAK,CAA+C;IAC5D,OAAO,CAAC,UAAU,CAA8C;IAChE,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAgE;IAChF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,eAAe,CAA8B;IACrD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,UAAU,CAAS;IAC3B,YAAY,OAAO,EAAE,yBAAyB,EAY7C;IACD,aAAa,CAAC,KAAK,EAAE,MAAM,gDAK1B;IACD,KAAK,IAAI,IAAI,CAQZ;IACD,IAAI,IAAI,IAAI,CAMX;IACK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAuE1B;IACK,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CA4D5C;IACD,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,KAAK;IAYb,OAAO,CAAC,cAAc;IAWtB,OAAO,CAAC,eAAe;IAMvB,IAAI;;;;;;;;;;;;;;;;;;;;;;;MA4BH;CACF"}

package/dist/core/JobCoverageMonitor.js

@@ -0,0 +1,364 @@
+/** Peer observation and promotion comparison for scheduler coverage. */
+import { randomBytes, createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { isRegistryEntryActive } from './MachineIdentity.js';
+import { isPeerUrlAllowedForCredentials } from '../server/peerUrlGuard.js';
+import { poolPeerFetch } from '../server/poolPeerFetch.js';
+import { loadJobsDetailed } from '../scheduler/JobLoader.js';
+import { reconcileLegacyDefaultJobs } from '../scheduler/JobCatalogReconcile.js';
+import { jobDependencyExists } from './JobDependency.js';
+import { SafeFsExecutor } from './SafeFsExecutor.js';
+import { featureEvidence } from '../monitoring/FeatureEvidenceLog.js';
+import { JobCoverageStore, acceptJobCoverage, assignJobCoverageGeneration, compareJobCoverage, projectJobCoverage, signJobCoverage } from './JobCoverage.js';
+/** Reads only the installed catalog. Scheduler-less standby still has a catalog. */
+export function readJobCoverageCatalog(jobsFile) {
+    try {
+        if (!fs.existsSync(jobsFile) && !fs.existsSync(path.join(path.dirname(jobsFile), 'jobs', 'schedule'))) {
+            return { jobs: [], complete: false };
+        }
+        const loaded = loadJobsDetailed(jobsFile, { quiet: true });
+        return { jobs: loaded.jobs, complete: loaded.problems.length === 0 && loaded.bodyFailures.length === 0
+                && !loaded.diagnostics.some(d => d.level === 'error') };
+    }
+    catch {
+        return { jobs: [], complete: false };
+    }
+}
+async function readBoundedJson(response, maxBytes = 256 * 1024) {
+    const reader = response.body?.getReader();
+    if (!reader)
+        throw new Error('empty-body');
+    const parts = [];
+    let length = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            length += value.byteLength;
+            if (length > maxBytes)
+                throw new Error('oversized-snapshot');
+            parts.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const merged = new Uint8Array(length);
+    let at = 0;
+    for (const part of parts) {
+        merged.set(part, at);
+        at += part.byteLength;
+    }
+    return JSON.parse(new TextDecoder().decode(merged));
+}
+export class JobCoverageMonitor {
+    store;
+    options;
+    timer = null;
+    firstTimer = null;
+    inFlight = false;
+    stopped = false;
+    failures = new Map();
+    failureFile;
+    portableCursorFile;
+    portableCursors = {};
+    auditFile;
+    alertFile;
+    reconciled = false;
+    constructor(options) {
+        this.options = options;
+        this.store = new JobCoverageStore(options.stateDir);
+        this.alertFile = path.join(options.stateDir, 'state', 'job-coverage-alert.json');
+        this.failureFile = path.join(options.stateDir, 'state', 'job-coverage-poll.json');
+        this.portableCursorFile = path.join(options.stateDir, 'state', 'job-portable-cursors.json');
+        try {
+            const parsed = JSON.parse(fs.readFileSync(this.portableCursorFile, 'utf8'));
+            if (parsed.version === 1 && parsed.cursors && typeof parsed.cursors === 'object')
+                this.portableCursors = parsed.cursors;
+        }
+        catch { /* first observation starts at the first portable job */ }
+        this.auditFile = path.join(options.stateDir, 'state', 'job-coverage-audit.jsonl');
+        this.failures = this.readFailures();
+    }
+    localSnapshot(nonce) {
+        const identity = this.options.identityManager.loadIdentity();
+        const catalog = readJobCoverageCatalog(this.options.jobsFile);
+        const payload = assignJobCoverageGeneration(projectJobCoverage(identity.machineId, catalog.jobs, catalog.complete), this.options.stateDir);
+        return signJobCoverage(payload, nonce, this.options.identityManager.loadSigningKey());
+    }
+    start() {
+        if (this.timer || this.stopped)
+            return;
+        const tick = () => {
+            void this.poll().then(() => this.checkPromotionCoverage())
+                .catch(error => { /* @silent-fallback-ok — the next bounded tick retries; the error is logged */ console.warn('[job-coverage] tick failed:', error); });
+        };
+        this.firstTimer = setTimeout(tick, 2000);
+        this.firstTimer.unref?.();
+        this.timer = setInterval(tick, 5 * 60_000);
+        this.timer.unref?.();
+    }
+    stop() {
+        this.stopped = true;
+        if (this.timer)
+            clearInterval(this.timer);
+        if (this.firstTimer)
+            clearTimeout(this.firstTimer);
+        this.timer = null;
+        this.firstTimer = null;
+    }
+    async poll() {
+        if (this.inFlight || this.stopped)
+            return;
+        this.inFlight = true;
+        try {
+            const identity = this.options.identityManager.loadIdentity();
+            const registered = Object.entries(this.options.identityManager.loadRegistry().machines)
+                .filter(([id, entry]) => id !== identity.machineId && isRegistryEntryActive(entry));
+            const urls = new Map(this.options.peerUrls().map(p => [p.machineId, p]));
+            // Two requests at a time, no overlapping ticks.
+            for (let i = 0; i < registered.length; i += 2) {
+                await Promise.all(registered.slice(i, i + 2).map(async ([id]) => {
+                    const peer = urls.get(id);
+                    const now = this.options.now?.() ?? Date.now();
+                    if (now < (this.failures.get(id)?.nextEligibleAt ?? 0))
+                        return;
+                    if (!peer) {
+                        this.markPeerFailure(id, 'no-reachable-url', now);
+                        return;
+                    }
+                    if (!isPeerUrlAllowedForCredentials({ url: peer.url, kind: peer.kind }).ok) {
+                        this.markPeerFailure(id, 'url-refused', now);
+                        return;
+                    }
+                    const publicKey = this.options.identityManager.getSigningPublicKeyPem(id);
+                    if (!publicKey) {
+                        this.markPeerFailure(id, 'identity-unverifiable', now);
+                        return;
+                    }
+                    let lastError = null;
+                    for (let attempt = 0; attempt < 2; attempt++) {
+                        const nonce = randomBytes(32).toString('hex');
+                        try {
+                            const response = await poolPeerFetch(this.options.recordRopeResult, peer, `/jobs/coverage-snapshot?nonce=${nonce}`, { headers: { Authorization: `Bearer ${this.options.authToken}` },
+                                signal: AbortSignal.timeout(3000), redirect: 'manual' });
+                            if (!response.ok)
+                                throw new Error(`http-${response.status}`);
+                            const payload = acceptJobCoverage(await readBoundedJson(response), id, nonce, publicKey);
+                            if (!payload)
+                                throw new Error('invalid-signed-snapshot');
+                            this.store.record(payload, new Date(now));
+                            if (this.options.onPortableCandidate) {
+                                // A bounded transfer attempt follows a verified advertisement; failure is
+                                // logged as a portability gap and never reclassifies signed metadata as bad.
+                                const candidates = payload.jobs.filter(row => row.portable === true);
+                                const start = (this.portableCursors[id] ?? 0) % Math.max(1, candidates.length);
+                                const selected = candidates.length > 20
+                                    ? Array.from({ length: 20 }, (_, n) => candidates[(start + n) % candidates.length])
+                                    : candidates;
+                                this.portableCursors[id] = candidates.length ? (start + selected.length) % candidates.length : 0;
+                                fs.mkdirSync(path.dirname(this.portableCursorFile), { recursive: true });
+                                const cursorTmp = `${this.portableCursorFile}.${process.pid}.tmp`;
+                                fs.writeFileSync(cursorTmp, JSON.stringify({ version: 1, cursors: this.portableCursors }), { mode: 0o600 });
+                                fs.renameSync(cursorTmp, this.portableCursorFile);
+                                for (const job of selected) {
+                                    try {
+                                        await this.options.onPortableCandidate(peer, job, payload.generation);
+                                    }
+                                    catch (error) { // @silent-fallback-ok — evidence and warning report transfer failure; no candidate is admitted by this handler
+                                        featureEvidence.record('multiMachine.jobDefinitionSync', { kind: 'error',
+                                            reason: 'portable transfer unavailable', context: { source: id, slug: job.slug } });
+                                        console.warn(`[job-coverage] portable transfer unavailable for ${job.slug}:`, error);
+                                    }
+                                }
+                            }
+                            this.failures.delete(id);
+                            this.writeFailures();
+                            this.audit('peer-observed', id);
+                            lastError = null;
+                            break;
+                        }
+                        catch (error) {
+                            lastError = error;
+                        }
+                    }
+                    if (lastError) {
+                        const message = lastError instanceof Error ? lastError.message : '';
+                        const failureClass = /^(?:http-[0-9]{3}|invalid-signed-snapshot|oversized-snapshot|empty-body)$/.test(message)
+                            ? message : 'fetch-failed';
+                        this.markPeerFailure(id, failureClass, now);
+                    }
+                }));
+            }
+        }
+        catch (error) {
+            console.warn('[job-coverage] poll failed:', error);
+        }
+        finally {
+            this.inFlight = false;
+        }
+    }
+    async checkPromotionCoverage() {
+        if (!this.options.isAwake() || this.stopped)
+            return;
+        const identity = this.options.identityManager.loadIdentity();
+        if (!this.reconciled) {
+            try {
+                const installed = (this.options.reconcileDefaults ?? reconcileLegacyDefaultJobs)(this.options.jobsFile, this.options.port);
+                if (installed.length > 0) {
+                    this.options.onCatalogRepair?.();
+                    this.audit('catalog-repaired', identity.machineId, String(installed.length));
+                }
+                this.reconciled = true;
+            }
+            catch (error) {
+                console.warn('[job-coverage] safe catalog repair failed:', error);
+            }
+        }
+        const local = readJobCoverageCatalog(this.options.jobsFile);
+        const own = projectJobCoverage(identity.machineId, local.jobs, local.complete);
+        const observations = this.store.list(this.options.now?.() ?? Date.now());
+        const registered = Object.entries(this.options.identityManager.loadRegistry().machines)
+            .filter(([id, entry]) => id !== identity.machineId && isRegistryEntryActive(entry));
+        const active = Object.fromEntries(Object.entries(observations)
+            .filter(([id]) => registered.some(([registeredId]) => registeredId === id)));
+        const differences = compareJobCoverage(own.jobs, active, identity.machineId, identity.name);
+        for (const job of local.jobs) {
+            if (!job.enabled || !job.requiredPaths?.length)
+                continue;
+            if (job.requiredPaths.some(dependency => !jobDependencyExists(this.options.projectDir, dependency))) {
+                differences.push({ slug: job.slug, sourceMachineId: identity.machineId,
+                    reason: 'dependency', observedAt: new Date().toISOString(), stale: false });
+            }
+        }
+        const unknown = registered.filter(([id]) => !observations[id] || observations[id].status !== 'fresh').map(([id]) => id);
+        const portableGaps = this.options.portableGaps?.() ?? [];
+        if (differences.length === 0 && unknown.length === 0 && portableGaps.length === 0 && local.complete) {
+            if (fs.existsSync(this.alertFile)) {
+                try {
+                    this.options.clearAlert?.('lease-job-coverage');
+                    SafeFsExecutor.safeRmSync(this.alertFile, { force: true, operation: 'JobCoverageMonitor.closeRecoveredEpisode' });
+                    this.audit('coverage-recovered', identity.machineId);
+                }
+                catch (error) {
+                    console.warn('[job-coverage] could not close recovered alert:', error);
+                }
+            }
+            return;
+        }
+        const summary = [
+            ...(!local.complete ? ['Local job catalog is incomplete; coverage cannot be proven'] : []),
+            ...differences.slice(0, 20).map(d => `${d.slug}: ${d.reason} (seen on ${d.sourceMachineId}${d.stale ? ', stale' : ''})`),
+            ...portableGaps.slice(0, 20),
+            ...(unknown.length ? [`Coverage uncertain for ${unknown.length} peer(s): ${unknown.slice(0, 5).join(', ')}`] : []),
+        ].join('\n');
+        const conditionKey = 'lease-job-coverage';
+        const now = this.options.now?.() ?? Date.now();
+        const fingerprint = createHash('sha256').update(summary).digest('hex');
+        const prior = this.readAlertState();
+        if (prior?.fingerprint === fingerprint) {
+            const floor = prior.deliveredAt ? 24 * 60 * 60_000 : 60 * 60_000;
+            if (now - prior.at < floor)
+                return;
+        }
+        this.writeAlertState({ fingerprint, at: now, deliveredAt: null });
+        try {
+            await this.options.alert(conditionKey, 'Scheduled jobs need review after lease handoff', summary);
+            this.writeAlertState({ fingerprint, at: now, deliveredAt: now });
+            this.audit('coverage-alert-delivered', identity.machineId);
+        }
+        catch (error) {
+            console.warn('[job-coverage] alert delivery failed:', error);
+        }
+    }
+    markPeerFailure(machineId, reason, now) {
+        const count = (this.failures.get(machineId)?.count ?? 0) + 1;
+        this.failures.set(machineId, { count, nextEligibleAt: now + Math.min(30 * 60_000, count >= 3 ? 15 * 60_000 : 5 * 60_000 * 2 ** (count - 1)) });
+        this.writeFailures();
+        this.store.markUnavailable(machineId, reason);
+        this.audit('peer-unavailable', machineId, reason);
+    }
+    readFailures() {
+        try {
+            const raw = fs.readFileSync(this.failureFile, 'utf8');
+            if (raw.length > 32 * 1024)
+                return new Map();
+            const rows = JSON.parse(raw);
+            return new Map(Object.entries(rows).filter(([id, row]) => /^[a-zA-Z0-9_-]{1,128}$/.test(id)
+                && Number.isSafeInteger(row?.count) && row.count > 0 && row.count <= 100000
+                && Number.isFinite(row.nextEligibleAt)));
+        }
+        catch {
+            return new Map();
+        }
+    }
+    writeFailures() {
+        fs.mkdirSync(path.dirname(this.failureFile), { recursive: true });
+        const tmp = `${this.failureFile}.${process.pid}.tmp`;
+        fs.writeFileSync(tmp, JSON.stringify(Object.fromEntries(this.failures)), { mode: 0o600 });
+        fs.renameSync(tmp, this.failureFile);
+    }
+    audit(event, machineId, reason) {
+        try {
+            fs.mkdirSync(path.dirname(this.auditFile), { recursive: true });
+            if (fs.existsSync(this.auditFile) && fs.statSync(this.auditFile).size > 1024 * 1024) {
+                const rotated = `${this.auditFile}.1`;
+                SafeFsExecutor.safeRmSync(rotated, { force: true, operation: 'JobCoverageMonitor.rotateAudit' });
+                fs.renameSync(this.auditFile, rotated);
+            }
+            fs.appendFileSync(this.auditFile, JSON.stringify({ at: new Date(this.options.now?.() ?? Date.now()).toISOString(),
+                event, machineId, ...(reason ? { reason: reason.slice(0, 100) } : {}) }) + '\n', { mode: 0o600 });
+        }
+        catch (error) { /* @silent-fallback-ok — audit loss is logged; coverage state remains authoritative */
+            console.warn('[job-coverage] audit write failed:', error);
+        }
+    }
+    readAlertState() {
+        try {
+            const raw = JSON.parse(fs.readFileSync(this.alertFile, 'utf8'));
+            if (typeof raw.fingerprint === 'string' && typeof raw.at === 'number') {
+                return { fingerprint: raw.fingerprint, at: raw.at,
+                    deliveredAt: typeof raw.deliveredAt === 'number' ? raw.deliveredAt : null };
+            }
+        }
+        catch { /* @silent-fallback-ok — no prior episode is normal */ }
+        return null;
+    }
+    writeAlertState(state) {
+        fs.mkdirSync(path.dirname(this.alertFile), { recursive: true });
+        const tmp = `${this.alertFile}.${process.pid}.tmp`;
+        fs.writeFileSync(tmp, JSON.stringify(state), { mode: 0o600 });
+        fs.renameSync(tmp, this.alertFile);
+    }
+    view() {
+        const identity = this.options.identityManager.loadIdentity();
+        const local = readJobCoverageCatalog(this.options.jobsFile);
+        const observations = this.store.list(this.options.now?.() ?? Date.now());
+        const registered = Object.entries(this.options.identityManager.loadRegistry().machines)
+            .filter(([id, entry]) => id !== identity.machineId && isRegistryEntryActive(entry));
+        const peers = registered.map(([machineId]) => {
+            const row = observations[machineId];
+            const failureCount = this.failures.get(machineId)?.count ?? 0;
+            return row ? { machineId, status: row.status, observedAt: row.observedAt,
+                ageMs: Math.max(0, (this.options.now?.() ?? Date.now()) - Date.parse(row.observedAt)),
+                jobCount: row.payload.jobs.length, complete: row.payload.complete, failureCount,
+                reason: row.error ?? null }
+                : { machineId, status: failureCount ? 'unavailable' : 'unknown', observedAt: null,
+                    ageMs: null, jobCount: null, complete: false, failureCount,
+                    reason: failureCount ? 'poll-failed' : null };
+        });
+        const active = Object.fromEntries(Object.entries(observations)
+            .filter(([id]) => registered.some(([registeredId]) => registeredId === id)));
+        const differences = compareJobCoverage(projectJobCoverage(identity.machineId, local.jobs, local.complete).jobs, active, identity.machineId, identity.name);
+        for (const job of local.jobs) {
+            if (job.enabled && job.requiredPaths?.some(dependency => !jobDependencyExists(this.options.projectDir, dependency))) {
+                differences.push({ slug: job.slug, sourceMachineId: identity.machineId,
+                    reason: 'dependency', observedAt: new Date().toISOString(), stale: false });
+            }
+        }
+        return { selfMachineId: identity.machineId, localComplete: local.complete, peers, differences };
+    }
+}
+//# sourceMappingURL=JobCoverageMonitor.js.map

package/dist/core/JobCoverageMonitor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JobCoverageMonitor.js","sourceRoot":"","sources":["../../src/core/JobCoverageMonitor.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,8BAA8B,EAAyB,MAAM,2BAA2B,CAAC;AAClG,OAAO,EAAE,aAAa,EAAgD,MAAM,4BAA4B,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAyB,iBAAiB,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAqBpL,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;YACtG,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;mBACjG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,QAAkB,EAAE,QAAQ,GAAG,GAAG,GAAG,IAAI;IACtE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;YAC3B,IAAI,MAAM,GAAG,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAC7D,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;YAAS,CAAC;QAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAAC,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC;IAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,OAAO,kBAAkB;IACpB,KAAK,CAAmB;IAChB,OAAO,CAA4B;IAC5C,KAAK,GAA0C,IAAI,CAAC;IACpD,UAAU,GAAyC,IAAI,CAAC;IACxD,QAAQ,GAAG,KAAK,CAAC;IACjB,OAAO,GAAG,KAAK,CAAC;IAChB,QAAQ,GAAG,IAAI,GAAG,EAAqD,CAAC;IAC/D,WAAW,CAAS;IACpB,kBAAkB,CAAS;IACpC,eAAe,GAA2B,EAAE,CAAC;IACpC,SAAS,CAAS;IAClB,SAAS,CAAS;IAC3B,UAAU,GAAG,KAAK,CAAC;IAC3B,YAAY,OAAkC;QAC5C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC;QACjF,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,wBAAwB,CAAC,CAAC;QAClF,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,2BAA2B,CAAC,CAAC;QAC5F,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;YAC5E,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;gBAAE,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC;QAC1H,CAAC;QAAC,MAAM,CAAC,CAAC,wDAAwD,CAAC,CAAC;QACpE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,0BAA0B,CAAC,CAAC;QAClF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACtC,CAAC;IACD,aAAa,CAAC,KAAa;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC;QAC7D,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,2BAA2B,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3I,OAAO,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,KAAK;QACH,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACvC,MAAM,IAAI,GAAG,GAAG,EAAE;YAAG,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;iBAC5E,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,8EAA8E,CAAC,OAAO,CAAC,IAAI,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC,CAAC;QAC7J,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IACD,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,KAAK;YAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,UAAU;YAAE,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACzB,CAAC;IACD,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC;YAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC,QAAQ,CAAC;iBACpF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,QAAQ,CAAC,SAAS,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;YACtF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACzE,gDAAgD;YAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9C,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;oBAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC/C,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,cAAc,IAAI,CAAC,CAAC;wBAAE,OAAO;oBAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;wBAAC,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;wBAAC,OAAO;oBAAC,CAAC;oBACzE,IAAI,CAAC,8BAA8B,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;wBAC3E,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;wBAAC,OAAO;oBACvD,CAAC;oBACD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;oBAC1E,IAAI,CAAC,SAAS,EAAE,CAAC;wBAAC,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;wBAAC,OAAO;oBAAC,CAAC;oBACnF,IAAI,SAAS,GAAY,IAAI,CAAC;oBAC9B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;wBAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;wBAC9C,IAAI,CAAC;4BACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,EACtE,iCAAiC,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE;gCACxG,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;4BAC7D,IAAI,CAAC,QAAQ,CAAC,EAAE;gCAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;4BAC7D,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;4BACzF,IAAI,CAAC,OAAO;gCAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;4BACzD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;4BAC1C,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;gCACrC,0EAA0E;gCAC1E,6EAA6E;gCAC7E,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;gCACrE,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;gCAC/E,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,GAAG,EAAE;oCACrC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;oCACnF,CAAC,CAAC,UAAU,CAAC;gCACf,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gCACjG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gCACzE,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;gCAClE,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gCAC5G,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;gCAClD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;oCAC3B,IAAI,CAAC;wCAAC,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;oCAAC,CAAC;oCAC9E,OAAO,KAAK,EAAE,CAAC,CAAC,+GAA+G;wCAC7H,eAAe,CAAC,MAAM,CAAC,gCAAgC,EAAE,EAAE,IAAI,EAAE,OAAO;4CACtE,MAAM,EAAE,+BAA+B,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wCACtF,OAAO,CAAC,IAAI,CAAC,oDAAoD,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;oCACvF,CAAC;gCACH,CAAC;4BACH,CAAC;4BACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;4BACzB,IAAI,CAAC,aAAa,EAAE,CAAC;4BACrB,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;4BAChC,SAAS,GAAG,IAAI,CAAC;4BACjB,MAAM;wBACR,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BAAC,SAAS,GAAG,KAAK,CAAC;wBAAC,CAAC;oBACxC,CAAC;oBACD,IAAI,SAAS,EAAE,CAAC;wBACd,MAAM,OAAO,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;wBACpE,MAAM,YAAY,GAAG,2EAA2E,CAAC,IAAI,CAAC,OAAO,CAAC;4BAC5G,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;wBAC7B,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;oBAC9C,CAAC;gBACH,CAAC,CAAC,CAAC,CAAC;YACN,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QACrD,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QAAC,CAAC;IACtC,CAAC;IACD,KAAK,CAAC,sBAAsB;QAC1B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,0BAA0B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC3H,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;oBACjC,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC/E,CAAC;gBACD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,4CAA4C,EAAE,KAAK,CAAC,CAAC;YAAC,CAAC;QACxF,CAAC;QACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/E,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC,QAAQ,CAAC;aACpF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,QAAQ,CAAC,SAAS,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;aAC3D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5F,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM;gBAAE,SAAS;YACzD,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;gBACpG,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,CAAC,SAAS;oBACpE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QACxH,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;QACzD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpG,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,oBAAoB,CAAC,CAAC;oBAChD,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,0CAA0C,EAAE,CAAC,CAAC;oBAClH,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACvD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,iDAAiD,EAAE,KAAK,CAAC,CAAC;gBAAC,CAAC;YAC7F,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG;YACd,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,4DAA4D,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;YACxH,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC5B,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,0BAA0B,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACnH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,YAAY,GAAG,oBAAoB,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACpC,IAAI,KAAK,EAAE,WAAW,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC;YACjE,IAAI,GAAG,GAAG,KAAK,CAAC,EAAE,GAAG,KAAK;gBAAE,OAAO;QACrC,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,gDAAgD,EAAE,OAAO,CAAC,CAAC;YAClG,IAAI,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,KAAK,CAAC,0BAA0B,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;IACnF,CAAC;IACO,eAAe,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;QACpE,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,EAC9E,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IACO,YAAY;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACtD,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI;gBAAE,OAAO,IAAI,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA8D,CAAC;YAC1F,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;mBACtF,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,IAAI,MAAM;mBACxE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,GAAG,EAAE,CAAC;QAAC,CAAC;IAC/B,CAAC;IACO,aAAa;QACnB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QACrD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1F,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IACO,KAAK,CAAC,KAAa,EAAE,SAAiB,EAAE,MAAe;QAC7D,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBACpF,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC;gBACtC,cAAc,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,gCAAgC,EAAE,CAAC,CAAC;gBACjG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACzC,CAAC;YACD,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;gBAC/G,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC,CAAC,sFAAsF;YAAC,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;IACvK,CAAC;IACO,cAAc;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CACE,CAAC;YACjE,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACtE,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE;oBAC/C,WAAW,EAAE,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAChF,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,sDAAsD,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IACO,eAAe,CAAC,KAAsE;QAC5F,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QACnD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IACD,IAAI;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC,QAAQ,CAAC;aACpF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,QAAQ,CAAC,SAAS,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE;YAC3C,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YACpC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;YAC9D,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU;gBACtE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACrF,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY;gBAC/E,MAAM,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,EAAE;gBAC3B,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI;oBAC/E,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY;oBAC1D,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;aAC3D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAC5G,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;gBACpH,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,CAAC,SAAS;oBACpE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,QAAQ,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAClG,CAAC;CACF"}

package/dist/core/JobDependency.d.ts

@@ -0,0 +1,4 @@
+export declare function validJobDependencyPath(value: unknown): value is string;
+/** Reject symlinks at every component; a dependency is only an existence signal. */
+export declare function jobDependencyExists(projectRoot: string, relativePath: string): boolean;
+//# sourceMappingURL=JobDependency.d.ts.map

package/dist/core/JobDependency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JobDependency.d.ts","sourceRoot":"","sources":["../../src/core/JobDependency.ts"],"names":[],"mappings":"AAKA,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAKtE;AAED,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAWtF"}

package/dist/core/JobDependency.js

@@ -0,0 +1,30 @@
+/** Declared local prerequisites for scheduled jobs; paths never leave this machine. */
+import fs from 'node:fs';
+import path from 'node:path';
+const SECRET_SEGMENT = /^(?:\.env(?:\..*)?|config(?:\.json)?|auth|secrets?|tokens?|credentials?|\.instar)$/i;
+export function validJobDependencyPath(value) {
+    if (typeof value !== 'string' || value.length < 1 || value.length > 256 || path.isAbsolute(value)
+        || value.includes('\\') || value.includes('\0'))
+        return false;
+    const parts = value.split('/');
+    return parts.every(part => part.length > 0 && part !== '.' && part !== '..' && !SECRET_SEGMENT.test(part));
+}
+/** Reject symlinks at every component; a dependency is only an existence signal. */
+export function jobDependencyExists(projectRoot, relativePath) {
+    if (!validJobDependencyPath(relativePath))
+        return false;
+    let cursor = path.resolve(projectRoot);
+    for (const part of relativePath.split('/')) {
+        cursor = path.join(cursor, part);
+        try {
+            const stat = fs.lstatSync(cursor);
+            if (stat.isSymbolicLink())
+                return false;
+        }
+        catch { /* @silent-fallback-ok — a missing or unreadable dependency refuses this job */
+            return false;
+        }
+    }
+    return true;
+}
+//# sourceMappingURL=JobDependency.js.map

package/dist/core/JobDependency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JobDependency.js","sourceRoot":"","sources":["../../src/core/JobDependency.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,cAAc,GAAG,qFAAqF,CAAC;AAC7G,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;WAC5F,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,WAAmB,EAAE,YAAoB;IAC3E,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,OAAO,KAAK,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC,CAAC,+EAA+E;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IAC3G,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/JobPortableBundle.d.ts

@@ -0,0 +1,61 @@
+export interface PortableFile {
+    path: string;
+    sha256: string;
+    content: string;
+}
+export interface PortableJobBundle {
+    version: 1;
+    slug: string;
+    root: string;
+    files: PortableFile[];
+}
+/** Read a user manifest and only its declared files. Unknown manifest fields are refused. */
+export declare function collectPortableJob(projectRoot: string, stateDir: string, slug: string): PortableJobBundle;
+/** Validate a decrypted bundle before storing any bytes. */
+export declare function validatePortableBundle(value: unknown): PortableJobBundle;
+import { type EncryptedSecretPayload } from './SecretStore.js';
+export interface PortableBundleRequest {
+    version: 1;
+    sourceMachineId: string;
+    recipientMachineId: string;
+    sourceKeyEpoch: number;
+    recipientKeyEpoch: number;
+    slug: string;
+    nonce: string;
+    signature: string;
+}
+export interface PortableBundleWire {
+    version: 1;
+    sourceMachineId: string;
+    recipientMachineId: string;
+    sourceKeyEpoch: number;
+    recipientKeyEpoch: number;
+    slug: string;
+    nonce: string;
+    root: string;
+    generation: number;
+    encrypted: EncryptedSecretPayload;
+    signature: string;
+}
+export declare function makePortableBundleRequest(sourceMachineId: string, recipientMachineId: string, slug: string, nonce: string, privateKey: string, sourceKeyEpoch?: number, recipientKeyEpoch?: number): PortableBundleRequest;
+export declare function acceptPortableBundleRequest(value: unknown, expectedSource: string, publicKey: string): PortableBundleRequest;
+export declare function makePortableBundleWire(bundle: PortableJobBundle, request: PortableBundleRequest, sourcePrivateKey: string, recipientEncryptionPublicKey: string, generation: number): PortableBundleWire;
+export declare function acceptPortableBundleWire(value: unknown, request: PortableBundleRequest, sourcePublicKey: string, recipientPrivateKeyPem: string): PortableJobBundle;
+export declare class PortableApprovalStore {
+    private readonly kind;
+    private readonly file;
+    constructor(stateDir: string, kind: 'export' | 'activate');
+    private read;
+    isApproved(slug: string, root: string): boolean;
+    approve(slug: string, root: string): void;
+    revoke(slug: string): void;
+}
+/** Source-owned monotonic content version, advanced only with an exact-root export approval. */
+export declare class PortableGenerationStore {
+    private readonly file;
+    constructor(stateDir: string);
+    private read;
+    current(slug: string, root: string): number | null;
+    advance(slug: string, root: string): number;
+}
+//# sourceMappingURL=JobPortableBundle.d.ts.map

package/dist/core/JobPortableBundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JobPortableBundle.d.ts","sourceRoot":"","sources":["../../src/core/JobPortableBundle.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,YAAY;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC/E,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,YAAY,EAAE,CAAC;CACvB;AAgBD,6FAA6F;AAC7F,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,CA8BzG;AAED,4DAA4D;AAC5D,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CA+CxE;AAYD,OAAO,EAAmC,KAAK,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAGhG,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,CAAC,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;CACpK;AACD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,CAAC,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAChJ,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,sBAAsB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;CACxF;AAMD,wBAAgB,yBAAyB,CACvC,eAAe,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EACpG,cAAc,SAAI,EAAE,iBAAiB,SAAI,GACxC,qBAAqB,CAMvB;AACD,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GACxD,qBAAqB,CAavB;AAID,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EACnF,4BAA4B,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GACvD,kBAAkB,CASpB;AACD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,EACvE,sBAAsB,EAAE,MAAM,GAC7B,iBAAiB,CAsBnB;AAED,qBAAa,qBAAqB;IAEF,OAAO,CAAC,QAAQ,CAAC,IAAI;IADnD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,YAAY,QAAQ,EAAE,MAAM,EAAmB,IAAI,EAAE,QAAQ,GAAG,UAAU,EAEzE;IACD,OAAO,CAAC,IAAI;IASZ,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAG9C;IACD,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAQxC;IACD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAOzB;CACF;AAED,gGAAgG;AAChG,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,YAAY,QAAQ,EAAE,MAAM,EAA+E;IAC3G,OAAO,CAAC,IAAI;IAaZ,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIjD;IACD,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAY1C;CACF"}