/** Bash helpers shared by every generated job script: step outputs/env files, hashFiles() and the R2-backed cache. */
const SOURCE = String.raw`__stig_re_heredoc='^([A-Za-z_][A-Za-z0-9_-]*)<<(.+)$'
__stig_re_kv='^([A-Za-z_][A-Za-z0-9_-]*)=(.*)$'
__stig_read_kv() {
  [ -s "$1" ] || return 0
  local __line __key __value __delim __more
  while IFS= read -r __line || [ -n "$__line" ]; do
    if [[ $__line =~ $__stig_re_heredoc ]]; then
      __key="#{BASH_REMATCH[1]}"; __delim="#{BASH_REMATCH[2]}"; __value=""; __more=0
      while IFS= read -r __line || [ -n "$__line" ]; do
        [ "$__line" = "$__delim" ] && break
        if [ $__more = 1 ]; then __value="$__value"$'\n'"$__line"; else __value="$__line"; __more=1; fi
      done
    elif [[ $__line =~ $__stig_re_kv ]]; then
      __key="#{BASH_REMATCH[1]}"; __value="#{BASH_REMATCH[2]}"
    else
      continue
    fi
    "$2" "$__key" "$__value" "#{3:-}"
  done < "$1"
}
__stig_set_output() { [ -n "$3" ] || return 0; export "STIG_STEPOUT_#{3}__#{1//-/_}=$2"; }
__stig_set_env() { case "$1" in *-*) return 0 ;; esac; export "$1=$2"; }
__stig_reset_files() { : > "$__stig_tmp/output"; : > "$__stig_tmp/env"; : > "$__stig_tmp/path"; }
__stig_after_step() {
  local __l __o=success __c=success
  __stig_read_kv "$__stig_tmp/env" __stig_set_env
  if [ -s "$__stig_tmp/path" ]; then
    while IFS= read -r __l || [ -n "$__l" ]; do if [ -n "$__l" ]; then PATH="$__l:$PATH"; fi; done < "$__stig_tmp/path"
    export PATH
  fi
  if [ -n "$1" ]; then
    __stig_read_kv "$__stig_tmp/output" __stig_set_output "$1"
    if [ "$2" -ne 0 ]; then __o=failure; [ "$3" = 1 ] || __c=failure; fi
    export "STIG_STEPOUTCOME_$1=$__o" "STIG_STEPCONCLUSION_$1=$__c"
  fi
  __stig_reset_files
}
__stig_sha256() { if command -v sha256sum >/dev/null 2>&1; then sha256sum "$@"; else shasum -a 256 "$@"; fi; }
__stig_hash_files() (
  cd "#{GITHUB_WORKSPACE:-.}" || exit 0
  shopt -s globstar nullglob dotglob 2>/dev/null
  __list=$(for __p in "$@"; do for __f in $__p; do if [ -f "$__f" ]; then printf '%s\n' "$__f"; fi; done; done | sort -u)
  [ -n "$__list" ] || exit 0
  printf '%s\n' "$__list" | while IFS= read -r __f; do __stig_sha256 "$__f" | cut -d' ' -f1; done | __stig_sha256 | cut -d' ' -f1
)
export -f __stig_sha256 __stig_hash_files
__stig_urlenc() { printf '%s' "$1" | od -An -v -tx1 | tr -d ' \n' | sed 's/../%&/g'; }
__stig_header() (
  shopt -s nocasematch
  __v=""
  while IFS= read -r __l; do __l="#{__l%$'\r'}"; if [[ $__l == "$2: "* ]]; then __v="#{__l#*: }"; fi; done < "$1"
  printf '%s' "$__v"
)
__stig_cache_restore() {
  local __id="$1" __key="$2" __version="$3" __query __r __hit __matched __headers="$__stig_tmp/cache-headers"
  shift 3
  __query="key=$(__stig_urlenc "$__key")&version=$__version"
  for __r in "$@"; do [ -n "$__r" ] && __query="$__query&restore=$(__stig_urlenc "$__r")"; done
  rm -f "$__stig_tmp/cache.tgz" "$__headers"
  if ! curl -fsS -H "Authorization: Bearer $STIG_JOB_TOKEN" -D "$__headers" -o "$__stig_tmp/cache.tgz" \
    "$STIG_API_URL/api/actions/cache?$__query" 2>/dev/null; then
    echo "Cache not found for key: $__key"
    __stig_set_output cache-hit false "$__id"
    return 1
  fi
  __hit=$(__stig_header "$__headers" x-stig-cache-hit)
  __matched=$(__stig_header "$__headers" x-stig-cache-key)
  __matched=$(printf '%b' "#{__matched//%/\\x}")
  if ! ( cd "$GITHUB_WORKSPACE" && tar -xzPf "$__stig_tmp/cache.tgz" ); then
    echo "Failed to extract the cache archive"
    __stig_set_output cache-hit false "$__id"
    return 1
  fi
  rm -f "$__stig_tmp/cache.tgz"
  echo "Cache restored from key: $__matched"
  __stig_set_output cache-matched-key "$__matched" "$__id"
  if [ "$__hit" = exact ]; then __stig_set_output cache-hit true "$__id"; return 0; fi
  __stig_set_output cache-hit false "$__id"
  return 1
}
__stig_cache_save() {
  local __key="$1" __version="$2" __archive="$__stig_tmp/cache-save.tgz" __p __code
  local __paths=()
  shift 2
  for __p in "$@"; do
    case "$__p" in "~") __p="$HOME" ;; "~/"*) __p="$HOME/#{__p#"~/"}" ;; esac
    __paths+=("$__p")
  done
  if ! ( cd "$GITHUB_WORKSPACE" && tar -czPf "$__archive" -- "#{__paths[@]}" ) 2>/dev/null; then
    echo "Cache not saved: some cached paths do not exist"
    return 0
  fi
  __code=$(curl -sS -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $STIG_JOB_TOKEN" \
    -H 'content-type: application/gzip' -T "$__archive" \
    "$STIG_API_URL/api/actions/cache?key=$(__stig_urlenc "$__key")&version=$__version") || __code=000
  rm -f "$__archive"
  case "$__code" in
    2*) echo "Cache saved with key: $__key" ;;
    409) echo "Cache entry for key $__key already exists; not saving" ;;
    413) echo "Cache not saved: the archive exceeds the cache size limit" ;;
    *) echo "Cache not saved (HTTP $__code)" ;;
  esac
}`;

/** Written with `#{` for bash `${` so the template literal does not interpolate. */
export const RUNTIME_FUNCTIONS = SOURCE.replaceAll("#{", "${");