@aetheros/kernel-runtime 0.0.0-stage → 0.1.0

package/src/release-signatures.js

@@ -0,0 +1,56 @@
+import {createHash, createPrivateKey, createPublicKey, KeyObject, sign, verify} from 'node:crypto';
+
+const hash = bytes => createHash('sha256').update(bytes).digest('hex');
+const REPOSITORY = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+const REVISION = /^[a-f0-9]{40}$/;
+function fields(value, names) {
+  if (!value || Object.getPrototypeOf(value) !== Object.prototype) throw new Error('Invalid release statement');
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  if (Reflect.ownKeys(value).length !== names.length || Reflect.ownKeys(value).some(key => !names.includes(key) || !descriptors[key].enumerable || !Object.hasOwn(descriptors[key], 'value'))) throw new Error('Invalid release statement');
+}
+function source(repository, revision) {
+  if (typeof repository !== 'string' || repository.length > 256 || !REPOSITORY.test(repository) || typeof revision !== 'string' || !REVISION.test(revision)) throw new Error('Expected repository and full revision required');
+}
+function manifestDigest(bytes) {
+  if (!Buffer.isBuffer(bytes) || !bytes.length || bytes.length > 1024 * 1024) throw new Error('Manifest must be bounded raw bytes');
+  return hash(bytes);
+}
+function keyObject(key, type) {
+  let selected;
+  try { selected = key instanceof KeyObject ? key : type === 'private' ? createPrivateKey(key) : createPublicKey(key); }
+  catch { throw new Error('Invalid release signing key'); }
+  if (type === 'public' && selected.type === 'private') selected = createPublicKey(selected);
+  if (selected.type !== type || selected.asymmetricKeyType !== 'ed25519') throw new Error('Ed25519 release key required');
+  return selected;
+}
+const fingerprint = key => hash(keyObject(key, 'public').export({type: 'spki', format: 'der'}));
+function statement(repository, revision, manifestSha256) {
+  source(repository, revision);
+  if (typeof manifestSha256 !== 'string' || !/^[a-f0-9]{64}$/.test(manifestSha256)) throw new Error('Invalid manifest digest');
+  return {domain: 'aetheros.release.v1', schemaVersion: 1, repository, revision, manifestSha256};
+}
+
+/** Host explicitly supplies a private key; never called by pack or release workflows. */
+export function signReleaseManifest(manifestBytes, {privateKey, repository, revision} = {}) {
+  const payload = statement(repository, revision, manifestDigest(manifestBytes));
+  const key = keyObject(privateKey, 'private');
+  return {statement: payload, keyId: fingerprint(key), signature: sign(null, Buffer.from(JSON.stringify(payload)), key).toString('base64')};
+}
+
+/** Expectations and trust anchor must come from consumer policy, never the signed file. */
+export function verifySignedRelease(manifestBytes, envelope, {publicKey, repository, revision} = {}) {
+  source(repository, revision);
+  fields(envelope, ['statement', 'keyId', 'signature']);
+  fields(envelope.statement, ['domain', 'schemaVersion', 'repository', 'revision', 'manifestSha256']);
+  const claimed = envelope.statement;
+  if (claimed.domain !== 'aetheros.release.v1' || claimed.schemaVersion !== 1) throw new Error('Unsupported release statement');
+  const payload = statement(claimed.repository, claimed.revision, claimed.manifestSha256), key = keyObject(publicKey, 'public');
+  if (typeof envelope.keyId !== 'string' || envelope.keyId !== fingerprint(key)) throw new Error('Untrusted release signing key');
+  if (typeof envelope.signature !== 'string' || !/^[A-Za-z0-9+/]{86}==$/.test(envelope.signature)) throw new Error('Invalid release signature');
+  const signature = Buffer.from(envelope.signature, 'base64');
+  if (signature.toString('base64') !== envelope.signature || !verify(null, Buffer.from(JSON.stringify(payload)), key, signature)) throw new Error('Release signature verification failed');
+  if (payload.repository !== repository || payload.revision !== revision) throw new Error('Release source does not match consumer policy');
+  if (manifestDigest(manifestBytes) !== payload.manifestSha256) throw new Error('Signed manifest digest mismatch');
+  return {repository, revision, keyId: envelope.keyId, manifestSha256: payload.manifestSha256};
+}
+

package/src/transactions.js

@@ -0,0 +1,50 @@
+import {randomBytes} from 'node:crypto';
+import {open,mkdir,readFile,unlink} from 'node:fs/promises';
+import {dirname} from 'node:path';
+import {FileStateStore} from './index.js';
+
+export class StateBusyError extends Error {
+ constructor(){super('State store is locked by another transaction');this.name='StateBusyError';}
+}
+/** Cooperating processes, one canonical path. No stale-lock takeover or implicit retry. */
+export class TransactionalStateStore extends FileStateStore {
+ async transaction(update) {
+  if(typeof update!=='function')throw new TypeError('Transaction callback required');
+  const lock=this.path+'.lock',lease=randomBytes(24).toString('hex');
+  await mkdir(dirname(this.path),{recursive:true});
+  let handle;
+  try{handle=await open(lock,'wx',0o600);}catch(error){if(error.code==='EEXIST')throw new StateBusyError();throw error;}
+  try {
+   try{await handle.writeFile(lease,'utf8');await handle.sync();}finally{await handle.close();}
+   const previous=await super.load();
+   const next=await update(structuredClone(previous));
+   // Clone before awaiting I/O so a caller cannot change the snapshot during save.
+   const snapshot=structuredClone(next);
+   await super.save(snapshot);
+   return structuredClone(snapshot);
+  } finally {
+   // Never remove a replacement lock if an external operator changed ownership.
+   const owner=await readFile(lock,'utf8').catch(error=>{if(error.code==='ENOENT')return null;throw error;});
+   if(owner===lease)await unlink(lock);
+   else throw new Error('State lock ownership changed; manual recovery required');
+  }
+ }
+ async save(state){const snapshot=structuredClone(state);await this.transaction(()=>snapshot);}
+ async putTenant(id,data){
+  if(typeof id!=='string'||!id.trim())throw new Error('Tenant id required');
+  if(data===undefined)throw new Error('Tenant data required');
+  const snapshot=structuredClone(data);
+  await this.transaction(state=>{Object.defineProperty(state.tenants,id,{value:snapshot,enumerable:true,writable:true,configurable:true});return state;});
+ }
+ async updateTenant(id,update){
+  if(typeof id!=='string'||!id.trim()||typeof update!=='function')throw new TypeError('Tenant id and update callback required');
+  let result;
+  await this.transaction(async state=>{
+   const previous=Object.hasOwn(state.tenants,id)?structuredClone(state.tenants[id]):null;
+   result=structuredClone(await update(previous));
+   if(result===undefined)throw new Error('Tenant data required');
+   Object.defineProperty(state.tenants,id,{value:result,enumerable:true,writable:true,configurable:true});return state;
+  });
+  return structuredClone(result);
+ }
+}

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.