@amalgm/shell 0.1.162 → 0.1.164-main.34182640231

package/dist/updates/trust.js

@@ -0,0 +1,138 @@
+import { createHash } from 'node:crypto';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { createRequire } from 'node:module';
+import { BaseFetcher, Updater } from 'tuf-js';
+import { DownloadHTTPError } from 'tuf-js/dist/error.js';
+import { Metadata, MetadataKind } from '@tufjs/models';
+import { admitManagedRuntimeRelease } from '@amalgm/core/supervision';
+import { packageRoot, runtimeHost } from './store.js';
+export const RELEASE_ORIGIN = 'https://amalgm-desktop-releases.fly.dev';
+const ROLES = ['root', 'targets', 'snapshot', 'timestamp'];
+const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
+export function runtimeRoot(value, lane) {
+    const root = Metadata.fromJSON(MetadataKind.Root, value);
+    if (root.signed.unrecognizedFields.amalgm !== `runtime/${lane}` || !root.signed.consistentSnapshot)
+        throw new Error('Runtime trust scope differs');
+    const used = new Set();
+    for (const role of ROLES) {
+        const entry = root.signed.roles[role];
+        if (!entry || entry.threshold < (role === 'root' ? 2 : 1) || entry.threshold > entry.keyIDs.length)
+            throw new Error('Insufficient runtime trust threshold');
+        for (const id of entry.keyIDs) {
+            const key = root.signed.keys[id];
+            if (key?.keyType !== 'ed25519' || key.scheme !== 'ed25519' || used.has(key.keyVal.public))
+                throw new Error('Runtime signing roles must be independent');
+            used.add(key.keyVal.public);
+        }
+    }
+    root.verifyDelegate('root', root);
+    return root;
+}
+class RuntimeFetcher extends BaseFetcher {
+    base;
+    signal;
+    constructor(base, signal) {
+        super();
+        this.base = base;
+        this.signal = signal;
+    }
+    async fetch(url) {
+        const target = new URL(url);
+        if (target.origin !== this.base.origin || !target.pathname.startsWith(this.base.pathname))
+            throw new Error('Runtime trust request escaped its repository');
+        const response = await fetch(target, { signal: this.signal, redirect: 'error', cache: 'no-store' });
+        if (!response.ok || !response.body)
+            throw new DownloadHTTPError('Runtime trust download failed', response.status);
+        return response.body;
+    }
+}
+/** Intentionally matches Electron's pinned host adapter: TUF owns verification;
+ * SQLite owns the four metadata writes, including partially failed refreshes.
+ * Neither consumer resets trust from a disposable filesystem mirror. */
+export class RuntimeTrust {
+    store;
+    signal;
+    repository;
+    lane;
+    constructor(store, signal, origin = RELEASE_ORIGIN) {
+        this.store = store;
+        this.signal = signal;
+        const lane = store.identity.binding.runtimeLabel;
+        if (lane !== 'main' && lane !== 'preview')
+            throw new Error('Local development has no managed release authority');
+        this.lane = lane;
+        this.repository = new URL(`/trust/runtime/${lane}/`, origin);
+        if (createRequire(import.meta.url)('tuf-js/package.json').version !== '6.0.0')
+            throw new Error('Review the pinned TUF storage interface before upgrading');
+        if (store.read('metadata:root') === null) {
+            if (['metadata:timestamp', 'metadata:snapshot', 'metadata:targets', 'policy'].some(key => store.read(key) !== null))
+                throw new Error('Runtime trust history is incomplete');
+            const root = readFileSync(join(packageRoot, 'config/releases/trust/runtime', `${lane}.root.json`), 'utf8');
+            runtimeRoot(JSON.parse(root), lane);
+            store.write('metadata:root', root);
+        }
+        runtimeRoot(JSON.parse(store.read('metadata:root')), lane);
+    }
+    async current(previous) {
+        const scratch = await mkdtemp(join(this.store.identity.serviceDir, 'trust-refresh-'));
+        try {
+            writeFileSync(join(scratch, 'root.json'), this.store.read('metadata:root'));
+            const client = new Updater({ metadataDir: scratch, targetDir: scratch,
+                metadataBaseUrl: new URL('metadata/', this.repository).href, targetBaseUrl: new URL('targets/', this.repository).href,
+                fetcher: new RuntimeFetcher(this.repository, AbortSignal.any([this.signal, AbortSignal.timeout(30_000)])),
+                config: { maxDelegations: 1, targetsMaxLength: 4 * 1024 * 1024, fetchRetry: 0 } });
+            if (typeof Reflect.get(client, 'loadLocalMetadata') !== 'function' || typeof Reflect.get(client, 'persistMetadata') !== 'function')
+                throw new Error('The examined TUF storage interface changed');
+            const key = (role) => { if (!ROLES.includes(role))
+                throw new Error('Runtime targets do not delegate'); return `metadata:${role}`; };
+            Reflect.set(client, 'loadLocalMetadata', (role) => {
+                const bytes = this.store.read(key(role));
+                if (bytes === null)
+                    throw new Error('No cached metadata');
+                return Buffer.from(bytes);
+            });
+            Reflect.set(client, 'persistMetadata', (role, bytes) => this.store.write(key(role), bytes.toString('utf8')));
+            await client.refresh();
+            const root = runtimeRoot(JSON.parse(this.store.read('metadata:root')), this.lane);
+            if (Date.parse(root.signed.expires) <= Date.now())
+                throw new Error('Runtime root expired');
+            const info = await client.getTargetInfo('current.json');
+            if (!info || info.custom.amalgm !== `runtime/${this.lane}` || info.length > 4 * 1024 * 1024)
+                throw new Error('No authorized runtime target exists');
+            const bytes = await readFile(await client.downloadTarget(info));
+            return this.admit(JSON.parse(bytes.toString('utf8')), digest(bytes), previous);
+        }
+        finally {
+            await rm(scratch, { recursive: true, force: true });
+        }
+    }
+    /** A historical signature identifies existing code; only current() authorizes
+     * a desired release. Expiry cannot retroactively change the installed bytes. */
+    async baseline(version) {
+        if (!/^[\w.-]+$/.test(version))
+            throw new Error('Invalid installed version');
+        const fetcher = new RuntimeFetcher(this.repository, AbortSignal.any([this.signal, AbortSignal.timeout(30_000)]));
+        const receipt = JSON.parse((await fetcher.downloadBytes(new URL(`releases/shell-${version}/receipt.json`, this.repository).href, 4 * 1024 * 1024)).toString('utf8'));
+        const root = runtimeRoot(JSON.parse(this.store.read('metadata:root')), this.lane);
+        const authorization = Metadata.fromJSON(MetadataKind.Targets, receipt.authorization);
+        root.verifyDelegate('targets', authorization);
+        const bytes = Buffer.from(JSON.stringify(receipt.target) + '\n');
+        const file = authorization.signed.targets['current.json'];
+        if (!file || authorization.signed.delegations || Object.keys(authorization.signed.targets).length !== 1
+            || file.custom.amalgm !== `runtime/${this.lane}` || file.length !== bytes.length || file.hashes.sha256 !== digest(bytes))
+            throw new Error('Installed receipt does not authenticate its exact target');
+        const accepted = this.admit(receipt.target, digest(bytes));
+        if (accepted.target.id !== `shell-${version}` || accepted.target.release.units[0].artifact.version !== version)
+            throw new Error('Installed receipt identity differs');
+        return accepted;
+    }
+    admit(value, hash, previous) {
+        const accepted = admitManagedRuntimeRelease(value, hash, this.store.identity.binding, runtimeHost(), previous);
+        if (accepted.target.release.units.length !== 1 || accepted.target.release.units[0].id !== 'shell')
+            throw new Error('This controller implements one Shell process unit');
+        return accepted;
+    }
+}
+//# sourceMappingURL=trust.js.map

package/dist/updates/trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.js","sourceRoot":"","sources":["../../src/updates/trust.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAA+B,MAAM,0BAA0B,CAAC;AACnG,OAAO,EAAE,WAAW,EAAE,WAAW,EAAoB,MAAM,YAAY,CAAC;AAExE,MAAM,CAAC,MAAM,cAAc,GAAG,yCAAyC,CAAC;AACxE,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,CAAU,CAAC;AACpE,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnF,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,IAAY;IACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,KAAgD,CAAC,CAAC;IACpG,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,KAAK,WAAW,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACnJ,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC5J,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,GAAG,EAAE,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACxJ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,cAAe,SAAQ,WAAW;IACjB;IAAoB;IAAzC,YAAqB,IAAS,EAAW,MAAmB;QAAI,KAAK,EAAE,CAAC;QAAnD,SAAI,GAAJ,IAAI,CAAK;QAAW,WAAM,GAAN,MAAM,CAAa;IAAa,CAAC;IAC1E,KAAK,CAAC,KAAK,CAAC,GAAW;QACrB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC3J,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;CACF;AAED;;wEAEwE;AACxE,MAAM,OAAO,YAAY;IAGF;IAA6B;IAFzC,UAAU,CAAM;IAChB,IAAI,CAAqB;IAClC,YAAqB,KAAkB,EAAW,MAAmB,EAAE,MAAM,GAAG,cAAc;QAAzE,UAAK,GAAL,KAAK,CAAa;QAAW,WAAM,GAAN,MAAM,CAAa;QACnE,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC;QACjD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACjH,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC,kBAAkB,IAAI,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC,OAAO,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC3J,IAAI,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAC5K,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,+BAA+B,EAAE,GAAG,IAAI,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;YAC3G,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;YACpC,KAAK,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,QAAiC;QAC7C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAE,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO;gBACnE,eAAe,EAAE,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI;gBACrH,OAAO,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACzG,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,KAAK,UAAU,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAClM,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAA4B,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC,OAAO,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACpK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,IAAY,EAAE,EAAE;gBACxD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAC,IAAI,KAAK,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;gBAAC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjI,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7H,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAE,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACnF,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC3F,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;YACxD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACpJ,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;QACjF,CAAC;gBAAS,CAAC;YAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IACpE,CAAC;IACD;oFACgF;IAChF,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACjH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,OAAO,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,kBAAkB,OAAO,eAAe,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACrK,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAE,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QACrF,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,IAAI,aAAa,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;eAClG,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QACxM,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3D,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,SAAS,OAAO,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACtK,OAAO,QAAQ,CAAC;IAClB,CAAC;IACO,KAAK,CAAC,KAAc,EAAE,IAAY,EAAE,QAAiC;QAC3E,MAAM,QAAQ,GAAG,0BAA0B,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC/G,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACxK,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/user-ground-host.d.ts

@@ -1,6 +1,6 @@
 import { type UserGroundPort, type UserHomeDeclaration } from "@amalgm/core/identity";
 import { type EntityType, type FilesAddPorts, type FilesRegisterPorts, type UserGroundIdentity } from "@amalgm/live";
-import Database from "better-sqlite3";
+import type Database from "better-sqlite3";
 import { type FilesStageObserver } from "./files-observability.js";
 import { type EntityApplyHostOptions, type EntityApplyStageEvidence } from "./entity-apply-host.js";
 import { type DurabilityBarrier } from "./durability-barrier.js";
@@ -68,6 +68,8 @@ export interface UserGroundHostOptions {
     readonly tunnelUrl: string;
     readonly tunnelToken: string;
     readonly runtimeVersion: string;
+    /** Installation-wide host admission, before any writer touches ground. */
+    readonly reserveWritableRoot?: (path: string) => void;
     readonly declaration?: UserHomeDeclaration;
     readonly now?: () => Date;
     /** Product diagnostics consume this; Core's `/healthz` remains liveness-only. */
@@ -256,6 +258,7 @@ export declare class UserGroundHost {
      * stay one read each. A lone artifact is a set of one. */
     private downloadContentSet;
     private downloadContent;
+    private reserveGroundRoots;
     private ensureWatchers;
     private scheduleRescan;
     /** A finite cold command may suppress Detect while it owns publication, but

package/dist/user-ground-host.js

@@ -4,7 +4,7 @@ import { open, readFile } from "node:fs/promises";
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { buildUserHomeManifest, buildUserManifest, liveMachineStateDir, scopedAmalgmDir, shippedUserHomeDeclaration, } from "@amalgm/core/identity";
 import { CHUNK_BYTES, CONTENT_CONTRACT, INLINE_CARGO_MAX_BYTES, ENTITY_CLOUD_CONTRACT, ENTITY_CLOUD_SCHEMA_VERSION, artifactForRecord, canonicalVersion, checkContentManifest, classifyDirectory, classifyFile, classifyRegisteredRoot, containedRecords, createLocalEntityRecord, createEntityRecordAuthorityPort, convergeUserGround, decodeAcceptedEntityRecord, deriveUploadManifest, createUserGroundEnrollmentPolicy, isRepositoryMetadataEntry, isContentPlacementChangedError, indexRepositoryTerritory, downloadAll as downloadAllArtifacts, encodeEntityRecord, EntityApplyRail, EntityRecordRail, membershipHash, materializedSlotNames, pathIsSuspect, CONTENT_REFS_BATCH_OBJECTS, privateEntityResourceId, repositoryIdentityHash, sameRecords, snapshotFromRecords, stableJson, streamCargo, travelingRecords, travelingRecordUUIDs, upload as uploadArtifact, userGroundRecords, portableFileMode, GRAPH_HEAD_OPERATION_KIND, } from "@amalgm/live";
-import Database from "better-sqlite3";
+import { openFileDatabase } from "./sqlite.js";
 import { atomicCopy, atomicWrite, ensurePrivateDir, ensureUserDir } from "./filesystem.js";
 import { emitFilesStage, } from "./files-observability.js";
 import { EntityApplyHost, } from "./entity-apply-host.js";
@@ -171,6 +171,7 @@ export class UserGroundHost {
             converge: async (identity) => {
                 this.converged = false;
                 this.activeIdentity = normalizedIdentity(identity);
+                this.reserveGroundRoots(this.activeIdentity);
                 const local = this.localPort(this.activeIdentity);
                 const result = await convergeUserGround(this.activeIdentity, {
                     sha256Hex,
@@ -312,6 +313,7 @@ export class UserGroundHost {
         const register = createFilesRegisterPorts({
             userRoot,
             deviceId: identity.deviceId,
+            reserveWritableRoot: this.options.reserveWritableRoot,
             onReferenceDeclared: () => this.scheduleRescan(),
             findKnownWorkspaceId: ({ absolutePath, deviceNumber, inode }) => findKnownEntityId(this.databasePath(identity), absolutePath, deviceNumber, inode),
         });
@@ -363,6 +365,7 @@ export class UserGroundHost {
                 return current;
             },
             materializeWorkspace: async (input) => {
+                this.options.reserveWritableRoot?.(join(input.destinationParent, input.workspace.name));
                 const groundWaitStarted = performance.now();
                 this.stage({
                     primitive: "download",
@@ -2060,9 +2063,19 @@ export class UserGroundHost {
             throw new Error(`download set did not seal ${artifact.contentHash}`);
         return local;
     }
+    reserveGroundRoots(identity) {
+        if (!this.options.reserveWritableRoot)
+            return;
+        const userRoot = this.userRoot(identity);
+        this.options.reserveWritableRoot(userRoot);
+        for (const { directory } of materializedWorkspaceBindings(workspaceBindingDir(userRoot, identity.deviceId))) {
+            this.options.reserveWritableRoot(directory);
+        }
+    }
     ensureWatchers(identity, authoritativeBaselineRootIds = []) {
         if (this.closing)
             return this.watchHost.health();
+        this.reserveGroundRoots(identity);
         const started = performance.now();
         const root = this.userRoot(identity);
         const wanted = new Map([[root, {
@@ -3023,7 +3036,7 @@ function convertLegacySnapshotJournal(database, shape, columns) {
  * heap-capped child process. */
 export function initializeDatabase(file) {
     ensurePrivateDir(dirname(file));
-    const database = new Database(file);
+    const database = openFileDatabase(file);
     database.pragma("busy_timeout = 5000");
     database.pragma("journal_mode = WAL");
     database.pragma("synchronous = FULL");
@@ -4292,7 +4305,7 @@ function refreshRevealedRootEvidence(file, workspaceId, absolutePath) {
     }
 }
 function assertDatabaseIdentity(file, identity) {
-    const database = new Database(file, { readonly: true });
+    const database = openFileDatabase(file, { readonly: true });
     try {
         const found = database.prepare("SELECT user_id AS userId, user_email AS userEmail, device_id AS deviceId FROM ground_identity WHERE singleton = 1").get();
         if (!found || found.userId !== identity.userId || found.userEmail !== identity.userEmail