@aopslabs/aops 0.2.0

package/dist/lib/commercial-lifecycle-smoke-isolation.js

@@ -0,0 +1,236 @@
+import { randomUUID } from 'node:crypto';
+import { closeSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync, } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { createServer } from 'node:net';
+import path from 'node:path';
+const RUN_NAME = /^aops-commercial-smoke-[a-f0-9]{32}$/;
+const FORBIDDEN_PORTS = new Set([5432, 5900, 5922]);
+const CLAIM_FILE = '.aops-commercial-smoke-claim.json';
+const verifiedIsolations = new WeakSet();
+const verifiedPortLeases = new WeakSet();
+function fail(reason) {
+    throw new Error(`commercial_developer_host_smoke_${reason}`);
+}
+function samePath(left, right) {
+    const resolvedLeft = path.resolve(left);
+    const resolvedRight = path.resolve(right);
+    return process.platform === 'win32'
+        ? resolvedLeft.toLowerCase() === resolvedRight.toLowerCase()
+        : resolvedLeft === resolvedRight;
+}
+function within(root, candidate) {
+    const relative = path.relative(path.resolve(root), path.resolve(candidate));
+    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+function overlaps(left, right) {
+    return within(left, right) || within(right, left);
+}
+function protectedRoots(environment) {
+    const home = path.resolve(environment.USERPROFILE || environment.HOME || homedir());
+    const roots = [path.join(home, '.aops')];
+    if (process.platform === 'win32') {
+        const localAppData = environment.LOCALAPPDATA;
+        if (!localAppData)
+            fail('local_app_data_missing');
+        roots.push(path.join(path.resolve(localAppData), 'AOPS'));
+    }
+    else if (process.platform === 'darwin') {
+        roots.push(path.join(home, 'Library', 'Application Support', 'AOPS'));
+    }
+    else {
+        roots.push(path.join(path.resolve(environment.XDG_DATA_HOME || path.join(home, '.local', 'share')), 'aops'));
+        roots.push(path.join(path.resolve(environment.XDG_STATE_HOME || path.join(home, '.local', 'state')), 'aops'));
+        roots.push(path.join(path.resolve(environment.XDG_CONFIG_HOME || path.join(home, '.config')), 'aops'));
+    }
+    return Object.freeze(roots.map((root) => path.resolve(root)));
+}
+function assertPlainCanonicalDirectory(candidate, reason) {
+    let stat;
+    try {
+        stat = lstatSync(candidate);
+    }
+    catch {
+        return fail(reason);
+    }
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        fail(reason);
+    const canonical = realpathSync.native(candidate);
+    if (!samePath(canonical, candidate))
+        fail(reason);
+    return canonical;
+}
+function assertAbsent(candidate) {
+    try {
+        lstatSync(candidate);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        fail('run_root_probe_failed');
+    }
+    fail('run_root_preexisting');
+}
+function claimMaterial(isolation) {
+    return `${JSON.stringify({
+        schemaVersion: isolation.schemaVersion,
+        objectType: isolation.objectType,
+        runId: isolation.runId,
+        runRoot: isolation.runRoot,
+        runRootProvenAbsent: isolation.runRootProvenAbsent,
+        hostClass: isolation.hostClass,
+    })}\n`;
+}
+export function claimCommercialDeveloperHostIsolation(options) {
+    const environment = options.environment ?? process.env;
+    if (!path.isAbsolute(options.runRoot))
+        fail('run_root_not_absolute');
+    const runRoot = path.resolve(options.runRoot);
+    if (protectedRoots(environment).some((protectedRoot) => overlaps(protectedRoot, runRoot))) {
+        fail('protected_root_refused');
+    }
+    const disposableRoot = assertPlainCanonicalDirectory(path.resolve(options.disposableRoot ?? tmpdir()), 'disposable_root_unsafe');
+    if (!samePath(path.dirname(runRoot), disposableRoot) || !RUN_NAME.test(path.basename(runRoot))) {
+        fail('run_root_not_disposable_child');
+    }
+    assertAbsent(runRoot);
+    try {
+        mkdirSync(runRoot, { recursive: false, mode: 0o700 });
+    }
+    catch {
+        return fail('run_root_claim_failed');
+    }
+    const canonical = assertPlainCanonicalDirectory(runRoot, 'run_root_claim_invalid');
+    const runId = randomUUID();
+    const isolation = Object.freeze({
+        schemaVersion: 1,
+        objectType: 'aops-commercial-developer-host-isolation-v1',
+        runId,
+        runRoot: canonical,
+        paths: Object.freeze({
+            installRoot: path.join(canonical, 'install'),
+            journalRoot: path.join(canonical, 'operation-journals'),
+            storeRoot: path.join(canonical, 'commercial-store'),
+            runtimeRoot: path.join(canonical, 'runtime'),
+            postgresRoot: path.join(canonical, 'postgres'),
+        }),
+        runRootProvenAbsent: true,
+        hostClass: 'developer-host',
+    });
+    const claimPath = path.join(canonical, CLAIM_FILE);
+    let descriptor;
+    try {
+        descriptor = openSync(claimPath, 'wx', 0o600);
+        writeFileSync(descriptor, claimMaterial(isolation), 'utf8');
+    }
+    catch {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+        rmSync(canonical, { recursive: true, force: false });
+        return fail('run_root_claim_file_failed');
+    }
+    closeSync(descriptor);
+    verifiedIsolations.add(isolation);
+    return isolation;
+}
+export function assertCommercialDeveloperHostIsolation(isolation) {
+    if (!verifiedIsolations.has(isolation))
+        fail('isolation_unverified');
+    const canonical = assertPlainCanonicalDirectory(isolation.runRoot, 'run_root_changed');
+    if (!samePath(canonical, isolation.runRoot))
+        fail('run_root_changed');
+    const claimPath = path.join(canonical, CLAIM_FILE);
+    let claim;
+    try {
+        claim = readFileSync(claimPath, 'utf8');
+    }
+    catch {
+        return fail('claim_missing');
+    }
+    if (claim !== claimMaterial(isolation))
+        fail('claim_changed');
+    return isolation;
+}
+function assertSafeTree(candidate) {
+    const stat = lstatSync(candidate);
+    if (stat.isSymbolicLink())
+        fail('cleanup_reparse_refused');
+    if (!stat.isDirectory())
+        return;
+    const names = readdirSync(candidate);
+    for (const name of names)
+        assertSafeTree(path.join(candidate, name));
+}
+export function cleanupCommercialDeveloperHostIsolation(isolation) {
+    const verified = assertCommercialDeveloperHostIsolation(isolation);
+    assertSafeTree(verified.runRoot);
+    rmSync(verified.runRoot, { recursive: true, force: false });
+    verifiedIsolations.delete(isolation);
+}
+function listenEphemeral() {
+    return new Promise((resolve, reject) => {
+        const server = createServer();
+        server.unref();
+        server.once('error', reject);
+        server.listen({ host: '127.0.0.1', port: 0, exclusive: true }, () => {
+            server.removeListener('error', reject);
+            const address = server.address();
+            if (!address || typeof address === 'string' || FORBIDDEN_PORTS.has(address.port)) {
+                server.close(() => reject(new Error('commercial_developer_host_smoke_forbidden_port_allocated')));
+                return;
+            }
+            resolve(Object.freeze({ server, port: address.port }));
+        });
+    });
+}
+function closeServer(server) {
+    return new Promise((resolve, reject) => {
+        if (!server.listening)
+            return resolve();
+        server.close((error) => error ? reject(error) : resolve());
+    });
+}
+export async function reserveCommercialDeveloperHostPorts(isolation) {
+    assertCommercialDeveloperHostIsolation(isolation);
+    const roles = ['postgres', 'server', 'cockpit', 'registry'];
+    const entries = new Map();
+    try {
+        for (const role of roles)
+            entries.set(role, await listenEphemeral());
+    }
+    catch (error) {
+        await Promise.allSettled([...entries.values()].map((entry) => closeServer(entry.server)));
+        throw error;
+    }
+    const released = new Set();
+    const lease = Object.freeze({
+        schemaVersion: 1,
+        objectType: 'aops-commercial-developer-host-port-lease-v1',
+        ports: Object.freeze(Object.fromEntries(roles.map((role) => [role, entries.get(role).port]))),
+        release: async (role) => {
+            if (!verifiedPortLeases.has(lease) || !roles.includes(role))
+                fail('port_lease_unverified');
+            if (released.has(role))
+                return;
+            await closeServer(entries.get(role).server);
+            released.add(role);
+        },
+        releaseAll: async () => {
+            if (!verifiedPortLeases.has(lease))
+                fail('port_lease_unverified');
+            await Promise.all(roles.map((role) => lease.release(role)));
+            verifiedPortLeases.delete(lease);
+        },
+    });
+    verifiedPortLeases.add(lease);
+    return lease;
+}
+export function assertCommercialDeveloperHostAllocatedPort(lease, role, observedPort) {
+    if (!verifiedPortLeases.has(lease))
+        fail('port_lease_unverified');
+    if (!Number.isSafeInteger(observedPort) || FORBIDDEN_PORTS.has(observedPort)) {
+        fail('forbidden_port_refused');
+    }
+    if (lease.ports[role] !== observedPort)
+        fail('port_not_allocated');
+    return observedPort;
+}

package/dist/lib/commercial-managed-postgres-docker-adapter.js

@@ -0,0 +1,274 @@
+import { execFile } from 'node:child_process';
+import { lstatSync, mkdirSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { Client } from 'pg';
+import { assertCommercialDeveloperHostAllocatedPort, assertCommercialDeveloperHostIsolation, } from './commercial-lifecycle-smoke-isolation.js';
+function fail(reason) {
+    throw new Error(`commercial_managed_postgres_${reason}`);
+}
+function exactLabels(expected, observed) {
+    const expectedKeys = Object.keys(expected).sort();
+    const observedKeys = Object.keys(observed).filter((key) => key.startsWith('aops.')).sort();
+    return expectedKeys.length === observedKeys.length &&
+        expectedKeys.every((key, index) => key === observedKeys[index] && expected[key] === observed[key]);
+}
+function parseJson(value, reason) {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return fail(reason);
+    }
+}
+function defaultDockerRun(command) {
+    return (args) => new Promise((resolve, reject) => {
+        execFile(command, [...args], {
+            windowsHide: true,
+            encoding: 'utf8',
+            maxBuffer: 8 * 1024 * 1024,
+            env: Object.fromEntries(['SystemRoot', 'WINDIR', 'PATH', 'TEMP', 'TMP']
+                .flatMap((key) => process.env[key] ? [[key, process.env[key]]] : [])),
+        }, (error, stdout, stderr) => {
+            if (error && typeof error.code !== 'number') {
+                reject(new Error('commercial_managed_postgres_docker_execution_failed'));
+                return;
+            }
+            resolve(Object.freeze({
+                exitCode: typeof error?.code === 'number'
+                    ? Number(error.code)
+                    : 0,
+                stdout,
+                stderr,
+            }));
+        });
+    });
+}
+function defaultPortOwnerInspect(port) {
+    if (process.platform !== 'win32')
+        return Promise.resolve(null);
+    const systemRoot = process.env.SystemRoot ?? process.env.WINDIR ?? 'C:\\Windows';
+    const netstat = path.join(systemRoot, 'System32', 'netstat.exe');
+    return new Promise((resolve, reject) => {
+        execFile(netstat, ['-ano', '-p', 'tcp'], {
+            windowsHide: true,
+            encoding: 'utf8',
+            maxBuffer: 8 * 1024 * 1024,
+        }, (error, stdout) => {
+            if (error)
+                return reject(new Error('commercial_managed_postgres_port_owner_inspect_failed'));
+            const owners = new Set();
+            for (const line of stdout.split(/\r?\n/)) {
+                const match = /^\s*TCP\s+(\S+):(\d+)\s+\S+\s+LISTENING\s+(\d+)\s*$/i.exec(line);
+                if (match && Number(match[2]) === port)
+                    owners.add(Number(match[3]));
+            }
+            if (owners.size > 1)
+                return reject(new Error('commercial_managed_postgres_port_owner_ambiguous'));
+            resolve([...owners][0] ?? null);
+        });
+    });
+}
+async function requiredRun(run, args, reason) {
+    const result = await run(args);
+    if (result.exitCode !== 0)
+        fail(reason);
+    return result;
+}
+async function inspectOptionalJson(run, args, reason) {
+    const result = await run(args);
+    if (result.exitCode !== 0) {
+        if (/No such (?:container|object|volume)/i.test(result.stderr))
+            return null;
+        fail(reason);
+    }
+    return parseJson(result.stdout.trim(), reason);
+}
+function assertSelectionBoundary(isolation, lease, selection) {
+    assertCommercialDeveloperHostIsolation(isolation);
+    if (selection.coordinates.host !== '127.0.0.1')
+        fail('non_loopback_refused');
+    if (selection.coordinates.port === 5432)
+        fail('ownership_refused_before_statement_live_port');
+    assertCommercialDeveloperHostAllocatedPort(lease, 'postgres', selection.coordinates.port);
+}
+function resourceLabels(value, reason) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        fail(reason);
+    const result = {};
+    for (const [key, candidate] of Object.entries(value)) {
+        if (typeof candidate !== 'string')
+            fail(reason);
+        result[key] = candidate;
+    }
+    return Object.freeze(result);
+}
+export function createCommercialManagedPostgresDockerAdapter(options) {
+    const isolation = assertCommercialDeveloperHostIsolation(options.isolation);
+    if (!path.isAbsolute(options.dockerCommand))
+        fail('docker_command_not_absolute');
+    const dockerStat = lstatSync(options.dockerCommand);
+    if (!dockerStat.isFile() || dockerStat.isSymbolicLink())
+        fail('docker_command_unsafe');
+    const run = options.dockerRun ?? defaultDockerRun(options.dockerCommand);
+    const inspectPortOwner = options.inspectPortOwner ?? defaultPortOwnerInspect;
+    const createClient = options.createClient ?? ((connectionString) => new Client({ connectionString }));
+    const inspectManaged = async (selection) => {
+        assertSelectionBoundary(isolation, options.portLease, selection);
+        const runtime = await run(['info', '--format', '{{json .ServerVersion}}']);
+        if (runtime.exitCode !== 0) {
+            return Object.freeze({ runtime: 'absent', portOwner: null, container: null, volume: null });
+        }
+        const containerInspect = await inspectOptionalJson(run, [
+            'container', 'inspect', selection.resources.containerName,
+        ], 'container_inspect_failed');
+        const volumeInspect = await inspectOptionalJson(run, [
+            'volume', 'inspect', selection.resources.volumeName,
+        ], 'volume_inspect_failed');
+        let container = null;
+        if (containerInspect) {
+            if (containerInspect.length !== 1)
+                fail('container_inspect_invalid');
+            const observed = containerInspect[0];
+            const bindings = observed?.HostConfig?.PortBindings?.['5432/tcp'];
+            const binding = Array.isArray(bindings) && bindings.length === 1 ? bindings[0] : null;
+            container = Object.freeze({
+                kind: 'container',
+                name: selection.resources.containerName,
+                labels: resourceLabels(observed?.Config?.Labels ?? {}, 'container_labels_invalid'),
+                imageRef: String(observed?.Config?.Image ?? ''),
+                imageDigest: selection.imageDigest,
+                bindHost: String(binding?.HostIp ?? ''),
+                hostPort: Number(binding?.HostPort),
+                volumeName: String(observed?.Mounts?.[0]?.Name ?? ''),
+                id: String(observed?.Id ?? ''),
+            });
+        }
+        let volume = null;
+        if (volumeInspect) {
+            if (volumeInspect.length !== 1)
+                fail('volume_inspect_invalid');
+            const observed = volumeInspect[0];
+            volume = Object.freeze({
+                kind: 'volume',
+                name: selection.resources.volumeName,
+                labels: resourceLabels(observed?.Labels ?? {}, 'volume_labels_invalid'),
+            });
+        }
+        const osPortOwner = await inspectPortOwner(selection.coordinates.port);
+        return Object.freeze({
+            runtime: 'ready',
+            portOwner: osPortOwner === null
+                ? null
+                : container && exactLabels(selection.resources.labels, container.labels)
+                    ? selection.resources.containerName
+                    : `pid:${osPortOwner}`,
+            container,
+            volume,
+        });
+    };
+    const assertOwnedBeforeStatement = async (selection) => {
+        const snapshot = await inspectManaged(selection);
+        if (snapshot.runtime !== 'ready' || snapshot.portOwner !== selection.resources.containerName ||
+            !snapshot.container || !snapshot.volume ||
+            !exactLabels(selection.resources.labels, snapshot.container.labels) ||
+            !exactLabels(selection.resources.labels, snapshot.volume.labels) ||
+            snapshot.container.imageRef !== selection.imageRef ||
+            snapshot.container.imageDigest !== selection.imageDigest ||
+            snapshot.container.bindHost !== '127.0.0.1' ||
+            snapshot.container.hostPort !== selection.coordinates.port ||
+            snapshot.container.volumeName !== selection.resources.volumeName)
+            fail('ownership_refused_before_statement');
+    };
+    return Object.freeze({
+        inspectManaged,
+        ensureManagedCredential: async (reference) => {
+            await options.credentials.ensure(reference.keyId);
+            const value = await options.credentials.read(reference.keyId);
+            if (!/^[A-Za-z0-9_-]{32,}$/.test(value))
+                fail('credential_invalid');
+        },
+        createManagedVolume: async (selection) => {
+            assertSelectionBoundary(isolation, options.portLease, selection);
+            await requiredRun(run, [
+                'volume', 'create',
+                ...Object.entries(selection.resources.labels).flatMap(([key, value]) => ['--label', `${key}=${value}`]),
+                selection.resources.volumeName,
+            ], 'volume_create_failed');
+            const snapshot = await inspectManaged(selection);
+            if (!snapshot.volume || !exactLabels(selection.resources.labels, snapshot.volume.labels)) {
+                fail('volume_create_unverified');
+            }
+        },
+        createManagedContainer: async (selection) => {
+            assertSelectionBoundary(isolation, options.portLease, selection);
+            const image = await run(['image', 'inspect', selection.imageRef]);
+            if (image.exitCode !== 0) {
+                await requiredRun(run, ['image', 'pull', selection.imageRef], 'image_pull_failed');
+            }
+            await requiredRun(run, ['image', 'inspect', selection.imageRef], 'image_digest_unverified');
+            const password = await options.credentials.read(selection.coordinates.credential.keyId);
+            if (!/^[A-Za-z0-9_-]{32,}$/.test(password))
+                fail('credential_invalid');
+            mkdirSync(isolation.paths.postgresRoot, { recursive: true, mode: 0o700 });
+            const envFile = path.join(isolation.paths.postgresRoot, 'managed-postgres.env');
+            writeFileSync(envFile, `POSTGRES_DB=${selection.coordinates.database}\nPOSTGRES_USER=${selection.coordinates.user}\nPOSTGRES_PASSWORD=${password}\n`, { flag: 'wx', mode: 0o600 });
+            await requiredRun(run, [
+                'container', 'create', '--name', selection.resources.containerName,
+                ...Object.entries(selection.resources.labels).flatMap(([key, value]) => ['--label', `${key}=${value}`]),
+                '--restart', 'no',
+                '--publish', `127.0.0.1:${selection.coordinates.port}:5432`,
+                '--mount', `type=volume,source=${selection.resources.volumeName},target=/var/lib/postgresql/data`,
+                '--env-file', envFile,
+                '--health-cmd', `pg_isready -U ${selection.coordinates.user} -d ${selection.coordinates.database}`,
+                '--health-interval', '1s', '--health-timeout', '5s', '--health-retries', '60',
+                selection.imageRef,
+                'postgres', '-c', 'log_statement=all',
+            ], 'container_create_failed');
+            const snapshot = await inspectManaged(selection);
+            if (!snapshot.container || !exactLabels(selection.resources.labels, snapshot.container.labels)) {
+                fail('container_create_unverified');
+            }
+        },
+        startManagedContainer: async (selection) => {
+            assertSelectionBoundary(isolation, options.portLease, selection);
+            await requiredRun(run, ['container', 'start', selection.resources.containerName], 'container_start_failed');
+            const deadline = Date.now() + 90_000;
+            for (;;) {
+                const health = await requiredRun(run, [
+                    'container', 'inspect', '--format', '{{json .State.Health.Status}}',
+                    selection.resources.containerName,
+                ], 'container_health_inspect_failed');
+                const status = parseJson(health.stdout.trim(), 'container_health_invalid');
+                if (status === 'healthy')
+                    break;
+                if (status === 'unhealthy')
+                    fail('container_unhealthy');
+                if (Date.now() >= deadline)
+                    fail('container_ready_timeout');
+                await new Promise((resolve) => setTimeout(resolve, 250));
+            }
+        },
+        removeManagedContainer: async (selection) => {
+            await assertOwnedBeforeStatement(selection);
+            await requiredRun(run, ['container', 'rm', '--force', selection.resources.containerName], 'container_remove_failed');
+        },
+        openReadOnly: async (selection) => {
+            if (selection.mode !== 'aops-managed-container')
+                fail('managed_surface_only');
+            await assertOwnedBeforeStatement(selection);
+            const password = await options.credentials.read(selection.coordinates.credential.keyId);
+            const url = new URL('postgresql://127.0.0.1/');
+            url.username = selection.coordinates.user;
+            url.password = password;
+            url.port = String(selection.coordinates.port);
+            url.pathname = `/${selection.coordinates.database}`;
+            url.searchParams.set('sslmode', 'disable');
+            const client = createClient(url.toString());
+            await client.connect();
+            return Object.freeze({
+                query: async (text) => (await client.query(text)).rows,
+                close: async () => { await client.end(); },
+            });
+        },
+    });
+}

package/dist/lib/commercial-setup-readiness-adapter.js

@@ -0,0 +1,179 @@
+import { createHash } from 'node:crypto';
+import { applyCommunityStrictPgSchema, } from '@aopslabs/aops-pg-bootstrap';
+import { Client } from 'pg';
+import { runCommunityNativeMigration, } from './community-native-migration.js';
+const SHA256 = /^sha256:[a-f0-9]{64}$/;
+function stableLockCoordinates(migrationSetDigest) {
+    if (!SHA256.test(migrationSetDigest))
+        throw new Error('commercial_setup_migration_digest_invalid');
+    const digest = createHash('sha256')
+        .update('aops-commercial-setup-production-migration-lock-v1\0', 'utf8')
+        .update(migrationSetDigest, 'utf8')
+        .digest();
+    return Object.freeze({
+        lockId: `migration:${digest.toString('hex')}`,
+        classId: digest.readInt32BE(0),
+        objectId: digest.readInt32BE(4),
+        migrationSetDigest,
+    });
+}
+export function productionMigrationLockCoordinates(migrationSetDigest) {
+    return stableLockCoordinates(migrationSetDigest);
+}
+export function createPgProductionMigrationSessionAuthority(options) {
+    return async (request) => {
+        let connectionString = '';
+        try {
+            connectionString = await options.readConnectionString();
+            if (!connectionString || /[\u0000\r\n]/.test(connectionString)) {
+                throw new Error('invalid-private-channel');
+            }
+        }
+        catch {
+            throw new Error('commercial_setup_postgres_credential_unavailable');
+        }
+        const client = options.createClient?.(connectionString) ??
+            new Client({ connectionString });
+        try {
+            await client.connect();
+            const lock = await client.query('SELECT pg_try_advisory_lock($1, $2) AS acquired', [request.classId, request.objectId]);
+            if (lock.rows[0]?.acquired !== true) {
+                await client.end().catch(() => undefined);
+                return null;
+            }
+        }
+        catch {
+            await client.end().catch(() => undefined);
+            throw new Error('commercial_setup_migration_lock_open_failed');
+        }
+        let released = false;
+        const release = async () => {
+            if (released)
+                throw new Error('commercial_setup_migration_session_already_released');
+            released = true;
+            try {
+                const unlocked = await client.query('SELECT pg_advisory_unlock($1, $2) AS unlocked', [request.classId, request.objectId]);
+                if (unlocked.rows[0]?.unlocked !== true) {
+                    throw new Error('lock-not-held');
+                }
+            }
+            catch {
+                throw new Error('commercial_setup_migration_lock_release_failed');
+            }
+            finally {
+                await client.end().catch(() => undefined);
+                connectionString = '';
+            }
+        };
+        return Object.freeze({
+            lockId: request.lockId,
+            apply: async (applyRequest) => {
+                if (released)
+                    throw new Error('commercial_setup_migration_session_not_held');
+                try {
+                    return await options.runProductionMigrations(applyRequest, { client, connectionString });
+                }
+                catch {
+                    throw new Error('commercial_setup_production_migration_failed');
+                }
+            },
+            release,
+        });
+    };
+}
+export function createCommunityNativeProductionMigrationRunner(options) {
+    return async (request, context) => {
+        const borrowedClient = Object.freeze({
+            connect: async () => undefined,
+            query: context.client.query.bind(context.client),
+            end: async () => undefined,
+        });
+        await runCommunityNativeMigration({
+            ...options.invocation,
+            repoUrl: context.connectionString,
+        }, {
+            applyStrictPgSchema: async (params) => applyCommunityStrictPgSchema({
+                ...params,
+                clientFactory: () => borrowedClient,
+            }),
+        });
+        return Object.freeze({
+            status: 'applied',
+            appliedMigrationIds: Object.freeze(request.pending.map((migration) => migration.id)),
+            reconciledSystemRowIds: Object.freeze(request.systemRows.map((row) => row.id)),
+            failedMigrationId: null,
+        });
+    };
+}
+export function createExistingOfficialCatalogReadinessAuthority(options) {
+    return async (request) => {
+        const result = await options.provider.reconcile({
+            fromRelease: options.fromRelease,
+            apiBaseUrl: options.apiBaseUrl,
+            timeoutMs: options.timeoutMs,
+            idempotencyKey: `setup-readiness:${request.planId}:${request.catalogDigest}`,
+        });
+        if (result.state !== 'current' || result.historyDeleteCount !== 0 || result.activationEffects.length !== 0) {
+            throw new Error('commercial_setup_catalog_reconcile_not_current');
+        }
+        return Object.freeze({ reconciledEntryIds: Object.freeze([...request.entryIds]) });
+    };
+}
+export function createExistingAgentAssetsReadinessAuthority(options) {
+    return async (request) => {
+        if (!options.provider.apply)
+            throw new Error('commercial_setup_agent_assets_provider_unavailable');
+        const result = await options.provider.apply({
+            action: 'install',
+            fromRelease: options.fromRelease,
+            target: 'all',
+        });
+        if (result.availability !== 'available' || result.state !== 'ready') {
+            throw new Error('commercial_setup_agent_assets_not_ready');
+        }
+        return Object.freeze({ installedBindingKeys: Object.freeze([...request.bindingKeys]) });
+    };
+}
+function sameLockRequest(left, right) {
+    return left.planId === right.planId &&
+        left.migrationSetDigest === right.migrationSetDigest;
+}
+export function createCommercialSetupReadinessAdapter(authorities) {
+    const active = new Map();
+    return Object.freeze({
+        inspectLiveReadiness: async (...request) => authorities.inspectLiveReadiness(...request),
+        tryAcquireProductionMigrationLock: async (request) => {
+            const coordinates = stableLockCoordinates(request.migrationSetDigest);
+            if (active.has(coordinates.lockId))
+                return null;
+            const session = await authorities.tryOpenProductionMigrationSession({
+                ...request,
+                ...coordinates,
+            });
+            if (!session)
+                return null;
+            if (session.lockId !== coordinates.lockId) {
+                await session.release().catch(() => undefined);
+                throw new Error('commercial_setup_migration_session_binding_mismatch');
+            }
+            active.set(coordinates.lockId, Object.freeze({ request: Object.freeze({ ...request }), session }));
+            return Object.freeze({ lockId: coordinates.lockId });
+        },
+        applyProductionMigrations: async (request) => {
+            const held = active.get(request.lock.lockId);
+            if (!held || !sameLockRequest(held.request, request)) {
+                throw new Error('commercial_setup_migration_session_not_held');
+            }
+            return held.session.apply(request);
+        },
+        releaseProductionMigrationLock: async (lock) => {
+            const held = active.get(lock.lockId);
+            if (!held)
+                throw new Error('commercial_setup_migration_session_not_held');
+            active.delete(lock.lockId);
+            await held.session.release();
+        },
+        reconcileOfficialCatalog: async (request) => authorities.reconcileOfficialCatalog(request),
+        installVerifiedAgentAssets: async (request) => authorities.installVerifiedAgentAssets(request),
+    });
+}