@artenx/dshb 0.1.18 → 0.1.20

package/lib/core/sync/node-sync.js

@@ -0,0 +1,660 @@
+import { HybridLogicalClock, compareSyncRevision } from "./revision.js";
+import { isNonNegativeSafeInteger, isRecord, syncRecordKey } from "./model.js";
+import { createHash } from "node:crypto";
+//#region src/core/sync/node-sync.ts
+const MAX_NODE_RECORDS = 1e4;
+const MAX_SECRET_BYTES = 65536;
+var SyncNodeManifestError = class extends Error {
+	constructor(message = "invalid node sync manifest") {
+		super(message);
+		this.name = "SyncNodeManifestError";
+	}
+};
+var SyncNodeInUseError = class extends Error {
+	workspaces;
+	constructor(workspaces) {
+		super("node is still bound to active workspaces");
+		this.workspaces = workspaces;
+		this.name = "SyncNodeInUseError";
+	}
+};
+function canonicalJson(value) {
+	if (value === null || typeof value !== "object") return JSON.stringify(value);
+	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+	const object = value;
+	return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(object[key])}`).join(",")}}`;
+}
+function nodeDigest(profile, secrets, credentialsRequired) {
+	const canonicalSecrets = secrets && Object.keys(secrets).length > 0 ? secrets : null;
+	return `sha256:${createHash("sha256").update(canonicalJson({
+		profile,
+		secrets: canonicalSecrets,
+		credentialsRequired
+	})).digest("hex")}`;
+}
+function tombstoneDigest(metadata) {
+	const origin = {
+		originInstanceId: metadata.originInstanceId,
+		originEntityId: metadata.originEntityId
+	};
+	return `sha256:${createHash("sha256").update(canonicalJson({
+		kind: "node",
+		origin,
+		deleted: true
+	})).digest("hex")}`;
+}
+function syncable(node) {
+	return (node.type === "remote-ssh" || node.type === "remote-docker") && Boolean(node.ssh);
+}
+function sanitizedProfile(node) {
+	if (!syncable(node)) throw new Error("node is outside the sync scope");
+	return {
+		name: node.name,
+		type: node.type,
+		ssh: {
+			host: node.ssh.host,
+			port: node.ssh.port,
+			username: node.ssh.username,
+			auth: { kind: node.ssh.auth.kind },
+			...node.ssh.jump ? { jump: node.ssh.jump.map(({ host, port, username }) => ({
+				host,
+				...port ? { port } : {},
+				...username ? { username } : {}
+			})) } : {},
+			...node.ssh.hostKeyFingerprint ? { hostKeyFingerprint: node.ssh.hostKeyFingerprint } : {}
+		},
+		...node.docker ? { docker: {
+			...node.docker,
+			...node.docker.resources ? { resources: { ...node.docker.resources } } : {}
+		} } : {}
+	};
+}
+function credentialsRequired(profile, secrets) {
+	if (profile.ssh.auth.kind === "agent") return true;
+	if (profile.ssh.auth.kind === "password") return !secrets?.password;
+	return !secrets?.privateKey;
+}
+function shareableSecrets(profile, secrets) {
+	if (profile.ssh.auth.kind === "agent") return void 0;
+	if (profile.ssh.auth.kind === "password") return secrets?.password ? { password: secrets.password } : void 0;
+	return secrets?.privateKey ? {
+		privateKey: secrets.privateKey,
+		...secrets.passphrase ? { passphrase: secrets.passphrase } : {}
+	} : void 0;
+}
+function text(value, label, maxLength) {
+	if (typeof value !== "string" || !value.trim() || value.length > maxLength || /[\u0000-\u001f\u007f]/.test(value)) throw new Error(`invalid node sync ${label}`);
+	return value.trim();
+}
+function parseSsh(value) {
+	if (!isRecord(value)) throw new Error("invalid node sync SSH configuration");
+	const allowed = /* @__PURE__ */ new Set([
+		"host",
+		"port",
+		"username",
+		"auth",
+		"jump",
+		"hostKeyFingerprint"
+	]);
+	if (Object.keys(value).some((key) => !allowed.has(key))) throw new Error("unsupported node sync SSH field");
+	if (!Number.isSafeInteger(value.port) || value.port < 1 || value.port > 65535) throw new Error("invalid node sync SSH port");
+	if (!isRecord(value.auth) || ![
+		"password",
+		"key",
+		"agent"
+	].includes(String(value.auth.kind))) throw new Error("invalid node sync SSH auth method");
+	if (Object.keys(value.auth).some((key) => key !== "kind")) throw new Error("SSH key paths cannot be imported");
+	const jump = value.jump;
+	if (jump !== void 0 && !Array.isArray(jump)) throw new Error("invalid node sync SSH jump list");
+	const parsedJump = jump?.map((hop) => {
+		if (!isRecord(hop) || Object.keys(hop).some((key) => ![
+			"host",
+			"port",
+			"username"
+		].includes(key))) throw new Error("invalid node sync SSH jump hop");
+		if (hop.port !== void 0 && (!Number.isSafeInteger(hop.port) || hop.port < 1 || hop.port > 65535)) throw new Error("invalid node sync SSH jump port");
+		const host = text(hop.host, "SSH jump host", 255);
+		const username = hop.username === void 0 ? void 0 : text(hop.username, "SSH jump username", 128);
+		if (/\s/.test(host) || username !== void 0 && /\s/.test(username)) throw new Error("invalid node sync SSH jump address");
+		return {
+			host,
+			...hop.port === void 0 ? {} : { port: hop.port },
+			...username === void 0 ? {} : { username }
+		};
+	});
+	const fingerprint = value.hostKeyFingerprint;
+	if (fingerprint !== void 0 && (typeof fingerprint !== "string" || !/^SHA256:[A-Za-z0-9+/]{43}$/.test(fingerprint))) throw new Error("invalid node sync SSH host-key fingerprint");
+	const host = text(value.host, "SSH host", 255);
+	const username = text(value.username, "SSH username", 128);
+	if (/\s/.test(host) || /\s/.test(username)) throw new Error("invalid node sync SSH address");
+	return {
+		host,
+		port: value.port,
+		username,
+		auth: { kind: value.auth.kind },
+		...parsedJump ? { jump: parsedJump } : {},
+		...typeof fingerprint === "string" ? { hostKeyFingerprint: fingerprint } : {}
+	};
+}
+function parseDocker(value) {
+	if (!isRecord(value)) throw new Error("invalid node sync Docker configuration");
+	const allowed = /* @__PURE__ */ new Set([
+		"mode",
+		"containerId",
+		"image",
+		"resources"
+	]);
+	if (Object.keys(value).some((key) => !allowed.has(key))) throw new Error("unsupported node sync Docker field");
+	if (value.mode !== "existing" && value.mode !== "managed") throw new Error("invalid node sync Docker mode");
+	const containerId = value.containerId === void 0 ? void 0 : text(value.containerId, "Docker container ID", 256);
+	const image = value.image === void 0 ? void 0 : text(value.image, "Docker image", 512);
+	let resources;
+	if (value.resources !== void 0) {
+		if (!isRecord(value.resources) || Object.keys(value.resources).some((key) => !["cpus", "memoryMB"].includes(key))) throw new Error("invalid node sync Docker resources");
+		const cpus = value.resources.cpus;
+		const memoryMB = value.resources.memoryMB;
+		if (cpus !== void 0 && (typeof cpus !== "number" || !Number.isFinite(cpus) || cpus <= 0)) throw new Error("invalid node sync Docker CPU limit");
+		if (memoryMB !== void 0 && (!Number.isSafeInteger(memoryMB) || memoryMB <= 0)) throw new Error("invalid node sync Docker memory limit");
+		resources = {
+			...cpus === void 0 ? {} : { cpus },
+			...memoryMB === void 0 ? {} : { memoryMB }
+		};
+	}
+	return {
+		mode: value.mode,
+		...containerId === void 0 ? {} : { containerId },
+		...image === void 0 ? {} : { image },
+		...resources ? { resources } : {}
+	};
+}
+function parseProfile(value) {
+	if (!isRecord(value)) throw new Error("invalid node sync profile");
+	if (Object.keys(value).some((key) => ![
+		"name",
+		"type",
+		"ssh",
+		"docker"
+	].includes(key))) throw new Error("unsupported node sync profile field");
+	if (value.type !== "remote-ssh" && value.type !== "remote-docker") throw new Error("local nodes cannot be imported");
+	const ssh = parseSsh(value.ssh);
+	if (value.type === "remote-ssh" && value.docker !== void 0) throw new Error("SSH node contains Docker configuration");
+	if (value.type === "remote-docker" && value.docker === void 0) throw new Error("remote Docker node requires Docker configuration");
+	return {
+		name: text(value.name, "name", 64),
+		type: value.type,
+		ssh,
+		...value.docker === void 0 ? {} : { docker: parseDocker(value.docker) }
+	};
+}
+function parseSecrets(value) {
+	if (value === void 0) return void 0;
+	if (!isRecord(value) || Object.keys(value).some((key) => ![
+		"password",
+		"privateKey",
+		"passphrase"
+	].includes(key))) throw new Error("invalid node sync secret payload");
+	const result = {};
+	for (const key of [
+		"password",
+		"privateKey",
+		"passphrase"
+	]) {
+		const secret = value[key];
+		if (secret === void 0) continue;
+		if (typeof secret !== "string" || Buffer.byteLength(secret, "utf8") > MAX_SECRET_BYTES || secret.includes("\0")) throw new Error(`invalid node sync secret: ${key}`);
+		if (secret) result[key] = secret;
+	}
+	return Object.keys(result).length > 0 ? result : void 0;
+}
+function validateMetadata(value) {
+	const safeText = (input) => typeof input === "string" && input.length > 0 && input.length <= 512 && !/[\u0000-\u001f\u007f]/.test(input);
+	if (!isRecord(value) || value.kind !== "node" || !safeText(value.originInstanceId) || !safeText(value.originEntityId) || !safeText(value.localEntityId) || !isRecord(value.revision) || !isNonNegativeSafeInteger(value.revision.physicalTimeMs) || !isNonNegativeSafeInteger(value.revision.logicalCounter) || !safeText(value.revision.writerInstanceId) || typeof value.contentDigest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(value.contentDigest) || value.deleted !== void 0 && typeof value.deleted !== "boolean" || value.pendingRemoval !== void 0 && typeof value.pendingRemoval !== "boolean" || value.credentialsRequired !== void 0 && typeof value.credentialsRequired !== "boolean" || value.importedVia !== void 0 && value.importedVia !== "peer" && value.importedVia !== "offline" || value.sourceName !== void 0 && !safeText(value.sourceName)) throw new Error("invalid node sync metadata");
+	return value;
+}
+function makeTombstone(metadata, revision) {
+	const origin = {
+		originInstanceId: metadata.originInstanceId,
+		originEntityId: metadata.originEntityId
+	};
+	return {
+		...metadata,
+		revision,
+		contentDigest: tombstoneDigest(origin),
+		deleted: true,
+		pendingRemoval: false
+	};
+}
+function makePlaceholderLocalId(origin) {
+	return `t-${createHash("sha256").update(canonicalJson(origin)).digest("hex").slice(0, 24)}`;
+}
+function makeImportedLocalId(origin) {
+	return `s-${createHash("sha256").update(canonicalJson(origin)).digest("hex").slice(0, 32)}`;
+}
+var SyncNodeService = class {
+	registry;
+	bindings;
+	state;
+	getWorkspaceRegistry;
+	disposeWorld;
+	mutationTail = Promise.resolve();
+	constructor(registry, bindings, state, getWorkspaceRegistry, disposeWorld) {
+		this.registry = registry;
+		this.bindings = bindings;
+		this.state = state;
+		this.getWorkspaceRegistry = getWorkspaceRegistry;
+		this.disposeWorld = disposeWorld;
+	}
+	exportManifest() {
+		return this.serializeMutation(() => this.exportManifestNow());
+	}
+	async exportManifestNow() {
+		const instanceId = this.state.instanceId();
+		const initial = this.state.read();
+		const clock = new HybridLogicalClock(instanceId, initial.clock);
+		const records = new Map(Object.entries(initial.records));
+		const changed = /* @__PURE__ */ new Map();
+		const localRecords = /* @__PURE__ */ new Map();
+		for (const metadata of records.values()) {
+			if (metadata.kind !== "node") continue;
+			const existing = localRecords.get(metadata.localEntityId);
+			if (!existing || compareSyncRevision(metadata.revision, existing.revision) > 0) localRecords.set(metadata.localEntityId, metadata);
+		}
+		const entries = [];
+		for (const node of this.registry.list()) {
+			if (!syncable(node)) continue;
+			const profile = sanitizedProfile(node);
+			const secrets = shareableSecrets(profile, parseSecrets(await this.registry.getSecrets(node.id)));
+			const credentialsNeeded = credentialsRequired(profile, secrets);
+			const digest = nodeDigest(profile, secrets, credentialsNeeded);
+			const current = localRecords.get(node.id);
+			if (current?.deleted) continue;
+			let metadata = current;
+			if (!metadata || metadata.contentDigest !== digest || metadata.credentialsRequired !== credentialsNeeded) {
+				const revision = clock.tick();
+				metadata = {
+					...current ?? {
+						kind: "node",
+						originInstanceId: instanceId,
+						originEntityId: node.id,
+						localEntityId: node.id
+					},
+					kind: "node",
+					localEntityId: node.id,
+					revision,
+					contentDigest: digest,
+					deleted: false,
+					pendingRemoval: false,
+					credentialsRequired: credentialsNeeded
+				};
+				const key = syncRecordKey("node", metadata);
+				records.set(key, metadata);
+				localRecords.set(node.id, metadata);
+				changed.set(key, metadata);
+			}
+			entries.push({
+				metadata,
+				profile,
+				...secrets ? { secrets } : {}
+			});
+		}
+		for (const metadata of records.values()) if (metadata.kind === "node" && metadata.deleted && !entries.some((entry) => sameOrigin(entry.metadata, metadata))) entries.push({ metadata });
+		if (changed.size > 0) this.state.update((state) => {
+			mergeClock(state, clock.snapshot());
+			for (const [key, metadata] of changed) state.records[key] = metadata;
+		});
+		return {
+			protocolVersion: 1,
+			instanceId,
+			records: entries
+		};
+	}
+	validateManifest(value) {
+		if (!Array.isArray(value) || value.length > MAX_NODE_RECORDS) throw new SyncNodeManifestError();
+		try {
+			const entries = value.map(parseEntry);
+			const keys = entries.map((entry) => syncRecordKey("node", entry.metadata));
+			if (new Set(keys).size !== keys.length) throw new Error("duplicate origins");
+			return entries;
+		} catch (error) {
+			throw new SyncNodeManifestError(error instanceof Error ? error.message : "invalid node sync manifest");
+		}
+	}
+	async preflightManifest(value) {
+		const entries = this.validateManifest(value);
+		const localInstanceId = this.state.instanceId();
+		const state = this.state.read();
+		for (const entry of entries) {
+			const { metadata } = entry;
+			const current = state.records[syncRecordKey("node", metadata)];
+			if (current) {
+				if (compareSyncRevision(metadata.revision, current.revision) === 0 && (metadata.contentDigest !== current.contentDigest || Boolean(metadata.deleted) !== Boolean(current.deleted))) throw new SyncNodeManifestError("conflicting node records share the same revision");
+				continue;
+			}
+			if (metadata.originInstanceId !== localInstanceId || metadata.deleted) continue;
+			const local = this.registry.get(metadata.originEntityId);
+			if (!local) continue;
+			const profile = sanitizedProfile(local);
+			const secrets = shareableSecrets(profile, parseSecrets(await this.registry.getSecrets(local.id)));
+			if (nodeDigest(profile, secrets, credentialsRequired(profile, secrets)) !== metadata.contentDigest) throw new SyncNodeManifestError("local origin metadata is missing for a changed node");
+		}
+	}
+	applyManifest(value, sourceName, importedVia = "peer") {
+		return this.serializeMutation(() => this.applyManifestNow(value, sourceName, importedVia));
+	}
+	async applyManifestNow(value, sourceName, importedVia) {
+		await this.preflightManifest(value);
+		const entries = this.validateManifest(value);
+		let safeSourceName;
+		try {
+			safeSourceName = text(sourceName, "source name", 128);
+		} catch (error) {
+			throw new SyncNodeManifestError(error instanceof Error ? error.message : "invalid node sync manifest");
+		}
+		const result = {
+			created: 0,
+			updated: 0,
+			deleted: 0,
+			pendingRemoval: 0,
+			skipped: 0
+		};
+		const localInstanceId = this.state.instanceId();
+		const initial = this.state.read();
+		const clock = new HybridLogicalClock(localInstanceId, initial.clock);
+		const records = new Map(Object.entries(initial.records));
+		const changed = /* @__PURE__ */ new Map();
+		for (const entry of entries) {
+			const { metadata } = entry;
+			const key = syncRecordKey("node", metadata);
+			const current = records.get(key);
+			if (metadata.originInstanceId === localInstanceId && !current) {
+				const local = this.registry.get(metadata.originEntityId);
+				if (local && !metadata.deleted) {
+					const localProfile = sanitizedProfile(local);
+					const localSecrets = shareableSecrets(localProfile, parseSecrets(await this.registry.getSecrets(local.id)));
+					if (nodeDigest(localProfile, localSecrets, credentialsRequired(localProfile, localSecrets)) !== metadata.contentDigest) throw new SyncNodeManifestError("local origin metadata is missing for a changed node");
+					clock.observe(metadata.revision);
+					const localMetadata = {
+						...metadata,
+						localEntityId: local.id,
+						importedVia: void 0,
+						sourceName: void 0
+					};
+					records.set(key, localMetadata);
+					changed.set(key, localMetadata);
+					this.state.update((state) => {
+						mergeClock(state, clock.snapshot());
+						state.records[key] = localMetadata;
+					});
+					result.skipped += 1;
+					continue;
+				}
+			}
+			if (current) {
+				const comparison = compareSyncRevision(metadata.revision, current.revision);
+				if (comparison < 0) {
+					result.skipped += 1;
+					continue;
+				}
+				if (comparison === 0) {
+					if (metadata.contentDigest !== current.contentDigest || Boolean(metadata.deleted) !== Boolean(current.deleted)) throw new SyncNodeManifestError("conflicting node records share the same revision");
+					result.skipped += 1;
+					continue;
+				}
+			}
+			clock.observe(metadata.revision);
+			const mappedLocalId = current?.deleted && current.localEntityId.startsWith("t-") ? void 0 : current?.localEntityId;
+			if (metadata.deleted) {
+				const localId = mappedLocalId ?? (metadata.originInstanceId === localInstanceId ? metadata.originEntityId : makePlaceholderLocalId(metadata));
+				const pendingMetadata = {
+					...metadata,
+					localEntityId: localId,
+					importedVia: metadata.originInstanceId === localInstanceId ? void 0 : importedVia,
+					sourceName: metadata.originInstanceId === localInstanceId ? void 0 : safeSourceName,
+					pendingRemoval: true
+				};
+				this.saveRecord(pendingMetadata);
+				records.set(key, pendingMetadata);
+				changed.set(key, pendingMetadata);
+				if (this.hasActiveBinding(localId)) result.pendingRemoval += 1;
+				else {
+					await this.removeNodeAndStaleBindings(localId);
+					const tombstoneMetadata = {
+						...metadata,
+						localEntityId: localId,
+						importedVia: metadata.originInstanceId === localInstanceId ? void 0 : importedVia,
+						sourceName: metadata.originInstanceId === localInstanceId ? void 0 : safeSourceName,
+						pendingRemoval: false
+					};
+					records.set(key, tombstoneMetadata);
+					changed.set(key, tombstoneMetadata);
+					this.saveRecord(tombstoneMetadata);
+					result.deleted += 1;
+				}
+				continue;
+			}
+			if (!entry.profile) throw new SyncNodeManifestError("node profile is missing from active manifest record");
+			const input = toNodeCreateInput(entry.profile, entry.secrets);
+			const localId = mappedLocalId ?? (metadata.originInstanceId === localInstanceId ? metadata.originEntityId : makeImportedLocalId(metadata));
+			let node;
+			if (this.registry.get(localId)) {
+				node = await this.registry.updateImported(localId, input);
+				result.updated += 1;
+			} else {
+				node = await this.registry.createImported(input, localId);
+				result.created += 1;
+			}
+			this.disposeWorld?.(node.id);
+			const appliedMetadata = {
+				...metadata,
+				localEntityId: node.id,
+				importedVia: metadata.originInstanceId === localInstanceId ? void 0 : importedVia,
+				sourceName: metadata.originInstanceId === localInstanceId ? void 0 : safeSourceName,
+				deleted: false,
+				pendingRemoval: false,
+				credentialsRequired: credentialsRequired(entry.profile, entry.secrets)
+			};
+			records.set(key, appliedMetadata);
+			changed.set(key, appliedMetadata);
+			this.state.update((state) => {
+				mergeClock(state, clock.snapshot());
+				state.records[key] = appliedMetadata;
+			});
+		}
+		const finalClock = clock.snapshot();
+		if (changed.size > 0 || finalClock.physicalTimeMs !== initial.clock.physicalTimeMs || finalClock.logicalCounter !== initial.clock.logicalCounter) this.state.update((state) => {
+			mergeClock(state, finalClock);
+			for (const [key, metadata] of changed) state.records[key] = metadata;
+		});
+		return result;
+	}
+	removeLocalNode(nodeId, remove) {
+		return this.serializeMutation(() => this.removeLocalNodeNow(nodeId, remove));
+	}
+	async removeLocalNodeNow(nodeId, remove) {
+		const node = this.registry.get(nodeId);
+		if (!node || !syncable(node)) {
+			await remove();
+			return;
+		}
+		const active = this.activeBindings(nodeId);
+		if (active.length > 0) throw new SyncNodeInUseError(active.map((binding) => binding.workspaceId ?? binding.mirrorPath));
+		const current = findNodeRecord(Object.values(this.state.read().records), nodeId);
+		const instanceId = this.state.instanceId();
+		const tombstone = {
+			...makeTombstone(current ?? {
+				kind: "node",
+				originInstanceId: instanceId,
+				originEntityId: nodeId,
+				localEntityId: nodeId,
+				revision: {
+					physicalTimeMs: 0,
+					logicalCounter: 0,
+					writerInstanceId: instanceId
+				},
+				contentDigest: ""
+			}, this.state.nextRevision()),
+			pendingRemoval: true
+		};
+		const key = syncRecordKey("node", tombstone);
+		this.saveRecord(tombstone);
+		try {
+			await remove();
+			this.saveRecord({
+				...tombstone,
+				pendingRemoval: false
+			});
+		} catch (error) {
+			this.state.update((state) => {
+				if (current) state.records[key] = current;
+				else delete state.records[key];
+			});
+			throw error;
+		}
+	}
+	view(nodeId) {
+		return this.views([nodeId]).get(nodeId);
+	}
+	views(nodeIds) {
+		const wanted = new Set(nodeIds);
+		const metadataById = /* @__PURE__ */ new Map();
+		for (const metadata of Object.values(this.state.read().records)) {
+			if (metadata.kind !== "node" || !wanted.has(metadata.localEntityId)) continue;
+			const current = metadataById.get(metadata.localEntityId);
+			if (!current || compareSyncRevision(metadata.revision, current.revision) > 0) metadataById.set(metadata.localEntityId, metadata);
+		}
+		const views = /* @__PURE__ */ new Map();
+		for (const [localId, metadata] of metadataById) views.set(localId, {
+			...metadata.importedVia ? { importedVia: metadata.importedVia } : {},
+			...metadata.sourceName ? { sourceName: metadata.sourceName } : {},
+			pendingRemoval: Boolean(metadata.deleted && metadata.pendingRemoval),
+			...metadata.credentialsRequired === void 0 ? {} : { credentialsRequired: metadata.credentialsRequired }
+		});
+		return views;
+	}
+	isPendingRemoval(nodeId) {
+		return this.view(nodeId)?.pendingRemoval ?? false;
+	}
+	originForLocalNode(nodeId) {
+		const metadata = findNodeRecord(Object.values(this.state.read().records), nodeId);
+		return !metadata || metadata.deleted ? void 0 : {
+			originInstanceId: metadata.originInstanceId,
+			originEntityId: metadata.originEntityId
+		};
+	}
+	localNodeIdForOrigin(origin) {
+		const metadata = Object.values(this.state.read().records).filter((record) => record.kind === "node" && record.originInstanceId === origin.originInstanceId && record.originEntityId === origin.originEntityId).sort((a, b) => compareSyncRevision(b.revision, a.revision))[0];
+		return !metadata || metadata.deleted ? void 0 : metadata.localEntityId;
+	}
+	withAvailableRemoteNode(origin, operation) {
+		return this.serializeMutation(async () => {
+			const nodeId = this.localNodeIdForOrigin(origin);
+			const node = nodeId ? this.registry.get(nodeId) : void 0;
+			if (!node || !syncable(node) || this.isPendingRemoval(node.id)) return void 0;
+			return operation(node.id);
+		});
+	}
+	reconcilePendingRemovals() {
+		return this.serializeMutation(() => this.reconcilePendingRemovalsNow());
+	}
+	async reconcilePendingRemovalsNow() {
+		const records = Object.values(this.state.read().records).filter((metadata) => metadata.kind === "node" && metadata.deleted && metadata.pendingRemoval);
+		for (const metadata of records) {
+			if (this.hasActiveBinding(metadata.localEntityId)) continue;
+			await this.removeNodeAndStaleBindings(metadata.localEntityId);
+			this.saveRecord({
+				...metadata,
+				pendingRemoval: false
+			});
+		}
+	}
+	hasActiveBinding(nodeId) {
+		return this.activeBindings(nodeId).length > 0;
+	}
+	activeBindings(nodeId) {
+		const bindings = this.bindings.list().filter((binding) => binding.nodeId === nodeId);
+		if (bindings.length === 0) return [];
+		let registry;
+		try {
+			registry = this.getWorkspaceRegistry?.();
+		} catch {}
+		if (!registry) return bindings;
+		try {
+			const activePaths = new Set(registry.list().map((workspace) => workspace.path));
+			return bindings.filter((binding) => activePaths.has(binding.mirrorPath));
+		} catch {
+			return bindings;
+		}
+	}
+	async removeNodeAndStaleBindings(nodeId) {
+		const bindings = this.bindings.list().filter((binding) => binding.nodeId === nodeId);
+		let activePaths;
+		try {
+			const registry = this.getWorkspaceRegistry?.();
+			if (registry) activePaths = new Set(registry.list().map((workspace) => workspace.path));
+		} catch {}
+		for (const binding of bindings) {
+			if (activePaths?.has(binding.mirrorPath)) continue;
+			this.bindings.remove(binding.mirrorPath);
+		}
+		if (this.registry.get(nodeId)) {
+			await this.registry.removeImported(nodeId);
+			this.disposeWorld?.(nodeId);
+		} else await this.registry.removeImported(nodeId);
+	}
+	saveRecord(metadata) {
+		const key = syncRecordKey("node", metadata);
+		this.state.update((state) => {
+			state.records[key] = metadata;
+		});
+	}
+	serializeMutation(operation) {
+		const result = this.mutationTail.then(operation);
+		this.mutationTail = result.then(() => void 0, () => void 0);
+		return result;
+	}
+};
+function mergeClock(state, incoming) {
+	if (incoming.physicalTimeMs > state.clock.physicalTimeMs || incoming.physicalTimeMs === state.clock.physicalTimeMs && incoming.logicalCounter > state.clock.logicalCounter) state.clock = incoming;
+}
+function findNodeRecord(records, localId) {
+	return [...records].filter((metadata) => metadata.kind === "node" && metadata.localEntityId === localId).sort((a, b) => compareSyncRevision(b.revision, a.revision))[0];
+}
+function sameOrigin(a, b) {
+	return a.kind === b.kind && a.originInstanceId === b.originInstanceId && a.originEntityId === b.originEntityId;
+}
+function toNodeCreateInput(profile, secrets) {
+	return {
+		name: profile.name,
+		type: profile.type,
+		ssh: profile.ssh,
+		...profile.docker ? { docker: profile.docker } : {},
+		...secrets ? { secrets } : {}
+	};
+}
+function parseEntry(value) {
+	if (!isRecord(value)) throw new Error("invalid node sync entry");
+	const metadata = validateMetadata(value.metadata);
+	if (metadata.deleted) {
+		if (value.profile !== void 0 || value.secrets !== void 0 || metadata.contentDigest !== tombstoneDigest(metadata)) throw new Error("invalid node sync tombstone");
+		return { metadata };
+	}
+	const profile = parseProfile(value.profile);
+	const rawSecrets = parseSecrets(value.secrets);
+	if (profile.ssh.auth.kind === "agent" && rawSecrets || profile.ssh.auth.kind === "password" && (rawSecrets?.privateKey || rawSecrets?.passphrase) || profile.ssh.auth.kind === "key" && (rawSecrets?.password || !rawSecrets?.privateKey && rawSecrets?.passphrase)) throw new Error("node sync secrets do not match the SSH auth method");
+	const secrets = shareableSecrets(profile, rawSecrets);
+	const needed = credentialsRequired(profile, secrets);
+	if (metadata.credentialsRequired !== void 0 && metadata.credentialsRequired !== needed) throw new Error("node sync credential status does not match its payload");
+	if (metadata.contentDigest !== nodeDigest(profile, secrets, needed)) throw new Error("node sync digest mismatch");
+	return {
+		metadata: {
+			...metadata,
+			credentialsRequired: needed
+		},
+		profile,
+		...secrets ? { secrets } : {}
+	};
+}
+//#endregion
+export { SyncNodeInUseError, SyncNodeManifestError, SyncNodeService };
+
+//# sourceMappingURL=node-sync.js.map