@deksden-com/dd-flow-cli 0.9.0-beta.15 → 0.9.0-beta.150

package/dist/services/run-start-custody.js

@@ -0,0 +1,189 @@
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-digest.js";
+import { runContextRelocations, projectPacketLocators } from "./stage-context.js";
+export const runStartPayloadLimit = 64 * 1024 * 1024;
+// One exact immutable payload per database, not cached custody or returned
+// objects. Every read still checks current SQL hashes, markers and receipts.
+const validatedPayloadBytes = new WeakMap();
+export function runStartBytesSha256(bytes) { return createHash("sha256").update(bytes).digest("hex"); }
+export function refuseRunStart(reason) {
+    throw new AppError("run_start_custody_invalid", "RUN creation requires its exact retained request", 1, { reason, effect: "no_effect", next_action: "reconcile_exact_request" });
+}
+export function hasRunStartTable(context) {
+    return Boolean(context.db.get("SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name = 'run_start_requests'"));
+}
+function object(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function exactKeys(value, keys) {
+    return Object.keys(value).sort().join("\0") === keys.sort().join("\0");
+}
+function digest(value) { return typeof value === "string" && /^[a-f0-9]{64}$/.test(value); }
+function canonicalBase64(value) {
+    return typeof value === "string" && Buffer.from(value, "base64").toString("base64") === value;
+}
+/** Retained data can drive filesystem writes only after a closed shape check. */
+export function validateRunStartPayload(value) {
+    if (!object(value) || !exactKeys(value, ["schema_id", "request_id", "project_id", "project_root", "workspace_root", "home_root",
+        "run_id", "request_sha256", "bundle_sha256", "subject_type", "subject_id", "slug", "run_root", "initial_index",
+        "bundle_manifest_base64", "blobs", "artifacts", "owners", "git"]))
+        refuseRunStart("invalid_allocation_shape");
+    for (const key of ["request_id", "project_id", "run_id", "slug", "subject_type", "subject_id"])
+        if (typeof value[key] !== "string" || !value[key].trim() || value[key].length > 1024)
+            refuseRunStart("invalid_allocation_shape");
+    if (!/^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(value.project_id)
+        || !/^RUN-\d+-[a-z0-9][a-z0-9-]*$/.test(value.run_id))
+        refuseRunStart("invalid_allocation_shape");
+    for (const key of ["project_root", "workspace_root", "home_root", "run_root"])
+        if (typeof value[key] !== "string" || !path.isAbsolute(value[key]) || path.resolve(value[key]) !== value[key])
+            refuseRunStart("invalid_allocation_scope");
+    if (value.run_root !== path.join(value.home_root, "projects", value.project_id, "runs", value.run_id)
+        || !digest(value.request_sha256) || !digest(value.bundle_sha256) || !canonicalBase64(value.bundle_manifest_base64)
+        || runStartBytesSha256(Buffer.from(value.bundle_manifest_base64, "base64")) !== value.bundle_sha256
+        || !object(value.initial_index) || !object(value.owners) || !exactKeys(value.owners, ["home", "project", "workspace"]))
+        refuseRunStart("invalid_allocation_shape");
+    for (const key of ["home", "project", "workspace"]) {
+        const owner = value.owners[key];
+        if (!object(owner) || !exactKeys(owner, ["dev", "ino"]) || ![owner.dev, owner.ino].every(number => Number.isSafeInteger(number) && Number(number) >= 0))
+            refuseRunStart("invalid_allocation_owner");
+    }
+    if (!object(value.git) || !exactKeys(value.git, ["branch", "head", "status_sha256"]) || typeof value.git.branch !== "string" || !value.git.branch
+        || value.git.head !== null && (typeof value.git.head !== "string" || !/^[a-f0-9]{40,64}$/.test(value.git.head))
+        || !digest(value.git.status_sha256))
+        refuseRunStart("invalid_allocation_git");
+    for (const key of ["blobs", "artifacts"]) {
+        const entries = value[key];
+        if (!Array.isArray(entries) || entries.length > 4096)
+            refuseRunStart("invalid_allocation_assets");
+        const seen = new Set();
+        for (const entry of entries) {
+            if (!object(entry) || !exactKeys(entry, ["path", "base64"]) || typeof entry.path !== "string"
+                || !entry.path || entry.path.includes("\\") || entry.path.includes("\0") || entry.path.split("/").some(part => !part || part === "." || part === "..")
+                || seen.has(entry.path) || !canonicalBase64(entry.base64))
+                refuseRunStart("invalid_allocation_assets");
+            const upgradeEvidence = value.initial_index.flow_kind === "mb-upgrade" && (["upgrade-baseline.json", "upgrade-target.json"].includes(entry.path)
+                || entry.path === `upgrade-target-${runStartBytesSha256(Buffer.from(entry.base64, "base64"))}.bin`
+                || entry.path === `upgrade-baseline-${runStartBytesSha256(Buffer.from(entry.base64, "base64"))}.bin`);
+            if (key === "artifacts" && (!["engine-binding.json", "operational-policy.source.md", "operational-contract.json"].includes(entry.path) && !upgradeEvidence
+                || Buffer.from(entry.base64, "base64").length > (upgradeEvidence ? 16 : 1) * 1024 * 1024))
+                refuseRunStart("invalid_allocation_artifact");
+            seen.add(entry.path);
+        }
+        if (key === "artifacts" && (!seen.has("engine-binding.json") || seen.has("operational-policy.source.md") && !seen.has("operational-contract.json")))
+            refuseRunStart("invalid_allocation_artifact");
+    }
+}
+/** Metadata and copied SQL bytes only. No engine/filesystem/provider admission. */
+export function readRunStartRequest(context, projectId, requestId) {
+    return context.db.readSnapshot(() => readRunStartRequestSnapshot(context, projectId, requestId));
+}
+function readRunStartRequestSnapshot(context, projectId, requestId) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,95}$/.test(requestId))
+        refuseRunStart("invalid_request_id");
+    const row = hasRunStartTable(context) ? context.db.get("SELECT run_id, payload_json, payload_sha256 FROM run_start_requests WHERE project_id = ? AND request_id = ?", [projectId, requestId]) : undefined;
+    const starts = context.db.all("SELECT payload_json FROM audit_events WHERE project_id = ? AND event_type = 'flow_run.start_request' AND json_extract(payload_json, '$.request_id') = ? LIMIT 2", [projectId, requestId]);
+    if (!row) {
+        const marker = context.db.get("SELECT 1 FROM runs WHERE project_id = ? AND json_extract(index_json, '$.start_request.request_id') = ? LIMIT 1", [projectId, requestId]);
+        const bound = context.db.get("SELECT 1 FROM sqlite_schema WHERE type = 'table' AND name = 'run_bundle_authorities'")
+            && context.db.get("SELECT 1 FROM run_bundle_authorities WHERE project_id = ? AND json_extract(admission_json, '$.executionScope.requestId') = ? LIMIT 1", [projectId, requestId]);
+        if (starts.length || marker || bound)
+            refuseRunStart("request_receipt_missing");
+        return null;
+    }
+    if (starts.length !== 1 || Buffer.byteLength(row.payload_json) > runStartPayloadLimit
+        || runStartBytesSha256(row.payload_json) !== row.payload_sha256)
+        refuseRunStart("allocation_changed");
+    let payload, receipt;
+    try {
+        payload = JSON.parse(row.payload_json);
+        receipt = JSON.parse(starts[0].payload_json);
+    }
+    catch {
+        return refuseRunStart("invalid_allocation_json");
+    }
+    if (validatedPayloadBytes.get(context.db) !== row.payload_json) {
+        validateRunStartPayload(payload);
+        validatedPayloadBytes.set(context.db, row.payload_json);
+    }
+    if (!object(receipt))
+        refuseRunStart("invalid_allocation_receipt");
+    const run = context.db.get("SELECT project_root, workspace_root, run_root, flow_kind, subject_type, subject_id, index_json FROM runs WHERE project_id = ? AND id = ?", [projectId, row.run_id]);
+    let index;
+    try {
+        if (!run)
+            refuseRunStart("allocated_run_missing");
+        index = JSON.parse(run.index_json);
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        return refuseRunStart("allocated_run_changed");
+    }
+    if (!object(index))
+        refuseRunStart("allocated_run_changed");
+    const marker = index.start_request, initial = payload.initial_index;
+    const relocations = runContextRelocations(context, projectId, row.run_id);
+    const currentPath = (value) => projectPacketLocators(value, relocations);
+    if (!payload || payload.schema_id !== "dd-flow/run-start-allocation@1" || payload.project_id !== projectId
+        || payload.request_id !== requestId || payload.run_id !== row.run_id || !Array.isArray(payload.blobs) || !Array.isArray(payload.artifacts)
+        || !initial || initial.run_id !== row.run_id || initial.project?.id !== projectId || initial.start_request !== undefined
+        || initial.execution_bundle?.manifest_sha256 !== payload.bundle_sha256 || !/^[a-f0-9]{64}$/.test(payload.request_sha256)
+        || !marker || marker.schema_id !== "dd-flow/run-start-request@1" || marker.request_id !== requestId
+        || marker.request_sha256 !== payload.request_sha256 || marker.allocation_sha256 !== row.payload_sha256
+        || receipt.run_id !== row.run_id || receipt.request_id !== requestId || receipt.request_sha256 !== payload.request_sha256 || receipt.allocation_sha256 !== row.payload_sha256
+        || run.project_root !== currentPath(payload.project_root) || run.workspace_root !== currentPath(payload.workspace_root) || run.run_root !== currentPath(payload.run_root)
+        || run.flow_kind !== initial.flow_kind || run.subject_id !== payload.subject_id || run.subject_type !== payload.subject_type
+        || !object(index.execution_bundle) || hybridDigest(index.execution_bundle) !== hybridDigest(initial.execution_bundle))
+        refuseRunStart("allocated_run_changed");
+    const publications = context.db.all("SELECT payload_json FROM audit_events WHERE project_id = ? AND event_type = 'flow_run.start_published' AND json_extract(payload_json, '$.run_id') = ? LIMIT 2", [projectId, row.run_id]);
+    if (publications.length > 1 || Boolean(marker.publication_sha256) !== (publications.length === 1))
+        refuseRunStart("publication_receipt_missing");
+    if (publications.length) {
+        let publication;
+        try {
+            publication = JSON.parse(publications[0].payload_json);
+        }
+        catch {
+            return refuseRunStart("invalid_publication_receipt");
+        }
+        if (!object(publication) || publication.schema_id !== "dd-flow/run-start-publication@1" || hybridDigest(publication) !== marker.publication_sha256 || publication.request_id !== requestId
+            || publication.run_id !== row.run_id || publication.allocation_sha256 !== row.payload_sha256 || publication.bundle_sha256 !== payload.bundle_sha256)
+            refuseRunStart("publication_receipt_changed");
+        const owners = context.db.all("SELECT payload_json FROM audit_events WHERE project_id = ? AND event_type = 'flow_run.start_root_owned' AND json_extract(payload_json, '$.run_id') = ? LIMIT 2", [projectId, row.run_id]);
+        if (owners.length !== 1)
+            refuseRunStart("root_ownership_receipt_missing");
+        let owner;
+        try {
+            owner = JSON.parse(owners[0].payload_json);
+        }
+        catch {
+            return refuseRunStart("root_ownership_receipt_changed");
+        }
+        if (!object(owner) || owner.schema_id !== "dd-flow/run-start-owner@1" || owner.run_id !== row.run_id || owner.request_id !== requestId
+            || owner.allocation_sha256 !== row.payload_sha256 || hybridDigest(owner) !== publication.root_owner_sha256)
+            refuseRunStart("root_ownership_receipt_changed");
+    }
+    return { payload, payloadJson: row.payload_json, sha256: row.payload_sha256, published: Boolean(marker.publication_sha256) };
+}
+/** Lost markers/receipts cannot silently become legacy mutable execution. */
+export function assertRunStartupSettled(context, projectId, runId) {
+    const run = context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [projectId, runId]);
+    let marker;
+    try {
+        marker = run ? JSON.parse(run.index_json).start_request : undefined;
+    }
+    catch {
+        return refuseRunStart("allocated_run_changed");
+    }
+    const row = hasRunStartTable(context) ? context.db.get("SELECT request_id FROM run_start_requests WHERE project_id = ? AND run_id = ?", [projectId, runId]) : undefined;
+    const audit = context.db.get("SELECT json_extract(payload_json, '$.request_id') AS request_id FROM audit_events WHERE project_id = ? AND event_type = 'flow_run.start_request' AND json_extract(payload_json, '$.run_id') = ? LIMIT 1", [projectId, runId]);
+    if (!marker && !row && !audit)
+        return;
+    if (!marker || !row || !audit || row.request_id !== marker.request_id || audit.request_id !== marker.request_id)
+        refuseRunStart("request_receipt_missing");
+    const retained = readRunStartRequest(context, projectId, marker.request_id);
+    if (!retained?.published)
+        throw new AppError("run_start_publication_pending", "Finish the original RUN creation request before lifecycle writes", 1, { effect: "no_effect", run_id: runId, request_id: marker.request_id, next_action: "reconcile_exact_request" });
+}