@deksden-com/dd-flow-cli 0.9.0-beta.16 → 0.9.0-beta.161

package/dist/storage/foreign-key-transaction.js

@@ -0,0 +1,39 @@
+import { AppError } from "../shared/errors.js";
+/** Relocation changes related keys together; restore connection policy even
+ * when BEGIN or rollback fails, and never reuse a connection with unknown FK mode. */
+export function foreignKeyTransaction(db, operation) {
+    const foreignKeys = db.get("PRAGMA foreign_keys").foreign_keys;
+    let value, primary, failed = false, committed = false;
+    try {
+        db.exec("PRAGMA foreign_keys = OFF");
+        if (db.get("PRAGMA foreign_keys")?.foreign_keys !== 0)
+            throw new AppError("foreign_key_transaction_active", "Key relocation requires its own connection transaction", 1);
+        value = db.writeTransaction(() => { db.afterCommit(() => { committed = true; }); return operation(); });
+    }
+    catch (error) {
+        primary = error;
+        failed = true;
+    }
+    try {
+        db.exec(`PRAGMA foreign_keys = ${foreignKeys ? "ON" : "OFF"}`);
+        if (db.get("PRAGMA foreign_keys")?.foreign_keys !== foreignKeys)
+            throw new Error("Foreign-key enforcement was not restored");
+    }
+    catch (restore) {
+        const details = { foreign_keys_restore_error: String(restore), effect: committed ? "committed" : "unknown" };
+        try {
+            db.close?.();
+        }
+        catch (close) {
+            details.connection_close_error = String(close);
+        }
+        if (primary instanceof AppError)
+            Object.assign(primary.details, details);
+        else
+            primary = new AppError("foreign_key_restoration_failed", primary instanceof Error ? primary.message : "Cannot restore foreign-key enforcement", 1, { ...details, ...(failed ? { cause: String(primary) } : {}) });
+        failed = true;
+    }
+    if (failed)
+        throw primary;
+    return value;
+}

package/dist/storage/immutable-input.js

@@ -0,0 +1,45 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+/** Durable immutable candidate; only a later SQL receipt grants it authority. */
+export function publishImmutableInput(file, bytes, conflictCode) {
+    const expected = crypto.createHash("sha256").update(bytes).digest("hex");
+    const verify = () => {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink() || crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex") !== expected)
+            throw new AppError(conflictCode, "Immutable input differs from the accepted bytes", 1, { path: file, expected_sha256: expected });
+    };
+    const temporary = `${file}.tmp-${crypto.randomUUID()}`;
+    try {
+        fs.writeFileSync(temporary, bytes, { flag: "wx", mode: 0o600 });
+        const descriptor = fs.openSync(temporary, "r");
+        try {
+            fs.fsyncSync(descriptor);
+        }
+        finally {
+            fs.closeSync(descriptor);
+        }
+        try {
+            fs.linkSync(temporary, file);
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            verify();
+        }
+        const directory = fs.openSync(path.dirname(file), "r");
+        try {
+            fs.fsyncSync(directory);
+        }
+        finally {
+            fs.closeSync(directory);
+        }
+    }
+    finally {
+        try {
+            fs.rmSync(temporary, { force: true });
+        }
+        catch { /* Unreferenced staging garbage must not mask the accepted input or primary error. */ }
+    }
+}

package/dist/storage/import-guard.js

@@ -0,0 +1,159 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+import { acquireInstallationLock } from "../services/installation-lock.js";
+import { withStoreCleanup } from "./native-cleanup.js";
+/** Outside the replaced runtime tree, so a copied source receipt cannot make
+ * an incomplete target look ready. A failed target is diagnostic evidence. */
+export function importGuardPath(home) {
+    const absolute = canonicalHome(home);
+    return path.join(path.dirname(absolute), `.${path.basename(absolute)}.dd-flow-import.json`);
+}
+function canonicalHome(home) {
+    let existing = path.resolve(home);
+    const suffix = [];
+    while (!fs.existsSync(existing)) {
+        suffix.unshift(path.basename(existing));
+        existing = path.dirname(existing);
+    }
+    return path.join(fs.realpathSync(existing), ...suffix);
+}
+function readImportGuard(home) {
+    const file = importGuardPath(home);
+    if (!fs.existsSync(file))
+        return null;
+    let guard;
+    try {
+        guard = JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch {
+        throw new AppError("snapshot_import_incomplete", "Snapshot import guard is unreadable; preserve this target for diagnosis", 1, { guard_path: file });
+    }
+    if (guard.schema_id !== "dd-flow/import-guard@1" || guard.runtime_home !== canonicalHome(home)
+        || !/^[0-9a-f-]{36}$/.test(guard.import_id) || !/^[a-f0-9]{64}$/.test(guard.source_manifest_sha256)
+        || !path.isAbsolute(guard.project_root) || !path.isAbsolute(guard.workspace_root)
+        || !["in_progress", "completed"].includes(guard.status) || guard.operation !== undefined && guard.operation !== "storage-migration") {
+        throw new AppError("snapshot_import_incomplete", "Snapshot import guard does not identify this target", 1, { guard_path: file });
+    }
+    return guard;
+}
+export function assertImportAdmission(home, permit) {
+    const guard = readImportGuard(home);
+    if (guard?.status === "in_progress" && guard.import_id !== permit)
+        throw new AppError(guard.operation === "storage-migration" ? "storage_migration_incomplete" : "snapshot_import_incomplete", guard.operation === "storage-migration" ? "Storage maintenance requires reconciliation of its original request" : "Snapshot import has not completed; preserve this target for diagnosis and restore into fresh targets", 1, { guard_path: importGuardPath(home), import_id: guard.import_id });
+}
+function durableWrite(file, bytes, create, expected) {
+    const lease = acquireInstallationLock(file + ".lock", crypto.createHash("sha256").update(file).digest("hex"));
+    return withStoreCleanup(() => {
+        lease.assertOwnership();
+        // A different request may have selected maintenance since the caller read
+        // a completed guard. Never rename over its now-live admission fence.
+        if (!create && JSON.stringify(JSON.parse(fs.readFileSync(file, "utf8"))) !== JSON.stringify(expected))
+            throw new AppError("storage_guard_changed", "Re-read the current maintenance owner before continuing", 1);
+        const target = create ? file : `${file}.tmp-${crypto.randomUUID()}`;
+        try {
+            fs.writeFileSync(target, bytes, { flag: "wx", mode: 0o600 });
+            const descriptor = fs.openSync(target, "r");
+            try {
+                fs.fsyncSync(descriptor);
+            }
+            finally {
+                fs.closeSync(descriptor);
+            }
+            if (!create)
+                fs.renameSync(target, file);
+            const directory = fs.openSync(path.dirname(file), "r");
+            try {
+                fs.fsyncSync(directory);
+            }
+            finally {
+                fs.closeSync(directory);
+            }
+        }
+        finally {
+            if (!create)
+                fs.rmSync(target, { force: true });
+        }
+    }, () => lease.release());
+}
+export function beginSnapshotImport(input) {
+    const importId = crypto.randomUUID();
+    const guard = { schema_id: "dd-flow/import-guard@1", import_id: importId, status: "in_progress", source_manifest_sha256: input.sourceManifestSha256,
+        runtime_home: canonicalHome(input.home), project_root: path.resolve(input.projectRoot), workspace_root: path.resolve(input.workspaceRoot),
+        ...(input.operation ? { operation: input.operation } : {}) };
+    durableWrite(importGuardPath(input.home), `${JSON.stringify(guard)}\n`, true, null);
+    return importId;
+}
+/** Reuse the import admission fence for one exact paired storage cutover.
+ * A completed older operation may be superseded; a live one never is. */
+export function beginStorageMaintenance(input) {
+    if (!/^[0-9a-f-]{36}$/.test(input.importId) || !/^[a-f0-9]{64}$/.test(input.sourceManifestSha256))
+        throw new AppError("storage_migration_request_invalid", "Invalid retained maintenance identity", 2);
+    const guard = readImportGuard(input.home);
+    const next = { schema_id: "dd-flow/import-guard@1", import_id: input.importId, status: "in_progress",
+        source_manifest_sha256: input.sourceManifestSha256, runtime_home: canonicalHome(input.home),
+        project_root: path.resolve(input.projectRoot), workspace_root: path.resolve(input.workspaceRoot), operation: "storage-migration" };
+    if (guard?.import_id === input.importId && guard.source_manifest_sha256 === input.sourceManifestSha256
+        && guard.project_root === next.project_root && guard.workspace_root === next.workspace_root && guard.operation === next.operation)
+        return;
+    if (guard?.import_id === input.importId)
+        throw new AppError("storage_migration_request_conflict", "A maintenance identity cannot select another request", 1);
+    if (guard?.status === "in_progress")
+        assertImportAdmission(input.home);
+    durableWrite(importGuardPath(input.home), `${JSON.stringify(next)}\n`, !guard, guard);
+}
+/** Explicit recovery may take over only its original paired maintenance scope.
+ * Keeping the permit identity makes an old apply unable to reopen recovery. */
+export function beginStorageRecovery(input) {
+    if (!/^[a-f0-9]{64}$/.test(input.originalSha256) || !/^[a-f0-9]{64}$/.test(input.recoverySha256))
+        throw new AppError("storage_recovery_scope_invalid", "Invalid retained recovery identity", 2);
+    const guard = readImportGuard(input.home);
+    if (!guard) {
+        beginStorageMaintenance({ ...input, sourceManifestSha256: input.originalSha256 });
+        return beginStorageRecovery(input);
+    }
+    if (guard.operation !== "storage-migration" || guard.import_id !== input.importId
+        || guard.project_root !== path.resolve(input.projectRoot) || guard.workspace_root !== path.resolve(input.workspaceRoot)
+        || ![input.originalSha256, input.recoverySha256].includes(guard.source_manifest_sha256))
+        throw new AppError("storage_recovery_scope_invalid", "Recovery cannot replace another maintenance scope", 1);
+    if (guard.source_manifest_sha256 === input.recoverySha256)
+        return;
+    durableWrite(importGuardPath(input.home), `${JSON.stringify({ ...guard, status: "in_progress", source_manifest_sha256: input.recoverySha256 })}\n`, false, guard);
+}
+export function completeStorageMaintenance(input) {
+    const guard = readImportGuard(input.home);
+    if (guard?.operation !== "storage-migration")
+        throw new AppError("storage_migration_incomplete", "Completion requires the original storage maintenance fence", 1);
+    if (guard?.status === "completed" && guard.operation === "storage-migration" && guard.import_id === input.importId
+        && guard.source_manifest_sha256 === input.sourceManifestSha256 && guard.project_root === path.resolve(input.projectRoot)
+        && guard.workspace_root === path.resolve(input.workspaceRoot))
+        return;
+    completeSnapshotImport(input.home, input.importId, input);
+}
+/** A fork with its own matching intent may rebuild a completed import when
+ * its final fork receipt was lost. Fence the existing home before removing any
+ * copied files; an interrupted rebuild remains closed to productive opens. */
+export function rearmCompletedSnapshotImport(input) {
+    const guard = readImportGuard(input.home);
+    if (!guard)
+        return null;
+    if (guard.status !== "completed" || guard.project_root !== path.resolve(input.projectRoot)
+        || guard.workspace_root !== path.resolve(input.workspaceRoot)
+        || guard.source_manifest_sha256 !== input.sourceManifestSha256) {
+        throw new AppError("snapshot_import_incomplete", "Existing import does not match this completed fork; preserve it for diagnosis", 1, { guard_path: importGuardPath(input.home) });
+    }
+    const importId = crypto.randomUUID();
+    durableWrite(importGuardPath(input.home), `${JSON.stringify({ ...guard, import_id: importId, status: "in_progress" })}\n`, false, guard);
+    return importId;
+}
+export function completeSnapshotImport(home, importId, completed) {
+    const guard = readImportGuard(home);
+    if (!guard || guard.import_id !== importId || guard.status !== "in_progress"
+        || guard.project_root !== path.resolve(completed.projectRoot)
+        || guard.workspace_root !== path.resolve(completed.workspaceRoot)
+        || guard.source_manifest_sha256 !== completed.sourceManifestSha256) {
+        throw new AppError("snapshot_import_incomplete", "Import completion does not match its source and target paths", 1, { guard_path: importGuardPath(home) });
+    }
+    durableWrite(importGuardPath(home), `${JSON.stringify({ ...guard, status: "completed" })}\n`, false, guard);
+}

package/dist/storage/memory-upgrade-schema-bootstrap.js

@@ -0,0 +1,38 @@
+import { getDatabase, getResourceDatabase } from "./database.js";
+import { withStoreCleanup } from "./native-cleanup.js";
+import { PreparedMemoryInitRuntimeStorage } from "../services/memory-init-storage.js";
+import { PreparedMemoryInitResourceStorage } from "../services/memory-init-resource-storage.js";
+import { AppError } from "../shared/errors.js";
+import fs from "node:fs";
+import path from "node:path";
+/** Fixed executing-engine recipe, never an operator command or a normal
+ * admission side effect. The paired migration owns backup, drain, permit,
+ * preservation verification and recovery for both stores around this step. */
+export function bootstrapMemoryUpgradeSchema(runHome, resourceHome, permitId) {
+    try {
+        for (const file of [path.join(runHome, "db.sqlite"), path.join(resourceHome, "runtime.sqlite")]) {
+            const owner = fs.lstatSync(file);
+            if (!owner.isFile() || owner.nlink !== 1)
+                throw new AppError("memory_schema_bootstrap_unavailable", "Schema bootstrap requires the existing paired stores", 1);
+        }
+        const db = getDatabase(runHome, "initialize", permitId);
+        withStoreCleanup(() => {
+            const resources = getResourceDatabase(resourceHome, "initialize", undefined, permitId);
+            withStoreCleanup(() => {
+                const context = { ddFlowHome: runHome, db,
+                    env: { DD_FLOW_HOME: runHome, DD_FLOW_RESOURCE_HOME: resourceHome }, now: () => new Date().toISOString() };
+                PreparedMemoryInitRuntimeStorage.prepareUpgrade(context);
+                PreparedMemoryInitResourceStorage.prepare(context);
+            }, () => resources.close?.());
+        }, () => db.close?.());
+    }
+    catch (error) {
+        // The writer cutover already happened. An admission failure does not mean
+        // no effect: retain both maintenance fences for exact replay or recovery.
+        if (error instanceof AppError) {
+            Object.assign(error.details, { effect: "unknown", next_action: "reconcile_exact_request" });
+            throw error;
+        }
+        throw new AppError("memory_schema_bootstrap_failed", "Reconcile the retained schema bootstrap before runtime admission", 1, { effect: "unknown", next_action: "reconcile_exact_request" });
+    }
+}

package/dist/storage/native-cleanup.js

@@ -0,0 +1,52 @@
+import { AppError, errorRecord } from "../shared/errors.js";
+/** Cleanup must not replace the operation's primary failure, including thrown null/undefined. */
+export function withStoreCleanup(operation, cleanup, details = () => ({})) {
+    let failed = false;
+    let primary;
+    let result;
+    try {
+        result = operation();
+    }
+    catch (error) {
+        failed = true;
+        primary = error;
+    }
+    try {
+        cleanup();
+    }
+    catch (error) {
+        const secondary = { ...details(), store_cleanup_errors: [errorRecord(error)] };
+        if (failed) {
+            const original = errorRecord(primary);
+            throw new AppError(original.code, original.message, original.exitCode, {
+                ...original.details, ...secondary,
+                store_cleanup_errors: [...(Array.isArray(original.details.store_cleanup_errors) ? original.details.store_cleanup_errors : []), ...secondary.store_cleanup_errors]
+            });
+        }
+        throw new AppError("store_cleanup_failed", "Store operation completed but cleanup failed", 1, secondary);
+    }
+    if (failed)
+        throw primary;
+    return result;
+}
+/** A failed rollback makes even an enclosing savepoint's connection unsafe to reuse. */
+export function rollbackStoreTransaction(db, sql, primary) {
+    try {
+        db.exec(sql);
+    }
+    catch (error) {
+        let closeError;
+        try {
+            db.close();
+        }
+        catch (close) {
+            closeError = errorRecord(close);
+        }
+        const original = errorRecord(primary);
+        throw new AppError(original.code, original.message, original.exitCode, {
+            ...original.details, transaction_cleanup_error: errorRecord(error),
+            ...(closeError ? { transaction_close_error: closeError } : {})
+        });
+    }
+    throw primary;
+}