@elie-laloum/outpost 1.1.4 → 3.0.0

package/dist/application/recovery-restorability.js

@@ -0,0 +1,137 @@
+import { copyFile, lstat, mkdir, mkdtemp, realpath, rm, } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { directory, safeDestination } from "../infrastructure/files.js";
+import { verificationGit as git } from "../infrastructure/git/verification-command.js";
+import { hashInspectionEntry } from "../infrastructure/inspection-hash.js";
+import { recoveryTransferPatches } from "./recovery-verification.constants.js";
+export async function verifyRecoveryRestorability(root, state, repository) {
+    const temporary = await realpath(await mkdtemp(join(tmpdir(), "outpost-restore-check-")));
+    const checks = [];
+    let stage = "REPOSITORY_OBJECTS";
+    try {
+        const source = await directory(repository);
+        stage = "SOURCE_UNSUPPORTED";
+        const common = (await git(source, [
+            "rev-parse",
+            "--path-format=absolute",
+            "--git-common-dir",
+        ])).trim();
+        const configuration = await git(source, [
+            "config",
+            "--local",
+            "--null",
+            "--list",
+        ]);
+        if (/(?:extensions\.partialclone|remote\.[^\n\0]+\.(?:promisor|partialclonefilter))\n/i.test(configuration))
+            throw new Error("Partial repositories are unsupported");
+        for (const name of [
+            "shallow",
+            "objects/info/alternates",
+            "objects/info/http-alternates",
+        ]) {
+            const exists = await lstat(join(common, name)).then(() => true, (error) => {
+                if (error &&
+                    typeof error === "object" &&
+                    "code" in error &&
+                    error.code === "ENOENT")
+                    return false;
+                throw error;
+            });
+            if (exists)
+                throw new Error("Repository depends on external or shallow objects");
+        }
+        const checkout = join(temporary, "checkout");
+        const snapshot = join(temporary, "transfer");
+        await mkdir(snapshot);
+        for (const name of [
+            ...recoveryTransferPatches,
+            ...(state.previous !== state.next ? ["commits.bundle"] : []),
+        ]) {
+            stage = "TRANSFER_SNAPSHOT";
+            const path = await safeDestination(root, name);
+            const before = await hashInspectionEntry(path);
+            if (before.kind !== "file")
+                throw new Error("Expected a regular transfer file");
+            await copyFile(path, join(snapshot, name));
+            const copied = await hashInspectionEntry(join(snapshot, name));
+            if (before.sha256 !== copied.sha256 || before.bytes !== copied.bytes)
+                throw new Error("Transfer changed while copying");
+        }
+        stage = "REPOSITORY_OBJECTS";
+        await git(temporary, [
+            "clone",
+            "--local",
+            "--no-hardlinks",
+            "--no-checkout",
+            "--",
+            source,
+            checkout,
+        ]);
+        if (state.previous !== state.next) {
+            stage = "BUNDLE_OBJECTS";
+            await git(checkout, [
+                "bundle",
+                "verify",
+                join(snapshot, "commits.bundle"),
+            ]);
+            await git(checkout, [
+                "bundle",
+                "unbundle",
+                join(snapshot, "commits.bundle"),
+            ]);
+            checks.push({
+                path: join(root, "commits.bundle"),
+                status: "pass",
+                code: "BUNDLE_OBJECTS_VALID",
+            });
+        }
+        stage = "COMMIT_OBJECTS";
+        await git(checkout, ["cat-file", "-e", `${state.previous}^{commit}`]);
+        await git(checkout, ["cat-file", "-e", `${state.next}^{commit}`]);
+        await git(checkout, [
+            "fsck",
+            "--strict",
+            "--no-reflogs",
+            state.previous,
+            state.next,
+        ]);
+        checks.push({ path: root, status: "pass", code: "COMMIT_OBJECTS_VALID" });
+        for (const [name, commit, cached] of [
+            ["previous.patch", state.previous, false],
+            ["previous-index.patch", state.previous, true],
+            ["remote.patch", state.next, false],
+        ]) {
+            stage = `PATCH_${name.toUpperCase().replaceAll(/[.-]/g, "_")}`;
+            await git(checkout, ["reset", "--hard", commit]);
+            const patch = join(snapshot, name);
+            if ((await lstat(patch)).size) {
+                const args = [
+                    "apply",
+                    "--binary",
+                    ...(cached ? ["--cached"] : []),
+                    patch,
+                ];
+                await git(checkout, [...args.slice(0, -1), "--check", patch]);
+                await git(checkout, args);
+            }
+            checks.push({
+                path: join(root, name),
+                status: "pass",
+                code: "PATCH_APPLIES",
+            });
+        }
+    }
+    catch {
+        checks.push({
+            path: root,
+            status: "fail",
+            code: stage === "SOURCE_UNSUPPORTED" ? stage : `${stage}_FAILED`,
+        });
+    }
+    finally {
+        await rm(temporary, { recursive: true, force: true, maxRetries: 3 });
+    }
+    return checks;
+}
+//# sourceMappingURL=recovery-restorability.js.map

package/dist/application/recovery-restorability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-restorability.js","sourceRoot":"","sources":["../../src/application/recovery-restorability.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,KAAK,EACL,KAAK,EACL,OAAO,EACP,QAAQ,EACR,EAAE,GACH,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,eAAe,IAAI,GAAG,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAM/E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAAY,EACZ,KAA4B,EAC5B,UAAkB;IAElB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAC9B,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CACxD,CAAC;IACF,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,IAAI,KAAK,GAAG,oBAAoB,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3C,KAAK,GAAG,oBAAoB,CAAC;QAC7B,MAAM,MAAM,GAAG,CACb,MAAM,GAAG,CAAC,MAAM,EAAE;YAChB,WAAW;YACX,wBAAwB;YACxB,kBAAkB;SACnB,CAAC,CACH,CAAC,IAAI,EAAE,CAAC;QACT,MAAM,aAAa,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE;YACtC,QAAQ;YACR,SAAS;YACT,QAAQ;YACR,QAAQ;SACT,CAAC,CAAC;QACH,IACE,mFAAmF,CAAC,IAAI,CACtF,aAAa,CACd;YAED,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI;YACjB,SAAS;YACT,yBAAyB;YACzB,8BAA8B;SAC/B,EAAE,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CACjD,GAAG,EAAE,CAAC,IAAI,EACV,CAAC,KAAc,EAAE,EAAE;gBACjB,IACE,KAAK;oBACL,OAAO,KAAK,KAAK,QAAQ;oBACzB,MAAM,IAAI,KAAK;oBACf,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAEvB,OAAO,KAAK,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC,CACF,CAAC;YACF,IAAI,MAAM;gBACR,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtB,KAAK,MAAM,IAAI,IAAI;YACjB,GAAG,uBAAuB;YAC1B,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,EAAE,CAAC;YACF,KAAK,GAAG,mBAAmB,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;gBACxB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/D,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;gBAClE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,GAAG,oBAAoB,CAAC;QAC7B,MAAM,GAAG,CAAC,SAAS,EAAE;YACnB,OAAO;YACP,SAAS;YACT,gBAAgB;YAChB,eAAe;YACf,IAAI;YACJ,MAAM;YACN,QAAQ;SACT,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YAClC,KAAK,GAAG,gBAAgB,CAAC;YACzB,MAAM,GAAG,CAAC,QAAQ,EAAE;gBAClB,QAAQ;gBACR,QAAQ;gBACR,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC;aACjC,CAAC,CAAC;YACH,MAAM,GAAG,CAAC,QAAQ,EAAE;gBAClB,QAAQ;gBACR,UAAU;gBACV,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC;aACjC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC;gBAClC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,sBAAsB;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,KAAK,GAAG,gBAAgB,CAAC;QACzB,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,QAAQ,WAAW,CAAC,CAAC,CAAC;QACtE,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,CAAC,QAAQ,EAAE;YAClB,MAAM;YACN,UAAU;YACV,cAAc;YACd,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,IAAI;SACX,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC1E,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI;YACnC,CAAC,gBAAgB,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC;YACzC,CAAC,sBAAsB,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC;YAC9C,CAAC,cAAc,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC;SAC3B,EAAE,CAAC;YACX,KAAK,GAAG,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YAC/D,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YACjD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG;oBACX,OAAO;oBACP,UAAU;oBACV,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/B,KAAK;iBACN,CAAC;gBACF,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;gBAC9D,MAAM,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC5B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;gBACtB,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,eAAe;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,KAAK,KAAK,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS;SACjE,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import {\n  copyFile,\n  lstat,\n  mkdir,\n  mkdtemp,\n  realpath,\n  rm,\n} from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { directory, safeDestination } from \"../infrastructure/files.ts\";\nimport { verificationGit as git } from \"../infrastructure/git/verification-command.ts\";\nimport { hashInspectionEntry } from \"../infrastructure/inspection-hash.ts\";\nimport { recoveryTransferPatches } from \"./recovery-verification.constants.ts\";\nimport type {\n  RecoveryStructureCheck,\n  RecoveryTransferState,\n} from \"./recovery-verification.types.ts\";\n\nexport async function verifyRecoveryRestorability(\n  root: string,\n  state: RecoveryTransferState,\n  repository: string,\n): Promise<readonly RecoveryStructureCheck[]> {\n  const temporary = await realpath(\n    await mkdtemp(join(tmpdir(), \"outpost-restore-check-\")),\n  );\n  const checks: RecoveryStructureCheck[] = [];\n  let stage = \"REPOSITORY_OBJECTS\";\n  try {\n    const source = await directory(repository);\n    stage = \"SOURCE_UNSUPPORTED\";\n    const common = (\n      await git(source, [\n        \"rev-parse\",\n        \"--path-format=absolute\",\n        \"--git-common-dir\",\n      ])\n    ).trim();\n    const configuration = await git(source, [\n      \"config\",\n      \"--local\",\n      \"--null\",\n      \"--list\",\n    ]);\n    if (\n      /(?:extensions\\.partialclone|remote\\.[^\\n\\0]+\\.(?:promisor|partialclonefilter))\\n/i.test(\n        configuration,\n      )\n    )\n      throw new Error(\"Partial repositories are unsupported\");\n    for (const name of [\n      \"shallow\",\n      \"objects/info/alternates\",\n      \"objects/info/http-alternates\",\n    ]) {\n      const exists = await lstat(join(common, name)).then(\n        () => true,\n        (error: unknown) => {\n          if (\n            error &&\n            typeof error === \"object\" &&\n            \"code\" in error &&\n            error.code === \"ENOENT\"\n          )\n            return false;\n          throw error;\n        },\n      );\n      if (exists)\n        throw new Error(\"Repository depends on external or shallow objects\");\n    }\n    const checkout = join(temporary, \"checkout\");\n    const snapshot = join(temporary, \"transfer\");\n    await mkdir(snapshot);\n    for (const name of [\n      ...recoveryTransferPatches,\n      ...(state.previous !== state.next ? [\"commits.bundle\"] : []),\n    ]) {\n      stage = \"TRANSFER_SNAPSHOT\";\n      const path = await safeDestination(root, name);\n      const before = await hashInspectionEntry(path);\n      if (before.kind !== \"file\")\n        throw new Error(\"Expected a regular transfer file\");\n      await copyFile(path, join(snapshot, name));\n      const copied = await hashInspectionEntry(join(snapshot, name));\n      if (before.sha256 !== copied.sha256 || before.bytes !== copied.bytes)\n        throw new Error(\"Transfer changed while copying\");\n    }\n    stage = \"REPOSITORY_OBJECTS\";\n    await git(temporary, [\n      \"clone\",\n      \"--local\",\n      \"--no-hardlinks\",\n      \"--no-checkout\",\n      \"--\",\n      source,\n      checkout,\n    ]);\n    if (state.previous !== state.next) {\n      stage = \"BUNDLE_OBJECTS\";\n      await git(checkout, [\n        \"bundle\",\n        \"verify\",\n        join(snapshot, \"commits.bundle\"),\n      ]);\n      await git(checkout, [\n        \"bundle\",\n        \"unbundle\",\n        join(snapshot, \"commits.bundle\"),\n      ]);\n      checks.push({\n        path: join(root, \"commits.bundle\"),\n        status: \"pass\",\n        code: \"BUNDLE_OBJECTS_VALID\",\n      });\n    }\n    stage = \"COMMIT_OBJECTS\";\n    await git(checkout, [\"cat-file\", \"-e\", `${state.previous}^{commit}`]);\n    await git(checkout, [\"cat-file\", \"-e\", `${state.next}^{commit}`]);\n    await git(checkout, [\n      \"fsck\",\n      \"--strict\",\n      \"--no-reflogs\",\n      state.previous,\n      state.next,\n    ]);\n    checks.push({ path: root, status: \"pass\", code: \"COMMIT_OBJECTS_VALID\" });\n    for (const [name, commit, cached] of [\n      [\"previous.patch\", state.previous, false],\n      [\"previous-index.patch\", state.previous, true],\n      [\"remote.patch\", state.next, false],\n    ] as const) {\n      stage = `PATCH_${name.toUpperCase().replaceAll(/[.-]/g, \"_\")}`;\n      await git(checkout, [\"reset\", \"--hard\", commit]);\n      const patch = join(snapshot, name);\n      if ((await lstat(patch)).size) {\n        const args = [\n          \"apply\",\n          \"--binary\",\n          ...(cached ? [\"--cached\"] : []),\n          patch,\n        ];\n        await git(checkout, [...args.slice(0, -1), \"--check\", patch]);\n        await git(checkout, args);\n      }\n      checks.push({\n        path: join(root, name),\n        status: \"pass\",\n        code: \"PATCH_APPLIES\",\n      });\n    }\n  } catch {\n    checks.push({\n      path: root,\n      status: \"fail\",\n      code: stage === \"SOURCE_UNSUPPORTED\" ? stage : `${stage}_FAILED`,\n    });\n  } finally {\n    await rm(temporary, { recursive: true, force: true, maxRetries: 3 });\n  }\n  return checks;\n}\n"]}

package/dist/application/recovery-retention-policy.d.ts

@@ -0,0 +1,2 @@
+import type { RecoveryRetentionPolicy } from "./recovery-retention.types.ts";
+export declare function retentionPolicy(value: unknown): asserts value is RecoveryRetentionPolicy;

package/dist/application/recovery-retention-policy.js

@@ -0,0 +1,21 @@
+import { invariant } from "../domain/errors.js";
+export function retentionPolicy(value) {
+    invariant(!!value && typeof value === "object", "Retention policy must be an object");
+    invariant("version" in value && value.version === 1, "Retention policy version must be 1");
+    invariant("scopes" in value &&
+        Array.isArray(value.scopes) &&
+        value.scopes.length > 0 &&
+        value.scopes.every((scope) => scope === "clean-workspaces" || scope === "closed-logs"), "Retention scopes must contain clean-workspaces or closed-logs");
+    invariant("minAgeMs" in value &&
+        typeof value.minAgeMs === "number" &&
+        Number.isSafeInteger(value.minAgeMs) &&
+        value.minAgeMs >= 0, "minAgeMs must be a nonnegative integer");
+    for (const key of ["maxBytes", "maxWorkspaces"]) {
+        if (!(key in value))
+            continue;
+        const limit = Object.getOwnPropertyDescriptor(value, key)?.value;
+        invariant(typeof limit === "number" && Number.isSafeInteger(limit) && limit >= 0, `${key} must be a nonnegative integer`);
+    }
+    invariant(Object.keys(value).every((key) => ["version", "scopes", "minAgeMs", "maxBytes", "maxWorkspaces"].includes(key)), "Unsupported retention policy field");
+}
+//# sourceMappingURL=recovery-retention-policy.js.map

package/dist/application/recovery-retention-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-retention-policy.js","sourceRoot":"","sources":["../../src/application/recovery-retention-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,MAAM,UAAU,eAAe,CAC7B,KAAc;IAEd,SAAS,CACP,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EACpC,oCAAoC,CACrC,CAAC;IACF,SAAS,CACP,SAAS,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,EACzC,oCAAoC,CACrC,CAAC;IACF,SAAS,CACP,QAAQ,IAAI,KAAK;QACf,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC3B,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACvB,KAAK,CAAC,MAAM,CAAC,KAAK,CAChB,CAAC,KAAc,EAAE,EAAE,CACjB,KAAK,KAAK,kBAAkB,IAAI,KAAK,KAAK,aAAa,CAC1D,EACH,+DAA+D,CAChE,CAAC;IACF,SAAS,CACP,UAAU,IAAI,KAAK;QACjB,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC;QACpC,KAAK,CAAC,QAAQ,IAAI,CAAC,EACrB,wCAAwC,CACzC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,eAAe,CAAU,EAAE,CAAC;QACzD,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC;YAAE,SAAS;QAC9B,MAAM,KAAK,GAAY,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC;QAC1E,SAAS,CACP,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EACtE,GAAG,GAAG,gCAAgC,CACvC,CAAC;IACJ,CAAC;IACD,SAAS,CACP,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAC/B,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,QAAQ,CACrE,GAAG,CACJ,CACF,EACD,oCAAoC,CACrC,CAAC;AACJ,CAAC","sourcesContent":["import { invariant } from \"../domain/errors.ts\";\nimport type { RecoveryRetentionPolicy } from \"./recovery-retention.types.ts\";\n\nexport function retentionPolicy(\n  value: unknown,\n): asserts value is RecoveryRetentionPolicy {\n  invariant(\n    !!value && typeof value === \"object\",\n    \"Retention policy must be an object\",\n  );\n  invariant(\n    \"version\" in value && value.version === 1,\n    \"Retention policy version must be 1\",\n  );\n  invariant(\n    \"scopes\" in value &&\n      Array.isArray(value.scopes) &&\n      value.scopes.length > 0 &&\n      value.scopes.every(\n        (scope: unknown) =>\n          scope === \"clean-workspaces\" || scope === \"closed-logs\",\n      ),\n    \"Retention scopes must contain clean-workspaces or closed-logs\",\n  );\n  invariant(\n    \"minAgeMs\" in value &&\n      typeof value.minAgeMs === \"number\" &&\n      Number.isSafeInteger(value.minAgeMs) &&\n      value.minAgeMs >= 0,\n    \"minAgeMs must be a nonnegative integer\",\n  );\n  for (const key of [\"maxBytes\", \"maxWorkspaces\"] as const) {\n    if (!(key in value)) continue;\n    const limit: unknown = Object.getOwnPropertyDescriptor(value, key)?.value;\n    invariant(\n      typeof limit === \"number\" && Number.isSafeInteger(limit) && limit >= 0,\n      `${key} must be a nonnegative integer`,\n    );\n  }\n  invariant(\n    Object.keys(value).every((key) =>\n      [\"version\", \"scopes\", \"minAgeMs\", \"maxBytes\", \"maxWorkspaces\"].includes(\n        key,\n      ),\n    ),\n    \"Unsupported retention policy field\",\n  );\n}\n"]}

package/dist/application/recovery-retention.constants.d.ts

@@ -0,0 +1,3 @@
+export declare const recoveryRetentionLimits: {
+    readonly maxPolicyBytes: 65536;
+};

package/dist/application/recovery-retention.constants.js

@@ -0,0 +1,2 @@
+export const recoveryRetentionLimits = { maxPolicyBytes: 65_536 };
+//# sourceMappingURL=recovery-retention.constants.js.map

package/dist/application/recovery-retention.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-retention.constants.js","sourceRoot":"","sources":["../../src/application/recovery-retention.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,cAAc,EAAE,MAAM,EAAW,CAAC","sourcesContent":["export const recoveryRetentionLimits = { maxPolicyBytes: 65_536 } as const;\n"]}

package/dist/application/recovery-retention.d.ts

@@ -0,0 +1,4 @@
+import type { RecoveryPruneResult, RecoveryQuotaOptions, RecoveryRetentionOptions, RecoveryRetentionPlan } from "./recovery-retention.types.ts";
+export declare function planRecoveryRetention(options: RecoveryRetentionOptions): Promise<RecoveryRetentionPlan>;
+export declare function pruneRecoveryRetention(plan: RecoveryRetentionPlan): Promise<RecoveryPruneResult>;
+export declare function assertRecoveryQuota(options: RecoveryQuotaOptions): Promise<void>;

package/dist/application/recovery-retention.js

@@ -0,0 +1,202 @@
+import { lstat, rm } from "node:fs/promises";
+import { OutpostError, invariant } from "../domain/errors.js";
+import { git } from "../infrastructure/git/command.js";
+import { lock, lockPath } from "../infrastructure/git/lock.js";
+import { closedJournal } from "../infrastructure/journal-retention.js";
+import { inspectRecovery } from "./recovery-inspection.js";
+import { retentionPolicy } from "./recovery-retention-policy.js";
+async function workspaceReason(entry, inspection) {
+    const workspace = inspection.git?.workspaces.find((value) => value.path === entry.path);
+    if (!workspace || workspace.state !== "registered")
+        return "WORKSPACE_UNREGISTERED_OR_UNKNOWN";
+    if (workspace.branch === null)
+        return "DETACHED_WORKSPACE";
+    if (workspace.dirty)
+        return "DIRTY_WORKSPACE";
+    if (workspace.locked)
+        return "GIT_LOCKED_WORKSPACE";
+    try {
+        await lstat(lockPath(inspection.repository, workspace.branch));
+        return "OPERATION_LOCK_PRESENT";
+    }
+    catch (error) {
+        if (!(error &&
+            typeof error === "object" &&
+            "code" in error &&
+            error.code === "ENOENT"))
+            return "OWNERSHIP_UNKNOWN";
+    }
+    try {
+        const ignored = await git(entry.path, [
+            "ls-files",
+            "--others",
+            "--ignored",
+            "--exclude-standard",
+            "-z",
+        ]);
+        if (ignored.length)
+            return "IGNORED_FILES";
+    }
+    catch {
+        return "WORKSPACE_STATE_UNKNOWN";
+    }
+    return "ELIGIBLE";
+}
+export async function planRecoveryRetention(options) {
+    retentionPolicy(options.policy);
+    const policy = structuredClone(options.policy);
+    const inspection = await inspectRecovery({
+        ...options,
+        git: true,
+        locks: true,
+    });
+    const entries = [];
+    const inspectedAt = new Date().toISOString();
+    const complete = inspection.complete && inspection.git?.complete !== false;
+    for (const category of inspection.categories) {
+        for (const entry of category.entries) {
+            let reason = "RECOVERY_DATA_PROTECTED";
+            if (category.name === "locks")
+                reason = "OWNERSHIP_RECORD_PROTECTED";
+            if (category.name === "logs")
+                reason = "LOG_ACTIVITY_OR_CONTENT_UNKNOWN";
+            if (category.name === "workspaces")
+                reason = "SCOPE_NOT_SELECTED";
+            if (category.name === "workspaces" &&
+                policy.scopes.includes("clean-workspaces"))
+                reason = await workspaceReason(entry, inspection);
+            if (category.name === "logs" &&
+                policy.scopes.includes("closed-logs") &&
+                entry.kind === "file" &&
+                entry.name.endsWith(".jsonl") &&
+                (await closedJournal(entry.path)))
+                reason = "ELIGIBLE";
+            if (category.name === "logs" && entry.name.endsWith(".closed.json"))
+                reason = "CLOSURE_RECORD_PROTECTED";
+            if (reason === "ELIGIBLE" &&
+                (!entry.modifiedAt ||
+                    Date.parse(inspectedAt) - Date.parse(entry.modifiedAt) <
+                        policy.minAgeMs))
+                reason = "RETENTION_AGE";
+            if (reason === "ELIGIBLE" && (!complete || !entry.complete))
+                reason = "INCOMPLETE_INVENTORY";
+            const workspace = inspection.git?.workspaces.find((value) => value.path === entry.path);
+            entries.push({
+                path: entry.path,
+                category: category.name,
+                bytes: entry.bytes,
+                eligible: reason === "ELIGIBLE",
+                reason,
+                ...(entry.modifiedAt ? { modifiedAt: entry.modifiedAt } : {}),
+                ...(workspace?.state === "registered" && workspace.branch
+                    ? { branch: workspace.branch, head: workspace.head }
+                    : {}),
+            });
+        }
+    }
+    const projectedBytes = inspection.usage.bytes -
+        entries
+            .filter((entry) => entry.eligible)
+            .reduce((sum, entry) => sum +
+            entry.bytes +
+            (entry.category === "logs"
+                ? (entries.find((other) => other.path === `${entry.path}.closed.json`)?.bytes ?? 0)
+                : 0), 0);
+    const workspaces = entries.filter((entry) => entry.category === "workspaces" && !entry.eligible).length;
+    const exceeded = (policy.maxBytes !== undefined && projectedBytes > policy.maxBytes) ||
+        (policy.maxWorkspaces !== undefined && workspaces > policy.maxWorkspaces);
+    return {
+        repository: inspection.repository,
+        policy,
+        inspectedAt,
+        inspection,
+        entries,
+        complete,
+        usageBytes: inspection.usage.bytes,
+        projectedBytes,
+        quota: !complete ? "unknown" : exceeded ? "exceeded" : "within",
+    };
+}
+export async function pruneRecoveryRetention(plan) {
+    retentionPolicy(plan.policy);
+    invariant(plan.complete, "Cannot prune an incomplete retention plan");
+    const removed = [];
+    const retained = [];
+    for (const candidate of plan.entries.filter((entry) => entry.eligible)) {
+        const fresh = await planRecoveryRetention({
+            repository: plan.repository,
+            policy: plan.policy,
+        });
+        const entry = fresh.entries.find((value) => value.path === candidate.path);
+        if (!entry?.eligible ||
+            entry.head !== candidate.head ||
+            entry.branch !== candidate.branch ||
+            entry.bytes !== candidate.bytes ||
+            entry.modifiedAt !== candidate.modifiedAt) {
+            retained.push({ path: candidate.path, reason: "PLAN_CHANGED" });
+            continue;
+        }
+        try {
+            if (entry.category === "workspaces" && entry.branch) {
+                const release = await lock(plan.repository, entry.branch);
+                try {
+                    const status = await git(entry.path, [
+                        "status",
+                        "--porcelain=v1",
+                        "--ignored",
+                        "--untracked-files=all",
+                    ]);
+                    invariant(!status.length, "Workspace changed before pruning");
+                    invariant((await git(entry.path, ["rev-parse", "HEAD"])).trim() ===
+                        entry.head, "Workspace HEAD changed before pruning");
+                    invariant((await git(entry.path, ["symbolic-ref", "--short", "HEAD"])).trim() === entry.branch, "Workspace branch changed before pruning");
+                    await git(plan.repository, ["worktree", "remove", entry.path]);
+                }
+                finally {
+                    await release();
+                }
+            }
+            else {
+                const release = await lock(plan.repository, `journal:${entry.path}`);
+                try {
+                    invariant(entry.category === "logs" && (await closedJournal(entry.path)), "Journal changed before pruning");
+                    await rm(entry.path);
+                    await rm(`${entry.path}.closed.json`);
+                }
+                finally {
+                    await release();
+                }
+            }
+            removed.push(entry.path);
+        }
+        catch {
+            retained.push({
+                path: candidate.path,
+                reason: "REVALIDATION_OR_REMOVAL_FAILED",
+            });
+        }
+    }
+    return {
+        removed,
+        retained,
+        after: await planRecoveryRetention({
+            repository: plan.repository,
+            policy: plan.policy,
+        }),
+    };
+}
+export async function assertRecoveryQuota(options) {
+    invariant(Number.isSafeInteger(options.maxBytes) && options.maxBytes >= 0, "maxBytes must be a nonnegative integer");
+    const reserve = options.reserveBytes ?? 0;
+    invariant(Number.isSafeInteger(reserve) && reserve >= 0, "reserveBytes must be a nonnegative integer");
+    const inspection = await inspectRecovery(options);
+    if (!inspection.complete ||
+        inspection.usage.bytes + reserve > options.maxBytes)
+        throw new OutpostError("workspace", "Outpost storage quota admission refused", {
+            usageBytes: inspection.usage.bytes,
+            reserveBytes: reserve,
+            maxBytes: options.maxBytes,
+            complete: inspection.complete,
+        });
+}
+//# sourceMappingURL=recovery-retention.js.map

package/dist/application/recovery-retention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-retention.js","sourceRoot":"","sources":["../../src/application/recovery-retention.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,GAAG,EAAE,MAAM,kCAAkC,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAGvE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAUjE,KAAK,UAAU,eAAe,CAC5B,KAAmB,EACnB,UAA8B;IAE9B,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAC/C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CACrC,CAAC;IACF,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,KAAK,KAAK,YAAY;QAChD,OAAO,mCAAmC,CAAC;IAC7C,IAAI,SAAS,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,oBAAoB,CAAC;IAC3D,IAAI,SAAS,CAAC,KAAK;QAAE,OAAO,iBAAiB,CAAC;IAC9C,IAAI,SAAS,CAAC,MAAM;QAAE,OAAO,sBAAsB,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,OAAO,wBAAwB,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CACH,KAAK;YACL,OAAO,KAAK,KAAK,QAAQ;YACzB,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,IAAI,KAAK,QAAQ,CACxB;YACC,OAAO,mBAAmB,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;YACpC,UAAU;YACV,UAAU;YACV,WAAW;YACX,oBAAoB;YACpB,IAAI;SACL,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM;YAAE,OAAO,eAAe,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAiC;IAEjC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC;QACvC,GAAG,OAAO;QACV,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;IACH,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,GAAG,EAAE,QAAQ,KAAK,KAAK,CAAC;IAC3E,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC7C,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrC,IAAI,MAAM,GAAG,yBAAyB,CAAC;YACvC,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,GAAG,4BAA4B,CAAC;YACrE,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM;gBAAE,MAAM,GAAG,iCAAiC,CAAC;YACzE,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY;gBAAE,MAAM,GAAG,oBAAoB,CAAC;YAClE,IACE,QAAQ,CAAC,IAAI,KAAK,YAAY;gBAC9B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAE1C,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YACpD,IACE,QAAQ,CAAC,IAAI,KAAK,MAAM;gBACxB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;gBACrC,KAAK,CAAC,IAAI,KAAK,MAAM;gBACrB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC7B,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAEjC,MAAM,GAAG,UAAU,CAAC;YACtB,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;gBACjE,MAAM,GAAG,0BAA0B,CAAC;YACtC,IACE,MAAM,KAAK,UAAU;gBACrB,CAAC,CAAC,KAAK,CAAC,UAAU;oBAChB,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;wBACpD,MAAM,CAAC,QAAQ,CAAC;gBAEpB,MAAM,GAAG,eAAe,CAAC;YAC3B,IAAI,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACzD,MAAM,GAAG,sBAAsB,CAAC;YAClC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAC/C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CACrC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,MAAM,KAAK,UAAU;gBAC/B,MAAM;gBACN,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,SAAS,EAAE,KAAK,KAAK,YAAY,IAAI,SAAS,CAAC,MAAM;oBACvD,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;oBACpD,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAClB,UAAU,CAAC,KAAK,CAAC,KAAK;QACtB,OAAO;aACJ,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;aACjC,MAAM,CACL,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CACb,GAAG;YACH,KAAK,CAAC,KAAK;YACX,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM;gBACxB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CACX,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,KAAK,CAAC,IAAI,cAAc,CACtD,EAAE,KAAK,IAAI,CAAC,CAAC;gBAChB,CAAC,CAAC,CAAC,CAAC,EACR,CAAC,CACF,CAAC;IACN,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAC/B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAC9D,CAAC,MAAM,CAAC;IACT,MAAM,QAAQ,GACZ,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC;QACnE,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;IAC5E,OAAO;QACL,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,MAAM;QACN,WAAW;QACX,UAAU;QACV,OAAO;QACP,QAAQ;QACR,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK;QAClC,cAAc;QACd,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;KAChE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAA2B;IAE3B,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,2CAA2C,CAAC,CAAC;IACtE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC;YACxC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3E,IACE,CAAC,KAAK,EAAE,QAAQ;YAChB,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI;YAC7B,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;YACjC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK;YAC/B,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU,EACzC,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAChE,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC1D,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;wBACnC,QAAQ;wBACR,gBAAgB;wBAChB,WAAW;wBACX,uBAAuB;qBACxB,CAAC,CAAC;oBACH,SAAS,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;oBAC9D,SAAS,CACP,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;wBACnD,KAAK,CAAC,IAAI,EACZ,uCAAuC,CACxC,CAAC;oBACF,SAAS,CACP,CACE,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAC3D,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,MAAM,EACzB,yCAAyC,CAC1C,CAAC;oBACF,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjE,CAAC;wBAAS,CAAC;oBACT,MAAM,OAAO,EAAE,CAAC;gBAClB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC;oBACH,SAAS,CACP,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAC9D,gCAAgC,CACjC,CAAC;oBACF,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACrB,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,cAAc,CAAC,CAAC;gBACxC,CAAC;wBAAS,CAAC;oBACT,MAAM,OAAO,EAAE,CAAC;gBAClB,CAAC;YACH,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,MAAM,EAAE,gCAAgC;aACzC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO;QACP,QAAQ;QACR,KAAK,EAAE,MAAM,qBAAqB,CAAC;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA6B;IAE7B,SAAS,CACP,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC,EAC/D,wCAAwC,CACzC,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;IAC1C,SAAS,CACP,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAC7C,4CAA4C,CAC7C,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAClD,IACE,CAAC,UAAU,CAAC,QAAQ;QACpB,UAAU,CAAC,KAAK,CAAC,KAAK,GAAG,OAAO,GAAG,OAAO,CAAC,QAAQ;QAEnD,MAAM,IAAI,YAAY,CACpB,WAAW,EACX,yCAAyC,EACzC;YACE,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK;YAClC,YAAY,EAAE,OAAO;YACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,UAAU,CAAC,QAAQ;SAC9B,CACF,CAAC;AACN,CAAC","sourcesContent":["import { lstat, rm } from \"node:fs/promises\";\nimport { OutpostError, invariant } from \"../domain/errors.ts\";\nimport { git } from \"../infrastructure/git/command.ts\";\nimport { lock, lockPath } from \"../infrastructure/git/lock.ts\";\nimport { closedJournal } from \"../infrastructure/journal-retention.ts\";\nimport type { StorageEntry } from \"../infrastructure/storage-inventory.types.ts\";\nimport type { RecoveryInspection } from \"./recovery-inspection.types.ts\";\nimport { inspectRecovery } from \"./recovery-inspection.ts\";\nimport { retentionPolicy } from \"./recovery-retention-policy.ts\";\nimport type {\n  RecoveryPruneResult,\n  RecoveryRetainedEntry,\n  RecoveryQuotaOptions,\n  RecoveryRetentionEntry,\n  RecoveryRetentionOptions,\n  RecoveryRetentionPlan,\n} from \"./recovery-retention.types.ts\";\n\nasync function workspaceReason(\n  entry: StorageEntry,\n  inspection: RecoveryInspection,\n): Promise<string> {\n  const workspace = inspection.git?.workspaces.find(\n    (value) => value.path === entry.path,\n  );\n  if (!workspace || workspace.state !== \"registered\")\n    return \"WORKSPACE_UNREGISTERED_OR_UNKNOWN\";\n  if (workspace.branch === null) return \"DETACHED_WORKSPACE\";\n  if (workspace.dirty) return \"DIRTY_WORKSPACE\";\n  if (workspace.locked) return \"GIT_LOCKED_WORKSPACE\";\n  try {\n    await lstat(lockPath(inspection.repository, workspace.branch));\n    return \"OPERATION_LOCK_PRESENT\";\n  } catch (error) {\n    if (!(\n      error &&\n      typeof error === \"object\" &&\n      \"code\" in error &&\n      error.code === \"ENOENT\"\n    ))\n      return \"OWNERSHIP_UNKNOWN\";\n  }\n  try {\n    const ignored = await git(entry.path, [\n      \"ls-files\",\n      \"--others\",\n      \"--ignored\",\n      \"--exclude-standard\",\n      \"-z\",\n    ]);\n    if (ignored.length) return \"IGNORED_FILES\";\n  } catch {\n    return \"WORKSPACE_STATE_UNKNOWN\";\n  }\n  return \"ELIGIBLE\";\n}\n\nexport async function planRecoveryRetention(\n  options: RecoveryRetentionOptions,\n): Promise<RecoveryRetentionPlan> {\n  retentionPolicy(options.policy);\n  const policy = structuredClone(options.policy);\n  const inspection = await inspectRecovery({\n    ...options,\n    git: true,\n    locks: true,\n  });\n  const entries: RecoveryRetentionEntry[] = [];\n  const inspectedAt = new Date().toISOString();\n  const complete = inspection.complete && inspection.git?.complete !== false;\n  for (const category of inspection.categories) {\n    for (const entry of category.entries) {\n      let reason = \"RECOVERY_DATA_PROTECTED\";\n      if (category.name === \"locks\") reason = \"OWNERSHIP_RECORD_PROTECTED\";\n      if (category.name === \"logs\") reason = \"LOG_ACTIVITY_OR_CONTENT_UNKNOWN\";\n      if (category.name === \"workspaces\") reason = \"SCOPE_NOT_SELECTED\";\n      if (\n        category.name === \"workspaces\" &&\n        policy.scopes.includes(\"clean-workspaces\")\n      )\n        reason = await workspaceReason(entry, inspection);\n      if (\n        category.name === \"logs\" &&\n        policy.scopes.includes(\"closed-logs\") &&\n        entry.kind === \"file\" &&\n        entry.name.endsWith(\".jsonl\") &&\n        (await closedJournal(entry.path))\n      )\n        reason = \"ELIGIBLE\";\n      if (category.name === \"logs\" && entry.name.endsWith(\".closed.json\"))\n        reason = \"CLOSURE_RECORD_PROTECTED\";\n      if (\n        reason === \"ELIGIBLE\" &&\n        (!entry.modifiedAt ||\n          Date.parse(inspectedAt) - Date.parse(entry.modifiedAt) <\n            policy.minAgeMs)\n      )\n        reason = \"RETENTION_AGE\";\n      if (reason === \"ELIGIBLE\" && (!complete || !entry.complete))\n        reason = \"INCOMPLETE_INVENTORY\";\n      const workspace = inspection.git?.workspaces.find(\n        (value) => value.path === entry.path,\n      );\n      entries.push({\n        path: entry.path,\n        category: category.name,\n        bytes: entry.bytes,\n        eligible: reason === \"ELIGIBLE\",\n        reason,\n        ...(entry.modifiedAt ? { modifiedAt: entry.modifiedAt } : {}),\n        ...(workspace?.state === \"registered\" && workspace.branch\n          ? { branch: workspace.branch, head: workspace.head }\n          : {}),\n      });\n    }\n  }\n  const projectedBytes =\n    inspection.usage.bytes -\n    entries\n      .filter((entry) => entry.eligible)\n      .reduce(\n        (sum, entry) =>\n          sum +\n          entry.bytes +\n          (entry.category === \"logs\"\n            ? (entries.find(\n                (other) => other.path === `${entry.path}.closed.json`,\n              )?.bytes ?? 0)\n            : 0),\n        0,\n      );\n  const workspaces = entries.filter(\n    (entry) => entry.category === \"workspaces\" && !entry.eligible,\n  ).length;\n  const exceeded =\n    (policy.maxBytes !== undefined && projectedBytes > policy.maxBytes) ||\n    (policy.maxWorkspaces !== undefined && workspaces > policy.maxWorkspaces);\n  return {\n    repository: inspection.repository,\n    policy,\n    inspectedAt,\n    inspection,\n    entries,\n    complete,\n    usageBytes: inspection.usage.bytes,\n    projectedBytes,\n    quota: !complete ? \"unknown\" : exceeded ? \"exceeded\" : \"within\",\n  };\n}\n\nexport async function pruneRecoveryRetention(\n  plan: RecoveryRetentionPlan,\n): Promise<RecoveryPruneResult> {\n  retentionPolicy(plan.policy);\n  invariant(plan.complete, \"Cannot prune an incomplete retention plan\");\n  const removed: string[] = [];\n  const retained: RecoveryRetainedEntry[] = [];\n  for (const candidate of plan.entries.filter((entry) => entry.eligible)) {\n    const fresh = await planRecoveryRetention({\n      repository: plan.repository,\n      policy: plan.policy,\n    });\n    const entry = fresh.entries.find((value) => value.path === candidate.path);\n    if (\n      !entry?.eligible ||\n      entry.head !== candidate.head ||\n      entry.branch !== candidate.branch ||\n      entry.bytes !== candidate.bytes ||\n      entry.modifiedAt !== candidate.modifiedAt\n    ) {\n      retained.push({ path: candidate.path, reason: \"PLAN_CHANGED\" });\n      continue;\n    }\n    try {\n      if (entry.category === \"workspaces\" && entry.branch) {\n        const release = await lock(plan.repository, entry.branch);\n        try {\n          const status = await git(entry.path, [\n            \"status\",\n            \"--porcelain=v1\",\n            \"--ignored\",\n            \"--untracked-files=all\",\n          ]);\n          invariant(!status.length, \"Workspace changed before pruning\");\n          invariant(\n            (await git(entry.path, [\"rev-parse\", \"HEAD\"])).trim() ===\n              entry.head,\n            \"Workspace HEAD changed before pruning\",\n          );\n          invariant(\n            (\n              await git(entry.path, [\"symbolic-ref\", \"--short\", \"HEAD\"])\n            ).trim() === entry.branch,\n            \"Workspace branch changed before pruning\",\n          );\n          await git(plan.repository, [\"worktree\", \"remove\", entry.path]);\n        } finally {\n          await release();\n        }\n      } else {\n        const release = await lock(plan.repository, `journal:${entry.path}`);\n        try {\n          invariant(\n            entry.category === \"logs\" && (await closedJournal(entry.path)),\n            \"Journal changed before pruning\",\n          );\n          await rm(entry.path);\n          await rm(`${entry.path}.closed.json`);\n        } finally {\n          await release();\n        }\n      }\n      removed.push(entry.path);\n    } catch {\n      retained.push({\n        path: candidate.path,\n        reason: \"REVALIDATION_OR_REMOVAL_FAILED\",\n      });\n    }\n  }\n  return {\n    removed,\n    retained,\n    after: await planRecoveryRetention({\n      repository: plan.repository,\n      policy: plan.policy,\n    }),\n  };\n}\n\nexport async function assertRecoveryQuota(\n  options: RecoveryQuotaOptions,\n): Promise<void> {\n  invariant(\n    Number.isSafeInteger(options.maxBytes) && options.maxBytes >= 0,\n    \"maxBytes must be a nonnegative integer\",\n  );\n  const reserve = options.reserveBytes ?? 0;\n  invariant(\n    Number.isSafeInteger(reserve) && reserve >= 0,\n    \"reserveBytes must be a nonnegative integer\",\n  );\n  const inspection = await inspectRecovery(options);\n  if (\n    !inspection.complete ||\n    inspection.usage.bytes + reserve > options.maxBytes\n  )\n    throw new OutpostError(\n      \"workspace\",\n      \"Outpost storage quota admission refused\",\n      {\n        usageBytes: inspection.usage.bytes,\n        reserveBytes: reserve,\n        maxBytes: options.maxBytes,\n        complete: inspection.complete,\n      },\n    );\n}\n"]}

package/dist/application/recovery-retention.types.d.ts

@@ -0,0 +1,52 @@
+import type { RecoveryInspection } from "./recovery-inspection.types.ts";
+export interface RecoveryRetentionPolicy {
+    readonly version: 1;
+    readonly scopes: readonly ("clean-workspaces" | "closed-logs")[];
+    readonly minAgeMs: number;
+    readonly maxBytes?: number;
+    readonly maxWorkspaces?: number;
+}
+export interface RecoveryRetentionOptions {
+    readonly repository?: string;
+    readonly policy: RecoveryRetentionPolicy;
+    readonly maxEntries?: number;
+}
+export interface RecoveryRetentionEntry {
+    readonly path: string;
+    readonly category: string;
+    readonly bytes: number;
+    readonly eligible: boolean;
+    readonly reason: string;
+    readonly branch?: string;
+    readonly head?: string;
+    readonly modifiedAt?: string;
+}
+export interface RecoveryRetentionPlan {
+    readonly repository: string;
+    readonly policy: RecoveryRetentionPolicy;
+    readonly inspectedAt: string;
+    readonly inspection: RecoveryInspection;
+    readonly entries: readonly RecoveryRetentionEntry[];
+    readonly complete: boolean;
+    readonly usageBytes: number;
+    readonly projectedBytes: number;
+    readonly quota: "within" | "exceeded" | "unknown";
+}
+export interface RecoveryRetainedEntry {
+    readonly path: string;
+    readonly reason: string;
+}
+export interface RecoveryPruneResult {
+    readonly removed: readonly string[];
+    readonly retained: readonly {
+        readonly path: string;
+        readonly reason: string;
+    }[];
+    readonly after: RecoveryRetentionPlan;
+}
+export interface RecoveryQuotaOptions {
+    readonly repository?: string;
+    readonly maxBytes: number;
+    readonly reserveBytes?: number;
+    readonly maxEntries?: number;
+}

package/dist/application/recovery-retention.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=recovery-retention.types.js.map

package/dist/application/recovery-retention.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-retention.types.js","sourceRoot":"","sources":["../../src/application/recovery-retention.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { RecoveryInspection } from \"./recovery-inspection.types.ts\";\nexport interface RecoveryRetentionPolicy {\n  readonly version: 1;\n  readonly scopes: readonly (\"clean-workspaces\" | \"closed-logs\")[];\n  readonly minAgeMs: number;\n  readonly maxBytes?: number;\n  readonly maxWorkspaces?: number;\n}\nexport interface RecoveryRetentionOptions {\n  readonly repository?: string;\n  readonly policy: RecoveryRetentionPolicy;\n  readonly maxEntries?: number;\n}\nexport interface RecoveryRetentionEntry {\n  readonly path: string;\n  readonly category: string;\n  readonly bytes: number;\n  readonly eligible: boolean;\n  readonly reason: string;\n  readonly branch?: string;\n  readonly head?: string;\n  readonly modifiedAt?: string;\n}\nexport interface RecoveryRetentionPlan {\n  readonly repository: string;\n  readonly policy: RecoveryRetentionPolicy;\n  readonly inspectedAt: string;\n  readonly inspection: RecoveryInspection;\n  readonly entries: readonly RecoveryRetentionEntry[];\n  readonly complete: boolean;\n  readonly usageBytes: number;\n  readonly projectedBytes: number;\n  readonly quota: \"within\" | \"exceeded\" | \"unknown\";\n}\nexport interface RecoveryRetainedEntry {\n  readonly path: string;\n  readonly reason: string;\n}\nexport interface RecoveryPruneResult {\n  readonly removed: readonly string[];\n  readonly retained: readonly {\n    readonly path: string;\n    readonly reason: string;\n  }[];\n  readonly after: RecoveryRetentionPlan;\n}\nexport interface RecoveryQuotaOptions {\n  readonly repository?: string;\n  readonly maxBytes: number;\n  readonly reserveBytes?: number;\n  readonly maxEntries?: number;\n}\n"]}

package/dist/application/recovery-verification.constants.d.ts

@@ -0,0 +1,5 @@
+export declare const recoveryVerificationDefaults: {
+    readonly maxStateBytes: 65536;
+    readonly maxPaths: 1000;
+};
+export declare const recoveryTransferPatches: readonly ["remote.patch", "previous.patch", "previous-index.patch"];

package/dist/application/recovery-verification.constants.js

@@ -0,0 +1,10 @@
+export const recoveryVerificationDefaults = {
+    maxStateBytes: 65_536,
+    maxPaths: 1000,
+};
+export const recoveryTransferPatches = [
+    "remote.patch",
+    "previous.patch",
+    "previous-index.patch",
+];
+//# sourceMappingURL=recovery-verification.constants.js.map

package/dist/application/recovery-verification.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-verification.constants.js","sourceRoot":"","sources":["../../src/application/recovery-verification.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,aAAa,EAAE,MAAM;IACrB,QAAQ,EAAE,IAAI;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,cAAc;IACd,gBAAgB;IAChB,sBAAsB;CACd,CAAC","sourcesContent":["export const recoveryVerificationDefaults = {\n  maxStateBytes: 65_536,\n  maxPaths: 1000,\n} as const;\n\nexport const recoveryTransferPatches = [\n  \"remote.patch\",\n  \"previous.patch\",\n  \"previous-index.patch\",\n] as const;\n"]}

package/dist/application/recovery-verification.d.ts

@@ -0,0 +1,2 @@
+import type { RecoveryVerification, RecoveryVerificationOptions } from "./recovery-verification.types.ts";
+export declare function verifyRecoveryTransfer(path: string, options?: RecoveryVerificationOptions): Promise<RecoveryVerification>;