@eyeauras/insight-cli 0.0.0-stage → 0.1.0

package/dist/src/server.js

@@ -0,0 +1,455 @@
+import { randomUUID, randomBytes, createHash } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { readFile, mkdir, open, rename, readdir, stat, chmod, realpath } from 'node:fs/promises';
+import { delimiter, dirname, join, resolve } from 'node:path';
+import { createServer } from 'node:net';
+import { setTimeout as delay } from 'node:timers/promises';
+import { fail, object, stable, text, digest } from './model.js';
+import { nativeHelpers, nativeJvmDirectories, nativeExtensionArguments } from './native-inputs.js';
+import { parseDomainJson } from './json.js';
+const live = (pid) => {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ESRCH')
+            return false;
+        throw error;
+    }
+};
+async function durable(path, value) {
+    const temporary = path + '.new-' + randomUUID(), handle = await open(temporary, 'wx', 0o600);
+    try {
+        await handle.writeFile(stable(value));
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    await rename(temporary, path);
+    if (process.platform !== 'win32') {
+        const directory = await open(dirname(path), 'r');
+        try {
+            await directory.sync();
+        }
+        finally {
+            await directory.close();
+        }
+    }
+}
+async function ports(count) {
+    for (let attempt = 0; attempt < 100; attempt++) {
+        const base = 20000 + Math.floor(Math.random() * 30000), held = [];
+        try {
+            for (let index = 0; index < count; index++) {
+                const listener = createServer();
+                held.push(listener);
+                await new Promise((resolve, reject) => { listener.once('error', reject); listener.listen(base + index, '127.0.0.1', resolve); });
+            }
+            return base;
+        }
+        catch { /* Collision is retried before any resource or process is published. */ }
+        finally {
+            await Promise.all(held.filter(listener => listener.listening).map(listener => new Promise(resolve => listener.close(() => resolve()))));
+        }
+    }
+    fail('launch', 'Could not reserve loopback ports for the owned server.');
+}
+/** Own local startup; external profiles connect without taking ownership of their server. */
+export class GhidraServer {
+    directory;
+    inputs;
+    c;
+    state;
+    constructor(directory, inputs, c, state = {}) {
+        this.directory = directory;
+        this.inputs = inputs;
+        this.c = c;
+        this.state = state;
+    }
+    fork(c) { return new GhidraServer(this.directory, this.inputs, c, this.state); }
+    root() { return join(this.directory, 'server'); }
+    async run(label, main, args, environment = {}, input, acceptedCodes = [0], timeoutMilliseconds = 120000) {
+        const root = join(this.root(), 'calls', label + '-' + randomUUID());
+        await mkdir(root, { recursive: true, mode: 0o700 });
+        const classes = await nativeHelpers(this.directory, this.inputs);
+        const log = await open(join(root, 'diagnostic.log'), 'a', 0o600);
+        const child = spawn(this.inputs.java, ['-Djava.awt.headless=true', '-Dghidra.home=' + this.inputs.ghidraHome,
+            ...nativeJvmDirectories(root), ...nativeExtensionArguments(this.inputs), '-cp', classes + delimiter + this.inputs.classpath, main, ...args], { cwd: root, windowsHide: true, env: { PATH: this.c.environment.PATH ?? process.env.PATH, HOME: root, TMPDIR: root, ...environment }, stdio: ['pipe', 'pipe', log.fd] });
+        const exited = new Promise((resolve, reject) => { child.once('error', reject); child.once('exit', resolve); });
+        exited.catch(() => { });
+        await log.close();
+        let output = '', overflow = false;
+        child.stdout.on('data', chunk => { if (!overflow)
+            output += chunk.toString(); if (Buffer.byteLength(output) > 1024 * 1024) {
+            overflow = true;
+            child.kill('SIGTERM');
+        } });
+        const abort = () => child.kill('SIGTERM');
+        this.c.signal.addEventListener('abort', abort, { once: true });
+        const timer = setTimeout(abort, timeoutMilliseconds);
+        const force = setTimeout(() => { if (child.exitCode === null && child.signalCode === null)
+            child.kill('SIGKILL'); }, timeoutMilliseconds + 5000);
+        try {
+            child.stdin.on('error', () => { });
+            child.stdin.end(input);
+            if (this.c.signal.aborted)
+                abort();
+            const code = await exited;
+            if (code === null || !acceptedCodes.includes(code) || overflow)
+                fail('authorization', 'Native server operation could not be verified; its owned diagnostic stage is retained.');
+            let result;
+            try {
+                result = object(parseDomainJson(output));
+            }
+            catch {
+                fail('malformed', 'Native server operation returned malformed content.');
+            }
+            if (result.error || result.state === 'failed')
+                fail('authorization', 'Native server operation did not establish its outcome.');
+            return result;
+        }
+        finally {
+            clearTimeout(timer);
+            clearTimeout(force);
+            this.c.signal.removeEventListener('abort', abort);
+        }
+    }
+    async credentials(binding, role) {
+        const url = new URL(binding.origin);
+        return { GHIDRA_SERVER_HOST: url.hostname, GHIDRA_SERVER_PORT: url.port || '13100',
+            GHIDRA_SERVER_USER: role === 'reader' ? binding.readerUser : binding.publisherUser,
+            GHIDRA_SERVER_PASSWORD: await this.c.secrets.require(role === 'reader' ? binding.readerSecret : binding.publisherSecret) };
+    }
+    async fields(snapshot, selectors) {
+        return this.run('snapshot-fields', 'InsightSnapshotFields', [snapshot, selectors]);
+    }
+    async inspect(snapshot, request) { return this.run('snapshot-inspect', 'InsightSnapshotInspect', [snapshot, request]); }
+    async sdkFile(operation, p) {
+        const root = join(this.root(), 'sdk-files', randomUUID());
+        await mkdir(root, { recursive: true, mode: 0o700 });
+        const tracking = operation.startsWith('vt.');
+        const request = join(root, 'request.json');
+        await durable(request, { ...p, operation: tracking ? operation.slice(3) : operation });
+        const main = tracking ? 'InsightVersionTracking' : /^(fid|bsim)-(build|query)$/.test(operation) ? 'InsightFunctionDatabases' : 'InsightSdkFiles';
+        const result = await this.run('sdk-file', main, [request]);
+        return object(result.value);
+    }
+    async traceInspect(snapshot) { return this.run('trace-inspect', 'InsightTraceInspect', [snapshot]); }
+    async project(operation, parameters) {
+        const requestId = text(parameters.request_id, 128);
+        if (!/^(?:a|read)_[a-zA-Z0-9-]+$/.test(requestId))
+            fail('binding', 'Invalid internal project request identity.');
+        const parent = join(this.directory, 'project-calls');
+        await mkdir(parent, { recursive: true, mode: 0o700 });
+        if (await realpath(parent) !== resolve(parent))
+            fail('binding', 'Project call container moved outside owned storage.');
+        const root = join(parent, requestId);
+        await mkdir(root, { mode: 0o700 });
+        const request = join(root, 'request.json');
+        await durable(request, { ...parameters, operation });
+        return this.run('project-files', 'InsightProjectFiles', [request]);
+    }
+    async projectOutcome(requestId, expected) {
+        if (!/^a_[a-zA-Z0-9-]+$/.test(requestId))
+            fail('binding', 'Invalid retained project request identity.');
+        const root = join(this.directory, 'project-calls', requestId);
+        try {
+            if (await realpath(root) !== resolve(root))
+                fail('binding', 'Retained project call moved outside owned storage.');
+            const raw = await readFile(join(root, 'request.json'), 'utf8'), request = object(parseDomainJson(raw)), journal = object(parseDomainJson(await readFile(join(root, 'result.json'), 'utf8')));
+            if (journal.schema !== 1 || journal.request !== requestId || journal.hash !== createHash('sha256').update(raw).digest('hex') ||
+                Object.entries(expected).some(([key, value]) => stable(request[key]) !== stable(value)))
+                fail('binding', 'Project completion journal differs from the retained request.');
+            return object(journal.result);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return;
+            throw error;
+        }
+    }
+    async administration(operation, parameters) {
+        const connection = join(this.root(), 'connection.json');
+        if (operation === 'status') {
+            try {
+                if (object(JSON.parse(await readFile(connection, 'utf8'))).enabled === false)
+                    return { connected: false, mode: this.c.profile.values.server ? 'external' : 'local', state: 'disconnected' };
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+        if (operation === 'connect') {
+            await mkdir(this.root(), { recursive: true, mode: 0o700 });
+            await durable(connection, { enabled: true });
+        }
+        if (operation === 'disconnect') {
+            await this.stop();
+            await mkdir(this.root(), { recursive: true, mode: 0o700 });
+            await durable(connection, { enabled: false });
+            return { connected: false, mode: this.c.profile.values.server ? 'external' : 'local' };
+        }
+        if (operation === 'status' && !this.c.profile.values.server) {
+            let local;
+            try {
+                local = JSON.parse(await readFile(join(this.root(), 'local.json'), 'utf8'));
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    return { connected: false, mode: 'local', state: 'not_started' };
+                throw error;
+            }
+            if (!local.pid || !live(local.pid))
+                return { connected: false, mode: 'local', repository: local.repository };
+            await this.identity(local);
+            await this.authority(local);
+            return { connected: true, mode: 'local', repository: local.repository };
+        }
+        const binding = await this.ensure();
+        if (operation === 'connect' || operation === 'status')
+            return { connected: true, mode: binding.mode, repository: binding.repository };
+        if (operation === 'set_permissions' && parameters.repository === binding.repository &&
+            (parameters.user === binding.readerUser && parameters.access !== 0 || parameters.user === binding.publisherUser && ![1, 2].includes(Number(parameters.access))))
+            fail('authorization', 'Canonical reader/publisher authority cannot be changed by repository administration.');
+        const root = join(this.root(), 'administration', randomUUID());
+        await mkdir(root, { recursive: true, mode: 0o700 });
+        const request = join(root, 'request.json');
+        await durable(request, { operation, ...parameters, protected_repository: binding.repository });
+        return this.run('administration', 'InsightServerAdministration', [request], await this.credentials(binding, 'publisher'));
+    }
+    async programStatus(binding, path) {
+        return this.run('program-status', 'InsightRepositoryProbe', [binding.repository, path, 'reader'], await this.credentials(binding, 'reader'));
+    }
+    async initialImport(root) { return this.run('initial-import', 'InsightInitialImport', [root], {}, undefined, [0], 600000); }
+    async initialPublication(binding, root, operation = 'stage') {
+        return this.run('initial-publication', 'db.InsightInitialPublication', [root, operation], await this.credentials(binding, operation.startsWith('verify') ? 'reader' : 'publisher'));
+    }
+    async publish(binding, path, snapshot, expected, request, journal, sourceSha) {
+        return this.run('publish', 'db.InsightSnapshotPublisher', [binding.repository, path, snapshot, String(expected), 'insight merge ' + request, journal, sourceSha], await this.credentials(binding, 'publisher'), undefined, [0, 2]);
+    }
+    async recoverPublication(binding, path, snapshot, expected, request, journal, sourceSha) {
+        return this.run('recover-publication', 'db.InsightPublicationRecovery', [binding.repository, path, snapshot, String(expected), 'insight merge ' + request, journal, sourceSha], { ...await this.credentials(binding, 'reader'), INSIGHT_PUBLISHER_USER: binding.publisherUser,
+            INSIGHT_PUBLISHER_PASSWORD: await this.c.secrets.require(binding.publisherSecret) });
+    }
+    async authority(binding) {
+        for (const role of ['reader', 'publisher']) {
+            const result = await this.run('verify-' + role, 'InsightServerProbe', [binding.repository, role], await this.credentials(binding, role));
+            if (result.repository !== binding.repository || result.role !== role || (role === 'reader' ? result.permission !== 0 : ![1, 2].includes(Number(result.permission))))
+                fail('authorization', 'Actual repository permissions do not match the selected server profile.');
+        }
+    }
+    async ensure() {
+        try {
+            if (object(JSON.parse(await readFile(join(this.root(), 'connection.json'), 'utf8'))).enabled === false)
+                fail('blocked', 'Configured server is disconnected; use ghidra server connect before shared operations.');
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        if (!this.state.initializing)
+            this.state.initializing = this.initialize().catch(error => { this.state.initializing = undefined; throw error; });
+        const binding = await this.state.initializing;
+        if (binding.mode === 'local') {
+            const local = binding;
+            if (local.pid && !live(local.pid)) {
+                this.state.initializing = undefined;
+                return this.ensure();
+            }
+            await this.identity(local);
+        }
+        return binding;
+    }
+    async initialize() {
+        const root = this.root();
+        await mkdir(root, { recursive: true, mode: 0o700 });
+        const values = this.c.profile.values;
+        const mode = values.server ? 'external' : 'local';
+        const effective = mode === 'external' ? { mode, origin: text(values.server), repository: text(values.repository),
+            readerUser: text(values.readerUser), publisherUser: text(values.publisherUser) } : { mode };
+        if (mode === 'external' && (!/^ghidra:\/\/[^/?#@]+$/.test(text(values.server)) || /[\\/]/.test(text(values.repository)) ||
+            text(values.repository).startsWith('.') || values.readerUser === values.publisherUser))
+            fail('configuration', 'External server requires an origin, repository and distinct reader/publisher accounts.');
+        const configuration = digest(effective), configured = join(root, 'configuration.json');
+        try {
+            if (object(JSON.parse(await readFile(configured, 'utf8'))).hash !== configuration)
+                fail('binding', 'Server profile changed while its durable workspace remains; restore the original binding.');
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            await durable(configured, { hash: configuration });
+        }
+        if (mode === 'external') {
+            const origin = text(values.server), repository = text(values.repository), readerUser = text(values.readerUser), publisherUser = text(values.publisherUser);
+            if (!/^ghidra:\/\/[^/?#@]+$/.test(origin) || new URL(origin).protocol !== 'ghidra:' || /[\\/]/.test(repository) || repository.startsWith('.') || readerUser === publisherUser)
+                fail('configuration', 'External server requires an origin, repository and distinct reader/publisher accounts.');
+            const binding = { mode, origin, repository, readerUser, publisherUser, readerSecret: 'readerPassword', publisherSecret: 'publisherPassword' };
+            await this.authority(binding);
+            return binding;
+        }
+        const saved = join(root, 'local.json'), data = join(root, 'data');
+        let local;
+        try {
+            local = JSON.parse(await readFile(saved, 'utf8'));
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            await mkdir(data, { recursive: true, mode: 0o700 });
+            if ((await readdir(data)).length)
+                fail('binding', 'Unidentified server storage exists; it cannot be adopted.');
+            const instance = 'server_' + randomUUID(), base = await ports(4);
+            local = { mode: 'local', instance, port: base, identityPort: base + 3, origin: `ghidra://127.0.0.1:${base}`,
+                repository: 'insight_' + randomUUID().replaceAll('-', ''), readerUser: 'reader', publisherUser: 'publisher',
+                readerSecret: instance + '-readerPassword', publisherSecret: instance + '-publisherPassword',
+                keySecret: instance + '-keystorePassword', tokenSecret: instance + '-identityToken', phase: 'seeded' };
+            await durable(saved, local);
+        }
+        if (local.mode !== 'local' || !/^server_[a-f0-9-]{36}$/.test(local.instance) || local.origin !== `ghidra://127.0.0.1:${local.port}` ||
+            local.identityPort !== local.port + 3 || !local.repository.startsWith('insight_') || local.readerUser !== 'reader' || local.publisherUser !== 'publisher')
+            fail('binding', 'Owned local server receipt is inconsistent.');
+        for (const key of [local.readerSecret, local.publisherSecret, local.keySecret, local.tokenSecret]) {
+            if (!key.startsWith(local.instance + '-'))
+                fail('binding', 'Owned local server secret reference is inconsistent.');
+            if (!await this.c.secrets.get(key)) {
+                if (local.phase !== 'seeded')
+                    fail('credentials', 'Owned local server credentials are missing; retain its storage and restore its credential store.');
+                await this.c.secrets.set(key, randomBytes(32).toString('hex'));
+            }
+        }
+        if (local.pid && live(local.pid)) {
+            await this.identity(local);
+            await this.authority(local);
+            return local;
+        }
+        // A prior owner may have died after spawn and before recording its PID.
+        if (!local.pid && await this.identity(local).then(() => true, () => false)) {
+            const identity = await this.identity(local);
+            local.pid = Number(identity.pid);
+            local.phase = 'running';
+            await durable(saved, local);
+            await this.authority(local);
+            return local;
+        }
+        const initialized = await this.run('initialize', 'ghidra.server.InsightServerInit', [data, local.repository, local.publisherUser, local.readerUser], {
+            INSIGHT_PUBLISHER_PASSWORD: await this.c.secrets.require(local.publisherSecret), INSIGHT_READER_PASSWORD: await this.c.secrets.require(local.readerSecret)
+        });
+        if (initialized.state !== 'ready' || initialized.repository !== local.repository || initialized.readerReadOnly !== true || initialized.publisherAdmin !== true)
+            fail('authorization', 'Owned local server initialization did not establish its permission boundary.');
+        local.phase = 'initialized';
+        delete local.pid;
+        await durable(saved, local);
+        const keystore = join(root, 'owned-cert.p12');
+        try {
+            await stat(keystore);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            // keytool gets the random password through its documented environment input, never argv.
+            await this.run('certificate', 'InsightKeytool', [keystore], { INSIGHT_KEYSTORE_PASSWORD: await this.c.secrets.require(local.keySecret) });
+            await chmod(keystore, 0o600);
+        }
+        const classes = await nativeHelpers(this.directory, this.inputs);
+        const processRoot = join(root, 'processes', randomUUID());
+        await mkdir(processRoot, { recursive: true, mode: 0o700 });
+        const log = await open(join(processRoot, 'runtime.log'), 'a', 0o600);
+        const child = spawn(this.inputs.java, ['-Djava.awt.headless=true', '-Dghidra.home=' + this.inputs.ghidraHome,
+            ...nativeJvmDirectories(processRoot), '-cp', classes + delimiter + (this.inputs.serverClasspath ?? this.inputs.classpath),
+            'InsightServerMain', data, String(local.port), String(local.identityPort), local.instance, keystore], { cwd: processRoot, detached: true, windowsHide: true, env: { PATH: this.c.environment.PATH ?? process.env.PATH, HOME: processRoot, TMPDIR: processRoot,
+                INSIGHT_KEYSTORE_PASSWORD: await this.c.secrets.require(local.keySecret), INSIGHT_SERVER_TOKEN: await this.c.secrets.require(local.tokenSecret) }, stdio: ['ignore', log.fd, log.fd] });
+        child.on('error', () => { });
+        child.unref();
+        await log.close();
+        if (!child.pid)
+            fail('launch', 'Owned local Ghidra server could not be started.');
+        this.state.child = child;
+        local.pid = child.pid;
+        local.phase = 'running';
+        await durable(saved, local);
+        try {
+            const deadline = Date.now() + 60000;
+            while (Date.now() < deadline && child.exitCode === null && child.signalCode === null && !this.c.signal.aborted) {
+                try {
+                    await this.identity(local);
+                    await this.authority(local);
+                    return local;
+                }
+                catch {
+                    await delay(100);
+                }
+            }
+            fail('launch', 'Owned local Ghidra server did not become ready; its storage and diagnostic stage are retained.');
+        }
+        catch (error) {
+            // Only this newly-created child handle can be cleaned without a ready identity probe.
+            if (child.exitCode === null && child.signalCode === null)
+                child.kill('SIGTERM');
+            for (let i = 0; i < 100 && child.exitCode === null && child.signalCode === null; i++)
+                await delay(50);
+            throw error;
+        }
+    }
+    async identity(local) {
+        const token = await this.c.secrets.require(local.tokenSecret);
+        const response = await this.c.fetch(`http://127.0.0.1:${local.identityPort}/identity`, { redirect: 'error',
+            signal: AbortSignal.timeout(1000), headers: { Authorization: 'Bearer ' + token } });
+        if (!response.ok || Number(response.headers.get('content-length')) > 4096)
+            fail('binding', 'Owned server identity was not verified.');
+        const reader = response.body?.getReader();
+        if (!reader)
+            fail('binding', 'Owned server identity has no body.');
+        const chunks = [];
+        let size = 0;
+        try {
+            for (;;) {
+                const next = await reader.read();
+                if (next.done)
+                    break;
+                size += next.value.byteLength;
+                if (size > 4096)
+                    fail('binding', 'Owned server identity exceeded its bound.');
+                chunks.push(next.value);
+            }
+        }
+        finally {
+            await reader.cancel().catch(() => { });
+        }
+        const value = Buffer.concat(chunks).toString('utf8');
+        const result = object(JSON.parse(value));
+        if (result.instance !== local.instance || result.port !== local.port || !Number.isSafeInteger(result.pid) || Number(result.pid) < 1 ||
+            local.pid !== undefined && result.pid !== local.pid)
+            fail('binding', 'Server endpoint no longer belongs to the recorded owned process.');
+        return result;
+    }
+    async stop() {
+        let local;
+        try {
+            local = JSON.parse(await readFile(join(this.root(), 'local.json'), 'utf8'));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return;
+            throw error;
+        }
+        if (!local.pid)
+            return;
+        if (live(local.pid)) {
+            await this.identity(local);
+            process.kill(local.pid, 'SIGTERM');
+            for (let i = 0; i < 100 && live(local.pid); i++)
+                await delay(50);
+            if (live(local.pid))
+                fail('busy', 'Owned server did not stop; its receipt is retained.');
+        }
+        local.phase = 'stopped';
+        delete local.pid;
+        await durable(join(this.root(), 'local.json'), local);
+        this.state.child = undefined;
+        this.state.initializing = undefined;
+    }
+}

package/dist/src/store.d.ts

@@ -0,0 +1,33 @@
+import { type Batch, type Binding, type FindingRecord, type State, type Target } from './model.js';
+export declare class Store {
+    readonly directory: string;
+    readonly profile: string;
+    readonly server: string;
+    static pending(directory: string): boolean;
+    private db;
+    constructor(directory: string, profile: string, server: string);
+    close(): void;
+    private transaction;
+    register(value: unknown): Target;
+    target(id: string): Target;
+    targets(): Target[];
+    submit(value: unknown): FindingRecord;
+    getFinding(id: string): FindingRecord;
+    findings(targetId?: string): FindingRecord[];
+    begin(targetId: string): Batch | undefined;
+    batch(id: string): Batch;
+    batches(): Batch[];
+    update(id: string, state: State, patch?: Partial<Omit<Batch, 'id' | 'targetId' | 'findings'>>): Batch;
+    conflicts(id: string, conflicts: unknown): void;
+    private event;
+    events(id: string): {
+        seq: import("node:sqlite").SQLOutputValue | undefined;
+        state: import("node:sqlite").SQLOutputValue | undefined;
+        data: any;
+    }[];
+    worker(id: string): Binding;
+    putWorker(id: string, targetId: string, binding: Binding): void;
+    updateReader(id: string, binding: Binding): void;
+    workers(): any[];
+    removeWorker(id: string): void;
+}

package/dist/src/store.js

@@ -0,0 +1,178 @@
+import { DatabaseSync } from 'node:sqlite';
+import { mkdirSync, chmodSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { assertIdentity, digest, fail, finding, identity, stable } from './model.js';
+export class Store {
+    directory;
+    profile;
+    server;
+    static pending(directory) {
+        const path = join(directory, 'coordinator.sqlite');
+        if (!existsSync(path))
+            return false;
+        const db = new DatabaseSync(path, { readOnly: true });
+        try {
+            return Number(db.prepare("SELECT COUNT(*) AS count FROM findings WHERE state != 'published_verified'").get()?.count) > 0;
+        }
+        finally {
+            db.close();
+        }
+    }
+    db;
+    constructor(directory, profile, server) {
+        this.directory = directory;
+        this.profile = profile;
+        this.server = server;
+        mkdirSync(directory, { recursive: true, mode: 0o700 });
+        const path = join(directory, 'coordinator.sqlite');
+        this.db = new DatabaseSync(path);
+        chmodSync(path, 0o600);
+        this.db.exec(`PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL; PRAGMA foreign_keys=ON; PRAGMA busy_timeout=5000;
+      CREATE TABLE IF NOT EXISTS targets(id TEXT PRIMARY KEY, lane TEXT NOT NULL UNIQUE, data TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS findings(id TEXT PRIMARY KEY, request_id TEXT NOT NULL UNIQUE, hash TEXT NOT NULL, target_id TEXT NOT NULL REFERENCES targets(id), state TEXT NOT NULL, batch_id TEXT, data TEXT NOT NULL, conflict TEXT);
+      CREATE TABLE IF NOT EXISTS batches(id TEXT PRIMARY KEY, target_id TEXT NOT NULL REFERENCES targets(id), state TEXT NOT NULL, owner_pid INTEGER NOT NULL, data TEXT NOT NULL);
+      CREATE UNIQUE INDEX IF NOT EXISTS active_lane ON batches(target_id) WHERE state IN ('applying','staged','checking_in','publication_unknown','failed');
+      CREATE TABLE IF NOT EXISTS events(seq INTEGER PRIMARY KEY AUTOINCREMENT, batch_id TEXT NOT NULL, state TEXT NOT NULL, data TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS workers(id TEXT PRIMARY KEY, target_id TEXT NOT NULL, data TEXT NOT NULL);
+      PRAGMA user_version=1;`);
+    }
+    close() { this.db.close(); }
+    transaction(action) {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const result = action();
+            this.db.exec('COMMIT');
+            return result;
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    register(value) {
+        const selected = identity(value);
+        if (selected.profile !== this.profile || selected.server !== this.server)
+            fail('binding', 'Target must match the selected profile and server.');
+        const lane = digest([selected.profile, selected.server, selected.repository, selected.programPath]);
+        const target = { ...selected, id: 't-' + digest(selected).slice(0, 24), lane };
+        return this.transaction(() => {
+            const existing = this.db.prepare('SELECT data FROM targets WHERE lane=?').get(lane);
+            if (existing) {
+                const t = JSON.parse(String(existing.data));
+                assertIdentity(t, target);
+                return t;
+            }
+            this.db.prepare('INSERT INTO targets VALUES(?,?,?)').run(target.id, lane, stable(target));
+            return target;
+        });
+    }
+    target(id) {
+        const row = this.db.prepare('SELECT data FROM targets WHERE id=?').get(id);
+        if (!row)
+            fail('notFound', 'Target was not found in the selected profile.');
+        const target = JSON.parse(String(row.data));
+        if (target.profile !== this.profile || target.server !== this.server)
+            fail('binding', 'Registered target belongs to a different profile or server.');
+        return target;
+    }
+    targets() { return this.db.prepare('SELECT data FROM targets ORDER BY id LIMIT 100').all().map(r => this.target(JSON.parse(String(r.data)).id)); }
+    submit(value) {
+        const f = finding(value);
+        assertIdentity(f.identity, this.target(f.targetId));
+        return this.transaction(() => {
+            const previous = this.db.prepare('SELECT id,hash FROM findings WHERE request_id=? OR id=?').all(f.requestId, f.findingId);
+            if (previous.length) {
+                if (previous.length !== 1 || previous[0]?.hash !== digest(f))
+                    fail('idempotency', 'Request or finding ID was already used with different content.');
+                return this.getFinding(String(previous[0].id));
+            }
+            const worker = this.worker(f.workerId);
+            assertIdentity(worker.identity, f.identity);
+            if (worker.role !== 'reader' || worker.version !== f.baselineVersion)
+                fail('binding', 'Finding does not match its registered reader baseline.');
+            if (f.resolves) {
+                const previous = this.getFinding(f.resolves);
+                if (previous.state !== 'conflict_pending' || previous.targetId !== f.targetId || previous.address !== f.address || previous.kind !== f.kind)
+                    fail('conflict', 'Resolution must reference a conflicting finding for the same scoped comment.');
+            }
+            this.db.prepare('INSERT INTO findings(id,request_id,hash,target_id,state,data) VALUES(?,?,?,?,?,?)').run(f.findingId, f.requestId, digest(f), f.targetId, 'queued', stable(f));
+            return this.getFinding(f.findingId);
+        });
+    }
+    getFinding(id) {
+        const row = this.db.prepare('SELECT * FROM findings WHERE id=?').get(id);
+        if (!row)
+            fail('notFound', 'Finding was not found.');
+        return { ...JSON.parse(String(row.data)), state: row.state, ...(row.batch_id ? { batchId: row.batch_id } : {}), ...(row.conflict ? { conflict: JSON.parse(String(row.conflict)) } : {}) };
+    }
+    findings(targetId) {
+        if (targetId)
+            this.target(targetId);
+        const rows = targetId ? this.db.prepare('SELECT id FROM findings WHERE target_id=? ORDER BY rowid LIMIT 100').all(targetId) : this.db.prepare('SELECT id FROM findings ORDER BY rowid LIMIT 100').all();
+        return rows.map(r => this.getFinding(String(r.id)));
+    }
+    begin(targetId) {
+        this.target(targetId);
+        return this.transaction(() => {
+            const active = this.db.prepare("SELECT id FROM batches WHERE target_id=? AND state IN ('applying','staged','checking_in','publication_unknown','failed')").get(targetId);
+            if (active)
+                fail('blocked', 'Publication lane requires recovery before new integration.', this.batch(String(active.id)));
+            const rows = this.db.prepare("SELECT id FROM findings WHERE target_id=? AND state='queued' ORDER BY rowid LIMIT 100").all(targetId);
+            if (!rows.length)
+                return undefined;
+            const id = 'b-' + randomUUID();
+            const batch = { id, targetId, state: 'applying', ownerPid: process.pid, findings: rows.map(r => this.getFinding(String(r.id))) };
+            this.db.prepare('INSERT INTO batches VALUES(?,?,?,?,?)').run(id, targetId, batch.state, process.pid, stable({}));
+            for (const row of rows)
+                this.db.prepare("UPDATE findings SET state='applying',batch_id=? WHERE id=?").run(id, row.id);
+            this.event(id, 'applying', {});
+            return this.batch(id);
+        });
+    }
+    batch(id) {
+        const row = this.db.prepare('SELECT * FROM batches WHERE id=?').get(id);
+        if (!row)
+            fail('notFound', 'Publication batch was not found.');
+        this.target(String(row.target_id));
+        return { ...JSON.parse(String(row.data)), id: String(row.id), targetId: String(row.target_id), state: String(row.state), ownerPid: Number(row.owner_pid), findings: this.db.prepare('SELECT id FROM findings WHERE batch_id=? ORDER BY rowid').all(id).map(r => this.getFinding(String(r.id))) };
+    }
+    batches() { return this.db.prepare('SELECT id FROM batches ORDER BY rowid DESC LIMIT 100').all().map(r => this.batch(String(r.id))); }
+    update(id, state, patch = {}) {
+        return this.transaction(() => {
+            const current = this.batch(id);
+            const { findings: _findings, id: _id, targetId: _targetId, ...data } = { ...current, ...patch, state };
+            this.db.prepare('UPDATE batches SET state=?,data=? WHERE id=?').run(state, stable(data), id);
+            this.db.prepare('UPDATE findings SET state=? WHERE batch_id=?').run(state, id);
+            this.event(id, state, patch);
+            return this.batch(id);
+        });
+    }
+    conflicts(id, conflicts) {
+        this.db.prepare('UPDATE findings SET conflict=? WHERE batch_id=?').run(stable(conflicts), id);
+    }
+    event(id, state, data) { this.db.prepare('INSERT INTO events(batch_id,state,data) VALUES(?,?,?)').run(id, state, stable(data)); }
+    events(id) { return this.db.prepare('SELECT seq,state,data FROM events WHERE batch_id=? ORDER BY seq').all(id).map(r => ({ seq: r.seq, state: r.state, data: JSON.parse(String(r.data)) })); }
+    worker(id) {
+        const row = this.db.prepare('SELECT data,target_id FROM workers WHERE id=?').get(id);
+        if (!row)
+            fail('notFound', 'Worker was not found.');
+        this.target(String(row.target_id));
+        return JSON.parse(String(row.data));
+    }
+    putWorker(id, targetId, binding) {
+        assertIdentity(binding.identity, this.target(targetId));
+        if (this.db.prepare('SELECT id FROM workers WHERE id=?').get(id))
+            fail('workerExists', 'Worker ID is already registered.');
+        this.db.prepare('INSERT INTO workers VALUES(?,?,?)').run(id, targetId, stable(binding));
+    }
+    updateReader(id, binding) {
+        const previous = this.worker(id);
+        assertIdentity(binding.identity, previous.identity);
+        if (previous.pid !== binding.pid || previous.endpoint !== binding.endpoint || previous.version !== binding.version || previous.projectDirectory !== binding.projectDirectory || previous.role !== 'reader' || binding.role !== 'reader' || previous.readEpoch && previous.readEpoch !== binding.readEpoch)
+            fail('binding', 'Reader update changed its immutable binding.');
+        this.db.prepare('UPDATE workers SET data=? WHERE id=?').run(stable(binding), id);
+    }
+    workers() { return this.db.prepare('SELECT id,target_id,data FROM workers ORDER BY id LIMIT 100').all().map(r => ({ id: r.id, targetId: r.target_id, ...JSON.parse(String(r.data)) })); }
+    removeWorker(id) { this.db.prepare('DELETE FROM workers WHERE id=?').run(id); }
+}