@forgezero/runtime 0.1.0 → 0.1.2

package/dist/queue.js

@@ -7,240 +7,276 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 });
 
 // src/queue.ts
-var systemClock = { now: () => Date.now() };
-var UNITS = { s: 1000, m: 60000, h: 3600000, d: 86400000 };
-function durationMs(value) {
-  if (typeof value === "number")
-    return value;
-  const match = /^(\d+)([smhd])$/.exec(value);
-  if (!match)
-    throw new Error(`"${value}" is not a duration like 30s, 5m, 1h, 1d.`);
-  return Number(match[1]) * UNITS[match[2]];
+class QueueStoppedError extends Error {
+  constructor() {
+    super("queue: stopped before this task could run");
+    this.name = "QueueStoppedError";
+  }
 }
-var MODES = ["standalone", "cluster"];
-function memoryStore(clock = systemClock) {
-  const messages = new Map;
-  const leases = new Map;
-  let fences = 0;
-  const all = (queue) => messages.get(queue) ?? [];
-  return {
-    mode: "standalone",
-    async append(queue, message) {
-      messages.set(queue, [...all(queue), message]);
-    },
-    async findByDedupe(queue, dedupeKey, sinceMs) {
-      return all(queue).find((message) => message.dedupeKey === dedupeKey && message.enqueuedAtMs >= sinceMs) ?? null;
-    },
-    async claimKey(queue, owner, ttlMs, nowMs) {
-      const ready = all(queue).filter((message) => message.status === "ready" && message.availableAtMs <= nowMs);
-      for (const message of ready.sort((a, b) => a.sequence - b.sequence)) {
-        const held = leases.get(`${queue}\x00${message.key}`);
-        if (held && held.untilMs > nowMs)
-          continue;
-        fences += 1;
-        const lease = { key: message.key, fence: fences, untilMs: nowMs + ttlMs, owner };
-        leases.set(`${queue}\x00${message.key}`, lease);
-        return lease;
-      }
-      return null;
-    },
-    async renewKey(queue, lease, ttlMs, nowMs) {
-      const held = leases.get(`${queue}\x00${lease.key}`);
-      if (!held || held.fence !== lease.fence)
-        return false;
-      held.untilMs = nowMs + ttlMs;
-      return true;
-    },
-    async releaseKey(queue, lease) {
-      const held = leases.get(`${queue}\x00${lease.key}`);
-      if (held?.fence === lease.fence)
-        leases.delete(`${queue}\x00${lease.key}`);
-    },
-    async readKey(queue, key, nowMs, limit) {
-      return all(queue).filter((message) => message.key === key && message.status === "ready" && message.availableAtMs <= nowMs).sort((a, b) => a.sequence - b.sequence).slice(0, limit);
-    },
-    async update(queue, id, patch) {
-      const message = all(queue).find((entry) => entry.id === id);
-      if (message)
-        Object.assign(message, patch);
-    },
-    async stats(queue) {
-      const list = all(queue);
-      return {
-        ready: list.filter((message) => message.status === "ready").length,
-        leased: list.filter((message) => message.status === "leased").length,
-        dead: list.filter((message) => message.status === "dead").length,
-        keys: new Set(list.filter((message) => message.status === "ready").map((m) => m.key)).size
-      };
-    },
-    async dead(queue, limit) {
-      return all(queue).filter((message) => message.status === "dead").sort((a, b) => b.sequence - a.sequence).slice(0, limit);
-    }
-  };
+
+class QueueKeyStoppedError extends Error {
+  key;
+  constructor(key) {
+    super(`queue: key ${key} is stopped`);
+    this.key = key;
+    this.name = "QueueKeyStoppedError";
+  }
+}
+
+class TaskCancelledError extends Error {
+  constructor() {
+    super("queue: task cancelled");
+    this.name = "TaskCancelledError";
+  }
 }
-function createQueue(options) {
-  const {
-    name,
-    store,
-    handler,
-    concurrency = 4,
-    leaseMs = 30000,
-    maxAttempts = 5,
-    backoffMs = 1000,
-    maxBackoffMs = 60000,
-    dedupeWindowMs = 300000,
-    batch = 32,
-    clock = systemClock,
-    owner = `worker-${Math.trunc(clock.now())}`
-  } = options;
-  if (options.require && store.mode !== options.require) {
-    throw new Error(`Queue "${name}" requires a ${options.require} store but was given a ${store.mode} one. ` + "A memory store loses everything on restart.");
+var DEFAULT_RETRY = {
+  attempts: 1,
+  backoffMs: (attempt) => Math.min(30000, 2 ** attempt * 100)
+};
+function createQueue(options = {}) {
+  const width = options.width ?? 8;
+  const retry = { ...DEFAULT_RETRY, ...options.retry };
+  if (!Number.isSafeInteger(width) || width < 1) {
+    throw new RangeError("queue: width must be a positive integer");
+  }
+  if (!Number.isSafeInteger(retry.attempts) || retry.attempts < 1) {
+    throw new RangeError("queue: retry attempts must be a positive integer");
   }
+  const sleep = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const lanes = new Map;
+  const running = new Set;
+  const paused = new Set;
+  const stoppedKeys = new Set;
   let sequence = 0;
-  let running = false;
-  let inFlight = 0;
-  const held = new Set;
-  const backoffFor = (attempt) => Math.min(maxBackoffMs, backoffMs * 2 ** Math.max(0, attempt - 1));
-  async function enqueue(args) {
-    if (!args.key)
-      throw new Error("Every message needs a key — it is what orders the work.");
-    const nowMs = clock.now();
-    if (args.dedupeKey) {
-      const existing = await store.findByDedupe(name, args.dedupeKey, nowMs - dedupeWindowMs);
-      if (existing)
-        return { id: existing.id, duplicate: true };
+  let globallyPaused = false;
+  let accepting = true;
+  let aborted = false;
+  let completed = 0;
+  let failed = 0;
+  const idle = [];
+  const announceIdle = () => {
+    if (running.size > 0)
+      return;
+    for (const lane of lanes.values())
+      if (lane.length > 0)
+        return;
+    while (idle.length > 0)
+      idle.shift()();
+  };
+  function pump() {
+    if (globallyPaused || aborted) {
+      announceIdle();
+      return;
     }
-    sequence += 1;
-    const message = {
-      id: `${name}-${nowMs}-${sequence}`,
-      key: args.key,
-      body: args.body,
-      sequence,
-      status: "ready",
-      attempts: 0,
-      availableAtMs: nowMs + (args.delayMs ?? 0),
-      dedupeKey: args.dedupeKey,
-      enqueuedAtMs: nowMs
-    };
-    await store.append(name, message);
-    return { id: message.id, duplicate: false };
+    for (const [key, lane] of lanes) {
+      if (running.size >= width)
+        break;
+      if (running.has(key) || paused.has(key) || lane.length === 0)
+        continue;
+      execute(key);
+    }
+    announceIdle();
   }
-  async function drainKey(lease) {
+  async function execute(key) {
+    running.add(key);
     try {
-      for (let taken = 0;taken < batch; taken += 1) {
-        const nowMs = clock.now();
-        if (!await store.renewKey(name, lease, leaseMs, nowMs))
-          return;
-        const [message] = await store.readKey(name, lease.key, nowMs, 1);
-        if (!message)
-          return;
-        await store.update(name, message.id, { status: "leased", attempts: message.attempts + 1 });
-        try {
-          await handler({ ...message, attempts: message.attempts + 1 }, {
-            holdsKey: () => store.renewKey(name, lease, leaseMs, clock.now()),
-            log: (line) => options.onError?.({ ...message }, line),
-            attempt: message.attempts + 1
-          });
-          await store.update(name, message.id, { status: "done", completedAtMs: clock.now() });
-        } catch (cause) {
-          const attempts = message.attempts + 1;
-          const reason = cause instanceof Error ? cause.message : String(cause);
-          options.onError?.(message, cause);
-          if (attempts >= maxAttempts) {
-            await store.update(name, message.id, { status: "dead", lastError: reason });
-            continue;
-          }
-          await store.update(name, message.id, {
-            status: "ready",
-            lastError: reason,
-            availableAtMs: clock.now() + backoffFor(attempts)
-          });
-          return;
-        }
+      const lane = lanes.get(key);
+      const entry = lane?.[0];
+      if (entry && !globallyPaused && !paused.has(key) && !aborted) {
+        lane.shift();
+        await attempt(entry);
       }
     } finally {
-      await store.releaseKey(name, lease);
-      held.delete(lease.key);
+      running.delete(key);
+      const remaining = lanes.get(key);
+      if (remaining?.length === 0)
+        lanes.delete(key);
+      else if (remaining) {
+        lanes.delete(key);
+        lanes.set(key, remaining);
+      }
+      pump();
     }
   }
-  async function tick() {
-    const claimed = [];
-    while (inFlight + claimed.length < concurrency) {
-      const lease = await store.claimKey(name, owner, leaseMs, clock.now());
-      if (!lease)
-        break;
-      if (held.has(lease.key))
-        break;
-      held.add(lease.key);
-      claimed.push(lease);
+  async function attempt(entry) {
+    if (entry.cancelled) {
+      entry.reject(new TaskCancelledError);
+      return;
     }
-    if (claimed.length === 0)
-      return 0;
-    inFlight += claimed.length;
-    try {
-      await Promise.all(claimed.map((lease) => drainKey(lease)));
-    } finally {
-      inFlight -= claimed.length;
+    for (;; ) {
+      entry.attempt += 1;
+      try {
+        const value = await entry.run();
+        completed += 1;
+        entry.resolve(value);
+        return;
+      } catch (cause) {
+        if (entry.attempt >= retry.attempts || entry.cancelled || aborted) {
+          failed += 1;
+          entry.reject(cause);
+          return;
+        }
+        const delay = retry.backoffMs(entry.attempt);
+        if (!Number.isFinite(delay) || delay < 0) {
+          failed += 1;
+          entry.reject(new RangeError("queue: retry backoff must be a non-negative finite number"));
+          return;
+        }
+        await sleep(delay);
+      }
     }
-    return claimed.length;
   }
   return {
-    enqueue,
-    tick,
-    async drain(maxPasses = 100) {
-      for (let pass = 0;pass < maxPasses; pass += 1) {
-        if (await tick() === 0)
+    run(key, handler, ...args) {
+      const id = `q_${++sequence}`;
+      if (!accepting || stoppedKeys.has(key)) {
+        const refused = Promise.reject(accepting ? new QueueKeyStoppedError(key) : new QueueStoppedError);
+        refused.catch(() => {
           return;
+        });
+        return { id, key, result: refused };
       }
+      let resolve;
+      let reject;
+      const result = new Promise((ok, no) => {
+        resolve = ok;
+        reject = no;
+      });
+      const entry = {
+        id,
+        key,
+        run: async () => handler(...args),
+        resolve,
+        reject,
+        attempt: 0,
+        cancelled: false
+      };
+      const lane = lanes.get(key);
+      if (lane)
+        lane.push(entry);
+      else
+        lanes.set(key, [entry]);
+      pump();
+      return { id, key, result };
     },
-    start(intervalMs = 200) {
-      if (running)
-        return;
-      running = true;
-      const loop = async () => {
-        while (running) {
-          try {
-            if (await tick() === 0)
-              await new Promise((r) => setTimeout(r, intervalMs));
-          } catch {
-            await new Promise((r) => setTimeout(r, intervalMs));
-          }
-        }
+    cancel(id) {
+      for (const [key, lane] of lanes) {
+        const index = lane.findIndex((entry2) => entry2.id === id);
+        if (index === -1)
+          continue;
+        const [entry] = lane.splice(index, 1);
+        entry.cancelled = true;
+        entry.reject(new TaskCancelledError);
+        if (lane.length === 0 && !running.has(key))
+          lanes.delete(key);
+        announceIdle();
+        return true;
+      }
+      return false;
+    },
+    pauseKey(key) {
+      paused.add(key);
+    },
+    resumeKey(key) {
+      paused.delete(key);
+      pump();
+    },
+    stopKey(key) {
+      stoppedKeys.add(key);
+      paused.delete(key);
+      const lane = lanes.get(key);
+      if (!lane)
+        return 0;
+      let removed = 0;
+      for (const entry of lane.splice(0)) {
+        removed += 1;
+        entry.cancelled = true;
+        entry.reject(new QueueKeyStoppedError(key));
+      }
+      if (!running.has(key))
+        lanes.delete(key);
+      announceIdle();
+      return removed;
+    },
+    startKey(key) {
+      const changed = stoppedKeys.delete(key);
+      pump();
+      return changed;
+    },
+    pause() {
+      globallyPaused = true;
+    },
+    resume() {
+      globallyPaused = false;
+      pump();
+    },
+    snapshot() {
+      let queued = 0;
+      for (const lane of lanes.values())
+        queued += lane.length;
+      return {
+        running: running.size,
+        queued,
+        keys: lanes.size,
+        paused: globallyPaused,
+        pausedKeys: [...paused],
+        stoppedKeys: [...stoppedKeys],
+        completed,
+        failed
       };
-      loop();
     },
-    stop() {
-      running = false;
+    whenIdle() {
+      if (running.size === 0 && [...lanes.values()].every((lane) => lane.length === 0)) {
+        return Promise.resolve();
+      }
+      return new Promise((resolve) => idle.push(resolve));
     },
-    mode: store.mode,
-    stats: () => store.stats(name),
-    dead: (limit = 50) => store.dead(name, limit),
-    async revive(id) {
-      await store.update(name, id, { status: "ready", attempts: 0, availableAtMs: clock.now() });
+    async stop(deadlineMs = 30000) {
+      if (!Number.isSafeInteger(deadlineMs) || deadlineMs < 0) {
+        throw new RangeError("queue: stop deadline must be a non-negative integer");
+      }
+      accepting = false;
+      const before = { completed, failed };
+      globallyPaused = false;
+      paused.clear();
+      pump();
+      let timedOut = false;
+      let deadlineHandle;
+      const deadline = new Promise((resolve) => {
+        deadlineHandle = setTimeout(() => {
+          timedOut = true;
+          resolve();
+        }, deadlineMs);
+      });
+      await Promise.race([this.whenIdle(), deadline]);
+      if (!timedOut && deadlineHandle !== undefined)
+        clearTimeout(deadlineHandle);
+      if (timedOut)
+        aborted = true;
+      let abandoned = 0;
+      for (const lane of lanes.values()) {
+        abandoned += lane.length;
+        for (const entry of lane.splice(0))
+          entry.reject(new QueueStoppedError);
+      }
+      abandoned += running.size;
+      for (const [key, lane] of lanes) {
+        if (lane.length === 0 && !running.has(key))
+          lanes.delete(key);
+      }
+      announceIdle();
+      return {
+        completed: completed - before.completed,
+        failed: failed - before.failed,
+        abandoned,
+        timedOut
+      };
     }
   };
 }
-var VERSION = "0.1.0";
-function clusterStore(adapter) {
-  return {
-    mode: "cluster",
-    append: (queue, message) => adapter.insert(queue, message),
-    findByDedupe: (queue, dedupeKey, sinceMs) => adapter.findDuplicate(queue, dedupeKey, sinceMs),
-    claimKey: (queue, owner, ttlMs, nowMs) => adapter.takeKey({ queue, owner, untilMs: nowMs + ttlMs, nowMs }),
-    renewKey: (queue, lease, ttlMs, nowMs) => adapter.extendKey(queue, lease.key, lease.fence, nowMs + ttlMs),
-    releaseKey: (queue, lease) => adapter.dropKey(queue, lease.key, lease.fence),
-    readKey: (queue, key, nowMs, limit) => adapter.readReady(queue, key, nowMs, limit),
-    update: (queue, id, patch) => adapter.patch(queue, id, patch),
-    stats: (queue) => adapter.counts(queue),
-    dead: (queue, limit) => adapter.deadLetter(queue, limit)
-  };
-}
 export {
-  systemClock,
-  memoryStore,
-  durationMs,
   createQueue,
-  clusterStore,
-  VERSION,
-  MODES
+  TaskCancelledError,
+  QueueStoppedError,
+  QueueKeyStoppedError
 };

package/dist/snp.d.ts

@@ -17,10 +17,9 @@
  * ## What this does NOT do
  *
  * It does not verify the signature. Chaining a report to AMD's root needs the
- * VCEK certificate for that specific chip at that specific TCB, fetched from
- * AMD's KDS — a network dependency with its own failure modes, and a
- * hand-rolled ECDSA-P384 verification here would be worse than none because it
- * would produce `verified: true` for a report nobody signed.
+ * VCEK certificate for that specific chip at that specific TCB and is performed
+ * by the API's pinned KDS verifier. Keeping network trust out of this parser
+ * preserves a total byte-to-fields function.
  *
  * So `parseSnpReport` returns the signature bytes and says nothing about them.
  * The caller supplies a verifier, which is the same shape every other trust
@@ -29,8 +28,8 @@
 /** The structure is exactly this long. Anything else is not a report. */
 export declare const REPORT_BYTES = 1184;
 export declare class SnpError extends Error {
-    readonly code: 'BAD_LENGTH' | 'BAD_VERSION' | 'BAD_VMPL';
-    constructor(code: 'BAD_LENGTH' | 'BAD_VERSION' | 'BAD_VMPL', message: string);
+    readonly code: 'BAD_LENGTH' | 'BAD_VERSION' | 'BAD_VMPL' | 'BAD_SIGNATURE_ALGORITHM';
+    constructor(code: 'BAD_LENGTH' | 'BAD_VERSION' | 'BAD_VMPL' | 'BAD_SIGNATURE_ALGORITHM', message: string);
 }
 /**
  * Guest policy bits.
@@ -61,6 +60,8 @@ export interface SnpReport {
     guestSvn: number;
     policy: GuestPolicy;
     vmpl: number;
+    /** 1 is ECDSA P-384 with SHA-384. */
+    signatureAlgorithm: number;
     /** 48 bytes of hex. What the guest actually booted. */
     measurement: string;
     /** 64 bytes of hex. Whatever the guest asked the PSP to bind in — our nonce. */

package/dist/snp.js

@@ -69,19 +69,24 @@ function parseSnpReport(bytes) {
   }
   const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
   const version = view.getUint32(OFFSET.version, true);
-  if (version !== 2 && version !== 3) {
+  if (version !== 2 && version !== 3 && version !== 5) {
     throw new SnpError("BAD_VERSION", `Report version ${version} is not one this parser understands.`);
   }
   const vmpl = view.getUint32(OFFSET.vmpl, true);
   if (vmpl > 3) {
     throw new SnpError("BAD_VMPL", `VMPL ${vmpl} is outside the defined range.`);
   }
+  const signatureAlgorithm = view.getUint32(OFFSET.signatureAlgo, true);
+  if (signatureAlgorithm !== 1) {
+    throw new SnpError("BAD_SIGNATURE_ALGORITHM", `Signature algorithm ${signatureAlgorithm} is not ECDSA P-384 with SHA-384.`);
+  }
   const slice = (offset, length) => hex(bytes.subarray(offset, offset + length));
   return {
     version,
     guestSvn: view.getUint32(OFFSET.guestSvn, true),
     policy: readPolicy(view, OFFSET.policy),
     vmpl,
+    signatureAlgorithm,
     measurement: slice(OFFSET.measurement, 48),
     reportData: slice(OFFSET.reportData, 64),
     hostData: slice(OFFSET.hostData, 32),

package/dist/ssh-agent.d.ts

@@ -46,6 +46,19 @@ export declare const AGENT_TIMEOUT_MS = 3000;
 export declare function listIdentities(socketPath?: string): Promise<AgentIdentity[]>;
 /** Ed25519 only. See the module note — determinism is the whole mechanism. */
 export declare function listCustodyIdentities(socketPath?: string): Promise<AgentIdentity[]>;
+/**
+ * Sign arbitrary bytes with an identity the agent holds.
+ *
+ * Exported because a fresh proof from a terminal needs it: the server issues a
+ * nonce and this is what turns it into something the server can verify against
+ * a registered public key. `deriveCustodyKey` signs a FIXED challenge and hashes
+ * the result — that is a key-derivation, not a proof, and using it as one would
+ * replay.
+ *
+ * Returns the raw ed25519 signature, unwrapped from the agent's blob, because
+ * that is what a verifier takes.
+ */
+export declare function signWithIdentity(identity: AgentIdentity, data: Uint8Array, socketPath?: string): Promise<Uint8Array>;
 /**
  * Derive the 32-byte custody key for an identity.
  *

package/dist/ssh-agent.js

@@ -100,6 +100,11 @@ async function listIdentities(socketPath) {
 async function listCustodyIdentities(socketPath) {
   return (await listIdentities(socketPath)).filter((id) => id.type === "ssh-ed25519");
 }
+async function signWithIdentity(identity, data, socketPath) {
+  const wrapped = await sign(identity.blob, Buffer.from(data), socketPath);
+  const [raw] = readString(wrapped, readString(wrapped, 0)[1]);
+  return new Uint8Array(raw);
+}
 async function sign(blob, data, socketPath) {
   const payload = Buffer.concat([
     Buffer.from([SSH_AGENTC_SIGN_REQUEST]),
@@ -132,6 +137,7 @@ async function assertDeterministic(identity, socketPath) {
   return first;
 }
 export {
+  signWithIdentity,
   listIdentities,
   listCustodyIdentities,
   deriveCustodyKey,