@hansjm10/volt-coding-agent 0.0.0-bootstrap.0 → 0.1.0

package/dist/core/remote/iroh/rpc-transport.js

@@ -0,0 +1,106 @@
+import { createIrohRpcTransport, } from "../../rpc/index.js";
+import { getIrohRemoteRpcFilterResult } from "./rpc-command-filter.js";
+/**
+ * Wrap an RPC transport with the remote Iroh command policy.
+ *
+ * Allowed commands are forwarded to the in-process RPC mode unchanged.
+ * Disallowed or malformed commands are rejected on the same transport without
+ * reaching Volt RPC handlers.
+ */
+export function createIrohRemoteFilteredRpcTransport(options) {
+    const pendingRejections = new Set();
+    let pendingRejectionError;
+    const startupAwareTransport = options.transport;
+    const recordRejectionError = (error) => {
+        const rejectionError = error instanceof Error ? error : new Error(String(error));
+        pendingRejectionError ??= rejectionError;
+        return rejectionError;
+    };
+    const trackRejectionWrite = (result) => {
+        if (!result) {
+            return;
+        }
+        const pending = Promise.resolve(result)
+            .catch((error) => {
+            recordRejectionError(error);
+        })
+            .finally(() => {
+            pendingRejections.delete(pending);
+        });
+        pendingRejections.add(pending);
+    };
+    const waitForRejectionWrites = async () => {
+        while (pendingRejections.size > 0) {
+            await Promise.allSettled(pendingRejections);
+        }
+        if (!pendingRejectionError) {
+            return;
+        }
+        const error = pendingRejectionError;
+        pendingRejectionError = undefined;
+        throw error;
+    };
+    return {
+        setRpcModeStartupComplete(startupComplete) {
+            startupAwareTransport.setRpcModeStartupComplete?.(startupComplete);
+        },
+        write(value) {
+            return options.transport.write(value);
+        },
+        onLine(handler) {
+            return options.transport.onLine(async (line) => {
+                const filterResult = getIrohRemoteRpcFilterResult(line, options.rpcGrant);
+                if (filterResult.allowed) {
+                    await handler(line);
+                    return;
+                }
+                try {
+                    const writeResult = options.transport.write(filterResult.response);
+                    trackRejectionWrite(writeResult);
+                    await writeResult;
+                }
+                catch (error) {
+                    recordRejectionError(error);
+                }
+            });
+        },
+        onClose(handler) {
+            return options.transport.onClose?.(handler) ?? (() => { });
+        },
+        async waitForBackpressure() {
+            await waitForRejectionWrites();
+            await options.transport.waitForBackpressure?.();
+        },
+        async flush() {
+            await waitForRejectionWrites();
+            await options.transport.flush?.();
+        },
+        async close() {
+            let rejectionError;
+            try {
+                await waitForRejectionWrites();
+            }
+            catch (error) {
+                rejectionError = error;
+            }
+            try {
+                await options.transport.close();
+            }
+            catch (closeError) {
+                if (!rejectionError) {
+                    throw closeError;
+                }
+            }
+            if (rejectionError) {
+                throw rejectionError;
+            }
+        },
+    };
+}
+export function createIrohRemoteRpcTransport(options) {
+    return createIrohRemoteFilteredRpcTransport({
+        transport: createIrohRpcTransport(options),
+        rpcGrant: options.rpcGrant,
+    });
+}
+//# sourceMappingURL=rpc-transport.js.map

package/dist/core/remote/iroh/rpc-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc-transport.js","sourceRoot":"","sources":["../../../../src/core/remote/iroh/rpc-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,sBAAsB,GAKtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AAYvE;;;;;;GAMG;AACH,MAAM,UAAU,oCAAoC,CACnD,OAA8C,EACkC;IAChF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAiB,CAAC;IACnD,IAAI,qBAAwC,CAAC;IAC7C,MAAM,qBAAqB,GAAG,OAAO,CAAC,SAAqC,CAAC;IAE5E,MAAM,oBAAoB,GAAG,CAAC,KAAc,EAAS,EAAE,CAAC;QACvD,MAAM,cAAc,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjF,qBAAqB,KAAK,cAAc,CAAC;QACzC,OAAO,cAAc,CAAC;IAAA,CACtB,CAAC;IAEF,MAAM,mBAAmB,GAAG,CAAC,MAA4B,EAAQ,EAAE,CAAC;QACnE,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO;QACR,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;aACrC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC;YAC1B,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAAA,CAC5B,CAAC;aACD,OAAO,CAAC,GAAG,EAAE,CAAC;YACd,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAAA,CAClC,CAAC,CAAC;QACJ,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAAA,CAC/B,CAAC;IAEF,MAAM,sBAAsB,GAAG,KAAK,IAAmB,EAAE,CAAC;QACzD,OAAO,iBAAiB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC5B,OAAO;QACR,CAAC;QACD,MAAM,KAAK,GAAG,qBAAqB,CAAC;QACpC,qBAAqB,GAAG,SAAS,CAAC;QAClC,MAAM,KAAK,CAAC;IAAA,CACZ,CAAC;IAEF,OAAO;QACN,yBAAyB,CAAC,eAAwB,EAAE;YACnD,qBAAqB,CAAC,yBAAyB,EAAE,CAAC,eAAe,CAAC,CAAC;QAAA,CACnE;QACD,KAAK,CAAC,KAAK,EAAE;YACZ,OAAO,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAAA,CACtC;QACD,MAAM,CAAC,OAAuB,EAAc;YAC3C,OAAO,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC/C,MAAM,YAAY,GAAG,4BAA4B,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC1E,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;oBAC1B,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;oBACpB,OAAO;gBACR,CAAC;gBAED,IAAI,CAAC;oBACJ,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;oBACnE,mBAAmB,CAAC,WAAW,CAAC,CAAC;oBACjC,MAAM,WAAW,CAAC;gBACnB,CAAC;gBAAC,OAAO,KAAc,EAAE,CAAC;oBACzB,oBAAoB,CAAC,KAAK,CAAC,CAAC;gBAC7B,CAAC;YAAA,CACD,CAAC,CAAC;QAAA,CACH;QACD,OAAO,CAAC,OAAwB,EAAc;YAC7C,OAAO,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAC;QAAA,CAC1D;QACD,KAAK,CAAC,mBAAmB,GAAG;YAC3B,MAAM,sBAAsB,EAAE,CAAC;YAC/B,MAAM,OAAO,CAAC,SAAS,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAAA,CAChD;QACD,KAAK,CAAC,KAAK,GAAG;YACb,MAAM,sBAAsB,EAAE,CAAC;YAC/B,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;QAAA,CAClC;QACD,KAAK,CAAC,KAAK,GAAG;YACb,IAAI,cAAuB,CAAC;YAC5B,IAAI,CAAC;gBACJ,MAAM,sBAAsB,EAAE,CAAC;YAChC,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACzB,cAAc,GAAG,KAAK,CAAC;YACxB,CAAC;YAED,IAAI,CAAC;gBACJ,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACjC,CAAC;YAAC,OAAO,UAAmB,EAAE,CAAC;gBAC9B,IAAI,CAAC,cAAc,EAAE,CAAC;oBACrB,MAAM,UAAU,CAAC;gBAClB,CAAC;YACF,CAAC;YAED,IAAI,cAAc,EAAE,CAAC;gBACpB,MAAM,cAAc,CAAC;YACtB,CAAC;QAAA,CACD;KACD,CAAC;AAAA,CACF;AAED,MAAM,UAAU,4BAA4B,CAC3C,OAAmE,EACpD;IACf,OAAO,oCAAoC,CAAC;QAC3C,SAAS,EAAE,sBAAsB,CAAC,OAAO,CAAC;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC1B,CAAC,CAAC;AAAA,CACH","sourcesContent":["import {\n\tcreateIrohRpcTransport,\n\ttype IrohRpcTransportOptions,\n\ttype RpcCloseHandler,\n\ttype RpcLineHandler,\n\ttype RpcTransport,\n} from \"../../rpc/index.ts\";\nimport type { IrohRemoteRpcGrant } from \"./access-grant.ts\";\nimport { getIrohRemoteRpcFilterResult } from \"./rpc-command-filter.ts\";\n\nexport interface IrohRemoteFilteredRpcTransportOptions {\n\ttransport: RpcTransport;\n\t/** Persisted grant snapshot for this authorized remote stream. */\n\trpcGrant: IrohRemoteRpcGrant;\n}\n\ninterface StartupAwareRpcTransport extends RpcTransport {\n\tsetRpcModeStartupComplete?(startupComplete: boolean): void;\n}\n\n/**\n * Wrap an RPC transport with the remote Iroh command policy.\n *\n * Allowed commands are forwarded to the in-process RPC mode unchanged.\n * Disallowed or malformed commands are rejected on the same transport without\n * reaching Volt RPC handlers.\n */\nexport function createIrohRemoteFilteredRpcTransport(\n\toptions: IrohRemoteFilteredRpcTransportOptions,\n): RpcTransport & { setRpcModeStartupComplete?(startupComplete: boolean): void } {\n\tconst pendingRejections = new Set<Promise<void>>();\n\tlet pendingRejectionError: Error | undefined;\n\tconst startupAwareTransport = options.transport as StartupAwareRpcTransport;\n\n\tconst recordRejectionError = (error: unknown): Error => {\n\t\tconst rejectionError = error instanceof Error ? error : new Error(String(error));\n\t\tpendingRejectionError ??= rejectionError;\n\t\treturn rejectionError;\n\t};\n\n\tconst trackRejectionWrite = (result: void | Promise<void>): void => {\n\t\tif (!result) {\n\t\t\treturn;\n\t\t}\n\t\tconst pending = Promise.resolve(result)\n\t\t\t.catch((error: unknown) => {\n\t\t\t\trecordRejectionError(error);\n\t\t\t})\n\t\t\t.finally(() => {\n\t\t\t\tpendingRejections.delete(pending);\n\t\t\t});\n\t\tpendingRejections.add(pending);\n\t};\n\n\tconst waitForRejectionWrites = async (): Promise<void> => {\n\t\twhile (pendingRejections.size > 0) {\n\t\t\tawait Promise.allSettled(pendingRejections);\n\t\t}\n\t\tif (!pendingRejectionError) {\n\t\t\treturn;\n\t\t}\n\t\tconst error = pendingRejectionError;\n\t\tpendingRejectionError = undefined;\n\t\tthrow error;\n\t};\n\n\treturn {\n\t\tsetRpcModeStartupComplete(startupComplete: boolean) {\n\t\t\tstartupAwareTransport.setRpcModeStartupComplete?.(startupComplete);\n\t\t},\n\t\twrite(value) {\n\t\t\treturn options.transport.write(value);\n\t\t},\n\t\tonLine(handler: RpcLineHandler): () => void {\n\t\t\treturn options.transport.onLine(async (line) => {\n\t\t\t\tconst filterResult = getIrohRemoteRpcFilterResult(line, options.rpcGrant);\n\t\t\t\tif (filterResult.allowed) {\n\t\t\t\t\tawait handler(line);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\ttry {\n\t\t\t\t\tconst writeResult = options.transport.write(filterResult.response);\n\t\t\t\t\ttrackRejectionWrite(writeResult);\n\t\t\t\t\tawait writeResult;\n\t\t\t\t} catch (error: unknown) {\n\t\t\t\t\trecordRejectionError(error);\n\t\t\t\t}\n\t\t\t});\n\t\t},\n\t\tonClose(handler: RpcCloseHandler): () => void {\n\t\t\treturn options.transport.onClose?.(handler) ?? (() => {});\n\t\t},\n\t\tasync waitForBackpressure() {\n\t\t\tawait waitForRejectionWrites();\n\t\t\tawait options.transport.waitForBackpressure?.();\n\t\t},\n\t\tasync flush() {\n\t\t\tawait waitForRejectionWrites();\n\t\t\tawait options.transport.flush?.();\n\t\t},\n\t\tasync close() {\n\t\t\tlet rejectionError: unknown;\n\t\t\ttry {\n\t\t\t\tawait waitForRejectionWrites();\n\t\t\t} catch (error: unknown) {\n\t\t\t\trejectionError = error;\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tawait options.transport.close();\n\t\t\t} catch (closeError: unknown) {\n\t\t\t\tif (!rejectionError) {\n\t\t\t\t\tthrow closeError;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (rejectionError) {\n\t\t\t\tthrow rejectionError;\n\t\t\t}\n\t\t},\n\t};\n}\n\nexport function createIrohRemoteRpcTransport(\n\toptions: IrohRpcTransportOptions & { rpcGrant: IrohRemoteRpcGrant },\n): RpcTransport {\n\treturn createIrohRemoteFilteredRpcTransport({\n\t\ttransport: createIrohRpcTransport(options),\n\t\trpcGrant: options.rpcGrant,\n\t});\n}\n"]}

package/dist/core/remote/iroh/state-manager.d.ts

@@ -0,0 +1,141 @@
+import { type IrohRemoteRpcGrant } from "./access-grant.ts";
+import { type AuthorizeIrohRemoteClientOptions, type IrohRemoteClientAuthorizationResult } from "./authorization.ts";
+import type { IrohRemoteHello } from "./handshake.ts";
+import { type IrohRemoteClient, type IrohRemoteGrantedClient, type IrohRemoteHostState, type IrohRemoteLiveActivityRegistration, type IrohRemotePendingPairingTicket, type IrohRemotePushTarget, type IrohRemotePushTargetPlatform, type IrohRemotePushTokenEnvironment, type IrohRemoteRevokedClient, type IrohRemoteWorkspace, type IrohRemoteWorkspaceWorktree } from "./state.ts";
+import { type IrohRemoteWorkspaceAvailabilityClassifier, type IrohRemoteWorkspaceStatus } from "./workspace.ts";
+export interface IrohRemoteHostStateStore {
+    read(): IrohRemoteHostState | Promise<IrohRemoteHostState>;
+    /** Resolve only after the supplied snapshot is durably persisted. */
+    write(state: IrohRemoteHostState): void | Promise<void>;
+}
+export interface IrohRemoteHostStateManagerOptions {
+    initialState?: IrohRemoteHostState;
+    statePath?: string;
+    /** Custom persistence (e.g. the voltd state envelope); mutually exclusive with statePath. */
+    store?: IrohRemoteHostStateStore;
+}
+export interface IrohRemoteClientRevocationResult {
+    revoked: boolean;
+    client?: IrohRemoteClient;
+    revokedClient?: IrohRemoteRevokedClient;
+}
+export interface IrohRemoteClientRePairApprovalResult {
+    approved: boolean;
+    revokedClient?: IrohRemoteRevokedClient;
+}
+export type IrohRemoteClientAccessUpdateResult = {
+    ok: true;
+    client: IrohRemoteGrantedClient;
+} | {
+    ok: false;
+    reason: "not_found" | "revision_conflict" | "revision_exhausted";
+    currentRevision?: number;
+};
+export interface IrohRemoteLiveActivityDeliveryChannelLookup {
+    tokenHash: string;
+    tokenEnvironment: IrohRemotePushTokenEnvironment;
+    platform: IrohRemotePushTargetPlatform;
+}
+export interface IrohRemoteLiveActivityRegistrationResult {
+    client?: IrohRemoteClient;
+    registration?: IrohRemoteLiveActivityRegistration;
+    replacedRegistration?: IrohRemoteLiveActivityRegistration;
+}
+export interface IrohRemoteLiveActivityPruneResult {
+    liveActivityRemoved: boolean;
+    registrationsRemoved: number;
+    pushTarget?: IrohRemotePushTarget;
+}
+export interface IrohRemoteWorkspaceWorktreeLifecycleContext {
+    workspace: IrohRemoteWorkspace;
+    worktrees: IrohRemoteWorkspaceWorktree[];
+}
+export interface IrohRemoteWorkspaceWorktreeLifecycleOutcome<T> {
+    result: T;
+    worktree?: IrohRemoteWorkspaceWorktree;
+}
+export declare const IROH_REMOTE_WORKSPACE_HAS_WORKTREES_ERROR = "workspace_has_worktrees";
+export declare const IROH_REMOTE_WORKTREE_PARENT_WORKSPACE_NOT_FOUND_ERROR = "worktree_parent_workspace_not_found";
+export declare const IROH_REMOTE_WORKTREE_PERSISTENCE_ERROR = "worktree_persistence_failed";
+/**
+ * A workspace with persisted worktree children cannot be unregistered. This
+ * typed conflict is thrown from the state mutation itself so every caller,
+ * including lower-level ones, gets the same non-destructive invariant.
+ */
+export declare class IrohRemoteWorkspaceHasWorktreesError extends Error {
+    readonly code = "workspace_has_worktrees";
+    readonly workspaceName: string;
+    readonly worktreeIds: string[];
+    constructor(workspaceName: string, worktrees: readonly IrohRemoteWorkspaceWorktree[]);
+}
+export declare function isIrohRemoteWorkspaceHasWorktreesError(error: unknown): error is IrohRemoteWorkspaceHasWorktreesError;
+export declare class IrohRemoteWorktreeParentWorkspaceNotFoundError extends Error {
+    readonly code = "worktree_parent_workspace_not_found";
+    readonly workspaceName: string;
+    constructor(workspaceName: string);
+}
+export declare function isIrohRemoteWorktreeParentWorkspaceNotFoundError(error: unknown): error is IrohRemoteWorktreeParentWorkspaceNotFoundError;
+export declare class IrohRemoteWorktreePersistenceError extends Error {
+    readonly code = "worktree_persistence_failed";
+    readonly workspaceName: string;
+    readonly worktreeId: string;
+    constructor(workspaceName: string, worktreeId: string, cause: unknown);
+}
+export declare function isIrohRemoteWorktreePersistenceError(error: unknown): error is IrohRemoteWorktreePersistenceError;
+export declare class IrohRemoteHostStateManager {
+    private readonly statePath;
+    private readonly store;
+    private operationQueue;
+    private state;
+    constructor(options?: IrohRemoteHostStateManagerOptions);
+    load(): Promise<IrohRemoteHostState>;
+    save(state?: IrohRemoteHostState): Promise<void>;
+    getState(): Promise<IrohRemoteHostState>;
+    upsertWorkspace(workspace: IrohRemoteWorkspace, allowTools?: string): Promise<IrohRemoteWorkspace>;
+    unregisterWorkspace(name: string): Promise<IrohRemoteWorkspace | undefined>;
+    /**
+     * Serialize a worktree create/adopt side effect with workspace unregister and
+     * commit its child record in the same state transaction. The operation runs
+     * while the state lock is held so an unregister cannot observe the gap between
+     * `git worktree add` and durable child persistence.
+     */
+    runWorkspaceWorktreeLifecycle<T>(workspaceName: string, operation: (context: IrohRemoteWorkspaceWorktreeLifecycleContext) => Promise<IrohRemoteWorkspaceWorktreeLifecycleOutcome<T>>): Promise<T>;
+    upsertWorktree(worktree: IrohRemoteWorkspaceWorktree): Promise<IrohRemoteWorkspaceWorktree>;
+    removeWorktree(workspaceName: string, worktreeId: string): Promise<IrohRemoteWorkspaceWorktree | undefined>;
+    listWorktrees(workspaceName?: string): Promise<IrohRemoteWorkspaceWorktree[]>;
+    bindWorktreeSession(workspaceName: string, worktreeId: string, sessionId: string): Promise<void>;
+    findWorktreeForSession(workspaceName: string, sessionId: string): Promise<IrohRemoteWorkspaceWorktree | undefined>;
+    listWorkspaceStatuses(options?: {
+        classifyWorkspaceAvailability?: IrohRemoteWorkspaceAvailabilityClassifier;
+    }): Promise<IrohRemoteWorkspaceStatus[]>;
+    addPendingPairingTicket(ticket: IrohRemotePendingPairingTicket): Promise<IrohRemotePendingPairingTicket>;
+    removePendingPairingTicket(secretHash: string): Promise<boolean>;
+    authorizeClient(hello: IrohRemoteHello, remoteNodeId: string, options: AuthorizeIrohRemoteClientOptions): Promise<IrohRemoteClientAuthorizationResult>;
+    listClients(): Promise<IrohRemoteGrantedClient[]>;
+    getClient(nodeId: string): Promise<IrohRemoteGrantedClient | undefined>;
+    updateClientAccess(nodeId: string, expectedRevision: number, access: {
+        allowedTools: string;
+        rpcGrant: IrohRemoteRpcGrant;
+    }): Promise<IrohRemoteClientAccessUpdateResult>;
+    listRevokedClients(): Promise<IrohRemoteRevokedClient[]>;
+    setClientLastSessionId(nodeId: string, workspace: string, sessionId: string): Promise<IrohRemoteClient | undefined>;
+    upsertClientPushTarget(nodeId: string, pushTarget: IrohRemotePushTarget): Promise<IrohRemoteClient | undefined>;
+    disableClientPushTarget(nodeId: string, pushTargetId: string, now?: number): Promise<IrohRemotePushTarget | undefined>;
+    findClientLiveActivityDeliveryChannel(nodeId: string, lookup: IrohRemoteLiveActivityDeliveryChannelLookup): Promise<IrohRemotePushTarget | undefined>;
+    registerClientLiveActivity(nodeId: string, registration: IrohRemoteLiveActivityRegistration): Promise<IrohRemoteLiveActivityRegistrationResult>;
+    unregisterClientLiveActivity(nodeId: string, workspaceName: string, sessionId: string, activityId: string): Promise<boolean>;
+    pruneClientLiveActivityDeliveryChannel(nodeId: string, registration: IrohRemoteLiveActivityRegistration, now?: number): Promise<IrohRemoteLiveActivityPruneResult>;
+    removeClientLiveActivitiesForSession(nodeId: string, workspaceName: string, sessionId: string): Promise<number>;
+    removeClientLiveActivitiesForWorkspace(nodeId: string, workspaceName: string): Promise<number>;
+    removeLiveActivitiesForWorkspace(workspaceName: string): Promise<number>;
+    revokeClient(nodeId: string, now?: number): Promise<IrohRemoteClientRevocationResult>;
+    approveClientRePair(nodeId: string, now?: number): Promise<IrohRemoteClientRePairApprovalResult>;
+    private getWorkspaceStatuses;
+    private runExclusive;
+    private withStateFileLock;
+    private loadUnlocked;
+    private saveUnlocked;
+    private restoreAfterFailedWorktreePersistence;
+    private removeClientLiveActivities;
+}
+//# sourceMappingURL=state-manager.d.ts.map

package/dist/core/remote/iroh/state-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-manager.d.ts","sourceRoot":"","sources":["../../../../src/core/remote/iroh/state-manager.ts"],"names":[],"mappings":"AAGA,OAAO,EAA2B,KAAK,kBAAkB,EAA2B,MAAM,mBAAmB,CAAC;AAC9G,OAAO,EACN,KAAK,gCAAgC,EAErC,KAAK,mCAAmC,EACxC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAEN,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAE5B,KAAK,mBAAmB,EACxB,KAAK,kCAAkC,EAEvC,KAAK,8BAA8B,EACnC,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EACjC,KAAK,8BAA8B,EACnC,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAKhC,MAAM,YAAY,CAAC;AACpB,OAAO,EAGN,KAAK,yCAAyC,EAC9C,KAAK,yBAAyB,EAE9B,MAAM,gBAAgB,CAAC;AAExB,MAAM,WAAW,wBAAwB;IACxC,IAAI,IAAI,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC3D,qEAAqE;IACrE,KAAK,CAAC,KAAK,EAAE,mBAAmB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,iCAAiC;IACjD,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,KAAK,CAAC,EAAE,wBAAwB,CAAC;CACjC;AAED,MAAM,WAAW,gCAAgC;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,aAAa,CAAC,EAAE,uBAAuB,CAAC;CACxC;AAED,MAAM,WAAW,oCAAoC;IACpD,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,uBAAuB,CAAC;CACxC;AAED,MAAM,MAAM,kCAAkC,GAC3C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,GAC7C;IACA,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,WAAW,GAAG,mBAAmB,GAAG,oBAAoB,CAAC;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEL,MAAM,WAAW,2CAA2C;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,8BAA8B,CAAC;IACjD,QAAQ,EAAE,4BAA4B,CAAC;CACvC;AAED,MAAM,WAAW,wCAAwC;IACxD,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,YAAY,CAAC,EAAE,kCAAkC,CAAC;IAClD,oBAAoB,CAAC,EAAE,kCAAkC,CAAC;CAC1D;AAED,MAAM,WAAW,iCAAiC;IACjD,mBAAmB,EAAE,OAAO,CAAC;IAC7B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,UAAU,CAAC,EAAE,oBAAoB,CAAC;CAClC;AAED,MAAM,WAAW,2CAA2C;IAC3D,SAAS,EAAE,mBAAmB,CAAC;IAC/B,SAAS,EAAE,2BAA2B,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,2CAA2C,CAAC,CAAC;IAC7D,MAAM,EAAE,CAAC,CAAC;IACV,QAAQ,CAAC,EAAE,2BAA2B,CAAC;CACvC;AAED,eAAO,MAAM,yCAAyC,4BAA4B,CAAC;AACnF,eAAO,MAAM,qDAAqD,wCAAwC,CAAC;AAC3G,eAAO,MAAM,sCAAsC,gCAAgC,CAAC;AAEpF;;;;GAIG;AACH,qBAAa,oCAAqC,SAAQ,KAAK;IAC9D,QAAQ,CAAC,IAAI,6BAA6C;IAC1D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAE/B,YAAY,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,2BAA2B,EAAE,EAWnF;CACD;AAED,wBAAgB,sCAAsC,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,oCAAoC,CAEpH;AAED,qBAAa,8CAA+C,SAAQ,KAAK;IACxE,QAAQ,CAAC,IAAI,yCAAyD;IACtE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,YAAY,aAAa,EAAE,MAAM,EAIhC;CACD;AAED,wBAAgB,gDAAgD,CAC/D,KAAK,EAAE,OAAO,GACZ,KAAK,IAAI,8CAA8C,CAEzD;AAED,qBAAa,kCAAmC,SAAQ,KAAK;IAC5D,QAAQ,CAAC,IAAI,iCAA0C;IACvD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,YAAY,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAKpE;CACD;AAED,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kCAAkC,CAEhH;AAED,qBAAa,0BAA0B;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuC;IAC7D,OAAO,CAAC,cAAc,CAAoC;IAC1D,OAAO,CAAC,KAAK,CAAkC;IAE/C,YAAY,OAAO,GAAE,iCAAsC,EAY1D;IAEK,IAAI,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAEzC;IAEK,IAAI,CAAC,KAAK,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUrD;IAEK,QAAQ,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAE7C;IAEK,eAAe,CAAC,SAAS,EAAE,mBAAmB,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAOvG;IAEK,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAkBhF;IAED;;;;;OAKG;IACG,6BAA6B,CAAC,CAAC,EACpC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,CACV,OAAO,EAAE,2CAA2C,KAChD,OAAO,CAAC,2CAA2C,CAAC,CAAC,CAAC,CAAC,GAC1D,OAAO,CAAC,CAAC,CAAC,CAmCZ;IAEK,cAAc,CAAC,QAAQ,EAAE,2BAA2B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAqBhG;IAEK,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAYhH;IAEK,aAAa,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,EAAE,CAAC,CAOlF;IAEK,mBAAmB,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYrG;IAEK,sBAAsB,CAC3B,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAQlD;IAEK,qBAAqB,CAC1B,OAAO,GAAE;QAAE,6BAA6B,CAAC,EAAE,yCAAyC,CAAA;KAAO,GACzF,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAKtC;IAEK,uBAAuB,CAAC,MAAM,EAAE,8BAA8B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAU7G;IAEK,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUrE;IAEK,eAAe,CACpB,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,gCAAgC,GACvC,OAAO,CAAC,mCAAmC,CAAC,CAkB9C;IAEK,WAAW,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAKtD;IAEK,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAM5E;IAEK,kBAAkB,CACvB,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,kBAAkB,CAAA;KAAE,GAC5D,OAAO,CAAC,kCAAkC,CAAC,CAyB7C;IAEK,kBAAkB,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAK7D;IAEK,sBAAsB,CAC3B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAcvC;IAEK,sBAAsB,CAC3B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,oBAAoB,GAC9B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAoBvC;IAEK,uBAAuB,CAC5B,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,GAAG,SAAa,GACd,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAc3C;IAEK,qCAAqC,CAC1C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,2CAA2C,GACjD,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAY3C;IAEK,0BAA0B,CAC/B,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,kCAAkC,GAC9C,OAAO,CAAC,wCAAwC,CAAC,CAqCnD;IAEK,4BAA4B,CACjC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAuBlB;IAEK,sCAAsC,CAC3C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,kCAAkC,EAChD,GAAG,SAAa,GACd,OAAO,CAAC,iCAAiC,CAAC,CA2C5C;IAEK,oCAAoC,CACzC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAIjB;IAEK,sCAAsC,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnG;IAEK,gCAAgC,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAoB7E;IAEK,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,OAAO,CAAC,gCAAgC,CAAC,CA8B9F;IAEK,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,OAAO,CAAC,oCAAoC,CAAC,CAWzG;YAEa,oBAAoB;IAOlC,OAAO,CAAC,YAAY;YAYN,iBAAiB;YAgDjB,YAAY;YAaZ,YAAY;YAYZ,qCAAqC;YAerC,0BAA0B;CAsBxC","sourcesContent":["import { mkdir } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport lockfile from \"proper-lockfile\";\nimport { cloneIrohRemoteRpcGrant, type IrohRemoteRpcGrant, parseIrohRemoteRpcGrant } from \"./access-grant.ts\";\nimport {\n\ttype AuthorizeIrohRemoteClientOptions,\n\tauthorizeIrohRemoteClient,\n\ttype IrohRemoteClientAuthorizationResult,\n} from \"./authorization.ts\";\nimport type { IrohRemoteHello } from \"./handshake.ts\";\nimport {\n\tcreateEmptyIrohRemoteHostState,\n\ttype IrohRemoteClient,\n\ttype IrohRemoteGrantedClient,\n\ttype IrohRemoteGrantedRevokedClient,\n\ttype IrohRemoteHostState,\n\ttype IrohRemoteLiveActivityRegistration,\n\ttype IrohRemotePairingSecretTombstone,\n\ttype IrohRemotePendingPairingTicket,\n\ttype IrohRemotePushTarget,\n\ttype IrohRemotePushTargetPlatform,\n\ttype IrohRemotePushTokenEnvironment,\n\ttype IrohRemoteRevokedClient,\n\ttype IrohRemoteWorkspace,\n\ttype IrohRemoteWorkspaceWorktree,\n\tnormalizeIrohRemoteLiveActivityRegistrations,\n\tparseIrohRemoteLiveActivityRegistration,\n\treadIrohRemoteHostState,\n\twriteIrohRemoteHostState,\n} from \"./state.ts\";\nimport {\n\tfindIrohRemoteWorkspace,\n\tgetIrohRemoteWorkspaceStatuses,\n\ttype IrohRemoteWorkspaceAvailabilityClassifier,\n\ttype IrohRemoteWorkspaceStatus,\n\tupsertIrohRemoteWorkspace,\n} from \"./workspace.ts\";\n\nexport interface IrohRemoteHostStateStore {\n\tread(): IrohRemoteHostState | Promise<IrohRemoteHostState>;\n\t/** Resolve only after the supplied snapshot is durably persisted. */\n\twrite(state: IrohRemoteHostState): void | Promise<void>;\n}\n\nexport interface IrohRemoteHostStateManagerOptions {\n\tinitialState?: IrohRemoteHostState;\n\tstatePath?: string;\n\t/** Custom persistence (e.g. the voltd state envelope); mutually exclusive with statePath. */\n\tstore?: IrohRemoteHostStateStore;\n}\n\nexport interface IrohRemoteClientRevocationResult {\n\trevoked: boolean;\n\tclient?: IrohRemoteClient;\n\trevokedClient?: IrohRemoteRevokedClient;\n}\n\nexport interface IrohRemoteClientRePairApprovalResult {\n\tapproved: boolean;\n\trevokedClient?: IrohRemoteRevokedClient;\n}\n\nexport type IrohRemoteClientAccessUpdateResult =\n\t| { ok: true; client: IrohRemoteGrantedClient }\n\t| {\n\t\t\tok: false;\n\t\t\treason: \"not_found\" | \"revision_conflict\" | \"revision_exhausted\";\n\t\t\tcurrentRevision?: number;\n\t  };\n\nexport interface IrohRemoteLiveActivityDeliveryChannelLookup {\n\ttokenHash: string;\n\ttokenEnvironment: IrohRemotePushTokenEnvironment;\n\tplatform: IrohRemotePushTargetPlatform;\n}\n\nexport interface IrohRemoteLiveActivityRegistrationResult {\n\tclient?: IrohRemoteClient;\n\tregistration?: IrohRemoteLiveActivityRegistration;\n\treplacedRegistration?: IrohRemoteLiveActivityRegistration;\n}\n\nexport interface IrohRemoteLiveActivityPruneResult {\n\tliveActivityRemoved: boolean;\n\tregistrationsRemoved: number;\n\tpushTarget?: IrohRemotePushTarget;\n}\n\nexport interface IrohRemoteWorkspaceWorktreeLifecycleContext {\n\tworkspace: IrohRemoteWorkspace;\n\tworktrees: IrohRemoteWorkspaceWorktree[];\n}\n\nexport interface IrohRemoteWorkspaceWorktreeLifecycleOutcome<T> {\n\tresult: T;\n\tworktree?: IrohRemoteWorkspaceWorktree;\n}\n\nexport const IROH_REMOTE_WORKSPACE_HAS_WORKTREES_ERROR = \"workspace_has_worktrees\";\nexport const IROH_REMOTE_WORKTREE_PARENT_WORKSPACE_NOT_FOUND_ERROR = \"worktree_parent_workspace_not_found\";\nexport const IROH_REMOTE_WORKTREE_PERSISTENCE_ERROR = \"worktree_persistence_failed\";\n\n/**\n * A workspace with persisted worktree children cannot be unregistered. This\n * typed conflict is thrown from the state mutation itself so every caller,\n * including lower-level ones, gets the same non-destructive invariant.\n */\nexport class IrohRemoteWorkspaceHasWorktreesError extends Error {\n\treadonly code = IROH_REMOTE_WORKSPACE_HAS_WORKTREES_ERROR;\n\treadonly workspaceName: string;\n\treadonly worktreeIds: string[];\n\n\tconstructor(workspaceName: string, worktrees: readonly IrohRemoteWorkspaceWorktree[]) {\n\t\tconst worktreeIds = worktrees.map((worktree) => worktree.id).sort();\n\t\tconst noun = worktreeIds.length === 1 ? \"worktree\" : \"worktrees\";\n\t\tsuper(\n\t\t\t`Workspace ${workspaceName} has ${worktreeIds.length} daemon-managed ${noun} (${worktreeIds.join(\", \")}). ` +\n\t\t\t\t`Remove each with \"volt remote worktree remove <id> --workspace ${workspaceName}\" before unregistering; ` +\n\t\t\t\t\"use --force only to explicitly discard dirty or busy worktrees.\",\n\t\t);\n\t\tthis.name = \"IrohRemoteWorkspaceHasWorktreesError\";\n\t\tthis.workspaceName = workspaceName;\n\t\tthis.worktreeIds = worktreeIds;\n\t}\n}\n\nexport function isIrohRemoteWorkspaceHasWorktreesError(error: unknown): error is IrohRemoteWorkspaceHasWorktreesError {\n\treturn error instanceof IrohRemoteWorkspaceHasWorktreesError;\n}\n\nexport class IrohRemoteWorktreeParentWorkspaceNotFoundError extends Error {\n\treadonly code = IROH_REMOTE_WORKTREE_PARENT_WORKSPACE_NOT_FOUND_ERROR;\n\treadonly workspaceName: string;\n\n\tconstructor(workspaceName: string) {\n\t\tsuper(`Cannot persist a worktree for unregistered workspace ${workspaceName}`);\n\t\tthis.name = \"IrohRemoteWorktreeParentWorkspaceNotFoundError\";\n\t\tthis.workspaceName = workspaceName;\n\t}\n}\n\nexport function isIrohRemoteWorktreeParentWorkspaceNotFoundError(\n\terror: unknown,\n): error is IrohRemoteWorktreeParentWorkspaceNotFoundError {\n\treturn error instanceof IrohRemoteWorktreeParentWorkspaceNotFoundError;\n}\n\nexport class IrohRemoteWorktreePersistenceError extends Error {\n\treadonly code = IROH_REMOTE_WORKTREE_PERSISTENCE_ERROR;\n\treadonly workspaceName: string;\n\treadonly worktreeId: string;\n\n\tconstructor(workspaceName: string, worktreeId: string, cause: unknown) {\n\t\tsuper(`Failed to persist worktree ${worktreeId} for workspace ${workspaceName}`, { cause });\n\t\tthis.name = \"IrohRemoteWorktreePersistenceError\";\n\t\tthis.workspaceName = workspaceName;\n\t\tthis.worktreeId = worktreeId;\n\t}\n}\n\nexport function isIrohRemoteWorktreePersistenceError(error: unknown): error is IrohRemoteWorktreePersistenceError {\n\treturn error instanceof IrohRemoteWorktreePersistenceError;\n}\n\nexport class IrohRemoteHostStateManager {\n\tprivate readonly statePath: string | undefined;\n\tprivate readonly store: IrohRemoteHostStateStore | undefined;\n\tprivate operationQueue: Promise<void> = Promise.resolve();\n\tprivate state: IrohRemoteHostState | undefined;\n\n\tconstructor(options: IrohRemoteHostStateManagerOptions = {}) {\n\t\tif (options.initialState && options.statePath) {\n\t\t\tthrow new Error(\"Cannot provide both initialState and statePath for Iroh remote host state manager\");\n\t\t}\n\t\tif (options.store && (options.statePath || options.initialState)) {\n\t\t\tthrow new Error(\n\t\t\t\t\"Cannot combine a custom store with statePath/initialState for Iroh remote host state manager\",\n\t\t\t);\n\t\t}\n\t\tthis.statePath = options.statePath;\n\t\tthis.store = options.store;\n\t\tthis.state = options.initialState ? cloneHostState(options.initialState) : undefined;\n\t}\n\n\tasync load(): Promise<IrohRemoteHostState> {\n\t\treturn this.runExclusive(async () => cloneHostState(await this.loadUnlocked()));\n\t}\n\n\tasync save(state?: IrohRemoteHostState): Promise<void> {\n\t\tawait this.runExclusive(async () => {\n\t\t\tif (state !== undefined && this.statePath) {\n\t\t\t\tthrow new Error(\"Cannot save explicit Iroh remote host state snapshots for file-backed state\");\n\t\t\t}\n\t\t\tif (state === undefined && this.statePath) {\n\t\t\t\tthis.state = await this.loadUnlocked();\n\t\t\t}\n\t\t\tawait this.saveUnlocked(state !== undefined ? cloneHostState(state) : this.state);\n\t\t});\n\t}\n\n\tasync getState(): Promise<IrohRemoteHostState> {\n\t\treturn this.runExclusive(async () => cloneHostState(await this.loadUnlocked()));\n\t}\n\n\tasync upsertWorkspace(workspace: IrohRemoteWorkspace, allowTools?: string): Promise<IrohRemoteWorkspace> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tconst savedWorkspace = upsertIrohRemoteWorkspace(state, workspace, allowTools);\n\t\t\tawait this.saveUnlocked(state);\n\t\t\treturn cloneWorkspace(savedWorkspace);\n\t\t});\n\t}\n\n\tasync unregisterWorkspace(name: string): Promise<IrohRemoteWorkspace | undefined> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tconst index = state.workspaces.findIndex((workspace) => workspace.name === name);\n\t\t\tif (index === -1) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\tconst worktrees = (state.worktrees ?? []).filter((worktree) => worktree.workspaceName === name);\n\t\t\tif (worktrees.length > 0) {\n\t\t\t\tthrow new IrohRemoteWorkspaceHasWorktreesError(name, worktrees);\n\t\t\t}\n\t\t\tconst [removedWorkspace] = state.workspaces.splice(index, 1);\n\t\t\tstate.pendingPairingTickets = (state.pendingPairingTickets ?? []).filter(\n\t\t\t\t(ticket) => ticket.workspace !== name,\n\t\t\t);\n\t\t\tawait this.saveUnlocked(state);\n\t\t\treturn removedWorkspace ? cloneWorkspace(removedWorkspace) : undefined;\n\t\t});\n\t}\n\n\t/**\n\t * Serialize a worktree create/adopt side effect with workspace unregister and\n\t * commit its child record in the same state transaction. The operation runs\n\t * while the state lock is held so an unregister cannot observe the gap between\n\t * `git worktree add` and durable child persistence.\n\t */\n\tasync runWorkspaceWorktreeLifecycle<T>(\n\t\tworkspaceName: string,\n\t\toperation: (\n\t\t\tcontext: IrohRemoteWorkspaceWorktreeLifecycleContext,\n\t\t) => Promise<IrohRemoteWorkspaceWorktreeLifecycleOutcome<T>>,\n\t): Promise<T> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tconst workspace = state.workspaces.find((entry) => entry.name === workspaceName);\n\t\t\tif (!workspace) {\n\t\t\t\tthrow new IrohRemoteWorktreeParentWorkspaceNotFoundError(workspaceName);\n\t\t\t}\n\t\t\tconst outcome = await operation({\n\t\t\t\tworkspace: cloneWorkspace(workspace),\n\t\t\t\tworktrees: (state.worktrees ?? [])\n\t\t\t\t\t.filter((worktree) => worktree.workspaceName === workspaceName)\n\t\t\t\t\t.map((worktree) => cloneWorktree(worktree)),\n\t\t\t});\n\t\t\tif (!outcome.worktree) {\n\t\t\t\treturn outcome.result;\n\t\t\t}\n\t\t\tif (outcome.worktree.workspaceName !== workspaceName) {\n\t\t\t\tthrow new Error(\"Worktree lifecycle result does not match its parent workspace\");\n\t\t\t}\n\n\t\t\tconst previousState = cloneHostState(state);\n\t\t\tstate.worktrees = [\n\t\t\t\t...(state.worktrees ?? []).filter(\n\t\t\t\t\t(entry) => entry.workspaceName !== workspaceName || entry.id !== outcome.worktree?.id,\n\t\t\t\t),\n\t\t\t\tcloneWorktree(outcome.worktree),\n\t\t\t];\n\t\t\ttry {\n\t\t\t\tawait this.saveUnlocked(state);\n\t\t\t} catch (error) {\n\t\t\t\tawait this.restoreAfterFailedWorktreePersistence(previousState);\n\t\t\t\tthrow new IrohRemoteWorktreePersistenceError(workspaceName, outcome.worktree.id, error);\n\t\t\t}\n\t\t\treturn outcome.result;\n\t\t});\n\t}\n\n\tasync upsertWorktree(worktree: IrohRemoteWorkspaceWorktree): Promise<IrohRemoteWorkspaceWorktree> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tif (!state.workspaces.some((workspace) => workspace.name === worktree.workspaceName)) {\n\t\t\t\tthrow new IrohRemoteWorktreeParentWorkspaceNotFoundError(worktree.workspaceName);\n\t\t\t}\n\t\t\tconst previousState = cloneHostState(state);\n\t\t\tstate.worktrees = [\n\t\t\t\t...(state.worktrees ?? []).filter(\n\t\t\t\t\t(entry) => entry.workspaceName !== worktree.workspaceName || entry.id !== worktree.id,\n\t\t\t\t),\n\t\t\t\tcloneWorktree(worktree),\n\t\t\t];\n\t\t\ttry {\n\t\t\t\tawait this.saveUnlocked(state);\n\t\t\t} catch (error) {\n\t\t\t\tawait this.restoreAfterFailedWorktreePersistence(previousState);\n\t\t\t\tthrow new IrohRemoteWorktreePersistenceError(worktree.workspaceName, worktree.id, error);\n\t\t\t}\n\t\t\treturn cloneWorktree(worktree);\n\t\t});\n\t}\n\n\tasync removeWorktree(workspaceName: string, worktreeId: string): Promise<IrohRemoteWorkspaceWorktree | undefined> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tconst worktrees = state.worktrees ?? [];\n\t\t\tconst removed = worktrees.find((entry) => entry.workspaceName === workspaceName && entry.id === worktreeId);\n\t\t\tif (!removed) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\tstate.worktrees = worktrees.filter((entry) => entry !== removed);\n\t\t\tawait this.saveUnlocked(state);\n\t\t\treturn cloneWorktree(removed);\n\t\t});\n\t}\n\n\tasync listWorktrees(workspaceName?: string): Promise<IrohRemoteWorkspaceWorktree[]> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\treturn (state.worktrees ?? [])\n\t\t\t\t.filter((entry) => workspaceName === undefined || entry.workspaceName === workspaceName)\n\t\t\t\t.map((entry) => cloneWorktree(entry));\n\t\t});\n\t}\n\n\tasync bindWorktreeSession(workspaceName: string, worktreeId: string, sessionId: string): Promise<void> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tconst worktree = (state.worktrees ?? []).find(\n\t\t\t\t(entry) => entry.workspaceName === workspaceName && entry.id === worktreeId,\n\t\t\t);\n\t\t\tif (!worktree || worktree.sessionIds.includes(sessionId)) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tworktree.sessionIds = [...worktree.sessionIds, sessionId];\n\t\t\tawait this.saveUnlocked(state);\n\t\t});\n\t}\n\n\tasync findWorktreeForSession(\n\t\tworkspaceName: string,\n\t\tsessionId: string,\n\t): Promise<IrohRemoteWorkspaceWorktree | undefined> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tconst worktree = (state.worktrees ?? []).find(\n\t\t\t\t(entry) => entry.workspaceName === workspaceName && entry.sessionIds.includes(sessionId),\n\t\t\t);\n\t\t\treturn worktree ? cloneWorktree(worktree) : undefined;\n\t\t});\n\t}\n\n\tasync listWorkspaceStatuses(\n\t\toptions: { classifyWorkspaceAvailability?: IrohRemoteWorkspaceAvailabilityClassifier } = {},\n\t): Promise<IrohRemoteWorkspaceStatus[]> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\treturn await getIrohRemoteWorkspaceStatuses(state, options.classifyWorkspaceAvailability);\n\t\t});\n\t}\n\n\tasync addPendingPairingTicket(ticket: IrohRemotePendingPairingTicket): Promise<IrohRemotePendingPairingTicket> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tstate.pendingPairingTickets = [\n\t\t\t\t...(state.pendingPairingTickets ?? []).filter((entry) => entry.secretHash !== ticket.secretHash),\n\t\t\t\tclonePendingPairingTicket(ticket),\n\t\t\t];\n\t\t\tawait this.saveUnlocked(state);\n\t\t\treturn clonePendingPairingTicket(ticket);\n\t\t});\n\t}\n\n\tasync removePendingPairingTicket(secretHash: string): Promise<boolean> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tconst pending = state.pendingPairingTickets ?? [];\n\t\t\tconst remaining = pending.filter((entry) => entry.secretHash !== secretHash);\n\t\t\tif (remaining.length === pending.length) return false;\n\t\t\tstate.pendingPairingTickets = remaining;\n\t\t\tawait this.saveUnlocked(state);\n\t\t\treturn true;\n\t\t});\n\t}\n\n\tasync authorizeClient(\n\t\thello: IrohRemoteHello,\n\t\tremoteNodeId: string,\n\t\toptions: AuthorizeIrohRemoteClientOptions,\n\t): Promise<IrohRemoteClientAuthorizationResult> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tconst workspaceStatuses = await this.getWorkspaceStatuses(state, options);\n\t\t\tconst workspace = findIrohRemoteWorkspace(state, hello.workspace);\n\t\t\tconst workspaceStatus = workspaceStatuses.find((entry) => entry.name === hello.workspace)?.status;\n\t\t\tconst workspaceAvailable =\n\t\t\t\tworkspace !== undefined &&\n\t\t\t\tworkspaceStatus === \"available\" &&\n\t\t\t\t(options.validateWorkspace === undefined || (await options.validateWorkspace(workspace)));\n\t\t\tconst result = authorizeIrohRemoteClient(state, hello, remoteNodeId, {\n\t\t\t\t...options,\n\t\t\t\tworkspace: workspaceAvailable ? workspace : undefined,\n\t\t\t\tworkspaceStatuses,\n\t\t\t});\n\t\t\tawait this.saveUnlocked(state);\n\t\t\treturn cloneAuthorizationResult(result);\n\t\t});\n\t}\n\n\tasync listClients(): Promise<IrohRemoteGrantedClient[]> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\treturn state.clients.map((client) => cloneClient(client));\n\t\t});\n\t}\n\n\tasync getClient(nodeId: string): Promise<IrohRemoteGrantedClient | undefined> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tconst client = state.clients.find((entry) => entry.nodeId === nodeId);\n\t\t\treturn client ? cloneClient(client) : undefined;\n\t\t});\n\t}\n\n\tasync updateClientAccess(\n\t\tnodeId: string,\n\t\texpectedRevision: number,\n\t\taccess: { allowedTools: string; rpcGrant: IrohRemoteRpcGrant },\n\t): Promise<IrohRemoteClientAccessUpdateResult> {\n\t\tif (!Number.isSafeInteger(expectedRevision) || expectedRevision < 1) {\n\t\t\tthrow new Error(\"expected RPC grant revision must be a safe integer greater than or equal to 1\");\n\t\t}\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tconst client = state.clients.find((entry) => entry.nodeId === nodeId);\n\t\t\tif (!client) {\n\t\t\t\treturn { ok: false, reason: \"not_found\" };\n\t\t\t}\n\t\t\tconst currentGrant = parseIrohRemoteRpcGrant(client.rpcGrant, \"client rpcGrant\");\n\t\t\tif (currentGrant.revision !== expectedRevision) {\n\t\t\t\treturn { ok: false, reason: \"revision_conflict\", currentRevision: currentGrant.revision };\n\t\t\t}\n\t\t\tif (currentGrant.revision === Number.MAX_SAFE_INTEGER) {\n\t\t\t\treturn { ok: false, reason: \"revision_exhausted\", currentRevision: currentGrant.revision };\n\t\t\t}\n\t\t\tclient.allowedTools = access.allowedTools;\n\t\t\tclient.rpcGrant = {\n\t\t\t\t...cloneIrohRemoteRpcGrant(access.rpcGrant),\n\t\t\t\trevision: expectedRevision + 1,\n\t\t\t};\n\t\t\tawait this.saveUnlocked(state);\n\t\t\treturn { ok: true, client: cloneClient(client) };\n\t\t});\n\t}\n\n\tasync listRevokedClients(): Promise<IrohRemoteRevokedClient[]> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\treturn getRevokedClients(state).map((client) => cloneRevokedClient(client));\n\t\t});\n\t}\n\n\tasync setClientLastSessionId(\n\t\tnodeId: string,\n\t\tworkspace: string,\n\t\tsessionId: string,\n\t): Promise<IrohRemoteClient | undefined> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tconst client = state.clients.find((entry) => entry.nodeId === nodeId);\n\t\t\tif (!client) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\tclient.lastSessionIdByWorkspace = {\n\t\t\t\t...(client.lastSessionIdByWorkspace ?? {}),\n\t\t\t\t[workspace]: sessionId,\n\t\t\t};\n\t\t\tawait this.saveUnlocked(state);\n\t\t\treturn cloneClient(client);\n\t\t});\n\t}\n\n\tasync upsertClientPushTarget(\n\t\tnodeId: string,\n\t\tpushTarget: IrohRemotePushTarget,\n\t): Promise<IrohRemoteClient | undefined> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tconst client = state.clients.find((entry) => entry.nodeId === nodeId);\n\t\t\tif (!client) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\tlet createdAt = pushTarget.createdAt;\n\t\t\tconst retainedTargets: IrohRemotePushTarget[] = [];\n\t\t\tfor (const existingTarget of client.pushTargets ?? []) {\n\t\t\t\tif (isSamePushTargetSlot(existingTarget, pushTarget)) {\n\t\t\t\t\tcreatedAt = existingTarget.createdAt;\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tretainedTargets.push(existingTarget);\n\t\t\t}\n\t\t\tclient.pushTargets = [...retainedTargets, { ...pushTarget, createdAt }];\n\t\t\tawait this.saveUnlocked(state);\n\t\t\treturn cloneClient(client);\n\t\t});\n\t}\n\n\tasync disableClientPushTarget(\n\t\tnodeId: string,\n\t\tpushTargetId: string,\n\t\tnow = Date.now(),\n\t): Promise<IrohRemotePushTarget | undefined> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tconst client = state.clients.find((entry) => entry.nodeId === nodeId);\n\t\t\tconst pushTarget = client?.pushTargets?.find((entry) => entry.id === pushTargetId);\n\t\t\tif (!pushTarget) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\tpushTarget.enabled = false;\n\t\t\tdelete pushTarget.liveActivity;\n\t\t\tpushTarget.updatedAt = now;\n\t\t\tawait this.saveUnlocked(state);\n\t\t\treturn clonePushTarget(pushTarget);\n\t\t});\n\t}\n\n\tasync findClientLiveActivityDeliveryChannel(\n\t\tnodeId: string,\n\t\tlookup: IrohRemoteLiveActivityDeliveryChannelLookup,\n\t): Promise<IrohRemotePushTarget | undefined> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tconst client = state.clients.find((entry) => entry.nodeId === nodeId);\n\t\t\tconst pushTarget = client?.pushTargets?.find(\n\t\t\t\t(entry) =>\n\t\t\t\t\tentry.platform === lookup.platform &&\n\t\t\t\t\tentry.liveActivity?.tokenHash === lookup.tokenHash &&\n\t\t\t\t\tentry.liveActivity.tokenEnvironment === lookup.tokenEnvironment,\n\t\t\t);\n\t\t\treturn pushTarget ? clonePushTarget(pushTarget) : undefined;\n\t\t});\n\t}\n\n\tasync registerClientLiveActivity(\n\t\tnodeId: string,\n\t\tregistration: IrohRemoteLiveActivityRegistration,\n\t): Promise<IrohRemoteLiveActivityRegistrationResult> {\n\t\tconst validatedRegistration = parseIrohRemoteLiveActivityRegistration(registration);\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tconst client = state.clients.find((entry) => entry.nodeId === nodeId);\n\t\t\tif (!client) {\n\t\t\t\treturn {};\n\t\t\t}\n\t\t\tlet createdAt = validatedRegistration.createdAt;\n\t\t\tlet replacedRegistration: IrohRemoteLiveActivityRegistration | undefined;\n\t\t\tconst retainedRegistrations: IrohRemoteLiveActivityRegistration[] = [];\n\t\t\tfor (const existingRegistration of client.liveActivities ?? []) {\n\t\t\t\tif (\n\t\t\t\t\t(existingRegistration.workspaceName === validatedRegistration.workspaceName &&\n\t\t\t\t\t\texistingRegistration.sessionId === validatedRegistration.sessionId) ||\n\t\t\t\t\texistingRegistration.activityId === validatedRegistration.activityId\n\t\t\t\t) {\n\t\t\t\t\tcreatedAt = existingRegistration.createdAt;\n\t\t\t\t\treplacedRegistration = existingRegistration;\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tretainedRegistrations.push(existingRegistration);\n\t\t\t}\n\t\t\tconst savedRegistration = { ...validatedRegistration, createdAt };\n\t\t\tclient.liveActivities = normalizeIrohRemoteLiveActivityRegistrations([\n\t\t\t\t...retainedRegistrations,\n\t\t\t\tsavedRegistration,\n\t\t\t]);\n\t\t\tawait this.saveUnlocked(state);\n\t\t\treturn {\n\t\t\t\tclient: cloneClient(client),\n\t\t\t\tregistration: cloneLiveActivityRegistration(savedRegistration),\n\t\t\t\t...(replacedRegistration\n\t\t\t\t\t? { replacedRegistration: cloneLiveActivityRegistration(replacedRegistration) }\n\t\t\t\t\t: {}),\n\t\t\t};\n\t\t});\n\t}\n\n\tasync unregisterClientLiveActivity(\n\t\tnodeId: string,\n\t\tworkspaceName: string,\n\t\tsessionId: string,\n\t\tactivityId: string,\n\t): Promise<boolean> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tconst client = state.clients.find((entry) => entry.nodeId === nodeId);\n\t\t\tif (!client?.liveActivities) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tconst beforeCount = client.liveActivities.length;\n\t\t\tclient.liveActivities = client.liveActivities.filter(\n\t\t\t\t(entry) =>\n\t\t\t\t\tentry.workspaceName !== workspaceName ||\n\t\t\t\t\tentry.sessionId !== sessionId ||\n\t\t\t\t\tentry.activityId !== activityId,\n\t\t\t);\n\t\t\tconst removed = client.liveActivities.length !== beforeCount;\n\t\t\tif (client.liveActivities.length === 0) {\n\t\t\t\tdelete client.liveActivities;\n\t\t\t}\n\t\t\tif (removed) {\n\t\t\t\tawait this.saveUnlocked(state);\n\t\t\t}\n\t\t\treturn removed;\n\t\t});\n\t}\n\n\tasync pruneClientLiveActivityDeliveryChannel(\n\t\tnodeId: string,\n\t\tregistration: IrohRemoteLiveActivityRegistration,\n\t\tnow = Date.now(),\n\t): Promise<IrohRemoteLiveActivityPruneResult> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tconst client = state.clients.find((entry) => entry.nodeId === nodeId);\n\t\t\tif (!client) {\n\t\t\t\treturn { liveActivityRemoved: false, registrationsRemoved: 0 };\n\t\t\t}\n\n\t\t\tlet registrationsRemoved = 0;\n\t\t\tif (client.liveActivities) {\n\t\t\t\tconst beforeCount = client.liveActivities.length;\n\t\t\t\tclient.liveActivities = client.liveActivities.filter(\n\t\t\t\t\t(entry) => !isSameLiveActivityRegistration(entry, registration),\n\t\t\t\t);\n\t\t\t\tregistrationsRemoved = beforeCount - client.liveActivities.length;\n\t\t\t\tif (client.liveActivities.length === 0) {\n\t\t\t\t\tdelete client.liveActivities;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst pushTarget = client.pushTargets?.find((entry) => {\n\t\t\t\treturn (\n\t\t\t\t\tentry.id === registration.pushTargetId &&\n\t\t\t\t\tentry.platform === registration.platform &&\n\t\t\t\t\tentry.liveActivity?.tokenHash === registration.tokenHash &&\n\t\t\t\t\tentry.liveActivity.tokenEnvironment === registration.tokenEnvironment\n\t\t\t\t);\n\t\t\t});\n\t\t\tconst liveActivityRemoved = pushTarget?.liveActivity !== undefined;\n\t\t\tif (liveActivityRemoved && pushTarget) {\n\t\t\t\tdelete pushTarget.liveActivity;\n\t\t\t\tpushTarget.updatedAt = now;\n\t\t\t}\n\n\t\t\tif (registrationsRemoved > 0 || liveActivityRemoved) {\n\t\t\t\tawait this.saveUnlocked(state);\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tliveActivityRemoved,\n\t\t\t\tregistrationsRemoved,\n\t\t\t\t...(pushTarget ? { pushTarget: clonePushTarget(pushTarget) } : {}),\n\t\t\t};\n\t\t});\n\t}\n\n\tasync removeClientLiveActivitiesForSession(\n\t\tnodeId: string,\n\t\tworkspaceName: string,\n\t\tsessionId: string,\n\t): Promise<number> {\n\t\treturn this.removeClientLiveActivities(nodeId, (entry) => {\n\t\t\treturn entry.workspaceName === workspaceName && entry.sessionId === sessionId;\n\t\t});\n\t}\n\n\tasync removeClientLiveActivitiesForWorkspace(nodeId: string, workspaceName: string): Promise<number> {\n\t\treturn this.removeClientLiveActivities(nodeId, (entry) => entry.workspaceName === workspaceName);\n\t}\n\n\tasync removeLiveActivitiesForWorkspace(workspaceName: string): Promise<number> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tlet removedCount = 0;\n\t\t\tfor (const client of state.clients) {\n\t\t\t\tif (!client.liveActivities) {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tconst beforeCount = client.liveActivities.length;\n\t\t\t\tclient.liveActivities = client.liveActivities.filter((entry) => entry.workspaceName !== workspaceName);\n\t\t\t\tremovedCount += beforeCount - client.liveActivities.length;\n\t\t\t\tif (client.liveActivities.length === 0) {\n\t\t\t\t\tdelete client.liveActivities;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (removedCount > 0) {\n\t\t\t\tawait this.saveUnlocked(state);\n\t\t\t}\n\t\t\treturn removedCount;\n\t\t});\n\t}\n\n\tasync revokeClient(nodeId: string, now = Date.now()): Promise<IrohRemoteClientRevocationResult> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tconst clientIndex = state.clients.findIndex((client) => client.nodeId === nodeId);\n\t\t\tif (clientIndex === -1) {\n\t\t\t\tconst revokedClient = getRevokedClients(state).find((client) => client.nodeId === nodeId);\n\t\t\t\treturn {\n\t\t\t\t\trevoked: false,\n\t\t\t\t\t...(revokedClient ? { revokedClient: cloneRevokedClient(revokedClient) } : {}),\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tconst [client] = state.clients.splice(clientIndex, 1);\n\t\t\tconst revokedClient: IrohRemoteRevokedClient = {\n\t\t\t\tnodeId: client.nodeId,\n\t\t\t\tlabel: client.label,\n\t\t\t\tallowedWorkspaces: [...client.allowedWorkspaces],\n\t\t\t\tallowedTools: client.allowedTools,\n\t\t\t\trpcGrant: parseIrohRemoteRpcGrant(client.rpcGrant, \"client rpcGrant\"),\n\t\t\t\tpairedAt: client.pairedAt,\n\t\t\t\tlastSeenAt: client.lastSeenAt,\n\t\t\t\trevokedAt: now,\n\t\t\t\t...(client.lastSessionIdByWorkspace\n\t\t\t\t\t? { lastSessionIdByWorkspace: { ...client.lastSessionIdByWorkspace } }\n\t\t\t\t\t: {}),\n\t\t\t};\n\t\t\tstate.revokedClients = [...getRevokedClients(state).filter((entry) => entry.nodeId !== nodeId), revokedClient];\n\t\t\tawait this.saveUnlocked(state);\n\t\t\treturn { revoked: true, client: cloneClient(client), revokedClient: cloneRevokedClient(revokedClient) };\n\t\t});\n\t}\n\n\tasync approveClientRePair(nodeId: string, now = Date.now()): Promise<IrohRemoteClientRePairApprovalResult> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tconst revokedClient = getRevokedClients(state).find((client) => client.nodeId === nodeId);\n\t\t\tif (!revokedClient) {\n\t\t\t\treturn { approved: false };\n\t\t\t}\n\t\t\trevokedClient.rePairApprovedAt = now;\n\t\t\tawait this.saveUnlocked(state);\n\t\t\treturn { approved: true, revokedClient: cloneRevokedClient(revokedClient) };\n\t\t});\n\t}\n\n\tprivate async getWorkspaceStatuses(\n\t\tstate: IrohRemoteHostState,\n\t\toptions: AuthorizeIrohRemoteClientOptions,\n\t): Promise<IrohRemoteWorkspaceStatus[]> {\n\t\treturn await getIrohRemoteWorkspaceStatuses(state, options.classifyWorkspaceAvailability);\n\t}\n\n\tprivate runExclusive<T>(operation: () => T | Promise<T>): Promise<T> {\n\t\tconst run = this.operationQueue.then(\n\t\t\t() => this.withStateFileLock(operation),\n\t\t\t() => this.withStateFileLock(operation),\n\t\t);\n\t\tthis.operationQueue = run.then(\n\t\t\t() => undefined,\n\t\t\t() => undefined,\n\t\t);\n\t\treturn run;\n\t}\n\n\tprivate async withStateFileLock<T>(operation: () => T | Promise<T>): Promise<T> {\n\t\tif (!this.statePath) {\n\t\t\treturn await operation();\n\t\t}\n\n\t\tawait mkdir(dirname(this.statePath), { recursive: true });\n\t\tlet release: (() => Promise<void>) | undefined;\n\t\tlet lockCompromised = false;\n\t\tlet lockCompromisedError: Error | undefined;\n\t\tconst throwIfCompromised = () => {\n\t\t\tif (lockCompromised) {\n\t\t\t\tthrow lockCompromisedError ?? new Error(\"Iroh remote host state lock was compromised\");\n\t\t\t}\n\t\t};\n\n\t\ttry {\n\t\t\trelease = await lockfile.lock(this.statePath, {\n\t\t\t\tlockfilePath: `${this.statePath}.lock`,\n\t\t\t\trealpath: false,\n\t\t\t\tretries: {\n\t\t\t\t\tretries: 10,\n\t\t\t\t\tfactor: 2,\n\t\t\t\t\tminTimeout: 100,\n\t\t\t\t\tmaxTimeout: 10000,\n\t\t\t\t\trandomize: true,\n\t\t\t\t},\n\t\t\t\tstale: 30000,\n\t\t\t\tonCompromised: (error) => {\n\t\t\t\t\tlockCompromised = true;\n\t\t\t\t\tlockCompromisedError = error;\n\t\t\t\t},\n\t\t\t});\n\n\t\t\tthrowIfCompromised();\n\t\t\tconst result = await operation();\n\t\t\tthrowIfCompromised();\n\t\t\treturn result;\n\t\t} finally {\n\t\t\tif (release) {\n\t\t\t\ttry {\n\t\t\t\t\tawait release();\n\t\t\t\t} catch {\n\t\t\t\t\t// Ignore unlock errors after a compromised lock.\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate async loadUnlocked(): Promise<IrohRemoteHostState> {\n\t\tif (this.store) {\n\t\t\tthis.state = cloneHostState(await this.store.read());\n\t\t\treturn this.state;\n\t\t}\n\t\tif (this.statePath) {\n\t\t\tthis.state = await readIrohRemoteHostState(this.statePath);\n\t\t\treturn this.state;\n\t\t}\n\t\tthis.state ??= createEmptyIrohRemoteHostState();\n\t\treturn this.state;\n\t}\n\n\tprivate async saveUnlocked(state: IrohRemoteHostState | undefined): Promise<void> {\n\t\tconst stateToSave = state ? cloneHostState(state) : createEmptyIrohRemoteHostState();\n\t\tthis.state = stateToSave;\n\t\tif (this.store) {\n\t\t\tawait this.store.write(cloneHostState(stateToSave));\n\t\t\treturn;\n\t\t}\n\t\tif (this.statePath) {\n\t\t\tawait writeIrohRemoteHostState(this.statePath, stateToSave);\n\t\t}\n\t}\n\n\tprivate async restoreAfterFailedWorktreePersistence(previousState: IrohRemoteHostState): Promise<void> {\n\t\tconst restoredState = cloneHostState(previousState);\n\t\tthis.state = restoredState;\n\t\tif (!this.store) {\n\t\t\treturn;\n\t\t}\n\t\ttry {\n\t\t\tawait this.store.write(cloneHostState(restoredState));\n\t\t\tthis.state = restoredState;\n\t\t} catch {\n\t\t\t// A failed rollback may leave the child record in the custom store, which\n\t\t\t// is safer than deleting a checkout whose persistence outcome is unknown.\n\t\t}\n\t}\n\n\tprivate async removeClientLiveActivities(\n\t\tnodeId: string,\n\t\tshouldRemove: (registration: IrohRemoteLiveActivityRegistration) => boolean,\n\t): Promise<number> {\n\t\treturn this.runExclusive(async () => {\n\t\t\tconst state = await this.loadUnlocked();\n\t\t\tconst client = state.clients.find((entry) => entry.nodeId === nodeId);\n\t\t\tif (!client?.liveActivities) {\n\t\t\t\treturn 0;\n\t\t\t}\n\t\t\tconst beforeCount = client.liveActivities.length;\n\t\t\tclient.liveActivities = client.liveActivities.filter((entry) => !shouldRemove(entry));\n\t\t\tconst removedCount = beforeCount - client.liveActivities.length;\n\t\t\tif (client.liveActivities.length === 0) {\n\t\t\t\tdelete client.liveActivities;\n\t\t\t}\n\t\t\tif (removedCount > 0) {\n\t\t\t\tawait this.saveUnlocked(state);\n\t\t\t}\n\t\t\treturn removedCount;\n\t\t});\n\t}\n}\n\nfunction cloneAuthorizationResult(result: IrohRemoteClientAuthorizationResult): IrohRemoteClientAuthorizationResult {\n\tif (!result.ok) {\n\t\treturn {\n\t\t\t...result,\n\t\t\t...(result.client ? { client: cloneClient(result.client) } : {}),\n\t\t\t...(result.expiredPairingTickets\n\t\t\t\t? { expiredPairingTickets: result.expiredPairingTickets.map((ticket) => clonePendingPairingTicket(ticket)) }\n\t\t\t\t: {}),\n\t\t\t...(result.workspace ? { workspace: cloneWorkspace(result.workspace) } : {}),\n\t\t};\n\t}\n\treturn {\n\t\t...result,\n\t\tclient: cloneClient(result.client),\n\t\t...(result.consumedPairingTicket\n\t\t\t? { consumedPairingTicket: clonePendingPairingTicket(result.consumedPairingTicket) }\n\t\t\t: {}),\n\t\t...(result.expiredPairingTickets\n\t\t\t? { expiredPairingTickets: result.expiredPairingTickets.map((ticket) => clonePendingPairingTicket(ticket)) }\n\t\t\t: {}),\n\t\tworkspace: cloneWorkspace(result.workspace),\n\t\tworkspaceNames: [...result.workspaceNames],\n\t\tworkspaces: result.workspaces.map((workspace) => ({ ...workspace })),\n\t};\n}\n\nfunction cloneClient(client: IrohRemoteClient): IrohRemoteGrantedClient {\n\treturn {\n\t\t...client,\n\t\tallowedWorkspaces: [...client.allowedWorkspaces],\n\t\trpcGrant: parseIrohRemoteRpcGrant(client.rpcGrant, \"client rpcGrant\"),\n\t\t...(client.lastSessionIdByWorkspace ? { lastSessionIdByWorkspace: { ...client.lastSessionIdByWorkspace } } : {}),\n\t\t...(client.pushTargets ? { pushTargets: client.pushTargets.map((target) => clonePushTarget(target)) } : {}),\n\t\t...(client.liveActivities\n\t\t\t? { liveActivities: client.liveActivities.map((registration) => cloneLiveActivityRegistration(registration)) }\n\t\t\t: {}),\n\t};\n}\n\nfunction cloneHostState(state: IrohRemoteHostState): IrohRemoteHostState {\n\treturn {\n\t\thostSecretKey: state.hostSecretKey ? [...state.hostSecretKey] : undefined,\n\t\tpairingSecretTombstones: (state.pairingSecretTombstones ?? []).map((tombstone) =>\n\t\t\tclonePairingSecretTombstone(tombstone),\n\t\t),\n\t\tworkspaces: state.workspaces.map((workspace) => cloneWorkspace(workspace)),\n\t\tworktrees: (state.worktrees ?? []).map((worktree) => cloneWorktree(worktree)),\n\t\tclients: state.clients.map((client) => cloneClient(client)),\n\t\trevokedClients: (state.revokedClients ?? []).map((client) => cloneRevokedClient(client)),\n\t\tpendingPairingTickets: (state.pendingPairingTickets ?? []).map((ticket) => clonePendingPairingTicket(ticket)),\n\t};\n}\n\nfunction clonePairingSecretTombstone(tombstone: IrohRemotePairingSecretTombstone): IrohRemotePairingSecretTombstone {\n\treturn { ...tombstone };\n}\n\nfunction clonePendingPairingTicket(ticket: IrohRemotePendingPairingTicket): IrohRemotePendingPairingTicket {\n\treturn {\n\t\t...ticket,\n\t\t...(ticket.rpcGrant === undefined ? {} : { rpcGrant: cloneIrohRemoteRpcGrant(ticket.rpcGrant) }),\n\t};\n}\n\nfunction clonePushTarget(pushTarget: IrohRemotePushTarget): IrohRemotePushTarget {\n\treturn {\n\t\t...pushTarget,\n\t\t...(pushTarget.liveActivity ? { liveActivity: { ...pushTarget.liveActivity } } : {}),\n\t};\n}\n\nfunction cloneLiveActivityRegistration(\n\tregistration: IrohRemoteLiveActivityRegistration,\n): IrohRemoteLiveActivityRegistration {\n\treturn { ...registration };\n}\n\nfunction cloneRevokedClient(client: IrohRemoteRevokedClient): IrohRemoteGrantedRevokedClient {\n\treturn {\n\t\t...client,\n\t\tallowedWorkspaces: [...client.allowedWorkspaces],\n\t\trpcGrant: parseIrohRemoteRpcGrant(client.rpcGrant, \"revoked client rpcGrant\"),\n\t\t...(client.lastSessionIdByWorkspace ? { lastSessionIdByWorkspace: { ...client.lastSessionIdByWorkspace } } : {}),\n\t};\n}\n\nfunction cloneWorkspace(workspace: IrohRemoteWorkspace): IrohRemoteWorkspace {\n\treturn { ...workspace };\n}\n\nfunction cloneWorktree(worktree: IrohRemoteWorkspaceWorktree): IrohRemoteWorkspaceWorktree {\n\treturn { ...worktree, sessionIds: [...worktree.sessionIds] };\n}\n\nfunction getRevokedClients(state: IrohRemoteHostState): IrohRemoteRevokedClient[] {\n\tstate.revokedClients ??= [];\n\treturn state.revokedClients;\n}\n\nfunction isSamePushTargetSlot(a: IrohRemotePushTarget, b: IrohRemotePushTarget): boolean {\n\treturn a.id === b.id || (a.provider === b.provider && a.platform === b.platform);\n}\n\nfunction isSameLiveActivityRegistration(\n\ta: IrohRemoteLiveActivityRegistration,\n\tb: IrohRemoteLiveActivityRegistration,\n): boolean {\n\treturn (\n\t\ta.workspaceName === b.workspaceName &&\n\t\ta.sessionId === b.sessionId &&\n\t\ta.activityId === b.activityId &&\n\t\ta.tokenHash === b.tokenHash &&\n\t\ta.tokenEnvironment === b.tokenEnvironment &&\n\t\ta.platform === b.platform &&\n\t\ta.pushTargetId === b.pushTargetId\n\t);\n}\n"]}