@hasna/infinity 0.1.0

package/dist/migrate.js

@@ -0,0 +1,346 @@
+#!/usr/bin/env bun
+// @bun
+
+// src/persistence/migrate-main.ts
+var {SQL } = globalThis.Bun;
+
+// src/core/errors.ts
+class InfinityError extends Error {
+  code;
+  status;
+  retryable;
+  details;
+  constructor(code, message, options = {}) {
+    super(message, { cause: options.cause });
+    this.name = "InfinityError";
+    this.code = code;
+    this.status = options.status ?? 400;
+    this.retryable = options.retryable ?? false;
+    this.details = Object.freeze({ ...options.details ?? {} });
+  }
+}
+
+// src/core/validation.ts
+function isPlainObject(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+var CREDENTIAL_CARRIER_PATTERN_SOURCE = "^(?:[sS][kK]-[A-Za-z0-9]|[gG][hH][pPoOuUsSrR]_|[gG][iI][tT][hH][uU][bB]_[pP][aA][tT]_|[xX][oO][xX][bBaApPrRsS]-|[aA][kKsS][iI][aA][0-9A-Za-z]|[aA][iI][zZ][aA]|[nN][pP][mM]_|[xX][aA][iI]-|[cC][tT][xX]7[sS][kK]-)";
+var CREDENTIAL_CARRIER_PATTERN = new RegExp(CREDENTIAL_CARRIER_PATTERN_SOURCE);
+function invalid(message) {
+  return new InfinityError("invalid_input", message, { status: 2 });
+}
+
+// src/core/strict-json.ts
+var strictDocuments = new WeakSet;
+var strictDocumentDigests = new WeakMap;
+function canonicalJson(value) {
+  if (value === null)
+    return "null";
+  if (typeof value === "boolean")
+    return value ? "true" : "false";
+  if (typeof value === "string") {
+    if (value.normalize("NFC") !== value)
+      throw invalid("canonical JSON strings must use NFC normalization");
+    if (hasUnpairedSurrogate(value))
+      throw invalid("canonical JSON strings must not contain unpaired surrogates");
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value) || Object.is(value, -0))
+      throw invalid("canonical JSON numbers must be finite and not negative zero");
+    if (Number.isInteger(value) && !Number.isSafeInteger(value)) {
+      throw invalid("canonical JSON integer Numbers must be safe integers; use bigint for exact wider values");
+    }
+    return JSON.stringify(value);
+  }
+  if (typeof value === "bigint")
+    return value.toString(10);
+  if (Array.isArray(value)) {
+    for (let index = 0;index < value.length; index += 1) {
+      if (!Object.hasOwn(value, index))
+        throw invalid("canonical JSON arrays must not be sparse");
+    }
+    return `[${value.map((entry) => canonicalJson(entry)).join(",")}]`;
+  }
+  if (!isPlainObject(value))
+    throw invalid("canonical JSON accepts only JSON-compatible values");
+  const entries = Object.keys(value).sort().map((key) => {
+    if (key.normalize("NFC") !== key)
+      throw invalid("canonical JSON keys must use NFC normalization");
+    if (hasUnpairedSurrogate(key))
+      throw invalid("canonical JSON keys must not contain unpaired surrogates");
+    const nested = value[key];
+    if (nested === undefined)
+      throw invalid("canonical JSON object contains an undefined field");
+    return `${JSON.stringify(key)}:${canonicalJson(nested)}`;
+  });
+  return `{${entries.join(",")}}`;
+}
+function hasUnpairedSurrogate(value) {
+  for (let index = 0;index < value.length; index += 1) {
+    const unit = value.charCodeAt(index);
+    if (unit >= 55296 && unit <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (!(next >= 56320 && next <= 57343))
+        return true;
+      index += 1;
+    } else if (unit >= 56320 && unit <= 57343) {
+      return true;
+    }
+  }
+  return false;
+}
+
+// src/persistence/migrations.ts
+import { existsSync, readFileSync } from "fs";
+import { dirname, join, parse } from "path";
+import { fileURLToPath } from "url";
+var DEFAULT_POSTGRES_ROLES = {
+  runtimeRole: "infinity_runtime",
+  reconcilerRole: "infinity_reconciler",
+  journalAckerRole: "infinity_journal_acker"
+};
+var POSTGRES_MIGRATION_MANIFEST = Object.freeze({
+  "0001_authority.sql": "sha256:bfcff16873cf8664ee46aeea581f9f4d212bac05cf3bbc1817dc495434f7f1d6",
+  "0002_effect_step_global_owner.sql": "sha256:3342801f79c4cf6321bbeaa3928cf7a0d4a3e9a391505274e88931c48eb4632d",
+  "0003_effect_journal_observed_head.sql": "sha256:0cf5388c8665f9727df4f1f7430761086bd2fa03d0e1e2aaddecda9ca7790aba",
+  "0004_authority_mutation_journal_binding.sql": "sha256:ddeb4d190016536f61ea55e3e0c36a5fa28211af5ed2c9a41c752ce3b1a857d0",
+  "20260710_checkpoint_broker_v1.sql": "sha256:3e250bee6358188cf30acb2ab14f31edfdf94c2b73502793b91a7caaf28c3d8f",
+  "20260711_checkpoint_trust_v2.sql": "sha256:5165e08ae32b671838a2ee9349b35cf7007afade70ec19694ad27334bdaac065",
+  "20260711_verifier_cleanup_v2.sql": "sha256:fe06ed0ec0bde18310321e7cce19c885f127e550ac1ea365b159be4effb71e79",
+  "20260711_accounts_operation_v1.sql": "sha256:7d9caa3aa9fbbdab501e81b363ec5258b006a86572211eccb563b000d52d3a62",
+  "20260711_z_accounts_claim_authority_v2.sql": "sha256:1da1ace609a4813472f2637d61b435cf372bd9d0f66694b3c502e17da3b9de38",
+  "20260711_zz_sandbox_dispatch_authority_v1.sql": "sha256:543bb2c9b392c98c2069c437616e3d7d0fbf1d02cb8d1f6e09f1bad83238e69f",
+  "20260712_sandbox_dispatch_authority_v2.sql": "sha256:c93b5b31d4f94549018300c94a568a4b8b5a403f28bf04d6177d14726518b3e3"
+});
+async function applyPostgresMigrations(sql, directory) {
+  const migrationDirectory = directory ?? packagedMigrationDirectory(import.meta.url);
+  const paths = [];
+  for await (const path of new Bun.Glob("*.sql").scan({ cwd: migrationDirectory, absolute: true, onlyFiles: true })) {
+    paths.push(path);
+  }
+  paths.sort((left, right) => left.localeCompare(right));
+  if (paths.length === 0)
+    throw new InfinityError("invalid_input", "no PostgreSQL migrations were found");
+  const names = paths.map((path) => path.slice(path.lastIndexOf("/") + 1));
+  if (canonicalStringArray(names) !== canonicalStringArray(Object.keys(POSTGRES_MIGRATION_MANIFEST))) {
+    throw new InfinityError("integrity_failure", "PostgreSQL migration files differ from the compiled immutable manifest");
+  }
+  return sql.begin(async (tx) => {
+    await tx.unsafe(`
+      CREATE SCHEMA IF NOT EXISTS infinity;
+      CREATE TABLE IF NOT EXISTS infinity.schema_migrations (
+        migration_name text PRIMARY KEY,
+        checksum text NOT NULL CHECK (checksum ~ '^sha256:[0-9a-f]{64}$'),
+        applied_at timestamptz NOT NULL
+      );
+    `).simple();
+    await tx`SELECT pg_advisory_xact_lock(hashtextextended('infinity.schema.migrations', 0))`;
+    const applied = [];
+    const alreadyApplied = [];
+    for (const path of paths) {
+      const name = path.slice(path.lastIndexOf("/") + 1);
+      if (!/^(?:\d{4}|\d{8})_[a-z0-9_]+\.sql$/.test(name)) {
+        throw new InfinityError("invalid_input", "migration filename is not canonical");
+      }
+      const source = await Bun.file(path).text();
+      const checksum = rawSha256(source);
+      const compiledChecksum = POSTGRES_MIGRATION_MANIFEST[name];
+      if (checksum !== compiledChecksum) {
+        throw new InfinityError("integrity_failure", `migration bytes differ from compiled manifest: ${name}`);
+      }
+      const existing = await tx`
+        SELECT checksum FROM infinity.schema_migrations WHERE migration_name = ${name}
+      `;
+      if (existing.length > 0) {
+        if (existing[0].checksum !== checksum) {
+          throw new InfinityError("integrity_failure", `applied migration checksum differs: ${name}`);
+        }
+        alreadyApplied.push(name);
+        continue;
+      }
+      await tx.unsafe(source).simple();
+      await tx`
+        INSERT INTO infinity.schema_migrations (migration_name, checksum, applied_at)
+        VALUES (${name}, ${checksum}, clock_timestamp())
+      `;
+      applied.push(name);
+    }
+    return { applied, alreadyApplied };
+  });
+}
+function packagedMigrationDirectory(moduleUrl) {
+  let candidate = dirname(fileURLToPath(moduleUrl));
+  const filesystemRoot = parse(candidate).root;
+  while (candidate !== filesystemRoot) {
+    const packagePath = join(candidate, "package.json");
+    const migrationsPath = join(candidate, "migrations");
+    if (existsSync(packagePath) && existsSync(migrationsPath)) {
+      try {
+        const packageManifest = JSON.parse(readFileSync(packagePath, "utf8"));
+        if (packageManifest.name === "@hasna/infinity")
+          return migrationsPath;
+      } catch {
+        throw new InfinityError("integrity_failure", "Infinity package manifest cannot locate PostgreSQL migrations");
+      }
+    }
+    candidate = dirname(candidate);
+  }
+  throw new InfinityError("invalid_input", "no PostgreSQL migrations were found");
+}
+async function configurePostgresRoles(sql, roles = DEFAULT_POSTGRES_ROLES) {
+  const runtimeRole = sqlIdentifier(roles.runtimeRole, "runtime role");
+  const reconcilerRole = sqlIdentifier(roles.reconcilerRole, "reconciler role");
+  const journalAckerRole = sqlIdentifier(roles.journalAckerRole, "journal acker role");
+  if (new Set([runtimeRole, reconcilerRole, journalAckerRole]).size !== 3) {
+    throw new InfinityError("invalid_input", "runtime, reconciler, and journal acker roles must differ");
+  }
+  const session = await sql`
+    SELECT current_user, database.datname AS database_name, owner.rolname AS database_owner
+    FROM pg_database database
+    JOIN pg_roles owner ON owner.oid = database.datdba
+    WHERE database.datname = current_database()
+  `;
+  const database = session[0];
+  if ([runtimeRole, reconcilerRole, journalAckerRole].includes(database?.current_user ?? "")) {
+    throw new InfinityError("capability_denied", "migration session must be distinct from authority service roles", { status: 403 });
+  }
+  if (!database || database.database_owner !== database.current_user) {
+    throw new InfinityError("capability_denied", "Infinity migration role must be the dedicated owner of the current database", { status: 503 });
+  }
+  for (const role of [runtimeRole, reconcilerRole, journalAckerRole]) {
+    const found = await sql`SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${role}) AS present`;
+    if (!found[0]?.present)
+      await sql.unsafe(`CREATE ROLE ${quoteIdentifier(role)} NOLOGIN`);
+    await sql.unsafe(`ALTER ROLE ${quoteIdentifier(role)} NOSUPERUSER NOCREATEDB NOCREATEROLE NOLOGIN NOREPLICATION NOBYPASSRLS`);
+    const parentMemberships = await sql`
+      SELECT parent.rolname AS role_name
+      FROM pg_auth_members membership
+      JOIN pg_roles child ON child.oid = membership.member
+      JOIN pg_roles parent ON parent.oid = membership.roleid
+      WHERE child.rolname = ${role}
+    `;
+    if (parentMemberships.length > 0) {
+      throw new InfinityError("capability_denied", `Infinity authority role ${role} has a privilege-escalating parent membership`, { status: 503 });
+    }
+    const databaseOwnerMembership = await sql`
+      SELECT pg_has_role(${role}, 'pg_database_owner', 'MEMBER') AS member,
+        pg_has_role(${role}, 'pg_database_owner', 'SET') AS settable
+    `;
+    if (databaseOwnerMembership[0]?.member || databaseOwnerMembership[0]?.settable) {
+      throw new InfinityError("capability_denied", `Infinity authority role ${role} must not inherit or SET pg_database_owner`, { status: 503 });
+    }
+  }
+  const runtime = quoteIdentifier(runtimeRole);
+  const reconciler = quoteIdentifier(reconcilerRole);
+  const journalAcker = quoteIdentifier(journalAckerRole);
+  await sql.begin(async (tx) => {
+    const databaseIdentifier = quoteIdentifier(database.database_name);
+    await tx.unsafe(`REVOKE CREATE, TEMPORARY ON DATABASE ${databaseIdentifier} FROM PUBLIC`);
+    await tx.unsafe(`REVOKE ALL PRIVILEGES ON DATABASE ${databaseIdentifier} FROM ${runtime}, ${reconciler}, ${journalAcker}`);
+    await tx.unsafe(`GRANT CONNECT ON DATABASE ${databaseIdentifier} TO ${runtime}, ${reconciler}, ${journalAcker}`);
+    await tx.unsafe("REVOKE ALL ON SCHEMA infinity FROM PUBLIC");
+    await tx.unsafe(`REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA infinity FROM ${runtime}, ${reconciler}, ${journalAcker}`);
+    await tx.unsafe(`REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA infinity FROM ${runtime}, ${reconciler}, ${journalAcker}`);
+    await tx.unsafe(`GRANT USAGE ON SCHEMA infinity TO ${runtime}, ${reconciler}, ${journalAcker}`);
+    await tx.unsafe(`GRANT SELECT ON ALL TABLES IN SCHEMA infinity TO ${runtime}, ${reconciler}`);
+    await tx.unsafe(`GRANT SELECT ON infinity.authority_runtime_meta, infinity.authority_mutation_envelopes,
+      infinity.authority_mutation_acknowledgements, infinity.authority_mutation_journal_binding,
+      infinity.outbox TO ${journalAcker}`);
+    await tx.unsafe(`GRANT INSERT ON infinity.run_specs, infinity.runs, infinity.attempts,
+      infinity.attempt_lease_grants, infinity.attempt_lease_events, infinity.queue_entries,
+      infinity.admission_keys, infinity.idempotency_records, infinity.events, infinity.budget_reservations,
+      infinity.event_stream_heads, infinity.outbox, infinity.external_operations,
+      infinity.authority_mutation_envelopes, infinity.accounts_resource_authority,
+      infinity.accounts_operation_signer_pin, infinity.accounts_serialization_domains,
+      infinity.accounts_serialization_frontier_heads, infinity.accounts_model_call_operations,
+      infinity.accounts_model_effect_journal, infinity.sandbox_dispatch_accounts_consume_evidence,
+      infinity.sandbox_dispatch_authorizations TO ${runtime}`);
+    await tx.unsafe(`GRANT UPDATE ON infinity.runs, infinity.attempts, infinity.queue_entries,
+      infinity.event_stream_heads, infinity.external_operations TO ${runtime}`);
+    await tx.unsafe(`GRANT UPDATE
+      (head_sequence, head_digest, pin_digest, pin_record, updated_at)
+      ON infinity.accounts_operation_signer_pin TO ${runtime}`);
+    await tx.unsafe(`GRANT UPDATE
+      (state, updated_at)
+      ON infinity.accounts_resource_authority TO ${runtime}`);
+    await tx.unsafe(`GRANT UPDATE
+      (active_model_operation_id, revision, state_digest, state_record, updated_at)
+      ON infinity.accounts_serialization_domains TO ${runtime}`);
+    await tx.unsafe(`GRANT UPDATE
+      (state, consume_receipt_digest, use_id, projection_digest, projection_record, updated_at)
+      ON infinity.accounts_model_call_operations TO ${runtime}`);
+    await tx.unsafe(`GRANT UPDATE
+      (state, consume_operation_id, consume_idempotency_key, consume_request_digest,
+       effect_claim_digest, canonical_intent_digest, dispatch_use_id, consumption_receipt_digest,
+       consumption_receipt_record, consumed_at, provider_contact_expires_at, updated_at)
+      ON infinity.sandbox_dispatch_authorizations TO ${runtime}`);
+    await tx.unsafe(`GRANT UPDATE
+      (next_queue_sequence, next_commit_sequence, budget_reserved_units, budget_charged_units, budget_released_units)
+      ON infinity.authority_runtime_meta TO ${runtime}`);
+    await tx.unsafe(`GRANT INSERT ON infinity.effect_operation_steps, infinity.effect_journal_records,
+      infinity.effect_journal_observed_head TO ${reconciler}`);
+    await tx.unsafe(`GRANT UPDATE ON infinity.effect_journal_frontier,
+      infinity.effect_journal_observed_head TO ${reconciler}`);
+    await tx.unsafe(`GRANT UPDATE (state, lease_owner, lease_expires_at) ON infinity.outbox TO ${reconciler}`);
+    await tx.unsafe(`GRANT INSERT ON infinity.authority_mutation_acknowledgements TO ${journalAcker}`);
+    await tx.unsafe(`GRANT INSERT ON infinity.authority_mutation_journal_binding TO ${journalAcker}`);
+    await tx.unsafe(`GRANT UPDATE (journal_acknowledged_through)
+      ON infinity.authority_runtime_meta TO ${journalAcker}`);
+    await tx.unsafe(`GRANT UPDATE (state) ON infinity.outbox TO ${journalAcker}`);
+    await tx.unsafe(`REVOKE CREATE ON SCHEMA infinity FROM ${runtime}, ${reconciler}, ${journalAcker}`);
+    await tx.unsafe(`REVOKE DELETE, TRUNCATE, REFERENCES, TRIGGER ON ALL TABLES IN SCHEMA infinity FROM ${runtime}, ${reconciler}, ${journalAcker}`);
+    await tx.unsafe(`REVOKE ALL ON FUNCTION infinity.capture_authority_mutation_change(),
+      infinity.validate_authority_mutation_envelope(), infinity.validate_authority_mutation_acknowledgement(),
+      infinity.validate_authority_ack_frontier_update(), infinity.validate_outbox_write(),
+      infinity.validate_effect_journal_observed_head_update(),
+      infinity.validate_accounts_operation_signer_pin_update(),
+      infinity.validate_accounts_resource_authority_update(),
+      infinity.validate_sandbox_dispatch_authorization_update()
+      FROM PUBLIC, ${runtime}, ${reconciler}, ${journalAcker}`);
+  });
+}
+function rawSha256(source) {
+  const value = new Bun.CryptoHasher("sha256").update(source).digest("hex");
+  return `sha256:${value}`;
+}
+function sqlIdentifier(value, label) {
+  if (!/^[a-z][a-z0-9_]{0,62}$/.test(value))
+    throw new InfinityError("invalid_input", `${label} is not a canonical PostgreSQL identifier`);
+  return value;
+}
+function quoteIdentifier(value) {
+  return `"${value.replaceAll('"', '""')}"`;
+}
+function canonicalStringArray(values) {
+  return JSON.stringify([...values].sort((left, right) => left.localeCompare(right)));
+}
+
+// src/persistence/migrate-main.ts
+var url = process.env.INFINITY_MIGRATOR_DATABASE_URL;
+if (!url) {
+  process.stderr.write(`INFINITY_MIGRATOR_DATABASE_URL is required
+`);
+  process.exitCode = 2;
+} else {
+  const sql = new SQL(url, { max: 1 });
+  try {
+    const result = await applyPostgresMigrations(sql);
+    await configurePostgresRoles(sql, {
+      runtimeRole: process.env.INFINITY_RUNTIME_ROLE ?? "infinity_runtime",
+      reconcilerRole: process.env.INFINITY_RECONCILER_ROLE ?? "infinity_reconciler",
+      journalAckerRole: process.env.INFINITY_JOURNAL_ACKER_ROLE ?? "infinity_journal_acker"
+    });
+    process.stdout.write(`${canonicalJson({ ok: true, ...result })}
+`);
+  } catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : "migration failed"}
+`);
+    process.exitCode = 1;
+  } finally {
+    await sql.close({ timeout: 1 });
+  }
+}