@hivemagnus/magnus-server 1.1.13 → 2.1.0

package/prisma/schema.prisma

@@ -44,6 +44,15 @@ enum UserRole {
   VIEWER
 }
 
+// Product-owned completion receipt. A schema migration alone does not prove that
+// the fresh installation's required base-data transaction committed.
+model ProductInitialization {
+  id          String   @id
+  completedAt DateTime @default(now())
+
+  @@map("product_initializations")
+}
+
 // ─── Nodes ───
 
 model Node {
@@ -2183,3 +2192,16 @@ model ManagedCronOccurrence {
   @@index([nodeId, state])
   @@map("managed_cron_occurrences")
 }
+
+/// Narrow Cindertrace bridge ledger; never replays an uncertain response.
+model CindertraceResponse {
+  id String @id
+  actionOperation String @unique
+  nodeId String
+  requestSha256 String
+  requestJson String
+  status String @default("claimed")
+  responseJson String?
+  createdAt DateTime @default(now())
+  @@map("cindertrace_responses")
+}

package/dist/services/security-fusion-actions.js

@@ -1,22 +0,0 @@
-export const SECURITY_FUSION_ACTION_TRANSITIONS = {
-    previewed: ['pending_approval', 'cancelled'],
-    pending_approval: ['dispatch_pending', 'rejected', 'cancelled'],
-    dispatch_pending: ['executing', 'verifying', 'succeeded', 'failed'],
-    executing: ['verifying', 'succeeded', 'failed', 'release_pending'],
-    verifying: ['succeeded', 'failed'],
-    succeeded: ['release_pending'],
-    release_pending: ['releasing', 'released', 'failed'],
-    releasing: ['released', 'failed'],
-    rejected: [],
-    cancelled: [],
-    failed: [],
-    released: [],
-};
-export function canTransitionSecurityFusionAction(from, to) {
-    return SECURITY_FUSION_ACTION_TRANSITIONS[from].includes(to);
-}
-export function securityFusionActionSources(to) {
-    return Object.keys(SECURITY_FUSION_ACTION_TRANSITIONS)
-        .filter((from) => canTransitionSecurityFusionAction(from, to));
-}
-//# sourceMappingURL=security-fusion-actions.js.map

package/dist/services/security-fusion-evidence-integrity.js

@@ -1,144 +0,0 @@
-import { createHash } from 'node:crypto';
-import { createReadStream } from 'node:fs';
-import { lstat, mkdir, rename } from 'node:fs/promises';
-import { basename, isAbsolute, join, relative, resolve } from 'node:path';
-import { getDb } from '../db/index.js';
-import { setMetricGauge } from '../routes/metrics.js';
-function evidenceBase() {
-    return resolve(process.env['SECURITY_FUSION_EVIDENCE_DIR'] ?? './state/security-fusion/evidence');
-}
-function pathInside(base, candidate) {
-    const rel = relative(base, resolve(candidate));
-    return rel.length > 0 && !rel.startsWith('..') && !isAbsolute(rel);
-}
-async function hashFile(path) {
-    const hash = createHash('sha256');
-    await new Promise((resolvePromise, reject) => {
-        const stream = createReadStream(path);
-        stream.on('data', (chunk) => hash.update(chunk));
-        stream.on('error', reject);
-        stream.on('end', resolvePromise);
-    });
-    return hash.digest('hex');
-}
-export async function ensurePrivateEvidenceDirectory(path) {
-    await mkdir(path, { recursive: true, mode: 0o700 });
-    const info = await lstat(path);
-    const expectedUid = typeof process.geteuid === 'function' ? process.geteuid() : info.uid;
-    if (!info.isDirectory() || info.isSymbolicLink()
-        || info.uid !== expectedUid || (info.mode & 0o077) !== 0) {
-        throw new Error(`Security Fusion evidence directory is unsafe: ${path}`);
-    }
-}
-async function quarantineEvidence(row, status, reason, actualBytes) {
-    const base = evidenceBase();
-    let storagePath = row.storagePath;
-    if (status === 'quarantined_hash_mismatch' && pathInside(base, row.storagePath)) {
-        const quarantineDir = join(base, 'quarantine');
-        await ensurePrivateEvidenceDirectory(quarantineDir);
-        const target = join(quarantineDir, `${row.id}.${basename(row.storagePath)}`);
-        await rename(row.storagePath, target);
-        storagePath = target;
-    }
-    await getDb().securityFusionEvidence.update({
-        where: { id: row.id },
-        data: {
-            byteSize: actualBytes,
-            integrityStatus: status,
-            quarantinedAt: new Date(),
-            quarantineReason: reason,
-            storagePath,
-        },
-    });
-}
-/**
- * Reconcile every retained artifact before byte admission and retention start.
- * Missing, unsafe, non-regular, and hash-mismatched evidence remains recorded
- * but is quarantined from normal evidence use.
- */
-export async function reconcileSecurityFusionEvidence() {
-    const base = evidenceBase();
-    await ensurePrivateEvidenceDirectory(base);
-    const mismatchedCases = new Set();
-    let checked = 0;
-    let updated = 0;
-    let quarantined = 0;
-    let cursor;
-    while (true) {
-        const rows = await getDb().securityFusionEvidence.findMany({
-            select: {
-                id: true,
-                caseId: true,
-                sha256: true,
-                storagePath: true,
-                byteSize: true,
-                integrityStatus: true,
-            },
-            orderBy: { id: 'asc' },
-            take: 250,
-            ...(cursor ? { cursor: { id: cursor }, skip: 1 } : {}),
-        });
-        for (const row of rows) {
-            checked += 1;
-            if (row.integrityStatus.startsWith('quarantined_')) {
-                mismatchedCases.add(row.caseId);
-                quarantined += 1;
-                continue;
-            }
-            if (!pathInside(base, row.storagePath)) {
-                mismatchedCases.add(row.caseId);
-                quarantined += 1;
-                await quarantineEvidence(row, 'quarantined_unsafe_path', 'storage path is outside the evidence root', row.byteSize);
-                continue;
-            }
-            let info;
-            try {
-                info = await lstat(row.storagePath);
-            }
-            catch (error) {
-                if (error.code !== 'ENOENT')
-                    throw error;
-                mismatchedCases.add(row.caseId);
-                quarantined += 1;
-                await quarantineEvidence(row, 'quarantined_missing', 'retained evidence file is missing', 0);
-                continue;
-            }
-            if (!info.isFile() || info.isSymbolicLink()) {
-                mismatchedCases.add(row.caseId);
-                quarantined += 1;
-                await quarantineEvidence(row, 'quarantined_unsafe_file', 'retained evidence is not a regular file', row.byteSize);
-                continue;
-            }
-            const actualBytes = info.size;
-            const actualSha256 = await hashFile(row.storagePath);
-            if (actualBytes !== row.byteSize)
-                mismatchedCases.add(row.caseId);
-            if (actualSha256 !== row.sha256) {
-                mismatchedCases.add(row.caseId);
-                quarantined += 1;
-                await quarantineEvidence(row, 'quarantined_hash_mismatch', 'retained evidence hash does not match its manifest', actualBytes);
-                continue;
-            }
-            if (actualBytes !== row.byteSize)
-                updated += 1;
-            await getDb().securityFusionEvidence.update({
-                where: { id: row.id },
-                data: {
-                    byteSize: actualBytes,
-                    integrityStatus: 'verified',
-                    quarantinedAt: null,
-                    quarantineReason: null,
-                },
-            });
-        }
-        if (rows.length < 250)
-            break;
-        cursor = rows.at(-1)?.id;
-        if (!cursor)
-            break;
-    }
-    setMetricGauge('securityFusionEvidenceReconciliationMismatchedCases', mismatchedCases.size);
-    setMetricGauge('securityFusionEvidenceQuarantinedArtifacts', quarantined);
-    return { checked, updated, quarantined, mismatchedCases: mismatchedCases.size };
-}
-//# sourceMappingURL=security-fusion-evidence-integrity.js.map

package/dist/services/security-fusion-ingest.js

@@ -1,101 +0,0 @@
-import { createHash } from 'node:crypto';
-import { securityFusionSourceSchema } from '@hivemagnus/magnus-contracts';
-import { HttpError } from '../middleware/error-handler.js';
-export const SECURITY_FUSION_MAX_BATCH_BYTES = 262_144;
-export const SECURITY_FUSION_MAX_EVENT_BYTES = 32_768;
-export const SECURITY_FUSION_MAX_EVENTS = 100;
-export const SECURITY_FUSION_MAX_NESTING_DEPTH = 8;
-function sources(value) {
-    const candidates = Array.isArray(value)
-        ? value
-        : typeof value === 'string'
-            ? value.split(',').map((item) => item.trim()).filter(Boolean)
-            : [];
-    const parsed = securityFusionSourceSchema.array().min(1).safeParse(candidates);
-    if (!parsed.success)
-        throw new Error('collector allowedSources must contain recognized Security Fusion sources');
-    return [...new Set(parsed.data)];
-}
-export function configuredCollectorCredentials(env = process.env) {
-    const credentials = new Map();
-    const encoded = env['SECURITY_FUSION_COLLECTOR_CREDENTIALS_JSON'];
-    if (encoded) {
-        const value = JSON.parse(encoded);
-        if (!value || typeof value !== 'object' || Array.isArray(value)) {
-            throw new Error('SECURITY_FUSION_COLLECTOR_CREDENTIALS_JSON must be an object');
-        }
-        for (const [collectorId, raw] of Object.entries(value)) {
-            if (!/^[a-zA-Z0-9._:-]{1,160}$/u.test(collectorId)) {
-                throw new Error('collector IDs must be 1-160 safe identifier characters');
-            }
-            const config = typeof raw === 'string' ? { secret: raw } : raw;
-            if (!config || typeof config !== 'object' || typeof config['secret'] !== 'string' || config['secret'].length < 16) {
-                throw new Error(`collector ${collectorId} must have a secret of at least 16 characters`);
-            }
-            credentials.set(collectorId, {
-                collectorId,
-                secret: config['secret'],
-                allowedSources: sources(config['allowedSources'] ?? securityFusionSourceSchema.options),
-                displayName: typeof config['displayName'] === 'string' ? config['displayName'] : collectorId,
-                schemaVersion: '1.0',
-                dataClassification: typeof config['dataClassification'] === 'string'
-                    ? config['dataClassification']
-                    : 'restricted',
-            });
-        }
-    }
-    const legacySecret = env['SECURITY_FUSION_INGEST_SECRET'];
-    if (legacySecret) {
-        const collectorId = env['SECURITY_FUSION_COLLECTOR_ID'] ?? 'magnus-security-collector';
-        if (!/^[a-zA-Z0-9._:-]{1,160}$/u.test(collectorId) || legacySecret.length < 16) {
-            throw new Error('legacy collector ID or credential is invalid');
-        }
-        if (!credentials.has(collectorId)) {
-            credentials.set(collectorId, {
-                collectorId,
-                secret: legacySecret,
-                allowedSources: sources(env['SECURITY_FUSION_COLLECTOR_ALLOWED_SOURCES'] ?? securityFusionSourceSchema.options),
-                displayName: collectorId,
-                schemaVersion: '1.0',
-                dataClassification: env['SECURITY_FUSION_DATA_CLASSIFICATION'] ?? 'restricted',
-            });
-        }
-    }
-    return credentials;
-}
-export function collectorCredentialFingerprint(secret) {
-    return createHash('sha256').update(secret).digest('hex').slice(0, 16);
-}
-function assertDepth(value, depth) {
-    if (depth > SECURITY_FUSION_MAX_NESTING_DEPTH) {
-        throw new HttpError(400, 'INGEST_NESTING_TOO_DEEP', 'Event nesting exceeds the permitted depth');
-    }
-    if (Array.isArray(value)) {
-        for (const item of value)
-            assertDepth(item, depth + 1);
-    }
-    else if (value !== null && typeof value === 'object') {
-        for (const item of Object.values(value))
-            assertDepth(item, depth + 1);
-    }
-}
-export function validateSecurityFusionBatchEnvelope(value, rawBytes) {
-    if (rawBytes > SECURITY_FUSION_MAX_BATCH_BYTES) {
-        throw new HttpError(413, 'PAYLOAD_TOO_LARGE', 'Security Fusion batch exceeds the byte limit');
-    }
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return;
-    const events = value['events'];
-    if (!Array.isArray(events))
-        return;
-    if (events.length > SECURITY_FUSION_MAX_EVENTS) {
-        throw new HttpError(400, 'INGEST_EVENT_LIMIT', `A batch may contain at most ${SECURITY_FUSION_MAX_EVENTS} events`);
-    }
-    for (const event of events) {
-        assertDepth(event, 1);
-        if (Buffer.byteLength(JSON.stringify(event), 'utf8') > SECURITY_FUSION_MAX_EVENT_BYTES) {
-            throw new HttpError(400, 'INGEST_EVENT_TOO_LARGE', 'An individual event exceeds the byte limit');
-        }
-    }
-}
-//# sourceMappingURL=security-fusion-ingest.js.map

package/dist/services/security-fusion-outbox.js

@@ -1,185 +0,0 @@
-import { getDb } from '../db/index.js';
-import { enqueueCommand } from '../queue/workers.js';
-import { securityFusionActionSources } from './security-fusion-actions.js';
-const OUTBOX_LEASE_MS = 30_000;
-const OUTBOX_INTERVAL_MS = 2_000;
-/**
- * Absolute path of an operator-installed containment helper on managed nodes
- * (`SECURITY_FUSION_CONTAINMENT_COMMAND`). Magnus does not ship one; without it
- * release records fail closed and stay visible for manual handling.
- */
-function containmentCommand() {
-    const command = process.env['SECURITY_FUSION_CONTAINMENT_COMMAND']?.trim() ?? '';
-    if (!/^\/[A-Za-z0-9._/-]{1,255}$/.test(command) || command.includes('..'))
-        throw new Error('SECURITY_FUSION_CONTAINMENT_COMMAND is not configured');
-    return command;
-}
-function containmentArgs(operation) {
-    if (operation !== 'release')
-        throw new Error('Embedded containment execute authority is retired');
-    return ['release'];
-}
-async function dispatchOutboxRecord(outboxId) {
-    const db = getDb();
-    const now = new Date();
-    const claimed = await db.securityFusionCommandOutbox.updateMany({
-        where: {
-            id: outboxId,
-            operation: 'release',
-            OR: [
-                { status: { in: ['pending', 'failed'] }, nextAttemptAt: { lte: now } },
-                { status: 'dispatching', leaseExpiresAt: { lt: now } },
-            ],
-        },
-        data: {
-            status: 'dispatching',
-            leaseExpiresAt: new Date(now.getTime() + OUTBOX_LEASE_MS),
-            attempts: { increment: 1 },
-            lastError: null,
-        },
-    });
-    if (claimed.count !== 1)
-        return false;
-    const outbox = await db.securityFusionCommandOutbox.findUnique({ where: { id: outboxId } });
-    const action = outbox
-        ? await db.securityFusionAction.findUnique({ where: { id: outbox.actionId } })
-        : null;
-    if (!outbox || !action)
-        throw new Error('Security Fusion outbox references a missing action');
-    const node = await db.node.findUnique({ where: { id: action.nodeId } });
-    if (!node)
-        throw new Error('Security Fusion containment target no longer exists');
-    const command = containmentCommand();
-    const args = containmentArgs(outbox.operation);
-    const idempotencyKey = `security-fusion:${action.id}:${node.id}:${outbox.operation}`;
-    const remote = await db.remoteCommand.upsert({
-        where: { idempotencyKey },
-        create: {
-            nodeId: node.id,
-            command,
-            args: JSON.stringify(args),
-            environment: '{}',
-            timeoutSeconds: 120,
-            status: 'QUEUED',
-            riskLevel: 'high',
-            idempotencyKey,
-            correlationId: outbox.id,
-            createdBy: outbox.actorId,
-        },
-        update: {},
-    });
-    await db.securityFusionCommandOutbox.update({
-        where: { id: outbox.id },
-        data: { remoteCommandId: remote.id },
-    });
-    await enqueueCommand(remote.id);
-    await db.$transaction([
-        db.securityFusionCommandOutbox.update({
-            where: { id: outbox.id },
-            data: {
-                status: 'dispatched',
-                leaseExpiresAt: null,
-                lastError: null,
-                dispatchedAt: new Date(),
-            },
-        }),
-        db.securityFusionAction.updateMany({
-            where: {
-                id: action.id,
-                status: {
-                    in: securityFusionActionSources('releasing'),
-                },
-            },
-            data: {
-                status: 'releasing',
-                resultJson: JSON.stringify({
-                    commandId: remote.id,
-                    outboxId: outbox.id,
-                    operation: outbox.operation,
-                }),
-            },
-        }),
-    ]);
-    return true;
-}
-export async function dispatchSecurityFusionOutbox() {
-    const db = getDb();
-    const now = new Date();
-    // Initial containment belongs exclusively to the standalone Security Fusion
-    // service. Keep only the independent emergency release path in this embedded
-    // compatibility service, and quarantine any row old code could retry.
-    await db.securityFusionCommandOutbox.updateMany({
-        where: {
-            operation: 'execute',
-            status: { in: ['pending', 'failed'] },
-        },
-        data: {
-            status: 'blocked',
-            leaseExpiresAt: null,
-            lastError: 'Embedded execute quarantined; standalone Security Fusion approval is required',
-        },
-    });
-    await db.securityFusionCommandOutbox.updateMany({
-        where: {
-            operation: 'execute',
-            status: { in: ['dispatching', 'unknown'] },
-        },
-        data: {
-            status: 'blocked',
-            leaseExpiresAt: null,
-            lastError: 'Embedded execute quarantined; execution may have occurred; do not retry',
-        },
-    });
-    const records = await db.securityFusionCommandOutbox.findMany({
-        where: {
-            operation: 'release',
-            OR: [
-                { status: { in: ['pending', 'failed'] }, nextAttemptAt: { lte: now } },
-                { status: 'dispatching', leaseExpiresAt: { lt: now } },
-            ],
-        },
-        orderBy: { createdAt: 'asc' },
-        take: 20,
-    });
-    let dispatched = 0;
-    for (const record of records) {
-        try {
-            if (await dispatchOutboxRecord(record.id))
-                dispatched += 1;
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            const retryDelay = Math.min(60_000, 1_000 * (2 ** Math.min(record.attempts, 6)));
-            await db.securityFusionCommandOutbox.updateMany({
-                where: { id: record.id, status: 'dispatching' },
-                data: {
-                    status: 'failed',
-                    leaseExpiresAt: null,
-                    lastError: message.slice(0, 1000),
-                    nextAttemptAt: new Date(Date.now() + retryDelay),
-                },
-            });
-            console.error(`[security-fusion] outbox dispatch failed for ${record.id}: ${message}`);
-        }
-    }
-    return dispatched;
-}
-let dispatcherTimer = null;
-export function startSecurityFusionOutboxDispatcher() {
-    if (dispatcherTimer)
-        return;
-    const dispatch = () => {
-        void dispatchSecurityFusionOutbox().catch((error) => {
-            console.error('[security-fusion] outbox scan failed', error instanceof Error ? error.message : String(error));
-        });
-    };
-    dispatch();
-    dispatcherTimer = setInterval(dispatch, OUTBOX_INTERVAL_MS);
-    dispatcherTimer.unref();
-}
-export function stopSecurityFusionOutboxDispatcher() {
-    if (dispatcherTimer)
-        clearInterval(dispatcherTimer);
-    dispatcherTimer = null;
-}
-//# sourceMappingURL=security-fusion-outbox.js.map

package/dist/services/security-fusion-receipt-chain.js

@@ -1,134 +0,0 @@
-import { createHmac, createHash } from 'node:crypto';
-import { appendFile, chmod, lstat, mkdir, open } from 'node:fs/promises';
-import { dirname, resolve } from 'node:path';
-import { getDb } from '../db/index.js';
-function canonicalJson(value) {
-    if (Array.isArray(value))
-        return `[${value.map(canonicalJson).join(',')}]`;
-    if (value && typeof value === 'object') {
-        return `{${Object.entries(value)
-            .sort(([a], [b]) => a.localeCompare(b))
-            .map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`).join(',')}}`;
-    }
-    return JSON.stringify(value);
-}
-export function deletionReceiptHash(input, previousReceiptSha256, chainSequence) {
-    return createHash('sha256').update(canonicalJson({
-        resourceType: input.resourceType,
-        resourceIdHash: input.resourceIdHash,
-        reason: input.reason,
-        outcome: input.outcome,
-        bytesDeleted: input.bytesDeleted,
-        detail: JSON.parse(input.detailJson),
-        deletedAt: input.deletedAt.toISOString(),
-        previousReceiptSha256,
-        chainSequence,
-        chainVersion: 2,
-    })).digest('hex');
-}
-/**
- * Append receipts while holding the singleton PostgreSQL chain-head row lock.
- * This serializes all writers across Control API processes.
- */
-export async function appendDeletionReceipts(tx, inputs) {
-    const [head] = await tx.$queryRaw `
-    SELECT "headSha256", "chainSequence"
-    FROM "security_fusion_receipt_chain_heads"
-    WHERE "id" = 'security-fusion'
-    FOR UPDATE
-  `;
-    if (!head)
-        throw new Error('Security Fusion receipt chain head is missing');
-    let previousReceiptSha256 = head.headSha256;
-    let chainSequence = head.chainSequence;
-    for (const input of inputs) {
-        chainSequence += 1;
-        const receiptSha256 = deletionReceiptHash(input, previousReceiptSha256, chainSequence);
-        await tx.securityFusionDeletionReceipt.create({
-            data: {
-                ...input,
-                receiptSha256,
-                previousReceiptSha256,
-                chainSequence,
-                chainVersion: 2,
-            },
-        });
-        previousReceiptSha256 = receiptSha256;
-    }
-    if (inputs.length > 0) {
-        await tx.securityFusionReceiptChainHead.update({
-            where: { id: 'security-fusion' },
-            data: { headSha256: previousReceiptSha256, chainSequence },
-        });
-    }
-    return { headSha256: previousReceiptSha256, chainSequence };
-}
-function chainHeadExportPath() {
-    return resolve(process.env['SECURITY_FUSION_RECEIPT_CHAIN_EXPORT']
-        ?? './state/security-fusion/receipt-chain-heads.jsonl');
-}
-/** Durably export the current chain head outside the mutable database. */
-export async function exportReceiptChainHead(head) {
-    const current = head ?? await getDb().securityFusionReceiptChainHead.findUnique({
-        where: { id: 'security-fusion' },
-        select: { headSha256: true, chainSequence: true },
-    });
-    if (!current)
-        throw new Error('Security Fusion receipt chain head is missing');
-    const path = chainHeadExportPath();
-    const directory = dirname(path);
-    await mkdir(directory, { recursive: true, mode: 0o700 });
-    const expectedUid = typeof process.geteuid === 'function' ? process.geteuid() : null;
-    const directoryInfo = await lstat(directory);
-    if (!directoryInfo.isDirectory() || directoryInfo.isSymbolicLink()
-        || (expectedUid !== null && directoryInfo.uid !== expectedUid)) {
-        throw new Error('Security Fusion receipt chain export directory is unsafe');
-    }
-    await chmod(directory, 0o700);
-    try {
-        const info = await lstat(path);
-        if (!info.isFile() || info.isSymbolicLink()
-            || (expectedUid !== null && info.uid !== expectedUid)
-            || (info.mode & 0o777) !== 0o600) {
-            throw new Error('Security Fusion receipt chain export must be a mode-0600 regular file');
-        }
-    }
-    catch (error) {
-        if (error.code !== 'ENOENT')
-            throw error;
-    }
-    const exportedAt = new Date().toISOString();
-    const signingKey = process.env['SECURITY_FUSION_RECEIPT_SIGNING_KEY'];
-    if (!signingKey || signingKey.length < 32) {
-        throw new Error('SECURITY_FUSION_RECEIPT_SIGNING_KEY must contain at least 32 characters');
-    }
-    const signedPayload = canonicalJson({
-        chain: 'security-fusion',
-        chainSequence: current.chainSequence,
-        headSha256: current.headSha256,
-        exportedAt,
-    });
-    const record = {
-        chain: 'security-fusion',
-        chainSequence: current.chainSequence,
-        headSha256: current.headSha256,
-        exportedAt,
-        signatureHmacSha256: createHmac('sha256', signingKey).update(signedPayload).digest('hex'),
-    };
-    const handle = await open(path, 'a', 0o600);
-    try {
-        await appendFile(handle, `${JSON.stringify(record)}\n`, 'utf8');
-        await handle.sync();
-    }
-    finally {
-        await handle.close();
-    }
-    const directoryHandle = await open(directory, 'r');
-    try {
-        await directoryHandle.sync();
-    }
-    finally {
-        await directoryHandle.close();
-    }
-}
-//# sourceMappingURL=security-fusion-receipt-chain.js.map