@idleware/ringi 0.5.0 → 0.6.0

package/target/esm/adapters/transport-git/remote/git.js

@@ -0,0 +1,58 @@
+// git: the isolated git invocation the signed transport uses for every read, write and signature check.
+import fs from 'node:fs';
+import path from 'node:path';
+import * as C from '../../../lib/index.js';
+import * as FS from '../../fs/index.js';
+import * as P from '../../../core/hub/protocol/index.js';
+import { withVerification } from './cache.js';
+import { BASE, command } from './process.js';
+import { ACCEPT, TRACK } from './types.js';
+export const reason = (e) => e instanceof Error ? e.message : String(e);
+export const mkdir = (d) => fs.mkdirSync(d, { recursive: true, mode: 0o700 });
+export const id = (s) => P.ID_RE.test(s) ? s : C.fail(`bad agent or hub id ${s}`);
+export const zero = (H) => '0'.repeat(git(H, ['rev-parse', '--show-object-format']).trim() === 'sha256' ? 64 : 40);
+export const ident = (who) => ({ GIT_AUTHOR_NAME: who, GIT_AUTHOR_EMAIL: `${who}@ringi`, GIT_COMMITTER_NAME: who, GIT_COMMITTER_EMAIL: `${who}@ringi` });
+export function git(H, args, opt) {
+    return command('git', ['--git-dir', H.dir, ...BASE, ...args], opt);
+}
+export const config = (H, key, value) => value === undefined
+    ? String(git(H, ['config', '--get', key], { ok: true }).stdout || '').trim()
+    : git(H, ['config', key, String(value)]);
+export const rev = (H, ref) => {
+    const r = git(H, ['rev-parse', '-q', '--verify', `${ref}^{commit}`], { ok: true });
+    return r.status === 0 ? r.stdout.trim() : null;
+};
+export const object = (H, ref) => {
+    const r = git(H, ['rev-parse', '-q', '--verify', ref], { ok: true });
+    return r.status === 0 ? r.stdout.trim() : null;
+};
+export const ancestor = (H, a, b) => !!a && !!b && git(H, ['merge-base', '--is-ancestor', a, b], { ok: true }).status === 0;
+export const isRemote = (H) => {
+    if (H.d.trust !== 'signed' && H.d.trust !== 'asserted')
+        C.fail(`unsupported hub trust ${String(H.d.trust)}`);
+    return H.d.trust === 'signed';
+};
+export const origin = (H) => H.d.store.remote;
+export const suffix = (ref) => ref.replace(/^refs\/heads\//, '');
+export const accepted = (ref) => ACCEPT + suffix(ref);
+export const tracking = (ref) => TRACK + suffix(ref);
+// Transport and home state use the same owner-aware lock.
+export const locked = (H, fn) => {
+    const file = path.join(H.dir, 'ringi', 'transport.lock');
+    mkdir(path.dirname(file));
+    return FS.locked(file, () => withVerification(H, fn));
+};
+export const refs = (H, prefix) => new Map(git(H, ['for-each-ref', '--format=%(refname) %(objectname)', prefix]).trim().split('\n').filter(Boolean).map(s => s.split(' ')));
+// The local accepted transport refs survive reader resets and retain evidence of remote rewrites/deletions.
+export const promote = (H, ref, sha) => {
+    const acc = rev(H, accepted(ref));
+    const cur = rev(H, ref);
+    if (acc && !ancestor(H, acc, sha))
+        C.fail(`${suffix(ref)} was rewritten or rolled back from ${acc.slice(0, 12)} to ${sha.slice(0, 12)}`);
+    if (cur && cur !== sha && !ancestor(H, cur, sha) && !ancestor(H, sha, cur))
+        C.fail(`${suffix(ref)} diverges from the local accepted history`);
+    if (!cur || (cur !== sha && ancestor(H, cur, sha)))
+        git(H, ['update-ref', ref, sha, cur || zero(H)]);
+    git(H, ['update-ref', accepted(ref), sha, acc || zero(H)]);
+};
+//# sourceMappingURL=git.js.map

package/target/esm/adapters/transport-git/remote/heartbeat-facts.js

@@ -0,0 +1,35 @@
+// heartbeat-facts: the text of a heartbeat object, its fields checked.
+import * as C from '../../../lib/index.js';
+import * as P from '../../../core/hub/protocol/index.js';
+import { SHA } from './types.js';
+export const heartbeatBody = (text) => {
+    if (Buffer.byteLength(text) > 16384)
+        C.fail('heartbeat body exceeds 16 KiB');
+    const decoded = P.decodeText(Buffer.from(text));
+    if (decoded.invalid)
+        C.fail(`heartbeat body is ${decoded.invalid}`);
+    const lines = decoded.text.trimEnd().split('\n');
+    const fields = heartbeatFields(lines);
+    const genesis = fields.get('Room') ?? C.fail('heartbeat must name its full room genesis');
+    if (!SHA.test(genesis))
+        C.fail('heartbeat must name its full room genesis');
+    if (!/^(working|waiting|gone)$/.test(fields.get('State') ?? ''))
+        C.fail('invalid heartbeat State');
+    if (!/^(yes|no|unknown)$/.test(fields.get('Alive') ?? ''))
+        C.fail('invalid heartbeat Alive');
+    const next = Number(fields.get('Next'));
+    if (!Number.isFinite(next) || next <= 0)
+        C.fail('heartbeat Next must be positive seconds');
+    return genesis;
+};
+const heartbeatFields = (lines) => {
+    const fields = new Map();
+    for (const line of lines) {
+        const m = /^([A-Z][A-Za-z]*): (.+)$/.exec(line) ?? C.fail('heartbeat body must contain only facts as trailers');
+        if (fields.has(m[1]))
+            C.fail(`duplicate heartbeat field ${m[1]}`);
+        fields.set(m[1], m[2]);
+    }
+    return fields;
+};
+//# sourceMappingURL=heartbeat-facts.js.map

package/target/esm/adapters/transport-git/remote/heartbeat-name.js

@@ -0,0 +1,19 @@
+// heartbeat-name: the one mutable tag name, `<actor>.heartbeat.<genesis12>`; every other tag is a signal.
+import * as C from '../../../lib/index.js';
+import { SHA, TAGS } from './types.js';
+// Heartbeats deliberately share the tag transport, but never the immutable signal acceptance.
+// Only this exact namespace is mutable; e.g. `actor.opened.heartbeat.<id>` is still a signal.
+export const HEARTBEAT_NAME = /^([a-z0-9]+(?:[_-][a-z0-9]+)*)\.heartbeat\.([0-9a-f]{12})$/;
+export const heartbeatName = (ref) => {
+    const m = ref.startsWith(TAGS) && HEARTBEAT_NAME.exec(ref.slice(TAGS.length));
+    return m ? { actor: m[1], genesis12: m[2] } : null;
+};
+export const heartbeatRef = (who, genesis) => {
+    if (!SHA.test(genesis))
+        C.fail('heartbeat requires a full room genesis');
+    const ref = `${TAGS}${who}.heartbeat.${genesis.slice(0, 12)}`;
+    if (!heartbeatName(ref))
+        C.fail('malformed heartbeat actor');
+    return ref;
+};
+//# sourceMappingURL=heartbeat-name.js.map

package/target/esm/adapters/transport-git/remote/heartbeat-object.js

@@ -0,0 +1,40 @@
+// heartbeat-object: a heartbeat tag object read and checked: its target in the room, its tagger, its signature.
+import * as C from '../../../lib/index.js';
+import * as P from '../../../core/hub/protocol/index.js';
+import { branch } from './branch.js';
+import { git, rev } from './git.js';
+import { heartbeatBody } from './heartbeat-facts.js';
+import { heartbeatName } from './heartbeat-name.js';
+import { checkSignature } from './signature.js';
+import { SHA, TAGS } from './types.js';
+export const heartbeatObject = (H, ref, sha) => {
+    const s = heartbeatName(ref) ?? C.fail('malformed heartbeat namespace');
+    if (!SHA.test(sha) || git(H, ['cat-file', '-t', sha]).trim() !== 'tag')
+        C.fail('heartbeat must be an annotated tag');
+    if (Number(git(H, ['cat-file', '-s', sha])) > 32768)
+        C.fail('heartbeat object exceeds 32 KiB');
+    const decoded = P.decodeText(git(H, ['cat-file', 'tag', sha], { raw: true }));
+    if (decoded.invalid)
+        C.fail(`heartbeat tag is ${decoded.invalid}`);
+    const [header, ...rest] = decoded.text.split('\n\n');
+    const target = /^object ([0-9a-f]+)\ntype commit\ntag ([^\n]+)\ntagger ([^<\n]+) <[^\n]*> (\d+) [+-]\d{4}\n?$/.exec(header) ?? C.fail('malformed heartbeat tag headers');
+    if (!SHA.test(target[1]) || target[2] !== ref.slice(TAGS.length) || target[3].trim() !== s.actor)
+        C.fail('heartbeat tag name or actor disagrees');
+    const text = rest.join('\n\n').split('-----BEGIN SSH SIGNATURE-----')[0];
+    const genesis = heartbeatBody(text);
+    if (!genesis.startsWith(s.genesis12))
+        C.fail('heartbeat tag name and room genesis disagree');
+    return { ...s, genesis, target: target[1], time: Number(target[4]), text };
+};
+export const checkHeartbeat = (H, R, ref, sha) => {
+    const s = heartbeatObject(H, ref, sha);
+    if (s.genesis !== R.genesis)
+        C.fail('heartbeat belongs to another room genesis');
+    const b = branch(H, R, rev(H, R.ref) ?? C.fail('heartbeat room has no branch here'));
+    // It is a replica's sync position, not a claim to author or execute the target message.
+    if (!b.control.includes(s.target) && !b.authors.has(s.target) && !b.skipped.has(s.target))
+        C.fail('heartbeat target is not on this room branch');
+    const signer = b.entries.find(e => e.principal === s.actor) ?? C.fail(`unadmitted heartbeat principal ${s.actor}`);
+    checkSignature(H, sha, s.actor, signer.key, 'tag');
+};
+//# sourceMappingURL=heartbeat-object.js.map

package/target/esm/adapters/transport-git/remote/heartbeat-push.js

@@ -0,0 +1,44 @@
+// heartbeat-push: a beat published with a lease on the object it replaces; a stale update loses.
+import * as C from '../../../lib/index.js';
+import { git, isRemote, locked, object, origin } from './git.js';
+import { checkHeartbeat, heartbeatRef } from './heartbeat.js';
+import { checkUrl } from './keys.js';
+import { SHA, TAG_ACCEPT, TAG_TRACK, TAGS } from './types.js';
+// Publish only the actor's exact heartbeat with an explicit old OID. A racing beat is ordinary contention, never a
+// signal rewrite alarm. Neither success nor failure changes immutable acceptance pins or budget/history state.
+export const pushHeartbeat = (H, R, who, sha, expected) => {
+    const ref = heartbeatRef(who, R.genesis);
+    if (!SHA.test(sha) || (expected !== null && !SHA.test(expected)))
+        C.fail('heartbeat publication requires full object ids');
+    if (!isRemote(H))
+        return true;
+    return locked(H, () => publishHeartbeat({ H, R, ref, sha, expected }));
+};
+const publishHeartbeat = ({ H, R, ref, sha, expected }) => {
+    if (object(H, ref) !== sha)
+        return false;
+    if (object(H, TAG_ACCEPT + ref.slice(TAGS.length)))
+        C.fail('heartbeat namespace overlaps previously accepted signal history');
+    checkHeartbeat(H, R, ref, sha);
+    const url = origin(H);
+    if (!url)
+        return true;
+    checkUrl(url);
+    const r = git(H, ['push', '-q', '--porcelain', `--force-with-lease=${ref}:${expected ?? ''}`, url, `${sha}:${ref}`], { ok: true });
+    if (r.status !== 0 && !reconcileHeartbeat(H, { url, ref, sha, stdout: r.stdout, stderr: r.stderr }))
+        return false;
+    git(H, ['update-ref', TAG_TRACK + ref.slice(TAGS.length), sha]);
+    if (H.heartbeatErrors)
+        delete H.heartbeatErrors[ref];
+    return true;
+};
+const reconcileHeartbeat = (H, { url, ref, sha, stdout, stderr }) => {
+    const observed = git(H, ['ls-remote', '--refs', url, ref], { ok: true });
+    const got = observed.status === 0 ? observed.stdout.trim().split(/\s+/) : [];
+    if (got[0] === sha && got[1] === ref)
+        return true;
+    if (/\[rejected\].*\(stale info\)/.test(stdout))
+        return false;
+    return C.fail(`heartbeat push failed for ${ref.slice(TAGS.length)}: ${String(stderr || stdout || 'transport error').trim().split('\n').at(-1)}`);
+};
+//# sourceMappingURL=heartbeat-push.js.map

package/target/esm/adapters/transport-git/remote/heartbeat.js

@@ -0,0 +1,44 @@
+// heartbeat: a signed heartbeat made and verified; it is published by heartbeat-push.ts.
+import * as C from '../../../lib/index.js';
+import { git, isRemote, reason } from './git.js';
+import { heartbeatBody } from './heartbeat-facts.js';
+import { heartbeatRef } from './heartbeat-name.js';
+import { checkHeartbeat } from './heartbeat-object.js';
+import { signBytes } from '../signing.js';
+import { SHA, TAGS } from './types.js';
+export { checkHeartbeat, heartbeatObject } from './heartbeat-object.js';
+export { heartbeatBody } from './heartbeat-facts.js';
+export { HEARTBEAT_NAME, heartbeatName, heartbeatRef } from './heartbeat-name.js';
+export const verifyHeartbeat = (H, R, ref, sha) => {
+    if (!isRemote(H))
+        return null;
+    if (H.remoteAlarms?.[ref])
+        return H.remoteAlarms[ref];
+    if (H.heartbeatErrors?.[ref])
+        return H.heartbeatErrors[ref];
+    try {
+        checkHeartbeat(H, R, ref, sha);
+        return null;
+    }
+    catch (e) {
+        return reason(e);
+    }
+};
+// Keep the transport's existing call contract while object construction has one named input.
+export const makeHeartbeat = (...[H, R, who, target, text, home]) => createHeartbeat({ H, R, who, target, text, home });
+const createHeartbeat = ({ H, R, who, target, text, home }) => {
+    const ref = heartbeatRef(who, R.genesis);
+    if (!SHA.test(target))
+        C.fail('heartbeat target must be a full commit id');
+    if (/^Room:/m.test(text))
+        C.fail('heartbeat Room is transport metadata');
+    const body = `Room: ${R.genesis}\n${text.trimEnd()}\n`;
+    heartbeatBody(body);
+    const raw = `object ${target}\ntype commit\ntag ${ref.slice(TAGS.length)}\ntagger ${who} <${who}@ringi> ${Math.floor(Date.now() / 1000)} +0000\n\n${body}`;
+    const signature = signBytes(H, who, raw, home);
+    const sha = git(H, ['mktag'], { input: raw + signature }).trim();
+    if (isRemote(H))
+        checkHeartbeat(H, R, ref, sha);
+    return sha;
+};
+//# sourceMappingURL=heartbeat.js.map

package/target/esm/adapters/transport-git/remote/keys.js

@@ -0,0 +1,75 @@
+// keys: public keys as given and pinned, a signed hub's root and its signers, and which key signs for a principal.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import * as C from '../../../lib/index.js';
+import { config, id, isRemote, mkdir, rev } from './git.js';
+import { command } from './process.js';
+import { ROOT } from './types.js';
+export const parseKey = (value) => {
+    const text = String(value || '').trim();
+    const m = /^(ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp(?:256|384|521)) ([A-Za-z0-9+/]+={0,2})(?: [^\r\n]*)?$/.exec(text) ?? C.fail('expected one SSH public key (or a file containing it)');
+    if (m[2].length > 16384)
+        C.fail('expected one SSH public key (or a file containing it)');
+    const data = Buffer.from(m[2], 'base64');
+    if (data.length < 8 || data.readUInt32BE(0) > data.length - 4 || data.subarray(4, 4 + data.readUInt32BE(0)).toString() !== m[1])
+        C.fail('malformed SSH public key');
+    const line = `${m[1]} ${m[2]}`;
+    return { line, fp: 'SHA256:' + crypto.createHash('sha256').update(data).digest('base64').replace(/=+$/, '') };
+};
+export const keyInput = (value) => parseKey(fs.existsSync(value) && fs.statSync(value).isFile() ? fs.readFileSync(value, 'utf8') : value);
+export const rootKey = (H) => parseKey(H.d.root || C.fail(`hub ${H.name} has no out-of-band root pin; use hub add --root <public-key|file>`));
+export const signerLine = (who, key) => `${who} namespaces="git" ${key.line}\n`;
+const keyPath = (H, who, home) => path.join(home, 'keys', id(H.name), id(who));
+const localKey = (H, who, home, create = false) => {
+    const file = keyPath(H, who, home);
+    if (!fs.existsSync(file)) {
+        if (!create)
+            C.fail(`no private key for ${who} on this machine; ${who === ROOT ? 'root keys are never obtained from a hub' : 'join here to generate one, then ask the root to admit its public key'}`);
+        mkdir(path.dirname(file));
+        command('ssh-keygen', ['-q', '-t', 'ed25519', '-N', '', '-C', `${who}@ringi`, '-f', file]);
+    }
+    // Derive from the private key instead of trusting a mutable .pub sidecar.
+    const key = parseKey(command('ssh-keygen', ['-y', '-f', file]));
+    return { ...key, file };
+};
+export const identityKey = (H, who, home, create = false) => H.signing
+    ? parseKey(H.signing.signer.publicIdentity(H.signing.resolve(id(H.name), id(who), create)).key)
+    : localKey(H, who, home, create);
+export const setupSigned = (H, home, url) => {
+    id(H.name);
+    if (rev(H, 'refs/heads/main'))
+        C.fail('setupSigned only initializes an empty hub; it cannot replace an existing trust anchor');
+    const key = identityKey(H, ROOT, home, true);
+    H.d.trust = 'signed';
+    H.d.root = key.line;
+    config(H, 'gpg.format', 'ssh');
+    config(H, 'gpg.ssh.program', 'ssh-keygen');
+    if (url) {
+        checkUrl(url);
+        H.d.store.remote = url;
+    }
+    return { root: key.line, allowedSigners: signerLine(ROOT, key) };
+};
+export const sign = (H, who, home) => {
+    if (!isRemote(H))
+        return [];
+    const key = localKey(H, who, home);
+    if (who === ROOT && key.line !== rootKey(H).line)
+        C.fail('the local operator key does not match this hub\'s pinned root');
+    config(H, 'gpg.format', 'ssh');
+    config(H, 'gpg.ssh.program', 'ssh-keygen');
+    return [`-S${key.file}`];
+};
+export const rootRoster = (H) => signerLine(ROOT, rootKey(H));
+const supportedUrl = (url) => {
+    const malformed = /[\r\n\0]/.test(url) || url.startsWith('-');
+    const cleartext = /^http:\/\//i.test(url);
+    const transport = /^(?:file|https|ssh):\/\/|^(?:[^\s/@:]+@)?[^\s/:]+:[^\s]+$|^\//.test(url);
+    return !malformed && !cleartext && transport;
+};
+export const checkUrl = (url) => {
+    if (typeof url !== 'string' || !supportedUrl(url))
+        C.fail('use a file://, https:// or ssh Git URL; cleartext HTTP and custom transport helpers are refused');
+};
+//# sourceMappingURL=keys.js.map

package/target/esm/adapters/transport-git/remote/main.js

@@ -0,0 +1,41 @@
+// main: the hub's contract branch verified: every commit signed by the root since the pinned genesis.
+import * as C from '../../../lib/index.js';
+import { memo } from './cache.js';
+import { git, isRemote, rev } from './git.js';
+import { parseKey, rootKey } from './keys.js';
+import { blobText } from './roster.js';
+import { chain, checkSignature, linear } from './signature.js';
+import { ROOT } from './types.js';
+export const verifyMain = (H, head) => memo(H, `main/${head}`, () => {
+    const key = rootKey(H);
+    const commits = chain(H, head);
+    if (!commits.length)
+        C.fail('signed hub has no genesis');
+    const pin = H.d.genesis;
+    if (!pin && !H.bootstrap)
+        C.fail(`hub ${H.name} has no pinned genesis`);
+    if (pin && commits[0].sha !== pin)
+        C.fail('hub does not descend from the pinned genesis');
+    linear(commits, null, sha => checkContract(H, sha, key));
+    if (!pin)
+        H.d.genesis = commits[0].sha;
+    H.bootstrap = false;
+    return { head, genesis: commits[0].sha, commits: commits.map(c => c.sha) };
+});
+export const verifyHub = (H) => {
+    if (!isRemote(H))
+        return null;
+    const head = rev(H, 'refs/heads/main') || C.fail('signed hub has no main');
+    return verifyMain(H, head);
+};
+const checkContract = (H, sha, key) => {
+    checkSignature(H, sha, ROOT, key);
+    const name = 'contract.json';
+    const meta = C.strictJson(blobText(H, sha, name), name);
+    if (meta.schema !== 'ringi-hub' || meta.trust !== 'signed' || parseKey(meta.root).line !== key.line)
+        C.fail(`${name} must declare signed trust and the pinned root key`);
+    const authority = git(H, ['cat-file', '-e', `${sha}:authority.json`], { ok: true });
+    if (authority.status === 0)
+        C.strictJson(blobText(H, sha, 'authority.json'), 'authority.json');
+};
+//# sourceMappingURL=main.js.map

package/target/esm/adapters/transport-git/remote/process.js

@@ -0,0 +1,37 @@
+// process: running git and ssh-keygen isolated from the user's configuration, with a timeout.
+import { spawnSync } from 'node:child_process';
+import os from 'node:os';
+import * as C from '../../../lib/index.js';
+export const ENV = { GIT_CONFIG_GLOBAL: os.devNull, GIT_CONFIG_NOSYSTEM: '1', GIT_TERMINAL_PROMPT: '0', GIT_NO_REPLACE_OBJECTS: '1', LC_ALL: 'C' };
+export const BASE = ['-c', 'core.hooksPath=' + os.devNull, '-c', 'gpg.format=ssh', '-c', 'gpg.ssh.program=ssh-keygen',
+    '-c', 'color.ui=false', '-c', 'log.showSignature=false', '-c', 'core.quotePath=false',
+    '-c', 'protocol.allow=never', '-c', 'protocol.file.allow=always', '-c', 'protocol.ssh.allow=always',
+    '-c', 'protocol.https.allow=always', '-c', 'http.followRedirects=false'];
+export const gitEnv = (extra = {}) => ({
+    ...Object.fromEntries(Object.entries(process.env).filter(([k]) => !/^(GIT_CONFIG_|GIT_DIR$|GIT_WORK_TREE$|GIT_INDEX_FILE$|GIT_OBJECT_DIRECTORY$|GIT_ALTERNATE_OBJECT_DIRECTORIES$|GIT_REPLACE_REF_BASE$)/.test(k))),
+    ...ENV, ...extra,
+});
+export const gitTimeout = () => {
+    const ms = Number(process.env.RINGI_GIT_TIMEOUT_MS ?? 30000);
+    if (!Number.isSafeInteger(ms) || ms < 1)
+        C.fail('RINGI_GIT_TIMEOUT_MS must be a positive integer (milliseconds)');
+    return ms;
+};
+export const checkGitTimeout = (error) => {
+    if (error?.code === 'ETIMEDOUT')
+        throw Object.assign(new C.Fail('git timed out; increase RINGI_GIT_TIMEOUT_MS (positive integer milliseconds)'), { code: 'ETIMEDOUT' });
+};
+export function command(cmd, args, opt = {}) {
+    const r = spawnSync(cmd, args, {
+        input: opt.input, encoding: opt.raw ? 'buffer' : 'utf8', env: gitEnv(opt.env),
+        maxBuffer: 64 * 1024 * 1024, timeout: cmd === 'git' ? gitTimeout() : 30000
+    });
+    if (cmd === 'git')
+        checkGitTimeout(r.error);
+    if (r.error && !opt.ok)
+        C.fail(`${cmd}: ${r.error.message}`);
+    if (r.status !== 0 && !opt.ok)
+        C.fail(`${cmd}: ${String(r.stderr || r.error?.message || r.signal || 'failed').trim().split('\n').at(-1)}`);
+    return opt.ok ? r : r.stdout;
+}
+//# sourceMappingURL=process.js.map

package/target/esm/adapters/transport-git/remote/push-retry.js

@@ -0,0 +1,46 @@
+// push-retry: a lost acknowledgement reconciled, or one unpublished append kept and its caller moved onto the
+// verified remote tip to make it again.
+import * as C from '../../../lib/index.js';
+import { savePushAlarms } from './alarms.js';
+import { branchData } from './branch.js';
+import { ancestor, git, promote, rev, suffix } from './git.js';
+const fetchIncoming = ({ H, ref, track, url, sha, acc }) => {
+    git(H, ['-c', 'fetch.fsckObjects=true', 'fetch', '-q', '--no-tags', url, `+${ref}:${track}`]);
+    const incoming = rev(H, track) ?? C.fail('remote room branch is missing');
+    const data = branchData(H, suffix(ref), sha);
+    branchData(H, suffix(ref), incoming, data.genesis);
+    if (acc && !ancestor(H, acc, incoming))
+        C.fail('remote room was rewritten or rolled back; retry refused');
+    return incoming;
+};
+const retryable = ({ H, sha, acc }, stdout) => {
+    const parents = git(H, ['show', '-s', '--format=%P', sha]).trim().split(' ');
+    const rejected = /\[rejected\].*\((?:fetch first|non-fast-forward)\)/.test(String(stdout));
+    return rejected && !!acc && parents.length === 1 && parents[0] === acc;
+};
+const retryRefs = ({ H, sha, ref, pin, acc, alarms }, incoming) => {
+    git(H, ['update-ref', `refs/ringi/unpublished/${sha}`, sha]);
+    git(H, ['update-ref', ref, incoming, sha]);
+    git(H, ['update-ref', pin, incoming, acc]);
+    delete alarms[ref];
+    savePushAlarms(H, alarms);
+    if (H.remoteAlarms)
+        delete H.remoteAlarms[ref];
+};
+export const recoverPublication = (p, stdout) => {
+    const incoming = fetchIncoming(p);
+    if (ancestor(p.H, p.sha, incoming)) {
+        // Acknowledgement lost after publication: the returned message id remains unchanged.
+        promote(p.H, p.ref, incoming);
+        delete p.alarms[p.ref];
+        savePushAlarms(p.H, p.alarms);
+        return true;
+    }
+    if (retryable(p, stdout)) {
+        // Only one unpublished message is re-made by its caller; retain its original object.
+        retryRefs(p, incoming);
+        return false;
+    }
+    return null;
+};
+//# sourceMappingURL=push-retry.js.map

package/target/esm/adapters/transport-git/remote/push-validate.js

@@ -0,0 +1,39 @@
+// push-validate: a ref checked before it is published: main, a room's branch, or an actor's signal on a message of a
+// verified room.
+import * as C from '../../../lib/index.js';
+import * as P from '../../../core/hub/protocol/index.js';
+import { branchData } from './branch.js';
+import { ancestor, refs } from './git.js';
+import { verifyMain } from './main.js';
+import { checkSignal, signalObject } from './signals.js';
+import { TAGS } from './types.js';
+export const validateRef = (H, ref, sha) => {
+    if (ref.startsWith(TAGS)) {
+        return validateSignalRef(H, ref, sha);
+    }
+    if (ref === 'refs/heads/main') {
+        verifyMain(H, sha);
+        return;
+    }
+    const room = /^refs\/heads\/([^/]+)$/.exec(ref) ?? C.fail('only explicit main, room or signal refs may be pushed');
+    if (!P.ID_RE.test(room[1]))
+        C.fail('only explicit main, room or signal refs may be pushed');
+    const why = branchData(H, room[1], sha).skipped.get(sha);
+    if (why)
+        C.fail(`${sha.slice(0, 12)} is no valid commit of room ${room[1]}: ${why}`);
+};
+const validateSignalRef = (H, ref, sha) => {
+    const s = signalObject(H, ref, sha);
+    for (const [branchRef, head] of refs(H, 'refs/heads/')) {
+        const name = branchRef.slice('refs/heads/'.length);
+        if (name === 'main' || name.includes('/') || !ancestor(H, s.message, head))
+            continue;
+        const b = branchData(H, name, head);
+        if (b.control.includes(s.message) || b.authors.has(s.message) || b.skipped.has(s.message)) {
+            checkSignal(H, { name, ref: branchRef, head: b.control.at(-1), genesis: b.genesis }, ref, sha);
+            return;
+        }
+    }
+    return C.fail('signal points at no verified room');
+};
+//# sourceMappingURL=push-validate.js.map

package/target/esm/adapters/transport-git/remote/push.js

@@ -0,0 +1,62 @@
+// Publish one immutable ref. Room append retries preserve already returned message ids.
+import * as C from '../../../lib/index.js';
+import { pushAlarms, savePushAlarms } from './alarms.js';
+import { accepted, ancestor, git, isRemote, locked, object, origin, rev, suffix, tracking, zero } from './git.js';
+import { heartbeatName } from './heartbeat.js';
+import { checkUrl } from './keys.js';
+import { recoverPublication } from './push-retry.js';
+import { validateRef } from './push-validate.js';
+import { TAGS, TAG_ACCEPT, TAG_TRACK } from './types.js';
+export { validateRef } from './push-validate.js';
+const preparePublication = (H, ref) => {
+    const alarms = pushAlarms(H), tag = ref.startsWith(TAGS);
+    const pin = tag ? TAG_ACCEPT + ref.slice(TAGS.length) : accepted(ref);
+    const track = tag ? TAG_TRACK + ref.slice(TAGS.length) : tracking(ref);
+    const sha = (tag ? object(H, ref) : rev(H, ref)) || C.fail(`no ${ref} to publish`);
+    validateRef(H, ref, sha);
+    return { H, ref, alarms, tag, pin, track, sha };
+};
+const rejectPublication = (p, behind, stdout) => {
+    let why = '';
+    if (behind && !p.tag && p.ref !== 'refs/heads/main') {
+        try {
+            const recovered = recoverPublication(p, stdout);
+            if (recovered !== null)
+                return recovered;
+        }
+        catch (e) {
+            why = `; ${e instanceof Error ? e.message : String(e)}`;
+        }
+    }
+    p.alarms[p.ref] = `push rejected for ${suffix(p.ref)}; local commit ${p.sha.slice(0, 12)} retained; resolve the remote conflict before continuing${why}`;
+    savePushAlarms(p.H, p.alarms);
+    return C.fail(`ALARM ${p.alarms[p.ref]}`);
+};
+const pushUnlocked = (H, ref, behind) => {
+    const prepared = preparePublication(H, ref);
+    const url = origin(H);
+    if (!url)
+        return true;
+    checkUrl(url);
+    const { tag, pin, sha, track, alarms } = prepared;
+    const acc = tag ? object(H, pin) : rev(H, pin);
+    if (acc && (tag ? acc !== sha : !ancestor(H, acc, sha)))
+        C.fail('ref to publish does not extend its accepted transport history');
+    const p = { ...prepared, acc, url };
+    const r = git(H, ['push', '-q', '--porcelain', url, `${sha}:${ref}`], { ok: true });
+    if (r.status !== 0)
+        return rejectPublication(p, behind, r.stdout);
+    delete alarms[ref];
+    savePushAlarms(H, alarms);
+    git(H, ['update-ref', pin, sha, acc || zero(H)]);
+    git(H, ['update-ref', track, sha]);
+    return true;
+};
+export const push = (H, ref, { behind = false } = {}) => {
+    if (heartbeatName(ref))
+        C.fail('heartbeat publication requires its actor and expected object id (pushHeartbeat)');
+    if (!isRemote(H))
+        return true;
+    return locked(H, () => pushUnlocked(H, ref, behind));
+};
+//# sourceMappingURL=push.js.map

package/target/esm/adapters/transport-git/remote/roster.js

@@ -0,0 +1,48 @@
+// roster: who may sign a room's logs at a control record: its signers file and members, checked against each other.
+import * as C from '../../../lib/index.js';
+import * as P from '../../../core/hub/protocol/index.js';
+import { git } from './git.js';
+import { parseKey, rootKey } from './keys.js';
+import { ROOT } from './types.js';
+export const blobText = (H, sha, name) => {
+    const entry = git(H, ['ls-tree', sha, '--', name]).trim();
+    if (!/^100(?:644|755) blob [0-9a-f]+\t/.test(entry))
+        C.fail(`${name} at ${sha.slice(0, 12)} must be a regular blob`);
+    const raw = git(H, ['cat-file', 'blob', `${sha}:${name}`], { raw: true });
+    const d = P.decodeText(raw);
+    if (d.invalid)
+        C.fail(`${name} at ${sha.slice(0, 12)} is ${d.invalid}`);
+    return d.text;
+};
+export const rosterAt = (H, sha) => {
+    const entries = blobText(H, sha, 'allowed_signers').split('\n').map(s => s.trim()).filter(s => s && !s.startsWith('#')).map(line => {
+        const m = /^(\S+) namespaces="git" (.+)$/.exec(line) ?? C.fail('malformed allowed_signers; only literal principals and git namespace are supported');
+        if (!P.ID_RE.test(m[1]))
+            C.fail('malformed allowed_signers; only literal principals and git namespace are supported');
+        return { principal: m[1], key: parseKey(m[2]) };
+    });
+    const principals = uniqueRoster(entries);
+    const members = checkedMembers(H, sha, entries, principals);
+    return { entries, members };
+};
+const uniqueRoster = (entries) => {
+    const keys = new Set(), principals = new Set();
+    for (const e of entries) {
+        if (keys.has(e.key.fp) || principals.has(e.principal))
+            C.fail('duplicate key or principal in allowed_signers; rotation requires an explicit revocation protocol');
+        keys.add(e.key.fp);
+        principals.add(e.principal);
+    }
+    return principals;
+};
+const checkedMembers = (H, sha, entries, principals) => {
+    const members = C.strictJson(blobText(H, sha, 'members.json'), 'members.json');
+    if (!members || typeof members !== 'object' || Array.isArray(members))
+        C.fail('members.json must be an object');
+    if (entries.find(e => e.principal === ROOT)?.key.line !== rootKey(H).line || members[ROOT]?.role !== 'root')
+        C.fail('room roster must retain the pinned operator as root');
+    if (Object.keys(members).some(who => !P.ID_RE.test(who) || !principals.has(who) || (who !== ROOT && members[who]?.role === 'root')) || entries.some(e => !members[e.principal]))
+        C.fail('members.json and allowed_signers disagree');
+    return members;
+};
+//# sourceMappingURL=roster.js.map