@knpkv/control-center 0.1.0

package/dist/server/server/cli.js

@@ -0,0 +1,669 @@
+#!/usr/bin/env node
+import { Fr as PersonId, Kr as WorkspaceId } from "../assets/domainEvent-x7yeq-gU.js";
+import { R as AgentProvider } from "../assets/controlCenterApi-tZPvRPRH.js";
+import { Dn as WorkspaceName, Fn as validateExistingControlCenterDatabase, Gn as PersistenceConfigError, Un as DatabaseInitializationError } from "../assets/portfolioInvalidation-Ds9Xm4_P.js";
+import { An as publishFreshDataRootClaim, Cn as DATA_ROOT_PENDING_MARKER_PREFIX, Dn as decodeOperationalDataPaths, En as decodeControlCenterDataPaths, Hn as TerminalRecovery, On as inspectFreshDataRootClaim, Sn as DATA_ROOT_MARKER_V2_PREFIX, Tn as boundDataRootMarkerContent, Un as terminalRecoveryLayer, a as decodeBindConfig, bn as DATA_ROOT_MARKER_NAME, c as makeControlCenterServer, en as ServerLifecycle, jn as syncDataRootPath, kn as publishDataRootMarker, ln as restoreBackup, nn as ControlCenterBootstrap, sn as createOfflineVerifiedBackup, un as verifyBackup } from "../assets/BindConfig-BjK10BEb.js";
+import * as Schema from "effect/Schema";
+import * as Effect from "effect/Effect";
+import * as Result from "effect/Result";
+import * as Context from "effect/Context";
+import * as Encoding from "effect/Encoding";
+import { NodeRuntime, NodeServices } from "@effect/platform-node";
+import * as Cause from "effect/Cause";
+import * as Config from "effect/Config";
+import * as Exit from "effect/Exit";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Path from "effect/Path";
+import * as Predicate from "effect/Predicate";
+import * as Redacted from "effect/Redacted";
+import * as Scope from "effect/Scope";
+import * as Stdio from "effect/Stdio";
+import * as Stream from "effect/Stream";
+import * as Crypto from "effect/Crypto";
+import * as FileSystem from "effect/FileSystem";
+import * as ConfigProvider from "effect/ConfigProvider";
+import { FetchHttpClient } from "effect/unstable/http";
+import { OtlpLogger, OtlpSerialization, OtlpTracer } from "effect/unstable/observability";
+//#region src/server/cliArguments.ts
+/** Classify the exact supported CLI argument shapes without accepting trailing arguments. */
+var classifyControlCenterCliArguments = (arguments_) => {
+	if (arguments_.length === 0) return { _tag: "serve" };
+	if (arguments_.length === 1 && arguments_[0] === "recover-owner") return { _tag: "recover-owner" };
+	const archiveRoot = arguments_[1];
+	if (arguments_.length === 2 && archiveRoot !== void 0 && archiveRoot !== "") {
+		if (arguments_[0] === "backup") return {
+			_tag: "backup",
+			archiveRoot
+		};
+		if (arguments_[0] === "verify-backup") return {
+			_tag: "verify-backup",
+			archiveRoot
+		};
+		if (arguments_[0] === "restore") return {
+			_tag: "restore",
+			archiveRoot
+		};
+	}
+	return {
+		_tag: "invalid",
+		command: arguments_.join(" ")
+	};
+};
+//#endregion
+//#region src/server/cliConfiguration.ts
+var DATA_ROOT_OWNER_PROBE_PREFIX = ".control-center-owner-";
+var SQLITE_HEADER = Uint8Array.from([
+	83,
+	81,
+	76,
+	105,
+	116,
+	101,
+	32,
+	102,
+	111,
+	114,
+	109,
+	97,
+	116,
+	32,
+	51,
+	0
+]);
+var hasNoControlCharacters = (value) => Array.from(value).every((character) => {
+	const codePoint = character.codePointAt(0);
+	return codePoint !== void 0 && !(codePoint >= 0 && codePoint <= 31 || codePoint >= 127 && codePoint <= 159);
+});
+var hasRandomHexSuffix = (entry, prefix) => {
+	if (!entry.startsWith(prefix)) return false;
+	const suffix = entry.slice(prefix.length);
+	return suffix.length === 32 && Array.from(suffix).every((character) => /[0-9a-f]/u.test(character));
+};
+var configurationError = () => new PersistenceConfigError({ message: "Control Center data root must identify a private, dedicated application directory" });
+var mapConfigurationError = (effect) => effect.pipe(Effect.mapError(configurationError));
+var sameOwner = (left, right) => Option.isSome(left.uid) && Option.isSome(right.uid) && left.uid.value === right.uid.value;
+var sameIdentity = (left, right) => left.dev === right.dev && Option.isSome(left.ino) && Option.isSome(right.ino) && left.ino.value === right.ino.value && sameOwner(left, right);
+var decodeMarkerBasename = (path, encodedBasename) => {
+	const decodedBasename = Encoding.decodeBase64UrlString(encodedBasename);
+	if (Result.isFailure(decodedBasename) || decodedBasename.success.length === 0 || decodedBasename.success.length > 4096 || !hasNoControlCharacters(decodedBasename.success) || decodedBasename.success === "." || decodedBasename.success === ".." || path.basename(decodedBasename.success) !== decodedBasename.success || Encoding.encodeBase64Url(decodedBasename.success) !== encodedBasename) return Result.fail(configurationError());
+	return Result.succeed(decodedBasename.success);
+};
+var decodeDataRootMarker = (path, content) => {
+	if (content === "@knpkv/control-center:data-root:v1\n") return Result.succeed({ _tag: "Legacy" });
+	if (!content.startsWith("@knpkv/control-center:data-root:v2\nclaim-basename:") || !content.endsWith("\n")) return Result.fail(configurationError());
+	const encodedFields = content.slice(DATA_ROOT_MARKER_V2_PREFIX.length, -1).split("\ntarget-basename:");
+	if (encodedFields.length !== 2) return Result.fail(configurationError());
+	const encodedClaim = encodedFields[0];
+	const encodedTarget = encodedFields[1];
+	if (encodedClaim === void 0 || encodedTarget === void 0) return Result.fail(configurationError());
+	const claimBasename = decodeMarkerBasename(path, encodedClaim);
+	if (Result.isFailure(claimBasename)) return Result.fail(claimBasename.failure);
+	if (claimBasename.success.startsWith(".control-center-incoming-")) return Result.fail(configurationError());
+	const targetBasename = decodeMarkerBasename(path, encodedTarget);
+	if (Result.isFailure(targetBasename)) return Result.fail(targetBasename.failure);
+	return Result.succeed({
+		_tag: "Bound",
+		claimBasename: claimBasename.success,
+		targetBasename: targetBasename.success
+	});
+};
+var validatePrivateDirectory = Effect.fn("ControlCenterCli.validatePrivateDirectory")(function* (fileSystem, dataRoot) {
+	const canonicalRoot = yield* mapConfigurationError(fileSystem.realPath(dataRoot));
+	const info = yield* mapConfigurationError(fileSystem.stat(dataRoot));
+	if (canonicalRoot !== dataRoot || info.type !== "Directory" || (info.mode & 511) !== 448 || Option.isNone(info.uid) || Option.isNone(info.ino)) return yield* configurationError();
+	return info;
+});
+var validateMarker = Effect.fn("ControlCenterCli.validateDataRootMarker")(function* (fileSystem, path, markerPath, rootInfo) {
+	const canonicalMarker = yield* mapConfigurationError(fileSystem.realPath(markerPath));
+	const markerInfo = yield* mapConfigurationError(fileSystem.stat(markerPath));
+	if (canonicalMarker !== markerPath || markerInfo.type !== "File" || (markerInfo.mode & 511) !== 384 || !sameOwner(rootInfo, markerInfo) || Number(markerInfo.size) > 8192) return yield* configurationError();
+	const content = yield* mapConfigurationError(fileSystem.readFileString(markerPath));
+	return yield* Effect.fromResult(decodeDataRootMarker(path, content));
+});
+var validateMarkerForClaim = Effect.fn("ControlCenterCli.validateDataRootMarkerForClaim")(function* (fileSystem, path, markerPath, rootInfo, claimBasename, targetBasename) {
+	const marker = yield* validateMarker(fileSystem, path, markerPath, rootInfo);
+	if (marker._tag === "Bound" && (marker.claimBasename !== claimBasename || marker.targetBasename !== targetBasename)) return yield* configurationError();
+	return marker;
+});
+var validateLegacyDataRoot = Effect.fn("ControlCenterCli.validateLegacyDataRoot")(function* (request) {
+	const { dataPaths, fileSystem, path, rootInfo } = request;
+	const databasePath = path.join(dataPaths.dataRoot, "control-center.db");
+	const canonicalDatabase = yield* mapConfigurationError(fileSystem.realPath(databasePath));
+	const databaseInfo = yield* mapConfigurationError(fileSystem.stat(databasePath));
+	if (canonicalDatabase !== databasePath || databaseInfo.type !== "File" || !sameOwner(rootInfo, databaseInfo) || Number(databaseInfo.size) < SQLITE_HEADER.length) return yield* configurationError();
+	const header = yield* Effect.scoped(mapConfigurationError(fileSystem.open(databasePath, { flag: "r" })).pipe(Effect.flatMap((file) => mapConfigurationError(file.readAlloc(SQLITE_HEADER.length)))));
+	if (Option.isNone(header) || header.value.length !== SQLITE_HEADER.length || !SQLITE_HEADER.every((byte, index) => header.value[index] === byte)) return yield* configurationError();
+	yield* Effect.scoped(Effect.gen(function* () {
+		const snapshotRoot = yield* mapConfigurationError(fileSystem.makeTempDirectoryScoped({ prefix: "control-center-legacy-snapshot-" }));
+		const snapshotDatabase = path.join(snapshotRoot, "control-center.db");
+		yield* mapConfigurationError(fileSystem.copyFile(databasePath, snapshotDatabase));
+		for (const suffix of ["-wal", "-journal"]) {
+			const sidecar = `${databasePath}${suffix}`;
+			if (!(yield* mapConfigurationError(fileSystem.exists(sidecar)))) continue;
+			const canonicalSidecar = yield* mapConfigurationError(fileSystem.realPath(sidecar));
+			const sidecarInfo = yield* mapConfigurationError(fileSystem.stat(sidecar));
+			if (canonicalSidecar !== sidecar || sidecarInfo.type !== "File" || !sameOwner(rootInfo, sidecarInfo)) return yield* configurationError();
+			yield* mapConfigurationError(fileSystem.copyFile(sidecar, `${snapshotDatabase}${suffix}`));
+		}
+		yield* validateExistingControlCenterDatabase({
+			blobRoot: path.join(snapshotRoot, "blobs"),
+			busyTimeoutMilliseconds: dataPaths.persistenceConfig.busyTimeoutMilliseconds,
+			databaseUrl: `file:${snapshotDatabase}`,
+			maxConnections: dataPaths.persistenceConfig.maxConnections
+		}).pipe(Effect.mapError(configurationError));
+	}));
+});
+var syncPath = Effect.fn("ControlCenterCli.syncDataRootPath")(function* (_fileSystem, target) {
+	yield* syncDataRootPath(target);
+});
+var publishMarker = Effect.fn("ControlCenterCli.publishDataRootMarker")(function* (request) {
+	yield* publishDataRootMarker(request.dataRoot, request.claimBasename, request.targetBasename);
+});
+var removeValidPendingMarkers = Effect.fn("ControlCenterCli.removeValidPendingMarkers")(function* (request, claimBasename, targetBasename) {
+	const { dataRoot, fileSystem, path, rootInfo } = request;
+	const pendingNames = (yield* mapConfigurationError(fileSystem.readDirectory(dataRoot))).filter((entry) => hasRandomHexSuffix(entry, DATA_ROOT_PENDING_MARKER_PREFIX));
+	const validPendingPaths = [];
+	for (const pendingName of pendingNames) {
+		const pendingPath = path.join(dataRoot, pendingName);
+		const canonicalPending = yield* mapConfigurationError(fileSystem.realPath(pendingPath));
+		const pendingInfo = yield* mapConfigurationError(fileSystem.stat(pendingPath));
+		if (canonicalPending !== pendingPath || pendingInfo.type !== "File" || (pendingInfo.mode & 511) !== 384 || !sameOwner(rootInfo, pendingInfo) || Number(pendingInfo.size) > boundDataRootMarkerContent(claimBasename, targetBasename).length) return yield* configurationError();
+		const content = yield* mapConfigurationError(fileSystem.readFileString(pendingPath));
+		if (!"@knpkv/control-center:data-root:v1\n".startsWith(content) && !boundDataRootMarkerContent(claimBasename, targetBasename).startsWith(content)) return yield* configurationError();
+		validPendingPaths.push(pendingPath);
+	}
+	for (const pendingPath of validPendingPaths) {
+		const removed = yield* fileSystem.remove(pendingPath).pipe(Effect.result);
+		if (Result.isFailure(removed) && removed.failure.reason._tag !== "NotFound") return yield* configurationError();
+	}
+	if (pendingNames.length > 0) yield* syncPath(fileSystem, dataRoot);
+});
+var verifyProcessOwnership = Effect.fn("ControlCenterCli.verifyProcessOwnership")(function* (request) {
+	const { cryptoService, dataRoot, fileSystem, initialRootInfo, path } = request;
+	const isExpectedRoot = (info) => info.type === "Directory" && (info.mode & 511) === 448 && sameIdentity(initialRootInfo, info);
+	yield* Effect.scoped(Effect.uninterruptible(Effect.gen(function* () {
+		const directory = yield* mapConfigurationError(fileSystem.open(dataRoot, { flag: "r" }));
+		const directoryInfo = yield* mapConfigurationError(directory.stat);
+		if (!isExpectedRoot(directoryInfo)) return yield* configurationError();
+		const assertIdentity = Effect.gen(function* () {
+			const current = yield* directory.stat.pipe(Effect.result);
+			const named = yield* fileSystem.stat(dataRoot).pipe(Effect.result);
+			const resolved = yield* fileSystem.realPath(dataRoot).pipe(Effect.result);
+			if (Result.isFailure(current) || Result.isFailure(named) || Result.isFailure(resolved) || resolved.success !== dataRoot || !isExpectedRoot(current.success) || !sameIdentity(current.success, named.success)) return yield* configurationError();
+		});
+		yield* assertIdentity;
+		const random = yield* mapConfigurationError(cryptoService.randomBytes(16));
+		const probePath = path.join(dataRoot, `${DATA_ROOT_OWNER_PROBE_PREFIX}${Encoding.encodeHex(random)}`);
+		const probe = yield* mapConfigurationError(fileSystem.open(probePath, {
+			flag: "wx",
+			mode: 384
+		}));
+		yield* Effect.addFinalizer(() => fileSystem.remove(probePath, { force: true }).pipe(Effect.andThen(directory.sync), Effect.ignore));
+		yield* mapConfigurationError(fileSystem.chmod(probePath, 384));
+		const probeInfo = yield* mapConfigurationError(probe.stat);
+		if (probeInfo.type !== "File" || (probeInfo.mode & 511) !== 384 || !sameOwner(directoryInfo, probeInfo)) return yield* configurationError();
+		yield* assertIdentity;
+		yield* mapConfigurationError(fileSystem.remove(probePath));
+		yield* mapConfigurationError(directory.sync);
+		yield* assertIdentity;
+	})));
+});
+var resolveStagingRoot = (path, parent, target) => {
+	const name = path.basename(target);
+	return !path.isAbsolute(target) && target === name && name.startsWith(".control-center-incoming-") ? Option.some(path.join(parent, name)) : Option.none();
+};
+var isBase64UrlPrefix = (value) => Array.from(value).every((character) => /[0-9A-Za-z_-]/u.test(character));
+var isPotentialBoundMarkerPrefix = (path, content) => {
+	if ("@knpkv/control-center:data-root:v2\nclaim-basename:".startsWith(content)) return true;
+	if (!content.startsWith("@knpkv/control-center:data-root:v2\nclaim-basename:")) return false;
+	const remaining = content.slice(DATA_ROOT_MARKER_V2_PREFIX.length);
+	const claimTerminator = remaining.indexOf("\n");
+	if (claimTerminator === -1) return isBase64UrlPrefix(remaining);
+	if (!isBase64UrlPrefix(remaining.slice(0, claimTerminator))) return false;
+	const targetLabel = "target-basename:";
+	const targetField = remaining.slice(claimTerminator + 1);
+	if (targetLabel.startsWith(targetField)) return true;
+	if (!targetField.startsWith(targetLabel)) return false;
+	const encodedTargetWithTerminator = targetField.slice(16);
+	if (!encodedTargetWithTerminator.endsWith("\n")) return isBase64UrlPrefix(encodedTargetWithTerminator);
+	return Result.isSuccess(decodeDataRootMarker(path, content));
+};
+var isPotentialMarkerPrefix = (path, content) => "@knpkv/control-center:data-root:v1\n".startsWith(content) || isPotentialBoundMarkerPrefix(path, content);
+var validateProtocolArtifact = Effect.fn("ControlCenterCli.validateDataRootProtocolArtifact")(function* (fileSystem, path, stagingRoot, rootInfo, entry) {
+	const isFinalMarker = entry === DATA_ROOT_MARKER_NAME;
+	const isOwnerProbe = hasRandomHexSuffix(entry, DATA_ROOT_OWNER_PROBE_PREFIX);
+	const isPendingMarker = hasRandomHexSuffix(entry, DATA_ROOT_PENDING_MARKER_PREFIX);
+	if (!isFinalMarker && !isOwnerProbe && !isPendingMarker) return false;
+	const artifactPath = path.join(stagingRoot, entry);
+	const canonicalArtifact = yield* mapConfigurationError(fileSystem.realPath(artifactPath));
+	const artifactInfo = yield* mapConfigurationError(fileSystem.stat(artifactPath));
+	if (canonicalArtifact !== artifactPath || artifactInfo.type !== "File" || (artifactInfo.mode & 511) !== 384 || !sameOwner(rootInfo, artifactInfo)) return yield* configurationError();
+	if (isFinalMarker) {
+		if (Number(artifactInfo.size) > 8192) return yield* configurationError();
+		const marker = decodeDataRootMarker(path, yield* mapConfigurationError(fileSystem.readFileString(artifactPath)));
+		if (Result.isFailure(marker) || marker.success._tag === "Bound" && marker.success.targetBasename !== path.basename(stagingRoot)) return yield* configurationError();
+		return true;
+	}
+	if (isOwnerProbe) {
+		if (Number(artifactInfo.size) !== 0) return yield* configurationError();
+		return true;
+	}
+	if (Number(artifactInfo.size) > 8192) return yield* configurationError();
+	const content = yield* mapConfigurationError(fileSystem.readFileString(artifactPath));
+	const completeMarker = decodeDataRootMarker(path, content);
+	if (Result.isSuccess(completeMarker) && completeMarker.success._tag === "Bound" && completeMarker.success.targetBasename !== path.basename(stagingRoot)) return yield* configurationError();
+	if (!isPotentialMarkerPrefix(path, content)) return yield* configurationError();
+	return true;
+});
+var inspectLostDataRootClaims = Effect.fn("ControlCenterCli.inspectLostDataRootClaims")(function* (request) {
+	const { fileSystem, parent, path, requestedClaimBasename } = request;
+	const entries = yield* mapConfigurationError(fileSystem.readDirectory(parent));
+	for (const entry of entries) {
+		if (!entry.startsWith(".control-center-incoming-") || path.basename(entry) !== entry) continue;
+		const stagingRoot = path.join(parent, entry);
+		const rootInfo = yield* validatePrivateDirectory(fileSystem, stagingRoot);
+		const stagingEntries = yield* mapConfigurationError(fileSystem.readDirectory(stagingRoot));
+		let hasDurableEntry = false;
+		for (const name of stagingEntries) if (!(yield* validateProtocolArtifact(fileSystem, path, stagingRoot, rootInfo, name))) hasDurableEntry = true;
+		if (!hasDurableEntry) continue;
+		const marker = yield* validateMarker(fileSystem, path, path.join(stagingRoot, DATA_ROOT_MARKER_NAME), rootInfo);
+		if (marker._tag === "Legacy") return yield* configurationError();
+		if (marker.targetBasename !== entry) return yield* configurationError();
+		if (marker.claimBasename !== requestedClaimBasename) continue;
+		const boundClaim = path.join(parent, marker.claimBasename);
+		const claimedTarget = yield* fileSystem.readLink(boundClaim).pipe(Effect.result);
+		if (Result.isFailure(claimedTarget) || claimedTarget.success !== entry) return yield* configurationError();
+	}
+});
+var refuseLostDataRootClaim = Effect.fn("ControlCenterCli.refuseLostDataRootClaim")(function* (request) {
+	for (let attempt = 0; attempt < 3; attempt += 1) {
+		const inspected = yield* inspectLostDataRootClaims(request).pipe(Effect.result);
+		if (Result.isSuccess(inspected)) return;
+		if (attempt === 2) return yield* Effect.fail(inspected.failure);
+		yield* Effect.yieldNow;
+	}
+});
+var resolveClaimedDataRoot = Effect.fn("ControlCenterCli.resolveClaimedDataRoot")(function* (request) {
+	const { cryptoService, dataRoot, fileSystem, parent, path } = request;
+	if ((yield* mapConfigurationError(fileSystem.realPath(dataRoot))) === dataRoot) return dataRoot;
+	const stagingRoot = resolveStagingRoot(path, parent, yield* mapConfigurationError(fileSystem.readLink(dataRoot)));
+	if (Option.isNone(stagingRoot)) return yield* configurationError();
+	const stagingInfo = yield* validatePrivateDirectory(fileSystem, stagingRoot.value);
+	if ((yield* validateMarkerForClaim(fileSystem, path, path.join(stagingRoot.value, ".control-center-root"), stagingInfo, path.basename(dataRoot), path.basename(stagingRoot.value)))._tag === "Legacy") return yield* configurationError();
+	yield* verifyProcessOwnership({
+		cryptoService,
+		dataRoot: stagingRoot.value,
+		fileSystem,
+		initialRootInfo: stagingInfo,
+		path
+	});
+	return stagingRoot.value;
+});
+var publishFreshDataRoot = Effect.fn("ControlCenterCli.publishFreshDataRoot")(function* (request) {
+	yield* publishFreshDataRootClaim(yield* inspectFreshDataRootClaim(request.dataRoot).pipe(Effect.mapError(configurationError)), false, () => Effect.void).pipe(Effect.mapError((error) => Predicate.isTagged(error, "FreshDataRootClaimConflict") || Predicate.isTagged(error, "DataRootProtocolError") ? configurationError() : error));
+});
+Effect.fn("claimFreshControlCenterDataRoot")(function* (dataPaths, initialize) {
+	const fileSystem = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const parent = path.dirname(dataPaths.dataRoot);
+	const claimBasename = path.basename(dataPaths.dataRoot);
+	if (claimBasename.startsWith(".control-center-incoming-")) return yield* configurationError();
+	if (yield* mapConfigurationError(fileSystem.exists(dataPaths.dataRoot))) return yield* configurationError();
+	yield* mapConfigurationError(fileSystem.makeDirectory(parent, { recursive: true }));
+	yield* refuseLostDataRootClaim({
+		fileSystem,
+		parent,
+		path,
+		requestedClaimBasename: claimBasename
+	});
+	return yield* publishFreshDataRootClaim(yield* inspectFreshDataRootClaim(dataPaths.dataRoot).pipe(Effect.mapError(configurationError)), true, initialize).pipe(Effect.mapError((error) => Predicate.isTagged(error, "DataRootProtocolError") ? configurationError() : error));
+});
+/** Resolve an already-prepared data root without creating, repairing, cleaning, or migrating it. */
+var resolvePreparedControlCenterDataRoot = Effect.fn("resolvePreparedControlCenterDataRoot")(function* (dataPaths) {
+	const fileSystem = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const parent = path.dirname(dataPaths.dataRoot);
+	const claimBasename = path.basename(dataPaths.dataRoot);
+	if (claimBasename.startsWith(".control-center-incoming-")) return yield* configurationError();
+	if (!(yield* mapConfigurationError(fileSystem.exists(dataPaths.dataRoot)))) return yield* configurationError();
+	const canonicalRoot = yield* mapConfigurationError(fileSystem.realPath(dataPaths.dataRoot));
+	let operationalPaths = dataPaths;
+	if (canonicalRoot !== dataPaths.dataRoot) {
+		const stagingRoot = resolveStagingRoot(path, parent, yield* mapConfigurationError(fileSystem.readLink(dataPaths.dataRoot)));
+		if (Option.isNone(stagingRoot) || stagingRoot.value !== canonicalRoot) return yield* configurationError();
+		operationalPaths = yield* decodeOperationalDataPaths(stagingRoot.value);
+	}
+	const rootInfo = yield* validatePrivateDirectory(fileSystem, operationalPaths.dataRoot);
+	const markerPath = path.join(operationalPaths.dataRoot, DATA_ROOT_MARKER_NAME);
+	if (!(yield* mapConfigurationError(fileSystem.exists(markerPath)))) return yield* configurationError();
+	if ((yield* validateMarkerForClaim(fileSystem, path, markerPath, rootInfo, claimBasename, path.basename(operationalPaths.dataRoot)))._tag !== "Bound") return yield* configurationError();
+	return operationalPaths;
+});
+/** Create or verify a dedicated data root and return its canonical operational paths. */
+var prepareControlCenterDataRoot = Effect.fn("prepareControlCenterDataRoot")(function* (dataPaths) {
+	const cryptoService = yield* Crypto.Crypto;
+	const fileSystem = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const parent = path.dirname(dataPaths.dataRoot);
+	const claimBasename = path.basename(dataPaths.dataRoot);
+	if (claimBasename.startsWith(".control-center-incoming-")) return yield* configurationError();
+	if (!(yield* mapConfigurationError(fileSystem.exists(dataPaths.dataRoot)))) {
+		yield* mapConfigurationError(fileSystem.makeDirectory(parent, { recursive: true }));
+		yield* refuseLostDataRootClaim({
+			fileSystem,
+			parent,
+			path,
+			requestedClaimBasename: claimBasename
+		});
+		yield* publishFreshDataRoot({
+			cryptoService,
+			dataRoot: dataPaths.dataRoot,
+			fileSystem,
+			parent,
+			path
+		});
+	}
+	const operationalRoot = yield* resolveClaimedDataRoot({
+		cryptoService,
+		dataRoot: dataPaths.dataRoot,
+		fileSystem,
+		parent,
+		path
+	});
+	const operationalPaths = operationalRoot === dataPaths.dataRoot ? dataPaths : yield* decodeOperationalDataPaths(operationalRoot);
+	const rootInfo = yield* validatePrivateDirectory(fileSystem, operationalPaths.dataRoot);
+	const targetBasename = path.basename(operationalPaths.dataRoot);
+	const markerPath = path.join(operationalPaths.dataRoot, DATA_ROOT_MARKER_NAME);
+	const existingMarker = (yield* mapConfigurationError(fileSystem.exists(markerPath))) ? Option.some(yield* validateMarkerForClaim(fileSystem, path, markerPath, rootInfo, claimBasename, targetBasename)) : Option.none();
+	yield* verifyProcessOwnership({
+		cryptoService,
+		dataRoot: operationalPaths.dataRoot,
+		fileSystem,
+		initialRootInfo: rootInfo,
+		path
+	});
+	if (Option.isNone(existingMarker)) {
+		yield* validateLegacyDataRoot({
+			dataPaths: operationalPaths,
+			fileSystem,
+			path,
+			rootInfo
+		});
+		yield* removeValidPendingMarkers({
+			dataRoot: operationalPaths.dataRoot,
+			fileSystem,
+			path,
+			rootInfo
+		}, claimBasename, targetBasename);
+		yield* publishMarker({
+			claimBasename,
+			cryptoService,
+			dataRoot: operationalPaths.dataRoot,
+			fileSystem,
+			markerPath,
+			targetBasename
+		});
+	} else {
+		yield* removeValidPendingMarkers({
+			dataRoot: operationalPaths.dataRoot,
+			fileSystem,
+			path,
+			rootInfo
+		}, claimBasename, targetBasename);
+		if (existingMarker.value._tag === "Legacy") yield* publishMarker({
+			claimBasename,
+			cryptoService,
+			dataRoot: operationalPaths.dataRoot,
+			fileSystem,
+			markerPath,
+			targetBasename
+		});
+	}
+	if ((yield* validateMarkerForClaim(fileSystem, path, markerPath, rootInfo, claimBasename, targetBasename))._tag !== "Bound") return yield* configurationError();
+	return operationalPaths;
+});
+//#endregion
+//#region src/server/observability.ts
+var resource = { serviceName: "control-center" };
+var activation = Config.all({
+	baseEndpoint: Config.string("OTEL_EXPORTER_OTLP_ENDPOINT").pipe(Config.withDefault("")),
+	disabled: Config.string("OTEL_SDK_DISABLED").pipe(Config.withDefault("")),
+	logsEndpoint: Config.string("OTEL_EXPORTER_OTLP_LOGS_ENDPOINT").pipe(Config.withDefault("")),
+	logsExporters: Config.string("OTEL_LOGS_EXPORTER").pipe(Config.withDefault("")),
+	logsProtocol: Config.string("OTEL_EXPORTER_OTLP_LOGS_PROTOCOL").pipe(Config.withDefault("")),
+	protocol: Config.string("OTEL_EXPORTER_OTLP_PROTOCOL").pipe(Config.withDefault("http/protobuf")),
+	tracesEndpoint: Config.string("OTEL_EXPORTER_OTLP_TRACES_ENDPOINT").pipe(Config.withDefault("")),
+	tracesExporters: Config.string("OTEL_TRACES_EXPORTER").pipe(Config.withDefault("")),
+	tracesProtocol: Config.string("OTEL_EXPORTER_OTLP_TRACES_PROTOCOL").pipe(Config.withDefault(""))
+});
+var includesOtlp = (exporters) => exporters.split(",").some((exporter) => exporter.trim().toLowerCase() === "otlp");
+var OtlpHttpProtocol = Schema.Literals(["http/json", "http/protobuf"]);
+var optionalIntegerConfigurationKeys = /* @__PURE__ */ new Set([
+	"OTEL_BLRP_EXPORT_TIMEOUT",
+	"OTEL_BLRP_MAX_EXPORT_BATCH_SIZE",
+	"OTEL_BLRP_SCHEDULE_DELAY",
+	"OTEL_BSP_EXPORT_TIMEOUT",
+	"OTEL_BSP_MAX_EXPORT_BATCH_SIZE",
+	"OTEL_BSP_SCHEDULE_DELAY",
+	"OTEL_EXPORTER_OTLP_LOGS_TIMEOUT",
+	"OTEL_EXPORTER_OTLP_TIMEOUT",
+	"OTEL_EXPORTER_OTLP_TRACES_TIMEOUT"
+]);
+var positiveScheduleDelayConfigurationKeys = /* @__PURE__ */ new Set(["OTEL_BLRP_SCHEDULE_DELAY", "OTEL_BSP_SCHEDULE_DELAY"]);
+var ObservabilityConfigurationError = class extends Schema.TaggedErrorClass()("ObservabilityConfigurationError", {
+	reason: Schema.Literals(["invalid-endpoint", "unsupported-protocol"]),
+	signal: Schema.Literals(["logs", "traces"])
+}) {};
+var validateSignalEndpoint = Effect.fn("ControlCenterObservability.validateSignalEndpoint")(function* (signal, endpoint) {
+	if (endpoint === "") return;
+	const url = yield* Schema.decodeUnknownEffect(Schema.URLFromString)(endpoint).pipe(Effect.mapError(() => new ObservabilityConfigurationError({
+		reason: "invalid-endpoint",
+		signal
+	})));
+	if (url.protocol !== "http:" && url.protocol !== "https:") return yield* new ObservabilityConfigurationError({
+		reason: "invalid-endpoint",
+		signal
+	});
+});
+var resolveProtocol = Effect.fn("ControlCenterObservability.resolveProtocol")(function* (signal, signalProtocol, baseProtocol) {
+	const protocol = (signalProtocol.trim() === "" ? baseProtocol : signalProtocol).trim().toLowerCase();
+	return yield* Schema.decodeUnknownEffect(OtlpHttpProtocol)(protocol).pipe(Effect.mapError(() => new ObservabilityConfigurationError({
+		reason: "unsupported-protocol",
+		signal
+	})));
+});
+var defaultEndpointLayer = ConfigProvider.layerAdd(ConfigProvider.fromEnv({ env: { OTEL_EXPORTER_OTLP_ENDPOINT: "http://localhost:4318" } }));
+var parseSdkDisabled = Effect.fn("ControlCenterObservability.parseSdkDisabled")(function* (value) {
+	const normalized = value.trim().toLowerCase();
+	if (normalized === "true") return true;
+	if (normalized === "" || normalized === "false") return false;
+	yield* Effect.logWarning("Ignoring invalid OTEL_SDK_DISABLED value; expected true or false.");
+	return false;
+});
+var decodeIntegerConfigurationValue = Schema.decodeUnknownOption(Schema.toCodecStringTree(Schema.Int));
+var sanitizedConfigProvider = (provider, sdkDisabled) => ConfigProvider.make((path) => {
+	if (path.length === 1 && path[0] === "OTEL_SDK_DISABLED") return Effect.succeed(ConfigProvider.makeValue(sdkDisabled ? "true" : "false"));
+	return provider.load(path).pipe(Effect.map((node) => {
+		if (path.length !== 1 || typeof path[0] !== "string" || !optionalIntegerConfigurationKeys.has(path[0]) || node === void 0) return node;
+		const value = node.value;
+		if (value === void 0) return void 0;
+		const integer = decodeIntegerConfigurationValue(value);
+		return Option.isNone(integer) || positiveScheduleDelayConfigurationKeys.has(path[0]) && integer.value <= 0 ? void 0 : node;
+	}));
+});
+var serializationLayer = (protocol) => protocol === "http/json" ? OtlpSerialization.layerJson : OtlpSerialization.layerProtobuf;
+var loggerLayer = (protocol) => OtlpLogger.layerFromConfig({ resource }).pipe(Layer.provide(serializationLayer(protocol)), Layer.provide(defaultEndpointLayer));
+var tracerLayer = (protocol) => OtlpTracer.layerFromConfig({ resource }).pipe(Layer.provide(serializationLayer(protocol)), Layer.provide(defaultEndpointLayer));
+var ControlCenterObservabilityLive = Effect.gen(function* () {
+	const configured = yield* activation;
+	const sdkDisabled = yield* parseSdkDisabled(configured.disabled);
+	if (sdkDisabled) return Layer.empty;
+	const provider = yield* ConfigProvider.ConfigProvider;
+	const logsEnabled = includesOtlp(configured.logsExporters);
+	const tracesEnabled = includesOtlp(configured.tracesExporters);
+	if (logsEnabled) yield* validateSignalEndpoint("logs", configured.logsEndpoint === "" ? configured.baseEndpoint : configured.logsEndpoint);
+	if (tracesEnabled) yield* validateSignalEndpoint("traces", configured.tracesEndpoint === "" ? configured.baseEndpoint : configured.tracesEndpoint);
+	const logsProtocol = logsEnabled ? yield* resolveProtocol("logs", configured.logsProtocol, configured.protocol) : "http/protobuf";
+	const tracesProtocol = tracesEnabled ? yield* resolveProtocol("traces", configured.tracesProtocol, configured.protocol) : "http/protobuf";
+	return Layer.merge(logsEnabled ? loggerLayer(logsProtocol) : Layer.empty, tracesEnabled ? tracerLayer(tracesProtocol) : Layer.empty).pipe(Layer.provide(ConfigProvider.layer(sanitizedConfigProvider(provider, sdkDisabled))));
+}).pipe(Layer.unwrap).pipe(Layer.provide(FetchHttpClient.layer));
+//#endregion
+//#region src/server/cli.ts
+var DEFAULT_WORKSPACE_ID = WorkspaceId.make("01890f6f-6d6a-7cc0-98d2-000000000001");
+var DEFAULT_OWNER_ID = PersonId.make("01890f6f-6d6a-7cc0-98d2-000000000002");
+var commaSeparated = (value) => value.split(",").map((part) => part.trim()).filter((part) => part.length > 0);
+var dataRootConfiguration = Config.string("CONTROL_CENTER_DATA_ROOT").pipe(Config.withDefault(".control-center"));
+var serverConfiguration = Config.all({
+	agentClaudeExecutable: Config.string("CONTROL_CENTER_AGENT_CLAUDE_EXECUTABLE").pipe(Config.withDefault("")),
+	agentClaudeModel: Config.string("CONTROL_CENTER_AGENT_CLAUDE_MODEL").pipe(Config.withDefault("")),
+	agentCodexExecutable: Config.string("CONTROL_CENTER_AGENT_CODEX_EXECUTABLE").pipe(Config.withDefault("")),
+	agentCodexModel: Config.string("CONTROL_CENTER_AGENT_CODEX_MODEL").pipe(Config.withDefault("")),
+	agentCwd: Config.string("CONTROL_CENTER_AGENT_CWD").pipe(Config.withDefault("")),
+	agentProviders: Config.string("CONTROL_CENTER_AGENT_PROVIDERS").pipe(Config.withDefault("")),
+	allowedHosts: Config.string("CONTROL_CENTER_ALLOWED_HOSTS").pipe(Config.withDefault("")),
+	allowedOrigins: Config.string("CONTROL_CENTER_ALLOWED_ORIGINS").pipe(Config.withDefault("")),
+	allowInsecureLan: Config.boolean("CONTROL_CENTER_ALLOW_INSECURE_LAN").pipe(Config.withDefault(false)),
+	directTlsCertificateRef: Config.string("CONTROL_CENTER_TLS_CERTIFICATE_REF").pipe(Config.withDefault("")),
+	directTlsPrivateKeyRef: Config.string("CONTROL_CENTER_TLS_PRIVATE_KEY_REF").pipe(Config.withDefault("")),
+	host: Config.string("CONTROL_CENTER_HOST").pipe(Config.withDefault("127.0.0.1")),
+	port: Config.int("CONTROL_CENTER_PORT").pipe(Config.withDefault(4173)),
+	publicOrigin: Config.string("CONTROL_CENTER_PUBLIC_ORIGIN").pipe(Config.withDefault("")),
+	trustedProxyAddresses: Config.string("CONTROL_CENTER_TRUSTED_PROXY_ADDRESSES").pipe(Config.withDefault(""))
+});
+var writeStdoutLine = (value) => Stdio.Stdio.use((stdio) => Stream.make(`${value}\n`).pipe(Stream.run(stdio.stdout())));
+var writeStderrLine = (value) => Stdio.Stdio.use((stdio) => Stream.make(`${value}\n`).pipe(Stream.run(stdio.stderr())));
+var verificationLine = (complete, degraded, verification) => verification._tag === "Complete" ? complete : `${degraded} ${verification.reproducibleBlobGaps.length} reproducible cache gaps.`;
+var ControlCenterCliUsageError = class extends Schema.TaggedErrorClass()("ControlCenterCliUsageError", { command: Schema.String }) {};
+var program = Effect.scoped(Effect.gen(function* () {
+	const path = yield* Path.Path;
+	const invocation = classifyControlCenterCliArguments(yield* (yield* Stdio.Stdio).args);
+	if (invocation._tag === "invalid") {
+		yield* writeStderrLine("Usage: control-center [recover-owner | backup <archive> | verify-backup <archive> | restore <archive>]");
+		return yield* new ControlCenterCliUsageError({ command: invocation.command });
+	}
+	if (invocation._tag === "verify-backup") {
+		yield* writeStdoutLine(verificationLine("Backup verified.", "Backup verified with", yield* verifyBackup(invocation.archiveRoot)));
+		return;
+	}
+	const configuredDataRoot = yield* dataRootConfiguration;
+	if (invocation._tag === "restore") {
+		yield* writeStdoutLine(verificationLine("Backup restored.", "Backup restored with", (yield* restoreBackup({
+			archiveRoot: invocation.archiveRoot,
+			configuredDataRoot
+		})).verification));
+		return;
+	}
+	const configuredDataPaths = yield* decodeControlCenterDataPaths(configuredDataRoot);
+	if (invocation._tag === "backup") {
+		const existingDataPaths = yield* resolvePreparedControlCenterDataRoot(configuredDataPaths);
+		yield* writeStdoutLine(verificationLine("Backup created.", "Backup created with", (yield* createOfflineVerifiedBackup({
+			destination: invocation.archiveRoot,
+			persistenceConfig: existingDataPaths.persistenceConfig
+		})).verification));
+		return;
+	}
+	const dataPaths = yield* prepareControlCenterDataRoot(configuredDataPaths);
+	if (invocation._tag === "recover-owner") {
+		const recoveryServices = yield* Layer.build(terminalRecoveryLayer(dataPaths.persistenceConfig));
+		const issued = yield* Context.get(recoveryServices, TerminalRecovery).issueOwnerRecovery({
+			workspaceId: DEFAULT_WORKSPACE_ID,
+			actor: {
+				_tag: "human",
+				personId: DEFAULT_OWNER_ID
+			},
+			revokeExistingOwnerSessions: true
+		});
+		yield* writeStdoutLine(`Recovery pairing code: ${Redacted.value(issued.pairingCode)}`);
+		return;
+	}
+	const programScope = yield* Effect.scope;
+	const observabilityScope = yield* Scope.fork(programScope);
+	const observabilityServices = yield* Layer.buildWithScope(ControlCenterObservabilityLive, observabilityScope);
+	return yield* Effect.gen(function* () {
+		const configured = yield* serverConfiguration;
+		const agentProviders = yield* Schema.decodeUnknownEffect(Schema.Array(AgentProvider).check(Schema.isUnique()))(commaSeparated(configured.agentProviders));
+		const agentCwd = agentProviders.length === 0 ? null : yield* Schema.decodeUnknownEffect(Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty()))(configured.agentCwd);
+		const allowedHosts = commaSeparated(configured.allowedHosts);
+		const allowedOrigins = commaSeparated(configured.allowedOrigins);
+		const trustedProxyAddresses = commaSeparated(configured.trustedProxyAddresses);
+		const hasDirectTlsInput = configured.directTlsCertificateRef.length > 0 || configured.directTlsPrivateKeyRef.length > 0;
+		const bindConfig = yield* decodeBindConfig({
+			host: configured.host,
+			port: configured.port,
+			allowInsecureLan: configured.allowInsecureLan,
+			...configured.publicOrigin.length > 0 ? { publicOrigin: configured.publicOrigin } : {},
+			...allowedHosts.length > 0 ? { allowedHosts } : {},
+			...allowedOrigins.length > 0 ? { allowedOrigins } : {},
+			...trustedProxyAddresses.length > 0 ? { trustedProxyAddresses } : {},
+			...hasDirectTlsInput ? { directTls: {
+				certificateRef: configured.directTlsCertificateRef,
+				privateKeyRef: configured.directTlsPrivateKeyRef
+			} } : {}
+		});
+		const staticRoot = yield* path.fromFileUrl(new URL("../../client", import.meta.url));
+		const services = yield* Layer.build(makeControlCenterServer({
+			bindConfig,
+			firstPartyPluginRuntime: true,
+			bootstrap: {
+				owner: {
+					_tag: "human",
+					personId: DEFAULT_OWNER_ID
+				},
+				workspaceId: DEFAULT_WORKSPACE_ID,
+				workspaceName: WorkspaceName.make("Control Center")
+			},
+			persistenceConfig: dataPaths.persistenceConfig,
+			releaseAgent: agentCwd === null ? null : {
+				cwd: agentCwd,
+				enabledProviders: agentProviders,
+				...configured.agentCodexExecutable.length > 0 ? { codexExecutable: configured.agentCodexExecutable } : {},
+				...configured.agentCodexModel.length > 0 ? { codexModel: configured.agentCodexModel } : {},
+				...configured.agentClaudeExecutable.length > 0 ? { claudeExecutable: configured.agentClaudeExecutable } : {},
+				...configured.agentClaudeModel.length > 0 ? { claudeModel: configured.agentClaudeModel } : {}
+			},
+			secretRoot: dataPaths.secretRoot,
+			staticAssets: { root: staticRoot }
+		}));
+		const bootstrap = Context.get(services, ControlCenterBootstrap);
+		const lifecycle = Context.get(services, ServerLifecycle);
+		yield* lifecycle.registerDrainHook({
+			hookId: "telemetry.otlp-export",
+			run: Scope.close(observabilityScope, Exit.void)
+		});
+		yield* writeStdoutLine(`Control Center listening at ${bindConfig.publicOrigin}`);
+		if (bootstrap._tag === "pairing-issued") yield* writeStdoutLine(`Pairing code: ${Redacted.value(bootstrap.pairingCode)}`);
+		else if (bootstrap._tag === "already-initialized") yield* writeStdoutLine("Workspace ready. Use an existing paired browser.");
+		return yield* Effect.never.pipe(Effect.onInterrupt(() => writeStdoutLine("Control Center draining.").pipe(Effect.andThen(lifecycle.drainWithin("10 seconds")), Effect.flatMap((result) => {
+			switch (result._tag) {
+				case "Drained": return writeStdoutLine("Control Center drained.");
+				case "DeadlineExceeded": return writeStderrLine("Control Center drain deadline reached.");
+				case "HooksFailed": return writeStderrLine(`Control Center drain hooks failed: ${result.hookIds.join(", ")}.`);
+			}
+		}))));
+	}).pipe(Effect.provide(observabilityServices));
+}));
+var findDatabaseInitializationError = (value, remainingWrapperDepth = 2) => {
+	if (Schema.is(DatabaseInitializationError)(value)) return value;
+	if (remainingWrapperDepth > 0 && Predicate.hasProperty(value, "_tag") && value._tag === "ServeError" && Predicate.hasProperty(value, "cause")) return findDatabaseInitializationError(value.cause, remainingWrapperDepth - 1);
+	return null;
+};
+var reportProgramFailure = (cause) => {
+	const error = Cause.findErrorOption(cause);
+	if (Option.exists(error, (value) => Predicate.hasProperty(value, "_tag") && value._tag === "ControlCenterCliUsageError")) return Effect.failCause(cause);
+	const databaseInitializationError = Option.flatMap(error, (value) => Option.fromNullishOr(findDatabaseInitializationError(value)));
+	if (Option.isSome(databaseInitializationError)) {
+		const operation = databaseInitializationError.value.operation;
+		return writeStderrLine(`Control Center command failed (DatabaseInitializationError: ${operation}).`).pipe(Effect.andThen(operation === "verify-schema" ? writeStderrLine("The database schema does not match this pre-stable build. Back up the data root if needed, then explicitly recreate local development data or choose a new CONTROL_CENTER_DATA_ROOT. Automatic migrations are disabled until schema stability.") : Effect.void), Effect.andThen(Effect.failCause(cause)));
+	}
+	const errorTag = Option.flatMap(error, (value) => Predicate.hasProperty(value, "_tag") && typeof value._tag === "string" ? Option.some(value._tag) : Option.none());
+	return writeStderrLine(Option.match(errorTag, {
+		onNone: () => "Control Center command failed unexpectedly.",
+		onSome: (tag) => `Control Center command failed (${tag}).`
+	})).pipe(Effect.andThen(Effect.failCause(cause)));
+};
+NodeRuntime.runMain(program.pipe(Effect.catchCause(reportProgramFailure), Effect.provide(NodeServices.layer)), { disableErrorReporting: true });
+//#endregion
+export {};
+
+//# sourceMappingURL=cli.js.map