@msn-control/liftoff 0.11.2 → 0.12.0

package/dist/adapters/state/posix-native-lock.js

@@ -0,0 +1,145 @@
+import path from 'node:path';
+import { StateMigrationError, stateFailureCodes } from '../../domain/repair/stateful.js';
+import { stateAssert } from '../../domain/repair/stateful-invariants.js';
+import { startPrivateStateProcess, nativeLocalStateProtocol } from './native-system.js';
+import { posixStateLockProgram } from './posix-lock-program.js';
+import { stopOwnedStateProcess } from './owned-process.js';
+class PrivateLockSession {
+    child;
+    timeoutMs;
+    #closed = false;
+    #buffer = '';
+    #pending = null;
+    #queue = Promise.resolve();
+    #timer = null;
+    constructor(child, timeoutMs) {
+        this.child = child;
+        this.timeoutMs = timeoutMs;
+        child.stdout.on('data', (data) => {
+            this.#buffer += data.toString('utf8');
+            if (this.#buffer.length > 8192) {
+                this.fail('storage-limit');
+                return;
+            }
+            const newline = this.#buffer.indexOf('\n');
+            if (newline < 0)
+                return;
+            const line = this.#buffer.slice(0, newline);
+            this.#buffer = this.#buffer.slice(newline + 1);
+            const pending = this.#pending;
+            this.#pending = null;
+            if (this.#timer)
+                clearTimeout(this.#timer);
+            try {
+                const reply = JSON.parse(line);
+                if (!pending || typeof reply.ok !== 'boolean') {
+                    this.fail('operation-failed');
+                    return;
+                }
+                if (!reply.ok) {
+                    const code = reply.code && stateFailureCodes.includes(reply.code) ? reply.code : 'operation-failed';
+                    this.#closed = true;
+                    pending.reject(new StateMigrationError(code));
+                }
+                else
+                    pending.resolve(reply);
+            }
+            catch {
+                pending?.reject(new StateMigrationError('operation-failed'));
+                this.fail('operation-failed');
+            }
+        });
+        child.stderr.on('data', (data) => { if (data.length)
+            this.fail('operation-failed'); });
+        child.stdin.on('error', () => this.fail('lock-lost'));
+        child.once('error', () => this.fail('tool-unavailable'));
+        child.once('close', () => this.fail('lock-lost'));
+    }
+    fail(code) {
+        this.#closed = true;
+        if (this.#timer)
+            clearTimeout(this.#timer);
+        this.#pending?.reject(new StateMigrationError(code));
+        this.#pending = null;
+        this.child.stdin.end();
+        this.child.kill('SIGTERM');
+    }
+    send(command) {
+        const work = this.#queue.then(() => new Promise((resolve, reject) => {
+            if (this.#closed) {
+                reject(new StateMigrationError('lock-lost'));
+                return;
+            }
+            this.#pending = { resolve, reject };
+            this.#timer = setTimeout(() => this.fail('timeout'), this.timeoutMs);
+            this.#timer.unref();
+            this.child.stdin.write(`${JSON.stringify(command)}\n`, (error) => { if (error)
+                this.fail('lock-lost'); });
+        }));
+        this.#queue = work.catch(() => undefined);
+        return work;
+    }
+    cancel() { this.fail('cancelled'); }
+    async release() {
+        try {
+            if (!this.#closed)
+                await this.send({ action: 'release' });
+        }
+        finally {
+            this.#closed = true;
+            this.child.stdin.end();
+            if (this.#timer)
+                clearTimeout(this.#timer);
+            await stopOwnedStateProcess(this.child, { immediate: false });
+        }
+    }
+}
+export class DarwinPosixStateLockProvider {
+    options;
+    capabilities = Object.freeze({
+        protocol: nativeLocalStateProtocol.version, existingInPlace: true, createAbsent: false, remove: false
+    });
+    constructor(options) {
+        this.options = options;
+    }
+    async acquire(request) {
+        stateAssert(process.platform === 'darwin', 'unsupported-native-platform');
+        stateAssert((this.options.timeoutMs ?? 15_000) > 0 && (this.options.timeoutMs ?? 15_000) <= 120_000, 'invalid-binding');
+        stateAssert(request.expectedVersion !== null, 'unsupported-local-state-operation');
+        stateAssert(/^[a-f0-9]{64}$/.test(request.expectedVersion) && /^[a-f0-9-]{36}$/.test(request.operationId), 'invalid-binding');
+        stateAssert(!request.signal?.aborted, 'cancelled');
+        const child = await startPrivateStateProcess(this.options.python, ['-I', '-S', '-B', '-u', '-c', posixStateLockProgram], path.dirname(request.path), undefined, 'lease');
+        const session = new PrivateLockSession(child, this.options.timeoutMs ?? 15_000);
+        const abort = () => session.cancel();
+        request.signal?.addEventListener('abort', abort, { once: true });
+        if (request.signal?.aborted)
+            abort();
+        try {
+            await session.send({
+                path: request.path, operationId: request.operationId, expectedVersion: request.expectedVersion, holdSeconds: 1800
+            });
+        }
+        catch (error) {
+            request.signal?.removeEventListener('abort', abort);
+            session.cancel();
+            await session.release();
+            throw error;
+        }
+        // Cancellation of the native operation is not release authority. The
+        // coordinator releases this lease only after native descendants stop.
+        request.signal?.removeEventListener('abort', abort);
+        return {
+            assertHeld: async () => { await session.send({ action: 'assert' }); },
+            replace: async (bytes, expectedVersion) => {
+                stateAssert(expectedVersion !== null && bytes.byteLength <= 32 * 1024 * 1024, 'unsupported-local-state-operation');
+                await session.send({ action: 'replace', expectedVersion, bytes: Buffer.from(bytes).toString('base64') });
+            },
+            remove: async () => { throw new StateMigrationError('unsupported-local-state-operation'); },
+            release: async () => {
+                request.signal?.removeEventListener('abort', abort);
+                await session.release();
+            }
+        };
+    }
+}
+//# sourceMappingURL=posix-native-lock.js.map

package/dist/adapters/state/posix-native-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"posix-native-lock.js","sourceRoot":"","sources":["../../../src/adapters/state/posix-native-lock.ts"],"names":[],"mappings":"AACA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,mBAAmB,EAAE,iBAAiB,EAEvC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAI3D,MAAM,kBAAkB;IAMO,KAAK;IAAmD,SAAS;IAL9F,OAAO,GAAG,KAAK,CAAC;IAChB,OAAO,GAAG,EAAE,CAAC;IACb,QAAQ,GAA+E,IAAI,CAAC;IAC5F,MAAM,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7C,MAAM,GAAyC,IAAI,CAAC;IACpD,YAA6B,KAAqC,EAAmB,SAAiB;qBAAzE,KAAK;yBAAmD,SAAS;QAC5F,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YACvC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACvE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,OAAO,GAAG,CAAC;gBAAE,OAAO;YACxB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,IAAI,IAAI,CAAC,MAAM;gBAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC;gBACxC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;oBAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACzF,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;oBACd,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC;oBACpG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;oBACpB,OAAO,CAAC,MAAM,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;gBAChD,CAAC;;oBAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,EAAE,MAAM,CAAC,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAAC,CAAC;QAC1G,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/F,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACpD,CAAC;IACO,IAAI,CAAC,IAAsB;QACjC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,MAAM;YAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,OAAe;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,OAAO,CAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACzE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC3E,IAAI,CAAC,QAAQ,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACrE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,KAAK;gBAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5G,CAAC,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAW,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1C,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAAC,CAAC;gBAC1D,CAAC;YACP,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,MAAM;gBAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,qBAAqB,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,4BAA4B;IAIV,OAAO;IAH3B,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;QACpC,QAAQ,EAAE,wBAAwB,CAAC,OAAO,EAAE,eAAe,EAAE,IAAa,EAAE,YAAY,EAAE,KAAc,EAAE,MAAM,EAAE,KAAc;KACjI,CAAC,CAAC;IACH,YAA6B,OAG5B;uBAH4B,OAAO;IAGhC,CAAC;IAEL,KAAK,CAAC,OAAO,CAAC,OAA+D;QAC3E,WAAW,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAC;QAC1E,WAAW,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACxH,WAAW,CAAC,OAAO,CAAC,eAAe,KAAK,IAAI,EAAE,mCAAmC,CAAC,CAAC;QACnF,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAC9H,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAC9D,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,qBAAqB,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACzG,MAAM,OAAO,GAAG,IAAI,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAC3C,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YAAE,KAAK,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,WAAW,EAAE,IAAI;aAClH,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACpD,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,KAAK,CAAC;QACd,CAAC;QACD,qEAAqE;QACrE,sEAAsE;QACtE,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO;YACL,UAAU,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YACrE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;gBACxC,WAAW,CAAC,eAAe,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,mCAAmC,CAAC,CAAC;gBACnH,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC3G,CAAC;YACD,MAAM,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC;YAC3F,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACpD,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/adapters/state/protected-workspace.d.ts

@@ -0,0 +1,57 @@
+import { type ProtectedArtifactStorage, type ProtectedStateWorkspace, type ProtectedVolumeAttestor, type StateArtifactDescriptor, type StateArtifactPurpose, type StateEncryptionKeyProvider, type StateExecutionContext } from '../../domain/repair/stateful.js';
+export type { ProtectedArtifactStorage, ProtectedVolumeAttestor, StateEncryptionKeyProvider } from '../../domain/repair/stateful.js';
+export declare class EncryptedStateWorkspace implements ProtectedStateWorkspace {
+    #private;
+    private readonly options;
+    readonly workspaceRef: string;
+    constructor(options: {
+        workspaceId: string;
+        keyRef: string;
+        ownerId: string;
+        storage: ProtectedArtifactStorage;
+        keys: StateEncryptionKeyProvider;
+        maxArtifactBytes?: number;
+        maxWrittenBytes?: number;
+        timeoutMs?: number;
+    });
+    toJSON(): {
+        workspaceRef: string;
+    };
+    private bounded;
+    assertAvailable(context: StateExecutionContext): Promise<void>;
+    private key;
+    private id;
+    private aad;
+    private seal;
+    private unseal;
+    put(purpose: StateArtifactPurpose, scope: string, bytes: Uint8Array, id?: `${string}-${string}-${string}-${string}-${string}`): Promise<StateArtifactDescriptor>;
+    get(ref: string, purpose: StateArtifactPurpose, scope: string): Promise<Uint8Array>;
+    describe(ref: string, purpose: StateArtifactPurpose, scope: string): Promise<StateArtifactDescriptor | null>;
+    replace(ref: string, purpose: StateArtifactPurpose, scope: string, previousDigest: string, bytes: Uint8Array): Promise<StateArtifactDescriptor>;
+    removeExact(descriptor: StateArtifactDescriptor): Promise<void>;
+    withScratch<T>(context: StateExecutionContext, action: (directory: string) => Promise<T>): Promise<T>;
+}
+export declare function assertPrivateStatePath(target: string, context: StateExecutionContext, attestor: ProtectedVolumeAttestor, directory: boolean, now?: number): Promise<void>;
+export declare function assertExistingStateSourcePath(target: string, context: StateExecutionContext): Promise<void>;
+export declare class FilesystemProtectedArtifactStorage implements ProtectedArtifactStorage {
+    #private;
+    private readonly root;
+    private readonly attestor;
+    private readonly maxStoredBytes;
+    constructor(root: string, attestor: ProtectedVolumeAttestor, maxStoredBytes?: number);
+    toJSON(): {
+        storage: string;
+    };
+    assertAvailable(context: StateExecutionContext): Promise<void>;
+    private filename;
+    private durableCreate;
+    private syncDirectory;
+    private allocate;
+    create(id: string, bytes: Uint8Array): Promise<void>;
+    read(id: string): Promise<Uint8Array>;
+    private guarded;
+    compareExchange(id: string, previousDigest: string, bytes: Uint8Array): Promise<void>;
+    remove(id: string, expectedDigest: string): Promise<void>;
+    withScratch<T>(context: StateExecutionContext, action: (directory: string) => Promise<T>): Promise<T>;
+}
+export declare function protectedStateScope(context: StateExecutionContext): string;

package/dist/adapters/state/protected-workspace.js

@@ -0,0 +1,412 @@
+import { createCipheriv, createDecipheriv, randomBytes, randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, readdir, realpath, rename, rm, stat, unlink } from 'node:fs/promises';
+import path from 'node:path';
+import { StateMigrationError } from '../../domain/repair/stateful.js';
+import { stateAssert, stateDigest, stateObjectDigest } from '../../domain/repair/stateful-invariants.js';
+import { boundedStateOperation } from '../../domain/repair/stateful-bounded.js';
+import { cleanupOwnedStateScratch } from './owned-process.js';
+const artifactId = /^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/;
+const purposes = new Set(['inspection', 'state', 'plan', 'journal', 'backup', 'candidate', 'recovery']);
+export class EncryptedStateWorkspace {
+    options;
+    workspaceRef;
+    #ready = false;
+    #writtenBytes = 0;
+    constructor(options) {
+        this.options = options;
+        stateAssert(artifactId.test(options.workspaceId), 'protected-workspace-required');
+        this.workspaceRef = `state-workspace:${options.workspaceId}`;
+    }
+    toJSON() { return { workspaceRef: this.workspaceRef }; }
+    bounded(action) {
+        const timeoutMs = this.options.timeoutMs ?? 30_000;
+        stateAssert(timeoutMs > 0 && timeoutMs <= 120_000, 'invalid-binding');
+        return boundedStateOperation(AbortSignal.timeout(timeoutMs), action);
+    }
+    async assertAvailable(context) {
+        this.#ready = false;
+        try {
+            await this.bounded(() => this.options.storage.assertAvailable(context));
+            const key = await this.bounded(() => this.options.keys.describe(this.options.keyRef, context));
+            stateAssert(key.keyRef === this.options.keyRef && key.ownerId === this.options.ownerId && key.hostId === context.hostId
+                && key.storage === 'external-key-provider' && key.algorithm === 'aes-256-gcm', 'key-unavailable');
+            await this.key(async () => undefined);
+            this.#ready = true;
+        }
+        catch (error) {
+            if (error instanceof StateMigrationError)
+                throw error;
+            throw new StateMigrationError('key-unavailable');
+        }
+    }
+    async key(action) {
+        let supplied = false;
+        try {
+            return await this.bounded(() => this.options.keys.withKey(this.options.keyRef, async (provided) => {
+                stateAssert(provided.byteLength === 32, 'key-unavailable');
+                const key = Buffer.from(provided);
+                supplied = true;
+                try {
+                    return await action(key);
+                }
+                finally {
+                    key.fill(0);
+                }
+            }));
+        }
+        catch (error) {
+            if (error instanceof StateMigrationError)
+                throw error;
+            if (supplied)
+                throw error;
+            throw new StateMigrationError('key-unavailable');
+        }
+    }
+    id(ref) {
+        const prefix = `${this.workspaceRef}/`;
+        stateAssert(ref.startsWith(prefix) && artifactId.test(ref.slice(prefix.length)), 'artifact-integrity');
+        return ref.slice(prefix.length);
+    }
+    aad(ref, purpose, scope) {
+        stateAssert(this.#ready, 'protected-workspace-required');
+        stateAssert(purposes.has(purpose) && /^[a-f0-9]{64}$/.test(scope), 'artifact-purpose');
+        return Buffer.from(JSON.stringify([this.workspaceRef, ref, purpose, scope, this.options.ownerId]));
+    }
+    async seal(ref, purpose, scope, bytes) {
+        stateAssert(bytes.byteLength <= (this.options.maxArtifactBytes ?? 64 * 1024 * 1024), 'storage-limit');
+        stateAssert(this.#writtenBytes + bytes.byteLength <= (this.options.maxWrittenBytes ?? 512 * 1024 * 1024), 'storage-limit');
+        const aad = this.aad(ref, purpose, scope);
+        const sealed = await this.key(async (key) => {
+            const nonce = randomBytes(12);
+            const cipher = createCipheriv('aes-256-gcm', key, nonce);
+            cipher.setAAD(aad);
+            const ciphertext = Buffer.concat([cipher.update(bytes), cipher.final()]);
+            const envelope = {
+                version: 1, keyRef: this.options.keyRef, nonce: nonce.toString('base64'),
+                tag: cipher.getAuthTag().toString('base64'), ciphertext: ciphertext.toString('base64')
+            };
+            return Buffer.from(JSON.stringify(envelope));
+        });
+        this.#writtenBytes += bytes.byteLength;
+        return sealed;
+    }
+    async unseal(ref, purpose, scope, bytes) {
+        stateAssert(bytes.byteLength <= (this.options.maxArtifactBytes ?? 64 * 1024 * 1024) * 2 + 4096, 'storage-limit');
+        const aad = this.aad(ref, purpose, scope);
+        try {
+            const envelope = JSON.parse(Buffer.from(bytes).toString('utf8'));
+            stateAssert(envelope.version === 1 && envelope.keyRef === this.options.keyRef, 'artifact-integrity');
+            stateAssert(typeof envelope.nonce === 'string' && typeof envelope.tag === 'string' && typeof envelope.ciphertext === 'string', 'artifact-integrity');
+            const nonce = Buffer.from(envelope.nonce, 'base64');
+            const tag = Buffer.from(envelope.tag, 'base64');
+            stateAssert(nonce.length === 12 && tag.length === 16, 'artifact-integrity');
+            return await this.key(async (key) => {
+                const cipher = createDecipheriv('aes-256-gcm', key, nonce);
+                cipher.setAAD(aad);
+                cipher.setAuthTag(tag);
+                return Buffer.concat([cipher.update(Buffer.from(envelope.ciphertext, 'base64')), cipher.final()]);
+            });
+        }
+        catch (error) {
+            if (error instanceof StateMigrationError && error.code === 'key-unavailable')
+                throw error;
+            throw new StateMigrationError('artifact-integrity');
+        }
+    }
+    async put(purpose, scope, bytes, id = randomUUID()) {
+        stateAssert(artifactId.test(id), 'artifact-integrity');
+        const ref = `${this.workspaceRef}/${id}`;
+        try {
+            const sealed = await this.seal(ref, purpose, scope, bytes);
+            await this.bounded(() => this.options.storage.create(id, sealed));
+        }
+        catch (error) {
+            if (error?.code === 'EEXIST')
+                throw new StateMigrationError('recovery-required');
+            throw error;
+        }
+        const verified = await this.get(ref, purpose, scope);
+        try {
+            stateAssert(stateDigest(verified) === stateDigest(bytes), 'artifact-integrity');
+        }
+        finally {
+            verified.fill(0);
+        }
+        return { ref, digest: stateDigest(bytes), purpose, scope };
+    }
+    async get(ref, purpose, scope) {
+        const id = this.id(ref);
+        return this.unseal(ref, purpose, scope, await this.bounded(() => this.options.storage.read(id)));
+    }
+    async describe(ref, purpose, scope) {
+        const id = this.id(ref);
+        this.aad(ref, purpose, scope);
+        const envelope = await this.bounded(() => this.options.storage.read(id)).catch((error) => {
+            if (error.code === 'ENOENT')
+                return null;
+            throw error;
+        });
+        if (!envelope)
+            return null;
+        const bytes = await this.unseal(ref, purpose, scope, envelope);
+        try {
+            return { ref, digest: stateDigest(bytes), purpose, scope };
+        }
+        finally {
+            bytes.fill(0);
+        }
+    }
+    async replace(ref, purpose, scope, previousDigest, bytes) {
+        const id = this.id(ref);
+        const priorEnvelope = await this.bounded(() => this.options.storage.read(id));
+        const prior = await this.unseal(ref, purpose, scope, priorEnvelope);
+        try {
+            stateAssert(stateDigest(prior) === previousDigest, 'artifact-integrity');
+        }
+        finally {
+            prior.fill(0);
+        }
+        const sealed = await this.seal(ref, purpose, scope, bytes);
+        await this.bounded(() => this.options.storage.compareExchange(id, stateDigest(priorEnvelope), sealed));
+        const verified = await this.get(ref, purpose, scope);
+        try {
+            stateAssert(stateDigest(verified) === stateDigest(bytes), 'artifact-integrity');
+        }
+        finally {
+            verified.fill(0);
+        }
+        return { ref, digest: stateDigest(bytes), purpose, scope };
+    }
+    async removeExact(descriptor) {
+        const id = this.id(descriptor.ref);
+        const envelope = await this.bounded(() => this.options.storage.read(id));
+        const bytes = await this.unseal(descriptor.ref, descriptor.purpose, descriptor.scope, envelope);
+        try {
+            stateAssert(stateDigest(bytes) === descriptor.digest, 'artifact-integrity');
+        }
+        finally {
+            bytes.fill(0);
+        }
+        await this.bounded(() => this.options.storage.remove(id, stateDigest(envelope)));
+    }
+    async withScratch(context, action) {
+        await this.assertAvailable(context);
+        return this.options.storage.withScratch(context, action);
+    }
+}
+function isUnder(root, candidate) {
+    const relative = path.relative(root.toLowerCase(), candidate.toLowerCase());
+    return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+}
+export async function assertPrivateStatePath(target, context, attestor, directory, now = Date.now()) {
+    stateAssert(path.isAbsolute(target) && path.normalize(target) === target && !isUnder(context.projectRoot, target), 'unsafe-path');
+    const parent = directory ? target : path.dirname(target);
+    let current = parent;
+    while (true) {
+        const info = await lstat(current).catch(() => { throw new StateMigrationError('unsafe-path'); });
+        stateAssert(info.isDirectory() && !info.isSymbolicLink(), 'unsafe-path');
+        const git = await lstat(path.join(current, '.git')).then(() => true, (error) => {
+            if (error.code === 'ENOENT')
+                return false;
+            throw new StateMigrationError('unsafe-path');
+        });
+        stateAssert(!git, 'unsafe-path');
+        const next = path.dirname(current);
+        if (current === next)
+            break;
+        current = next;
+    }
+    stateAssert(await realpath(parent) === parent, 'unsafe-path');
+    const info = await stat(parent);
+    if (process.platform !== 'win32') {
+        stateAssert((info.mode & 0o077) === 0 && (process.getuid === undefined || info.uid === process.getuid()), 'unsafe-path');
+    }
+    const proof = await attestor.verify(parent, context);
+    stateAssert(proof.canonicalDirectory === parent && proof.hostId === context.hostId && proof.encryptedVolume === true
+        && proof.privateAccess === true && proof.storageClass === 'protected-state-workspace' && proof.expiresAt > now, 'protected-workspace-required');
+    if (!directory) {
+        const file = await lstat(target).catch((error) => {
+            if (error.code === 'ENOENT')
+                return null;
+            throw new StateMigrationError('unsafe-path');
+        });
+        stateAssert(!file || (file.isFile() && !file.isSymbolicLink() && file.nlink === 1
+            && (process.platform === 'win32' || ((file.mode & 0o077) === 0 && (process.getuid === undefined || file.uid === process.getuid())))), 'unsafe-path');
+    }
+}
+export async function assertExistingStateSourcePath(target, context) {
+    stateAssert(path.isAbsolute(target) && path.normalize(target) === target
+        && isUnder(context.projectRoot, target) && target !== context.projectRoot
+        && !path.relative(context.projectRoot, target).split(path.sep).some((part) => part.toLowerCase() === '.git'), 'unsafe-path');
+    stateAssert(await realpath(context.projectRoot) === context.projectRoot, 'unsafe-path');
+    let directory = path.dirname(target);
+    while (true) {
+        const info = await lstat(directory);
+        stateAssert(info.isDirectory() && !info.isSymbolicLink(), 'unsafe-path');
+        if (directory === context.projectRoot)
+            break;
+        const parent = path.dirname(directory);
+        stateAssert(parent !== directory && isUnder(context.projectRoot, parent), 'unsafe-path');
+        directory = parent;
+    }
+    const file = await lstat(target).catch((error) => {
+        if (error.code === 'ENOENT')
+            return null;
+        throw new StateMigrationError('unsafe-path');
+    });
+    stateAssert(!file || (file.isFile() && !file.isSymbolicLink() && file.nlink === 1
+        && (process.platform === 'win32' || ((file.mode & 0o077) === 0 && (process.getuid === undefined || file.uid === process.getuid())))), 'unsafe-path');
+}
+export class FilesystemProtectedArtifactStorage {
+    root;
+    attestor;
+    maxStoredBytes;
+    #context = null;
+    constructor(root, attestor, maxStoredBytes = 768 * 1024 * 1024) {
+        this.root = root;
+        this.attestor = attestor;
+        this.maxStoredBytes = maxStoredBytes;
+    }
+    toJSON() { return { storage: 'protected-external' }; }
+    async assertAvailable(context) {
+        await assertPrivateStatePath(this.root, context, this.attestor, true);
+        this.#context = context;
+    }
+    async filename(id) {
+        stateAssert(artifactId.test(id) && this.#context, 'artifact-integrity');
+        const filename = path.join(this.root, `${id}.sealed`);
+        await assertPrivateStatePath(filename, this.#context, this.attestor, false);
+        return filename;
+    }
+    async durableCreate(filename, bytes) {
+        const file = await open(filename, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 0o600);
+        try {
+            await file.writeFile(bytes);
+            await file.sync();
+        }
+        finally {
+            await file.close();
+        }
+    }
+    async syncDirectory() {
+        if (process.platform === 'win32')
+            return;
+        const directory = await open(this.root, 'r');
+        try {
+            await directory.sync();
+        }
+        finally {
+            await directory.close();
+        }
+    }
+    async allocate(bytes, action) {
+        stateAssert(this.#context, 'protected-workspace-required');
+        await assertPrivateStatePath(this.root, this.#context, this.attestor, true);
+        const guardPath = path.join(this.root, '.liftoff-state-store.guard');
+        const guard = await open(guardPath, 'wx', 0o600).catch(() => { throw new StateMigrationError('lock-unavailable'); });
+        try {
+            let used = 0;
+            let entries = 0;
+            const directories = [this.root];
+            while (directories.length) {
+                const directory = directories.pop();
+                for (const entry of await readdir(directory, { withFileTypes: true })) {
+                    stateAssert(++entries <= 10_000, 'storage-limit');
+                    const filename = path.join(directory, entry.name);
+                    const info = await lstat(filename).catch((error) => {
+                        if (error.code === 'ENOENT')
+                            return null;
+                        throw error;
+                    });
+                    if (!info)
+                        continue;
+                    if (info.isDirectory() && !info.isSymbolicLink())
+                        directories.push(filename);
+                    else
+                        used += info.size;
+                    stateAssert(used + bytes <= this.maxStoredBytes, 'storage-limit');
+                }
+            }
+            await action();
+        }
+        finally {
+            await guard.close();
+            await unlink(guardPath);
+        }
+    }
+    async create(id, bytes) {
+        stateAssert(bytes.byteLength <= this.maxStoredBytes, 'storage-limit');
+        const filename = await this.filename(id);
+        await this.allocate(bytes.byteLength, () => this.durableCreate(filename, bytes));
+        await this.syncDirectory();
+    }
+    async read(id) {
+        const file = await open(await this.filename(id), constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        try {
+            const info = await file.stat();
+            stateAssert(info.isFile() && info.nlink === 1 && info.size <= Math.min(this.maxStoredBytes, 128 * 1024 * 1024 + 4096), 'artifact-integrity');
+            return await file.readFile();
+        }
+        finally {
+            await file.close();
+        }
+    }
+    async guarded(id, previousDigest, action) {
+        const filename = await this.filename(id);
+        const guard = `${filename}.guard`;
+        const lock = await open(guard, 'wx', 0o600).catch(() => { throw new StateMigrationError('lock-unavailable'); });
+        try {
+            stateAssert(stateDigest(await this.read(id)) === previousDigest, 'artifact-integrity');
+            await action(filename);
+            await this.syncDirectory();
+        }
+        finally {
+            await lock.close();
+            await unlink(guard);
+        }
+    }
+    async compareExchange(id, previousDigest, bytes) {
+        stateAssert(bytes.byteLength <= this.maxStoredBytes, 'storage-limit');
+        await this.allocate(bytes.byteLength, () => this.guarded(id, previousDigest, async (filename) => {
+            const staging = path.join(this.root, `${randomUUID()}.sealed`);
+            await this.durableCreate(staging, bytes);
+            try {
+                await rename(staging, filename);
+            }
+            finally {
+                await unlink(staging).catch((error) => { if (error.code !== 'ENOENT')
+                    throw error; });
+            }
+        }));
+    }
+    async remove(id, expectedDigest) {
+        await this.guarded(id, expectedDigest, (filename) => unlink(filename));
+    }
+    async withScratch(context, action) {
+        await this.assertAvailable(context);
+        const directory = path.join(this.root, `native-${randomUUID()}`);
+        await mkdir(directory, { mode: 0o700 });
+        let terminationUnproven = false;
+        try {
+            return await action(directory);
+        }
+        catch (error) {
+            terminationUnproven = error instanceof StateMigrationError && error.code === 'process-tree-termination-unproven';
+            throw error;
+        }
+        finally {
+            if (!terminationUnproven) {
+                await cleanupOwnedStateScratch(directory, async () => {
+                    const info = await lstat(directory);
+                    stateAssert(info.isDirectory() && !info.isSymbolicLink() && await realpath(directory) === directory, 'unsafe-path');
+                    await rm(directory, { recursive: true });
+                });
+            }
+        }
+    }
+}
+export function protectedStateScope(context) {
+    return stateObjectDigest({ projectId: context.projectId, projectRoot: context.projectRoot, hostId: context.hostId });
+}
+//# sourceMappingURL=protected-workspace.js.map