@noopolis/daimon 0.1.1 → 0.2.0

package/dist/runtime/wakeAcceptanceProcessIdentity.js

@@ -0,0 +1,50 @@
+import { readFile, stat } from "node:fs/promises";
+export class WakeTransitionLockBlockedError extends Error {
+    code = "offline_reconciliation_required";
+    constructor() { super("wake transition lock requires offline reconciliation"); }
+}
+export function sameNamespace(left, right) { return left.pid_namespace_dev === right.pid_namespace_dev && left.pid_namespace_ino === right.pid_namespace_ino; }
+export async function currentProcessIdentity() {
+    if (process.platform !== "linux")
+        throw new Error("wake transition locks require Linux process identity");
+    const boot_id = (await readFile("/proc/sys/kernel/random/boot_id", "utf8")).trim();
+    if (!boot_id)
+        throw new Error("wake transition owner identity is invalid");
+    return { pid: process.pid, process_start: await linuxProcessStart(process.pid), boot_id, ...await linuxPidNamespace() };
+}
+export async function processIsAlive(lock) {
+    if (process.platform !== "linux")
+        throw new Error("wake transition lock liveness is unsupported");
+    if (!sameNamespace(lock, await linuxPidNamespace()))
+        throw new WakeTransitionLockBlockedError();
+    const boot = (await readFile("/proc/sys/kernel/random/boot_id", "utf8")).trim();
+    if (!boot)
+        throw new Error("wake transition owner liveness cannot be proven");
+    if (boot !== lock.boot_id)
+        return false;
+    try {
+        return await linuxProcessStart(lock.pid) === lock.process_start;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw new Error("wake transition owner liveness cannot be proven");
+    }
+}
+async function linuxProcessStart(pid) {
+    const stat = await readFile(`/proc/${pid}/stat`, "utf8");
+    const close = stat.lastIndexOf(")");
+    const fields = stat.slice(close + 2).trim().split(/\s+/u);
+    const start = fields[19];
+    if (close < 0 || start === undefined || !/^\d+$/u.test(start))
+        throw new Error("wake transition owner identity is invalid");
+    return start;
+}
+async function linuxPidNamespace() {
+    const identity = await stat("/proc/self/ns/pid");
+    const pid_namespace_dev = Number(identity.dev);
+    const pid_namespace_ino = Number(identity.ino);
+    if (!Number.isSafeInteger(pid_namespace_dev) || !Number.isSafeInteger(pid_namespace_ino) || pid_namespace_dev < 1 || pid_namespace_ino < 1)
+        throw new Error("wake transition owner identity is invalid");
+    return { pid_namespace_dev, pid_namespace_ino };
+}

package/dist/runtime/wakeAcceptanceReconciliation.d.ts

@@ -0,0 +1,211 @@
+import { open } from "node:fs/promises";
+import { type StoreHostRegistration, type StoreHostRegistrationIdentity } from "./storeCoordination.js";
+export declare const OFFLINE_RECONCILIATION_VERSION: "noopolis.daimon.offline-transition-reconciliation.v1";
+export declare const OFFLINE_RECONCILIATION_BLOCKED_CODE: "offline_reconciliation_required";
+declare const RECEIPT_VERSION: "noopolis.daimon.offline-transition-reconciliation-receipt.v1";
+export declare const OFFLINE_RECONCILIATION_REQUEST_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "noopolis.daimon.offline-transition-reconciliation.v1";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["version", "agent_id", "delivery_id", "store", "lock", "attestation"];
+    readonly properties: {
+        readonly version: {
+            readonly const: "noopolis.daimon.offline-transition-reconciliation.v1";
+        };
+        readonly agent_id: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 16384;
+        };
+        readonly delivery_id: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 16384;
+        };
+        readonly store: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["dev", "ino"];
+            readonly properties: {
+                readonly dev: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly ino: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+            };
+        };
+        readonly lock: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["dev", "ino", "owner_id", "generation", "pid", "process_start", "boot_id", "pid_namespace_dev", "pid_namespace_ino"];
+            readonly properties: {
+                readonly dev: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly ino: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly owner_id: {
+                    readonly type: "string";
+                };
+                readonly generation: {
+                    readonly type: "string";
+                };
+                readonly pid: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly process_start: {
+                    readonly type: "string";
+                };
+                readonly boot_id: {
+                    readonly type: "string";
+                };
+                readonly pid_namespace_dev: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly pid_namespace_ino: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+            };
+        };
+        readonly attestation: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["version", "authority_id", "attestation_id", "state", "proof"];
+            readonly properties: {
+                readonly version: {
+                    readonly const: "noopolis.deployment.container-quiescence.v1";
+                };
+                readonly authority_id: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 16384;
+                };
+                readonly attestation_id: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 16384;
+                };
+                readonly state: {
+                    readonly enum: readonly ["absent", "quiescent"];
+                };
+                readonly proof: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 16384;
+                };
+            };
+        };
+    };
+};
+type Identity = Readonly<{
+    dev: number;
+    ino: number;
+}>;
+type Lock = Readonly<{
+    dev: number;
+    ino: number;
+    owner_id: string;
+    generation: string;
+    pid: number;
+    process_start: string;
+    boot_id: string;
+    pid_namespace_dev: number;
+    pid_namespace_ino: number;
+}>;
+type Lease = Readonly<{
+    owner_id: string;
+    pid: number;
+    process_start: string;
+    boot_id: string;
+    pid_namespace_dev: number;
+    pid_namespace_ino: number;
+}>;
+export type OfflineDeploymentAttestation = Readonly<{
+    version: "noopolis.deployment.container-quiescence.v1";
+    authority_id: string;
+    attestation_id: string;
+    state: "absent" | "quiescent";
+    proof: string;
+}>;
+export type OfflineTransitionReconciliationRequest = Readonly<{
+    version: typeof OFFLINE_RECONCILIATION_VERSION;
+    agent_id: string;
+    delivery_id: string;
+    store: Identity;
+    lock: Lock;
+    attestation: OfflineDeploymentAttestation;
+}>;
+export type OfflineTransitionReconciliationAuthorizationContext = Readonly<{
+    version: "noopolis.daimon.offline-transition-authorization-context.v1";
+    deployment_identity: string;
+    deployment_state: "absent" | "quiescent";
+    nonce: string;
+    request_digest: string;
+    agent_id: string;
+    delivery_id: string;
+    store: Identity;
+    lock: Lock;
+    stale_host_registrations: readonly StoreHostRegistrationIdentity[];
+}>;
+export type OfflineTransitionReconciliationProofReceipt = Readonly<{
+    request_digest: string;
+    nonce: string;
+    exclusive_store: true;
+    authorized_registration_digests: readonly string[];
+}>;
+export type OfflineTransitionReconciliationReceipt = Readonly<{
+    version: typeof RECEIPT_VERSION;
+    reconciliation_id: string;
+    request_digest: string;
+    state: "reconciled";
+    reconciled_at: string;
+    cleared_registration_digests: readonly string[];
+}>;
+export type OfflineTransitionReconciliationResult = OfflineTransitionReconciliationReceipt | Readonly<{
+    version: typeof OFFLINE_RECONCILIATION_VERSION;
+    state: "blocked";
+    code: typeof OFFLINE_RECONCILIATION_BLOCKED_CODE;
+}>;
+export type OfflineTransitionReconciliationOptions = Readonly<{
+    storePath: string;
+    verifyDeploymentAttestation: (context: OfflineTransitionReconciliationAuthorizationContext, attestation: OfflineDeploymentAttestation) => Promise<OfflineTransitionReconciliationProofReceipt>;
+    leaseIdentity?: () => Promise<Lease>;
+    leaseLiveness?: (lease: Lease) => Promise<boolean>;
+    hostLiveness?: (host: StoreHostRegistration) => Promise<boolean>;
+}>;
+/** Deployment-only: caller must exclusively mount the private store offline. */
+export declare function reconcileOfflineWakeTransition(value: unknown, options: OfflineTransitionReconciliationOptions): Promise<OfflineTransitionReconciliationResult>;
+export declare function parseOfflineTransitionReconciliationRequest(value: unknown): OfflineTransitionReconciliationRequest;
+export declare class OfflineTransitionReconciliationBlockedError extends Error {
+    readonly code: "offline_reconciliation_required";
+    constructor();
+}
+/** Normal hosts may start only after the durable offline lease is absent. */
+export declare function assertOfflineReconciliationLeaseAvailable(root: string): Promise<void>;
+/**
+ * Publishes `value` at `target` only if `target` does not already exist, and
+ * only ever under complete, fsynced content — the name never appears holding a
+ * partial or zero-byte document, which `readLease` would otherwise accept as a
+ * safe file and then fail to `JSON.parse`.
+ *
+ * `link(2)` is mandatory here and `rename(2)` is FORBIDDEN. rename overwrites
+ * its destination unconditionally, so two acquirers that both pass the
+ * (non-atomic) `readLeaseOptional` pre-check would both publish and both
+ * believe they hold the exclusive offline-reconciliation lease. link fails with
+ * EEXIST when the target exists, which is the mutual exclusion `acquireLease`
+ * converts into a blocked result. Exported solely so that contract can be
+ * asserted directly; it is not re-exported from `./index.ts`.
+ */
+export declare function publishExclusive(target: string, value: unknown, directory: Awaited<ReturnType<typeof open>>): Promise<void>;
+export {};
+//# sourceMappingURL=wakeAcceptanceReconciliation.d.ts.map

package/dist/runtime/wakeAcceptanceReconciliation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wakeAcceptanceReconciliation.d.ts","sourceRoot":"","sources":["../../src/runtime/wakeAcceptanceReconciliation.ts"],"names":[],"mappings":"AAEA,OAAO,EAAe,IAAI,EAA4C,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EAA6E,KAAK,qBAAqB,EAAE,KAAK,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AAEnL,eAAO,MAAM,8BAA8B,EAAG,sDAA+D,CAAC;AAC9G,eAAO,MAAM,mCAAmC,EAAG,iCAA0C,CAAC;AAE9F,QAAA,MAAM,eAAe,EAAG,8DAAuE,CAAC;AAEhG,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQxC,CAAC;AAEX,KAAK,QAAQ,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AACvD,KAAK,IAAI,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AACpM,KAAK,KAAK,GAAG,QAAQ,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AACvJ,MAAM,MAAM,4BAA4B,GAAG,QAAQ,CAAC;IAAE,OAAO,EAAE,6CAA6C,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,GAAG,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAC5M,MAAM,MAAM,sCAAsC,GAAG,QAAQ,CAAC;IAAE,OAAO,EAAE,OAAO,8BAA8B,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,4BAA4B,CAAA;CAAE,CAAC,CAAC;AACjO,MAAM,MAAM,mDAAmD,GAAG,QAAQ,CAAC;IAAE,OAAO,EAAE,6DAA6D,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,QAAQ,GAAG,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,wBAAwB,EAAE,SAAS,6BAA6B,EAAE,CAAA;CAAE,CAAC,CAAC;AAC7Y,MAAM,MAAM,2CAA2C,GAAG,QAAQ,CAAC;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,IAAI,CAAC;IAAC,+BAA+B,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AACzL,MAAM,MAAM,sCAAsC,GAAG,QAAQ,CAAC;IAAE,OAAO,EAAE,OAAO,eAAe,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,YAAY,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,4BAA4B,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AACnP,MAAM,MAAM,qCAAqC,GAAG,sCAAsC,GAAG,QAAQ,CAAC;IAAE,OAAO,EAAE,OAAO,8BAA8B,CAAC;IAAC,KAAK,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,OAAO,mCAAmC,CAAA;CAAE,CAAC,CAAC;AAC9N,MAAM,MAAM,sCAAsC,GAAG,QAAQ,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,2BAA2B,EAAE,CAAC,OAAO,EAAE,mDAAmD,EAAE,WAAW,EAAE,4BAA4B,KAAK,OAAO,CAAC,2CAA2C,CAAC,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,CAAC;AAEjb,gFAAgF;AAChF,wBAAsB,8BAA8B,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,sCAAsC,GAAG,OAAO,CAAC,qCAAqC,CAAC,CAsCpK;AAED,wBAAgB,2CAA2C,CAAC,KAAK,EAAE,OAAO,GAAG,sCAAsC,CAUlH;AAED,qBAAa,2CAA4C,SAAQ,KAAK;IAAG,QAAQ,CAAC,IAAI,oCAAuC;;CAA2E;AACxM,6EAA6E;AAC7E,wBAAsB,yCAAyC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAyJ;AAerP;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAA4L"}

package/dist/runtime/wakeAcceptanceReconciliation.js

@@ -0,0 +1,289 @@
+import { createHash, randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { link, lstat, open, readFile, realpath, rename, stat, unlink } from "node:fs/promises";
+import path from "node:path";
+import { clearDeadHostRegistrations, hostRegistrationDigest, listHostRegistrations } from "./storeCoordination.js";
+export const OFFLINE_RECONCILIATION_VERSION = "noopolis.daimon.offline-transition-reconciliation.v1";
+export const OFFLINE_RECONCILIATION_BLOCKED_CODE = "offline_reconciliation_required";
+const MAX_BYTES = 16_384;
+const RECEIPT_VERSION = "noopolis.daimon.offline-transition-reconciliation-receipt.v1";
+export const OFFLINE_RECONCILIATION_REQUEST_SCHEMA = {
+    $schema: "https://json-schema.org/draft/2020-12/schema", $id: OFFLINE_RECONCILIATION_VERSION, type: "object", additionalProperties: false,
+    required: ["version", "agent_id", "delivery_id", "store", "lock", "attestation"], properties: {
+        version: { const: OFFLINE_RECONCILIATION_VERSION }, agent_id: { type: "string", minLength: 1, maxLength: MAX_BYTES }, delivery_id: { type: "string", minLength: 1, maxLength: MAX_BYTES },
+        store: { type: "object", additionalProperties: false, required: ["dev", "ino"], properties: { dev: { type: "integer", minimum: 1 }, ino: { type: "integer", minimum: 1 } } },
+        lock: { type: "object", additionalProperties: false, required: ["dev", "ino", "owner_id", "generation", "pid", "process_start", "boot_id", "pid_namespace_dev", "pid_namespace_ino"], properties: { dev: { type: "integer", minimum: 1 }, ino: { type: "integer", minimum: 1 }, owner_id: { type: "string" }, generation: { type: "string" }, pid: { type: "integer", minimum: 1 }, process_start: { type: "string" }, boot_id: { type: "string" }, pid_namespace_dev: { type: "integer", minimum: 1 }, pid_namespace_ino: { type: "integer", minimum: 1 } } },
+        attestation: { type: "object", additionalProperties: false, required: ["version", "authority_id", "attestation_id", "state", "proof"], properties: { version: { const: "noopolis.deployment.container-quiescence.v1" }, authority_id: { type: "string", minLength: 1, maxLength: MAX_BYTES }, attestation_id: { type: "string", minLength: 1, maxLength: MAX_BYTES }, state: { enum: ["absent", "quiescent"] }, proof: { type: "string", minLength: 1, maxLength: MAX_BYTES } } }
+    }
+};
+/** Deployment-only: caller must exclusively mount the private store offline. */
+export async function reconcileOfflineWakeTransition(value, options) {
+    try {
+        const request = parseOfflineTransitionReconciliationRequest(value);
+        const root = await openStore(options.storePath, request.store);
+        try {
+            const lease = await acquireLease(root.path, root.directory, await (options.leaseIdentity ?? currentLeaseIdentity)(), options.leaseLiveness ?? leaseIsAlive);
+            if (lease === undefined)
+                return blocked();
+            try {
+                const target = lockPath(root.path, request.agent_id, request.delivery_id);
+                const receiptPath = receiptFile(root.path, request);
+                let receipt = await readReceiptOptional(receiptPath);
+                if (receipt !== undefined && receipt.request_digest !== digest(request))
+                    return blocked();
+                if (receipt?.state === "reconciled")
+                    return publicReceipt(receipt);
+                const context = authorizationContext(request, await listHostRegistrations(root.path));
+                const proof = await options.verifyDeploymentAttestation(context, request.attestation).catch(() => { throw new OfflineTransitionReconciliationBlockedError(); });
+                if (!sameProofReceipt(proof, context))
+                    throw new OfflineTransitionReconciliationBlockedError();
+                const cleared = await clearDeadHostRegistrations(root.path, root.directory, lease, options.hostLiveness ?? leaseIsAlive, new Set(proof.authorized_registration_digests)).catch(() => undefined);
+                if (cleared === undefined)
+                    return blocked();
+                await assertStore(root, request.store);
+                await assertRecord(recordPath(root.path, request.agent_id, request.delivery_id), request);
+                if (receipt === undefined)
+                    receipt = await writeReceipt(receiptPath, { version: RECEIPT_VERSION, reconciliation_id: randomUUID(), request_digest: digest(request), state: "prepared", reconciled_at: "", cleared_registration_digests: [] }, root.directory);
+                const lock = await readLockOptional(target);
+                if (lock !== undefined) {
+                    if (!same(lock, request.lock) || !same(await lstat(target), request.lock))
+                        throw new OfflineTransitionReconciliationBlockedError();
+                    await assertStore(root, request.store);
+                    await assertRecord(recordPath(root.path, request.agent_id, request.delivery_id), request);
+                    await unlink(target);
+                    await root.directory.sync();
+                }
+                const reconciled = { ...receipt, state: "reconciled", reconciled_at: new Date().toISOString(), cleared_registration_digests: uniqueDigests([...receipt.cleared_registration_digests, ...cleared]) };
+                await replaceReceipt(receiptPath, reconciled, root.directory);
+                return publicReceipt(reconciled);
+            }
+            finally {
+                await releaseLease(lease, root.directory, root.path);
+            }
+        }
+        finally {
+            await root.directory.close();
+        }
+    }
+    catch (error) {
+        if (error instanceof OfflineTransitionReconciliationBlockedError)
+            return blocked();
+        throw error;
+    }
+}
+export function parseOfflineTransitionReconciliationRequest(value) {
+    const root = strictRecord(value, ["version", "agent_id", "delivery_id", "store", "lock", "attestation"]);
+    if (text(root.version) !== OFFLINE_RECONCILIATION_VERSION)
+        throw new TypeError("offline reconciliation version is unsupported");
+    const store = strictRecord(root.store, ["dev", "ino"]);
+    const lock = strictRecord(root.lock, ["dev", "ino", "owner_id", "generation", "pid", "process_start", "boot_id", "pid_namespace_dev", "pid_namespace_ino"]);
+    const attestation = strictRecord(root.attestation, ["version", "authority_id", "attestation_id", "state", "proof"]);
+    const state = text(attestation.state);
+    if (text(attestation.version) !== "noopolis.deployment.container-quiescence.v1" || (state !== "absent" && state !== "quiescent"))
+        throw new TypeError("offline reconciliation attestation is invalid");
+    const parsedLock = { dev: positive(lock.dev), ino: positive(lock.ino), owner_id: uuid(lock.owner_id), generation: uuid(lock.generation), pid: positive(lock.pid), process_start: nonBlank(lock.process_start), boot_id: nonBlank(lock.boot_id), pid_namespace_dev: positive(lock.pid_namespace_dev), pid_namespace_ino: positive(lock.pid_namespace_ino) };
+    return { version: OFFLINE_RECONCILIATION_VERSION, agent_id: nonBlank(root.agent_id), delivery_id: nonBlank(root.delivery_id), store: { dev: positive(store.dev), ino: positive(store.ino) }, lock: parsedLock, attestation: { version: "noopolis.deployment.container-quiescence.v1", authority_id: nonBlank(attestation.authority_id), attestation_id: nonBlank(attestation.attestation_id), state, proof: nonBlank(attestation.proof) } };
+}
+export class OfflineTransitionReconciliationBlockedError extends Error {
+    code = OFFLINE_RECONCILIATION_BLOCKED_CODE;
+    constructor() { super("offline transition reconciliation is blocked"); }
+}
+/** Normal hosts may start only after the durable offline lease is absent. */
+export async function assertOfflineReconciliationLeaseAvailable(root) { if (await readLeaseOptional(path.join(root, ".offline-reconciliation.lock")) !== undefined)
+    throw new OfflineTransitionReconciliationBlockedError(); }
+async function openStore(root, expected) {
+    if (!path.isAbsolute(root))
+        throw new OfflineTransitionReconciliationBlockedError();
+    await assertNoLinks(root);
+    const before = await lstat(root);
+    if (!before.isDirectory() || before.isSymbolicLink() || before.uid !== process.getuid?.() || (before.mode & 0o777) !== 0o700 || !same(before, expected))
+        throw new OfflineTransitionReconciliationBlockedError();
+    const directory = await open(root, constants.O_RDONLY | directoryFlag() | noFollow());
+    try {
+        const canonical = await realpath(root);
+        if (!same(await directory.stat(), expected))
+            throw new OfflineTransitionReconciliationBlockedError();
+        return { path: canonical, directory };
+    }
+    catch (error) {
+        await directory.close().catch(() => undefined);
+        throw error;
+    }
+}
+async function assertStore(root, expected) { await assertNoLinks(root.path); if (!same(await lstat(root.path), expected) || !same(await root.directory.stat(), expected) || await realpath(root.path) !== root.path)
+    throw new OfflineTransitionReconciliationBlockedError(); }
+/**
+ * Publishes `value` at `target` only if `target` does not already exist, and
+ * only ever under complete, fsynced content — the name never appears holding a
+ * partial or zero-byte document, which `readLease` would otherwise accept as a
+ * safe file and then fail to `JSON.parse`.
+ *
+ * `link(2)` is mandatory here and `rename(2)` is FORBIDDEN. rename overwrites
+ * its destination unconditionally, so two acquirers that both pass the
+ * (non-atomic) `readLeaseOptional` pre-check would both publish and both
+ * believe they hold the exclusive offline-reconciliation lease. link fails with
+ * EEXIST when the target exists, which is the mutual exclusion `acquireLease`
+ * converts into a blocked result. Exported solely so that contract can be
+ * asserted directly; it is not re-exported from `./index.ts`.
+ */
+export async function publishExclusive(target, value, directory) { const temp = `${target}.${randomUUID()}`; try {
+    await writeNew(temp, value);
+    await link(temp, target);
+    await directory.sync();
+}
+finally {
+    await unlink(temp).catch(() => undefined);
+} }
+async function acquireLease(root, directory, owner, liveness) { const target = path.join(root, ".offline-reconciliation.lock"); const current = await readLeaseOptional(target); if (current !== undefined) {
+    if (!sameNamespace(current, owner) || await liveness(current))
+        return undefined;
+    await unlink(target);
+    await directory.sync();
+} try {
+    await publishExclusive(target, owner, directory);
+    return owner;
+}
+catch (error) {
+    if (error.code === "EEXIST")
+        return undefined;
+    throw error;
+} }
+async function releaseLease(lease, directory, root) { const target = path.join(root, ".offline-reconciliation.lock"); const current = await readLease(target); if (!sameLease(current, lease))
+    throw new OfflineTransitionReconciliationBlockedError(); await unlink(target); await directory.sync(); }
+function lockPath(root, agent, delivery) { return path.join(root, `${createHash("sha256").update(`${agent}\u0000${delivery}`).digest("hex")}.transition-lock`); }
+function recordPath(root, agent, delivery) { return path.join(root, `${createHash("sha256").update(`${agent}\u0000${delivery}`).digest("hex")}.json`); }
+function receiptFile(root, request) { return path.join(root, `.reconcile-${createHash("sha256").update(JSON.stringify({ store: request.store, lock: request.lock })).digest("hex")}.json`); }
+function digest(request) { return createHash("sha256").update(JSON.stringify(request)).digest("hex"); }
+function authorizationContext(request, stale_host_registrations) { return { version: "noopolis.daimon.offline-transition-authorization-context.v1", deployment_identity: request.attestation.authority_id, deployment_state: request.attestation.state, nonce: request.attestation.attestation_id, request_digest: digest({ request, stale_host_registrations }), agent_id: request.agent_id, delivery_id: request.delivery_id, store: request.store, lock: request.lock, stale_host_registrations }; }
+function sameProofReceipt(value, context) { try {
+    const proof = strictRecord(value, ["request_digest", "nonce", "exclusive_store", "authorized_registration_digests"]);
+    return text(proof.request_digest) === context.request_digest && text(proof.nonce) === context.nonce && proof.exclusive_store === true && Array.isArray(proof.authorized_registration_digests) && proof.authorized_registration_digests.every((item) => /^[a-f0-9]{64}$/u.test(text(item))) && proof.authorized_registration_digests.every((item) => context.stale_host_registrations.some((host) => hostRegistrationDigest(host) === item));
+}
+catch {
+    return false;
+} }
+async function readLock(file) { const entry = await lstat(file); if (!safeFile(entry))
+    throw new OfflineTransitionReconciliationBlockedError(); const value = strictRecord(JSON.parse((await readFile(file)).toString("utf8")), ["owner_id", "generation", "pid", "process_start", "boot_id", "pid_namespace_dev", "pid_namespace_ino"]); return { dev: Number(entry.dev), ino: Number(entry.ino), owner_id: uuid(value.owner_id), generation: uuid(value.generation), pid: positive(value.pid), process_start: nonBlank(value.process_start), boot_id: nonBlank(value.boot_id), pid_namespace_dev: positive(value.pid_namespace_dev), pid_namespace_ino: positive(value.pid_namespace_ino) }; }
+async function readLease(file) { const entry = await lstat(file); if (!safeFile(entry))
+    throw new OfflineTransitionReconciliationBlockedError(); const value = strictRecord(JSON.parse((await readFile(file)).toString("utf8")), ["owner_id", "pid", "process_start", "boot_id", "pid_namespace_dev", "pid_namespace_ino"]); return { owner_id: uuid(value.owner_id), pid: positive(value.pid), process_start: nonBlank(value.process_start), boot_id: nonBlank(value.boot_id), pid_namespace_dev: positive(value.pid_namespace_dev), pid_namespace_ino: positive(value.pid_namespace_ino) }; }
+async function readLeaseOptional(file) { try {
+    return await readLease(file);
+}
+catch (error) {
+    if (error.code === "ENOENT")
+        return undefined;
+    throw error;
+} }
+async function readLockOptional(file) { try {
+    return await readLock(file);
+}
+catch (error) {
+    if (error.code === "ENOENT")
+        return undefined;
+    throw error;
+} }
+async function assertRecord(file, request) { const entry = await lstat(file).catch(() => { throw new OfflineTransitionReconciliationBlockedError(); }); if (!safeFile(entry))
+    throw new OfflineTransitionReconciliationBlockedError(); const value = JSON.parse((await readFile(file)).toString("utf8")); if (value === null || typeof value !== "object" || Array.isArray(value))
+    throw new OfflineTransitionReconciliationBlockedError(); const record = value; if (record.agent_id !== request.agent_id || record.delivery_id !== request.delivery_id)
+    throw new OfflineTransitionReconciliationBlockedError(); }
+async function readReceiptOptional(file) { try {
+    const entry = await lstat(file);
+    if (!safeFile(entry))
+        throw new OfflineTransitionReconciliationBlockedError();
+    const value = strictRecord(JSON.parse((await readFile(file)).toString("utf8")), ["version", "reconciliation_id", "request_digest", "state", "reconciled_at", "cleared_registration_digests"]);
+    const state = text(value.state);
+    const cleared_registration_digests = digests(value.cleared_registration_digests);
+    if (text(value.version) !== RECEIPT_VERSION || (state !== "prepared" && state !== "reconciled") || !/^[a-f0-9]{64}$/u.test(text(value.request_digest)))
+        throw new OfflineTransitionReconciliationBlockedError();
+    const receipt = { version: RECEIPT_VERSION, reconciliation_id: uuid(value.reconciliation_id), request_digest: text(value.request_digest), state, reconciled_at: text(value.reconciled_at), cleared_registration_digests };
+    if (state === "prepared" && receipt.reconciled_at)
+        throw new OfflineTransitionReconciliationBlockedError();
+    if (state === "reconciled" && !receipt.reconciled_at)
+        throw new OfflineTransitionReconciliationBlockedError();
+    return receipt;
+}
+catch (error) {
+    if (error.code === "ENOENT")
+        return undefined;
+    throw error;
+} }
+async function writeReceipt(target, receipt, directory) { const temp = `${target}.${randomUUID()}`; try {
+    await writeNew(temp, receipt);
+    await link(temp, target);
+    await directory.sync();
+    return receipt;
+}
+catch (error) {
+    if (error.code === "EEXIST")
+        throw new OfflineTransitionReconciliationBlockedError();
+    throw error;
+}
+finally {
+    await unlink(temp).catch(() => undefined);
+} }
+async function replaceReceipt(target, receipt, directory) { const temp = `${target}.${randomUUID()}`; try {
+    await writeNew(temp, receipt);
+    await rename(temp, target);
+    await directory.sync();
+}
+finally {
+    await unlink(temp).catch(() => undefined);
+} }
+async function writeNew(file, value) { const handle = await open(file, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | noFollow(), 0o600); try {
+    await handle.writeFile(JSON.stringify(value));
+    await handle.sync();
+}
+finally {
+    await handle.close();
+} }
+function publicReceipt(receipt) { return receipt; }
+function blocked() { return { version: OFFLINE_RECONCILIATION_VERSION, state: "blocked", code: OFFLINE_RECONCILIATION_BLOCKED_CODE }; }
+function strictRecord(value, keys) { if (value === null || typeof value !== "object" || Array.isArray(value) || (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null))
+    throw new TypeError("offline reconciliation request is invalid"); const result = Object.create(null); for (const key of Reflect.ownKeys(value)) {
+    if (typeof key !== "string")
+        throw new TypeError("offline reconciliation request is invalid");
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (descriptor === undefined || !descriptor.enumerable || !("value" in descriptor))
+        throw new TypeError("offline reconciliation request is invalid");
+    result[key] = descriptor.value;
+} if (Object.keys(result).length !== keys.length || keys.some((key) => !Object.hasOwn(result, key)))
+    throw new TypeError("offline reconciliation request is invalid"); return result; }
+function text(value) { if (typeof value !== "string" || Buffer.byteLength(value, "utf8") > MAX_BYTES)
+    throw new TypeError("offline reconciliation request is invalid"); return value; }
+function nonBlank(value) { const result = text(value); if (!result.trim())
+    throw new TypeError("offline reconciliation request is invalid"); return result; }
+function uuid(value) { const result = nonBlank(value); if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(result))
+    throw new TypeError("offline reconciliation request is invalid"); return result; }
+function positive(value) { if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1)
+    throw new TypeError("offline reconciliation request is invalid"); return value; }
+function digests(value) { if (!Array.isArray(value) || value.length > 128 || value.some((item) => !/^[a-f0-9]{64}$/u.test(text(item))))
+    throw new OfflineTransitionReconciliationBlockedError(); return uniqueDigests(value); }
+function uniqueDigests(values) { return [...new Set(values)].sort(); }
+function same(left, right) { return Number(left.dev) === right.dev && Number(left.ino) === right.ino; }
+function sameNamespace(left, right) { return left.pid_namespace_dev === right.pid_namespace_dev && left.pid_namespace_ino === right.pid_namespace_ino; }
+function sameLease(left, right) { return left.owner_id === right.owner_id && left.pid === right.pid && left.process_start === right.process_start && left.boot_id === right.boot_id && sameNamespace(left, right); }
+function safeFile(entry) { return entry.isFile() && !entry.isSymbolicLink() && Number(entry.uid) === process.getuid?.() && (Number(entry.mode) & 0o777) === 0o600 && Number(entry.size) <= MAX_BYTES; }
+function noFollow() { return constants.O_NOFOLLOW ?? 0; }
+function directoryFlag() { return constants.O_DIRECTORY ?? 0; }
+async function assertNoLinks(target) { let current = path.parse(target).root; for (const part of path.relative(current, target).split(path.sep).filter(Boolean)) {
+    current = path.join(current, part);
+    if ((await lstat(current)).isSymbolicLink() && current !== "/var")
+        throw new OfflineTransitionReconciliationBlockedError();
+} }
+async function currentLeaseIdentity() { if (process.platform !== "linux")
+    throw new OfflineTransitionReconciliationBlockedError(); const boot_id = (await readFile("/proc/sys/kernel/random/boot_id", "utf8")).trim(); const namespace = await stat("/proc/self/ns/pid"); const process_start = await linuxProcessStart(process.pid); if (!boot_id || !Number.isSafeInteger(Number(namespace.dev)) || !Number.isSafeInteger(Number(namespace.ino)))
+    throw new OfflineTransitionReconciliationBlockedError(); return { owner_id: randomUUID(), pid: process.pid, process_start, boot_id, pid_namespace_dev: Number(namespace.dev), pid_namespace_ino: Number(namespace.ino) }; }
+async function leaseIsAlive(lease) { if (process.platform !== "linux")
+    throw new OfflineTransitionReconciliationBlockedError(); const namespace = await stat("/proc/self/ns/pid"); if (!sameNamespace(lease, { pid_namespace_dev: Number(namespace.dev), pid_namespace_ino: Number(namespace.ino) }))
+    throw new OfflineTransitionReconciliationBlockedError(); const boot = (await readFile("/proc/sys/kernel/random/boot_id", "utf8")).trim(); if (!boot)
+    throw new OfflineTransitionReconciliationBlockedError(); if (boot !== lease.boot_id)
+    return false; try {
+    return await linuxProcessStart(lease.pid) === lease.process_start;
+}
+catch (error) {
+    if (error.code === "ENOENT")
+        return false;
+    throw new OfflineTransitionReconciliationBlockedError();
+} }
+async function linuxProcessStart(pid) { const statText = await readFile(`/proc/${pid}/stat`, "utf8"); const close = statText.lastIndexOf(")"); const start = statText.slice(close + 2).trim().split(/\s+/u)[19]; if (close < 0 || start === undefined || !/^\d+$/u.test(start))
+    throw new OfflineTransitionReconciliationBlockedError(); return start; }

package/dist/runtime/wakeAcceptanceRecord.d.ts

@@ -0,0 +1,23 @@
+import { type OrganizationRuntimeWakeAcceptance, type OrganizationRuntimeWakeAcceptanceRequest, type OrganizationRuntimeWakeReceiptStatus, type WakeReceiptCode, type WakeReceiptState } from "./wakeAcceptanceTypes.js";
+export type StoredWakeAcceptanceRecord = Readonly<{
+    acceptance_id: string;
+    agent_id: string;
+    delivery_id: string;
+    request_digest: string;
+    event: OrganizationRuntimeWakeAcceptanceRequest["event"];
+    state: WakeReceiptState;
+    accepted_at: string;
+    updated_at: string;
+    claim_generation?: string;
+    execution_id?: string;
+    deferred?: boolean;
+    execution_error?: string;
+    code?: WakeReceiptCode;
+    text?: string;
+}>;
+export declare function publicAcceptance(record: StoredWakeAcceptanceRecord): OrganizationRuntimeWakeAcceptance;
+export declare function publicStatus(record: StoredWakeAcceptanceRecord): OrganizationRuntimeWakeReceiptStatus;
+export declare function parseStoredWakeAcceptance(value: unknown): StoredWakeAcceptanceRecord;
+/** Private failure diagnostic, surfaced through the existing availability error. */
+export declare function sanitizeExecutionError(value: string): string;
+//# sourceMappingURL=wakeAcceptanceRecord.d.ts.map

package/dist/runtime/wakeAcceptanceRecord.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wakeAcceptanceRecord.d.ts","sourceRoot":"","sources":["../../src/runtime/wakeAcceptanceRecord.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,iCAAiC,EACtC,KAAK,wCAAwC,EAC7C,KAAK,oCAAoC,EACzC,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAEtB,MAAM,0BAA0B,CAAC;AAElC,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAChD,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IACrF,KAAK,EAAE,wCAAwC,CAAC,OAAO,CAAC,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAC;IAClF,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,eAAe,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CAChL,CAAC,CAAC;AAEH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,0BAA0B,GAAG,iCAAiC,CAEtG;AACD,wBAAgB,YAAY,CAAC,MAAM,EAAE,0BAA0B,GAAG,oCAAoC,CAErG;AACD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,0BAA0B,CA0BpF;AAMD,oFAAoF;AACpF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5D"}