@nowcrew/daemon 0.6.88-beta.14 → 0.6.88-beta.16

package/dist/storage-copy.js

@@ -1,628 +0,0 @@
-import { createHash } from "node:crypto";
-import { constants } from "node:fs";
-import { lstat, realpath, rename, } from "node:fs/promises";
-import { dirname, isAbsolute, relative, resolve } from "node:path";
-import { readStorageManifestChunks, storageManifestChunkSequenceSeed, storageManifestChunkSequenceStep, } from "./storage-manifest.js";
-import { containsStorageCredentialMaterial } from "./storage-credential-guard.js";
-import { chmodAnchoredDirectory, createAnchoredFile, createAnchoredSymlink, ensureAnchoredDirectory, inspectAnchoredEntry, openAnchoredFile, readAnchoredDirectory, removeAnchoredEntry, } from "./storage-safe-fs.js";
-export const REDACTED_STORAGE_TOKEN = "[REDACTED: historical generic_sk credential removed during NOWWORK_HOME migration]";
-const WORKSPACE_DIRECTORIES = ["agent-items", "daemon", "repos", "suite-tools"];
-const LIVE_LIKE_TOKEN = /(?:bearer[ \t]+[a-z0-9._~-]{20,}|sk-[a-z0-9_-]{20,}|AKIA[0-9A-Z]{16})/giu;
-const MAX_TRANSFORM_FILE_BYTES = 8 * 1024 * 1024;
-const CREDENTIAL_SCAN_OVERLAP_BYTES = 4 * 1024;
-const FILE_OPERATION_CONCURRENCY = 8;
-const MAX_DESTINATION_INDEX_ENTRIES = 2_000_000;
-function containedPath(root, logicalPath) {
-    if (logicalPath.length === 0 || isAbsolute(logicalPath) || logicalPath.includes("\0")
-        || logicalPath.includes("\n") || logicalPath.includes("\r")) {
-        throw new Error(`unsafe logical migration path: ${logicalPath}`);
-    }
-    const target = resolve(root, logicalPath);
-    const child = relative(root, target);
-    if (child === "" || child.startsWith("..") || isAbsolute(child)) {
-        throw new Error(`logical migration path escapes staging: ${logicalPath}`);
-    }
-    return target;
-}
-function sourcePath(input) {
-    const root = input.sourceRoots[input.entry.sourceKind];
-    if (root === undefined)
-        throw new Error(`missing source root: ${input.entry.sourceKind}`);
-    return containedPath(root, input.entry.sourcePath);
-}
-/**
- * Chunk-backed manifests intentionally carry an empty `entries` array. Read and
- * authenticate their persisted chunks before any target mutation so all copy,
- * verify, and reconcile paths observe the same complete manifest.
- */
-async function* iterateManifestEntries(manifest) {
-    if (manifest.chunkStore === undefined) {
-        yield* manifest.entries;
-        return;
-    }
-    if (manifest.entries.length !== 0 || manifest.chunkStore.migrationId !== manifest.migrationId) {
-        throw new Error("storage manifest chunk store identity is inconsistent");
-    }
-    let sequenceDigest = storageManifestChunkSequenceSeed({
-        migrationId: manifest.migrationId,
-        environment: manifest.environment,
-        workspaceId: manifest.workspaceId,
-        targetWorkspaceRoot: manifest.targetWorkspaceRoot,
-        sourceKinds: manifest.sourceKinds,
-    });
-    for await (const chunk of readStorageManifestChunks(manifest.chunkStore)) {
-        sequenceDigest = storageManifestChunkSequenceStep(sequenceDigest, chunk.digest);
-        for (const entry of chunk.entries)
-            yield entry;
-    }
-    if (sequenceDigest !== manifest.chunkStore.sequenceDigest) {
-        throw new Error("storage manifest chunk sequence digest mismatch");
-    }
-}
-async function exists(path) {
-    try {
-        await lstat(path);
-        return true;
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return false;
-        throw error;
-    }
-}
-async function copyVerifiedFile(source, target, stagingWorkspaceRoot, entry, replaceExisting, afterSourceLstat, afterTargetParentOpen, assertHealthy) {
-    assertHealthy?.();
-    if (entry.sha256 === undefined)
-        throw new Error(`manifest file digest is missing: ${source}`);
-    const sourceHandle = await openAnchoredFile(source, constants.O_RDONLY).catch((error) => {
-        throw new Error(`migration source cannot be opened without following links: ${entry.sourcePath}`, { cause: error });
-    });
-    try {
-        const opened = await sourceHandle.stat();
-        if (!opened.isFile())
-            throw new Error(`migration source is no longer a file: ${entry.sourcePath}`);
-        await afterSourceLstat?.(source);
-        let sourceAfterHook;
-        try {
-            sourceAfterHook = inspectAnchoredEntry(dirname(source), source);
-        }
-        catch (error) {
-            throw new Error(`migration source changed before copy: ${entry.sourcePath}`, { cause: error });
-        }
-        if (sourceAfterHook.kind !== "file" || sourceAfterHook.stats.dev !== opened.dev
-            || sourceAfterHook.stats.ino !== opened.ino) {
-            throw new Error(`migration source changed before copy: ${entry.sourcePath}`);
-        }
-        if (replaceExisting)
-            removeReplaceableTarget(stagingWorkspaceRoot, target, entry.logicalDestination ?? entry.sourcePath);
-        const targetHandle = await createAnchoredFile(stagingWorkspaceRoot, target, 0o600, afterTargetParentOpen).catch((error) => {
-            throw new Error(`migration target cannot be opened without following links: ${entry.logicalDestination}`, { cause: error });
-        });
-        const targetOpened = await targetHandle.stat();
-        const digest = createHash("sha256");
-        const sourceStream = sourceHandle.createReadStream({ autoClose: false });
-        try {
-            for await (const rawChunk of sourceStream) {
-                assertHealthy?.();
-                const chunk = Buffer.from(rawChunk);
-                digest.update(chunk);
-                await targetHandle.write(chunk, 0, chunk.length, null);
-            }
-            assertHealthy?.();
-            await targetHandle.sync();
-            await targetHandle.chmod(Number.parseInt(entry.mode, 8));
-        }
-        finally {
-            await targetHandle.close();
-        }
-        const after = await sourceHandle.stat();
-        const sourceCurrent = inspectAnchoredEntry(dirname(source), source);
-        if (opened.dev !== after.dev || opened.ino !== after.ino || opened.size !== after.size
-            || opened.mtimeMs !== after.mtimeMs || digest.digest("hex") !== entry.sha256
-            || sourceCurrent.kind !== "file" || sourceCurrent.stats.dev !== opened.dev
-            || sourceCurrent.stats.ino !== opened.ino) {
-            throw new Error(`source digest mismatch: ${source}`);
-        }
-        let targetCurrent;
-        try {
-            targetCurrent = inspectAnchoredEntry(stagingWorkspaceRoot, target);
-        }
-        catch (error) {
-            throw new Error(`migration target changed while copying: ${entry.logicalDestination}`, { cause: error });
-        }
-        if (targetCurrent.kind !== "file" || targetCurrent.stats.dev !== targetOpened.dev
-            || targetCurrent.stats.ino !== targetOpened.ino) {
-            throw new Error(`migration target changed while copying: ${entry.logicalDestination}`);
-        }
-    }
-    finally {
-        await sourceHandle.close();
-    }
-}
-async function createSafeDirectory(root, target) {
-    try {
-        ensureAnchoredDirectory(root, target, 0o700);
-    }
-    catch (error) {
-        throw new Error(`migration target ancestor is a symbolic link or non-directory: ${target}`, { cause: error });
-    }
-}
-async function createSafeParent(root, path) {
-    await createSafeDirectory(root, dirname(path));
-}
-function removeReplaceableTarget(root, path, logicalDestination) {
-    try {
-        const existing = inspectAnchoredEntry(root, path);
-        if (existing.kind === "symlink") {
-            throw new Error(`migration target is a symbolic link: ${logicalDestination}`);
-        }
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return;
-        throw new Error(`migration target ancestor is a symbolic link or non-directory: ${logicalDestination}`, { cause: error });
-    }
-    removeAnchoredEntry(root, path);
-}
-async function assertRealpathWithin(root, candidate, message) {
-    const [canonicalRoot, canonicalCandidate] = await Promise.all([realpath(root), realpath(candidate)]);
-    const child = relative(canonicalRoot, canonicalCandidate);
-    if (child.startsWith("..") || isAbsolute(child))
-        throw new Error(message);
-}
-async function mapInBatches(items, concurrency, operation) {
-    const results = [];
-    for (let offset = 0; offset < items.length; offset += concurrency) {
-        results.push(...await Promise.all(items.slice(offset, offset + concurrency).map(operation)));
-    }
-    return results;
-}
-async function transformFile(source, target, stagingWorkspaceRoot, entry, replaceExisting, afterSourceLstat, afterTargetParentOpen, assertHealthy) {
-    assertHealthy?.();
-    if (entry.sha256 === undefined)
-        throw new Error(`manifest file digest is missing: ${source}`);
-    const sourceHandle = await openAnchoredFile(source, constants.O_RDONLY).catch((error) => {
-        throw new Error(`migration source cannot be opened without following links: ${entry.sourcePath}`, { cause: error });
-    });
-    let input;
-    try {
-        const opened = await sourceHandle.stat();
-        if (!opened.isFile())
-            throw new Error(`migration source is no longer a file: ${entry.sourcePath}`);
-        await afterSourceLstat?.(source);
-        let sourceAfterHook;
-        try {
-            sourceAfterHook = inspectAnchoredEntry(dirname(source), source);
-        }
-        catch (error) {
-            throw new Error(`migration source changed before transform: ${entry.sourcePath}`, { cause: error });
-        }
-        if (sourceAfterHook.kind !== "file" || sourceAfterHook.stats.dev !== opened.dev
-            || sourceAfterHook.stats.ino !== opened.ino) {
-            throw new Error(`migration source changed before transform: ${entry.sourcePath}`);
-        }
-        if (opened.size > MAX_TRANSFORM_FILE_BYTES) {
-            throw new Error(`target transformation source exceeds bounded size: ${entry.sourcePath}`);
-        }
-        input = await sourceHandle.readFile("utf8");
-        const after = await sourceHandle.stat();
-        const sourceCurrent = inspectAnchoredEntry(dirname(source), source);
-        if (opened.dev !== after.dev || opened.ino !== after.ino || opened.size !== after.size
-            || opened.mtimeMs !== after.mtimeMs || createHash("sha256").update(input).digest("hex") !== entry.sha256
-            || sourceCurrent.kind !== "file" || sourceCurrent.stats.dev !== opened.dev
-            || sourceCurrent.stats.ino !== opened.ino) {
-            throw new Error(`source digest mismatch: ${source}`);
-        }
-    }
-    finally {
-        await sourceHandle.close();
-    }
-    const output = input.replaceAll(LIVE_LIKE_TOKEN, REDACTED_STORAGE_TOKEN);
-    if (output === input || LIVE_LIKE_TOKEN.test(output))
-        throw new Error(`target transformation did not remove live-like tokens: ${entry.sourcePath}`);
-    LIVE_LIKE_TOKEN.lastIndex = 0;
-    if (entry.targetSha256 === undefined || createHash("sha256").update(output).digest("hex") !== entry.targetSha256) {
-        throw new Error(`transformed target digest mismatch: ${entry.sourcePath}`);
-    }
-    if (replaceExisting)
-        removeReplaceableTarget(stagingWorkspaceRoot, target, entry.logicalDestination ?? entry.sourcePath);
-    const targetHandle = await createAnchoredFile(stagingWorkspaceRoot, target, 0o600, afterTargetParentOpen).catch((error) => {
-        throw new Error(`migration target cannot be opened without following links: ${entry.logicalDestination}`, { cause: error });
-    });
-    const targetOpened = await targetHandle.stat();
-    try {
-        assertHealthy?.();
-        await targetHandle.writeFile(output, "utf8");
-        await targetHandle.sync();
-        await targetHandle.chmod(Number.parseInt(entry.targetMode ?? "0600", 8));
-    }
-    finally {
-        await targetHandle.close();
-    }
-    let targetCurrent;
-    try {
-        targetCurrent = inspectAnchoredEntry(stagingWorkspaceRoot, target);
-    }
-    catch (error) {
-        throw new Error(`migration target changed while transforming: ${entry.logicalDestination}`, { cause: error });
-    }
-    if (targetCurrent.kind !== "file" || targetCurrent.stats.dev !== targetOpened.dev
-        || targetCurrent.stats.ino !== targetOpened.ino) {
-        throw new Error(`migration target changed while transforming: ${entry.logicalDestination}`);
-    }
-    return Buffer.byteLength(output);
-}
-async function materializeChunkedManifest(input, injected) {
-    injected.assertHealthy?.();
-    if (await exists(input.stagingWorkspaceRoot)) {
-        if (!(await lstat(input.stagingWorkspaceRoot)).isDirectory()
-            || (!input.mergeIntoExisting
-                && (await readAnchoredDirectory(input.stagingWorkspaceRoot, input.stagingWorkspaceRoot)).length > 0)) {
-            throw new Error("staging collision: staging workspace root is not empty");
-        }
-    }
-    else {
-        ensureAnchoredDirectory(dirname(input.stagingWorkspaceRoot), input.stagingWorkspaceRoot, 0o700);
-    }
-    let createdDirectories = 0;
-    for (const directory of WORKSPACE_DIRECTORIES) {
-        await createSafeDirectory(input.stagingWorkspaceRoot, containedPath(input.stagingWorkspaceRoot, directory));
-        createdDirectories += 1;
-    }
-    let copiedFiles = 0;
-    let transformedFiles = 0;
-    let copiedSymlinks = 0;
-    let bytesWritten = 0;
-    let pending = [];
-    const flushFiles = async () => {
-        if (pending.length === 0)
-            return;
-        const batch = pending;
-        pending = [];
-        injected.assertHealthy?.();
-        const results = await mapInBatches(batch, FILE_OPERATION_CONCURRENCY, async (entry) => {
-            injected.assertHealthy?.();
-            const target = containedPath(input.stagingWorkspaceRoot, entry.logicalDestination);
-            const source = sourcePath({ sourceRoots: input.sourceRoots, entry });
-            if (entry.disposition === "transform") {
-                return { transformed: true, bytesWritten: await transformFile(source, target, input.stagingWorkspaceRoot, entry, input.mergeIntoExisting === true, injected.afterSourceLstat, injected.afterTargetParentOpen, injected.assertHealthy) };
-            }
-            await copyVerifiedFile(source, target, input.stagingWorkspaceRoot, entry, input.mergeIntoExisting === true, injected.afterSourceLstat, injected.afterTargetParentOpen, injected.assertHealthy);
-            return { transformed: false, bytesWritten: entry.sizeBytes };
-        });
-        for (const result of results) {
-            if (result.transformed)
-                transformedFiles += 1;
-            else
-                copiedFiles += 1;
-            bytesWritten += result.bytesWritten;
-        }
-    };
-    for await (const entry of iterateManifestEntries(input.manifest)) {
-        injected.assertHealthy?.();
-        if (entry.disposition === "skip" || entry.logicalDestination === null)
-            continue;
-        const target = containedPath(input.stagingWorkspaceRoot, entry.logicalDestination);
-        if (entry.type === "directory") {
-            await createSafeDirectory(input.stagingWorkspaceRoot, target);
-            createdDirectories += 1;
-        }
-        else if (entry.type === "file") {
-            pending.push(entry);
-            if (pending.length >= 64)
-                await flushFiles();
-        }
-        else if (entry.type !== "symlink") {
-            throw new Error(`unsupported copied manifest entry: ${entry.sourcePath}`);
-        }
-    }
-    await flushFiles();
-    for await (const entry of iterateManifestEntries(input.manifest)) {
-        injected.assertHealthy?.();
-        if (entry.disposition === "skip" || entry.logicalDestination === null || entry.type !== "symlink")
-            continue;
-        if (entry.link?.classification !== "internal" || !entry.link.portable || entry.link.relativeTarget === undefined)
-            throw new Error(`manifest contains a non-portable copied symlink: ${entry.sourcePath}`);
-        const target = containedPath(input.stagingWorkspaceRoot, entry.logicalDestination);
-        await createSafeParent(input.stagingWorkspaceRoot, target);
-        if (input.mergeIntoExisting)
-            removeReplaceableTarget(input.stagingWorkspaceRoot, target, entry.logicalDestination);
-        createAnchoredSymlink(input.stagingWorkspaceRoot, target, entry.link.relativeTarget);
-        await assertRealpathWithin(input.stagingWorkspaceRoot, target, `staged symlink escapes workspace: ${entry.sourcePath}`);
-        copiedSymlinks += 1;
-    }
-    for await (const entry of iterateManifestEntries(input.manifest)) {
-        injected.assertHealthy?.();
-        if (entry.disposition === "skip" || entry.logicalDestination === null || entry.type !== "directory")
-            continue;
-        chmodAnchoredDirectory(input.stagingWorkspaceRoot, containedPath(input.stagingWorkspaceRoot, entry.logicalDestination), Number.parseInt(entry.mode, 8));
-    }
-    return Object.freeze({ copiedFiles, transformedFiles, copiedSymlinks, createdDirectories, bytesWritten });
-}
-export async function materializeStorageManifest(input, injected = {}) {
-    injected.assertHealthy?.();
-    if (input.manifest.chunkStore !== undefined)
-        return materializeChunkedManifest(input, injected);
-    const manifest = input.manifest;
-    if (await exists(input.stagingWorkspaceRoot)) {
-        if (!(await lstat(input.stagingWorkspaceRoot)).isDirectory()
-            || (!input.mergeIntoExisting
-                && (await readAnchoredDirectory(input.stagingWorkspaceRoot, input.stagingWorkspaceRoot)).length > 0)) {
-            throw new Error("staging collision: staging workspace root is not empty");
-        }
-    }
-    else {
-        ensureAnchoredDirectory(dirname(input.stagingWorkspaceRoot), input.stagingWorkspaceRoot, 0o700);
-    }
-    let createdDirectories = 0;
-    for (const directory of WORKSPACE_DIRECTORIES) {
-        const path = containedPath(input.stagingWorkspaceRoot, directory);
-        await createSafeDirectory(input.stagingWorkspaceRoot, path);
-        createdDirectories += 1;
-    }
-    const directoryModes = [];
-    const symlinks = [];
-    const files = [];
-    for (const entry of manifest.entries) {
-        if (entry.disposition === "skip" || entry.logicalDestination === null)
-            continue;
-        const target = containedPath(input.stagingWorkspaceRoot, entry.logicalDestination);
-        if (entry.type === "directory") {
-            await createSafeDirectory(input.stagingWorkspaceRoot, target);
-            directoryModes.push({ path: target, mode: Number.parseInt(entry.mode, 8) });
-            createdDirectories += 1;
-            continue;
-        }
-        if (entry.type === "file") {
-            files.push(entry);
-            continue;
-        }
-        if (entry.type === "symlink") {
-            if (entry.link?.classification !== "internal" || !entry.link.portable || entry.link.relativeTarget === undefined) {
-                throw new Error(`manifest contains a non-portable copied symlink: ${entry.sourcePath}`);
-            }
-            symlinks.push({ entry, target });
-            continue;
-        }
-        throw new Error(`unsupported copied manifest entry: ${entry.sourcePath}`);
-    }
-    const fileResults = await mapInBatches(files, FILE_OPERATION_CONCURRENCY, async (entry) => {
-        injected.assertHealthy?.();
-        const target = containedPath(input.stagingWorkspaceRoot, entry.logicalDestination);
-        const source = sourcePath({ sourceRoots: input.sourceRoots, entry });
-        if (entry.disposition === "transform") {
-            return {
-                transformed: true,
-                bytesWritten: await transformFile(source, target, input.stagingWorkspaceRoot, entry, input.mergeIntoExisting === true, injected.afterSourceLstat, injected.afterTargetParentOpen, injected.assertHealthy),
-            };
-        }
-        await copyVerifiedFile(source, target, input.stagingWorkspaceRoot, entry, input.mergeIntoExisting === true, injected.afterSourceLstat, injected.afterTargetParentOpen, injected.assertHealthy);
-        return { transformed: false, bytesWritten: entry.sizeBytes };
-    });
-    for (const { entry, target } of symlinks) {
-        injected.assertHealthy?.();
-        await createSafeParent(input.stagingWorkspaceRoot, target);
-        if (input.mergeIntoExisting)
-            removeReplaceableTarget(input.stagingWorkspaceRoot, target, entry.logicalDestination ?? entry.sourcePath);
-        createAnchoredSymlink(input.stagingWorkspaceRoot, target, entry.link.relativeTarget);
-    }
-    for (const { entry, target } of symlinks) {
-        injected.assertHealthy?.();
-        await assertRealpathWithin(input.stagingWorkspaceRoot, target, `staged symlink escapes workspace: ${entry.sourcePath}`);
-    }
-    directoryModes.sort((left, right) => right.path.length - left.path.length);
-    for (const directory of directoryModes) {
-        injected.assertHealthy?.();
-        chmodAnchoredDirectory(input.stagingWorkspaceRoot, directory.path, directory.mode);
-    }
-    const transformedFiles = fileResults.filter((result) => result.transformed).length;
-    return Object.freeze({
-        copiedFiles: fileResults.length - transformedFiles,
-        transformedFiles,
-        copiedSymlinks: symlinks.length,
-        createdDirectories,
-        bytesWritten: fileResults.reduce((total, result) => total + result.bytesWritten, 0),
-    });
-}
-function copiedEntries(manifest) {
-    return new Map(manifest.entries
-        .filter((entry) => entry.disposition !== "skip" && entry.logicalDestination !== null)
-        .map((entry) => [entry.logicalDestination, entry]));
-}
-async function collectChunkDestinations(manifest) {
-    const destinations = new Set();
-    for await (const entry of iterateManifestEntries(manifest)) {
-        if (entry.disposition === "skip" || entry.logicalDestination === null)
-            continue;
-        destinations.add(entry.logicalDestination);
-        if (destinations.size > MAX_DESTINATION_INDEX_ENTRIES)
-            throw new Error("storage destination index entry limit exceeded");
-    }
-    return destinations;
-}
-async function pruneStaleChunkPaths(root, destinations) {
-    const walk = async (directory) => {
-        let retained = false;
-        for (const name of await readAnchoredDirectory(root, directory)) {
-            const child = resolve(directory, name);
-            const logical = relative(root, child).replaceAll("\\", "/");
-            const current = inspectAnchoredEntry(root, child);
-            if (current.kind === "directory") {
-                const childRetained = await walk(child);
-                if (!childRetained && !destinations.has(logical))
-                    removeAnchoredEntry(root, child);
-                else
-                    retained = true;
-            }
-            else if (destinations.has(logical)) {
-                retained = true;
-            }
-            else {
-                removeAnchoredEntry(root, child);
-            }
-        }
-        return retained || destinations.has(relative(root, directory).replaceAll("\\", "/"));
-    };
-    for (const directory of WORKSPACE_DIRECTORIES) {
-        const path = containedPath(root, directory);
-        if (inspectAnchoredEntry(root, path).kind === "directory")
-            await walk(path);
-    }
-}
-export async function reconcileStorageManifest(input) {
-    input.assertHealthy?.();
-    if (input.previousManifest.migrationId !== input.manifest.migrationId
-        || input.previousManifest.workspaceId !== input.manifest.workspaceId
-        || input.previousManifest.targetWorkspaceRoot !== input.manifest.targetWorkspaceRoot) {
-        throw new Error("storage reconciliation manifest identity mismatch");
-    }
-    const stagingRoot = await lstat(input.stagingWorkspaceRoot);
-    if (!stagingRoot.isDirectory() || stagingRoot.isSymbolicLink()) {
-        throw new Error("storage reconciliation requires existing staging");
-    }
-    if (input.previousManifest.chunkStore !== undefined || input.manifest.chunkStore !== undefined) {
-        // Build a bounded destination index, prune stale staging paths, then replay
-        // the authenticated final snapshot without retaining manifest entries.
-        const destinations = await collectChunkDestinations(input.manifest);
-        input.assertHealthy?.();
-        await pruneStaleChunkPaths(input.stagingWorkspaceRoot, destinations);
-        return materializeChunkedManifest({
-            manifest: input.manifest,
-            sourceRoots: input.sourceRoots,
-            stagingWorkspaceRoot: input.stagingWorkspaceRoot,
-            mergeIntoExisting: true,
-        }, input.assertHealthy === undefined ? {} : { assertHealthy: input.assertHealthy });
-    }
-    const previous = copiedEntries(input.previousManifest);
-    const next = copiedEntries(input.manifest);
-    const removals = [...previous.entries()].filter(([logical, entry]) => {
-        const current = next.get(logical);
-        return current === undefined || current.type !== entry.type;
-    }).sort(([left], [right]) => right.length - left.length);
-    for (const [logical] of removals) {
-        input.assertHealthy?.();
-        const target = containedPath(input.stagingWorkspaceRoot, logical);
-        try {
-            removeAnchoredEntry(input.stagingWorkspaceRoot, target);
-        }
-        catch (error) {
-            throw new Error(`migration target ancestor is a symbolic link or non-directory: ${logical}`, { cause: error });
-        }
-    }
-    const changed = input.manifest.entries.filter((entry) => {
-        if (entry.logicalDestination === null || entry.disposition === "skip")
-            return false;
-        const prior = previous.get(entry.logicalDestination);
-        return prior === undefined || JSON.stringify(prior) !== JSON.stringify(entry);
-    });
-    return materializeStorageManifest({
-        manifest: { ...input.manifest, entries: changed },
-        sourceRoots: input.sourceRoots,
-        stagingWorkspaceRoot: input.stagingWorkspaceRoot,
-        mergeIntoExisting: true,
-    }, input.assertHealthy === undefined ? {} : { assertHealthy: input.assertHealthy });
-}
-async function inspectStorageFile(root, path, afterTargetLstat) {
-    const handle = await openAnchoredFile(path, constants.O_RDONLY).catch((error) => {
-        throw new Error(`staged file cannot be opened without following links: ${path}`, { cause: error });
-    });
-    try {
-        const opened = await handle.stat();
-        if (!opened.isFile())
-            throw new Error(`staged file is no longer a regular file: ${path}`);
-        await afterTargetLstat?.(path);
-        const digest = createHash("sha256");
-        let tail = "";
-        let credentialMaterial = false;
-        const stream = handle.createReadStream({ autoClose: false });
-        for await (const chunk of stream) {
-            digest.update(chunk);
-            const text = tail + Buffer.from(chunk).toString("latin1");
-            if (containsStorageCredentialMaterial(text))
-                credentialMaterial = true;
-            tail = text.slice(-CREDENTIAL_SCAN_OVERLAP_BYTES);
-        }
-        const after = await handle.stat();
-        const pathAfter = inspectAnchoredEntry(root, path);
-        if (pathAfter.kind !== "file" || opened.dev !== after.dev || opened.ino !== after.ino
-            || opened.size !== after.size || opened.mtimeMs !== after.mtimeMs
-            || opened.dev !== pathAfter.stats.dev || opened.ino !== pathAfter.stats.ino) {
-            throw new Error(`staged file changed while verifying: ${path}`);
-        }
-        return Object.freeze({ digest: digest.digest("hex"), credentialMaterial });
-    }
-    finally {
-        await handle.close();
-    }
-}
-async function scanLiveLikeMatches(root, alreadyScanned) {
-    let matches = 0;
-    const pending = [root];
-    while (pending.length > 0) {
-        const directory = pending.pop();
-        for (const name of await readAnchoredDirectory(root, directory)) {
-            const path = resolve(directory, name);
-            const entry = inspectAnchoredEntry(root, path);
-            if (entry.kind === "directory")
-                pending.push(path);
-            else if (entry.kind === "file" && !alreadyScanned.has(path)
-                && (await inspectStorageFile(root, path)).credentialMaterial)
-                matches += 1;
-        }
-    }
-    return matches;
-}
-export async function verifyStagedStorage(input, injected = {}) {
-    let checkedEntries = 0;
-    let liveLikeMatches = 0;
-    for (const directory of WORKSPACE_DIRECTORIES) {
-        const target = containedPath(input.stagingWorkspaceRoot, directory);
-        const targetEntry = inspectAnchoredEntry(input.stagingWorkspaceRoot, target);
-        if (targetEntry.kind !== "directory" || (targetEntry.stats.mode & 0o777) !== 0o700) {
-            throw new Error(`required workspace directory is invalid: ${directory}`);
-        }
-    }
-    for await (const entry of iterateManifestEntries(input.manifest)) {
-        const logical = entry.logicalDestination;
-        if (entry.disposition === "skip" || logical === null)
-            continue;
-        const target = containedPath(input.stagingWorkspaceRoot, logical);
-        const targetEntry = inspectAnchoredEntry(input.stagingWorkspaceRoot, target);
-        if (entry.type === "directory" && targetEntry.kind !== "directory")
-            throw new Error(`staged type mismatch: ${logical}`);
-        if (entry.type === "file") {
-            if (targetEntry.kind !== "file")
-                throw new Error(`staged type mismatch: ${logical}`);
-            const expected = entry.disposition === "transform" ? entry.targetSha256 : entry.sha256;
-            const inspected = await inspectStorageFile(input.stagingWorkspaceRoot, target, injected.afterTargetLstat);
-            if (expected === undefined || inspected.digest !== expected)
-                throw new Error(`staged digest mismatch: ${logical}`);
-            if (inspected.credentialMaterial)
-                liveLikeMatches += 1;
-            const expectedMode = Number.parseInt(entry.disposition === "transform" ? entry.targetMode ?? "0600" : entry.mode, 8);
-            if ((targetEntry.stats.mode & 0o7777) !== expectedMode)
-                throw new Error(`staged mode mismatch: ${logical}`);
-        }
-        if (entry.type === "symlink") {
-            if (targetEntry.kind !== "symlink" || targetEntry.linkTarget !== entry.link?.relativeTarget) {
-                throw new Error(`staged symlink mismatch: ${logical}`);
-            }
-            await assertRealpathWithin(input.stagingWorkspaceRoot, target, `staged symlink escapes workspace: ${logical}`);
-        }
-        checkedEntries += 1;
-    }
-    liveLikeMatches += await scanLiveLikeMatches(input.stagingWorkspaceRoot, new Set());
-    if (liveLikeMatches !== 0)
-        throw new Error(`staging contains credential material in ${liveLikeMatches} file(s)`);
-    return Object.freeze({ valid: true, checkedEntries, liveLikeMatches: 0 });
-}
-export async function publishStagedStorage(input, dependencies = {}) {
-    if (dirname(input.stagingWorkspaceRoot) !== dirname(input.targetWorkspaceRoot)) {
-        throw new Error("staging and target workspace roots must be siblings on one filesystem");
-    }
-    if (await exists(input.targetWorkspaceRoot))
-        throw new Error("target collision: target workspace root already exists");
-    if (!(await lstat(input.stagingWorkspaceRoot)).isDirectory())
-        throw new Error("staging workspace root is not a directory");
-    await (dependencies.rename ?? rename)(input.stagingWorkspaceRoot, input.targetWorkspaceRoot);
-}

package/dist/storage-credential-guard.js

@@ -1,21 +0,0 @@
-const CREDENTIAL_PATTERNS = Object.freeze([
-    /-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----/iu,
-    /\bAuthorization\s*:\s*(?:Bearer|Basic)\s+\S{8,}/iu,
-    /\bCookie\s*:\s*[^\n]*(?:session|token|auth)[^\n]{8,}/iu,
-    /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis):\/\/[^\s:/]+:[^\s@]+@/iu,
-    /\bsk_(?:machine|user|agent)_[A-Za-z0-9_-]{4,}\b/u,
-    /\bAKIA[0-9A-Z]{16}\b/u,
-    /\b(?:sk|gh[oprsu]|xox[baprs])-[-A-Za-z0-9_]{12,}\b/u,
-    /(?:^|[^A-Za-z0-9])(?:[A-Z0-9]+_)*(?:PASSWORD|PASSWD|SECRET|TOKEN|API_KEY|ACCESS_KEY|PRIVATE_KEY)["']?\s*[:=]\s*["']?[^\s"';&,}]{8,}/imu,
-    /\b(?:AWS_SECRET_ACCESS_KEY|TENCENTCLOUD_SECRET_KEY|SECRET_KEY|API_KEY|ACCESS_TOKEN|AUTH_TOKEN|SESSION_TOKEN)\s*[:=]\s*\S{8,}/iu,
-    /\b(?:api[-_]?key|access[-_]?token|refresh[-_]?token|password|passwd|secret|credential|authorization|session|token)\s*[:=]\s*["']?[^\s"';&]{8,}/iu,
-    /\bbearer[ \t]+[A-Za-z0-9._~+/=-]{12,}\b/iu,
-]);
-export function containsStorageCredentialMaterial(value) {
-    return CREDENTIAL_PATTERNS.some((pattern) => pattern.test(value));
-}
-export function assertStorageControlMaterialTokenFree(value, source) {
-    if (containsStorageCredentialMaterial(value)) {
-        throw new Error(`credential material detected in ${source}`);
-    }
-}