@nowcrew/daemon 0.6.88-beta.2 → 0.6.88-beta.21

package/dist/storage-manifest.js

@@ -1,1027 +0,0 @@
-import { createHash } from "node:crypto";
-import { createReadStream } from "node:fs";
-import { chmod, lstat, mkdir, open, readFile, readdir, readlink, realpath, rename } from "node:fs/promises";
-import { createInterface } from "node:readline";
-import { basename, dirname, isAbsolute, join, posix, relative, resolve, win32 } from "node:path";
-import { z } from "zod";
-import { validateStorageEnvironment } from "./storage-layout.js";
-import { atomicPrivateWrite } from "./atomic-private-write.js";
-export const STORAGE_MANIFEST_SCHEMA = "nowwork.storage.migration-manifest";
-export const STORAGE_MANIFEST_VERSION = 1;
-// A dev profile can legitimately contain the durable history of many Agents. Keep a
-// finite bound for memory/DoS protection, but leave enough headroom for the observed
-// Mac mini profile (1,062,161 inventory entries) to be migrated as one verified digest.
-export const MAX_STORAGE_MANIFEST_ENTRIES = 2_000_000;
-const SourceKindSchema = z.enum(["daemon-home", "agents-root", "legacy-agents-root"]);
-const HashSchema = z.string().regex(/^[0-9a-f]{64}$/u);
-const ManifestEntrySchema = z.object({
-    sourceKind: SourceKindSchema,
-    sourcePath: z.string().min(1),
-    logicalDestination: z.string().min(1).nullable(),
-    type: z.enum(["file", "directory", "symlink", "unsupported"]),
-    disposition: z.enum(["copy", "skip", "transform"]),
-    reason: z.string().min(1),
-    mode: z.string().regex(/^[0-7]{4}$/u),
-    sizeBytes: z.number().int().nonnegative(),
-    sha256: HashSchema.optional(),
-    transform: z.literal("redact_live_like_tokens_v1").optional(),
-    targetSha256: HashSchema.optional(),
-    targetMode: z.string().regex(/^[0-7]{4}$/u).optional(),
-    link: z.object({
-        classification: z.enum(["internal", "external", "broken"]),
-        portable: z.boolean(),
-        targetFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/u),
-        relativeTarget: z.string().min(1).optional(),
-    }).strict().optional(),
-}).strict();
-const StorageManifestSchema = z.object({
-    schema: z.literal(STORAGE_MANIFEST_SCHEMA),
-    formatVersion: z.literal(STORAGE_MANIFEST_VERSION),
-    migrationId: z.string().uuid(),
-    generatedAt: z.string().datetime({ offset: true }),
-    environment: z.string().min(1),
-    workspaceId: z.string().uuid(),
-    targetWorkspaceRoot: z.string().min(1),
-    sourceKinds: z.array(SourceKindSchema),
-    entries: z.array(ManifestEntrySchema).max(MAX_STORAGE_MANIFEST_ENTRIES),
-    chunkStore: z.object({
-        version: z.literal(1),
-        migrationId: z.string().uuid(),
-        path: z.string().min(1).refine((value) => isAbsolute(value) && !/[\0\r\n]/u.test(value), "chunk store path must be absolute"),
-        checkpointPath: z.string().min(1).refine((value) => isAbsolute(value) && !/[\0\r\n]/u.test(value), "checkpoint path must be absolute"),
-        chunkSize: z.number().int().positive(),
-        chunkCount: z.number().int().nonnegative(),
-        entryCount: z.number().int().nonnegative(),
-        sequenceDigest: HashSchema,
-        credentialLinks: z.number().int().nonnegative(),
-        unapprovedLinks: z.number().int().nonnegative(),
-        brokenLinks: z.number().int().nonnegative(),
-        unsupportedItems: z.number().int().nonnegative(),
-    }).strict().optional(),
-    summary: z.object({
-        records: z.number().int().nonnegative(),
-        files: z.number().int().nonnegative(),
-        directories: z.number().int().nonnegative(),
-        symlinks: z.number().int().nonnegative(),
-        copied: z.number().int().nonnegative(),
-        skipped: z.number().int().nonnegative(),
-        transformations: z.number().int().nonnegative(),
-        externalSymlinks: z.number().int().nonnegative(),
-        bytesToCopy: z.number().int().nonnegative(),
-        errors: z.number().int().nonnegative(),
-    }).strict(),
-}).strict();
-const CONTROL = /[\0\r\n]/u;
-function normalizedRelativePath(value) {
-    const normalized = value.replaceAll("\\", "/");
-    if (normalized.length === 0 || CONTROL.test(normalized) || posix.isAbsolute(normalized) || win32.isAbsolute(normalized)) {
-        throw new Error(`migration path must be normalized relative path: ${value}`);
-    }
-    const segments = normalized.split("/");
-    if (segments.some((segment) => segment.length === 0 || segment === "." || segment === "..")) {
-        throw new Error(`migration path must be normalized relative path: ${value}`);
-    }
-    if (posix.normalize(normalized) !== normalized)
-        throw new Error(`migration path must be normalized relative path: ${value}`);
-    return normalized;
-}
-function modeString(mode) {
-    return (mode & 0o7777).toString(8).padStart(4, "0");
-}
-function pathWithin(root, candidate) {
-    const child = relative(root, candidate);
-    return child === "" || (!child.startsWith("..") && !isAbsolute(child));
-}
-function pathReason(sourceKind, sourcePath) {
-    const wrapped = `/${sourcePath}/`;
-    if (sourceKind === "daemon-home" && wrapped.startsWith("/profiles/"))
-        return "credential_material";
-    if (wrapped.includes("/.home/.codex/auth.json/")
-        || wrapped.includes("/.home/auth.json/")
-        || wrapped.includes("/.home/.codex/sessions/")
-        || wrapped.includes("/.home/.config/")
-        || wrapped.includes("/.home/.local/share/"))
-        return "credential_material";
-    if (wrapped.includes("/.home/.cache/")
-        || wrapped.includes("/.home/.codex/tmp/")
-        || wrapped.includes("/.crew/ability-cache/")
-        || wrapped.includes("/.crew/executions/")
-        || wrapped.includes("/.execution-telemetry/")
-        || wrapped.includes("/tmp/"))
-        return "local_runtime";
-    return null;
-}
-function abortedManifestScanError() {
-    return Object.assign(new Error("storage manifest scan aborted"), { code: "preflight_aborted" });
-}
-async function fileDigest(path, signal) {
-    if (signal?.aborted)
-        throw abortedManifestScanError();
-    const before = await lstat(path);
-    const digest = createHash("sha256");
-    try {
-        await new Promise((resolvePromise, reject) => {
-            const stream = createReadStream(path, signal === undefined ? {} : { signal });
-            stream.on("data", (chunk) => digest.update(chunk));
-            stream.once("end", resolvePromise);
-            stream.once("error", reject);
-        });
-    }
-    catch (error) {
-        if (signal?.aborted || (error instanceof Error && error.name === "AbortError")) {
-            throw abortedManifestScanError();
-        }
-        throw error;
-    }
-    if (signal?.aborted)
-        throw abortedManifestScanError();
-    const after = await lstat(path);
-    if (before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs) {
-        throw new Error(`source changed while hashing: ${path}`);
-    }
-    return digest.digest("hex");
-}
-export function assertStorageManifestEntryLimit(count) {
-    if (!Number.isSafeInteger(count) || count < 0 || count > MAX_STORAGE_MANIFEST_ENTRIES) {
-        throw new Error(`storage manifest entry limit exceeded: ${count}`);
-    }
-}
-function fingerprint(value) {
-    return `sha256:${createHash("sha256").update(value).digest("hex")}`;
-}
-class CanonicalHashWriter {
-    hash = createHash("sha256");
-    chunks = [];
-    bufferedBytes = 0;
-    append(value) {
-        this.chunks.push(value);
-        this.bufferedBytes += Buffer.byteLength(value);
-        if (this.bufferedBytes >= 64 * 1024)
-            this.flush();
-    }
-    flush() {
-        if (this.chunks.length === 0)
-            return;
-        this.hash.update(this.chunks.join(""));
-        this.chunks = [];
-        this.bufferedBytes = 0;
-    }
-    write(value) {
-        const work = [{ kind: "value", value }];
-        while (work.length > 0) {
-            const item = work.pop();
-            if (item.kind === "text") {
-                this.append(item.text);
-                continue;
-            }
-            const current = item.value;
-            if (current === null) {
-                this.append("null");
-            }
-            else if (typeof current === "string" || typeof current === "boolean") {
-                this.append(JSON.stringify(current));
-            }
-            else if (typeof current === "number") {
-                if (!Number.isFinite(current))
-                    throw new Error("storage manifest contains a non-finite number");
-                this.append(JSON.stringify(current));
-            }
-            else if (Array.isArray(current)) {
-                this.append("[");
-                work.push({ kind: "text", text: "]" });
-                for (let index = current.length - 1; index >= 0; index -= 1) {
-                    if (index < current.length - 1)
-                        work.push({ kind: "text", text: "," });
-                    work.push({ kind: "value", value: current[index] });
-                }
-            }
-            else if (typeof current === "object") {
-                const record = current;
-                const keys = Object.keys(record)
-                    .filter((key) => record[key] !== undefined)
-                    .sort((left, right) => left.localeCompare(right));
-                this.append("{");
-                work.push({ kind: "text", text: "}" });
-                for (let index = keys.length - 1; index >= 0; index -= 1) {
-                    const key = keys[index];
-                    if (index < keys.length - 1)
-                        work.push({ kind: "text", text: "," });
-                    work.push({ kind: "value", value: record[key] });
-                    work.push({ kind: "text", text: ":" });
-                    work.push({ kind: "text", text: JSON.stringify(key) });
-                }
-            }
-            else {
-                throw new Error("storage manifest contains a non-JSON value");
-            }
-        }
-    }
-    digest() {
-        this.flush();
-        return this.hash.digest("hex");
-    }
-}
-function validatePolicy(policy) {
-    const exclusions = policy.exclusions.map((entry) => ({
-        sourceKind: SourceKindSchema.parse(entry.sourceKind),
-        sourcePath: normalizedRelativePath(entry.sourcePath),
-        reason: z.string().min(1).max(256).parse(entry.reason),
-    }));
-    const transformations = policy.transformations.map((entry) => ({
-        sourceKind: SourceKindSchema.parse(entry.sourceKind),
-        sourcePath: normalizedRelativePath(entry.sourcePath),
-        logicalDestination: normalizedRelativePath(entry.logicalDestination),
-        sourceSha256: HashSchema.parse(entry.sourceSha256),
-        targetSha256: HashSchema.parse(entry.targetSha256),
-        targetMode: z.string().regex(/^[0-7]{4}$/u).parse(entry.targetMode),
-        transform: z.literal("redact_live_like_tokens_v1").parse(entry.transform),
-    }));
-    const identities = new Set();
-    for (const entry of [...exclusions, ...transformations]) {
-        const identity = `${entry.sourceKind}:${entry.sourcePath}`;
-        if (identities.has(identity))
-            throw new Error(`duplicate migration policy path: ${identity}`);
-        identities.add(identity);
-    }
-    return Object.freeze({ exclusions: Object.freeze(exclusions), transformations: Object.freeze(transformations) });
-}
-const policyKey = (sourceKind, sourcePath) => `${sourceKind}\0${sourcePath}`;
-function indexPolicy(policy) {
-    return Object.freeze({
-        exclusions: new Map(policy.exclusions.map((entry) => [policyKey(entry.sourceKind, entry.sourcePath), entry])),
-        transformations: new Map(policy.transformations.map((entry) => [policyKey(entry.sourceKind, entry.sourcePath), entry])),
-    });
-}
-function excludedBy(index, sourceKind, sourcePath) {
-    let candidate = sourcePath;
-    for (;;) {
-        const exclusion = index.exclusions.get(policyKey(sourceKind, candidate));
-        if (exclusion !== undefined)
-            return exclusion;
-        const separator = candidate.lastIndexOf("/");
-        if (separator < 0)
-            return undefined;
-        candidate = candidate.slice(0, separator);
-    }
-}
-function transformedBy(index, sourceKind, sourcePath) {
-    return index.transformations.get(policyKey(sourceKind, sourcePath));
-}
-async function linkEvidence(root, path) {
-    const rawTarget = await readlink(path);
-    const resolvedTarget = resolve(dirname(path), rawTarget);
-    const canonicalRoot = await realpath(root);
-    let canonicalTarget;
-    try {
-        canonicalTarget = await realpath(resolvedTarget);
-    }
-    catch (error) {
-        if (error.code !== "ENOENT")
-            throw error;
-        return Object.freeze({ classification: "broken", portable: false, targetFingerprint: fingerprint(rawTarget) });
-    }
-    if (!pathWithin(canonicalRoot, canonicalTarget)) {
-        return Object.freeze({ classification: "external", portable: false, targetFingerprint: fingerprint(canonicalTarget) });
-    }
-    const portable = !isAbsolute(rawTarget);
-    return Object.freeze({
-        classification: "internal",
-        portable,
-        targetFingerprint: fingerprint(canonicalTarget),
-        ...(portable ? { relativeTarget: rawTarget.replaceAll("\\", "/") } : {}),
-    });
-}
-async function* scanSourceEntries(input) {
-    let emitted = 0;
-    const emit = (entry) => {
-        if (emitted >= input.remainingEntries) {
-            throw new Error(`storage manifest entry limit exceeded: ${emitted + 1}`);
-        }
-        emitted += 1;
-        return entry;
-    };
-    const pending = [input.root];
-    while (pending.length > 0) {
-        if (input.signal?.aborted)
-            throw Object.assign(new Error("storage manifest scan aborted"), { code: "preflight_aborted" });
-        const directory = pending.pop();
-        const children = await readdir(directory, { withFileTypes: true });
-        children.sort((left, right) => left.name.localeCompare(right.name));
-        for (const child of children) {
-            if (input.signal?.aborted)
-                throw Object.assign(new Error("storage manifest scan aborted"), { code: "preflight_aborted" });
-            const path = resolve(directory, child.name);
-            const sourcePath = normalizedRelativePath(relative(input.root, path));
-            const stat = await lstat(path);
-            const exclusion = excludedBy(input.policy, input.sourceKind, sourcePath);
-            const transformation = transformedBy(input.policy, input.sourceKind, sourcePath);
-            const classifiedReason = pathReason(input.sourceKind, sourcePath);
-            const defaultDestination = normalizedRelativePath(`${input.logicalPrefix}/${sourcePath}`);
-            let type = "unsupported";
-            if (stat.isDirectory())
-                type = "directory";
-            else if (stat.isFile())
-                type = "file";
-            else if (stat.isSymbolicLink())
-                type = "symlink";
-            // Host-local runtime and credential trees are intentionally excluded from
-            // the migration. Do not descend into them: their contents are volatile,
-            // never copied, and would otherwise make the source digest drift between
-            // preflight and apply.
-            if (stat.isDirectory()
-                && transformation === undefined
-                && (classifiedReason === "local_runtime" || classifiedReason === "credential_material")) {
-                continue;
-            }
-            if (stat.isDirectory())
-                pending.push(path);
-            if (exclusion !== undefined) {
-                const entry = emit(ManifestEntrySchema.parse({
-                    sourceKind: input.sourceKind,
-                    sourcePath,
-                    logicalDestination: null,
-                    type,
-                    disposition: "skip",
-                    reason: exclusion.reason,
-                    mode: modeString(stat.mode),
-                    sizeBytes: stat.size,
-                }));
-                input.onEntry?.(entry.sourceKind, entry.sourcePath);
-                yield entry;
-                continue;
-            }
-            if (transformation !== undefined) {
-                if (type !== "file")
-                    throw new Error(`transformation source is not a file: ${sourcePath}`);
-                const digest = await fileDigest(path, input.signal);
-                if (digest !== transformation.sourceSha256)
-                    throw new Error(`transformation source drift: ${sourcePath}`);
-                const entry = emit(ManifestEntrySchema.parse({
-                    sourceKind: input.sourceKind,
-                    sourcePath,
-                    logicalDestination: transformation.logicalDestination,
-                    type,
-                    disposition: "transform",
-                    reason: "approved_target_only_transformation",
-                    mode: modeString(stat.mode),
-                    sizeBytes: stat.size,
-                    sha256: digest,
-                    transform: transformation.transform,
-                    targetSha256: transformation.targetSha256,
-                    targetMode: transformation.targetMode,
-                }));
-                input.onEntry?.(entry.sourceKind, entry.sourcePath);
-                yield entry;
-                continue;
-            }
-            if (type === "symlink") {
-                const link = await linkEvidence(input.root, path);
-                const reason = classifiedReason
-                    ?? (link.classification === "internal" && link.portable ? "portable_internal_symlink" : "unsupported_symlink");
-                const copy = reason === "portable_internal_symlink";
-                const entry = emit(ManifestEntrySchema.parse({
-                    sourceKind: input.sourceKind,
-                    sourcePath,
-                    logicalDestination: copy ? defaultDestination : null,
-                    type,
-                    disposition: copy ? "copy" : "skip",
-                    reason,
-                    mode: modeString(stat.mode),
-                    sizeBytes: stat.size,
-                    link,
-                }));
-                input.onEntry?.(entry.sourceKind, entry.sourcePath);
-                yield entry;
-                continue;
-            }
-            if (classifiedReason !== null || type === "unsupported") {
-                const entry = emit(ManifestEntrySchema.parse({
-                    sourceKind: input.sourceKind,
-                    sourcePath,
-                    logicalDestination: null,
-                    type,
-                    disposition: "skip",
-                    reason: classifiedReason ?? "unsupported_file_type",
-                    mode: modeString(stat.mode),
-                    sizeBytes: stat.size,
-                }));
-                input.onEntry?.(entry.sourceKind, entry.sourcePath);
-                yield entry;
-                continue;
-            }
-            const entry = emit(ManifestEntrySchema.parse({
-                sourceKind: input.sourceKind,
-                sourcePath,
-                logicalDestination: defaultDestination,
-                type,
-                disposition: "copy",
-                reason: "durable_workspace_data",
-                mode: modeString(stat.mode),
-                sizeBytes: stat.size,
-                ...(type === "file" ? { sha256: await fileDigest(path, input.signal) } : {}),
-            }));
-            input.onEntry?.(entry.sourceKind, entry.sourcePath);
-            yield entry;
-        }
-    }
-}
-function prepareManifestScan(input) {
-    z.string().uuid().parse(input.migrationId);
-    z.string().datetime({ offset: true }).parse(input.generatedAt);
-    z.string().uuid().parse(input.workspaceId);
-    if (!isAbsolute(input.targetWorkspaceRoot) || CONTROL.test(input.targetWorkspaceRoot)) {
-        throw new Error("target workspace root must be an absolute single-line path");
-    }
-    const environment = validateStorageEnvironment(input.environment);
-    const policy = validatePolicy(input.policy);
-    const policyIndex = indexPolicy(policy);
-    const entryLimit = z.number().int().positive().max(MAX_STORAGE_MANIFEST_ENTRIES)
-        .parse(input.entryLimit ?? MAX_STORAGE_MANIFEST_ENTRIES);
-    const sourceKinds = input.sources.map((source) => SourceKindSchema.parse(source.kind));
-    if (new Set(sourceKinds).size !== sourceKinds.length)
-        throw new Error("duplicate migration source kind");
-    for (const source of input.sources) {
-        if (!isAbsolute(source.root))
-            throw new Error(`migration source root must be absolute: ${source.kind}`);
-    }
-    return Object.freeze({
-        environment,
-        policyIndex,
-        sourceKinds: Object.freeze(sourceKinds),
-        entryLimit,
-    });
-}
-export async function generateStorageManifest(input) {
-    const prepared = prepareManifestScan(input);
-    const entries = [];
-    const progressIntervalEntries = z.number().int().positive().max(100_000)
-        .parse(input.progressIntervalEntries ?? 1_000);
-    let scannedEntries = 0;
-    let lastProgress = 0;
-    const onEntry = (sourceKind, sourcePath) => {
-        scannedEntries += 1;
-        if (input.onProgress !== undefined
-            && (scannedEntries - lastProgress >= progressIntervalEntries || scannedEntries === 1)) {
-            lastProgress = scannedEntries;
-            input.onProgress({ scannedEntries, sourceKind, sourcePath });
-        }
-    };
-    for (const source of input.sources) {
-        const scanInput = {
-            sourceKind: source.kind,
-            root: source.root,
-            logicalPrefix: normalizedRelativePath(source.logicalPrefix),
-            policy: prepared.policyIndex,
-            remainingEntries: prepared.entryLimit - entries.length,
-            onEntry,
-            ...(input.signal === undefined ? {} : { signal: input.signal }),
-        };
-        for await (const entry of scanSourceEntries(scanInput))
-            entries.push(entry);
-        if (entries.length > prepared.entryLimit)
-            throw new Error(`storage manifest entry limit exceeded: ${entries.length}`);
-    }
-    entries.sort((left, right) => (left.sourceKind.localeCompare(right.sourceKind) || left.sourcePath.localeCompare(right.sourcePath)));
-    const destinations = new Set();
-    for (const entry of entries) {
-        if (entry.logicalDestination === null)
-            continue;
-        if (destinations.has(entry.logicalDestination))
-            throw new Error(`duplicate migration destination: ${entry.logicalDestination}`);
-        destinations.add(entry.logicalDestination);
-    }
-    return StorageManifestSchema.parse({
-        schema: STORAGE_MANIFEST_SCHEMA,
-        formatVersion: STORAGE_MANIFEST_VERSION,
-        migrationId: input.migrationId,
-        generatedAt: input.generatedAt,
-        environment: prepared.environment,
-        workspaceId: input.workspaceId.toLowerCase(),
-        targetWorkspaceRoot: input.targetWorkspaceRoot,
-        sourceKinds: prepared.sourceKinds,
-        entries,
-        summary: {
-            records: entries.length,
-            files: entries.filter((entry) => entry.type === "file").length,
-            directories: entries.filter((entry) => entry.type === "directory").length,
-            symlinks: entries.filter((entry) => entry.type === "symlink").length,
-            copied: entries.filter((entry) => entry.disposition === "copy").length,
-            skipped: entries.filter((entry) => entry.disposition === "skip").length,
-            transformations: entries.filter((entry) => entry.disposition === "transform").length,
-            externalSymlinks: entries.filter((entry) => entry.link?.classification === "external").length,
-            bytesToCopy: entries.filter((entry) => entry.type === "file" && entry.disposition !== "skip")
-                .reduce((total, entry) => total + entry.sizeBytes, 0),
-            errors: 0,
-        },
-    });
-}
-const CHUNK_DIGEST = /^[0-9a-f]{64}$/u;
-/** Digest only the entries in one bounded chunk. */
-export function storageManifestChunkDigest(entries) {
-    const writer = new CanonicalHashWriter();
-    writer.write(entries);
-    return writer.digest();
-}
-/**
- * Build a stable digest for a persisted chunk sequence. This is deliberately a
- * separate digest from the v1 whole-manifest digest; callers can migrate to a
- * chunked worker protocol without changing existing v1 receipts.
- */
-export function storageManifestChunkSequenceDigest(input) {
-    z.string().uuid().parse(input.migrationId);
-    const environment = validateStorageEnvironment(input.environment);
-    z.string().uuid().parse(input.workspaceId);
-    if (!isAbsolute(input.targetWorkspaceRoot) || CONTROL.test(input.targetWorkspaceRoot)) {
-        throw new Error("target workspace root must be an absolute single-line path");
-    }
-    const sourceKinds = input.sourceKinds.map((kind) => SourceKindSchema.parse(kind));
-    if (new Set(sourceKinds).size !== sourceKinds.length)
-        throw new Error("duplicate migration source kind");
-    const chunkDigests = input.chunkDigests.map((digest) => {
-        if (!CHUNK_DIGEST.test(digest))
-            throw new Error("invalid storage manifest chunk digest");
-        return digest;
-    });
-    let sequenceDigest = storageManifestChunkSequenceSeed({
-        migrationId: input.migrationId,
-        environment,
-        workspaceId: input.workspaceId,
-        targetWorkspaceRoot: input.targetWorkspaceRoot,
-        sourceKinds,
-    });
-    for (const digest of chunkDigests)
-        sequenceDigest = storageManifestChunkSequenceStep(sequenceDigest, digest);
-    return sequenceDigest;
-}
-export function storageManifestChunkSequenceSeed(input) {
-    const writer = new CanonicalHashWriter();
-    writer.write({
-        schema: STORAGE_MANIFEST_SCHEMA,
-        formatVersion: STORAGE_MANIFEST_VERSION,
-        migrationId: input.migrationId,
-        environment: input.environment,
-        workspaceId: input.workspaceId.toLowerCase(),
-        targetWorkspaceRoot: input.targetWorkspaceRoot,
-        sourceKinds: input.sourceKinds,
-        chunkDigests: [],
-    });
-    return writer.digest();
-}
-export function storageManifestChunkSequenceStep(previous, chunkDigest) {
-    return createHash("sha256").update(`${previous}\0${chunkDigest}`).digest("hex");
-}
-/**
- * Stream a manifest in bounded chunks. The source tree is still checked in a
- * deterministic order, but only one chunk plus one directory listing is kept
- * in memory. A yielded checkpoint is safe to persist and pass back through
- * `resumeFrom` after a daemon restart.
- */
-export async function* streamStorageManifestChunks(input, options = {}) {
-    const prepared = prepareManifestScan(input);
-    const chunkSize = z.number().int().positive().max(50_000).parse(options.chunkSize ?? 10_000);
-    const identityDigest = storageManifestChunkSequenceSeed({
-        migrationId: input.migrationId,
-        environment: prepared.environment,
-        workspaceId: input.workspaceId,
-        targetWorkspaceRoot: input.targetWorkspaceRoot,
-        sourceKinds: prepared.sourceKinds,
-    });
-    const resume = options.resumeFrom;
-    if (resume !== undefined) {
-        z.string().uuid().parse(resume.migrationId);
-        if (resume.migrationId !== input.migrationId)
-            throw new Error("manifest checkpoint migration identity mismatch");
-        if (!Number.isSafeInteger(resume.nextChunkIndex) || resume.nextChunkIndex < 0
-            || !Number.isSafeInteger(resume.emittedEntries) || resume.emittedEntries < 0
-            || !CHUNK_DIGEST.test(resume.identityDigest)
-            || !CHUNK_DIGEST.test(resume.sequenceDigest)
-            || resume.identityDigest !== identityDigest) {
-            throw new Error("invalid storage manifest checkpoint");
-        }
-        if (resume.emittedEntries > prepared.entryLimit)
-            throw new Error("manifest checkpoint exceeds entry limit");
-        if (!Number.isInteger(resume.sourceIndex) || resume.sourceIndex < 0
-            || resume.sourceIndex > input.sources.length) {
-            throw new Error("invalid storage manifest checkpoint source index");
-        }
-    }
-    const skipEntries = resume?.emittedEntries ?? 0;
-    // Re-walk skipped entries to revalidate their metadata and digests. This is
-    // intentionally I/O-only and bounded in memory; a future index can avoid
-    // the re-walk, but must preserve the same source-change checks.
-    let scannedEntries = 0;
-    let emittedEntries = skipEntries;
-    let chunkIndex = resume?.nextChunkIndex ?? 0;
-    let sequenceDigest = resume?.sequenceDigest ?? identityDigest;
-    let chunk = [];
-    let chunkKinds = new Set();
-    let sourceIndex = 0;
-    let sourcePath = resume?.sourcePath ?? null;
-    let lastProgress = 0;
-    const progressIntervalEntries = z.number().int().positive().max(100_000)
-        .parse(input.progressIntervalEntries ?? 1_000);
-    const emitChunk = () => {
-        if (chunk.length === 0)
-            throw new Error("cannot emit an empty storage manifest chunk");
-        const entries = Object.freeze([...chunk]);
-        const digest = storageManifestChunkDigest(entries);
-        sequenceDigest = storageManifestChunkSequenceStep(sequenceDigest, digest);
-        const checkpoint = Object.freeze({
-            version: 1,
-            migrationId: input.migrationId,
-            nextChunkIndex: chunkIndex + 1,
-            emittedEntries: emittedEntries + entries.length,
-            sourceIndex,
-            sourcePath,
-            identityDigest,
-            sequenceDigest,
-        });
-        const result = Object.freeze({
-            index: chunkIndex,
-            sourceKind: chunkKinds.size === 1 ? [...chunkKinds][0] : "mixed",
-            entries,
-            digest,
-            checkpoint,
-        });
-        emittedEntries += entries.length;
-        chunkIndex += 1;
-        chunk = [];
-        chunkKinds = new Set();
-        return result;
-    };
-    for (; sourceIndex < input.sources.length; sourceIndex += 1) {
-        const source = input.sources[sourceIndex];
-        for await (const entry of scanSourceEntries({
-            sourceKind: source.kind,
-            root: source.root,
-            logicalPrefix: normalizedRelativePath(source.logicalPrefix),
-            policy: prepared.policyIndex,
-            remainingEntries: prepared.entryLimit - scannedEntries,
-            ...(input.signal === undefined ? {} : { signal: input.signal }),
-            onEntry: (sourceKind, path) => {
-                scannedEntries += 1;
-                if (input.onProgress !== undefined && (scannedEntries - lastProgress >= progressIntervalEntries || scannedEntries === 1)) {
-                    lastProgress = scannedEntries;
-                    input.onProgress({ scannedEntries, sourceKind, sourcePath: path });
-                }
-            },
-        })) {
-            if (scannedEntries <= skipEntries)
-                continue;
-            chunk.push(entry);
-            chunkKinds.add(source.kind);
-            sourcePath = entry.sourcePath;
-            if (chunk.length >= chunkSize)
-                yield emitChunk();
-        }
-    }
-    if (chunk.length > 0)
-        yield emitChunk();
-    if (resume !== undefined && scannedEntries < skipEntries) {
-        throw new Error("manifest checkpoint exceeds current source entries");
-    }
-}
-const StoredChunkSchema = z.object({
-    version: z.literal(1),
-    index: z.number().int().nonnegative(),
-    digest: z.string().regex(CHUNK_DIGEST),
-    entries: z.array(ManifestEntrySchema).max(50_000),
-}).strict();
-// A timeout aborts the scan asynchronously. Keep a process-local single-flight
-// guard so a retry cannot append to the same partial JSONL while the timed-out
-// invocation is still unwinding. A daemon restart clears this guard; the
-// persisted checkpoint and chunk digests remain the cross-process authority.
-const activeManifestPersists = new Set();
-const StorageManifestChunkCheckpointSchema = z.object({
-    version: z.literal(1),
-    migrationId: z.string().uuid(),
-    nextChunkIndex: z.number().int().nonnegative(),
-    emittedEntries: z.number().int().nonnegative(),
-    sourceIndex: z.number().int().nonnegative(),
-    sourcePath: z.string().min(1).nullable(),
-    identityDigest: z.string().regex(CHUNK_DIGEST),
-    sequenceDigest: z.string().regex(CHUNK_DIGEST),
-}).strict();
-function emptyManifestSummary() {
-    return { records: 0, files: 0, directories: 0, symlinks: 0, copied: 0, skipped: 0, transformations: 0, externalSymlinks: 0, bytesToCopy: 0, errors: 0 };
-}
-function emptyManifestWarnings() {
-    return { credentialLinks: 0, unapprovedLinks: 0, brokenLinks: 0, unsupportedItems: 0 };
-}
-function addManifestEntryToSummary(summary, warnings, entry) {
-    summary.records += 1;
-    if (entry.type === "file")
-        summary.files += 1;
-    if (entry.type === "directory")
-        summary.directories += 1;
-    if (entry.type === "symlink")
-        summary.symlinks += 1;
-    if (entry.disposition === "copy")
-        summary.copied += 1;
-    if (entry.disposition === "skip")
-        summary.skipped += 1;
-    if (entry.disposition === "transform")
-        summary.transformations += 1;
-    if (entry.type === "file" && entry.disposition !== "skip")
-        summary.bytesToCopy += entry.sizeBytes;
-    if (entry.link?.classification === "external") {
-        summary.externalSymlinks += 1;
-        if (entry.reason === "credential_material")
-            warnings.credentialLinks += 1;
-        else if (entry.reason !== "local_runtime")
-            warnings.unapprovedLinks += 1;
-    }
-    if (entry.link?.classification === "broken")
-        warnings.brokenLinks += 1;
-    if (entry.type === "unsupported")
-        warnings.unsupportedItems += 1;
-}
-function chunkStorePaths(root, migrationId) {
-    if (!isAbsolute(root) || CONTROL.test(root))
-        throw new Error("manifest chunk store root must be an absolute single-line path");
-    z.string().uuid().parse(migrationId);
-    const directory = resolve(root, "migrations", migrationId);
-    return Object.freeze({ directory, path: join(directory, "manifest.jsonl"), checkpointPath: join(directory, "checkpoint.json") });
-}
-async function pathExists(path) {
-    try {
-        await lstat(path);
-        return true;
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return false;
-        throw error;
-    }
-}
-async function readManifestCheckpoint(path) {
-    try {
-        return StorageManifestChunkCheckpointSchema.parse(JSON.parse(await readFile(path, "utf8")));
-    }
-    catch (error) {
-        throw new Error("Invalid storage manifest checkpoint", { cause: error });
-    }
-}
-async function readPartialManifestChunkState(path, input, prepared) {
-    if (input.signal?.aborted)
-        throw abortedManifestScanError();
-    const stream = createReadStream(path, {
-        encoding: "utf8",
-        ...(input.signal === undefined ? {} : { signal: input.signal }),
-    });
-    const lines = createInterface({ input: stream, crlfDelay: Infinity });
-    let expected = 0;
-    let entryCount = 0;
-    let sequenceDigest = storageManifestChunkSequenceSeed({
-        migrationId: input.migrationId,
-        environment: prepared.environment,
-        workspaceId: input.workspaceId,
-        targetWorkspaceRoot: input.targetWorkspaceRoot,
-        sourceKinds: prepared.sourceKinds,
-    });
-    const summary = emptyManifestSummary();
-    const warnings = emptyManifestWarnings();
-    try {
-        for await (const line of lines) {
-            if (input.signal?.aborted)
-                throw abortedManifestScanError();
-            if (line.trim().length === 0)
-                continue;
-            let parsed;
-            try {
-                parsed = StoredChunkSchema.parse(JSON.parse(line));
-            }
-            catch (error) {
-                throw new Error("Invalid partial storage manifest chunk", { cause: error });
-            }
-            if (parsed.index !== expected)
-                throw new Error("storage manifest partial chunk sequence is not contiguous");
-            if (storageManifestChunkDigest(parsed.entries) !== parsed.digest) {
-                throw new Error("storage manifest partial chunk digest mismatch");
-            }
-            for (const entry of parsed.entries)
-                addManifestEntryToSummary(summary, warnings, entry);
-            expected += 1;
-            entryCount += parsed.entries.length;
-            sequenceDigest = storageManifestChunkSequenceStep(sequenceDigest, parsed.digest);
-        }
-    }
-    catch (error) {
-        if (input.signal?.aborted || (error instanceof Error && error.name === "AbortError")) {
-            throw abortedManifestScanError();
-        }
-        throw error;
-    }
-    finally {
-        lines.close();
-        stream.destroy();
-    }
-    assertStorageManifestEntryLimit(entryCount);
-    return { chunkCount: expected, entryCount, sequenceDigest, summary, warnings };
-}
-/** Iterate a persisted manifest without materializing its entries array. */
-export async function* readStorageManifestChunks(store) {
-    const record = z.object({
-        version: z.literal(1), migrationId: z.string().uuid(),
-        path: z.string().min(1).refine((value) => isAbsolute(value) && !/[\0\r\n]/u.test(value)),
-        checkpointPath: z.string().min(1).refine((value) => isAbsolute(value) && !/[\0\r\n]/u.test(value)),
-        chunkSize: z.number().int().positive(), chunkCount: z.number().int().nonnegative(),
-        entryCount: z.number().int().nonnegative(), sequenceDigest: z.string().regex(CHUNK_DIGEST),
-        credentialLinks: z.number().int().nonnegative(), unapprovedLinks: z.number().int().nonnegative(),
-        brokenLinks: z.number().int().nonnegative(), unsupportedItems: z.number().int().nonnegative(),
-    }).strict().parse(store);
-    if (record.checkpointPath !== join(dirname(record.path), "checkpoint.json")) {
-        throw new Error("storage manifest checkpoint path is not bound to chunk store");
-    }
-    if (record.migrationId !== manifestMigrationIdFromStorePath(record.path)) {
-        throw new Error("storage manifest chunk store path is not bound to migration identity");
-    }
-    const stream = createReadStream(record.path, { encoding: "utf8" });
-    const lines = createInterface({ input: stream, crlfDelay: Infinity });
-    let expected = 0;
-    let entryCount = 0;
-    try {
-        for await (const line of lines) {
-            if (line.trim().length === 0)
-                continue;
-            const parsed = StoredChunkSchema.parse(JSON.parse(line));
-            if (parsed.index !== expected)
-                throw new Error("storage manifest chunk sequence is not contiguous");
-            const entries = Object.freeze(parsed.entries);
-            if (storageManifestChunkDigest(entries) !== parsed.digest)
-                throw new Error("storage manifest chunk digest mismatch");
-            const result = Object.freeze({
-                index: parsed.index,
-                sourceKind: entries.length === 0 ? "mixed" : entries.every((entry) => entry.sourceKind === entries[0].sourceKind) ? entries[0].sourceKind : "mixed",
-                entries,
-                digest: parsed.digest,
-                checkpoint: Object.freeze({
-                    version: 1,
-                    migrationId: record.migrationId,
-                    nextChunkIndex: parsed.index + 1,
-                    emittedEntries: 0,
-                    sourceIndex: 0,
-                    sourcePath: null,
-                    identityDigest: "0".repeat(64),
-                    sequenceDigest: "0".repeat(64),
-                }),
-            });
-            expected += 1;
-            entryCount += entries.length;
-            yield result;
-        }
-    }
-    finally {
-        lines.close();
-        stream.destroy();
-    }
-    if (expected !== record.chunkCount)
-        throw new Error("storage manifest chunk count mismatch");
-    if (entryCount !== record.entryCount)
-        throw new Error("storage manifest chunk entry count mismatch");
-}
-/** Verify a chunk store's complete sequence without retaining its entries. */
-export async function verifyStorageManifestChunkStore(manifest) {
-    if (manifest.chunkStore === undefined)
-        return;
-    if (manifest.entries.length !== 0 || manifest.chunkStore.migrationId !== manifest.migrationId) {
-        throw new Error("storage manifest chunk store identity is inconsistent");
-    }
-    let sequenceDigest = storageManifestChunkSequenceSeed({
-        migrationId: manifest.migrationId,
-        environment: manifest.environment,
-        workspaceId: manifest.workspaceId,
-        targetWorkspaceRoot: manifest.targetWorkspaceRoot,
-        sourceKinds: manifest.sourceKinds,
-    });
-    let entryCount = 0;
-    for await (const chunk of readStorageManifestChunks(manifest.chunkStore)) {
-        sequenceDigest = storageManifestChunkSequenceStep(sequenceDigest, chunk.digest);
-        entryCount += chunk.entries.length;
-    }
-    if (sequenceDigest !== manifest.chunkStore.sequenceDigest)
-        throw new Error("storage manifest chunk sequence digest mismatch");
-    if (entryCount !== manifest.chunkStore.entryCount)
-        throw new Error("storage manifest chunk entry count mismatch");
-}
-function manifestMigrationIdFromStorePath(path) {
-    const id = basename(dirname(path));
-    return z.string().uuid().parse(id);
-}
-/** Persist a chunk stream and return a compact manifest reference. */
-async function persistStorageManifestChunksLocked(input, options) {
-    const prepared = prepareManifestScan(input);
-    const chunkSize = z.number().int().positive().max(50_000).parse(options.chunkSize ?? 10_000);
-    const paths = chunkStorePaths(options.root, input.migrationId);
-    await mkdir(paths.directory, { recursive: true, mode: 0o700 });
-    await chmod(paths.directory, 0o700);
-    const temporary = `${paths.path}.tmp`;
-    const temporaryExists = await pathExists(temporary);
-    const checkpointExists = await pathExists(paths.checkpointPath);
-    if (temporaryExists && !checkpointExists) {
-        throw new Error("storage manifest partial state is incomplete");
-    }
-    const resumeFrom = temporaryExists
-        ? await readManifestCheckpoint(paths.checkpointPath)
-        : options.resumeFrom;
-    if (options.resumeFrom !== undefined && resumeFrom !== undefined
-        && JSON.stringify(options.resumeFrom) !== JSON.stringify(resumeFrom)) {
-        throw new Error("storage manifest checkpoint does not match persisted state");
-    }
-    if (resumeFrom !== undefined && !temporaryExists) {
-        throw new Error("storage manifest checkpoint has no partial chunk store");
-    }
-    const partial = temporaryExists
-        ? await readPartialManifestChunkState(temporary, input, prepared)
-        : null;
-    if (resumeFrom !== undefined && partial !== null) {
-        const expectedIdentityDigest = storageManifestChunkSequenceSeed({
-            migrationId: input.migrationId,
-            environment: prepared.environment,
-            workspaceId: input.workspaceId,
-            targetWorkspaceRoot: input.targetWorkspaceRoot,
-            sourceKinds: prepared.sourceKinds,
-        });
-        if (resumeFrom.migrationId !== input.migrationId
-            || resumeFrom.identityDigest !== expectedIdentityDigest
-            || resumeFrom.nextChunkIndex !== partial.chunkCount
-            || resumeFrom.emittedEntries !== partial.entryCount
-            || resumeFrom.sequenceDigest !== partial.sequenceDigest
-            || resumeFrom.sourceIndex > input.sources.length) {
-            throw new Error("storage manifest checkpoint identity or digest mismatch");
-        }
-    }
-    let handle = null;
-    let chunkCount = partial?.chunkCount ?? 0;
-    let entryCount = partial?.entryCount ?? 0;
-    let sequenceDigest = partial?.sequenceDigest ?? storageManifestChunkSequenceDigest({
-        migrationId: input.migrationId, environment: prepared.environment, workspaceId: input.workspaceId,
-        targetWorkspaceRoot: input.targetWorkspaceRoot, sourceKinds: prepared.sourceKinds, chunkDigests: [],
-    });
-    const summary = partial?.summary ?? emptyManifestSummary();
-    const warnings = partial?.warnings ?? emptyManifestWarnings();
-    try {
-        handle = await open(temporary, temporaryExists ? "a" : "wx", 0o600);
-        for await (const chunk of streamStorageManifestChunks(input, {
-            chunkSize,
-            ...(resumeFrom === undefined ? {} : { resumeFrom }),
-        })) {
-            const line = `${JSON.stringify({ version: 1, index: chunk.index, digest: chunk.digest, entries: chunk.entries })}\n`;
-            await handle.writeFile(line, "utf8");
-            await handle.sync();
-            await atomicPrivateWrite(paths.checkpointPath, `${JSON.stringify(chunk.checkpoint)}\n`);
-            chunkCount += 1;
-            entryCount += chunk.entries.length;
-            sequenceDigest = chunk.checkpoint.sequenceDigest;
-            for (const entry of chunk.entries)
-                addManifestEntryToSummary(summary, warnings, entry);
-            input.onProgress?.({ scannedEntries: entryCount, sourceKind: chunk.sourceKind === "mixed" ? prepared.sourceKinds[0] : chunk.sourceKind, sourcePath: chunk.entries.at(-1)?.sourcePath ?? "" });
-        }
-        await handle.close();
-        handle = null;
-        await rename(temporary, paths.path);
-        await chmod(paths.path, 0o600);
-        const chunkStore = Object.freeze({ version: 1, migrationId: input.migrationId, path: paths.path, checkpointPath: paths.checkpointPath, chunkSize, chunkCount, entryCount, sequenceDigest, ...warnings });
-        return StorageManifestSchema.parse({
-            schema: STORAGE_MANIFEST_SCHEMA, formatVersion: STORAGE_MANIFEST_VERSION, migrationId: input.migrationId,
-            generatedAt: input.generatedAt, environment: prepared.environment, workspaceId: input.workspaceId.toLowerCase(),
-            targetWorkspaceRoot: input.targetWorkspaceRoot, sourceKinds: prepared.sourceKinds, entries: [], chunkStore, summary,
-        });
-    }
-    catch (error) {
-        await handle?.close().catch(() => undefined);
-        // Keep both the partial JSONL and its last authenticated checkpoint. A
-        // subsequent preflight can resume this exact migration, while a mismatched
-        // or incomplete pair fails closed instead of being silently overwritten.
-        throw error;
-    }
-}
-export async function persistStorageManifestChunks(input, options) {
-    const paths = chunkStorePaths(options.root, input.migrationId);
-    if (activeManifestPersists.has(paths.path)) {
-        throw new Error("storage manifest persistence is already running for this migration");
-    }
-    activeManifestPersists.add(paths.path);
-    try {
-        return await persistStorageManifestChunksLocked(input, options);
-    }
-    finally {
-        activeManifestPersists.delete(paths.path);
-    }
-}
-export function parseStorageManifest(raw) {
-    try {
-        return StorageManifestSchema.parse(JSON.parse(raw));
-    }
-    catch (error) {
-        throw new Error("Invalid storage migration manifest", { cause: error });
-    }
-}
-export function storageManifestDigest(manifest) {
-    if (manifest.chunkStore !== undefined)
-        return manifest.chunkStore.sequenceDigest;
-    const { generatedAt: _generatedAt, ...stable } = manifest;
-    const writer = new CanonicalHashWriter();
-    writer.write(stable);
-    return writer.digest();
-}