@nowcrew/daemon 0.6.88-beta.3 → 0.6.88-beta.30

package/dist/storage-migration-controller.js

@@ -1,440 +0,0 @@
-import { createHash } from "node:crypto";
-import { createReadStream } from "node:fs";
-import { chmod, copyFile, lstat, mkdir, open, readFile, unlink } from "node:fs/promises";
-import { basename, dirname, join } from "node:path";
-import { z } from "zod";
-import { atomicPrivateWrite } from "./atomic-private-write.js";
-import { materializeStorageManifest, publishStagedStorage, reconcileStorageManifest, verifyStagedStorage, } from "./storage-copy.js";
-import { storageManifestDigest } from "./storage-manifest.js";
-const ReceiptStatusSchema = z.enum([
-    "preflight_passed",
-    "backing_up",
-    "initial_sync",
-    "quiescing",
-    "final_sync",
-    "verified",
-    "service_switched",
-    "hello_confirmed",
-    "completed",
-    "failed",
-    "rollback_pending",
-    "rolled_back",
-    "rollback_failed",
-]);
-const ReceiptSchema = z.object({
-    version: z.literal(1),
-    migrationId: z.string().uuid(),
-    environment: z.string().min(1),
-    workspaceId: z.string().uuid(),
-    profile: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,47}$/u),
-    ownerEpoch: z.number().int().positive().safe().optional(),
-    ownershipClaimFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
-    manifestDigest: z.string().regex(/^[0-9a-f]{64}$/u),
-    targetFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/u),
-    status: ReceiptStatusSchema,
-    history: z.array(z.object({ status: ReceiptStatusSchema, at: z.string().datetime({ offset: true }) }).strict()),
-    artifacts: z.array(z.object({ name: z.string().min(1), sha256: z.string().regex(/^[0-9a-f]{64}$/u) }).strict()),
-    errorCode: z.string().min(1).max(128).optional(),
-    errorMessage: z.string().min(1).max(512).optional(),
-    sourceStopAttempted: z.boolean().optional(),
-    sourceStopped: z.boolean().optional(),
-    targetTouched: z.boolean().optional(),
-}).strict().superRefine((receipt, context) => {
-    if ((receipt.ownerEpoch === undefined) !== (receipt.ownershipClaimFingerprint === undefined)) {
-        context.addIssue({ code: z.ZodIssueCode.custom, message: "storage receipt ownership identity must be complete" });
-    }
-});
-const MigrationLockSchema = z.object({
-    version: z.literal(1),
-    migrationId: z.string().uuid(),
-    pid: z.number().int().positive(),
-    createdAt: z.string().datetime({ offset: true }),
-}).strict();
-const REQUIRED_BACKUP_ARTIFACTS = Object.freeze([
-    "profile.json",
-    "service-descriptor",
-    "managed-service-registry.json",
-]);
-export class StorageMigrationFailure extends Error {
-    code;
-    receipt;
-    constructor(code, message, receipt, options) {
-        super(message, options);
-        this.name = "StorageMigrationFailure";
-        this.code = code;
-        if (receipt !== undefined)
-            this.receipt = receipt;
-    }
-}
-const TOKEN = /(?:\bsk_(?:machine|user|agent)_[A-Za-z0-9_-]{4,}\b|\bbearer\s+[^\s]+|(?:password|secret|token)\s*[:=]\s*[^\s]+)/giu;
-function safeError(error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return message.replaceAll(TOKEN, "<redacted>").slice(0, 512) || "storage migration failed";
-}
-function targetFingerprint(path) {
-    return `sha256:${createHash("sha256").update(path).digest("hex")}`;
-}
-async function digestFile(path) {
-    const digest = createHash("sha256");
-    await new Promise((resolvePromise, reject) => {
-        const stream = createReadStream(path);
-        stream.on("data", (chunk) => digest.update(chunk));
-        stream.once("end", resolvePromise);
-        stream.once("error", reject);
-    });
-    return digest.digest("hex");
-}
-function receiptPath(backupsRoot, migrationId) {
-    return join(backupsRoot, migrationId, "receipt.json");
-}
-async function readReceipt(path) {
-    try {
-        return ReceiptSchema.parse(JSON.parse(await readFile(path, "utf8")));
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return null;
-        throw new StorageMigrationFailure("receipt_invalid", `Invalid storage migration receipt: ${path}`, undefined, { cause: error });
-    }
-}
-export function readStorageMigrationReceipt(backupsRoot, migrationId) {
-    return readReceipt(receiptPath(backupsRoot, migrationId));
-}
-export async function recoverStorageMigration(input, dependencies) {
-    const path = receiptPath(input.backupsRoot, input.migrationId);
-    let receipt = await readReceipt(path);
-    if (receipt === null || receipt.migrationId !== input.migrationId) {
-        throw new StorageMigrationFailure("migration_receipt_missing", "storage migration recovery receipt is missing");
-    }
-    if (receipt.status === "completed" || receipt.status === "rolled_back")
-        return receipt;
-    const release = await acquireMigrationLock(input.backupsRoot, input.migrationId, dependencies.processAlive ?? systemProcessAlive);
-    const now = dependencies.now ?? (() => new Date());
-    const recoveryCode = "worker_restarted_recovery_required";
-    const recoveryMessage = "detached storage migration worker restarted with an incomplete receipt";
-    const transition = async (status, errorCode = recoveryCode, errorMessage = recoveryMessage) => {
-        receipt = ReceiptSchema.parse({
-            ...receipt,
-            status,
-            errorCode,
-            errorMessage,
-            history: [...receipt.history, { status, at: now().toISOString() }],
-        });
-        await writeReceipt(path, receipt);
-    };
-    try {
-        if (receipt.sourceStopAttempted !== true) {
-            if (receipt.status !== "failed")
-                await transition("failed");
-            return receipt;
-        }
-        if (receipt.status !== "failed" && receipt.status !== "rollback_pending" && receipt.status !== "rollback_failed") {
-            await transition("failed");
-        }
-        if (receipt.status !== "rollback_pending")
-            await transition("rollback_pending");
-        try {
-            if (receipt.targetTouched === true)
-                await dependencies.removeTargetService();
-            await dependencies.restoreSourceService();
-            await transition("rolled_back");
-            return receipt;
-        }
-        catch (error) {
-            const message = safeError(error);
-            await transition("rollback_failed", "rollback_failed", message).catch(() => undefined);
-            throw new StorageMigrationFailure("rollback_failed", message, receipt, { cause: error });
-        }
-    }
-    finally {
-        await release().catch(() => undefined);
-    }
-}
-const REPLAYABLE_STATUSES = new Set([
-    "backing_up", "initial_sync", "quiescing", "final_sync", "verified", "service_switched",
-    "completed", "failed", "rollback_pending", "rolled_back", "rollback_failed",
-]);
-export function storageMigrationReplayStatuses(receipt) {
-    return Object.freeze(receipt.history
-        .map((entry) => entry.status)
-        .filter((status) => REPLAYABLE_STATUSES.has(status)));
-}
-async function writeReceipt(path, receipt) {
-    await atomicPrivateWrite(path, `${JSON.stringify(ReceiptSchema.parse(receipt), null, 2)}\n`);
-}
-function systemProcessAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (error) {
-        return error.code !== "ESRCH";
-    }
-}
-async function acquireMigrationLock(backupsRoot, migrationId, processAlive) {
-    await mkdir(backupsRoot, { recursive: true, mode: 0o700 });
-    await chmod(backupsRoot, 0o700);
-    const path = join(backupsRoot, ".active-storage-migration");
-    for (let attempt = 0; attempt < 2; attempt += 1) {
-        let handle;
-        try {
-            handle = await open(path, "wx", 0o600);
-            await handle.writeFile(`${JSON.stringify(MigrationLockSchema.parse({
-                version: 1,
-                migrationId,
-                pid: process.pid,
-                createdAt: new Date().toISOString(),
-            }))}\n`, "utf8");
-            await handle.sync();
-            await handle.close();
-            return async () => { await unlink(path); };
-        }
-        catch (error) {
-            await handle?.close();
-            if (error.code !== "EEXIST")
-                throw error;
-            let owner;
-            try {
-                owner = MigrationLockSchema.parse(JSON.parse(await readFile(path, "utf8")));
-            }
-            catch (invalid) {
-                throw new StorageMigrationFailure("migration_lock_invalid", "storage migration lock owner is invalid", undefined, { cause: invalid });
-            }
-            if (processAlive(owner.pid)) {
-                throw new StorageMigrationFailure("migration_active", "another storage migration requires recovery or completion");
-            }
-            await unlink(path);
-        }
-    }
-    throw new StorageMigrationFailure("migration_active", "storage migration lock could not be acquired safely");
-}
-function assertOwnedStaging(input) {
-    if (dirname(input.stagingWorkspaceRoot) !== dirname(input.targetWorkspaceRoot)
-        || !basename(input.stagingWorkspaceRoot).includes(input.doctor.manifest.migrationId)) {
-        throw new StorageMigrationFailure("staging_identity_mismatch", "staging must be a migration-owned sibling of the target");
-    }
-}
-async function backupArtifacts(input, receipt) {
-    const providedNames = new Set(input.backupArtifacts.map((artifact) => artifact.name));
-    const missing = REQUIRED_BACKUP_ARTIFACTS.filter((name) => !providedNames.has(name));
-    if (missing.length > 0) {
-        throw new StorageMigrationFailure("backup_artifact_missing", `required rollback artifacts are missing: ${missing.join(", ")}`);
-    }
-    for (const artifact of input.backupArtifacts) {
-        if (!(await lstat(artifact.path)).isFile()) {
-            throw new StorageMigrationFailure("backup_artifact_invalid", "backup artifact must be a file");
-        }
-    }
-    const directory = join(input.backupsRoot, receipt.migrationId);
-    const artifactsDirectory = join(directory, "artifacts");
-    await mkdir(artifactsDirectory, { recursive: true, mode: 0o700 });
-    await chmod(directory, 0o700);
-    await chmod(artifactsDirectory, 0o700);
-    await atomicPrivateWrite(join(directory, "manifest.json"), `${JSON.stringify(input.doctor.manifest, null, 2)}\n`);
-    const artifacts = [];
-    const names = new Set();
-    for (const artifact of input.backupArtifacts) {
-        if (!/^[a-z0-9][a-z0-9_.-]{0,127}$/u.test(artifact.name) || names.has(artifact.name)) {
-            throw new StorageMigrationFailure("backup_artifact_invalid", "backup artifact names must be unique safe file names");
-        }
-        names.add(artifact.name);
-        const destination = join(artifactsDirectory, artifact.name);
-        await copyFile(artifact.path, destination);
-        await chmod(destination, 0o600);
-        artifacts.push(Object.freeze({ name: artifact.name, sha256: await digestFile(destination) }));
-    }
-    return ReceiptSchema.parse({ ...receipt, artifacts });
-}
-function unacceptedWarnings(doctor, acceptedWarnings) {
-    return doctor.warnings.map((warning) => warning.code)
-        .filter((code) => !acceptedWarnings.some((accepted) => accepted === code));
-}
-function validateFinalDoctor(initial, final, acceptedWarnings) {
-    if (!final.applyAllowed || final.manifest.migrationId !== initial.manifest.migrationId
-        || final.environment !== initial.environment || final.workspaceId !== initial.workspaceId
-        || final.profile !== initial.profile || final.manifest.targetWorkspaceRoot !== initial.manifest.targetWorkspaceRoot
-        || unacceptedWarnings(final, acceptedWarnings).length > 0) {
-        throw new StorageMigrationFailure("final_doctor_failed", "final doctor did not confirm the exact migration identity");
-    }
-}
-export async function runStorageMigration(input, dependencies) {
-    if (!input.doctor.applyAllowed)
-        throw new StorageMigrationFailure("doctor_blocked", "storage doctor did not allow apply");
-    if (unacceptedWarnings(input.doctor, input.acceptedWarnings).length > 0) {
-        throw new StorageMigrationFailure("doctor_warnings_unacknowledged", "storage doctor warnings require explicit acknowledgement");
-    }
-    if (input.targetWorkspaceRoot !== input.doctor.manifest.targetWorkspaceRoot) {
-        throw new StorageMigrationFailure("target_identity_mismatch", "target does not match the doctor manifest");
-    }
-    assertOwnedStaging(input);
-    const path = receiptPath(input.backupsRoot, input.doctor.manifest.migrationId);
-    const existing = await readReceipt(path);
-    if (existing?.status === "completed" || existing?.status === "rolled_back")
-        return existing;
-    if (existing !== null)
-        throw new StorageMigrationFailure("migration_recovery_required", "an incomplete migration receipt requires recovery", existing);
-    if (dependencies.isBusy())
-        throw new StorageMigrationFailure("runtime_busy", "active executions must finish before migration");
-    await dependencies.assertServiceIdentity().catch((error) => {
-        throw new StorageMigrationFailure("service_identity_drift", safeError(error), undefined, { cause: error });
-    });
-    const release = await acquireMigrationLock(input.backupsRoot, input.doctor.manifest.migrationId, dependencies.processAlive ?? systemProcessAlive);
-    const now = dependencies.now ?? (() => new Date());
-    const materialize = dependencies.materialize ?? materializeStorageManifest;
-    const reconcile = dependencies.reconcile ?? reconcileStorageManifest;
-    const verify = dependencies.verify ?? verifyStagedStorage;
-    const publish = dependencies.publish ?? publishStagedStorage;
-    let receipt = ReceiptSchema.parse({
-        version: 1,
-        migrationId: input.doctor.manifest.migrationId,
-        environment: input.doctor.environment,
-        workspaceId: input.doctor.workspaceId,
-        profile: input.doctor.profile,
-        ...(input.ownership === undefined ? {} : input.ownership),
-        manifestDigest: input.doctor.manifestDigest,
-        targetFingerprint: targetFingerprint(input.targetWorkspaceRoot),
-        status: "preflight_passed",
-        history: [],
-        artifacts: [],
-        sourceStopAttempted: false,
-        sourceStopped: false,
-        targetTouched: false,
-    });
-    const transition = async (status, errorCode, errorMessage) => {
-        receipt = ReceiptSchema.parse({
-            ...receipt,
-            status,
-            history: [...receipt.history, { status, at: now().toISOString() }],
-            ...(errorCode === undefined ? {} : { errorCode }),
-            ...(errorMessage === undefined ? {} : { errorMessage }),
-        });
-        await writeReceipt(path, receipt);
-        input.onStatus?.(status);
-    };
-    let sourceStopAttempted = false;
-    let sourceStopped = false;
-    let targetTouched = false;
-    let failureCode = "storage_migration_failed";
-    try {
-        input.assertHealthy?.();
-        await transition("preflight_passed");
-        input.assertHealthy?.();
-        await transition("backing_up");
-        receipt = await backupArtifacts(input, receipt).catch((error) => {
-            failureCode = error instanceof StorageMigrationFailure ? error.code : "backup_failed";
-            throw error;
-        });
-        await writeReceipt(path, receipt);
-        await transition("initial_sync");
-        await materialize({
-            manifest: input.doctor.manifest,
-            sourceRoots: input.sourceRoots,
-            stagingWorkspaceRoot: input.stagingWorkspaceRoot,
-        }, input.assertHealthy === undefined ? {} : { assertHealthy: input.assertHealthy }).catch((error) => {
-            failureCode = "initial_sync_failed";
-            throw error;
-        });
-        await transition("quiescing");
-        await dependencies.quiesceExecutions().catch((error) => {
-            failureCode = "quiesce_failed";
-            throw error;
-        });
-        await dependencies.waitForIdle().catch((error) => {
-            failureCode = "quiesce_failed";
-            throw error;
-        });
-        await dependencies.flushLocalState().catch((error) => {
-            failureCode = "local_state_flush_failed";
-            throw error;
-        });
-        sourceStopAttempted = true;
-        receipt = ReceiptSchema.parse({ ...receipt, sourceStopAttempted: true });
-        await writeReceipt(path, receipt);
-        await dependencies.stopSourceService().catch((error) => {
-            failureCode = "source_service_stop_failed";
-            throw error;
-        });
-        sourceStopped = true;
-        receipt = ReceiptSchema.parse({ ...receipt, sourceStopped: true });
-        await writeReceipt(path, receipt);
-        const finalDoctor = await (dependencies.refreshDoctor?.() ?? Promise.resolve(input.doctor));
-        try {
-            validateFinalDoctor(input.doctor, finalDoctor, input.acceptedWarnings);
-        }
-        catch (error) {
-            failureCode = "final_doctor_failed";
-            throw error;
-        }
-        await dependencies.assertServiceIdentity().catch((error) => {
-            failureCode = "service_identity_drift";
-            throw error;
-        });
-        await transition("final_sync");
-        await reconcile({
-            previousManifest: input.doctor.manifest,
-            manifest: finalDoctor.manifest,
-            sourceRoots: input.sourceRoots,
-            stagingWorkspaceRoot: input.stagingWorkspaceRoot,
-            ...(input.assertHealthy === undefined ? {} : { assertHealthy: input.assertHealthy }),
-        }).catch((error) => {
-            failureCode = "final_sync_failed";
-            throw error;
-        });
-        receipt = ReceiptSchema.parse({ ...receipt, manifestDigest: storageManifestDigest(finalDoctor.manifest) });
-        await atomicPrivateWrite(join(input.backupsRoot, receipt.migrationId, "manifest-final.json"), `${JSON.stringify(finalDoctor.manifest, null, 2)}\n`);
-        await verify({ manifest: finalDoctor.manifest, stagingWorkspaceRoot: input.stagingWorkspaceRoot }).catch((error) => {
-            failureCode = "verification_failed";
-            throw error;
-        });
-        await transition("verified");
-        await publish({ stagingWorkspaceRoot: input.stagingWorkspaceRoot, targetWorkspaceRoot: input.targetWorkspaceRoot }).catch((error) => {
-            failureCode = "publish_failed";
-            throw error;
-        });
-        targetTouched = true;
-        receipt = ReceiptSchema.parse({ ...receipt, targetTouched: true });
-        await writeReceipt(path, receipt);
-        await dependencies.installTargetService().catch((error) => {
-            failureCode = "target_service_failed";
-            throw error;
-        });
-        await transition("service_switched");
-        await dependencies.startTargetService().catch((error) => {
-            failureCode = "target_service_failed";
-            throw error;
-        });
-        await dependencies.confirmHello(receipt).catch((error) => {
-            failureCode = "hello_timeout";
-            throw error;
-        });
-        await transition("hello_confirmed");
-        await transition("completed");
-        return receipt;
-    }
-    catch (error) {
-        const message = safeError(error);
-        if (!sourceStopAttempted) {
-            await transition("failed", failureCode, message).catch(() => undefined);
-            throw new StorageMigrationFailure(failureCode, message, receipt, { cause: error });
-        }
-        await transition("failed", failureCode, message).catch(() => undefined);
-        await transition("rollback_pending").catch(() => undefined);
-        try {
-            if (targetTouched)
-                await dependencies.removeTargetService();
-            await dependencies.restoreSourceService();
-            await transition("rolled_back", failureCode, message);
-            throw new StorageMigrationFailure(failureCode, message, receipt, { cause: error });
-        }
-        catch (rollbackError) {
-            if (rollbackError instanceof StorageMigrationFailure)
-                throw rollbackError;
-            const rollbackMessage = safeError(rollbackError);
-            await transition("rollback_failed", "rollback_failed", rollbackMessage).catch(() => undefined);
-            throw new StorageMigrationFailure("rollback_failed", rollbackMessage, receipt, { cause: rollbackError });
-        }
-    }
-    finally {
-        await release().catch(() => undefined);
-    }
-}

package/dist/storage-migration-manifest.js

@@ -1,105 +0,0 @@
-import { createHash } from "node:crypto";
-import { posix, win32 } from "node:path";
-const HASH = /^[a-f0-9]{64}$/u;
-const AGENT_HANDLE = /^[a-z0-9][a-z0-9_-]{0,63}$/u;
-export class CredentialMaterialError extends Error {
-    constructor(source) {
-        super(`credential material detected in ${source}; rotate the credential before migration`);
-        this.name = "CredentialMaterialError";
-    }
-}
-function normalizedRelativePath(value) {
-    const normalized = value.replaceAll("\\", "/");
-    if (normalized.length === 0 || posix.isAbsolute(normalized) || win32.isAbsolute(normalized)) {
-        throw new Error(`migration path must be relative: ${value}`);
-    }
-    const segments = normalized.split("/");
-    if (segments.some((segment) => segment.length === 0 || segment === "." || segment === "..")) {
-        throw new Error(`migration path must be normalized and relative: ${value}`);
-    }
-    const canonical = posix.normalize(normalized);
-    if (canonical !== normalized || canonical === "." || canonical.startsWith("../")) {
-        throw new Error(`migration path must be normalized and relative: ${value}`);
-    }
-    return canonical;
-}
-function digestOf(input) {
-    const path = normalizedRelativePath(input.path);
-    if (!HASH.test(input.sha256))
-        throw new Error(`invalid sha256 for migration path: ${path}`);
-    return Object.freeze({ path, sha256: input.sha256 });
-}
-function mapDaemonFile(input) {
-    const file = digestOf(input);
-    return Object.freeze({
-        sourceRoot: "daemon-home",
-        sourcePath: file.path,
-        logicalDestination: `daemon/${file.path}`,
-        sha256: file.sha256,
-    });
-}
-function mapAgentFile(input) {
-    const file = digestOf(input);
-    const [handle, ...rest] = file.path.split("/");
-    if (handle === undefined || !AGENT_HANDLE.test(handle) || rest.length === 0) {
-        throw new Error(`agent migration path must start with an agent handle: ${file.path}`);
-    }
-    return Object.freeze({
-        sourceRoot: "agents-root",
-        sourcePath: file.path,
-        logicalDestination: `agent-items/${handle}/${rest.join("/")}`,
-        sha256: file.sha256,
-    });
-}
-/** Build the immutable source -> logical destination contract used by backup and copy. */
-export function buildStorageMigrationMappings(input) {
-    const mappings = [
-        ...input.daemonFiles.map(mapDaemonFile),
-        ...input.agentFiles.map(mapAgentFile),
-    ].sort((left, right) => left.logicalDestination.localeCompare(right.logicalDestination));
-    const destinations = new Set();
-    for (const mapping of mappings) {
-        if (destinations.has(mapping.logicalDestination)) {
-            throw new Error(`duplicate migration destination: ${mapping.logicalDestination}`);
-        }
-        destinations.add(mapping.logicalDestination);
-    }
-    return Object.freeze(mappings);
-}
-const CREDENTIAL_PATTERN = /(?:\bsk_(?:machine|user|agent)_[A-Za-z0-9_-]{8,}\b|\bbearer\s+[A-Za-z0-9._~+/=-]{12,}\b|(?:api[-_]?key|access[-_]?token|refresh[-_]?token|password|secret|credential|authorization)\s*[:=]\s*["']?[^\s"';&]{8,})/iu;
-export function assertNoCredentialMaterial(value, source) {
-    if (value !== null && CREDENTIAL_PATTERN.test(value))
-        throw new CredentialMaterialError(source);
-}
-const SAFE_RECORD_KEYS = [
-    "version", "generation", "platform", "serviceId", "profile", "daemonHome", "agentsRoot",
-    "nodePath", "entryPath", "packageRoot", "npmPrefix", "descriptorPath", "descriptorSha256", "createdAt",
-];
-function safeManagedRecord(record) {
-    if (record === null)
-        return null;
-    assertNoCredentialMaterial(JSON.stringify(record), "managed service registry");
-    const safe = Object.fromEntries(SAFE_RECORD_KEYS.flatMap((key) => (record[key] === undefined ? [] : [[key, record[key]]])));
-    return Object.freeze(safe);
-}
-/** Project service identity for a backup manifest without persisting descriptor or secrets. */
-export function createSafeServiceManifest(input) {
-    assertNoCredentialMaterial(input.spec.descriptor, "service descriptor");
-    for (const [index, argument] of input.spec.daemonCommand.entries()) {
-        assertNoCredentialMaterial(argument, `service command argument ${index}`);
-    }
-    const descriptorSha256 = input.spec.descriptor === null
-        ? null
-        : createHash("sha256").update(input.spec.descriptor).digest("hex");
-    return Object.freeze({
-        id: input.spec.id,
-        platform: input.spec.platform,
-        profile: input.spec.profile,
-        descriptorPath: input.spec.descriptorPath,
-        descriptorSha256,
-        daemonCommand: Object.freeze([...input.spec.daemonCommand]),
-        installed: input.snapshot.installed,
-        running: input.snapshot.running,
-        managedRecord: safeManagedRecord(input.managedRecord),
-    });
-}

package/dist/storage-migration-policy.js

@@ -1,100 +0,0 @@
-import { readFile, realpath, stat } from "node:fs/promises";
-import { basename, dirname, isAbsolute, resolve } from "node:path";
-import { z } from "zod";
-import { assertStorageControlMaterialTokenFree } from "./storage-credential-guard.js";
-const CONTROL = /[\0\r\n]/u;
-const AbsolutePathSchema = z.string().min(1).max(32768)
-    .refine((value) => isAbsolute(value) && !CONTROL.test(value), "must be an absolute single-line path");
-const RelativePathSchema = z.string().min(1).max(32768)
-    .refine((value) => !isAbsolute(value) && !CONTROL.test(value), "must be a relative single-line path")
-    .refine((value) => !value.split(/[\\/]/u).some((segment) => segment === "" || segment === "." || segment === ".."), "must be normalized");
-const SourceKindSchema = z.enum(["daemon-home", "agents-root", "legacy-agents-root"]);
-export const StorageMigrationWarningCodeSchema = z.enum([
-    "credential_link_excluded",
-    "target_transformations_required",
-]);
-const PolicySchema = z.object({
-    acceptedWarnings: z.array(StorageMigrationWarningCodeSchema).max(StorageMigrationWarningCodeSchema.options.length),
-    exclusions: z.array(z.object({
-        sourceKind: SourceKindSchema,
-        sourcePath: RelativePathSchema,
-        reason: z.string().min(1).max(256),
-    }).strict()).max(100_000),
-    transformations: z.array(z.object({
-        sourceKind: SourceKindSchema,
-        sourcePath: RelativePathSchema,
-        logicalDestination: RelativePathSchema,
-        sourceSha256: z.string().regex(/^[0-9a-f]{64}$/u),
-        targetSha256: z.string().regex(/^[0-9a-f]{64}$/u),
-        targetMode: z.string().regex(/^[0-7]{4}$/u),
-        transform: z.literal("redact_live_like_tokens_v1"),
-    }).strict()).max(100_000),
-}).strict();
-const DocumentSchema = z.object({
-    version: z.literal(1),
-    profile: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,47}$/u),
-    environment: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,31}$/u),
-    nowworkHome: AbsolutePathSchema,
-    sourceDaemonHome: AbsolutePathSchema,
-    sourceAgentsRoot: AbsolutePathSchema,
-    policy: PolicySchema,
-}).strict();
-async function canonicalPath(value) {
-    let candidate = resolve(value);
-    const missing = [];
-    for (;;) {
-        try {
-            return resolve(await realpath(candidate), ...missing);
-        }
-        catch (error) {
-            const code = error.code;
-            if (code !== "ENOENT" && code !== "ENOTDIR")
-                throw error;
-        }
-        const parent = dirname(candidate);
-        if (parent === candidate)
-            return resolve(value);
-        missing.unshift(basename(candidate));
-        candidate = parent;
-    }
-}
-async function samePath(left, right) {
-    const [canonicalLeft, canonicalRight] = await Promise.all([canonicalPath(left), canonicalPath(right)]);
-    return canonicalLeft === canonicalRight;
-}
-export async function readStorageMigrationPolicy(path, expected) {
-    try {
-        if (!isAbsolute(path) || CONTROL.test(path))
-            throw new Error("policy path must be absolute");
-        const metadata = await stat(path);
-        if (!metadata.isFile() || (metadata.mode & 0o077) !== 0) {
-            throw new Error("policy file permissions must be private");
-        }
-        if (process.getuid !== undefined && metadata.uid !== process.getuid()) {
-            throw new Error("policy file must be owned by the daemon user");
-        }
-        const raw = await readFile(path, "utf8");
-        assertStorageControlMaterialTokenFree(raw, "storage migration policy");
-        const document = DocumentSchema.parse(JSON.parse(raw));
-        const [sameNowworkHome, sameDaemonHome, sameAgentsRoot] = await Promise.all([
-            samePath(document.nowworkHome, expected.nowworkHome),
-            samePath(document.sourceDaemonHome, expected.sourceDaemonHome),
-            samePath(document.sourceAgentsRoot, expected.sourceAgentsRoot),
-        ]);
-        if (document.profile !== expected.profile || document.environment !== expected.environment
-            || !sameNowworkHome || !sameDaemonHome || !sameAgentsRoot) {
-            throw new Error("policy binding does not match the active storage migration");
-        }
-        return Object.freeze({
-            acceptedWarnings: Object.freeze([...new Set(document.policy.acceptedWarnings)]),
-            exclusions: Object.freeze(document.policy.exclusions.map((entry) => Object.freeze(entry))),
-            transformations: Object.freeze(document.policy.transformations.map((entry) => Object.freeze(entry))),
-        });
-    }
-    catch (error) {
-        const detail = error instanceof Error
-            ? error.message.replace(/sk_(?:machine|user|agent)_[A-Za-z0-9_-]+/gu, "<redacted>").slice(0, 256)
-            : "validation failed";
-        throw new Error(`Invalid storage migration policy: ${detail}`, { cause: error });
-    }
-}