@nurix/nustack 0.10.0-dev.4

package/dist/lib/git-sync/outbound/queue.js

@@ -0,0 +1,123 @@
+import { updateBindingStatus } from "../../local_store/bindings.js";
+import { enqueueUpload, getUpload, recordUploadAttempt, deleteUpload, } from "../../local_store/pending_uploads.js";
+import { recordAcceptedUpload } from "../../local_store/accepted_uploads.js";
+import { fetchWhitelist, pinWhitelist } from "../whitelist/store.js";
+import { mediaTypeForPath } from "../whitelist/validation.js";
+import { extractCommitDelta } from "./extraction.js";
+import { buildGitHandoffManifest } from "./manifest_builder.js";
+import { UploadRequestError } from "./upload_client.js";
+const MIN_BACKOFF_MS = 60_000;
+const MAX_BACKOFF_MS = 30 * 60_000;
+const MAX_STALE_REPINS = 2;
+export function backoffMs(attempts) {
+    const exponential = MIN_BACKOFF_MS * 2 ** Math.max(0, attempts - 1);
+    return Math.min(exponential, MAX_BACKOFF_MS);
+}
+export function enqueueCommit(store, binding, commitId, idempotencyKey, whitelistManifestSha256, manifestSha256) {
+    enqueueUpload(store, { bindingId: binding.id, commitId, idempotencyKey, whitelistManifestSha256, manifestSha256 });
+}
+export async function submitHead(ctx, commitId) {
+    const existing = getUpload(ctx.store, ctx.binding.id, commitId);
+    if (existing?.nextRetryAtMs != null && existing.nextRetryAtMs > ctx.now()) {
+        return { kind: "not_due" };
+    }
+    return attempt(ctx, commitId, 0);
+}
+async function attempt(ctx, commitId, staleDepth) {
+    const extraction = extractCommitDelta(ctx.repo, commitId, ctx.whitelistRef.current, ctx.workspaceId);
+    if (!extraction.ok) {
+        return blockBinding(ctx, commitId, extraction.code, { path: extraction.path });
+    }
+    if (extraction.delta.operations.length === 0) {
+        deleteUpload(ctx.store, ctx.binding.id, commitId);
+        return { kind: "no_op" };
+    }
+    const result = await pushOperations(ctx, commitId, extraction.delta.parentCommitId, extraction.delta.operations);
+    if (result.kind === "stale") {
+        if (staleDepth < MAX_STALE_REPINS) {
+            const repinned = await repinWhitelist(ctx);
+            if (!repinned.ok)
+                return handleFailure(ctx, commitId, repinned.error);
+            return attempt(ctx, commitId, staleDepth + 1);
+        }
+        return handleFailure(ctx, commitId, { kind: "retryable", code: "SYNC_WHITELIST_STALE" });
+    }
+    return result;
+}
+export async function pushOperations(ctx, commitId, parentCommitId, operations) {
+    const built = buildGitHandoffManifest({
+        binding: ctx.binding,
+        commitId,
+        parentCommitId,
+        whitelist: ctx.whitelistRef.current,
+        operations,
+    });
+    enqueueCommit(ctx.store, ctx.binding, commitId, built.idempotencyKey, ctx.whitelistRef.current.manifestSha256, built.manifestSha256);
+    const upserts = operations.filter((op) => op.operation === "upsert");
+    const check = await ctx.client.checkMissingBlobs(ctx.binding.id, upserts.map((op) => op.contentSha256));
+    if (!check.ok)
+        return handleFailure(ctx, commitId, check.error);
+    const absent = new Set(check.value);
+    for (const op of upserts) {
+        if (!absent.has(op.contentSha256))
+            continue;
+        const upload = await ctx.client.uploadBlob(ctx.binding.id, {
+            bytes: op.bytes,
+            sha256: op.contentSha256,
+            byteSize: op.byteSize,
+            mediaType: mediaTypeForPath(op.path) ?? "application/octet-stream",
+        });
+        if (!upload.ok)
+            return handleFailure(ctx, commitId, upload.error);
+    }
+    const submit = await ctx.client.submitGitHandoff(ctx.binding.id, built.manifest, built.idempotencyKey);
+    if (!submit.ok) {
+        if (submit.error.kind === "stale_whitelist")
+            return { kind: "stale" };
+        return handleFailure(ctx, commitId, submit.error);
+    }
+    const outcome = submit.value;
+    if ("noOp" in outcome) {
+        deleteUpload(ctx.store, ctx.binding.id, commitId);
+        return { kind: "no_op" };
+    }
+    recordAcceptedUpload(ctx.store, {
+        bindingId: ctx.binding.id,
+        commitId,
+        handoffId: outcome.accepted.handoffId,
+        workspaceSequence: outcome.accepted.workspaceSequence,
+        manifestSha256: built.manifestSha256,
+    });
+    deleteUpload(ctx.store, ctx.binding.id, commitId);
+    return { kind: "accepted", handoffId: outcome.accepted.handoffId, workspaceSequence: outcome.accepted.workspaceSequence };
+}
+async function repinWhitelist(ctx) {
+    try {
+        const fresh = await fetchWhitelist(ctx.client, ctx.binding.id);
+        await pinWhitelist(ctx.store, ctx.binding, fresh);
+        ctx.whitelistRef.current = fresh;
+        return { ok: true };
+    }
+    catch (error) {
+        if (error instanceof UploadRequestError)
+            return { ok: false, error: error.failure };
+        return { ok: false, error: { kind: "retryable", code: "WHITELIST_REFETCH_FAILED" } };
+    }
+}
+function handleFailure(ctx, commitId, error) {
+    if (error.kind === "terminal")
+        return blockBinding(ctx, commitId, error.code, { detail: error.detail });
+    const current = getUpload(ctx.store, ctx.binding.id, commitId);
+    const nextAttempts = (current?.attempts ?? 0) + 1;
+    recordUploadAttempt(ctx.store, ctx.binding.id, commitId, {
+        nextRetryAtMs: ctx.now() + backoffMs(nextAttempts),
+        lastErrorCode: error.code,
+        lastErrorDetail: error.detail ?? null,
+    });
+    return { kind: "retry_scheduled", code: error.code };
+}
+function blockBinding(ctx, commitId, code, info = {}) {
+    updateBindingStatus(ctx.store, ctx.binding.id, "failed", { code, detail: info.detail ?? info.path ?? null });
+    deleteUpload(ctx.store, ctx.binding.id, commitId);
+    return { kind: "blocked", code, ...(info.path ? { path: info.path } : {}) };
+}

package/dist/lib/git-sync/outbound/state.js

@@ -0,0 +1,12 @@
+export const OUTBOUND_STATES = [
+    "idle",
+    "reconciling",
+    "commit_range_ready",
+    "extracting",
+    "uploading",
+    "accepted",
+    "branch_wait",
+    "no_op",
+    "retry",
+    "history_decision_required",
+];

package/dist/lib/git-sync/outbound/upload_client.js

@@ -0,0 +1,141 @@
+const DEFAULT_TIMEOUT_MS = 15_000;
+export class UploadRequestError extends Error {
+    failure;
+    constructor(failure) {
+        super(`${failure.kind}:${failure.code}`);
+        this.name = "UploadRequestError";
+        this.failure = failure;
+    }
+}
+const TERMINAL_CODES = new Set([
+    "CONTENT_NOT_ALLOWED",
+    "INVALID_PATH",
+    "PROTECTED_PATH",
+    "VALIDATION_FAILED",
+    "BLOB_TOO_LARGE",
+    "HANDOFF_TOO_LARGE",
+    "UNSUPPORTED_PROTOCOL",
+    "INVALID_STATE",
+    "IDEMPOTENCY_CONFLICT",
+    "HANDOFF_SUPERSEDED",
+    "WORKSPACE_NOT_FOUND",
+    "DOCUMENT_NOT_FOUND",
+]);
+const AUTH_CODES = new Set(["AUTH_REQUIRED", "ACCESS_TOKEN_EXPIRED", "DEVICE_CREDENTIAL_INVALID"]);
+export function classifyFailure(status, code) {
+    if (status === 409 && code === "SYNC_WHITELIST_STALE")
+        return { kind: "stale_whitelist", code };
+    if (status === 401 || AUTH_CODES.has(code))
+        return { kind: "auth", code };
+    if (status === 429 || status >= 500)
+        return { kind: "retryable", code: code || "SERVER_ERROR" };
+    if (TERMINAL_CODES.has(code))
+        return { kind: "terminal", code };
+    return { kind: "terminal", code: code || `HTTP_${status}` };
+}
+export function createUploadClient(deps) {
+    const timeoutMs = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const doFetch = deps.fetchImpl ?? fetch;
+    async function request(method, path, init = {}) {
+        let response = await send(method, path, init, false);
+        if (response.status === 401) {
+            response = await send(method, path, init, true);
+        }
+        return response;
+    }
+    async function send(method, path, init, forceRefresh) {
+        const token = await deps.getAccessToken(forceRefresh);
+        const headers = { ...init.headers };
+        if (token)
+            headers.Authorization = `Bearer ${token}`;
+        const res = await doFetch(`${deps.baseUrl}${path}`, {
+            method,
+            headers,
+            body: init.body,
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        const body = (await res.json().catch(() => null));
+        return { status: res.status, body };
+    }
+    function failureOf(response) {
+        if (response.status >= 200 && response.status < 300)
+            return null;
+        const code = response.body?.error?.code ?? "";
+        return { ...classifyFailure(response.status, code), detail: response.body?.error?.message };
+    }
+    async function guarded(run) {
+        try {
+            return await run();
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            return { ok: false, error: { kind: "retryable", code: "NETWORK", detail } };
+        }
+    }
+    return {
+        async getSyncWhitelist(bindingId) {
+            const response = await request("GET", `/api/v2/bindings/${encodeURIComponent(bindingId)}/sync-whitelist`);
+            const failure = failureOf(response);
+            if (failure)
+                throw new UploadRequestError(failure);
+            return response.body?.data;
+        },
+        checkMissingBlobs(bindingId, hashes) {
+            return guarded(async () => {
+                const response = await request("POST", `/api/v2/content/blobs/check`, {
+                    headers: { "Content-Type": "application/json" },
+                    body: JSON.stringify({ bindingId, hashes }),
+                });
+                const failure = failureOf(response);
+                if (failure)
+                    return { ok: false, error: failure };
+                const absent = response.body?.data?.absent;
+                return { ok: true, value: Array.isArray(absent) ? absent : [] };
+            });
+        },
+        uploadBlob(bindingId, input) {
+            return guarded(async () => {
+                const response = await request("POST", `/api/v2/content/blobs`, {
+                    headers: {
+                        "Content-Type": input.mediaType,
+                        "X-NuStack-Binding-Id": bindingId,
+                        "X-NuStack-Content-Sha256": input.sha256,
+                        "X-NuStack-Byte-Size": String(input.byteSize),
+                    },
+                    body: input.bytes,
+                });
+                const failure = failureOf(response);
+                return failure ? { ok: false, error: failure } : { ok: true, value: undefined };
+            });
+        },
+        submitGitHandoff(bindingId, manifest, idempotencyKey) {
+            return guarded(async () => {
+                const response = await request("POST", `/api/v2/bindings/${encodeURIComponent(bindingId)}/git-handoffs`, {
+                    headers: { "Content-Type": "application/json", "Idempotency-Key": idempotencyKey },
+                    body: JSON.stringify(manifest),
+                });
+                const failure = failureOf(response);
+                if (failure)
+                    return { ok: false, error: failure };
+                const data = (response.body?.data ?? {});
+                if (data.noOp)
+                    return { ok: true, value: { noOp: true } };
+                const workspaceSequence = data.workspaceSequence ?? response.body?.meta?.workspaceSequence;
+                if (!data.handoffId || typeof workspaceSequence !== "number") {
+                    return { ok: false, error: { kind: "terminal", code: "MALFORMED_ACCEPTANCE" } };
+                }
+                return { ok: true, value: { accepted: { handoffId: data.handoffId, workspaceSequence } } };
+            });
+        },
+        reportHealth(bindingId, report) {
+            return guarded(async () => {
+                const response = await request("POST", `/api/v2/bindings/${encodeURIComponent(bindingId)}/health`, {
+                    headers: { "Content-Type": "application/json" },
+                    body: JSON.stringify(report),
+                });
+                const failure = failureOf(response);
+                return failure ? { ok: false, error: failure } : { ok: true, value: undefined };
+            });
+        },
+    };
+}

package/dist/lib/git-sync/recovery/bundle.js

@@ -0,0 +1,56 @@
+import { open, mkdir, readFile } from "node:fs/promises";
+import path from "node:path";
+import { recoveryDir } from "../../local_store/paths.js";
+import { mkdirSecure, writeFileSecure } from "../../secure_file.js";
+import { encryptBundle, decryptBundle } from "./crypto.js";
+export function bundlePathFor(bindingId, bundleId) {
+    return path.join(recoveryDir(), bindingId, `${bundleId}.bin`);
+}
+export function serializeBundle(content) {
+    return Buffer.from(JSON.stringify(content), "utf8");
+}
+export class RecoveryVerifyError extends Error {
+    constructor() {
+        super("recovery bundle failed its post-write decrypt-verify round-trip");
+        this.name = "RecoveryVerifyError";
+    }
+}
+export async function createRecoveryBundle(input) {
+    const plaintext = serializeBundle(input.content);
+    const sealed = encryptBundle(input.key.key, plaintext);
+    const bundlePath = bundlePathFor(input.bindingId, input.bundleId);
+    await mkdirSecure(path.dirname(bundlePath));
+    const handle = await open(bundlePath, "w", 0o600);
+    try {
+        await handle.write(sealed);
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    const readBack = await readFile(bundlePath);
+    const roundTrip = decryptBundle(input.key.key, readBack);
+    if (!roundTrip.equals(plaintext))
+        throw new RecoveryVerifyError();
+    return { bundlePath };
+}
+export async function readRecoveryBundle(key, bundlePath) {
+    const sealed = await readFile(bundlePath);
+    const plaintext = decryptBundle(key.key, sealed);
+    return JSON.parse(plaintext.toString("utf8"));
+}
+export async function extractRecoveryBundle(key, bundleId, bundlePath, destDir) {
+    const content = await readRecoveryBundle(key, bundlePath);
+    const dir = destDir ?? path.join(recoveryDir(), "extracted", bundleId);
+    await mkdir(dir, { recursive: true });
+    const files = [];
+    for (const target of content.targets) {
+        if (target.workingContentBase64 === null)
+            continue;
+        const outPath = path.join(dir, target.path);
+        await mkdir(path.dirname(outPath), { recursive: true });
+        await writeFileSecure(outPath, Buffer.from(target.workingContentBase64, "base64").toString("utf8"));
+        files.push(target.path);
+    }
+    return { dir, files };
+}

package/dist/lib/git-sync/recovery/crypto.js

@@ -0,0 +1,114 @@
+import { execFile } from "node:child_process";
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import path from "node:path";
+import { promisify } from "node:util";
+import { recoveryDir } from "../../local_store/paths.js";
+import { mkdirSecure, writeFileSecure } from "../../secure_file.js";
+const runFile = promisify(execFile);
+const DEFAULT_SECURITY_BIN = "/usr/bin/security";
+const RECOVERY_SERVICE = "nustack-recovery";
+const KEY_BYTES = 32;
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+function securityBin() {
+    return process.env.NUSTACK_KEYCHAIN_BIN?.trim() || DEFAULT_SECURITY_BIN;
+}
+export function isRecoveryKeychainAvailable() {
+    if (process.env.NUSTACK_KEYCHAIN_BIN)
+        return true;
+    return process.platform === "darwin" && existsSync(DEFAULT_SECURITY_BIN);
+}
+function keyFilePath() {
+    return path.join(recoveryDir(), "recovery.key");
+}
+async function readKeychainKey(account) {
+    try {
+        const { stdout } = await runFile(securityBin(), [
+            "find-generic-password",
+            "-s",
+            RECOVERY_SERVICE,
+            "-a",
+            account,
+            "-w",
+        ]);
+        const decoded = Buffer.from(stdout.trim(), "base64");
+        return decoded.length === KEY_BYTES ? decoded : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function writeKeychainKey(account, key) {
+    await runFile(securityBin(), [
+        "add-generic-password",
+        "-U",
+        "-s",
+        RECOVERY_SERVICE,
+        "-a",
+        account,
+        "-w",
+        key.toString("base64"),
+    ]);
+}
+async function readKeyFile() {
+    try {
+        const decoded = Buffer.from((await readFile(keyFilePath(), "utf8")).trim(), "base64");
+        return decoded.length === KEY_BYTES ? decoded : null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function ensureRecoveryKey(deviceRef) {
+    if (isRecoveryKeychainAvailable()) {
+        const existing = await readKeychainKey(deviceRef);
+        if (existing)
+            return { key: existing, source: "keychain" };
+        const minted = randomBytes(KEY_BYTES);
+        await writeKeychainKey(deviceRef, minted);
+        return { key: minted, source: "keychain" };
+    }
+    const existing = await readKeyFile();
+    if (existing)
+        return { key: existing, source: "keyfile" };
+    await mkdirSecure(recoveryDir());
+    const minted = randomBytes(KEY_BYTES);
+    await writeFileSecure(keyFilePath(), minted.toString("base64"));
+    return { key: minted, source: "keyfile" };
+}
+export async function inspectRecoveryKey(deviceRef) {
+    if (isRecoveryKeychainAvailable()) {
+        return (await readKeychainKey(deviceRef)) ? "keychain" : null;
+    }
+    return (await readKeyFile()) ? "keyfile" : null;
+}
+export function encryptBundle(key, plaintext) {
+    const iv = randomBytes(IV_BYTES);
+    const cipher = createCipheriv("aes-256-gcm", key, iv);
+    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    return Buffer.concat([iv, cipher.getAuthTag(), ciphertext]);
+}
+export class RecoveryDecryptError extends Error {
+    constructor(detail) {
+        super(`recovery bundle could not be decrypted: ${detail}`);
+        this.name = "RecoveryDecryptError";
+    }
+}
+export function decryptBundle(key, sealed) {
+    if (sealed.length < IV_BYTES + TAG_BYTES) {
+        throw new RecoveryDecryptError("sealed blob is too short");
+    }
+    const iv = sealed.subarray(0, IV_BYTES);
+    const tag = sealed.subarray(IV_BYTES, IV_BYTES + TAG_BYTES);
+    const ciphertext = sealed.subarray(IV_BYTES + TAG_BYTES);
+    const decipher = createDecipheriv("aes-256-gcm", key, iv);
+    decipher.setAuthTag(tag);
+    try {
+        return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    }
+    catch (error) {
+        throw new RecoveryDecryptError(error instanceof Error ? error.message : "auth failed");
+    }
+}

package/dist/lib/git-sync/recovery/index.js

@@ -0,0 +1,3 @@
+export { ensureRecoveryKey, inspectRecoveryKey, isRecoveryKeychainAvailable, encryptBundle, decryptBundle, RecoveryDecryptError, } from "./crypto.js";
+export { createRecoveryBundle, readRecoveryBundle, extractRecoveryBundle, serializeBundle, bundlePathFor, RecoveryVerifyError, } from "./bundle.js";
+export { persistRecoveryBundle, listBundles, restoreBundle, deleteBundle, sweepExpiredBundles, } from "./store.js";

package/dist/lib/git-sync/recovery/store.js

@@ -0,0 +1,55 @@
+import { unlink } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { insertRecoveryBundle, getRecoveryBundle, listRecoveryBundles, markRecoveryBundleState, listExpiredRecoveryBundles, } from "../../local_store/recovery_bundles.js";
+import { ensureRecoveryKey } from "./crypto.js";
+import { createRecoveryBundle, extractRecoveryBundle, } from "./bundle.js";
+export async function persistRecoveryBundle(input) {
+    const key = await ensureRecoveryKey(input.deviceRef);
+    const bundleId = randomUUID();
+    const { bundlePath } = await createRecoveryBundle({
+        key,
+        bindingId: input.bindingId,
+        bundleId,
+        content: input.content,
+    });
+    const bundle = insertRecoveryBundle(input.store, {
+        id: bundleId,
+        bindingId: input.bindingId,
+        handoffId: input.handoffId,
+        bundlePath,
+        manifestSha256: input.manifestSha256,
+    });
+    return { bundle, keySource: key.source };
+}
+export function listBundles(store, bindingId) {
+    return listRecoveryBundles(store, bindingId);
+}
+export async function restoreBundle(store, deviceRef, bundleId, destDir) {
+    const bundle = getRecoveryBundle(store, bundleId);
+    if (!bundle)
+        return { ok: false, code: "not_found" };
+    if (bundle.state !== "active")
+        return { ok: false, code: "not_active" };
+    const key = await ensureRecoveryKey(deviceRef);
+    const { dir, files } = await extractRecoveryBundle(key, bundleId, bundle.bundlePath, destDir);
+    const updated = markRecoveryBundleState(store, bundleId, "restored") ?? bundle;
+    return { ok: true, bundle: updated, dir, files };
+}
+export async function deleteBundle(store, bundleId) {
+    const bundle = getRecoveryBundle(store, bundleId);
+    if (!bundle)
+        return { ok: false, code: "not_found" };
+    await unlink(bundle.bundlePath).catch(() => { });
+    const updated = markRecoveryBundleState(store, bundleId, "deleted") ?? bundle;
+    return { ok: true, bundle: updated };
+}
+export async function sweepExpiredBundles(store, nowMs = Date.now()) {
+    const expired = listExpiredRecoveryBundles(store, nowMs);
+    const swept = [];
+    for (const bundle of expired) {
+        await unlink(bundle.bundlePath).catch(() => { });
+        markRecoveryBundleState(store, bundle.id, "expired");
+        swept.push(bundle.id);
+    }
+    return swept;
+}

package/dist/lib/git-sync/whitelist/index.js

@@ -0,0 +1,4 @@
+export { SYNC_PROTOCOL_VERSION, isWhitelistManifest, } from "./types.js";
+export { matchPath, isProtectedPath, globMatch } from "./matcher.js";
+export { validateOperationContent, mediaTypeForPath, frontmatterWorkspaceId, } from "./validation.js";
+export { fetchWhitelist, pinWhitelist, loadPinnedWhitelist, canonicalWhitelistSha256, whitelistCacheFile, WhitelistError, } from "./store.js";

package/dist/lib/git-sync/whitelist/matcher.js

@@ -0,0 +1,62 @@
+export function isProtectedPath(path) {
+    const segments = path.split("/");
+    if (segments.some((segment) => /^\.env/.test(segment)))
+        return true;
+    if (segments.includes(".git"))
+        return true;
+    for (let i = 0; i + 1 < segments.length; i++) {
+        if (segments[i] === ".nustack" && segments[i + 1] === "recovery")
+            return true;
+    }
+    return false;
+}
+function permitsDirection(entry, direction) {
+    return entry.direction === "bidirectional" || entry.direction === direction;
+}
+export function matchPath(manifest, normalizedPath, direction) {
+    if (isProtectedPath(normalizedPath))
+        return { allowed: false, reason: "protected" };
+    let globEntry = null;
+    for (const entry of manifest.entries) {
+        if (entry.kind === "exact") {
+            if (entry.pattern === normalizedPath) {
+                return permitsDirection(entry, direction)
+                    ? { allowed: true, entry, matchKind: "exact" }
+                    : { allowed: false, reason: "direction" };
+            }
+        }
+        else if (globEntry === null && globMatch(entry.pattern, normalizedPath)) {
+            globEntry = entry;
+        }
+    }
+    if (globEntry === null)
+        return { allowed: false, reason: "unlisted" };
+    return permitsDirection(globEntry, direction)
+        ? { allowed: true, entry: globEntry, matchKind: "glob" }
+        : { allowed: false, reason: "direction" };
+}
+export function globMatch(pattern, path) {
+    return matchSegments(pattern.split("/"), 0, path.split("/"), 0);
+}
+function matchSegments(pattern, pi, target, ti) {
+    if (pi === pattern.length)
+        return ti === target.length;
+    if (pattern[pi] === "**") {
+        for (let k = ti; k <= target.length; k++) {
+            if (matchSegments(pattern, pi + 1, target, k))
+                return true;
+        }
+        return false;
+    }
+    if (ti === target.length)
+        return false;
+    if (segmentMatch(pattern[pi], target[ti]))
+        return matchSegments(pattern, pi + 1, target, ti + 1);
+    return false;
+}
+function segmentMatch(pattern, segment) {
+    if (!pattern.includes("*"))
+        return pattern === segment;
+    const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*");
+    return new RegExp(`^${escaped}$`).test(segment);
+}

package/dist/lib/git-sync/whitelist/store.js

@@ -0,0 +1,99 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { updateBindingWhitelistCache, } from "../../local_store/bindings.js";
+import { cacheDir } from "../../local_store/paths.js";
+import { mkdirSecure, writeFileSecure } from "../../secure_file.js";
+import { isWhitelistManifest } from "./types.js";
+export class WhitelistError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "WhitelistError";
+        this.code = code;
+    }
+}
+export function whitelistCacheFile(bindingId, manifestSha256) {
+    return path.join(cacheDir(), "whitelists", bindingId, `${manifestSha256}.json`);
+}
+function sortKeys(value) {
+    if (Array.isArray(value))
+        return value.map(sortKeys);
+    if (value && typeof value === "object") {
+        const source = value;
+        const out = {};
+        for (const key of Object.keys(source).sort())
+            out[key] = sortKeys(source[key]);
+        return out;
+    }
+    return value;
+}
+export function canonicalWhitelistSha256(manifest) {
+    const core = {
+        protocolVersion: manifest.protocolVersion,
+        protectedPatterns: manifest.protectedPatterns,
+        limits: manifest.limits,
+        entries: manifest.entries.map((entry) => ({
+            pattern: entry.pattern,
+            kind: entry.kind,
+            direction: entry.direction,
+            maxBytes: entry.maxBytes,
+            mediaTypes: entry.mediaTypes,
+            allowsSupplemental: entry.allowsSupplemental ?? false,
+        })),
+    };
+    return createHash("sha256").update(JSON.stringify(sortKeys(core)), "utf8").digest("hex");
+}
+export async function fetchWhitelist(client, bindingId) {
+    const raw = await client.getSyncWhitelist(bindingId);
+    if (!isWhitelistManifest(raw)) {
+        throw new WhitelistError("malformed_manifest", "the Sync Whitelist response is not a valid manifest");
+    }
+    assertManifestIntegrity(raw);
+    return raw;
+}
+function assertManifestIntegrity(manifest) {
+    if (canonicalWhitelistSha256(manifest) !== manifest.manifestSha256) {
+        throw new WhitelistError("hash_mismatch", "the Sync Whitelist manifest hash does not match its content");
+    }
+}
+export async function pinWhitelist(store, binding, manifest) {
+    const cachePath = whitelistCacheFile(binding.id, manifest.manifestSha256);
+    await mkdirSecure(path.dirname(cachePath));
+    await writeFileSecure(cachePath, JSON.stringify(manifest));
+    updateBindingWhitelistCache(store, binding.id, {
+        whitelistManifestId: manifest.manifestId,
+        whitelistManifestSha256: manifest.manifestSha256,
+        whitelistCachePath: cachePath,
+    });
+    return { manifest, cachePath };
+}
+export async function loadPinnedWhitelist(store, binding, client) {
+    const cached = await readPinnedCache(binding);
+    if (cached)
+        return cached;
+    if (!client) {
+        throw new WhitelistError("not_pinned", "no pinned Sync Whitelist is available for this binding");
+    }
+    const fresh = await fetchWhitelist(client, binding.id);
+    await pinWhitelist(store, binding, fresh);
+    return fresh;
+}
+async function readPinnedCache(binding) {
+    if (!binding.whitelistCachePath || !binding.whitelistManifestSha256)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(await readFile(binding.whitelistCachePath, "utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (!isWhitelistManifest(parsed))
+        return null;
+    if (parsed.manifestSha256 !== binding.whitelistManifestSha256)
+        return null;
+    if (canonicalWhitelistSha256(parsed) !== parsed.manifestSha256)
+        return null;
+    return parsed;
+}