@platless/axom-cli 0.5.9 → 0.6.52

package/dist/workstation/rd/sessions.js

@@ -0,0 +1,391 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { createHash, randomBytes } from 'node:crypto';
+import { execFile, spawn } from 'node:child_process';
+import { promisify } from 'node:util';
+import { fileURLToPath } from 'node:url';
+import { setTimeout as delay } from 'node:timers/promises';
+import { z } from 'zod';
+import { readRdState } from './state.js';
+import { privateDirectory } from '../keepers/kit/paths.js';
+import { withPrivateLock } from '../control/locks.js';
+const execute = promisify(execFile);
+const allowedEnvironment = ['DISPLAY', 'XAUTHORITY', 'XDG_RUNTIME_DIR', 'DBUS_SESSION_BUS_ADDRESS', 'XDG_SESSION_ID', 'XDG_SESSION_TYPE', 'XDG_CURRENT_DESKTOP',
+    'AXOM_DESKTOP_RUNTIME_DIR', 'AXOM_DESKTOP_OWNED_DUMMY', 'AXOM_DESKTOP_AUTO_DPI',
+    'PULSE_SERVER', 'PULSE_SINK', 'AXOM_DESKTOP_AUDIO_SOURCE', 'ALSA_CONFIG_PATH'];
+const displayPattern = /^:\d+(?:\.\d+)?$/;
+export function chooseSession(candidates, selection) {
+    if (selection.session === 'virtual')
+        return;
+    const selected = candidates.filter(candidate => !selection.display || candidate.display.split('.')[0] === selection.display.split('.')[0]);
+    if (selected.some(candidate => candidate.type === 'wayland'))
+        throw new Error('The existing desktop uses Wayland; use --rd-session virtual for an independent X11 desktop');
+    if (selected.some(candidate => candidate.locked))
+        throw new Error('The selected desktop is locked');
+    if (selected.some(candidate => candidate.unavailable))
+        throw new Error('An existing graphical desktop is unavailable; select an accessible X11 display or use --rd-session virtual');
+    const unique = [...new Map(selected.filter(candidate => candidate.type === 'x11').map(candidate => [candidate.display.split('.')[0], candidate])).values()];
+    if (unique.length > 1)
+        throw new Error('Several X11 desktops are available; select one with --rd-display :N');
+    if (!unique.length && (selection.session === 'existing' || selection.display))
+        throw new Error('No matching X11 desktop is available');
+    return unique[0];
+}
+export async function processStart(pid) {
+    const text = await fs.readFile(`/proc/${pid}/stat`, 'utf8');
+    return text.slice(text.lastIndexOf(')') + 2).split(' ')[19];
+}
+export async function sessionAlive(session) {
+    try {
+        if (await processStart(session.processId) !== session.processStart)
+            return false;
+        if (session.sessionId) {
+            const { stdout } = await execute('loginctl', ['show-session', session.sessionId, '-p', 'LockedHint', '-p', 'State'], { timeout: 1500, maxBuffer: 4096 });
+            if (/^LockedHint=yes$/m.test(stdout) || /^State=closing$/m.test(stdout))
+                return false;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function sessionEnvironment(pid) {
+    const environment = {};
+    for (const item of (await fs.readFile(`/proc/${pid}/environ`, 'utf8')).split('\0')) {
+        const equals = item.indexOf('=');
+        const key = item.slice(0, equals);
+        if (equals >= 0 && allowedEnvironment.includes(key))
+            environment[key] = item.slice(equals + 1);
+    }
+    return environment;
+}
+export async function discoverSessions() {
+    const sessions = new Map();
+    let hasLogind = false;
+    try {
+        const { stdout } = await execute('loginctl', ['list-sessions', '--no-legend', '--no-pager'], { timeout: 2000, maxBuffer: 32768 });
+        hasLogind = true;
+        for (const row of stdout.trim().split('\n')) {
+            const [id, uid] = row.trim().split(/\s+/);
+            if (Number(uid) !== process.getuid?.() || !/^[a-zA-Z0-9_-]+$/.test(id))
+                continue;
+            const { stdout: details } = await execute('loginctl', ['show-session', id, '-p', 'Type', '-p', 'Display', '-p', 'LockedHint', '-p', 'State', '-p', 'Class', '-p', 'Leader'], { timeout: 1500, maxBuffer: 4096 });
+            sessions.set(id, Object.fromEntries(details.trim().split('\n').map(line => line.split('=', 2))));
+        }
+    }
+    catch {
+        hasLogind = false;
+    }
+    const candidates = [];
+    for (const entry of await fs.readdir('/proc').catch(() => [])) {
+        if (!/^\d+$/.test(entry))
+            continue;
+        try {
+            const root = `/proc/${entry}`;
+            if ((await fs.stat(root)).uid !== process.getuid?.())
+                continue;
+            const name = (await fs.readFile(`${root}/comm`, 'utf8')).trim();
+            if (!/^(xfce4-session|gnome-session.*|gnome-shell|ksmserver|plasmashell|mate-session|lxsession|i3|openbox|sway)$/.test(name))
+                continue;
+            const environment = await sessionEnvironment(Number(entry));
+            const display = environment.DISPLAY;
+            if (!display || !displayPattern.test(display))
+                continue;
+            const sessionEntry = environment.XDG_SESSION_ID ? [environment.XDG_SESSION_ID, sessions.get(environment.XDG_SESSION_ID)] :
+                [...sessions].find(([, details]) => details.Display === display.split('.')[0]);
+            const [sessionId, details] = sessionEntry ?? [];
+            if (hasLogind && (!details || details.Class !== 'user' || details.State === 'closing'))
+                continue;
+            const type = details?.Type === 'wayland' || environment.XDG_SESSION_TYPE === 'wayland' ? 'wayland' : 'x11';
+            environment.XAUTHORITY ??= path.join(os.homedir(), '.Xauthority');
+            environment.XDG_RUNTIME_DIR ??= `/run/user/${process.getuid?.()}`;
+            const start = await processStart(Number(entry));
+            const identity = createHash('sha256').update(`${sessionId ?? ''}:${display}:${entry}:${start}`).digest('hex').slice(0, 32);
+            const managed = !hasLogind && environment.AXOM_DESKTOP_OWNED_DUMMY === '1' &&
+                environment.AXOM_DESKTOP_RUNTIME_DIR !== undefined && path.isAbsolute(environment.AXOM_DESKTOP_RUNTIME_DIR);
+            candidates.push({ identity, display, environment, managed, sessionId, processId: Number(entry), processStart: start, type, locked: details?.LockedHint === 'yes' });
+        }
+        catch {
+            continue;
+        }
+    }
+    for (const [sessionId, details] of sessions) {
+        if (details.Class !== 'user' || details.State === 'closing' || !['wayland', 'x11'].includes(details.Type) || candidates.some(candidate => candidate.sessionId === sessionId))
+            continue;
+        const display = displayPattern.test(details.Display ?? '') ? details.Display : '';
+        const leader = Number(details.Leader);
+        let environment = {};
+        let start = '';
+        let unavailable = true;
+        if (details.Type === 'x11' && display && /^[1-9]\d*$/.test(details.Leader ?? '') && Number.isSafeInteger(leader)) {
+            try {
+                if ((await fs.stat(`/proc/${leader}`)).uid !== process.getuid?.())
+                    throw new Error('Foreign graphical session leader');
+                start = await processStart(leader);
+                if (!/^\d+$/.test(start))
+                    throw new Error('Invalid graphical session leader identity');
+                environment = await sessionEnvironment(leader).catch(() => ({}));
+                if (environment.DISPLAY && environment.DISPLAY.split('.')[0] !== display.split('.')[0])
+                    throw new Error('Graphical session display mismatch');
+                if (environment.XDG_SESSION_ID && environment.XDG_SESSION_ID !== sessionId)
+                    throw new Error('Graphical session identity mismatch');
+                environment.DISPLAY = display;
+                environment.XDG_SESSION_ID = sessionId;
+                environment.XDG_SESSION_TYPE = 'x11';
+                environment.XAUTHORITY ??= path.join(os.homedir(), '.Xauthority');
+                environment.XDG_RUNTIME_DIR ??= `/run/user/${process.getuid?.()}`;
+                unavailable = false;
+            }
+            catch {
+                environment = {};
+            }
+        }
+        const identity = createHash('sha256').update(`${sessionId}:${display}:${details.Leader ?? ''}:${start}`).digest('hex').slice(0, 32);
+        candidates.push({ identity, display, environment, managed: false, sessionId, processId: unavailable ? 0 : leader,
+            processStart: start, type: details.Type, locked: details.LockedHint === 'yes', unavailable });
+    }
+    return candidates;
+}
+const managedSchema = z.object({ identity: z.string().regex(/^[a-f0-9]{32}$/), display: z.string().regex(displayPattern),
+    environment: z.record(z.string(), z.string()), managed: z.literal(true), processId: z.number().int().positive(), processStart: z.string() });
+async function readManaged(directory) {
+    try {
+        const file = await fs.lstat(path.join(directory, 'rd', 'managed.json'));
+        if (!file.isFile() || file.isSymbolicLink() || file.uid !== process.getuid?.() || file.mode & 0o077 || file.size > 16384)
+            throw new Error('Unsafe desktop session state');
+        const session = managedSchema.parse(JSON.parse(await fs.readFile(path.join(directory, 'rd', 'managed.json'), 'utf8')));
+        return await sessionAlive(session) ? session : undefined;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+}
+export async function ensureManagedSession(directory) {
+    const existing = await readManaged(directory);
+    if (existing)
+        return existing;
+    const cli = fileURLToPath(new URL('../../cli.js', import.meta.url));
+    const unit = `axom-rd-desktop-${createHash('sha256').update(directory).digest('hex').slice(0, 12)}`;
+    const args = [process.execPath, cli, '__rd-desktop', '--directory', directory];
+    try {
+        await execute('systemctl', ['--user', 'show-environment'], { timeout: 3000, maxBuffer: 65536 });
+        await execute('systemd-run', ['--user', `--unit=${unit}`, '--property=Restart=on-failure', '--property=RestartSec=3', '--property=KillMode=control-group', ...args], { timeout: 5000, maxBuffer: 8192 });
+    }
+    catch (error) {
+        const recovered = await readManaged(directory);
+        if (recovered)
+            return recovered;
+        if (process.env.AXOM_DESKTOP_NATIVE_PROVIDER !== '1')
+            throw new Error(`A user service manager is required for a persistent virtual desktop: ${String(error)}`);
+        const child = spawn(args[0], args.slice(1), { detached: true, stdio: 'ignore', env: { ...process.env, AXOM_ACCESS_TOKEN: undefined } });
+        child.unref();
+    }
+    for (let attempt = 0; attempt < 350; attempt++) {
+        const session = await readManaged(directory);
+        if (session)
+            return session;
+        await delay(100);
+    }
+    throw new Error(`The virtual desktop did not become ready; inspect the ${unit} user service`);
+}
+function authFile(cookie) {
+    const pieces = [Buffer.from([255, 255])];
+    for (const value of [Buffer.alloc(0), Buffer.from('0'), Buffer.from('MIT-MAGIC-COOKIE-1'), cookie]) {
+        const length = Buffer.alloc(2);
+        length.writeUInt16BE(value.length);
+        pieces.push(length, value);
+    }
+    return Buffer.concat(pieces);
+}
+async function lineFrom(child) {
+    const stream = child.stdio[3];
+    if (!stream || !('on' in stream))
+        throw new Error('Desktop child did not supply a readiness pipe');
+    return new Promise((resolve, reject) => {
+        let text = '';
+        const timer = setTimeout(() => reject(new Error('Desktop readiness timed out')), 30000);
+        stream.on('data', (bytes) => {
+            text += bytes.toString();
+            if (text.length > 4096) {
+                clearTimeout(timer);
+                reject(new Error('Invalid desktop readiness'));
+            }
+            else if (text.includes('\n')) {
+                clearTimeout(timer);
+                resolve(text.split('\n')[0]);
+            }
+        });
+        child.once('error', error => { clearTimeout(timer); reject(error); });
+        child.once('exit', () => { clearTimeout(timer); reject(new Error('Desktop child exited before readiness')); });
+    });
+}
+export async function runManagedDesktop(directory) {
+    const state = await readRdState(directory);
+    if (!state?.enabled)
+        throw new Error('Remote desktop is disabled');
+    if (state.artifact.ipcVersion === 1)
+        return runLegacyManagedDesktop(directory);
+    await withPrivateLock(path.join(directory, 'rd', 'desktop-owner'), async () => {
+        const baseRuntime = process.env.XDG_RUNTIME_DIR ?? `/run/user/${process.getuid?.()}`;
+        const runtimeRoot = path.join(baseRuntime, 'axom-rd');
+        await privateDirectory(runtimeRoot);
+        const runtime = await fs.mkdtemp(path.join(runtimeRoot, 'desktop-'));
+        const profile = path.join(directory, 'rd', 'desktop');
+        await privateDirectory(profile);
+        const log = await fs.open(path.join(directory, 'rd', 'desktop.log'), 'a', 0o600);
+        let stopping = false;
+        const stop = () => { stopping = true; };
+        process.once('SIGTERM', stop);
+        process.once('SIGINT', stop);
+        const child = spawn(path.join(state.installation, 'bin/axom-desktop-session'), ['--managed', '--runtime', runtime,
+            '--profile', profile, '--xorg-config', path.join(state.installation, 'xorg.conf')], {
+            detached: true, stdio: ['ignore', log.fd, log.fd, 'pipe'],
+            env: { ...process.env, XDG_RUNTIME_DIR: baseRuntime, AXOM_DESKTOP_AUTO_DPI: '0', AXOM_ACCESS_TOKEN: undefined, SESSION_MANAGER: undefined },
+        });
+        try {
+            const report = z.object({ display: z.string().regex(displayPattern), environment: z.record(z.string(), z.string()) }).parse(JSON.parse(await lineFrom(child)));
+            if (report.environment.DISPLAY !== report.display || report.environment.XAUTHORITY !== path.join(runtime, 'Xauthority'))
+                throw new Error('Invalid managed desktop environment');
+            const keys = [...allowedEnvironment, 'XDG_CONFIG_HOME', 'XDG_CACHE_HOME', 'XDG_DATA_HOME'];
+            const environment = { ...Object.fromEntries(Object.entries(report.environment).filter(([key]) => keys.includes(key))),
+                AXOM_DESKTOP_AUTO_DPI: '0' };
+            const session = { identity: randomBytes(16).toString('hex'), display: report.display, environment, managed: true,
+                processId: process.pid, processStart: await processStart(process.pid) };
+            const staging = path.join(directory, 'rd', `.managed-${session.identity}.json`);
+            try {
+                await fs.writeFile(staging, JSON.stringify(session), { mode: 0o600, flag: 'wx' });
+                await fs.rename(staging, path.join(directory, 'rd', 'managed.json'));
+            }
+            finally {
+                await fs.rm(staging, { force: true });
+            }
+            while (!stopping) {
+                if (child.exitCode !== null || child.signalCode !== null)
+                    throw new Error('The shared desktop runtime stopped');
+                await delay(250);
+            }
+        }
+        finally {
+            await fs.rm(path.join(directory, 'rd', 'managed.json'), { force: true });
+            if (child.pid && child.exitCode === null && child.signalCode === null) {
+                try {
+                    process.kill(-child.pid, 'SIGTERM');
+                }
+                catch { }
+                for (let attempt = 0; attempt < 70 && child.exitCode === null && child.signalCode === null; attempt++)
+                    await delay(100);
+                if (child.exitCode === null && child.signalCode === null) {
+                    try {
+                        process.kill(-child.pid, 'SIGKILL');
+                    }
+                    catch { }
+                }
+            }
+            await log.close();
+            await fs.rm(runtime, { recursive: true, force: true });
+            process.removeListener('SIGTERM', stop);
+            process.removeListener('SIGINT', stop);
+        }
+    });
+}
+async function runLegacyManagedDesktop(directory) {
+    await withPrivateLock(path.join(directory, 'rd', 'desktop-owner'), async () => {
+        const state = await readRdState(directory);
+        if (!state?.enabled)
+            throw new Error('Remote desktop is disabled');
+        const baseRuntime = process.env.XDG_RUNTIME_DIR ?? `/run/user/${process.getuid?.()}`;
+        const runtimeRoot = path.join(baseRuntime, 'axom-rd');
+        await privateDirectory(runtimeRoot);
+        const runtime = await fs.mkdtemp(path.join(runtimeRoot, 'desktop-'));
+        const profile = path.join(directory, 'rd', 'desktop');
+        for (const name of ['config', 'cache', 'data'])
+            await privateDirectory(path.join(profile, name));
+        const authority = path.join(runtime, 'Xauthority');
+        const cookie = randomBytes(16);
+        await fs.writeFile(authority, authFile(cookie), { mode: 0o600, flag: 'wx' });
+        const log = await fs.open(path.join(directory, 'rd', 'desktop.log'), 'a', 0o600);
+        const children = [];
+        let stopping = false;
+        const stop = () => { stopping = true; };
+        process.once('SIGTERM', stop);
+        process.once('SIGINT', stop);
+        try {
+            const xorg = spawn('/usr/lib/xorg/Xorg', ['-displayfd', '3', '-config', path.join(state.installation, 'xorg.conf'), '-auth', authority,
+                '-nolisten', 'tcp', '-noreset', '-logfile', path.join(runtime, 'Xorg.log')], { detached: true, stdio: ['ignore', log.fd, log.fd, 'pipe'] });
+            children.push(xorg);
+            const number = await lineFrom(xorg);
+            if (!/^\d+$/.test(number))
+                throw new Error('Invalid X server display number');
+            const display = `:${number}`;
+            const bus = spawn('dbus-daemon', ['--session', '--nofork', '--print-address=3'], { detached: true, stdio: ['ignore', log.fd, log.fd, 'pipe'] });
+            children.push(bus);
+            const busAddress = await lineFrom(bus);
+            const environment = { DISPLAY: display, XAUTHORITY: authority, XDG_RUNTIME_DIR: baseRuntime,
+                DBUS_SESSION_BUS_ADDRESS: busAddress, XDG_CURRENT_DESKTOP: 'XFCE', XDG_SESSION_TYPE: 'x11',
+                XDG_CONFIG_HOME: path.join(profile, 'config'), XDG_CACHE_HOME: path.join(profile, 'cache'), XDG_DATA_HOME: path.join(profile, 'data') };
+            const xauth = spawn('xauth', ['-f', authority, 'source', '-'], { stdio: ['pipe', log.fd, log.fd] });
+            xauth.stdin.end(`add ${display} . ${cookie.toString('hex')}\n`);
+            await new Promise((resolve, reject) => { xauth.once('error', reject); xauth.once('exit', code => code === 0 ? resolve() : reject(new Error('Xauthority setup failed'))); });
+            const desktop = spawn('xfce4-session', ['--disable-tcp'], { detached: true, stdio: ['ignore', log.fd, log.fd], env: { ...process.env, ...environment, SESSION_MANAGER: undefined, AXOM_ACCESS_TOKEN: undefined } });
+            children.push(desktop);
+            let ready = false;
+            for (let attempt = 0; attempt < 100 && !stopping; attempt++) {
+                if (children.some(child => child.exitCode !== null || child.signalCode !== null))
+                    throw new Error('Desktop child exited during startup');
+                try {
+                    const { stdout } = await execute('xprop', ['-root', '_NET_SUPPORTING_WM_CHECK'], { env: { ...process.env, ...environment }, timeout: 1000, maxBuffer: 4096 });
+                    if (stdout.includes('window id')) {
+                        ready = true;
+                        break;
+                    }
+                }
+                catch { }
+                await delay(100);
+            }
+            if (!ready)
+                throw new Error('Xfce did not become ready');
+            const session = { identity: randomBytes(16).toString('hex'), display, environment, managed: true,
+                processId: process.pid, processStart: await processStart(process.pid) };
+            const staging = path.join(directory, 'rd', `.managed-${session.identity}.json`);
+            try {
+                await fs.writeFile(staging, JSON.stringify(session), { mode: 0o600, flag: 'wx' });
+                await fs.rename(staging, path.join(directory, 'rd', 'managed.json'));
+            }
+            finally {
+                await fs.rm(staging, { force: true });
+            }
+            while (!stopping) {
+                if (children.some(child => child.exitCode !== null || child.signalCode !== null))
+                    throw new Error('A virtual desktop component stopped');
+                await delay(250);
+            }
+        }
+        finally {
+            await fs.rm(path.join(directory, 'rd', 'managed.json'), { force: true });
+            for (const child of children.reverse()) {
+                if (child.pid && child.exitCode === null && child.signalCode === null) {
+                    try {
+                        process.kill(-child.pid, 'SIGTERM');
+                    }
+                    catch { }
+                    for (let attempt = 0; attempt < 20 && child.exitCode === null && child.signalCode === null; attempt++)
+                        await delay(100);
+                    if (child.exitCode === null && child.signalCode === null) {
+                        try {
+                            process.kill(-child.pid, 'SIGKILL');
+                        }
+                        catch { }
+                    }
+                }
+            }
+            await log.close();
+            await fs.rm(runtime, { recursive: true, force: true });
+            process.removeListener('SIGTERM', stop);
+            process.removeListener('SIGINT', stop);
+        }
+    });
+}

package/dist/workstation/rd/state.js

@@ -0,0 +1,57 @@
+import { promises as fs, constants } from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { z } from 'zod';
+import { rdArtifactSchema } from './artifact.js';
+import { privateDirectory } from '../keepers/kit/paths.js';
+const selection = { schemaVersion: z.literal(2), artifactSource: z.string().url(),
+    session: z.enum(['auto', 'existing', 'virtual']), display: z.string().regex(/^:\d+(?:\.\d+)?$/).optional(),
+};
+const currentRdStateSchema = z.discriminatedUnion('enabled', [
+    z.strictObject({ ...selection, enabled: z.literal(true), installation: z.string().startsWith('/'), artifact: rdArtifactSchema }),
+    z.strictObject({ ...selection, enabled: z.literal(false), installation: z.string().startsWith('/').optional(), artifact: rdArtifactSchema.optional() }),
+]);
+const legacySelection = { schemaVersion: z.literal(1), server: z.string().url(), session: selection.session, display: selection.display };
+const legacyRdStateSchema = z.discriminatedUnion('enabled', [
+    z.strictObject({ ...legacySelection, enabled: z.literal(true), installation: z.string().startsWith('/'), artifact: rdArtifactSchema }),
+    z.strictObject({ ...legacySelection, enabled: z.literal(false), installation: z.string().startsWith('/').optional(), artifact: rdArtifactSchema.optional() }),
+]);
+export const rdStateSchema = z.preprocess(value => {
+    const legacy = legacyRdStateSchema.safeParse(value);
+    if (!legacy.success)
+        return value;
+    const { server, ...state } = legacy.data;
+    return { ...state, schemaVersion: 2, artifactSource: server };
+}, currentRdStateSchema);
+export async function readRdState(directory) {
+    let file;
+    try {
+        file = await fs.open(path.join(directory, 'rd', 'state.json'), constants.O_RDONLY | constants.O_NOFOLLOW);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    try {
+        const stat = await file.stat();
+        if (!stat.isFile() || stat.uid !== process.getuid?.() || stat.mode & 0o077 || stat.size > 32768)
+            throw new Error('Unsafe remote desktop state');
+        return rdStateSchema.parse(JSON.parse(await file.readFile('utf8')));
+    }
+    finally {
+        await file.close();
+    }
+}
+export async function writeRdState(directory, state) {
+    const root = path.join(directory, 'rd');
+    await privateDirectory(root);
+    const staging = path.join(root, `.state-${randomUUID()}`);
+    try {
+        await fs.writeFile(staging, JSON.stringify(rdStateSchema.parse(state)), { mode: 0o600, flag: 'wx' });
+        await fs.rename(staging, path.join(root, 'state.json'));
+    }
+    finally {
+        await fs.rm(staging, { force: true });
+    }
+}

package/dist/workstation/rd/update.js

@@ -0,0 +1,168 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { installRd, rdArtifactSchema, rdPlatform, verifyRdInstallation, RD_DEVICE_HOST_PLATFORM } from './artifact.js';
+import { readRdState, writeRdState } from './state.js';
+import { assertLockOwnership, withPrivateLock } from '../control/locks.js';
+import { privateDirectory } from '../keepers/kit/paths.js';
+import { z } from 'zod';
+import { CLIENT_VERSION } from '../version.js';
+import { authenticatedRdActivation, completeRdActivation, guardRdActivation, rdStateDigest, readPrivateRdFile } from '../update/rdRollback.js';
+const execute = promisify(execFile);
+async function selfTest(installation, artifact, options) {
+    if (options.selfTest)
+        return options.selfTest(installation);
+    const names = artifact.ipcVersion === 1 ? ['axom-desktop-keeper'] : ['axom-desktop-keeper', 'axom-display', 'axom-desktop-session'];
+    for (const name of names) {
+        await (options.execute ?? execute)(path.join(installation, 'bin', name), ['--self-test'], {
+            timeout: 5000, maxBuffer: 8192, env: { ...process.env, AXOM_ACCESS_TOKEN: undefined },
+        });
+    }
+}
+export async function adoptBundledRd(directory, server, options = {}) {
+    await withPrivateLock(path.join(directory, 'rd', 'install'), () => adoptBundle(directory, server, options));
+}
+async function adoptBundle(directory, server, options) {
+    if (await readRdState(directory) !== undefined)
+        return;
+    const bundle = options.bundle ?? (process.env.AXOM_DESKTOP_BUNDLED_RD_ROOT && process.env.AXOM_DESKTOP_BUNDLED_RD_MANIFEST ? {
+        root: process.env.AXOM_DESKTOP_BUNDLED_RD_ROOT, manifest: process.env.AXOM_DESKTOP_BUNDLED_RD_MANIFEST, display: process.env.DISPLAY,
+    } : undefined);
+    if (!bundle)
+        return;
+    const catalog = z.object({ schemaVersion: z.literal(1), artifacts: z.record(z.string(), rdArtifactSchema) }).parse(JSON.parse(await fs.readFile(bundle.manifest, 'utf8')));
+    const artifact = catalog.artifacts[RD_DEVICE_HOST_PLATFORM];
+    if (!artifact || artifact.ipcVersion !== 2)
+        throw new Error('Bundled RD requires the device-host platform and IPC 2 runtime');
+    if (!bundle.display || !/^:\d+(?:\.\d+)?$/.test(bundle.display))
+        throw new Error('Bundled RD requires a local X11 DISPLAY');
+    if (!path.isAbsolute(bundle.root))
+        throw new Error('Bundled RD runtime root must be absolute');
+    await verifyRdInstallation(bundle.root, artifact);
+    await selfTest(bundle.root, artifact, options);
+    assertLockOwnership();
+    await writeRdState(directory, { schemaVersion: 2, enabled: true, artifactSource: server, session: 'existing', display: bundle.display, installation: bundle.root, artifact });
+}
+function requireSupportedIpc(artifact) {
+    if (artifact.ipcVersion !== 1 && artifact.ipcVersion !== 2)
+        throw new Error(`Unsupported RD IPC version ${artifact.ipcVersion}; this CLI supports versions 1 and 2`);
+}
+function reason(error) { return error instanceof Error ? error.message : String(error); }
+async function writeStatus(directory, status) {
+    const root = path.join(directory, 'rd');
+    await privateDirectory(root);
+    const staging = path.join(root, `.update-status-${randomUUID()}`);
+    try {
+        await fs.writeFile(staging, JSON.stringify({ schemaVersion: 1, updatedAt: new Date().toISOString(), ...status }), { flag: 'wx', mode: 0o600 });
+        assertLockOwnership();
+        await fs.rename(staging, path.join(root, 'update-status.json'));
+    }
+    finally {
+        await fs.rm(staging, { force: true });
+    }
+}
+export async function synchronizeRd(directory, server, options = {}) {
+    return withPrivateLock(path.join(directory, 'rd', 'install'), async () => {
+        let previous;
+        try {
+            await adoptBundle(directory, server, options);
+            previous = await readRdState(directory);
+            if (!previous?.enabled)
+                return;
+            requireSupportedIpc(previous.artifact);
+        }
+        catch (error) {
+            await writeStatus(directory, { state: 'blocked', reason: reason(error) });
+            throw error;
+        }
+        const fallback = async (error) => {
+            try {
+                requireSupportedIpc(previous.artifact);
+                await verifyRdInstallation(previous.installation, previous.artifact);
+                await selfTest(previous.installation, previous.artifact, options);
+            }
+            catch (fallbackError) {
+                await writeStatus(directory, { state: 'blocked', reason: reason(error), fallbackReason: reason(fallbackError), previousVersion: previous.artifact.version });
+                throw new Error(`RD synchronization failed: ${reason(error)}; previous installation is unusable: ${reason(fallbackError)}`, { cause: fallbackError });
+            }
+            await writeStatus(directory, { state: 'fallback', activeVersion: previous.artifact.version, reason: reason(error) });
+        };
+        let installed;
+        try {
+            const platform = options.platform ?? rdPlatform(await fs.readFile('/etc/os-release', 'utf8'), process.arch);
+            installed = await (options.install ?? installRd)(directory, previous.artifactSource, platform, options.fetch ?? globalThis.fetch);
+            requireSupportedIpc(installed.artifact);
+            await verifyRdInstallation(installed.directory, installed.artifact);
+            await selfTest(installed.directory, installed.artifact, options);
+            const next = { ...previous, installation: installed.directory, artifact: installed.artifact };
+            if (options.deferActivation) {
+                if (installed.artifact.sha512 === previous.artifact.sha512) {
+                    await writeStatus(directory, { state: 'current', activeVersion: previous.artifact.version });
+                    return;
+                }
+                await writeStatus(directory, { state: 'staged', activeVersion: previous.artifact.version, targetVersion: installed.artifact.version,
+                    reason: 'RD activation waits for an idle remote desktop' });
+                const candidate = installed;
+                const expected = JSON.stringify(previous);
+                return async () => withPrivateLock(path.join(directory, 'rd', 'install'), async () => {
+                    if (JSON.stringify(await readRdState(directory)) !== expected)
+                        return;
+                    try {
+                        await verifyRdInstallation(candidate.directory, candidate.artifact);
+                        await selfTest(candidate.directory, candidate.artifact, options);
+                        if (await guardRdActivation(directory, options.cliVersion ?? CLIENT_VERSION, next))
+                            throw new Error('RD activation waits for authenticated CLI update readiness');
+                        assertLockOwnership();
+                        await writeRdState(directory, next);
+                    }
+                    catch (error) {
+                        await fallback(error);
+                        throw error;
+                    }
+                    await completeRdActivation(directory, options.cliVersion ?? CLIENT_VERSION);
+                    await writeStatus(directory, { state: 'updated', activeVersion: candidate.artifact.version, previousVersion: previous.artifact.version,
+                        previousInstallation: previous.installation, previousArtifact: previous.artifact });
+                });
+            }
+            const guard = await guardRdActivation(directory, options.cliVersion ?? CLIENT_VERSION, next);
+            if (guard) {
+                await verifyRdInstallation(previous.installation, previous.artifact);
+                await selfTest(previous.installation, previous.artifact, options);
+                await writeStatus(directory, { state: 'staged', activeVersion: previous.artifact.version, targetVersion: installed.artifact.version,
+                    reason: 'RD activation waits for authenticated CLI readiness because this watchdog cannot restore the previous RD state' });
+                const candidate = installed;
+                return async () => withPrivateLock(path.join(directory, 'rd', 'install'), async () => {
+                    if (!await authenticatedRdActivation(directory, guard))
+                        return;
+                    const active = await readPrivateRdFile(path.join(directory, 'rd', 'state.json'), 32768);
+                    if (active === null || rdStateDigest(active) !== guard.previousSha256)
+                        return;
+                    try {
+                        await verifyRdInstallation(candidate.directory, candidate.artifact);
+                        await selfTest(candidate.directory, candidate.artifact, options);
+                        assertLockOwnership();
+                        await writeRdState(directory, next);
+                    }
+                    catch (error) {
+                        await fallback(error);
+                        return;
+                    }
+                    await writeStatus(directory, { state: 'updated', activeVersion: candidate.artifact.version, previousVersion: previous.artifact.version,
+                        previousInstallation: previous.installation, previousArtifact: previous.artifact });
+                });
+            }
+            assertLockOwnership();
+            await writeRdState(directory, next);
+        }
+        catch (error) {
+            await fallback(error);
+            return;
+        }
+        await completeRdActivation(directory, options.cliVersion ?? CLIENT_VERSION);
+        await writeStatus(directory, { state: installed.artifact.sha512 === previous.artifact.sha512 ? 'current' : 'updated',
+            activeVersion: installed.artifact.version, previousVersion: previous.artifact.version, previousInstallation: previous.installation,
+            previousArtifact: previous.artifact });
+    });
+}