@platless/axom-cli 0.5.9 → 0.6.52

package/dist/workstation/runtime/deviceServices.js

@@ -0,0 +1,117 @@
+import { updateServiceContext } from '../config.js';
+import { SystemMetricsSampler } from '../systemMetrics.js';
+import { ToolchainProbe } from '../toolchain.js';
+import { terminalEnv, terminalShell } from '../tools/terminalRouter.js';
+import { preflightOptionalPty } from '../update/ptyPreflight.js';
+import { DeviceEventRouter } from './events.js';
+import { DeviceOwnership } from '../desktopControl/deviceOwnership.js';
+import { DeviceDesktopRuntime } from './deviceDesktop.js';
+import { DeviceUpdateCoordinator } from '../update/deviceCoordinator.js';
+export class DeviceUpdateService {
+    generations = new Map();
+    releases = new Map();
+    coordinator;
+    constructor(options) { if (options)
+        this.configure(options); }
+    configure(options) {
+        if (this.coordinator)
+            throw new Error('Device update coordinator is already configured');
+        this.coordinator = new DeviceUpdateCoordinator({ ...options, management: id => { const origin = this.generations.get(id); return origin ? { origin, release: this.releases.get(id) } : undefined; } });
+    }
+    ready(origin, release) {
+        this.generations.set(origin.registrationId, Object.freeze({ ...origin }));
+        if (release)
+            this.releases.set(origin.registrationId, { ...release });
+        else
+            this.releases.delete(origin.registrationId);
+        return Promise.resolve();
+    }
+    closed(origin) {
+        if (this.generations.get(origin.registrationId)?.managementGeneration === origin.managementGeneration) {
+            this.generations.delete(origin.registrationId);
+            this.releases.delete(origin.registrationId);
+        }
+    }
+    async handle(origin, command) {
+        const current = this.generations.get(origin.registrationId);
+        const valid = current?.managementGeneration === origin.managementGeneration && current.server === origin.server;
+        if (valid && this.coordinator)
+            return this.coordinator.request(Object.freeze({ ...origin }), command);
+        return { phase: 'FAILED', commandId: command.commandId, version: command.release.version, error: valid ? 'Device updates require the device activity and source compatibility policy; update is unavailable until that policy is integrated' : 'The originating management connection is no longer current' };
+    }
+    async local(operationId, release, source) {
+        if (this.coordinator && release && source)
+            return this.coordinator.local(operationId, release, source);
+        return { phase: 'FAILED', commandId: operationId, error: 'Device update source and activity policy is not yet integrated' };
+    }
+    async health(request, generation) {
+        if (!this.coordinator)
+            throw new Error('Device successor health is not configured');
+        return this.coordinator.health(request, generation);
+    }
+    async snapshot(registrationId) {
+        if (!this.coordinator)
+            return;
+        const origin = this.generations.get(registrationId);
+        return origin ? this.coordinator.snapshot(origin) : { phase: 'SUCCEEDED', remoteForcePolicy: 'drain-only' };
+    }
+}
+export function createDeviceServices(options) {
+    const desktopOwnership = new DeviceOwnership();
+    const workspaces = [];
+    const configurations = new Map();
+    const factRecipients = new Set();
+    const facts = new Map();
+    const events = new DeviceEventRouter((registrationId, event) => facts.get(registrationId)?.(event), factRecipients);
+    const desktop = new DeviceDesktopRuntime(options.root, desktopOwnership, options.resolveDesktopProvider);
+    const metrics = new SystemMetricsSampler(workspaces, options.metricsDependencies);
+    const toolchain = new ToolchainProbe(() => terminalShell(), () => terminalEnv());
+    let maintenance = Promise.resolve();
+    let started;
+    let stopped = false;
+    const refresh = () => {
+        workspaces.splice(0, workspaces.length, ...[...configurations].flatMap(([id, configuration]) => (configuration.workspaces ?? []).map((workspace, index) => ({ name: `${id}:${index}`, cwd: workspace.cwd }))));
+        metrics.refreshWorkspaces();
+    };
+    return {
+        desktopOwnership,
+        get desktopProvider() { return options.desktopProvider ?? desktop.provider; },
+        desktopFacts: () => desktop.facts(),
+        desktopActivity: () => desktop.activity(),
+        watchDesktop: (id, consumer) => desktop.watch(id, consumer),
+        watchFacts(registrationId, receive) {
+            facts.set(registrationId, receive);
+            factRecipients.add(registrationId);
+            return () => { if (facts.get(registrationId) === receive) {
+                facts.delete(registrationId);
+                factRecipients.delete(registrationId);
+            } };
+        },
+        publishToolState() { events.publish({ scope: 'device', kind: 'tool-state', payload: { changed: true } }); },
+        updates: new DeviceUpdateService(),
+        start() {
+            started ??= (async () => { await (options.preflight ?? (() => preflightOptionalPty(updateServiceContext(options.root))))(); await desktop.start(); await metrics.start(); if (stopped)
+                metrics.stop();
+            else
+                toolchain.start(); })();
+            return started;
+        },
+        async stop() { stopped = true; await started?.catch(() => { }); await maintenance; await desktop.stop(); metrics.stop(); toolchain.stop(); },
+        register(id, configuration) { configurations.set(id, configuration); refresh(); },
+        unregister(id) { configurations.delete(id); facts.delete(id); factRecipients.delete(id); refresh(); },
+        metrics(id) {
+            const snapshot = metrics.snapshot();
+            if (!snapshot)
+                return null;
+            const owned = configurations.get(id)?.workspaces ?? [];
+            return { ...snapshot, storagePools: snapshot.storagePools.flatMap(pool => {
+                    const names = pool.workspaces.flatMap(name => { const index = owned.findIndex((_workspace, position) => name === `${id}:${position}`); return index < 0 ? [] : [owned[index].name]; });
+                    return names.length ? [{ ...pool, label: 'Storage', workspaces: names }] : [];
+                }) };
+        },
+        toolchain: () => toolchain.current(),
+        rdSource: () => { const sources = new Set([...configurations.values()].map(configuration => configuration.server)); return sources.size === 1 ? sources.values().next().value : undefined; },
+        maintainAdapters(operation) { const result = maintenance.then(async () => { if (!stopped)
+            await operation(); }); maintenance = result.catch(() => { }); return result; },
+    };
+}

package/dist/workstation/runtime/events.js

@@ -0,0 +1,20 @@
+export class DeviceEventRouter {
+    send;
+    registrations;
+    constructor(send, registrations) {
+        this.send = send;
+        this.registrations = registrations;
+    }
+    publish(event) {
+        if (event.scope === 'registration') {
+            if (this.registrations.has(event.registrationId))
+                this.send(event.registrationId, event);
+            return;
+        }
+        const payload = event.payload;
+        if (!['metrics', 'desktop-capability', 'tool-state'].includes(event.kind) || !payload || typeof payload !== 'object' || Array.isArray(payload) || Object.keys(payload).length !== 1 || payload.changed !== true)
+            throw new Error('Device fact must contain only a change notification');
+        for (const registrationId of [...this.registrations])
+            this.send(registrationId, { ...event, payload: { changed: true } });
+    }
+}

package/dist/workstation/runtime/ownership.js

@@ -0,0 +1,100 @@
+import { constants, closeSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { readLegacyRegistrationSources } from '../registrations/migration.js';
+import { RegistrationStore } from '../registrations/store.js';
+const verifiedLegacySources = new WeakMap();
+export class RegistrationOwnershipError extends Error {
+    code = 'REGISTRATION_OWNERSHIP';
+    constructor(message, cause) { super(message, { cause }); this.name = 'RegistrationOwnershipError'; }
+}
+export function legacySourcesOf(ownership) {
+    return ownership ? verifiedLegacySources.get(ownership) : undefined;
+}
+export async function resolveRegistrationOwnership(registration, sources) {
+    if (!sources)
+        return Object.freeze({ registrationId: registration.id });
+    const verified = await readLegacyRegistrationSources(sources.adapterCacheDirectory, registration.id);
+    if (!verified || JSON.stringify(verified) !== JSON.stringify(sources) || registration.keeperConfigDirectory !== sources.adapterCacheDirectory)
+        throw new RegistrationOwnershipError('Legacy registration ownership needs verification');
+    const current = (await new RegistrationStore(sources.adapterCacheDirectory).read(registration.id)).registration;
+    if (current.server !== registration.server || current.ownerUserId !== registration.ownerUserId || current.workstationId !== registration.workstationId || current.keeperConfigDirectory !== registration.keeperConfigDirectory)
+        throw new RegistrationOwnershipError('Legacy registration ownership changed');
+    const ownership = Object.freeze({ registrationId: registration.id, legacySources: Object.freeze({ ...verified }) });
+    verifiedLegacySources.set(ownership, ownership.legacySources);
+    return ownership;
+}
+export function legacyOwnershipAllowed(ownership, directory, kind) {
+    const sources = legacySourcesOf(ownership);
+    if (!sources)
+        return false;
+    const resolved = path.resolve(directory);
+    if (kind === 'journal')
+        return resolved === path.resolve(sources.journalDirectory);
+    if (kind === 'local-outbox')
+        return path.dirname(resolved) === path.resolve(sources.localOutboxDirectory);
+    const root = path.join(sources.adapterCacheDirectory, 'keepers', kind);
+    return resolved === root || path.dirname(resolved) === root;
+}
+export function assertRegistrationOwner(value, ownership, legacy) {
+    if (!ownership)
+        return;
+    if (value && typeof value === 'object' && (value.registrationId === ownership.registrationId || (value.registrationId === undefined && legacy && legacyOwnershipAllowed(ownership, legacy.directory, legacy.kind))))
+        return;
+    throw new RegistrationOwnershipError('Registration owner is unknown or mismatched; state quarantined');
+}
+export function readOwnerFile(file) {
+    let descriptor;
+    try {
+        descriptor = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        const stat = fstatSync(descriptor);
+        if (!stat.isFile() || stat.nlink !== 1 || stat.size > 4096 || (stat.mode & 0o077) || (process.getuid && stat.uid !== process.getuid()))
+            throw new RegistrationOwnershipError('Unsafe registration owner metadata');
+        const value = JSON.parse(readFileSync(descriptor, 'utf8'));
+        if (value?.schemaVersion !== 1 || typeof value.registrationId !== 'string' || !value.registrationId)
+            throw new RegistrationOwnershipError('Invalid registration owner metadata');
+        return value;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT' || error instanceof RegistrationOwnershipError)
+            throw error;
+        throw new RegistrationOwnershipError('Registration owner metadata could not be verified; state quarantined', error);
+    }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+    }
+}
+export function assertOwnedDirectory(directory, ownership, kind) {
+    if (!ownership)
+        return;
+    try {
+        mkdirSync(directory, { recursive: true, mode: 0o700 });
+        const stat = lstatSync(directory);
+        if (!stat.isDirectory() || stat.isSymbolicLink() || (process.getuid && stat.uid !== process.getuid()))
+            throw new RegistrationOwnershipError('Unsafe registration owner directory');
+        const file = path.join(directory, 'registration-owner.json');
+        try {
+            assertRegistrationOwner(readOwnerFile(file), ownership);
+            return;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        if (readdirSync(directory).length && !(kind && legacyOwnershipAllowed(ownership, directory, kind)))
+            throw new RegistrationOwnershipError('Registration owner is unknown; state quarantined');
+        try {
+            writeFileSync(file, JSON.stringify({ schemaVersion: 1, registrationId: ownership.registrationId }), { mode: 0o600, flag: 'wx' });
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+        }
+        assertRegistrationOwner(readOwnerFile(file), ownership);
+    }
+    catch (error) {
+        if (error instanceof RegistrationOwnershipError)
+            throw error;
+        throw new RegistrationOwnershipError('Registration owner directory could not be verified; state quarantined', error);
+    }
+}