@platless/axom-cli 0.6.36 → 0.6.52

package/dist/workstation/registrations/migration.js

@@ -0,0 +1,356 @@
+import { constants, promises as fs } from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { createHash, randomUUID } from 'node:crypto';
+import { z } from 'zod';
+import { loadClientConfig, readKeys } from '../config.js';
+import { BindingStore } from '../control/bindingStore.js';
+import { assertLockOwnership, assertWorkstationOperationLock, withWorkstationLock } from '../control/locks.js';
+import { LocalControlError, operationRecordSchema } from '../control/protocol.js';
+import { inspectRuntime } from '../control/runtimeClient.js';
+import { normalizeWorkstationServer } from '../control/serverIdentity.js';
+import { registrationIdSchema } from './model.js';
+import { RegistrationStore } from './store.js';
+import { assertDeviceUpdateTransitionSafe } from '../control/updateTransition.js';
+import { withLegacyBridgeMigration, assertLegacyBridgeMutationAllowed } from '../update/legacyBridge.js';
+const files = ['config.yml', 'client.key', 'server.pub'];
+const hashSchema = z.string().regex(/^[a-f0-9]{64}$/);
+const receiptSchema = z.object({
+    schemaVersion: z.literal(1), registrationId: registrationIdSchema, legacyRevision: hashSchema,
+    keeperServer: z.string().min(1), workstationId: z.string().min(1), ownerUserId: z.string().min(1),
+    files: z.object({ 'config.yml': hashSchema, 'client.key': hashSchema, 'server.pub': hashSchema }).strict(),
+    sources: z.object({ journalDirectory: z.string(), localOutboxDirectory: z.string(), adapterCacheDirectory: z.string() }).strict(),
+    state: z.enum(['staged', 'committed', 'complete']), registrationRevision: hashSchema.optional(),
+}).strict().refine(value => value.state === 'staged' || value.registrationRevision !== undefined);
+const removalNamespaces = new WeakMap();
+export function assertRemovalNamespace(namespace) {
+    const lease = removalNamespaces.get(namespace);
+    if (!lease || assertWorkstationOperationLock(namespace.root) !== lease)
+        throw new LocalControlError('CORRUPT_IDENTITY', 'Removal namespace has not been verified in this operation');
+}
+export async function resolveRemovalNamespaceLocked(root, id, expectedRevision) {
+    root = path.resolve(root);
+    assertWorkstationOperationLock(root);
+    const registration = await new RegistrationStore(root).readMetadata(id, expectedRevision);
+    let server = registration.server;
+    const legacy = registration.keeperConfigDirectory === root;
+    if (legacy) {
+        await directory(root);
+        const receipt = await readReceipt(root);
+        if (!receipt || receipt.state !== 'complete' || !(await checkDevice(root))?.initialized || receipt.registrationId !== id || normalizeWorkstationServer(receipt.keeperServer) !== registration.server || receipt.ownerUserId !== registration.ownerUserId || receipt.workstationId !== registration.workstationId)
+            throw new LocalControlError('CORRUPT_IDENTITY', 'Legacy removal lineage needs verification');
+        for (const name of [...files, 'identity.pending'])
+            if (await present(path.join(root, name)))
+                throw new LocalControlError('CORRUPT_IDENTITY', 'Legacy identity retirement needs verification');
+        await checkSources(root);
+        server = receipt.keeperServer;
+    }
+    assertWorkstationOperationLock(root);
+    const namespace = Object.freeze({ root, registrationId: id, revision: registration.revision, configDir: registration.keeperConfigDirectory, dataDirectory: registration.dataDirectory, workstationId: registration.workstationId, server, legacy });
+    removalNamespaces.set(namespace, assertWorkstationOperationLock(root));
+    return namespace;
+}
+const missing = (error) => error.code === 'ENOENT';
+const hash = (value) => createHash('sha256').update(value).digest('hex');
+const receiptFile = (root) => path.join(root, 'legacy-migration.json');
+function sourcePaths(root) {
+    return { journalDirectory: path.join(root, 'agents/sessions'), localOutboxDirectory: path.join(root, 'agents/local'), adapterCacheDirectory: root };
+}
+async function directory(directory) {
+    const stat = await fs.lstat(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0 || (process.getuid && stat.uid !== process.getuid()))
+        throw Error('Unsafe migration directory');
+}
+async function normalizeCanonicalLegacyParent(root) {
+    const parent = path.join(os.homedir(), '.axom');
+    if (root !== path.join(parent, 'workstation'))
+        return;
+    const handle = await fs.open(parent, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    try {
+        const stat = await handle.stat();
+        if (!stat.isDirectory() || (process.getuid && stat.uid !== process.getuid()))
+            throw Error('Unsafe canonical CLI metadata parent');
+        if ((stat.mode & 0o7777) !== 0o700) {
+            await handle.chmod(0o700);
+            await handle.sync();
+        }
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function file(file, publicKey = false) {
+    const handle = await fs.open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.nlink !== 1 || stat.size > 1_048_576 || (stat.mode & (publicKey ? 0o022 : 0o077)) !== 0 || (process.getuid && stat.uid !== process.getuid()))
+            throw Error('Unsafe migration file');
+        const buffer = Buffer.alloc(stat.size + 1);
+        const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+        if (bytesRead !== stat.size)
+            throw Error('Migration file changed');
+        return buffer.subarray(0, bytesRead);
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function present(file) {
+    try {
+        await fs.lstat(file);
+        return true;
+    }
+    catch (error) {
+        if (missing(error))
+            return false;
+        throw error;
+    }
+}
+async function sync(root) {
+    const handle = await fs.open(root, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function writeReceipt(root, receipt) {
+    assertLockOwnership();
+    await directory(root);
+    if (await present(receiptFile(root)))
+        await file(receiptFile(root));
+    const temporary = path.join(root, `.migration-${randomUUID()}`);
+    const handle = await fs.open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+    try {
+        await handle.writeFile(JSON.stringify(receiptSchema.parse(receipt)));
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    try {
+        assertLockOwnership();
+        await fs.rename(temporary, receiptFile(root));
+        await sync(root);
+    }
+    finally {
+        await fs.rm(temporary, { force: true });
+    }
+}
+async function readReceipt(root) {
+    if (!await present(receiptFile(root)))
+        return null;
+    const receipt = receiptSchema.parse(JSON.parse((await file(receiptFile(root))).toString()));
+    if (JSON.stringify(receipt.sources) !== JSON.stringify(sourcePaths(root)))
+        throw Error('Unrecognized legacy source paths');
+    normalizeWorkstationServer(receipt.keeperServer);
+    return receipt;
+}
+async function checkSources(root, normalizeLegacyModes = false) {
+    await directory(root);
+    for (const relative of ['agents', 'agents/sessions', 'agents/local', 'acp-adapters']) {
+        const current = path.join(root, relative);
+        if (!await present(current))
+            continue;
+        if (!normalizeLegacyModes) {
+            await directory(current);
+            continue;
+        }
+        // Older CLIs created these owned journals/caches with the login umask (0755/0775).
+        // Tighten the opened directory itself, preserving every entry and the keeper namespace.
+        const handle = await fs.open(current, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+        try {
+            const stat = await handle.stat();
+            if (!stat.isDirectory() || (process.getuid && stat.uid !== process.getuid()))
+                throw Error('Unsafe migration source directory');
+            if ((stat.mode & 0o7777) !== 0o700) {
+                await handle.chmod(0o700);
+                await handle.sync();
+            }
+        }
+        finally {
+            await handle.close();
+        }
+    }
+}
+async function checkDevice(root) {
+    if (!await present(path.join(root, 'device.json')))
+        return null;
+    return z.object({ schemaVersion: z.literal(1), deviceId: z.string().uuid(), initialized: z.boolean() }).strict().parse(JSON.parse((await file(path.join(root, 'device.json'))).toString()));
+}
+async function checkLegacyEvidence(root) {
+    if (await present(path.join(root, 'identity.pending')))
+        throw Error('Incomplete legacy identity');
+    if (await present(path.join(root, 'operation.json'))) {
+        const operation = operationRecordSchema.parse(JSON.parse((await file(path.join(root, 'operation.json'))).toString()));
+        if (operation.outcome === 'pending' || operation.outcome === 'unknown')
+            throw Error('Unresolved legacy operation');
+    }
+    if (await present(path.join(root, 'binding-history.json')))
+        await file(path.join(root, 'binding-history.json'));
+    await new BindingStore(root).history();
+}
+async function verifyRemainingFiles(root, receipt, all) {
+    for (const name of files) {
+        const current = path.join(root, name);
+        if (!all && !await present(current))
+            continue;
+        if (hash(await file(current, name === 'server.pub')) !== receipt.files[name])
+            throw Error('Legacy identity changed since migration began');
+    }
+}
+function legacyRevision(identity) {
+    const registration = identity.registration;
+    const binding = { server: registration.server, workstationId: registration.workstationId, ownerUserId: registration.ownerUserId };
+    return createHash('sha256').update(JSON.stringify(binding)).update('\0').update(identity.clientKey.toString('base64')).update('\0').update(identity.serverPub.toString('base64')).digest('hex');
+}
+async function verifyImported(store, receipt) {
+    const identity = await store.read(receipt.registrationId);
+    const registration = identity.registration;
+    if (registration.server !== normalizeWorkstationServer(receipt.keeperServer) || registration.ownerUserId !== receipt.ownerUserId || registration.workstationId !== receipt.workstationId || registration.keeperConfigDirectory !== store.root || legacyRevision(identity) !== receipt.legacyRevision || (receipt.registrationRevision && registration.revision !== receipt.registrationRevision))
+        throw Error('Migration registration changed');
+}
+export async function migrateLegacyRegistration(root, options = {}) {
+    root = path.resolve(root);
+    try {
+        await directory(root);
+        await normalizeCanonicalLegacyParent(root);
+    }
+    catch (error) {
+        return { kind: missing(error) ? 'absent' : 'needs-verification' };
+    }
+    let injected;
+    const checkpoint = async (stage) => { try {
+        await options.afterStage?.(stage);
+    }
+    catch (error) {
+        injected = error;
+        throw error;
+    } };
+    try {
+        return await withLegacyBridgeMigration(root, () => withWorkstationLock(root, 'operation', async () => {
+            await assertDeviceUpdateTransitionSafe(root, options.startupPackage);
+            await directory(root);
+            const device = await checkDevice(root);
+            let receipt = await readReceipt(root);
+            if (receipt?.state === 'complete') {
+                if (!device?.initialized)
+                    throw Error('Missing migration device marker');
+                for (const name of files)
+                    if (await present(path.join(root, name)))
+                        throw Error('Legacy identity reappeared after migration');
+                return { kind: 'already-migrated', registrationId: receipt.registrationId };
+            }
+            if ((await inspectRuntime(root)).state !== 'stopped')
+                return { kind: 'needs-verification' };
+            await checkLegacyEvidence(root);
+            await checkSources(root, true);
+            if (!receipt) {
+                const legacy = await new BindingStore(root).inspect();
+                if (legacy.identityState === 'absent')
+                    return { kind: 'absent' };
+                if (legacy.identityState !== 'ready' || !legacy.binding?.ownerUserId)
+                    return { kind: 'needs-verification' };
+                const config = await loadClientConfig(root);
+                receipt = { schemaVersion: 1, registrationId: randomUUID(), legacyRevision: legacy.revision, keeperServer: config.server, workstationId: legacy.binding.workstationId, ownerUserId: legacy.binding.ownerUserId, files: { 'config.yml': hash(await file(path.join(root, 'config.yml'))), 'client.key': hash(await file(path.join(root, 'client.key'))), 'server.pub': hash(await file(path.join(root, 'server.pub'), true)) }, sources: sourcePaths(root), state: 'staged' };
+                await writeReceipt(root, receipt);
+                await checkpoint('receipt-persisted');
+            }
+            await verifyRemainingFiles(root, receipt, false);
+            const store = new RegistrationStore(root, { afterStage: stage => checkpoint(`store-${stage}`) });
+            const registrations = await store.list();
+            const registrationId = receipt.registrationId;
+            let registration = registrations.find(entry => entry.id === registrationId);
+            if (!registration) {
+                if (receipt.state !== 'staged')
+                    throw Error('Committed migration identity is missing');
+                await verifyRemainingFiles(root, receipt, true);
+                const legacy = await new BindingStore(root).inspect();
+                if (legacy.identityState !== 'ready' || legacy.revision !== receipt.legacyRevision)
+                    throw Error('Legacy identity changed');
+                const configuration = await loadClientConfig(root);
+                const keys = await readKeys(root);
+                registration = await store.commit({ registration: { id: receipt.registrationId, server: receipt.keeperServer, ownerUserId: receipt.ownerUserId, workstationId: receipt.workstationId, dataDirectory: path.join(root, 'registrations', receipt.registrationId, 'data'), keeperConfigDirectory: root }, ...keys, expectedRevision: null, configuration });
+            }
+            await verifyImported(store, receipt);
+            if (receipt.state === 'staged') {
+                receipt = { ...receipt, state: 'committed', registrationRevision: registration.revision };
+                await writeReceipt(root, receipt);
+            }
+            await checkpoint('registration-committed');
+            for (const name of files) {
+                const current = path.join(root, name);
+                if (await present(current)) {
+                    if (hash(await file(current, name === 'server.pub')) !== receipt.files[name])
+                        throw Error('Legacy retirement source changed');
+                    assertLockOwnership();
+                    await fs.unlink(current);
+                    await sync(root);
+                }
+                await checkpoint(`retired-${name}`);
+            }
+            await writeReceipt(root, { ...receipt, state: 'complete' });
+            return { kind: 'migrated', registrationId: receipt.registrationId };
+        }));
+    }
+    catch (error) {
+        if (error === injected)
+            throw error;
+        return { kind: 'needs-verification' };
+    }
+}
+export async function readLegacyRegistrationSources(root, id) {
+    root = path.resolve(root);
+    registrationIdSchema.parse(id);
+    await directory(root);
+    return withWorkstationLock(root, 'operation', async () => {
+        const device = await checkDevice(root);
+        const receipt = await readReceipt(root);
+        if (!receipt || receipt.registrationId !== id)
+            return null;
+        if (receipt.state !== 'complete' || !device?.initialized)
+            throw Error('Legacy migration is not complete');
+        const store = new RegistrationStore(root);
+        const inspection = await store.inspect();
+        if (!inspection.known)
+            throw Error('Registration storage needs verification');
+        const entry = inspection.entries.find(entry => entry.id === id);
+        if (!entry)
+            return null;
+        if (entry.state !== 'ready')
+            throw Error('Migrated registration needs verification');
+        const registration = entry.registration;
+        if (registration.server !== normalizeWorkstationServer(receipt.keeperServer) || registration.ownerUserId !== receipt.ownerUserId || registration.workstationId !== receipt.workstationId || registration.keeperConfigDirectory !== root)
+            throw Error('Legacy ownership changed');
+        await checkSources(root);
+        return { ...receipt.sources, keeperServer: receipt.keeperServer };
+    });
+}
+export async function assertRegistrationEnrollmentAdmission(root, options = {}) {
+    await assertLegacyBridgeMutationAllowed(root, options.startupPackage);
+    try {
+        await directory(root);
+        const receipt = await readReceipt(root);
+        if (receipt) {
+            if (receipt.state !== 'complete' || !(await checkDevice(root))?.initialized)
+                throw Error('Incomplete legacy migration');
+            for (const name of [...files, 'identity.pending'])
+                if (await present(path.join(root, name)))
+                    throw Error('Legacy identity remains');
+            return;
+        }
+        for (const name of [...files, 'identity.pending']) {
+            if (await present(path.join(root, name)))
+                throw Error('Legacy registration requires handoff');
+        }
+        const historicalEvidence = await present(path.join(root, 'operation.json')) || await present(path.join(root, 'binding-history.json'));
+        if (historicalEvidence)
+            await checkLegacyEvidence(root);
+        if ((historicalEvidence || !await checkDevice(root)) && (await inspectRuntime(root)).state !== 'stopped')
+            throw Error('Legacy runtime requires verification');
+    }
+    catch {
+        throw new LocalControlError('CORRUPT_IDENTITY', 'Legacy workstation registration requires migration or verification before enrollment');
+    }
+}

package/dist/workstation/registrations/model.js

@@ -0,0 +1,34 @@
+import { z } from 'zod';
+import { normalizeWorkstationServer } from '../control/serverIdentity.js';
+export const registrationIdSchema = z.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/);
+export const registrationServerSchema = z.string().transform((server, context) => {
+    try {
+        return normalizeWorkstationServer(server);
+    }
+    catch {
+        context.addIssue({ code: 'custom', message: 'Invalid workstation server URL' });
+        return z.NEVER;
+    }
+});
+export const registrationIdentitySchema = z.object({
+    id: registrationIdSchema,
+    server: registrationServerSchema,
+    ownerUserId: z.string().min(1),
+    workstationId: z.string().min(1),
+    revision: z.string().min(1),
+}).strict();
+export const registrationSchema = registrationIdentitySchema.extend({
+    dataDirectory: z.string().min(1),
+    keeperConfigDirectory: z.string().min(1),
+}).strict();
+export const registrationActivitySchema = z.object({
+    known: z.boolean(),
+    agents: z.number().int().nonnegative(),
+    terminals: z.number().int().nonnegative(),
+    commands: z.number().int().nonnegative(),
+    transfers: z.number().int().nonnegative(),
+    desktopConsumers: z.number().int().nonnegative(),
+}).strict();
+export function registrationKey(server, ownerUserId) {
+    return JSON.stringify([normalizeWorkstationServer(server), ownerUserId]);
+}

package/dist/workstation/registrations/removal.js

@@ -0,0 +1,222 @@
+import { z } from 'zod';
+import { withWorkstationLock } from '../control/locks.js';
+import { LocalControlError } from '../control/protocol.js';
+import { TargetAdmissionPendingError } from '../runtime/deviceRuntime.js';
+import { retireRegistrationEnrollment } from './enrollment.js';
+import { operationIdSchema } from './enrollmentPending.js';
+import { resolveRemovalNamespaceLocked } from './migration.js';
+import { registrationIdSchema } from './model.js';
+const inputSchema = z.object({ id: registrationIdSchema, expectedRevision: z.string().regex(/^[a-f0-9]{64}$/), operationId: operationIdSchema, runtimeGeneration: z.string().min(1).max(128), force: z.boolean() }).strict();
+export class RegistrationRemovalController {
+    options;
+    originals = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    async removeRegistration(value) {
+        this.options.device.assertMutationAllowed();
+        const parsed = inputSchema.safeParse(value);
+        if (!parsed.success)
+            throw new LocalControlError('UNSUPPORTED_PROTOCOL', 'Invalid local removal request');
+        const input = parsed.data;
+        if (input.runtimeGeneration !== this.options.generation)
+            throw new LocalControlError('BINDING_CONFLICT', 'Original runtime generation changed');
+        let original = this.originals.get(input.id);
+        if (original && JSON.stringify(original.input) !== JSON.stringify(input))
+            throw new LocalControlError('BINDING_CONFLICT', 'Original removal operation changed');
+        if (!original) {
+            if ([...this.originals.values()].some(entry => entry.input.operationId === input.operationId))
+                throw new LocalControlError('BINDING_CONFLICT', 'Removal operation target changed');
+            original = { input, activity: null };
+            this.originals.set(input.id, original);
+        }
+        if (original.operation)
+            return original.operation;
+        const finishMutation = this.options.device.beginMembershipMutation();
+        const operation = this.run(original).finally(finishMutation);
+        original.operation = operation;
+        try {
+            return await operation;
+        }
+        catch (error) {
+            if (!original.hold)
+                this.originals.delete(input.id);
+            throw error;
+        }
+        finally {
+            original.operation = undefined;
+        }
+    }
+    async current(original) {
+        const input = original.input;
+        const intent = (await this.options.store.removalIntents()).find(entry => entry.operationId === input.operationId || entry.registration.id === input.id && entry.phase !== 'cancelled');
+        if (intent && (intent.operationId !== input.operationId || intent.registration.id !== input.id || intent.registration.revision !== input.expectedRevision || intent.force !== input.force))
+            throw new LocalControlError('BINDING_CONFLICT', 'Durable removal operation changed');
+        return intent;
+    }
+    async restore(original) {
+        const { device, store } = this.options;
+        if (original.preparation)
+            await device.releaseTargetResources(original.hold, original.preparation);
+        else if (original.hold)
+            await device.releaseTargetAdmission(original.hold);
+        const intent = await this.current(original);
+        if (intent)
+            await withWorkstationLock(store.root, 'operation', () => store.finishRemovalRestoration(intent));
+        await original.resumeRecovered?.();
+        this.originals.delete(original.input.id);
+    }
+    async run(original) {
+        const { store, device } = this.options;
+        const input = original.input;
+        let intent = await this.current(original);
+        try {
+            if (intent?.phase === 'cancelled') {
+                this.originals.delete(input.id);
+                return { status: 'busy', activity: original.activity };
+            }
+            if (intent?.phase === 'completed') {
+                if (!await store.verifyRemovalCompletion(intent.registration))
+                    throw new LocalControlError('OUTCOME_UNKNOWN', 'Completed removal needs verification');
+                if (original.hold && !original.finalized) {
+                    await device.finalizeTargetRemoval(original.hold);
+                    original.finalized = true;
+                }
+                else if (!original.hold)
+                    await device.reconcile();
+                this.originals.delete(input.id);
+                return { status: 'removed', activity: original.activity };
+            }
+            if (intent && !original.hold && intent.phase === 'restoring') {
+                await withWorkstationLock(store.root, 'operation', () => store.finishRemovalRestoration(intent));
+                this.originals.delete(input.id);
+                await device.reconcile();
+                return { status: 'busy', activity: null };
+            }
+            if (intent && !original.hold && ['disposed', 'credentials-retired'].includes(intent.phase)) {
+                // Resource shutdown was already persisted; only credential retirement and membership publication remain.
+                original.registration = intent.registration;
+                original.sealed = true;
+                original.disposed = true;
+            }
+            else if (intent && !original.hold) {
+                original.resumeRecovered ??= await device.recoverRemovalRuntime(input);
+                original.registration = intent.registration;
+            }
+            if (original.restoring || intent?.phase === 'restoring') {
+                await this.restore(original);
+                return { status: 'busy', activity: original.activity };
+            }
+            if (!original.hold && !original.disposed) {
+                original.registration = await store.readMetadata(input.id, input.expectedRevision);
+                original.activity = (await device.activities()).get(input.id) ?? null;
+                original.hold = await device.prepareTargetAdmission(input, async () => {
+                    const cancelling = await this.current(original);
+                    if (cancelling)
+                        await withWorkstationLock(store.root, 'operation', () => store.cancelRemoval(cancelling));
+                    original.restoring = true;
+                });
+            }
+            if (!intent)
+                intent = await withWorkstationLock(store.root, 'operation', () => store.beginRemoval({ schemaVersion: 1, registration: original.registration, operationId: input.operationId, runtimeGeneration: input.runtimeGeneration, force: input.force, phase: 'intent' }));
+            if (!original.disposed && !original.preparation)
+                original.preparation = await device.prepareTargetResources(original.hold);
+            if (!original.disposed && !original.sealAttempted) {
+                const observation = await device.observeTargetResources(original.hold, original.preparation);
+                original.activity = (await device.activities()).get(input.id) ?? original.activity;
+                if (observation.status !== 'candidate' && !input.force) {
+                    await this.restore(original);
+                    return { status: observation.status === 'busy' ? 'busy' : 'pending', activity: original.activity };
+                }
+                original.sealAttempted = true;
+            }
+            if (!original.sealed) {
+                await device.sealTargetResources(original.hold, original.preparation, input.force ? 'force' : undefined);
+                original.sealed = true;
+            }
+            intent = await this.current(original);
+            if (!intent)
+                throw new LocalControlError('OUTCOME_UNKNOWN', 'Original removal intent is unavailable');
+            if (original.sealed && intent.phase === 'intent')
+                intent = await withWorkstationLock(store.root, 'operation', () => store.advanceRemoval(intent, 'sealed'));
+            if (!original.disposed) {
+                await withWorkstationLock(store.root, 'operation', async () => {
+                    const namespace = await resolveRemovalNamespaceLocked(store.root, input.id, input.expectedRevision);
+                    original.settlement = await device.prepareTargetDisposition(original.hold, original.preparation, namespace);
+                    if (!original.sealed) {
+                        original.sealed = true;
+                        intent = await store.advanceRemoval(intent, 'sealed');
+                    }
+                    await device.disposeTargetResources(original.hold, original.preparation, original.settlement, namespace);
+                    original.disposed = true;
+                });
+            }
+            if (intent.phase === 'sealed')
+                intent = await withWorkstationLock(store.root, 'operation', () => store.advanceRemoval(intent, 'disposed'));
+            if (intent.phase === 'disposed') {
+                await withWorkstationLock(store.root, 'operation', () => retireRegistrationEnrollment(store.root, intent.registration));
+                intent = await withWorkstationLock(store.root, 'operation', () => store.advanceRemoval(intent, 'credentials-retired'));
+            }
+            if (!await store.verifyRemovalCompletion(intent.registration))
+                await withWorkstationLock(store.root, 'operation', () => store.remove(input.id, input.expectedRevision));
+            if (!await store.verifyRemovalCompletion(intent.registration))
+                throw new LocalControlError('OUTCOME_UNKNOWN', 'Original removal finalization needs verification');
+            if (!original.finalized) {
+                if (original.hold)
+                    await device.finalizeTargetRemoval(original.hold);
+                original.finalized = true;
+            }
+            await withWorkstationLock(store.root, 'operation', () => store.advanceRemoval(intent, 'completed'));
+            if (!original.hold)
+                await device.reconcile();
+            this.originals.delete(input.id);
+            return { status: 'removed', activity: original.activity };
+        }
+        catch (error) {
+            if (error instanceof TargetAdmissionPendingError) {
+                original.hold ??= error.hold;
+                original.restoring = true;
+            }
+            let durable;
+            try {
+                durable = await this.current(original);
+            }
+            catch {
+                return { status: 'pending', activity: original.activity };
+            }
+            if (original.restoring || durable?.phase === 'restoring') {
+                try {
+                    await this.restore(original);
+                    return { status: error instanceof LocalControlError && error.code === 'BUSY' ? 'busy' : 'pending', activity: original.activity };
+                }
+                catch {
+                    return { status: 'pending', activity: original.activity };
+                }
+            }
+            if (durable?.phase === 'intent' && !original.sealed && original.hold && !(input.force && original.sealAttempted)) {
+                try {
+                    await this.restore(original);
+                    const activity = original.activity;
+                    if (!input.force && activity?.known && activity.agents + activity.terminals + activity.commands + activity.transfers + activity.desktopConsumers > 0)
+                        return { status: 'busy', activity };
+                }
+                catch {
+                    return { status: 'pending', activity: original.activity };
+                }
+            }
+            if (!durable && original.hold && !original.sealed) {
+                try {
+                    await this.restore(original);
+                }
+                catch {
+                    return { status: 'pending', activity: original.activity };
+                }
+            }
+            else if (!durable && !original.hold)
+                this.originals.delete(input.id);
+            if (error instanceof LocalControlError && ['BINDING_CONFLICT', 'UNSUPPORTED_PROTOCOL'].includes(error.code))
+                throw error;
+            return { status: 'pending', activity: original.activity };
+        }
+    }
+}