@rex0220/ksql-flownet 1.0.0

package/dist/io/io-path.js

@@ -0,0 +1,279 @@
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, realpath } from "node:fs/promises";
+import { dirname, isAbsolute, relative, resolve, sep, win32 } from "node:path";
+export class InputPathError extends Error {
+    code;
+    constructor(code, message, options) {
+        super(message, options);
+        this.code = code;
+        this.name = "InputPathError";
+    }
+}
+export class OutputPathError extends Error {
+    code = "OUTPUT_PATH_REJECTED";
+    constructor(message, options) {
+        super(message, options);
+        this.name = "OutputPathError";
+    }
+}
+export async function resolveNodeOutputs(input) {
+    const substitutedPatterns = Object.keys(input.patterns)
+        .sort(compareText)
+        .map((name) => {
+        const pattern = substituteOutputPattern(input.patterns[name], {
+            business_key: input.businessKey,
+            profile: input.profile,
+            run_id: input.runId,
+            node_id: input.nodeId,
+        });
+        assertRelativeOutputPattern(pattern);
+        return { name, pattern };
+    });
+    const ioRoot = resolve(input.ioRoot);
+    await requireOutputDirectory(ioRoot, "IO root");
+    const canonicalRoot = await outputRealpath(ioRoot, "IO root");
+    const outputRoot = resolve(ioRoot, "out");
+    assertOutputContained(ioRoot, outputRoot);
+    await ensureOutputDirectories(ioRoot, outputRoot);
+    const outputs = [];
+    for (const { name, pattern } of substitutedPatterns) {
+        const candidate = resolve(outputRoot, pattern);
+        assertOutputContained(outputRoot, candidate);
+        const parent = dirname(candidate);
+        await ensureOutputDirectories(ioRoot, parent);
+        const canonicalParent = await outputRealpath(parent, "output parent");
+        assertOutputContained(canonicalRoot, canonicalParent, true);
+        await inspectOutputTarget(candidate, canonicalRoot);
+        outputs.push({ name, path: candidate });
+    }
+    return outputs;
+}
+export async function resolveNodeInputs(input) {
+    const inputRoot = resolve(input.ioRoot, "in");
+    const canonicalRoot = await requiredRealpath(inputRoot);
+    await requireDirectory(inputRoot, "input root");
+    const baselines = [];
+    for (const name of Object.keys(input.patterns).sort(compareText)) {
+        const pattern = input.patterns[name];
+        const substituted = substitutePattern(pattern, {
+            business_key: input.businessKey,
+            profile: input.profile,
+        });
+        assertRelativePattern(substituted);
+        const candidate = resolve(inputRoot, substituted);
+        assertContained(inputRoot, candidate);
+        await inspectComponents(inputRoot, candidate);
+        const canonicalCandidate = await requiredRealpath(candidate);
+        assertContained(canonicalRoot, canonicalCandidate);
+        let handle;
+        try {
+            handle = await open(candidate, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        }
+        catch (error) {
+            throw fromFsError(error, `cannot open input '${name}'`);
+        }
+        try {
+            const stat = await handle.stat();
+            if (!stat.isFile()) {
+                throw new InputPathError("INPUT_PATH_REJECTED", `input '${name}' is not a regular file`);
+            }
+            const hash = createHash("sha256");
+            let bytes = 0;
+            for await (const chunk of handle.createReadStream({ autoClose: false })) {
+                const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                bytes += buffer.byteLength;
+                hash.update(buffer);
+            }
+            baselines.push({
+                name,
+                path: candidate,
+                sha256: hash.digest("hex"),
+                bytes,
+            });
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    return baselines;
+}
+export function percentEncodePathSegment(value) {
+    return [...Buffer.from(value, "utf8")]
+        .map((byte) => (byte >= 0x30 && byte <= 0x39) ||
+        (byte >= 0x41 && byte <= 0x5a) ||
+        (byte >= 0x61 && byte <= 0x7a) ||
+        byte === 0x2d ||
+        byte === 0x5f ||
+        byte === 0x7e
+        ? String.fromCharCode(byte)
+        : `%${byte.toString(16).toUpperCase().padStart(2, "0")}`)
+        .join("");
+}
+function substitutePattern(pattern, values) {
+    return pattern.replace(/\{(business_key|profile)\}/gu, (_match, key) => percentEncodePathSegment(values[key]));
+}
+function substituteOutputPattern(pattern, values) {
+    return pattern.replace(/\{(business_key|profile|run_id|node_id)\}/gu, (_match, key) => percentEncodePathSegment(values[key]));
+}
+function assertRelativeOutputPattern(pattern) {
+    if (pattern.length === 0 ||
+        pattern.includes("\0") ||
+        isAbsolute(pattern) ||
+        win32.isAbsolute(pattern) ||
+        /^[A-Za-z]:/u.test(pattern) ||
+        pattern.split(/[\\/]/u).some((part) => part === "." || part === "..")) {
+        throw new OutputPathError("output pattern does not resolve to an allowed relative path");
+    }
+}
+async function ensureOutputDirectories(root, targetDirectory) {
+    assertOutputContained(root, targetDirectory, true);
+    const rel = relative(root, targetDirectory);
+    const parts = rel === "" ? [] : rel.split(sep);
+    let current = root;
+    await requireOutputDirectory(current, "IO root");
+    for (const part of parts) {
+        current = resolve(current, part);
+        try {
+            await mkdir(current);
+        }
+        catch (error) {
+            if (fsErrorCode(error) !== "EEXIST") {
+                throw new OutputPathError("output directory could not be created", {
+                    cause: error,
+                });
+            }
+        }
+        await requireOutputDirectory(current, "output path component");
+    }
+}
+async function inspectOutputTarget(candidate, canonicalRoot) {
+    let stat;
+    try {
+        stat = await lstat(candidate);
+    }
+    catch (error) {
+        if (fsErrorCode(error) === "ENOENT")
+            return;
+        throw new OutputPathError("output target could not be inspected", {
+            cause: error,
+        });
+    }
+    if (stat.isSymbolicLink() || !stat.isFile()) {
+        throw new OutputPathError("output target is not a regular file or is a symbolic link or junction");
+    }
+    const canonicalCandidate = await outputRealpath(candidate, "output target");
+    assertOutputContained(canonicalRoot, canonicalCandidate);
+}
+async function requireOutputDirectory(path, label) {
+    let stat;
+    try {
+        stat = await lstat(path);
+    }
+    catch (error) {
+        throw new OutputPathError(`${label} is unavailable`, { cause: error });
+    }
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+        throw new OutputPathError(`${label} is not a regular directory or is a symbolic link or junction`);
+    }
+}
+async function outputRealpath(path, label) {
+    try {
+        return await realpath(path);
+    }
+    catch (error) {
+        throw new OutputPathError(`${label} could not be resolved`, {
+            cause: error,
+        });
+    }
+}
+function assertOutputContained(root, candidate, allowRoot = false) {
+    const rel = relative(root, candidate);
+    if ((!allowRoot && rel === "") ||
+        rel === ".." ||
+        rel.startsWith(`..${sep}`) ||
+        isAbsolute(rel)) {
+        throw new OutputPathError("output path is outside the configured output root");
+    }
+}
+function fsErrorCode(error) {
+    return typeof error === "object" && error !== null && "code" in error
+        ? String(error.code)
+        : "";
+}
+function assertRelativePattern(pattern) {
+    if (pattern.length === 0 ||
+        pattern.includes("\0") ||
+        isAbsolute(pattern) ||
+        win32.isAbsolute(pattern) ||
+        /^[A-Za-z]:/u.test(pattern) ||
+        pattern.split(/[\\/]/u).some((part) => part === "." || part === "..")) {
+        throw new InputPathError("INPUT_PATH_REJECTED", "input pattern does not resolve to an allowed relative path");
+    }
+}
+function assertContained(root, candidate) {
+    const rel = relative(root, candidate);
+    if (rel === "" ||
+        rel === ".." ||
+        rel.startsWith(`..${sep}`) ||
+        isAbsolute(rel)) {
+        throw new InputPathError("INPUT_PATH_REJECTED", "input path is outside the configured input root");
+    }
+}
+async function inspectComponents(root, candidate) {
+    const rel = relative(root, candidate);
+    const parts = rel.split(sep);
+    let current = root;
+    await requireDirectory(current, "input root");
+    for (let index = 0; index < parts.length; index += 1) {
+        current = resolve(current, parts[index]);
+        let stat;
+        try {
+            stat = await lstat(current);
+        }
+        catch (error) {
+            throw fromFsError(error, "input path component is unavailable");
+        }
+        if (stat.isSymbolicLink()) {
+            throw new InputPathError("INPUT_PATH_REJECTED", "input path contains a symbolic link or junction");
+        }
+        const final = index === parts.length - 1;
+        if ((!final && !stat.isDirectory()) || (final && !stat.isFile())) {
+            throw new InputPathError("INPUT_PATH_REJECTED", final
+                ? "input path is not a regular file"
+                : "input path contains a non-directory component");
+        }
+    }
+}
+async function requireDirectory(path, label) {
+    let stat;
+    try {
+        stat = await lstat(path);
+    }
+    catch (error) {
+        throw fromFsError(error, `${label} is unavailable`);
+    }
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+        throw new InputPathError("INPUT_PATH_REJECTED", `${label} is not a regular directory`);
+    }
+}
+async function requiredRealpath(path) {
+    try {
+        return await realpath(path);
+    }
+    catch (error) {
+        throw fromFsError(error, "input path does not exist");
+    }
+}
+function fromFsError(error, message) {
+    const code = typeof error === "object" && error !== null && "code" in error
+        ? String(error.code)
+        : "";
+    return new InputPathError(code === "ENOENT" || code === "ENOTDIR"
+        ? "INPUT_FILE_MISSING"
+        : "INPUT_PATH_REJECTED", message, { cause: error });
+}
+function compareText(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+//# sourceMappingURL=io-path.js.map

package/dist/orchestration/archive-run.d.ts

@@ -0,0 +1,53 @@
+import { type PersistenceRepository } from "../persistence/repository.js";
+import type { NetworkLockReference } from "../persistence/network-lock.js";
+export type ArchiveRejectedCode = "LOCK_CONFLICT" | "LOCK_UNAVAILABLE" | "LEASE_INTERRUPTED" | "RUN_READ_FAILED" | "RUN_STATUS_NOT_CLOSABLE" | "RUN_UNKNOWN_NOT_CLOSABLE" | "RUN_NOT_TERMINAL" | "RUN_ON_HOLD" | "RUN_LIVE" | "ARCHIVE_WRITE_FAILED";
+export type ArchivePendingCode = "ARCHIVE_AUDIT_FAILED" | "AUDIT_CONFLICT" | "LEASE_INTERRUPTED_AFTER_ARCHIVE";
+type Base = {
+    readonly run_id: string;
+    readonly event_id: string;
+    readonly lock_released: boolean;
+};
+export type ArchiveRunOutcome = (Base & {
+    readonly outcome: "ARCHIVED";
+    readonly run_revision: number;
+    readonly audit: "RECORDED";
+}) | (Base & {
+    readonly outcome: "ARCHIVED";
+    readonly run_revision: number;
+    readonly audit: "PENDING";
+    readonly code: ArchivePendingCode;
+}) | (Base & {
+    readonly outcome: "ALREADY_ARCHIVED";
+    readonly run_revision: number;
+}) | (Base & {
+    readonly outcome: "UNCONFIRMED";
+    readonly run_revision: null;
+    readonly code: "ARCHIVE_UNCONFIRMED";
+}) | (Base & {
+    readonly outcome: "REJECTED";
+    readonly run_revision: number | null;
+    readonly code: ArchiveRejectedCode;
+});
+export interface ArchiveLockManager {
+    acquire(): Promise<NetworkLockReference>;
+    release(reference: NetworkLockReference): Promise<unknown>;
+}
+export interface ArchiveLeaseMonitor {
+    start(): void;
+    stop(): void;
+    tick(): Promise<boolean>;
+}
+export interface ArchiveRunInput {
+    repository: PersistenceRepository;
+    lockManagerFactory: (owner: string) => ArchiveLockManager;
+    leaseMonitorFactory: (manager: ArchiveLockManager, reference: NetworkLockReference) => ArchiveLeaseMonitor;
+    runId: string;
+    requestedBy: string;
+    reason: string;
+    servicePrincipal: string;
+    now?: () => Date;
+    uuid?: () => string;
+}
+export declare function archiveRun(input: ArchiveRunInput): Promise<ArchiveRunOutcome>;
+export {};
+//# sourceMappingURL=archive-run.d.ts.map

package/dist/orchestration/archive-run.js

@@ -0,0 +1,323 @@
+import { randomUUID } from "node:crypto";
+import { RepositoryError, } from "../persistence/repository.js";
+const hold = (value) => value?.value.state === "REQUESTED" || value?.value.state === "ACCEPTED";
+const sameAudit = (left, right) => left.event_id === right.event_id &&
+    left.event_type === "RUN_ARCHIVED" &&
+    left.run_id === right.run_id &&
+    left.previous_status === right.previous_status &&
+    left.run_revision_before === right.run_revision_before;
+export async function archiveRun(input) {
+    const eventId = `archive_${(input.uuid ?? randomUUID)()}`;
+    const base = { run_id: input.runId, event_id: eventId };
+    const manager = input.lockManagerFactory(eventId);
+    let reference;
+    try {
+        reference = await manager.acquire();
+    }
+    catch (error) {
+        const code = typeof error === "object" &&
+            error !== null &&
+            "code" in error &&
+            error.code === "LOCK_CONFLICT"
+            ? "LOCK_CONFLICT"
+            : "LOCK_UNAVAILABLE";
+        return {
+            ...base,
+            outcome: "REJECTED",
+            run_revision: null,
+            code,
+            lock_released: true,
+        };
+    }
+    const monitor = input.leaseMonitorFactory(manager, reference);
+    let result;
+    let cleaned = false;
+    try {
+        monitor.start();
+        let run;
+        try {
+            run = await input.repository.getRun(input.runId);
+        }
+        catch {
+            result = {
+                ...base,
+                outcome: "REJECTED",
+                run_revision: null,
+                code: "RUN_READ_FAILED",
+            };
+            return await finish();
+        }
+        if (run.value.lifecycle_status === "ARCHIVED") {
+            result = {
+                ...base,
+                outcome: "ALREADY_ARCHIVED",
+                run_revision: run.revision,
+            };
+            return await finish();
+        }
+        const code = run.value.status === "SUCCESS"
+            ? "RUN_STATUS_NOT_CLOSABLE"
+            : run.value.status === "UNKNOWN"
+                ? "RUN_UNKNOWN_NOT_CLOSABLE"
+                : run.value.status === "CREATED" || run.value.status === "RUNNING"
+                    ? "RUN_NOT_TERMINAL"
+                    : null;
+        if (code !== null) {
+            result = {
+                ...base,
+                outcome: "REJECTED",
+                run_revision: run.revision,
+                code,
+            };
+            return await finish();
+        }
+        try {
+            if (hold(await input.repository.getCancelRequest(input.runId))) {
+                result = {
+                    ...base,
+                    outcome: "REJECTED",
+                    run_revision: run.revision,
+                    code: "RUN_ON_HOLD",
+                };
+                return await finish();
+            }
+        }
+        catch {
+            result = {
+                ...base,
+                outcome: "REJECTED",
+                run_revision: run.revision,
+                code: "RUN_READ_FAILED",
+            };
+            return await finish();
+        }
+        // RUN_LIVE(G-02: lock owner が当該 Run の Invocation に属し lease 生存)は
+        // ポーラーの一次審査で判定する。ここでは Network ロックを保持しているため
+        // 生存中の Invocation は存在し得ない。Invocation レコードの RUNNING 残骸
+        // (クラッシュ後の未 finalize)は reconciliation の対象であり、CLOSE を阻まない。
+        if (!(await monitor.tick())) {
+            result = {
+                ...base,
+                outcome: "REJECTED",
+                run_revision: run.revision,
+                code: "LEASE_INTERRUPTED",
+            };
+            return await finish();
+        }
+        let archived = null;
+        let already = false;
+        try {
+            archived = await input.repository.archiveRun(input.runId, run.revision, (input.now ?? (() => new Date()))().toISOString());
+        }
+        catch (first) {
+            const ambiguous = first instanceof RepositoryError && first.code === "AMBIGUOUS_WRITE";
+            const conflict = first instanceof RepositoryError && first.code === "REVISION_CONFLICT";
+            let reread;
+            try {
+                reread = await input.repository.getRun(input.runId);
+            }
+            catch {
+                result = {
+                    ...base,
+                    outcome: "UNCONFIRMED",
+                    run_revision: null,
+                    code: "ARCHIVE_UNCONFIRMED",
+                };
+                return await finish();
+            }
+            if (reread.value.lifecycle_status === "ARCHIVED") {
+                archived = reread;
+                already = conflict;
+            }
+            else if (conflict) {
+                result = {
+                    ...base,
+                    outcome: "UNCONFIRMED",
+                    run_revision: null,
+                    code: "ARCHIVE_UNCONFIRMED",
+                };
+                return await finish();
+            }
+            else if (!ambiguous) {
+                result = {
+                    ...base,
+                    outcome: "REJECTED",
+                    run_revision: reread.revision,
+                    code: "ARCHIVE_WRITE_FAILED",
+                };
+                return await finish();
+            }
+            else {
+                if (!(await monitor.tick())) {
+                    result = {
+                        ...base,
+                        outcome: "REJECTED",
+                        run_revision: reread.revision,
+                        code: "LEASE_INTERRUPTED",
+                    };
+                    return await finish();
+                }
+                try {
+                    archived = await input.repository.archiveRun(input.runId, reread.revision, (input.now ?? (() => new Date()))().toISOString());
+                }
+                catch {
+                    try {
+                        const final = await input.repository.getRun(input.runId);
+                        if (final.value.lifecycle_status === "ARCHIVED")
+                            archived = final;
+                        else {
+                            result = {
+                                ...base,
+                                outcome: "REJECTED",
+                                run_revision: final.revision,
+                                code: "ARCHIVE_WRITE_FAILED",
+                            };
+                            return await finish();
+                        }
+                    }
+                    catch {
+                        result = {
+                            ...base,
+                            outcome: "UNCONFIRMED",
+                            run_revision: null,
+                            code: "ARCHIVE_UNCONFIRMED",
+                        };
+                        return await finish();
+                    }
+                }
+            }
+        }
+        if (already) {
+            result = {
+                ...base,
+                outcome: "ALREADY_ARCHIVED",
+                run_revision: archived.revision,
+            };
+            return await finish();
+        }
+        if (!(await monitor.tick())) {
+            result = {
+                ...base,
+                outcome: "ARCHIVED",
+                run_revision: archived.revision,
+                audit: "PENDING",
+                code: "LEASE_INTERRUPTED_AFTER_ARCHIVE",
+            };
+            return await finish();
+        }
+        const audit = {
+            event_id: eventId,
+            event_type: "RUN_ARCHIVED",
+            run_id: input.runId,
+            result_code: "RUN_ARCHIVED",
+            requested_by: input.requestedBy,
+            reason: input.reason,
+            archived_at: archived.value.updated_at,
+            previous_status: run.value.status,
+            run_revision_before: run.revision,
+            service_principal: input.servicePrincipal,
+        };
+        try {
+            await input.repository.appendOperationAudit(audit);
+            result = {
+                ...base,
+                outcome: "ARCHIVED",
+                run_revision: archived.revision,
+                audit: "RECORDED",
+            };
+        }
+        catch (error) {
+            if (error instanceof RepositoryError && error.code === "AUDIT_CONFLICT")
+                result = {
+                    ...base,
+                    outcome: "ARCHIVED",
+                    run_revision: archived.revision,
+                    audit: "PENDING",
+                    code: "AUDIT_CONFLICT",
+                };
+            else if (error instanceof RepositoryError &&
+                error.code === "AMBIGUOUS_WRITE") {
+                try {
+                    const found = await input.repository.getOperationAuditByEventId(eventId);
+                    if (found !== null && sameAudit(found.value, audit))
+                        result = {
+                            ...base,
+                            outcome: "ARCHIVED",
+                            run_revision: archived.revision,
+                            audit: "RECORDED",
+                        };
+                    else if (found !== null)
+                        result = {
+                            ...base,
+                            outcome: "ARCHIVED",
+                            run_revision: archived.revision,
+                            audit: "PENDING",
+                            code: "AUDIT_CONFLICT",
+                        };
+                    else {
+                        try {
+                            await input.repository.appendOperationAudit(audit);
+                            result = {
+                                ...base,
+                                outcome: "ARCHIVED",
+                                run_revision: archived.revision,
+                                audit: "RECORDED",
+                            };
+                        }
+                        catch {
+                            result = {
+                                ...base,
+                                outcome: "ARCHIVED",
+                                run_revision: archived.revision,
+                                audit: "PENDING",
+                                code: "ARCHIVE_AUDIT_FAILED",
+                            };
+                        }
+                    }
+                }
+                catch {
+                    result = {
+                        ...base,
+                        outcome: "ARCHIVED",
+                        run_revision: archived.revision,
+                        audit: "PENDING",
+                        code: "ARCHIVE_AUDIT_FAILED",
+                    };
+                }
+            }
+            else
+                result = {
+                    ...base,
+                    outcome: "ARCHIVED",
+                    run_revision: archived.revision,
+                    audit: "PENDING",
+                    code: "ARCHIVE_AUDIT_FAILED",
+                };
+        }
+        return await finish();
+    }
+    finally {
+        if (!cleaned) {
+            monitor.stop();
+            try {
+                await manager.release(reference);
+            }
+            catch {
+                // Preserve the unexpected primary exception after attempting cleanup.
+            }
+        }
+    }
+    async function finish() {
+        monitor.stop();
+        let released = true;
+        try {
+            await manager.release(reference);
+        }
+        catch {
+            released = false;
+        }
+        cleaned = true;
+        return { ...result, lock_released: released };
+    }
+}
+//# sourceMappingURL=archive-run.js.map

package/dist/orchestration/cancel-request.d.ts

@@ -0,0 +1,18 @@
+import type { CancelRequest } from "../domain/persistence-model.js";
+import type { PersistenceRepository, Versioned } from "../persistence/repository.js";
+export type CancelRequestErrorCode = "RUN_ALREADY_TERMINAL";
+export declare class CancelRequestError extends Error {
+    readonly code: CancelRequestErrorCode;
+    constructor(code: CancelRequestErrorCode, message: string);
+}
+export interface ChangeCancelRequestInput {
+    readonly repository: PersistenceRepository;
+    readonly runId: string;
+    readonly requestedBy: string;
+    readonly reason: string;
+    readonly release: boolean;
+    readonly now?: () => Date;
+}
+export declare function changeCancelRequest(input: ChangeCancelRequestInput): Promise<Versioned<CancelRequest> | null>;
+export declare function isCancelHold(request: Versioned<CancelRequest> | null): request is Versioned<CancelRequest>;
+//# sourceMappingURL=cancel-request.d.ts.map