@ricsam/r5d-worker 0.0.137 → 0.0.139

package/dist/mjs/runtime/releases/rpc-client.mjs

@@ -0,0 +1,184 @@
+import { createConnection } from "node:net";
+import { lstatSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { dirname } from "node:path";
+import { z } from "zod";
+import {
+  ExecutorError,
+  isStartNonAdmissionCode,
+  MAX_FRAME_BYTES,
+  ExecutorCommand
+} from "../protocol.mjs";
+import { canonicalDirectory } from "./artifacts.mjs";
+import { digest } from "./grants.mjs";
+import { DeliveryReceipt, ManagerRpcClientConfig } from "./rpc-protocol.mjs";
+class ManagerRpcClient {
+  config;
+  constructor(config) {
+    this.config = ManagerRpcClientConfig.parse(config);
+  }
+  request(command) {
+    const c = this.config;
+    canonicalDirectory(dirname(c.socketPath));
+    const st = lstatSync(c.socketPath), requestId = randomUUID();
+    if (!st.isSocket() || st.uid !== process.getuid?.() || st.mode & 63)
+      return Promise.reject(new ExecutorError("insecure_manager_socket"));
+    const frame = JSON.stringify({
+      protocol: 1,
+      requestId,
+      installationId: c.installationId,
+      workerId: c.workerId,
+      auth: { principalId: c.principalId, token: c.token },
+      command
+    }) + "\n";
+    if (Buffer.byteLength(frame) > MAX_FRAME_BYTES) return Promise.reject(new ExecutorError("request_too_large"));
+    return new Promise((resolve, reject) => {
+      const socket = createConnection(c.socketPath);
+      let bytes = Buffer.alloc(0), done = false;
+      const finish = (error, result) => {
+        if (done) return;
+        done = true;
+        socket.destroy();
+        if (error) reject(error);
+        else resolve(result);
+      };
+      socket.setTimeout(c.timeoutMs, () => finish(new ExecutorError("manager_transport_unknown")));
+      socket.once("error", () => finish(new ExecutorError("manager_transport_unknown")));
+      socket.once("close", () => finish(new ExecutorError("manager_transport_unknown")));
+      socket.once("connect", () => socket.write(frame));
+      socket.on("data", (chunk) => {
+        bytes = Buffer.concat([bytes, chunk]);
+        if (bytes.length > MAX_FRAME_BYTES) {
+          finish(new ExecutorError("manager_response_invalid"));
+          return;
+        }
+        if (!bytes.includes(10)) return;
+        try {
+          const response = z.discriminatedUnion("ok", [
+            z.object({ requestId: z.literal(requestId), ok: z.literal(true), result: z.unknown() }).strict(),
+            z.object({
+              requestId: z.literal(requestId),
+              ok: z.literal(false),
+              error: z.object({ code: z.string(), rejectedBeforeAdmission: z.boolean() }).strict()
+            }).strict()
+          ]).parse(JSON.parse(bytes.toString("utf8")));
+          if (response.ok === true && Object.hasOwn(response, "result")) finish(void 0, response.result);
+          else
+            finish(
+              new ExecutorError(
+                response.ok === false ? response.error.code : "manager_response_invalid",
+                void 0,
+                response.ok === false && response.error.rejectedBeforeAdmission && command.method === "execute" && command.command.method === "start" && [
+                  "candidate_not_ready",
+                  "manager_delivery_busy",
+                  "delivery_retention_full",
+                  "release_manager_closed",
+                  "manager_ipc_busy"
+                ].includes(response.error.code)
+              )
+            );
+        } catch {
+          finish(new ExecutorError("manager_response_invalid"));
+        }
+      });
+    });
+  }
+  probe() {
+    return this.request({ method: "probe", adapterId: this.config.adapterId, hello: this.config.hello });
+  }
+  async execute(callId, command) {
+    return DeliveryReceipt.parse(
+      await this.request({
+        method: "execute",
+        callId,
+        adapterId: this.config.adapterId,
+        hello: this.config.hello,
+        command: ExecutorCommand.parse(command)
+      })
+    );
+  }
+  async observe(command) {
+    return DeliveryReceipt.parse(
+      await this.request({
+        method: "observe",
+        adapterId: this.config.adapterId,
+        hello: this.config.hello,
+        command: ExecutorCommand.parse(command)
+      })
+    );
+  }
+  async receipt(callId) {
+    return DeliveryReceipt.parse(await this.request({ method: "receipt", callId }));
+  }
+  async acknowledge(callId, responseDigest, ackToken) {
+    return z.object({ callId: z.literal(callId), responseDigest: z.literal(responseDigest), acknowledged: z.literal(true) }).strict().parse(await this.request({ method: "acknowledge", callId, responseDigest, ackToken }));
+  }
+}
+class ManagedExecutorClient {
+  constructor(config, receiptSink, onAcknowledged) {
+    this.receiptSink = receiptSink;
+    this.onAcknowledged = onAcknowledged;
+    this.rpc = new ManagerRpcClient(config);
+  }
+  receiptSink;
+  onAcknowledged;
+  rpc;
+  get config() {
+    return this.rpc.config;
+  }
+  status() {
+    return this.rpc.probe();
+  }
+  async request(command) {
+    if (command.method === "status") return this.status();
+    if (!["start", "poll", "write", "resize", "cancel"].includes(command.method)) throw new ExecutorError("forbidden");
+    command = ExecutorCommand.parse(command);
+    const callId = command.method === "poll" ? null : `delivery-${digest(command)}`;
+    let receipt;
+    try {
+      receipt = callId === null ? await this.rpc.observe(command) : await this.rpc.execute(callId, command);
+    } catch (error2) {
+      if (command.method === "start" && error2 instanceof ExecutorError && error2.rejectedBeforeAdmission)
+        throw new ExecutorError("capacity_busy", void 0, true);
+      throw error2;
+    }
+    const identity = command.method === "start" ? command.operation : "run" in command ? command.run : null;
+    if ((callId !== null ? receipt.callId !== callId || receipt.deliveryKind !== "mutation" : !/^observation-[1-9][0-9]*$/.test(receipt.callId) || receipt.deliveryKind !== "observation") || receipt.adapterId !== this.config.adapterId || receipt.requesterId !== this.config.principalId || receipt.userId !== identity?.userId || receipt.sessionId !== identity?.sessionId || receipt.operationId !== identity?.operationId || receipt.commandDigest !== digest(command) || receipt.installationId !== this.config.installationId || receipt.workerId !== this.config.workerId || receipt.responseDigest !== digest({ callId: receipt.callId, commandDigest: receipt.commandDigest, state: receipt.state, outcome: receipt.outcome }))
+      throw new ExecutorError("manager_response_invalid");
+    if (this.receiptSink) await this.receiptSink(receipt);
+    if (receipt.state !== "completed" || receipt.outcome === null) throw new ExecutorError("manager_delivery_unknown");
+    if (this.receiptSink) {
+      try {
+        await this.rpc.acknowledge(receipt.callId, receipt.responseDigest, receipt.ackToken);
+        await this.onAcknowledged?.(receipt);
+      } catch {
+      }
+    }
+    if (receipt.outcome.ok) return receipt.outcome.result;
+    const error = receipt.outcome.error;
+    throw new ExecutorError(
+      error.code,
+      void 0,
+      command.method === "start" && isStartNonAdmissionCode(error.code) && error.rejectedBeforeAdmission
+    );
+  }
+  start(operation) {
+    return this.request({ method: "start", operation });
+  }
+  poll(run, stdoutOffset = 0, stderrOffset = 0, maxBytes = 32768) {
+    return this.request({ method: "poll", run, stdoutOffset, stderrOffset, maxBytes });
+  }
+  write(run, actionId, data, eof = false) {
+    return this.request({ method: "write", run, actionId, data, eof });
+  }
+  resize(run, actionId, cols, rows) {
+    return this.request({ method: "resize", run, actionId, cols, rows });
+  }
+  cancel(run, actionId) {
+    return this.request({ method: "cancel", run, actionId });
+  }
+}
+export {
+  ManagedExecutorClient,
+  ManagerRpcClient
+};

package/dist/mjs/runtime/releases/rpc-main.mjs

@@ -0,0 +1,213 @@
+import { chmodSync, constants, closeSync, fstatSync, lstatSync, openSync, readSync, unlinkSync } from "node:fs";
+import { timingSafeEqual } from "node:crypto";
+import { createServer } from "node:net";
+import { dirname, join } from "node:path";
+import { RuntimeId } from "@ricsam/r5d-api/runtime-protocol";
+import { ExecutorError, MAX_FRAME_BYTES } from "../protocol.mjs";
+import { WorkerAdapterReleases } from "./manager.mjs";
+import { bytesHash, canonicalDirectory } from "./artifacts.mjs";
+import { ManagerRequest, ManagerRpcConfig } from "./rpc-protocol.mjs";
+function readManagerPrivateJson(path) {
+  canonicalDirectory(dirname(path));
+  const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  try {
+    const st = fstatSync(fd);
+    if (!st.isFile() || st.nlink !== 1 || st.uid !== process.getuid?.() || st.mode & 63 || st.size > MAX_FRAME_BYTES)
+      throw new ExecutorError("insecure_manager_config");
+    const bytes = Buffer.alloc(st.size + 1);
+    let offset = 0;
+    while (offset < bytes.length) {
+      const n = readSync(fd, bytes, offset, bytes.length - offset, null);
+      if (!n) break;
+      offset += n;
+    }
+    const after = fstatSync(fd);
+    if (offset !== st.size || after.size !== st.size || after.mtimeMs !== st.mtimeMs || after.ctimeMs !== st.ctimeMs)
+      throw new ExecutorError("manager_config_changed");
+    return JSON.parse(bytes.subarray(0, offset).toString("utf8"));
+  } finally {
+    closeSync(fd);
+  }
+}
+async function startManagerRpc(input) {
+  const config = ManagerRpcConfig.parse(input), manager = new WorkerAdapterReleases(config.manager);
+  const socketPath = join(manager.config.stateDir, "manager.sock"), sockets = /* @__PURE__ */ new Set();
+  let pending = 0;
+  const server = createServer((socket) => {
+    if (sockets.size >= 48) {
+      socket.destroy();
+      return;
+    }
+    sockets.add(socket);
+    socket.once("close", () => sockets.delete(socket));
+    socket.on("error", () => {
+    });
+    socket.setTimeout(15e3, () => socket.destroy());
+    let bytes = Buffer.alloc(0), received = false;
+    socket.on("data", (chunk) => {
+      if (received) {
+        socket.destroy();
+        return;
+      }
+      if (bytes.length + chunk.length > MAX_FRAME_BYTES) {
+        socket.destroy();
+        return;
+      }
+      bytes = Buffer.concat([bytes, chunk]);
+      const end = bytes.indexOf(10);
+      if (end < 0) return;
+      received = true;
+      if (end !== bytes.length - 1) {
+        socket.destroy();
+        return;
+      }
+      let requestId = null;
+      const execute = async () => {
+        const raw = JSON.parse(bytes.subarray(0, end).toString("utf8"));
+        requestId = RuntimeId.parse(raw?.requestId);
+        const request = ManagerRequest.parse(raw);
+        const principal = config.principals.find((p) => p.id === request.auth.principalId);
+        if (!timingSafeEqual(
+          Buffer.from(bytesHash(Buffer.from(request.auth.token)), "hex"),
+          Buffer.from(principal?.tokenHash ?? "0".repeat(64), "hex")
+        ) || !principal)
+          throw new ExecutorError("unauthenticated");
+        if (request.installationId !== manager.config.installationId || request.workerId !== manager.config.workerId)
+          throw new ExecutorError("wrong_installation");
+        const command = request.command;
+        const sessionAllowed = (userId, sessionId) => principal.sessions.some((scope) => scope.userId === userId && scope.sessionId === sessionId) || principal.role === "workspace" && principal.userIds?.includes(userId) === true;
+        if (command.method === "probe") return manager.probe(command.adapterId, command.hello);
+        if (command.method === "execute" || command.method === "observe") {
+          if (principal.role !== "workspace") throw new ExecutorError("forbidden");
+          const operation = command.command.method === "start" ? command.command.operation : "run" in command.command ? command.command.run : null;
+          if (!operation?.sessionId || !sessionAllowed(operation.userId, operation.sessionId)) throw new ExecutorError("forbidden");
+          if (pending > (command.command.method === "cancel" ? 44 : 40))
+            throw new ExecutorError("manager_ipc_busy", void 0, command.command.method === "start");
+          return command.method === "observe" ? manager.observe(command.adapterId, command.hello, principal.id, command.command) : manager.deliver(command.callId, command.adapterId, command.hello, principal.id, command.command);
+        }
+        if (command.method === "receipt" || command.method === "acknowledge") {
+          if (principal.role !== "workspace") throw new ExecutorError("forbidden");
+          const receipt = manager.delivery(command.callId);
+          if (receipt && (receipt.requesterId !== principal.id || !sessionAllowed(receipt.userId, receipt.sessionId)))
+            throw new ExecutorError("delivery_not_found");
+          if (command.method === "receipt") {
+            if (!receipt) throw new ExecutorError("delivery_not_found");
+            return receipt;
+          }
+          return manager.acknowledgeDelivery(command.callId, command.responseDigest, command.ackToken, principal.id);
+        }
+        if (principal.role !== "admin") throw new ExecutorError("forbidden");
+        switch (command.method) {
+          case "stage":
+            return manager.stage(command);
+          case "launch":
+            return manager.launch(command.adapterId);
+          case "stop-adapter":
+            return manager.stopAdapter(command.adapterId);
+          case "promote":
+            return manager.promote(command.adapterId, command.fence, command.validUntil);
+          case "retire":
+            return manager.retire(command.adapterId, command.retirementIntentDigest);
+          case "settle-unknown":
+            return manager.settleUnknownDelivery(command.callId, command.evidenceDigest);
+          case "reconcile":
+            return manager.reconcile();
+          case "status":
+            return {
+              managerInvocation: manager.invocation,
+              releases: manager.list().map((r) => ({
+                principalId: r.principalId,
+                phase: r.phase,
+                retirementCompletion: r.retirementCompletion,
+                hello: r.manifest.hello,
+                artifactDigest: r.artifactDigest,
+                drain: manager.deliveryDrain(r.principalId)
+              })),
+              transitions: manager.transitions()
+            };
+        }
+      };
+      pending++;
+      void execute().then(
+        (result) => {
+          const frame = JSON.stringify({ requestId, ok: true, result: result ?? null }) + "\n";
+          if (Buffer.byteLength(frame) > MAX_FRAME_BYTES) socket.destroy();
+          else socket.end(frame);
+        },
+        (error) => socket.end(
+          JSON.stringify({
+            requestId,
+            ok: false,
+            error: {
+              code: error instanceof ExecutorError ? error.code : "invalid_request",
+              rejectedBeforeAdmission: error instanceof ExecutorError && error.rejectedBeforeAdmission
+            }
+          }) + "\n"
+        )
+      ).finally(() => pending--);
+    });
+  });
+  try {
+    manager.bindRpcPrincipals(config.principals);
+    canonicalDirectory(manager.config.stateDir);
+    try {
+      const st = lstatSync(socketPath);
+      if (!st.isSocket() || st.uid !== process.getuid?.()) throw new ExecutorError("unsafe_manager_socket");
+      unlinkSync(socketPath);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    await new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(socketPath, () => {
+        server.off("error", reject);
+        resolve();
+      });
+    });
+    chmodSync(socketPath, 384);
+  } catch (error) {
+    server.close();
+    await manager.close();
+    throw error;
+  }
+  let closing;
+  return {
+    manager,
+    socketPath,
+    get pending() {
+      return pending;
+    },
+    close() {
+      return closing ??= (async () => {
+        for (const socket of sockets) socket.destroy();
+        await new Promise((resolve) => server.close(() => resolve()));
+        await manager.close();
+      })();
+    }
+  };
+}
+if (import.meta.main) {
+  try {
+    if (process.argv.length !== 3) throw new ExecutorError("private_config_required");
+    const service = await startManagerRpc(ManagerRpcConfig.parse(readManagerPrivateJson(process.argv[2])));
+    console.log(JSON.stringify({ ready: true, pid: process.pid, protocol: 1 }));
+    let stopping = false;
+    const stop = () => {
+      if (stopping) return;
+      stopping = true;
+      void service.close().then(
+        () => process.exit(0),
+        () => process.exit(1)
+      );
+    };
+    process.once("SIGTERM", stop);
+    process.once("SIGINT", stop);
+  } catch {
+    console.error("Private adapter manager startup failed");
+    process.exitCode = 1;
+  }
+}
+export {
+  readManagerPrivateJson,
+  startManagerRpc
+};

package/dist/mjs/runtime/releases/rpc-protocol.mjs

@@ -0,0 +1,103 @@
+import { z } from "zod";
+import { RuntimeHello, RuntimeId, OwnershipFence } from "@ricsam/r5d-api/runtime-protocol";
+import { AdapterConfig, AdapterGrant, ExecutorCommand } from "../protocol.mjs";
+import { AdapterManifest } from "./artifacts.mjs";
+import { ReleaseManagerConfig } from "./manager.mjs";
+const Absolute = z.string().startsWith("/").max(4096);
+const ManagerRpcConfig = z.object({
+  manager: ReleaseManagerConfig,
+  principals: z.array(
+    z.object({
+      id: RuntimeId,
+      tokenHash: z.string().regex(/^[a-f0-9]{64}$/),
+      role: z.enum(["admin", "probe", "workspace"]),
+      sessions: z.array(z.object({ userId: RuntimeId, sessionId: RuntimeId }).strict()).max(100),
+      // Only the trusted catalog-authorizing workspace keeper receives these grants.
+      userIds: z.array(RuntimeId).max(1e3).optional()
+    }).strict()
+  ).min(1).max(100)
+}).strict().refine(
+  (v) => new Set(v.principals.map((p) => p.id)).size === v.principals.length && new Set(v.principals.map((p) => p.tokenHash)).size === v.principals.length,
+  "Duplicate RPC principal/credential"
+);
+const ManagerRpcClientConfig = z.object({
+  socketPath: Absolute,
+  installationId: RuntimeId,
+  workerId: RuntimeId,
+  principalId: RuntimeId,
+  token: z.string().min(32).max(512),
+  adapterId: RuntimeId,
+  hello: RuntimeHello,
+  timeoutMs: z.number().int().min(100).max(6e4).default(1e4)
+}).strict();
+const ManagerCommand = z.discriminatedUnion("method", [
+  z.object({ method: z.literal("probe"), adapterId: RuntimeId, hello: RuntimeHello }).strict(),
+  z.object({ method: z.literal("execute"), adapterId: RuntimeId, hello: RuntimeHello, callId: RuntimeId, command: ExecutorCommand }).strict(),
+  z.object({ method: z.literal("observe"), adapterId: RuntimeId, hello: RuntimeHello, command: ExecutorCommand }).strict(),
+  z.object({ method: z.literal("receipt"), callId: RuntimeId }).strict(),
+  z.object({
+    method: z.literal("acknowledge"),
+    callId: RuntimeId,
+    responseDigest: z.string().regex(/^[a-f0-9]{64}$/),
+    ackToken: z.string().regex(/^[a-f0-9]{64}$/)
+  }).strict(),
+  z.object({
+    method: z.literal("stage"),
+    source: Absolute,
+    manifest: AdapterManifest,
+    approvalDigest: z.string(),
+    grant: AdapterGrant,
+    adapter: AdapterConfig
+  }).strict(),
+  z.object({ method: z.literal("launch"), adapterId: RuntimeId }).strict(),
+  z.object({ method: z.literal("stop-adapter"), adapterId: RuntimeId }).strict(),
+  z.object({ method: z.literal("promote"), adapterId: RuntimeId, fence: OwnershipFence, validUntil: z.number().int().positive() }).strict(),
+  z.object({
+    method: z.literal("retire"),
+    adapterId: RuntimeId,
+    retirementIntentDigest: z.string().regex(/^[a-f0-9]{64}$/).optional()
+  }).strict(),
+  z.object({ method: z.literal("settle-unknown"), callId: RuntimeId, evidenceDigest: z.string().regex(/^[a-f0-9]{64}$/) }).strict(),
+  z.object({ method: z.literal("status") }).strict(),
+  z.object({ method: z.literal("reconcile") }).strict()
+]);
+const ManagerRequest = z.object({
+  protocol: z.literal(1),
+  requestId: RuntimeId,
+  installationId: RuntimeId,
+  workerId: RuntimeId,
+  auth: z.object({ principalId: RuntimeId, token: z.string().min(32).max(512) }).strict(),
+  command: ManagerCommand
+}).strict();
+const DeliveryOutcome = z.discriminatedUnion("ok", [
+  z.object({ ok: z.literal(true), result: z.unknown() }).strict(),
+  z.object({ ok: z.literal(false), error: z.object({ code: z.string(), rejectedBeforeAdmission: z.boolean() }).strict() }).strict()
+]);
+const DeliveryReceipt = z.object({
+  callId: RuntimeId,
+  deliveryKind: z.enum(["mutation", "observation"]),
+  ackToken: z.string().regex(/^[a-f0-9]{64}$/),
+  installationId: RuntimeId,
+  workerId: RuntimeId,
+  adapterId: RuntimeId,
+  requesterId: RuntimeId,
+  userId: RuntimeId,
+  sessionId: RuntimeId,
+  operationId: RuntimeId,
+  commandDigest: z.string().regex(/^[a-f0-9]{64}$/),
+  state: z.enum(["pending", "completed", "unknown"]),
+  outcome: DeliveryOutcome.nullable(),
+  responseDigest: z.string().regex(/^[a-f0-9]{64}$/),
+  acknowledged: z.boolean()
+}).strict().superRefine((receipt, ctx) => {
+  if (receipt.state === "completed" !== (receipt.outcome !== null) || receipt.outcome?.ok === true && !Object.hasOwn(receipt.outcome, "result"))
+    ctx.addIssue({ code: "custom", message: "Delivery state/payload mismatch" });
+});
+export {
+  DeliveryOutcome,
+  DeliveryReceipt,
+  ManagerCommand,
+  ManagerRequest,
+  ManagerRpcClientConfig,
+  ManagerRpcConfig
+};

package/dist/mjs/runtime/storage.mjs

@@ -0,0 +1,156 @@
+import { Database } from "bun:sqlite";
+import {
+  closeSync,
+  constants,
+  fstatSync,
+  fsyncSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  readSync,
+  rmSync,
+  writeSync
+} from "node:fs";
+import { join } from "node:path";
+import { ExecutorError } from "./protocol.mjs";
+function privateDirectory(path) {
+  mkdirSync(path, { mode: 448, recursive: true });
+  const stat = lstatSync(path);
+  if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || stat.mode & 63)
+    throw new ExecutorError("insecure_directory");
+}
+function readPrivateJson(path) {
+  const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || stat.uid !== process.getuid?.() || stat.mode & 63 || stat.size > 1024 * 1024)
+      throw new ExecutorError("insecure_config");
+    return JSON.parse(readFileSync(fd, "utf8"));
+  } finally {
+    closeSync(fd);
+  }
+}
+function privateDatabase(path) {
+  try {
+    closeSync(openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384));
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+  }
+  for (const file of [path, `${path}-journal`, `${path}-wal`, `${path}-shm`]) {
+    try {
+      const stat = lstatSync(file);
+      if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.uid !== process.getuid?.() || stat.mode & 63)
+        throw new ExecutorError("insecure_store_file");
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  return new Database(path);
+}
+class ExecutorStore {
+  constructor(root, installationId, workerId) {
+    this.root = root;
+    privateDirectory(root);
+    this.lock = privateDatabase(join(root, "authority.lock.sqlite"));
+    try {
+      this.lock.exec(
+        "PRAGMA busy_timeout=0; PRAGMA locking_mode=EXCLUSIVE; BEGIN EXCLUSIVE; CREATE TABLE IF NOT EXISTS keeper_lock (id INTEGER)"
+      );
+    } catch {
+      this.lock.close();
+      throw new ExecutorError("executor_already_running");
+    }
+    try {
+      this.db = privateDatabase(join(root, "receipts.sqlite"));
+      this.db.exec(`PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL; PRAGMA foreign_keys=ON;
+        CREATE TABLE IF NOT EXISTS identity (id INTEGER PRIMARY KEY CHECK (id=1), installation TEXT NOT NULL, worker TEXT NOT NULL, version INTEGER NOT NULL);
+        CREATE TABLE IF NOT EXISTS authority (id INTEGER PRIMARY KEY CHECK (id=1), fence TEXT NOT NULL, valid_until INTEGER NOT NULL);
+        CREATE TABLE IF NOT EXISTS runs (id TEXT PRIMARY KEY, receipt TEXT NOT NULL);
+        CREATE TABLE IF NOT EXISTS actions (run_id TEXT NOT NULL REFERENCES runs(id), id TEXT NOT NULL, hash TEXT NOT NULL, state TEXT NOT NULL, PRIMARY KEY(run_id,id));`);
+      const identity = this.db.query("SELECT * FROM identity WHERE id=1").get();
+      if (identity && (identity.installation !== installationId || identity.worker !== workerId || identity.version !== 1))
+        throw new ExecutorError("wrong_store_identity");
+      if (!identity) this.db.query("INSERT INTO identity VALUES (1,?,?,1)").run(installationId, workerId);
+      privateDirectory(join(root, "output"));
+      privateDirectory(join(root, "secrets"));
+      for (const receipt of this.all()) {
+        if (receipt.state === "accepted" || receipt.state === "running") {
+          receipt.state = "unknown";
+          receipt.reason = "executor_restarted_reconciliation_required";
+          this.put(receipt);
+        }
+      }
+      this.db.exec("UPDATE actions SET state='unknown' WHERE state='accepted'; UPDATE authority SET valid_until=0");
+      rmSync(join(root, "secrets"), { recursive: true });
+      privateDirectory(join(root, "secrets"));
+    } catch (error) {
+      this.db?.close();
+      this.lock.close();
+      throw error;
+    }
+  }
+  root;
+  db;
+  lock;
+  all() {
+    return this.db.query("SELECT receipt FROM runs").all().map((row) => JSON.parse(row.receipt));
+  }
+  get(id) {
+    const row = this.db.query("SELECT receipt FROM runs WHERE id=?").get(id);
+    return row ? JSON.parse(row.receipt) : null;
+  }
+  put(receipt) {
+    this.db.query("INSERT INTO runs VALUES (?,?) ON CONFLICT(id) DO UPDATE SET receipt=excluded.receipt").run(receipt.operationId, JSON.stringify(receipt));
+  }
+  outputPath(id, stream) {
+    return join(this.root, "output", `${id}.${stream}`);
+  }
+  append(id, stream, data) {
+    const fd = openSync(
+      this.outputPath(id, stream),
+      constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT | constants.O_NOFOLLOW,
+      384
+    );
+    try {
+      let offset = 0;
+      while (offset < data.length) offset += writeSync(fd, data, offset);
+      fsyncSync(fd);
+      const directory = openSync(join(this.root, "output"), constants.O_RDONLY | constants.O_DIRECTORY);
+      try {
+        fsyncSync(directory);
+      } finally {
+        closeSync(directory);
+      }
+    } finally {
+      closeSync(fd);
+    }
+  }
+  read(id, stream, offset, end, max) {
+    if (offset > end) throw new ExecutorError("invalid_offset");
+    const buffer = Buffer.alloc(Math.min(end - offset, max));
+    if (buffer.length) {
+      const fd = openSync(this.outputPath(id, stream), constants.O_RDONLY | constants.O_NOFOLLOW);
+      try {
+        let n = 0;
+        while (n < buffer.length) {
+          const read = readSync(fd, buffer, n, buffer.length - n, offset + n);
+          if (!read) throw new ExecutorError("output_truncated");
+          n += read;
+        }
+      } finally {
+        closeSync(fd);
+      }
+    }
+    return { base64: buffer.toString("base64"), nextOffset: offset + buffer.length };
+  }
+  close() {
+    this.db.close();
+    this.lock.close();
+  }
+}
+export {
+  ExecutorStore,
+  privateDirectory,
+  readPrivateJson
+};