@tinycloud/operations 0.6.1-beta.4 → 0.6.1-beta.5

package/dist/delegation-binding.js

@@ -3705,15 +3705,16 @@ function canonicalizeCaveats(caveats) {
 // src/state.ts
 import { randomUUID } from "crypto";
 import { AsyncLocalStorage } from "async_hooks";
-import { readFileSync, readlinkSync } from "fs";
+import { constants as fsConstants, fstatSync, readFileSync, readlinkSync } from "fs";
 import {
   chmod,
   link,
-  lstat,
   mkdir,
+  lstat,
   open,
   readFile,
   readdir,
+  realpath,
   rename,
   rmdir,
   rm,
@@ -3743,14 +3744,18 @@ var TEST_LOCK_TURN_SETTLE_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_TURN_SETTLE_BARRIE
 var TEST_LOCK_TURN_COLLECT_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_TURN_COLLECT_BARRIER_DIR";
 var TEST_LOCK_LIVENESS_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_LIVENESS_BARRIER_DIR";
 function processWideContext(key) {
-  var _a4;
+  var _a5;
   const registry = globalThis;
-  return registry[_a4 = Symbol.for(key)] ?? (registry[_a4] = new AsyncLocalStorage());
+  return registry[_a5 = Symbol.for(key)] ?? (registry[_a5] = new AsyncLocalStorage());
 }
 var invocationStateRoot = processWideContext("tinycloud.operations.invocationStateRoot.v1");
 var heldProfileLocks = processWideContext("tinycloud.operations.heldProfileLocks.v2");
+var pinnedProfiles = processWideContext("tinycloud.operations.pinnedProfiles.v2");
+var pinnedHomes = processWideContext("tinycloud.operations.pinnedHomes.v2");
 var _a2;
-var processInstanceId = globalThis[_a2 = /* @__PURE__ */ Symbol.for("tinycloud.operations.profileLockInstance.v1")] ?? (globalThis[_a2] = randomUUID());
+var canonicalHomes = globalThis[_a2 = /* @__PURE__ */ Symbol.for("tinycloud.operations.canonicalHomes.v1")] ?? (globalThis[_a2] = /* @__PURE__ */ new Map());
+var _a3;
+var processInstanceId = globalThis[_a3 = /* @__PURE__ */ Symbol.for("tinycloud.operations.profileLockInstance.v1")] ?? (globalThis[_a3] = randomUUID());
 var cachedProcessOrigin;
 function processOrigin() {
   if (cachedProcessOrigin !== void 0) return cachedProcessOrigin;
@@ -3928,9 +3933,14 @@ function tinycloudHomePath() {
 function profilesPath() {
   return join(tinycloudHomePath(), "profiles");
 }
-function profilePath(profile) {
+function namedProfilePath(profile) {
   return join(profilesPath(), validateProfileName(profile));
 }
+function profilePath(profile) {
+  const named = namedProfilePath(profile);
+  const pinned = pinnedProfiles.getStore()?.get(named);
+  return pinned ? livePinnedPath(profile, pinned) : named;
+}
 function profileConfigPath(profile) {
   return join(profilePath(profile), "profile.json");
 }
@@ -3944,10 +3954,12 @@ function profileStoreMetadataPath(profile, store) {
   return `${profileStorePath(profile, store)}.metadata.json`;
 }
 function profileLockPath(profile) {
-  return join(profilePath(profile), ".lock");
+  return join(namedProfilePath(profile), ".lock");
 }
 function profileTurnLockPath(profile) {
-  return join(tinycloudHomePath(), "profile-locks", validateProfileName(profile));
+  const home = tinycloudHomePath();
+  const pinned = pinnedHomes.getStore()?.get(home);
+  return join(pinned ? livePinnedPath(profile, pinned) : home, "profile-locks", validateProfileName(profile));
 }
 async function readJson(filePath) {
   try {
@@ -3957,6 +3969,44 @@ async function readJson(filePath) {
     throw error;
   }
 }
+async function readProfileJson(profile, filePath) {
+  const before = process.platform !== "linux" ? await lstat(filePath, { bigint: true }).catch((error) => {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }) : null;
+  if (process.platform !== "linux" && !before) return null;
+  if (before && !before.isFile()) throw new ProfileSymlinkError(profile);
+  const dev = before && exactFileId(before.dev);
+  const ino = before && exactFileId(before.ino);
+  try {
+    const handle = await open(filePath, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));
+    try {
+      if (before) {
+        const opened = await handle.stat({ bigint: true });
+        if (!opened.isFile() || dev === null || ino === null || dev !== exactFileId(opened.dev) || ino !== exactFileId(opened.ino)) {
+          throw new ProfileSymlinkError(profile, "changed while opening its file");
+        }
+      }
+      const contents = await handle.readFile("utf8");
+      if (before) {
+        const named = await lstat(filePath, { bigint: true }).catch((error) => {
+          if (error.code === "ENOENT") return null;
+          throw error;
+        });
+        if (!named?.isFile() || dev !== exactFileId(named.dev) || ino !== exactFileId(named.ino)) {
+          throw new ProfileSymlinkError(profile, "changed while reading its file");
+        }
+      }
+      return JSON.parse(contents);
+    } finally {
+      await handle.close();
+    }
+  } catch (error) {
+    if (isErrno(error, "ENOENT")) return null;
+    if (isErrno(error, "ELOOP") || isErrno(error, "ENOTDIR")) throw new ProfileSymlinkError(profile);
+    throw error;
+  }
+}
 async function writeJsonAtomic(filePath, value) {
   await replaceJson(filePath, value, false);
 }
@@ -3990,50 +4040,204 @@ async function writeFileDurably(path, contents) {
   }
 }
 async function readSession(profile) {
-  await readStoreMetadata(profile, "session");
-  return readJson(sessionPath(profile));
+  return withPinnedProfileDirectory(profile, async (directory) => {
+    if (!directory) return null;
+    await readStoreMetadata(profile, "session");
+    return readProfileJson(profile, sessionPath(profile));
+  });
 }
 async function readAdditionalDelegations(profile) {
   return (await readProfileStore(profile, "additional-delegations")).records;
 }
 async function readStoreMetadata(profile, store) {
-  const metadata = await readJson(profileStoreMetadataPath(profile, store));
-  if (metadata === null) return { formatVersion: 1 };
-  if (typeof metadata !== "object" || metadata.formatVersion !== 1) {
-    throw new TypeError(`Unsupported store format for "${store}".`);
-  }
-  return metadata;
+  return withPinnedProfileDirectory(profile, async (directory) => {
+    const metadata = directory ? await readProfileJson(profile, profileStoreMetadataPath(profile, store)) : null;
+    if (metadata === null) return { formatVersion: 1 };
+    if (typeof metadata !== "object" || metadata.formatVersion !== 1) {
+      throw new TypeError(`Unsupported store format for "${store}".`);
+    }
+    return metadata;
+  });
 }
 async function readProfileStore(profile, store) {
-  const [metadata, raw] = await Promise.all([
-    readStoreMetadata(profile, store),
-    readJson(profileStorePath(profile, store))
-  ]);
-  return {
-    formatVersion: metadata.formatVersion,
-    records: Array.isArray(raw) ? raw : []
-  };
+  return withPinnedProfileDirectory(profile, async (directory) => {
+    if (!directory) return { formatVersion: 1, records: [] };
+    const [metadata, raw] = await Promise.all([
+      readStoreMetadata(profile, store),
+      readProfileJson(profile, profileStorePath(profile, store))
+    ]);
+    return {
+      formatVersion: metadata.formatVersion,
+      records: Array.isArray(raw) ? raw : []
+    };
+  });
 }
-async function withProfileLock(profile, action, options = {}) {
-  const normalizedProfile = validateProfileName(profile);
-  const lockPath = profileLockPath(normalizedProfile);
-  const held = (heldProfileLocks.getStore() ?? []).filter((ownership2) => ownership2.active);
-  if (held.some((ownership2) => ownership2.lockPath === lockPath)) return action();
-  const acquired = await acquireProfileLock(normalizedProfile, options);
-  const ownership = {
-    lockPath,
-    turnSlot: acquired.turnSlot,
-    deletedWhileWaiting: acquired.deletedWhileWaiting,
-    active: true
-  };
+var ProfileSymlinkError = class extends Error {
+  constructor(profile, detail = "must be a real directory, not a symlink or another file type") {
+    super(`Profile "${profile}" ${detail}.`);
+    this.code = "PROFILE_SYMLINK";
+    this.name = "ProfileSymlinkError";
+  }
+};
+function exactFileId(value) {
+  if (typeof value === "bigint") return value >= 0n ? value : null;
+  return Number.isSafeInteger(value) && value >= 0 ? BigInt(value) : null;
+}
+function isPinnedLive(pinned) {
+  if (!pinned.active) return false;
   try {
-    return await heldProfileLocks.run([...held, ownership], action);
+    const stats = fstatSync(pinned.fd, { bigint: true });
+    return exactFileId(stats.dev) === pinned.dev && exactFileId(stats.ino) === pinned.ino;
+  } catch {
+    return false;
+  }
+}
+function livePinnedPath(profile, pinned) {
+  if (isPinnedLive(pinned)) return pinned.path;
+  throw new ProfileSymlinkError(profile, "its pinned directory is no longer active or changed during use");
+}
+async function withPinnedProfileDirectory(profile, action, options = {}) {
+  const named = namedProfilePath(profile);
+  const existing = pinnedProfiles.getStore()?.get(named);
+  if (existing) return action(livePinnedPath(profile, existing));
+  if (process.platform !== "linux") {
+    if (options.create) await mkdir(named, { recursive: true, mode: PRIVATE_DIR_MODE });
+    const stats = await lstat(named).catch((error) => {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    });
+    if (!stats) return action(null);
+    if (!stats.isDirectory() || stats.isSymbolicLink()) throw new ProfileSymlinkError(profile);
+    return action(named);
+  }
+  const home = tinycloudHomePath();
+  const handles = [];
+  const fdPath = (fd) => `/proc/self/fd/${fd}`;
+  const flags = fsConstants.O_RDONLY | fsConstants.O_DIRECTORY | fsConstants.O_NOFOLLOW;
+  try {
+    if (options.create) await mkdir(home, { recursive: true, mode: PRIVATE_DIR_MODE });
+    const resolved = canonicalHomes.get(home) ?? await realpath(home).catch((error) => {
+      if (error.code === "ENOENT" && !options.create) return null;
+      if (error.code === "ELOOP" || error.code === "ENOTDIR") throw new ProfileSymlinkError(profile);
+      throw error;
+    });
+    if (!resolved) return await action(null);
+    const root = canonicalHomes.get(home) ?? resolved;
+    canonicalHomes.set(home, root);
+    const segments = [root, "profiles", validateProfileName(profile)];
+    for (let index = 0; index < segments.length; index++) {
+      const path = handles.length ? join(fdPath(handles[handles.length - 1].fd), segments[index]) : segments[index];
+      if (options.create && handles.length) {
+        await mkdir(path, { mode: PRIVATE_DIR_MODE }).catch((error) => {
+          if (error.code !== "EEXIST") throw error;
+        });
+      }
+      const handle = await open(path, index === 1 ? flags & ~fsConstants.O_NOFOLLOW : flags).catch((error) => {
+        if (error.code === "ENOENT" && !options.create) return null;
+        if (error.code === "ELOOP" || error.code === "ENOTDIR") throw new ProfileSymlinkError(profile);
+        throw error;
+      });
+      if (!handle) return await action(null);
+      handles.push(handle);
+      if (options.create) await handle.chmod(PRIVATE_DIR_MODE);
+    }
+    const opened = handles[2];
+    const [actual, namedStats] = await Promise.all([opened.stat({ bigint: true }), lstat(named, { bigint: true })]);
+    const dev = exactFileId(actual.dev);
+    const ino = exactFileId(actual.ino);
+    if (!namedStats.isDirectory() || dev === null || ino === null || dev !== exactFileId(namedStats.dev) || ino !== exactFileId(namedStats.ino)) {
+      throw new ProfileSymlinkError(profile, "changed while opening its directory");
+    }
+    const directory = fdPath(opened.fd);
+    const pinned = {
+      path: directory,
+      fd: opened.fd,
+      dev,
+      ino,
+      active: true
+    };
+    const homeHandle = handles[0];
+    const homeStats = await homeHandle.stat({ bigint: true });
+    const homeDev = exactFileId(homeStats.dev);
+    const homeIno = exactFileId(homeStats.ino);
+    if (homeDev === null || homeIno === null) throw new ProfileSymlinkError(profile, "has an unverified home directory identity");
+    const homePinned = {
+      path: fdPath(homeHandle.fd),
+      fd: homeHandle.fd,
+      dev: homeDev,
+      ino: homeIno,
+      active: true
+    };
+    const context = new Map(pinnedProfiles.getStore());
+    context.set(named, pinned);
+    const homes = new Map(pinnedHomes.getStore());
+    homes.set(home, homePinned);
+    try {
+      return await pinnedHomes.run(homes, () => pinnedProfiles.run(context, () => action(directory)));
+    } finally {
+      pinned.active = false;
+      homePinned.active = false;
+    }
   } finally {
-    ownership.active = false;
-    await acquired.release();
-    if (acquired.deletedWhileWaiting) await rmdir(profilePath(normalizedProfile)).catch(() => void 0);
+    for (const handle of handles.reverse()) await handle.close();
   }
 }
+async function assertRealProfileDirectory(profile) {
+  const named = namedProfilePath(profile);
+  const pinned = pinnedProfiles.getStore()?.get(named);
+  if (pinned) {
+    livePinnedPath(profile, pinned);
+    return;
+  }
+  const stats = await lstat(named).catch((error) => {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  });
+  if (stats && (!stats.isDirectory() || stats.isSymbolicLink())) throw new ProfileSymlinkError(profile);
+}
+async function withProfileLock(profile, action, options = {}) {
+  const normalizedProfile = validateProfileName(profile);
+  const lockPath = profileLockPath(normalizedProfile);
+  const held = (heldProfileLocks.getStore() ?? []).filter((ownership) => ownership.active);
+  if (held.some((ownership) => ownership.lockPath === lockPath)) {
+    await assertRealProfileDirectory(normalizedProfile);
+    return action();
+  }
+  const named = namedProfilePath(normalizedProfile);
+  const inherited = pinnedProfiles.getStore()?.get(named);
+  if (inherited && !isPinnedLive(inherited)) {
+    const profiles = new Map(pinnedProfiles.getStore());
+    profiles.delete(named);
+    const homes = new Map(pinnedHomes.getStore());
+    homes.delete(tinycloudHomePath());
+    return pinnedHomes.run(homes, () => pinnedProfiles.run(profiles, () => withProfileLock(normalizedProfile, action, options)));
+  }
+  return withPinnedProfileDirectory(normalizedProfile, async (directory) => {
+    if (!directory) throw new ProfileDeletedError(normalizedProfile);
+    const acquired = await acquireProfileLock(normalizedProfile, options);
+    const ownership = {
+      lockPath,
+      turnSlot: acquired.turnSlot,
+      deletedWhileWaiting: acquired.deletedWhileWaiting,
+      active: true
+    };
+    try {
+      return await heldProfileLocks.run([...held, ownership], action);
+    } finally {
+      ownership.active = false;
+      await acquired.release();
+      if (ownership.deletedProfile || acquired.deletedWhileWaiting) {
+        const current = await lstat(namedProfilePath(normalizedProfile), { bigint: true }).catch(() => null);
+        const original = await stat(directory, { bigint: true }).catch(() => null);
+        const currentDev = current && exactFileId(current.dev);
+        const currentIno = current && exactFileId(current.ino);
+        if (currentDev !== null && currentIno !== null && original && currentDev === exactFileId(original.dev) && currentIno === exactFileId(original.ino)) {
+          await rmdir(namedProfilePath(normalizedProfile)).catch(() => void 0);
+        }
+      }
+    }
+  }, { create: !options.requireProfile });
+}
 async function refuseWriteToDeletedProfile(profile) {
   const lockPath = profileLockPath(profile);
   const ownership = (heldProfileLocks.getStore() ?? []).find((candidate) => candidate.active && candidate.lockPath === lockPath);
@@ -4066,17 +4270,15 @@ async function acquireProfileLock(profile, options) {
     retryMs: options.retryMs ?? DEFAULT_LOCK_RETRY_MS
   };
   const staleAfterMs = options.staleAfterMs ?? DEFAULT_STALE_LOCK_MS;
-  const lockPath = profileLockPath(profile);
+  const lockPath = join(profilePath(profile), ".lock");
   const turnDirectory = profileTurnLockPath(profile);
   const directory = profilePath(profile);
+  await assertRealProfileDirectory(profile);
   if (options.requireProfile && !await exists(profileConfigPath(profile))) throw new ProfileDeletedError(profile);
   if (!options.requireProfile) await mkdir(directory, { recursive: true, mode: PRIVATE_DIR_MODE });
+  await assertRealProfileDirectory(profile);
   await mkdir(dirname(turnDirectory), { recursive: true, mode: PRIVATE_DIR_MODE });
-  for (const path of [tinycloudHomePath(), profilesPath(), directory]) {
-    await chmod(path, PRIVATE_DIR_MODE).catch((error) => {
-      if (path !== directory || !isErrno(error, "ENOENT")) throw error;
-    });
-  }
+  await chmod(directory, PRIVATE_DIR_MODE);
   const liveness = { directory: turnDirectory, held: void 0 };
   const closeAcquisitionLiveness = async () => {
     if (liveness.held) await closeLiveness(liveness.held);
@@ -4096,6 +4298,7 @@ async function acquireProfileLock(profile, options) {
     }
     const deletion = await readJson(join(turnDirectory, "deleted.json")).catch(() => null);
     const deletedWhileWaiting = typeof deletion?.slot === "number" && deletion.slot >= firstWaitedTurn;
+    if (deletedWhileWaiting && !await exists(profileConfigPath(profile))) throw new ProfileDeletedError(profile);
     while (true) {
       const token = randomUUID();
       if (await publishProfileLock(profile, lockPath, token, options.requireProfile === true, liveness.held ?? null)) {
@@ -4132,8 +4335,8 @@ async function waitOrTimeOut(profile, deadline, detail) {
   await sleep(Math.min(deadline.retryMs, deadline.timeoutMs - (Date.now() - deadline.startedAt)));
 }
 var TURN = /^(?:0|[1-9][0-9]*)$/;
-var _a3;
-var relinquishedTurns = globalThis[_a3 = /* @__PURE__ */ Symbol.for("tinycloud.operations.relinquishedProfileTurns.v1")] ?? (globalThis[_a3] = /* @__PURE__ */ new Set());
+var _a4;
+var relinquishedTurns = globalThis[_a4 = /* @__PURE__ */ Symbol.for("tinycloud.operations.relinquishedProfileTurns.v1")] ?? (globalThis[_a4] = /* @__PURE__ */ new Set());
 var MARKER_RETRY_DELAYS_MS = [10, 50, 250];
 var SETTLE_RETRY_MS = 1e3;
 var SETTLE_RETRIES = 300;
@@ -4247,7 +4450,7 @@ async function takeTurn(profile, directory, latest, liveness) {
     if (published) await markTurn(path, token, "done");
     return null;
   } catch (error) {
-    if (published) settleOwnTurn(directory, slot, token);
+    if (published) await settleOwnTurn(directory, slot, token);
     throw error;
   }
 }
@@ -4258,17 +4461,25 @@ async function settleAbandonedTurn(directory, abandoned) {
   }
   await markTurn(path, abandoned.token, "done");
 }
-function settleOwnTurn(directory, slot, token, retries = SETTLE_RETRIES) {
+async function settleOwnTurn(directory, slot, token) {
   relinquishedTurns.add(token);
-  void (async () => {
-    try {
-      const turn = await readTurn(directory, slot);
-      if (turn !== null && turn !== "damaged" && turn.token === token && !turn.done) await settleAbandonedTurn(directory, turn);
-      relinquishedTurns.delete(token);
-    } catch {
-      if (retries > 0) setTimeout(() => settleOwnTurn(directory, slot, token, retries - 1), SETTLE_RETRY_MS).unref();
-    }
-  })();
+  const pinned = await pinDirectory(directory).catch(() => null);
+  const path = pinned?.path(".") ?? directory;
+  let retries = SETTLE_RETRIES;
+  const attempt = () => {
+    void (async () => {
+      try {
+        const turn = await readTurn(path, slot);
+        if (turn !== null && turn !== "damaged" && turn.token === token && !turn.done) await settleAbandonedTurn(path, turn);
+        relinquishedTurns.delete(token);
+        await pinned?.close();
+      } catch {
+        if (retries-- > 0) setTimeout(attempt, SETTLE_RETRY_MS).unref();
+        else await pinned?.close();
+      }
+    })();
+  };
+  attempt();
 }
 async function markTurn(path, token, kind) {
   for (let attempt = 0; ; attempt++) {
@@ -4313,7 +4524,7 @@ async function releaseTurn(profile, turn, liveness) {
   try {
     await markTurn(join(turn.directory, String(turn.slot)), turn.token, "done");
   } catch {
-    settleOwnTurn(turn.directory, turn.slot, turn.token);
+    await settleOwnTurn(turn.directory, turn.slot, turn.token);
     return;
   }
   await collectTurns(profile, turn, liveness).catch(() => void 0);