agent-hitch 0.2.12 → 0.2.14

package/dist/src/resources/evidence.js

@@ -0,0 +1,93 @@
+import { lstat, readFile } from "node:fs/promises";
+import path from "node:path";
+import { durableWriteJSON as atomicWriteJSON, runCommand } from "../foundation/index.js";
+import { canonical, identity, parseStrictJson, sha } from "./protocol.js";
+import { finishResourceWorkspace } from "./materialize.js";
+import { parseResourceTask, taskClosureLock } from "./tasks.js";
+import { exportResourceResultProof } from "./result-retention.js";
+export async function readResourceEvidence(file) {
+    const info = await lstat(file).catch(e => { if (e.code !== "ENOENT")
+        throw e; return undefined; });
+    if (!info)
+        return undefined;
+    if (!info.isFile() || info.size > 16 * 1024 ** 2)
+        throw new Error("invalid resource execution evidence");
+    const evidence = parseStrictJson(await readFile(file, "utf8"));
+    const { digest, ...body } = evidence.plan;
+    parseResourceTask(evidence.plan.task);
+    if (evidence.protocol !== "hitch-resource-workspace@1" || digest !== identity("hitch-resource-plan@1", body) || !/^[a-f0-9-]{36}$/.test(evidence.id) || typeof evidence.executionEnded !== "boolean")
+        throw new Error("resource execution evidence identity mismatch");
+    sha(evidence.materialized_task_digest);
+    if (!evidence.materializedTree || identity("hitch-materialized-task@1", evidence.materializedTree) !== evidence.materialized_task_digest)
+        throw new Error("materialized tree proof missing");
+    return evidence;
+}
+/** Run evidence is sealed before the execution lease can be released. */
+export async function sealResourceEvidence(input) {
+    const evidence = await readResourceEvidence(input.file);
+    if (!evidence)
+        return;
+    if (evidence.plan.task.task_id !== input.taskId)
+        throw new Error("resource execution task mismatch");
+    const observed = [];
+    const docker = process.env.HITCH_DOCKER_PATH || "docker", cache = new Map();
+    const inspect = async (digest) => {
+        sha(digest);
+        let value = cache.get(digest);
+        if (value)
+            return value;
+        value = JSON.parse((await runCommand(docker, ["image", "inspect", "--format", "{{json .}}", digest], { timeoutMs: 30_000 })).stdout);
+        if (value.Id !== digest || !Array.isArray(value.RootFS?.Layers))
+            throw new Error("observed OCI config identity mismatch");
+        cache.set(digest, value);
+        return value;
+    };
+    for (const container of input.execution?.observed.containers ?? []) {
+        if (!container.image_config_digest)
+            continue;
+        const image = await inspect(container.image_config_digest), labels = image.Config?.Labels ?? {};
+        if (labels["dev.hitch.resource.plan"] !== evidence.plan.digest)
+            continue;
+        const role = labels["dev.hitch.resource.consumer"], consumer = parseStrictJson(role);
+        const bindings = evidence.plan.task.lock.bindings.filter(b => canonical(b.consumer) === canonical(consumer) && b.use === "environment-image");
+        if (!bindings.length)
+            throw new Error("observed resource consumer is undeclared");
+        const platform = `${image.Os}/${image.Architecture}${image.Variant ? `/${image.Variant}` : ""}`;
+        if (platform !== evidence.plan.platform)
+            throw new Error("observed resource platform changed");
+        const baseConfigs = [];
+        for (const binding of bindings) {
+            const expected = evidence.images.find(i => i.resource === binding.resource);
+            if (!expected)
+                throw new Error("OCI base evidence missing");
+            const base = await inspect(expected.configDigest);
+            if (canonical(image.RootFS.Layers.slice(0, base.RootFS.Layers.length)) !== canonical(base.RootFS.Layers))
+                throw new Error("observed image does not descend from declared resource base");
+            baseConfigs.push(expected.configDigest);
+        }
+        observed.push({ consumer, configDigest: container.image_config_digest, platform, baseConfigs });
+    }
+    if (input.requireObserved)
+        for (const binding of evidence.plan.task.lock.bindings.filter(b => b.use === "environment-image"))
+            if (!observed.some(i => canonical(i.consumer) === canonical(binding.consumer)))
+                throw new Error("successful resource trial lacks observed role/image evidence");
+    const lock = taskClosureLock(evidence.plan.task);
+    if ("hitch-materialized-task" in lock.resources)
+        throw new Error("reserved materialization resource ID");
+    const root = await input.store.pin({ owner: input.owner, generation: 1, purpose: "sealed-run", lock: { ...lock, resources: { ...lock.resources, "hitch-materialized-task": evidence.materializedTree } } });
+    const proofObjects = await exportResourceResultProof(input.store, evidence.plan, root.closure.objectDigests, input.runDirectory);
+    await atomicWriteJSON(path.join(input.runDirectory, "resource.execution.json"), { protocol: "hitch-resource-execution@1", plan: evidence.plan, materialized_task_digest: evidence.materialized_task_digest, materializedTree: evidence.materializedTree, images: evidence.images, observed, proofObjects, materialization: { clonedBytes: evidence.clonedBytes, copiedBytes: evidence.copiedBytes, fallbackReasons: evidence.fallbackReasons } });
+}
+export async function confirmResourceResultSealed(file) {
+    const evidence = await readResourceEvidence(file);
+    if (evidence)
+        await atomicWriteJSON(file, { ...evidence, resultSealed: true });
+}
+export async function reclaimResourceExecution(store, file, cleanupConfirmed) {
+    const evidence = await readResourceEvidence(file);
+    if (!evidence || !cleanupConfirmed || !evidence.executionEnded || !evidence.resultSealed)
+        return false;
+    await finishResourceWorkspace(store, evidence.id, { executionEnded: true, resultSealed: true });
+    return true;
+}
+//# sourceMappingURL=evidence.js.map

package/dist/src/resources/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../../src/resources/evidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,IAAI,eAAe,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAA0B,MAAM,kBAAkB,CAAC;AAEnF,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAGlE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY;IACrD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAChI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzG,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAA8B,CAAC;IAC5F,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC;IAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjF,IAAI,QAAQ,CAAC,QAAQ,KAAK,4BAA4B,IAAI,MAAM,KAAK,QAAQ,CAAC,uBAAuB,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,OAAO,QAAQ,CAAC,cAAc,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACvQ,GAAG,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,IAAI,QAAQ,CAAC,2BAA2B,EAAE,QAAQ,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,wBAAwB;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC7L,OAAO,QAAQ,CAAC;AAClB,CAAC;AACD,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAA6J;IACtM,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,QAAQ;QAAE,OAAO;IAC/E,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACrG,MAAM,QAAQ,GAAgG,EAAE,CAAC;IACjH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,QAAQ,EAAE,KAAK,GAAG,IAAI,GAAG,EAA+B,CAAC;IACzG,MAAM,OAAO,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;QACvC,GAAG,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACpE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACrI,IAAI,KAAM,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAM,CAAC,MAAM,EAAE,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,KAAM,CAAC,CAAC;QAAC,OAAO,KAAM,CAAC;IACxK,CAAC,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QACnE,IAAI,CAAC,SAAS,CAAC,mBAAmB;YAAE,SAAS;QAC7C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;QAChG,IAAI,MAAM,CAAC,yBAAyB,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,MAAM;YAAE,SAAS;QACzE,MAAM,IAAI,GAAG,MAAM,CAAC,6BAA6B,CAAC,EAAE,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACrF,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;QAC9I,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAClF,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAChG,IAAI,QAAQ,KAAK,QAAQ,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC/F,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;YAAC,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YACzI,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAClD,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;YACzL,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC1C,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,mBAAmB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,KAAK,CAAC,eAAe;QAAE,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,mBAAmB,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAC9R,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,yBAAyB,IAAI,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACzG,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,yBAAyB,EAAE,QAAQ,CAAC,gBAAiB,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7M,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACjI,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,yBAAyB,CAAC,EAAE,EAAE,QAAQ,EAAE,4BAA4B,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;AACpb,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,IAAY;IAC5D,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAAC,IAAI,QAAQ;QAAE,MAAM,eAAe,CAAC,IAAI,EAAE,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;AACpI,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAAoB,EAAE,IAAY,EAAE,gBAAyB;IAC1G,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,IAAI,CAAC,QAAQ,CAAC,cAAc,IAAI,CAAC,QAAQ,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAC1J,MAAM,uBAAuB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,OAAO,IAAI,CAAC;AAC/G,CAAC"}

package/dist/src/resources/gc.js

@@ -0,0 +1,123 @@
+import { mkdir, readdir, rename, rm } from "node:fs/promises";
+import path from "node:path";
+import { durableWriteJSON as atomicWriteJSON, readJSON } from "../foundation/index.js";
+import { canonical, natural, object } from "./protocol.js";
+import { validateLease, validateRoot } from "./store.js";
+import { planViewGc } from "./views.js";
+export async function auditResources(store, options = {}) {
+    const graceMs = options.graceMs ?? 24 * 60 * 60 * 1000;
+    natural(graceMs);
+    return store.locked(async () => {
+        const roots = await store.records("roots"), leases = await store.records("leases"), marked = new Map();
+        const mark = (digest, reason) => { const reasons = marked.get(digest) ?? new Set(); reasons.add(reason); marked.set(digest, reasons); };
+        for (const root of roots) {
+            validateRoot(root);
+            if (root.state !== "active")
+                continue;
+            const actual = await fileClosure(store, Object.values(root.lock.resources));
+            if (canonical(actual) !== canonical(root.closure.objectDigests))
+                throw new Error("durable resource closure is incomplete; GC stopped");
+            for (const digest of actual)
+                mark(digest, `owner:${root.owner}:${root.generation}`);
+        }
+        for (const lease of leases) {
+            validateLease(lease);
+            if (lease.state === "released")
+                continue;
+            // No PID or expiry test: unknown remote execution keeps its protection.
+            for (const digest of lease.objectDigests)
+                mark(digest, `${lease.state}-lease:${lease.id}`);
+        }
+        const report = { protocol: "hitch-resource-gc@1", dryRun: !options.apply, objects: 0, logicalBytes: 0, retained: [], eligible: [], quarantined: [], deleted: [] };
+        const directory = path.join(store.directory, "objects", "sha256"), quarantine = path.join(store.directory, "quarantine");
+        const names = async (dir) => readdir(dir).catch((e) => { if (e.code !== "ENOENT")
+            throw e; return []; });
+        // Verify every present object before any mutation. A partial producer may
+        // protect its next not-yet-published digest; active roots may never do so.
+        const files = await names(directory), quarantined = await names(quarantine);
+        for (const name of [...files, ...quarantined])
+            if (!/^[a-f0-9]{64}$/.test(name))
+                throw new Error("unknown object store entry; GC stopped");
+        const quarantineTimes = new Map();
+        for (const name of quarantined) {
+            const digest = `sha256:${name}`;
+            if (files.includes(name) || marked.has(digest))
+                throw new Error("duplicate or referenced quarantine object; GC stopped");
+            const index = object(await readJSON(path.join(store.directory, "quarantine-index", `${name}.json`)), ["protocol", "digest", "quarantinedAt"]);
+            if (index.protocol !== "hitch-resource-quarantine@1" || index.digest !== digest || !Number.isSafeInteger(index.quarantinedAt) || index.quarantinedAt < 0)
+                throw new Error("invalid quarantine record; GC stopped");
+            await store.objects.verify(digest, undefined, path.join(quarantine, name));
+            quarantineTimes.set(name, index.quarantinedAt);
+        }
+        for (const lease of leases)
+            if (lease.state !== "released" && lease.purpose !== "import") {
+                for (const digest of lease.objectDigests)
+                    if (!files.includes(digest.slice(7)))
+                        throw new Error("active resource lease has missing content; GC stopped");
+            }
+        for (const name of files) {
+            options.signal?.throwIfAborted();
+            report.logicalBytes += await store.objects.verify(`sha256:${name}`);
+            report.objects++;
+        }
+        const collectViews = await planViewGc(store, marked, graceMs);
+        if (options.apply)
+            await collectViews();
+        for (const name of files) {
+            const digest = `sha256:${name}`, reasons = marked.get(digest);
+            if (reasons) {
+                report.retained.push({ digest, reasons: [...reasons].sort() });
+                continue;
+            }
+            report.eligible.push(digest);
+            if (!options.apply)
+                continue;
+            options.signal?.throwIfAborted();
+            await mkdir(quarantine, { recursive: true });
+            await atomicWriteJSON(path.join(store.directory, "quarantine-index", `${name}.json`), { protocol: "hitch-resource-quarantine@1", digest, quarantinedAt: Date.now() });
+            await rename(path.join(directory, name), path.join(quarantine, name));
+            report.quarantined.push(digest);
+        }
+        for (const name of quarantined) {
+            const digest = `sha256:${name}`;
+            if (marked.has(digest))
+                throw new Error("referenced object is quarantined; acquire must restore it before GC");
+            if (!options.apply || Date.now() - quarantineTimes.get(name) < graceMs)
+                continue;
+            options.signal?.throwIfAborted();
+            await rm(path.join(quarantine, name));
+            await rm(path.join(store.directory, "quarantine-index", `${name}.json`));
+            report.deleted.push(digest);
+        }
+        return report;
+    }, options.signal);
+}
+export async function fileClosure(store, resources) {
+    const found = new Set();
+    let bytes = 0, files = 0;
+    for (const resource of resources) {
+        if (resource.kind === "oci-image")
+            continue;
+        const digest = resource.kind === "blob" ? resource.digest : resource.manifestDigest;
+        await store.objects.verify(digest, resource.kind === "blob" ? resource.size : undefined);
+        found.add(digest);
+        if (resource.kind === "tree") {
+            const tree = await store.objects.readTree(digest);
+            files += tree.entries.length;
+            for (const entry of tree.entries)
+                if (entry.kind === "file") {
+                    await store.objects.verify(entry.digest, entry.size);
+                    found.add(entry.digest);
+                    bytes += entry.size;
+                }
+        }
+        else {
+            bytes += resource.size;
+            files++;
+        }
+        if (bytes > store.objects.budget.maxTotalBytes || files > store.objects.budget.maxFiles)
+            throw new Error("resource closure budget exceeded");
+    }
+    return [...found].sort();
+}
+//# sourceMappingURL=gc.js.map

package/dist/src/resources/gc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gc.js","sourceRoot":"","sources":["../../../src/resources/gc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,IAAI,eAAe,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAiB,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAiB,aAAa,EAAE,YAAY,EAAyC,MAAM,YAAY,CAAC;AAC/G,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAYxC,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAoB,EAAE,UAAuE,EAAE;IAClI,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QAC7B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAe,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAgB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;QACzJ,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,MAAc,EAAE,EAAE,GAAG,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAChK,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,YAAY,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAAE,SAAS;YAC1D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAC5E,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACvI,KAAK,MAAM,MAAM,IAAI,MAAM;gBAAE,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,aAAa,CAAC,KAAK,CAAC,CAAC;YAAC,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU;gBAAE,SAAS;YAC/D,wEAAwE;YACxE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,aAAa;gBAAE,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,UAAU,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,MAAM,GAAqB,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACpL,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACzH,MAAM,KAAK,GAAG,KAAK,EAAE,GAAW,EAAqB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAwB,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3J,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,WAAW,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5E,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,GAAG,WAAW,CAAC;YAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC3I,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;QAClD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,UAAU,IAAI,EAAY,CAAC;YAC1C,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACzH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,kBAAkB,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;YAC9I,IAAI,KAAK,CAAC,QAAQ,KAAK,6BAA6B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,IAAK,KAAK,CAAC,aAAwB,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC/N,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;YAC3E,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,aAAuB,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACzF,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,aAAa;oBAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC3J,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YAAC,MAAM,CAAC,YAAY,IAAI,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAAC,CAAC;QACtJ,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,KAAK;YAAE,MAAM,YAAY,EAAE,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,UAAU,IAAI,EAAY,EAAE,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACxE,IAAI,OAAO,EAAE,CAAC;gBAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC1F,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAAC,IAAI,CAAC,OAAO,CAAC,KAAK;gBAAE,SAAS;YAC3D,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YAAC,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,kBAAkB,EAAE,GAAG,IAAI,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,6BAA6B,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACtK,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;YAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzG,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,UAAU,IAAI,EAAY,CAAC;YAC1C,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;YAC/G,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAE,GAAG,OAAO;gBAAE,SAAS;YAClF,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;YAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,kBAAkB,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;YAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAoB,EAAE,SAAqB;IAC3E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAAC,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;IAC1D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;QACpF,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5G,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YAChF,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAAC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;oBAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC;gBAAC,CAAC;QACtK,CAAC;aAAM,CAAC;YAAC,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAC3C,IAAI,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC/I,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC"}

package/dist/src/resources/index.js

@@ -0,0 +1,14 @@
+export { ResourceStore } from "./store.js";
+export { resourceRequest, resourceFileRequest, configuredResourceStore, preflightResourceInput } from "./api.js";
+export { readResourceInput, parseResourceDataset, parseResourceSelection, parseResourceTask, selectResources, sealResourceTask, preflightResourceTask, taskClosureLock, resourceDescriptorDirectory } from "./tasks.js";
+export { materializeResourceTask, finishResourceWorkspace } from "./materialize.js";
+export { parseResource, parseResourceLock, parseStrictJson, parseTree, canonical, identity, hash, RESOURCE_CAPABILITIES } from "./protocol.js";
+export { DockerResourceImageProvider } from "./oci-provider.js";
+export { auditResources } from "./gc.js";
+export { DEFAULT_RESOURCE_LIMITS } from "./object-store.js";
+export { createResourceDelivery, parseResourceDelivery, receiveResourceDelivery } from "./transfer.js";
+export { exportResourceBundle, importResourceBundle } from "./bundle.js";
+export { readResourceEvidence, sealResourceEvidence, confirmResourceResultSealed, reclaimResourceExecution } from "./evidence.js";
+export { resourceStorageStats } from "./stats.js";
+export { retainResourceResult } from "./result-retention.js";
+//# sourceMappingURL=index.js.map

package/dist/src/resources/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/resources/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAEjH,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAExN,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAGpF,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE/I,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAEvG,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAClI,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/src/resources/materialize.js

@@ -0,0 +1,143 @@
+import { roleDirectory, validateRoleContexts } from "./role-context.js";
+import { randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { appendFile, chmod, copyFile, lstat, mkdir, readFile, rename, rm, statfs, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { durableWriteJSON as atomicWriteJSON } from "../foundation/index.js";
+import { canonical, identity, parseStrictJson } from "./protocol.js";
+import { validateLease } from "./store.js";
+import { preflightResourceTask, parseResourceTask, taskClosureLock } from "./tasks.js";
+export async function materializeResourceTask(store, plan, input) {
+    const checked = await preflightResourceTask(store, plan.task, { platform: plan.platform, owner: input.owner, generation: input.generation, ...(input.signal ? { signal: input.signal } : {}) });
+    if (checked.plan.digest !== plan.digest)
+        throw new Error("resource execution plan changed");
+    const { lease } = await store.acquire(input.owner, taskClosureLock(plan.task), "execution", input.signal), id = randomUUID();
+    const directory = path.join(store.directory, "workspaces", id), temp = `${directory}.tmp`, taskDirectory = path.join(directory, plan.task.task_id);
+    const evidence = { protocol: "hitch-resource-workspace@1", id, state: "active", leaseId: lease.id, plan, taskDirectory, materialized_task_digest: "", clonedBytes: 0, copiedBytes: 0, fallbackReasons: {}, images: checked.closure.images };
+    try {
+        return await store.locked(async () => {
+            const mode = input.policy?.mode ?? "auto", maxWorkspaces = input.policy?.maxWorkspaces ?? 4, maxCopy = input.policy?.maxCopyBytes ?? store.objects.budget.maxTotalBytes;
+            if (!["auto", "copy", "require-clone"].includes(mode) || !Number.isSafeInteger(maxWorkspaces) || maxWorkspaces < 1 || !Number.isSafeInteger(maxCopy) || maxCopy < 0)
+                throw new TypeError("invalid workspace policy");
+            const active = (await store.records("leases")).filter(l => { validateLease(l); return l.purpose === "execution" && l.state !== "released"; });
+            if (active.length > maxWorkspaces)
+                throw new Error("resource workspace concurrency budget exceeded");
+            await mkdir(path.dirname(directory), { recursive: true });
+            await mkdir(temp, { mode: 0o700 });
+            const destination = path.join(temp, plan.task.task_id);
+            await mkdir(destination);
+            const file = async (digest, target, size, executable) => {
+                input.signal?.throwIfAborted();
+                await store.objects.verify(digest, size);
+                let clone = false;
+                if (mode !== "copy")
+                    try {
+                        await copyFile(store.objects.objectPath(digest), target, constants.COPYFILE_FICLONE_FORCE | constants.COPYFILE_EXCL);
+                        clone = true;
+                    }
+                    catch (error) {
+                        const code = error.code ?? "unknown";
+                        if (mode === "require-clone" || !["ENOTSUP", "EOPNOTSUPP", "EXDEV", "ENOSYS"].includes(code))
+                            throw error;
+                        evidence.fallbackReasons[code] = (evidence.fallbackReasons[code] ?? 0) + 1;
+                    }
+                if (clone)
+                    evidence.clonedBytes += size;
+                else {
+                    if (evidence.copiedBytes + size > maxCopy)
+                        throw new Error("resource workspace copy budget exceeded");
+                    const space = await statfs(temp, { bigint: true });
+                    if (space.bavail * space.bsize < BigInt(size + store.objects.budget.minFreeBytes))
+                        throw new Error("resource workspace free-space reserve exceeded");
+                    await copyFile(store.objects.objectPath(digest), target, constants.COPYFILE_EXCL);
+                    evidence.copiedBytes += size;
+                }
+                input.signal?.throwIfAborted();
+                await store.objects.verify(digest, size, target);
+                await chmod(target, executable ? 0o755 : 0o644);
+            };
+            const tree = async (resource, target) => {
+                const manifest = await store.objects.readTree(resource.manifestDigest);
+                for (const entry of manifest.entries) {
+                    const output = path.join(target, entry.path);
+                    if (entry.kind === "directory")
+                        await mkdir(output, { mode: 0o755 });
+                    else
+                        await file(entry.digest, output, entry.size, entry.executable);
+                }
+            };
+            await tree(plan.task.sourceTree, destination);
+            await validateRoleContexts(destination, plan.task.lock.bindings, plan.platform, checked.closure.images);
+            for (const binding of plan.task.lock.bindings) {
+                if (binding.use === "environment-image")
+                    continue;
+                const target = path.join(destination, roleDirectory(binding.consumer), binding.target), resource = plan.task.lock.resources[binding.resource];
+                await mkdir(path.dirname(target), { recursive: true });
+                // A source descriptor may not overwrite or shadow a resource binding.
+                if (await lstat(target).catch((e) => { if (e.code !== "ENOENT")
+                    throw e; return undefined; }))
+                    throw new Error("resource target collides with task descriptor");
+                if (resource.kind === "tree") {
+                    await mkdir(target);
+                    await tree(resource, target);
+                }
+                else if (resource.kind === "blob" && binding.use === "input-file")
+                    await file(resource.digest, target, resource.size, binding.executable);
+                else
+                    throw new Error("resource binding changed after preflight");
+            }
+            const roles = new Map(plan.task.lock.bindings.map(b => [canonical(b.consumer), b.consumer]));
+            for (const [role, consumer] of roles) {
+                const file = path.join(destination, roleDirectory(consumer), "Dockerfile"), text = await readFile(file, "utf8");
+                const transported = text.replace(/^(FROM\s+)(\S+)(.*)$/gim, (_all, prefix, ref, suffix) => {
+                    const image = checked.closure.images.find(i => ref.endsWith(`@${i.manifestDigest}`));
+                    if (!image)
+                        throw new Error("unresolved OCI build base");
+                    return `${prefix}${image.reference}${suffix}`;
+                });
+                await writeFile(file, transported);
+                await appendFile(file, `\nLABEL dev.hitch.resource.plan=${JSON.stringify(plan.digest)} dev.hitch.resource.consumer=${JSON.stringify(role)}\n`);
+            }
+            // Import the actual output as an identity proof while holding the same lock.
+            // Its independent evidence lease keeps it reproducible until result sealing.
+            const staging = path.join(temp, "proof");
+            await mkdir(staging);
+            const actual = await store.objects.importTree(destination, staging, d => store.protect(lease, d), input.signal);
+            evidence.materializedTree = actual.resource;
+            evidence.materialized_task_digest = identity("hitch-materialized-task@1", actual.resource);
+            await rm(staging, { recursive: true });
+            input.signal?.throwIfAborted();
+            await rename(temp, directory);
+            await atomicWriteJSON(path.join(store.directory, "workspace-records", `${id}.json`), evidence);
+            return evidence;
+        }, input.signal);
+    }
+    catch (error) {
+        await rm(temp, { recursive: true, force: true });
+        // If published, retain the workspace and execution lease for explicit recovery.
+        if (!await lstat(directory).catch(() => undefined))
+            await store.finishLease(lease.id, "ended");
+        throw error;
+    }
+}
+export async function finishResourceWorkspace(store, id, confirmation) {
+    if (!/^[a-f0-9-]{36}$/.test(id) || confirmation.executionEnded !== true || confirmation.resultSealed !== true)
+        throw new TypeError("workspace cleanup requires execution end and result sealing confirmation");
+    await store.locked(async () => {
+        const file = path.join(store.directory, "workspace-records", `${id}.json`), record = parseStrictJson(await readFile(file, "utf8"));
+        parseResourceTask(record.plan.task);
+        if (record.protocol !== "hitch-resource-workspace@1" || record.id !== id || record.taskDirectory !== path.join(store.directory, "workspaces", id, record.plan.task.task_id))
+            throw new TypeError("workspace ownership record mismatch");
+        record.state = "sealed";
+        await atomicWriteJSON(file, record);
+        await rm(path.join(store.directory, "workspaces", id), { recursive: true, force: true });
+        const lease = await store.readRecord("leases", record.leaseId);
+        if (!lease)
+            throw new Error("workspace lease missing");
+        validateLease(lease);
+        await store.finishLeaseLocked(lease);
+        record.state = "removed";
+        await atomicWriteJSON(file, record);
+    });
+}
+//# sourceMappingURL=materialize.js.map

package/dist/src/resources/materialize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"materialize.js","sourceRoot":"","sources":["../../../src/resources/materialize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAW,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC/H,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,IAAI,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAU,eAAe,EAA8C,MAAM,eAAe,CAAC;AACzH,OAAO,EAAiB,aAAa,EAAsB,MAAM,YAAY,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,eAAe,EAAqB,MAAM,YAAY,CAAC;AAkB1G,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAAoB,EAAE,IAAkB,EAAE,KAA4F;IAClL,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAChM,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC5F,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC;IAC7H,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,IAAI,GAAG,GAAG,SAAS,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnJ,MAAM,QAAQ,GAAsB,EAAE,QAAQ,EAAE,4BAA4B,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,wBAAwB,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;IAC/P,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,IAAI,MAAM,EAAE,aAAa,GAAG,KAAK,CAAC,MAAM,EAAE,aAAa,IAAI,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,YAAY,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;YACxK,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;YACrN,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,OAAO,CAAgB,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7J,IAAI,MAAM,CAAC,MAAM,GAAG,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACrG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9F,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;YACjF,MAAM,IAAI,GAAG,KAAK,EAAE,MAA0B,EAAE,MAAc,EAAE,IAAY,EAAE,UAAmB,EAAE,EAAE;gBACnG,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;gBAAC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAAC,IAAI,KAAK,GAAG,KAAK,CAAC;gBAC5F,IAAI,IAAI,KAAK,MAAM;oBAAE,IAAI,CAAC;wBAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,sBAAsB,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;wBAAC,KAAK,GAAG,IAAI,CAAC;oBAAC,CAAC;oBAChK,OAAO,KAAK,EAAE,CAAC;wBAAC,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,IAAI,SAAS,CAAC;wBAAC,IAAI,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;4BAAE,MAAM,KAAK,CAAC;wBAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;oBAAC,CAAC;gBACzQ,IAAI,KAAK;oBAAE,QAAQ,CAAC,WAAW,IAAI,IAAI,CAAC;qBACnC,CAAC;oBACJ,IAAI,QAAQ,CAAC,WAAW,GAAG,IAAI,GAAG,OAAO;wBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;oBACtG,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBAAC,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;oBACzM,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;oBAAC,QAAQ,CAAC,WAAW,IAAI,IAAI,CAAC;gBAClH,CAAC;gBACD,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;gBAAC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBAAC,MAAM,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACpI,CAAC,CAAC;YACF,MAAM,IAAI,GAAG,KAAK,EAAE,QAA6C,EAAE,MAAc,EAAE,EAAE;gBACnF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;gBACvE,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACrC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;wBAAE,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;;wBAChE,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC,CAAC;YACF,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YAC9C,MAAM,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACxG,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9C,IAAI,OAAO,CAAC,GAAG,KAAK,mBAAmB;oBAAE,SAAS;gBAClD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAE,CAAC;gBAC/I,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvD,sEAAsE;gBACtE,IAAI,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAwB,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBACvL,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;oBAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAAC,CAAC;qBAC/E,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,KAAK,YAAY;oBAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;;oBACrI,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC7F,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,EAAE,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAChH,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC,IAAI,EAAE,MAAc,EAAE,GAAW,EAAE,MAAc,EAAE,EAAE;oBAChH,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;oBAAC,IAAI,CAAC,KAAK;wBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;oBAC/I,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC;gBAChD,CAAC,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBAAC,MAAM,UAAU,CAAC,IAAI,EAAE,mCAAmC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrL,CAAC;YACD,6EAA6E;YAC7E,6EAA6E;YAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAChH,QAAQ,CAAC,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC5C,QAAQ,CAAC,wBAAwB,GAAG,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3F,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACvE,MAAM,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAAC,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,mBAAmB,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC9H,OAAO,QAAQ,CAAC;QAClB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,gFAAgF;QAChF,IAAI,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YAAE,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/F,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAAoB,EAAE,EAAU,EAAE,YAA0D;IACxI,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,cAAc,KAAK,IAAI,IAAI,YAAY,CAAC,YAAY,KAAK,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,0EAA0E,CAAC,CAAC;IAC/M,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,mBAAmB,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAsB,CAAC;QACxJ,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,QAAQ,KAAK,4BAA4B,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;QACxO,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC;QAAC,MAAM,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,UAAU,CAAgB,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAClM,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC;QAAC,MAAM,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/resources/object-store.js

@@ -0,0 +1,191 @@
+import { createHash, randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, readFile, readdir, rename, rm, statfs, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { syncDirectory } from "../foundation/index.js";
+import { canonical, compare, hash, natural, parseStrictJson, parseTree, portablePath, sha } from "./protocol.js";
+export const DEFAULT_RESOURCE_LIMITS = { maxObjectBytes: 1024 ** 3, maxTotalBytes: 8 * 1024 ** 3, maxFiles: 100_000, minFreeBytes: 64 * 1024 ** 2, maxViewBytes: 512 * 1024 ** 2 };
+export function limits(input = {}) {
+    if (Object.keys(input).some(k => !Object.keys(DEFAULT_RESOURCE_LIMITS).includes(k)))
+        throw new TypeError("unknown resource budget");
+    const value = { ...DEFAULT_RESOURCE_LIMITS, ...input };
+    Object.values(value).forEach(natural);
+    return value;
+}
+const signature = (s) => [s.dev, s.ino, s.mode, s.size, s.mtimeMs, s.ctimeMs].join(":");
+export class ObjectStore {
+    root;
+    budget;
+    directory;
+    constructor(root, budget = DEFAULT_RESOURCE_LIMITS) {
+        this.root = root;
+        this.budget = budget;
+        this.directory = path.join(root, "store", "benchmark-resources");
+    }
+    objectPath(digest) { return path.join(this.directory, "objects", "sha256", sha(digest).slice(7)); }
+    async verify(digest, expectedSize, file = this.objectPath(digest)) {
+        const info = await lstat(file);
+        if (!info.isFile() || info.isSymbolicLink() || info.size > this.budget.maxObjectBytes || expectedSize !== undefined && info.size !== expectedSize)
+            throw new Error("resource object type or size mismatch");
+        const handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            if (signature(await handle.stat()) !== signature(info))
+                throw new Error("resource object changed while opening");
+            const h = createHash("sha256");
+            let size = 0;
+            for await (const chunk of handle.createReadStream({ autoClose: false })) {
+                size += chunk.length;
+                if (size > this.budget.maxObjectBytes)
+                    throw new Error("resource object byte budget exceeded");
+                h.update(chunk);
+            }
+            if (`sha256:${h.digest("hex")}` !== digest || size !== info.size || signature(await handle.stat()) !== signature(info) || signature(await lstat(file)) !== signature(info))
+                throw new Error("resource object digest mismatch or concurrent modification");
+            return size;
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async readTree(digest) {
+        const size = await this.verify(digest);
+        if (size > 16 * 1024 ** 2)
+            throw new Error("tree manifest byte budget exceeded");
+        const text = await readFile(this.objectPath(digest), "utf8"), tree = parseTree(parseStrictJson(text));
+        if (hash(text) !== digest || text !== canonical(tree))
+            throw new Error("non-canonical tree manifest");
+        if (tree.entries.length > this.budget.maxFiles)
+            throw new Error("tree file budget exceeded");
+        return tree;
+    }
+    async publish(staged, digest, size, protect) {
+        await protect(digest); // Durable producer lease precedes first visibility.
+        const destination = this.objectPath(digest);
+        await mkdir(path.dirname(destination), { recursive: true });
+        const existing = await lstat(destination).catch((e) => { if (e.code !== "ENOENT")
+            throw e; return undefined; });
+        if (existing) {
+            await this.verify(digest, size);
+            await rm(staged);
+            return false;
+        }
+        const quarantined = path.join(this.directory, "quarantine", digest.slice(7));
+        if (await lstat(quarantined).catch((e) => { if (e.code !== "ENOENT")
+            throw e; return undefined; })) {
+            await this.verify(digest, size, quarantined);
+            await rename(quarantined, destination);
+            await syncDirectory(path.dirname(destination));
+            await rm(path.join(this.directory, "quarantine-index", `${digest.slice(7)}.json`), { force: true });
+            await rm(staged);
+            return false;
+        }
+        // All publishers and GC hold the store lock. An existing empty/corrupt object
+        // is never overwritten and shared files are never hardlinked into workspaces.
+        const handle = await open(staged, "r");
+        try {
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await rename(staged, destination);
+        await syncDirectory(path.dirname(destination));
+        await this.verify(digest, size);
+        return true;
+    }
+    async importFile(source, staging, protect, signal) {
+        signal?.throwIfAborted();
+        const info = await lstat(source);
+        if (!info.isFile() || info.isSymbolicLink())
+            throw new TypeError("resource import requires a regular file");
+        if (info.size > this.budget.maxObjectBytes || info.size > this.budget.maxTotalBytes)
+            throw new Error("resource object byte budget exceeded");
+        const space = await statfs(staging, { bigint: true });
+        if (space.bsize * space.bavail < BigInt(info.size + this.budget.minFreeBytes))
+            throw new Error("resource import free-space reserve exceeded");
+        const input = await open(source, constants.O_RDONLY | constants.O_NOFOLLOW), file = path.join(staging, randomUUID());
+        try {
+            if (signature(await input.stat()) !== signature(info))
+                throw new Error("resource source changed");
+            const output = await open(file, "wx", 0o600), digest = createHash("sha256");
+            let size = 0;
+            try {
+                for await (const chunk of input.createReadStream({ autoClose: false })) {
+                    signal?.throwIfAborted();
+                    size += chunk.length;
+                    if (size > this.budget.maxObjectBytes || size > info.size)
+                        throw new Error("resource source grew past byte budget");
+                    digest.update(chunk);
+                    await output.writeFile(chunk);
+                }
+                await output.sync();
+            }
+            finally {
+                await output.close();
+            }
+            if (size !== info.size || signature(await input.stat()) !== signature(info) || signature(await lstat(source)) !== signature(info))
+                throw new Error("resource source changed during import");
+            const resource = { kind: "blob", digest: `sha256:${digest.digest("hex")}`, size };
+            signal?.throwIfAborted();
+            return { resource, storedBytes: await this.publish(file, resource.digest, size, protect) ? size : 0 };
+        }
+        finally {
+            await input.close();
+            await rm(file, { force: true });
+        }
+    }
+    async importTree(source, staging, protect, signal) {
+        const snapshot = [];
+        let logicalBytes = 0, storedBytes = 0;
+        const visit = async (file, name) => {
+            signal?.throwIfAborted();
+            const info = await lstat(file);
+            if (!info.isFile() && !info.isDirectory())
+                throw new TypeError("resource import refuses links and special files");
+            if (name)
+                portablePath(name);
+            snapshot.push({ name, file, info });
+            if (snapshot.length > this.budget.maxFiles + 1)
+                throw new Error("resource file budget exceeded");
+            if (info.isFile()) {
+                logicalBytes += info.size;
+                if (info.size > this.budget.maxObjectBytes || logicalBytes > this.budget.maxTotalBytes)
+                    throw new Error("resource total byte budget exceeded");
+            }
+            else
+                for (const child of (await readdir(file)).sort(compare))
+                    await visit(path.join(file, child), name ? `${name}/${child}` : child);
+        };
+        await visit(source, "");
+        if (!snapshot[0]?.info.isDirectory())
+            throw new TypeError("tree source must be a directory");
+        // Validate shape, Unicode and case collisions before publishing any content.
+        const skeleton = { protocol: "hitch-tree@1", entries: snapshot.filter(e => e.name).map(e => e.info.isDirectory()
+                ? { path: e.name, kind: "directory" } : { path: e.name, kind: "file", digest: `sha256:${"0".repeat(64)}`, size: e.info.size, executable: Boolean(e.info.mode & 0o111) }).sort((a, b) => compare(a.path, b.path)) };
+        parseTree(skeleton);
+        const entries = [];
+        for (const e of snapshot) {
+            if (signature(await lstat(e.file)) !== signature(e.info))
+                throw new Error("resource source path changed");
+            if (!e.name)
+                continue;
+            if (e.info.isDirectory())
+                entries.push({ path: e.name, kind: "directory" });
+            else {
+                const imported = await this.importFile(e.file, staging, protect, signal);
+                storedBytes += imported.storedBytes;
+                entries.push({ path: e.name, kind: "file", digest: imported.resource.digest, size: imported.resource.size, executable: Boolean(e.info.mode & 0o111) });
+            }
+        }
+        for (const e of snapshot)
+            if (signature(await lstat(e.file)) !== signature(e.info))
+                throw new Error("resource source changed during tree import");
+        const tree = parseTree({ protocol: "hitch-tree@1", entries: entries.sort((a, b) => compare(a.path, b.path)) }), text = canonical(tree), manifestDigest = hash(text), file = path.join(staging, randomUUID());
+        if (Buffer.byteLength(text) > Math.min(this.budget.maxObjectBytes, 16 * 1024 ** 2))
+            throw new Error("tree manifest byte budget exceeded");
+        await writeFile(file, text, { flag: "wx", mode: 0o600 });
+        storedBytes += await this.publish(file, manifestDigest, Buffer.byteLength(text), protect) ? Buffer.byteLength(text) : 0;
+        return { resource: { kind: "tree", format: "hitch-tree@1", manifestDigest }, logicalBytes, storedBytes };
+    }
+}
+//# sourceMappingURL=object-store.js.map