akanjs 3.1.1 → 3.1.2-rc.0

package/server/oauth/OAuthClientIdMetadata.ts

@@ -1,6 +1,7 @@
 import { lookup } from "node:dns/promises";
 import { TrustedProxy } from "akanjs/common";
 import { OAuthRedirect } from "./OAuthRedirect";
+import { OAuthRegistration } from "./OAuthRegistration";
 import type { OAuthClientRecord, OAuthRedirectPolicy } from "./oauthTypes";
 
 export interface OAuthClientIdMetadataResult {
@@ -64,8 +65,8 @@ export class OAuthClientIdMetadata {
     }).catch(() => null);
     if (!res?.ok) return null;
     if (Number(res.headers.get("content-length")) > OAuthClientIdMetadata.maxBytes) return null;
-    const text = await res.text().catch(() => "");
-    if (!text || text.length > OAuthClientIdMetadata.maxBytes) return null;
+    const text = await OAuthClientIdMetadata.#readCapped(res).catch(() => null);
+    if (!text) return null;
     let json: unknown;
     try {
       json = JSON.parse(text);
@@ -85,19 +86,41 @@ export class OAuthClientIdMetadata {
     if (!Array.isArray(redirectUris) || !redirectUris.length) return null;
     if (!redirectUris.every((uri) => typeof uri === "string" && OAuthRedirect.isRegistrable(uri, policy))) return null;
     if ((doc.token_endpoint_auth_method ?? "none") !== "none") return null;
-    const grantTypes = Array.isArray(doc.grant_types)
-      ? doc.grant_types.filter((g) => typeof g === "string")
-      : undefined;
+    
+    const named = Array.isArray(doc.grant_types) ? (doc.grant_types as unknown[]) : [];
+    const grantTypes = named.length
+      ? [
+          ...new Set(
+            named.filter((g): g is string => typeof g === "string" && OAuthRegistration.grantTypes.includes(g)),
+          ),
+        ]
+      : ["authorization_code"];
     return {
       clientId,
       clientName: doc.client_name.trim(),
       redirectUris: redirectUris as string[],
-      grantTypes: grantTypes?.length ? grantTypes : ["authorization_code"],
+      grantTypes,
       tokenEndpointAuthMethod: "none",
       source: "metadataDocument",
     };
   }
 
+  static async #readCapped(res: Response): Promise<string | null> {
+    const reader = res.body?.getReader();
+    if (!reader) return null;
+    const chunks: Uint8Array[] = [];
+    let bytes = 0;
+    for (let chunk = await reader.read(); !chunk.done; chunk = await reader.read()) {
+      bytes += chunk.value.byteLength;
+      if (bytes > OAuthClientIdMetadata.maxBytes) {
+        await reader.cancel().catch(() => undefined);
+        return null;
+      }
+      chunks.push(chunk.value);
+    }
+    return Buffer.concat(chunks).toString("utf8");
+  }
+
   static readonly #lookup: OAuthAddressLookup = async (hostname) =>
     await Promise.race([
       lookup(hostname, { all: true }),

package/server/oauth/OAuthRegistration.ts

@@ -8,6 +8,9 @@ export class OAuthRegistration {
   static readonly authMethods: readonly OAuthClientAuthMethod[] = ["none", "client_secret_post", "client_secret_basic"];
   static readonly grantTypes: readonly string[] = ["authorization_code", "refresh_token"];
   static readonly maxNameLength = 200;
+  
+  static maxRedirectUris = 10;
+  static maxRedirectUriLength = 2048;
 
   static parse(body: unknown, policy: OAuthRedirectPolicy = {}): OAuthRegistrationResult {
     if (!body || typeof body !== "object" || Array.isArray(body))
@@ -16,6 +19,12 @@ export class OAuthRegistration {
     const redirectUris = meta.redirect_uris;
     if (!OAuthRegistration.#strings(redirectUris) || !redirectUris.length)
       return OAuthRegistration.#fail("invalid_redirect_uri", "`redirect_uris` must be a non-empty array of strings.");
+    const { maxRedirectUris, maxRedirectUriLength } = OAuthRegistration;
+    if (redirectUris.length > maxRedirectUris || redirectUris.some((uri) => uri.length > maxRedirectUriLength))
+      return OAuthRegistration.#fail(
+        "invalid_redirect_uri",
+        `\`redirect_uris\` may hold ${maxRedirectUris} URIs of at most ${maxRedirectUriLength} characters each.`,
+      );
     const rejected = redirectUris.find((uri) => !OAuthRedirect.isRegistrable(uri, policy));
     if (rejected !== undefined)
       return OAuthRegistration.#fail(

package/server/ops/failureLimiter.ts

@@ -0,0 +1,42 @@
+export interface FailureLimiterOptions {
+  limit: number;
+  windowMs?: number;
+  maxClients?: number;
+}
+
+export class FailureLimiter {
+  readonly #limit: number;
+  readonly #windowMs: number;
+  readonly #maxClients: number;
+  readonly #failures = new Map<string, number[]>();
+
+  constructor({ limit, windowMs = 60_000, maxClients = 10_000 }: FailureLimiterOptions) {
+    this.#limit = limit;
+    this.#windowMs = windowMs;
+    this.#maxClients = maxClients;
+  }
+
+  blocked(client: string | null | undefined, now = Date.now()): boolean {
+    if (!client) return false;
+    return this.#recent(client, now).length >= this.#limit;
+  }
+
+  fail(client: string | null | undefined, now = Date.now()) {
+    if (!client) return;
+    const recent = this.#recent(client, now);
+    this.#failures.delete(client);
+    while (this.#failures.size >= this.#maxClients) {
+      const oldest = this.#failures.keys().next().value;
+      if (oldest === undefined) break;
+      this.#failures.delete(oldest);
+    }
+    this.#failures.set(client, [...recent, now].slice(-this.#limit));
+  }
+
+  #recent(client: string, now: number) {
+    const recent = (this.#failures.get(client) ?? []).filter((at) => now - at < this.#windowMs);
+    if (recent.length) this.#failures.set(client, recent);
+    else this.#failures.delete(client);
+    return recent;
+  }
+}

package/server/ops/opsCommand.ts

@@ -1,6 +1,7 @@
 import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { parseArgs } from "node:util";
+import { getEnv } from "../../base/baseEnv";
 import type { AkanServer } from "../akanServer";
 import { MigrationCommand } from "../migration/migrationCommand";
 import type { Migrations } from "../migration/migrations";
@@ -17,8 +18,8 @@ export interface OpsHost {
 export class OpsCommand {
   static readonly usage = [
     "Usage:",
-    "  bun main.js ops snapshot [--id <id>] [--out <dir>] [--include-solid] [--db <file>] [--solid-db <file>] [--json]",
-    "  bun main.js ops restore <manifest.json> [--identity <file>] [--db <file>] [--solid-db <file>] [--force]",
+    "  bun main.js ops snapshot [--id <id>] [--out <dir>] [--include-solid] [--db <file>] [--solid-db <file>] [--allow-plaintext] [--json]",
+    "  bun main.js ops restore <manifest.json> [--identity <file>] [--db <file>] [--solid-db <file>] [--allow-plaintext] [--force]",
     "  bun main.js ops migrate [list|plan|apply|verify|rollback] [<id>] [--param <name>=<value>]... [--expect <planHash>] [--items <n>] [--actor <id>] [--json]",
   ].join("\n");
 
@@ -45,6 +46,7 @@ export class OpsCommand {
         db: { type: "string" },
         "solid-db": { type: "string" },
         "include-solid": { type: "boolean", default: false },
+        "allow-plaintext": { type: "boolean", default: false },
         json: { type: "boolean", default: false },
       },
     });
@@ -54,7 +56,7 @@ export class OpsCommand {
       dir: path.resolve(values.out ?? SqliteFiles.snapshotDir(sources)),
       sources,
       includeSolid: values["include-solid"],
-      encryptor: await OpsCommand.#encryptor(),
+      encryptor: await OpsCommand.#encryptor(values["allow-plaintext"]),
     });
     process.stdout.write(values.json ? `${JSON.stringify(capture)}\n` : `${JSON.stringify(capture, null, 2)}\n`);
     return 0;
@@ -68,6 +70,7 @@ export class OpsCommand {
         identity: { type: "string" },
         db: { type: "string" },
         "solid-db": { type: "string" },
+        "allow-plaintext": { type: "boolean", default: false },
         force: { type: "boolean", default: false },
       },
     });
@@ -82,6 +85,7 @@ export class OpsCommand {
       manifestPath: path.resolve(manifestPath),
       sources: OpsCommand.#sources(values.db, values["solid-db"]),
       decryptor: await OpsCommand.#decryptor(values.identity),
+      allowPlaintext: values["allow-plaintext"],
     });
     for (const { role, target, preservedAs } of restored)
       process.stdout.write(`restored ${role} → ${target}${preservedAs ? ` (previous kept at ${preservedAs})` : ""}\n`);
@@ -129,10 +133,18 @@ export class OpsCommand {
     }
   }
 
-  static async #encryptor() {
-    if (!process.env.AKAN_BACKUP_RECIPIENT?.trim()) return null;
-    const { AgeEncryption } = await import("./ageEncryption");
-    return await AgeEncryption.fromEnv();
+  static async #encryptor(allowPlaintext: boolean) {
+    if (process.env.AKAN_BACKUP_RECIPIENT?.trim()) {
+      const { AgeEncryption } = await import("./ageEncryption");
+      return await AgeEncryption.fromEnv();
+    }
+    if (getEnv().operationMode === "local") return null;
+    if (!allowPlaintext && !["1", "true"].includes(process.env.AKAN_BACKUP_PLAINTEXT ?? ""))
+      throw new Error(
+        "AKAN_BACKUP_RECIPIENT is unset; set it to an age recipient, or allow an unencrypted snapshot with --allow-plaintext or AKAN_BACKUP_PLAINTEXT=1",
+      );
+    process.stderr.write("ops snapshot: AKAN_BACKUP_RECIPIENT is unset, so this snapshot is not encrypted\n");
+    return null;
   }
 
   static async #decryptor(identityFile = process.env.AKAN_BACKUP_IDENTITY_FILE) {

package/server/ops/opsRoute.ts

@@ -1,7 +1,10 @@
 import { Logger } from "akanjs/common";
 import { getEnv } from "../../base/baseEnv";
+import { Ed25519Key } from "../ed25519Key";
+import { MachineToken } from "../machine/machineToken";
 import { SelfExec } from "../selfExec";
 import type { AppDetailInfo } from "./appInfo";
+import { FailureLimiter } from "./failureLimiter";
 import { MigrateJobs, type MigrateProcessOutput } from "./migrateJobs";
 import { type OpsTokenClaims, OpsTokenVerifier } from "./opsToken";
 import { type SnapshotJobRequest, SnapshotJobs } from "./snapshotJobs";
@@ -15,6 +18,7 @@ export interface OpsRouteOptions {
   jobs: SnapshotJobs;
   migrateJobs: MigrateJobs;
   rateLimitPerMinute?: number;
+  failuresPerMinute?: number;
 }
 
 export interface OpsRouteEnvOptions {
@@ -24,6 +28,7 @@ export interface OpsRouteEnvOptions {
 
 export class OpsRoute {
   static readonly prefix = "/_akan/ops/";
+  static readonly loggedRefusalsPerMinute = 10;
 
   readonly #logger = new Logger("OpsRoute");
   readonly #verifier: OpsTokenVerifier;
@@ -31,14 +36,25 @@ export class OpsRoute {
   readonly #jobs: SnapshotJobs;
   readonly #migrateJobs: MigrateJobs;
   readonly #rateLimit: number;
+  readonly #failures: FailureLimiter;
   #window: number[] = [];
+  #refusalWindowAt = 0;
+  #refusalCount = 0;
 
-  constructor({ verifier, detail, jobs, migrateJobs, rateLimitPerMinute = 30 }: OpsRouteOptions) {
+  constructor({
+    verifier,
+    detail,
+    jobs,
+    migrateJobs,
+    rateLimitPerMinute = 30,
+    failuresPerMinute = 10,
+  }: OpsRouteOptions) {
     this.#verifier = verifier;
     this.#detail = detail;
     this.#jobs = jobs;
     this.#migrateJobs = migrateJobs;
     this.#rateLimit = rateLimitPerMinute;
+    this.#failures = new FailureLimiter({ limit: failuresPerMinute });
   }
 
   static fromEnv({ detail, sources = SqliteFiles.fromEnv }: OpsRouteEnvOptions): OpsRoute | null {
@@ -48,21 +64,28 @@ export class OpsRoute {
     const logger = new Logger("OpsRoute");
     let verifier: OpsTokenVerifier;
     try {
-      verifier = new OpsTokenVerifier(
-        OpsTokenVerifier.parsePublicKey(publicKey),
-        OpsTokenVerifier.audienceOf(appName, environment),
-      );
+      const key = OpsTokenVerifier.parsePublicKey(publicKey);
+      
+      const machineKey = OpsRoute.#machinePublicKey();
+      if (machineKey && Ed25519Key.rawPublic(machineKey) === Ed25519Key.rawPublic(key))
+        throw new Error("AKAN_OPS_PUBLIC_KEY is also the machine token key; give the ops channel a key of its own");
+      verifier = new OpsTokenVerifier(key, OpsTokenVerifier.audienceOf(appName, environment));
     } catch (error) {
       
       logger.error(`Ops channel disabled: ${error instanceof Error ? error.message : String(error)}`);
       return null;
     }
     const snapshotDir = SqliteFiles.snapshotDir(sources());
+    void SqliteSnapshot.sweep(snapshotDir);
     const jobs = new SnapshotJobs({
       snapshotDir,
       capture: (request) => OpsRoute.captureInChild(request, sources(), snapshotDir),
     });
-    logger.info(`Ops channel enabled for audience ${verifier.audience}`);
+    logger.info(
+      process.env.AKAN_OPS_INSTANCE?.trim()
+        ? `Ops channel enabled for audience ${verifier.audience}`
+        : `Ops channel enabled for audience ${verifier.audience}; without AKAN_OPS_INSTANCE a token for it is good on every instance of ${appName}/${environment}`,
+    );
     const migrateJobs = new MigrateJobs((argv) => OpsRoute.migrateInChild(argv));
     return new OpsRoute({ verifier, detail, jobs, migrateJobs });
   }
@@ -104,14 +127,17 @@ export class OpsRoute {
     return pathname.startsWith(OpsRoute.prefix);
   }
 
-  async handle(req: Request): Promise<Response> {
+  async handle(req: Request, client?: string | null): Promise<Response> {
     const url = new URL(req.url);
-    if (!this.#admit()) return OpsRoute.#json({ error: "rate limited" }, 429, { "retry-after": "60" });
+    if (this.#failures.blocked(client)) return OpsRoute.#rateLimited();
     const verdict = this.#verifier.verifyRequest(req);
     if (!verdict.ok) {
-      this.#logger.warn(`Refused ops call to ${url.pathname}: ${verdict.reason}`);
+      this.#failures.fail(client);
+      this.#noteRefusal(url.pathname, verdict.reason);
       return OpsRoute.#json({ error: "unauthorized" }, 401, { "www-authenticate": "Bearer" });
     }
+    
+    if (!this.#admit()) return OpsRoute.#rateLimited();
     const route = url.pathname.slice(OpsRoute.prefix.length);
     if (route === "info" && req.method === "GET") return OpsRoute.#json(this.#detail(), 200);
     if (route === "snapshot" && req.method === "POST") return await this.#startSnapshot(req);
@@ -178,6 +204,31 @@ export class OpsRoute {
     return true;
   }
 
+  #noteRefusal(pathname: string, reason: string) {
+    const now = Date.now();
+    if (now - this.#refusalWindowAt >= 60_000) {
+      this.#refusalWindowAt = now;
+      this.#refusalCount = 0;
+    }
+    this.#refusalCount += 1;
+    if (this.#refusalCount <= OpsRoute.loggedRefusalsPerMinute)
+      this.#logger.warn(`Refused ops call to ${pathname}: ${reason}`);
+    else if (this.#refusalCount === OpsRoute.loggedRefusalsPerMinute + 1)
+      this.#logger.warn("Refusing further ops calls this minute without logging each");
+  }
+
+  static #machinePublicKey() {
+    try {
+      return MachineToken.publicKey();
+    } catch {
+      return null;
+    }
+  }
+
+  static #rateLimited() {
+    return OpsRoute.#json({ error: "rate limited" }, 429, { "retry-after": "60" });
+  }
+
   static #json(value: unknown, status: number, headers: Record<string, string> = {}) {
     return Response.json(value, { status, headers: { "cache-control": "no-store", ...headers } });
   }

package/server/ops/opsToken.ts

@@ -15,6 +15,9 @@ export interface OpsTokenClaims {
 export type OpsTokenVerdict = { ok: true; claims: OpsTokenClaims } | { ok: false; reason: string };
 
 export class OpsTokenVerifier {
+  static readonly type = "akan-ops+jwt";
+  
+  static readonly acceptedTypes: ReadonlySet<unknown> = new Set([undefined, "JWT", OpsTokenVerifier.type]);
   static readonly maxLifetimeSec = 300;
   static readonly clockSkewSec = 30;
   static readonly maxRememberedJti = 10_000;
@@ -45,6 +48,8 @@ export class OpsTokenVerifier {
   }
 
   verify(token: string, nowSec = Math.floor(Date.now() / 1000)): OpsTokenVerdict {
+    if (!OpsTokenVerifier.acceptedTypes.has(EdDsaJwt.headerOf(token)?.typ))
+      return { ok: false, reason: `typ must be ${OpsTokenVerifier.type}` };
     const verdict = EdDsaJwt.verify(token, this.#key, { audience: this.audience });
     if (!verdict.ok) return verdict;
     const { exp, iat, jti, sub } = verdict.claims;

package/server/ops/snapshotJobs.ts

@@ -60,6 +60,8 @@ export class SnapshotJobs {
   async #run(job: SnapshotJobState, request: SnapshotJobRequest) {
     try {
       const capture = await this.#options.capture(request);
+      if (!capture.manifest.encryption)
+        this.#logger.warn(`Snapshot ${job.id} is not encrypted: AKAN_BACKUP_RECIPIENT is unset`);
       job.manifest = capture.manifest;
       job.status = "uploading";
       for (const file of capture.manifest.files) {
@@ -118,7 +120,7 @@ export class SnapshotJobs {
     const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
     const dated = await Promise.all(
       entries
-        .filter((entry) => entry.isDirectory())
+        .filter((entry) => entry.isDirectory() && !entry.name.startsWith("."))
         .map(async (entry) => {
           const full = path.join(dir, entry.name);
           const manifest = await stat(path.join(full, "manifest.json")).catch(() => null);

package/server/ops/snapshotRestore.ts

@@ -16,6 +16,8 @@ export interface SnapshotRestoreOptions {
   manifestPath: string;
   sources: SnapshotSources;
   decryptor?: SnapshotDecryptor | null;
+  /** Restores a manifest that records no encryption even though a decryptor was given. */
+  allowPlaintext?: boolean;
   now?: Date;
 }
 
@@ -33,9 +35,21 @@ interface StagedFile {
 
 /** Offline only: it swaps files under a closed database, and nothing here can tell an open connection to let go. */
 export class SnapshotRestore {
-  static async run({ manifestPath, sources, decryptor = null, now = new Date() }: SnapshotRestoreOptions) {
+  static async run({
+    manifestPath,
+    sources,
+    decryptor = null,
+    allowPlaintext = false,
+    now = new Date(),
+  }: SnapshotRestoreOptions) {
     const manifest = JSON.parse(await readFile(manifestPath, "utf8")) as SnapshotManifest;
     if (manifest.format !== "akan-snapshot/v1") throw new Error(`Unknown snapshot format "${String(manifest.format)}"`);
+    
+    if (decryptor && !manifest.encryption && !allowPlaintext)
+      throw new Error(
+        "The manifest records no encryption although an identity was given; pass --allow-plaintext to restore it",
+      );
+    for (const file of manifest.files) SnapshotRestore.#assertFile(file);
     const dir = path.dirname(manifestPath);
     const stamp = now.toISOString().replace(/[:.]/g, "-");
     const staged: StagedFile[] = [];
@@ -100,6 +114,14 @@ export class SnapshotRestore {
     return stagedPath;
   }
 
+  static #assertFile(file: SnapshotFile) {
+    if (file.role !== "main" && file.role !== "solid")
+      throw new Error(`Unknown snapshot file role "${String(file.role)}"`);
+    const name = String(file.name);
+    if (!name || name === "." || name === ".." || path.basename(name) !== name)
+      throw new Error(`Snapshot file "${name}" must name a file beside the manifest`);
+  }
+
   static async #preserve(target: string, stamp: string) {
     if (!existsSync(target)) return null;
     const preserved = `${target}.pre-restore-${stamp}`;

package/server/ops/sqliteSnapshot.ts

@@ -1,7 +1,8 @@
 import { Database } from "bun:sqlite";
 import { createHash } from "node:crypto";
 import { createReadStream, createWriteStream, existsSync } from "node:fs";
-import { mkdir, rm, stat, writeFile } from "node:fs/promises";
+import { chmod, mkdir, mkdtemp, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { hostname } from "node:os";
 import path from "node:path";
 import { Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
@@ -28,6 +29,7 @@ export interface SnapshotCaptureOptions {
   sources: SnapshotSources;
   includeSolid?: boolean;
   encryptor?: SnapshotEncryptor | null;
+  fileMode?: number;
 }
 
 export interface SnapshotCapture {
@@ -40,6 +42,23 @@ export interface SnapshotCapture {
 export class SqliteSnapshot {
   static readonly manifestName = "manifest.json";
   static readonly idPattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+  static readonly stagingPrefix = ".capture-";
+  static staleAfterMs = 60 * 60 * 1000;
+  static readonly #stagingName = /^\.capture-([0-9a-f]{8})\.(\d+)\.([0-9a-z]+)-/;
+
+  static fileMode(value = process.env.AKAN_OPS_SNAPSHOT_FILE_MODE) {
+    const raw = value?.trim();
+    if (!raw) return 0o600;
+    const mode = /^[0-7]{3,4}$/.test(raw) ? Number.parseInt(raw, 8) : 0;
+    if (mode > 0 && mode <= 0o777) return mode;
+    process.stderr.write(`AKAN_OPS_SNAPSHOT_FILE_MODE="${raw}" is not an octal mode such as 640; using 600\n`);
+    return 0o600;
+  }
+
+  static stagingOwner(host = hostname(), pid = process.pid, startedAt = performance.timeOrigin) {
+    const hostKey = createHash("sha256").update(host).digest("hex").slice(0, 8);
+    return `${SqliteSnapshot.stagingPrefix}${hostKey}.${pid}.${Math.floor(startedAt).toString(36)}`;
+  }
 
   static async capture({
     id,
@@ -47,6 +66,7 @@ export class SqliteSnapshot {
     sources,
     includeSolid = false,
     encryptor = null,
+    fileMode = SqliteSnapshot.fileMode(),
   }: SnapshotCaptureOptions): Promise<SnapshotCapture> {
     if (!SqliteSnapshot.idPattern.test(id)) throw new Error(`Invalid snapshot id "${id}"`);
     const { appName, environment, databaseMode } = getEnv();
@@ -54,7 +74,9 @@ export class SqliteSnapshot {
       throw new Error(`Snapshots support SQLite database modes only, not "${databaseMode ?? "unknown"}"`);
     const targetDir = path.join(dir, id);
     if (existsSync(targetDir)) throw new Error(`Snapshot ${id} already exists at ${targetDir}`);
-    await mkdir(targetDir, { recursive: true });
+    await mkdir(dir, { recursive: true });
+    await SqliteSnapshot.sweep(dir);
+    const staging = await mkdtemp(path.join(dir, `${SqliteSnapshot.stagingOwner()}-`));
     try {
       const roles: [SnapshotFileRole, string][] = [["main", sources.main]];
       if (includeSolid && sources.solid) roles.push(["solid", sources.solid]);
@@ -62,9 +84,9 @@ export class SqliteSnapshot {
       const integrity: string[] = [];
       const paths: SnapshotCapture["paths"] = {};
       for (const [role, source] of roles) {
-        const { file, problems, packedPath } = await SqliteSnapshot.#captureOne(role, source, targetDir, encryptor);
+        const { file, problems } = await SqliteSnapshot.#captureOne(role, source, staging, encryptor, fileMode);
         files.push(file);
-        paths[role] = packedPath;
+        paths[role] = path.join(targetDir, file.name);
         integrity.push(...problems.map((problem) => `${role}: ${problem}`));
       }
       const { akanVersion, buildId } = AppInfo.build();
@@ -81,31 +103,89 @@ export class SqliteSnapshot {
         integrity: integrity.length ? integrity : "ok",
         encryption: encryptor?.encryption ?? null,
       };
-      const manifestPath = path.join(targetDir, SqliteSnapshot.manifestName);
-      await writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
-      return { dir: targetDir, manifest, manifestPath, paths };
+      await writeFile(path.join(staging, SqliteSnapshot.manifestName), `${JSON.stringify(manifest, null, 2)}\n`, {
+        mode: fileMode,
+      });
+      
+      await chmod(staging, fileMode | ((fileMode & 0o444) >> 2));
+      await rename(staging, targetDir);
+      return { dir: targetDir, manifest, manifestPath: path.join(targetDir, SqliteSnapshot.manifestName), paths };
     } catch (error) {
-      await rm(targetDir, { recursive: true, force: true });
+      await rm(staging, { recursive: true, force: true });
       throw error;
     }
   }
 
-  static async #captureOne(role: SnapshotFileRole, source: string, dir: string, encryptor: SnapshotEncryptor | null) {
+  static async sweep(dir: string) {
+    const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
+    const staged = entries.filter(
+      (entry) => entry.isDirectory() && entry.name.startsWith(SqliteSnapshot.stagingPrefix),
+    );
+    await Promise.all(
+      staged.map(async (entry) => {
+        const staging = path.join(dir, entry.name);
+        if (await SqliteSnapshot.#abandoned(entry.name, staging))
+          await rm(staging, { recursive: true, force: true }).catch(() => undefined);
+      }),
+    );
+  }
+
+  static async #abandoned(name: string, staging: string) {
+    const [, hostKey, pid, startedAt] = SqliteSnapshot.#stagingName.exec(name) ?? [];
+    const [, ownHost, ownPid, ownStart] = SqliteSnapshot.#stagingName.exec(`${SqliteSnapshot.stagingOwner()}-`) ?? [];
+    if (hostKey && hostKey === ownHost) {
+      if (pid === ownPid) return startedAt !== ownStart;
+      if (!SqliteSnapshot.#alive(Number(pid))) return true;
+    }
+    return Date.now() - (await SqliteSnapshot.#lastWrite(staging)) > SqliteSnapshot.staleAfterMs;
+  }
+
+  static async #lastWrite(staging: string) {
+    const names = await readdir(staging).catch(() => []);
+    const files = [staging, ...names.map((name) => path.join(staging, name))];
+    const stats = await Promise.all(files.map((file) => stat(file).catch(() => null)));
+    return Math.max(0, ...stats.map((stats) => stats?.mtimeMs ?? 0));
+  }
+
+  static #alive(pid: number) {
+    if (!Number.isInteger(pid) || pid <= 0) return false;
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch (error) {
+      return (error as NodeJS.ErrnoException).code === "EPERM";
+    }
+  }
+
+  static async #captureOne(
+    role: SnapshotFileRole,
+    source: string,
+    dir: string,
+    encryptor: SnapshotEncryptor | null,
+    fileMode: number,
+  ) {
     if (!existsSync(source)) throw new Error(`No ${role} database at ${source}`);
     const baseName = path.basename(source);
     const rawPath = path.join(dir, baseName);
-    SqliteSnapshot.vacuumInto(source, rawPath);
-    const problems = SqliteSnapshot.integrityProblems(rawPath);
-    const sizeBytes = (await stat(rawPath)).size;
     const name = `${baseName}.gz${encryptor?.extension ?? ""}`;
-    const packedPath = path.join(dir, name);
     const sourceHash = createHash("sha256");
     const uploadHash = createHash("sha256");
-    const stages: NodeJS.ReadWriteStream[] = [SqliteSnapshot.tap(sourceHash), createGzip()];
-    if (encryptor) stages.push(encryptor.transform());
-    stages.push(SqliteSnapshot.tap(uploadHash));
-    await pipeline([createReadStream(rawPath), ...stages, createWriteStream(packedPath)]);
-    await rm(rawPath, { force: true });
+    let problems: string[];
+    let sizeBytes: number;
+    try {
+      SqliteSnapshot.vacuumInto(source, rawPath);
+      await chmod(rawPath, 0o600);
+      problems = SqliteSnapshot.integrityProblems(rawPath);
+      sizeBytes = (await stat(rawPath)).size;
+      const stages: NodeJS.ReadWriteStream[] = [SqliteSnapshot.tap(sourceHash), createGzip()];
+      if (encryptor) stages.push(encryptor.transform());
+      stages.push(SqliteSnapshot.tap(uploadHash));
+      const packed = createWriteStream(path.join(dir, name), { mode: fileMode });
+      await pipeline([createReadStream(rawPath), ...stages, packed]);
+    } finally {
+      await rm(rawPath, { force: true });
+    }
+    const packedPath = path.join(dir, name);
     const file: SnapshotFile = {
       role,
       name,