borgmcp 1.1.15 → 2.0.2

package/dist/seat-probe.js

@@ -1 +1,78 @@
-import{whoami as n}from"./remote-client.js";import{DroneEvictedError as o,DroneFrozenError as i}from"./drone-lifecycle.js";async function c(e,t){try{return await n(e,t),"live"}catch(r){return r instanceof o?"evicted":r instanceof i?"frozen":"indeterminate"}}export{c as defaultProbeSeat};
+// Shared per-seat liveness probe (gh#877 reuse).
+//
+// Extracted from cleanup-cmd.ts so BOTH `borg cleanup` (destructive → fail-SAFE)
+// and `borg launch-all` (constructive → fail-OPEN) can classify a saved seat by
+// ITS OWN token, without launch-all having to import cleanup-cmd's chalk/report
+// graph. cleanup-cmd re-exports `SeatStatus` for backwards compatibility.
+import { whoami } from './remote-client.js';
+import { DroneEvictedError } from './drone-lifecycle.js';
+import { BorgServerError, BorgServerHttpError, BorgServerTrustError, BorgServerUnreachableError, } from './server-errors.js';
+// Stable transport-level errno / undici codes (a CODE check, not error-text). A
+// pinned-CA TLS failure and a refused/reset/timeout all surface one of these.
+const TRANSPORT_ERRNOS = new Set([
+    'ECONNREFUSED',
+    'ECONNRESET',
+    'ENOTFOUND',
+    'EHOSTUNREACH',
+    'ENETUNREACH',
+    'ETIMEDOUT',
+    'EAI_AGAIN',
+    'EPIPE',
+    'UND_ERR_CONNECT_TIMEOUT',
+    'UND_ERR_HEADERS_TIMEOUT',
+    'UND_ERR_SOCKET',
+    'ABORT_ERR',
+]);
+function isTransportFailure(err) {
+    if (err instanceof BorgServerUnreachableError)
+        return true;
+    const e = err;
+    if (e?.name === 'AbortError')
+        return true;
+    const code = e?.code ?? e?.cause?.code;
+    return typeof code === 'string' && TRANSPORT_ERRNOS.has(code);
+}
+/**
+ * Default seat probe: a lightweight drone-authed `whoami` with the seat's OWN
+ * saved token. authedFetch throws TYPED errors on the authoritative outcomes
+ * (410→DroneEvictedError; pin-matched typed 401→BorgServerError('SESSION_REJECTED');
+ * every other 401→BorgServerError('CREDENTIAL_REJECTED'); a pinned-identity mismatch
+ * →BorgServerTrustError; a non-ok status→BorgServerHttpError(status); a transport
+ * failure/timeout→BorgServerUnreachableError). Each maps to a STABLE typed verdict
+ * so recovery copy is cause-accurate; the cleanup path must NEVER delete on anything
+ * but `evicted`; the launch path treats every non-`evicted`/non-terminal cause as
+ * fail-OPEN.
+ */
+export async function defaultProbeSeat(sessionToken, apiUrl, serverTrustIdentity) {
+    try {
+        await whoami(sessionToken, apiUrl, serverTrustIdentity);
+        return 'live';
+    }
+    catch (err) {
+        if (err instanceof DroneEvictedError)
+            return 'evicted';
+        // A pinned-identity / CA mismatch is a TERMINAL trust verdict — classified from
+        // the error TYPE, never from message text (the security boundary).
+        if (err instanceof BorgServerTrustError)
+            return 'trust-mismatch';
+        if (err instanceof BorgServerError) {
+            if (err.code === 'SESSION_REJECTED')
+                return 'rejected';
+            // Every non-SESSION 401 (bare/untyped or a different typed code) is a
+            // credential rejection — non-destructive, distinct from a takeover.
+            if (err.code === 'CREDENTIAL_REJECTED')
+                return 'credential-rejected';
+        }
+        if (err instanceof BorgServerHttpError) {
+            if (err.status === 404)
+                return 'endpoint-mismatch';
+            if (err.status >= 500 && err.status <= 599)
+                return 'server-failure';
+            return 'indeterminate';
+        }
+        if (isTransportFailure(err))
+            return 'unreachable';
+        return 'indeterminate';
+    }
+}
+//# sourceMappingURL=seat-probe.js.map

package/dist/seat-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-probe.js","sourceRoot":"","sources":["../src/seat-probe.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,0EAA0E;AAE1E,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAqC5B,gFAAgF;AAChF,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,cAAc;IACd,YAAY;IACZ,WAAW;IACX,cAAc;IACd,aAAa;IACb,WAAW;IACX,WAAW;IACX,OAAO;IACP,yBAAyB;IACzB,yBAAyB;IACzB,gBAAgB;IAChB,WAAW;CACZ,CAAC,CAAC;AAEH,SAAS,kBAAkB,CAAC,GAAY;IACtC,IAAI,GAAG,YAAY,0BAA0B;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,CAAC,GAAG,GAAkE,CAAC;IAC7E,IAAI,CAAC,EAAE,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC;IACvC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,YAAoB,EACpB,MAAc,EACd,mBAA4B;IAE5B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB;YAAE,OAAO,SAAS,CAAC;QACvD,gFAAgF;QAChF,mEAAmE;QACnE,IAAI,GAAG,YAAY,oBAAoB;YAAE,OAAO,gBAAgB,CAAC;QACjE,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;YACnC,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB;gBAAE,OAAO,UAAU,CAAC;YACvD,sEAAsE;YACtE,oEAAoE;YACpE,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB;gBAAE,OAAO,qBAAqB,CAAC;QACvE,CAAC;QACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,mBAAmB,CAAC;YACnD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;gBAAE,OAAO,gBAAgB,CAAC;YACpE,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,IAAI,kBAAkB,CAAC,GAAG,CAAC;YAAE,OAAO,aAAa,CAAC;QAClD,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/seat-store.d.ts

@@ -0,0 +1,76 @@
+/**
+ * 0600 flocked atomic file store (Queen rescope: replaces the OS keychain).
+ *
+ * This is the SINGLE storage primitive the collapsed seat/credential model sits
+ * on. It provides one advisory lock plus an atomic 0600 read-compare-write so
+ * that a record and everything that must stay consistent with it are written as
+ * ONE atomic unit (a temp-write + rename either lands wholly or not at all).
+ *
+ * SR-seven file-store checklist (fb0e446d) implemented here:
+ *   1. 0600 AT CREATE — the temp file is opened O_CREAT|O_EXCL mode 0600, and
+ *      rename preserves the mode, so the secret is never world/group-readable for
+ *      any window (no write-then-chmod).
+ *   2. ATOMIC RENAME — temp in the SAME dir/fs, created 0600, fsync THEN rename;
+ *      a crash never leaves a torn/readable partial, and the temp is cleaned up
+ *      on any write failure.
+ *   3. PARENT DIR 0700 — created with mode 0700.
+ *   4. flock DISCIPLINE — a single advisory lock (O_EXCL lockfile), RULED option
+ *      (b) (Coordinator cca6957a): NO automatic reclaim, EVER. Acquire is an atomic
+ *      `open(lockPath,'wx',0o600)`; the whole read-compare-write runs inside ONE
+ *      continuous hold, released on EVERY path (finally) by unlinking our OWN lock.
+ *      A pre-existing lock held by a LIVE pid is waited on (bounded) then reported
+ *      transient-busy; a lock whose recorded pid is DEAD (or whose payload is
+ *      missing/unparseable) FAILS CLOSED naming the exact lockfile path — Borg NEVER
+ *      steals or auto-deletes it (rename-claim reclaim is rejected: pathname
+ *      substitution). No per-account locks, no TOCTOU between acquire and commit.
+ *
+ * The raw secret rests only in the 0600 file (parity with the server's TLS keys);
+ * this module never logs it, and the digest-only observation discipline of the
+ * callers keeps the raw bearer from leaving the store owner.
+ */
+/**
+ * Atomic 0600 write (checklist #1 + #2): write to a same-dir temp opened
+ * O_CREAT|O_EXCL at mode 0600 (never write-then-chmod), fsync the data, then
+ * rename over the target (atomic; the mode carries across). A failed write
+ * cleans up the temp so no leftover file ever holds the secret.
+ */
+export declare function atomicWrite0600(filePath: string, data: string): Promise<void>;
+/**
+ * Read the store file, or null when it does not exist (ONLY the missing-file
+ * no-op path initializes empty). When the file exists, the 0600-store + 0700-parent
+ * perms are enforced BEFORE the bytes are read (CR#2) — a loosely-permissioned
+ * secret fails closed and is never read.
+ */
+export declare function readStoreFile(filePath: string): Promise<string | null>;
+/**
+ * Acquire the single advisory lock (checklist #4, RULED option b), run `op`, and
+ * release it on EVERY path (finally) by unlinking OUR OWN lock. Acquire is an atomic
+ * `open(lockPath,'wx',0o600)`. On EEXIST the lock is held:
+ *   - holder PID ALIVE → bounded wait/retry (attempts×waitMs), then throw the truthful
+ *     transient 'Borg seat store is busy' error;
+ *   - holder PID DEAD, or the payload is missing/unparseable → FAIL CLOSED naming the
+ *     exact lockfile path + the recorded dead pid/start-time. Borg NEVER auto-deletes
+ *     or steals it (no reclaim, no rename-claim). The operator clears it by hand only
+ *     after confirming no borg process is running.
+ * Because nothing ever steals a held lock, a plain unlink of our own lock on release
+ * is safe (no successor can be holding it).
+ */
+export declare function withStoreLock<T>(lockPath: string, op: () => Promise<T>, opts?: {
+    attempts?: number;
+    waitMs?: number;
+}): Promise<T>;
+/** A locked, in-memory transaction over one store file. */
+export interface StoreTxn<S> {
+    /** The mutable in-memory state, loaded under the lock. Mutate then commit(). */
+    data: S;
+    /** Atomically persist `data` (0600) — the single-write commit of the RCW. */
+    commit(): Promise<void>;
+}
+/**
+ * Run a read-compare-write transaction over `storePath` under the single store
+ * lock: load the current state (or an empty one), hand the caller a mutable view
+ * + an atomic commit, and release the lock on every path. The entire read →
+ * compare → (mutate) → commit happens inside ONE lock hold — no TOCTOU.
+ */
+export declare function withStore<S, T>(storePath: string, emptyState: () => S, parse: (raw: string) => S | null, op: (txn: StoreTxn<S>) => Promise<T>): Promise<T>;
+//# sourceMappingURL=seat-store.d.ts.map

package/dist/seat-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-store.d.ts","sourceRoot":"","sources":["../src/seat-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AA+FH;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBnF;AAkCD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAe5E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,CAAC,EACnC,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAChD,OAAO,CAAC,CAAC,CAAC,CAwDZ;AAED,2DAA2D;AAC3D,MAAM,WAAW,QAAQ,CAAC,CAAC;IACzB,gFAAgF;IAChF,IAAI,EAAE,CAAC,CAAC;IACR,6EAA6E;IAC7E,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAAE,CAAC,EAClC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,CAAC,EACnB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,GAAG,IAAI,EAChC,EAAE,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,CAAC,CAAC,CAgCZ"}

package/dist/seat-store.js

@@ -0,0 +1,309 @@
+/**
+ * 0600 flocked atomic file store (Queen rescope: replaces the OS keychain).
+ *
+ * This is the SINGLE storage primitive the collapsed seat/credential model sits
+ * on. It provides one advisory lock plus an atomic 0600 read-compare-write so
+ * that a record and everything that must stay consistent with it are written as
+ * ONE atomic unit (a temp-write + rename either lands wholly or not at all).
+ *
+ * SR-seven file-store checklist (fb0e446d) implemented here:
+ *   1. 0600 AT CREATE — the temp file is opened O_CREAT|O_EXCL mode 0600, and
+ *      rename preserves the mode, so the secret is never world/group-readable for
+ *      any window (no write-then-chmod).
+ *   2. ATOMIC RENAME — temp in the SAME dir/fs, created 0600, fsync THEN rename;
+ *      a crash never leaves a torn/readable partial, and the temp is cleaned up
+ *      on any write failure.
+ *   3. PARENT DIR 0700 — created with mode 0700.
+ *   4. flock DISCIPLINE — a single advisory lock (O_EXCL lockfile), RULED option
+ *      (b) (Coordinator cca6957a): NO automatic reclaim, EVER. Acquire is an atomic
+ *      `open(lockPath,'wx',0o600)`; the whole read-compare-write runs inside ONE
+ *      continuous hold, released on EVERY path (finally) by unlinking our OWN lock.
+ *      A pre-existing lock held by a LIVE pid is waited on (bounded) then reported
+ *      transient-busy; a lock whose recorded pid is DEAD (or whose payload is
+ *      missing/unparseable) FAILS CLOSED naming the exact lockfile path — Borg NEVER
+ *      steals or auto-deletes it (rename-claim reclaim is rejected: pathname
+ *      substitution). No per-account locks, no TOCTOU between acquire and commit.
+ *
+ * The raw secret rests only in the 0600 file (parity with the server's TLS keys);
+ * this module never logs it, and the digest-only observation discipline of the
+ * callers keeps the raw bearer from leaving the store owner.
+ */
+import { open, link, mkdir, readFile, rename, stat, unlink } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { randomBytes } from 'node:crypto';
+const LOCK_WAIT_MS = 10;
+const LOCK_ATTEMPTS = 500;
+/**
+ * Liveness check for the alive/dead branch (RULED option b). `process.kill(pid, 0)`
+ * sends no signal but validates the target: ESRCH ⇒ no such process (DEAD → fail
+ * closed); EPERM ⇒ the process exists but is owned by another user (ALIVE → wait).
+ * Any success ⇒ alive. This decides ONLY whether to wait vs. fail closed — it never
+ * authorizes a reclaim.
+ */
+function isProcessAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === 'EPERM';
+    }
+}
+/** Approximate wall-clock process start time (Date.now() − uptime). */
+function processStartTime() {
+    return new Date(Date.now() - Math.round(process.uptime() * 1000)).toISOString();
+}
+function parseLockPayload(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.pid === 'number' && Number.isInteger(parsed.pid) && parsed.pid > 0) {
+            return {
+                pid: parsed.pid,
+                startTime: typeof parsed.startTime === 'string' ? parsed.startTime : 'unknown',
+            };
+        }
+    }
+    catch {
+        /* unparseable — treated as a corrupt/foreign lock by the caller (fail closed) */
+    }
+    return null;
+}
+/**
+ * The fail-closed stale-lock error (RULED option b). Names the EXACT lockfile path
+ * plus the recorded dead pid / start time, and tells the operator to delete that
+ * file ONLY if no borg process is running. Borg never removes it automatically.
+ */
+function staleLockError(lockPath, held) {
+    const who = held
+        ? `its recorded owner process (pid ${held.pid}, started ${held.startTime}) is no longer running`
+        : 'its lock file is missing a valid owner identity or is corrupt';
+    return new Error(`Borg seat store lock file ${lockPath} is stale: ${who}. ` +
+        'Borg will NOT remove it automatically. If no borg process is running on this ' +
+        `machine, delete ${lockPath} and retry; otherwise wait for the other borg process to finish.`);
+}
+/**
+ * Ensure the store's parent directory exists at 0700 (checklist #3) AND repair-or-
+ * refuse a loose pre-existing one (CR3c). `mkdir(mode)` does NOT tighten an already-
+ * existing directory, so a pre-existing world/group-traversable parent would leave
+ * the 0600 credential-at-rest reachable. Fail CLOSED rather than write a secret
+ * beneath it.
+ */
+async function ensureParentDir(filePath) {
+    const dir = dirname(filePath);
+    let existing = null;
+    try {
+        existing = await stat(dir);
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT')
+            throw err;
+    }
+    if (existing) {
+        if ((existing.mode & 0o777) !== 0o700) {
+            throw new Error(`Borg store directory ${dir} has insecure permissions ` +
+                `(0${(existing.mode & 0o777).toString(8)}, expected 0700); refusing to write a credential under it`);
+        }
+        return;
+    }
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+}
+/**
+ * Atomic 0600 write (checklist #1 + #2): write to a same-dir temp opened
+ * O_CREAT|O_EXCL at mode 0600 (never write-then-chmod), fsync the data, then
+ * rename over the target (atomic; the mode carries across). A failed write
+ * cleans up the temp so no leftover file ever holds the secret.
+ */
+export async function atomicWrite0600(filePath, data) {
+    await ensureParentDir(filePath);
+    const tmp = `${filePath}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`;
+    const handle = await open(tmp, 'wx', 0o600);
+    try {
+        await handle.writeFile(data);
+        await handle.sync();
+    }
+    catch (err) {
+        await handle.close().catch(() => { });
+        await unlink(tmp).catch(() => { });
+        throw err;
+    }
+    await handle.close();
+    try {
+        await rename(tmp, filePath);
+    }
+    catch (err) {
+        await unlink(tmp).catch(() => { });
+        throw err;
+    }
+}
+/**
+ * CR#2: enforce the at-rest perms on the READ / no-op paths too (not just
+ * atomicWrite). A secret must NEVER be read from a group/other-accessible store
+ * file, nor from under a group/other-traversable parent. Fail CLOSED without
+ * reading the bytes. Mirrors the server-trust.ts `(mode & 0o077) !== 0` idiom.
+ */
+async function assertSecureStorePerms(filePath, fileMode) {
+    if ((fileMode & 0o077) !== 0) {
+        throw new Error(`Borg seat store file ${filePath} has insecure permissions ` +
+            `(0${(fileMode & 0o777).toString(8)}, expected 0600); refusing to read a credential from it`);
+    }
+    const dir = dirname(filePath);
+    let dirStat;
+    try {
+        dirStat = await stat(dir);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return; // vanished — readFile handles
+        throw err;
+    }
+    if ((dirStat.mode & 0o077) !== 0) {
+        throw new Error(`Borg seat store directory ${dir} has insecure permissions ` +
+            `(0${(dirStat.mode & 0o777).toString(8)}, expected 0700); refusing to read a credential under it`);
+    }
+}
+/**
+ * Read the store file, or null when it does not exist (ONLY the missing-file
+ * no-op path initializes empty). When the file exists, the 0600-store + 0700-parent
+ * perms are enforced BEFORE the bytes are read (CR#2) — a loosely-permissioned
+ * secret fails closed and is never read.
+ */
+export async function readStoreFile(filePath) {
+    let fileStat;
+    try {
+        fileStat = await stat(filePath);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+    await assertSecureStorePerms(filePath, fileStat.mode);
+    try {
+        return await readFile(filePath, 'utf8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+}
+/**
+ * Acquire the single advisory lock (checklist #4, RULED option b), run `op`, and
+ * release it on EVERY path (finally) by unlinking OUR OWN lock. Acquire is an atomic
+ * `open(lockPath,'wx',0o600)`. On EEXIST the lock is held:
+ *   - holder PID ALIVE → bounded wait/retry (attempts×waitMs), then throw the truthful
+ *     transient 'Borg seat store is busy' error;
+ *   - holder PID DEAD, or the payload is missing/unparseable → FAIL CLOSED naming the
+ *     exact lockfile path + the recorded dead pid/start-time. Borg NEVER auto-deletes
+ *     or steals it (no reclaim, no rename-claim). The operator clears it by hand only
+ *     after confirming no borg process is running.
+ * Because nothing ever steals a held lock, a plain unlink of our own lock on release
+ * is safe (no successor can be holding it).
+ */
+export async function withStoreLock(lockPath, op, opts = {}) {
+    const attempts = opts.attempts ?? LOCK_ATTEMPTS;
+    const waitMs = opts.waitMs ?? LOCK_WAIT_MS;
+    await mkdir(dirname(lockPath), { recursive: true, mode: 0o700 });
+    const myPayload = JSON.stringify({ pid: process.pid, startTime: processStartTime() });
+    // Stage the FULLY-WRITTEN payload in a same-dir temp, then acquire by atomically
+    // hard-linking it into place. `link` is atomic (EEXIST when the lock is held), and
+    // because the target appears already carrying the complete payload there is NO
+    // empty creation window — a concurrent contender never misreads a just-created
+    // lock as a corrupt/missing payload (which under option (b) would wrongly fail
+    // closed). A plain `open('wx')` create-then-write leaves exactly that window.
+    const tmp = `${lockPath}.${process.pid}.${randomBytes(6).toString('hex')}.acq`;
+    const staged = await open(tmp, 'wx', 0o600);
+    try {
+        await staged.writeFile(myPayload);
+    }
+    finally {
+        await staged.close();
+    }
+    try {
+        for (let attempt = 0; attempt < attempts; attempt += 1) {
+            try {
+                await link(tmp, lockPath);
+            }
+            catch (err) {
+                if (err.code !== 'EEXIST')
+                    throw err;
+                // The lock is held. Inspect the holder — but NEVER reclaim/steal it.
+                let raw;
+                try {
+                    raw = await readFile(lockPath, 'utf8');
+                }
+                catch (readErr) {
+                    if (readErr.code === 'ENOENT')
+                        continue; // released — retry
+                    throw readErr;
+                }
+                const held = parseLockPayload(raw);
+                if (held && isProcessAlive(held.pid)) {
+                    // A live-but-slow holder keeps its lock: wait a bounded interval and retry.
+                    await new Promise((resolvePromise) => setTimeout(resolvePromise, waitMs));
+                    continue;
+                }
+                // Dead recorded holder, or a missing/unparseable payload → fail closed. The
+                // operator must confirm no borg process is running and delete the file by hand.
+                throw staleLockError(lockPath, held);
+            }
+            // We own the lock (it already carries our payload from the staged temp).
+            try {
+                return await op();
+            }
+            finally {
+                // No reclaim exists, so nobody can be holding our lock — a plain unlink is safe.
+                await unlink(lockPath).catch((e) => {
+                    if (e.code !== 'ENOENT')
+                        throw e;
+                });
+            }
+        }
+        throw new Error('Borg seat store is busy');
+    }
+    finally {
+        await unlink(tmp).catch(() => { });
+    }
+}
+/**
+ * Run a read-compare-write transaction over `storePath` under the single store
+ * lock: load the current state (or an empty one), hand the caller a mutable view
+ * + an atomic commit, and release the lock on every path. The entire read →
+ * compare → (mutate) → commit happens inside ONE lock hold — no TOCTOU.
+ */
+export async function withStore(storePath, emptyState, parse, op) {
+    return withStoreLock(`${storePath}.lock`, async () => {
+        const raw = await readStoreFile(storePath);
+        // CR4 fail-closed: ONLY a missing file (ENOENT → readStoreFile returns null)
+        // may initialize an empty state. A present-but-malformed / wrong-version /
+        // schema-invalid store must NEVER be silently mapped to empty and then
+        // OVERWRITTEN by a subsequent commit — that erases every seat/credential and
+        // silently recreates authority. Throw WITHOUT writing so the corrupt bytes are
+        // preserved for recovery (parity with getServerCredentialRecord).
+        let data;
+        if (raw === null) {
+            data = emptyState();
+        }
+        else {
+            let loaded;
+            try {
+                loaded = parse(raw);
+            }
+            catch {
+                loaded = null;
+            }
+            if (loaded === null) {
+                throw new Error('Borg seat store is malformed or has an unsupported version; refusing to overwrite it');
+            }
+            data = loaded;
+        }
+        const txn = {
+            data,
+            commit: () => atomicWrite0600(storePath, JSON.stringify(data, null, 2) + '\n'),
+        };
+        return op(txn);
+    });
+}
+//# sourceMappingURL=seat-store.js.map

package/dist/seat-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-store.js","sourceRoot":"","sources":["../src/seat-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,aAAa,GAAG,GAAG,CAAC;AAQ1B;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAQ,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAC;IACzD,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,SAAS,gBAAgB;IACvB,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAClF,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2C,CAAC;QACzE,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YACrF,OAAO;gBACL,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;aAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iFAAiF;IACnF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,QAAgB,EAAE,IAAwB;IAChE,MAAM,GAAG,GAAG,IAAI;QACd,CAAC,CAAC,mCAAmC,IAAI,CAAC,GAAG,aAAa,IAAI,CAAC,SAAS,wBAAwB;QAChG,CAAC,CAAC,+DAA+D,CAAC;IACpE,OAAO,IAAI,KAAK,CACd,6BAA6B,QAAQ,cAAc,GAAG,IAAI;QACxD,+EAA+E;QAC/E,mBAAmB,QAAQ,kEAAkE,CAChG,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAAC,QAAgB;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,QAAQ,GAA4C,IAAI,CAAC;IAC7D,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,wBAAwB,GAAG,4BAA4B;gBACrD,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,2DAA2D,CACtG,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,IAAY;IAClE,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrC,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAClC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAClC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CACnC,QAAgB,EAChB,QAAgB;IAEhB,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,wBAAwB,QAAQ,4BAA4B;YAC1D,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,yDAAyD,CAC/F,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,OAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,8BAA8B;QAC5F,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,6BAA6B,GAAG,4BAA4B;YAC1D,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,0DAA0D,CACpG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB;IAClD,IAAI,QAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAgB,EAChB,EAAoB,EACpB,OAA+C,EAAE;IAEjD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC;IAC3C,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;IACtF,iFAAiF;IACjF,mFAAmF;IACnF,+EAA+E;IAC/E,+EAA+E;IAC/E,+EAA+E;IAC/E,8EAA8E;IAC9E,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IACD,IAAI,CAAC;QACH,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC;gBAChE,qEAAqE;gBACrE,IAAI,GAAW,CAAC;gBAChB,IAAI,CAAC;oBACH,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACzC,CAAC;gBAAC,OAAO,OAAO,EAAE,CAAC;oBACjB,IAAK,OAAiC,CAAC,IAAI,KAAK,QAAQ;wBAAE,SAAS,CAAC,mBAAmB;oBACvF,MAAM,OAAO,CAAC;gBAChB,CAAC;gBACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACrC,4EAA4E;oBAC5E,MAAM,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;oBAC1E,SAAS;gBACX,CAAC;gBACD,4EAA4E;gBAC5E,gFAAgF;gBAChF,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC;YACD,yEAAyE;YACzE,IAAI,CAAC;gBACH,OAAO,MAAM,EAAE,EAAE,CAAC;YACpB,CAAC;oBAAS,CAAC;gBACT,iFAAiF;gBACjF,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAwB,EAAE,EAAE;oBACxD,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;wBAAE,MAAM,CAAC,CAAC;gBACnC,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAUD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,SAAiB,EACjB,UAAmB,EACnB,KAAgC,EAChC,EAAoC;IAEpC,OAAO,aAAa,CAAC,GAAG,SAAS,OAAO,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;QAC3C,6EAA6E;QAC7E,2EAA2E;QAC3E,uEAAuE;QACvE,6EAA6E;QAC7E,+EAA+E;QAC/E,kEAAkE;QAClE,IAAI,IAAO,CAAC;QACZ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,IAAI,GAAG,UAAU,EAAE,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,IAAI,MAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;YACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,GAAG,GAAgB;YACvB,IAAI;YACJ,MAAM,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;SAC/E,CAAC;QACF,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC"}