clinkx 0.2.3 → 1.0.0

package/clinkx-workflows/dist/dashboard/auth/credential-store.js

@@ -0,0 +1,776 @@
+import { randomBytes } from "node:crypto";
+import { closeSync, fsyncSync, lstatSync, openSync, readFileSync, renameSync, utimesSync, } from "node:fs";
+import { lstat, mkdir, open, readFile, readdir, unlink, utimes, } from "node:fs/promises";
+import { hostname } from "node:os";
+import { join } from "node:path";
+import { z } from "zod";
+import { logger } from "../../logger.js";
+const CREDENTIAL_STORE_VERSION = 1;
+const CREDENTIAL_FILENAME = "credentials.json";
+const CREDENTIAL_LOCK_FILENAME = ".credentials.lock";
+const MAX_CREDENTIAL_FILE_BYTES = 256 * 1024;
+const MAX_CREDENTIALS = 16;
+const LOCK_HEARTBEAT_MS = 10_000;
+const LOCK_STALE_MS = 60_000;
+const MAX_DIAGNOSTIC_CAUSES = 8;
+const MAX_DIAGNOSTIC_NAME_LENGTH = 80;
+const MAX_DIAGNOSTIC_MESSAGE_LENGTH = 512;
+function canonicalBase64Url(value, expectedBytes) {
+    if (value === "" || !/^[A-Za-z0-9_-]+$/.test(value))
+        return false;
+    const decoded = Buffer.from(value, "base64url");
+    return (expectedBytes == null || decoded.byteLength === expectedBytes)
+        && decoded.toString("base64url") === value;
+}
+const Base64UrlSchema = z.string().refine((value) => canonicalBase64Url(value), "must be canonical base64url");
+const TransportSchema = z.enum([
+    "ble",
+    "cable",
+    "hybrid",
+    "internal",
+    "nfc",
+    "smart-card",
+    "usb",
+]);
+const StoredCredentialSchema = z.object({
+    id: Base64UrlSchema,
+    publicKey: Base64UrlSchema,
+    counter: z.number().int().nonnegative().safe(),
+    transports: z.array(TransportSchema).max(7),
+    label: z.string().trim().min(1).max(120).optional(),
+    createdAt: z.string().refine((value) => Number.isFinite(Date.parse(value)), "must be an ISO timestamp"),
+}).strict();
+const CredentialDocumentSchema = z.object({
+    version: z.literal(CREDENTIAL_STORE_VERSION),
+    userHandle: z.string().refine((value) => canonicalBase64Url(value, 16), "must encode exactly 16 bytes as canonical base64url"),
+    rpId: z.string().min(1),
+    credentials: z.array(StoredCredentialSchema).max(MAX_CREDENTIALS),
+}).strict().superRefine((document, context) => {
+    const seen = new Set();
+    for (const [index, credential] of document.credentials.entries()) {
+        if (seen.has(credential.id)) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "duplicate credential id",
+                path: ["credentials", index, "id"],
+            });
+        }
+        seen.add(credential.id);
+    }
+});
+function createCredentialLockRecord() {
+    return {
+        version: 1,
+        pid: process.pid,
+        hostname: hostname(),
+        token: randomBytes(16).toString("base64url"),
+        startedAt: new Date().toISOString(),
+    };
+}
+async function reclaimCredentialTransitionIfOwnerless(transitionPath) {
+    let raw;
+    let transitionStat;
+    try {
+        transitionStat = await lstat(transitionPath);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return true;
+        throw error;
+    }
+    if (transitionStat.isSymbolicLink()
+        || !transitionStat.isFile()
+        || (transitionStat.mode & 0o777) !== 0o600) {
+        throw new Error("dashboard credential lock transition ownership is unknown");
+    }
+    try {
+        raw = await readFile(transitionPath, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return true;
+        throw error;
+    }
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        value = undefined;
+    }
+    const recordValue = isCredentialLockRecord(value) ? value : undefined;
+    const validRecord = recordValue != null;
+    const provablyOwnerless = Date.now() - transitionStat.mtimeMs > LOCK_STALE_MS;
+    if (!provablyOwnerless) {
+        if (!validRecord) {
+            throw new Error("dashboard credential lock transition ownership is unknown");
+        }
+        return false;
+    }
+    const identity = { dev: transitionStat.dev, ino: transitionStat.ino };
+    if (recordValue == null) {
+        await assertUnchangedRegularFile(transitionPath, identity, raw, "dashboard credential lock transition");
+    }
+    else {
+        await assertOwnedLockFile(transitionPath, recordValue, identity, "dashboard credential lock transition");
+    }
+    await unlink(transitionPath);
+    return true;
+}
+async function withCredentialLockTransition(lockPath, operation) {
+    const transitionPath = `${lockPath}.reclaim`;
+    const record = createCredentialLockRecord();
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        let transitionHandle;
+        let transitionIdentity;
+        let transitionRecordWritten = false;
+        try {
+            transitionHandle = await open(transitionPath, "wx", 0o600);
+            const openedStat = await transitionHandle.stat();
+            transitionIdentity = { dev: openedStat.dev, ino: openedStat.ino };
+            await transitionHandle.writeFile(`${JSON.stringify(record)}\n`, "utf8");
+            transitionRecordWritten = true;
+            await transitionHandle.sync();
+            await transitionHandle.close();
+            transitionHandle = undefined;
+        }
+        catch (error) {
+            await transitionHandle?.close().catch(() => { });
+            if (error.code !== "EEXIST") {
+                if (transitionIdentity != null && transitionRecordWritten) {
+                    await assertOwnedLockFile(transitionPath, record, transitionIdentity, "dashboard credential lock transition").then(() => unlink(transitionPath), () => undefined).catch(() => { });
+                }
+                throw error;
+            }
+            if (attempt > 0
+                || !(await reclaimCredentialTransitionIfOwnerless(transitionPath))) {
+                return { entered: false };
+            }
+            continue;
+        }
+        if (transitionIdentity == null) {
+            throw new Error("dashboard credential lock transition ownership is unknown");
+        }
+        let heartbeatError;
+        let heartbeatTail = Promise.resolve();
+        const heartbeat = setInterval(() => {
+            heartbeatTail = heartbeatTail.then(async () => {
+                if (heartbeatError != null)
+                    return;
+                await assertOwnedLockFile(transitionPath, record, transitionIdentity, "dashboard credential lock transition", () => heartbeatError);
+                const now = new Date();
+                await utimes(transitionPath, now, now);
+                await assertOwnedLockFile(transitionPath, record, transitionIdentity, "dashboard credential lock transition", () => heartbeatError);
+            }).catch((error) => {
+                heartbeatError = error instanceof Error ? error : new Error(String(error));
+            });
+        }, LOCK_HEARTBEAT_MS);
+        heartbeat.unref();
+        try {
+            await assertOwnedLockFile(transitionPath, record, transitionIdentity, "dashboard credential lock transition", () => heartbeatError);
+            const value = await operation({
+                assertHealthy: async () => {
+                    await assertOwnedLockFile(transitionPath, record, transitionIdentity, "dashboard credential lock transition", () => heartbeatError);
+                },
+                runCritical: (criticalOperation) => {
+                    if (heartbeatError != null)
+                        throw heartbeatError;
+                    assertOwnedLockFileSync(transitionPath, record, transitionIdentity, "dashboard credential lock transition");
+                    const now = new Date();
+                    utimesSync(transitionPath, now, now);
+                    assertOwnedLockFileSync(transitionPath, record, transitionIdentity, "dashboard credential lock transition");
+                    return criticalOperation();
+                },
+            });
+            await assertOwnedLockFile(transitionPath, record, transitionIdentity, "dashboard credential lock transition", () => heartbeatError);
+            return { entered: true, value };
+        }
+        finally {
+            clearInterval(heartbeat);
+            await heartbeatTail.catch(() => { });
+            try {
+                await assertOwnedLockFile(transitionPath, record, transitionIdentity, "dashboard credential lock transition", () => heartbeatError);
+                await unlink(transitionPath);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+        }
+    }
+    return { entered: false };
+}
+function cloneDocument(document) {
+    return structuredClone(document);
+}
+function parseDocument(value, expectedRPID) {
+    const parsed = CredentialDocumentSchema.parse(value);
+    if (parsed.rpId !== expectedRPID) {
+        throw new Error(`dashboard credential store RP ID mismatch: expected ${JSON.stringify(expectedRPID)}`);
+    }
+    return parsed;
+}
+const CREDENTIAL_TEMP_FILENAME = /^\.credentials\.json\.[1-9]\d*\.[0-9a-f]{16}\.tmp$/;
+/**
+ * Deployment-only state classification. This intentionally does not compare
+ * RP IDs; DashboardCredentialStore.open remains the sole RP authority.
+ */
+export async function inspectDashboardCredentialEnrollmentState(directory) {
+    const entries = await readdir(directory, { withFileTypes: true });
+    for (const entry of entries) {
+        const recognized = entry.name === CREDENTIAL_FILENAME
+            || entry.name === CREDENTIAL_LOCK_FILENAME
+            || entry.name === `${CREDENTIAL_LOCK_FILENAME}.reclaim`
+            || CREDENTIAL_TEMP_FILENAME.test(entry.name);
+        if (!recognized) {
+            throw new Error(`unexpected credential directory entry ${JSON.stringify(entry.name)}`);
+        }
+        const entryStat = await lstat(join(directory, entry.name));
+        if (entryStat.isSymbolicLink() || !entryStat.isFile()) {
+            throw new Error(`credential directory entry ${JSON.stringify(entry.name)} must be a regular file`);
+        }
+    }
+    const filePath = join(directory, CREDENTIAL_FILENAME);
+    let raw;
+    try {
+        raw = await readFile(filePath);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return "absent";
+        throw error;
+    }
+    if (raw.byteLength > MAX_CREDENTIAL_FILE_BYTES) {
+        throw new Error("dashboard credential store exceeds the 256 KiB limit");
+    }
+    const document = CredentialDocumentSchema.parse(JSON.parse(raw.toString("utf8")));
+    return document.credentials.length === 0 ? "zero" : "nonzero";
+}
+async function assertSecureDirectory(directory) {
+    let entry;
+    try {
+        entry = await lstat(directory);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        await mkdir(directory, { recursive: true, mode: 0o700 });
+        entry = await lstat(directory);
+    }
+    if (entry.isSymbolicLink() || !entry.isDirectory()) {
+        throw new Error("dashboard credential directory must be a real directory");
+    }
+    const mode = entry.mode & 0o777;
+    if ((mode & 0o077) !== 0 || (mode & 0o700) !== 0o700) {
+        throw new Error("dashboard credential directory permissions must be 0700");
+    }
+}
+async function acquireCredentialDirectoryLock(directory, testHooks = {}) {
+    const lockPath = join(directory, CREDENTIAL_LOCK_FILENAME);
+    const record = createCredentialLockRecord();
+    let acquiredIdentity;
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        const transition = await withCredentialLockTransition(lockPath, async () => {
+            let handle;
+            let identity;
+            let recordWritten = false;
+            try {
+                handle = await open(lockPath, "wx", 0o600);
+                const openedStat = await handle.stat();
+                identity = { dev: openedStat.dev, ino: openedStat.ino };
+                await handle.writeFile(`${JSON.stringify(record)}\n`, "utf8");
+                recordWritten = true;
+                await handle.sync();
+                await handle.close();
+                handle = undefined;
+                return identity;
+            }
+            catch (error) {
+                await handle?.close().catch(() => { });
+                if (error.code === "EEXIST")
+                    return false;
+                if (identity != null && recordWritten) {
+                    await assertOwnedLockFile(lockPath, record, identity, "dashboard credential lock").then(() => unlink(lockPath), () => undefined).catch(() => { });
+                }
+                throw error;
+            }
+        });
+        if (!transition.entered) {
+            throw new Error("dashboard credential lock transition is held by another process");
+        }
+        if (transition.value !== false && transition.value != null) {
+            acquiredIdentity = transition.value;
+            break;
+        }
+        if (attempt > 0 || !(await reclaimCredentialLockIfOwnerless(lockPath))) {
+            throw new Error("dashboard credential directory is locked by another process");
+        }
+    }
+    if (acquiredIdentity == null) {
+        throw new Error("dashboard credential lock ownership is unknown");
+    }
+    const identity = acquiredIdentity;
+    await assertOwnedLockFile(lockPath, record, identity, "dashboard credential lock");
+    let released = false;
+    let heartbeatError;
+    let heartbeatTail = Promise.resolve();
+    const heartbeat = setInterval(() => {
+        heartbeatTail = heartbeatTail.then(async () => {
+            if (released || heartbeatError != null)
+                return;
+            await assertOwnedLockFile(lockPath, record, identity, "dashboard credential lock", () => heartbeatError);
+            const now = new Date();
+            await utimes(lockPath, now, now);
+            await assertOwnedLockFile(lockPath, record, identity, "dashboard credential lock", () => heartbeatError);
+        }).catch((error) => {
+            heartbeatError = error instanceof Error ? error : new Error(String(error));
+        });
+    }, LOCK_HEARTBEAT_MS);
+    heartbeat.unref();
+    return {
+        assertHealthy: async () => {
+            await assertOwnedLockFile(lockPath, record, identity, "dashboard credential lock", () => heartbeatError);
+        },
+        publish: async (prepared, afterRename) => {
+            let publicationCommitted = false;
+            let committedOutcome;
+            let transition;
+            try {
+                transition = await withCredentialLockTransition(lockPath, async (ownedTransition) => {
+                    await testHooks.beforePublicationCriticalSection?.();
+                    await ownedTransition.assertHealthy();
+                    await assertOwnedLockFile(lockPath, record, identity, "dashboard credential lock", () => heartbeatError);
+                    return ownedTransition.runCritical(() => {
+                        if (heartbeatError != null)
+                            throw heartbeatError;
+                        testHooks.onPublicationCriticalSection?.("transition-renewed");
+                        assertOwnedLockFileSync(lockPath, record, identity, "dashboard credential lock");
+                        testHooks.onPublicationCriticalSection?.("credential-asserted");
+                        committedOutcome = publishPreparedDocumentSync(directory, prepared, () => {
+                            try {
+                                afterRename();
+                            }
+                            finally {
+                                publicationCommitted = true;
+                            }
+                        }, testHooks);
+                        return committedOutcome;
+                    });
+                });
+            }
+            catch (error) {
+                if (!publicationCommitted)
+                    throw error;
+                return {
+                    postPublicationError: combinePostPublicationErrors(committedOutcome?.postPublicationError, error),
+                };
+            }
+            if (!transition.entered) {
+                throw new Error("dashboard credential lock transition is busy during publication");
+            }
+            return transition.value;
+        },
+        release: async () => {
+            if (released)
+                return;
+            released = true;
+            clearInterval(heartbeat);
+            await heartbeatTail;
+            await assertOwnedLockFile(lockPath, record, identity, "dashboard credential lock", () => heartbeatError);
+            await unlink(lockPath);
+        },
+    };
+}
+function isCredentialLockRecord(value) {
+    if (typeof value !== "object" || value == null || Array.isArray(value))
+        return false;
+    const candidate = value;
+    return candidate.version === 1
+        && Number.isSafeInteger(candidate.pid)
+        && candidate.pid > 0
+        && typeof candidate.hostname === "string"
+        && candidate.hostname !== ""
+        && typeof candidate.token === "string"
+        && canonicalBase64Url(candidate.token, 16)
+        && typeof candidate.startedAt === "string"
+        && Number.isFinite(Date.parse(candidate.startedAt));
+}
+function assertOwnedLockFileSync(filePath, record, identity, label) {
+    const entry = lstatSync(filePath);
+    if (entry.isSymbolicLink()
+        || !entry.isFile()
+        || (entry.mode & 0o777) !== 0o600
+        || entry.dev !== identity.dev
+        || entry.ino !== identity.ino) {
+        throw new Error(`${label} ownership changed`);
+    }
+    let current;
+    try {
+        current = JSON.parse(readFileSync(filePath, "utf8"));
+    }
+    catch {
+        throw new Error(`${label} ownership changed`);
+    }
+    if (!isCredentialLockRecord(current) || current.token !== record.token) {
+        throw new Error(`${label} ownership changed`);
+    }
+}
+async function assertOwnedLockFile(filePath, record, identity, label, heartbeatFailure) {
+    const assertHeartbeatHealthy = () => {
+        const failure = heartbeatFailure?.();
+        if (failure != null)
+            throw failure;
+    };
+    assertHeartbeatHealthy();
+    try {
+        const before = await lstat(filePath);
+        if (before.isSymbolicLink()
+            || !before.isFile()
+            || (before.mode & 0o777) !== 0o600
+            || before.dev !== identity.dev
+            || before.ino !== identity.ino) {
+            throw new Error(`${label} ownership changed`);
+        }
+        const raw = await readFile(filePath, "utf8");
+        const after = await lstat(filePath);
+        if (after.isSymbolicLink()
+            || !after.isFile()
+            || (after.mode & 0o777) !== 0o600
+            || after.dev !== identity.dev
+            || after.ino !== identity.ino) {
+            throw new Error(`${label} ownership changed`);
+        }
+        let current;
+        try {
+            current = JSON.parse(raw);
+        }
+        catch {
+            throw new Error(`${label} ownership changed`);
+        }
+        if (!isCredentialLockRecord(current) || current.token !== record.token) {
+            throw new Error(`${label} ownership changed`);
+        }
+    }
+    catch (error) {
+        if (error instanceof Error && error.message === `${label} ownership changed`) {
+            throw error;
+        }
+        throw new Error(`${label} ownership changed`);
+    }
+    assertHeartbeatHealthy();
+}
+async function assertUnchangedRegularFile(filePath, identity, expectedRaw, label) {
+    try {
+        const before = await lstat(filePath);
+        if (before.isSymbolicLink()
+            || !before.isFile()
+            || (before.mode & 0o777) !== 0o600
+            || before.dev !== identity.dev
+            || before.ino !== identity.ino) {
+            throw new Error(`${label} ownership changed`);
+        }
+        const raw = await readFile(filePath, "utf8");
+        const after = await lstat(filePath);
+        if (raw !== expectedRaw
+            || after.isSymbolicLink()
+            || !after.isFile()
+            || (after.mode & 0o777) !== 0o600
+            || after.dev !== identity.dev
+            || after.ino !== identity.ino) {
+            throw new Error(`${label} ownership changed`);
+        }
+    }
+    catch (error) {
+        if (error instanceof Error && error.message === `${label} ownership changed`) {
+            throw error;
+        }
+        throw new Error(`${label} ownership changed`);
+    }
+}
+async function reclaimCredentialLockIfOwnerless(lockPath) {
+    const transition = await withCredentialLockTransition(lockPath, async () => {
+        let raw;
+        let lockStat;
+        try {
+            lockStat = await lstat(lockPath);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return true;
+            throw error;
+        }
+        if (lockStat.isSymbolicLink()
+            || !lockStat.isFile()
+            || (lockStat.mode & 0o777) !== 0o600) {
+            throw new Error("dashboard credential lock ownership is unknown");
+        }
+        try {
+            raw = await readFile(lockPath, "utf8");
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return true;
+            throw error;
+        }
+        let value;
+        try {
+            value = JSON.parse(raw);
+        }
+        catch {
+            throw new Error("dashboard credential lock ownership is unknown");
+        }
+        if (!isCredentialLockRecord(value)) {
+            throw new Error("dashboard credential lock ownership is unknown");
+        }
+        const provablyOwnerless = Date.now() - lockStat.mtimeMs > LOCK_STALE_MS;
+        if (!provablyOwnerless)
+            return false;
+        await assertOwnedLockFile(lockPath, value, { dev: lockStat.dev, ino: lockStat.ino }, "dashboard credential lock");
+        await unlink(lockPath);
+        return true;
+    });
+    return transition.entered && transition.value === true;
+}
+async function assertSecureCredentialFile(filePath) {
+    const entry = await lstat(filePath);
+    if (entry.isSymbolicLink() || !entry.isFile()) {
+        throw new Error("dashboard credential store must be a regular file");
+    }
+    if ((entry.mode & 0o777) !== 0o600) {
+        throw new Error("dashboard credential store permissions must be 0600");
+    }
+    if (entry.size > MAX_CREDENTIAL_FILE_BYTES) {
+        throw new Error("dashboard credential store exceeds the 256 KiB limit");
+    }
+}
+async function prepareDocumentPublication(directory, document) {
+    const parsed = CredentialDocumentSchema.parse(document);
+    const serialized = `${JSON.stringify(parsed, null, 2)}\n`;
+    if (Buffer.byteLength(serialized, "utf8") > MAX_CREDENTIAL_FILE_BYTES) {
+        throw new Error("dashboard credential store exceeds the 256 KiB limit");
+    }
+    const filePath = join(directory, CREDENTIAL_FILENAME);
+    const temporaryPath = join(directory, `.${CREDENTIAL_FILENAME}.${String(process.pid)}.${randomBytes(8).toString("hex")}.tmp`);
+    const handle = await open(temporaryPath, "wx", 0o600);
+    try {
+        await handle.writeFile(serialized, "utf8");
+        await handle.sync();
+    }
+    catch (error) {
+        await handle.close().catch(() => { });
+        await unlink(temporaryPath).catch(() => { });
+        throw error;
+    }
+    await handle.close();
+    return { filePath, temporaryPath };
+}
+function publishPreparedDocumentSync(directory, prepared, afterRename, testHooks) {
+    renameSync(prepared.temporaryPath, prepared.filePath);
+    testHooks.onPublicationCriticalSection?.("renamed");
+    const errors = [];
+    try {
+        afterRename();
+    }
+    catch (error) {
+        errors.push(error);
+    }
+    testHooks.onPublicationCriticalSection?.("after-commit");
+    let descriptor;
+    try {
+        descriptor = (testHooks.openDirectorySync ?? ((path) => openSync(path, "r")))(directory);
+        testHooks.onPublicationCriticalSection?.("directory-opened");
+        try {
+            (testHooks.fsyncDirectorySync ?? fsyncSync)(descriptor);
+            testHooks.onPublicationCriticalSection?.("directory-fsynced");
+        }
+        catch (error) {
+            errors.push(error);
+        }
+    }
+    catch (error) {
+        errors.push(error);
+    }
+    finally {
+        if (descriptor != null) {
+            try {
+                (testHooks.closeDirectorySync ?? closeSync)(descriptor);
+                testHooks.onPublicationCriticalSection?.("directory-closed");
+            }
+            catch (error) {
+                errors.push(error);
+            }
+        }
+    }
+    if (errors.length === 0)
+        return {};
+    return {
+        postPublicationError: combinePostPublicationErrors(...errors),
+    };
+}
+function flattenPostPublicationError(error) {
+    if (error instanceof AggregateError) {
+        return Array.from(error.errors).flatMap(flattenPostPublicationError);
+    }
+    return [error];
+}
+function combinePostPublicationErrors(...errors) {
+    const flattened = errors.flatMap((error) => error == null
+        ? []
+        : flattenPostPublicationError(error));
+    if (flattened.length === 0)
+        return undefined;
+    if (flattened.length === 1)
+        return flattened[0];
+    return new AggregateError(flattened, "dashboard credential publication had multiple failures");
+}
+async function publishDocument(lock, directory, document, afterRename) {
+    const prepared = await prepareDocumentPublication(directory, document);
+    try {
+        return await lock.publish(prepared, afterRename);
+    }
+    catch (error) {
+        await unlink(prepared.temporaryPath).catch(() => { });
+        throw error;
+    }
+}
+function boundedDiagnosticText(value, limit) {
+    return value
+        .slice(0, limit)
+        .replace(/[A-Za-z0-9_-]{16,}/g, "[redacted]")
+        .replace(/\bcounter\s*(?:[:=]\s*)?\d+\b/gi, "counter [redacted]");
+}
+function safeDiagnosticCause(error) {
+    if (!(error instanceof Error)) {
+        return { name: "UnknownError", message: "non-Error failure" };
+    }
+    return {
+        name: boundedDiagnosticText(error.name, MAX_DIAGNOSTIC_NAME_LENGTH),
+        message: boundedDiagnosticText(error.message, MAX_DIAGNOSTIC_MESSAGE_LENGTH),
+    };
+}
+function safeDiagnosticError(error) {
+    const root = safeDiagnosticCause(error);
+    if (!(error instanceof AggregateError))
+        return root;
+    return {
+        ...root,
+        causes: Array.from(error.errors)
+            .slice(0, MAX_DIAGNOSTIC_CAUSES)
+            .map(safeDiagnosticCause),
+    };
+}
+function emitPostPublicationDiagnostic(error, testHooks) {
+    const diagnostic = {
+        code: "dashboard_credential_store_post_publication_failure",
+        error: safeDiagnosticError(error),
+    };
+    try {
+        if (testHooks.onPostPublicationDiagnostic != null) {
+            testHooks.onPostPublicationDiagnostic(diagnostic);
+            return;
+        }
+        logger.error({
+            code: diagnostic.code,
+            error: diagnostic.error,
+        }, "dashboard credential store entered post-publication failure; mutations are disabled until process restart/reopen");
+    }
+    catch {
+        // Diagnostics must not replace the captured publication failure.
+    }
+}
+export class DashboardCredentialStore {
+    #directory;
+    #expectedRPID;
+    #lock;
+    #testHooks;
+    #document;
+    #writeTail = Promise.resolve();
+    #postPublicationFailure = false;
+    #closed = false;
+    constructor(options, lock, document) {
+        this.#directory = options.directory;
+        this.#expectedRPID = options.expectedRPID;
+        this.#lock = lock;
+        this.#testHooks = options.testHooks ?? {};
+        this.#document = document;
+    }
+    static async open(options) {
+        await assertSecureDirectory(options.directory);
+        const lock = await acquireCredentialDirectoryLock(options.directory, options.testHooks);
+        try {
+            const filePath = join(options.directory, CREDENTIAL_FILENAME);
+            let document;
+            try {
+                await assertSecureCredentialFile(filePath);
+                const raw = await readFile(filePath);
+                if (raw.byteLength > MAX_CREDENTIAL_FILE_BYTES) {
+                    throw new Error("dashboard credential store exceeds the 256 KiB limit");
+                }
+                document = parseDocument(JSON.parse(raw.toString("utf8")), options.expectedRPID);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+                document = {
+                    version: CREDENTIAL_STORE_VERSION,
+                    userHandle: randomBytes(16).toString("base64url"),
+                    rpId: options.expectedRPID,
+                    credentials: [],
+                };
+                const publication = await publishDocument(lock, options.directory, document, () => { });
+                if (publication.postPublicationError != null) {
+                    throw publication.postPublicationError;
+                }
+            }
+            return new DashboardCredentialStore(options, lock, document);
+        }
+        catch (error) {
+            await lock.release().catch(() => { });
+            throw error;
+        }
+    }
+    read() {
+        if (this.#closed)
+            throw new Error("dashboard credential store is closed");
+        return cloneDocument(this.#document);
+    }
+    mutate(operation) {
+        if (this.#closed) {
+            return Promise.reject(new Error("dashboard credential store is closed"));
+        }
+        if (this.#postPublicationFailure) {
+            return Promise.reject(this.#postPublicationFailureError());
+        }
+        const run = this.#writeTail.then(async () => {
+            if (this.#postPublicationFailure) {
+                throw this.#postPublicationFailureError();
+            }
+            await this.#lock.assertHealthy();
+            const mutation = await operation(cloneDocument(this.#document));
+            const next = parseDocument(mutation.document, this.#expectedRPID);
+            const publication = await publishDocument(this.#lock, this.#directory, next, () => {
+                this.#document = next;
+                mutation.afterCommit?.();
+            });
+            if (publication.postPublicationError != null) {
+                this.#postPublicationFailure = true;
+                emitPostPublicationDiagnostic(publication.postPublicationError, this.#testHooks);
+                throw publication.postPublicationError;
+            }
+            return mutation.result;
+        });
+        this.#writeTail = run.then(() => { }, () => { });
+        return run;
+    }
+    #postPublicationFailureError() {
+        return new Error("dashboard credential store is disabled after a post-publication failure; process restart/reopen is required");
+    }
+    async close() {
+        if (this.#closed)
+            return;
+        this.#closed = true;
+        await this.#writeTail;
+        await this.#lock.release();
+    }
+}
+//# sourceMappingURL=credential-store.js.map