knodin 0.8.4 → 0.8.6

package/dist/src/shared-index/provenance.js

@@ -0,0 +1,149 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { z } from "zod";
+import { Database } from "../engine/sqlite.js";
+import { resolveDbPath, resolveStateDir } from "../engine/state-paths.js";
+const counts = z
+    .object({
+    committedPaths: z.number().int().nonnegative(),
+    stagedPaths: z.number().int().nonnegative(),
+    workingTreePaths: z.number().int().nonnegative(),
+    deletedPaths: z.number().int().nonnegative(),
+    untrackedPaths: z.number().int().nonnegative(),
+})
+    .strict();
+export const sharedIndexProvenanceSchema = z
+    .object({
+    schemaVersion: z.literal(1),
+    enabled: z.boolean(),
+    state: z.enum([
+        "disabled",
+        "not-configured",
+        "configuration-invalid",
+        "local-only",
+        "restore-pending",
+        "restored-and-verified",
+        "restore-failed",
+    ]),
+    registrationId: z.string().optional(),
+    baseCommit: z
+        .string()
+        .regex(/^[a-f0-9]{40,64}$/)
+        .optional(),
+    manifestDigest: z
+        .string()
+        .regex(/^[a-f0-9]{64}$/)
+        .optional(),
+    source: z.enum(["local-index", "shared-snapshot"]),
+    cache: z.enum(["not-used", "downloaded", "hit", "unavailable", "corrupt-refetched"]).optional(),
+    overlay: counts.optional(),
+    failureCategory: z
+        .enum([
+        "authentication",
+        "authorization",
+        "not-found",
+        "timeout",
+        "integrity",
+        "compatibility",
+        "configuration",
+        "unavailable",
+    ])
+        .optional(),
+    effectiveTreeFingerprint: z
+        .string()
+        .regex(/^[a-f0-9]{64}$/)
+        .optional(),
+    restoredAt: z.iso.datetime().optional(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.state === "restored-and-verified" &&
+        (!value.registrationId ||
+            !value.baseCommit ||
+            !value.manifestDigest ||
+            !value.cache ||
+            !value.overlay ||
+            !value.effectiveTreeFingerprint ||
+            !value.restoredAt))
+        context.addIssue({ code: "custom", message: "verified provenance is incomplete" });
+    if (value.state === "restore-failed" && !value.failureCategory)
+        context.addIssue({ code: "custom", message: "failed provenance has no category" });
+});
+export const EMPTY_OVERLAY = {
+    committedPaths: 0,
+    stagedPaths: 0,
+    workingTreePaths: 0,
+    deletedPaths: 0,
+    untrackedPaths: 0,
+};
+function atomicJson(target, value) {
+    fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+    const temporary = `${target}.${process.pid}.${crypto.randomUUID()}.tmp`;
+    fs.writeFileSync(temporary, `${JSON.stringify(value)}\n`, { flag: "wx", mode: 0o600 });
+    const descriptor = fs.openSync(temporary, "r");
+    try {
+        fs.fsyncSync(descriptor);
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+    fs.renameSync(temporary, target);
+}
+export function readSharedIndexProvenance(repo) {
+    // The active database is authoritative. A sidecar from an older restore must
+    // never survive a later local rebuild as misleading current provenance.
+    const databasePath = resolveDbPath(repo);
+    if (!fs.existsSync(databasePath))
+        return null;
+    try {
+        const db = new Database(databasePath, { readonly: true });
+        try {
+            const get = (key) => db.query("SELECT value FROM meta WHERE key = ?").get(key)
+                ?.value ?? null;
+            const registrationId = get("sharedIndexRegistrationId");
+            const baseCommit = get("sharedIndexBaseCommit");
+            const manifestDigest = get("sharedIndexManifestDigest");
+            if (!registrationId || !baseCommit || !manifestDigest)
+                return null;
+            return sharedIndexProvenanceSchema.parse({
+                schemaVersion: 1,
+                enabled: true,
+                state: "restored-and-verified",
+                registrationId,
+                baseCommit,
+                manifestDigest,
+                source: "shared-snapshot",
+                cache: get("sharedIndexCache") ?? "unavailable",
+                overlay: JSON.parse(get("sharedIndexOverlay") ?? "null"),
+                effectiveTreeFingerprint: get("sharedIndexEffectiveTreeFingerprint") ?? undefined,
+                restoredAt: get("sharedIndexRestoredAt") ?? undefined,
+            });
+        }
+        finally {
+            db.close();
+        }
+    }
+    catch {
+        return null;
+    }
+}
+export function writeSharedIndexProvenance(repo, value) {
+    atomicJson(path.join(resolveStateDir(repo), "shared-index-provenance.json"), sharedIndexProvenanceSchema.parse(value));
+}
+export function readSharedRestoreAttempt(repo) {
+    try {
+        const value = JSON.parse(fs.readFileSync(path.join(resolveStateDir(repo), "shared-index-last-attempt.json"), "utf8"));
+        if (value.schemaVersion !== 1 ||
+            (value.outcome !== "restored" && value.outcome !== "failed") ||
+            !Number.isFinite(Date.parse(value.attemptedAt)))
+            return null;
+        return value;
+    }
+    catch {
+        return null;
+    }
+}
+export function writeSharedRestoreAttempt(repo, value) {
+    atomicJson(path.join(resolveStateDir(repo), "shared-index-last-attempt.json"), value);
+}

package/dist/src/shared-index/publisher.js

@@ -0,0 +1,198 @@
+import child_process from "node:child_process";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { createZstdCompress } from "node:zlib";
+import { Database } from "../engine/sqlite.js";
+import { resolveDbPath } from "../engine/state-paths.js";
+import { currentSharedIndexCompatibility } from "./compatibility.js";
+import { canonicalManifestBytes, SHARED_INDEX_LIMITS, sha256Hex, sharedBranchMatches, sharedRepositoryPrefix, } from "./contract.js";
+import { branchPointerKey, compatibilityFingerprint, signatureKey, validatePointerBinding, verifyManifest, } from "./manifest.js";
+import { SharedIndexError } from "./s3-client.js";
+import { parseBranchPointer, parseManifest } from "./schemas.js";
+/** Stamp the exact compatibility fingerprint into the checkpointed publisher DB. */
+export function prepareSharedPublisherDatabase(repo) {
+    const databasePath = resolveDbPath(repo);
+    if (!fs.existsSync(databasePath))
+        throw new SharedIndexError("configuration", "shared-index publisher database is missing");
+    const compatibility = currentSharedIndexCompatibility();
+    const inputFingerprint = compatibilityFingerprint(compatibility);
+    const db = new Database(databasePath);
+    try {
+        const commit = db.query("SELECT value FROM meta WHERE key='lastIndexedHead'").get()
+            ?.value ?? "";
+        if (!/^[a-f0-9]{40,64}$/.test(commit))
+            throw new SharedIndexError("integrity", "shared-index publisher database has no valid indexed commit");
+        const schema = db
+            .query("PRAGMA user_version")
+            .get()?.user_version;
+        if (schema !== compatibility.databaseSchemaVersion)
+            throw new SharedIndexError("compatibility", "shared-index publisher database schema is incompatible");
+        db.run("INSERT INTO meta(key, value) VALUES ('sharedIndexInputFingerprint', ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value", [inputFingerprint]);
+        db.run("PRAGMA wal_checkpoint(TRUNCATE)");
+        return { schemaVersion: 1, compatibility, inputFingerprint, commit };
+    }
+    finally {
+        db.close();
+        for (const suffix of ["-wal", "-shm"])
+            fs.rmSync(`${databasePath}${suffix}`, { force: true });
+    }
+}
+function safeOutputDirectory(target) {
+    const resolved = path.resolve(target);
+    if (fs.existsSync(resolved)) {
+        const stat = fs.lstatSync(resolved);
+        if (!stat.isDirectory() || stat.isSymbolicLink() || fs.readdirSync(resolved).length > 0)
+            throw new SharedIndexError("configuration", "shared-index publisher output must be a new or empty non-symlink directory");
+    }
+    else
+        fs.mkdirSync(resolved, { recursive: true, mode: 0o700 });
+    fs.chmodSync(resolved, 0o700);
+    return resolved;
+}
+function countingHash(hash, count) {
+    return new Transform({
+        transform(chunk, _encoding, callback) {
+            count.bytes += chunk.byteLength;
+            hash.update(chunk);
+            callback(null, chunk);
+        },
+    });
+}
+export async function createSharedPublisherBundle(options) {
+    if (!options.config.enabled)
+        throw new SharedIndexError("configuration", "shared-index publishing is disabled");
+    if (!options.config.branches.some((pattern) => sharedBranchMatches(pattern, options.branch)))
+        throw new SharedIndexError("configuration", "shared-index publishing branch is not configured");
+    const metadata = prepareSharedPublisherDatabase(options.repo);
+    const head = child_process
+        .execFileSync("git", ["rev-parse", "--verify", "HEAD"], {
+        cwd: options.repo,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+    })
+        .trim();
+    if (head !== metadata.commit)
+        throw new SharedIndexError("integrity", "shared-index publisher graph does not match repository HEAD");
+    const output = safeOutputDirectory(options.outputDirectory);
+    const graphFile = path.join(output, "graph.sqlite.zst");
+    const manifestFile = path.join(output, "manifest.json");
+    const signatureFile = path.join(output, "manifest.sig");
+    const pointerFile = path.join(output, "branch-pointer.json");
+    const databasePath = resolveDbPath(options.repo);
+    const uncompressedHash = crypto.createHash("sha256");
+    const compressedHash = crypto.createHash("sha256");
+    const uncompressed = { bytes: 0 };
+    const compressed = { bytes: 0 };
+    await pipeline(fs.createReadStream(databasePath), countingHash(uncompressedHash, uncompressed), createZstdCompress(), countingHash(compressedHash, compressed), fs.createWriteStream(graphFile, { flags: "wx", mode: 0o600 }));
+    if (uncompressed.bytes <= 0 ||
+        uncompressed.bytes > SHARED_INDEX_LIMITS.uncompressedBytes ||
+        compressed.bytes <= 0 ||
+        compressed.bytes > SHARED_INDEX_LIMITS.compressedBytes)
+        throw new SharedIndexError("integrity", "shared-index publisher graph exceeds contract bounds");
+    const immutable = `${sharedRepositoryPrefix(options.config.repository)}snapshots/${metadata.commit}/${metadata.inputFingerprint}`;
+    const graphKey = `${immutable}/graph.sqlite.zst`;
+    const manifestKey = `${immutable}/manifest.json`;
+    const manifest = {
+        schemaVersion: 1,
+        registrationId: options.config.registrationId,
+        repository: options.config.repository,
+        commit: metadata.commit,
+        generatedAt: new Date().toISOString(),
+        compatibility: metadata.compatibility,
+        graph: {
+            key: graphKey,
+            compressedSha256: compressedHash.digest("hex"),
+            compressedBytes: compressed.bytes,
+            uncompressedSha256: uncompressedHash.digest("hex"),
+            uncompressedBytes: uncompressed.bytes,
+        },
+    };
+    const manifestBytes = canonicalManifestBytes(manifest);
+    fs.writeFileSync(manifestFile, manifestBytes, { flag: "wx", mode: 0o600 });
+    const bundle = {
+        schemaVersion: 1,
+        branch: options.branch,
+        commit: metadata.commit,
+        inputFingerprint: metadata.inputFingerprint,
+        manifestKey,
+        manifestSha256: sha256Hex(manifestBytes),
+        signatureKey: signatureKey(manifestKey),
+        pointerKey: branchPointerKey(options.config, options.branch),
+        graphKey,
+        region: options.config.aws.region,
+        bucket: options.config.aws.bucket,
+        keyId: options.config.signing.keyId,
+        files: {
+            graph: graphFile,
+            manifest: manifestFile,
+            signature: signatureFile,
+            pointer: pointerFile,
+        },
+    };
+    fs.writeFileSync(path.join(output, "bundle.json"), `${JSON.stringify(bundle)}\n`, {
+        flag: "wx",
+        mode: 0o600,
+    });
+    return bundle;
+}
+export function finalizeSharedPublisherBundle(options) {
+    const bundle = options.bundle;
+    const directory = path.dirname(path.resolve(bundle.files?.manifest ?? ""));
+    const expectedFiles = {
+        graph: "graph.sqlite.zst",
+        manifest: "manifest.json",
+        signature: "manifest.sig",
+        pointer: "branch-pointer.json",
+    };
+    if (bundle.schemaVersion !== 1 ||
+        !/^[a-f0-9]{40,64}$/.test(bundle.commit) ||
+        !/^[a-f0-9]{64}$/.test(bundle.inputFingerprint) ||
+        !/^[a-f0-9]{64}$/.test(bundle.manifestSha256) ||
+        bundle.region !== options.config.aws.region ||
+        bundle.bucket !== options.config.aws.bucket ||
+        bundle.keyId !== options.config.signing.keyId ||
+        Object.entries(expectedFiles).some(([name, filename]) => path.resolve(bundle.files[name] ?? "") !==
+            path.join(directory, filename)))
+        throw new SharedIndexError("integrity", "shared-index publisher bundle descriptor is invalid");
+    const manifestBytes = fs.readFileSync(options.bundle.files.manifest);
+    const signature = fs.readFileSync(options.bundle.files.signature);
+    const manifest = parseManifest(manifestBytes);
+    if (!options.config.branches.some((pattern) => sharedBranchMatches(pattern, bundle.branch)) ||
+        bundle.graphKey !== manifest.graph.key ||
+        bundle.signatureKey !== signatureKey(bundle.manifestKey) ||
+        sha256Hex(manifestBytes) !== bundle.manifestSha256)
+        throw new SharedIndexError("integrity", "shared-index publisher bundle bindings are invalid");
+    const pointer = parseBranchPointer(canonicalManifestBytes({
+        schemaVersion: 1,
+        registrationId: options.config.registrationId,
+        repository: options.config.repository,
+        branch: options.bundle.branch,
+        commit: options.bundle.commit,
+        inputFingerprint: options.bundle.inputFingerprint,
+        manifestKey: options.bundle.manifestKey,
+        manifestSha256: options.bundle.manifestSha256,
+        updatedAt: new Date().toISOString(),
+    }));
+    validatePointerBinding(options.config, pointer);
+    verifyManifest(options.config, pointer, manifestBytes, manifest, signature, manifest.compatibility);
+    const pointerBytes = canonicalManifestBytes(pointer);
+    fs.writeFileSync(options.bundle.files.pointer, pointerBytes, { flag: "wx", mode: 0o600 });
+    return pointerBytes;
+}
+export function guardPublisherPointer(options) {
+    const pointer = parseBranchPointer(options.existingPointerBytes);
+    if (pointer.branch !== options.branch)
+        throw new SharedIndexError("integrity", "shared-index existing pointer branch is invalid");
+    validatePointerBinding(options.config, pointer);
+    if (pointer.commit === options.newCommit)
+        return;
+    const relation = child_process.spawnSync("git", ["merge-base", "--is-ancestor", pointer.commit, options.newCommit], { cwd: options.repo, stdio: "ignore" });
+    if (relation.status !== 0)
+        throw new SharedIndexError("compatibility", "shared-index publisher refuses a backward or diverged pointer update");
+}
+export function publisherPointerKey(config, branch) {
+    return branchPointerKey(config, branch);
+}

package/dist/src/shared-index/restore.js

@@ -0,0 +1,209 @@
+import fs from "node:fs";
+import { Database } from "../engine/sqlite.js";
+import { acquireRepairLease } from "../repair-lease.js";
+import { decompressArtifactToCandidate } from "./artifact.js";
+import { SharedIndexCache } from "./cache.js";
+import { canonicalManifestBytes, sha256Hex } from "./contract.js";
+import { deriveSharedOverlay } from "./overlay.js";
+import { readSharedIndexProvenance, writeSharedIndexProvenance, writeSharedRestoreAttempt, } from "./provenance.js";
+import { SharedIndexError, } from "./s3-client.js";
+import { selectSharedSnapshot } from "./selection.js";
+function progress(listener, phase, message, extra = {}) {
+    try {
+        listener?.({ phase, timestamp: new Date().toISOString(), message, ...extra });
+    }
+    catch {
+        // Observability cannot change restore correctness.
+    }
+}
+function boundedFailure(error) {
+    if (error instanceof SharedIndexError)
+        return { category: error.category, reason: error.message.slice(0, 512) };
+    return { category: "unavailable", reason: "shared-index restore failed" };
+}
+function metadata(db, key) {
+    return (db.query("SELECT value FROM meta WHERE key = ?").get(key)?.value ??
+        null);
+}
+function validateSnapshotDatabase(databasePath, commit, inputFingerprint, databaseSchemaVersion) {
+    const db = new Database(databasePath, { readonly: true });
+    try {
+        const schema = db
+            .query("PRAGMA user_version")
+            .get()?.user_version;
+        if (schema !== databaseSchemaVersion)
+            throw new SharedIndexError("integrity", "shared-index database schema does not match signed manifest");
+        if (metadata(db, "lastIndexedHead") !== commit)
+            throw new SharedIndexError("integrity", "shared-index database commit does not match signed manifest");
+        const embeddedFingerprint = metadata(db, "sharedIndexInputFingerprint");
+        if (embeddedFingerprint !== inputFingerprint)
+            throw new SharedIndexError("integrity", "shared-index database compatibility does not match signed manifest");
+    }
+    finally {
+        db.close();
+    }
+}
+function stampCandidate(databasePath, values) {
+    const db = new Database(databasePath);
+    try {
+        db.run("BEGIN IMMEDIATE");
+        for (const [key, value] of Object.entries(values))
+            db.run("INSERT INTO meta(key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value=excluded.value", [key, value]);
+        db.run("COMMIT");
+        db.run("PRAGMA wal_checkpoint(TRUNCATE)");
+    }
+    catch (error) {
+        try {
+            db.run("ROLLBACK");
+        }
+        catch {
+            // The original database failure is authoritative.
+        }
+        throw error;
+    }
+    finally {
+        db.close();
+    }
+    for (const suffix of ["-wal", "-shm"])
+        fs.rmSync(`${databasePath}${suffix}`, { force: true });
+}
+export async function restoreSharedIndex(options) {
+    const startedAt = Date.now();
+    let candidate;
+    let lease;
+    let promoted = false;
+    let lifecycleLease;
+    try {
+        if (!options.config.enabled)
+            throw new SharedIndexError("configuration", "shared-index restore is disabled");
+        lifecycleLease = acquireRepairLease(options.repo, "shared pull");
+        progress(options.onProgress, "discovery", "Discovering shared snapshots");
+        const selection = await selectSharedSnapshot({
+            repo: options.repo,
+            config: options.config,
+            store: options.store,
+            clientCompatibility: options.clientCompatibility,
+            signal: options.signal,
+        });
+        const selected = selection.selected;
+        if (!selected) {
+            const first = selection.rejected[0];
+            throw new SharedIndexError(first?.category ?? "not-found", first?.reason ?? "no usable shared-index snapshot was found");
+        }
+        progress(options.onProgress, "verification", "Verified signed shared snapshot");
+        const cache = options.cache ?? new SharedIndexCache();
+        progress(options.onProgress, "download", "Resolving immutable shared artifact");
+        lease = await cache.acquire(options.store, selected.manifest, options.signal);
+        progress(options.onProgress, "download", lease.state === "hit" ? "Using verified cache entry" : "Verified shared artifact download", { bytes: selected.manifest.graph.compressedBytes });
+        candidate = await options.engine.createCandidate(options.repo, { empty: true });
+        progress(options.onProgress, "decompression", "Decompressing into candidate graph");
+        await decompressArtifactToCandidate({
+            repo: options.repo,
+            candidate,
+            artifact: lease,
+            manifest: selected.manifest,
+            signal: options.signal,
+        });
+        validateSnapshotDatabase(candidate.databasePath, selected.pointer.commit, selected.pointer.inputFingerprint, selected.manifest.compatibility.databaseSchemaVersion);
+        const overlay = deriveSharedOverlay(options.repo, selected.pointer.commit);
+        const restoredAt = new Date().toISOString();
+        stampCandidate(candidate.databasePath, {
+            sharedIndexRegistrationId: options.config.registrationId,
+            sharedIndexBaseCommit: selected.pointer.commit,
+            sharedIndexManifestDigest: sha256Hex(selected.manifestBytes),
+            sharedIndexInputFingerprint: selected.pointer.inputFingerprint,
+            sharedIndexEffectiveTreeFingerprint: overlay.effectiveTreeFingerprint,
+            sharedIndexOverlay: canonicalManifestBytes(overlay.counts).toString("utf8"),
+            sharedIndexCache: lease.state,
+            sharedIndexRestoredAt: restoredAt,
+        });
+        progress(options.onProgress, "reconciliation", "Reconciling local repository overlay", {
+            completed: 0,
+            total: overlay.changedPaths.length,
+        });
+        await options.engine.reconcileCandidate(candidate, options.repo, overlay.changedPaths, {
+            onProgress: (_phase, completed, message, details) => {
+                const elapsedMs = Math.max(1, Date.now() - startedAt);
+                const total = details?.phaseTotal;
+                const ratePerSecond = completed > 0 ? completed / (elapsedMs / 1000) : undefined;
+                progress(options.onProgress, "reconciliation", message, {
+                    completed,
+                    ...(total !== undefined ? { total } : {}),
+                    ...(ratePerSecond !== undefined ? { ratePerSecond } : {}),
+                    ...(ratePerSecond && total !== undefined && total > completed
+                        ? { etaSeconds: (total - completed) / ratePerSecond }
+                        : {}),
+                    elapsedMs,
+                });
+            },
+        });
+        progress(options.onProgress, "audit", "Deep-auditing reconciled candidate");
+        const audit = await options.engine.auditCandidate(candidate, { mode: "deep" });
+        if (!audit.healthy)
+            throw new SharedIndexError("integrity", `shared-index candidate audit failed (${audit.issues.slice(0, 8).join(",")})`);
+        progress(options.onProgress, "promotion", "Promoting verified candidate graph");
+        const promotion = await options.engine.promoteCandidate(candidate);
+        promoted = true;
+        const provenance = {
+            schemaVersion: 1,
+            enabled: true,
+            state: "restored-and-verified",
+            registrationId: options.config.registrationId,
+            baseCommit: selected.pointer.commit,
+            manifestDigest: sha256Hex(selected.manifestBytes),
+            source: "shared-snapshot",
+            cache: lease.state,
+            overlay: overlay.counts,
+            effectiveTreeFingerprint: overlay.effectiveTreeFingerprint,
+            restoredAt,
+        };
+        try {
+            writeSharedIndexProvenance(options.repo, provenance);
+            writeSharedRestoreAttempt(options.repo, {
+                schemaVersion: 1,
+                attemptedAt: new Date().toISOString(),
+                outcome: "restored",
+            });
+        }
+        catch {
+            // The promoted database contains the same provenance metadata and remains
+            // authoritative if the convenience sidecar cannot be written.
+        }
+        progress(options.onProgress, "completed", "Shared snapshot restored and verified");
+        return { restored: true, provenance, backupPath: promotion.backupPath };
+    }
+    catch (error) {
+        const failure = boundedFailure(error);
+        if (!promoted) {
+            try {
+                writeSharedRestoreAttempt(options.repo, {
+                    schemaVersion: 1,
+                    attemptedAt: new Date().toISOString(),
+                    outcome: "failed",
+                    failureCategory: failure.category,
+                });
+            }
+            catch {
+                // A diagnostic write cannot alter active graph preservation.
+            }
+        }
+        progress(options.onProgress, "failed", failure.reason);
+        return {
+            restored: false,
+            ...failure,
+            activeProvenance: readSharedIndexProvenance(options.repo),
+        };
+    }
+    finally {
+        lease?.release();
+        if (candidate && !promoted) {
+            try {
+                await options.engine.discardCandidate(candidate);
+            }
+            catch {
+                // Candidate cleanup never justifies touching the active graph.
+            }
+        }
+        lifecycleLease?.release();
+    }
+}

package/dist/src/shared-index/s3-client.js

@@ -0,0 +1,124 @@
+import { Readable } from "node:stream";
+import { GetObjectCommand, HeadObjectCommand, S3Client, } from "@aws-sdk/client-s3";
+import { NodeHttpHandler } from "@smithy/node-http-handler";
+import { sharedRepositoryPrefix } from "./contract.js";
+export class SharedIndexError extends Error {
+    category;
+    constructor(category, message) {
+        super(message);
+        this.name = "SharedIndexError";
+        this.category = category;
+    }
+}
+function classified(error) {
+    if (error instanceof SharedIndexError)
+        return error;
+    const record = typeof error === "object" && error !== null ? error : {};
+    const name = typeof record.name === "string" ? record.name : "";
+    const status = Number(record.$metadata?.httpStatusCode);
+    if ([
+        "CredentialsProviderError",
+        "TokenProviderError",
+        "ExpiredToken",
+        "InvalidAccessKeyId",
+        "UnrecognizedClientException",
+    ].includes(name))
+        return new SharedIndexError("authentication", "shared-index AWS authentication failed");
+    if (name === "AccessDenied" || name === "AccessDeniedException" || status === 403)
+        return new SharedIndexError("authorization", "shared-index object access was denied");
+    if (["NoSuchKey", "NotFound", "NoSuchBucket"].includes(name) || status === 404)
+        return new SharedIndexError("not-found", "shared-index object was not found");
+    if (name === "AbortError" || name === "TimeoutError" || name === "RequestTimeout")
+        return new SharedIndexError("timeout", "shared-index object request timed out or was cancelled");
+    return new SharedIndexError("unavailable", "shared-index object service is unavailable");
+}
+function requestSignal(signal, timeoutMs) {
+    const timeout = AbortSignal.timeout(timeoutMs);
+    return signal ? AbortSignal.any([signal, timeout]) : timeout;
+}
+function readableBody(body) {
+    if (body instanceof Readable)
+        return body;
+    if (body && typeof body === "object" && "transformToWebStream" in body) {
+        const stream = body.transformToWebStream();
+        return Readable.fromWeb(stream);
+    }
+    throw new SharedIndexError("unavailable", "shared-index object response had no readable body");
+}
+export class AwsSharedObjectStore {
+    client;
+    bucket;
+    prefix;
+    constructor(config, client) {
+        if (!config.enabled)
+            throw new SharedIndexError("configuration", "shared-index object access is disabled");
+        this.bucket = config.aws.bucket;
+        this.prefix = sharedRepositoryPrefix(config.repository);
+        const clientConfig = {
+            region: config.aws.region,
+            maxAttempts: 3,
+            requestHandler: new NodeHttpHandler({
+                connectionTimeout: 5_000,
+                requestTimeout: 30_000,
+            }),
+        };
+        // Omitting `credentials` intentionally selects the SDK's native Node default
+        // provider chain (environment, shared config/SSO, web identity, ECS, EC2).
+        this.client = client ?? new S3Client(clientConfig);
+    }
+    key(key) {
+        if (!key.startsWith(this.prefix) ||
+            key.length <= this.prefix.length ||
+            key.includes("\\") ||
+            key.split("/").some((segment) => segment === "" || segment === "." || segment === ".."))
+            throw new SharedIndexError("configuration", "shared-index object key escaped its repository prefix");
+        return key;
+    }
+    async head(key, options = {}) {
+        try {
+            const response = await this.client.send(new HeadObjectCommand({ Bucket: this.bucket, Key: this.key(key) }), { abortSignal: requestSignal(options.signal, options.timeoutMs ?? 15_000) });
+            const bytes = Number(response.ContentLength);
+            if (!Number.isSafeInteger(bytes) || bytes < 0)
+                throw new SharedIndexError("integrity", "shared-index object size metadata is invalid");
+            return {
+                bytes,
+                ...(typeof response.ETag === "string" ? { etag: response.ETag } : {}),
+            };
+        }
+        catch (error) {
+            throw classified(error);
+        }
+    }
+    async get(key, limits) {
+        if (!Number.isSafeInteger(limits.maxBytes) || limits.maxBytes <= 0)
+            throw new SharedIndexError("configuration", "shared-index download limit is invalid");
+        try {
+            const response = await this.client.send(new GetObjectCommand({ Bucket: this.bucket, Key: this.key(key) }), { abortSignal: requestSignal(limits.signal, limits.timeoutMs ?? 30_000) });
+            const declared = Number(response.ContentLength);
+            if (Number.isFinite(declared) && declared > limits.maxBytes)
+                throw new SharedIndexError("integrity", "shared-index object exceeds the download limit");
+            const source = readableBody(response.Body);
+            let received = 0;
+            return Readable.from((async function* bounded() {
+                try {
+                    for await (const chunk of source) {
+                        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                        received += bytes.length;
+                        if (received > limits.maxBytes)
+                            throw new SharedIndexError("integrity", "shared-index object exceeded the download limit");
+                        yield bytes;
+                    }
+                }
+                finally {
+                    source.destroy();
+                }
+            })());
+        }
+        catch (error) {
+            throw classified(error);
+        }
+    }
+}
+export function createSharedObjectStore(config, client) {
+    return config.enabled ? new AwsSharedObjectStore(config, client) : null;
+}