run402 4.63.1 → 4.64.0

package/sdk/dist/node/gitvault-publication.js

@@ -38,6 +38,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { LocalError, isRun402Error } from "../errors.js";
 import { fetchGitvaultObjectBytes } from "./gitvault-edge-fetch.js";
+import { openGitvaultDestinationBackend } from "./gitvault-mirror-backend.js";
 import { GITVAULT_FORMAT, GITVAULT_GENESIS_EPOCH, GITVAULT_GENESIS_GENERATION, GITVAULT_HEX16_RE, GITVAULT_OID40_RE, GITVAULT_SUITE, attemptKeyCommitment, bytesToHex, checkFreshEpochKeyAgainstPriorKeys, checkHPartition, computeRotationId, computeTargetPartitionDigest, deriveDigestKey, deriveObjectKey, ekFingerprint, epochRotationKeyCommitment, formatGitvaultTimestamp, fromBase64url, hexToBytes, jcs, keyEnvelopeLedgerId, keyedCommitment, newGitvaultId, newHex32, nextEpoch, objectsetContent, openBindingPreimage, openEpochRotationForRecipient, openFrame, parseGitvaultStrict, parseRotateEpochPayload, pinManifestLedgerId, randomBytes, sealFrame, sealKeyEnvelope, sha256Hex, signGitvaultObject, storedBytes, storedBytesSha256, toBase64url, verifyGitvaultObject, } from "../namespaces/gitvault.crypto.js";
 import { GITVAULT_ZERO_SHA256_SENTINEL } from "../namespaces/gitvault.types.js";
 import { gitvaultCheckpointStaleness } from "../namespaces/gitvault.js";
@@ -961,14 +962,20 @@ export function createGitvaultHttpTransport(client, options = {}) {
             return { path: o.path, object_id: o.object_id, sha256: r.ciphertext_sha256 ?? r.stored_bytes_sha256 ?? "", size_bytes: r.size_bytes };
         });
     }
-    async function upload(repoId, objects, resourceBinding) {
+    async function upload(repoId, objects, resourceBinding, byo) {
         if (objects.length === 0)
             return [];
         // The manifest is closed-key: `path` is client-local and MUST NOT ride the
         // wire — the control plane derives the bucket key itself and refuses an
         // entry carrying an unexpected member.
         const entries = objects.map((o) => gitvaultManifestEntry(o));
-        if (gitvaultInlineUploadEligible(objects)) {
+        // gitvault-byo-primary-bucket task 3.2: the inline (bytes-in-body) fast
+        // path is NEVER used for a BYO vault, even when the payload is small
+        // enough to be eligible — that transport writes bytes into run402's own
+        // bucket, exactly what the credential model forbids (the gateway
+        // refuses it too, VALIDATION_FAILED, so skipping it here is purely a
+        // wasted-round-trip avoidance, not a correctness dependency).
+        if (!byo && gitvaultInlineUploadEligible(objects)) {
             // gitvault-composite-state-read design D2: every object fits under the
             // caps — one POST, bytes verified + written server-side, and the
             // response IS the finalize response (no session, no PUTs, no separate
@@ -987,6 +994,14 @@ export function createGitvaultHttpTransport(client, options = {}) {
             context: "opening gitvault upload session",
         });
         const issued = new Map(session.objects.map((u) => [gitvaultLedgerId(u), u]));
+        // gitvault-byo-primary-bucket task 3.2 — one backend, opened ONCE, for
+        // every BYO payload object this session names; `null` `put` never
+        // appears in the session response unless `byo` was supplied (the
+        // gateway only mints `put: null` for a vault whose storage_profile is
+        // "byo", which is exactly when THIS caller must have supplied `byo`
+        // too — see the resolution in `GitvaultVault.uploadAll`).
+        const byoBackend = byo ? openGitvaultDestinationBackend(byo.destination, byo.credential) : null;
+        const byoAttestations = [];
         // Independent create-only PUTs within one session (design D2) — bounded
         // concurrency, same limit as the batched object reads below.
         await mapBounded(objects, GITVAULT_TRANSPORT_CONCURRENCY, async (o, i) => {
@@ -994,6 +1009,36 @@ export function createGitvaultHttpTransport(client, options = {}) {
             const target = issued.get(id);
             if (!target)
                 fail("GITVAULT_UPLOAD_SESSION_INVALID", `the session issued no upload for ${id}`, "uploading gitvault objects", { object_id: id, path: o.path });
+            if (target.put === null) {
+                // BYO payload object (task 2.2's GITVAULT_BYO_PAYLOAD_KINDS
+                // partition, mirrored client-side by the server's own `put: null` +
+                // `key` shape) — the client writes DIRECTLY to its own bucket. No
+                // request to run402 ever carries a customer-bucket credential; no
+                // request to run402 ever carries these bytes either.
+                if (!byoBackend || !target.key) {
+                    fail("GITVAULT_BYO_BUCKET_WRITE_REFUSED", `the session named ${o.path} as a BYO-written object but no BYO write target was resolved`, "uploading gitvault objects", { path: o.path, object_id: id });
+                }
+                let put;
+                try {
+                    put = await byoBackend.putCreateOnly(target.key, o.bytes);
+                }
+                catch (e) {
+                    fail("GITVAULT_BYO_BUCKET_WRITE_REFUSED", `writing ${o.path} to the BYO destination failed: ${e instanceof Error ? e.message : String(e)}`, "uploading gitvault objects", { path: o.path, key: target.key });
+                }
+                if (!put.created) {
+                    // create-only: the key already exists — legal ONLY if it is
+                    // byte-identical (an idempotent retry of THIS SAME write; a
+                    // permanent object id is never legitimately reused for
+                    // different bytes — matches the managed presigned-PUT read-and-
+                    // compare branch below, and the gateway's own attestation rule).
+                    const existing = await byoBackend.get(target.key);
+                    if (!existing || sha256Hex(existing) !== o.sha256) {
+                        fail("GITVAULT_BYO_BUCKET_WRITE_REFUSED", `${o.path} already exists in the BYO destination with different bytes`, "uploading gitvault objects", { path: o.path, key: target.key });
+                    }
+                }
+                byoAttestations.push({ key: target.key, sha256: o.sha256, size_bytes: o.size_bytes, create_only_result: "created" });
+                return;
+            }
             // `If-None-Match: *` (create-only) and the FULL_OBJECT `x-amz-checksum-sha256`
             // are SIGNED INTO the presigned URL, so they must go out exactly as the
             // server issued them — a dropped or altered header is a signature
@@ -1015,7 +1060,13 @@ export function createGitvaultHttpTransport(client, options = {}) {
             if (!r.ok)
                 fail("GITVAULT_UPLOAD_FAILED", `presigned PUT failed (HTTP ${r.status}) for ${o.path}`, "uploading gitvault objects", { path: o.path, status: r.status });
         });
-        const fin = await client.request(`${base(repoId)}/upload-sessions/${encodeURIComponent(session.upload_session_id)}/finalize`, { method: "POST", body: {}, context: "finalizing gitvault upload session" });
+        const fin = await client.request(`${base(repoId)}/upload-sessions/${encodeURIComponent(session.upload_session_id)}/finalize`, {
+            method: "POST",
+            // Only a BYO session ever carries attestations — an ordinary managed
+            // session's finalize body stays `{}`, byte-identical to today.
+            body: byo ? { attestations: byoAttestations } : {},
+            context: "finalizing gitvault upload session",
+        });
         return receiptsFromFinalize(objects, entries, fin);
     }
     async function admit(repoId, generation, bytes, hash, extra = {}) {
@@ -1046,7 +1097,7 @@ export function createGitvaultHttpTransport(client, options = {}) {
             return res.allocation ?? res;
         },
         async putObject(request) {
-            const [r] = await upload(request.repo_id, [{ path: request.path, object_kind: "key_envelope", object_id: null, bytes: request.bytes, sha256: request.expected_sha256, size_bytes: request.expected_size_bytes }]);
+            const [r] = await upload(request.repo_id, [{ path: request.path, object_kind: "key_envelope", object_id: null, bytes: request.bytes, sha256: request.expected_sha256, size_bytes: request.expected_size_bytes }], undefined, request.byo);
             return { stored_bytes_sha256: r.sha256, size_bytes: r.size_bytes };
         },
         getObject: ({ repo_id, path }) => getObjectBytes(repo_id, path),
@@ -1075,7 +1126,7 @@ export function createGitvaultHttpTransport(client, options = {}) {
                 qs.set("cursor", request.cursor);
             return client.request(`${base(request.repo_id)}/heads?${qs.toString()}`, { context: "listing gitvault heads" });
         },
-        uploadObjects: ({ repo_id, objects, resource_binding }) => upload(repo_id, objects, resource_binding),
+        uploadObjects: ({ repo_id, objects, resource_binding, byo }) => upload(repo_id, objects, resource_binding, byo),
         admitHead: (r) => admit(r.repo_id, r.generation, r.stored_bytes, r.stored_bytes_sha256),
         // Both routes SHIPPED (`routes/gitvault-admission.ts`). `retention-cutoffs`
         // answers `{ticket, receipt, next_actions}`, which IS
@@ -1413,6 +1464,16 @@ export class GitvaultVault {
     retries;
     servicePublicKey;
     genesisCache = null;
+    /**
+     * gitvault-byo-primary-bucket task 3.2 — this vault's resolved BYO write
+     * target, cached after the first resolution (storage_profile/
+     * byo_destination are immutable-at-allocation in v1, so a single
+     * read-once-per-instance is safe). `undefined` = not yet resolved;
+     * `null` = this machine has no LOCAL BYO write config for this repo
+     * (either an ordinary managed vault, or a BYO vault this machine has not
+     * been configured to write — see {@link resolveByoWriteTarget}).
+     */
+    byoResolution = undefined;
     constructor(options) {
         this.keystore = options.keystore;
         this.transport = options.transport;
@@ -2379,12 +2440,14 @@ export class GitvaultVault {
                 created_at: formatGitvaultTimestamp(this.now()),
             });
             try {
+                const byo = await this.resolveByoWriteTarget();
                 await this.transport.putObject({
                     repo_id: this.repoId,
                     path: gitvaultPaths.envelope(epoch, sealed.receipt.recipient_fingerprint),
                     bytes: sealed.stored_bytes,
                     expected_sha256: sealed.stored_bytes_sha256,
                     expected_size_bytes: sealed.size_bytes,
+                    ...(byo ? { byo } : {}),
                 });
                 wrapped.push({ principal_id: entry.principal_id, ek_fingerprint: entry.ek_fingerprint });
             }
@@ -2751,8 +2814,27 @@ export class GitvaultVault {
         return out;
     }
     // ── upload with receipt-compare ──
+    /**
+     * gitvault-byo-primary-bucket task 3.2 — resolve (once, cached) this
+     * machine's local BYO write config for THIS vault. `null` when none is
+     * configured locally — either because this is an ordinary managed vault
+     * (the common case; deliberately never confirmed with a network call, so
+     * a managed vault's push pays zero extra round trips), or because this
+     * machine has not been configured to write a BYO vault it nonetheless
+     * belongs to (surfaced downstream as `GITVAULT_BYO_BUCKET_WRITE_REFUSED`
+     * when the session actually names a `put: null` object with no target).
+     */
+    async resolveByoWriteTarget() {
+        if (this.byoResolution !== undefined)
+            return this.byoResolution;
+        const { readByoConfig } = await import("./gitvault-byo-config.js");
+        const local = readByoConfig(this.keystore, this.repoId);
+        this.byoResolution = local ? { destination: local.destination, ...(local.credential ? { credential: local.credential } : {}) } : null;
+        return this.byoResolution;
+    }
     async uploadAll(objects) {
-        const receipts = await this.transport.uploadObjects({ repo_id: this.repoId, objects });
+        const byo = await this.resolveByoWriteTarget();
+        const receipts = await this.transport.uploadObjects({ repo_id: this.repoId, objects, ...(byo ? { byo } : {}) });
         if (receipts.length !== objects.length)
             fail("GITVAULT_RECEIPT_MISMATCH", `${receipts.length} receipts for ${objects.length} objects`, "comparing finalization receipts");
         const mismatches = objects.filter((o, i) => receipts[i].path !== o.path || receipts[i].sha256 !== o.sha256 || receipts[i].size_bytes !== o.size_bytes);