swarm-deploy 0.0.0 → 0.2.0

package/dist/server.js

@@ -0,0 +1,928 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FINGERPRINT_LENGTH = exports.MAX_ACTIVE_UPLOADS = exports.MAX_CONNECTIONS = exports.DEFAULT_MIN_FREE_BYTES = exports.DEFAULT_MAX_ACTIVE_UPLOADS = exports.DEFAULT_MAX_CONNECTIONS = exports.Server = exports.MAX_OWED_POST_COMMIT_RETENTION = void 0;
+exports.fingerprint = fingerprint;
+const b4a_1 = __importDefault(require("b4a"));
+const _events_1 = __importDefault(require("#events"));
+const _fs_1 = __importDefault(require("#fs"));
+const _path_1 = __importDefault(require("#path"));
+const sodium_native_1 = __importDefault(require("sodium-native"));
+const abort_js_1 = require("./abort.js");
+const direct_dht_js_1 = require("./direct-dht.js");
+const errors_js_1 = require("./errors.js");
+const files_js_1 = require("./files.js");
+const hooks_js_1 = require("./hooks.js");
+const identity_js_1 = require("./identity.js");
+const release_js_1 = require("./release.js");
+const commit_store_js_1 = require("./storage/commit-store.js");
+const link_store_js_1 = require("./storage/link-store.js");
+const layout_js_1 = require("./storage/layout.js");
+const root_coordinator_js_1 = require("./storage/root-coordinator.js");
+const recovery_js_1 = require("./storage/recovery.js");
+const retention_js_1 = require("./storage/retention.js");
+const session_store_js_1 = require("./storage/session-store.js");
+const tree_fs_js_1 = require("./storage/tree-fs.js");
+const controls_js_1 = require("./tar-protocol/controls.js");
+const direct_wire_js_1 = require("./tar-protocol/direct-wire.js");
+const hash_js_1 = require("./tar-protocol/hash.js");
+const manifest_js_1 = require("./tar-protocol/manifest.js");
+const tree_manifest_js_1 = require("./tar-protocol/tree-manifest.js");
+const symlinks_js_1 = require("./symlinks.js");
+const EventEmitter = _events_1.default.EventEmitter;
+const DEFAULT_MAX_CONNECTIONS = 64;
+exports.DEFAULT_MAX_CONNECTIONS = DEFAULT_MAX_CONNECTIONS;
+const DEFAULT_MAX_ACTIVE_UPLOADS = 8;
+exports.DEFAULT_MAX_ACTIVE_UPLOADS = DEFAULT_MAX_ACTIVE_UPLOADS;
+const DEFAULT_MIN_FREE_BYTES = 1024 * 1024 * 1024;
+exports.DEFAULT_MIN_FREE_BYTES = DEFAULT_MIN_FREE_BYTES;
+const MAX_CONNECTIONS = 1024;
+exports.MAX_CONNECTIONS = MAX_CONNECTIONS;
+const MAX_ACTIVE_UPLOADS = 1024;
+exports.MAX_ACTIVE_UPLOADS = MAX_ACTIVE_UPLOADS;
+const FINGERPRINT_LENGTH = 12;
+exports.FINGERPRINT_LENGTH = FINGERPRINT_LENGTH;
+const TAR_DURABILITY_BATCH_BYTES = 1024 * 1024;
+/**
+ * How many transfers may owe a deferred post-commit retention pass at once.
+ *
+ * The set grows only when an `afterCommit` hook fails after a durable commit,
+ * and entries are removed as soon as a retry succeeds, so reaching the bound
+ * means a persistently failing hook. Capping it at the connection ceiling
+ * keeps a broken deployment step from growing server memory without limit.
+ */
+exports.MAX_OWED_POST_COMMIT_RETENTION = MAX_CONNECTIONS;
+function fail(code, message, cause = null) {
+    return new errors_js_1.SwarmDeployError(code, message, cause);
+}
+function codeOf(error) {
+    return error instanceof errors_js_1.SwarmDeployError &&
+        Object.values(errors_js_1.ERRORS).includes(error.code)
+        ? error.code
+        : errors_js_1.ERRORS.PROTOCOL_INVALID;
+}
+function positive(value, name, max = Number.MAX_SAFE_INTEGER) {
+    if (!Number.isSafeInteger(value) || value <= 0 || value > max) {
+        throw fail(errors_js_1.ERRORS.PROTOCOL_INVALID, `Invalid ${name}`);
+    }
+    return value;
+}
+function key(value, label) {
+    if (typeof value === 'string') {
+        if (!/^[0-9a-f]{64}$/.test(value))
+            throw fail(errors_js_1.ERRORS.INVALID_PUBLIC_KEY, `Invalid ${label}`);
+        return b4a_1.default.from(value, 'hex');
+    }
+    if (!b4a_1.default.isBuffer(value) || value.byteLength !== 32) {
+        throw fail(errors_js_1.ERRORS.INVALID_PUBLIC_KEY, `Invalid ${label}`);
+    }
+    return b4a_1.default.from(value);
+}
+function fingerprint(value) {
+    return b4a_1.default.toString((0, hash_js_1.sodiumSha256)(value), 'hex').slice(0, FINGERPRINT_LENGTH);
+}
+function safeLogger(logger) {
+    const call = (method, message, details) => {
+        try {
+            logger?.[method]?.(message, details);
+        }
+        catch { }
+    };
+    return {
+        info: (m, d) => call('info', m, d),
+        warn: (m, d) => call('warn', m, d),
+        error: (m, d) => call('error', m, d)
+    };
+}
+class Server extends EventEmitter {
+    publicKey;
+    storageDir;
+    maxFileBytes;
+    maxStagingBytes;
+    maxConnections;
+    maxActiveUploads;
+    idleTimeout;
+    cleanupInterval;
+    resumeTtl;
+    minFreeBytes;
+    maxAge;
+    maxStorageBytes;
+    artifactPatterns;
+    maxCount;
+    maxVersions;
+    versionGranularity;
+    releaseMatcher;
+    allowedKeySnapshot;
+    logger;
+    dht;
+    dhtFactory;
+    storage;
+    scheduler;
+    replaceNames;
+    hooks;
+    symlinks;
+    linkNames;
+    links = null;
+    listening = false;
+    closed = false;
+    keyPair;
+    signal;
+    abort = (0, abort_js_1.createAbortController)();
+    active = new Map();
+    activeUploads = new Set();
+    /**
+     * Transfer IDs this process committed but whose deferred post-commit
+     * retention is still owed because `afterCommit` has not yet succeeded. Only
+     * these may start a retention pass from an already-committed retry, so an
+     * ordinary duplicate offer cannot be used to force repeated full passes.
+     * The set is in-memory only and bounded by `MAX_OWED_POST_COMMIT_RETENTION`;
+     * a restart or an eviction loses an entry, and the documented fallback is the
+     * next startup, scheduled, or commit-triggered pass.
+     */
+    pendingAfterCommit = new Set();
+    /**
+     * Authenticated transfer IDs a connection currently owns. One connection
+     * holds at most one entry and releases it in a `finally`, so the set is
+     * bounded by `maxConnections`. A second connection offering the same
+     * transfer is rejected with `FILE_BUSY` rather than running the lifecycle
+     * and its hooks concurrently against one staging and commit identity.
+     */
+    activeTransfers = new Set();
+    receives = new Set();
+    layout = null;
+    sessions = null;
+    commits = null;
+    retention = null;
+    transport = null;
+    releaseLock = null;
+    listenPromise = null;
+    closePromise = null;
+    constructor(options) {
+        super();
+        if (!options || typeof options !== 'object') {
+            throw fail(errors_js_1.ERRORS.PROTOCOL_INVALID, 'Invalid server options');
+        }
+        this.keyPair = (0, identity_js_1.keyPairFromSeed)(options.seed);
+        this.publicKey = b4a_1.default.from(this.keyPair.publicKey);
+        this.storageDir =
+            typeof options.storageDir === 'string' && options.storageDir
+                ? options.storageDir
+                : (() => {
+                    throw fail(errors_js_1.ERRORS.PROTOCOL_INVALID, 'Invalid storage directory');
+                })();
+        this.maxFileBytes = positive(options.maxFileBytes, 'maxFileBytes');
+        this.maxStagingBytes = positive(options.maxStagingBytes, 'maxStagingBytes');
+        this.maxConnections = positive(options.maxConnections ?? DEFAULT_MAX_CONNECTIONS, 'maxConnections', MAX_CONNECTIONS);
+        this.maxActiveUploads = positive(options.maxActiveUploads ?? DEFAULT_MAX_ACTIVE_UPLOADS, 'maxActiveUploads', MAX_ACTIVE_UPLOADS);
+        if (this.maxActiveUploads > this.maxConnections) {
+            throw fail(errors_js_1.ERRORS.PROTOCOL_INVALID, 'maxActiveUploads exceeds maxConnections');
+        }
+        this.idleTimeout = positive(options.idleTimeout ?? 60_000, 'idleTimeout', 0x7fffffff);
+        this.cleanupInterval = positive(options.cleanupInterval ?? retention_js_1.DEFAULT_CLEANUP_INTERVAL, 'cleanupInterval', 0x7fffffff);
+        this.resumeTtl = positive(options.resumeTtl ?? retention_js_1.DEFAULT_RESUME_TTL, 'resumeTtl');
+        this.minFreeBytes = options.minFreeBytes ?? DEFAULT_MIN_FREE_BYTES;
+        if (!Number.isSafeInteger(this.minFreeBytes) || this.minFreeBytes < 0) {
+            throw fail(errors_js_1.ERRORS.PROTOCOL_INVALID, 'Invalid minFreeBytes');
+        }
+        if (options.maxAge !== undefined) {
+            positive(options.maxAge, 'maxAge');
+        }
+        if (options.maxStorageBytes !== undefined) {
+            positive(options.maxStorageBytes, 'maxStorageBytes');
+        }
+        this.maxAge = options.maxAge;
+        this.maxStorageBytes = options.maxStorageBytes;
+        const patterns = options.artifactPatterns ?? [];
+        if (typeof patterns[Symbol.iterator] !== 'function') {
+            throw fail(errors_js_1.ERRORS.PROTOCOL_INVALID, 'Invalid artifact patterns');
+        }
+        try {
+            this.artifactPatterns = Object.freeze([...patterns]);
+            this.releaseMatcher = new release_js_1.ReleaseMatcher(this.artifactPatterns);
+        }
+        catch (error) {
+            throw fail(errors_js_1.ERRORS.PROTOCOL_INVALID, 'Invalid artifact patterns', error);
+        }
+        if (options.maxCount !== undefined) {
+            positive(options.maxCount, 'maxCount');
+            if (this.releaseMatcher.size === 0) {
+                throw fail(errors_js_1.ERRORS.PROTOCOL_INVALID, 'maxCount requires artifact patterns');
+            }
+        }
+        if (options.maxVersions !== undefined) {
+            positive(options.maxVersions, 'maxVersions');
+            if (!this.releaseMatcher.hasVersionPattern) {
+                throw fail(errors_js_1.ERRORS.PROTOCOL_INVALID, 'maxVersions requires a {version} artifact pattern');
+            }
+            if (options.versionGranularity !== 'major' && options.versionGranularity !== 'minor') {
+                throw fail(errors_js_1.ERRORS.PROTOCOL_INVALID, 'Invalid versionGranularity');
+            }
+        }
+        else if (options.versionGranularity !== undefined) {
+            throw fail(errors_js_1.ERRORS.PROTOCOL_INVALID, 'versionGranularity requires maxVersions');
+        }
+        this.maxCount = options.maxCount;
+        this.maxVersions = options.maxVersions;
+        this.versionGranularity = options.versionGranularity;
+        const allow = [];
+        if (!options.allowedKeys ||
+            typeof options.allowedKeys[Symbol.iterator] !== 'function') {
+            throw fail(errors_js_1.ERRORS.PROTOCOL_INVALID, 'Invalid allowed keys');
+        }
+        for (const candidate of options.allowedKeys) {
+            const candidateKey = key(candidate, 'allowed key');
+            if (allow.some((allowed) => sodium_native_1.default.sodium_memcmp(allowed, candidateKey))) {
+                throw fail(errors_js_1.ERRORS.PROTOCOL_INVALID, 'Duplicate allowed key');
+            }
+            allow.push(candidateKey);
+        }
+        this.allowedKeySnapshot = allow.map((candidate) => b4a_1.default.from(candidate));
+        this.dht = options.dht;
+        this.dhtFactory = options.dhtFactory;
+        this.storage = options.storage || _fs_1.default.promises;
+        this.scheduler = options.scheduler || { setTimeout, clearTimeout, setInterval, clearInterval };
+        this.replaceNames = (0, files_js_1.validateReplaceNames)(options.replaceNames);
+        this.hooks = (0, hooks_js_1.snapshotHooks)(options.hooks);
+        this.symlinks = (0, symlinks_js_1.compileSymlinkRules)(options.symlinks);
+        this.linkNames = (0, symlinks_js_1.symlinkRuleNames)(this.symlinks);
+        if (this.symlinks.length > 0)
+            (0, tree_fs_js_1.assertSymlinkCapable)(this.storage);
+        this.logger = safeLogger(options.logger);
+        this.signal = this.abort.signal;
+    }
+    artifactKind(metadata) {
+        return (0, controls_js_1.isTreeMetadata)(metadata) ? 'directory' : 'file';
+    }
+    payloadBytes(metadata) {
+        return (0, controls_js_1.isTreeMetadata)(metadata) ? metadata.payloadBytes : metadata.fileSize;
+    }
+    payloadDigest(metadata) {
+        return (0, controls_js_1.isTreeMetadata)(metadata) ? metadata.treeSha256 : metadata.fileSha256;
+    }
+    emitSafe(type, payload) {
+        try {
+            this.emit(type, payload);
+        }
+        catch { }
+    }
+    allowed(owner) {
+        if (!owner || !b4a_1.default.isBuffer(owner) || owner.byteLength !== 32)
+            return false;
+        let accepted = false;
+        for (const allowed of this.allowedKeySnapshot) {
+            accepted = sodium_native_1.default.sodium_memcmp(owner, allowed) || accepted;
+        }
+        return accepted;
+    }
+    transfer(metadata) {
+        return {
+            transfer: fingerprint(b4a_1.default.from(metadata.transferId, 'hex')),
+            name: metadata.name,
+            kind: this.artifactKind(metadata),
+            size: this.payloadBytes(metadata)
+        };
+    }
+    async rejectOffer(socket, event, owner, reason) {
+        await (0, direct_wire_js_1.writeAdmission)(socket, { v: 1, status: 'REJECTED', code: reason }, { signal: this.signal, timeout: this.idleTimeout });
+        this.emitSafe('offer', {
+            ...event,
+            fingerprint: fingerprint(owner),
+            status: 'rejected',
+            reason
+        });
+    }
+    hookArtifact(metadata, release) {
+        return Object.freeze({
+            name: metadata.name,
+            kind: this.artifactKind(metadata),
+            size: this.payloadBytes(metadata),
+            sha256: this.payloadDigest(metadata),
+            transferId: metadata.transferId,
+            ...((0, controls_js_1.isTreeMetadata)(metadata) ? { entryCount: metadata.entryCount } : {}),
+            ...(metadata.sourceParent === undefined ? {} : { sourceParent: metadata.sourceParent }),
+            ...(release === null
+                ? {}
+                : {
+                    release: Object.freeze({
+                        series: release.series,
+                        ...(release.version === undefined ? {} : { version: release.version })
+                    })
+                })
+        });
+    }
+    /**
+     * Computes and converges the desired links from durable commit records.
+     * Called with the root lease already held.
+     */
+    async reconcileLinksUnlocked(records) {
+        if (this.symlinks.length === 0 || !this.links)
+            return new Set();
+        const desired = (0, symlinks_js_1.selectDesiredLinks)(this.symlinks, records);
+        await this.links.reconcile(desired, this.linkNames, {
+            managedArtifactNames: new Set(records.map((record) => record.name))
+        });
+        return new Set(desired.map((link) => link.transferId));
+    }
+    /** Pins link targets when reconciliation fails but retention must continue. */
+    async linkPinsFallbackUnlocked(records) {
+        const pins = new Set((0, symlinks_js_1.selectDesiredLinks)(this.symlinks, records).map((link) => link.transferId));
+        if (!this.links)
+            return pins;
+        for (const ledger of await this.links.list()) {
+            pins.add(ledger.transferId);
+            const target = records.find((record) => record.name === ledger.target);
+            if (target)
+                pins.add(target.transferId);
+        }
+        return pins;
+    }
+    /** Reconciles after a durable commit; this is the only caller that leases the root. */
+    async reconcileAfterCommit() {
+        if (this.symlinks.length === 0 || !this.links || !this.commits)
+            return;
+        try {
+            await (0, root_coordinator_js_1.withRootLease)(this.layout.root, async () => this.reconcileLinksUnlocked(await this.commits.list()));
+        }
+        catch (error) {
+            if (error instanceof errors_js_1.SwarmDeployError && error.code === errors_js_1.ERRORS.LINK_CONFLICT)
+                throw error;
+            throw new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.LINK_FAILED, 'Unable to reconcile managed symlinks', error);
+        }
+    }
+    /** Runs a gating callback; only callback exceptions become HOOK_FAILED. */
+    async runHook(phase, hook, context) {
+        if (hook === undefined)
+            return;
+        (0, abort_js_1.throwIfAborted)(this.signal);
+        let outcome;
+        try {
+            outcome = await (0, hooks_js_1.invokeHook)(hook, context, this.signal);
+        }
+        catch (cause) {
+            throw (0, hooks_js_1.hookError)(phase, cause);
+        }
+        if (outcome === 'aborted')
+            throw (0, abort_js_1.abortError)();
+    }
+    /** Runs onFailure once; its own failure is logged and never replaces the original. */
+    async runFailureHook(context, owner, transfer) {
+        const hook = this.hooks.onFailure;
+        if (hook === undefined)
+            return;
+        try {
+            await (0, hooks_js_1.invokeHook)(hook, context, this.signal);
+        }
+        catch {
+            this.logger.warn('Failure hook failed', {
+                fingerprint: owner ? fingerprint(owner) : 'invalid',
+                transfer,
+                phase: context.phase,
+                reason: errors_js_1.ERRORS.HOOK_FAILED
+            });
+        }
+    }
+    async receive(socket) {
+        const owner = socket.remotePublicKey;
+        if (this.closed || !this.allowed(owner) || !this.sessions || !this.commits) {
+            try {
+                socket.destroy(fail(errors_js_1.ERRORS.AUTH_REJECTED, 'Unauthorised direct connection'));
+            }
+            catch { }
+            return;
+        }
+        if (this.active.size >= this.maxConnections) {
+            try {
+                socket.destroy(fail(errors_js_1.ERRORS.FILE_BUSY, 'Connection capacity exceeded'));
+            }
+            catch { }
+            return;
+        }
+        const current = { owner: b4a_1.default.from(owner), transfer: null };
+        this.active.set(socket, current);
+        socket.on('error', () => { });
+        socket.once('close', () => {
+            this.active.delete(socket);
+            this.emitSafe('connection-close', {
+                fingerprint: fingerprint(owner),
+                connections: this.active.size
+            });
+        });
+        this.emitSafe('authentication', { status: 'accepted', fingerprint: fingerprint(owner) });
+        this.emitSafe('connection', { fingerprint: fingerprint(owner), connections: this.active.size });
+        this.emitSafe('connection-open', {
+            fingerprint: fingerprint(owner),
+            connections: this.active.size
+        });
+        const reader = new direct_wire_js_1.DirectWireReader(socket);
+        let sentAdmission = false;
+        let event = null;
+        let verificationStarted = false;
+        let verificationSucceeded = false;
+        let commitStarted = false;
+        let commitSucceeded = false;
+        let artifact = null;
+        let phase = 'offer';
+        let hookPath = null;
+        let resumed = false;
+        let alreadyCommitted = false;
+        let hooksFinished = false;
+        let finalStarted = false;
+        let failureReported = false;
+        let guardedTransfer = null;
+        /**
+         * Hands the transfer back before this connection's last await. Clearing
+         * `guardedTransfer` makes the `finally` a no-op, so a late release can
+         * never take ownership away from the connection that acquired it next.
+         */
+        const releaseTransfer = () => {
+            if (guardedTransfer === null)
+                return;
+            this.activeTransfers.delete(guardedTransfer);
+            guardedTransfer = null;
+        };
+        // Runs onFailure at most once per connection, after the client was answered.
+        const reportFailure = async (error) => {
+            if (failureReported || !event || !artifact)
+                return;
+            failureReported = true;
+            // The guard serializes the commit lifecycle, and this connection has
+            // finished its own. `onFailure` only observes, so holding the transfer
+            // across a slow callback would reject the client's legitimate retry.
+            releaseTransfer();
+            await this.runFailureHook(Object.freeze({ artifact, path: hookPath, phase, resumed, alreadyCommitted, error }), owner, event.transfer);
+        };
+        const rejectEarly = async (reason, message) => {
+            await this.rejectOffer(socket, event, owner, reason);
+            sentAdmission = true;
+            await reportFailure(fail(reason, message));
+        };
+        try {
+            const metadata = await reader.control(controls_js_1.decodeAnyMetadataRecord, this.signal, this.idleTimeout);
+            // The decoded record is shape-validated but not yet authenticated; the
+            // artifact context carries only its non-secret descriptive fields.
+            event = this.transfer(metadata);
+            artifact = this.hookArtifact(metadata, null);
+            if ((0, controls_js_1.isTreeMetadata)(metadata))
+                (0, tree_manifest_js_1.assertTreeMetadataTransferId)(owner, metadata);
+            else
+                (0, manifest_js_1.assertMetadataTransferId)(owner, metadata);
+            // The transfer ID is authenticated from here on, so it is safe to key
+            // the single-owner guard on it.
+            if (this.activeTransfers.has(metadata.transferId)) {
+                await rejectEarly(errors_js_1.ERRORS.FILE_BUSY, 'Transfer is already in progress');
+                return;
+            }
+            this.activeTransfers.add(metadata.transferId);
+            guardedTransfer = metadata.transferId;
+            let release = null;
+            if (this.releaseMatcher.size > 0) {
+                release = this.releaseMatcher.match(metadata.name, metadata.sourceParent);
+                if (release === null) {
+                    await rejectEarly(errors_js_1.ERRORS.INVALID_FILENAME, 'Artifact name does not match a configured pattern');
+                    return;
+                }
+                artifact = this.hookArtifact(metadata, release);
+            }
+            if (this.linkNames.has(metadata.name)) {
+                await rejectEarly(errors_js_1.ERRORS.INVALID_FILENAME, 'Artifact name is a configured symlink name');
+                return;
+            }
+            const hookArtifact = artifact;
+            const stagingHookPath = (0, controls_js_1.isTreeMetadata)(metadata)
+                ? _path_1.default.join(this.layout.staging, `${metadata.transferId}.tree`)
+                : _path_1.default.join(this.layout.staging, `${metadata.transferId}.part`);
+            const finish = async (verified) => {
+                phase = 'beforeCommit';
+                hookPath = stagingHookPath;
+                await this.runHook('beforeCommit', this.hooks.beforeCommit, Object.freeze({
+                    artifact: hookArtifact,
+                    path: hookPath,
+                    resumed,
+                    alreadyCommitted: false
+                }));
+                phase = 'commit';
+                commitStarted = true;
+                await this.commits.commit(verified, {
+                    retentionManager: this.retention,
+                    signal: this.signal,
+                    replaceNames: this.replaceNames,
+                    release,
+                    deferPostCommitRetention: this.hooks.afterCommit !== undefined
+                });
+                this.emitSafe('commit', {
+                    ...event,
+                    fingerprint: fingerprint(owner),
+                    status: 'succeeded'
+                });
+                commitSucceeded = true;
+                hookPath = _path_1.default.join(this.layout.root, metadata.name);
+                await this.retireQuietly(verified.transferId, owner);
+                await this.reconcileAfterCommit();
+                phase = 'afterCommit';
+                if (this.hooks.afterCommit !== undefined) {
+                    this.owePostCommitRetention(metadata.transferId);
+                }
+                await this.runHook('afterCommit', this.hooks.afterCommit, Object.freeze({
+                    artifact: hookArtifact,
+                    path: hookPath,
+                    resumed,
+                    alreadyCommitted: false
+                }));
+                hooksFinished = true;
+                await this.settleDeferredRetention(metadata.transferId, owner);
+                finalStarted = true;
+                await (0, direct_wire_js_1.writeFinal)(socket, { v: 1, status: 'COMMITTED' }, { signal: this.signal, timeout: this.idleTimeout });
+            };
+            const payloadBytes = this.payloadBytes(metadata);
+            if (payloadBytes > this.maxFileBytes || this.activeUploads.size >= this.maxActiveUploads) {
+                if (payloadBytes > this.maxFileBytes) {
+                    await rejectEarly(errors_js_1.ERRORS.FILE_TOO_LARGE, 'File exceeds the maximum size');
+                }
+                else {
+                    await rejectEarly(errors_js_1.ERRORS.ACTIVE_UPLOAD_LIMIT, 'Active upload capacity exceeded');
+                }
+                return;
+            }
+            const inspected = await this.commits.inspect(metadata.name, {
+                name: metadata.name,
+                kind: this.artifactKind(metadata),
+                size: payloadBytes,
+                digest: b4a_1.default.from(this.payloadDigest(metadata), 'hex'),
+                ...((0, controls_js_1.isTreeMetadata)(metadata) ? { entryCount: metadata.entryCount } : {}),
+                transferId: b4a_1.default.from(metadata.transferId, 'hex'),
+                release
+            }, { replaceNames: this.replaceNames });
+            if (inspected.status === 'ALREADY_COMMITTED') {
+                alreadyCommitted = true;
+                hookPath = _path_1.default.join(this.layout.root, metadata.name);
+                await this.reconcileAfterCommit();
+                phase = 'afterCommit';
+                await this.runHook('afterCommit', this.hooks.afterCommit, Object.freeze({
+                    artifact: hookArtifact,
+                    path: hookPath,
+                    resumed: false,
+                    alreadyCommitted: true
+                }));
+                hooksFinished = true;
+                // Only a transfer this process committed can still owe a deferred
+                // pass; an ordinary duplicate offer never starts one.
+                if (this.pendingAfterCommit.has(metadata.transferId)) {
+                    await this.settleDeferredRetention(metadata.transferId, owner);
+                }
+                await (0, direct_wire_js_1.writeAdmission)(socket, { v: 1, status: 'ALREADY_COMMITTED' }, { signal: this.signal, timeout: this.idleTimeout });
+                sentAdmission = true;
+                this.emitSafe('offer', {
+                    ...event,
+                    fingerprint: fingerprint(owner),
+                    status: 'already-committed'
+                });
+                return;
+            }
+            if (inspected.status === 'FILE_EXISTS') {
+                await rejectEarly(errors_js_1.ERRORS.FILE_EXISTS, 'Destination already exists');
+                return;
+            }
+            if (this.activeUploads.size >= this.maxActiveUploads) {
+                await rejectEarly(errors_js_1.ERRORS.ACTIVE_UPLOAD_LIMIT, 'Active upload capacity exceeded');
+                return;
+            }
+            this.activeUploads.add(socket);
+            const admission = await this.sessions.admit(owner, metadata);
+            current.transfer = metadata.transferId;
+            resumed = admission.status !== 'ACCEPT';
+            if (admission.status === 'VERIFIED') {
+                await (0, direct_wire_js_1.writeAdmission)(socket, { v: 1, status: 'VERIFIED' }, { signal: this.signal, timeout: this.idleTimeout });
+                sentAdmission = true;
+                phase = 'verification';
+                hookPath = stagingHookPath;
+                this.emitSafe('verification', {
+                    ...event,
+                    fingerprint: fingerprint(owner),
+                    status: 'started'
+                });
+                verificationStarted = true;
+                const verified = await this.sessions.readVerified(b4a_1.default.from(metadata.transferId, 'hex'));
+                this.emitSafe('verification', {
+                    ...event,
+                    fingerprint: fingerprint(owner),
+                    status: 'succeeded'
+                });
+                verificationSucceeded = true;
+                await finish(verified);
+                return;
+            }
+            await (0, direct_wire_js_1.writeAdmission)(socket, admission.status === 'ACCEPT'
+                ? { v: 1, status: 'ACCEPT', offset: 0 }
+                : {
+                    v: 1,
+                    status: 'RESUME',
+                    offset: admission.offset,
+                    prefixSha256: b4a_1.default.toString(admission.prefixSha256, 'hex')
+                }, { signal: this.signal, timeout: this.idleTimeout });
+            sentAdmission = true;
+            phase = 'transfer';
+            hookPath = _path_1.default.join(this.layout.staging, `${metadata.transferId}.tar.part`);
+            this.emitSafe('offer', {
+                ...event,
+                fingerprint: fingerprint(owner),
+                status: metadata.reset ? 'reset' : admission.status === 'ACCEPT' ? 'accepted' : 'resumed',
+                offset: admission.offset
+            });
+            let offset = admission.offset;
+            const batch = b4a_1.default.allocUnsafe(TAR_DURABILITY_BATCH_BYTES);
+            let bufferedBytes = 0;
+            const append = async (chunk) => {
+                offset = await this.sessions.append(owner, metadata, offset, chunk);
+                this.emitSafe('progress', {
+                    ...event,
+                    fingerprint: fingerprint(owner),
+                    bytesReceived: offset,
+                    totalBytes: metadata.tarSize
+                });
+            };
+            const flush = async () => {
+                if (bufferedBytes === 0)
+                    return;
+                const bytes = batch.subarray(0, bufferedBytes);
+                await append(bytes);
+                bufferedBytes = 0;
+            };
+            await reader.tar(metadata.tarSize - offset, async (chunk) => {
+                let position = 0;
+                while (position < chunk.byteLength) {
+                    const take = Math.min(TAR_DURABILITY_BATCH_BYTES - bufferedBytes, chunk.byteLength - position);
+                    batch.set(chunk.subarray(position, position + take), bufferedBytes);
+                    bufferedBytes += take;
+                    position += take;
+                    if (bufferedBytes === TAR_DURABILITY_BATCH_BYTES)
+                        await flush();
+                }
+            }, this.signal, this.idleTimeout);
+            await flush();
+            await reader.requireEnd(this.signal, this.idleTimeout);
+            phase = 'verification';
+            this.emitSafe('verification', {
+                ...event,
+                fingerprint: fingerprint(owner),
+                status: 'started'
+            });
+            verificationStarted = true;
+            const verified = await this.sessions.verify(owner, metadata);
+            this.emitSafe('verification', {
+                ...event,
+                fingerprint: fingerprint(owner),
+                status: 'succeeded'
+            });
+            verificationSucceeded = true;
+            await finish(verified);
+        }
+        catch (error) {
+            const reason = codeOf(error);
+            this.logger.warn('Direct upload failed', {
+                fingerprint: owner ? fingerprint(owner) : 'invalid',
+                reason
+            });
+            this.emitSafe('failure', { fingerprint: owner ? fingerprint(owner) : 'invalid', reason });
+            if (event && verificationStarted && !verificationSucceeded) {
+                this.emitSafe('verification', {
+                    ...event,
+                    fingerprint: fingerprint(owner),
+                    status: 'failed',
+                    reason
+                });
+            }
+            if (event && commitStarted && !commitSucceeded) {
+                this.emitSafe('commit', {
+                    ...event,
+                    fingerprint: fingerprint(owner),
+                    status: 'failed',
+                    reason
+                });
+            }
+            try {
+                if (!sentAdmission) {
+                    await (0, direct_wire_js_1.writeAdmission)(socket, { v: 1, status: 'REJECTED', code: reason }, { timeout: this.idleTimeout });
+                }
+                else if (!finalStarted) {
+                    await (0, direct_wire_js_1.writeFinal)(socket, { v: 1, status: 'FAILED', code: reason }, { timeout: this.idleTimeout });
+                }
+            }
+            catch { }
+            try {
+                socket.destroy();
+            }
+            catch { }
+            this.activeUploads.delete(socket);
+            if (!hooksFinished)
+                await reportFailure((0, hooks_js_1.callbackError)(error));
+        }
+        finally {
+            this.activeUploads.delete(socket);
+            releaseTransfer();
+            reader.closeReader();
+        }
+    }
+    /**
+     * Records that a transfer still owes its deferred post-commit retention
+     * pass, keeping at most `MAX_OWED_POST_COMMIT_RETENTION` entries.
+     *
+     * `Set` preserves insertion order, so the oldest owed transfer is evicted
+     * first and eviction is deterministic. An evicted transfer loses nothing
+     * durable: its artifact is already committed and its rotation falls back to
+     * the next startup, scheduled, or commit-triggered pass.
+     */
+    owePostCommitRetention(transferId) {
+        if (this.pendingAfterCommit.has(transferId))
+            return;
+        if (this.pendingAfterCommit.size >= exports.MAX_OWED_POST_COMMIT_RETENTION) {
+            const oldest = this.pendingAfterCommit.values().next();
+            if (!oldest.done)
+                this.pendingAfterCommit.delete(oldest.value);
+        }
+        this.pendingAfterCommit.add(transferId);
+    }
+    /**
+     * Runs the post-commit retention pass that a configured `afterCommit` hook
+     * deferred, only after that hook succeeded, and then stops owing it. The
+     * retention manager already reports its own failures as non-fatal, so
+     * nothing here can fail the upload; the pass is attempted exactly once per
+     * successful hook, which is why the transfer is cleared either way.
+     */
+    async settleDeferredRetention(transferId, owner) {
+        if (this.hooks.afterCommit === undefined)
+            return;
+        try {
+            if (this.retention)
+                await this.retention.afterCommit();
+        }
+        catch (error) {
+            this.logger.warn('Post-commit retention failed', {
+                fingerprint: owner ? fingerprint(owner) : 'invalid',
+                reason: codeOf(error)
+            });
+        }
+        finally {
+            this.pendingAfterCommit.delete(transferId);
+        }
+    }
+    /**
+     * Retires a committed session without letting cleanup undo a durable commit.
+     *
+     * The artifact is already published at this point, so a failure to unlink the
+     * session leaves recoverable residue that `init()` purges on the next start.
+     * Propagating it here would abort before the terminal record and tell the
+     * client its upload failed after it had in fact succeeded.
+     */
+    async retireQuietly(transferId, owner) {
+        try {
+            await this.sessions.retireCommitted(transferId);
+        }
+        catch (error) {
+            this.logger.warn('Committed session cleanup failed', {
+                fingerprint: owner ? fingerprint(owner) : 'invalid',
+                reason: codeOf(error)
+            });
+        }
+    }
+    async start() {
+        try {
+            this.layout = (0, layout_js_1.initLayout)(this.storageDir);
+            this.releaseLock = await (0, layout_js_1.acquireStorageLock)(this.layout, { storage: this.storage });
+            this.sessions = new session_store_js_1.SessionStore({
+                layout: this.layout,
+                maxStagingBytes: this.maxStagingBytes,
+                minFreeBytes: this.minFreeBytes,
+                resumeTtl: this.resumeTtl,
+                storage: this.storage,
+                isSessionActive: (session) => [...this.active.values()].some((active) => active.transfer === session.id)
+            });
+            this.commits = new commit_store_js_1.CommitStore({
+                layout: this.layout,
+                storage: this.storage,
+                logger: this.logger
+            });
+            if (this.symlinks.length > 0) {
+                this.links = new link_store_js_1.LinkStore({
+                    layout: this.layout,
+                    storage: this.storage
+                });
+            }
+            this.emitSafe('recovery', { status: 'started' });
+            await (0, recovery_js_1.prepareStorageRecovery)({
+                layout: this.layout,
+                commitStore: this.commits,
+                logger: this.logger,
+                onEvent: ({ type, ...event }) => this.emitSafe(type, event)
+            });
+            await this.sessions.init();
+            const recovered = await (0, recovery_js_1.recoverStorage)({
+                layout: this.layout,
+                sessionStore: this.sessions,
+                commitStore: this.commits,
+                logger: this.logger,
+                isAuthorized: (owner) => this.allowed(owner),
+                onEvent: ({ type, ...event }) => this.emitSafe(type, event)
+            });
+            this.emitSafe('recovery', {
+                status: 'completed',
+                journals: recovered.length,
+                purgedSessions: this.sessions.purgedSessions
+            });
+            this.logger.info('Storage recovery completed', {
+                journals: recovered.length,
+                purgedSessions: this.sessions.purgedSessions
+            });
+            this.retention = new retention_js_1.RetentionManager({
+                layout: this.layout,
+                sessionStore: this.sessions,
+                commitStore: this.commits,
+                maxAge: this.maxAge,
+                maxCount: this.maxCount,
+                maxVersions: this.maxVersions,
+                versionGranularity: this.versionGranularity,
+                maxStorageBytes: this.maxStorageBytes,
+                resumeTtl: this.resumeTtl,
+                cleanupInterval: this.cleanupInterval,
+                storage: this.storage,
+                scheduler: this.scheduler,
+                isSessionActive: (session) => [...this.active.values()].some((active) => active.transfer === session.id),
+                hasActiveUploads: () => this.activeUploads.size > 0,
+                isPinned: (record) => this.replaceNames.has(record.name),
+                managedLinkNames: () => this.linkNames,
+                reconcileLinks: (records) => this.reconcileLinksUnlocked(records),
+                linkPinsFallback: (records) => this.linkPinsFallbackUnlocked(records),
+                logger: this.logger,
+                onEvent: ({ type, ...event }) => this.emitSafe(type, event)
+            });
+            await this.retention.start();
+            (0, abort_js_1.throwIfAborted)(this.signal);
+            this.transport = new direct_dht_js_1.DirectDhtServer({
+                keyPair: this.keyPair,
+                allowedClientPublicKeys: this.allowedKeySnapshot.map((value) => b4a_1.default.from(value)),
+                dht: this.dht,
+                dhtFactory: this.dhtFactory,
+                onConnection: (socket) => {
+                    const receive = this.receive(socket);
+                    this.receives.add(receive);
+                    const settled = () => {
+                        this.receives.delete(receive);
+                    };
+                    receive.then(settled, settled);
+                }
+            });
+            await this.transport.listen();
+            this.listening = true;
+            this.emitSafe('listening', { fingerprint: fingerprint(this.publicKey) });
+            this.logger.info('Direct DHT server listening', { fingerprint: fingerprint(this.publicKey) });
+            return this;
+        }
+        catch (error) {
+            await this.dispose();
+            throw error;
+        }
+    }
+    listen() {
+        if (this.closed)
+            return Promise.reject(fail(errors_js_1.ERRORS.ABORTED, 'Server is closed'));
+        return (this.listenPromise ||= this.start());
+    }
+    async dispose() {
+        for (const socket of this.active.keys()) {
+            try {
+                socket.destroy();
+            }
+            catch { }
+        }
+        await this.transport?.close().catch(() => { });
+        this.transport = null;
+        await Promise.allSettled([...this.receives]);
+        this.active.clear();
+        this.activeTransfers.clear();
+        this.pendingAfterCommit.clear();
+        await this.retention?.stop().catch(() => { });
+        this.retention = null;
+        this.links = null;
+        await this.sessions?.close().catch(() => { });
+        this.sessions = null;
+        if (this.releaseLock)
+            await this.releaseLock().catch(() => { });
+        this.releaseLock = null;
+        this.listening = false;
+    }
+    close() {
+        if (this.closePromise)
+            return this.closePromise;
+        this.closed = true;
+        this.abort.abort();
+        this.closePromise = (async () => {
+            await this.listenPromise?.catch(() => { });
+            await this.dispose();
+            this.emitSafe('close', { status: 'closed' });
+        })();
+        return this.closePromise;
+    }
+}
+exports.Server = Server;
+//# sourceMappingURL=server.js.map