voidforge-build 23.9.1

package/dist/wizard/lib/project-scope.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Project Scope — ProjectContext type and resolveProject() middleware.
+ *
+ * Provides the core abstraction for v22.0 project-scoped operations:
+ * - ProjectContext: immutable object with all derived paths for a project
+ * - resolveProject(): middleware that extracts project ID, validates access, returns context
+ *
+ * ADR-040 (project-scoped dashboards), ADR-041 (Muster amendments)
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type Project } from './project-registry.js';
+export interface ProjectContext {
+    /** Project ID from projects.json registry */
+    readonly id: string;
+    /** Human-readable name */
+    readonly name: string;
+    /** Absolute path to project root (contains CLAUDE.md) */
+    readonly directory: string;
+    /** The full Project record from registry */
+    readonly project: Project;
+    /** {directory}/logs/ */
+    readonly logsDir: string;
+    /** {directory}/cultivation/ */
+    readonly cultivationDir: string;
+    /** {directory}/cultivation/treasury/ */
+    readonly treasuryDir: string;
+    /** {directory}/cultivation/treasury/spend-log.jsonl */
+    readonly spendLog: string;
+    /** {directory}/cultivation/treasury/revenue-log.jsonl */
+    readonly revenueLog: string;
+    /** {directory}/cultivation/treasury/pending-ops.jsonl */
+    readonly pendingOps: string;
+    /** {directory}/cultivation/treasury/budgets.json */
+    readonly budgetsFile: string;
+    /** {directory}/cultivation/treasury/campaigns/ */
+    readonly campaignsDir: string;
+    /** {directory}/cultivation/heartbeat.pid */
+    readonly pidFile: string;
+    /** {directory}/cultivation/heartbeat.sock */
+    readonly socketPath: string;
+    /** {directory}/cultivation/heartbeat.json */
+    readonly stateFile: string;
+    /** {directory}/cultivation/heartbeat.log */
+    readonly logFile: string;
+    /** {directory}/cultivation/heartbeat.token */
+    readonly tokenFile: string;
+}
+/** Construct a ProjectContext from a registry Project. */
+export declare function createProjectContext(project: Project): ProjectContext;
+export interface ResolvedProject {
+    context: ProjectContext;
+    role: 'admin' | 'deployer' | 'viewer';
+}
+/**
+ * Extract project ID from route params or query string, validate access, return ProjectContext.
+ *
+ * Checks (in order):
+ * 1. Route param :id (from parameterized routes like /api/projects/:id/...)
+ * 2. Query param ?project=<id>
+ *
+ * Returns null if the response was already sent (error path).
+ * In local mode, all projects are accessible as admin.
+ */
+export declare function resolveProject(req: IncomingMessage, res: ServerResponse): Promise<ResolvedProject | null>;

package/dist/wizard/lib/project-scope.js

@@ -0,0 +1,96 @@
+/**
+ * Project Scope — ProjectContext type and resolveProject() middleware.
+ *
+ * Provides the core abstraction for v22.0 project-scoped operations:
+ * - ProjectContext: immutable object with all derived paths for a project
+ * - resolveProject(): middleware that extracts project ID, validates access, returns context
+ *
+ * ADR-040 (project-scoped dashboards), ADR-041 (Muster amendments)
+ */
+import { join } from 'node:path';
+import { existsSync } from 'node:fs';
+import { getProject, checkProjectAccess } from './project-registry.js';
+import { isRemoteMode, isLanMode, validateSession, parseSessionCookie, getClientIp } from './tower-auth.js';
+import { sendJson } from './http-helpers.js';
+import { getRouteParams } from '../router.js';
+/** Construct a ProjectContext from a registry Project. */
+export function createProjectContext(project) {
+    const dir = project.directory;
+    const cultivationDir = join(dir, 'cultivation');
+    const treasuryDir = join(cultivationDir, 'treasury');
+    return {
+        id: project.id,
+        name: project.name,
+        directory: dir,
+        project,
+        logsDir: join(dir, 'logs'),
+        cultivationDir,
+        treasuryDir,
+        spendLog: join(treasuryDir, 'spend-log.jsonl'),
+        revenueLog: join(treasuryDir, 'revenue-log.jsonl'),
+        pendingOps: join(treasuryDir, 'pending-ops.jsonl'),
+        budgetsFile: join(treasuryDir, 'budgets.json'),
+        campaignsDir: join(treasuryDir, 'campaigns'),
+        pidFile: join(cultivationDir, 'heartbeat.pid'),
+        socketPath: join(cultivationDir, 'heartbeat.sock'),
+        stateFile: join(cultivationDir, 'heartbeat.json'),
+        logFile: join(cultivationDir, 'heartbeat.log'),
+        tokenFile: join(cultivationDir, 'heartbeat.token'),
+    };
+}
+/**
+ * Extract project ID from route params or query string, validate access, return ProjectContext.
+ *
+ * Checks (in order):
+ * 1. Route param :id (from parameterized routes like /api/projects/:id/...)
+ * 2. Query param ?project=<id>
+ *
+ * Returns null if the response was already sent (error path).
+ * In local mode, all projects are accessible as admin.
+ */
+export async function resolveProject(req, res) {
+    // Extract project ID from route params or query string
+    const params = getRouteParams(req);
+    const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
+    const projectId = params.id || url.searchParams.get('project');
+    if (!projectId) {
+        sendJson(res, 400, { success: false, error: 'project parameter is required' });
+        return null;
+    }
+    // Look up project in registry
+    const project = await getProject(projectId);
+    if (!project) {
+        sendJson(res, 404, { success: false, error: 'Not found' });
+        return null;
+    }
+    // Verify project directory still exists (stale registry detection — Batman M2 finding)
+    if (!existsSync(project.directory)) {
+        sendJson(res, 404, { success: false, error: 'Not found' });
+        return null;
+    }
+    // In local mode, no auth — full access
+    if (!isRemoteMode() && !isLanMode()) {
+        return {
+            context: createProjectContext(project),
+            role: 'admin',
+        };
+    }
+    // Remote/LAN mode: validate session and project access
+    const token = parseSessionCookie(req.headers.cookie);
+    const ip = getClientIp(req);
+    const session = token ? validateSession(token, ip) : null;
+    if (!session) {
+        sendJson(res, 401, { success: false, error: 'Authentication required' });
+        return null;
+    }
+    const role = await checkProjectAccess(projectId, session.username, session.role);
+    if (!role) {
+        // 404 not 403 — no information leakage (per CLAUDE.md)
+        sendJson(res, 404, { success: false, error: 'Not found' });
+        return null;
+    }
+    return {
+        context: createProjectContext(project),
+        role,
+    };
+}

package/dist/wizard/lib/project-vault.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Per-Project Vault — HKDF-derived encryption for project-scoped secrets.
+ *
+ * Derives a unique encryption key per project from the global vault password
+ * using HKDF (RFC 5869). Each project's vault.enc is encrypted with its own
+ * key, so compromising one project's vault doesn't expose another's secrets.
+ *
+ * Key derivation: HKDF-SHA256(masterKey, projectId, 'voidforge-project-vault') → 256-bit key
+ *
+ * The global financial vault (~/.voidforge/treasury/vault.enc) stays global
+ * for cross-project credentials (API keys shared across projects). Per-project
+ * vaults store project-specific secrets (campaign configs, scoped platform tokens).
+ *
+ * v22.1 Mission 3 — Campaign 30
+ * PRD Reference: §9.11 (Financial Security), ADR-040 (project scoping)
+ */
+/**
+ * Derive a per-project encryption key using HKDF (RFC 5869).
+ *
+ * HKDF extracts a pseudorandom key from the master password + salt,
+ * then expands it with the project ID as context info. This ensures
+ * each project gets a cryptographically independent key.
+ *
+ * @param password — The global vault password (IKM)
+ * @param salt — Random salt stored alongside the ciphertext
+ * @param projectId — Project identifier used as HKDF info context
+ */
+declare function deriveProjectKey(password: string, salt: Buffer, projectId: string): Promise<Buffer>;
+/** Store a project-specific credential. */
+export declare function projectVaultSet(password: string, projectId: string, projectDir: string, key: string, value: string): Promise<void>;
+/** Retrieve a project-specific credential. */
+export declare function projectVaultGet(password: string, projectId: string, projectDir: string, key: string): Promise<string | null>;
+/** Delete a project-specific credential. */
+export declare function projectVaultDelete(password: string, projectId: string, projectDir: string, key: string): Promise<void>;
+/** Check if a per-project vault exists. */
+export declare function projectVaultExists(projectDir: string): boolean;
+/** Verify password can decrypt the project vault. */
+export declare function projectVaultUnlock(password: string, projectId: string, projectDir: string): Promise<boolean>;
+/** List stored keys in a project vault (requires password). */
+export declare function projectVaultKeys(password: string, projectId: string, projectDir: string): Promise<string[]>;
+/** Clear the in-memory cache for a specific project vault. */
+export declare function projectVaultLock(projectDir: string): void;
+/** Clear ALL per-project vault caches — call on daemon shutdown. */
+export declare function projectVaultLockAll(): void;
+/** Return the vault file path for a project directory. */
+export declare function projectVaultPath(projectDir: string): string;
+export { deriveProjectKey as _deriveProjectKey };

package/dist/wizard/lib/project-vault.js

@@ -0,0 +1,221 @@
+/**
+ * Per-Project Vault — HKDF-derived encryption for project-scoped secrets.
+ *
+ * Derives a unique encryption key per project from the global vault password
+ * using HKDF (RFC 5869). Each project's vault.enc is encrypted with its own
+ * key, so compromising one project's vault doesn't expose another's secrets.
+ *
+ * Key derivation: HKDF-SHA256(masterKey, projectId, 'voidforge-project-vault') → 256-bit key
+ *
+ * The global financial vault (~/.voidforge/treasury/vault.enc) stays global
+ * for cross-project credentials (API keys shared across projects). Per-project
+ * vaults store project-specific secrets (campaign configs, scoped platform tokens).
+ *
+ * v22.1 Mission 3 — Campaign 30
+ * PRD Reference: §9.11 (Financial Security), ADR-040 (project scoping)
+ */
+import { createCipheriv, createDecipheriv, hkdf, randomBytes, timingSafeEqual } from 'node:crypto';
+import { readFile, mkdir, open, rename } from 'node:fs/promises';
+import { join } from 'node:path';
+import { existsSync } from 'node:fs';
+import { platform } from 'node:os';
+// ── Constants ────────────────────────────────────────────
+const VAULT_FILENAME = 'vault.enc';
+const ALGORITHM = 'aes-256-gcm';
+const KEY_LENGTH = 32; // 256 bits
+const IV_LENGTH = 16;
+const SALT_LENGTH = 32; // Random salt per encryption (stored in file)
+const AUTH_TAG_LENGTH = 16;
+const MAX_PASSWORD_LENGTH = 256;
+// HKDF parameters
+const HKDF_HASH = 'sha256';
+const HKDF_INFO = 'voidforge-project-vault';
+// Per-project session caches keyed by vault path
+const sessionCaches = new Map();
+// Write queues per vault path
+const writeQueues = new Map();
+// ── HKDF Key Derivation ──────────────────────────────────
+/**
+ * Derive a per-project encryption key using HKDF (RFC 5869).
+ *
+ * HKDF extracts a pseudorandom key from the master password + salt,
+ * then expands it with the project ID as context info. This ensures
+ * each project gets a cryptographically independent key.
+ *
+ * @param password — The global vault password (IKM)
+ * @param salt — Random salt stored alongside the ciphertext
+ * @param projectId — Project identifier used as HKDF info context
+ */
+async function deriveProjectKey(password, salt, projectId) {
+    const capped = password.slice(0, MAX_PASSWORD_LENGTH);
+    const info = `${HKDF_INFO}:${projectId}`;
+    return new Promise((resolve, reject) => {
+        hkdf(HKDF_HASH, capped, salt, info, KEY_LENGTH, (err, derivedKey) => {
+            if (err)
+                reject(err);
+            else
+                resolve(Buffer.from(derivedKey));
+        });
+    });
+}
+// ── Encrypt / Decrypt ────────────────────────────────────
+async function encrypt(plaintext, password, projectId) {
+    const salt = randomBytes(SALT_LENGTH);
+    const iv = randomBytes(IV_LENGTH);
+    const key = await deriveProjectKey(password, salt, projectId);
+    const cipher = createCipheriv(ALGORITHM, key, iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext, 'utf-8'), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    // Format: salt (32) + iv (16) + authTag (16) + ciphertext
+    return Buffer.concat([salt, iv, authTag, encrypted]);
+}
+async function decrypt(data, password, projectId) {
+    if (data.length < SALT_LENGTH + IV_LENGTH + AUTH_TAG_LENGTH + 1) {
+        throw new Error('Project vault data is corrupted or empty');
+    }
+    const salt = data.subarray(0, SALT_LENGTH);
+    const iv = data.subarray(SALT_LENGTH, SALT_LENGTH + IV_LENGTH);
+    const authTag = data.subarray(SALT_LENGTH + IV_LENGTH, SALT_LENGTH + IV_LENGTH + AUTH_TAG_LENGTH);
+    const ciphertext = data.subarray(SALT_LENGTH + IV_LENGTH + AUTH_TAG_LENGTH);
+    const key = await deriveProjectKey(password, salt, projectId);
+    const decipher = createDecipheriv(ALGORITHM, key, iv);
+    decipher.setAuthTag(authTag);
+    const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    return decrypted.toString('utf-8');
+}
+// ── Serialization ────────────────────────────────────────
+function serialized(vaultPath, fn) {
+    const queue = writeQueues.get(vaultPath) ?? Promise.resolve();
+    const result = queue.then(fn, () => fn());
+    writeQueues.set(vaultPath, result.then(() => { }, () => { }));
+    return result;
+}
+// ── Internal Read/Write ──────────────────────────────────
+function getVaultPath(projectDir) {
+    return join(projectDir, 'cultivation', 'treasury', VAULT_FILENAME);
+}
+async function readVault(password, projectId, vaultPath) {
+    const cache = sessionCaches.get(vaultPath);
+    if (cache && cache.projectId === projectId) {
+        const a = Buffer.from(cache.password, 'utf-8');
+        const b = Buffer.from(password, 'utf-8');
+        if (a.length === b.length && timingSafeEqual(a, b)) {
+            return { ...cache.data };
+        }
+    }
+    if (!existsSync(vaultPath)) {
+        return {};
+    }
+    const raw = await readFile(vaultPath);
+    const json = await decrypt(raw, password, projectId);
+    const data = JSON.parse(json);
+    sessionCaches.set(vaultPath, { password, projectId, data });
+    return { ...data };
+}
+async function writeVault(password, projectId, vaultPath, data) {
+    const dir = join(vaultPath, '..');
+    await mkdir(dir, { recursive: true });
+    const json = JSON.stringify(data);
+    const encrypted = await encrypt(json, password, projectId);
+    // Atomic write: temp → datasync/sync → rename (per ADR-1)
+    const tmpPath = vaultPath + '.tmp.' + process.pid;
+    const fh = await open(tmpPath, 'w', 0o600);
+    try {
+        await fh.writeFile(encrypted);
+        if (platform() === 'darwin') {
+            await fh.datasync();
+        }
+        else {
+            await fh.sync();
+        }
+    }
+    finally {
+        await fh.close();
+    }
+    await rename(tmpPath, vaultPath);
+    sessionCaches.set(vaultPath, { password, projectId, data: { ...data } });
+}
+// ── Public API ───────────────────────────────────────────
+const MIN_PASSWORD_LENGTH = 12;
+function validatePassword(password) {
+    if (password.length < MIN_PASSWORD_LENGTH) {
+        throw new Error(`Vault password must be at least ${MIN_PASSWORD_LENGTH} characters`);
+    }
+}
+/** Store a project-specific credential. */
+export function projectVaultSet(password, projectId, projectDir, key, value) {
+    validatePassword(password);
+    const vaultPath = getVaultPath(projectDir);
+    return serialized(vaultPath, async () => {
+        const data = await readVault(password, projectId, vaultPath);
+        data[key] = value;
+        await writeVault(password, projectId, vaultPath, data);
+    });
+}
+/** Retrieve a project-specific credential. */
+export function projectVaultGet(password, projectId, projectDir, key) {
+    const vaultPath = getVaultPath(projectDir);
+    return serialized(vaultPath, async () => {
+        const data = await readVault(password, projectId, vaultPath);
+        return data[key] ?? null;
+    });
+}
+/** Delete a project-specific credential. */
+export function projectVaultDelete(password, projectId, projectDir, key) {
+    const vaultPath = getVaultPath(projectDir);
+    return serialized(vaultPath, async () => {
+        const data = await readVault(password, projectId, vaultPath);
+        delete data[key];
+        await writeVault(password, projectId, vaultPath, data);
+    });
+}
+/** Check if a per-project vault exists. */
+export function projectVaultExists(projectDir) {
+    return existsSync(getVaultPath(projectDir));
+}
+/** Verify password can decrypt the project vault. */
+export function projectVaultUnlock(password, projectId, projectDir) {
+    const vaultPath = getVaultPath(projectDir);
+    if (!existsSync(vaultPath)) {
+        return Promise.resolve(true); // No vault yet = password is for creation
+    }
+    return serialized(vaultPath, async () => {
+        try {
+            await readVault(password, projectId, vaultPath);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/** List stored keys in a project vault (requires password). */
+export function projectVaultKeys(password, projectId, projectDir) {
+    const vaultPath = getVaultPath(projectDir);
+    return serialized(vaultPath, async () => {
+        const data = await readVault(password, projectId, vaultPath);
+        return Object.keys(data);
+    });
+}
+/** Clear the in-memory cache for a specific project vault. */
+export function projectVaultLock(projectDir) {
+    const vaultPath = getVaultPath(projectDir);
+    const cache = sessionCaches.get(vaultPath);
+    if (cache) {
+        cache.password = '\0'.repeat(cache.password.length);
+        sessionCaches.delete(vaultPath);
+    }
+}
+/** Clear ALL per-project vault caches — call on daemon shutdown. */
+export function projectVaultLockAll() {
+    for (const [, cache] of sessionCaches) {
+        cache.password = '\0'.repeat(cache.password.length);
+    }
+    sessionCaches.clear();
+}
+/** Return the vault file path for a project directory. */
+export function projectVaultPath(projectDir) {
+    return getVaultPath(projectDir);
+}
+// Export for testing
+export { deriveProjectKey as _deriveProjectKey };

package/dist/wizard/lib/provision-manifest.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Provision manifest — persists resource state to disk for crash recovery.
+ *
+ * Before each AWS resource creation, the intended action is recorded.
+ * After creation, the resource ID is written. On cleanup, the manifest
+ * is read and resources deleted in reverse. On wizard startup, incomplete
+ * manifests can be detected and cleaned up.
+ *
+ * Stored at ~/.voidforge/runs/<runId>.json
+ */
+import type { CreatedResource } from './provisioners/types.js';
+export interface ManifestResource {
+    type: string;
+    id: string;
+    region: string;
+    status: 'pending' | 'created' | 'cleaned' | 'failed';
+}
+export interface ProvisionManifest {
+    runId: string;
+    startedAt: string;
+    target: string;
+    region: string;
+    projectName: string;
+    status: 'in-progress' | 'complete' | 'failed' | 'cleaned';
+    resources: ManifestResource[];
+}
+/** Create a new manifest for a provisioning run. */
+export declare function createManifest(runId: string, target: string, region: string, projectName: string): Promise<ProvisionManifest>;
+/** Record that a resource is about to be created (write-ahead). */
+export declare function recordResourcePending(runId: string, type: string, id: string, region: string): Promise<void>;
+/** Record that a resource was successfully created. */
+export declare function recordResourceCreated(runId: string, type: string, id: string, region: string): Promise<void>;
+/** Mark the overall run status. */
+export declare function updateManifestStatus(runId: string, status: ProvisionManifest['status']): Promise<void>;
+/** Mark a resource as cleaned up. */
+export declare function recordResourceCleaned(runId: string, type: string, id: string): Promise<void>;
+/** Read a manifest by run ID. Returns null if not found. */
+export declare function readManifest(runId: string): Promise<ProvisionManifest | null>;
+/** Delete a manifest file (after successful cleanup). */
+export declare function deleteManifest(runId: string): Promise<void>;
+/** List all incomplete manifests (for recovery on startup). */
+export declare function listIncompleteRuns(): Promise<ProvisionManifest[]>;
+/** Convert manifest resources to the CreatedResource[] format used by provisioners. */
+export declare function manifestToCreatedResources(manifest: ProvisionManifest): CreatedResource[];

package/dist/wizard/lib/provision-manifest.js

@@ -0,0 +1,164 @@
+/**
+ * Provision manifest — persists resource state to disk for crash recovery.
+ *
+ * Before each AWS resource creation, the intended action is recorded.
+ * After creation, the resource ID is written. On cleanup, the manifest
+ * is read and resources deleted in reverse. On wizard startup, incomplete
+ * manifests can be detected and cleaned up.
+ *
+ * Stored at ~/.voidforge/runs/<runId>.json
+ */
+import { readFile, readdir, unlink, mkdir, open, rename } from 'node:fs/promises';
+import { join } from 'node:path';
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+const RUNS_DIR = join(homedir(), '.voidforge', 'runs');
+/** QA-R2-004: Write queue to serialize manifest mutations and prevent race conditions */
+let writeQueue = Promise.resolve();
+function serialized(fn) {
+    const result = writeQueue.then(fn, () => fn());
+    writeQueue = result.then(() => { }, () => { });
+    return result;
+}
+// IG-R4 LOKI-003: Atomic write with fsync — crash-recovery manifests must survive crashes
+async function atomicWriteManifest(runId, manifest) {
+    const filePath = manifestPath(runId);
+    const tmpPath = filePath + '.tmp';
+    const fh = await open(tmpPath, 'w', 0o600);
+    try {
+        await fh.writeFile(JSON.stringify(manifest, null, 2));
+        await fh.sync();
+    }
+    finally {
+        await fh.close();
+    }
+    await rename(tmpPath, filePath);
+}
+async function ensureDir() {
+    await mkdir(RUNS_DIR, { recursive: true });
+}
+// SEC-R3-013: Validate runId is a UUID to prevent path traversal
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+function manifestPath(runId) {
+    if (!UUID_RE.test(runId))
+        throw new Error('Invalid runId format');
+    return join(RUNS_DIR, `${runId}.json`);
+}
+/** Create a new manifest for a provisioning run. */
+export function createManifest(runId, target, region, projectName) {
+    // QA-R3-004: Wrap in serialized() for consistency with other mutation functions
+    return serialized(async () => {
+        await ensureDir();
+        const manifest = {
+            runId,
+            startedAt: new Date().toISOString(),
+            target,
+            region,
+            projectName,
+            status: 'in-progress',
+            resources: [],
+        };
+        await atomicWriteManifest(runId, manifest);
+        return manifest;
+    });
+}
+/** Record that a resource is about to be created (write-ahead). */
+export function recordResourcePending(runId, type, id, region) {
+    return serialized(async () => {
+        const manifest = await readManifest(runId);
+        if (!manifest)
+            return;
+        manifest.resources.push({ type, id, region, status: 'pending' });
+        await atomicWriteManifest(runId, manifest);
+    });
+}
+/** Record that a resource was successfully created. */
+export function recordResourceCreated(runId, type, id, region) {
+    return serialized(async () => {
+        const manifest = await readManifest(runId);
+        if (!manifest)
+            return;
+        const existing = manifest.resources.find((r) => r.type === type && r.id === id);
+        if (existing) {
+            existing.status = 'created';
+        }
+        else {
+            manifest.resources.push({ type, id, region, status: 'created' });
+        }
+        await atomicWriteManifest(runId, manifest);
+    });
+}
+/** Mark the overall run status. */
+export function updateManifestStatus(runId, status) {
+    return serialized(async () => {
+        const manifest = await readManifest(runId);
+        if (!manifest)
+            return;
+        manifest.status = status;
+        await atomicWriteManifest(runId, manifest);
+    });
+}
+/** Mark a resource as cleaned up. */
+export function recordResourceCleaned(runId, type, id) {
+    return serialized(async () => {
+        const manifest = await readManifest(runId);
+        if (!manifest)
+            return;
+        const resource = manifest.resources.find((r) => r.type === type && r.id === id);
+        if (resource)
+            resource.status = 'cleaned';
+        await atomicWriteManifest(runId, manifest);
+    });
+}
+/** Read a manifest by run ID. Returns null if not found. */
+export async function readManifest(runId) {
+    const path = manifestPath(runId);
+    if (!existsSync(path))
+        return null;
+    try {
+        const raw = await readFile(path, 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+/** Delete a manifest file (after successful cleanup). */
+export async function deleteManifest(runId) {
+    const path = manifestPath(runId);
+    try {
+        await unlink(path);
+    }
+    catch { /* already gone */ }
+}
+/** List all incomplete manifests (for recovery on startup). */
+export async function listIncompleteRuns() {
+    await ensureDir();
+    const incomplete = [];
+    try {
+        const files = await readdir(RUNS_DIR);
+        for (const file of files) {
+            if (!file.endsWith('.json'))
+                continue;
+            try {
+                const raw = await readFile(join(RUNS_DIR, file), 'utf-8');
+                const manifest = JSON.parse(raw);
+                if (manifest.status === 'in-progress' || manifest.status === 'failed') {
+                    const hasCreatedResources = manifest.resources.some((r) => r.status === 'created');
+                    if (hasCreatedResources) {
+                        incomplete.push(manifest);
+                    }
+                }
+            }
+            catch { /* skip corrupt files */ }
+        }
+    }
+    catch { /* directory might not exist */ }
+    return incomplete;
+}
+/** Convert manifest resources to the CreatedResource[] format used by provisioners. */
+export function manifestToCreatedResources(manifest) {
+    return manifest.resources
+        .filter((r) => r.status === 'created')
+        .map((r) => ({ type: r.type, id: r.id, region: r.region }));
+}

package/dist/wizard/lib/provisioner-registry.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Provisioner Registry — single source of truth for provisioner map,
+ * credential scoping, and GitHub-linked target constants.
+ *
+ * ARCH-R2-002: Extracted from provision.ts + headless-deploy.ts to prevent drift.
+ */
+import type { Provisioner } from './provisioners/types.js';
+/** All available provisioners keyed by deploy target name. */
+export declare const provisioners: Record<string, Provisioner>;
+/** Credential scoping — each provisioner only receives vault keys it needs (ADR-020). */
+export declare const provisionKeys: Record<string, string[]>;
+/** Deploy targets that benefit from GitHub repo linking (ADR-015). */
+export declare const GITHUB_LINKED_TARGETS: string[];
+/** Deploy targets where GitHub push is optional (deploy via SSH/SDK instead). */
+export declare const GITHUB_OPTIONAL_TARGETS: string[];