@agentage/cli 0.0.3 → 0.0.4

package/dist/lib/auth/env-match.d.ts

@@ -0,0 +1,9 @@
+import { type AuthState } from '../fs/config.js';
+import { type Env } from '../net/origins.js';
+export interface AuthEnvMismatch {
+    credentialFqdn: string;
+    credentialEnv: Env;
+    targetFqdn: string;
+    targetEnv: Env;
+}
+export declare const detectEnvMismatch: (auth: AuthState, targetFqdn: string) => AuthEnvMismatch | null;

package/dist/lib/auth/env-match.js

@@ -0,0 +1,17 @@
+import { environment, normalizeFqdn } from '../net/origins.js';
+// The stored credential belongs to the environment it was issued for (auth.siteFqdn); the CLI's
+// current target comes from AGENTAGE_SITE_FQDN (production default). Introspecting a dev credential
+// against production rejects it and misreads as "expired" - so detect the mismatch by normalized
+// fqdn BEFORE any introspection. Returns null when the credential matches the current target.
+export const detectEnvMismatch = (auth, targetFqdn) => {
+    const credentialFqdn = normalizeFqdn(auth.siteFqdn);
+    const target = normalizeFqdn(targetFqdn);
+    if (credentialFqdn === target)
+        return null;
+    return {
+        credentialFqdn,
+        credentialEnv: environment(credentialFqdn),
+        targetFqdn: target,
+        targetEnv: environment(target),
+    };
+};

package/dist/lib/auth/introspect.d.ts

@@ -0,0 +1,7 @@
+import { type AuthState } from '../fs/config.js';
+import { type Links } from '../net/origins.js';
+export interface TokenSession {
+    userId?: string;
+    expiresAt?: string;
+}
+export declare const introspectToken: (auth: AuthState, links: Links) => Promise<TokenSession>;

package/dist/lib/auth/introspect.js

@@ -0,0 +1,89 @@
+import { authedGet, refreshOrThrow } from './api.js';
+import { AuthRequiredError, TransientAuthError } from './auth-errors.js';
+const isPast = (iso) => {
+    if (!iso)
+        return false;
+    const t = Date.parse(iso);
+    return !Number.isNaN(t) && t <= Date.now();
+};
+const sleep = (ms) => new Promise((resolve) => {
+    // unref so a pending backoff never keeps `status` from exiting.
+    const timer = setTimeout(resolve, ms);
+    timer.unref();
+});
+// Introspection over global fetch: a network error reflects as a transient (a blip must not read as
+// a dead session), never letting the raw error escape to gatherStatus. Only a 401 stays terminal.
+const getSession = async (auth, links) => {
+    const url = `${links.auth}/api/auth/mcp/get-session`;
+    try {
+        return await authedGet(auth, links, url);
+    }
+    catch (err) {
+        if (err instanceof AuthRequiredError)
+            throw err;
+        throw new TransientAuthError('get-session temporarily failed');
+    }
+};
+const mapSession = (body) => ({
+    userId: body.userId,
+    expiresAt: body.accessTokenExpiresAt,
+});
+const isUnexpired = (auth) => auth.tokens.expiresAt !== undefined && auth.tokens.expiresAt > Date.now();
+// A cosmetic freshen when get-session returns a present-but-past-expiry body: refresh to display the
+// post-refresh expiry, but tolerate a transient refresh failure by keeping the present body.
+const freshenIfStale = async (auth, links, body) => {
+    if (!isPast(body.accessTokenExpiresAt))
+        return mapSession(body);
+    try {
+        await refreshOrThrow(auth, links);
+    }
+    catch (err) {
+        if (err instanceof TransientAuthError)
+            return mapSession(body); // keep the last good session
+        throw err;
+    }
+    return mapSession((await getSession(auth, links)) ?? body);
+};
+// The OAuth introspection endpoint: the only live surface that validates the CLI's bearer today
+// (backend REST accepts session cookies only). get-session answers 200 + null (not 401) for an
+// inactive session, so the on-401 refresh never fires here. TERMINAL failures (401 / dead grant)
+// throw AuthRequiredError; TRANSIENT ones (429/5xx/network/timeout) throw TransientAuthError so the
+// caller renders a temporary note, never "session expired".
+const introspectOnce = async (auth, links) => {
+    const expired = auth.tokens.expiresAt !== undefined && auth.tokens.expiresAt <= Date.now();
+    if (expired)
+        await refreshOrThrow(auth, links); // throws AuthRequired or Transient by class
+    // With an unexpired token, a transient get-session is not proof of a dead session: we still hold a
+    // valid bearer, so report signed-in against the stored expiry rather than surfacing the blip.
+    const holdUnexpired = isUnexpired(auth);
+    let body;
+    try {
+        body = await getSession(auth, links);
+    }
+    catch (err) {
+        if (holdUnexpired && err instanceof TransientAuthError)
+            return { expiresAt: new Date(auth.tokens.expiresAt).toISOString() };
+        throw err;
+    }
+    // 200 + null = definitive no-session: refresh is decisive (terminal -> expired, transient -> blip).
+    if (!body) {
+        await refreshOrThrow(auth, links);
+        const after = await getSession(auth, links);
+        if (!after)
+            throw new AuthRequiredError('no active session');
+        return mapSession(after);
+    }
+    return freshenIfStale(auth, links, body);
+};
+// A retry-once with a short unref'd backoff absorbs a lone transient blip; a terminal error skips it.
+export const introspectToken = async (auth, links) => {
+    try {
+        return await introspectOnce(auth, links);
+    }
+    catch (err) {
+        if (err instanceof AuthRequiredError)
+            throw err; // terminal: no point retrying a dead session
+        await sleep(300);
+        return introspectOnce(auth, links); // one transient-only retry; a 2nd transient propagates
+    }
+};

package/dist/lib/{oauth.d.ts → auth/oauth.d.ts}

@@ -20,6 +20,11 @@ export declare const buildAuthorizeUrl: (authUrl: string, params: {
     state: string;
     scope?: string;
 }) => string;
+export declare class TokenRequestError extends Error {
+    readonly status: number;
+    readonly oauthError?: string | undefined;
+    constructor(status: number, oauthError?: string | undefined);
+}
 export declare const exchangeCode: (authUrl: string, params: {
     clientId: string;
     code: string;
@@ -27,5 +32,4 @@ export declare const exchangeCode: (authUrl: string, params: {
     verifier: string;
 }) => Promise<TokenResponse>;
 export declare const refreshTokens: (authUrl: string, clientId: string, refreshToken: string) => Promise<TokenResponse>;
-export declare const revokeToken: (authUrl: string, token: string) => Promise<void>;
-//# sourceMappingURL=oauth.d.ts.map
+export declare const revokeToken: (authUrl: string, token: string, timeoutMs?: number) => Promise<void>;

package/dist/lib/{oauth.js → auth/oauth.js}

@@ -1,4 +1,7 @@
 import { createHash, randomBytes } from 'node:crypto';
+import { requestHeaders } from '../net/user-agent.js';
+// OAuth register/token/revoke are all CLI-originated; identify the caller on each.
+const cliHeaders = () => requestHeaders({ component: 'cli' });
 const REGISTER_PATH = '/api/auth/mcp/register';
 const AUTHORIZE_PATH = '/api/auth/mcp/authorize';
 const TOKEN_PATH = '/api/auth/mcp/token';
@@ -13,7 +16,7 @@ export const randomState = () => randomBytes(16).toString('base64url');
 export const registerClient = async (authUrl, redirectUri) => {
     const res = await fetch(`${authUrl}${REGISTER_PATH}`, {
         method: 'POST',
-        headers: { 'content-type': 'application/json' },
+        headers: { 'content-type': 'application/json', ...cliHeaders() },
         body: JSON.stringify({
             client_name: 'agentage CLI',
             redirect_uris: [redirectUri],
@@ -40,14 +43,28 @@ export const buildAuthorizeUrl = (authUrl, params) => {
     url.searchParams.set('scope', params.scope ?? DEFAULT_SCOPE);
     return url.toString();
 };
+// A token-endpoint failure that carries the HTTP status and any RFC 6749 `error` code so the
+// caller can tell a dead grant (invalid_grant/invalid_client/401) from a transient blip (429/5xx).
+export class TokenRequestError extends Error {
+    status;
+    oauthError;
+    constructor(status, oauthError) {
+        super(`token request failed (${status}${oauthError ? ` ${oauthError}` : ''})`);
+        this.status = status;
+        this.oauthError = oauthError;
+        this.name = 'TokenRequestError';
+    }
+}
 const postForm = async (url, form) => {
     const res = await fetch(url, {
         method: 'POST',
-        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        headers: { 'content-type': 'application/x-www-form-urlencoded', ...cliHeaders() },
         body: new URLSearchParams(form).toString(),
     });
-    if (!res.ok)
-        throw new Error(`token request failed (${res.status})`);
+    if (!res.ok) {
+        const body = (await res.json().catch(() => null));
+        throw new TokenRequestError(res.status, body?.error);
+    }
     return (await res.json());
 };
 export const exchangeCode = (authUrl, params) => postForm(`${authUrl}${TOKEN_PATH}`, {
@@ -62,16 +79,18 @@ export const refreshTokens = (authUrl, clientId, refreshToken) => postForm(`${au
     refresh_token: refreshToken,
     client_id: clientId,
 });
-export const revokeToken = async (authUrl, token) => {
+// AbortSignal.timeout caps a stalled revoke on a packet-drop network; residual undici keepalive is
+// acceptable here since --disconnect exits right after and errors are swallowed anyway.
+export const revokeToken = async (authUrl, token, timeoutMs = 3000) => {
     try {
         await fetch(`${authUrl}${REVOKE_PATH}`, {
             method: 'POST',
-            headers: { 'content-type': 'application/x-www-form-urlencoded' },
+            headers: { 'content-type': 'application/x-www-form-urlencoded', ...cliHeaders() },
             body: new URLSearchParams({ token }).toString(),
+            signal: AbortSignal.timeout(timeoutMs),
         });
     }
     catch {
         // best-effort: local credentials are removed regardless
     }
 };
-//# sourceMappingURL=oauth.js.map

package/dist/lib/auth/provision.d.ts

@@ -0,0 +1,14 @@
+import { type AuthState } from '../fs/config.js';
+import { type Links } from '../net/origins.js';
+export type ProvisionStatus = 'provisioned' | 'exists' | 'disabled' | 'conflict' | 'unauthenticated' | 'offline';
+export interface ProvisionResult {
+    status: ProvisionStatus;
+    message: string;
+}
+export interface ProvisionDeps {
+    readAuth: () => AuthState | null;
+    links: () => Links;
+    post: (auth: AuthState, links: Links, url: string, body: unknown) => Promise<Response>;
+}
+export declare const defaultProvisionDeps: () => ProvisionDeps;
+export declare const provisionAccountVault: (name: string, deps?: ProvisionDeps) => Promise<ProvisionResult>;

package/dist/lib/auth/provision.js

@@ -0,0 +1,62 @@
+import { authedPost } from './api.js';
+import { readAuth } from '../fs/config.js';
+import { links as buildLinks, siteFqdn } from '../net/origins.js';
+export const defaultProvisionDeps = () => ({
+    readAuth,
+    links: () => buildLinks(siteFqdn()),
+    post: authedPost,
+});
+// The API error envelope carries the code as `error.code` (or a top-level `code`); read it best
+// effort - a non-JSON body just yields undefined and the caller falls back to non-fatal.
+const errorCode = async (res) => {
+    try {
+        const body = (await res.json());
+        return body.error?.code ?? body.code;
+    }
+    catch {
+        return undefined;
+    }
+};
+const registeredLocally = (name, tail) => `Vault '${name}' registered locally${tail}`;
+export const provisionAccountVault = async (name, deps = defaultProvisionDeps()) => {
+    const auth = deps.readAuth();
+    if (!auth) {
+        return {
+            status: 'unauthenticated',
+            message: registeredLocally(name, ' - run `agentage setup` to sync.'),
+        };
+    }
+    const links = deps.links();
+    let res;
+    try {
+        res = await deps.post(auth, links, `${links.api}/memories`, { name, channel: 'couch' });
+    }
+    catch {
+        return {
+            status: 'offline',
+            message: registeredLocally(name, ' - will provision when online.'),
+        };
+    }
+    if (res.status === 201)
+        return { status: 'provisioned', message: `Provisioned account vault '${name}'.` };
+    if (res.status === 200)
+        return { status: 'exists', message: `Account vault '${name}' already provisioned.` };
+    if (res.status === 401)
+        return {
+            status: 'unauthenticated',
+            message: registeredLocally(name, ' - run `agentage setup` to sync.'),
+        };
+    const code = await errorCode(res);
+    if (res.status === 403 && code === 'CHANNEL_DISABLED')
+        return {
+            status: 'disabled',
+            message: registeredLocally(name, '. Account sync is not enabled on this server.'),
+        };
+    if (res.status === 409 && code === 'CHANNEL_CONFLICT')
+        return {
+            status: 'conflict',
+            message: registeredLocally(name, `. A memory named '${name}' already exists on another channel - not syncing.`),
+        };
+    // Any other status stays non-fatal: keep the local entry, let the daemon retry later.
+    return { status: 'offline', message: registeredLocally(name, ' - will provision when online.') };
+};

package/dist/lib/daemon/daemon-client.d.ts

@@ -0,0 +1,39 @@
+import { type SyncResult } from '../../sync/git/cycle.js';
+import { type CouchSyncResult } from '../../sync/couch/manager.js';
+import { type SyncStatus } from '../../sync/git/manager.js';
+export type SyncRunResult = SyncResult | CouchSyncResult;
+import { type MemoryClient } from '../memory/memory-client.js';
+export interface Health {
+    ok: boolean;
+    version: string;
+    pid: number;
+    uptime: number;
+    served: number;
+    mcp?: boolean;
+}
+export declare const health: (port: number, timeoutMs?: number) => Promise<Health | null>;
+export declare const syncStatus: (port: number, timeoutMs?: number) => Promise<SyncStatus | null>;
+export declare const syncRun: (port: number, vault: string) => Promise<SyncRunResult>;
+export declare const waitForHealth: (port: number, opts?: {
+    timeoutMs?: number;
+    intervalMs?: number;
+}) => Promise<boolean>;
+export declare const createDaemonClient: (port: number) => MemoryClient;
+export declare const mismatchNotice: (daemonVersion: string) => string | null;
+export type SpawnOutcome = {
+    ok: true;
+} | {
+    ok: false;
+    reason: 'port-in-use' | 'unreachable' | 'blocked';
+};
+export declare const spawnDaemon: (port: number, opts?: {
+    timeoutMs?: number;
+    noMcp?: boolean;
+}) => Promise<SpawnOutcome>;
+export interface EnsureDeps {
+    port?: number;
+    probe?: (port: number) => Promise<Health | null>;
+    spawn?: (port: number) => Promise<SpawnOutcome>;
+    readToken?: () => string | null;
+}
+export declare const ensureDaemon: (deps?: EnsureDeps) => Promise<MemoryClient | null>;

package/dist/lib/daemon/daemon-client.js

@@ -0,0 +1,134 @@
+import { spawn as spawnChild } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import chalk from 'chalk';
+import { EADDRINUSE_EXIT_CODE, readDaemonToken, resolvePort } from '../../daemon/lifecycle.js';
+import { VERSION } from '../../utils/version.js';
+const base = (port) => `http://127.0.0.1:${port}`;
+// The 0600 token file is the daemon's auth: read it fresh per call so a restart's new token is
+// picked up; absent means we cannot authenticate, so /api/* will 401 and callers fall back.
+const apiHeaders = () => {
+    const token = readDaemonToken();
+    return { 'Content-Type': 'application/json', ...(token ? { 'X-Agentage-Token': token } : {}) };
+};
+const post = async (port, verb, body) => {
+    const res = await fetch(`${base(port)}/api/memory/${verb}`, {
+        method: 'POST',
+        headers: apiHeaders(),
+        body: JSON.stringify(body),
+    });
+    if (!res.ok) {
+        const data = (await res.json().catch(() => ({})));
+        throw new Error(data.error || `daemon request failed: ${res.status}`);
+    }
+    return res.json();
+};
+export const health = async (port, timeoutMs = 1000) => {
+    try {
+        const res = await fetch(`${base(port)}/api/health`, {
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        return res.ok ? (await res.json()) : null;
+    }
+    catch {
+        return null;
+    }
+};
+// Read the daemon's per-vault sync state (last run, last error); null when the endpoint is absent
+// (an older daemon) or unreachable.
+export const syncStatus = async (port, timeoutMs = 1000) => {
+    try {
+        const res = await fetch(`${base(port)}/api/sync/status`, {
+            headers: apiHeaders(),
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        return res.ok ? (await res.json()) : null;
+    }
+    catch {
+        return null;
+    }
+};
+// Ask the daemon to sync one vault now; the daemon runs the cycle in its own process. The result
+// shape depends on the vault's channel (git SyncResult vs account CouchSyncResult).
+export const syncRun = async (port, vault) => {
+    const res = await fetch(`${base(port)}/api/sync/run`, {
+        method: 'POST',
+        headers: apiHeaders(),
+        body: JSON.stringify({ vault }),
+    });
+    if (!res.ok) {
+        const data = (await res.json().catch(() => ({})));
+        throw new Error(data.error || `sync request failed: ${res.status}`);
+    }
+    return res.json();
+};
+export const waitForHealth = async (port, opts = {}) => {
+    const intervalMs = opts.intervalMs ?? 100;
+    const deadline = Date.now() + (opts.timeoutMs ?? 4000);
+    while (Date.now() < deadline) {
+        if (await health(port, intervalMs + 200))
+            return true;
+        await new Promise((r) => setTimeout(r, intervalMs));
+    }
+    return false;
+};
+// A thin MemoryClient over HTTP: every method is a pass-through POST; the daemon's in-process
+// DirectClient does the vault scoping, so the wire carries the raw ref + opts unchanged.
+export const createDaemonClient = (port) => ({
+    search: (query, opts) => post(port, 'search', { query, opts }),
+    read: (ref, opts) => post(port, 'read', { ref, opts }),
+    write: (ref, body, opts) => post(port, 'write', { ref, body, opts }),
+    edit: (ref, op, opts) => post(port, 'edit', { ref, op, opts }),
+    list: (folder, opts) => post(port, 'list', { folder, opts }),
+    delete: (ref, opts) => post(port, 'delete', { ref, opts }),
+});
+// A restart hint when the running daemon predates the current binary.
+export const mismatchNotice = (daemonVersion) => daemonVersion === VERSION
+    ? null
+    : `daemon version ${daemonVersion} != cli ${VERSION}; restart with: agentage daemon stop && agentage daemon start`;
+const entryPath = () => fileURLToPath(new URL('../../daemon-entry.js', import.meta.url));
+// Detached spawn (not fork: fork's IPC channel keeps the parent event loop alive past unref) so
+// the daemon outlives this CLI; ignore stdio + unref so the CLI can exit. Watches the child's exit
+// so a fast EADDRINUSE death short-circuits the health wait instead of burning the full timeout.
+export const spawnDaemon = async (port, opts = {}) => {
+    let child;
+    try {
+        child = spawnChild(process.execPath, [entryPath()], {
+            detached: true,
+            stdio: 'ignore',
+            env: {
+                ...process.env,
+                AGENTAGE_DAEMON_PORT: String(port),
+                ...(opts.noMcp ? { AGENTAGE_DAEMON_NO_MCP: '1' } : {}),
+            },
+        });
+    }
+    catch {
+        return { ok: false, reason: 'blocked' };
+    }
+    const exited = new Promise((resolve) => {
+        child.once('exit', (code) => resolve({ ok: false, reason: code === EADDRINUSE_EXIT_CODE ? 'port-in-use' : 'unreachable' }));
+    });
+    child.unref();
+    const healthy = waitForHealth(port, { timeoutMs: opts.timeoutMs ?? 4000 }).then((ok) => (ok ? { ok: true } : { ok: false, reason: 'unreachable' }));
+    return Promise.race([healthy, exited]);
+};
+// DO3/DO4/DO9: prefer a live daemon, autostart one if absent, and return null when it is
+// unreachable, cannot be spawned, or has no readable token (nothing to authenticate with) so the
+// caller falls back to the in-process DirectClient.
+export const ensureDaemon = async (deps = {}) => {
+    const port = deps.port ?? resolvePort();
+    const probe = deps.probe ?? health;
+    const spawn = deps.spawn ?? spawnDaemon;
+    const readToken = deps.readToken ?? readDaemonToken;
+    const existing = await probe(port);
+    if (existing) {
+        if (!readToken())
+            return null;
+        const notice = mismatchNotice(existing.version);
+        if (notice)
+            console.error(chalk.yellow(notice));
+        return createDaemonClient(port);
+    }
+    const outcome = await spawn(port).catch(() => ({ ok: false, reason: 'blocked' }));
+    return outcome.ok && readToken() ? createDaemonClient(port) : null;
+};

package/dist/lib/daemon/daemon-pref.d.ts

@@ -0,0 +1,2 @@
+export declare const disableDaemon: () => void;
+export declare const daemonDisabled: () => boolean;

package/dist/lib/daemon/daemon-pref.js

@@ -0,0 +1,10 @@
+// Whether the memory verbs must run in-process (DirectClient) instead of via the daemon.
+// Set by the `--no-daemon` global flag or AGENTAGE_NO_DAEMON=1 (tests/sandbox/CI).
+let forced = false;
+export const disableDaemon = () => {
+    forced = true;
+};
+export const daemonDisabled = () => {
+    const env = process.env['AGENTAGE_NO_DAEMON'];
+    return forced || env === '1' || env === 'true';
+};

package/dist/lib/{config.d.ts → fs/config.d.ts}

@@ -17,4 +17,4 @@ export declare const ensureConfigDir: () => string;
 export declare const readAuth: () => AuthState | null;
 export declare const saveAuth: (state: AuthState) => void;
 export declare const deleteAuth: () => void;
-//# sourceMappingURL=config.d.ts.map
+export declare const mutateAuth: (fn: (current: AuthState | null) => AuthState | null | void) => Promise<AuthState | null>;

package/dist/lib/fs/config.js

@@ -0,0 +1,55 @@
+import { randomBytes } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { withFileLock } from './file-lock.js';
+export const getConfigDir = () => process.env['AGENTAGE_CONFIG_DIR'] || join(process.env['HOME'] || homedir(), '.agentage');
+export const ensureConfigDir = () => {
+    const dir = getConfigDir();
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    return dir;
+};
+const authPath = () => join(getConfigDir(), 'auth.json');
+export const readAuth = () => {
+    const path = authPath();
+    if (!existsSync(path))
+        return null;
+    try {
+        return JSON.parse(readFileSync(path, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+};
+// Atomic 0600 write: a token file is never left half-written or briefly world-readable. Write a
+// per-save sibling temp (unique name: concurrent savers can never clobber each other's tmp),
+// chmod it 0600 BEFORE the rename, then rename over the target in one step.
+export const saveAuth = (state) => {
+    ensureConfigDir();
+    const path = authPath();
+    const tmp = `${path}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+    writeFileSync(tmp, JSON.stringify(state, null, 2) + '\n', { encoding: 'utf-8', mode: 0o600 });
+    chmodSync(tmp, 0o600);
+    renameSync(tmp, path);
+};
+export const deleteAuth = () => {
+    const path = authPath();
+    if (existsSync(path))
+        unlinkSync(path);
+};
+// Cross-process-safe read-modify-write on auth.json (issue #231). Under the advisory lock, re-read
+// FRESH from disk, apply `fn`, then atomic-save - so a foreground sign-in and a background token
+// refresh can never clobber each other. `fn` may return a new state, mutate the fresh one and return
+// void, or leave a null re-read null (a concurrent sign-out is never resurrected). Any network
+// refresh must run BEFORE this call, never under the lock. Returns the state on disk after the call.
+export const mutateAuth = async (fn) => {
+    ensureConfigDir();
+    return withFileLock(authPath(), () => {
+        const current = readAuth();
+        const next = fn(current) ?? current;
+        if (next)
+            saveAuth(next);
+        return next;
+    });
+};

package/dist/lib/fs/file-lock.d.ts

@@ -0,0 +1,3 @@
+export declare const acquireFileLock: (target: string, now?: number) => boolean;
+export declare const releaseFileLock: (target: string) => void;
+export declare const withFileLock: <T>(target: string, fn: () => T) => Promise<T>;