@amalgm/shell 0.1.163 → 0.1.164-main.34182745507

package/dist/service/systemd.js

@@ -6,34 +6,11 @@ import { stopKeepalive } from "./control.js";
  */
 import { existsSync, rmSync } from "node:fs";
 import { dirname } from "node:path";
-import { systemdQuote, systemdUnavailableOutput, systemdUnitPath } from "@amalgm/core/supervision";
+import { systemdUnavailableOutput, systemdUnitPath } from "@amalgm/core/supervision";
 import { atomicWrite, ensureUserDir } from "../filesystem.js";
 import { keepaliveCommand, osCommand, serviceEnvironment } from "./adapter.js";
-const RESTART_SEC = 5;
-/** SIGTERM to the keepalive, SIGKILL to the whole group after this. */
-const TIMEOUT_STOP_SEC = 30;
-export function renderSystemdUnit(input) {
-    const env = Object.entries(input.environment)
-        .map(([key, value]) => `Environment=${systemdQuote(`${key}=${value}`)}`)
-        .join("\n");
-    return `[Unit]
-Description=Amalgm always-on runtime
-StartLimitIntervalSec=0
-
-[Service]
-Type=exec
-WorkingDirectory=${systemdQuote(input.workingDirectory)}
-${env}
-ExecStart=${input.command.map(systemdQuote).join(" ")}
-Restart=on-failure
-RestartSec=${RESTART_SEC}
-KillMode=mixed
-TimeoutStopSec=${TIMEOUT_STOP_SEC}
-
-[Install]
-WantedBy=default.target
-`;
-}
+import { renderSystemdUnit } from './systemd-unit.js';
+export { renderSystemdUnit } from './systemd-unit.js';
 /** Does this login have a user manager to talk to? Containers and bare SSH often do not. */
 export function userSystemdAvailable() {
     const probe = osCommand("systemctl", ["--user", "show-environment"], { tolerate: true });
@@ -49,14 +26,15 @@ export const systemdOwner = {
     backend: "systemd",
     files: (identity) => ({ unit: unit(identity) }),
     async install(identity, launcher, keepaliveArgs) {
-        await stopKeepalive(identity);
-        const file = unit(identity);
-        ensureUserDir(dirname(file));
-        atomicWrite(file, renderSystemdUnit({
+        const description = renderSystemdUnit({
             command: keepaliveCommand(launcher, keepaliveArgs),
             environment: serviceEnvironment(identity),
             workingDirectory: identity.home,
-        }), 0o644);
+        });
+        await stopKeepalive(identity);
+        const file = unit(identity);
+        ensureUserDir(dirname(file));
+        atomicWrite(file, description, 0o644);
         systemctl(["daemon-reload"]);
         // A selected data home need not be in the OS account's unit search path.
         // Enabling the absolute file also links it into that account's user manager.

package/dist/service/systemd.js.map

@@ -1 +1 @@
-{"version":3,"file":"systemd.js","sourceRoot":"","sources":["../../src/service/systemd.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,YAAY,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEnG,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE9D,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,kBAAkB,EAAuC,MAAM,cAAc,CAAC;AAEpH,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,MAAM,UAAU,iBAAiB,CAAC,KAIjC;IACC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;SAC1C,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,eAAe,YAAY,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,EAAE,CAAC;SACvE,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;;;;;;mBAMU,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC;EACrD,GAAG;YACO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;;aAExC,WAAW;;iBAEP,gBAAgB;;;;CAIhC,CAAC;AACF,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC,EAAE,IAAI,CAAC,wBAAwB,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,IAAI,CAAC,QAAyB;IACrC,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,IAAuB,EAAE,QAAQ,GAAG,KAAK;IAC1D,OAAO,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/C,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa;QAC7C,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7B,WAAW,CAAC,IAAI,EAAE,iBAAiB,CAAC;YAClC,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE,aAAa,CAAC;YAClD,WAAW,EAAE,kBAAkB,CAAC,QAAQ,CAAC;YACzC,gBAAgB,EAAE,QAAQ,CAAC,IAAI;SAChC,CAAC,EAAE,KAAK,CAAC,CAAC;QACX,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;QAC7B,yEAAyE;QACzE,6EAA6E;QAC7E,SAAS,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5B,SAAS,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,KAAK,CAAC,QAAQ;QACZ,SAAS,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,QAAQ;QACjB,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9B,SAAS,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,CAAC,QAAQ;QACb,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;QAClI,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,IAAI,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;QAC5G,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;QACvC,OAAO;YACL,UAAU;YACV,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI;YAC3D,KAAK,EAAE,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM;YACpF,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;SAC1B,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,QAAQ;QACtB,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9B,SAAS,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,SAAS,CAAC,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,CAAC;QACnC,SAAS,CAAC,CAAC,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;CACF,CAAC"}
+{"version":3,"file":"systemd.js","sourceRoot":"","sources":["../../src/service/systemd.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAErF,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE9D,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,kBAAkB,EAAuC,MAAM,cAAc,CAAC;AACpH,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,4FAA4F;AAC5F,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC,EAAE,IAAI,CAAC,wBAAwB,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,IAAI,CAAC,QAAyB;IACrC,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,IAAuB,EAAE,QAAQ,GAAG,KAAK;IAC1D,OAAO,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/C,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa;QAC7C,MAAM,WAAW,GAAG,iBAAiB,CAAC;YACpC,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE,aAAa,CAAC;YAClD,WAAW,EAAE,kBAAkB,CAAC,QAAQ,CAAC;YACzC,gBAAgB,EAAE,QAAQ,CAAC,IAAI;SAChC,CAAC,CAAC;QACH,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7B,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QACtC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;QAC7B,yEAAyE;QACzE,6EAA6E;QAC7E,SAAS,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5B,SAAS,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,KAAK,CAAC,QAAQ;QACZ,SAAS,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,QAAQ;QACjB,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9B,SAAS,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,CAAC,QAAQ;QACb,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;QAClI,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,IAAI,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;QAC5G,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;QACvC,OAAO;YACL,UAAU;YACV,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI;YAC3D,KAAK,EAAE,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM;YACpF,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;SAC1B,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,QAAQ;QACtB,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9B,SAAS,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,SAAS,CAAC,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,CAAC;QACnC,SAAS,CAAC,CAAC,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;CACF,CAAC"}

package/dist/service/windows-action.d.ts

@@ -0,0 +1,9 @@
+import { type ChildRestartPolicy } from '@amalgm/core/supervision';
+export declare const encodePowerShell: (source: string) => string;
+export declare function jsonExpression(value: unknown): string;
+export declare function powershellExecutable(env?: NodeJS.ProcessEnv): string;
+/** Microsoft argv quoting goes directly to ProcessStartInfo, without a shell. */
+export declare function quoteWindowsArgument(value: string): string;
+/** Scheduler owns this action's logged-in lifetime. Its launch-retry setting
+ * cannot observe controller exits, so this native port applies Core's policy. */
+export declare function windowsControllerAction(command: readonly string[], workingDirectory: string, restartPolicy?: ChildRestartPolicy): string;

package/dist/service/windows-action.js

@@ -0,0 +1,55 @@
+import { win32 } from 'node:path';
+import { CHILD_RESTART_POLICY } from '@amalgm/core/supervision';
+export const encodePowerShell = (source) => Buffer.from(source, 'utf16le').toString('base64');
+export function jsonExpression(value) {
+    return `ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${Buffer.from(JSON.stringify(value), 'utf8').toString('base64')}')))`;
+}
+export function powershellExecutable(env = process.env) {
+    return win32.join(env.SystemRoot || 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+}
+/** Microsoft argv quoting goes directly to ProcessStartInfo, without a shell. */
+export function quoteWindowsArgument(value) {
+    if (value.includes('\0'))
+        throw new Error('A process argument cannot contain NUL.');
+    return `"${value.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, '$1$1')}"`;
+}
+/** Scheduler owns this action's logged-in lifetime. Its launch-retry setting
+ * cannot observe controller exits, so this native port applies Core's policy. */
+export function windowsControllerAction(command, workingDirectory, restartPolicy = CHILD_RESTART_POLICY) {
+    if (!command.length || !command[0])
+        throw new Error('The controller needs an executable.');
+    return encodePowerShell(`
+$ErrorActionPreference = 'Stop'
+$launch = ${jsonExpression({ executable: command[0], arguments: command.slice(1).map(quoteWindowsArgument).join(' '), workingDirectory })}
+$policy = ${jsonExpression(restartPolicy)}
+$start = New-Object System.Diagnostics.ProcessStartInfo
+$start.FileName = $launch.executable
+$start.Arguments = $launch.arguments
+$start.WorkingDirectory = $launch.workingDirectory
+$start.UseShellExecute = $false
+$start.CreateNoWindow = $true
+$clock = [Diagnostics.Stopwatch]::StartNew()
+$history = @()
+$delay = $policy.initialDelayMs
+while ($true) {
+  $started = $clock.ElapsedMilliseconds
+  $runtimeProcess = $null
+  $result = 1
+  try {
+    $runtimeProcess = [System.Diagnostics.Process]::Start($start)
+    $runtimeProcess.WaitForExit()
+    $result = $runtimeProcess.ExitCode
+  } catch { [Console]::Error.WriteLine($_.Exception.Message) }
+  finally { if ($runtimeProcess) { $runtimeProcess.Dispose() } }
+  if ($result -eq 0) { exit 0 }
+  $now = $clock.ElapsedMilliseconds
+  if ($now - $started -ge $policy.stableAfterMs) { $delay = $policy.initialDelayMs; $history = @() }
+  $history = @($history | Where-Object { $now - $_ -le $policy.windowMs })
+  if ($history.Count -ge $policy.maxRestarts) { exit $result }
+  $history += $now
+  Start-Sleep -Milliseconds $delay
+  $delay = [Math]::Min($delay * 2, $policy.maxDelayMs)
+}
+`);
+}
+//# sourceMappingURL=windows-action.js.map

package/dist/service/windows-action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows-action.js","sourceRoot":"","sources":["../../src/service/windows-action.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,oBAAoB,EAA2B,MAAM,0BAA0B,CAAC;AAEzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC9G,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,kFAAkF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;AAC/J,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACvE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAChH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACpF,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;AAC9E,CAAC;AAED;iFACiF;AACjF,MAAM,UAAU,uBAAuB,CAAC,OAA0B,EAAE,gBAAwB,EAC1F,gBAAoC,oBAAoB;IACxD,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3F,OAAO,gBAAgB,CAAC;;YAEd,cAAc,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,CAAC;YAC7H,cAAc,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BxC,CAAC,CAAC;AACH,CAAC"}

package/dist/service/windows-task.d.ts

@@ -1,11 +1,4 @@
-export declare function encodePowerShell(source: string): string;
-/** Microsoft command-line quoting, applied directly to ProcessStartInfo.
- * No cmd.exe, environment expansion, or shell interpretation is involved. */
-export declare function quoteWindowsArgument(value: string): string;
-export declare function powershellExecutable(env?: NodeJS.ProcessEnv): string;
-/** The scheduler must observe the controller's real lifetime and exit code.
- * A hidden, waiting host wrapper does not make any recovery decisions. */
-export declare function windowsControllerAction(command: readonly string[], workingDirectory: string): string;
+export { encodePowerShell, powershellExecutable, quoteWindowsArgument, windowsControllerAction } from './windows-action.js';
 export type WindowsTaskOperation = 'install' | 'start' | 'disable' | 'stop' | 'status' | 'uninstall';
 /** All interpolated input is encoded JSON data. Task Scheduler runs under the
  * current account's interactive token and never stores an account password. */

package/dist/service/windows-task.js

@@ -1,49 +1,13 @@
-import { win32 } from 'node:path';
 import { CHILD_RESTART_POLICY } from '@amalgm/core/supervision';
-export function encodePowerShell(source) {
-    return Buffer.from(source, 'utf16le').toString('base64');
-}
-/** Microsoft command-line quoting, applied directly to ProcessStartInfo.
- * No cmd.exe, environment expansion, or shell interpretation is involved. */
-export function quoteWindowsArgument(value) {
-    if (value.includes('\0'))
-        throw new Error('A process argument cannot contain NUL.');
-    return `"${value.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/, '$1$1')}"`;
-}
-export function powershellExecutable(env = process.env) {
-    return win32.join(env.SystemRoot || 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
-}
-function jsonExpression(value) {
-    const encoded = Buffer.from(JSON.stringify(value), 'utf8').toString('base64');
-    return `ConvertFrom-Json ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encoded}')))`;
-}
-/** The scheduler must observe the controller's real lifetime and exit code.
- * A hidden, waiting host wrapper does not make any recovery decisions. */
-export function windowsControllerAction(command, workingDirectory) {
-    if (!command.length || !command[0])
-        throw new Error('The controller needs an executable.');
-    return encodePowerShell(`
-$ErrorActionPreference = 'Stop'
-$launch = ${jsonExpression({ executable: command[0], arguments: command.slice(1).map(quoteWindowsArgument).join(' '), workingDirectory })}
-$start = New-Object System.Diagnostics.ProcessStartInfo
-$start.FileName = $launch.executable
-$start.Arguments = $launch.arguments
-$start.WorkingDirectory = $launch.workingDirectory
-$start.UseShellExecute = $false
-$start.CreateNoWindow = $true
-$runtimeProcess = [System.Diagnostics.Process]::Start($start)
-try {
-  $runtimeProcess.WaitForExit()
-  $result = $runtimeProcess.ExitCode
-} finally { $runtimeProcess.Dispose() }
-exit $result
-`);
-}
+import { encodePowerShell, jsonExpression, powershellExecutable } from './windows-action.js';
+export { encodePowerShell, powershellExecutable, quoteWindowsArgument, windowsControllerAction } from './windows-action.js';
 /** All interpolated input is encoded JSON data. Task Scheduler runs under the
  * current account's interactive token and never stores an account password. */
 export function windowsTaskOperation(input) {
     const request = { ...input, executable: powershellExecutable(),
         restartCount: CHILD_RESTART_POLICY.maxRestarts,
+        // MS-TSCH 2.5.4.2: these retries cover failure to start an action, not its exit.
+        // https://learn.microsoft.com/openspecs/windows_protocols/ms-tsch/2ff4aa5a-7bc4-449f-bbb1-27475645867f
         // Task Scheduler's supported minimum is one minute.
         // https://learn.microsoft.com/windows/win32/taskschd/taskschedulerschema-restarttype-complextype
         restartIntervalMs: Math.max(60_000, CHILD_RESTART_POLICY.initialDelayMs) };

package/dist/service/windows-task.js.map

@@ -1 +1 @@
-{"version":3,"file":"windows-task.js","sourceRoot":"","sources":["../../src/service/windows-task.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED;6EAC6E;AAC7E,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACpF,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACvE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAChH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC9E,OAAO,kFAAkF,OAAO,MAAM,CAAC;AACzG,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,uBAAuB,CAAC,OAA0B,EAAE,gBAAwB;IAC1F,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3F,OAAO,gBAAgB,CAAC;;YAEd,cAAc,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,CAAC;;;;;;;;;;;;;CAaxI,CAAC,CAAC;AACH,CAAC;AAID;+EAC+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,MAAM,OAAO,GAAG,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,oBAAoB,EAAE;QAC5D,YAAY,EAAE,oBAAoB,CAAC,WAAW;QAC9C,oDAAoD;QACpD,iGAAiG;QACjG,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,cAAc,CAAC,EAAE,CAAC;IAC7E,OAAO,gBAAgB,CAAC;;aAEb,cAAc,CAAC,OAAO,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BnC,CAAC,CAAC;AACH,CAAC"}
+{"version":3,"file":"windows-task.js","sourceRoot":"","sources":["../../src/service/windows-task.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAI5H;+EAC+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,MAAM,OAAO,GAAG,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,oBAAoB,EAAE;QAC5D,YAAY,EAAE,oBAAoB,CAAC,WAAW;QAC9C,iFAAiF;QACjF,uGAAuG;QACvG,oDAAoD;QACpD,iGAAiG;QACjG,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,cAAc,CAAC,EAAE,CAAC;IAC7E,OAAO,gBAAgB,CAAC;;aAEb,cAAc,CAAC,OAAO,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BnC,CAAC,CAAC;AACH,CAAC"}

package/dist/service/windows.js

@@ -1,5 +1,5 @@
-/** Windows Task Scheduler owns a hidden controller in the current account's
- * logged-in lifetime, including Core's bounded automatic crash recovery. */
+/** Windows Task Scheduler owns a hidden action in the current account's
+ * logged-in lifetime; that action applies Core's controller recovery policy. */
 import { existsSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { windowsStartupScriptPath } from '@amalgm/core/supervision';
@@ -49,7 +49,7 @@ export const windowsOwner = {
         return {
             registered: native.registered && existsSync(definition(identity)), loaded: native.registered,
             state: controller?.alive ? 'running' : native.state?.toLowerCase() || 'not registered',
-            pid: controller?.alive ? controller.pid : null,
+            pid: controller?.alive ? controller.bootstrapPid ?? controller.pid : null,
             ...(native.lastResult ? { detail: `Task Scheduler result: ${native.lastResult}` } : {}),
         };
     },

package/dist/service/windows.js.map

@@ -1 +1 @@
-{"version":3,"file":"windows.js","sourceRoot":"","sources":["../../src/service/windows.ts"],"names":[],"mappings":"AAAA;4EAC4E;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE9D,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAqB,MAAM,cAAc,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,oBAAoB,EAA6B,MAAM,mBAAmB,CAAC;AAEnI,MAAM,UAAU,GAAG,CAAC,QAAyB,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;AACjG,MAAM,IAAI,GAAG,CAAC,QAAyB,EAAE,SAA+B,EAAE,MAAe,EAAE,EAAE,CAAC,SAAS,CACrG,oBAAoB,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,CAAC;QAChG,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC,CACJ,CAAC;AAEF,KAAK,UAAU,iBAAiB,CAAC,QAAyB;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK;YAAE,OAAO;QACrD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,KAAK,oDAAoD,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;AACnI,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;IACrD,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa;QAC7C,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjG,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAClC,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAClC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9F,2EAA2E;QAC3E,MAAM,CAAC,wBAAwB,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChI,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,QAAQ;QAClB,IAAI,CAAC,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK;YAAE,OAAO;QACrD,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACxB,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,QAAQ;QACjB,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1B,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,QAAQ;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAiE,CAAC;QAC3H,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU;YAC5F,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,gBAAgB;YACtF,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YAC9C,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,0BAA0B,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,QAAQ;QACtB,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1B,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvB,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC5B,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,wBAAwB,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChI,CAAC;CACF,CAAC"}
+{"version":3,"file":"windows.js","sourceRoot":"","sources":["../../src/service/windows.ts"],"names":[],"mappings":"AAAA;gFACgF;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE9D,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAqB,MAAM,cAAc,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,oBAAoB,EAA6B,MAAM,mBAAmB,CAAC;AAEnI,MAAM,UAAU,GAAG,CAAC,QAAyB,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;AACjG,MAAM,IAAI,GAAG,CAAC,QAAyB,EAAE,SAA+B,EAAE,MAAe,EAAE,EAAE,CAAC,SAAS,CACrG,oBAAoB,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,CAAC;QAChG,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC,CACJ,CAAC;AAEF,KAAK,UAAU,iBAAiB,CAAC,QAAyB;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK;YAAE,OAAO;QACrD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,KAAK,oDAAoD,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;AACnI,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;IACrD,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa;QAC7C,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjG,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAClC,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAClC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9F,2EAA2E;QAC3E,MAAM,CAAC,wBAAwB,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChI,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,QAAQ;QAClB,IAAI,CAAC,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK;YAAE,OAAO;QACrD,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACxB,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,QAAQ;QACjB,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1B,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,QAAQ;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAiE,CAAC;QAC3H,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU;YAC5F,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,gBAAgB;YACtF,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YACzE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,0BAA0B,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,QAAQ;QACtB,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1B,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvB,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC5B,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,wBAAwB,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChI,CAAC;CACF,CAAC"}

package/dist/sqlite.d.ts

@@ -0,0 +1,4 @@
+import Database from 'better-sqlite3';
+/** Every persistent SQLite handle names the same OS file as Node's filesystem.
+ * The Windows namespace prefix bypasses legacy Win32 MAX_PATH interpretation. */
+export declare function openFileDatabase(file: string, options?: Database.Options): Database.Database;

package/dist/sqlite.js

@@ -0,0 +1,16 @@
+import Database from 'better-sqlite3';
+import { resolve, toNamespacedPath } from 'node:path';
+/** Every persistent SQLite handle names the same OS file as Node's filesystem.
+ * The Windows namespace prefix bypasses legacy Win32 MAX_PATH interpretation. */
+export function openFileDatabase(file, options) {
+    const filename = toNamespacedPath(resolve(file));
+    try {
+        return new Database(filename, options);
+    }
+    catch (error) {
+        if (error instanceof Error)
+            error.message = `SQLite ${JSON.stringify(file)}: ${error.message}`;
+        throw error;
+    }
+}
+//# sourceMappingURL=sqlite.js.map

package/dist/sqlite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite.js","sourceRoot":"","sources":["../src/sqlite.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAEtD;iFACiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAA0B;IACvE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC;QAAC,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAAC,CAAC;IAC/C,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,KAAK;YAAE,KAAK,CAAC,OAAO,GAAG,UAAU,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QAC/F,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/updates/artifacts.d.ts

@@ -0,0 +1,40 @@
+import type { AcceptedRuntimeRelease } from '@amalgm/core/supervision';
+import type { ServiceIdentity } from '../service/registration.js';
+export declare class RuntimeDownloadError extends Error {
+}
+export declare class RuntimeCommandError extends Error {
+    readonly stdout: string;
+    readonly exitCode: number | null;
+    constructor(message: string, stdout: string, exitCode: number | null);
+}
+/** Only npm's structured top-level error classifies dependency transport.
+ * Script diagnostics, integrity failures and preflight output never do. */
+export declare function classifyNpmFailure(error: unknown): unknown;
+export declare const RUNTIME_CONTRACT: Readonly<{
+    schema: 1;
+    controllerProtocol: 1;
+    nodeMajor: 24;
+    platforms: string[];
+    protocol: 1;
+    stores: Readonly<{
+        id: "installation";
+        reads: {
+            min: number;
+            max: number;
+        };
+        writes: 1;
+    }>[];
+}>;
+export declare function managedPackage(root?: string): boolean;
+export declare function artifactDirectory(identity: ServiceIdentity, release: AcceptedRuntimeRelease): string;
+export declare function hashFile(file: string): Promise<string>;
+export declare function examineArchive(file: string, directory: string): Promise<readonly string[]>;
+export declare function runIsolated(node: string, args: readonly string[], cwd: string, signal: AbortSignal, timeout?: number): Promise<string>;
+/** New generations never overwrite packages that an existing process can read.
+ * The receipt is written only after strict installation and isolated preflight. */
+export declare function stageRuntime(identity: ServiceIdentity, release: AcceptedRuntimeRelease, node: string, signal: AbortSignal, installedBaseline?: string): Promise<string>;
+export declare function collectRuntimeArtifacts(identity: ServiceIdentity, retained: readonly string[]): Promise<void>;
+/** Called only after the new controller owns the exclusive controller lease,
+ * before discovery or staging starts. An isolated command's own lease remains
+ * authoritative even if the controller that spawned it has already exited. */
+export declare function collectAbandonedUpdateWork(identity: ServiceIdentity): Promise<void>;

package/dist/updates/artifacts.js

@@ -0,0 +1,299 @@
+import { spawn } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import { createServer } from 'node:net';
+import { createRequire } from 'node:module';
+import { createReadStream, existsSync } from 'node:fs';
+import { lstat, mkdir, mkdtemp, readFile, readdir, rename, rm, writeFile } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+import { extract, list } from 'tar';
+import { BaseFetcher } from 'tuf-js';
+import { acquireProcessLease } from '../installation/lease.js';
+import { installedPackage, packageRoot, RUNTIME_FORMAT, CONTROLLER_PROTOCOL } from './store.js';
+const require = createRequire(import.meta.url);
+export class RuntimeDownloadError extends Error {
+}
+export class RuntimeCommandError extends Error {
+    stdout;
+    exitCode;
+    constructor(message, stdout, exitCode) {
+        super(message);
+        this.stdout = stdout;
+        this.exitCode = exitCode;
+    }
+}
+const npmTransportCodes = new Set(['ECONNRESET', 'ECONNREFUSED', 'ETIMEDOUT', 'ESOCKETTIMEDOUT', 'EAI_AGAIN',
+    'ENOTFOUND', 'ENETUNREACH', 'EHOSTUNREACH', 'E408', 'E429', 'E500', 'E502', 'E503', 'E504']);
+/** Only npm's structured top-level error classifies dependency transport.
+ * Script diagnostics, integrity failures and preflight output never do. */
+export function classifyNpmFailure(error) {
+    if (!(error instanceof RuntimeCommandError) || error.exitCode === null)
+        return error;
+    let code;
+    try {
+        code = JSON.parse(error.stdout).error?.code;
+    }
+    catch {
+        return error;
+    }
+    return typeof code === 'string' && npmTransportCodes.has(code)
+        ? new RuntimeDownloadError(`Runtime dependency transport failed (${code})`, { cause: error }) : error;
+}
+export const RUNTIME_CONTRACT = Object.freeze({ schema: 1, controllerProtocol: CONTROLLER_PROTOCOL, nodeMajor: 24,
+    platforms: ['darwin-arm64', 'darwin-x64', 'linux-x64', 'win32-x64'],
+    protocol: 1, stores: [RUNTIME_FORMAT] });
+export function managedPackage(root = packageRoot) {
+    const pkg = installedPackage(root);
+    return pkg.name === 'amalgm' && ['main', 'preview'].includes(pkg.amalgmSource?.branch ?? '');
+}
+export function artifactDirectory(identity, release) {
+    return join(identity.serviceDir, 'generations', release.digest, 'package');
+}
+export async function hashFile(file) {
+    const hash = createHash('sha512');
+    for await (const bytes of createReadStream(file))
+        hash.update(bytes);
+    return hash.digest('hex');
+}
+class RegistryFetcher extends BaseFetcher {
+    signal;
+    constructor(signal) {
+        super();
+        this.signal = signal;
+    }
+    async fetch(url) {
+        const target = new URL(url);
+        if (target.origin !== 'https://registry.npmjs.org')
+            throw new Error('Runtime archive escaped the npm registry');
+        try {
+            const response = await fetch(target, { signal: this.signal, redirect: 'error' });
+            if (!response.ok || !response.body) {
+                const message = `Runtime archive returned HTTP ${response.status}`;
+                if (response.status >= 500 || response.status === 429 || response.status === 404)
+                    throw new RuntimeDownloadError(message);
+                throw new Error(message);
+            }
+            // BaseFetcher consumes this body after fetch() returns. Classify failures
+            // at the transport reader, before archive integrity or disk effects run.
+            const reader = response.body.getReader();
+            return new ReadableStream({
+                async pull(controller) {
+                    try {
+                        const next = await reader.read();
+                        if (next.done) {
+                            reader.releaseLock();
+                            controller.close();
+                        }
+                        else
+                            controller.enqueue(next.value);
+                    }
+                    catch (error) {
+                        reader.releaseLock();
+                        controller.error(new RuntimeDownloadError('Runtime archive transfer was interrupted', { cause: error }));
+                    }
+                },
+                async cancel(reason) { try {
+                    await reader.cancel(reason);
+                }
+                finally {
+                    reader.releaseLock();
+                } },
+            });
+        }
+        catch (error) {
+            if (error instanceof TypeError || error.name === 'TimeoutError')
+                throw new RuntimeDownloadError(String(error));
+            throw error;
+        }
+    }
+}
+export async function examineArchive(file, directory) {
+    const paths = new Set();
+    let size = 0;
+    let invalid = null;
+    await list({ file, strict: true, onReadEntry(entry) {
+            if (invalid)
+                return;
+            const parts = entry.path.replace(/\/$/, '').split('/');
+            if (parts[0] !== 'package' || parts.some(part => !part || part === '.' || part === '..') || entry.path.includes('\\')
+                || !['File', 'Directory'].includes(entry.type) || paths.has(entry.path) || paths.size >= 20_000) {
+                invalid = 'Runtime archive has unsafe or ambiguous entries';
+                return;
+            }
+            paths.add(entry.path);
+            size += entry.size;
+            if (size > 256 * 1024 * 1024)
+                invalid = 'Runtime archive exceeds its expanded bound';
+        } });
+    if (invalid)
+        throw new Error(invalid);
+    await extract({ file, cwd: directory, strict: true, preservePaths: false, noChmod: true });
+    return [...paths].filter(path => !path.endsWith('/'));
+}
+export async function runIsolated(node, args, cwd, signal, timeout = 600_000) {
+    const ownerFile = join(cwd, '.isolated-command.sqlite');
+    const token = randomBytes(32).toString('hex');
+    const streams = new Set();
+    const lifetime = createServer(stream => {
+        streams.add(stream);
+        stream.once('close', () => streams.delete(stream));
+        stream.on('error', () => { });
+        stream.setTimeout(5_000, () => stream.destroy());
+        let admission = '';
+        stream.on('data', bytes => {
+            admission += bytes.toString('utf8');
+            if (admission.length > 65 || !(token + '\n').startsWith(admission))
+                stream.destroy();
+            else if (admission === token + '\n') {
+                stream.setTimeout(0);
+                stream.write('start\n');
+            }
+        });
+    });
+    lifetime.maxConnections = 1;
+    await new Promise((resolveReady, reject) => { lifetime.once('error', reject); lifetime.listen(0, '127.0.0.1', resolveReady); });
+    const address = lifetime.address();
+    if (!address || typeof address === 'string')
+        throw new Error('The isolated command has no parent lifetime address');
+    const env = { ...process.env, npm_config_userconfig: join(cwd, '.release-npmrc'), npm_config_audit: 'false', npm_config_fund: 'false',
+        AMALGM_ISOLATED_COMMAND_LIFETIME: JSON.stringify({ file: ownerFile, timeout, port: address.port, token }) };
+    delete env.NODE_AUTH_TOKEN;
+    delete env.NPM_TOKEN;
+    delete env.NODE_OPTIONS;
+    return await new Promise((resolveResult, reject) => {
+        const child = spawn(node, ['--import', new URL('./isolated-command-lifetime.js', import.meta.url).href, ...args], { cwd, env, stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
+        let bytes = '';
+        let outputBytes = '';
+        let complete = false;
+        let drain;
+        const cancel = () => child.kill('SIGKILL');
+        const timer = setTimeout(cancel, timeout);
+        signal.addEventListener('abort', cancel, { once: true });
+        const clean = () => { clearTimeout(timer); clearTimeout(drain); signal.removeEventListener('abort', cancel); };
+        const output = (chunk) => { bytes = (bytes + chunk.toString('utf8')).slice(-64 * 1024); };
+        child.stdout.on('data', (chunk) => { outputBytes = (outputBytes + chunk.toString('utf8')).slice(-64 * 1024); output(chunk); });
+        child.stderr.on('data', output);
+        child.once('exit', () => {
+            // A script descendant retaining stdout cannot keep the direct command's
+            // result pending after that command has actually exited.
+            drain = setTimeout(() => { child.stdout?.destroy(); child.stderr?.destroy(); }, 1_000);
+            drain.unref();
+        });
+        child.on('error', error => { if (!child.pid) {
+            complete = true;
+            clean();
+            reject(error);
+        } });
+        child.on('close', code => { if (complete)
+            return; clean(); if (code === 0 && !signal.aborted)
+            resolveResult(outputBytes);
+        else
+            reject(new RuntimeCommandError(`Isolated runtime command failed (${code}): ${bytes.slice(-4_000)}`, outputBytes, code)); });
+        if (signal.aborted)
+            cancel();
+    }).finally(async () => {
+        for (const stream of streams)
+            stream.destroy();
+        await new Promise(resolveClosed => lifetime.close(() => resolveClosed()));
+    });
+}
+async function verifyPackage(root, release) {
+    const artifact = release.target.release.units[0].artifact;
+    const pkg = installedPackage(root);
+    if (pkg.name !== artifact.name || pkg.version !== artifact.version
+        || ['repository', 'branch', 'commit'].some(key => Reflect.get(pkg.amalgmSource ?? {}, key) !== Reflect.get(artifact.source, key))
+        || await hashFile(join(root, 'npm-shrinkwrap.json')) !== artifact.lockSha512)
+        throw new Error('Runtime package differs from the signed composition');
+}
+/** New generations never overwrite packages that an existing process can read.
+ * The receipt is written only after strict installation and isolated preflight. */
+export async function stageRuntime(identity, release, node, signal, installedBaseline) {
+    const destination = artifactDirectory(identity, release);
+    if (!installedBaseline && existsSync(join(dirname(destination), 'verified.json'))) {
+        await verifyPackage(destination, release);
+        return destination;
+    }
+    const parent = dirname(dirname(destination));
+    await mkdir(parent, { recursive: true, mode: 0o700 });
+    const scratch = await mkdtemp(join(parent, '.stage-'));
+    try {
+        const artifact = release.target.release.units[0].artifact;
+        const archive = join(scratch, 'runtime.tgz');
+        const fetcher = new RegistryFetcher(AbortSignal.any([signal, AbortSignal.timeout(120_000)]));
+        await fetcher.downloadFile(`https://registry.npmjs.org/amalgm/-/amalgm-${artifact.version}.tgz`, 128 * 1024 * 1024, async (file) => {
+            if (await hashFile(file) !== artifact.sha512)
+                throw new Error('Runtime archive integrity differs from its signed target');
+            await writeFile(archive, await readFile(file));
+        });
+        const files = await examineArchive(archive, scratch);
+        const root = join(scratch, 'package');
+        await verifyPackage(root, release);
+        if (installedBaseline) {
+            await verifyPackage(installedBaseline, release);
+            for (const path of files) {
+                const source = resolve(scratch, path);
+                const relative = path.slice('package/'.length);
+                const stat = await lstat(source);
+                if (stat.isFile() && await hashFile(source) !== await hashFile(join(installedBaseline, relative)))
+                    throw new Error('Installed baseline contains different package bytes');
+            }
+        }
+        await writeFile(join(root, '.release-npmrc'), 'registry=https://registry.npmjs.org/\nstrict-allow-scripts=true\n');
+        const npm = join(dirname(require.resolve('npm/package.json')), 'bin/npm-cli.js');
+        try {
+            await runIsolated(node, [npm, 'ci', '--json', '--omit=dev', '--strict-allow-scripts', '--no-audit', '--no-fund'], root, signal);
+        }
+        catch (error) {
+            throw classifyNpmFailure(error);
+        }
+        const result = await runIsolated(node, [join(root, 'dist/main.js'), 'version', '--runtime-contract'], root, signal, 30_000);
+        const contract = JSON.parse(result.trim());
+        const declared = release.target.release;
+        if (contract.controllerProtocol !== declared.controllerProtocol || contract.nodeMajor !== declared.nodeMajor
+            || contract.protocol !== declared.units[0].protocol || JSON.stringify(contract.stores) !== JSON.stringify(declared.units[0].stores))
+            throw new Error('Runtime preflight contract differs from its signed recipe');
+        await rm(archive);
+        await rm(join(root, '.release-npmrc'));
+        await rm(join(root, '.isolated-command.sqlite'));
+        await writeFile(join(scratch, 'verified.json'), JSON.stringify({ digest: release.digest }));
+        if (existsSync(dirname(destination))) {
+            await verifyPackage(destination, release);
+            return destination;
+        }
+        await rename(scratch, dirname(destination));
+        return destination;
+    }
+    finally {
+        await rm(scratch, { recursive: true, force: true });
+    }
+}
+export async function collectRuntimeArtifacts(identity, retained) {
+    const parent = join(identity.serviceDir, 'generations');
+    for (const entry of await readdir(parent).catch(() => [])) {
+        if (/^[a-f0-9]{64}$/.test(entry) && !retained.includes(entry))
+            await rm(join(parent, entry), { recursive: true, force: true });
+    }
+}
+/** Called only after the new controller owns the exclusive controller lease,
+ * before discovery or staging starts. An isolated command's own lease remains
+ * authoritative even if the controller that spawned it has already exited. */
+export async function collectAbandonedUpdateWork(identity) {
+    const parent = join(identity.serviceDir, 'generations');
+    for (const entry of await readdir(parent, { withFileTypes: true }).catch(() => [])) {
+        if (!entry.isDirectory() || !/^\.stage-[A-Za-z0-9]+$/.test(entry.name))
+            continue;
+        const directory = join(parent, entry.name);
+        const owner = join(directory, 'package', '.isolated-command.sqlite');
+        if (existsSync(owner)) {
+            const lease = acquireProcessLease(owner);
+            if (!lease)
+                continue;
+            lease.close();
+        }
+        await rm(directory, { recursive: true, force: true });
+    }
+    for (const entry of await readdir(identity.serviceDir, { withFileTypes: true })) {
+        if (entry.isDirectory() && /^trust-refresh-[A-Za-z0-9]+$/.test(entry.name))
+            await rm(join(identity.serviceDir, entry.name), { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=artifacts.js.map