@canhta/dsh-autopilot 0.1.0-alpha.1

package/lib/operations/runtime-owner.js

@@ -0,0 +1,281 @@
+import { randomUUID } from 'node:crypto';
+import { lstat, mkdir, open, readFile, realpath, rename, rmdir, stat, unlink } from 'node:fs/promises';
+import { basename, dirname, join, resolve } from 'node:path';
+import { Service } from '@deepseek-ai/cordis';
+import { authoritativeStorePath } from './storage-composition.js';
+const OWNER_FILE = 'owner.json';
+export class RuntimeStoreOwnedError extends Error {
+    owner;
+    constructor(owner) {
+        super(owner === undefined
+            ? 'the Autopilot runtime store has an incomplete owner fence'
+            : `the Autopilot runtime store is already owned by process ${String(owner.pid)} since ${owner.acquiredAt}`);
+        this.owner = owner;
+        this.name = 'RuntimeStoreOwnedError';
+    }
+}
+export class RuntimeStoreConfigurationError extends Error {
+    constructor(configured, authoritative) {
+        super(`runtimeStorePath "${configured}" does not match the authoritative DSH storage backend "${authoritative}"`);
+        this.name = 'RuntimeStoreConfigurationError';
+    }
+}
+/** Hold the one-VPS fence for the authoritative DSH storage medium before Autopilot opens durable state. */
+export class RuntimeOwner extends Service {
+    options;
+    static inject = ['autopilotConfig'];
+    owned;
+    holders = 0;
+    closing = false;
+    waitForHolders;
+    constructor(ctx, options = {}) {
+        super(ctx, 'runtimeOwner');
+        this.options = options;
+    }
+    async *[Service.init]() {
+        await this.ensureOwned();
+        yield async () => {
+            this.closing = true;
+            if (this.holders > 0) {
+                await new Promise((resolve) => {
+                    this.waitForHolders = resolve;
+                });
+            }
+            await this.release();
+        };
+    }
+    /**
+     * Acquire the authoritative DSH storage-medium fence, or prove this service already owns that exact canonical
+     * medium. An optional runtimeStorePath is only a configuration assertion. Unprovable or changed media,
+     * unsafe/incomplete targets and a live owner reject; stale local-process ownership is reclaimed atomically.
+     */
+    async ensureOwned() {
+        if (this.closing)
+            throw new Error('the runtime-store owner is shutting down');
+        const storePath = await canonicalPath(authoritativeStorePath(this.ctx, this.options));
+        const configured = this.ctx.autopilotConfig.get().runtimeStorePath;
+        if (configured !== '') {
+            const configuredPath = await canonicalPath(configured);
+            if (configuredPath !== storePath)
+                throw new RuntimeStoreConfigurationError(configuredPath, storePath);
+        }
+        if (this.owned?.storePath === storePath)
+            return storePath;
+        if (this.owned !== undefined) {
+            throw new Error('the authoritative DSH storage medium cannot change while this Host owns another medium');
+        }
+        const lockPath = `${storePath}.autopilot-owner`;
+        const record = await acquire(lockPath);
+        this.owned = { storePath, lockPath, record };
+        return storePath;
+    }
+    /**
+     * Keep the owner fence alive through a dependent service's complete asynchronous shutdown. Rejects during owner
+     * shutdown; the returned idempotent release callback performs no I/O.
+     */
+    hold() {
+        if (this.closing)
+            throw new Error('the runtime-store owner is shutting down');
+        this.holders += 1;
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            this.holders -= 1;
+            if (this.holders === 0)
+                this.waitForHolders?.();
+        };
+    }
+    /** Return detached owner/fence facts without touching the filesystem; available until this service is disposed. */
+    snapshot() {
+        return this.owned === undefined
+            ? { status: 'unconfigured' }
+            : { status: 'held', storePath: this.owned.storePath, acquiredAt: this.owned.record.acquiredAt };
+    }
+    async release() {
+        const owned = this.owned;
+        if (owned === undefined)
+            return;
+        this.owned = undefined;
+        let current;
+        try {
+            current = await readOwner(owned.lockPath);
+        }
+        catch {
+            return;
+        }
+        if (current?.nonce !== owned.record.nonce)
+            return;
+        const releasePath = `${owned.lockPath}.release-${owned.record.nonce}`;
+        try {
+            await rename(owned.lockPath, releasePath);
+            await removeLockDirectory(releasePath);
+        }
+        catch (error) {
+            if (!isMissing(error))
+                throw error;
+        }
+    }
+}
+async function canonicalPath(path) {
+    const absolute = resolve(path);
+    await mkdir(dirname(absolute), { recursive: true, mode: 0o700 });
+    try {
+        return await realpath(absolute);
+    }
+    catch (error) {
+        if (!isMissing(error))
+            throw error;
+        return join(await realpath(dirname(absolute)), basename(absolute));
+    }
+}
+async function acquire(lockPath) {
+    await mkdir(dirname(lockPath), { recursive: true, mode: 0o700 });
+    for (;;) {
+        const record = await currentOwnerRecord();
+        try {
+            await mkdir(lockPath, { mode: 0o700 });
+            const handle = await open(`${lockPath}/${OWNER_FILE}`, 'wx', 0o600);
+            try {
+                await handle.writeFile(`${JSON.stringify(record)}\n`);
+                await handle.sync();
+            }
+            finally {
+                await handle.close();
+            }
+            return record;
+        }
+        catch (error) {
+            if (!isAlreadyExists(error)) {
+                try {
+                    await removeLockDirectory(lockPath);
+                }
+                catch {
+                    // Preserve the acquisition error; a partial fence fails closed on the next attempt.
+                }
+                throw error;
+            }
+        }
+        let metadata;
+        try {
+            metadata = await lstat(lockPath);
+        }
+        catch (error) {
+            if (isMissing(error))
+                continue;
+            throw error;
+        }
+        if (!metadata.isDirectory() || metadata.isSymbolicLink())
+            throw new RuntimeStoreOwnedError(undefined);
+        const existing = await readOwner(lockPath);
+        if ((existing === undefined && !(await incompleteFenceIsStale(lockPath))) ||
+            (existing !== undefined && (await ownerIsLive(existing)))) {
+            throw new RuntimeStoreOwnedError(existing);
+        }
+        const stalePath = `${lockPath}.stale-${randomUUID()}`;
+        try {
+            await rename(lockPath, stalePath);
+        }
+        catch (error) {
+            if (isMissing(error))
+                continue;
+            throw error;
+        }
+        await removeLockDirectory(stalePath);
+    }
+}
+async function currentOwnerRecord() {
+    const [bootId, processStart] = await Promise.all([linuxBootId(), linuxProcessStart(process.pid)]);
+    return {
+        version: 1,
+        pid: process.pid,
+        nonce: randomUUID(),
+        acquiredAt: new Date().toISOString(),
+        ...(bootId === undefined ? {} : { bootId }),
+        ...(processStart === undefined ? {} : { processStart }),
+    };
+}
+async function readOwner(lockPath) {
+    try {
+        const parsed = JSON.parse(await readFile(`${lockPath}/${OWNER_FILE}`, 'utf8'));
+        if (parsed.version !== 1 ||
+            !Number.isSafeInteger(parsed.pid) ||
+            (parsed.pid ?? 0) <= 0 ||
+            typeof parsed.nonce !== 'string' ||
+            parsed.nonce.length === 0 ||
+            typeof parsed.acquiredAt !== 'string' ||
+            !Number.isFinite(Date.parse(parsed.acquiredAt))) {
+            return undefined;
+        }
+        return parsed;
+    }
+    catch (error) {
+        if (!isMissing(error))
+            return undefined;
+        return undefined;
+    }
+}
+async function incompleteFenceIsStale(lockPath) {
+    try {
+        return Date.now() - (await stat(lockPath)).mtimeMs >= 5_000;
+    }
+    catch {
+        return false;
+    }
+}
+async function ownerIsLive(owner) {
+    const bootId = await linuxBootId();
+    if (owner.bootId !== undefined && bootId !== undefined && owner.bootId !== bootId)
+        return false;
+    const processStart = await linuxProcessStart(owner.pid);
+    if (owner.processStart !== undefined && processStart !== undefined)
+        return owner.processStart === processStart;
+    try {
+        process.kill(owner.pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+async function linuxBootId() {
+    try {
+        return (await readFile('/proc/sys/kernel/random/boot_id', 'utf8')).trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+async function linuxProcessStart(pid) {
+    try {
+        const value = await readFile(`/proc/${String(pid)}/stat`, 'utf8');
+        const close = value.lastIndexOf(')');
+        return value.slice(close + 2).split(' ')[19];
+    }
+    catch {
+        return undefined;
+    }
+}
+async function removeLockDirectory(path) {
+    const metadata = await lstat(path);
+    if (!metadata.isDirectory() || metadata.isSymbolicLink()) {
+        throw new Error('refusing to remove a runtime-owner fence that is not a directory');
+    }
+    try {
+        await unlink(`${path}/${OWNER_FILE}`);
+    }
+    catch (error) {
+        if (!isMissing(error))
+            throw error;
+    }
+    await rmdir(path);
+}
+function isAlreadyExists(error) {
+    return error.code === 'EEXIST';
+}
+function isMissing(error) {
+    return error.code === 'ENOENT';
+}
+export default RuntimeOwner;
+//# sourceMappingURL=runtime-owner.js.map

package/lib/operations/runtime-owner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-owner.js","sourceRoot":"","sources":["../../src/operations/runtime-owner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACtG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,EAAgB,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,EAAE,sBAAsB,EAA4B,MAAM,0BAA0B,CAAA;AAE3F,MAAM,UAAU,GAAG,YAAY,CAAA;AAW/B,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC1B,KAAK;IAA1B,YAAqB,KAA0D;QAC7E,KAAK,CACH,KAAK,KAAK,SAAS;YACjB,CAAC,CAAC,2DAA2D;YAC7D,CAAC,CAAC,2DAA2D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,UAAU,EAAE,CAC7G,CAAA;qBALkB,KAAK;QAMxB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD,YAAY,UAAkB,EAAE,aAAqB;QACnD,KAAK,CAAC,qBAAqB,UAAU,2DAA2D,aAAa,GAAG,CAAC,CAAA;QACjH,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAA;IAC9C,CAAC;CACF;AAQD,4GAA4G;AAC5G,MAAM,OAAO,YAAa,SAAQ,OAAO;IAUpB,OAAO;IAT1B,MAAM,CAAU,MAAM,GAAG,CAAC,iBAAiB,CAAC,CAAA;IAEpC,KAAK,CAA0E;IAC/E,OAAO,GAAG,CAAC,CAAA;IACX,OAAO,GAAG,KAAK,CAAA;IACf,cAAc,CAA0B;IAEhD,YACE,GAAY,EACK,OAAO,GAAwB,EAAE;QAElD,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;uBAFT,OAAO;IAG1B,CAAC;IAED,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACnB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxB,MAAM,KAAK,IAAI,EAAE;YACf,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;YACnB,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAClC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAA;gBAC/B,CAAC,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;QACtB,CAAC,CAAA;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW;QACf,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;QAC7E,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;QACrF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAA;QAClE,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;YACtB,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAA;YACtD,IAAI,cAAc,KAAK,SAAS;gBAAE,MAAM,IAAI,8BAA8B,CAAC,cAAc,EAAE,SAAS,CAAC,CAAA;QACvG,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACzD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAA;QAC3G,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,SAAS,kBAAkB,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAA;QACtC,IAAI,CAAC,KAAK,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;QAC5C,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;;OAGG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;QAC7E,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA;QACjB,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,OAAO,GAAG,EAAE;YACV,IAAI,QAAQ;gBAAE,OAAM;YACpB,QAAQ,GAAG,IAAI,CAAA;YACf,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA;YACjB,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC;gBAAE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAA;QACjD,CAAC,CAAA;IACH,CAAC;IAED,mHAAmH;IACnH,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS;YAC7B,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE;YAC5B,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAA;IACnG,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACxB,IAAI,KAAK,KAAK,SAAS;YAAE,OAAM;QAC/B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAA;QACtB,IAAI,OAAgC,CAAA;QACpC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAM;QACR,CAAC;QACD,IAAI,OAAO,EAAE,KAAK,KAAK,KAAK,CAAC,MAAM,CAAC,KAAK;YAAE,OAAM;QACjD,MAAM,WAAW,GAAG,GAAG,KAAK,CAAC,QAAQ,YAAY,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;QACrE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;YACzC,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAA;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAA;QACpC,CAAC;IACH,CAAC;CACF;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9B,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAChE,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAA;QAClC,OAAO,IAAI,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;IACpE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,QAAgB;IACrC,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAChE,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAA;QACzC,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,QAAQ,IAAI,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;YACnE,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBACrD,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YACrB,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;YACtB,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAA;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACP,oFAAoF;gBACtF,CAAC;gBACD,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC;QAED,IAAI,QAA2C,CAAA;QAC/C,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAA;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC;gBAAE,SAAQ;YAC9B,MAAM,KAAK,CAAA;QACb,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,sBAAsB,CAAC,SAAS,CAAC,CAAA;QACrG,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAA;QAC1C,IACE,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrE,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EACzD,CAAC;YACD,MAAM,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAA;QAC5C,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,QAAQ,UAAU,UAAU,EAAE,EAAE,CAAA;QACrD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC;gBAAE,SAAQ;YAC9B,MAAM,KAAK,CAAA;QACb,CAAC;QACD,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAA;IACtC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACjG,OAAO;QACL,OAAO,EAAE,CAAC;QACV,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK,EAAE,UAAU,EAAE;QACnB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;KACxD,CAAA;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,QAAgB;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,GAAG,QAAQ,IAAI,UAAU,EAAE,EAAE,MAAM,CAAC,CAAyB,CAAA;QACtG,IACE,MAAM,CAAC,OAAO,KAAK,CAAC;YACpB,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC;YACjC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC;YACtB,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAChC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YACzB,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YACrC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAC/C,CAAC;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,MAAqB,CAAA;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAA;QACvC,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,QAAgB;IACpD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,CAAA;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAAkB;IAC3C,MAAM,MAAM,GAAG,MAAM,WAAW,EAAE,CAAA;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAA;IAC/F,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,YAAY,KAAK,YAAY,CAAA;IAC9G,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QAC1B,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAA;IAC1D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,QAAQ,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACjE,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACpC,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAY;IAC7C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,GAAG,IAAI,IAAI,UAAU,EAAE,CAAC,CAAA;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAA;IACpC,CAAC;IACD,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAQ,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAAA;AAC3D,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAQ,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAAA;AAC3D,CAAC;AAED,eAAe,YAAY,CAAA"}

package/lib/operations/service.d.ts

@@ -0,0 +1,55 @@
+import { type Context, Service } from '@deepseek-ai/cordis';
+import type { RunId } from '../admission.js';
+import type { CleanupPreview, MaintenanceAudit, OperationsHealth, OrphanWorktreeFact, RecoveryParticipant, RetainedWorktreeFact } from './model.js';
+export interface AutopilotOperationsOptions {
+    readonly now?: () => number;
+}
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        autopilotOperations: AutopilotOperations;
+    }
+}
+/** Coordinate conservative retained-worktree maintenance, recovery readiness, audit, and operational health. */
+export declare class AutopilotOperations extends Service {
+    static readonly inject: string[];
+    private readonly store;
+    private readonly recovery;
+    private readonly inspector;
+    private readonly cleanup;
+    private readonly retention;
+    private readonly now;
+    private readying;
+    private storeRecovered;
+    constructor(ctx: Context, options?: AutopilotOperationsOptions);
+    [Service.init](): AsyncGenerator<() => Promise<void>, void, void>;
+    /** Register one effect-owned recovery generation; disposal withdraws, cancels, and drains active reconciliation. */
+    registerRecoveryParticipant(id: string, participant: RecoveryParticipant): () => Promise<void>;
+    /** Reconcile every required contributor and reject execution while durable restart work remains unresolved. */
+    assertDispatchReady(): Promise<void>;
+    /** Inspect one allocated run and retain an opaque process-local authorization preview. */
+    previewCleanup(runId: RunId): Promise<CleanupPreview>;
+    /** Inspect one allocated run without retaining an authorization capable cleanup preview. */
+    inspectCleanup(runId: RunId): Promise<Omit<CleanupPreview, 'previewId'>>;
+    /** Recheck and consume one eligible preview, persist intent, and remove only through native Git worktree operations. */
+    removeWorktree(previewId: string, operationId?: string): Promise<CleanupPreview>;
+    /** Reconcile a replayed Web cleanup command against its durable maintenance outcome. */
+    cleanupCommandOutcome(operationId: string): Promise<'completed' | 'pending' | 'retry-required' | 'unknown'>;
+    /** Run the automatic retention policy through the same preview, recheck, intent, and removal path. */
+    runRetentionMaintenance(): Promise<{
+        inspected: number;
+        removed: number;
+        attention: number;
+    }>;
+    /** Project retained, missing, unsafe, and orphaned worktrees without authorizing orphan deletion. */
+    inspectWorktrees(): Promise<{
+        retained: readonly RetainedWorktreeFact[];
+        orphans: readonly OrphanWorktreeFact[];
+        audit: readonly MaintenanceAudit[];
+    }>;
+    /** Return independent process, persistence, recovery, integration, and admission health facts without I/O. */
+    health(): OperationsHealth;
+    private ensureStore;
+    private openStore;
+    private reconcilePendingCleanup;
+}
+export default AutopilotOperations;

package/lib/operations/service.js

@@ -0,0 +1,154 @@
+import { randomUUID } from 'node:crypto';
+import { Service } from '@deepseek-ai/cordis';
+import { CleanupOperations } from './cleanup.js';
+import { CleanupInspector } from './cleanup-inspector.js';
+import { projectOperationsHealth } from './health.js';
+import { pathExists } from './inspection.js';
+import { RecoveryParticipants } from './recovery.js';
+import { RetentionMaintenance } from './retention.js';
+import { appendMaintenanceAudit } from './state.js';
+import { MaintenanceStateStore } from './store.js';
+/** Coordinate conservative retained-worktree maintenance, recovery readiness, audit, and operational health. */
+export class AutopilotOperations extends Service {
+    static inject = [
+        'admission',
+        'autopilotConfig',
+        'pullRequestDisposition',
+        'runtimeOwner',
+        'storageDomain',
+        'subprocess',
+    ];
+    store;
+    recovery = new RecoveryParticipants();
+    inspector;
+    cleanup;
+    retention;
+    now;
+    readying;
+    storeRecovered = false;
+    constructor(ctx, options = {}) {
+        super(ctx, 'autopilotOperations');
+        this.now = options.now ?? Date.now;
+        this.store = new MaintenanceStateStore(ctx);
+        this.inspector = new CleanupInspector(ctx, this.store, this.now);
+        this.cleanup = new CleanupOperations(ctx, this.store, this.inspector, () => this.ensureStore(), this.now);
+        this.retention = new RetentionMaintenance(ctx, this.store, this.cleanup, () => this.ensureStore());
+    }
+    async *[Service.init]() {
+        const releaseOwnerHold = this.ctx.runtimeOwner.hold();
+        let stopSettingsWatch;
+        try {
+            await this.ensureStore();
+            stopSettingsWatch = this.ctx.autopilotConfig.watch(() => this.retention.reschedule());
+        }
+        catch (error) {
+            try {
+                await this.store.close();
+            }
+            catch {
+                // Preserve the recovery failure that prevented the service from mounting.
+            }
+            finally {
+                releaseOwnerHold();
+            }
+            throw error;
+        }
+        yield async () => {
+            stopSettingsWatch?.();
+            try {
+                await this.retention.stop();
+                await this.recovery.dispose();
+                await this.store.close();
+            }
+            finally {
+                releaseOwnerHold();
+            }
+        };
+        this.retention.schedule(0);
+    }
+    /** Register one effect-owned recovery generation; disposal withdraws, cancels, and drains active reconciliation. */
+    registerRecoveryParticipant(id, participant) {
+        return this.recovery.register(id, participant);
+    }
+    /** Reconcile every required contributor and reject execution while durable restart work remains unresolved. */
+    async assertDispatchReady() {
+        await this.ensureStore();
+        await this.recovery.reconcileAll();
+        if (this.health().recovery.status !== 'complete') {
+            throw new Error('Autopilot recovery must be completed before execution starts');
+        }
+    }
+    /** Inspect one allocated run and retain an opaque process-local authorization preview. */
+    previewCleanup(runId) {
+        return this.cleanup.preview(runId);
+    }
+    /** Inspect one allocated run without retaining an authorization capable cleanup preview. */
+    inspectCleanup(runId) {
+        return this.cleanup.inspect(runId);
+    }
+    /** Recheck and consume one eligible preview, persist intent, and remove only through native Git worktree operations. */
+    removeWorktree(previewId, operationId) {
+        return this.cleanup.remove(previewId, operationId);
+    }
+    /** Reconcile a replayed Web cleanup command against its durable maintenance outcome. */
+    async cleanupCommandOutcome(operationId) {
+        await this.ensureStore();
+        const state = this.store.current();
+        if (state.pendingCleanup?.operationId === operationId)
+            return 'pending';
+        return state.audit.findLast((entry) => entry.operationId === operationId)?.outcome ?? 'unknown';
+    }
+    /** Run the automatic retention policy through the same preview, recheck, intent, and removal path. */
+    runRetentionMaintenance() {
+        return this.retention.run();
+    }
+    /** Project retained, missing, unsafe, and orphaned worktrees without authorizing orphan deletion. */
+    inspectWorktrees() {
+        return this.retention.inspectWorktrees();
+    }
+    /** Return independent process, persistence, recovery, integration, and admission health facts without I/O. */
+    health() {
+        return projectOperationsHealth(this.ctx, this.store, this.recovery, this.inspector);
+    }
+    async ensureStore() {
+        if (this.storeRecovered)
+            return;
+        if (this.readying !== undefined)
+            return await this.readying;
+        this.readying = this.openStore();
+        try {
+            await this.readying;
+        }
+        finally {
+            this.readying = undefined;
+        }
+    }
+    async openStore() {
+        await this.store.open();
+        await this.reconcilePendingCleanup();
+        this.storeRecovered = true;
+    }
+    async reconcilePendingCleanup() {
+        const pending = this.store.current().pendingCleanup;
+        if (pending === undefined)
+            return;
+        const remains = await pathExists(pending.worktreePath);
+        await this.store.update((state) => ({
+            ...appendMaintenanceAudit(state, {
+                id: randomUUID(),
+                operationId: pending.operationId,
+                at: new Date(this.now()).toISOString(),
+                kind: 'cleanup-recovered',
+                runId: pending.runId,
+                worktreePath: pending.worktreePath,
+                outcome: remains ? 'retry-required' : 'completed',
+                detail: remains
+                    ? 'interrupted cleanup left the path present; a new preview is required'
+                    : 'interrupted cleanup completed before acknowledgement; the absent path was retained as the outcome',
+            }),
+            pendingCleanup: undefined,
+        }));
+    }
+}
+export default AutopilotOperations;
+//# sourceMappingURL=service.js.map

package/lib/operations/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/operations/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAgB,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAS5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAYlD,gHAAgH;AAChH,MAAM,OAAO,mBAAoB,SAAQ,OAAO;IAC9C,MAAM,CAAU,MAAM,GAAG;QACvB,WAAW;QACX,iBAAiB;QACjB,wBAAwB;QACxB,cAAc;QACd,eAAe;QACf,YAAY;KACb,CAAA;IAEgB,KAAK,CAAuB;IAC5B,QAAQ,GAAG,IAAI,oBAAoB,EAAE,CAAA;IACrC,SAAS,CAAkB;IAC3B,OAAO,CAAmB;IAC1B,SAAS,CAAsB;IAC/B,GAAG,CAAc;IAC1B,QAAQ,CAA2B;IACnC,cAAc,GAAG,KAAK,CAAA;IAE9B,YAAY,GAAY,EAAE,OAAO,GAA+B,EAAE;QAChE,KAAK,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAA;QACjC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;QAClC,IAAI,CAAC,KAAK,GAAG,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;QAChE,IAAI,CAAC,OAAO,GAAG,IAAI,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;QACzG,IAAI,CAAC,SAAS,GAAG,IAAI,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;IACpG,CAAC;IAED,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACnB,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;QACrD,IAAI,iBAA2C,CAAA;QAC/C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;YACxB,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,CAAA;QACvF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,0EAA0E;YAC5E,CAAC;oBAAS,CAAC;gBACT,gBAAgB,EAAE,CAAA;YACpB,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;QACD,MAAM,KAAK,IAAI,EAAE;YACf,iBAAiB,EAAE,EAAE,CAAA;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;gBAC3B,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAA;gBAC7B,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;YAC1B,CAAC;oBAAS,CAAC;gBACT,gBAAgB,EAAE,CAAA;YACpB,CAAC;QACH,CAAC,CAAA;QACD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IAC5B,CAAC;IAED,oHAAoH;IACpH,2BAA2B,CAAC,EAAU,EAAE,WAAgC;QACtE,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;IAChD,CAAC;IAED,+GAA+G;IAC/G,KAAK,CAAC,mBAAmB;QACvB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxB,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAA;QAClC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;QACjF,CAAC;IACH,CAAC;IAED,0FAA0F;IAC1F,cAAc,CAAC,KAAY;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;IAED,4FAA4F;IAC5F,cAAc,CAAC,KAAY;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;IAED,wHAAwH;IACxH,cAAc,CAAC,SAAiB,EAAE,WAAoB;QACpD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IACpD,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,qBAAqB,CAAC,WAAmB;QAC7C,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;QAClC,IAAI,KAAK,CAAC,cAAc,EAAE,WAAW,KAAK,WAAW;YAAE,OAAO,SAAS,CAAA;QACvE,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,EAAE,OAAO,IAAI,SAAS,CAAA;IACjG,CAAC;IAED,sGAAsG;IACtG,uBAAuB;QACrB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAA;IAC7B,CAAC;IAED,qGAAqG;IACrG,gBAAgB;QAKd,OAAO,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAA;IAC1C,CAAC;IAED,8GAA8G;IAC9G,MAAM;QACJ,OAAO,uBAAuB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IACrF,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,IAAI,IAAI,CAAC,cAAc;YAAE,OAAM;QAC/B,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAA;QAC3D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,CAAA;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAA;QACrB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAA;QAC3B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;QACvB,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAA;QACpC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAA;IAC5B,CAAC;IAEO,KAAK,CAAC,uBAAuB;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,cAAc,CAAA;QACnD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAM;QACjC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QACtD,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAClC,GAAG,sBAAsB,CAAC,KAAK,EAAE;gBAC/B,EAAE,EAAE,UAAU,EAAE;gBAChB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;gBACtC,IAAI,EAAE,mBAAmB;gBACzB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW;gBACjD,MAAM,EAAE,OAAO;oBACb,CAAC,CAAC,sEAAsE;oBACxE,CAAC,CAAC,mGAAmG;aACxG,CAAC;YACF,cAAc,EAAE,SAAS;SAC1B,CAAC,CAAC,CAAA;IACL,CAAC;CACF;AAED,eAAe,mBAAmB,CAAA"}

package/lib/operations/state.d.ts

@@ -0,0 +1,79 @@
+import { z } from 'zod';
+import type { RunId } from '../admission.js';
+import type { MaintenanceAudit } from './model.js';
+export declare const MAINTENANCE_STATE_KEY: 'primary';
+export declare const maintenanceStateSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    revision: z.ZodNumber;
+    mergeObservations: z.ZodArray<z.ZodObject<{
+        runId: z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>;
+        firstObservedMergedAt: z.ZodISODateTime;
+        lastObservedMergedAt: z.ZodISODateTime;
+    }, z.core.$strip>>;
+    pendingCleanup: z.ZodOptional<z.ZodObject<{
+        operationId: z.ZodString;
+        runId: z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>;
+        worktreePath: z.ZodString;
+        previewFingerprint: z.ZodString;
+        startedAt: z.ZodISODateTime;
+    }, z.core.$strip>>;
+    audit: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        operationId: z.ZodOptional<z.ZodString>;
+        at: z.ZodISODateTime;
+        kind: z.ZodEnum<{
+            "cleanup-recovered": "cleanup-recovered";
+            "cleanup-rejected": "cleanup-rejected";
+            "cleanup-removed": "cleanup-removed";
+            "cleanup-started": "cleanup-started";
+            "merge-observed": "merge-observed";
+        }>;
+        runId: z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>;
+        worktreePath: z.ZodString;
+        outcome: z.ZodOptional<z.ZodEnum<{
+            completed: "completed";
+            "retry-required": "retry-required";
+        }>>;
+        detail: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type MaintenanceState = z.infer<typeof maintenanceStateSchema>;
+export declare const maintenanceDomainSpec: {
+    name: string;
+    version: number;
+    tables: {
+        state: import("@deepseek-ai/dsh-storage-domain").DomainTableSpec<"primary", {
+            schemaVersion: 1;
+            revision: number;
+            mergeObservations: {
+                runId: RunId;
+                firstObservedMergedAt: string;
+                lastObservedMergedAt: string;
+            }[];
+            pendingCleanup?: {
+                operationId: string;
+                runId: RunId;
+                worktreePath: string;
+                previewFingerprint: string;
+                startedAt: string;
+            } | undefined;
+            audit: {
+                id: string;
+                operationId?: string | undefined;
+                at: string;
+                kind: "cleanup-recovered" | "cleanup-rejected" | "cleanup-removed" | "cleanup-started" | "merge-observed";
+                runId: RunId;
+                worktreePath: string;
+                outcome?: "completed" | "retry-required" | undefined;
+                detail: string;
+            }[];
+        }>;
+    };
+};
+export declare function initialMaintenanceState(): MaintenanceState;
+export declare function existingMergeObservation(state: MaintenanceState, runId: RunId): {
+    runId: RunId;
+    firstObservedMergedAt: string;
+    lastObservedMergedAt: string;
+} | undefined;
+export declare function appendMaintenanceAudit(state: MaintenanceState, audit: MaintenanceAudit): MaintenanceState;

package/lib/operations/state.js

@@ -0,0 +1,51 @@
+import { defineDomain, domainTable } from '@deepseek-ai/dsh-storage-domain';
+import { z } from 'zod';
+import { runIdSchema } from '../admission/state.js';
+export const MAINTENANCE_STATE_KEY = 'primary';
+const pathSchema = z.string().min(1).max(4096);
+const mergeObservationSchema = z.object({
+    runId: runIdSchema,
+    firstObservedMergedAt: z.iso.datetime({ offset: true }),
+    lastObservedMergedAt: z.iso.datetime({ offset: true }),
+});
+const pendingCleanupSchema = z.object({
+    operationId: z.string().uuid(),
+    runId: runIdSchema,
+    worktreePath: pathSchema,
+    previewFingerprint: z.string().regex(/^[a-f0-9]{64}$/),
+    startedAt: z.iso.datetime({ offset: true }),
+});
+const auditSchema = z.object({
+    id: z.string().uuid(),
+    operationId: z.string().uuid().optional(),
+    at: z.iso.datetime({ offset: true }),
+    kind: z.enum(['merge-observed', 'cleanup-started', 'cleanup-removed', 'cleanup-rejected', 'cleanup-recovered']),
+    runId: runIdSchema,
+    worktreePath: pathSchema,
+    outcome: z.enum(['completed', 'retry-required']).optional(),
+    detail: z.string().min(1).max(4096),
+});
+export const maintenanceStateSchema = z.object({
+    schemaVersion: z.literal(1),
+    revision: z.number().int().nonnegative(),
+    mergeObservations: z.array(mergeObservationSchema).max(100),
+    pendingCleanup: pendingCleanupSchema.optional(),
+    audit: z.array(auditSchema).max(1000),
+});
+export const maintenanceDomainSpec = defineDomain({
+    name: 'autopilot_maintenance',
+    version: 1,
+    tables: {
+        state: domainTable(maintenanceStateSchema),
+    },
+});
+export function initialMaintenanceState() {
+    return { schemaVersion: 1, revision: 0, mergeObservations: [], audit: [] };
+}
+export function existingMergeObservation(state, runId) {
+    return state.mergeObservations.find((observation) => observation.runId === runId);
+}
+export function appendMaintenanceAudit(state, audit) {
+    return { ...state, audit: [...state.audit, audit].slice(-1000) };
+}
+//# sourceMappingURL=state.js.map

package/lib/operations/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/operations/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAA;AAC3E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAInD,MAAM,CAAC,MAAM,qBAAqB,GAAG,SAAkB,CAAA;AACvD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AAE9C,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,KAAK,EAAE,WAAW;IAClB,qBAAqB,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvD,oBAAoB,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;CACvD,CAAC,CAAA;AAEF,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC9B,KAAK,EAAE,WAAW;IAClB,YAAY,EAAE,UAAU;IACxB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACtD,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;CAC5C,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACzC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;IAC/G,KAAK,EAAE,WAAW;IAClB,YAAY,EAAE,UAAU;IACxB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;CACpC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3D,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;CACtC,CAAC,CAAA;AAIF,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC;IAChD,IAAI,EAAE,uBAAuB;IAC7B,OAAO,EAAE,CAAC;IACV,MAAM,EAAE;QACN,KAAK,EAAE,WAAW,CAAiD,sBAAsB,CAAC;KAC3F;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,uBAAuB;IACrC,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,iBAAiB,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;AAC5E,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAuB,EAAE,KAAY;IAC5E,OAAO,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;AACnF,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAuB,EAAE,KAAuB;IACrF,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAA;AAClE,CAAC"}

package/lib/operations/storage-composition.d.ts

@@ -0,0 +1,16 @@
+import type { Context } from '@deepseek-ai/cordis';
+interface LoaderEntry {
+    readonly disabled: boolean;
+    readonly options: {
+        readonly name: string;
+        readonly config?: unknown;
+    };
+    evaluate(expression: string): unknown;
+}
+export interface RuntimeOwnerOptions {
+    /** Programmatic host proof for compositions that do not use the DSH Loader. */
+    readonly authoritativeStorePath?: string;
+}
+export declare function authoritativeStorePath(ctx: Context, options: RuntimeOwnerOptions): string;
+export declare function authoritativePathFromEntries(entries: readonly LoaderEntry[]): string;
+export {};