@claudexor/workspace 4.8.1 → 5.0.1

package/dist/object-sparse.js

@@ -0,0 +1,72 @@
+import { lstatPresent } from "./fs-presence.js";
+import { classifyGitFailure, gitObserved, GitOperationError } from "./git-observed.js";
+/** `git sparse-checkout check-rules` arrived in Git 2.41; an older Git answers its
+ * usage error (exit 129: an unknown subcommand) instead. */
+const CHECK_RULES_UNKNOWN = 129;
+/**
+ * The paths among `paths` that the worktree's sparse-checkout patterns leave out
+ * (none when it is not a sparse checkout), from one `check-rules` call, or null when
+ * this Git cannot evaluate the patterns (older than 2.41). A snapshot's `add -A`
+ * skips such a path, a tracked one keeping HEAD's blob whether its file is absent,
+ * as a sparse checkout usually leaves it, or present, so an operation that addresses
+ * one could not tell what it holds before or after writing. With
+ * `core.sparseCheckout` set but no patterns file, Git checks out everything, and so
+ * nothing is left out here either. A worktree that is not sparse costs one
+ * `git config` and never asks `check-rules`.
+ */
+export async function outsideSparseCheckout(worktree, paths, env) {
+    if (paths.length === 0)
+        return [];
+    const sparse = await gitObserved(worktree, ["config", "--type=bool", "--get", "core.sparseCheckout"], { env, label: "config core.sparseCheckout", allowFailure: true });
+    if (sparse.stdout.trim() !== "true")
+        return [];
+    const patterns = await gitObserved(worktree, ["rev-parse", "--path-format=absolute", "--git-path", "info/sparse-checkout"], { env, label: "rev-parse --git-path info/sparse-checkout" });
+    if (!lstatPresent(patterns.stdout.trim()))
+        return [];
+    const kept = await gitObserved(worktree, ["sparse-checkout", "check-rules", "-z"], {
+        env,
+        label: "sparse-checkout check-rules",
+        input: paths.map((path) => `${path}\0`).join(""),
+        allowFailure: true,
+    });
+    if (kept.code === CHECK_RULES_UNKNOWN)
+        return null;
+    if (kept.code !== 0)
+        throw new GitOperationError(classifyGitFailure(kept.stderr), `git sparse-checkout check-rules failed: ${kept.stderr.trim().slice(0, 2_000)}`);
+    const inside = new Set(kept.stdout.split("\0"));
+    return paths.filter((path) => !inside.has(path));
+}
+/**
+ * The refusal of an operation that must write or remove a path outside the
+ * sparse-checkout patterns, naming those paths, or of any operation in a sparse
+ * checkout whose Git cannot evaluate its patterns; nothing is written. Widening the
+ * sparse checkout (`git sparse-checkout add`) lets the same operation run. Paths it
+ * does not address keep their files: the checkout runs with the patterns off.
+ */
+export async function sparseCheckoutRefusal(worktree, paths, operation, env = {}) {
+    const found = await outsideSparseCheckout(worktree, paths, env);
+    if (found === null) {
+        const version = await gitObserved(worktree, ["version"], {
+            env,
+            label: "version",
+            allowFailure: true,
+        });
+        return {
+            code: "git_failed",
+            message: `this checkout is sparse, and its Git (${version.stdout.trim() || "version unknown"}) cannot evaluate the sparse-checkout patterns: Claudexor asks \`git sparse-checkout check-rules\`, which Git 2.41 added, which of the paths this ${operation} changes are inside them; nothing was written. Use Git 2.41 or newer, or turn the sparse checkout off (git sparse-checkout disable), and try again`,
+            paths: [],
+            pathCount: 0,
+        };
+    }
+    const outside = [...new Set(found)].sort();
+    if (outside.length === 0)
+        return null;
+    const what = operation === "delivery" ? "this result changes" : "this revert must change";
+    return {
+        code: "delivery_outside_sparse_checkout",
+        message: `${outside.length} path(s) ${what} are outside this checkout's sparse-checkout patterns, so nothing was written; widen the sparse checkout (git sparse-checkout add) to include them and try again: ${outside.slice(0, 20).join(", ")}`.slice(0, 4_000),
+        paths: outside.slice(0, 200),
+        pathCount: outside.length,
+    };
+}
+//# sourceMappingURL=object-sparse.js.map

package/dist/object-sparse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-sparse.js","sourceRoot":"","sources":["../src/object-sparse.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEvF;4DAC4D;AAC5D,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAgB,EAChB,KAAwB,EACxB,GAA2B;IAE3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,QAAQ,EACR,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,qBAAqB,CAAC,EACzD,EAAE,GAAG,EAAE,KAAK,EAAE,4BAA4B,EAAE,YAAY,EAAE,IAAI,EAAE,CACjE,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,WAAW,CAChC,QAAQ,EACR,CAAC,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,sBAAsB,CAAC,EAC7E,EAAE,GAAG,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAC5D,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,CAAC,iBAAiB,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE;QACjF,GAAG;QACH,KAAK,EAAE,6BAA6B;QACpC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;QACjB,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAC/B,2CAA2C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAChF,CAAC;IACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAgB,EAChB,KAAwB,EACxB,SAAgC,EAChC,GAAG,GAA2B,EAAE;IAEhC,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAChE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE;YACvD,GAAG;YACH,KAAK,EAAE,SAAS;YAChB,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,yCAAyC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,iBAAiB,qJAAqJ,SAAS,oJAAoJ;YAC9Y,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,CAAC;SACb,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,IAAI,GAAG,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,yBAAyB,CAAC;IAC1F,OAAO;QACL,IAAI,EAAE,kCAAkC;QACxC,OAAO,EACL,GAAG,OAAO,CAAC,MAAM,YAAY,IAAI,qKAAqK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAC3O,CAAC,EACD,KAAK,CACN;QACH,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QAC5B,SAAS,EAAE,OAAO,CAAC,MAAM;KAC1B,CAAC;AACJ,CAAC"}

package/dist/object-store-leases.d.ts

@@ -0,0 +1,41 @@
+/** The store's private control directories (pending, roots, tmp, the prune lock). */
+export declare function controlDir(store: string, name: string): string;
+export interface PendingRoots {
+    store: string;
+    path: string;
+    roots: string[];
+    /** Renews the record's mtime while the import runs. */
+    renewal?: ReturnType<typeof setInterval>;
+}
+/**
+ * Two-flag protocol with prune: an import first records its pending roots, then
+ * waits out a prune already holding the lock; a prune first takes the lock,
+ * then yields when any live pending record exists. One of the two always sees
+ * the other, so a prune never deletes an object a concurrent import relies on.
+ * The record names this process by PID and kernel birth: it stays live for as
+ * long as this process runs, however long the import takes.
+ */
+export declare function beginPendingRoots(store: string, roots: string[]): Promise<PendingRoots>;
+/**
+ * End a pending lease. Never throws: what the leased operation answered stays its
+ * answer, and its caller's remaining cleanup still runs. A record that cannot be
+ * removed (a directory that refuses the unlink) is not released: it stays, naming
+ * this process, and a prune counts it as it counts any record (see
+ * `livePendingRecords`), so it can only delay pruning. Returns that removal fault
+ * as the caller's cleanup diagnostic, else undefined.
+ */
+export declare function endPendingRoots(pending: PendingRoots | null | undefined): unknown;
+/**
+ * Take the prune lock atomically: the owner record is written into a private
+ * directory that becomes the lock by one rename, so no reader ever sees a lock
+ * without its owner. A stale lock (dead or reused-PID owner, or ownerless
+ * debris) is moved aside by one rename — of racing reapers only one moves it —
+ * and checked to be the lock judged stale before it is removed. Returns the
+ * hold, or null when another live pruner holds the lock.
+ */
+export declare function acquirePruneLock(store: string): {
+    stillHeld: () => boolean;
+    release: () => void;
+} | null;
+export declare function livePendingRecords(store: string, graceMs: number): string[][];
+//# sourceMappingURL=object-store-leases.d.ts.map

package/dist/object-store-leases.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-store-leases.d.ts","sourceRoot":"","sources":["../src/object-store-leases.ts"],"names":[],"mappings":"AAgCA,qFAAqF;AACrF,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9D;AA6DD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uDAAuD;IACvD,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;CAC1C;AAKD;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAoC7F;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CASjF;AAqCD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,GACZ;IAAE,SAAS,EAAE,MAAM,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,GAAG,IAAI,CAmD1D;AAOD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,CAoC7E"}

package/dist/object-store-leases.js

@@ -0,0 +1,277 @@
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, unlinkSync, utimesSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { setTimeout as sleep } from "node:timers/promises";
+import { compareProcessBirth, defaultProcessIdentityService, isKnownProcessIdentity, WorkspaceError, } from "@claudexor/core";
+import { noteCleanupFault } from "./cleanup-fault.js";
+import { existsStrict } from "./fs-presence.js";
+/*
+ * Leases of the project object store (#535): the pending records that keep a
+ * running import's objects from a concurrent prune, and the prune lock. Both
+ * name their process by PID and, where the platform reports one, its kernel
+ * birth, so a reused PID never keeps a lease alive.
+ */
+/** The store's private control directories (pending, roots, tmp, the prune lock). */
+export function controlDir(store, name) {
+    return join(store, "claudexor", name);
+}
+function processAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+function selfOwner() {
+    const identity = defaultProcessIdentityService.self();
+    return { pid: process.pid, ...(identity.status === "known" ? { identity } : {}) };
+}
+/**
+ * `alive`: the recorded process still runs (same PID and same kernel birth);
+ * `dead`: it exited, or its PID now names another process; `unverified`: the
+ * PID is in use but no birth was recorded or it cannot be read now.
+ */
+function ownerState(owner) {
+    const pid = Number(owner.pid);
+    if (!Number.isSafeInteger(pid) || pid <= 0 || !processAlive(pid))
+        return "dead";
+    if (!isKnownProcessIdentity(owner.identity))
+        return "unverified";
+    const birth = compareProcessBirth(owner.identity, defaultProcessIdentityService.read(pid));
+    if (birth === "same")
+        return "alive";
+    return birth === "unknown" ? "unverified" : "dead";
+}
+/** Milliseconds since `path` was last written; vanished paths are infinitely old. */
+function ageOf(path) {
+    try {
+        return Date.now() - statSync(path).mtimeMs;
+    }
+    catch {
+        return Number.POSITIVE_INFINITY;
+    }
+}
+/** Keep `path`'s mtime fresh while its holder runs (the bounded liveness of an
+ * unverifiable owner); unref'd, so it never keeps a process alive. */
+function renewWhileHeld(path, everyMs, held = () => true) {
+    const timer = setInterval(() => {
+        try {
+            if (!held())
+                return;
+            const now = new Date();
+            utimesSync(path, now, now);
+        }
+        catch {
+            // Gone: its holder released it.
+        }
+    }, everyMs);
+    timer.unref?.();
+    return timer;
+}
+/** Bound of a prune-lock wait before an import gives up. */
+const PRUNE_WAIT_MS = 600_000;
+/**
+ * Two-flag protocol with prune: an import first records its pending roots, then
+ * waits out a prune already holding the lock; a prune first takes the lock,
+ * then yields when any live pending record exists. One of the two always sees
+ * the other, so a prune never deletes an object a concurrent import relies on.
+ * The record names this process by PID and kernel birth: it stays live for as
+ * long as this process runs, however long the import takes.
+ */
+export async function beginPendingRoots(store, roots) {
+    const dir = controlDir(store, "pending");
+    mkdirSync(dir, { recursive: true });
+    const path = join(dir, `${process.pid}-${randomUUID()}.json`);
+    writeFileSync(path, JSON.stringify({ ...selfOwner(), created_at: new Date().toISOString(), roots }) + "\n", { mode: 0o600 });
+    const pending = {
+        store,
+        path,
+        roots,
+        renewal: renewWhileHeld(path, PENDING_RENEW_MS),
+    };
+    try {
+        const lock = controlDir(store, "prune.lock");
+        // A holder verified once (by kernel birth) needs only a PID check per poll.
+        let verified;
+        const held = () => {
+            const owner = existsSync(lock) ? readLockOwner(lock) : null;
+            if (owner?.nonce && owner.nonce === verified && processAlive(Number(owner.pid)))
+                return true;
+            const live = pruneLockHeld(lock);
+            verified = live ? owner?.nonce : undefined;
+            return live;
+        };
+        for (let waited = 0; held(); waited += 100) {
+            if (waited > PRUNE_WAIT_MS)
+                throw new WorkspaceError("object store prune did not finish in time");
+            await sleep(100);
+        }
+        return pending;
+    }
+    catch (error) {
+        noteCleanupFault(error, endPendingRoots(pending));
+        throw error;
+    }
+}
+/**
+ * End a pending lease. Never throws: what the leased operation answered stays its
+ * answer, and its caller's remaining cleanup still runs. A record that cannot be
+ * removed (a directory that refuses the unlink) is not released: it stays, naming
+ * this process, and a prune counts it as it counts any record (see
+ * `livePendingRecords`), so it can only delay pruning. Returns that removal fault
+ * as the caller's cleanup diagnostic, else undefined.
+ */
+export function endPendingRoots(pending) {
+    if (!pending)
+        return undefined;
+    if (pending.renewal)
+        clearInterval(pending.renewal);
+    try {
+        rmSync(pending.path, { force: true });
+        return undefined;
+    }
+    catch (error) {
+        return error;
+    }
+}
+function readLockOwner(lock) {
+    try {
+        const owner = JSON.parse(readFileSync(join(lock, "owner.json"), "utf8"));
+        return owner && typeof owner === "object" ? owner : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** A lock appears whole (owner included) by one rename; one without an owner
+ * is debris of an interrupted writer, held only while this young. */
+const LOCK_SETTLE_MS = 60_000;
+/** A pruner renews its lock this often; an unverifiable holder silent for
+ * LOCK_STALE_MS is gone (a verified live holder is never stale). */
+const LOCK_RENEW_MS = 30_000;
+const LOCK_STALE_MS = 10 * 60_000;
+function pruneLockHeld(lock) {
+    if (!existsSync(lock))
+        return false;
+    const owner = readLockOwner(lock);
+    if (owner === null)
+        return ageOf(lock) < LOCK_SETTLE_MS;
+    const state = ownerState(owner);
+    return (state === "alive" || (state === "unverified" && ageOf(join(lock, "owner.json")) < LOCK_STALE_MS));
+}
+/** Errors meaning "the lock path is taken" (a directory rename onto an existing one). */
+const LOCK_TAKEN = new Set(["EEXIST", "ENOTEMPTY", "EPERM", "EACCES", "EISDIR"]);
+/**
+ * Take the prune lock atomically: the owner record is written into a private
+ * directory that becomes the lock by one rename, so no reader ever sees a lock
+ * without its owner. A stale lock (dead or reused-PID owner, or ownerless
+ * debris) is moved aside by one rename — of racing reapers only one moves it —
+ * and checked to be the lock judged stale before it is removed. Returns the
+ * hold, or null when another live pruner holds the lock.
+ */
+export function acquirePruneLock(store) {
+    const lock = controlDir(store, "prune.lock");
+    const tmp = controlDir(store, "tmp");
+    mkdirSync(tmp, { recursive: true });
+    const nonce = randomUUID();
+    const staged = join(tmp, `prune-lock-${nonce}`);
+    mkdirSync(staged);
+    try {
+        writeFileSync(join(staged, "owner.json"), JSON.stringify({ ...selfOwner(), nonce }) + "\n");
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            // An existing (even empty) lock is never replaced by the rename below.
+            if (!existsSync(lock)) {
+                try {
+                    renameSync(staged, lock);
+                    const stillHeld = () => readLockOwner(lock)?.nonce === nonce;
+                    const renewal = renewWhileHeld(join(lock, "owner.json"), LOCK_RENEW_MS, stillHeld);
+                    return {
+                        stillHeld,
+                        release: () => {
+                            clearInterval(renewal);
+                            if (stillHeld())
+                                rmSync(lock, { recursive: true, force: true });
+                        },
+                    };
+                }
+                catch (error) {
+                    if (!LOCK_TAKEN.has(error.code ?? "") || !existsSync(lock))
+                        throw error;
+                }
+            }
+            if (pruneLockHeld(lock))
+                return null;
+            const judged = readLockOwner(lock)?.nonce;
+            const aside = join(tmp, `prune-lock-stale-${randomUUID()}`);
+            try {
+                renameSync(lock, aside);
+            }
+            catch {
+                return null; // another pruner reaped or replaced it first
+            }
+            if (readLockOwner(aside)?.nonce !== judged) {
+                // A fresh lock replaced the stale one meanwhile: hand it back and yield.
+                try {
+                    renameSync(aside, lock);
+                }
+                catch {
+                    // The slot is taken again; that holder's own checks see the change.
+                }
+                return null;
+            }
+            rmSync(aside, { recursive: true, force: true });
+        }
+        return null;
+    }
+    finally {
+        rmSync(staged, { recursive: true, force: true });
+    }
+}
+/** Without a readable kernel birth a pending record is live this long after
+ * its last renewal, so a leaked record can delay pruning but never block it. */
+const PENDING_MAX_AGE_MS = 60 * 60 * 1000;
+const PENDING_RENEW_MS = 60_000;
+export function livePendingRecords(store, graceMs) {
+    const dir = controlDir(store, "pending");
+    // Only ENOENT and ENOTDIR say there are none: an unreadable one may hold a live lease.
+    if (!existsStrict(dir))
+        return [];
+    const live = [];
+    for (const name of readdirSync(dir)) {
+        const path = join(dir, name);
+        try {
+            const record = JSON.parse(readFileSync(path, "utf8"));
+            const age = Date.now() - statSync(path).mtimeMs;
+            // A running import has no wall-clock limit: its record stays live while
+            // its own process (PID and kernel birth) runs. A dead owner's or a
+            // reused PID's record is reclaimed once past the grace window.
+            const state = ownerState(record);
+            if (age < graceMs ||
+                state === "alive" ||
+                (state === "unverified" && age < PENDING_MAX_AGE_MS))
+                live.push(record.roots ?? []);
+            else
+                unlinkSync(path);
+        }
+        catch {
+            // A record being written is young: it counts as live. An unreadable one
+            // past the maximum age is debris and must not block pruning forever.
+            const age = (() => {
+                try {
+                    return Date.now() - statSync(path).mtimeMs;
+                }
+                catch {
+                    return 0;
+                }
+            })();
+            if (age < PENDING_MAX_AGE_MS)
+                live.push([]);
+            else
+                rmSync(path, { force: true });
+        }
+    }
+    return live;
+}
+//# sourceMappingURL=object-store-leases.js.map

package/dist/object-store-leases.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-store-leases.js","sourceRoot":"","sources":["../src/object-store-leases.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,UAAU,EACV,MAAM,EACN,QAAQ,EACR,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,sBAAsB,EACtB,cAAc,GAEf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD;;;;;GAKG;AAEH,qFAAqF;AACrF,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,IAAY;IACpD,OAAO,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3D,CAAC;AACH,CAAC;AAQD,SAAS,SAAS;IAChB,MAAM,QAAQ,GAAG,6BAA6B,CAAC,IAAI,EAAE,CAAC;IACtD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACpF,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAA4C;IAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAChF,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,YAAY,CAAC;IACjE,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3F,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC;IACrC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;AACrD,CAAC;AAED,qFAAqF;AACrF,SAAS,KAAK,CAAC,IAAY;IACzB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,iBAAiB,CAAC;IAClC,CAAC;AACH,CAAC;AAED;sEACsE;AACtE,SAAS,cAAc,CAAC,IAAY,EAAE,OAAe,EAAE,IAAI,GAAkB,GAAG,EAAE,CAAC,IAAI;IACrF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,EAAE;gBAAE,OAAO;YACpB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC,EAAE,OAAO,CAAC,CAAC;IACZ,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,OAAO,KAAK,CAAC;AACf,CAAC;AAUD,4DAA4D;AAC5D,MAAM,aAAa,GAAG,OAAO,CAAC;AAE9B;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa,EAAE,KAAe;IACpE,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACzC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9D,aAAa,CACX,IAAI,EACJ,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,SAAS,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EACtF,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACF,MAAM,OAAO,GAAiB;QAC5B,KAAK;QACL,IAAI;QACJ,KAAK;QACL,OAAO,EAAE,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC;KAChD,CAAC;IACF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC7C,4EAA4E;QAC5E,IAAI,QAA4B,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5D,IAAI,KAAK,EAAE,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7F,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACjC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACF,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,IAAI,GAAG,EAAE,CAAC;YAC3C,IAAI,MAAM,GAAG,aAAa;gBACxB,MAAM,IAAI,cAAc,CAAC,2CAA2C,CAAC,CAAC;YACxE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QAClD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,OAAwC;IACtE,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,OAAO,CAAC,OAAO;QAAE,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAOD,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAClF,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;qEACqE;AACrE,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B;oEACoE;AACpE,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,aAAa,GAAG,EAAE,GAAG,MAAM,CAAC;AAElC,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC;IACxD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,CACL,KAAK,KAAK,OAAO,IAAI,CAAC,KAAK,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,GAAG,aAAa,CAAC,CACjG,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAa;IAEb,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,KAAK,EAAE,CAAC,CAAC;IAChD,SAAS,CAAC,MAAM,CAAC,CAAC;IAClB,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5F,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAChD,uEAAuE;YACvE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC;oBACH,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBACzB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,KAAK,CAAC;oBAC7D,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;oBACnF,OAAO;wBACL,SAAS;wBACT,OAAO,EAAE,GAAG,EAAE;4BACZ,aAAa,CAAC,OAAO,CAAC,CAAC;4BACvB,IAAI,SAAS,EAAE;gCAAE,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;wBAClE,CAAC;qBACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,UAAU,CAAC,GAAG,CAAE,KAA+B,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;wBACnF,MAAM,KAAK,CAAC;gBAChB,CAAC;YACH,CAAC;YACD,IAAI,aAAa,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;YAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,UAAU,EAAE,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,CAAC,6CAA6C;YAC5D,CAAC;YACD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,MAAM,EAAE,CAAC;gBAC3C,yEAAyE;gBACzE,IAAI,CAAC;oBACH,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACP,oEAAoE;gBACtE,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED;gFACgF;AAChF,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,OAAe;IAC/D,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACzC,uFAAuF;IACvF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;YAChD,wEAAwE;YACxE,mEAAmE;YACnE,+DAA+D;YAC/D,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YACjC,IACE,GAAG,GAAG,OAAO;gBACb,KAAK,KAAK,OAAO;gBACjB,CAAC,KAAK,KAAK,YAAY,IAAI,GAAG,GAAG,kBAAkB,CAAC;gBAEpD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;;gBAC3B,UAAU,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,qEAAqE;YACrE,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE;gBAChB,IAAI,CAAC;oBACH,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;gBAC7C,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,CAAC,CAAC;gBACX,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;YACL,IAAI,GAAG,GAAG,kBAAkB;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;;gBACvC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/object-store-roots.d.ts

@@ -0,0 +1,25 @@
+import { GitDeliveryPair } from "@claudexor/schema";
+/**
+ * Durable custody: a root record names the objects it keeps and the path that
+ * owns them (a run directory, a thread directory, an envelope, an anchor). It
+ * is live while its owner exists, so retention of the owner is retention of its
+ * objects, and roots are durable the moment an import is verified (no caller
+ * has to finish later). A run directory retention retired keeps only
+ * `tombstone.yaml`: its payload is gone, and so is its custody. A record appears
+ * whole by one rename: one torn by a crash or a full disk would refuse every
+ * later prune of its project.
+ */
+export declare function writeRootRecord(store: string, owner: string, roots: string[], pair?: GitDeliveryPair): string;
+/**
+ * The newest delivery pair kept under `owner` whose post-tree is `postTree`:
+ * a delivery retains its pair before it writes, so a replay that finds the
+ * result already applied (its caller died before recording it) recovers the
+ * pair revert needs. Null when no such record exists; a record directory that
+ * cannot be looked at throws, since it may hold that pair.
+ */
+export declare function retainedPairOf(store: string, owner: string, postTree: string): GitDeliveryPair | null;
+/** Roots of every record whose owner still holds custody; dead records are
+ * removed unless `dryRun`. `retired` names owners a retention pass retires now
+ * (a dry run has not written their tombstones, yet must count the same set). */
+export declare function liveRootRecords(store: string, dryRun?: boolean, retired?: ReadonlySet<string>): string[];
+//# sourceMappingURL=object-store-roots.d.ts.map

package/dist/object-store-roots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-store-roots.d.ts","sourceRoot":"","sources":["../src/object-store-roots.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAMpD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EAAE,EACf,IAAI,CAAC,EAAE,eAAe,GACrB,MAAM,CAuBR;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,eAAe,GAAG,IAAI,CAkBxB;AAcD;;gFAEgF;AAChF,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,MAAM,UAAQ,EACd,OAAO,GAAE,WAAW,CAAC,MAAM,CAAa,GACvC,MAAM,EAAE,CAoBV"}

package/dist/object-store-roots.js

@@ -0,0 +1,114 @@
+import { mkdirSync, readdirSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { GitDeliveryPair } from "@claudexor/schema";
+import { WorkspaceError } from "@claudexor/core";
+import { existsStrict } from "./fs-presence.js";
+import { controlDir } from "./object-store-leases.js";
+import { runFilesExpired } from "./run-expiry.js";
+/**
+ * Durable custody: a root record names the objects it keeps and the path that
+ * owns them (a run directory, a thread directory, an envelope, an anchor). It
+ * is live while its owner exists, so retention of the owner is retention of its
+ * objects, and roots are durable the moment an import is verified (no caller
+ * has to finish later). A run directory retention retired keeps only
+ * `tombstone.yaml`: its payload is gone, and so is its custody. A record appears
+ * whole by one rename: one torn by a crash or a full disk would refuse every
+ * later prune of its project.
+ */
+export function writeRootRecord(store, owner, roots, pair) {
+    const dir = controlDir(store, "roots");
+    const tmp = controlDir(store, "tmp");
+    mkdirSync(dir, { recursive: true });
+    mkdirSync(tmp, { recursive: true });
+    const name = `${Date.now()}-${process.pid}-${randomUUID()}.json`;
+    const staged = join(tmp, `root-${name}`);
+    try {
+        writeFileSync(staged, JSON.stringify({
+            owner,
+            roots,
+            created_at: new Date().toISOString(),
+            ...(pair ? { pair } : {}),
+        }) + "\n", { mode: 0o600 });
+        renameSync(staged, join(dir, name));
+    }
+    finally {
+        rmSync(staged, { force: true });
+    }
+    return join(dir, name);
+}
+/**
+ * The newest delivery pair kept under `owner` whose post-tree is `postTree`:
+ * a delivery retains its pair before it writes, so a replay that finds the
+ * result already applied (its caller died before recording it) recovers the
+ * pair revert needs. Null when no such record exists; a record directory that
+ * cannot be looked at throws, since it may hold that pair.
+ */
+export function retainedPairOf(store, owner, postTree) {
+    const dir = controlDir(store, "roots");
+    if (!existsStrict(dir))
+        return null;
+    let newest = null;
+    for (const name of readdirSync(dir)) {
+        let record;
+        try {
+            record = JSON.parse(readFileSync(join(dir, name), "utf8"));
+        }
+        catch {
+            continue;
+        }
+        if (record.owner !== owner || record.pair === undefined)
+            continue;
+        const pair = GitDeliveryPair.safeParse(record.pair);
+        if (!pair.success || pair.data.post_tree !== postTree)
+            continue;
+        const at = Date.parse(String(record.created_at));
+        if (!newest || at >= newest.at)
+            newest = { at, pair: pair.data };
+    }
+    return newest?.pair ?? null;
+}
+/** An owner path that still holds custody: it exists and is not a retired run. */
+function ownerHoldsCustody(owner, retired) {
+    if (retired.has(owner))
+        return false;
+    try {
+        return existsStrict(owner) && !runFilesExpired(owner);
+    }
+    catch {
+        // An owner whose presence or retirement cannot be read (only ENOENT and ENOTDIR
+        // say it is gone) keeps its objects.
+        return true;
+    }
+}
+/** Roots of every record whose owner still holds custody; dead records are
+ * removed unless `dryRun`. `retired` names owners a retention pass retires now
+ * (a dry run has not written their tombstones, yet must count the same set). */
+export function liveRootRecords(store, dryRun = false, retired = new Set()) {
+    const dir = controlDir(store, "roots");
+    // A record directory that cannot be looked at may name live roots: it throws.
+    if (!existsStrict(dir))
+        return [];
+    const roots = [];
+    for (const name of readdirSync(dir)) {
+        const path = join(dir, name);
+        let record;
+        try {
+            record = JSON.parse(readFileSync(path, "utf8"));
+        }
+        catch {
+            // Unreadable custody is never treated as absent: keep everything it could name.
+            throw new WorkspaceError(`object store root record ${path} is unreadable; pruning refused`);
+        }
+        if (typeof record.owner === "string" && ownerHoldsCustody(record.owner, retired)) {
+            if (Array.isArray(record.roots))
+                for (const root of record.roots)
+                    if (typeof root === "string")
+                        roots.push(root);
+        }
+        else if (!dryRun)
+            unlinkSync(path);
+    }
+    return roots;
+}
+//# sourceMappingURL=object-store-roots.js.map

package/dist/object-store-roots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-store-roots.js","sourceRoot":"","sources":["../src/object-store-roots.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,WAAW,EACX,YAAY,EACZ,UAAU,EACV,MAAM,EACN,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAa,EACb,KAAa,EACb,KAAe,EACf,IAAsB;IAEtB,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,OAAO,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,aAAa,CACX,MAAM,EACN,IAAI,CAAC,SAAS,CAAC;YACb,KAAK;YACL,KAAK;YACL,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1B,CAAC,GAAG,IAAI,EACT,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;QACF,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAa,EACb,KAAa,EACb,QAAgB;IAEhB,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,MAAM,GAAiD,IAAI,CAAC;IAChE,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,MAAiE,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,SAAS;QAClE,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ;YAAE,SAAS;QAChE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC,EAAE;YAAE,MAAM,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,KAAa,EAAE,OAA4B;IACpE,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;QAChF,qCAAqC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;gFAEgF;AAChF,MAAM,UAAU,eAAe,CAC7B,KAAa,EACb,MAAM,GAAG,KAAK,EACd,OAAO,GAAwB,IAAI,GAAG,EAAE;IAExC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,8EAA8E;IAC9E,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,MAA4C,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;YAChF,MAAM,IAAI,cAAc,CAAC,4BAA4B,IAAI,iCAAiC,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YACjF,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;oBAAE,IAAI,OAAO,IAAI,KAAK,QAAQ;wBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpF,CAAC;aAAM,IAAI,CAAC,MAAM;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}