@fffattiger/pix-cli 0.1.0

package/dist/supervise.d.ts

@@ -0,0 +1,131 @@
+import { type ChildProcess } from "node:child_process";
+import { type SessiondPaths } from "@fffattiger/pix-sessiond/control";
+export interface ShutdownOptions {
+    /** Override the bounded shutdown wait (default 10s). Useful for tests. */
+    timeoutMs?: number;
+}
+export type ShutdownResult = {
+    action: "already-down";
+    pid: number | undefined;
+} | {
+    action: "obstructed";
+    pid: number | undefined;
+    reason: string;
+} | {
+    action: "terminated";
+    pid: number;
+} | {
+    action: "failed";
+    pid: number;
+    reason: string;
+};
+export interface SessiondLocation {
+    directory: string;
+    endpoint: string;
+    paths: SessiondPaths;
+}
+export interface SessiondStatus {
+    /** A lock file names a live pid. */
+    alive: boolean;
+    /** That live instance also answers an RPC ping. */
+    pingable: boolean;
+    /**
+     * When true, a daemon must NOT be spawned for this directory: some live or
+     * unsafe state blocks ownership (a live listener without a lock, an unsafe
+     * lock, or a live-but-unreachable pid).
+     */
+    obstructed: boolean;
+    /** Human-readable reason when {@link obstructed} is true. */
+    obstruction: string | undefined;
+    pid: number | undefined;
+    instanceId: string | undefined;
+    directory: string;
+    endpoint: string;
+}
+export interface EnsureResult {
+    directory: string;
+    endpoint: string;
+    pid: number | undefined;
+    instanceId: string | undefined;
+    reused: boolean;
+}
+export type Logger = (message: string) => void;
+/** Resolve the sessiond location for a (possibly env-overridden) directory. */
+export declare function locateSessiond(directory?: string): SessiondLocation;
+/**
+ * Inspect a (possibly running) sessiond without side effects. Reuse decisions
+ * must NOT rely on pid-aliveness alone: a recycled pid or a hung daemon would
+ * look "alive" but be unusable, so reachability is confirmed by a real ping.
+ * Fail-closed for spawn decisions: an unsafe lock, a live listener without a
+ * lock, an unsafe secret file, or a live-but-unreachable pid marks the
+ * directory as obstructed so callers never spawn a second daemon over it.
+ */
+export declare function inspectSessiond(directory?: string): Promise<SessiondStatus>;
+/**
+ * Detached, unref'd spawn of the foreground `pix-sessiond` bin so the daemon
+ * survives the supervisor (host) process exiting. `stdio: "ignore"` +
+ * `windowsHide` keep it headless; `unref()` ensures the supervisor's event loop
+ * is not kept alive by the child handle.
+ */
+export declare function spawnSessiond(directory: string): ChildProcess;
+/**
+ * Revalidate the probe→reuse decision (Phase 7A race fence): the EXACT
+ * instance the compatibility probe authenticated (pid + instanceId) must still
+ * own the lock and still answer a bounded authenticated ping at commit time.
+ * Deterministic and never throws: `false` means the observed instance is not
+ * provably current — the caller must re-decide (bounded) or fail closed; it
+ * must NEVER reuse or spawn over the directory on that guess.
+ */
+export declare function revalidateSessiondInstance(paths: SessiondPaths, observed: {
+    pid: number | undefined;
+    instanceId: string | undefined;
+}, secret: string): Promise<boolean>;
+/**
+ * Ensure a pingable sessiond is running for `directory`. Reuses an existing,
+ * reachable instance ONLY when it is POSITIVELY authenticated AND passes the
+ * explicit Phase 7A build compatibility matrix (product, protocol, sessiond /
+ * Worker / adapter contract generations, and the deterministic capability
+ * fingerprint — the same protocol major is NEVER sufficient to reuse).
+ *
+ * Compatibility is classified into explicit states ({@link probeSessiondCompatibility}):
+ *  - `current` ⇒ reuse as-is, but only after the probe→reuse decision is
+ *    REVALIDATED against the exact lock instance (bounded race fence: a daemon
+ *    replaced between probe and commit is never silently reused; at most
+ *    {@link MAX_ENSURE_ATTEMPTS} bounded re-decisions, then a fixed operator
+ *    error — never a spawn over unverifiable state).
+ *  - `staleBuild` (current protocol, missing/failing build identity) and
+ *    `knownLegacy` (positively authenticated protocol v1) ⇒ ordinary start/
+ *    ensure MUST leave the live incompatible daemon intact (busy or idle;
+ *    occupancy is never guessed from a client snapshot) and fail closed with
+ *    the fixed operator instruction. There is no auto-maintenance/quiescent
+ *    replacement API in this path. Explicit `shutdownSessiond` / `pix down
+ *    --all` remain the authorized lifecycle methods.
+ *  - `unverifiable` (transient hello timeout, auth failure, malformed or
+ *    unparseable response — including a malformed build block — or secret
+ *    unreadable) ⇒ the running daemon is PRESERVED and a retryable/fixed
+ *    operator error is returned — authority is never destroyed on a guess.
+ */
+export declare function ensureSessiond(directory?: string, log?: Logger): Promise<EnsureResult>;
+/**
+ * Stop the sessiond named by `directory`'s lock via its authenticated RPC
+ * control method (`system.shutdown`), then wait boundedly until the pid, lock
+ * file and socket are all cleared. Idempotent: a missing/stale lock is a no-op
+ * returning "already-down".
+ *
+ * RPC-only production authority (no SIGTERM/PID fallback): the AUTH secret and
+ * the exact lock instance identity are read from the local secure state, the
+ * request is authenticated and instance-fenced by the daemon, and the daemon
+ * ACKs the response to the client BEFORE beginning its shutdown transition. The
+ * pid is used only as a final observation that the authenticated instance
+ * exited — never to signal/kill. Any wrong secret / wrong instance / unsupported
+ * / timeout / connection failure returns a sanitized failure and leaves the
+ * target process untouched (old daemons without the control method are not
+ * killable via a fallback).
+ *
+ * Fail-closed: an unsafe lock, a live listener without a lock, or a
+ * live-but-unreachable pid is never touched — the daemon state is not safely
+ * owned, so the caller is told it is obstructed instead of being reported as
+ * already-down (which would hide a live authority from the operator).
+ */
+export declare function shutdownSessiond(directory?: string, options?: ShutdownOptions): Promise<ShutdownResult>;
+//# sourceMappingURL=supervise.d.ts.map

package/dist/supervise.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervise.d.ts","sourceRoot":"","sources":["../src/supervise.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,EAQL,KAAK,aAAa,EACnB,MAAM,kCAAkC,CAAC;AAoB1C,MAAM,WAAW,eAAe;IAC9B,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,aAAa,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,oCAAoC;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,mDAAmD;IACnD,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;AAE/C,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAInE;AAgBD;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAgFjF;AAWD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,CAU7D;AAkFD;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE;IAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EACrE,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,cAAc,CAClC,SAAS,CAAC,EAAE,MAAM,EAClB,GAAG,GAAE,MAAuB,GAC3B,OAAO,CAAC,YAAY,CAAC,CA4EvB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,cAAc,CAAC,CA8EzB"}

package/dist/supervise.js

@@ -0,0 +1,453 @@
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { instanceAlive, listPrivateSocketAliases, probeSocket, readInstanceLockStrict, resolveRuntimeDir, sessiondPaths, } from "@fffattiger/pix-sessiond/control";
+import { SessiondRpcClient } from "@fffattiger/pix-sessiond/client";
+import { SessiondError } from "@fffattiger/pix-sessiond";
+import { readLocalSecret, UnsafeSecretError } from "./secret.js";
+import { probeSessiondCompatibility, pingLegacyV1Sessiond, pingSessiond, shutdownLegacyV1Sessiond, } from "./probe.js";
+import { resolveSessiondBin } from "./paths.js";
+const READINESS_TIMEOUT_MS = 10_000;
+const SHUTDOWN_TIMEOUT_MS = 10_000;
+const SHUTDOWN_RPC_TIMEOUT_MS = 5_000;
+const POLL_INTERVAL_MS = 100;
+const REVALIDATE_PING_TIMEOUT_MS = 1_000;
+/** Bounded probe→reuse revalidation attempts (Phase 7A race fence). */
+const MAX_ENSURE_ATTEMPTS = 2;
+/** Resolve the sessiond location for a (possibly env-overridden) directory. */
+export function locateSessiond(directory) {
+    const dir = resolveRuntimeDir(directory);
+    const paths = sessiondPaths(dir);
+    return { directory: dir, endpoint: paths.endpoint, paths };
+}
+function pidAlive(pid) {
+    if (!Number.isSafeInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Inspect a (possibly running) sessiond without side effects. Reuse decisions
+ * must NOT rely on pid-aliveness alone: a recycled pid or a hung daemon would
+ * look "alive" but be unusable, so reachability is confirmed by a real ping.
+ * Fail-closed for spawn decisions: an unsafe lock, a live listener without a
+ * lock, an unsafe secret file, or a live-but-unreachable pid marks the
+ * directory as obstructed so callers never spawn a second daemon over it.
+ */
+export async function inspectSessiond(directory) {
+    const { directory: dir, endpoint, paths } = locateSessiond(directory);
+    const lock = await readInstanceLockStrict(paths);
+    if (lock.kind === "unsafe") {
+        // Never treat an unsafe lock as absent and never auto-remove it.
+        return {
+            alive: false,
+            pingable: false,
+            obstructed: true,
+            obstruction: lock.reason,
+            pid: undefined,
+            instanceId: undefined,
+            directory: dir,
+            endpoint,
+        };
+    }
+    if (lock.kind === "missing") {
+        // No lock: a live public/private listener is an orphan that lost its lock;
+        // spawning another daemon would create a second authority over it.
+        if (await anyLiveSocket(paths)) {
+            return {
+                alive: false,
+                pingable: false,
+                obstructed: true,
+                obstruction: "a live sessiond socket exists without an instance lock",
+                pid: undefined,
+                instanceId: undefined,
+                directory: dir,
+                endpoint,
+            };
+        }
+        return { alive: false, pingable: false, obstructed: false, obstruction: undefined, pid: undefined, instanceId: undefined, directory: dir, endpoint };
+    }
+    const alive = pidAlive(lock.record.pid);
+    if (!alive) {
+        return {
+            alive: false,
+            pingable: false,
+            obstructed: false,
+            obstruction: undefined,
+            pid: lock.record.pid,
+            instanceId: lock.record.instanceId,
+            directory: dir,
+            endpoint,
+        };
+    }
+    // An unsafe secret (symlink / non-regular / too-short) means this live pid
+    // cannot be confirmed as ours: classify as obstructed with a fixed reason
+    // instead of letting the read error escape to the CLI as a stack trace.
+    let secret;
+    try {
+        secret = await readLocalSecret(paths.secretFile);
+    }
+    catch (error) {
+        if (!(error instanceof UnsafeSecretError))
+            throw error;
+        return {
+            alive: true,
+            pingable: false,
+            obstructed: true,
+            obstruction: "sessiond secret file is unsafe",
+            pid: lock.record.pid,
+            instanceId: lock.record.instanceId,
+            directory: dir,
+            endpoint,
+        };
+    }
+    const pingable = secret !== undefined
+        ? (await pingSessiond(endpoint, secret)) || (await pingLegacyV1Sessiond(endpoint, secret))
+        : false;
+    // A live pid that is unreachable is authoritative until it dies or is
+    // explicitly downed: never spawn a replacement over it.
+    return {
+        alive: true,
+        pingable,
+        obstructed: !pingable,
+        obstruction: !pingable ? "sessiond pid is alive but not reachable" : undefined,
+        pid: lock.record.pid,
+        instanceId: lock.record.instanceId,
+        directory: dir,
+        endpoint,
+    };
+}
+/** True when any Pix-named Unix socket in the directory answers a connect. */
+async function anyLiveSocket(paths) {
+    if ((await probeSocket(paths.endpoint)) === "live")
+        return true;
+    for (const alias of await listPrivateSocketAliases(paths.directory)) {
+        if ((await probeSocket(alias)) === "live")
+            return true;
+    }
+    return false;
+}
+/**
+ * Detached, unref'd spawn of the foreground `pix-sessiond` bin so the daemon
+ * survives the supervisor (host) process exiting. `stdio: "ignore"` +
+ * `windowsHide` keep it headless; `unref()` ensures the supervisor's event loop
+ * is not kept alive by the child handle.
+ */
+export function spawnSessiond(directory) {
+    const bin = resolveSessiondBin();
+    const child = spawn(process.execPath, [bin], {
+        env: { ...process.env, PIX_SESSIOND_DIR: directory },
+        stdio: "ignore",
+        detached: true,
+        windowsHide: true,
+    });
+    child.unref();
+    return child;
+}
+/**
+ * Poll a freshly-spawned daemon until it answers a ping. Detects early child
+ * exit (so a crash-on-start is reported immediately, not after the full
+ * timeout) and enforces a hard {@link READINESS_TIMEOUT_MS} ceiling.
+ */
+async function waitForReadiness(paths, child) {
+    const deadline = Date.now() + READINESS_TIMEOUT_MS;
+    let exitCode = null;
+    child.once("exit", (code) => {
+        exitCode = code ?? -1;
+    });
+    while (Date.now() < deadline) {
+        if (exitCode !== null) {
+            return {
+                ok: false,
+                error: new Error(`sessiond exited early (code ${exitCode}) before becoming ready`),
+            };
+        }
+        // A transient FS error (e.g. mid-bootstrap) must not abort readiness; treat
+        // it as "not ready yet" and rely on exit detection + the hard timeout.
+        let secret;
+        try {
+            secret = await readLocalSecret(paths.secretFile);
+        }
+        catch {
+            secret = undefined;
+        }
+        if (secret !== undefined && (await pingSessiond(paths.endpoint, secret, 1_000))) {
+            return { ok: true, error: undefined };
+        }
+        await sleep(POLL_INTERVAL_MS);
+    }
+    return { ok: false, error: new Error(`sessiond did not become ready within ${READINESS_TIMEOUT_MS}ms`) };
+}
+/**
+ * Fixed operator instruction when a running sessiond's protocol version cannot
+ * be positively verified (transient hello timeout, auth failure, malformed or
+ * unparseable response, secret unreadable). The daemon is ALWAYS preserved — an
+ * unverified daemon is never shut down or replaced on a guess. Never echoes the
+ * endpoint, pid, instance id or raw error.
+ */
+const UNVERIFIABLE_INSTRUCTION = "[pix] could not verify the running sessiond's protocol version; it was left untouched. Wait a moment and run `pix start` again, or stop it with `pix down --all` if it is genuinely stale";
+/**
+ * Fixed operator instruction when a stale (protocol-v1) sessiond cannot be
+ * safely replaced. Ordinary start/ensure never auto-stops it. The only CLI
+ * stop path is the explicit `pix down --all` command, which ends sessions and
+ * must be a deliberate maintenance action. Never echoes the endpoint, pid,
+ * instance id or raw error.
+ */
+const STALE_DAEMON_INSTRUCTION = "[pix] a sessiond with an incompatible protocol version is running and was left untouched; `pix down --all` is the explicit maintenance stop and will end sessions, then run `pix start` again";
+/**
+ * Fixed operator instruction when a running sessiond FAILS the explicit Phase
+ * 7A build compatibility matrix (missing/old/mismatched build identity — the
+ * same protocol major alone never proves implementation compatibility) and
+ * could not be safely replaced via the authenticated, instance-fenced
+ * shutdown path. Never echoes the endpoint, pid, instance id, build values, or
+ * raw error.
+ */
+const STALE_BUILD_INSTRUCTION = "[pix] the running sessiond is a different, incompatible pix build and was left untouched; `pix down --all` is the explicit maintenance stop and will end sessions, then update the pix installation so all pix dists come from the same build and run `pix start` again";
+/**
+ * Fixed operator instruction when the probe→reuse decision could not be
+ * revalidated: the daemon observed by the compatibility probe is not provably
+ * the exact instance that owns the directory at commit time (it was replaced
+ * or exited mid-probe on every bounded attempt). Nothing is ever spawned or
+ * destroyed on a guess.
+ */
+const PROBE_REUSE_RACE_INSTRUCTION = "[pix] the running sessiond changed while its build was being verified; it was left untouched. Run `pix start` again";
+/**
+ * Revalidate the probe→reuse decision (Phase 7A race fence): the EXACT
+ * instance the compatibility probe authenticated (pid + instanceId) must still
+ * own the lock and still answer a bounded authenticated ping at commit time.
+ * Deterministic and never throws: `false` means the observed instance is not
+ * provably current — the caller must re-decide (bounded) or fail closed; it
+ * must NEVER reuse or spawn over the directory on that guess.
+ */
+export async function revalidateSessiondInstance(paths, observed, secret) {
+    if (observed.pid === undefined || observed.instanceId === undefined)
+        return false;
+    const lock = await readInstanceLockStrict(paths);
+    if (lock.kind !== "ok")
+        return false;
+    if (lock.record.pid !== observed.pid || lock.record.instanceId !== observed.instanceId)
+        return false;
+    if (!pidAlive(lock.record.pid))
+        return false;
+    return pingSessiond(paths.endpoint, secret, REVALIDATE_PING_TIMEOUT_MS);
+}
+/**
+ * Ensure a pingable sessiond is running for `directory`. Reuses an existing,
+ * reachable instance ONLY when it is POSITIVELY authenticated AND passes the
+ * explicit Phase 7A build compatibility matrix (product, protocol, sessiond /
+ * Worker / adapter contract generations, and the deterministic capability
+ * fingerprint — the same protocol major is NEVER sufficient to reuse).
+ *
+ * Compatibility is classified into explicit states ({@link probeSessiondCompatibility}):
+ *  - `current` ⇒ reuse as-is, but only after the probe→reuse decision is
+ *    REVALIDATED against the exact lock instance (bounded race fence: a daemon
+ *    replaced between probe and commit is never silently reused; at most
+ *    {@link MAX_ENSURE_ATTEMPTS} bounded re-decisions, then a fixed operator
+ *    error — never a spawn over unverifiable state).
+ *  - `staleBuild` (current protocol, missing/failing build identity) and
+ *    `knownLegacy` (positively authenticated protocol v1) ⇒ ordinary start/
+ *    ensure MUST leave the live incompatible daemon intact (busy or idle;
+ *    occupancy is never guessed from a client snapshot) and fail closed with
+ *    the fixed operator instruction. There is no auto-maintenance/quiescent
+ *    replacement API in this path. Explicit `shutdownSessiond` / `pix down
+ *    --all` remain the authorized lifecycle methods.
+ *  - `unverifiable` (transient hello timeout, auth failure, malformed or
+ *    unparseable response — including a malformed build block — or secret
+ *    unreadable) ⇒ the running daemon is PRESERVED and a retryable/fixed
+ *    operator error is returned — authority is never destroyed on a guess.
+ */
+export async function ensureSessiond(directory, log = () => { }) {
+    const { directory: dir, endpoint, paths } = locateSessiond(directory);
+    let spawnFresh = false;
+    for (let attempt = 1;; attempt += 1) {
+        const existing = await inspectSessiond(dir);
+        if (existing.pingable) {
+            // Re-read the secret strictly. A missing or unsafe secret means we cannot
+            // authenticate the running daemon: it is unverifiable and MUST be preserved
+            // (a secret-read failure must never destroy authority).
+            let secret;
+            try {
+                secret = await readLocalSecret(paths.secretFile);
+            }
+            catch (error) {
+                if (error instanceof UnsafeSecretError) {
+                    throw new Error(UNVERIFIABLE_INSTRUCTION);
+                }
+                throw error;
+            }
+            if (secret === undefined) {
+                throw new Error(UNVERIFIABLE_INSTRUCTION);
+            }
+            // Classify the daemon explicitly. Reuse only a positively authenticated,
+            // protocol-CURRENT, BUILD-COMPATIBLE daemon.
+            const compat = await probeSessiondCompatibility(endpoint, secret);
+            if (compat.state === "current") {
+                // Probe→reuse race fence: the exact authenticated instance must still
+                // own the directory when we commit to reuse. A daemon replaced or lost
+                // mid-probe triggers a bounded re-decision, never a silent reuse.
+                const stillOwned = await revalidateSessiondInstance(paths, { pid: existing.pid, instanceId: existing.instanceId }, secret);
+                if (stillOwned) {
+                    log(`reusing sessiond (pid ${existing.pid}) at ${dir}`);
+                    return { directory: dir, endpoint, pid: existing.pid, instanceId: existing.instanceId, reused: true };
+                }
+                if (attempt >= MAX_ENSURE_ATTEMPTS) {
+                    throw new Error(PROBE_REUSE_RACE_INSTRUCTION);
+                }
+                continue;
+            }
+            if (compat.state === "unverifiable") {
+                // Transient hello timeout / auth failure / malformed or unparseable
+                // response: preserve the running daemon and return a fixed operator
+                // error — never shut it down on a guess.
+                throw new Error(UNVERIFIABLE_INSTRUCTION);
+            }
+            // staleBuild / knownLegacy: a positively authenticated live daemon this
+            // build must not silently reuse AND must not be auto-replaced. Ordinary
+            // start/ensure leaves it intact even when it appears idle — occupancy is
+            // not a client-side guess, and this slice has no auto-maintenance fence.
+            throw new Error(compat.state === "staleBuild" ? STALE_BUILD_INSTRUCTION : STALE_DAEMON_INSTRUCTION);
+        }
+        else if (existing.obstructed) {
+            // Fail closed: never spawn over a live listener without a lock, an unsafe
+            // lock, or a live-but-unreachable pid.
+            throw new Error(`[pix] cannot start sessiond: ${existing.obstruction ?? "sessiond state is unsafe"}`);
+        }
+        else {
+            spawnFresh = true;
+        }
+        break;
+    }
+    if (!spawnFresh) {
+        // Unreachable: every loop iteration either returns, throws, or sets spawnFresh.
+        throw new Error(PROBE_REUSE_RACE_INSTRUCTION);
+    }
+    log(`starting sessiond at ${dir}`);
+    const child = spawnSessiond(dir);
+    const readiness = await waitForReadiness(paths, child);
+    if (!readiness.ok) {
+        throw readiness.error ?? new Error("[pix] sessiond did not become ready");
+    }
+    const lock = await readInstanceLockStrict(paths);
+    const record = lock.kind === "ok" ? lock.record : undefined;
+    log(`sessiond ready (pid ${record?.pid}) at ${dir}`);
+    return { directory: dir, endpoint, pid: record?.pid, instanceId: record?.instanceId, reused: false };
+}
+/**
+ * Stop the sessiond named by `directory`'s lock via its authenticated RPC
+ * control method (`system.shutdown`), then wait boundedly until the pid, lock
+ * file and socket are all cleared. Idempotent: a missing/stale lock is a no-op
+ * returning "already-down".
+ *
+ * RPC-only production authority (no SIGTERM/PID fallback): the AUTH secret and
+ * the exact lock instance identity are read from the local secure state, the
+ * request is authenticated and instance-fenced by the daemon, and the daemon
+ * ACKs the response to the client BEFORE beginning its shutdown transition. The
+ * pid is used only as a final observation that the authenticated instance
+ * exited — never to signal/kill. Any wrong secret / wrong instance / unsupported
+ * / timeout / connection failure returns a sanitized failure and leaves the
+ * target process untouched (old daemons without the control method are not
+ * killable via a fallback).
+ *
+ * Fail-closed: an unsafe lock, a live listener without a lock, or a
+ * live-but-unreachable pid is never touched — the daemon state is not safely
+ * owned, so the caller is told it is obstructed instead of being reported as
+ * already-down (which would hide a live authority from the operator).
+ */
+export async function shutdownSessiond(directory, options = {}) {
+    const { paths } = locateSessiond(directory);
+    const status = await inspectSessiond(directory);
+    if (status.obstructed) {
+        return {
+            action: "obstructed",
+            pid: status.pid,
+            reason: status.obstruction ?? "sessiond state is unsafe",
+        };
+    }
+    if (status.pid === undefined || !status.alive) {
+        return { action: "already-down", pid: status.pid };
+    }
+    // The exact authenticated instance identity comes from the strict lock read;
+    // without it we can never authorize a shutdown of this instance.
+    if (status.instanceId === undefined) {
+        return { action: "failed", pid: status.pid, reason: "sessiond instance identity is unknown" };
+    }
+    // The AUTH secret is mandatory and read strictly (never created). A missing
+    // or unsafe secret means we cannot authenticate and must fail closed.
+    let secret;
+    try {
+        secret = await readLocalSecret(paths.secretFile);
+    }
+    catch (error) {
+        if (error instanceof UnsafeSecretError) {
+            return { action: "failed", pid: status.pid, reason: "sessiond secret is unsafe" };
+        }
+        throw error;
+    }
+    if (secret === undefined) {
+        return { action: "failed", pid: status.pid, reason: "sessiond secret is unavailable" };
+    }
+    // Authenticate + instance-fence, then call system.shutdown with the exact
+    // instance id. The daemon ACKs the response before it begins to shut down, so
+    // a successful call means the transition was authorized and accepted.
+    const rpcTimeoutMs = options.timeoutMs ?? SHUTDOWN_RPC_TIMEOUT_MS;
+    const client = new SessiondRpcClient({ endpoint: paths.endpoint, secret, timeoutMs: rpcTimeoutMs });
+    let accepted = false;
+    let currentFailure;
+    try {
+        const result = await client.call("system.shutdown", { instanceId: status.instanceId });
+        accepted = result.accepted === true;
+    }
+    catch (error) {
+        currentFailure = error;
+    }
+    if (!accepted) {
+        // Coordinated v1→v2 rollout: a current client cannot schema-parse a v1
+        // control response. Retry exactly once with the narrow legacy envelope,
+        // still authenticated and fenced by the SAME strict-lock instance id.
+        accepted = await shutdownLegacyV1Sessiond(paths.endpoint, secret, status.instanceId, rpcTimeoutMs);
+    }
+    if (!accepted) {
+        // Never echo the secret, endpoint, instance id, or a raw error/stack.
+        return {
+            action: "failed",
+            pid: status.pid,
+            reason: currentFailure === undefined
+                ? "sessiond did not accept shutdown"
+                : sanitizeShutdownFailure(currentFailure),
+        };
+    }
+    // Wait boundedly for the authenticated instance to exit: the owned socket and
+    // lock disappear and the pid (final observation only) dies.
+    const deadline = Date.now() + (options.timeoutMs ?? SHUTDOWN_TIMEOUT_MS);
+    while (Date.now() < deadline) {
+        // instanceAlive reads the lock each poll; once the daemon releases it the
+        // lock file is gone and instanceAlive returns false.
+        if (!(await instanceAlive(paths)) && !existsSync(paths.endpoint)) {
+            return { action: "terminated", pid: status.pid };
+        }
+        await sleep(50);
+    }
+    return { action: "failed", pid: status.pid, reason: "timeout" };
+}
+/** Map an RPC shutdown failure onto a fixed sanitized reason (never secret/endpoint/instance/stack). */
+function sanitizeShutdownFailure(error) {
+    if (error instanceof SessiondError) {
+        switch (error.code) {
+            case "unauthorized": return "sessiond refused shutdown (unauthorized)";
+            case "forbidden": return "sessiond refused shutdown (instance mismatch)";
+            case "unsupported_capability": return "sessiond does not support remote shutdown";
+            case "timeout": return "timeout waiting for sessiond shutdown response";
+            case "invalid_request": return "sessiond rejected the shutdown request";
+            default: return "sessiond refused shutdown";
+        }
+    }
+    return "sessiond refused shutdown";
+}
+//# sourceMappingURL=supervise.js.map

package/dist/supervise.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervise.js","sourceRoot":"","sources":["../src/supervise.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EACL,aAAa,EACb,wBAAwB,EACxB,WAAW,EACX,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,GAGd,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,YAAY,EACZ,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AACtC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,0BAA0B,GAAG,KAAK,CAAC;AACzC,uEAAuE;AACvE,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAgD9B,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,SAAkB;IAC/C,MAAM,GAAG,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAkB;IACtD,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACtE,MAAM,IAAI,GAAqB,MAAM,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,iEAAiE;QACjE,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,IAAI,CAAC,MAAM;YACxB,GAAG,EAAE,SAAS;YACd,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,GAAG;YACd,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,2EAA2E;QAC3E,mEAAmE;QACnE,IAAI,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,wDAAwD;gBACrE,GAAG,EAAE,SAAS;gBACd,UAAU,EAAE,SAAS;gBACrB,SAAS,EAAE,GAAG;gBACd,QAAQ;aACT,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IACvJ,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,KAAK;YACjB,WAAW,EAAE,SAAS;YACtB,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;YACpB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAClC,SAAS,EAAE,GAAG;YACd,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,iBAAiB,CAAC;YAAE,MAAM,KAAK,CAAC;QACvD,OAAO;YACL,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,gCAAgC;YAC7C,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;YACpB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAClC,SAAS,EAAE,GAAG;YACd,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS;QACnC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1F,CAAC,CAAC,KAAK,CAAC;IACV,sEAAsE;IACtE,wDAAwD;IACxD,OAAO;QACL,KAAK,EAAE,IAAI;QACX,QAAQ;QACR,UAAU,EAAE,CAAC,QAAQ;QACrB,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,SAAS;QAC9E,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;QACpB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;QAClC,SAAS,EAAE,GAAG;QACd,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,aAAa,CAAC,KAAoB;IAC/C,IAAI,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAChE,KAAK,MAAM,KAAK,IAAI,MAAM,wBAAwB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE;QAC3C,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,SAAS,EAAE;QACpD,KAAK,EAAE,QAAQ;QACf,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,OAAO,KAAK,CAAC;AACf,CAAC;AAOD;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAAC,KAAoB,EAAE,KAAmB;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC;IACnD,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1B,QAAQ,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,IAAI,KAAK,CAAC,+BAA+B,QAAQ,yBAAyB,CAAC;aACnF,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,uEAAuE;QACvE,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QACxC,CAAC;QACD,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,wCAAwC,oBAAoB,IAAI,CAAC,EAAE,CAAC;AAC3G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,wBAAwB,GAC5B,2LAA2L,CAAC;AAE9L;;;;;;GAMG;AACH,MAAM,wBAAwB,GAC5B,+LAA+L,CAAC;AAElM;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAC3B,yQAAyQ,CAAC;AAE5Q;;;;;;GAMG;AACH,MAAM,4BAA4B,GAChC,qHAAqH,CAAC;AAExH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAoB,EACpB,QAAqE,EACrE,MAAc;IAEd,IAAI,QAAQ,CAAC,GAAG,KAAK,SAAS,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClF,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACrG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,0BAA0B,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAkB,EAClB,MAAc,GAAS,EAAE,GAAE,CAAC;IAE5B,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,0EAA0E;YAC1E,4EAA4E;YAC5E,wDAAwD;YACxD,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;oBACvC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;gBAC5C,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,CAAC;YACD,yEAAyE;YACzE,6CAA6C;YAC7C,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,sEAAsE;gBACtE,uEAAuE;gBACvE,kEAAkE;gBAClE,MAAM,UAAU,GAAG,MAAM,0BAA0B,CACjD,KAAK,EACL,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,EACtD,MAAM,CACP,CAAC;gBACF,IAAI,UAAU,EAAE,CAAC;oBACf,GAAG,CAAC,yBAAyB,QAAQ,CAAC,GAAG,QAAQ,GAAG,EAAE,CAAC,CAAC;oBACxD,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBACxG,CAAC;gBACD,IAAI,OAAO,IAAI,mBAAmB,EAAE,CAAC;oBACnC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBAChD,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,KAAK,cAAc,EAAE,CAAC;gBACpC,oEAAoE;gBACpE,oEAAoE;gBACpE,yCAAyC;gBACzC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,CAAC;YACD,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QACtG,CAAC;aAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC/B,0EAA0E;YAC1E,uCAAuC;YACvC,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,WAAW,IAAI,0BAA0B,EAAE,CAAC,CAAC;QACxG,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,MAAM;IACR,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,gFAAgF;QAChF,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,GAAG,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,SAAS,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,GAAG,CAAC,uBAAuB,MAAM,EAAE,GAAG,QAAQ,GAAG,EAAE,CAAC,CAAC;IACrD,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACvG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAkB,EAClB,UAA2B,EAAE;IAE7B,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,MAAM,CAAC,WAAW,IAAI,0BAA0B;SACzD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IACrD,CAAC;IACD,6EAA6E;IAC7E,iEAAiE;IACjE,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IAChG,CAAC;IACD,4EAA4E;IAC5E,sEAAsE;IACtE,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;YACvC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;QACpF,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACzF,CAAC;IACD,0EAA0E;IAC1E,8EAA8E;IAC9E,sEAAsE;IACtE,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;IACpG,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,cAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACvF,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,QAAQ,GAAG,MAAM,wBAAwB,CACvC,KAAK,CAAC,QAAQ,EACd,MAAM,EACN,MAAM,CAAC,UAAU,EACjB,YAAY,CACb,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,sEAAsE;QACtE,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,cAAc,KAAK,SAAS;gBAClC,CAAC,CAAC,kCAAkC;gBACpC,CAAC,CAAC,uBAAuB,CAAC,cAAc,CAAC;SAC5C,CAAC;IACJ,CAAC;IACD,8EAA8E;IAC9E,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,mBAAmB,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,0EAA0E;QAC1E,qDAAqD;QACrD,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QACnD,CAAC;QACD,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAED,wGAAwG;AACxG,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,KAAK,YAAY,aAAa,EAAE,CAAC;QACnC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,cAAc,CAAC,CAAC,OAAO,0CAA0C,CAAC;YACvE,KAAK,WAAW,CAAC,CAAC,OAAO,+CAA+C,CAAC;YACzE,KAAK,wBAAwB,CAAC,CAAC,OAAO,2CAA2C,CAAC;YAClF,KAAK,SAAS,CAAC,CAAC,OAAO,gDAAgD,CAAC;YACxE,KAAK,iBAAiB,CAAC,CAAC,OAAO,wCAAwC,CAAC;YACxE,OAAO,CAAC,CAAC,OAAO,2BAA2B,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,2BAA2B,CAAC;AACrC,CAAC"}

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@fffattiger/pix-cli",
+  "version": "0.1.0",
+  "description": "Production composition + lifecycle CLI for pix: ensure/reuse sessiond, host boot, status, down --all",
+  "type": "module",
+  "engines": { "node": ">=22.19.0" },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" }
+  },
+  "bin": {
+    "pix": "./bin/pix.mjs",
+    "pix-host": "./bin/pix-host.mjs",
+    "pix-sessiond": "./bin/pix-sessiond.mjs"
+  },
+  "files": ["dist", "bin", "client"],
+  "scripts": {
+    "clean": "node ../../scripts/remove-paths.mjs dist dist-test",
+    "prebuild": "node scripts/prebuild-deps.mjs",
+    "build": "npm run clean && tsc -p tsconfig.json",
+    "pretypecheck": "node scripts/prebuild-deps.mjs",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json --noEmit",
+    "pretest": "node scripts/prebuild-deps.mjs",
+    "test": "npm run build:test && node ../../scripts/run-node-test.mjs \"dist-test/**/*.test.js\" --test-concurrency=1",
+    "build:test": "node ../../scripts/remove-paths.mjs dist-test && tsc -p tsconfig.test.json"
+  },
+  "dependencies": {
+    "@fffattiger/pix-host": "0.1.0",
+    "@fffattiger/pix-sessiond": "0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22",
+    "typescript": "^5"
+  }
+}