@happyvertical/smrt-app-runtime 0.55.23 → 0.56.0

package/AGENTS.md

@@ -13,6 +13,20 @@ Application infrastructure composition for the validated runtime profiles in
 - SQLite is acquired through `@happyvertical/sql`'s explicit
   `{ driver: 'node:sqlite', custody: 'trusted-parent' }` boundary after the
   runtime establishes its user-owned mode-0700 data root.
+- The initialization lease lives beside the data root
+  (`<parent>/.smrt-lease-<key>/initialization.sqlite`, #3877), then the legacy
+  `/tmp/.smrt-<uid>/<key>` lease, which older releases take alone: secure when
+  its ancestry is trusted, else lock-only (owner check on unmapped ancestors
+  relaxed, nothing written; skipped only if its directory cannot be created
+  and no lock file exists). It is required (secure) when the parent cannot hold
+  a lease. Legacy candidates, deduplicated and in this order: the in-namespace
+  uid, then that uid mapped through `/proc/self/uid_map` (identity when absent;
+  unparseable/non-covering fails closed); ownership checks still use the
+  in-namespace uid. The beside-data lease taken first keeps that order
+  deadlock-free. Only the in-namespace candidate (when it differs) is skipped
+  if its root is an existing real directory owned by another uid. Acquire in that order; never make the
+  lease location configurable per process — every process sharing a data root
+  must derive the same lease.
 - Application migrations are explicit through `prepareDatabase`; runtime never
   creates application model tables implicitly. A rejected `prepareDatabase` is
   normalized into `LocalRuntimeError` with the stable `migration_failed` code
@@ -28,7 +42,11 @@ Application infrastructure composition for the validated runtime profiles in
   app-bound marker, source separation, real path chain, ownership, and mode
   without creating or repairing storage.
 - Owner bootstrap creates normal `Person`, `User`, `Tenant`, owner `Role` /
-  `Membership`, and `Session` records in one transaction.
+  `Membership`, and `Session` records in one transaction. `ownerTenant`
+  selects the tenant slug (default `default`); because `Tenant` upserts on
+  slug, the claim must look the slug up first and fail closed
+  (`owner_tenant_conflict`) rather than save over it. `adoptExisting` adopts
+  only an active root tenant with zero memberships (#3032).
 - Bootstrap is loopback-only. Only an HMAC of the short-lived token is stored.
   A token that cannot claim fails a read-only preflight before role/catalog
   seeding (#3323); the claim transaction's conditional UPDATE stays the

package/README.md

@@ -55,9 +55,42 @@ complete ancestor/root chain, including macOS ACLs. Failed custody removes the
 pending claim and every directory only when they were created by that attempt;
 an inherited pending claim and its database remain authoritative for retry.
 Initializers for the same data root are serialized across processes by an
-exclusive transaction in a dedicated SQLite lock database under a private
-per-user, root-keyed custody directory. The released `@happyvertical/sql`
-trusted-parent boundary validates that directory, its ancestors, and the lock
+exclusive transaction in a dedicated SQLite lock database under a private,
+root-keyed custody directory kept beside the data it protects:
+`<parent of the data root>/.smrt-lease-<key>/initialization.sqlite`. That
+parent has already passed the custody preflight and is the one location every
+process sharing the data directory sees, so the lease also works inside a user
+namespace (agent sandboxes, rootless containers) where `/tmp` reads as owned by
+the overflow uid. The historical per-user `/tmp/.smrt-<uid>/<key>` lease is
+still taken afterwards, so a process running an older release (which takes
+only that lease) stays excluded. When `/tmp` fails the ancestry owner check
+because its owner is unmapped, the legacy lease is taken lock-only: the lock
+file is never written, every ancestor must still be a real directory that is
+not group/world writable unless sticky, and the lock directories and file must
+be current-user-owned and private. A held legacy lease therefore makes the new
+process wait (and fail closed after two minutes). Inside a user namespace that
+remaps the uid (for example `unshare -Ur`, where host uid 1000 reads as 0), the
+legacy lease is taken for both the in-namespace uid (`/tmp/.smrt-0`, what an
+older release inside the namespace locks) and, in that order, the uid's mapping
+in `/proc/self/uid_map` (`/tmp/.smrt-<host uid>`, what an older host process
+locks); identical paths are taken once, so a host process takes the single
+lease it always did. Every new process takes the beside-data lease first, which
+is what keeps the fixed legacy order deadlock-free. When the in-namespace uid
+differs from its mapping and its `/tmp/.smrt-<uid>` root already exists as a
+real directory owned by someone else (under `unshare -Ur`, host root's
+`/tmp/.smrt-0` reads as the overflow uid), that one candidate is skipped: no
+process in the namespace can hold a lease beneath a root it does not own. A
+symlink there, and any problem with the mapped candidate, still fails closed.
+A map that
+cannot be read, parsed, or does not cover the current uid fails closed. Only
+one namespace level is visible, so a doubly nested remap is not translated
+past its parent. The residual rule: when the
+legacy lock directory cannot be created at all (`/tmp` not writable or
+read-only in that view) and no legacy lock file exists, the legacy lease is
+skipped. When the data root's parent is not writable by the current user (or is
+read-only) the secure `/tmp` lease is required instead, as before. The
+released `@happyvertical/sql`
+trusted-parent boundary validates each lease directory, its ancestors, and the lock
 leaf for ownership, write permissions, static links, and macOS ACLs before it
 opens the lock database. Atomic SQLite locking elects one owner without deleting
 or replacing a pathname, so there is no stale-file ABA window and no PID or
@@ -97,6 +130,14 @@ literals (`127.0.0.0/8` or `::1`), avoiding hostname-resolution ambiguity.
 The first valid claim creates a real global `Person`, `User`, default `Tenant`,
 owner `Role` / `Membership`, and server-side `Session` atomically. Startup and
 setup are idempotent; replayed, expired, or concurrent claims fail closed.
+`ownerTenant: { slug, name, adoptExisting }` (also accepted by the SvelteKit
+runtime) selects the bootstrap tenant; the default is a new tenant with slug
+`default`. Because `Tenant` upserts on its slug, the claim checks first and
+never replaces an existing tenant: it fails with `owner_tenant_conflict`, or,
+with `adoptExisting: true`, adds the owner membership to an application-seeded
+tenant only when that tenant is active, has no parent, and has no memberships of
+any status. An adopted tenant keeps its id and name. A failed claim rolls back
+and leaves the invitation claimable.
 Authenticated session TTLs are configured in whole seconds with a minimum of
 one second, and invalid values are rejected before filesystem mutation.
 
@@ -194,8 +235,8 @@ re-checks on every request that both the peer address and the URL host are
 loopback; its `default` action reads `token`, `name`, `email`, and optional
 `tenantName`, sets the session cookie, and redirects 303, or returns
 `fail(status, { code, message })` with `setup_disabled` (404),
-`setup_unavailable` (403), `setup_invalid_input` (400), or `setup_invalid`
-(400). Claim error text is never returned. After the claim commits, the
+`setup_unavailable` (403), `setup_invalid_input` (400), `setup_invalid`
+(400), or `setup_conflict` (409, the `ownerTenant` slug already exists). Claim error text is never returned. After the claim commits, the
 runtime removes the `smrt app setup` / `recover` hand-off files
 (`ONBOARDING_HANDOFF_FILES`: `onboarding.json`, `onboarding-launch.html`) from
 `runtime.applicationStateRoot()`, so `pnpm app:open` stops offering the spent

package/dist/chunks/{src-vP6GV99v.js → src-DeNO6bG_.js}

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
-import { constants, link, lstat, mkdir, open, readdir, realpath, rmdir, unlink } from "node:fs/promises";
+import { constants, link, lstat, mkdir, open, readFile, readdir, realpath, rmdir, unlink } from "node:fs/promises";
 import { homedir, platform } from "node:os";
 import { dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
@@ -9,7 +9,7 @@ import { resolveApplicationRuntime } from "@happyvertical/smrt-config";
 import { SCHEDULED_JOB_QUEUE, ScheduleRunner, TaskRunner } from "@happyvertical/smrt-jobs";
 import { Person, ProfileTypeCollection } from "@happyvertical/smrt-profiles";
 import { withSystemContext } from "@happyvertical/smrt-tenancy";
-import { DEFAULT_ROLE_SLUGS, MembershipCollection, MembershipStatus, PermissionResolver, RoleCollection, SessionCollection, SessionService, TenantService, UserCollection, UserStatus } from "@happyvertical/smrt-users";
+import { DEFAULT_ROLE_SLUGS, MembershipCollection, MembershipStatus, PermissionResolver, RoleCollection, SessionCollection, SessionService, TenantCollection, TenantService, TenantStatus, UserCollection, UserStatus } from "@happyvertical/smrt-users";
 import { getDatabase } from "@happyvertical/sql";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { chmodSync, closeSync, constants as constants$1, existsSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
@@ -1513,10 +1513,15 @@ var DEFAULT_BIND_HOST = "127.0.0.1";
 var DEFAULT_BOOTSTRAP_TTL_SECONDS = 600;
 var MAX_BOOTSTRAP_TTL_SECONDS = 900;
 var DEFAULT_SESSION_TTL_SECONDS = 10080 * 60;
+var DEFAULT_OWNER_TENANT_SLUG = "default";
+var DEFAULT_OWNER_TENANT_NAME = "My Workspace";
+var OWNER_TENANT_SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
 var BOOTSTRAP_TABLE = "_smrt_local_owner_bootstrap";
 var SECRET_FILE_NAME = "application.secret";
 var DATABASE_FILE_NAME = "application.sqlite";
 var ROOT_MARKER_PREFIX = ".smrt-local-runtime-";
+var LEASE_DIRECTORY_PREFIX = ".smrt-lease-";
+var UID_MAP_PATH = "/proc/self/uid_map";
 var PREFLIGHT_RETRY_LIMIT = 4;
 var INITIALIZATION_LOCK_TIMEOUT_MS = 12e4;
 var INITIALIZATION_LOCK_WORKER = `
@@ -1525,6 +1530,19 @@ var INITIALIZATION_LOCK_WORKER = `
   let transaction;
   (async () => {
     try {
+      if (workerData.lockOnly) {
+        // Legacy /tmp lease probe (#3877): the same BEGIN IMMEDIATE lock an
+        // older release's secure acquisition takes, on a pre-validated,
+        // already-existing, never-written lock file.
+        const { DatabaseSync } = require('node:sqlite');
+        const lockDatabase = new DatabaseSync(workerData.path, {
+          timeout: workerData.timeout,
+        });
+        database = { close: async () => lockDatabase.close() };
+        lockDatabase.exec('BEGIN IMMEDIATE');
+        transaction = { rollback: async () => lockDatabase.exec('ROLLBACK') };
+        parentPort.postMessage({ type: 'acquired' });
+      } else {
       const { getDatabase } = await import(workerData.sqlModuleUrl);
       database = await getDatabase({
         type: 'sqlite',
@@ -1542,6 +1560,7 @@ var INITIALIZATION_LOCK_WORKER = `
       await database.query('PRAGMA busy_timeout = ' + workerData.timeout);
       transaction = await database.beginTransaction();
       parentPort.postMessage({ type: 'acquired' });
+      }
     } catch (error) {
       try { await database?.close?.(); } catch {}
       parentPort.postMessage({ type: 'error', message: String(error) });
@@ -1668,6 +1687,7 @@ async function initializeLocalApplicationRuntime(options) {
 	const bindHost = normalizeLoopbackHost(options.bindHost ?? DEFAULT_BIND_HOST);
 	const bootstrapTtlSeconds = validateBootstrapTtl(options.bootstrapTtlSeconds ?? DEFAULT_BOOTSTRAP_TTL_SECONDS);
 	const sessionTtlSeconds = validateSessionTtl(options.sessionTtlSeconds ?? DEFAULT_SESSION_TTL_SECONDS);
+	const ownerTenant = resolveOwnerTenant(options.ownerTenant);
 	const resolvedRuntime = resolveApplicationRuntime({
 		profile: "local",
 		providers: options.providers
@@ -1704,6 +1724,7 @@ async function initializeLocalApplicationRuntime(options) {
 			sessionTtlSeconds,
 			backgroundJobs: options.backgroundJobs === true,
 			paidCapabilities: options.paidCapabilities === true,
+			ownerTenant,
 			now: options.now ?? (() => /* @__PURE__ */ new Date()),
 			canonicalSourceRoot
 		});
@@ -1744,6 +1765,7 @@ var InitializedLocalApplicationRuntime = class {
 	mcpTokens;
 	bootstrapTtlSeconds;
 	sessionTtlSeconds;
+	ownerTenant;
 	now;
 	canonicalSourceRoot;
 	constructor(state) {
@@ -1753,6 +1775,7 @@ var InitializedLocalApplicationRuntime = class {
 		this.resolvedRuntime = state.resolvedRuntime;
 		this.bootstrapTtlSeconds = state.bootstrapTtlSeconds;
 		this.sessionTtlSeconds = state.sessionTtlSeconds;
+		this.ownerTenant = state.ownerTenant;
 		this.backgroundJobsEnabled = state.backgroundJobs;
 		this.paidCapabilitiesEnabled = state.paidCapabilities;
 		this.now = state.now;
@@ -1805,7 +1828,7 @@ var InitializedLocalApplicationRuntime = class {
            AND expires_at > ?
          RETURNING expires_at`, nowIso, tokenHash, nowIso)).rows.length === 0) await throwBootstrapClaimFailure(tx, now);
 			if (await findExistingOwner(tx)) throw new LocalRuntimeError("bootstrap_claimed", "The local owner has already been claimed.");
-			return createLocalOwnerRecords(tx, input, this.sessionTtlSeconds);
+			return createLocalOwnerRecords(tx, input, this.sessionTtlSeconds, this.ownerTenant);
 		});
 	}
 	/** Restore the normal server-side session created by owner bootstrap. */
@@ -1895,7 +1918,10 @@ var InitializedLocalApplicationRuntime = class {
 		return createHmac("sha256", (await validateApplicationSecret(this.paths.applicationSecret, this.canonicalSourceRoot)).trim()).update(token).digest("hex");
 	}
 };
-async function createLocalOwnerRecords(db, input, sessionTtlSeconds) {
+async function createLocalOwnerRecords(db, input, sessionTtlSeconds, ownerTenant) {
+	const existingTenant = await (await TenantCollection.create({ db })).findBySlug(ownerTenant.slug);
+	const memberships = await MembershipCollection.create({ db });
+	if (existingTenant) await assertAdoptableOwnerTenant(existingTenant, ownerTenant, memberships);
 	const profileTypes = await ProfileTypeCollection.create({ db });
 	const person = new Person({
 		db,
@@ -1916,15 +1942,32 @@ async function createLocalOwnerRecords(db, input, sessionTtlSeconds) {
 		lastLoginAt: /* @__PURE__ */ new Date()
 	});
 	await user.save();
-	const tenantService = new TenantService({ db }, {
-		mode: "required",
-		maxTenants: 1,
-		defaultName: input.tenantName?.trim() || "My Workspace"
-	});
-	await tenantService.initialize();
-	const { tenant, membership } = await tenantService.createTenantWithOwnership(requireId(user.id, "User"), input.tenantName?.trim() || "My Workspace", { slug: "default" });
+	const userId = requireId(user.id, "User");
+	let tenant;
+	let membership;
+	if (existingTenant) {
+		const ownerRole = await (await RoleCollection.create({ db })).findSystemRoleBySlug(DEFAULT_ROLE_SLUGS.OWNER);
+		const created = await memberships.create({
+			userId,
+			tenantId: requireId(existingTenant.id, "Tenant"),
+			roleId: requireId(ownerRole?.id, "Owner role"),
+			status: MembershipStatus.ACTIVE
+		});
+		await created.save();
+		tenant = existingTenant;
+		membership = created;
+	} else {
+		const tenantName = input.tenantName?.trim() || ownerTenant.name;
+		const tenantService = new TenantService({ db }, {
+			mode: "required",
+			maxTenants: 1,
+			defaultName: tenantName
+		});
+		await tenantService.initialize();
+		({tenant, membership} = await tenantService.createTenantWithOwnership(userId, tenantName, { slug: ownerTenant.slug }));
+	}
 	const session = await (await SessionCollection.create({ db })).createSession({
-		userId: requireId(user.id, "User"),
+		userId,
 		tenantId: requireId(tenant.id, "Tenant"),
 		ttl: sessionTtlSeconds,
 		userAgent: input.userAgent,
@@ -1933,12 +1976,27 @@ async function createLocalOwnerRecords(db, input, sessionTtlSeconds) {
 	});
 	return Object.freeze({
 		profileId: requireId(person.id, "Person"),
-		userId: requireId(user.id, "User"),
+		userId,
 		tenantId: requireId(tenant.id, "Tenant"),
 		membershipId: requireId(membership.id, "Membership"),
 		sessionId: requireId(session.id, "Session")
 	});
 }
+async function assertAdoptableOwnerTenant(tenant, ownerTenant, memberships) {
+	if (!ownerTenant.adoptExisting) throw new LocalRuntimeError("owner_tenant_conflict", "A tenant with the owner tenant slug already exists; set ownerTenant.adoptExisting to adopt it or choose another slug.");
+	const tenantId = requireId(tenant.id, "Tenant");
+	if (tenant.status !== TenantStatus.ACTIVE || tenant.parentTenantId || (await memberships.findByTenant(tenantId)).length > 0) throw new LocalRuntimeError("owner_tenant_conflict", "The existing owner tenant cannot be adopted: it must be an active root tenant with no memberships.");
+}
+function resolveOwnerTenant(options) {
+	const slug = options?.slug ?? DEFAULT_OWNER_TENANT_SLUG;
+	if (typeof slug !== "string" || !OWNER_TENANT_SLUG_PATTERN.test(slug)) throw new LocalRuntimeError("invalid_configuration", "ownerTenant.slug must be 1-64 lowercase letters, digits, or inner hyphens.");
+	const name = typeof options?.name === "string" && options.name.trim() ? options.name.trim() : DEFAULT_OWNER_TENANT_NAME;
+	return Object.freeze({
+		slug,
+		name,
+		adoptExisting: options?.adoptExisting === true
+	});
+}
 async function findExistingOwner(db) {
 	const ownerRole = await (await RoleCollection.create({ db })).findSystemRoleBySlug(DEFAULT_ROLE_SLUGS.OWNER);
 	if (!ownerRole?.id) return null;
@@ -2194,15 +2252,97 @@ async function prepareDedicatedRoot(path, canonicalSourceRoot, appId, createdDir
 async function acquireInitializationLock(root) {
 	const currentUid = process.getuid?.();
 	if (currentUid === void 0) throw unsafeFilesystemEntry("Local runtime initialization locks require a numeric current-user identity.");
-	const lockRoot = resolve(await realpath("/tmp"), `.smrt-${currentUid}`);
+	const lockKey = createHash("sha256").update(normalizeFilesystemIdentity(root)).digest("hex").slice(0, 32);
+	const besideData = await prepareDataParentLeaseRoot(root, lockKey, currentUid);
+	const canonicalTemporaryRoot = await realpath("/tmp");
+	const mappedUid = await legacyLeaseUid(currentUid);
+	const legacyLockRoots = [.../* @__PURE__ */ new Set([currentUid, mappedUid])].map((uid) => resolve(canonicalTemporaryRoot, `.smrt-${uid}`));
+	if (mappedUid !== currentUid && await isForeignOwnedDirectory(legacyLockRoots[0], currentUid)) legacyLockRoots.shift();
+	const held = [];
+	try {
+		if (besideData === null) for (const lockRoot of legacyLockRoots) held.push(await acquireTemporaryInitializationLease(lockRoot, lockKey, currentUid));
+		else {
+			held.push(await acquireInitializationDatabaseLease(resolve(besideData, "initialization.sqlite"), besideData));
+			for (const lockRoot of legacyLockRoots) {
+				const legacy = await hasTrustedLeaseAncestry(lockRoot, currentUid) ? await acquireTemporaryInitializationLease(lockRoot, lockKey, currentUid) : await acquireLegacyLeaseWithoutTrustedAncestry(lockRoot, lockKey, currentUid);
+				if (legacy) held.push(legacy);
+			}
+		}
+	} catch (error) {
+		try {
+			await releaseInitializationLeases(held);
+		} catch (releaseError) {
+			throw preservePrimaryFailure(error, releaseError, "initializationLockReleaseError", "Local runtime initialization-lock acquisition and release both failed.");
+		}
+		throw error;
+	}
+	let released = false;
+	return { release: async () => {
+		if (released) return;
+		released = true;
+		await releaseInitializationLeases(held);
+	} };
+}
+async function isForeignOwnedDirectory(path, currentUid) {
+	let details;
+	try {
+		details = await lstat(path);
+	} catch (error) {
+		if (isMissingFile(error)) return false;
+		throw error;
+	}
+	return !details.isSymbolicLink() && details.isDirectory() && details.uid !== currentUid;
+}
+async function releaseInitializationLeases(leases) {
+	let failure;
+	for (const lease of leases.toReversed()) try {
+		await lease.release();
+	} catch (error) {
+		failure = failure === void 0 ? error : preservePrimaryFailure(failure, error, "initializationLockReleaseError", "Several local runtime initialization leases failed to release.");
+	}
+	if (failure !== void 0) throw failure;
+}
+async function legacyLeaseUid(currentUid) {
+	let map;
+	try {
+		map = await readFile(UID_MAP_PATH, "utf8");
+	} catch (error) {
+		if (isMissingFile(error)) return currentUid;
+		throw unsafeFilesystemEntry("Local runtime could not read the user-namespace uid map for its legacy lease.", error);
+	}
+	for (const line of map.split("\n")) {
+		if (!line.trim()) continue;
+		const fields = line.trim().split(/\s+/);
+		const [inside, outside, count] = fields.map((field) => /^\d+$/.test(field) ? Number(field) : NaN);
+		if (fields.length !== 3 || !Number.isSafeInteger(inside) || !Number.isSafeInteger(outside) || !Number.isSafeInteger(count)) throw unsafeFilesystemEntry("Local runtime could not parse the user-namespace uid map for its legacy lease.");
+		if (currentUid >= inside && currentUid - inside < count) return outside + (currentUid - inside);
+	}
+	throw unsafeFilesystemEntry("The user-namespace uid map does not cover the current user; the legacy local runtime lease cannot be located.");
+}
+async function prepareDataParentLeaseRoot(root, lockKey, currentUid) {
+	const parent = resolve(root, "..");
+	const leaseRoot = resolve(parent, `${LEASE_DIRECTORY_PREFIX}${lockKey}`);
+	try {
+		await mkdir(parent, {
+			recursive: true,
+			mode: 448
+		});
+		await mkdir(leaseRoot, { mode: 448 });
+	} catch (error) {
+		if (isLeaseLocationUnavailable(error)) return null;
+		if (!isFileAlreadyExists(error)) throw error;
+	}
+	await assertPrivateLeaseDirectory(leaseRoot, currentUid);
+	return leaseRoot;
+}
+async function acquireTemporaryInitializationLease(lockRoot, lockKey, currentUid) {
 	try {
 		await mkdir(lockRoot, { mode: 448 });
 	} catch (error) {
 		if (!isFileAlreadyExists(error)) throw error;
 	}
-	const lockRootDetails = await lstat(lockRoot);
-	if (!lockRootDetails.isDirectory() || lockRootDetails.isSymbolicLink() || lockRootDetails.uid !== currentUid || (lockRootDetails.mode & 511) !== 448) throw unsafeFilesystemEntry(`Local runtime lock directory must be current-user-owned with mode 0700: ${lockRoot}`);
-	const custodyRoot = resolve(lockRoot, createHash("sha256").update(normalizeFilesystemIdentity(root)).digest("hex").slice(0, 32));
+	await assertPrivateLeaseDirectory(lockRoot, currentUid);
+	const custodyRoot = resolve(lockRoot, lockKey);
 	try {
 		await mkdir(custodyRoot, { mode: 448 });
 	} catch (error) {
@@ -2210,12 +2350,70 @@ async function acquireInitializationLock(root) {
 	}
 	return acquireInitializationDatabaseLease(resolve(custodyRoot, "initialization.sqlite"), custodyRoot);
 }
-async function acquireInitializationDatabaseLease(path, custodyRoot) {
+async function assertPrivateLeaseDirectory(path, currentUid) {
+	const details = await lstat(path);
+	if (!details.isDirectory() || details.isSymbolicLink() || details.uid !== currentUid || (details.mode & 511) !== 448) throw unsafeFilesystemEntry(`Local runtime lock directory must be current-user-owned with mode 0700: ${path}`);
+}
+async function acquireLegacyLeaseWithoutTrustedAncestry(lockRoot, lockKey, currentUid) {
+	for (const component of absolutePathComponents(resolve(lockRoot, ".."))) {
+		const details = await lstat(component);
+		if (details.isSymbolicLink() || !details.isDirectory() || (details.mode & 18) !== 0 && (details.mode & 512) === 0) throw unsafeFilesystemEntry(`Legacy local runtime lock ancestry permits replacement by another principal: ${component}`);
+	}
+	const custodyRoot = resolve(lockRoot, lockKey);
+	const path = resolve(custodyRoot, "initialization.sqlite");
+	try {
+		await mkdir(lockRoot, { mode: 448 });
+	} catch (error) {
+		if (isLeaseLocationUnavailable(error)) {
+			try {
+				await lstat(path);
+			} catch (probeError) {
+				if (isMissingFile(probeError)) return null;
+				throw probeError;
+			}
+			throw error;
+		}
+		if (!isFileAlreadyExists(error)) throw error;
+	}
+	await assertPrivateLeaseDirectory(lockRoot, currentUid);
+	try {
+		await mkdir(custodyRoot, { mode: 448 });
+	} catch (error) {
+		if (!isFileAlreadyExists(error)) throw error;
+	}
+	await assertPrivateLeaseDirectory(custodyRoot, currentUid);
+	let created;
+	try {
+		created = await open(path, constants.O_RDWR | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
+	} catch (error) {
+		if (!isFileAlreadyExists(error)) throw error;
+	} finally {
+		await created?.close();
+	}
+	const leaf = await lstat(path);
+	if (leaf.isSymbolicLink() || !leaf.isFile() || leaf.uid !== currentUid || (leaf.mode & 18) !== 0) throw unsafeFilesystemEntry(`Legacy local runtime lock file must be a current-user-owned private file: ${path}`);
+	return acquireInitializationDatabaseLease(path, custodyRoot, true);
+}
+async function hasTrustedLeaseAncestry(path, currentUid) {
+	for (const component of absolutePathComponents(resolve(path, ".."))) {
+		const details = await lstat(component);
+		if (details.isSymbolicLink() || !details.isDirectory()) return false;
+		if (details.uid !== currentUid && details.uid !== 0) return false;
+		if ((details.mode & 18) !== 0 && (details.mode & 512) === 0) return false;
+	}
+	return true;
+}
+function isLeaseLocationUnavailable(error) {
+	const code = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+	return code === "EACCES" || code === "EPERM" || code === "EROFS";
+}
+async function acquireInitializationDatabaseLease(path, custodyRoot, lockOnly = false) {
 	const worker = new Worker(INITIALIZATION_LOCK_WORKER, {
 		eval: true,
 		workerData: {
 			path,
 			custodyRoot,
+			lockOnly,
 			timeout: INITIALIZATION_LOCK_TIMEOUT_MS,
 			sqlModuleUrl: import.meta.resolve("@happyvertical/sql")
 		}
@@ -2552,4 +2750,4 @@ function isDirectoryNotEmpty(error) {
 //#endregion
 export { reclaimStaleRecord as A, deepFrozenPlainCopy as B, findInstalledPackage as C, processExists as D, lockOwnerPid as E, LOCAL_MCP_TOKEN_PRINCIPAL as F, initializeDeployedApplicationRuntime as G, resolveBoundMembershipPermissions as H, LOCAL_MCP_TOKEN_TABLE as I, isSessionTenantAuthorized as K, MAX_LOCAL_MCP_TOKEN_TTL_SECONDS as L, runtimeConfigurationFingerprint as M, DEFAULT_LOCAL_MCP_TOKEN_TTL_SECONDS as N, withOperationLock as O, LOCAL_MCP_TOKEN_PREFIX as P, isLocalMcpTokenPrincipal as R, createProviderReadinessProbe as S, isStaleOperationLock as T, DeployedRuntimeCleanupError as U, ownValue as V, DeployedRuntimeError as W, MAX_RUNTIME_DIAGNOSTIC_TOOLS as _, openLocalMcpTokenStore as a, projectRuntimeDiagnostics as b, validateApplicationId as c, readActiveWriterLease as d, ONBOARDING_HANDOFF_FILES as f, MAX_RUNTIME_DIAGNOSTIC_ERRORS as g, resolveApplicationStateRoot as h, initializeLocalApplicationRuntime as i, resolveApplicationId as j, RECLAIM_MUTEX_FILE as k, validateLocalDatabaseStorage as l, removeOnboardingHandoff as m, MIGRATION_FAILED_MESSAGE as n, prepareLocalDatabaseStorage as o, prepareApplicationStateRoot as p, encodeApplicationId as r, resolveLocalRuntimePaths as s, LocalRuntimeError as t, acquireWriterLease as u, RUNTIME_DIAGNOSTICS_SCHEMA_VERSION as v, resolveReadinessModule as w, PROVIDER_READINESS_SETTINGS as x, RUNTIME_WORKER_FRESHNESS_SECONDS as y, PlainDataError as z };
 
-//# sourceMappingURL=src-vP6GV99v.js.map
+//# sourceMappingURL=src-DeNO6bG_.js.map