@itpay/cli 2.1.41 → 2.1.44

package/dist/src/state/device_authority.js

@@ -1,8 +1,7 @@
 import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomUUID, sign, } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
-import { homedir } from "node:os";
+import { chmodSync, existsSync, mkdirSync, lstatSync, linkSync, readFileSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import { dirname, resolve } from "node:path";
-const PROTECTED_PATHS = ["/v1/carts", "/v1/service-executions", "/v1/agent-instances", "/v1/orders", "/v1/refunds", "/v1/me", "/v1/vault"];
+const PROTECTED_PATHS = ["/v1/agent-device-account-bindings", "/v1/carts", "/v1/service-executions", "/v1/agent-instances", "/v1/orders", "/v1/refunds", "/v1/me", "/v1/vault", "/v1/rail/phone-links", "/v1/rail-aftercare"];
 export class DeviceAuthority {
     baseURL;
     backendKey;
@@ -17,7 +16,7 @@ export class DeviceAuthority {
         this.backendKey = normalizeBackendKey(options.baseURL);
         this.requestedAgentType = options.requestedAgentType;
         this.compatibilityHeaders = options.compatibilityHeaders;
-        const root = resolve(homedir(), ".itpay-v3", "device");
+        const root = resolve(stateDir(), "device");
         this.statePath = options.statePath ?? resolve(root, "identity.json");
         this.privateKeyPath = options.privateKeyPath ?? resolve(root, "device-private.pem");
         this.fetchImpl = (options.fetchImpl ?? globalThis.fetch).bind(globalThis);
@@ -43,21 +42,24 @@ export class DeviceAuthority {
     }
     async ensureAuthorization() {
         if (!this.pending) {
-            this.pending = withFileLock(`${this.statePath}.lock`, () => this.prepareAuthorization()).finally(() => {
+            this.pending = this.cachedAuthorization() ?? withFileLock(`${this.statePath}.lock`, () => this.prepareAuthorization());
+            this.pending = this.pending.finally(() => {
                 this.pending = undefined;
             });
         }
         return this.pending;
     }
-    async status() {
-        // Readiness needs a current server proof, not an unexpired cached token.
-        return withFileLock(`${this.statePath}.lock`, async () => {
-            const auth = await this.prepareAuthorization(true);
-            if (!auth.session.token || !(Date.parse(auth.session.expiresAt) > Date.now())) {
-                throw new Error('Device verification returned an invalid session');
-            }
-            return { agent_type: auth.agentType, expires_at: auth.session.expiresAt };
-        });
+    cachedAuthorization() {
+        const agentType = this.requestedAgentType;
+        if (!agentType)
+            return undefined;
+        const state = this.readState();
+        const registration = state?.registrations[this.backendKey];
+        const session = registration?.sessions[agentType];
+        if (!registration?.agentInstances[agentType] || !session || Date.parse(session.expiresAt) <= Date.now() + 60_000)
+            return undefined;
+        const privateKey = this.readPrivateKey();
+        return privateKey ? Promise.resolve({ state: registration, agentType, session, privateKey }) : undefined;
     }
     async recoverAuthorization() {
         await withFileLock(`${this.statePath}.lock`, async () => {
@@ -71,6 +73,9 @@ export class DeviceAuthority {
             this.writeState(state);
         });
     }
+    repairLock() {
+        return inspectAndRecoverLock(`${this.statePath}.lock`);
+    }
     async recoverBackendReset() {
         return withFileLock(`${this.statePath}.lock`, async () => {
             const state = this.readState();
@@ -83,7 +88,28 @@ export class DeviceAuthority {
             return { removed: true, agentTypes };
         });
     }
-    async prepareAuthorization(forceSession = false) {
+    async resetDeviceKey() {
+        return withFileLock(`${this.statePath}.lock`, async () => {
+            const state = this.readState();
+            const removedBackends = state ? Object.keys(state.registrations).sort() : [];
+            // Delete the key first: if the process dies before the state write, the
+            // next run treats the missing key as a fresh install and completes the
+            // reset itself; it can never pair a new key with stale registrations.
+            if (existsSync(this.privateKeyPath)) {
+                try {
+                    unlinkSync(this.privateKeyPath);
+                }
+                catch (error) {
+                    if (error.code !== "ENOENT") {
+                        throw asDeviceStateError(error, "remove_private_key");
+                    }
+                }
+            }
+            this.writeState(emptyDeviceState());
+            return { removedBackends };
+        });
+    }
+    async prepareAuthorization() {
         let state = this.readState() ?? emptyDeviceState();
         const agentType = this.requestedAgentType;
         if (!agentType) {
@@ -93,8 +119,14 @@ export class DeviceAuthority {
         if (!privateKey) {
             const pair = generateKeyPairSync("ed25519");
             privateKey = pair.privateKey;
-            this.writePrivateKey(pair.privateKey.export({ format: "pem", type: "pkcs8" }).toString());
+            // Persist an empty state before the new key ever reaches disk so a crash
+            // can never pair the new key with registrations bound to the old one.
+            // A crash between the two writes leaves either no key (fresh retry) or a
+            // key with no registrations (the backend re-attaches to the existing
+            // device instead of creating a duplicate).
             state = emptyDeviceState();
+            this.writeState(state);
+            this.writePrivateKey(pair.privateKey.export({ format: "pem", type: "pkcs8" }).toString());
         }
         let registration = state.registrations[this.backendKey];
         if (!registration && state.legacyRegistration) {
@@ -112,7 +144,21 @@ export class DeviceAuthority {
             registration = await this.enroll(agentType, privateKey);
         }
         state.registrations[this.backendKey] = registration;
-        const session = await this.ensureRegistrationAgentType(registration, agentType, privateKey, forceSession);
+        let session;
+        try {
+            session = await this.ensureRegistrationAgentType(registration, agentType, privateKey, false);
+        }
+        catch (error) {
+            if (!isUnknownDeviceRegistration(error))
+                throw error;
+            // The backend lost this registration (e.g. its identity store was
+            // rebuilt). Drop the stale record and enroll once: the same key either
+            // re-attaches to the surviving device or creates a fresh one.
+            delete state.registrations[this.backendKey];
+            registration = await this.enroll(agentType, privateKey);
+            state.registrations[this.backendKey] = registration;
+            session = await this.ensureRegistrationAgentType(registration, agentType, privateKey, false);
+        }
         this.writeState(state);
         return { state: registration, agentType, session, privateKey };
     }
@@ -146,16 +192,23 @@ export class DeviceAuthority {
         if (!publicJWK.x)
             throw new Error("unable to export Ed25519 public key");
         const publicKey = Buffer.from(publicJWK.x, "base64url").toString("base64");
-        const started = await this.publicJSON("/v1/agent-device-enrollments", { public_key: publicKey, agent_type: agentType });
-        const proof = enrollmentProofMessage(started.agent_device_enrollment_id, started.challenge);
-        const verified = await this.publicJSON(`/v1/agent-device-enrollments/${encodeURIComponent(started.agent_device_enrollment_id)}/verify`, { challenge: started.challenge, signature: sign(null, Buffer.from(proof), privateKey).toString("base64") });
-        return {
-            deviceID: verified.agent_device_id,
-            deviceKeyID: verified.agent_device_key_id,
-            quotaLineageID: verified.quota_lineage_id,
-            agentInstances: { [verified.agent_type]: verified.agent_instance_id },
-            sessions: {},
-        };
+        try {
+            const started = await this.publicJSON("/v1/agent-device-enrollments", { public_key: publicKey, agent_type: agentType });
+            const proof = enrollmentProofMessage(started.agent_device_enrollment_id, started.challenge);
+            const verified = await this.publicJSON(`/v1/agent-device-enrollments/${encodeURIComponent(started.agent_device_enrollment_id)}/verify`, { challenge: started.challenge, signature: sign(null, Buffer.from(proof), privateKey).toString("base64") });
+            return {
+                deviceID: verified.agent_device_id,
+                deviceKeyID: verified.agent_device_key_id,
+                quotaLineageID: verified.quota_lineage_id,
+                agentInstances: { [verified.agent_type]: verified.agent_instance_id },
+                sessions: {},
+            };
+        }
+        catch (error) {
+            if (error instanceof DeviceAuthorizationError)
+                error.enrollmentFailed = true;
+            throw error;
+        }
     }
     async ensureSession(state, agentType, privateKey, force = false) {
         const existing = state.sessions[agentType];
@@ -198,6 +251,7 @@ export class DeviceAuthority {
             method: "POST",
             headers: { "Content-Type": "application/json", Accept: "application/json", ...this.compatibilityHeaders, ...extraHeaders },
             body,
+            signal: AbortSignal.timeout(15_000),
         });
         const payload = await response.json().catch(() => ({}));
         if (!response.ok)
@@ -218,10 +272,7 @@ export class DeviceAuthority {
             return undefined;
         }
         catch (error) {
-            const stateError = asDeviceStateError(error, "read_state");
-            if (stateError)
-                throw stateError;
-            return undefined;
+            throw asDeviceStateError(error, "read_state");
         }
     }
     readPrivateKey() {
@@ -231,10 +282,7 @@ export class DeviceAuthority {
             return createPrivateKey(readFileSync(this.privateKeyPath, "utf8"));
         }
         catch (error) {
-            const stateError = asDeviceStateError(error, "read_private_key");
-            if (stateError)
-                throw stateError;
-            return undefined;
+            throw asDeviceStateError(error, "read_private_key");
         }
     }
     writeState(state) { atomicOwnerOnlyWrite(this.statePath, JSON.stringify(state, null, 2), "write_state"); }
@@ -243,6 +291,7 @@ export class DeviceAuthority {
 export class DeviceAuthorizationError extends Error {
     status;
     code;
+    enrollmentFailed = false;
     constructor(status, code, message) {
         super(message);
         this.status = status;
@@ -253,12 +302,24 @@ export class DeviceAuthorizationError extends Error {
 export class DeviceStateError extends Error {
     operation;
     causeCode;
-    code = "device_state_unwritable";
-    constructor(operation, causeCode) {
+    blockedPath;
+    code = "device_state_unavailable";
+    source;
+    constructor(operation, causeCode, blockedPath) {
         super(`ItPay device state operation failed: ${operation} (${causeCode})`);
         this.operation = operation;
         this.causeCode = causeCode;
+        this.blockedPath = blockedPath;
         this.name = "DeviceStateError";
+        this.source = causeCode === "UNCLASSIFIED_LOCAL_FAILURE" ? "unclassified_local_operation" : causeCode.startsWith("CODEBUDDY_BROKER_") ? "host_broker"
+            : ["LEGACY_LOCK_OWNER_UNKNOWN", "SYMLINK_LOCK", "LOCK_SOURCE_CHANGED", "LOCK_TRANSITION_BUSY", "LOCK_OWNER_PROBE_UNAVAILABLE"].includes(causeCode) ? "client_state_validation" : "native_filesystem";
+    }
+}
+export class DeviceLockBusyError extends Error {
+    code = "device_lock_busy";
+    constructor() {
+        super("ItPay device lock is occupied or its transition cannot be safely completed");
+        this.name = "DeviceLockBusyError";
     }
 }
 function emptyDeviceState() {
@@ -267,6 +328,9 @@ function emptyDeviceState() {
 function canMovePastLegacyRegistration(error) {
     return error instanceof DeviceAuthorizationError && (error.code === "agent_device_revoked" || error.status === 404);
 }
+function isUnknownDeviceRegistration(error) {
+    return error instanceof DeviceAuthorizationError && (error.code === "agent_device_not_found" || error.status === 404);
+}
 function normalizeBackendKey(value) {
     const url = new URL(value);
     url.search = "";
@@ -292,7 +356,7 @@ function atomicOwnerOnlyWrite(path, value, operation) {
             unlinkSync(temporary);
         }
         catch { /* best-effort cleanup */ }
-        throw asDeviceStatePathError(error, operation) ?? error;
+        throw asDeviceStatePathError(error, operation);
     }
 }
 async function withFileLock(path, run) {
@@ -300,75 +364,341 @@ async function withFileLock(path, run) {
         mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
     }
     catch (error) {
-        throw asDeviceStatePathError(error, "prepare_lock") ?? error;
+        throw asDeviceStatePathError(error, "prepare_lock");
     }
-    const ownerToken = randomUUID();
+    const ownerToken = `${process.pid}:${randomUUID()}`;
     let acquired = false;
-    for (let attempt = 0; attempt < 200; attempt += 1) {
+    for (let attempt = 0; attempt < 800; attempt += 1) {
         try {
-            writeFileSync(path, ownerToken, { encoding: "utf8", flag: "wx", mode: 0o600 });
-            chmodSync(path, 0o600);
+            if (!lockTransition(path, () => {
+                writeFileSync(path, ownerToken, { encoding: "utf8", flag: "wx", mode: 0o600 });
+                chmodSync(path, 0o600);
+            })) {
+                await new Promise((resolve) => setTimeout(resolve, 25));
+                continue;
+            }
             acquired = true;
             break;
         }
         catch (error) {
             const code = error.code;
             if (code !== "EEXIST")
-                throw asDeviceStateError(error, "acquire_lock") ?? error;
-            try {
-                if (Date.now() - statSync(path).mtimeMs > 30_000)
-                    moveLockAside(path, "stale", "remove_stale_lock");
-            }
-            catch (statError) {
-                if (statError.code !== "ENOENT") {
-                    throw asDeviceStateError(statError, "inspect_lock") ?? statError;
-                }
-            }
+                throw asDeviceStateError(error, "acquire_lock");
+            inspectAndRecoverLock(path);
             await new Promise((resolve) => setTimeout(resolve, 25));
         }
     }
     if (!acquired)
-        throw new Error("timed out waiting for ItPay device identity lock");
+        throw new DeviceLockBusyError();
+    let operationFailed = false;
     try {
         return await run();
     }
+    catch (error) {
+        operationFailed = true;
+        throw error;
+    }
     finally {
-        releaseLock(path, ownerToken);
+        try {
+            await releaseLock(path, ownerToken);
+        }
+        catch (error) {
+            if (!operationFailed)
+                throw error;
+        }
+    }
+}
+function inspectAndRecoverLock(path) {
+    let result = "active";
+    lockTransition(path, () => { result = inspectLockOwner(path); });
+    return result;
+}
+function inspectLockOwner(path) {
+    let token;
+    let age;
+    let inspected;
+    try {
+        const lockStat = lstatSync(path);
+        if (lockStat.isSymbolicLink())
+            throw new DeviceStateError("inspect_lock", "SYMLINK_LOCK");
+        inspected = lockStat;
+        age = Date.now() - lockStat.mtimeMs;
+        token = lockStat.isDirectory() ? "" : readFileSync(path, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return "absent";
+        throw asDeviceStateError(error, "inspect_lock");
+    }
+    const ownerPID = /^(\d+):[0-9a-f-]+$/.exec(token)?.[1];
+    if (ownerPID) {
+        try {
+            process.kill(Number(ownerPID), 0);
+            return "active";
+        }
+        catch (error) {
+            if (error.code !== "ESRCH")
+                return "active";
+        }
+    }
+    else {
+        if (age <= 30_000)
+            return "active";
+        // Legacy ownerless locks cannot prove that an old caller has exited.
+        throw new DeviceStateError("inspect_lock", "LEGACY_LOCK_OWNER_UNKNOWN");
     }
+    // Recheck the exact owner before moving the lock; another process may have renewed it.
+    try {
+        if (token ? readFileSync(path, "utf8") !== token : !statSync(path).isDirectory())
+            return "active";
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return "absent";
+        throw asDeviceStateError(error, "inspect_lock");
+    }
+    moveLockAside(path, "stale", "remove_stale_lock", inspected);
+    return "recovered";
 }
-function releaseLock(path, ownerToken) {
+async function releaseLock(path, ownerToken) {
+    // Another caller may be inspecting our live owner under the same short
+    // transition. Wait for that critical section, without reclaiming its guard.
+    for (let attempt = 0; attempt < 20; attempt += 1) {
+        if (lockTransition(path, () => releaseOwnedLock(path, ownerToken)))
+            return;
+        await new Promise((resolve) => setTimeout(resolve, 25));
+    }
+    throw new DeviceStateError("release_lock", "LOCK_TRANSITION_BUSY");
+}
+function releaseOwnedLock(path, ownerToken) {
     try {
+        const inspected = lstatSync(path);
+        if (!inspected.isFile())
+            throw new DeviceStateError("release_lock", "LOCK_SOURCE_CHANGED");
         if (readFileSync(path, "utf8") !== ownerToken)
             return;
-        moveLockAside(path, "released", "release_lock");
+        moveLockAside(path, "released", "release_lock", inspected);
     }
     catch (error) {
         if (error.code !== "ENOENT")
-            throw asDeviceStateError(error, "release_lock") ?? error;
+            throw asDeviceStateError(error, "release_lock");
     }
 }
-function moveLockAside(path, suffix, operation) {
+// Per-process tickets publish ownership in the directory name before any write.
+// The pool itself is not a lock. An interrupted choosing/ready ticket is ignored
+// only after its PID is proven dead; no caller removes another caller's ticket.
+// New arrivals choose a larger ticket, and simultaneous choices use name order.
+function lockTransition(path, run) {
+    const legacy = `${path}.transition`;
+    const pool = `${path}.transition-owners`;
+    mkdirSync(pool, { recursive: true, mode: 0o700 });
+    if (lstatSync(pool).isSymbolicLink())
+        throw new DeviceStateError("inspect_lock", "SYMLINK_LOCK");
+    const incarnation = processIncarnation(process.pid);
+    if (!incarnation)
+        throw new DeviceStateError("prepare_lock", "LOCK_OWNER_PROBE_UNAVAILABLE");
+    // mkdir publishes the choosing owner and its incarnation in one atomic step.
+    const name = `${process.pid}-${sha256(incarnation).slice(7)}-${randomUUID()}`;
+    const own = resolve(pool, name);
+    mkdirSync(own, { mode: 0o700 });
+    let failed = false;
+    let linked = false;
+    const token = JSON.stringify({ pid: process.pid, incarnation, token: randomUUID() });
     try {
-        renameSync(path, `${path}.${suffix}`);
+        let ticket = 1;
+        for (const other of readdirSync(pool)) {
+            if (other === name || other === "archives")
+                continue;
+            const value = transitionTicket(pool, other);
+            if (value !== undefined)
+                ticket = Math.max(ticket, (value ?? 0) + 1);
+        }
+        if (!Number.isSafeInteger(ticket))
+            throw new DeviceStateError("inspect_lock", "LOCK_TRANSITION_BUSY");
+        writeFileSync(resolve(own, "ticket"), JSON.stringify({ sequence: ticket, incarnation }), { flag: "wx", mode: 0o600 });
+        for (const other of readdirSync(pool)) {
+            if (other === name || other === "archives")
+                continue;
+            const value = transitionTicket(pool, other);
+            if (value === null || (value !== undefined && (value < ticket || (value === ticket && other < name))))
+                return false;
+        }
+        // All new binaries hold the ticket mutex during stale recovery. Old binaries
+        // see EEXIST on this same path, so cannot race acquisition with recovery.
+        if (existsSync(legacy)) {
+            const stat = lstatSync(legacy);
+            if (!stat.isFile())
+                return false; // Unknown old directory owner stays protected.
+            const text = readFileSync(legacy, "utf8");
+            const old = /^(\d+):[0-9a-f-]+$/.exec(text);
+            let ownerPID;
+            let birth;
+            if (old)
+                ownerPID = Number(old[1]);
+            else {
+                let value;
+                try {
+                    value = JSON.parse(text);
+                }
+                catch {
+                    return false;
+                }
+                if (!value || typeof value !== "object" || !("pid" in value) || typeof value.pid !== "number" || !("incarnation" in value) || typeof value.incarnation !== "string")
+                    return false;
+                ownerPID = value.pid;
+                birth = value.incarnation;
+            }
+            if (!Number.isSafeInteger(ownerPID) || ownerPID <= 0)
+                return false;
+            try {
+                process.kill(ownerPID, 0);
+                const current = birth && processIncarnation(ownerPID);
+                if (!current || current === birth)
+                    return false;
+            }
+            catch (error) {
+                if (error.code !== "ESRCH")
+                    return false;
+            }
+            moveLockAside(legacy, "stale", "remove_stale_lock", stat);
+        }
+        const owner = resolve(own, "owner");
+        writeFileSync(owner, token, { flag: "wx", mode: 0o600 });
+        // Hard-link a fully written owner: no empty/unowned publication crash gap.
+        try {
+            linkSync(owner, legacy);
+        }
+        catch (error) {
+            if (error.code === "EEXIST")
+                return false;
+            throw error;
+        }
+        linked = true;
+        run();
+        return true;
     }
     catch (error) {
-        const code = error.code;
-        if (code === "ENOENT")
-            return;
-        if (code === "EEXIST" || code === "ENOTEMPTY") {
-            renameSync(path, `${path}.${suffix}.${randomUUID()}`);
-            return;
+        failed = true;
+        throw error;
+    }
+    finally {
+        try {
+            if (linked) {
+                if (readFileSync(legacy, "utf8") !== token)
+                    throw new DeviceStateError("release_lock", "LOCK_SOURCE_CHANGED");
+                renameSync(legacy, resolve(own, "transition-released"));
+            }
+            const archive = resolve(pool, "archives");
+            mkdirSync(archive, { recursive: true, mode: 0o700 });
+            if (lstatSync(archive).isSymbolicLink())
+                throw new DeviceStateError("release_lock", "SYMLINK_LOCK");
+            const destination = resolve(archive, randomUUID());
+            mkdirSync(destination, { mode: 0o700 });
+            renameSync(own, resolve(destination, "entry"));
+        }
+        catch (error) {
+            if (!failed)
+                throw asDeviceStateError(error, "release_lock");
         }
-        throw asDeviceStateError(error, operation) ?? error;
+    }
+}
+// undefined = absent/dead, null = a live process still choosing its ticket.
+function transitionTicket(pool, name) {
+    const owner = /^(\d+)-(?:([0-9a-f]{64})-)?[0-9a-f-]+$/.exec(name);
+    if (!owner || Number(owner[1]) <= 0)
+        throw new DeviceStateError("inspect_lock", "LOCK_SOURCE_CHANGED");
+    try {
+        process.kill(Number(owner[1]), 0);
+    }
+    catch (error) {
+        if (error.code === "ESRCH")
+            return undefined;
+        return null;
+    }
+    if (owner[2]) {
+        const birth = processIncarnation(Number(owner[1]));
+        if (!birth)
+            return null;
+        if (sha256(birth).slice(7) !== owner[2])
+            return undefined;
+    }
+    try {
+        const entry = resolve(pool, name);
+        if (!lstatSync(entry).isDirectory())
+            throw new DeviceStateError("inspect_lock", "SYMLINK_LOCK");
+        const file = resolve(entry, "ticket");
+        if (lstatSync(file).isSymbolicLink())
+            throw new DeviceStateError("inspect_lock", "SYMLINK_LOCK");
+        let value;
+        try {
+            value = JSON.parse(readFileSync(file, "utf8"));
+        }
+        catch {
+            return null;
+        }
+        if (!value || typeof value !== "object" || !("sequence" in value) || typeof value.sequence !== "number" || !("incarnation" in value) || typeof value.incarnation !== "string")
+            return null;
+        const birth = processIncarnation(Number(owner[1]));
+        if (!birth)
+            return null;
+        if (birth !== value.incarnation)
+            return undefined; // PID belongs to a different process.
+        return Number.isSafeInteger(value.sequence) && value.sequence > 0 ? value.sequence : null;
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return existsSync(resolve(pool, name)) ? null : undefined;
+        }
+        throw asDeviceStateError(error, "inspect_lock");
+    }
+}
+// Built-in OS process metadata distinguishes reused PIDs without an age timeout.
+// If probing is unavailable, ownership stays conservative rather than stolen.
+function processIncarnation(pid) {
+    try {
+        if (process.platform === "linux") {
+            const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+            const started = stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19];
+            return started ? `${readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim()}:${started}` : undefined;
+        }
+        const output = process.platform === "win32"
+            ? execFileSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `(Get-Process -Id ${pid}).StartTime.ToUniversalTime().ToString('o')`], { encoding: "utf8", timeout: 1000, stdio: ["ignore", "pipe", "ignore"] })
+            : execFileSync("ps", ["-p", String(pid), "-o", "lstart="], { encoding: "utf8", timeout: 1000, stdio: ["ignore", "pipe", "ignore"], env: { ...process.env, LC_ALL: "C", TZ: "UTC" } });
+        return output.trim() || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function moveLockAside(path, suffix, operation, source) {
+    try {
+        if (source.isSymbolicLink())
+            throw new DeviceStateError(operation, "SYMLINK_LOCK");
+        // Reserve a private, unique destination; never rename over shared archives.
+        const archive = `${path}.${suffix}.${randomUUID()}`;
+        mkdirSync(archive, { mode: 0o700 });
+        const current = lstatSync(path);
+        if (source.dev !== current.dev || source.ino !== current.ino || source.mtimeMs !== current.mtimeMs || source.size !== current.size) {
+            throw new DeviceStateError(operation, "LOCK_SOURCE_CHANGED");
+        }
+        renameSync(path, `${archive}/lock`);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return;
+        throw asDeviceStateError(error, operation);
     }
 }
 function asDeviceStateError(error, operation) {
-    const code = error.code;
-    return code === "EACCES" || code === "EPERM" || code === "EROFS" || code === "ENOTDIR" || code === "EISDIR"
-        ? new DeviceStateError(operation, code)
-        : undefined;
+    if (error instanceof DeviceStateError)
+        return error;
+    const code = error?.code;
+    const known = ["EACCES", "EPERM", "EROFS", "ENOTDIR", "EISDIR", "EEXIST", "ENOENT", "ENOTEMPTY", "ENOSPC", "EMFILE", "EIO", "CODEBUDDY_BROKER_DENY", "CODEBUDDY_BROKER_OUTCOME_UNKNOWN"];
+    return new DeviceStateError(operation, typeof code === "string" && known.includes(code) ? code : "UNCLASSIFIED_LOCAL_FAILURE");
 }
 function asDeviceStatePathError(error, operation) {
     const code = error.code;
-    return code === "EEXIST" ? new DeviceStateError(operation, code) : asDeviceStateError(error, operation);
+    return code === "EEXIST" ? new DeviceStateError(operation, code, error.path) : asDeviceStateError(error, operation);
 }
+import { stateDir } from "./config.js";
+import { execFileSync } from "node:child_process";