@neottia/repository-store 0.2.0

package/dist/lease.js

@@ -0,0 +1,932 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { randomBytes } from 'node:crypto';
+import { closeSync, constants as fsConstants, fstatSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, rmSync, rmdirSync, writeFileSync, } from 'node:fs';
+import { hostname } from 'node:os';
+import { basename, dirname, join } from 'node:path';
+import { LeaseContentionError, PathSafetyError, RepositoryStoreConfigError, ResourceLimitError } from './errors.js';
+import { emitFilesystemFault, emitLeaseFault } from './internal/fault-injection.js';
+import { assertSafeRegular, captureDirectories, ensurePrivateDirectory, hasCode, readRegularFile, readRegularFileWithIdentity, revalidateDirectories, sameIdentity, syncDirectory, syncFileDescriptor, } from './internal/filesystem.js';
+import { createRepositoryLease, getLeaseState, getRootState, } from './internal/model.js';
+import { assertNativePublicationPath, nativeRenameNoReplace, requireNativePublicationBackend, } from './internal/native-publication.js';
+const authorityContext = new AsyncLocalStorage();
+const authorityQueueTails = new Map();
+const DEFAULT_STALE_MS = 60_000;
+const DEFAULT_POLL_MS = 20;
+const DEFAULT_WAIT_MS = 10_000;
+const MAX_LEASE_METADATA_BYTES = 4 * 1024;
+export async function withRepositoryLease(root, operation, options = {}) {
+    const rootState = getRootState(root);
+    if (rootState === undefined)
+        throw new RepositoryStoreConfigError('Managed root is not a repository-store handle.');
+    const inherited = authorityContext.getStore()?.get(rootState.authorityId);
+    if (inherited?.active === true)
+        throw new LeaseContentionError('Repository lease acquisition is non-reentrant.', 'LEASE_REENTRANT');
+    checkControl(options);
+    const staleMs = positiveInteger(options.staleMs ?? DEFAULT_STALE_MS, 'staleMs');
+    const pollMs = positiveInteger(options.pollMs ?? DEFAULT_POLL_MS, 'pollMs');
+    const explicitDeadline = options.deadline;
+    const deadline = explicitDeadline ?? Date.now() + nonnegativeInteger(options.waitMs ?? DEFAULT_WAIT_MS, 'waitMs');
+    const turn = enqueueAuthority(rootState.authorityId);
+    try {
+        await waitForAuthorityTurn(turn.predecessor, deadline, explicitDeadline !== undefined, options.signal);
+    }
+    catch (error) {
+        void turn.predecessor.finally(turn.release);
+        throw error;
+    }
+    const controlRoot = join(rootState.authorityRoot, '.neottia', 'repository-store');
+    let acquired = false;
+    let lockIdentity;
+    let ownerIdentity;
+    let leaseState;
+    let lockPath = '';
+    let token = '';
+    try {
+        checkAcquisitionControl(deadline, explicitDeadline !== undefined, options.signal);
+        ensurePrivateDirectory(controlRoot);
+        const cleanupBackend = requireNativePublicationBackend();
+        assertNativePublicationPath(cleanupBackend, controlRoot);
+        const hostId = ensureHostId(controlRoot);
+        lockPath = join(controlRoot, 'authority.lease');
+        const claimPath = join(controlRoot, 'authority.claim');
+        token = randomBytes(32).toString('hex');
+        while (!acquired) {
+            checkAcquisitionControl(deadline, explicitDeadline !== undefined, options.signal);
+            if (!acquireClaim(claimPath, controlRoot, token, hostId)) {
+                if (tryReclaimClaim(claimPath, lockPath, controlRoot, hostId, staleMs))
+                    continue;
+                await waitForLeasePoll(pollMs, deadline, explicitDeadline !== undefined, options.signal);
+                continue;
+            }
+            let initializingLock;
+            let claimOwnershipUncertain = false;
+            try {
+                try {
+                    mkdirSync(lockPath, { mode: 0o700 });
+                    initializingLock = lstatSync(lockPath);
+                    emitLeaseFault('lease-directory-created');
+                }
+                catch (error) {
+                    if (!hasCode(error, 'EEXIST'))
+                        throw error;
+                    if (tryReclaimLockedLease(lockPath, controlRoot, hostId, staleMs))
+                        continue;
+                    await waitForLeasePoll(pollMs, deadline, explicitDeadline !== undefined, options.signal);
+                    continue;
+                }
+                ownerIdentity = writeOwner(lockPath, ownerMetadata(token, hostId));
+                emitLeaseFault('lease-owner-written');
+                lockIdentity = lstatSync(lockPath);
+                if (!lockIdentity.isDirectory() || lockIdentity.isSymbolicLink())
+                    throw new PathSafetyError('Unsafe repository lease path.');
+                const ownerPath = join(lockPath, 'owner.json');
+                const ownerAtPath = lstatSync(ownerPath);
+                assertSafeRegular(ownerAtPath, ownerPath);
+                if (!sameLeaseIdentity(ownerIdentity, ownerAtPath))
+                    throw new PathSafetyError('Repository lease owner changed during initialization.', 'IDENTITY_CHANGED');
+                syncDirectory(controlRoot);
+                if (!removeOwnedClaim(claimPath, token)) {
+                    claimOwnershipUncertain = true;
+                    releaseOwnedLease(lockPath, controlRoot, token, lockIdentity, ownerIdentity);
+                    throw new LeaseContentionError('Repository initialization claim ownership changed.', 'LEASE_OWNER_UNKNOWN');
+                }
+                emitLeaseFault('lease-claim-removed');
+                acquired = true;
+            }
+            catch (error) {
+                if (!acquired && initializingLock !== undefined)
+                    cleanupOwnedInitialization(lockPath, controlRoot, token, initializingLock);
+                throw error;
+            }
+            finally {
+                if (!acquired && !claimOwnershipUncertain)
+                    removeOwnedClaim(claimPath, token);
+            }
+        }
+        if (lockIdentity === undefined || ownerIdentity === undefined)
+            throw new LeaseContentionError('Repository lease identity was not initialized.', 'LEASE_OWNER_UNKNOWN');
+        const acquiredState = {
+            authorityId: rootState.authorityId,
+            token,
+            lockPath,
+            lockIdentity,
+            ownerIdentity,
+            pendingOperations: new Set(),
+            active: true,
+        };
+        leaseState = acquiredState;
+        const lease = createRepositoryLease(rootState.authorityRoot, acquiredState);
+        const context = new Map(authorityContext.getStore() ?? []);
+        context.set(rootState.authorityId, acquiredState);
+        return await authorityContext.run(context, async () => {
+            const { recoverCanonicalTransactions } = await import('./transaction/recovery.js');
+            await recoverCanonicalTransactions(root, lease, options);
+            return operation(lease);
+        });
+    }
+    finally {
+        if (leaseState !== undefined) {
+            while (leaseState.pendingOperations.size > 0)
+                await Promise.allSettled([...leaseState.pendingOperations]);
+            leaseState.active = false;
+        }
+        if (acquired && lockIdentity !== undefined && ownerIdentity !== undefined)
+            releaseOwnedLease(lockPath, controlRoot, token, lockIdentity, ownerIdentity);
+        turn.release();
+    }
+}
+export function assertLiveLease(root, lease) {
+    const rootState = getRootState(root);
+    const leaseState = getLeaseState(lease);
+    if (rootState === undefined || leaseState === undefined || rootState.authorityId !== leaseState.authorityId)
+        throw new RepositoryStoreConfigError('Lease and managed root have different authorities.', 'AUTHORITY_MISMATCH');
+    if (!leaseState.active)
+        throw new LeaseContentionError('Repository lease is no longer active.', 'LEASE_BUSY');
+    if (!ownedLeaseIdentityMatches(leaseState.lockPath, leaseState.token, leaseState.lockIdentity, leaseState.ownerIdentity)) {
+        leaseState.active = false;
+        throw new LeaseContentionError('Repository lease ownership changed.', 'LEASE_OWNER_UNKNOWN');
+    }
+}
+export function trackLeaseOperation(lease, operation) {
+    void operation.catch(() => undefined);
+    const state = getLeaseState(lease);
+    if (state === undefined || !state.active)
+        throw new LeaseContentionError('Repository lease is no longer active.', 'LEASE_BUSY');
+    state.pendingOperations.add(operation);
+    void operation.finally(() => state.pendingOperations.delete(operation)).catch(() => undefined);
+    return operation;
+}
+export function checkControl(control) {
+    if (control.signal?.aborted)
+        throw new LeaseContentionError('Repository operation was aborted.', 'ABORTED');
+    if (control.deadline !== undefined && Date.now() >= control.deadline)
+        throw new LeaseContentionError('Repository operation deadline was exceeded.', 'DEADLINE_EXCEEDED');
+}
+function writeOwner(directory, owner) {
+    const identity = writeOwnerFile(join(directory, 'owner.json'), owner);
+    syncDirectory(directory);
+    return identity;
+}
+function writeOwnerFile(path, owner) {
+    let descriptor;
+    try {
+        descriptor = openSync(path, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, 0o600);
+        writeFileSync(descriptor, `${JSON.stringify(owner)}\n`);
+        syncFileDescriptor(descriptor, path);
+        return fstatSync(descriptor);
+    }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+    }
+}
+function ownerMetadata(token, hostId) {
+    const processStart = readProcessStart(process.pid);
+    return {
+        version: 1,
+        token,
+        pid: process.pid,
+        acquiredAt: new Date().toISOString(),
+        hostname: hostname(),
+        hostId,
+        runtime: typeof Bun === 'undefined' ? `node:${process.version}` : `bun:${Bun.version}`,
+        ...(processStart === undefined ? {} : { processStart }),
+    };
+}
+function ensureHostId(controlRoot) {
+    const path = join(controlRoot, 'host-id');
+    try {
+        const value = new TextDecoder().decode(readRegularFile(path, MAX_LEASE_METADATA_BYTES)).trim();
+        if (!/^[0-9a-f]{64}$/u.test(value))
+            throw new PathSafetyError('Repository host-id is malformed.');
+        return value;
+    }
+    catch (error) {
+        if (!hasCode(error, 'ENOENT'))
+            throw error;
+    }
+    const value = randomBytes(32).toString('hex');
+    try {
+        const descriptor = openSync(path, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, 0o600);
+        try {
+            writeFileSync(descriptor, `${value}\n`);
+            syncFileDescriptor(descriptor, path);
+        }
+        finally {
+            closeSync(descriptor);
+        }
+        syncDirectory(controlRoot);
+        return value;
+    }
+    catch (error) {
+        if (!hasCode(error, 'EEXIST'))
+            throw error;
+        return ensureHostId(controlRoot);
+    }
+}
+function tryReclaimLockedLease(lockPath, controlRoot, hostId, staleMs) {
+    const controlDirectories = captureDirectories(controlRoot);
+    try {
+        const ownerPath = join(lockPath, 'owner.json');
+        const verifiedOwner = readOwner(ownerPath);
+        const owner = verifiedOwner.metadata;
+        const lockStat = lstatSync(lockPath);
+        const ownerStat = verifiedOwner.identity;
+        const releaseExpectation = {
+            kind: 'directory',
+            identity: lockStat,
+            ownerIdentity: ownerStat,
+            token: owner.token,
+        };
+        if (!lockStat.isDirectory() || lockStat.isSymbolicLink())
+            throw new PathSafetyError('Unsafe repository lease path.');
+        if (Date.now() - lockStat.mtimeMs < staleMs || !conclusivelyDead(owner, hostId))
+            return false;
+        const quarantine = `${lockPath}.release-${owner.token}`;
+        if (!quarantineNoReplace(lockPath, quarantine))
+            return false;
+        const quarantinedOwnerPath = join(quarantine, 'owner.json');
+        const movedOwner = readOwner(quarantinedOwnerPath);
+        const movedLock = lstatSync(quarantine);
+        if (!sameIdentity(lockStat, movedLock) ||
+            !sameLeaseIdentity(ownerStat, movedOwner.identity) ||
+            movedOwner.metadata.token !== owner.token) {
+            restoreQuarantinedLease(quarantine, lockPath, releaseExpectation, {
+                kind: 'directory',
+                identity: movedLock,
+                ownerIdentity: movedOwner.identity,
+                token: movedOwner.metadata.token,
+            });
+            throw new LeaseContentionError('Stale lease identity changed during reclamation.', 'LEASE_OWNER_UNKNOWN');
+        }
+        if (!removeVerifiedOwnerFile(quarantinedOwnerPath, movedOwner)) {
+            restoreQuarantinedLease(quarantine, lockPath, releaseExpectation);
+            return false;
+        }
+        rmdirSync(quarantine);
+        syncDirectory(controlRoot);
+        return true;
+    }
+    catch (error) {
+        if (hasCode(error, 'ENOENT') || (error instanceof PathSafetyError && error.code === 'IDENTITY_CHANGED'))
+            return exactPathWasReleased(lockPath, controlDirectories, error);
+        if (error instanceof PathSafetyError || error instanceof ResourceLimitError)
+            throw error;
+        return false;
+    }
+}
+function exactPathWasReleased(path, controlDirectories, originalError, failOnExistingIdentityChange = true) {
+    revalidateDirectories(controlDirectories);
+    try {
+        lstatSync(path);
+    }
+    catch (inspectionError) {
+        if (hasCode(inspectionError, 'ENOENT')) {
+            revalidateDirectories(controlDirectories);
+            return true;
+        }
+        if (originalError instanceof PathSafetyError)
+            throw originalError;
+        throw inspectionError;
+    }
+    if (failOnExistingIdentityChange && originalError instanceof PathSafetyError)
+        throw originalError;
+    return false;
+}
+function acquireClaim(claimPath, controlRoot, token, hostId) {
+    const staging = `${claimPath}.prepare-${token}`;
+    try {
+        writeOwnerFile(staging, ownerMetadata(token, hostId));
+        linkSync(staging, claimPath);
+        emitLeaseFault('claim-published');
+        rmSync(staging);
+        syncDirectory(controlRoot);
+        emitLeaseFault('claim-finalized');
+        return true;
+    }
+    catch (error) {
+        try {
+            rmSync(staging);
+        }
+        catch {
+        }
+        if (hasCode(error, 'EEXIST'))
+            return false;
+        throw error;
+    }
+}
+function tryReclaimClaim(claimPath, lockPath, controlRoot, hostId, staleMs) {
+    const controlDirectories = captureDirectories(controlRoot);
+    try {
+        const preliminary = lstatSync(claimPath);
+        if (preliminary.isSymbolicLink())
+            throw new PathSafetyError('Unsafe repository claim symbolic link.', 'UNSAFE_LINK');
+        if (!preliminary.isFile() || (preliminary.nlink !== 1 && preliminary.nlink !== 2))
+            throw new PathSafetyError('Unsafe repository claim artifact.', 'UNSAFE_HARD_LINK');
+        const verifiedOwner = readOwner(claimPath, true);
+        if (!sameIdentity(preliminary, verifiedOwner.identity))
+            throw new LeaseContentionError('Claim identity changed before owner verification.', 'LEASE_OWNER_UNKNOWN');
+        if (Date.now() - verifiedOwner.identity.mtimeMs < staleMs)
+            return false;
+        const owner = verifiedOwner.metadata;
+        if (!conclusivelyDead(owner, hostId))
+            return false;
+        emitFilesystemFault('after-stale-claim-owner-verified', claimPath);
+        normalizeInterruptedClaimLink(claimPath, controlRoot);
+        const normalizedOwner = readOwner(claimPath);
+        if (!sameIdentity(preliminary, normalizedOwner.identity) ||
+            !sameIdentity(verifiedOwner.identity, normalizedOwner.identity) ||
+            normalizedOwner.metadata.token !== owner.token)
+            throw new LeaseContentionError('Claim owner changed during reclamation.', 'LEASE_OWNER_UNKNOWN');
+        cleanupInterruptedInitialization(lockPath, controlRoot, owner, staleMs);
+        const quarantine = `${claimPath}.release-${owner.token}`;
+        const releaseExpectation = {
+            kind: 'file',
+            identity: normalizedOwner.identity,
+            token: owner.token,
+        };
+        if (!quarantineNoReplace(claimPath, quarantine))
+            return false;
+        const moved = readOwner(quarantine);
+        if (!sameIdentity(normalizedOwner.identity, moved.identity) || moved.metadata.token !== owner.token) {
+            restoreQuarantinedLease(quarantine, claimPath, releaseExpectation, {
+                kind: 'file',
+                identity: moved.identity,
+                token: moved.metadata.token,
+            });
+            return false;
+        }
+        rmSync(quarantine);
+        syncDirectory(controlRoot);
+        return true;
+    }
+    catch (error) {
+        if (hasCode(error, 'ENOENT') || (error instanceof PathSafetyError && error.code === 'IDENTITY_CHANGED'))
+            return exactPathWasReleased(claimPath, controlDirectories, error, false);
+        if (error instanceof PathSafetyError || error instanceof ResourceLimitError)
+            throw error;
+        return false;
+    }
+}
+function cleanupInterruptedInitialization(lockPath, controlRoot, owner, staleMs) {
+    let lockStat;
+    try {
+        lockStat = lstatSync(lockPath);
+    }
+    catch (error) {
+        if (hasCode(error, 'ENOENT'))
+            return;
+        throw error;
+    }
+    if (!lockStat.isDirectory() || lockStat.isSymbolicLink())
+        throw new PathSafetyError('Unsafe incomplete repository lease path.');
+    if (Date.now() - lockStat.mtimeMs < staleMs)
+        return;
+    try {
+        readOwner(join(lockPath, 'owner.json'));
+        return;
+    }
+    catch (error) {
+        if (!hasCode(error, 'ENOENT'))
+            return;
+    }
+    if (readdirSync(lockPath).length !== 0)
+        return;
+    const quarantine = `${lockPath}.release-${owner.token}`;
+    const releaseExpectation = { kind: 'directory', identity: lockStat, token: owner.token };
+    if (!quarantineNoReplace(lockPath, quarantine))
+        return;
+    const quarantined = lstatSync(quarantine);
+    if (!sameIdentity(lockStat, quarantined) || readdirSync(quarantine).length !== 0) {
+        restoreQuarantinedLease(quarantine, lockPath, releaseExpectation);
+        throw new LeaseContentionError('Incomplete lease identity changed during reclamation.', 'LEASE_OWNER_UNKNOWN');
+    }
+    rmdirSync(quarantine);
+    syncDirectory(controlRoot);
+}
+function cleanupOwnedInitialization(lockPath, controlRoot, token, expectedLock) {
+    const quarantine = `${lockPath}.release-${token}`;
+    let releaseExpectation = { kind: 'directory', identity: expectedLock, token };
+    let restorationSafe = false;
+    try {
+        const current = lstatSync(lockPath);
+        if (!current.isDirectory() || current.isSymbolicLink() || !sameIdentity(expectedLock, current))
+            return;
+        const currentEntries = readdirSync(lockPath);
+        if (currentEntries.some((entry) => entry !== 'owner.json'))
+            return;
+        if (currentEntries.includes('owner.json')) {
+            const owner = readOwner(join(lockPath, 'owner.json'));
+            if (owner.metadata.token !== token)
+                return;
+            releaseExpectation = { ...releaseExpectation, ownerIdentity: owner.identity };
+        }
+        if (!quarantineNoReplace(lockPath, quarantine))
+            return;
+        restorationSafe = true;
+        const moved = lstatSync(quarantine);
+        if (!sameIdentity(expectedLock, moved)) {
+            restoreQuarantinedLease(quarantine, lockPath, releaseExpectation);
+            return;
+        }
+        const entries = readdirSync(quarantine);
+        if (entries.some((entry) => entry !== 'owner.json')) {
+            restoreQuarantinedLease(quarantine, lockPath, releaseExpectation);
+            return;
+        }
+        if (entries.includes('owner.json')) {
+            const ownerPath = join(quarantine, 'owner.json');
+            const owner = readOwner(ownerPath);
+            if (owner.metadata.token !== token ||
+                releaseExpectation.ownerIdentity === undefined ||
+                !sameIdentity(owner.identity, releaseExpectation.ownerIdentity) ||
+                !removeVerifiedOwnerFile(ownerPath, owner)) {
+                restoreQuarantinedLease(quarantine, lockPath, releaseExpectation);
+                return;
+            }
+            restorationSafe = false;
+        }
+        rmdirSync(quarantine);
+        syncDirectory(controlRoot);
+    }
+    catch {
+        if (restorationSafe)
+            restoreQuarantinedLease(quarantine, lockPath, releaseExpectation);
+    }
+}
+function normalizeInterruptedClaimLink(claimPath, controlRoot) {
+    const claim = lstatSync(claimPath);
+    if (!claim.isFile() || claim.isSymbolicLink() || claim.nlink === 1)
+        return;
+    if (claim.nlink !== 2)
+        throw new PathSafetyError('Unsafe repository claim hard-link count.', 'UNSAFE_HARD_LINK');
+    const prefix = `${basename(claimPath)}.prepare-`;
+    const candidates = readdirSync(dirname(claimPath)).filter((name) => name.startsWith(prefix));
+    const matching = candidates.filter((name) => {
+        const suffix = name.slice(prefix.length);
+        if (!/^[0-9a-f-]{32,64}$/u.test(suffix))
+            return false;
+        const stat = lstatSync(join(dirname(claimPath), name));
+        return stat.isFile() && !stat.isSymbolicLink() && sameIdentity(claim, stat);
+    });
+    if (matching.length !== 1) {
+        const current = lstatSync(claimPath);
+        if (current.nlink === 1 && sameIdentity(claim, current))
+            return;
+        throw new PathSafetyError('Repository claim hard link is not package-owned.');
+    }
+    rmSync(join(dirname(claimPath), matching[0]));
+    syncDirectory(controlRoot);
+}
+function conclusivelyDead(owner, hostId) {
+    if (owner.hostname !== hostname() || owner.hostId !== hostId)
+        return false;
+    const currentStart = readProcessStart(owner.pid);
+    if (owner.processStart !== undefined && currentStart !== undefined && owner.processStart !== currentStart)
+        return true;
+    try {
+        process.kill(owner.pid, 0);
+        return false;
+    }
+    catch (error) {
+        return hasCode(error, 'ESRCH');
+    }
+}
+function readProcessStart(pid) {
+    if (process.platform !== 'linux')
+        return undefined;
+    try {
+        const fields = readFileSync(`/proc/${pid}/stat`, 'utf8').trim().split(/\s+/u);
+        return fields[21];
+    }
+    catch {
+        return undefined;
+    }
+}
+function readOwner(path, allowInterruptedClaimLink = false) {
+    const initialIdentity = allowInterruptedClaimLink ? lstatSync(path) : undefined;
+    const stagingPeer = allowInterruptedClaimLink ? interruptedClaimPeer(path, initialIdentity) : undefined;
+    let file;
+    try {
+        file = readRegularFileWithIdentity(path, MAX_LEASE_METADATA_BYTES, {
+            allowedLinkCounts: allowInterruptedClaimLink ? [1, 2] : [1],
+        });
+    }
+    catch (error) {
+        const recoverableReadRace = error instanceof PathSafetyError && (error.code === 'IDENTITY_CHANGED' || error.code === 'UNSAFE_HARD_LINK');
+        if (initialIdentity === undefined || !recoverableReadRace)
+            throw error;
+        const stabilized = lstatSync(path);
+        if (stabilized.isSymbolicLink() || !stabilized.isFile())
+            throw error;
+        if (!sameIdentity(initialIdentity, stabilized))
+            throw new PathSafetyError('Interrupted claim identity changed during owner verification.', 'IDENTITY_CHANGED');
+        if (stabilized.nlink !== 1)
+            throw error;
+        file = readRegularFileWithIdentity(path, MAX_LEASE_METADATA_BYTES);
+    }
+    const owner = JSON.parse(new TextDecoder().decode(file.bytes));
+    if (owner.version !== 1 ||
+        typeof owner.token !== 'string' ||
+        !/^[0-9a-f-]{32,64}$/u.test(owner.token) ||
+        !Number.isSafeInteger(owner.pid) ||
+        typeof owner.acquiredAt !== 'string' ||
+        typeof owner.hostname !== 'string' ||
+        typeof owner.hostId !== 'string' ||
+        typeof owner.runtime !== 'string')
+        throw new Error('Malformed lease owner.');
+    const finalIdentity = allowInterruptedClaimLink ? lstatSync(path) : undefined;
+    if (finalIdentity !== undefined && !sameIdentity(file.identity, finalIdentity))
+        throw new PathSafetyError('Interrupted claim identity changed after owner verification.', 'IDENTITY_CHANGED');
+    const finalStagingPeer = allowInterruptedClaimLink && finalIdentity !== undefined ? interruptedClaimPeer(path, finalIdentity) : undefined;
+    if ([stagingPeer, finalStagingPeer].some((peer) => peer !== undefined && owner.token !== peer.token))
+        throw new PathSafetyError('Interrupted claim token does not match its package-owned staging link.');
+    return { metadata: owner, identity: file.identity };
+}
+function interruptedClaimPeer(path, observed) {
+    const stat = observed ?? lstatSync(path);
+    if (stat.isSymbolicLink() || !stat.isFile() || (stat.nlink !== 1 && stat.nlink !== 2))
+        throw new PathSafetyError('Unsafe interrupted repository claim.', 'UNSAFE_HARD_LINK');
+    if (stat.nlink === 1)
+        return undefined;
+    const prefix = `${basename(path)}.prepare-`;
+    const peers = readdirSync(dirname(path)).flatMap((name) => {
+        if (!name.startsWith(prefix))
+            return [];
+        const token = name.slice(prefix.length);
+        if (!/^[0-9a-f-]{32,64}$/u.test(token))
+            return [];
+        try {
+            const peer = lstatSync(join(dirname(path), name));
+            return peer.isFile() && !peer.isSymbolicLink() && sameIdentity(stat, peer) ? [{ token }] : [];
+        }
+        catch (error) {
+            if (hasCode(error, 'ENOENT'))
+                return [];
+            throw error;
+        }
+    });
+    if (peers.length === 1)
+        return peers[0];
+    const stabilized = lstatSync(path);
+    if (!stabilized.isSymbolicLink() && stabilized.isFile() && stabilized.nlink === 1 && sameIdentity(stat, stabilized))
+        return undefined;
+    throw new PathSafetyError('Interrupted claim hard link is not package-owned.', 'UNSAFE_HARD_LINK');
+}
+function releaseOwnedLease(lockPath, controlRoot, token, lockIdentity, ownerIdentity) {
+    const releasePath = `${lockPath}.release-${token}`;
+    const releaseExpectation = {
+        kind: 'directory',
+        identity: lockIdentity,
+        ownerIdentity,
+        token,
+    };
+    let restorationSafe = false;
+    try {
+        const currentLock = lstatSync(lockPath);
+        const currentOwner = readOwner(join(lockPath, 'owner.json'));
+        if (!currentLock.isDirectory() ||
+            currentLock.isSymbolicLink() ||
+            !sameLeaseIdentity(lockIdentity, currentLock) ||
+            !sameLeaseIdentity(ownerIdentity, currentOwner.identity) ||
+            currentOwner.metadata.token !== token)
+            return;
+        if (!quarantineNoReplace(lockPath, releasePath))
+            return;
+        restorationSafe = true;
+        const movedLock = lstatSync(releasePath);
+        const movedOwnerPath = join(releasePath, 'owner.json');
+        const movedOwner = readOwner(movedOwnerPath);
+        if (!sameIdentity(lockIdentity, movedLock) ||
+            !sameLeaseIdentity(ownerIdentity, movedOwner.identity) ||
+            movedOwner.metadata.token !== token) {
+            restoreQuarantinedLease(releasePath, lockPath, releaseExpectation, {
+                kind: 'directory',
+                identity: movedLock,
+                ownerIdentity: movedOwner.identity,
+                token: movedOwner.metadata.token,
+            });
+            return;
+        }
+        if (!removeVerifiedOwnerFile(movedOwnerPath, movedOwner)) {
+            restoreQuarantinedLease(releasePath, lockPath, releaseExpectation);
+            return;
+        }
+        restorationSafe = false;
+        rmdirSync(releasePath);
+        syncDirectory(controlRoot);
+    }
+    catch {
+        if (restorationSafe)
+            restoreQuarantinedLease(releasePath, lockPath, releaseExpectation);
+    }
+}
+export function restoreQuarantinedLease(quarantine, lockPath, expected, movedFromLock) {
+    const verification = `${quarantine}.restore-${randomBytes(16).toString('hex')}`;
+    let staged = false;
+    let preserveUnverified = false;
+    let restorationExpectation;
+    try {
+        nativeRenameNoReplace(requireNativePublicationBackend(), quarantine, verification);
+        staged = true;
+        restorationExpectation = releaseArtifactMatches(verification, expected)
+            ? expected
+            : movedFromLock !== undefined && releaseArtifactMatches(verification, movedFromLock)
+                ? movedFromLock
+                : undefined;
+        if (restorationExpectation === undefined) {
+            preserveUnverified = true;
+            return;
+        }
+        try {
+            nativeRenameNoReplace(requireNativePublicationBackend(), verification, lockPath);
+            staged = false;
+        }
+        catch (error) {
+            if (!hasCode(error, 'EEXIST'))
+                throw error;
+            if (restorationExpectation === expected)
+                cleanupVerifiedReleaseArtifact(verification, expected, quarantine);
+            return;
+        }
+        if (!releaseArtifactMatches(lockPath, restorationExpectation))
+            throw new PathSafetyError('Restored repository lease identity changed.', 'IDENTITY_CHANGED');
+    }
+    catch {
+    }
+    finally {
+        if (staged) {
+            try {
+                if (preserveUnverified ||
+                    releaseArtifactMatches(verification, expected) ||
+                    (movedFromLock !== undefined && releaseArtifactMatches(verification, movedFromLock)))
+                    nativeRenameNoReplace(requireNativePublicationBackend(), verification, quarantine);
+            }
+            catch {
+            }
+        }
+    }
+}
+function releaseArtifactMatches(path, expected) {
+    try {
+        const identity = lstatSync(path);
+        if (!sameIdentity(identity, expected.identity) || identity.isSymbolicLink())
+            return false;
+        if (expected.kind === 'file') {
+            if (!identity.isFile())
+                return false;
+            const owner = readOwner(path);
+            return owner.metadata.token === expected.token && sameIdentity(owner.identity, expected.identity);
+        }
+        if (!identity.isDirectory())
+            return false;
+        const entries = readdirSync(path);
+        if (expected.ownerIdentity === undefined)
+            return entries.length === 0;
+        if (entries.length !== 1 || entries[0] !== 'owner.json')
+            return false;
+        const owner = readOwner(join(path, 'owner.json'));
+        const finalEntries = readdirSync(path);
+        return (owner.metadata.token === expected.token &&
+            sameIdentity(owner.identity, expected.ownerIdentity) &&
+            sameIdentity(lstatSync(path), expected.identity) &&
+            finalEntries.length === 1 &&
+            finalEntries[0] === 'owner.json');
+    }
+    catch {
+        return false;
+    }
+}
+function cleanupVerifiedReleaseArtifact(path, expected, releasePath = path) {
+    const cleanup = `${path}.cleanup-${randomBytes(16).toString('hex')}`;
+    let moved = false;
+    let removed = false;
+    try {
+        const match = /\.release-([0-9a-f-]{32,64})$/u.exec(basename(releasePath));
+        if (match?.[1] !== expected.token)
+            return;
+        nativeRenameNoReplace(requireNativePublicationBackend(), path, cleanup);
+        moved = true;
+        const identity = lstatSync(cleanup);
+        if (!sameIdentity(identity, expected.identity) || identity.isSymbolicLink())
+            return;
+        if (expected.kind === 'file') {
+            if (!identity.isFile())
+                return;
+            const owner = readOwner(cleanup);
+            if (owner.metadata.token !== expected.token || !sameIdentity(owner.identity, expected.identity))
+                return;
+            rmSync(cleanup);
+            removed = true;
+        }
+        else {
+            if (!identity.isDirectory())
+                return;
+            const entries = readdirSync(cleanup);
+            if (expected.ownerIdentity === undefined) {
+                if (entries.length !== 0)
+                    return;
+            }
+            else {
+                if (entries.length !== 1 || entries[0] !== 'owner.json')
+                    return;
+                const ownerPath = join(cleanup, 'owner.json');
+                const owner = readOwner(ownerPath);
+                if (owner.metadata.token !== expected.token || !sameIdentity(owner.identity, expected.ownerIdentity))
+                    return;
+                rmSync(ownerPath);
+            }
+            if (!sameIdentity(lstatSync(cleanup), expected.identity) || readdirSync(cleanup).length !== 0)
+                return;
+            rmdirSync(cleanup);
+            removed = true;
+        }
+        syncDirectory(dirname(path));
+    }
+    catch {
+    }
+    finally {
+        if (moved && !removed) {
+            try {
+                nativeRenameNoReplace(requireNativePublicationBackend(), cleanup, path);
+            }
+            catch {
+            }
+        }
+    }
+}
+function removeOwnedClaim(path, token) {
+    try {
+        const expected = readOwner(path);
+        if (expected.metadata.token !== token)
+            return false;
+        const quarantine = `${path}.release-${token}`;
+        const releaseExpectation = { kind: 'file', identity: expected.identity, token };
+        if (!quarantineNoReplace(path, quarantine))
+            return false;
+        const moved = readOwner(quarantine);
+        if (moved.metadata.token !== token || !sameIdentity(expected.identity, moved.identity)) {
+            restoreQuarantinedLease(quarantine, path, releaseExpectation, {
+                kind: 'file',
+                identity: moved.identity,
+                token: moved.metadata.token,
+            });
+            return false;
+        }
+        rmSync(quarantine);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function ownedLeaseIdentityMatches(lockPath, token, lockIdentity, ownerIdentity) {
+    try {
+        const currentLock = lstatSync(lockPath);
+        const currentOwner = readOwner(join(lockPath, 'owner.json'));
+        return (currentLock.isDirectory() &&
+            !currentLock.isSymbolicLink() &&
+            sameLeaseIdentity(lockIdentity, currentLock) &&
+            sameLeaseIdentity(ownerIdentity, currentOwner.identity) &&
+            currentOwner.metadata.token === token);
+    }
+    catch {
+        return false;
+    }
+}
+function sameLeaseIdentity(left, right) {
+    return (sameIdentity(left, right) &&
+        left.birthtimeMs === right.birthtimeMs &&
+        left.ctimeMs === right.ctimeMs &&
+        left.mtimeMs === right.mtimeMs);
+}
+function removeVerifiedOwnerFile(path, expected) {
+    const quarantine = `${path}.release-${expected.metadata.token}`;
+    if (!quarantineNoReplace(path, quarantine))
+        return false;
+    try {
+        const moved = readOwner(quarantine);
+        const releaseExpectation = {
+            kind: 'file',
+            identity: expected.identity,
+            token: expected.metadata.token,
+        };
+        if (moved.metadata.token !== expected.metadata.token || !sameIdentity(moved.identity, expected.identity)) {
+            restoreQuarantinedLease(quarantine, path, releaseExpectation, {
+                kind: 'file',
+                identity: moved.identity,
+                token: moved.metadata.token,
+            });
+            return false;
+        }
+        rmSync(quarantine);
+        return true;
+    }
+    catch {
+        restoreQuarantinedLease(quarantine, path, {
+            kind: 'file',
+            identity: expected.identity,
+            token: expected.metadata.token,
+        });
+        return false;
+    }
+}
+function enqueueAuthority(authorityId) {
+    const predecessor = authorityQueueTails.get(authorityId) ?? Promise.resolve();
+    let releaseGate = () => undefined;
+    const gate = new Promise((resolveGate) => {
+        releaseGate = resolveGate;
+    });
+    const tail = predecessor.then(() => gate);
+    authorityQueueTails.set(authorityId, tail);
+    let released = false;
+    return {
+        predecessor,
+        release() {
+            if (released)
+                return;
+            released = true;
+            releaseGate();
+            if (authorityQueueTails.get(authorityId) === tail)
+                authorityQueueTails.delete(authorityId);
+        },
+    };
+}
+async function waitForAuthorityTurn(predecessor, deadline, hasExplicitDeadline, signal) {
+    checkAcquisitionControl(deadline, hasExplicitDeadline, signal);
+    await new Promise((resolveTurn, rejectTurn) => {
+        let settled = false;
+        const timer = setTimeout(timedOut, Math.max(0, deadline - Date.now()));
+        const settle = (operation) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', aborted);
+            operation();
+        };
+        const aborted = () => settle(() => rejectTurn(new LeaseContentionError('Repository operation was aborted.', 'ABORTED')));
+        function timedOut() {
+            settle(() => rejectTurn(acquisitionTimeout(hasExplicitDeadline)));
+        }
+        signal?.addEventListener('abort', aborted, { once: true });
+        void predecessor.then(() => settle(resolveTurn));
+    });
+    checkAcquisitionControl(deadline, hasExplicitDeadline, signal);
+}
+async function waitForLeasePoll(pollMs, deadline, hasExplicitDeadline, signal) {
+    checkAcquisitionControl(deadline, hasExplicitDeadline, signal);
+    await interruptibleDelay(Math.min(pollMs, Math.max(1, deadline - Date.now())), signal);
+    checkAcquisitionControl(deadline, hasExplicitDeadline, signal);
+}
+async function interruptibleDelay(ms, signal) {
+    await new Promise((resolveDelay, rejectDelay) => {
+        const timer = setTimeout(done, ms);
+        function done() {
+            signal?.removeEventListener('abort', aborted);
+            resolveDelay();
+        }
+        function aborted() {
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', aborted);
+            rejectDelay(new LeaseContentionError('Repository operation was aborted.', 'ABORTED'));
+        }
+        signal?.addEventListener('abort', aborted, { once: true });
+    });
+}
+function checkAcquisitionControl(deadline, hasExplicitDeadline, signal) {
+    if (signal?.aborted)
+        throw new LeaseContentionError('Repository operation was aborted.', 'ABORTED');
+    if (Date.now() >= deadline)
+        throw acquisitionTimeout(hasExplicitDeadline);
+}
+function acquisitionTimeout(hasExplicitDeadline) {
+    return hasExplicitDeadline
+        ? new LeaseContentionError('Repository operation deadline was exceeded.', 'DEADLINE_EXCEEDED')
+        : new LeaseContentionError('Repository authority lease is busy.', 'LEASE_BUSY');
+}
+function quarantineNoReplace(source, destination) {
+    emitFilesystemFault('before-lease-artifact-quarantine', source);
+    try {
+        const backend = requireNativePublicationBackend();
+        assertNativePublicationPath(backend, dirname(source));
+        nativeRenameNoReplace(backend, source, destination);
+        return true;
+    }
+    catch (error) {
+        if (hasCode(error, 'EEXIST') || hasCode(error, 'ENOENT'))
+            return false;
+        throw error;
+    }
+}
+function positiveInteger(value, name) {
+    if (!Number.isSafeInteger(value) || value <= 0)
+        throw new RepositoryStoreConfigError(`${name} must be a positive safe integer.`);
+    return value;
+}
+function nonnegativeInteger(value, name) {
+    if (!Number.isSafeInteger(value) || value < 0)
+        throw new RepositoryStoreConfigError(`${name} must be a nonnegative safe integer.`);
+    return value;
+}
+//# sourceMappingURL=lease.js.map