@noopolis/daimon 0.1.2 → 0.2.1

package/dist/runtime/wakeAcceptanceClaimDiagnostics.js

@@ -0,0 +1,79 @@
+import { setTimeout as delay } from "node:timers/promises";
+import { performance } from "node:perf_hooks";
+import { WakeTransitionLockBlockedError } from "./wakeAcceptanceProcessIdentity.js";
+export class WakeExecutionClaimLostError extends Error {
+    detail;
+    constructor(detail, cause) {
+        super(`wake execution claim was lost${detail === undefined ? "" : `: step=${detail.step} assertion=${detail.assertion} ${JSON.stringify({ ...detail, expected: diagnosticIdentity(detail.expected), current: diagnosticIdentity(detail.current) })}`}`, { cause });
+        this.detail = detail;
+        this.name = "WakeExecutionClaimLostError";
+    }
+}
+export class WakeTransitionLockContentionError extends WakeExecutionClaimLostError {
+    constructor(detail) { super(detail); this.name = "WakeTransitionLockContentionError"; }
+}
+const lockWaitTiming = { now: () => performance.now(), sleep: async (ms) => { await delay(ms); } };
+/**
+ * Only an occupied lock is retried; claim mismatches and I/O failures are not.
+ * The 250 ms budget bounds attempt starts and requested sleeps. Filesystem I/O
+ * is not cancellable, so an admitted acquisition can finish after the deadline.
+ * Keep that lock: callers revalidate the claim before writing and release the
+ * lock in finally, so late acquisition cannot authorize a stale claim.
+ */
+export async function waitForClaimTransitionLock(acquire, read, acceptanceId, claim, step, timing = lockWaitTiming) {
+    const deadline = timing.now() + 250;
+    for (let attempt = 0;; attempt++) {
+        if (attempt >= 26 || timing.now() >= deadline) {
+            let current;
+            try {
+                current = await read();
+            }
+            catch (cause) {
+                throw new WakeExecutionClaimLostError({ step, assertion: "transition_lock_read", acceptance_id: acceptanceId, expected: claim, current: null }, cause);
+            }
+            throw new WakeTransitionLockContentionError({ step, assertion: "transition_lock_contended", acceptance_id: acceptanceId, expected: claim, current: current ?? null, lock: current ?? null });
+        }
+        let lock;
+        try {
+            lock = await acquire();
+        }
+        catch (cause) {
+            if (cause instanceof WakeTransitionLockBlockedError)
+                throw cause;
+            throw new WakeExecutionClaimLostError({ step, assertion: "transition_lock_acquire", acceptance_id: acceptanceId, expected: claim, current: null }, cause);
+        }
+        if (lock !== undefined)
+            return lock;
+        const remaining = deadline - timing.now();
+        if (remaining > 0 && attempt < 25)
+            await timing.sleep(Math.min(10, remaining));
+    }
+}
+function diagnosticIdentity(value) {
+    if (value === null || typeof value === "string" || "pid" in value)
+        return value;
+    // Membership can contain 32 UUIDs. Keep both identities and the lock visible
+    // through the host's 2 KiB diagnostic bound; the typed detail keeps membership.
+    const { acceptance_ids: _members, ...identity } = value;
+    return identity;
+}
+/** Read errors retain their errno as cause; no record/event/credential data enters diagnostics. */
+export async function readExpectedClaim(read, acceptanceId, expected, step, now, lock) {
+    let current;
+    try {
+        current = await read();
+    }
+    catch (cause) {
+        const assertion = cause?.code === "ENOENT" ? "claim_missing" : "claim_read";
+        throw new WakeExecutionClaimLostError({ step, assertion, acceptance_id: acceptanceId, expected, current: null, ...(lock === undefined ? {} : { lock }) }, cause);
+    }
+    const assertion = !(current.acceptance_id === acceptanceId || current.acceptance_ids?.includes(acceptanceId)) ? "claim_membership"
+        : current.acceptance_id !== expected.acceptance_id ? "claim_acceptance_id"
+            : current.owner_id !== expected.owner_id ? "claim_owner_id"
+                : current.generation !== expected.generation ? "claim_generation"
+                    : current.expires_at !== expected.expires_at ? "claim_expires_at"
+                        : Date.parse(current.expires_at) <= now() ? "claim_expired" : undefined;
+    if (assertion !== undefined)
+        throw new WakeExecutionClaimLostError({ step, assertion, acceptance_id: acceptanceId, expected, current, ...(lock === undefined ? {} : { lock }) });
+    return current;
+}

package/dist/runtime/wakeAcceptanceIndex.d.ts

@@ -0,0 +1,55 @@
+export type WakeAcceptanceStat = Readonly<{
+    ino: bigint;
+    size: bigint;
+    mtimeNs: bigint;
+    ctimeNs: bigint;
+}>;
+export type WakeAcceptanceIndexSource = Readonly<{
+    /** Opened-handle stat of the store directory. */
+    directoryStat: () => Promise<WakeAcceptanceStat>;
+    /** Record file names, after the store's own root validation and bounds. */
+    files: () => Promise<readonly string[]>;
+    /** Acceptance id of one record, read through every safety check of the store. */
+    readId: (file: string) => Promise<string>;
+    /** Identity stamp of one record file; undefined when it is gone. */
+    fileStat: (file: string) => Promise<WakeAcceptanceStat | undefined>;
+}>;
+/**
+ * Acceptance-id → record-file index. Own writes keep it current; a directory
+ * whose stamp moved since the last sync (another process, or this one) is
+ * re-listed, and only record files whose own stamp moved are read again. A miss
+ * against an unchanged directory reads no record file.
+ */
+export declare class WakeAcceptanceIndex {
+    private readonly root;
+    private readonly source;
+    private readonly nowNs;
+    private readonly byId;
+    private readonly byFile;
+    private synced;
+    /** Bumped by every binding change made outside a sync; a sync that saw one never vouches for the directory. */
+    private mutations;
+    private refreshing;
+    constructor(root: string, source: WakeAcceptanceIndexSource, nowNs?: () => bigint);
+    /**
+     * The record bound to this id, verified to still carry it. Unknown and
+     * compacted ids are polled, so a miss against an unchanged directory reads
+     * no record file.
+     */
+    find<T extends Readonly<{
+        acceptance_id: string;
+    }>>(acceptanceId: string, read: (file: string) => Promise<T | undefined>): Promise<T | undefined>;
+    /** Binds a record this process wrote; its file stamp is learned on the next sync. */
+    set(acceptanceId: string, file: string): void;
+    /** Drops a record file this process deleted. */
+    forget(file: string): void;
+    /** Brings the index level with the directory; a no-op while the directory is unchanged. Single-flight. */
+    refresh(): Promise<void>;
+    private refreshNow;
+    private scan;
+    /** A binding found stale: drop only what still says so, never a newer binding of the same file. */
+    private unbind;
+    private drop;
+    private bind;
+}
+//# sourceMappingURL=wakeAcceptanceIndex.d.ts.map

package/dist/runtime/wakeAcceptanceIndex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wakeAcceptanceIndex.d.ts","sourceRoot":"","sources":["../../src/runtime/wakeAcceptanceIndex.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE3G,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAC/C,iDAAiD;IACjD,aAAa,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjD,2EAA2E;IAC3E,KAAK,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IACxC,iFAAiF;IACjF,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,oEAAoE;IACpE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;CACrE,CAAC,CAAC;AAEH;;;;;GAKG;AACH,qBAAa,mBAAmB;IAOlB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAU,OAAO,CAAC,QAAQ,CAAC,MAAM;IAA6B,OAAO,CAAC,QAAQ,CAAC,KAAK;IANrH,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IACnD,OAAO,CAAC,MAAM,CAAqB;IACnC,+GAA+G;IAC/G,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,UAAU,CAA4B;gBACjB,IAAI,EAAE,MAAM,EAAmB,MAAM,EAAE,yBAAyB,EAAmB,KAAK,GAAE,MAAM,MAA8C;IAC3K;;;;OAIG;IACG,IAAI,CAAC,CAAC,SAAS,QAAQ,CAAC;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAYvJ,qFAAqF;IACrF,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAK7C,gDAAgD;IAChD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAC1B,0GAA0G;IACpG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAMhB,UAAU;YAiBV,IAAI;IAiBlB,mGAAmG;IACnG,OAAO,CAAC,MAAM;IAMd,OAAO,CAAC,IAAI;IAMZ,OAAO,CAAC,IAAI;CAMb"}

package/dist/runtime/wakeAcceptanceIndex.js

@@ -0,0 +1,158 @@
+import path from "node:path";
+import { MAX_WAKE_ACCEPTANCE_RECORDS } from "./wakeAcceptanceRetention.js";
+/**
+ * A stamp younger than this may share a coarse filesystem timestamp tick with
+ * a write that lands after it was taken, so it is never trusted to prove that
+ * nothing changed (the racy-timestamp rule).
+ */
+const RACY_WINDOW_NS = 2000000000n;
+/**
+ * Own writes bind without a sync, so another process compacting behind a host
+ * that only ever hits could leave bindings for files that are gone. Past this
+ * many the index is dropped and the next miss rebuilds it from the directory.
+ */
+const MAX_INDEX_ENTRIES = MAX_WAKE_ACCEPTANCE_RECORDS * 2;
+/**
+ * Acceptance-id → record-file index. Own writes keep it current; a directory
+ * whose stamp moved since the last sync (another process, or this one) is
+ * re-listed, and only record files whose own stamp moved are read again. A miss
+ * against an unchanged directory reads no record file.
+ */
+export class WakeAcceptanceIndex {
+    root;
+    source;
+    nowNs;
+    byId = new Map();
+    byFile = new Map();
+    synced;
+    /** Bumped by every binding change made outside a sync; a sync that saw one never vouches for the directory. */
+    mutations = 0;
+    refreshing;
+    constructor(root, source, nowNs = () => BigInt(Date.now()) * 1000000n) {
+        this.root = root;
+        this.source = source;
+        this.nowNs = nowNs;
+    }
+    /**
+     * The record bound to this id, verified to still carry it. Unknown and
+     * compacted ids are polled, so a miss against an unchanged directory reads
+     * no record file.
+     */
+    async find(acceptanceId, read) {
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            const known = this.byId.get(acceptanceId);
+            if (known !== undefined) {
+                const record = await read(known);
+                if (record?.acceptance_id === acceptanceId)
+                    return record;
+                this.unbind(acceptanceId, known);
+            }
+            if (attempt === 0)
+                await this.refresh();
+        }
+        return undefined;
+    }
+    /** Binds a record this process wrote; its file stamp is learned on the next sync. */
+    set(acceptanceId, file) {
+        this.mutations += 1;
+        if (this.byFile.size >= MAX_INDEX_ENTRIES) {
+            this.byFile.clear();
+            this.byId.clear();
+            this.synced = undefined;
+        }
+        this.bind(file, acceptanceId, undefined);
+    }
+    /** Drops a record file this process deleted. */
+    forget(file) { this.mutations += 1; this.drop(file); }
+    /** Brings the index level with the directory; a no-op while the directory is unchanged. Single-flight. */
+    async refresh() {
+        while (this.refreshing !== undefined)
+            await this.refreshing.catch(() => undefined);
+        const run = this.refreshNow();
+        this.refreshing = run;
+        try {
+            await run;
+        }
+        finally {
+            if (this.refreshing === run)
+                this.refreshing = undefined;
+        }
+    }
+    async refreshNow() {
+        const startedAt = this.nowNs();
+        const directory = await this.source.directoryStat();
+        const directoryStamp = stampOf(directory);
+        if (this.synced === directoryStamp)
+            return;
+        const mutations = this.mutations;
+        const listed = (await this.source.files()).map((name) => path.join(this.root, name));
+        // Prune what the directory no longer lists even when a record below fails to
+        // read, so the maps stay bounded by the store's own record bound.
+        const present = new Set(listed);
+        try {
+            await this.scan(listed, present);
+        }
+        finally {
+            for (const file of [...this.byFile.keys()])
+                if (!present.has(file))
+                    this.drop(file);
+        }
+        // Vouch for the directory only if nothing rebound while listing and its stamp
+        // was already settled when it was taken (the racy-timestamp rule).
+        this.synced = this.mutations === mutations && !racy(directory, startedAt) ? directoryStamp : undefined;
+    }
+    async scan(listed, present) {
+        for (const file of listed) {
+            const seenAt = this.nowNs();
+            const stat = await this.source.fileStat(file);
+            if (stat === undefined) {
+                present.delete(file);
+                continue;
+            }
+            const stamp = racy(stat, seenAt) ? undefined : stampOf(stat);
+            const known = this.byFile.get(file);
+            if (known !== undefined && known.stamp !== undefined && known.stamp === stamp)
+                continue;
+            let id;
+            try {
+                id = await this.source.readId(file);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+                present.delete(file);
+                continue;
+            }
+            this.bind(file, id, stamp);
+        }
+    }
+    /** A binding found stale: drop only what still says so, never a newer binding of the same file. */
+    unbind(acceptanceId, file) {
+        this.mutations += 1;
+        if (this.byId.get(acceptanceId) === file)
+            this.byId.delete(acceptanceId);
+        if (this.byFile.get(file)?.id === acceptanceId)
+            this.byFile.delete(file);
+        this.synced = undefined;
+    }
+    drop(file) {
+        const entry = this.byFile.get(file);
+        if (entry !== undefined && this.byId.get(entry.id) === file)
+            this.byId.delete(entry.id);
+        this.byFile.delete(file);
+        this.synced = undefined;
+    }
+    bind(file, acceptanceId, stamp) {
+        const prior = this.byFile.get(file);
+        if (prior !== undefined && prior.id !== acceptanceId && this.byId.get(prior.id) === file)
+            this.byId.delete(prior.id);
+        this.byFile.set(file, { id: acceptanceId, ...(stamp === undefined ? {} : { stamp }) });
+        this.byId.set(acceptanceId, file);
+    }
+}
+/** A stamp taken within the window of its own last change may share a tick with a later write. */
+function racy(stat, observedAt) {
+    const changed = stat.mtimeNs > stat.ctimeNs ? stat.mtimeNs : stat.ctimeNs;
+    return observedAt - changed < RACY_WINDOW_NS;
+}
+function stampOf(stat) { return `${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`; }

package/dist/runtime/wakeAcceptanceProcessIdentity.d.ts

@@ -0,0 +1,25 @@
+export type TransitionLock = Readonly<{
+    owner_id: string;
+    generation: string;
+    pid: number;
+    process_start: string;
+    boot_id: string;
+    pid_namespace_dev: number;
+    pid_namespace_ino: number;
+}>;
+type BlockedLockDetail = Readonly<{
+    step: string;
+    acceptance_id: string;
+    expected: Omit<TransitionLock, "owner_id" | "generation">;
+    current: TransitionLock;
+}>;
+export declare class WakeTransitionLockBlockedError extends Error {
+    readonly detail?: BlockedLockDetail | undefined;
+    readonly code: "offline_reconciliation_required";
+    constructor(detail?: BlockedLockDetail | undefined);
+}
+export declare function sameNamespace(left: Pick<TransitionLock, "pid_namespace_dev" | "pid_namespace_ino">, right: Pick<TransitionLock, "pid_namespace_dev" | "pid_namespace_ino">): boolean;
+export declare function currentProcessIdentity(): Promise<Omit<TransitionLock, "owner_id" | "generation">>;
+export declare function processIsAlive(lock: TransitionLock): Promise<boolean>;
+export {};
+//# sourceMappingURL=wakeAcceptanceProcessIdentity.d.ts.map

package/dist/runtime/wakeAcceptanceProcessIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wakeAcceptanceProcessIdentity.d.ts","sourceRoot":"","sources":["../../src/runtime/wakeAcceptanceProcessIdentity.ts"],"names":[],"mappings":"AACA,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAC3L,KAAK,iBAAiB,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,YAAY,CAAC,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC,CAAC;AAC/J,qBAAa,8BAA+B,SAAQ,KAAK;IAE3C,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB;IAD/C,QAAQ,CAAC,IAAI,EAAG,iCAAiC,CAAU;gBACtC,MAAM,CAAC,EAAE,iBAAiB,YAAA;CAChD;AACD,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,mBAAmB,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,mBAAmB,GAAG,mBAAmB,CAAC,GAAG,OAAO,CAAqH;AAC1S,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,YAAY,CAAC,CAAC,CAKvG;AACD,wBAAsB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAO3E"}

package/dist/runtime/wakeAcceptanceProcessIdentity.js

@@ -0,0 +1,54 @@
+import { readFile, stat } from "node:fs/promises";
+export class WakeTransitionLockBlockedError extends Error {
+    detail;
+    code = "offline_reconciliation_required";
+    constructor(detail) {
+        super(`wake transition lock requires offline reconciliation${detail === undefined ? "" : `: step=${detail.step} assertion=transition_lock_namespace ${JSON.stringify(detail)}`}`);
+        this.detail = detail;
+    }
+}
+export function sameNamespace(left, right) { return left.pid_namespace_dev === right.pid_namespace_dev && left.pid_namespace_ino === right.pid_namespace_ino; }
+export async function currentProcessIdentity() {
+    if (process.platform !== "linux")
+        throw new Error("wake transition locks require Linux process identity");
+    const boot_id = (await readFile("/proc/sys/kernel/random/boot_id", "utf8")).trim();
+    if (!boot_id)
+        throw new Error("wake transition owner identity is invalid");
+    return { pid: process.pid, process_start: await linuxProcessStart(process.pid), boot_id, ...await linuxPidNamespace() };
+}
+export async function processIsAlive(lock) {
+    if (process.platform !== "linux")
+        throw new Error("wake transition lock liveness is unsupported");
+    if (!sameNamespace(lock, await linuxPidNamespace()))
+        throw new WakeTransitionLockBlockedError();
+    const boot = (await readFile("/proc/sys/kernel/random/boot_id", "utf8")).trim();
+    if (!boot)
+        throw new Error("wake transition owner liveness cannot be proven");
+    if (boot !== lock.boot_id)
+        return false;
+    try {
+        return await linuxProcessStart(lock.pid) === lock.process_start;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw new Error("wake transition owner liveness cannot be proven");
+    }
+}
+async function linuxProcessStart(pid) {
+    const stat = await readFile(`/proc/${pid}/stat`, "utf8");
+    const close = stat.lastIndexOf(")");
+    const fields = stat.slice(close + 2).trim().split(/\s+/u);
+    const start = fields[19];
+    if (close < 0 || start === undefined || !/^\d+$/u.test(start))
+        throw new Error("wake transition owner identity is invalid");
+    return start;
+}
+async function linuxPidNamespace() {
+    const identity = await stat("/proc/self/ns/pid");
+    const pid_namespace_dev = Number(identity.dev);
+    const pid_namespace_ino = Number(identity.ino);
+    if (!Number.isSafeInteger(pid_namespace_dev) || !Number.isSafeInteger(pid_namespace_ino) || pid_namespace_dev < 1 || pid_namespace_ino < 1)
+        throw new Error("wake transition owner identity is invalid");
+    return { pid_namespace_dev, pid_namespace_ino };
+}

package/dist/runtime/wakeAcceptanceReconciliation.d.ts

@@ -0,0 +1,211 @@
+import { open } from "node:fs/promises";
+import { type StoreHostRegistration, type StoreHostRegistrationIdentity } from "./storeCoordination.js";
+export declare const OFFLINE_RECONCILIATION_VERSION: "noopolis.daimon.offline-transition-reconciliation.v1";
+export declare const OFFLINE_RECONCILIATION_BLOCKED_CODE: "offline_reconciliation_required";
+declare const RECEIPT_VERSION: "noopolis.daimon.offline-transition-reconciliation-receipt.v1";
+export declare const OFFLINE_RECONCILIATION_REQUEST_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "noopolis.daimon.offline-transition-reconciliation.v1";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["version", "agent_id", "delivery_id", "store", "lock", "attestation"];
+    readonly properties: {
+        readonly version: {
+            readonly const: "noopolis.daimon.offline-transition-reconciliation.v1";
+        };
+        readonly agent_id: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 16384;
+        };
+        readonly delivery_id: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 16384;
+        };
+        readonly store: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["dev", "ino"];
+            readonly properties: {
+                readonly dev: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly ino: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+            };
+        };
+        readonly lock: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["dev", "ino", "owner_id", "generation", "pid", "process_start", "boot_id", "pid_namespace_dev", "pid_namespace_ino"];
+            readonly properties: {
+                readonly dev: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly ino: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly owner_id: {
+                    readonly type: "string";
+                };
+                readonly generation: {
+                    readonly type: "string";
+                };
+                readonly pid: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly process_start: {
+                    readonly type: "string";
+                };
+                readonly boot_id: {
+                    readonly type: "string";
+                };
+                readonly pid_namespace_dev: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+                readonly pid_namespace_ino: {
+                    readonly type: "integer";
+                    readonly minimum: 1;
+                };
+            };
+        };
+        readonly attestation: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["version", "authority_id", "attestation_id", "state", "proof"];
+            readonly properties: {
+                readonly version: {
+                    readonly const: "noopolis.deployment.container-quiescence.v1";
+                };
+                readonly authority_id: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 16384;
+                };
+                readonly attestation_id: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 16384;
+                };
+                readonly state: {
+                    readonly enum: readonly ["absent", "quiescent"];
+                };
+                readonly proof: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 16384;
+                };
+            };
+        };
+    };
+};
+type Identity = Readonly<{
+    dev: number;
+    ino: number;
+}>;
+type Lock = Readonly<{
+    dev: number;
+    ino: number;
+    owner_id: string;
+    generation: string;
+    pid: number;
+    process_start: string;
+    boot_id: string;
+    pid_namespace_dev: number;
+    pid_namespace_ino: number;
+}>;
+type Lease = Readonly<{
+    owner_id: string;
+    pid: number;
+    process_start: string;
+    boot_id: string;
+    pid_namespace_dev: number;
+    pid_namespace_ino: number;
+}>;
+export type OfflineDeploymentAttestation = Readonly<{
+    version: "noopolis.deployment.container-quiescence.v1";
+    authority_id: string;
+    attestation_id: string;
+    state: "absent" | "quiescent";
+    proof: string;
+}>;
+export type OfflineTransitionReconciliationRequest = Readonly<{
+    version: typeof OFFLINE_RECONCILIATION_VERSION;
+    agent_id: string;
+    delivery_id: string;
+    store: Identity;
+    lock: Lock;
+    attestation: OfflineDeploymentAttestation;
+}>;
+export type OfflineTransitionReconciliationAuthorizationContext = Readonly<{
+    version: "noopolis.daimon.offline-transition-authorization-context.v1";
+    deployment_identity: string;
+    deployment_state: "absent" | "quiescent";
+    nonce: string;
+    request_digest: string;
+    agent_id: string;
+    delivery_id: string;
+    store: Identity;
+    lock: Lock;
+    stale_host_registrations: readonly StoreHostRegistrationIdentity[];
+}>;
+export type OfflineTransitionReconciliationProofReceipt = Readonly<{
+    request_digest: string;
+    nonce: string;
+    exclusive_store: true;
+    authorized_registration_digests: readonly string[];
+}>;
+export type OfflineTransitionReconciliationReceipt = Readonly<{
+    version: typeof RECEIPT_VERSION;
+    reconciliation_id: string;
+    request_digest: string;
+    state: "reconciled";
+    reconciled_at: string;
+    cleared_registration_digests: readonly string[];
+}>;
+export type OfflineTransitionReconciliationResult = OfflineTransitionReconciliationReceipt | Readonly<{
+    version: typeof OFFLINE_RECONCILIATION_VERSION;
+    state: "blocked";
+    code: typeof OFFLINE_RECONCILIATION_BLOCKED_CODE;
+}>;
+export type OfflineTransitionReconciliationOptions = Readonly<{
+    storePath: string;
+    verifyDeploymentAttestation: (context: OfflineTransitionReconciliationAuthorizationContext, attestation: OfflineDeploymentAttestation) => Promise<OfflineTransitionReconciliationProofReceipt>;
+    leaseIdentity?: () => Promise<Lease>;
+    leaseLiveness?: (lease: Lease) => Promise<boolean>;
+    hostLiveness?: (host: StoreHostRegistration) => Promise<boolean>;
+}>;
+/** Deployment-only: caller must exclusively mount the private store offline. */
+export declare function reconcileOfflineWakeTransition(value: unknown, options: OfflineTransitionReconciliationOptions): Promise<OfflineTransitionReconciliationResult>;
+export declare function parseOfflineTransitionReconciliationRequest(value: unknown): OfflineTransitionReconciliationRequest;
+export declare class OfflineTransitionReconciliationBlockedError extends Error {
+    readonly code: "offline_reconciliation_required";
+    constructor();
+}
+/** Normal hosts may start only after the durable offline lease is absent. */
+export declare function assertOfflineReconciliationLeaseAvailable(root: string): Promise<void>;
+/**
+ * Publishes `value` at `target` only if `target` does not already exist, and
+ * only ever under complete, fsynced content — the name never appears holding a
+ * partial or zero-byte document, which `readLease` would otherwise accept as a
+ * safe file and then fail to `JSON.parse`.
+ *
+ * `link(2)` is mandatory here and `rename(2)` is FORBIDDEN. rename overwrites
+ * its destination unconditionally, so two acquirers that both pass the
+ * (non-atomic) `readLeaseOptional` pre-check would both publish and both
+ * believe they hold the exclusive offline-reconciliation lease. link fails with
+ * EEXIST when the target exists, which is the mutual exclusion `acquireLease`
+ * converts into a blocked result. Exported solely so that contract can be
+ * asserted directly; it is not re-exported from `./index.ts`.
+ */
+export declare function publishExclusive(target: string, value: unknown, directory: Awaited<ReturnType<typeof open>>): Promise<void>;
+export {};
+//# sourceMappingURL=wakeAcceptanceReconciliation.d.ts.map

package/dist/runtime/wakeAcceptanceReconciliation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wakeAcceptanceReconciliation.d.ts","sourceRoot":"","sources":["../../src/runtime/wakeAcceptanceReconciliation.ts"],"names":[],"mappings":"AAEA,OAAO,EAAe,IAAI,EAA4C,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EAA6E,KAAK,qBAAqB,EAAE,KAAK,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AAEnL,eAAO,MAAM,8BAA8B,EAAG,sDAA+D,CAAC;AAC9G,eAAO,MAAM,mCAAmC,EAAG,iCAA0C,CAAC;AAE9F,QAAA,MAAM,eAAe,EAAG,8DAAuE,CAAC;AAEhG,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQxC,CAAC;AAEX,KAAK,QAAQ,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AACvD,KAAK,IAAI,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AACpM,KAAK,KAAK,GAAG,QAAQ,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AACvJ,MAAM,MAAM,4BAA4B,GAAG,QAAQ,CAAC;IAAE,OAAO,EAAE,6CAA6C,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,GAAG,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAC5M,MAAM,MAAM,sCAAsC,GAAG,QAAQ,CAAC;IAAE,OAAO,EAAE,OAAO,8BAA8B,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,4BAA4B,CAAA;CAAE,CAAC,CAAC;AACjO,MAAM,MAAM,mDAAmD,GAAG,QAAQ,CAAC;IAAE,OAAO,EAAE,6DAA6D,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,QAAQ,GAAG,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,wBAAwB,EAAE,SAAS,6BAA6B,EAAE,CAAA;CAAE,CAAC,CAAC;AAC7Y,MAAM,MAAM,2CAA2C,GAAG,QAAQ,CAAC;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,IAAI,CAAC;IAAC,+BAA+B,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AACzL,MAAM,MAAM,sCAAsC,GAAG,QAAQ,CAAC;IAAE,OAAO,EAAE,OAAO,eAAe,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,YAAY,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,4BAA4B,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AACnP,MAAM,MAAM,qCAAqC,GAAG,sCAAsC,GAAG,QAAQ,CAAC;IAAE,OAAO,EAAE,OAAO,8BAA8B,CAAC;IAAC,KAAK,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,OAAO,mCAAmC,CAAA;CAAE,CAAC,CAAC;AAC9N,MAAM,MAAM,sCAAsC,GAAG,QAAQ,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,2BAA2B,EAAE,CAAC,OAAO,EAAE,mDAAmD,EAAE,WAAW,EAAE,4BAA4B,KAAK,OAAO,CAAC,2CAA2C,CAAC,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,CAAC;AAEjb,gFAAgF;AAChF,wBAAsB,8BAA8B,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,sCAAsC,GAAG,OAAO,CAAC,qCAAqC,CAAC,CAsCpK;AAED,wBAAgB,2CAA2C,CAAC,KAAK,EAAE,OAAO,GAAG,sCAAsC,CAUlH;AAED,qBAAa,2CAA4C,SAAQ,KAAK;IAAG,QAAQ,CAAC,IAAI,oCAAuC;;CAA2E;AACxM,6EAA6E;AAC7E,wBAAsB,yCAAyC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAyJ;AAerP;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAA4L"}