@north-light/cli 0.0.0 → 0.3.413

package/dist/daemon/cron-run.js

@@ -0,0 +1 @@
+var A=Object.defineProperty;var f=(e,t)=>A(e,"name",{value:t,configurable:!0});import{randomUUID as R}from"node:crypto";import{CRON_OUTPUT_HEAD_BYTES as h,EMPTY_STDOUT_SHA256 as T,formatCronOutputHead as H}from"./cron/capture.js";import{clearLiveRun as _,cronDaemonInstanceId as E,registerLiveRun as g}from"./cron/live-runs.js";import{buildArmedRunContext as v}from"./cron/armed-context.js";import{decideHeldSettle as M,EXIT_HELD as k,HELD_DELIVERED as b}from"./cron/held.js";import{settleRun as D}from"./cron/settle.js";import{applyOverlapPolicies as B,expireDueCrons as L}from"./cron/passes.js";import{dueClockCrons as U,acquireCronRunLease as y,attachCronRunPid as P,advanceCron as $,setCronState as N}from"../core/canvas/crons.js";import{emitEvent as Y}from"../core/events/emit.js";import{runAppCommand as q}from"../core/runtime/run-command.js";import{nextSlotAfter as F}from"../core/wake.js";import{CRON_OUTPUT_HEAD_BYTES as ie}from"./cron/capture.js";import{cronDaemonInstanceId as ue,markSelfCanceledCronRun as ce}from"./cron/live-runs.js";import{recoverStaleCronLeases as me}from"./cron/lease-recovery.js";async function J(e,t){const{runId:s,outOfBand:r,startedAtIso:n,finishedAtMs:o,code:u,timedOut:i,processError:l}=t,p=!r&&!i&&l==null&&u===k&&!t.wasReplaced&&!t.wasSelfCanceled;let c,m;return t.wasReplaced?(c={kind:"stated",delivered:"replaced (overlap=replace)"},m="release"):p?(c={kind:"stated",delivered:b},m=M(e,n,o)??"release"):(c={kind:"disposed",ctx:{runId:s,startedAtIso:n,exitCode:i?-1:u,timedOut:i,runTimeoutS:e.run_timeout_s,processErrorMessage:l!=null?l.message:null,stdoutHead:t.stdoutHead,stdoutSha256:t.stdoutSha256,stderrHead:t.stderrHead},selfCanceled:t.wasSelfCanceled},m=r?"release":{kind:"clear"}),D(e,{outOfBand:r,outcome:c,record:{runId:s,startedAtIso:n,finishedAtMs:o,durationMs:o-t.startedAtMs,exitCode:i?-1:u,stdoutHead:t.stdoutHead===""?null:t.stdoutHead,stderrHead:l!=null?`run process error: ${l.message}`.slice(0,h):t.stderrHead===""?null:t.stderrHead},lease:m})}f(J,"settleClosedRun");function I(e,t,s,r){const n=Date.now(),o=`${s}: ${r.message}`.slice(0,h);return D(e,{outOfBand:t.outOfBand,outcome:{kind:"disposed",ctx:{runId:t.runId,startedAtIso:t.startedAtIso,exitCode:null,timedOut:!1,runTimeoutS:e.run_timeout_s,processErrorMessage:r.message,stdoutHead:"",stdoutSha256:T,stderrHead:o}},record:{runId:t.runId,startedAtIso:t.startedAtIso,finishedAtMs:n,durationMs:n-t.startedAtMs,exitCode:null,stdoutHead:null,stderrHead:o},lease:"release"})}f(I,"settleUnspawnedRun");function V(e,t){let s;try{s=F(e.recur,new Date(t))}catch(r){return Y({level:"error",event:"cron.recur.unparseable",error:r,fields:{cron_id:e.cron_id,name:e.name,recur:e.recur}}),N(e.cron_id,"paused"),new Error(`unparseable recurrence ${JSON.stringify(e.recur)}: ${r.message} \u2014 this cron cannot be rescheduled until its recurrence is fixed (\`crtr cron cancel\` and re-arm it), so it has been paused.`)}return $(e.cron_id,s),null}f(V,"advanceRecurrence");function X(e,t){const{outOfBand:s}=t;return new Promise((r,n)=>{const o=R(),u=Date.now(),i=new Date(u).toISOString(),l={runId:o,outOfBand:s,startedAtIso:i,startedAtMs:u};if(!y(e.cron_id,E,i,s)){r(null);return}let p;try{if({env:p}=v(e,o),!s&&e.recur!=null){const d=V(e,u);if(d!==null)throw d}}catch(d){I(e,l,"run could not be armed",d).then(r,n);return}let c=null,m=!1;const C={runId:o,replaced:!1,selfCanceled:!1,kill:f(()=>{c!==null?c():m=!0},"kill")};g(e.cron_id,C),q({command:e.command,cwd:e.cwd,env:p,app:e.grantee,isolated:e.isolated,...e.isolated?{nodeId:e.created_by}:e.anchor_node===null?{}:{nodeId:e.anchor_node},timeoutMs:e.run_timeout_s*1e3,headBytes:h}).then(d=>{if(d.pid===null){_(e.cron_id,o),d.completion.then(a=>{I(e,l,"run failed to spawn",a.processError??new Error("bash did not provide a process id")).then(r,n)},n);return}let S=!1;const w=f(()=>{d.completion.then(a=>{const O=C.replaced,x=C.selfCanceled;if(_(e.cron_id,o),S){r(null);return}J(e,{runId:o,outOfBand:s,startedAtIso:i,startedAtMs:u,finishedAtMs:Date.now(),code:a.exitCode,timedOut:a.timedOut,processError:a.processError,stdoutHead:H(a.stdout,a.stdoutTruncated),stderrHead:H(a.stderr,a.stderrTruncated),stdoutSha256:a.stdoutSha256,wasReplaced:O,wasSelfCanceled:x}).then(r,n)},n)},"settleCommand");if(!P(e.cron_id,E,i,d.pid)&&!C.selfCanceled){S=!0,d.terminate(),w();return}c=d.terminate,m&&d.terminate(),w()},d=>{_(e.cron_id,o),I(e,l,"run failed to spawn",d).then(r,n)})})}f(X,"executeCron");function se(e,t={}){const s=new Date(e).toISOString();L(s),B(e,s);const r=[];for(const n of U(s)){const o=X(n,{outOfBand:!1}).then(()=>{});r.push(o),t.register?.(o)}for(const n of r)n.catch(()=>{});return r}f(se,"runDueCrons");export{ie as CRON_OUTPUT_HEAD_BYTES,ue as cronDaemonInstanceId,X as executeCron,ce as markSelfCanceledCronRun,me as recoverStaleCronLeases,se as runDueCrons};

package/dist/daemon/crtrd-cli.d.ts

@@ -0,0 +1 @@
+import '../suppress-experimental-warnings.js';

package/dist/daemon/crtrd-cli.js

@@ -0,0 +1 @@
+var i=Object.defineProperty;var n=(r,e)=>i(r,"name",{value:e,configurable:!0});import"../suppress-experimental-warnings.js";import{runDaemon as c}from"./crtrd.js";import{configureDaemonHttpDispatcher as o}from"./http-dispatcher.js";function a(r){for(let e=0;e<r.length;e++){const t=r[e];if(t==="--tcp")return r[e+1];if(t!==void 0&&t.startsWith("--tcp="))return t.slice(6)}}n(a,"parseTcpArg");function s(r){return r.includes("--prepare")}n(s,"parsePrepareArg"),o();const p=process.argv.slice(2);await c({tcp:a(p),prepare:s(p)});

package/dist/daemon/crtrd.d.ts

@@ -0,0 +1,28 @@
+import { type DetachedWorkLifecycle } from './reconcilers/broker-supervision.js';
+import { DaemonFleet } from './fleet.js';
+export declare function brokerCommandDeclaresCanvasHome(command: string, home: string): boolean;
+/** The `--epoch <id>` tag host.ts stamps into every broker's argv, or null
+ *  for a legacy/untagged broker (which the census treats as prior-epoch). */
+export declare function brokerCommandEpoch(command: string): string | null;
+export declare function teardownFleet(fleet: DaemonFleet): Promise<void>;
+interface DaemonTickLifecycle extends DetachedWorkLifecycle {
+}
+/** Supervision tick over the daemon's current live set. */
+export declare function superviseTick(now?: number, lifecycle?: DaemonTickLifecycle): Promise<void>;
+export interface DaemonOpts {
+    /** Milliseconds between supervision polls. Default 2000. */
+    intervalMs?: number;
+    /** Opt-in TCP listener for the API server as `host:port` (§4.1). Falls back
+     *  to `CRTRD_TCP` when unset. Absent → unix socket only. */
+    tcp?: string;
+    /** Hold after storage preparation until `POST /v1/daemon/admit`. */
+    prepare?: boolean;
+}
+/** Start the supervisor loop after winning the authoritative canvas claim.
+ *
+ *  A losing claimant stays unbound and returns an inert async teardown so its
+ *  process exits cleanly. A winner returns the one serialized teardown that
+ *  quiesces admitted work, removes its readiness mirror, and releases its exact
+ *  claim. */
+export declare function runDaemon(opts?: DaemonOpts): Promise<() => Promise<void>>;
+export default runDaemon;

package/dist/daemon/crtrd.js

@@ -0,0 +1,12 @@
+var Se=Object.defineProperty;var s=(t,o)=>Se(t,"name",{value:o,configurable:!0});import{writeFileSync as _e,readFileSync as ke,rmSync as be,mkdirSync as Y,existsSync as k,chmodSync as Ee}from"node:fs";import{createServer as X}from"node:http";import{dirname as Re}from"node:path";import{envCrtrdTcp as Ie}from"../shared/env.js";import{serveCanvasConversationStore as Pe}from"../core/canvas/sessions.js";import{pollRunObservers as xe}from"./runs/observer.js";import{randomBytes as De}from"node:crypto";import{apiSocketPath as Te,crtrHome as Ce}from"../core/canvas/paths.js";import{activeAppUsers as Le}from"../core/spaces/users.js";import{ensureAppSpace as Ae,ensureUserFiles as Ne}from"../core/spaces/space.js";import{LAUNCHER_SOCKET as R}from"../launcher/spec.js";import{launcherRequest as x}from"../launcher/client.js";import{installLauncherEventSink as $e}from"./launcher-events.js";import{initializeEmptyLayout as Me,layoutNeedsMigration as Ge,socketDir as Z}from"../core/layout.js";import{migrateLooseKeys as Oe}from"../core/layout-migrate/loose-keys.js";import{getNode as Fe,listNodesForSupervision as He,setFrozen as Be}from"../core/canvas/index.js";import{createApiServer as je}from"./api/server.js";import{createAppListener as qe}from"./api/app-listener.js";import{installLocalTerminalGrant as ze}from"../core/grants/local.js";import{onRunEventAppended as We}from"../core/runs/events.js";import{runNotices as Ue}from"./run-notices.js";import{createGrantSync as Ke,GRANT_SYNC_INTERVAL_S as Je}from"../core/grants/sync.js";import{runRemovalCascades as Ve}from"../core/grants/remove.js";import{sweepSandboxes as Qe}from"../core/grants/on-sync.js";import{hasSyncedGrants as Ye}from"../core/grants/mirror.js";import{readConfig as Xe}from"../core/config.js";import{reconcileUndeliveredTickets as Ze}from"./human/sweep.js";import{resetHandedOffDeliveries as er}from"../core/canvas/deliveries.js";import{resetHandedOffDaemonActions as rr}from"../core/canvas/daemon-actions.js";import{sweepReviews as tr}from"./review/sweep.js";import{pidfilePath as G}from"./pidfile.js";import{rendererWarning as or}from"../core/runtime/package-health.js";import{DEFAULT_INTERVAL_MS as nr}from"./supervise-cadence.js";import{createResumeDetector as ir}from"./resume-detector.js";import{BrokerSupervisionReconciler as sr}from"./reconcilers/broker-supervision.js";import{ControllerDeathReconciler as ar}from"./reconcilers/controller-death.js";import{NodeLifecycleReconciler as cr}from"./reconcilers/node-lifecycle/tick.js";import{NodeDeadlineReconciler as lr}from"./reconcilers/node-deadline.js";import{CronLaneReconciler as dr}from"./reconcilers/cron-lane.js";import{DeliveryLaneReconciler as pr}from"./reconcilers/delivery-lane.js";import{ActionLaneReconciler as mr}from"./reconcilers/action-lane.js";import{endLiveExecution as fr,migrateLegacyExecutionIdentities as ur}from"../core/canvas/executions.js";import{revokePriorEpochNodeTokens as hr}from"../core/canvas/node-tokens.js";import{PendingReviewSubmitReconciler as vr}from"./reconcilers/pending-review-submit.js";import{StorageMaintenanceReconciler as wr}from"./reconcilers/storage-maintenance.js";import{StorageDueWorkReconciler as gr}from"./reconcilers/storage-due-work.js";import{BashDeadlineReconciler as yr}from"./reconcilers/bash-deadline.js";import{FaultRetryBackstopReconciler as Sr}from"./reconcilers/fault-retry-backstop.js";import{StructuredRequestReconciler as _r}from"./reconcilers/structured-request-lane.js";import{reconcileStructuredRequestSidecars as kr}from"./structured-requests/boot.js";import{captureLivenessSnapshot as ee,capturePidCommand as br,captureTeardownSnapshot as re,isPidAlive as Er,isAnyPidAlive as te,killProcessTreePids as oe}from"../core/canvas/pid.js";import{bindFleet as Rr,boundFleet as Ir}from"../core/runtime/fleet.js";import{bindDaemonControl as Pr,clearDaemonControl as xr}from"./control.js";import{execDaemon as Dr,spawnDaemon as Tr}from"./manage.js";import{reconcileAndMigrateBoot as Cr}from"../core/canvas/boot.js";import{resolveInstallId as Lr}from"../core/canvas/install-id.js";import{setInstallId as Ar}from"../core/runtime/nodes.js";import{claimDaemonOwnership as Nr,releaseDaemonOwnership as ne}from"../core/canvas/daemon-owner.js";import{migrate as $r,openDb as ie,withCanvasWrite as Mr,bindDaemonCanvasOpenHook as Gr,clearDaemonCanvasOpenHook as se}from"../core/canvas/db.js";import{brokerSignalBus as O}from"./broker-signals/bus.js";import{brokerSignalStreams as Or}from"./api/handlers/broker-signals.js";import{reconcilePackageDocuments as Fr}from"../core/graph/package-docs.js";import{startRepoSync as Hr}from"../core/graph/repo-sync/index.js";import{prewarmRecentRecipes as Br,reapStaleSpares as jr}from"../core/runtime/warm-pool.js";import{DaemonFleet as qr}from"./fleet.js";import{BOOT_MIGRATIONS as zr}from"./boot-migrations.js";import{applyJoinedOwner as Wr}from"./joined-owner.js";import{emitEvent as u}from"../core/events/emit.js";import{operationIdContext as _}from"../core/events/operation-id.js";import{bindDaemonEventSource as Ur}from"../core/events/source.js";import{activateCanvasImport as Kr,MigrationBlockedError as Jr,runForcedCanvasImport as Vr}from"../migrations/activation.js";import{convertLegacyProviderStore as Qr,convertLegacyScopedStore as Yr}from"../core/scoped-state/migrate.js";import{userScopeRoot as Xr}from"../core/scope.js";import{secretsDir as Zr}from"../core/layout.js";function F(t,o){return t.includes(` --canvas-home ${o} `)}s(F,"brokerCommandDeclaresCanvasHome");function H(t){return/ --epoch (\S+) /.exec(t)?.[1]??null}s(H,"brokerCommandEpoch");const et=5e3,ae=150;async function rt(t){const o=ee();if(o===null)throw u({level:"error",event:"daemon.census.snapshot_failed",fields:{invariant:"prior-epoch brokers are reaped before readiness"}}),new Error("prior-epoch broker census could not capture the process table");const a=Ce(),m=[];for(const[i,p]of o.processes){const g=p.command;if(p.zombie||!g.includes("broker-cli.js")||!F(g,a)||H(g)===t)continue;const S=g.trim().split(/\s+/).at(-1)??"";S===""||S.endsWith("broker-cli.js")||m.push({pid:i,nodeId:S})}let f=0;const n=[];for(const i of m){const p=br(i.pid);if(p===null||!p.includes("broker-cli.js")||!F(p,a)||H(p)===t||p.trim().split(/\s+/).at(-1)!==i.nodeId)continue;const g=re(i.pid,null);if(!g.reused){try{process.platform==="linux"&&k(R)?await x({operation:"stop",pid:i.pid}):process.kill(i.pid,"SIGTERM")}catch{continue}f++,n.push({pid:i.pid,snap:g})}}const w=Date.now()+et;for(;Date.now()<w&&n.some(i=>te(i.snap.tree.length>0?i.snap.tree:[i.pid]));)await new Promise(i=>setTimeout(i,ae));let v=0;for(const i of n){const p=i.snap.tree.length>0?i.snap.tree:[i.pid];te(p)&&(process.platform==="linux"&&k(R)?await x({operation:"stop",pid:i.pid}):oe(p,"SIGKILL",i.snap.identities),v++)}v>0&&await new Promise(i=>setTimeout(i,ae));const l=ee();if(l===null)throw u({level:"error",event:"daemon.census.snapshot_failed",fields:{invariant:"prior-epoch brokers are reaped before readiness",stage:"final"}}),new Error("prior-epoch broker census could not capture the final process table");const d=[];for(const[i,p]of l.processes){const g=p.command;p.zombie||!g.includes("broker-cli.js")||F(g,a)&&H(g)!==t&&d.push(i)}if(d.length>0)throw new Error(`prior-epoch broker census could not prove termination of pid(s): ${d.join(", ")}`);u({level:"info",event:"daemon.census.completed",fields:{prior_epoch_brokers:m.length,sigtermed:f,sigkilled:v}})}s(rt,"reapPriorEpochBrokers");const tt=5e3;async function ot(t){const o=Array.from(t.entries());if(o.length===0)return;for(const[n]of o){const w=Fe(n)?.status;(w==="active"||w==="idle")&&Be(n,new Date().toISOString())}const a=o.map(([,n])=>({pid:n.pid,snap:re(n.pid,null),exited:n.handle.exited}));for(const n of a)if(!n.snap.reused)try{process.platform==="linux"&&k(R)?await x({operation:"stop",pid:n.pid}):process.kill(n.pid,"SIGTERM")}catch{}const m=new Promise(n=>{setTimeout(n,tt).unref()});await Promise.allSettled(a.map(n=>Promise.race([n.exited.then(()=>{}),m])));const f=[];for(const n of a)Er(n.pid)&&(process.platform==="linux"&&k(R)?await x({operation:"stop",pid:n.pid}):oe(n.snap.tree.length>0?n.snap.tree:[n.pid],"SIGKILL",n.snap.identities),f.push(n));await Promise.all(f.map(n=>n.exited));for(const[n]of o)fr(n,{reason:"daemon-teardown"});u({level:"info",event:"daemon.fleet_teardown.completed",fields:{brokers:a.length,sigkilled:f.length}})}s(ot,"teardownFleet");function ce(){Y(Re(G()),{recursive:!0}),_e(G(),String(process.pid),"utf8")}s(ce,"writePidfile");function le(t){return typeof t=="object"&&t!==null&&t.code==="ENOENT"}s(le,"isMissingPathError");function de(t){const o=G();let a;try{a=ke(o,"utf8")}catch(m){if(le(m))return;throw m}if(a.trim()!==String(t))throw new Error(`daemon readiness mirror does not name this invocation (expected pid ${t})`);try{be(o)}catch(m){if(le(m))return;throw m}}s(de,"removeOwnedPidfileMirror");const nt={acceptsDetachedWork:s(()=>!0,"acceptsDetachedWork"),registerDetached:s(t=>{t.catch(()=>{})},"registerDetached")},B=new sr,it=new ar,st=new cr,at=new lr,ct=new dr,lt=new pr,dt=new mr,pt=new vr,mt=new wr,ft=new gr,ut=new yr,ht=new Sr,vt=new _r;async function wt(t=Date.now(),o=nt){const a=Ir(),m=await B.runFleetPreamble(a);let f,n;try{const v=He();f=v.filter(l=>l.status==="active"||l.status==="idle"),n=v.filter(l=>l.status==="done"||l.status==="canceled"||l.status==="dead")}catch(v){u({level:"error",event:"canvas.node_list.failed",error:v});return}await B.run(t,{rows:f,fleet:a,lifecycle:o}),it.run(t,{rows:f});const w=await st.run(t,{rows:[...f,...n],fleet:a});at.run(t),vt.run(t),ct.run(t,{lifecycle:o}),lt.run(t,{lifecycle:o}),dt.run(t,{lifecycle:o}),pt.run(t,{lifecycle:o}),mt.run(t,{lifecycle:o,fleet:a}),ft.run(t,{lifecycle:o}),xe(),ht.run(t,{fleet:a,lifecycle:o}),await ut.run(t,{rows:f}),B.warnIfSaturated({fleet:a,lifecycle:o,thresholds:m,frozen:w})}s(wt,"superviseTick");async function gt(t){Y(Z(),{recursive:!0,mode:493}),process.platform==="linux"&&Ee(Z(),493);const o=Te();if(k(o))throw new Error(`layout refusal cannot bind occupied socket: ${o}`);const a=X((l,d)=>{if(l.method==="GET"&&l.url==="/healthz"){d.writeHead(200,{"content-type":"application/json; charset=utf-8"}),d.end(JSON.stringify({ok:!1,daemon_up:!0,store_accessible:!1,brokers_reconciled:!1,startup_phase:"blocked",startup_blocked:"layout_migration_required"}));return}d.writeHead(503,{"content-type":"application/json; charset=utf-8"}),d.end(JSON.stringify({error:{code:"layout_migration_required",message:"run crtr sys migrate while the runtime is offline",type:"server_error",origin:"runtime",retryable:!1}}))});await new Promise((l,d)=>{a.once("error",d),a.listen(o,()=>{a.off("error",d),l()})});let m;const f=t.tcp??Ie();if(f){const l=/^(.*):(\d+)$/.exec(f);if(!l||Number(l[2])>65535)throw new Error(`invalid refusal TCP address: ${f}`);const d=X(a.listeners("request")[0]);await new Promise((i,p)=>{d.once("error",p),d.listen(Number(l[2]),l[1],()=>{d.off("error",p),i()})}),m=d}ce();let n;const w=s(()=>(n??=(async()=>{a.closeAllConnections(),m?.closeAllConnections(),await Promise.all([a,m].filter(l=>l!==void 0).map(l=>new Promise((d,i)=>l.close(p=>p?i(p):d())))),de(process.pid),process.off("SIGINT",v),process.off("SIGTERM",v)})(),n),"cleanup"),v=s(()=>{w().then(()=>process.exit(0),l=>{process.stderr.write(`[crtrd] layout refusal cleanup failed: ${String(l)}
+`),process.exit(1)})},"onSignal");return process.on("SIGINT",v),process.on("SIGTERM",v),w}s(gt,"serveLayoutRefusal");async function yt(t={}){if(Ge())return gt(t);Me();const o=Nr(De(16).toString("hex"));if(!o.claimed){if(o.reason==="incumbent_alive")process.stderr.write(`[crtrd] already running (pid ${o.incumbentPid??"?"})
+`);else{const r=[o.incumbentPid!==void 0?`pid ${o.incumbentPid}`:void 0,o.verdict!==void 0?`verdict ${o.verdict}`:void 0].filter(c=>c!==void 0),e=r.length>0?` (${r.join(", ")})`:"";process.stderr.write(`[crtrd] claim lost: ${o.reason}${e}
+`),o.reason==="own_identity_indeterminate"&&process.stderr.write("[crtrd] cannot read its own process identity. crouter needs /proc on Linux, or the `ps` command elsewhere (Debian/Ubuntu: apt-get install procps).\n"),(o.reason==="own_identity_indeterminate"||o.reason==="incumbent_malformed")&&(process.exitCode=1)}return async()=>{}}const a=o.claim;let m=null;try{if(await rt(a.token),Yr({kind:"user",root:Xr()}),process.platform==="darwin"){const{readConfig:e,updateConfig:c}=await import("../core/config.js");if(e("user").paths?.user_files===void 0){const{homedir:y}=await import("node:os");c("user",Q=>{Q.paths??={},Q.paths.user_files??=y()})}}await Qr(Zr());for(const e of Oe())process.stderr.write(`[crtrd] ${e}
+`);$r(ie()),Gr(e=>O.install(e));const r=Mr(e=>Fr(e));for(const e of r.conflicts)process.stderr.write(`[crtrd] plugin documents not reconciled: ${e.message}
+`);for(const e of r.invalid)process.stderr.write(`[crtrd] package file is not a document: ${e.path}: ${e.error}
+`);m=Wr(),process.platform==="linux"&&k(R)&&($e(),await x({operation:"users.sync",users:Le()})),hr(a.token)}catch(r){se(),O.close();try{const{released:e}=ne(a);if(!e)throw new Error("daemon ownership claim was not released")}catch(e){throw new AggregateError([r,e],"daemon startup failed and cleanup also failed")}throw r}let f=!0,n,w=Promise.resolve(),v=!1,l,d;const i=new Set;let p=!1,g=!1,S,L,j=!1,A,D,T;const pe=ir();let I,h={phase:"initializing",message:"daemon startup is running the canvas import and normal services are unavailable",blockerPaths:[]},P="initial startup activation",me=null;function fe(){return h.phase==="ready"?null:{phase:h.phase,message:h.message,blockerPaths:h.blockerPaths}}s(fe,"startupBlock");function b(r){i.add(r),r.finally(()=>{i.delete(r)}).catch(()=>{})}s(b,"registerDetached");const q={acceptsDetachedWork:s(()=>f,"acceptsDetachedWork"),registerDetached:b};Hr(q,ie);async function ue(){try{f=!1,Or.close(),se(),O.close(),l!==void 0&&(clearInterval(l),l=void 0),T!==void 0&&(clearInterval(T),T=void 0);let r;do r=w,await r;while(r!==w);for(;i.size>0;)await Promise.allSettled([...i]);if(d!==void 0&&(await ot(d),d.dispose()),L!==void 0&&!j&&(j=!0,await L.close()),D!==void 0){const e=D;D=void 0,await e.close()}if(A!==void 0){const e=A;A=void 0,await e.close()}if(p||(de(process.pid),p=!0),p&&!g){const{released:e}=ne(a);if(!e)throw new Error("daemon ownership claim was not released");g=!0}}finally{xr(),process.off("SIGINT",U),process.off("SIGTERM",K),process.off("exit",J)}}s(ue,"cleanupAttempt");const N=1e3;let z=!1;function he(){return z?{graceMs:N}:(z=!0,_.fresh(()=>{u({level:"info",event:"daemon.handover.armed",fields:{pid:process.pid,grace_ms:N}})}),setTimeout(()=>{ve()},N),{graceMs:N})}s(he,"requestHandover");async function ve(){try{await E()}catch(r){const e=r instanceof Error?r.stack??r.message:String(r);process.stderr.write(`[crtrd] handover cleanup failed:
+${e}
+`),process.exit(1)}try{process.platform==="linux"&&k(R)&&(await x({operation:"daemon.handover"}),process.exit(0)),process.pid===1&&await Dr();const r=await Tr();_.fresh(()=>{u({level:"info",event:"daemon.handover.completed",fields:{predecessor_pid:process.pid,successor_pid:r.pid??r.existing_pid??null,spawned:r.started}})})}catch(r){_.fresh(()=>{u({level:"error",event:"daemon.handover.successor_failed",error:r})});const e=r instanceof Error?r.message:String(r);process.stderr.write(`[crtrd] handover successor failed to start: ${e}
+`),process.exit(1)}process.exit(0)}s(ve,"performHandover");function E(){if(S!==void 0)return S;const r=ue();return S=r,r.then(()=>{S===r&&(S=void 0)},()=>{S===r&&(S=void 0)}),r}s(E,"requestCleanup");async function W(r){try{await E(),process.exit(0)}catch(e){process.exitCode=1;const c=e instanceof Error?e.stack??`${e.name}: ${e.message}`:String(e);process.stderr.write(`[crtrd] ${r} cleanup failed:
+${c}
+`),process.exit(1)}}s(W,"handleSignal");function U(){W("SIGINT")}s(U,"onSigint");function K(){W("SIGTERM")}s(K,"onSigterm");function J(){E().catch(()=>{})}s(J,"onExit");function $(r){f&&(w=w.then(r).then(()=>{},e=>{_.fresh(()=>{u({level:"error",event:"daemon.lane_job.failed",error:e})})}))}s($,"enqueue");function V(){!f||v||(pe.check()&&I&&(u({level:"info",event:"daemon.resume.detected"}),b(I().catch(()=>{}))),v=!0,$(async()=>{if(v=!1,!!f)try{await wt(Date.now(),q)}catch(r){_.fresh(()=>{u({level:"error",event:"daemon.tick.failed",error:r})})}}))}s(V,"enqueueTick");let C=null;async function we(){if(C!==null)throw{status:500,code:"admission_failed",message:`daemon admission previously failed: ${C instanceof Error?C.message:String(C)}`};if(h.phase==="ready")return{admitted:!1,already_admitted:!0,startup_phase:"ready"};if(h.phase!=="prepared"&&h.phase!=="recovering")throw{status:409,code:"not_prepared",message:h.message};const r=h.phase==="prepared";try{return await M(),h={phase:"ready",message:"",blockerPaths:[]},r?{admitted:!0,already_admitted:!1,startup_phase:"ready"}:{admitted:!1,already_admitted:!0,startup_phase:"ready"}}catch(e){throw C=e,{status:500,code:"admission_failed",message:`daemon admission failed: ${e instanceof Error?e.message:String(e)}`}}}s(we,"admitStartup");async function ge(r){if(P!==null)throw{status:409,code:"migration_in_progress",message:`the canvas import is already running (${P})`};P="repair";try{const e=await Vr({dryRun:r.dryRun});if(r.dryRun||e.pending||h.phase!=="blocked")return{result:e,resumed:!1};if(t.prepare)return h={phase:"prepared",message:"daemon storage is prepared and normal services are unavailable until admission",blockerPaths:[]},{result:e,resumed:!1};try{return await M(),h={phase:"ready",message:"",blockerPaths:[]},{result:e,resumed:!0}}catch(c){const y=c instanceof Error?c.message:String(c);return setTimeout(()=>{E().catch(()=>{})},1e3),{result:e,resumed:!1,resumeError:y}}}finally{P=null}}s(ge,"repairMigrations");async function ye(){n=t.intervalMs??nr;const r=a.token;d=new qr({epoch:r,enqueue:$}),Rr(d),h={phase:"recovering",message:"daemon startup recovery is running and normal services are unavailable",blockerPaths:[]},_.fresh(()=>{u({level:"info",event:"daemon.started",fields:{pid:process.pid,interval_ms:n}})});const e=Lr();if(Ar(e),_.fresh(()=>{u({level:"info",event:"daemon.install_id.resolved",fields:{install_id:e}})}),_.fresh(()=>{let c;try{c=or()}catch{return}c!==null&&u({level:"warn",event:"daemon.startup.warning",fields:{stage:"termrender",warning:c.slice(0,2048)}})}),await _.fresh(async()=>{await tr(),await Ze(),er(Date.now()),rr(Date.now())}),_.fresh(()=>{const{reconcile:c,migrated:y}=Cr(ur);c.changed&&u({level:"info",event:"daemon.boot_change.reconciled",fields:{cleared_count:c.cleared.length,same_boot_proven:c.sameBootProven}}),y.length>0&&u({level:"info",event:"daemon.pid_identity.migrated",fields:{migrated_count:y.length}})}),_.fresh(()=>{kr();for(const c of zr){const y=c.apply();y.changed&&u({level:"info",event:"daemon.boot_migration.applied",fields:{migration:c.id,...y.summary}})}}),I){const c=s(()=>{b(I().catch(()=>{}))},"refresh");b(Ve().catch(()=>{})),b(Qe().then(({completion:y})=>y).catch(y=>{u({level:"error",event:"daemon.grants.sweep_failed",error:y})})),c(),T=setInterval(c,Je*1e3),T.unref()}$(()=>{jr(),Br()}),l=setInterval(V,n),V()}s(ye,"completeStartup");function M(){return me??=ye().catch(r=>{throw h={phase:"initializing",message:"daemon startup recovery failed and normal services are unavailable",blockerPaths:[]},r})}s(M,"resumeStartup");try{process.on("SIGINT",U),process.on("SIGTERM",K),process.on("exit",J),Ur(),m!==null&&u({level:"info",event:"daemon.joined_owner.applied",fields:{owner:m.owner,rows:m.rows}}),A=await Pe();const r=a.token;Pr({epoch:r,requestHandover:he,registerDetached:b,startupBlock:fe,admitStartup:we,repairMigrations:ge}),ce(),L=je({tcp:t.tcp}),await L.ready;const e=Xe("user").runtime;e?.issuer?(I=Ke(e.issuer,b),We(c=>Ue().appended(c))):ze(),e!==void 0&&(D=qe(e,()=>Ye(e.issuer.replace(/\/$/,"")),I),await D.ready);try{await Kr()}catch(c){if(P=null,c instanceof Jr)return h={phase:"blocked",message:c.message,blockerPaths:c.blockerPaths},E;throw c}process.platform==="linux"&&k(R)&&(Ne(),await Ae("app:terminal"));try{t.prepare?h={phase:"prepared",message:"daemon storage is prepared and normal services are unavailable until admission",blockerPaths:[]}:(await M(),h={phase:"ready",message:"",blockerPaths:[]})}finally{P=null}return E}catch(r){try{await E()}catch(e){throw new AggregateError([r,e],"daemon startup failed and cleanup also failed")}throw r}}s(yt,"runDaemon");var jo=yt;export{F as brokerCommandDeclaresCanvasHome,H as brokerCommandEpoch,jo as default,yt as runDaemon,wt as superviseTick,ot as teardownFleet};

package/dist/daemon/delivery/run-delivery.d.ts

@@ -0,0 +1,34 @@
+import { type DeliverySettlement } from '../../core/canvas/delivery-contract.js';
+export declare const DELIVERY_TIMEOUT_MS = 120000;
+export declare const DELIVERY_STDERR_TAIL_BYTES: number;
+export interface DeliveryProcessOutcome {
+    exitCode: number | null;
+    signal: string | null;
+    timedOut: boolean;
+    spawnError?: Error;
+    stderr: string;
+}
+/** Process contract mapping. stdout deliberately does not participate. */
+export declare function deliverySettlementForOutcome(outcome: DeliveryProcessOutcome, attempt: number, now: number): DeliverySettlement;
+/** One already-claimed attempt: where to deliver, what to deliver, and which
+ *  attempt this is. The caller resolved argv and cwd when the target was
+ *  registered, so a later config edit cannot redirect this delivery. */
+export interface DeliveryJob {
+    argv: string[];
+    cwd: string;
+    /** The stored document; its `delivery.attempt` is stamped per attempt. */
+    document: unknown;
+    attempt: number;
+    /** Originating node, or null for a request made outside a node. */
+    nodeId?: string | null;
+    /** Frozen originating app, used with its current grant after node deletion. */
+    app?: string;
+    /** Custom argv deliveries carry the queue document unchanged. */
+    custom?: {
+        deliveryId: string;
+        messageId: string;
+    };
+}
+/** Spawn and settle one already-claimed delivery. `settle` writes the outcome
+ *  to whichever durable row owns this attempt. */
+export declare function runDelivery(job: DeliveryJob, settle: (settlement: DeliverySettlement) => void): Promise<void>;

package/dist/daemon/delivery/run-delivery.js

@@ -0,0 +1 @@
+var C=Object.defineProperty;var l=(e,t)=>C(e,"name",{value:t,configurable:!0});import{spawn as T}from"node:child_process";import{envHomeOverride as _}from"../../shared/env.js";import{deliveryBackoffMs as g}from"../../core/canvas/delivery-contract.js";import{killProcessGroup as x}from"../../core/canvas/pid.js";import{buildOperationalEnvBase as y}from"../../core/runtime/spawn-env.js";import{getNode as R}from"../../core/canvas/canvas.js";import{appProcessSandboxed as A,launchAppProcess as O}from"../../core/spaces/process.js";const I=12e4,h=2e3,E=4*1024;function w(e,t,r){return e.spawnError!==void 0?{state:"pending",nextAttemptAt:r+g(t),failure:m("spawn_error",{message:e.spawnError.message,stderr:e.stderr})}:e.timedOut?{state:"pending",nextAttemptAt:r+g(t),failure:m("timeout",{...e.signal===null?{}:{signal:e.signal},stderr:e.stderr})}:e.signal!==null?{state:"pending",nextAttemptAt:r+g(t),failure:m("signal",{signal:e.signal,stderr:e.stderr})}:e.exitCode===0?{state:"accepted"}:e.exitCode===78?{state:"permanent_failed",failure:m("exit",{exitCode:78,stderr:e.stderr})}:{state:"pending",nextAttemptAt:r+g(t),failure:m("exit",{exitCode:e.exitCode??void 0,stderr:e.stderr})}}l(w,"deliverySettlementForOutcome");function m(e,t){return{kind:e,...t}}l(m,"failure");function D(){let e=Buffer.alloc(0);return{take(t){e=t.length>=E?t.subarray(t.length-E):Buffer.concat([e,t]).subarray(Math.max(0,e.length+t.length-E))},decode(){return e.toString("utf8")}}}l(D,"stderrTailCapture");function S(e,t,r){if(r)return JSON.stringify(e);const d=e,n=d.delivery;return JSON.stringify({...d,delivery:{...n,attempt:t}})}l(S,"documentForAttempt");function L(e,t){const r=y({targetCwd:e,targetProfileId:null}),d=_();return d!==void 0&&d!==""&&(r.CRTR_HOME=d),{...r,...t}}l(L,"deliveryEnv");async function H(e,t){const r=D();let d;try{d=S(e.document,e.attempt,e.custom!==void 0)}catch(s){t(w({exitCode:null,signal:null,timedOut:!1,spawnError:s,stderr:r.decode()},e.attempt,Date.now()));return}if(process.platform==="linux"){let s;try{if(!A())throw new Error("root launcher is required for delivery");const u=e.nodeId===null||e.nodeId===void 0?null:R(e.nodeId),f=e.app??u?.grantee??(e.nodeId==null?"app:terminal":void 0);if(!f)throw new Error(`delivery origin ${e.nodeId} was deleted without a stored app`);const o=await O({...u?{nodeId:e.nodeId}:{},app:f,command:e.argv,cwd:e.cwd,env:{...y({targetCwd:e.cwd,targetProfileId:null,skipSpawnAllow:!0}),...e.custom?{CRTR_DELIVERY_ID:e.custom.deliveryId,CRTR_CAUSE_EVENT:e.custom.messageId}:{}},stdin:d,stdoutBytes:0,stderrBytes:E,stderrTail:!0});let a,p=!1;try{a=setTimeout(()=>{p=!0,o.stop().catch(i=>{console.error(`delivery process ${o.pid} could not be stopped:`,i)})},I),a.unref?.();const c=await o.completion;s={exitCode:c.exitCode,signal:c.signal,timedOut:p,stderr:c.stderr}}finally{a!==void 0&&clearTimeout(a)}}catch(u){s={exitCode:null,signal:null,timedOut:!1,spawnError:u,stderr:""}}t(w(s,e.attempt,Date.now()));return}let n;try{n=T(e.argv[0],e.argv.slice(1),{cwd:e.cwd,env:L(e.cwd,e.custom?{CRTR_DELIVERY_ID:e.custom.deliveryId,CRTR_CAUSE_EVENT:e.custom.messageId}:void 0),detached:!0,stdio:["pipe","pipe","pipe"]})}catch(s){t(w({exitCode:null,signal:null,timedOut:!1,spawnError:s,stderr:r.decode()},e.attempt,Date.now()));return}await new Promise(s=>{let u=!1,f=!1,o,a;const p=l(i=>{u||(u=!0,a!==void 0&&clearTimeout(a),!i.timedOut&&o!==void 0&&clearTimeout(o),n.stdin?.destroy(),n.stdout?.destroy(),n.stderr?.destroy(),t(w(i,e.attempt,Date.now())),s())},"finish");n.stdout?.on("data",()=>{}),n.stderr?.on("data",i=>r.take(i)),n.stdin?.on("error",()=>{}),n.on("error",i=>{p({exitCode:null,signal:null,timedOut:!1,spawnError:i,stderr:r.decode()})}),n.on("exit",(i,v)=>{p({exitCode:i,signal:v,timedOut:f,stderr:r.decode()})});const c=l(()=>{n.pid!==void 0&&(x(n.pid),o=setTimeout(()=>x(n.pid,"SIGKILL"),h),o.unref?.())},"killWithEscalation");a=setTimeout(()=>{f=!0,c()},I),a.unref?.(),n.stdin?.end(d,"utf8")})}l(H,"runDelivery");export{E as DELIVERY_STDERR_TAIL_BYTES,I as DELIVERY_TIMEOUT_MS,w as deliverySettlementForOutcome,H as runDelivery};

package/dist/daemon/due-sources.d.ts

@@ -0,0 +1,15 @@
+/** Every lane `superviseTick` runs, named as in crtrd.ts. Keep in tick order. */
+export declare const TICK_LANES: readonly ["brokerSupervision", "controllerDeath", "nodeLifecycle", "nodeDeadline", "structuredRequests", "cronLane", "deliveryLane", "actionLane", "pendingReviewSubmit", "storageMaintenance", "storageDueWork", "pollRunObservers", "faultRetryBackstop", "bashDeadline"];
+export interface DueSource {
+    /** Epoch ms of the earliest timed work this lane owes; `now` when work is due already; null when none. */
+    nextDue(now: number): number | null;
+}
+export declare function registerDueSource(lane: string, source: DueSource): void;
+export declare function declareBusyOnly(lane: string, reason: string): void;
+export declare function dueSourceLanes(): string[];
+export declare function busyOnlyLanes(): string[];
+/** The earliest due time over every source, and whether any source is due at `now`. A source that throws counts as due now: a lane that cannot answer must keep the sandbox awake, never let it sleep past work. */
+export declare function collectDue(now: number, onError?: (lane: string, error: unknown) => void): {
+    dueNow: boolean;
+    nextDueMs: number | null;
+};

package/dist/daemon/due-sources.js

@@ -0,0 +1 @@
+var f=Object.defineProperty;var r=(e,n)=>f(e,"name",{value:n,configurable:!0});const p=["brokerSupervision","controllerDeath","nodeLifecycle","nodeDeadline","structuredRequests","cronLane","deliveryLane","actionLane","pendingReviewSubmit","storageMaintenance","storageDueWork","pollRunObservers","faultRetryBackstop","bashDeadline"],u=new Map,c=new Map;function y(e,n){u.set(e,n)}r(y,"registerDueSource");function x(e,n){c.set(e,n)}r(x,"declareBusyOnly");function D(){return[...u.keys()]}r(D,"dueSourceLanes");function b(){return[...c.keys()]}r(b,"busyOnlyLanes");function L(e,n=()=>{}){let o=null,s=!1;for(const[l,i]of u){let t;try{t=i.nextDue(e)}catch(a){n(l,a),t=e}t===null||!Number.isFinite(t)||(t<=e&&(s=!0),(o===null||t<o)&&(o=t))}return{dueNow:s,nextDueMs:o}}r(L,"collectDue");export{p as TICK_LANES,b as busyOnlyLanes,L as collectDue,x as declareBusyOnly,D as dueSourceLanes,y as registerDueSource};

package/dist/daemon/due.d.ts

@@ -0,0 +1,14 @@
+/** Register every due source and busy-only declaration. Idempotent. */
+export declare function installDueSources(): void;
+/** How long a node with no engine yet, or an engine that has not opened its first
+ *  turn, counts as work the daemon is about to do. Past it the node is idle or
+ *  stranded, not starting: a resident revived with no prompt sits at an idle
+ *  prompt forever and must not hold the sandbox awake. */
+export declare const START_GRACE_MS = 120000;
+export interface DueReport {
+    busy: boolean;
+    next_due_at: string | null;
+}
+export declare function dueReport(now?: number): DueReport;
+/** For tests and diagnostics: the lanes covered. */
+export declare function coveredLanes(): string[];

package/dist/daemon/due.js

@@ -0,0 +1,11 @@
+var T=Object.defineProperty;var r=(n,e)=>T(n,"name",{value:e,configurable:!0});import{prepared as f}from"../core/sqlite-statements.js";import{openDb as E}from"../core/canvas/db.js";import{isPidPresent as x}from"../core/canvas/pid.js";import{isProfilePaused as p}from"../core/profiles/manifest.js";import{hasUnseenWakeMail as L}from"../core/canvas/deliveries.js";import{listPendingProviderRetries as I}from"../core/canvas/recovery.js";import{listSubmitRequestedRequests as O}from"../core/human/requests.js";import{storageConfig as A}from"../core/storage/client.js";import{emitEvent as M}from"../core/events/emit.js";import{wantsExecution as N}from"./reconcilers/node-lifecycle/wants-execution.js";import{dueAtMs as b}from"./reconcilers/fault-retry-backstop.js";import{UNUSED_UPLOAD_TTL_MS as h}from"./reconcilers/storage-due-work.js";import{busyOnlyLanes as g,collectDue as w,declareBusyOnly as l,dueSourceLanes as U,registerDueSource as o}from"./due-sources.js";const _=r((n,...e)=>f(E(),n).all(...e),"rows"),a=r(n=>f(E(),n).get(),"first"),s=r(n=>{if(n==null)return null;const e=Date.parse(n);return Number.isFinite(e)?e:null},"iso"),c=r(n=>{let e=null;for(const t of n)t!==null&&(e===null||t<e)&&(e=t);return e},"earliest"),m="node_id NOT IN (SELECT node_id FROM warm_pool)";let S=!1;function D(){if(S)return;S=!0,l("brokerSupervision","acts only on live broker processes, which already make busy true"),l("controllerDeath","acts only on live controller processes"),l("pollRunObservers","follows live pids only"),l("bashDeadline","acts only on running bash jobs, which already make busy true"),l("storageMaintenance","retention and placement housekeeping: never time-critical, and it must not wake or hold a sleeping runtime"),o("nodeLifecycle",{nextDue:r(()=>c(_(`SELECT node_id, status, intent, profile_id, respawn_not_before FROM node_rows
+        WHERE status IN ('active', 'idle') AND kind != 'human' AND ${m}
+          AND pi_pid IS NULL AND respawn_not_before IS NOT NULL`).filter(e=>!p(e.profile_id)&&N({node_id:e.node_id,status:e.status,intent:e.intent})).map(e=>s(e.respawn_not_before))),"nextDue")}),o("nodeDeadline",{nextDue:r(()=>c(_(`SELECT deadline_at, profile_id FROM node_rows
+        WHERE deadline_at IS NOT NULL AND outcome_at IS NULL AND status IN ('active', 'idle') AND kind != 'human'`).filter(e=>!p(e.profile_id)).map(e=>s(e.deadline_at))),"nextDue")}),o("structuredRequests",{nextDue:r(e=>a("SELECT 1 FROM structured_requests WHERE state != 'pending' AND effects_done_at IS NULL LIMIT 1")!==void 0?e:a("SELECT MIN(deadline_at) AS at FROM structured_requests WHERE state = 'pending' AND deadline_at IS NOT NULL")?.at??null,"nextDue")}),o("cronLane",{nextDue:r(()=>{const e=_(`SELECT fire_at, profile FROM crons
+          WHERE state = 'active' AND run_state = 'idle'
+            AND NOT (held = 1 AND recur IS NULL AND expires_at IS NULL)`).filter(i=>!p(i.profile)).map(i=>s(i.fire_at)),t=_("SELECT expires_at FROM crons WHERE expires_at IS NOT NULL AND run_state = 'idle'").map(i=>s(i.expires_at));return c([...e,...t])},"nextDue")});const n=r(e=>()=>a(`SELECT MIN(next_attempt_at) AS at FROM ${e} WHERE state = 'pending' AND canceled_at IS NULL AND next_attempt_at IS NOT NULL`)?.at??null,"attempts");o("deliveryLane",{nextDue:n("deliveries")}),o("actionLane",{nextDue:n("daemon_actions")}),o("pendingReviewSubmit",{nextDue:r(e=>O().length>0?e:null,"nextDue")}),o("storageDueWork",{nextDue:r(e=>{if(A()===null)return null;if(a("SELECT 1 FROM uploads WHERE delete_pending_since IS NOT NULL LIMIT 1")!==void 0||a("SELECT 1 FROM shares WHERE status = 'off' AND object_deleted_at IS NULL LIMIT 1")!==void 0)return e;const t=a("SELECT MIN(expires_at) AS at FROM shares WHERE status = 'on' AND expires_at IS NOT NULL")?.at,i=a(`SELECT MIN(created_at) AS at FROM uploads u WHERE delete_pending_since IS NULL
+          AND NOT EXISTS (SELECT 1 FROM upload_uses x WHERE x.upload_id = u.upload_id)`)?.at,u=s(i);return c([s(t),u===null?null:u+h])},"nextDue")}),o("faultRetryBackstop",{nextDue:r(()=>c(I().map(e=>b(e))),"nextDue")})}r(D,"installDueSources");const R=12e4;function C(n){const e=_(`SELECT n.node_id, n.status, n.intent, n.profile_id, n.pi_pid, n.frozen_at, n.respawn_not_before, n.created, n.launched_at,
+            n.turn_open_at, n.turn_closed_at,
+            (SELECT x.started_at FROM executions x WHERE x.node_id = n.node_id AND x.state != 'exited') AS exec_started_at
+       FROM node_rows n
+      WHERE n.status IN ('active', 'idle') AND n.kind != 'human' AND n.${m}`);for(const t of e){if(p(t.profile_id)||!N({node_id:t.node_id,status:t.status,intent:t.intent}))continue;if(t.pi_pid!==null&&x(t.pi_pid)){if(t.turn_open_at!==null&&t.turn_closed_at===null)return!0;const d=s(t.exec_started_at);if(t.turn_open_at===null&&d!==null&&n-d<R||L(t.node_id))return!0;continue}if(t.respawn_not_before!==null)continue;if(t.pi_pid!==null||t.frozen_at!==null)return!0;const u=Math.max(...[t.created,t.launched_at,t.exec_started_at].map(d=>s(d)??0));if(u>0&&n-u<R||t.status==="idle"&&L(t.node_id))return!0}return!1}r(C,"nodesOweWork");function X(n=Date.now()){D();const{dueNow:e,nextDueMs:t}=w(n,(u,d)=>{M({level:"warn",event:"daemon.due.source_failed",error:d,fields:{lane:u}})});return{busy:e||C(n)||a("SELECT 1 FROM crons WHERE run_state = 'running' LIMIT 1")!==void 0||a("SELECT 1 FROM jobs j JOIN objects o ON o.rowid = j.object WHERE j.status = 'running' AND o.deleted_at IS NULL LIMIT 1")!==void 0,next_due_at:t===null?null:new Date(t).toISOString()}}r(X,"dueReport");function K(){return D(),[...U(),...g()]}r(K,"coveredLanes");export{R as START_GRACE_MS,K as coveredLanes,X as dueReport,D as installDueSources};

package/dist/daemon/fleet.d.ts

@@ -0,0 +1,79 @@
+import { type NodeMeta } from '../core/canvas/index.js';
+import { type FleetEntry, type FleetExitStatus, type FleetRegistry } from '../core/runtime/fleet.js';
+import type { NodeOutcomeDetailV1, TerminalReason } from '../core/canvas/types.js';
+import type { HostHandle } from '../core/runtime/host.js';
+export declare function surfaceBootFailure(meta: NodeMeta, exitStatus?: FleetExitStatus): Promise<void>;
+/** Whether a dead relaunch should resume the saved session strictly, or retry
+ *  as a fresh cycle instead. A cycling attempt (cycle_pending) that dies before
+ *  session_start must retry AS a cycle: the fresh branch it was opening is not
+ *  confirmed, so resuming would silently continue the old leaf the refresh was
+ *  meant to leave behind.
+ *
+ *  An interrupted turn is NOT a reason to cycle. A strict reopen does restore
+ *  the transcript at an idle prompt without restarting the dead turn — but the
+ *  fix for that is the continuation prompt recovery delivers (see `#respawn`),
+ *  not throwing the conversation away. */
+export declare function retryResumeMode(meta: Pick<NodeMeta, 'cycle_pending'> | null): boolean;
+export type DeadNodeAction = 'forget' | 'respawn-fresh' | 'dormant' | 'release-idle' | 'respawn-cycle' | 'respawn-resume' | 'boot-failure';
+/** The narrow durable state the policy table reads. Structural (a Pick, not
+ *  NodeMeta itself) so tests fabricate table rows directly. */
+export type DeadNodeRow = Pick<NodeMeta, 'status' | 'intent' | 'pi_session_id' | 'cycle_pending' | 'fork_from' | 'lifecycle'>;
+/** One pure function producing the action for a node known-dead. Used at
+ *  exactly two call sites — an exit-policy job and the node-lifecycle tick
+ *  (design D-12) — so exit recovery and tick recovery can never diverge.
+ *  Evaluated in table order; `busy` is the on-disk busy marker.
+ *
+ *  `busy` no longer selects the ACTION. Whether the engine died mid-turn or
+ *  parked at an idle prompt, the saved transcript is equally resumable — pi
+ *  persists whole entries (`appendFileSync` per line) so a killed generation
+ *  simply leaves the file ending at its last complete entry, and the loader
+ *  skips a malformed line rather than rejecting the session. A mid-turn death
+ *  needs the turn re-driven, which is a continuation prompt on top of the
+ *  resume (see `#respawn`), not a fresh branch. `busy` therefore survives here
+ *  only to route a node that died before session_start ever recorded a session
+ *  to a fresh relaunch instead of terminalizing it as a boot failure.
+ *
+ *  `pendingWake` is the one non-row input (`hasPendingWake`): whether anything
+ *  would drive a turn if the engine came back. It selects row 4b and defaults
+ *  to `true`, so an uninformed caller keeps the conservative respawn. */
+export declare function classifyDeadNode(row: DeadNodeRow | null, busy: boolean, pendingWake?: boolean): DeadNodeAction;
+export interface DaemonFleetOpts {
+    /** This daemon's epoch id (randomBytes(8).toString('hex'), minted by
+     *  runDaemon after the ownership claim). */
+    epoch: string;
+    /** The serial work lane. Exit-policy jobs and backoff respawns run here,
+     *  strictly one at a time with ticks. */
+    enqueue: (job: () => void | Promise<void>) => void;
+    /** Injectable clock for tests. */
+    now?: () => number;
+    /** Injectable network-reachability probe. Every respawn decision consults it,
+     *  so tests drive the offline branch without touching the real network. */
+    probeOnline?: () => Promise<boolean>;
+}
+export declare class DaemonFleet implements FleetRegistry {
+    #private;
+    constructor(opts: DaemonFleetOpts);
+    epoch(): string;
+    register(nodeId: string, handle: HostHandle): void;
+    has(nodeId: string): boolean;
+    isClaimed(nodeId: string): boolean;
+    get(nodeId: string): FleetEntry | undefined;
+    size(): number;
+    occupancy(): number;
+    reserveSlot(nodeId: string): boolean;
+    releaseReservation(nodeId: string): void;
+    entries(): Iterable<[string, FleetEntry]>;
+    interruptForProfilePause(nodeId: string, pid?: number | undefined): void;
+    hasProfilePauseInterruption(nodeId: string): boolean;
+    forget(nodeId: string): void;
+    onChildExit(nodeId: string, status: FleetExitStatus, executionId?: string): void;
+    deliverExit(nodeId: string, status: FleetExitStatus): void;
+    /** The node-lifecycle tick's enactment entry. */
+    applyDeadRowPolicy(nodeId: string): Promise<void>;
+    /** A revive refusal before its launch try/catch leaves the row active but
+     *  with no fleet entry. Convert that otherwise-silent strand into the same
+     *  terminal outcome as a boot failure. The fresh read avoids duplicating
+     *  reviveNode's launch-failure crash path. */
+    terminalizeIfStillNonTerminal(nodeId: string, event: string, error: unknown, reason: TerminalReason, detail: NodeOutcomeDetailV1): Promise<boolean>;
+    dispose(): void;
+}

package/dist/daemon/fleet.js

@@ -0,0 +1,19 @@
+var g=Object.defineProperty;var l=(s,e)=>g(s,"name",{value:e,configurable:!0});import{getNode as v,getRow as k}from"../core/canvas/index.js";import{revokeExitedNodeToken as $}from"../core/canvas/node-tokens.js";import{isProfilePaused as T}from"../core/profiles/manifest.js";import{fullName as p}from"../core/canvas/labels.js";import{isSafeNodeId as o}from"../core/canvas/paths.js";import{hasIdleReleaseIntent as R,transition as _}from"../core/runtime/lifecycle.js";import{publishNotice as E}from"../core/runtime/close.js";import{readInterruptedTurn as P,readTransportPoisonVerdict as N}from"../core/canvas/recovery.js";import{hasPendingWake as x}from"./reconcilers/live-obligation.js";import{clearRespawnPolicy as h,deferRespawnWhileOffline as C,MAX_RESPAWN_ATTEMPTS as F,OFFLINE_RESPAWN_RETRY_MS as M,recordRespawnPolicy as S,respawnBackoffMs as O}from"./reconcilers/node-lifecycle/respawn-policy.js";import{probeOnline as z}from"../core/runtime/connectivity.js";import{reviveNode as A}from"../core/runtime/revive.js";import{pushUrgent as m}from"../core/feed/feed.js";import{emitEvent as c}from"../core/events/emit.js";import{brokerThresholdsForDaemon as B}from"../core/runtime/fleet.js";import{isRecoveryHeld as D}from"../core/runtime/recovery-hold.js";function w(s,e){const r=e===void 0?"The daemon did not observe an exit status.":`The observed exit status was code ${e.code??"null"}, signal ${e.signal??"null"}.`;return`\u26A0 Spawn failed \u2014 \`${s.name}\` (${s.kind}) never started.
+
+Its pi vehicle exited before the session came up (no pi_session_id was ever recorded), so the node produced no output. ${r}
+
+Inspect canonical event diagnostics with \`crtr sys logs --node ${s.node_id}\`.
+
+If the work still needs doing, re-spawn it.`}l(w,"bootFailureBody");async function y(s,e){await m(s.node_id,w(s,e),{from:s.node_id})}l(y,"surfaceBootFailure");function b(s){return`\u26A0 Out of memory \u2014 \`${s.name}\` (${s.kind}) was killed because its app's processes together passed the app's memory limit.
+
+Every process of the run was stopped. The daemon does not restart it, because it would reach the same limit. Reduce what the run holds in memory, or ask the person to raise the app's limit (\`crtr sys limits set --app ${s.grantee??"app:terminal"} --memory <size>\`), then revive the node.`}l(b,"outOfMemoryBody");async function L(s){const e=N(s.node_id),r=e===null?"":`
+
+Provider rotation observed ${e.consecutivePasses} consecutive route-queue passes with no HTTP response (tried ${e.routes.join(", ")}). Check network and provider transport before reviving.`,t=`\u26A0 Crash loop \u2014 \`${s.name}\` (${s.kind}) kept dying without settling a turn.
+
+Its session started successfully, but six consecutive relaunches made no progress, so the daemon stopped retrying.`+r+`
+
+Fix the crash cause, then revive the node if the work still needs doing.`;await m(s.node_id,t,{from:s.node_id})}l(L,"surfaceCrashLoop");async function W(s,e){const r=e instanceof Error?e.message:String(e),t=`\u26A0 Recovery failed \u2014 \`${s.name}\` (${s.kind}) could not be relaunched.
+
+The daemon refused this recovery before starting a broker: ${r}
+
+The node is now dead. Fix the recorded launch configuration, then revive it if the work still needs doing.`;await m(s.node_id,t,{from:s.node_id})}l(W,"surfaceRecoveryFailure");function q(s){return s?.cycle_pending!==!0}l(q,"retryResumeMode");function G(s,e,r=!0){return s===null||s.status==="done"||s.status==="canceled"||s.status==="dead"?"forget":s.intent==="refresh"?"respawn-fresh":R(s)?"dormant":s.lifecycle==="resident"&&!e&&!r&&s.pi_session_id!=null?"release-idle":s.pi_session_id!=null?q(s)?"respawn-resume":"respawn-cycle":e||s.fork_from!=null?"respawn-fresh":"boot-failure"}l(G,"classifyDeadNode");const H=3e4;class oe{static{l(this,"DaemonFleet")}#n;#o;#s;#l;#e=new Map;#r=new Set;#a=new Set;#t=new Map;#c=Number.NEGATIVE_INFINITY;constructor(e){this.#n=e.epoch,this.#o=e.enqueue,this.#s=e.now??Date.now,this.#l=e.probeOnline??(()=>z())}epoch(){return this.#n}register(e,r){if(this.#e.has(e))throw new Error(`fleet: ${e} already has a live broker entry \u2014 refusing a second launch (programming error)`);if(r.pid===null)throw new Error(`fleet: refusing to register ${e} with no pid`);this.#r.delete(e),this.#t.delete(e),this.#e.set(e,{pid:r.pid,handle:r})}has(e){return this.#e.has(e)}isClaimed(e){return this.#e.has(e)||this.#r.has(e)}get(e){return this.#e.get(e)}size(){return this.#e.size}occupancy(){return this.#e.size+this.#r.size}reserveSlot(e){if(this.#r.has(e)||this.#e.has(e))return!0;const{automaticReviveCap:r}=B();if(this.occupancy()<r)return this.#r.add(e),!0;const t=this.#s();return t-this.#c>=H&&(this.#c=t,c({level:"warn",event:"broker.capacity.revive_deferred",fields:{live_count:this.occupancy(),hard_cap:r}})),!1}releaseReservation(e){this.#r.delete(e)}entries(){return this.#e.entries()}interruptForProfilePause(e,r=this.#e.get(e)?.pid){if(r!==void 0){this.#a.add(e);try{process.kill(r,"SIGTERM")}catch{}}}hasProfilePauseInterruption(e){return this.#a.has(e)}forget(e){this.#e.delete(e),this.#r.delete(e),this.#t.delete(e)}onChildExit(e,r,t){t&&$(t),this.#e.delete(e),this.#o(()=>{const i=v(e),a=i?.launched_at==null?Number.NaN:Date.parse(i.launched_at),n=Number.isFinite(a)?Math.max(0,this.#s()-a):null,d=i?.respawn_failures??0;i?.status==="done"||i?.status==="canceled"||i?.status==="dead"?this.#t.delete(e):this.#t.set(e,r),this.#u(e,r,n,d)})}deliverExit(e,r){this.onChildExit(e,r)}async applyDeadRowPolicy(e){const r=this.#t.get(e);try{await this.#f(e,r)}finally{this.#t.get(e)===r&&this.#t.delete(e)}}async terminalizeIfStillNonTerminal(e,r,t,i,a){const n=v(e);return n===null||n.status==="done"||n.status==="canceled"||n.status==="dead"?!1:(await this.#i(e,n,{event:r,reason:i,detail:a,wake:`Child crashed \u2014 ${p(n)} (${e}) could not be relaunched and is now dead. It stays dead until you revive it \u2014 \`crtr node lifecycle revive ${e}\`.`,surface:l(()=>W(n,t),"surface")}),!0)}dispose(){}#u(e,r,t,i){c({level:"info",event:"broker.exit.observed",...o(e)?{node_id:e}:{},fields:{...o(e)?{}:{affected_node_id:e},code:r.code,signal:r.signal,uptime_ms:t,consecutive_failures:i}})}async#f(e,r){return this.#h(e,r)}async#h(e,r){const t=v(e);if(t!==null&&T(t.profile_id))return h(e),"forget";if(this.#a.delete(e))return h(e),"forget";if(D(e))return"dormant";const i=P(e)?.interrupted===!0;if(r?.oomKilled===!0&&t!==null&&t.status!=="done"&&t.status!=="canceled"&&t.status!=="dead")return h(e),await this.#i(e,t,{event:"broker.out_of_memory",reason:"out_of_memory",detail:{schema:"crtr.node-outcome-detail/v1",message:b(t)},wake:`Child out of memory \u2014 ${p(t)} (${e}) used more memory than its app is allowed and is now dead. It is not restarted automatically. Revive it with \`crtr node lifecycle revive ${e}\` once the work needs less memory or the cap is raised (\`crtr sys limits set\`).`,surface:l(async()=>{await m(e,b(t),{from:e})},"surface")}),"forget";const a=G(t,i,x(e));switch(a){case"forget":h(e);break;case"dormant":h(e);break;case"release-idle":h(e),_(e,"release"),c({level:"info",event:"broker.recovery.released",...o(e)?{node_id:e}:{},fields:{...o(e)?{}:{affected_node_id:e}}});break;case"boot-failure":await this.#i(e,t,{event:"broker.boot.failed",reason:"boot_failed",detail:{schema:"crtr.node-outcome-detail/v1",message:w(t,r)},wake:`Child crashed \u2014 ${p(t)} (${e}) exited before its session ever came up and is now dead. It stays dead until you revive it \u2014 \`crtr node lifecycle revive ${e}\`.`,surface:l(()=>y(t,r),"surface")});break;case"respawn-fresh":case"respawn-cycle":case"respawn-resume":await this.#d(e,t,a,i);break}return a}async#d(e,r,t,i){const a=k(e);if(a===null)return;const n=a.respawn_failures??0;if(!await this.#l()){C(e,n,this.#s()),c({level:"info",event:"broker.respawn.offline_deferred",...o(e)?{node_id:e}:{},fields:{...o(e)?{}:{affected_node_id:e},action:t,retry_in_ms:M,consecutive_failures:n}});return}const d=a.respawn_not_before==null,f=d?S(a,this.#s()):{failures:n,notBefore:a.respawn_not_before,exhausted:n>=F};if(f.exhausted){const u=`Child crashed \u2014 ${p(r)} (${e}) kept dying without settling a turn (${f.failures} consecutive launches) and is now dead. It stays dead until you revive it \u2014 \`crtr node lifecycle revive ${e}\`.`;await this.#i(e,r,{event:"broker.respawn.exhausted",reason:"crash_looped",detail:{schema:"crtr.node-outcome-detail/v1",message:u,respawn_failures:f.failures},wake:u,...r.pi_session_id!=null?{surface:l(()=>L(r),"surface")}:{}});return}if(d&&f.notBefore!==null){c({level:"info",event:"broker.respawn.deferred",...o(e)?{node_id:e}:{},fields:{...o(e)?{}:{affected_node_id:e},action:t,backoff_ms:O(f.failures),consecutive_failures:f.failures}});return}c({level:"info",event:"broker.respawn.started",...o(e)?{node_id:e}:{},fields:{...o(e)?{}:{affected_node_id:e},action:t,consecutive_failures:f.failures}});try{await A(e,{capacity:"freeze",resume:t==="respawn-resume",wakeReason:t==="respawn-resume"&&i?"runtime-restart-abort":void 0,recovery:!0})}catch(u){c({level:"error",event:"broker.respawn.failed",...o(e)?{node_id:e}:{},error:u,fields:{...o(e)?{}:{affected_node_id:e},action:t}}),await this.terminalizeIfStillNonTerminal(e,"broker.respawn.refused",u,"launch_failed",{schema:"crtr.node-outcome-detail/v1",message:u instanceof Error?u.message:String(u)})}}async#i(e,r,t){c({level:"error",event:t.event,...o(e)?{node_id:e}:{fields:{affected_node_id:e}}}),_(e,"crash",{reason:t.reason,outcome:{detail:t.detail}});try{await(t.surface??(()=>y(r)))()}catch(i){c({level:"error",event:"broker.boot_failure_surface.failed",...o(e)?{node_id:e}:{fields:{affected_node_id:e}},error:i})}E(e,"notice.crash",t.wake,{reason:"child-crashed",child:e})}}export{oe as DaemonFleet,G as classifyDeadNode,q as retryResumeMode,y as surfaceBootFailure};

package/dist/daemon/http-dispatcher.d.ts

@@ -0,0 +1 @@
+export declare function configureDaemonHttpDispatcher(): void;

package/dist/daemon/http-dispatcher.js

@@ -0,0 +1 @@
+var i=Object.defineProperty;var n=(t,e)=>i(t,"name",{value:e,configurable:!0});import{EventEmitter as r}from"node:events";import{Agent as l,Client as a,Pool as f,setGlobalDispatcher as m}from"undici";const u=2e3;function o(t){return t instanceof r&&r.prototype.on.call(t,"error",()=>{}),t}n(o,"withErrorListener");function c(t,e){return o(new a(t,e))}n(c,"createClient");function p(){m(o(new l({allowH2:!1,connect:{autoSelectFamilyAttemptTimeout:u},factory:n((t,e)=>e.connections===1?c(t,e):o(new f(t,{...e,factory:c})),"factory")})))}n(p,"configureDaemonHttpDispatcher");export{p as configureDaemonHttpDispatcher};

package/dist/daemon/human/finish.d.ts

@@ -0,0 +1,24 @@
+import type { TicketResult } from '../../core/human/types.js';
+export interface CompletePageOptions {
+    completedAt?: string;
+    actor?: string;
+}
+export interface CancelTicketOptions {
+    reason?: string;
+    actor?: string;
+    disposition?: 'canceled' | 'dismissed';
+}
+/** Settle a page request directly in human_requests; result files and bridge nodes are not part of this path. */
+export declare function resolvePageTicket(ticketId: string, responses: unknown, opts?: CompletePageOptions): Promise<TicketResult>;
+/** {@link resolvePageTicket}, also saying whether this answer won (`settled`) or the request was already settled. */
+export declare function answerPageTicket(ticketId: string, responses: unknown, opts?: CompletePageOptions): Promise<{
+    outcome: 'settled' | 'already_settled';
+    result: TicketResult;
+}>;
+export declare function cancelHumanTicket(ticketId: string, opts: CancelTicketOptions): Promise<{
+    outcome: 'settled' | 'already_settled';
+    result: TicketResult;
+}>;
+/** Legacy callers use this as a replay hook. Settlement effects are repaired by sweepHumanRequests. */
+export declare function deliverTerminalResult(ticketId: string): Promise<boolean>;
+export declare function settleFeedbackCompanion(ticketId: string, outcome: 'approved' | 'canceled'): Promise<void>;

package/dist/daemon/human/finish.js

@@ -0,0 +1,10 @@
+var _=Object.defineProperty;var r=(t,e)=>_(t,"name",{value:e,configurable:!0});import{getRequest as y,getRequestByInboxTicket as b,presentationDir as q}from"../../core/human/requests.js";import{buildPageSummary as v}from"../../core/human/summary.js";import{validateFinalPageResponses as $}from"../../core/human/tickets.js";import{composeHumanCompletion as j}from"../../core/human/completion.js";import{describePageAnswer as k}from"../../core/human/answer.js";import{renderAnswerText as S}from"../../core/human/answer-text.js";import{readPageFeedback as T}from"../../core/human/feedback.js";import{pageDocumentSha256 as A}from"../../core/human/feedback-companion.js";import{pagePath as N}from"../../core/human/convention.js";import{retireCompanion as f}from"../companion-retire.js";import{settleHumanRequest as h}from"./settle.js";function d(t){const e=y(t)??b(t);if(e===null||e.kind!=="page")throw new Error(`unknown page request: ${t}`);return e}r(d,"requestForTicket");function c(t){try{const e=JSON.parse(t.specification_json);if(typeof e!="object"||e===null)throw new Error("not an object");return e}catch(e){throw new Error(`corrupt page specification: ${t.request_id}`,{cause:e})}}r(c,"manifest");function u(t,e){if(t.action_json!==null)try{const n=JSON.parse(t.action_json);if(n.schema!=="crtr.human-action-binding/v1"||!Array.isArray(n.argv)||typeof n.cwd!="string")throw new Error("invalid binding");return{adapter:{adapter:"subprocess",argv:n.argv,cwd:n.cwd,node_id:t.requester_node_id,...n.app?{app:n.app}:{}},bodyJson:j({requestId:t.request_id,result:e,binding:n,source:c(t).source??{}})}}catch(n){throw new Error(`corrupt frozen completion action: ${t.request_id}`,{cause:n})}}r(u,"completionAction");function O(t,e=80){const n=t.split(`
+`)[0]??"";return n.length>e?`${n.slice(0,e-1)}\u2026`:n}r(O,"firstLine");function x(t){try{return c(t).title}catch{return}}r(x,"pageTitle");function w(t){let e;try{const n=T(t.request_dir);if(n.companionNodeId===void 0)return"";e=[],n.firstCommentedSha256!==void 0&&A(t.request_dir)!==n.firstCommentedSha256&&e.push(`The page changed during feedback: the person commented on it and its companion conversation (node ${n.companionNodeId}) revised it in place. Reread the final page at ${N(q(t),c(t).dialect)} before interpreting this outcome.`);const o=n.comments.filter(i=>i.status==="open");if(o.length>0){const i=o.map(s=>[...s.quote.split(`
+`).map(a=>`> ${a}`),s.note].join(`
+`));e.push([`Feedback left unresolved at settlement \u2014 the companion conversation (node ${n.companionNodeId}) had not dealt with these items:`,...i].join(`
+
+`))}}catch{return""}return e.length===0?"":`
+
+${e.join(`
+
+`)}`}r(w,"feedbackAddendum");function E(t,e){const n=k(c(t),e.responses,{completedAt:e.completedAt});return S(n)+w(t)}r(E,"answerBody");function J(t,e,n){const o=x(t),i=o===void 0?`the human interaction ${t.request_id}`:`\u201C${o}\u201D`,s=n!==void 0&&n!==""?n:"no reason was given";return(e?`The user dismissed ${i} without answering \u2014 a deliberate \u201Cno, I'm not answering this.\u201D Treat it as a rejection: no response will arrive, no partial answer exists, and the same ask must not be raised again.`:`${o===void 0?`The human interaction ${t.request_id}`:`The page \u201C${o}\u201D`} was canceled \u2014 ${s}. No response will arrive, and any partial answers the user had entered were discarded unsent.`)+w(t)}r(J,"cancelBody");function g(t,e,n,o){if(t.requester_node_id!==null)return{label:O(n),disposition:e,body_json:{body:n,result:o}}}r(g,"notification");function l(t){return t.companion_node_id===null?void 0:{retire:r(async(e,n)=>{await f(e,n)},"retire")}}r(l,"retire");async function Q(t,e,n={}){return(await P(t,e,n)).result}r(Q,"resolvePageTicket");async function P(t,e,n={}){const o=d(t),i=c(o),s=$(i,e),a={schema:"crtr.page-response/v1",kind:"page",responses:s,summary:v(i,s),completedAt:n.completedAt??new Date().toISOString(),...n.actor===void 0?{}:{actor:n.actor}},m=await h({request_id:o.request_id,outcome:"answered",result_json:JSON.stringify(a),notification:r(p=>g(p,"human-answer",E(p,a),a),"notification"),...u(o,a)===void 0?{}:{completion_action:u(o,a)},...l(o)===void 0?{}:{post_commit:l(o)}});if(m.outcome==="already_settled"){if(m.request.result_json===null)throw new Error(`settled page request lacks a result: ${o.request_id}`);return{outcome:"already_settled",result:JSON.parse(m.request.result_json)}}return{outcome:"settled",result:a}}r(P,"answerPageTicket");async function U(t,e){const n=d(t),i={schema:"humanloop.cancel/v1",kind:"canceled",canceledAt:new Date().toISOString(),...e.reason===void 0?{}:{reason:e.reason},...e.actor===void 0?{}:{actor:e.actor},...e.disposition===void 0?{}:{disposition:e.disposition}},s=await h({request_id:n.request_id,outcome:e.disposition==="dismissed"?"dismissed":"canceled",result_json:JSON.stringify(i),notification:r(a=>g(a,"human-canceled",J(a,e.disposition==="dismissed",e.reason),i),"notification"),...u(n,i)===void 0?{}:{completion_action:u(n,i)},...l(n)===void 0?{}:{post_commit:l(n)}});if(s.outcome==="already_settled"){if(s.request.result_json===null)throw new Error(`settled page request lacks a result: ${n.request_id}`);return{outcome:"already_settled",result:JSON.parse(s.request.result_json)}}return{outcome:"settled",result:i}}r(U,"cancelHumanTicket");async function V(t){return d(t).state==="settled"}r(V,"deliverTerminalResult");async function W(t,e){const n=d(t);n.companion_node_id!==null&&await f(n.companion_node_id,e)}r(W,"settleFeedbackCompanion");export{P as answerPageTicket,U as cancelHumanTicket,V as deliverTerminalResult,Q as resolvePageTicket,W as settleFeedbackCompanion};

package/dist/daemon/human/settle.d.ts

@@ -0,0 +1,44 @@
+import { type DaemonActionAdapter } from '../../core/canvas/daemon-actions.js';
+import { type InboxDisposition } from '../../core/feed/messages.js';
+import { type HumanRequestOutcome, type HumanRequestRecord } from '../../core/human/requests.js';
+interface SettlementNotification {
+    label: string;
+    /** `human-answer` marks the body as the person's own words (attached views
+     *  render it as their message); null is a runtime notice about the request. */
+    disposition: InboxDisposition | null;
+    body_ref?: string;
+    body_json?: unknown;
+}
+export interface SettleHumanRequestInput {
+    request_id: string;
+    outcome: HumanRequestOutcome;
+    result_json: string;
+    settled_at?: string;
+    notification?: SettlementNotification | ((request: HumanRequestRecord) => SettlementNotification | undefined);
+    completion_action?: {
+        adapter: DaemonActionAdapter;
+        bodyJson: unknown;
+    };
+    post_commit?: {
+        project?: (request: HumanRequestRecord) => Promise<void> | void;
+        retire?: (companionNodeId: string, outcome: 'approved' | 'canceled') => Promise<void>;
+    };
+}
+export type SettleHumanRequestOutcome = {
+    outcome: 'settled';
+    request: HumanRequestRecord;
+} | {
+    outcome: 'already_settled';
+    request: HumanRequestRecord;
+};
+/**
+ * The only terminal transition. The conditional update is first-writer-wins;
+ * the winner's result and every obligation are committed in the same canvas write.
+ */
+export declare function settleHumanRequest(input: SettleHumanRequestInput): Promise<SettleHumanRequestOutcome>;
+/** Projection and companion retirement happen after settlement because filesystem and node lifecycle cannot join SQLite. */
+export declare function projectAndRetire(request: HumanRequestRecord, effects: {
+    project?: (request: HumanRequestRecord) => Promise<void> | void;
+    retire?: (companionNodeId: string, outcome: 'approved' | 'canceled') => Promise<void>;
+}): Promise<void>;
+export {};

package/dist/daemon/human/settle.js

@@ -0,0 +1 @@
+var u=Object.defineProperty;var d=(e,o)=>u(e,"name",{value:o,configurable:!0});import{withCanvasWrite as m}from"../../core/canvas/db.js";import{enqueueDaemonAction as f}from"../../core/canvas/daemon-actions.js";import{cancelDelivery as p,enqueueNodeMail as w}from"../../core/feed/messages.js";import{getRequest as l,markCompanionRetired as y,markProjected as q,markProjectionError as v,setSettlementDeliveryMarksLocked as j,settleRequestLocked as h}from"../../core/human/requests.js";import{appendQuestionAnswered as k}from"../../core/runs/questions.js";import{notifyProviderApproval as b}from"../../core/providers/approval.js";async function x(e){const o=m(i=>{const _=e.settled_at??new Date().toISOString(),t=h(i,{request_id:e.request_id,outcome:e.outcome,result_json:e.result_json,settled_at:_});if(t===null){const c=l(e.request_id);if(c===null)throw new Error(`human request disappeared while settling: ${e.request_id}`);return{outcome:"already_settled",request:c}}const n=typeof e.notification=="function"?e.notification(t):e.notification;if(t.requester_node_id!==null&&n===void 0)throw new Error(`request ${t.request_id} needs a requester notification`);if(t.action_json!==null&&t.kind==="page"&&e.completion_action===void 0)throw new Error(`request ${t.request_id} needs its frozen completion action`);if(t.kind==="review"&&t.projected_at===null&&e.post_commit?.project===void 0)throw new Error(`review ${t.request_id} needs a projection effect`);if(t.companion_node_id!==null&&t.companion_retired_at===null&&e.post_commit?.retire===void 0)throw new Error(`request ${t.request_id} needs a companion retirement effect`);let a=null,s=null;if(t.requester_node_id!==null){if(n===void 0)throw new Error(`request ${t.request_id} needs a requester notification`);a=w(t.requester_node_id,{kind:"completed",label:n.label,senderName:"crtrd",...n.body_ref===void 0?{}:{bodyRef:n.body_ref},...n.body_json===void 0?{}:{bodyJson:n.body_json},disposition:n.disposition,urgency:"normal",wake:1}).deliveryId}t.action_json!==null&&e.completion_action!==void 0&&t.kind==="page"&&(s=f({adapter:e.completion_action.adapter,bodyJson:e.completion_action.bodyJson,idempotencyKey:`human-action:${t.inbox_ticket_id}`})),t.submit_note_delivery_id!==null&&p(t.submit_note_delivery_id),j(i,t.request_id,{settlement_delivery_id:a,action_delivery_id:s});const r=l(t.request_id);if(r===null)throw new Error(`settled human request disappeared: ${t.request_id}`);return k(i,r),{outcome:"settled",request:r}});return o.outcome==="settled"&&(b(o.request.request_id),e.post_commit!==void 0&&await g(o.request,e.post_commit)),o}d(x,"settleHumanRequest");async function g(e,o){if(e.kind==="review"&&e.projected_at===null&&o.project!==void 0)try{await o.project(e),q(e.request_id,new Date().toISOString())}catch(i){v(e.request_id,i instanceof Error?i.message:String(i))}if(e.companion_node_id!==null&&e.companion_retired_at===null&&o.retire!==void 0)try{await o.retire(e.companion_node_id,e.outcome==="canceled"||e.outcome==="dismissed"?"canceled":"approved"),y(e.request_id,new Date().toISOString())}catch{}}d(g,"projectAndRetire");export{g as projectAndRetire,x as settleHumanRequest};

package/dist/daemon/human/sweep.d.ts

@@ -0,0 +1,21 @@
+import { type HumanRequestRecord } from '../../core/human/requests.js';
+export interface HumanRequestSweepEffects {
+    realizeReview(requestId: string): Promise<HumanRequestRecord>;
+    projectReview(request: HumanRequestRecord): Promise<void> | void;
+    retireCompanion(nodeId: string, outcome: 'approved' | 'canceled'): Promise<void>;
+}
+export interface HumanRequestSweepResult {
+    realized: number;
+    collected: number;
+    reprojected: number;
+    retired: number;
+    failed: number;
+}
+/**
+ * The one startup repair pass for SQL-authoritative pages and reviews. It does
+ * not infer a missing notification or action delivery: settlement created both
+ * atomically. The two remaining filesystem effects retain their durable marks.
+ */
+/** Direct outbox rows are created in the settlement transaction; there is no separate ticket-delivery repair pass. */
+export declare function reconcileUndeliveredTickets(): Promise<void>;
+export declare function sweepHumanRequests(effects: HumanRequestSweepEffects): Promise<HumanRequestSweepResult>;

package/dist/daemon/human/sweep.js

@@ -0,0 +1 @@
+var m=Object.defineProperty;var n=(e,o)=>m(e,"name",{value:o,configurable:!0});import{existsSync as p,readdirSync as f,rmSync as y}from"node:fs";import{reviewsRoot as c}from"../../core/canvas/paths.js";import{listBindingRequests as w,listRequests as u,listUnprojectedReviews as q,markProjectionError as v}from"../../core/human/requests.js";import{projectAndRetire as d}from"./settle.js";function R(e){return e instanceof Error?e.message:String(e)}n(R,"errorText");async function g(){}n(g,"reconcileUndeliveredTickets");async function k(e){let o=0,s=0,a=0,l=0,i=0;for(const r of w())try{await e.realizeReview(r.request_id),o+=1}catch{i+=1}try{const r=new Set(u({kind:"review"}).map(t=>t.request_id));if(p(c()))for(const t of f(c(),{withFileTypes:!0}))t.isDirectory()&&!r.has(t.name)&&(y(`${c()}/${t.name}`,{recursive:!0,force:!0}),s+=1)}catch{i+=1}for(const r of q())try{await d(r,{project:e.projectReview,retire:e.retireCompanion}),a+=1}catch(t){v(r.request_id,R(t)),i+=1}for(const r of u({state:"settled"}))if(!(r.companion_node_id===null||r.companion_retired_at!==null))try{await d(r,{retire:e.retireCompanion}),l+=1}catch{i+=1}return{realized:o,collected:s,reprojected:a,retired:l,failed:i}}n(k,"sweepHumanRequests");export{g as reconcileUndeliveredTickets,k as sweepHumanRequests};

package/dist/daemon/joined-owner.d.ts

@@ -0,0 +1,5 @@
+/** Rows changed, or null when this runtime has not joined a directory. */
+export declare function applyJoinedOwner(): {
+    owner: string;
+    rows: number;
+} | null;

package/dist/daemon/joined-owner.js

@@ -0,0 +1 @@
+var i=Object.defineProperty;var t=(r,e)=>i(r,"name",{value:e,configurable:!0});import{withCanvasWrite as m}from"../core/canvas/db.js";import{rewriteLocalNodeIdentity as p}from"../core/canvas/canvas.js";import{rewriteLocalNodeTokenIdentity as a}from"../core/canvas/node-tokens.js";import{joinedOwner as f}from"../core/directory/join.js";import{LOCAL_TERMINAL_GRANT_ID as n}from"../core/grants/local.js";import{dropLocalGrantMirror as l}from"../core/grants/mirror.js";import{rewriteLocalRunEventGrantee as c}from"../core/runs/events.js";import{rewriteLocalIdempotencyGrantee as w}from"../core/runs/operations.js";function O(){const r=f();if(r===null)return null;const e=m(o=>p(o,r,n)+a(o,r,n)+l(o)+c(o)+w(o));return{owner:r,rows:e}}t(O,"applyJoinedOwner");export{O as applyJoinedOwner};

package/dist/daemon/launcher-events.d.ts

@@ -0,0 +1,2 @@
+/** Launcher diagnostics (limits applied or skipped, OOM kills, cache purges) arrive on its replies; the daemon turns each into a canonical event. */
+export declare function installLauncherEventSink(): void;

package/dist/daemon/launcher-events.js

@@ -0,0 +1 @@
+var o=Object.defineProperty;var d=(n,e)=>o(n,"name",{value:e,configurable:!0});import{emitEvent as i}from"../core/events/emit.js";import{isSafeNodeId as t}from"../core/canvas/paths.js";import{setLauncherEventSink as f}from"../launcher/client.js";function s(){f(n=>{for(const e of n)i({level:e.level,event:e.event,...e.nodeId!==void 0&&t(e.nodeId)?{node_id:e.nodeId}:{},...e.fields===void 0?{}:{fields:e.fields}})})}d(s,"installLauncherEventSink");export{s as installLauncherEventSink};