@north-light/cli 0.3.529 → 0.3.531

package/dist/commands/node/message.js

@@ -1 +1 @@
-var _=Object.defineProperty;var i=(e,n)=>_(e,"name",{value:n,configurable:!0});import{envNodeId as y}from"../../shared/env.js";import{defineBranch as C,defineLeaf as w}from"../../core/command.js";import{InputError as o}from"../../core/io.js";import{requireScope as N}from"../../core/errors.js";import{OUTPUT_SCHEMA_CONSTRAINTS as R,OUTPUT_SCHEMA_TRANSPORT as P,parseOutputSchemaValue as E}from"../../core/runtime/structured-output.js";import{cliClient as A,getNodeOrNull as O,rethrowAsCliError as $}from"../api-client.js";function D(e,n){const t=e[n];if(t!==void 0&&(typeof t!="string"||t.trim()==="")){const r=n.replace(/[A-Z]/g,a=>`-${a.toLowerCase()}`);throw new o({error:"empty_discriminant",message:`--${r} must contain non-whitespace text`,received:typeof t=="string"?t:String(t),field:r,next:`Pass a non-empty --${r} value, or omit the flag.`})}}i(D,"requireNonBlankDiscriminant");async function U(e,n){const t=e.to?.trim(),r=e.self===!0,a=t!==void 0&&t!=="";if(a===r)throw new o({error:"bad_target",message:a&&r?"--to and --self are mutually exclusive":n?"no target given \u2014 the message body is not a node id":"exactly one of --to or --self is required",field:a?void 0:"to",next:a?"Pass --to <node-id> or --self.":n?"Pass the node id with --to <node-id> and provide the message body as a positional argument or on stdin, or use --self.":"Pass --to <node-id> or --self."});if(r){const s=y();if(s===void 0||s==="")throw new o({error:"no_node",message:"no node to target with --self (CRTR_NODE_ID unset)",next:"Run from inside a node, or pass --to <node-id>."});return{targetId:s,isSelf:!0}}if(await O(t)===null)throw new o({error:"not_found",message:`no node: ${t}`,field:"to",next:"List nodes with `crtr node inspect list`."});return{targetId:t,isSelf:!1}}i(U,"resolveMsgTarget");function v(){return[{name:"revived",type:"boolean",required:!1,constraint:"True when this request synchronously revived the target; ordinary durable delivery to an active or idle dormant target queues lifecycle revival instead."},{name:"guidance",type:"string",required:!0,constraint:"Immediate action confirmation."}]}i(v,"messageOutput");function b(e){const n=e.to?.trim();if(!(n!==void 0&&n!==""||e.self===!0))return{message:"no target given \u2014 the positional argument is the message body, not a node id",field:"to",next:"Pass the node id with --to <node-id> and pipe the message body on stdin, or use --self."}}i(b,"missingMessageTargetForBody");function I(){return[{kind:"stdin",name:"body",required:!1,constraint:"Visible message body. Required unless --situational-context is supplied.",positionalStdinConflict:b},{kind:"flag",name:"to",type:"string",required:!1,constraint:"Target an existing node by id. Exactly one of --to or --self is required."},{kind:"flag",name:"self",type:"bool",required:!1,constraint:"Target the calling node. Exactly one of --to or --self is required."},{kind:"flag",name:"tier",type:"enum",choices:["critical","urgent","normal","deferred"],required:!1,default:"normal",constraint:"Delivery urgency. Deferred never wakes an idle node, except a terminal one, which has no later cycle to read it on and is raised to urgent."},{kind:"flag",name:"situational-context",type:"string",required:!1,constraint:"Non-empty hidden ambient context delivered beside the message, or alone."},{kind:"flag",name:"reopen",type:"bool",required:!1,constraint:"Re-task the target: commits it resident and clears any finalization latch before delivery. Valid for live, parked, and finalized targets."}]}i(I,"messageSendParams");function M(){return[{kind:"stdin",name:"body",required:!1,constraint:"Visible message body. The schema alone is a complete request.",positionalStdinConflict:b},{kind:"flag",name:"to",type:"string",required:!1,constraint:"Target an existing node by id. Exactly one of --to or --self is required."},{kind:"flag",name:"self",type:"bool",required:!1,constraint:"Target the calling node. Exactly one of --to or --self is required."},{kind:"flag",name:"tier",type:"enum",choices:["critical","urgent","normal"],required:!1,default:"normal",constraint:"Delivery urgency. Every accepted tier queues lifecycle revival for an active or idle dormant target because the request must be answered; deferred is rejected for that reason."},{kind:"flag",name:"output-schema",type:"string",required:!0,constraint:`JSON Schema the result must satisfy. ${P} The target answers with \`crtr push result\` (or declines with \`crtr push result --decline "<reason>" --code <token>\`), then keeps working. ${R}`},{kind:"flag",name:"situational-context",type:"string",required:!1,constraint:"Non-empty hidden ambient context delivered beside the message, or alone."},{kind:"flag",name:"reopen",type:"bool",required:!1,hidden:!0,constraint:"Clear a finalized target latch before delivery or fresh revive."}]}i(M,"messageRequestParams");async function x(e){N("crtr:act","crtr node message");const n=e.situationalContext!==void 0,t=e.situationalContext?.trim();if(n&&t==="")throw new o({error:"empty_situational_context",message:"--situational-context must contain non-whitespace text",field:"situational-context",next:"Pass non-whitespace text, or omit --situational-context."});const r=e.body,a=r!==void 0?r.trim():void 0,m=a!==void 0&&a!=="",{targetId:s}=await U(e,m),u=e.tier,q=u!==void 0&&u!=="",f=E(e.outputSchema),c=f!==null?JSON.stringify(f):null,g=t!==void 0&&t!=="",k=e.reopen===!0;if(c!==null&&u==="deferred")throw new o({error:"output_schema_deferred_tier",message:"--output-schema cannot combine with --tier deferred because the target must answer",field:"tier",next:"Use normal, urgent, or critical tier, or drop --output-schema."});const h=y(),T=A();if(!m&&!g&&c===null)throw new o({error:"empty_body",message:"a message body is required unless --output-schema or --situational-context is supplied",field:"body",next:"Pass the message on stdin, or supply one of the documented alternatives."});const p=q?u:"normal",d=await T.sendMessage(s,{body:a??"",tier:p,...k?{reopen:!0}:{},...g?{situational_context:t}:{},...c!==null?{output_schema:c}:{},...h!==void 0?{from:h}:{}}).catch($);if(d.wake_failed!==void 0){const l=d.wake_failed;return{revived:!1,guidance:`Accepted but NOT delivered to a running node \u2014 waking the target failed (${l.error}): ${l.message}${l.next===void 0?"":` ${l.next}`} The message is queued durably (${l.message_id}); do not resend it.`}}const S=d.revived?"Delivered \u2014 the dormant target was revived to receive it.":p!=="deferred"?"Delivered.":d.delivered_tier===void 0?"Delivered \u2014 held for the target's next natural cycle; not revived.":"Delivered \u2014 the target is terminal and takes no later cycle, so it was raised to urgent rather than held.";return{revived:d.revived,guidance:S}}i(x,"runMessageEngine");const j=w({name:"send",description:"deliver an inbox message to an existing node immediately",whenToUse:"a target chosen with `--to <node-id>` or `--self` should have information or new direction now \u2014 steering a worker mid-task, handing over a finding it needs, correcting a wrong turn, or waking a dormant node with fresh work. The target reads it and decides what to do with it. Use `node message request` instead when you need an answer back in a shape you specify, and `node subscription add` when the target should keep receiving this node\u2019s pushes rather than this one delivery",help:{name:"node message send",summary:"deliver an inbox message to an existing node immediately",params:I(),output:v(),outputKind:"object",effects:["Appends one inbox entry. Critical, urgent, and normal delivery queues lifecycle revival for an active or idle dormant target; deferred waits for its next natural cycle.","--reopen commits the target resident and clears any finalization latch before delivery, allowing it to take a new mandate; it is valid for live, parked, and finalized targets. Without it, a finalized target rejects delivery before an inbox entry is appended or a revive is attempted."]},run:i(e=>x(e),"run"),render:i(e=>String(e.guidance),"render")}),z=w({name:"request",description:"deliver an immediate typed-output request to an existing node",whenToUse:"a target chosen with `--to <node-id>` or `--self` must hand back one answer in a shape you fix \u2014 a choice among options, a structured extraction, a verdict your own logic will branch on \u2014 or must be held to answering at all before it goes quiet. Use `node message send` instead when prose in the target\u2019s own judgment is enough, and `node new --output-schema` when no node holds the context yet and the work needs a fresh agent",help:{name:"node message request",summary:"deliver an immediate typed-output request to an existing node",params:M(),output:v(),outputKind:"object",effects:["Installs the one-off output schema before appending the request."]},run:i(e=>(D(e,"outputSchema"),x(e)),"run"),render:i(e=>String(e.guidance),"render")}),G=C({name:"message",description:"deliver immediate inbox work to an existing node",whenToUse:"you need one immediate delivery: send ordinary information, or request one schema-constrained result",help:{name:"node message",summary:"deliver one immediate inbox entry to an existing node",model:"Both children append one inbox entry to a node that already exists, targeted with `--to <node-id>` or `--self`, and may revive it if it is dormant. They differ in what the delivery obligates. An ordinary message obligates nothing: the target reads it and acts however it judges best. A request installs a one-off output schema and holds the target awake and owing until it answers; the answer is validated against the schema, written to the target\u2019s result file, and pushed as an update report to the TARGET\u2019S subscribers, so subscribe to it first if the answer has to reach you. Neither child creates that standing relationship \u2014 a durable delivery edge is `node subscription`, and work that needs a fresh agent is `node new`."},children:[j,z]});export{G as nodeMessage};
+var _=Object.defineProperty;var i=(e,n)=>_(e,"name",{value:n,configurable:!0});import{envNodeId as y}from"../../shared/env.js";import{defineBranch as C,defineLeaf as w}from"../../core/command.js";import{InputError as o}from"../../core/io.js";import{requireScope as N}from"../../core/errors.js";import{OUTPUT_SCHEMA_CONSTRAINTS as R,OUTPUT_SCHEMA_TRANSPORT as P,parseOutputSchemaValue as E}from"../../core/runtime/structured-output.js";import{cliClient as A,getNodeOrNull as I,rethrowAsCliError as O}from"../api-client.js";function $(e,n){const t=e[n];if(t!==void 0&&(typeof t!="string"||t.trim()==="")){const a=n.replace(/[A-Z]/g,r=>`-${r.toLowerCase()}`);throw new o({error:"empty_discriminant",message:`--${a} must contain non-whitespace text`,received:typeof t=="string"?t:String(t),field:a,next:`Pass a non-empty --${a} value, or omit the flag.`})}}i($,"requireNonBlankDiscriminant");async function D(e,n){const t=e.to?.trim(),a=e.self===!0,r=t!==void 0&&t!=="";if(r===a)throw new o({error:"bad_target",message:r&&a?"--to and --self are mutually exclusive":n?"no target given \u2014 the message body is not a node id":"exactly one of --to or --self is required",field:r?void 0:"to",next:r?"Pass --to <node-id> or --self.":n?"Pass the node id with --to <node-id> and provide the message body as a positional argument or on stdin, or use --self.":"Pass --to <node-id> or --self."});if(a){const s=y();if(s===void 0||s==="")throw new o({error:"no_node",message:"no node to target with --self (CRTR_NODE_ID unset)",next:"Run from inside a node, or pass --to <node-id>."});return{targetId:s,isSelf:!0}}if(await I(t)===null)throw new o({error:"not_found",message:`no node: ${t}`,field:"to",next:"List nodes with `crtr node inspect list`."});return{targetId:t,isSelf:!1}}i(D,"resolveMsgTarget");function v(){return[{name:"revived",type:"boolean",required:!1,constraint:"True when this request synchronously revived the target; ordinary durable delivery to an active or idle dormant target queues lifecycle revival instead."},{name:"guidance",type:"string",required:!0,constraint:"Immediate action confirmation."}]}i(v,"messageOutput");function b(e){const n=e.to?.trim();if(!(n!==void 0&&n!==""||e.self===!0))return{message:"no target given \u2014 the positional argument is the message body, not a node id",field:"to",next:"Pass the node id with --to <node-id> and pipe the message body on stdin, or use --self."}}i(b,"missingMessageTargetForBody");function U(){return[{kind:"stdin",name:"body",required:!1,constraint:"Visible message body. Required unless --situational-context is supplied.",positionalStdinConflict:b},{kind:"flag",name:"to",type:"string",required:!1,constraint:"Target an existing node by id. Exactly one of --to or --self is required."},{kind:"flag",name:"self",type:"bool",required:!1,constraint:"Target the calling node. Exactly one of --to or --self is required."},{kind:"flag",name:"tier",type:"enum",choices:["critical","urgent","normal","deferred"],required:!1,default:"normal",constraint:"Delivery urgency. Deferred never wakes an idle node, except a terminal one, which has no later cycle to read it on and is raised to urgent."},{kind:"flag",name:"situational-context",type:"string",required:!1,constraint:"Non-empty hidden ambient context delivered beside the message, or alone."},{kind:"flag",name:"reopen",type:"bool",required:!1,constraint:"Re-task the target: clears any finalization latch before delivery and brings a done target back to active. Commits the target resident, except when you are its manager (the node that spawned it): then it keeps its lifecycle, so a terminal child still owes a final report. Valid for live, parked, and finalized targets."}]}i(U,"messageSendParams");function M(){return[{kind:"stdin",name:"body",required:!1,constraint:"Visible message body. The schema alone is a complete request.",positionalStdinConflict:b},{kind:"flag",name:"to",type:"string",required:!1,constraint:"Target an existing node by id. Exactly one of --to or --self is required."},{kind:"flag",name:"self",type:"bool",required:!1,constraint:"Target the calling node. Exactly one of --to or --self is required."},{kind:"flag",name:"tier",type:"enum",choices:["critical","urgent","normal"],required:!1,default:"normal",constraint:"Delivery urgency. Every accepted tier queues lifecycle revival for an active or idle dormant target because the request must be answered; deferred is rejected for that reason."},{kind:"flag",name:"output-schema",type:"string",required:!0,constraint:`JSON Schema the result must satisfy. ${P} The target answers with \`crtr push result\` (or declines with \`crtr push result --decline "<reason>" --code <token>\`), then keeps working. ${R}`},{kind:"flag",name:"situational-context",type:"string",required:!1,constraint:"Non-empty hidden ambient context delivered beside the message, or alone."},{kind:"flag",name:"reopen",type:"bool",required:!1,hidden:!0,constraint:"Clear a finalized target latch before delivery or fresh revive."}]}i(M,"messageRequestParams");async function x(e){N("crtr:act","crtr node message");const n=e.situationalContext!==void 0,t=e.situationalContext?.trim();if(n&&t==="")throw new o({error:"empty_situational_context",message:"--situational-context must contain non-whitespace text",field:"situational-context",next:"Pass non-whitespace text, or omit --situational-context."});const a=e.body,r=a!==void 0?a.trim():void 0,m=r!==void 0&&r!=="",{targetId:s}=await D(e,m),u=e.tier,q=u!==void 0&&u!=="",f=E(e.outputSchema),c=f!==null?JSON.stringify(f):null,h=t!==void 0&&t!=="",k=e.reopen===!0;if(c!==null&&u==="deferred")throw new o({error:"output_schema_deferred_tier",message:"--output-schema cannot combine with --tier deferred because the target must answer",field:"tier",next:"Use normal, urgent, or critical tier, or drop --output-schema."});const g=y(),T=A();if(!m&&!h&&c===null)throw new o({error:"empty_body",message:"a message body is required unless --output-schema or --situational-context is supplied",field:"body",next:"Pass the message on stdin, or supply one of the documented alternatives."});const p=q?u:"normal",d=await T.sendMessage(s,{body:r??"",tier:p,...k?{reopen:!0}:{},...h?{situational_context:t}:{},...c!==null?{output_schema:c}:{},...g!==void 0?{from:g}:{}}).catch(O);if(d.wake_failed!==void 0){const l=d.wake_failed;return{revived:!1,guidance:`Accepted but NOT delivered to a running node \u2014 waking the target failed (${l.error}): ${l.message}${l.next===void 0?"":` ${l.next}`} The message is queued durably (${l.message_id}); do not resend it.`}}const S=d.revived?"Delivered \u2014 the dormant target was revived to receive it.":p!=="deferred"?"Delivered.":d.delivered_tier===void 0?"Delivered \u2014 held for the target's next natural cycle; not revived.":"Delivered \u2014 the target is terminal and takes no later cycle, so it was raised to urgent rather than held.";return{revived:d.revived,guidance:S}}i(x,"runMessageEngine");const j=w({name:"send",description:"deliver an inbox message to an existing node immediately",whenToUse:"a target chosen with `--to <node-id>` or `--self` should have information or new direction now \u2014 steering a worker mid-task, handing over a finding it needs, correcting a wrong turn, or waking a dormant node with fresh work. The target reads it and decides what to do with it. Use `node message request` instead when you need an answer back in a shape you specify, and `node subscription add` when the target should keep receiving this node\u2019s pushes rather than this one delivery",help:{name:"node message send",summary:"deliver an inbox message to an existing node immediately",params:U(),output:v(),outputKind:"object",effects:["Appends one inbox entry. Critical, urgent, and normal delivery queues lifecycle revival for an active or idle dormant target; deferred waits for its next natural cycle.","--reopen clears any finalization latch before delivery, allowing the target to take a new mandate. It commits the target resident unless you are its manager (the node that spawned it), in which case the target keeps its lifecycle and a terminal child still owes a final report. It is valid for live, parked, and finalized targets. Without it, a finalized target rejects delivery before an inbox entry is appended or a revive is attempted."]},run:i(e=>x(e),"run"),render:i(e=>String(e.guidance),"render")}),z=w({name:"request",description:"deliver an immediate typed-output request to an existing node",whenToUse:"a target chosen with `--to <node-id>` or `--self` must hand back one answer in a shape you fix \u2014 a choice among options, a structured extraction, a verdict your own logic will branch on \u2014 or must be held to answering at all before it goes quiet. Use `node message send` instead when prose in the target\u2019s own judgment is enough, and `node new --output-schema` when no node holds the context yet and the work needs a fresh agent",help:{name:"node message request",summary:"deliver an immediate typed-output request to an existing node",params:M(),output:v(),outputKind:"object",effects:["Installs the one-off output schema before appending the request."]},run:i(e=>($(e,"outputSchema"),x(e)),"run"),render:i(e=>String(e.guidance),"render")}),G=C({name:"message",description:"deliver immediate inbox work to an existing node",whenToUse:"you need one immediate delivery: send ordinary information, or request one schema-constrained result",help:{name:"node message",summary:"deliver one immediate inbox entry to an existing node",model:"Both children append one inbox entry to a node that already exists, targeted with `--to <node-id>` or `--self`, and may revive it if it is dormant. They differ in what the delivery obligates. An ordinary message obligates nothing: the target reads it and acts however it judges best. A request installs a one-off output schema and holds the target awake and owing until it answers; the answer is validated against the schema, written to the target\u2019s result file, and pushed as an update report to the TARGET\u2019S subscribers, so subscribe to it first if the answer has to reach you. Neither child creates that standing relationship \u2014 a durable delivery edge is `node subscription`, and work that needs a fresh agent is `node new`."},children:[j,z]});export{G as nodeMessage};

package/dist/commands/sys/join.js

@@ -1 +1 @@
-var s=Object.defineProperty;var n=(e,r)=>s(e,"name",{value:r,configurable:!0});import{defineLeaf as o}from"../../core/command.js";import{existsSync as a}from"node:fs";import{join as d}from"node:path";import{pluginsDir as l}from"../../core/scope.js";import{joinDirectory as u}from"../../core/directory/join.js";import{apiSocketPath as c}from"../../core/canvas/paths.js";import{listProcessTable as m}from"../../core/canvas/pid.js";import{daemonAnswers as h}from"../../core/layout-migrate/index.js";import{envNodeId as p}from"../../shared/env.js";import{isDaemonRunning as f}from"../../daemon/pidfile.js";import{findDaemonPids as w,spawnDaemon as y,stopAllDaemons as g}from"../../daemon/manage.js";function k(){const e=m();if(e===null||(p()??"")!=="")return!0;const r=new Map(e.map(t=>[t.pid,t])),i=new Set;for(let t=process.ppid;t>1&&!i.has(t);t=r.get(t)?.ppid??0)if(i.add(t),r.get(t)?.command.includes("broker-cli"))return!0;return!1}n(k,"insideBroker");function b(){if(!(process.platform==="linux"&&a("/run/crtr/launcher.sock")))return{running:n(async()=>f()||w().length>0||await h(c()),"running"),stop:n(async()=>{await g()},"stop"),start:n(async()=>{await y()},"start"),firstSync:n(async()=>{const e=l("user"),r=Date.now()+2e4;for(;e&&Date.now()<r&&!a(d(e,"cloud","commands.json"));)await new Promise(i=>setTimeout(i,250))},"firstSync"),insideNode:k}}n(b,"daemonControl");const T=o({name:"join",description:"register this runtime with its directory using an enrollment token, offline",whenToUse:"on your own computer, with a token from `<issuer>/account/machines`: run it from a plain terminal, with any viewers open. It stops the daemon, joins, and starts it again. Also at a hosted runtime's first boot, before the daemon starts, with the enrollment token provisioning passed in.",help:{name:"sys join",summary:"exchange a directory enrollment token for a new runtime client key and record the returned identity",guide:"Generates a new ES256 client key, sends only its public key to `PUT <directory>/v1/runtimes/registration` with the token as bearer, and learns the runtime id, client id, issuer, owner and URL from the answer. Only after that answer does it write the key file, set the user settings `runtime.issuer` and `runtime.audience`, and rewrite `user:local` profile grantees to `app:terminal`. canvas.db belongs to the daemon: its next start rewrites `user:local` there, before it serves anything. On your own computer a running daemon is no obstacle: join takes a `join.lock` in the runtime directory (so no open viewer's redial can autostart a daemon while it works), registers with the directory while the daemon still serves, stops the daemon, writes the identity, and starts the daemon again, whose start applies the canvas.db rewrite. Run it from a plain terminal, not from inside a node: a node's broker dies with the daemon, so join refuses `join_inside_node` instead. Where the launcher owns the daemon (a hosted container) join keeps the offline contract and refuses `daemon_running`. Presenting the token of the stored successful registration again finishes those local writes without calling the directory. Any other token generates a new key and registers again.",params:[{kind:"flag",name:"directory",type:"string",required:!0,constraint:"Directory base URL (http or https) that minted the token."},{kind:"flag",name:"token",type:"string",required:!0,sensitive:!0,constraint:"Single-use enrollment token. Sensitive: never echoed in output or errors."},{kind:"flag",name:"name",type:"string",required:!1,constraint:"Label shown for this machine on the account page. Default: this computer's hostname."}],output:[{name:"runtime",type:"string",required:!0,constraint:"Runtime principal from the directory, `runtime:<id>`."},{name:"client_id",type:"string",required:!0,constraint:"OAuth client id registered for the new key."},{name:"issuer",type:"string",required:!0,constraint:"Canonical issuer, written to `runtime.issuer`."},{name:"owner",type:"string",required:!0,constraint:"Owner principal, `user:<id>`, that replaces `user:local` subjects."},{name:"canvas_rewrite",type:"string",required:!0,constraint:"Always `next daemon start`: when canvas.db identity fields are rewritten."},{name:"url",type:"string",required:!0,constraint:"Runtime URL, written to `runtime.audience`."},{name:"registered",type:"boolean",required:!0,constraint:"False when the token matched the stored registration and the directory was not called."},{name:"daemon",type:"string",required:!0,constraint:"`restarted` (a daemon was stopped and started on the joined settings), `started` (none was running; join started one and waited, up to 20s, for its first grant sync to install the account's provider plugins, so `crtr cloud \u2026` resolves), `not_running` (none was started: a hosted container's launcher owns its daemon), or `restart_failed` (joined, but the new daemon did not start: see `daemon_error`, then run `crtr sys daemon start`)."},{name:"daemon_error",type:"string",required:!1,constraint:"Why the new daemon did not start, with `daemon: restart_failed`."}],outputKind:"object",effects:["Holds `<runtime>/join.lock` (its pid) from the start until the daemon is back; `ensureDaemon` and `sys daemon start` (without `--force`) decline to start a daemon while a live process holds it (including a start already in flight when the join began). A lock whose holder died is reclaimed.","A running daemon is stopped (SIGTERM, then SIGKILL, plus strays) after the directory accepts the registration and before the local writes, then started again. Every broker dies with it and is revived by the new daemon. If the join fails after the stop, the daemon is started again anyway. With no daemon running join starts one anyway, because a bare `crtr cloud \u2026` is an unknown command (it never autostarts a daemon) until a daemon's grant sync has installed the provider plugins. Refuses `join_inside_node` when run from inside a node and a daemon is running; refuses `daemon_running` where a container launcher owns the daemon.","On a new token: calls the directory once; on success writes `<runtime>/secrets/runtime-client.json` (mode 0600) with the private key, registration and the token's SHA-256, replacing any earlier key file. A refused or failed call writes nothing.","Sends name, platform, crtr version, installed plugin ids and sandbox state with the public key. Before the request it writes `runtime-client.pending.json` (mode 0600); a rerun with the same token and directory reuses that key, so a lost reply is retried safely. The file is deleted on success or a refusal.","Sets `runtime.issuer` and `runtime.audience` in user settings. When the directory says this machine is not the account's default (`is_default: false`) it replaces the whole `runtime` setting with `{issuer, audience, unsandboxed: true}`: no app listener, and only `app:terminal` nodes run.","Rewrites `user:local` profile grantees to `app:terminal`.","At every later daemon start, before any listener: exact `user:local` subjects in canvas.db nodes and node_tokens become the owner (as do missing subjects on `app:terminal` nodes), `user:local` grantees in nodes, run_events, idempotency_keys and node_tokens become `app:terminal`, references to the unjoined runtime's `local:terminal` grant are cleared, and that local grant mirror is deleted so grant sync installs the directory's. Application grantees and free text are unchanged; a start with nothing left to rewrite changes no rows."]},run:n(async e=>({...await u(e.directory,e.token,e.name||void 0,b()),canvas_rewrite:"next daemon start"}),"run")});export{T as sysJoinLeaf};
+var s=Object.defineProperty;var n=(e,r)=>s(e,"name",{value:r,configurable:!0});import{defineLeaf as o}from"../../core/command.js";import{existsSync as a}from"node:fs";import{join as d}from"node:path";import{pluginsDir as u}from"../../core/scope.js";import{joinDirectory as l}from"../../core/directory/join.js";import{apiSocketPath as c}from"../../core/canvas/paths.js";import{listProcessTable as m}from"../../core/canvas/pid.js";import{daemonAnswers as h}from"../../core/layout-migrate/index.js";import{envNodeId as p}from"../../shared/env.js";import{isDaemonRunning as f}from"../../daemon/pidfile.js";import{findDaemonPids as w,spawnDaemon as y,stopAllDaemons as g}from"../../daemon/manage.js";function k(){const e=m();if(e===null||(p()??"")!=="")return!0;const r=new Map(e.map(t=>[t.pid,t])),i=new Set;for(let t=process.ppid;t>1&&!i.has(t);t=r.get(t)?.ppid??0)if(i.add(t),r.get(t)?.command.includes("broker-cli"))return!0;return!1}n(k,"insideBroker");function b(){if(!(process.platform==="linux"&&a("/run/crtr/launcher.sock")))return{running:n(async()=>f()||w().length>0||await h(c()),"running"),stop:n(async()=>{await g()},"stop"),start:n(async()=>{await y()},"start"),firstSync:n(async()=>{const e=u("user"),r=Date.now()+2e4;for(;e&&Date.now()<r&&!a(d(e,"cloud","commands.json"));)await new Promise(i=>setTimeout(i,250))},"firstSync"),insideNode:k}}n(b,"daemonControl");const T=o({name:"join",description:"register this runtime with its directory using an enrollment token, offline",whenToUse:"on your own computer, with a token from `<issuer>/account/machines`: run it from a plain terminal, with any viewers open. It stops the daemon, joins, and starts it again. Also at a hosted runtime's first boot, before the daemon starts, with the enrollment token provisioning passed in.",help:{name:"sys join",summary:"exchange a directory enrollment token for a new runtime client key and record the returned identity",guide:"Generates a new ES256 client key, sends only its public key to `PUT <directory>/v1/runtimes/registration` with the token as bearer, and learns the runtime id, client id, issuer, owner and URL from the answer. Only after that answer does it write the key file, set the user settings `runtime.issuer` and `runtime.audience`, and rewrite `user:local` profile grantees to `app:terminal`. canvas.db belongs to the daemon: its next start rewrites `user:local` there, before it serves anything. On your own computer a running daemon is no obstacle: join takes a `join.lock` in the runtime directory (so no open viewer's redial can autostart a daemon while it works), registers with the directory while the daemon still serves, stops the daemon, writes the identity, and starts the daemon again, whose start applies the canvas.db rewrite. Run it from a plain terminal, not from inside a node: a node's broker dies with the daemon, so join refuses `join_inside_node` instead. Where the launcher owns the daemon (a hosted container) join keeps the offline contract and refuses `daemon_running`. Presenting the token of the stored successful registration again finishes those local writes without calling the directory. Any other token generates a new key and registers again.",params:[{kind:"flag",name:"directory",type:"string",required:!0,constraint:"Directory base URL (http or https) that minted the token."},{kind:"flag",name:"token",type:"string",required:!0,sensitive:!0,constraint:"Single-use enrollment token. Sensitive: never echoed in output or errors."},{kind:"flag",name:"name",type:"string",required:!1,constraint:"Label shown for this machine on the account page. Default: this computer's hostname."}],output:[{name:"runtime",type:"string",required:!0,constraint:"Runtime principal from the directory, `runtime:<id>`."},{name:"client_id",type:"string",required:!0,constraint:"OAuth client id registered for the new key."},{name:"issuer",type:"string",required:!0,constraint:"Canonical issuer, written to `runtime.issuer`."},{name:"owner",type:"string",required:!0,constraint:"Owner principal, `user:<id>`, that replaces `user:local` subjects."},{name:"canvas_rewrite",type:"string",required:!0,constraint:"Always `next daemon start`: when canvas.db identity fields are rewritten."},{name:"url",type:"string",required:!0,constraint:"Runtime URL, written to `runtime.audience`."},{name:"registered",type:"boolean",required:!0,constraint:"False when the token matched the stored registration and the directory was not called."},{name:"daemon",type:"string",required:!0,constraint:"`restarted` (a daemon was stopped and started on the joined settings), `started` (none was running; join started one and waited, up to 20s, for its first grant sync to install the account's provider plugins, so `crtr cloud \u2026` resolves), `not_running` (none was started: a hosted container's launcher owns its daemon), or `restart_failed` (joined, but the new daemon did not start: see `daemon_error`, then run `crtr sys daemon start`)."},{name:"daemon_error",type:"string",required:!1,constraint:"Why the new daemon did not start, with `daemon: restart_failed`."}],outputKind:"object",effects:["Holds `<runtime>/join.lock` (its pid) from the start until the daemon is back; `ensureDaemon` and `sys daemon start` (without `--force`) decline to start a daemon while a live process holds it (including a start already in flight when the join began). A lock whose holder died is reclaimed.","A running daemon is stopped (SIGTERM, then SIGKILL, plus strays) after the directory accepts the registration and before the local writes, then started again. Every broker dies with it and is revived by the new daemon. If the join fails after the stop, the daemon is started again anyway. With no daemon running join starts one anyway, because a bare `crtr cloud \u2026` is an unknown command (it never autostarts a daemon) until a daemon's grant sync has installed the provider plugins. Refuses `join_inside_node` when run from inside a node and a daemon is running; refuses `daemon_running` where a container launcher owns the daemon.","On a new token: calls the directory once; on success writes `<runtime>/secrets/runtime-client.json` (mode 0600) with the private key, registration and the token's SHA-256, replacing any earlier key file. A refused or failed call writes nothing.","Sends name, platform, crtr version, installed plugin ids and sandbox state with the public key. Before the request it writes `runtime-client.pending.json` (mode 0600); a rerun with the same token and directory reuses that key, so a lost reply is retried safely. The file is deleted on success or a refusal.","Sets `runtime.issuer` and `runtime.audience` in user settings. When the directory says this machine is not the account's default (`is_default: false`) it replaces the whole `runtime` setting with `{issuer, audience, unsandboxed: true}`: no app listener, and only `app:terminal` nodes run.","Rewrites `user:local` profile grantees to `app:terminal`.","At the first daemon start after a join as this owner, before any listener (a later start under the same owner skips it): exact `user:local` subjects in canvas.db nodes and node_tokens become the owner (as do missing subjects on `app:terminal` nodes), `user:local` grantees in nodes, run_events, idempotency_keys and node_tokens become `app:terminal`, references to the unjoined runtime's `local:terminal` grant are cleared, and that local grant mirror is deleted so grant sync installs the directory's. Application grantees and free text are unchanged; a join as a different owner runs it again."]},run:n(async e=>({...await l(e.directory,e.token,e.name||void 0,b()),canvas_rewrite:"next daemon start"}),"run")});export{T as sysJoinLeaf};

package/dist/core/async-array.d.ts

@@ -0,0 +1,7 @@
+export declare function mapAsync<T, U>(items: readonly T[], fn: (item: T, index: number, items: readonly T[]) => Promise<U>): Promise<U[]>;
+export declare function flatMapAsync<T, U>(items: readonly T[], fn: (item: T, index: number, items: readonly T[]) => Promise<U | readonly U[]>): Promise<U[]>;
+export declare function filterAsync<T>(items: readonly T[], fn: (item: T, index: number, items: readonly T[]) => Promise<unknown>): Promise<T[]>;
+export declare function someAsync<T>(items: readonly T[], fn: (item: T, index: number, items: readonly T[]) => Promise<unknown>): Promise<boolean>;
+export declare function everyAsync<T>(items: readonly T[], fn: (item: T, index: number, items: readonly T[]) => Promise<unknown>): Promise<boolean>;
+export declare function findAsync<T>(items: readonly T[], fn: (item: T, index: number, items: readonly T[]) => Promise<unknown>): Promise<T | undefined>;
+export declare function forEachAsync<T>(items: readonly T[], fn: (item: T, index: number, items: readonly T[]) => Promise<unknown>): Promise<void>;

package/dist/core/async-array.js

@@ -0,0 +1 @@
+var e=Object.defineProperty;var a=(n,t)=>e(n,"name",{value:t,configurable:!0});async function u(n,t){const r=[];for(let o=0;o<n.length;o++)r.push(await t(n[o],o,n));return r}a(u,"mapAsync");async function l(n,t){const r=[];for(let o=0;o<n.length;o++){const c=await t(n[o],o,n);Array.isArray(c)?r.push(...c):r.push(c)}return r}a(l,"flatMapAsync");async function y(n,t){const r=[];for(let o=0;o<n.length;o++)await t(n[o],o,n)&&r.push(n[o]);return r}a(y,"filterAsync");async function i(n,t){for(let r=0;r<n.length;r++)if(await t(n[r],r,n))return!0;return!1}a(i,"someAsync");async function p(n,t){for(let r=0;r<n.length;r++)if(!await t(n[r],r,n))return!1;return!0}a(p,"everyAsync");async function h(n,t){for(let r=0;r<n.length;r++)if(await t(n[r],r,n))return n[r]}a(h,"findAsync");async function s(n,t){for(let r=0;r<n.length;r++)await t(n[r],r,n)}a(s,"forEachAsync");export{p as everyAsync,y as filterAsync,h as findAsync,l as flatMapAsync,s as forEachAsync,u as mapAsync,i as someAsync};

package/dist/core/audit.d.ts

@@ -18,6 +18,6 @@ export interface PeerAuditRow {
     resource?: string | null;
 }
 /** Write one audit row. A failure to write is logged by the caller's wrapper and never changes the answer. */
-export declare function writePeerAudit(row: PeerAuditRow): void;
+export declare function writePeerAudit(row: PeerAuditRow): Promise<void>;
 /** The outcome string for an HTTP status. */
 export declare const auditOutcome: (status: number) => string;

package/dist/core/audit.js

@@ -1,3 +1,3 @@
-var n=Object.defineProperty;var i=(e,t)=>n(e,"name",{value:t,configurable:!0});import{prepared as u}from"./sqlite-statements.js";import{withCanvasWrite as r}from"./canvas/db.js";function s(e){r(t=>{u(t,`INSERT INTO audit_rows
+var n=Object.defineProperty;var t=(e,i)=>n(e,"name",{value:i,configurable:!0});import{openDb as u}from"./canvas/db.js";async function r(e){await(await u()).prepare(`INSERT INTO audit_rows
       (request_id, time, grantee, sub, class, operation, outcome, node_id, run_id, resource, via)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(e.request_id,new Date().toISOString(),e.grantee,e.sub,e.class,e.operation,e.outcome,e.node_id??null,e.run_id??null,e.resource??null,e.via)})}i(s,"writePeerAudit");const c=i(e=>e>=200&&e<300?"ok":`status:${e}`,"auditOutcome");export{c as auditOutcome,s as writePeerAudit};
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(e.request_id,new Date().toISOString(),e.grantee,e.sub,e.class,e.operation,e.outcome,e.node_id??null,e.run_id??null,e.resource??null,e.via)}t(r,"writePeerAudit");const d=t(e=>e>=200&&e<300?"ok":`status:${e}`,"auditOutcome");export{d as auditOutcome,r as writePeerAudit};

package/dist/core/canvas/attention.d.ts

@@ -9,10 +9,10 @@ export interface TicketEntry {
 /** Kept for callers that reset a canvas home in process. SQL has no directory-scan cache to invalidate. */
 export declare function invalidateTicketCounts(): void;
 /** Count pending tickets asked by one node. */
-export declare function countTickets(nodeId: string): number;
+export declare function countTickets(nodeId: string): Promise<number>;
 /** Pending tickets for every reachable asking node, including the root. */
-export declare function pendingTicketsForView(rootId: string): TicketEntry[];
+export declare function pendingTicketsForView(rootId: string): Promise<TicketEntry[]>;
 /** Per-node pending ticket counts for an explicit node set. */
-export declare function ticketCountsForNodes(ids: string[]): Record<string, number>;
+export declare function ticketCountsForNodes(ids: string[]): Promise<Record<string, number>>;
 /** Pending tickets across the entire canvas, attributed to asking nodes. */
-export declare function ticketsAcrossCanvas(): TicketEntry[];
+export declare function ticketsAcrossCanvas(): Promise<TicketEntry[]>;

package/dist/core/canvas/attention.js

@@ -1 +1 @@
-var u=Object.defineProperty;var s=(t,n)=>u(t,"name",{value:n,configurable:!0});import{listOpenReplyBearingRequests as d}from"../human/requests.js";import{getNode as f,listNodes as l,view as p}from"./canvas.js";function h(){}s(h,"invalidateTicketCounts");function c(){const t=new Map;for(const n of d()){const e=n.requester_node_id,o=t.get(e);o===void 0?t.set(e,[n.title]):o.push(n.title)}return t}s(c,"ticketSubjects");function w(t){return c().get(t)?.length??0}s(w,"countTickets");function k(t){const n=c(),e=[];for(const o of[t,...p(t)]){const i=f(o),r=n.get(o)??[];i!==null&&r.length>0&&e.push({node_id:o,name:i.name,cwd:i.cwd,count:r.length,subjects:r})}return e}s(k,"pendingTicketsForView");function _(t){const n=c();return Object.fromEntries(t.map(e=>[e,n.get(e)?.length??0]))}s(_,"ticketCountsForNodes");function b(){const t=c(),n=[];for(const e of l()){const o=t.get(e.node_id)??[];o.length>0&&n.push({node_id:e.node_id,name:e.name,cwd:e.cwd,count:o.length,subjects:o})}return n}s(b,"ticketsAcrossCanvas");export{w as countTickets,h as invalidateTicketCounts,k as pendingTicketsForView,_ as ticketCountsForNodes,b as ticketsAcrossCanvas};
+var r=Object.defineProperty;var s=(t,n)=>r(t,"name",{value:n,configurable:!0});import{listOpenReplyBearingRequests as u}from"../human/requests.js";import{getNode as d,listNodes as f,view as l}from"./canvas.js";function m(){}s(m,"invalidateTicketCounts");async function i(){const t=new Map;for(const n of await u()){const e=n.requester_node_id,o=t.get(e);o===void 0?t.set(e,[n.title]):o.push(n.title)}return t}s(i,"ticketSubjects");async function h(t){return(await i()).get(t)?.length??0}s(h,"countTickets");async function k(t){const n=await i(),e=[];for(const o of[t,...await l(t)]){const c=await d(o),a=n.get(o)??[];c!==null&&a.length>0&&e.push({node_id:o,name:c.name,cwd:c.cwd,count:a.length,subjects:a})}return e}s(k,"pendingTicketsForView");async function y(t){const n=await i();return Object.fromEntries(t.map(e=>[e,n.get(e)?.length??0]))}s(y,"ticketCountsForNodes");async function _(){const t=await i(),n=[];for(const e of await f()){const o=t.get(e.node_id)??[];o.length>0&&n.push({node_id:e.node_id,name:e.name,cwd:e.cwd,count:o.length,subjects:o})}return n}s(_,"ticketsAcrossCanvas");export{h as countTickets,m as invalidateTicketCounts,k as pendingTicketsForView,y as ticketCountsForNodes,_ as ticketsAcrossCanvas};

package/dist/core/canvas/boot.d.ts

@@ -64,14 +64,14 @@ export interface BootReconcileResult {
  *
  *  `current` defaults to the real identity; tests inject a synthetic one against
  *  an isolated CRTR_HOME to simulate a boot change without a real reboot. */
-export declare function reconcileBootLiveness(current?: BootIdentity): BootReconcileResult;
+export declare function reconcileBootLiveness(current?: BootIdentity): Promise<BootReconcileResult>;
 /** The one-time execution-identity migration, injected into the startup
  *  composition. In production this is `migrateLegacyExecutionIdentities` from
  *  executions.ts. It remains injected so tests can exercise this composition
  *  without reaching process inspection. */
-export type MigrateLegacyExecutionIdentities = (captureIdentity?: (pid: number) => string | undefined) => {
+export type MigrateLegacyExecutionIdentities = (captureIdentity?: (pid: number) => string | undefined) => Promise<{
     migrated: string[];
-};
+}>;
 export interface BootStartupResult {
     /** The pid-liveness reconciliation result (boot-change sweep + provenance). */
     reconcile: BootReconcileResult;
@@ -89,4 +89,4 @@ export interface BootStartupResult {
  *
  *  `migrate` is injected (see `MigrateLegacyPidIdentities`); `current` and
  *  `captureIdentity` pass through to the two steps for test injection. */
-export declare function reconcileAndMigrateBoot(migrate: MigrateLegacyExecutionIdentities, current?: BootIdentity, captureIdentity?: (pid: number) => string | undefined): BootStartupResult;
+export declare function reconcileAndMigrateBoot(migrate: MigrateLegacyExecutionIdentities, current?: BootIdentity, captureIdentity?: (pid: number) => string | undefined): Promise<BootStartupResult>;

package/dist/core/canvas/boot.js

@@ -1 +1 @@
-var E=Object.defineProperty;var n=(e,o)=>E(e,"name",{value:o,configurable:!0});import{prepared as d}from"../sqlite-statements.js";import{uptime as f}from"node:os";import{openDb as p}from"./db.js";import{readKernelBootId as b}from"./boot-id.js";import{readKernelBootId as R}from"./boot-id.js";const I=6e4;function M(e=Date.now()){return{bootId:b(),bootEpochMs:e-Math.round(f()*1e3)}}n(M,"currentBootIdentity");function m(e,o){return o===null?!1:e.bootId!==null&&o.bootId!==null?e.bootId!==o.bootId:Math.abs(e.bootEpochMs-o.bootEpochMs)>I}n(m,"bootChanged");function x(e,o){return o!==null&&e.bootId!==null&&o.bootId!==null&&e.bootId===o.bootId}n(x,"bootProvenSame");const s="boot_identity";function h(e){const o=d(e,"SELECT value FROM canvas_meta WHERE key = ?").get(s);if(o===void 0)return null;try{const t=JSON.parse(o.value);return typeof t.bootEpochMs!="number"?null:{bootId:typeof t.bootId=="string"?t.bootId:null,bootEpochMs:t.bootEpochMs}}catch{return null}}n(h,"readBootMarker");function u(e,o){e.prepare("INSERT INTO canvas_meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(s,JSON.stringify(o))}n(u,"writeBootMarker");function O(e=M()){const o=p();o.exec("BEGIN IMMEDIATE");try{const t=h(o);if(!m(e,t)){t===null&&u(o,e);const a=x(e,t);return o.exec("COMMIT"),{changed:!1,cleared:[],sameBootProven:a}}const r=d(o,"SELECT execution_id, node_id FROM executions WHERE state != 'exited'").all(),c=d(o,"UPDATE executions SET state = 'exited', ended_at = ?, exit_reason = 'boot-change' WHERE execution_id = ? AND state != 'exited'"),i=[],l=new Date().toISOString();for(const a of r)c.run(l,a.execution_id).changes>0&&i.push(a.node_id);return u(o,e),o.exec("COMMIT"),{changed:!0,cleared:i,sameBootProven:!1}}catch(t){try{o.exec("ROLLBACK")}catch{}throw t}}n(O,"reconcileBootLiveness");function v(e,o,t){const r=O(o),c=r.sameBootProven?e(t).migrated:[];return{reconcile:r,migrated:c}}n(v,"reconcileAndMigrateBoot");export{m as bootChanged,x as bootProvenSame,M as currentBootIdentity,R as readKernelBootId,v as reconcileAndMigrateBoot,O as reconcileBootLiveness};
+var l=Object.defineProperty;var n=(t,o)=>l(t,"name",{value:o,configurable:!0});import{uptime as p}from"node:os";import{withCanvasWrite as f}from"./db.js";import{readKernelBootId as E}from"./boot-id.js";import{readKernelBootId as S}from"./boot-id.js";const b=6e4;function I(t=Date.now()){return{bootId:E(),bootEpochMs:t-Math.round(p()*1e3)}}n(I,"currentBootIdentity");function h(t,o){return o===null?!1:t.bootId!==null&&o.bootId!==null?t.bootId!==o.bootId:Math.abs(t.bootEpochMs-o.bootEpochMs)>b}n(h,"bootChanged");function m(t,o){return o!==null&&t.bootId!==null&&o.bootId!==null&&t.bootId===o.bootId}n(m,"bootProvenSame");const s="boot_identity";async function x(t){const o=await t.prepare("SELECT value FROM canvas_meta WHERE key = ?").get(s);if(o===void 0)return null;try{const e=JSON.parse(o.value);return typeof e.bootEpochMs!="number"?null:{bootId:typeof e.bootId=="string"?e.bootId:null,bootEpochMs:e.bootEpochMs}}catch{return null}}n(x,"readBootMarker");async function u(t,o){await t.prepareUncached("INSERT INTO canvas_meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(s,JSON.stringify(o))}n(u,"writeBootMarker");async function _(t=I()){return f(async o=>{const e=await x(o);if(!h(t,e)){e===null&&await u(o,t);const r=m(t,e);return{changed:!1,cleared:[],sameBootProven:r}}const a=await o.prepare("SELECT execution_id, node_id FROM executions WHERE state != 'exited'").all(),i=o.prepare("UPDATE executions SET state = 'exited', ended_at = ?, exit_reason = 'boot-change' WHERE execution_id = ? AND state != 'exited'"),c=[],d=new Date().toISOString();for(const r of a)(await i.run(d,r.execution_id)).changes>0&&c.push(r.node_id);return await u(o,t),{changed:!0,cleared:c,sameBootProven:!1}})}n(_,"reconcileBootLiveness");async function g(t,o,e){const a=await _(o),i=a.sameBootProven?(await t(e)).migrated:[];return{reconcile:a,migrated:i}}n(g,"reconcileAndMigrateBoot");export{h as bootChanged,m as bootProvenSame,I as currentBootIdentity,S as readKernelBootId,g as reconcileAndMigrateBoot,_ as reconcileBootLiveness};

package/dist/core/canvas/canvas.d.ts

@@ -1,4 +1,4 @@
-import type { DatabaseSync } from 'node:sqlite';
+import { type CanvasDb } from './db.js';
 import type { ExitIntent, Lifecycle, Mode, NodeIdentity, NodeMeta, NodeOutcomeKind, NodeRow, NodeStatus, TerminalReason } from './types.js';
 export interface OutcomeDeliveryBinding {
     actionName: string;
@@ -7,65 +7,65 @@ export interface OutcomeDeliveryBinding {
     configOrigin: string;
     payload?: unknown;
 }
-export declare function assertRunNotDeleting(db: DatabaseSync, runId: string): void;
+export declare function assertRunNotDeleting(db: CanvasDb, runId: string): Promise<void>;
 /** Create a SQL-authoritative node, then ensure its artifact directories exist. */
 export declare function createNode(meta: NodeMeta, opts?: {
     outcomeDelivery?: OutcomeDeliveryBinding;
-    withinCreate?: (db: DatabaseSync, row: NodeMeta) => void;
-}): NodeMeta;
+    withinCreate?: (db: CanvasDb, row: NodeMeta) => Promise<void> | void;
+}): Promise<NodeMeta>;
 /** The canonical node record, hydrated from SQL. Null if unknown. */
-export declare function getNode(nodeId: string): NodeMeta | null;
+export declare function getNode(nodeId: string): Promise<NodeMeta | null>;
 export type CreateRequestState = 'reserved' | 'warm_claimed' | 'complete';
 export interface CreateRequestRecord {
     requestKey: string;
     nodeId: string | null;
     state: CreateRequestState;
 }
-export declare function findCreateRequest(requestKey: string): CreateRequestRecord | null;
+export declare function findCreateRequest(requestKey: string): Promise<CreateRequestRecord | null>;
 /** Reserve an idempotency key before creation. A null node id means the request
  *  has not yet selected a cold-birth identity or claimed a warm spare. */
-export declare function reserveCreateRequest(requestKey: string): CreateRequestRecord;
+export declare function reserveCreateRequest(requestKey: string): Promise<CreateRequestRecord>;
 /** Delete keys past their recovery window; returns how many were removed. */
-export declare function pruneExpiredCreateRequests(now?: number): number;
+export declare function pruneExpiredCreateRequests(now?: number): Promise<number>;
 /** Bind a reserved key to the node it created (state `complete`). The mapping is
  *  durable so a retry after a daemon handover returns the original node. */
-export declare function recordCreateRequestNode(requestKey: string, nodeId: string): void;
+export declare function recordCreateRequestNode(requestKey: string, nodeId: string): Promise<void>;
 /** Reserve a cold-birth node id for a key (state stays `reserved`) so a retry
  *  after a daemon restart resumes the same identity instead of minting another. */
-export declare function reserveCreateRequestNode(requestKey: string, nodeId: string): void;
-export declare function completeCreateRequest(requestKey: string, nodeId: string): void;
+export declare function reserveCreateRequestNode(requestKey: string, nodeId: string): Promise<void>;
+export declare function completeCreateRequest(requestKey: string, nodeId: string): Promise<void>;
 /** Forget an unserved reservation after a pre-birth failure. A record that
  *  names a durable node is never removed by this path. */
-export declare function abandonCreateRequest(requestKey: string, nodeId: string | null): void;
+export declare function abandonCreateRequest(requestKey: string, nodeId: string | null): Promise<void>;
 export declare function canonicalSessionFile(sessionFile: string): string;
 /** Resolve the crouter node that owns one exact Pi session file. */
-export declare function findNodeBySessionFile(sessionFile: string): NodeMeta | null;
+export declare function findNodeBySessionFile(sessionFile: string): Promise<NodeMeta | null>;
 /** The indexed row (from the db) — cheap for queries that don't need full meta. */
-export declare function getRow(nodeId: string): NodeRow | null;
+export declare function getRow(nodeId: string): Promise<NodeRow | null>;
 /** The node row whose durable LOCATION pane is `pane`, or null. Lets placement
  *  resolve "who sits in this pane" by the first-class `%pane_id` handle (e.g.
  *  to adopt a caller's pane as a focus). pane is not UNIQUE in the schema, but a
  *  live pane backs at most one node, so this returns the single match. */
-export declare function getRowByPane(pane: string): NodeRow | null;
+export declare function getRowByPane(pane: string): Promise<NodeRow | null>;
 /** Nodes whose persisted spawn deadline has elapsed and that remain live work. */
-export declare function dueNodeDeadlines(nowIso: string): NodeRow[];
+export declare function dueNodeDeadlines(nowIso: string): Promise<NodeRow[]>;
 /** Write a claimed warm spare's deadline before it is handed to its caller. */
-export declare function setNodeDeadline(nodeId: string, deadlineAt: string | null): boolean;
+export declare function setNodeDeadline(nodeId: string, deadlineAt: string | null): Promise<boolean>;
 /** Shift active/idle profile deadlines by a completed profile pause duration. */
-export declare function shiftProfileNodeDeadlines(profileId: string, pauseDurationMs: number): number;
+export declare function shiftProfileNodeDeadlines(profileId: string, pauseDurationMs: number): Promise<number>;
 /** OWN-11 for a joined runtime: a `user:local` subject becomes the owner, a
  *  `user:local` grantee becomes `app:terminal` (no node has the owner as grantee),
  *  a terminal node born before the local grant mirror (no subject) gets the owner,
  *  and a reference to the dropped local grant is cleared so the node resolves the
  *  synced grant by grantee and subject. */
-export declare function rewriteLocalNodeIdentity(db: DatabaseSync, owner: string, localGrantId: string): number;
+export declare function rewriteLocalNodeIdentity(db: CanvasDb, owner: string, localGrantId: string): Promise<number>;
 type NodeUpdate = Partial<Omit<NodeIdentity, 'node_id' | 'pi_session_id' | 'pi_session_file' | 'managed_worktree'>>;
 /** Update node identity/configuration columns. Sessions and worktrees have named stores. */
-export declare function updateNode(nodeId: string, patch: NodeUpdate): NodeMeta;
+export declare function updateNode(nodeId: string, patch: NodeUpdate): Promise<NodeMeta>;
 /** Set a node's status. Atomic single-column write. */
-export declare function setStatus(nodeId: string, status: NodeStatus): void;
+export declare function setStatus(nodeId: string, status: NodeStatus): Promise<void>;
 /** Set a node's exit intent. Atomic single-column write. */
-export declare function setIntent(nodeId: string, intent: ExitIntent): void;
+export declare function setIntent(nodeId: string, intent: ExitIntent): Promise<void>;
 /** Atomically write status and/or intent, gated on an optional from-status set
  *  and/or on the row carrying no committed final_report. The lifecycle state
  *  machine (runtime/lifecycle.ts) is the one caller: it owns the legality
@@ -92,14 +92,14 @@ export declare function transitionStatusIntent(nodeId: string, fields: {
         /** Action-independent document composed before the conditional latch. */
         documentJson?: string | null;
     };
-}): number;
+}): Promise<number>;
 /** Read a node's committed-final latch pointer. Pure read, no side effect. */
-export declare function getFinalReport(nodeId: string): string | null;
+export declare function getFinalReport(nodeId: string): Promise<string | null>;
 /** CAS-clear a node's finalization latch (final_report + finalized_at) —
  *  retract-pointer-only. Gated on the exact final_report value the caller
  *  observed via getFinalReport, so a concurrent clear/refinalize can never be
  *  clobbered. Returns true iff the CAS matched and cleared. */
-export declare function clearFinalReportIfMatches(nodeId: string, expectedFinalReport: string): boolean;
+export declare function clearFinalReportIfMatches(nodeId: string, expectedFinalReport: string): Promise<boolean>;
 /** Set a node's tmux presence in one atomic write: the durable LOCATION anchor
  *  `pane` (the `%pane_id`) plus its derived cache (`tmux_session` + `window`).
  *  All three move together — `pane` joins the others inside the single UPDATE so
@@ -110,27 +110,27 @@ export declare function setPresence(nodeId: string, presence: {
     tmux_session?: string | null;
     window?: string | null;
     pane?: string | null;
-}): void;
-export declare function recordLaunch(nodeId: string, at: string): void;
-export declare function recordSettledTurn(nodeId: string, at: string): void;
-export declare function setFrozen(nodeId: string, at: string): void;
-export declare function clearFrozen(nodeId: string): void;
+}): Promise<void>;
+export declare function recordLaunch(nodeId: string, at: string): Promise<void>;
+export declare function recordSettledTurn(nodeId: string, at: string): Promise<void>;
+export declare function setFrozen(nodeId: string, at: string): Promise<void>;
+export declare function clearFrozen(nodeId: string): Promise<void>;
 export declare function recordRespawnAttempt(nodeId: string, attempt: {
     failures: number;
     notBefore: string | null;
-}): void;
-export declare function listNodesByProfile(profileId: string): NodeMeta[];
+}): Promise<void>;
+export declare function listNodesByProfile(profileId: string): Promise<NodeMeta[]>;
 /** Browse's first frame: select only fields its rows/tree use. Keep the fault and
  * turn columns for rowFrom's live fault/streaming semantics, but never hydrate
  * outcomes, placement, metadata or the (often large) telemetry activity text. */
-export declare function browseNodes(): NodeRow[];
+export declare function browseNodes(): Promise<NodeRow[]>;
 /** All rows, optionally filtered by status and terminal execution traces. Unclaimed warm spares are excluded. */
 export declare function updateNodeTelemetry(nodeId: string, telemetry: {
     tokensIn: number;
     contextTokens: number | null;
     lastActivity: string | null;
     updatedAt: string;
-}): void;
+}): Promise<void>;
 export interface GraphNodeRow {
     node_id: string;
     name: string;
@@ -148,39 +148,39 @@ export interface GraphNodeRow {
 /** Stored fields the attach graph displays, plus the two live execution cues it
  * needs. This keeps the interactive graph off the full node-summary projection
  * and its unused runtime, outcome, and placement fields. */
-export declare function graphNodes(): GraphNodeRow[];
+export declare function graphNodes(): Promise<GraphNodeRow[]>;
 export declare function listNodes(filter?: {
     status?: NodeStatus | NodeStatus[];
     withRecordedPid?: boolean;
     withRecordedPidOrFrozen?: boolean;
-}): NodeRow[];
+}): Promise<NodeRow[]>;
 /** Placement-only terminal rows for the daemon's residue pass. These columns
  * preserve lastActivityMs's timestamp inputs and the teardown event fields;
  * unlike node_rows, the nodes table needs no execution/session/fault joins. */
 export type TerminalPlacementResidue = Pick<NodeRow, 'node_id' | 'created' | 'launched_at' | 'last_settled_at' | 'finalized_at' | 'outcome_at' | 'last_activity_at' | 'pane' | 'window' | 'tmux_session'>;
 export declare const terminalPlacementResidueSql = "SELECT\n      node_id, created, launched_at, last_settled_at, finalized_at,\n      outcome_at, last_activity_at, pane, \"window\", tmux_session\n    FROM nodes INDEXED BY idx_nodes_terminal_placement_created\n    WHERE node_id NOT IN (SELECT node_id FROM warm_pool)\n      AND status IN ('done', 'canceled', 'dead')\n      AND (pane IS NOT NULL OR \"window\" IS NOT NULL OR tmux_session IS NOT NULL)\n    ORDER BY created";
-export declare function listTerminalPlacementResidue(): TerminalPlacementResidue[];
+export declare function listTerminalPlacementResidue(): Promise<TerminalPlacementResidue[]>;
 /** The daemon's complete supervision set. Live rows participate regardless of
  * PID; terminal rows participate only while they retain a PID or freeze mark. */
 export declare const nodesForSupervisionSql = "WITH candidates AS MATERIALIZED (\n    SELECT node_id FROM nodes WHERE status IN ('active', 'idle')\n    UNION\n    SELECT node_id FROM nodes INDEXED BY idx_nodes_supervision_frozen\n      WHERE frozen_at IS NOT NULL AND status IN ('done', 'canceled', 'dead')\n    UNION\n    SELECT node_id FROM executions\n      WHERE state != 'exited' AND state = 'running' AND pid IS NOT NULL\n  )\n  SELECT v.* FROM candidates c CROSS JOIN node_rows v\n  WHERE v.node_id = c.node_id\n    AND v.node_id NOT IN (SELECT node_id FROM warm_pool)\n    AND v.kind != 'human'\n    AND (v.status IN ('active', 'idle') OR (v.status IN ('done', 'canceled', 'dead') AND (v.pi_pid IS NOT NULL OR v.frozen_at IS NOT NULL)))\n  ORDER BY v.created";
-export declare function listNodesForSupervision(): NodeRow[];
+export declare function listNodesForSupervision(): Promise<NodeRow[]>;
 /** Identity-only projection of every user-visible row: the broker's report
  *  resolver needs only "does this sender exist, and what is it called", and a
  *  three-column read stays cheap against a canvas of thousands of rows where a
  *  full `listNodes()` hydration does not. */
-export declare function listNodeIdentities(): Array<Pick<NodeRow, 'node_id' | 'name' | 'created'> & {
+export declare function listNodeIdentities(): Promise<Array<Pick<NodeRow, 'node_id' | 'name' | 'created'> & {
     grantee: string;
-}>;
+}>>;
 /** Mark an already-spawned node as an unclaimed spare for `recipeKey`. Hides it
  *  from every listing until it is claimed. */
-export declare function registerWarmSpare(nodeId: string, recipeKey: string): void;
+export declare function registerWarmSpare(nodeId: string, recipeKey: string): Promise<void>;
 /** Take a parked spare OUT of the pool without claiming it — the reaper's
  *  first move. Returns false when the marker was already gone (a concurrent
  *  claim won it), which is the reaper's signal to leave that node alone: it is
  *  somebody's live conversation now, not a spare. Deleting the marker under the
  *  write lock is exactly what `claimWarmSpare` does, so the two can never both
  *  succeed on the same node. */
-export declare function unregisterWarmSpare(nodeId: string): boolean;
+export declare function unregisterWarmSpare(nodeId: string): Promise<boolean>;
 /** One parked spare, joined to the node row a claim/reap needs to judge it. */
 export interface WarmSpareRow {
     node_id: string;
@@ -194,14 +194,14 @@ export interface WarmSpareRow {
 /** Every parked spare, oldest first — what the reaper (`runtime/warm-pool.ts`
  *  `reapStaleSpares`) sweeps. Deliberately NOT filtered by liveness: judging a
  *  spare is the caller's job. */
-export declare function listWarmSpares(): WarmSpareRow[];
+export declare function listWarmSpares(): Promise<WarmSpareRow[]>;
 /** True while `nodeId` is an UNCLAIMED spare — nobody owns this conversation
  *  yet. `registerWarmSpare` runs the instant the row exists and BEFORE the
  *  broker launch, and a claim deletes the marker atomically, so this is a
  *  reliable read from inside the booting engine (the context-intro extension
  *  asks it at `session_start` to withhold bearings that would otherwise assert
  *  the spare's placeholder persona instead of its eventual claimant's). */
-export declare function isWarmSpare(nodeId: string): boolean;
+export declare function isWarmSpare(nodeId: string): Promise<boolean>;
 /** Hand out the oldest CLAIMABLE spare matching `recipeKey`, or null when the
  *  pool has none. The select+delete run inside ONE canvas write-lock
  *  transaction, so two concurrent creates can never be handed the same spare.
@@ -217,15 +217,15 @@ export declare function claimWarmSpare(recipeKey: string, created: string, opts?
     deadlineAt?: string;
     outcomeDelivery?: OutcomeDeliveryBinding;
     requestKey?: string;
-}): string | null;
+}): Promise<string | null>;
 /** How many CLAIMABLE spares are parked for `recipeKey` (the depth check a
  *  refill reads before minting). Uses the same liveness test as the claim, so a
  *  spare the claim would skip can never hold the pool at depth 1 and starve
  *  every later create of a warm start. */
-export declare function warmSpareCount(recipeKey: string): number;
+export declare function warmSpareCount(recipeKey: string): Promise<number>;
 /** Direct children of `id`, oldest first — an indexed point query
  *  (`idx_nodes_parent`) instead of a full-table `listNodes()` scan. */
-export declare function childrenOf(id: string): string[];
+export declare function childrenOf(id: string): Promise<string[]>;
 /** One lean roster row: only the `nodes` columns needed by the roster. Backs
  *  `GET /v1/canvas/roster` — the recurring attach /
  *  browser topology poll, distinct from the enriched per-row
@@ -244,14 +244,14 @@ export interface RosterRow {
 }
 /** Every node's lean roster row, oldest first — a single scan indexed by
  *  `idx_nodes_created`, with no per-row hydration or N+1 query. */
-export declare function rosterNodes(): RosterRow[];
+export declare function rosterNodes(): Promise<RosterRow[]>;
 /** Resumable ROOT conversations pinned to `cwd`, most-recently-created first.
  *  A "root" is the top of a spine (`parent IS NULL`) that is a real
  *  conversation (not a `kind:'human'` ask) and still resumable (`active`/`idle`,
  *  never a `done`/`dead`/`canceled` node). This backs the front-door
  *  `crtr -c`/`-r` resume: cwd is the key (the Claude-Code mental model — "my
  *  last session HERE"), so it never teleports across projects. */
-export declare function listResumableRoots(cwd: string): NodeRow[];
+export declare function listResumableRoots(cwd: string): Promise<NodeRow[]>;
 export * from './tree.js';
 /** The outcome of {@link withFreshTerminalGuard} — exactly one of three
  *  tagged states, never conflated:
@@ -300,7 +300,7 @@ export declare function withFreshTerminalGuard<T>(nodeId: string, isTerminal: (r
     status: NodeStatus;
     final_report: string | null;
     frozen_at: string | null;
-}) => boolean, body: () => T): TerminalGuardResult<T>;
+}) => boolean, body: () => Promise<T> | T): Promise<TerminalGuardResult<T>>;
 /** A node selected for pruning (or that would be, under --dry-run). */
 export interface PrunedNode {
     node_id: string;
@@ -315,7 +315,7 @@ export interface PruneResult {
 /** Whether a row may be removed by an automatic collection sweep. */
 export declare function isCollectible(row: NodeRow, opts?: {
     pastTtl?: boolean;
-}): boolean;
+}): Promise<boolean>;
 /** {@link deleteNode}'s result: whether it actually deleted the node. */
 export interface DeleteNodeResult {
     deleted: boolean;
@@ -325,10 +325,10 @@ export interface NodeFiles {
     nodeId: string;
     app: string | null;
 }
-export declare function nodeFiles(nodeId: string): NodeFiles;
+export declare function nodeFiles(nodeId: string): Promise<NodeFiles>;
 /** Remove every directory a deleted node owned. A conversation another node
  *  still references keeps its file, and so its conversations directory. */
-export declare function removeNodeFiles(files: NodeFiles): void;
+export declare function removeNodeFiles(files: NodeFiles): Promise<void>;
 /** Delete ONE node with what it owns ({@link deleteNodeWithOwned}) and remove its on-disk `nodes/<id>/` dir. The single-node
  *  analogue of {@link pruneNodes}, for IMMEDIATE reaping — e.g. an empty node the
  *  user closed or detached from. An open managed worktree is never deleted: its
@@ -337,10 +337,10 @@ export declare function removeNodeFiles(files: NodeFiles): void;
  *  viewer (this does not signal any process). The node row and its FK-coupled
  *  state are removed in one canvas write boundary. Best-effort dir removal
  *  follows the commit. */
-export declare function deleteNode(nodeId: string): DeleteNodeResult;
+export declare function deleteNode(nodeId: string): Promise<DeleteNodeResult>;
 /** Hard-delete a validated set of nodes in one row transaction, then remove
  *  their directories. The caller must tear down engines and viewers first. */
-export declare function deleteNodes(nodeIds: readonly string[]): string[];
+export declare function deleteNodes(nodeIds: readonly string[]): Promise<string[]>;
 /** Retention sweep: remove TERMINAL nodes (status dead | done | canceled) whose
  *  last activity ({@link lastActivityMs}) is older than `ttlDays`, bounding the
  *  otherwise-unbounded growth of node rows + dirs. Only {@link isCollectible}
@@ -358,11 +358,11 @@ export declare function deleteNodes(nodeIds: readonly string[]): string[];
  *  reports the candidate set and deletes NOTHING. */
 export declare function pruneNodes(opts: {
     ttlDays: number;
-    held: (nodeId: string) => boolean;
+    held: (nodeId: string) => Promise<boolean>;
     dryRun?: boolean;
     includeStale?: boolean;
     removeDirs?: (dirs: string[]) => void;
-}): PruneResult;
+}): Promise<PruneResult>;
 /** A node's most recent activity (epoch ms): the latest of its lifecycle
  *  timestamps (created, launched, settled, finalized, outcome, last run event)
  *  and the mtime of `job/telemetry.json`, which every turn_end rewrites. 0 when
@@ -379,6 +379,6 @@ export declare function lastActivityMs(row: Pick<NodeRow, 'node_id' | 'created'
  *  reports the candidate set and deletes NOTHING. */
 export declare function pruneToLimit(opts: {
     maxNodes: number;
-    held: (nodeId: string) => boolean;
+    held: (nodeId: string) => Promise<boolean>;
     dryRun?: boolean;
-}): PruneResult;
+}): Promise<PruneResult>;