@north-light/cli 0.3.549 → 0.3.550

package/dist/daemon/api/server.js

@@ -1 +1 @@
-var ce=Object.defineProperty;var a=(t,o)=>ce(t,"name",{value:o,configurable:!0});import{createServer as D}from"node:http";import{chmodSync as ue,existsSync as N,unlinkSync as F}from"node:fs";import{MINIMUM_RUNTIME_VERSION_HEADER as G,RUNTIME_VERSION_HEADER as z,minimumRuntimeRefusal as pe}from"../../api/runtime-version.js";import{CONTRACT_HEADER as P,CONTRACT_LEVEL as J,REQUIRED_CONTRACT_HEADER as V,contractRefusal as de}from"../../api/contract.js";import{crtrVersion as I}from"../../shared/crtr-version.js";import{apiSocketPath as me}from"../../core/canvas/paths.js";import{resolveNodeToken as fe}from"../../core/canvas/node-tokens.js";import{grantFor as ge,hasSyncedGrants as he}from"../../core/grants/mirror.js";import{readConfig as x}from"../../core/config.js";import{peerUid as Ae}from"../../native/linux.js";import{findScopedApiToken as Re,getApiToken as ye,listScopedApiTokens as ve}from"../../core/secrets.js";import{emitEvent as g}from"../../core/events/emit.js";import{envCrtrdTcp as be,envCrtrdToken as Ee}from"../../shared/env.js";import{Router as K}from"./router.js";import{handleAttachUpgrade as we,refuseUpgrade as h}from"./bridge.js";import{boundDaemonControl as Se}from"../control.js";import{attachRoutes as Te}from"./handlers/attach.js";import{peerRoutes as _e}from"../peer/handlers.js";import{bashJobRoutes as Ce}from"./handlers/bash-jobs.js";import{bashRoutes as ke}from"./handlers/bash.js";import{hookExecRoutes as Oe}from"./handlers/hook-exec.js";import{brokerOperationRoutes as Q}from"./handlers/broker-ops.js";import{brokerSignalRoutes as Ue,brokerSignalStreams as He}from"./handlers/broker-signals.js";import{brokerRecoveryRoutes as X,nodeFaultRoutes as Ne}from"./handlers/broker-recovery.js";import{canvasRoutes as ze}from"./handlers/canvas.js";import{chatInventoryRoutes as Pe}from"./handlers/chat-inventory.js";import{daemonRoutes as Ie}from"./handlers/daemon.js";import{fileRoutes as xe}from"./handlers/files.js";import{focusRoutes as Be}from"./handlers/focus.js";import{analyticsRoutes as We}from"./handlers/analytics.js";import{memoryReadsRoutes as $e}from"./handlers/memory-reads.js";import{memoryRoutes as Le}from"./handlers/memory.js";import{healthRoutes as Me}from"./handlers/health.js";import{humanRequestRoutes as je}from"./handlers/human-requests.js";import{inboxRoutes as De}from"./handlers/inbox.js";import{feedbackCommentRoutes as Fe}from"./handlers/feedback-comments.js";import{objectRoutes as Ge}from"./handlers/objects.js";import{customObjectRoutes as Je}from"./handlers/custom-objects.js";import{docRoutes as Ve}from"./handlers/docs.js";import{deliveryRoutes as Y}from"./handlers/delivery.js";import{deliveryRetryRoutes as Ke}from"./handlers/delivery-retry.js";import{packageDocRoutes as Qe}from"./handlers/package-docs.js";import{documentAccessRoutes as Xe}from"./handlers/document-access.js";import{pluginAppRoutes as Ye}from"./handlers/plugin-app-token.js";import{brokerMailRoutes as Z,messageRoutes as Ze}from"./handlers/messages.js";import{modelAuthRoutes as qe}from"./handlers/modelauth.js";import{llmRoutes as er}from"./handlers/llm.js";import{providerRoutes as rr}from"./handlers/providers.js";import{modelConfigRoutes as tr}from"./handlers/model-config.js";import{nodeRoutes as or}from"./handlers/nodes.js";import{nodeRecordRoutes as nr}from"./handlers/node-records.js";import{nodeOutcomeRoutes as ir}from"./handlers/node-outcomes.js";import{nodeEventRoutes as sr}from"./handlers/node-events.js";import{profileRoutes as lr}from"./handlers/profiles.js";import{prospectiveChatInventoryRoutes as ar}from"./handlers/prospective-chat-inventory.js";import{reportRoutes as cr}from"./handlers/reports.js";import{runRoutes as ur}from"./handlers/run-routes.js";import{reviewCommentRoutes as pr}from"./handlers/review-comments.js";import{reviewRoutes as dr}from"./handlers/reviews.js";import{subscriptionRoutes as mr}from"./handlers/subscriptions.js";import{structuredRequestRoutes as fr}from"./handlers/structured-requests.js";import{cronRoutes as gr}from"./handlers/crons.js";import{setCronRequestHandler as q}from"../cron/run-socket.js";import{worktreeRoutes as hr}from"./handlers/worktree.js";import{limitsRoutes as Ar}from"./handlers/limits.js";function Rr(t){return new K().registerAll(Me(t)).registerAll(Ie).registerAll(or).registerAll(nr).registerAll(ir).registerAll(Ke).registerAll(sr).registerAll(Ce).registerAll(ke).registerAll(Oe).registerAll(Q).registerAll(Ue).registerAll(Y).registerAll(X).registerAll(Ne).registerAll(hr).registerAll(Ar).registerAll(Z).registerAll(Ze).registerAll(cr).registerAll(ur).registerAll(fr).registerAll(Te).registerAll(ze).registerAll(We).registerAll($e).registerAll(Le).registerAll(xe).registerAll(Ge).registerAll(Je).registerAll(Ve).registerAll(Qe).registerAll(Xe).registerAll(Ye).registerAll(Be).registerAll(mr).registerAll(gr).registerAll(lr).registerAll(qe).registerAll(er).registerAll(rr).registerAll(tr).registerAll(dr).registerAll(pr).registerAll(De).registerAll(je).registerAll(Pe).registerAll(ar).registerAll(Fe).registerAll(_e)}a(Rr,"buildRouter");function yr(t,o){if(t.toUpperCase()!=="GET")return null;const l=o.split("/").filter(f=>f.length>0);if(l.length!==4||l[0]!=="v1"||l[1]!=="nodes"||l[3]!=="attach")return null;const p=l[2];return p===void 0||p===""?null:decodeURIComponent(p)}a(yr,"attachNodeId");function vr(t){const o=t.trim();if(o==="")return null;const l=o.lastIndexOf(":");if(l<0)return null;const p=o.slice(0,l),f=o.slice(l+1),m=Number(f);return!Number.isInteger(m)||m<0||m>65535?null:{host:p===""?"0.0.0.0":p,port:m}}a(vr,"parseTcp");function br(t,o){return`${t.includes(":")?`[${t}]`:t}:${o}`}a(br,"formatTcpAddress");const R={code:"unauthorized",message:"missing or invalid bearer token"},v={code:"owner_only",message:"attach is owner-only; a scoped token does not reach it"},B={class:"anonymous",app:"",node:"",run:null,uid:-1,sub:"",grant:null,client_id:null,scopes:[]},b=new WeakMap;function ee(t){return b.get(t)}a(ee,"socketPrincipal");async function re(t,o){const l=process.platform==="linux"?Ae(t.socket):null,p=t.headers.authorization;if(p===void 0)return l===null||o.has(l)?{class:"person"}:"unauthorized";if(typeof p!="string"||!p.startsWith("Bearer "))return"unauthorized";if(p.slice(7).startsWith("crtr_pub_"))return B;if(p.slice(7).startsWith(W)){const A=O(p.slice(7));return A!==void 0&&(l===null||o.has(l))?A.principal:"unauthorized"}const f=await fe(p.slice(7));if(!f||l!==null&&l!==f.uid)return"unauthorized";const m=x("user").runtime?.issuer;if(m&&!await he(m.replace(/\/$/,"")))return"runtime_starting";const C=f.grant??(await ge("app:terminal",f.sub))?.id??null;return{class:"broker",...f,grant:C}}a(re,"resolveSocketPrincipal");const W="crtr_app_";function O(t){const o=t.startsWith(W)?Re(t):void 0;return o===void 0?void 0:{principal:{class:"app",app:o.grantee,scopes:o.scopes},ceiling:o.scopes}}a(O,"appBearer");function Er(t){const o=new Map;for(const l of ve("user"))o.set(l.token,{principal:{class:"app",app:l.grantee,scopes:l.scopes},ceiling:l.scopes});return o.set(t,{principal:{class:"person"},ceiling:null}),o}a(Er,"resolveBearers");function te(t,o){const l=t.headers.authorization;if(typeof l!="string"||!l.startsWith("Bearer "))return;const p=l.slice(7);return p.startsWith(W)?O(p):o.get(p)}a(te,"authorize");function U(t){t.setHeader(z,I()),t.setHeader(P,J)}a(U,"advertiseRuntime");function T(t){t.setHeader("Access-Control-Allow-Origin","*"),t.setHeader("Access-Control-Expose-Headers",`${z}, ${P}`)}a(T,"exposeRuntimeHeaders");function oe(t,o){return(t.method??"GET").toUpperCase()!=="OPTIONS"?!1:(U(o),o.writeHead(204,{"Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":`${z}, ${P}`,"Access-Control-Allow-Headers":`authorization, content-type, ${G.toLowerCase()}, ${V.toLowerCase()}`,"Access-Control-Allow-Methods":"GET, POST, PATCH, PUT, DELETE, OPTIONS","Access-Control-Max-Age":"600"}),o.end(),!0)}a(oe,"answerPreflight");function _(t,o=!1){U(t),o&&T(t),t.writeHead(401,{"content-type":"application/json; charset=utf-8"}),t.end(JSON.stringify({error:{...R,origin:"runtime"}}))}a(_,"writeUnauthorized");function wr(t,o){t.writeHead(503,{"content-type":"application/json; charset=utf-8"}),t.end(JSON.stringify({error:{code:"startup_blocked",message:o,origin:"runtime"}}))}a(wr,"writeStartupBlocked");function ne(t){return new Promise(o=>{try{t.closeAllConnections()}catch{}t.close(()=>o())})}a(ne,"closeServer");function Bt(t={}){let o=null;const l=Rr(()=>o),p=new K().registerAll(Q).registerAll(Y).registerAll(X).registerAll(Z),f=a((e,r)=>{const n=Se()?.startupBlock()??null;return n===null||e==="GET"&&(r==="/healthz"||r==="/v1/status"||r==="/v1/ready")||e==="POST"&&(r==="/v1/daemon/migrate"||r==="/v1/daemon/admit")||n.phase==="recovering"&&p.match(e,r)!==null?null:n},"startupBlockFor"),m=me(),C=new Set([process.getuid?.()??0,...x("user").runtime?.person_uids??[]]),A=a((e,r,n)=>{U(r);const c=a(u=>Array.isArray(u)?u[0]:u,"first"),E=c(e.headers[G.toLowerCase()]),i=pe(E,I())??de(c(e.headers[V.toLowerCase()]),J,{legacyMinimum:E,runtimeVersion:I()});if(i!==null){r.writeHead(i.status,{"content-type":"application/json; charset=utf-8"}),r.end(JSON.stringify({error:{code:i.code,message:i.message,type:"invalid_request_error",origin:"runtime",retryable:!1,..."param"in i?{param:i.param}:{details:i.details}}}));return}const s=a(u=>{const w=ee(e);g({event:"api.request.failed",level:"error",...w?.class==="broker"?{node_id:w.node}:{},error:u instanceof Error?u:new Error(String(u))});try{r.headersSent||r.writeHead(500,{"content-type":"application/json; charset=utf-8"}),r.end(JSON.stringify({error:{code:"internal",message:"internal error",origin:"runtime"}}))}catch{}},"internalFailure");let d;try{d=new URL(e.url??"/","http://127.0.0.1")}catch{try{r.writeHead(400,{"content-type":"application/json; charset=utf-8"}),r.end(JSON.stringify({error:{code:"invalid_request",message:"request URL is invalid",origin:"runtime"}}))}catch{}return}try{const u=f((e.method??"GET").toUpperCase(),d.pathname);if(u!==null){wr(r,u.message);return}l.handle(e,r,n,ee(e)??{class:"person"}).catch(s)}catch(u){s(u)}},"onRequest"),H=a((e,r,n)=>{r.on("error",()=>{});try{const c=new URL(e.url??"/","http://127.0.0.1"),E=f((e.method??"GET").toUpperCase(),c.pathname);if(E!==null){h(r,503,"Service Unavailable","startup_blocked",E.message);return}const i=yr(e.method??"GET",c.pathname);if(i===null){r.destroy();return}we(e,r,n,i).catch(()=>{try{r.destroy()}catch{}})}catch{try{r.destroy()}catch{}}},"onUpgrade"),ie=a(e=>{e.on("error",r=>{g({event:"api.server.failed",level:"error",error:r})})},"bindErrorHandler"),se=a(async(e,r)=>{try{const n=await re(e,C);if(n==="unauthorized"){g({event:"api.principal.denied",level:"warn",fields:{method:e.method}}),_(r);return}if(n==="runtime_starting"){U(r),r.writeHead(503,{"content-type":"application/json; charset=utf-8"}),r.end(JSON.stringify({error:{code:"runtime_starting",message:"grant sync is not ready",type:"server_error",origin:"runtime",retryable:!0}}));return}b.set(e,n),n.class==="broker"&&g({event:"api.request.principal",level:n.app==="app:terminal"?"debug":"info",node_id:n.node,fields:{principal:`${n.app} node:${n.node}`,method:e.method,path:e.url}}),A(e,r,n.class==="app"?n.scopes:null)}catch(n){g({event:"api.principal.failed",level:"error",error:n instanceof Error?n:new Error(String(n))}),_(r)}},"onSocketRequest"),S=D((e,r)=>{se(e,r).catch(n=>g({event:"api.principal.failed",level:"error",error:n instanceof Error?n:new Error(String(n))}))}),le=a(async(e,r,n)=>{try{const c=await re(e,C);if(c==="unauthorized"||c==="runtime_starting"){c==="unauthorized"&&g({event:"api.principal.denied",level:"warn",fields:{method:e.method}}),h(r,c==="unauthorized"?401:503,"Unauthorized",c,"socket principal unavailable");return}if(c.class!=="person"&&c.class!=="broker"){h(r,403,"Forbidden",v.code,v.message);return}b.set(e,c),H(e,r,n)}catch(c){g({event:"api.principal.failed",level:"error",error:c instanceof Error?c:new Error(String(c))}),h(r,401,"Unauthorized",R.code,R.message)}},"onSocketUpgrade");S.on("upgrade",(e,r,n)=>{le(e,r,n).catch(c=>g({event:"api.principal.failed",level:"error",error:c instanceof Error?c:new Error(String(c))}))}),q((e,r,n)=>{b.set(e,n),A(e,r,null)});let $=!1,L,M;const ae=new Promise((e,r)=>{L=e,M=r});S.once("listening",()=>{$=!0,L()}),S.on("error",e=>{g({event:"api.server.failed",level:"error",error:e}),$||M(e)});try{N(m)&&F(m)}catch{}S.listen(m,()=>{try{ue(m,process.platform==="linux"&&N("/run/crtr/launcher.sock")?438:384)}catch(e){g({event:"api.socket.chmod_failed",level:"error",error:e instanceof Error?e:new Error(String(e))})}});let y;const k=t.tcp??be()??x("user").api.tcp;if(k!==void 0&&k!==""){const e=vr(k);if(e===null)g({event:"api.tcp.invalid",level:"error",error:new Error(`invalid CRTRD_TCP/--tcp spec: ${k}`)});else{const r=t.token??Ee()??ye("user"),n=r===void 0?void 0:Er(r),c=n===void 0?(i,s)=>{if(oe(i,s))return;const d=i.headers.authorization;if(typeof d=="string"&&d.startsWith("Bearer crtr_pub_"))b.set(i,B),T(s);else if(i.headers.origin!==void 0){_(s,!0);return}else if(d!==void 0){const w=typeof d=="string"&&d.startsWith("Bearer ")?O(d.slice(7)):void 0;if(w===void 0){_(s,!0);return}b.set(i,w.principal),T(s),A(i,s,w.ceiling);return}A(i,s,null)}:(i,s)=>{if(oe(i,s))return;const d=te(i,n);if(d===void 0&&i.headers.authorization?.startsWith("Bearer crtr_pub_")){b.set(i,B),T(s),A(i,s,null);return}if(d===void 0){_(s,!0);return}b.set(i,d.principal),T(s),A(i,s,d.ceiling)},E=n===void 0?(i,s,d)=>{if(i.headers.origin!==void 0){h(s,401,"Unauthorized",R.code,R.message);return}const u=i.headers.authorization;if(u!==void 0){if(typeof u=="string"&&u.startsWith("Bearer crtr_pub_")){h(s,403,"Forbidden",v.code,v.message);return}(typeof u=="string"&&u.startsWith("Bearer ")?O(u.slice(7)):void 0)===void 0?h(s,401,"Unauthorized",R.code,R.message):h(s,403,"Forbidden",v.code,v.message);return}H(i,s,d)}:(i,s,d)=>{const u=te(i,n);if(u===void 0){h(s,401,"Unauthorized",R.code,R.message);return}if(u.ceiling!==null){h(s,403,"Forbidden",v.code,v.message);return}H(i,s,d)};y=D(c),y.on("upgrade",E),ie(y),y.once("listening",()=>{const i=y?.address();if(i!==null&&typeof i=="object"){const{address:s,port:d}=i;o=br(s,d)}}),y.listen(e.port,e.host)}}let j=!1;return{ready:ae,tcpAddress:a(()=>o,"tcpAddress"),close:a(async()=>{if(!j){j=!0,q(null),He.close(),await Promise.all([ne(S),y!==void 0?ne(y):Promise.resolve()]);try{N(m)&&F(m)}catch{}}},"close")}}a(Bt,"createApiServer");export{Rr as buildRouter,Bt as createApiServer,ee as socketPrincipal};
+var pe=Object.defineProperty;var a=(t,i)=>pe(t,"name",{value:i,configurable:!0});import{createServer as F}from"node:http";import{chmodSync as de,existsSync as H,unlinkSync as G}from"node:fs";import{MINIMUM_RUNTIME_VERSION_HEADER as J,RUNTIME_VERSION_HEADER as P,minimumRuntimeRefusal as me}from"../../api/runtime-version.js";import{CONTRACT_HEADER as I,CONTRACT_LEVEL as V,REQUIRED_CONTRACT_HEADER as K,contractRefusal as fe}from"../../api/contract.js";import{crtrVersion as x}from"../../shared/crtr-version.js";import{apiSocketPath as ge}from"../../core/canvas/paths.js";import{resolveNodeToken as he}from"../../core/canvas/node-tokens.js";import{grantFor as Ae,hasSyncedGrants as Re}from"../../core/grants/mirror.js";import{readConfig as B}from"../../core/config.js";import{peerUid as ye}from"../../native/linux.js";import{findScopedApiToken as ve,getApiToken as be,listScopedApiTokens as we}from"../../core/secrets.js";import{emitEvent as g}from"../../core/events/emit.js";import{envCrtrdTcp as Ee,envCrtrdToken as _e}from"../../shared/env.js";import{Router as Q}from"./router.js";import{handleAttachUpgrade as Se,refuseUpgrade as h}from"./bridge.js";import{boundDaemonControl as Te}from"../control.js";import{attachRoutes as Ce,mayAttachNode as X}from"./handlers/attach.js";import{peerRoutes as ke}from"../peer/handlers.js";import{bashJobRoutes as Oe}from"./handlers/bash-jobs.js";import{bashRoutes as Ue}from"./handlers/bash.js";import{hookExecRoutes as Ne}from"./handlers/hook-exec.js";import{brokerOperationRoutes as Y}from"./handlers/broker-ops.js";import{brokerSignalRoutes as ze,brokerSignalStreams as He}from"./handlers/broker-signals.js";import{brokerRecoveryRoutes as Z,nodeFaultRoutes as Pe}from"./handlers/broker-recovery.js";import{canvasRoutes as Ie}from"./handlers/canvas.js";import{chatInventoryRoutes as xe}from"./handlers/chat-inventory.js";import{daemonRoutes as Be}from"./handlers/daemon.js";import{fileRoutes as $e}from"./handlers/files.js";import{focusRoutes as We}from"./handlers/focus.js";import{analyticsRoutes as Le}from"./handlers/analytics.js";import{memoryReadsRoutes as Me}from"./handlers/memory-reads.js";import{memoryRoutes as je}from"./handlers/memory.js";import{healthRoutes as De}from"./handlers/health.js";import{humanRequestRoutes as Fe}from"./handlers/human-requests.js";import{inboxRoutes as Ge}from"./handlers/inbox.js";import{feedbackCommentRoutes as Je}from"./handlers/feedback-comments.js";import{objectRoutes as Ve}from"./handlers/objects.js";import{shareRoutes as Ke}from"./handlers/shares.js";import{customObjectRoutes as Qe}from"./handlers/custom-objects.js";import{docRoutes as Xe}from"./handlers/docs.js";import{deliveryRoutes as q}from"./handlers/delivery.js";import{deliveryRetryRoutes as Ye}from"./handlers/delivery-retry.js";import{packageDocRoutes as Ze}from"./handlers/package-docs.js";import{documentAccessRoutes as qe}from"./handlers/document-access.js";import{pluginAppRoutes as er}from"./handlers/plugin-app-token.js";import{brokerMailRoutes as ee,messageRoutes as rr}from"./handlers/messages.js";import{modelAuthRoutes as tr}from"./handlers/modelauth.js";import{llmRoutes as or}from"./handlers/llm.js";import{providerRoutes as nr}from"./handlers/providers.js";import{modelConfigRoutes as ir}from"./handlers/model-config.js";import{nodeRoutes as sr}from"./handlers/nodes.js";import{nodeRecordRoutes as lr}from"./handlers/node-records.js";import{nodeOutcomeRoutes as ar}from"./handlers/node-outcomes.js";import{nodeEventRoutes as cr}from"./handlers/node-events.js";import{profileRoutes as ur}from"./handlers/profiles.js";import{prospectiveChatInventoryRoutes as pr}from"./handlers/prospective-chat-inventory.js";import{reportRoutes as dr}from"./handlers/reports.js";import{runRoutes as mr}from"./handlers/run-routes.js";import{reviewCommentRoutes as fr}from"./handlers/review-comments.js";import{reviewRoutes as gr}from"./handlers/reviews.js";import{subscriptionRoutes as hr}from"./handlers/subscriptions.js";import{structuredRequestRoutes as Ar}from"./handlers/structured-requests.js";import{cronRoutes as Rr}from"./handlers/crons.js";import{setCronRequestHandler as re}from"../cron/run-socket.js";import{worktreeRoutes as yr}from"./handlers/worktree.js";import{limitsRoutes as vr}from"./handlers/limits.js";function br(t){return new Q().registerAll(De(t)).registerAll(Be).registerAll(Ke).registerAll(sr).registerAll(lr).registerAll(ar).registerAll(Ye).registerAll(cr).registerAll(Oe).registerAll(Ue).registerAll(Ne).registerAll(Y).registerAll(ze).registerAll(q).registerAll(Z).registerAll(Pe).registerAll(yr).registerAll(vr).registerAll(ee).registerAll(rr).registerAll(dr).registerAll(mr).registerAll(Ar).registerAll(Ce).registerAll(Ie).registerAll(Le).registerAll(Me).registerAll(je).registerAll($e).registerAll(Ve).registerAll(Qe).registerAll(Xe).registerAll(Ze).registerAll(qe).registerAll(er).registerAll(We).registerAll(hr).registerAll(Rr).registerAll(ur).registerAll(tr).registerAll(or).registerAll(nr).registerAll(ir).registerAll(gr).registerAll(fr).registerAll(Ge).registerAll(Fe).registerAll(xe).registerAll(pr).registerAll(Je).registerAll(ke)}a(br,"buildRouter");function wr(t,i){if(t.toUpperCase()!=="GET")return null;const c=i.split("/").filter(f=>f.length>0);if(c.length!==4||c[0]!=="v1"||c[1]!=="nodes"||c[3]!=="attach")return null;const d=c[2];return d===void 0||d===""?null:decodeURIComponent(d)}a(wr,"attachNodeId");function Er(t){const i=t.trim();if(i==="")return null;const c=i.lastIndexOf(":");if(c<0)return null;const d=i.slice(0,c),f=i.slice(c+1),m=Number(f);return!Number.isInteger(m)||m<0||m>65535?null:{host:d===""?"0.0.0.0":d,port:m}}a(Er,"parseTcp");function _r(t,i){return`${t.includes(":")?`[${t}]`:t}:${i}`}a(_r,"formatTcpAddress");const R={code:"unauthorized",message:"missing or invalid bearer token"},v={code:"owner_only",message:"attach is owner-only; a scoped token does not reach it"},$={class:"anonymous",app:"",node:"",run:null,uid:-1,sub:"",grant:null,client_id:null,scopes:[]},b=new WeakMap;function O(t){return b.get(t)}a(O,"socketPrincipal");async function te(t,i){const c=process.platform==="linux"?ye(t.socket):null,d=t.headers.authorization;if(d===void 0)return c===null||i.has(c)?{class:"person"}:"unauthorized";if(typeof d!="string"||!d.startsWith("Bearer "))return"unauthorized";if(d.slice(7).startsWith("crtr_pub_"))return $;if(d.slice(7).startsWith(W)){const A=U(d.slice(7));return A!==void 0&&(c===null||i.has(c))?A.principal:"unauthorized"}const f=await he(d.slice(7));if(!f||c!==null&&c!==f.uid)return"unauthorized";const m=B("user").runtime?.issuer;if(m&&!await Re(m.replace(/\/$/,"")))return"runtime_starting";const C=f.grant??(await Ae("app:terminal",f.sub))?.id??null;return{class:"broker",...f,grant:C}}a(te,"resolveSocketPrincipal");const W="crtr_app_";function U(t){const i=t.startsWith(W)?ve(t):void 0;return i===void 0?void 0:{principal:{class:"app",app:i.grantee,scopes:i.scopes},ceiling:i.scopes}}a(U,"appBearer");function Sr(t){const i=new Map;for(const c of we("user"))i.set(c.token,{principal:{class:"app",app:c.grantee,scopes:c.scopes},ceiling:c.scopes});return i.set(t,{principal:{class:"person"},ceiling:null}),i}a(Sr,"resolveBearers");function oe(t,i){const c=t.headers.authorization;if(typeof c!="string"||!c.startsWith("Bearer "))return;const d=c.slice(7);return d.startsWith(W)?U(d):i.get(d)}a(oe,"authorize");function N(t){t.setHeader(P,x()),t.setHeader(I,V)}a(N,"advertiseRuntime");function S(t){t.setHeader("Access-Control-Allow-Origin","*"),t.setHeader("Access-Control-Expose-Headers",`${P}, ${I}`)}a(S,"exposeRuntimeHeaders");function ne(t,i){return(t.method??"GET").toUpperCase()!=="OPTIONS"?!1:(N(i),i.writeHead(204,{"Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":`${P}, ${I}`,"Access-Control-Allow-Headers":`authorization, content-type, ${J.toLowerCase()}, ${K.toLowerCase()}`,"Access-Control-Allow-Methods":"GET, POST, PATCH, PUT, DELETE, OPTIONS","Access-Control-Max-Age":"600"}),i.end(),!0)}a(ne,"answerPreflight");function T(t,i=!1){N(t),i&&S(t),t.writeHead(401,{"content-type":"application/json; charset=utf-8"}),t.end(JSON.stringify({error:{...R,origin:"runtime"}}))}a(T,"writeUnauthorized");function Tr(t,i){t.writeHead(503,{"content-type":"application/json; charset=utf-8"}),t.end(JSON.stringify({error:{code:"startup_blocked",message:i,origin:"runtime"}}))}a(Tr,"writeStartupBlocked");function ie(t){return new Promise(i=>{try{t.closeAllConnections()}catch{}t.close(()=>i())})}a(ie,"closeServer");function Mt(t={}){let i=null;const c=br(()=>i),d=new Q().registerAll(Y).registerAll(q).registerAll(Z).registerAll(ee),f=a((e,r)=>{const o=Te()?.startupBlock()??null;return o===null||e==="GET"&&(r==="/healthz"||r==="/v1/status"||r==="/v1/ready")||e==="POST"&&(r==="/v1/daemon/migrate"||r==="/v1/daemon/admit")||o.phase==="recovering"&&d.match(e,r)!==null?null:o},"startupBlockFor"),m=ge(),C=new Set([process.getuid?.()??0,...B("user").runtime?.person_uids??[]]),A=a((e,r,o)=>{N(r);const l=a(u=>Array.isArray(u)?u[0]:u,"first"),w=l(e.headers[J.toLowerCase()]),n=me(w,x())??fe(l(e.headers[K.toLowerCase()]),V,{legacyMinimum:w,runtimeVersion:x()});if(n!==null){r.writeHead(n.status,{"content-type":"application/json; charset=utf-8"}),r.end(JSON.stringify({error:{code:n.code,message:n.message,type:"invalid_request_error",origin:"runtime",retryable:!1,..."param"in n?{param:n.param}:{details:n.details}}}));return}const s=a(u=>{const E=O(e);g({event:"api.request.failed",level:"error",...E?.class==="broker"?{node_id:E.node}:{},error:u instanceof Error?u:new Error(String(u))});try{r.headersSent||r.writeHead(500,{"content-type":"application/json; charset=utf-8"}),r.end(JSON.stringify({error:{code:"internal",message:"internal error",origin:"runtime"}}))}catch{}},"internalFailure");let p;try{p=new URL(e.url??"/","http://127.0.0.1")}catch{try{r.writeHead(400,{"content-type":"application/json; charset=utf-8"}),r.end(JSON.stringify({error:{code:"invalid_request",message:"request URL is invalid",origin:"runtime"}}))}catch{}return}try{const u=f((e.method??"GET").toUpperCase(),p.pathname);if(u!==null){Tr(r,u.message);return}c.handle(e,r,o,O(e)??{class:"person"}).catch(s)}catch(u){s(u)}},"onRequest"),se=a(async(e,r,o)=>{const l=O(e);return l===void 0||l.class==="person"||await X(l,"either",o)?!0:(h(r,404,"Not Found","node_not_found",`no node ${o}`),!1)},"authorizeAttachUpgrade"),z=a((e,r,o)=>{r.on("error",()=>{});try{const l=new URL(e.url??"/","http://127.0.0.1"),w=f((e.method??"GET").toUpperCase(),l.pathname);if(w!==null){h(r,503,"Service Unavailable","startup_blocked",w.message);return}const n=wr(e.method??"GET",l.pathname);if(n===null){r.destroy();return}se(e,r,n).then(s=>s?Se(e,r,o,n,async p=>{const u=O(e);return u===void 0||u.class==="person"||await X(u,p,n)}):void 0).catch(()=>{try{r.destroy()}catch{}})}catch{try{r.destroy()}catch{}}},"onUpgrade"),le=a(e=>{e.on("error",r=>{g({event:"api.server.failed",level:"error",error:r})})},"bindErrorHandler"),ae=a(async(e,r)=>{try{const o=await te(e,C);if(o==="unauthorized"){g({event:"api.principal.denied",level:"warn",fields:{method:e.method}}),T(r);return}if(o==="runtime_starting"){N(r),r.writeHead(503,{"content-type":"application/json; charset=utf-8"}),r.end(JSON.stringify({error:{code:"runtime_starting",message:"grant sync is not ready",type:"server_error",origin:"runtime",retryable:!0}}));return}b.set(e,o),o.class==="broker"&&g({event:"api.request.principal",level:o.app==="app:terminal"?"debug":"info",node_id:o.node,fields:{principal:`${o.app} node:${o.node}`,method:e.method,path:e.url}}),A(e,r,o.class==="app"?o.scopes:null)}catch(o){g({event:"api.principal.failed",level:"error",error:o instanceof Error?o:new Error(String(o))}),T(r)}},"onSocketRequest"),_=F((e,r)=>{ae(e,r).catch(o=>g({event:"api.principal.failed",level:"error",error:o instanceof Error?o:new Error(String(o))}))}),ce=a(async(e,r,o)=>{try{const l=await te(e,C);if(l==="unauthorized"||l==="runtime_starting"){l==="unauthorized"&&g({event:"api.principal.denied",level:"warn",fields:{method:e.method}}),h(r,l==="unauthorized"?401:503,"Unauthorized",l,"socket principal unavailable");return}if(l.class!=="person"&&l.class!=="broker"){h(r,403,"Forbidden",v.code,v.message);return}b.set(e,l),z(e,r,o)}catch(l){g({event:"api.principal.failed",level:"error",error:l instanceof Error?l:new Error(String(l))}),h(r,401,"Unauthorized",R.code,R.message)}},"onSocketUpgrade");_.on("upgrade",(e,r,o)=>{ce(e,r,o).catch(l=>g({event:"api.principal.failed",level:"error",error:l instanceof Error?l:new Error(String(l))}))}),re((e,r,o)=>{b.set(e,o),A(e,r,null)});let L=!1,M,j;const ue=new Promise((e,r)=>{M=e,j=r});_.once("listening",()=>{L=!0,M()}),_.on("error",e=>{g({event:"api.server.failed",level:"error",error:e}),L||j(e)});try{H(m)&&G(m)}catch{}_.listen(m,()=>{try{de(m,process.platform==="linux"&&H("/run/crtr/launcher.sock")?438:384)}catch(e){g({event:"api.socket.chmod_failed",level:"error",error:e instanceof Error?e:new Error(String(e))})}});let y;const k=t.tcp??Ee()??B("user").api.tcp;if(k!==void 0&&k!==""){const e=Er(k);if(e===null)g({event:"api.tcp.invalid",level:"error",error:new Error(`invalid CRTRD_TCP/--tcp spec: ${k}`)});else{const r=t.token??_e()??be("user"),o=r===void 0?void 0:Sr(r),l=o===void 0?(n,s)=>{if(ne(n,s))return;const p=n.headers.authorization;if(typeof p=="string"&&p.startsWith("Bearer crtr_pub_"))b.set(n,$),S(s);else if(n.headers.origin!==void 0){T(s,!0);return}else if(p!==void 0){const E=typeof p=="string"&&p.startsWith("Bearer ")?U(p.slice(7)):void 0;if(E===void 0){T(s,!0);return}b.set(n,E.principal),S(s),A(n,s,E.ceiling);return}A(n,s,null)}:(n,s)=>{if(ne(n,s))return;const p=oe(n,o);if(p===void 0&&n.headers.authorization?.startsWith("Bearer crtr_pub_")){b.set(n,$),S(s),A(n,s,null);return}if(p===void 0){T(s,!0);return}b.set(n,p.principal),S(s),A(n,s,p.ceiling)},w=o===void 0?(n,s,p)=>{if(n.headers.origin!==void 0){h(s,401,"Unauthorized",R.code,R.message);return}const u=n.headers.authorization;if(u!==void 0){if(typeof u=="string"&&u.startsWith("Bearer crtr_pub_")){h(s,403,"Forbidden",v.code,v.message);return}(typeof u=="string"&&u.startsWith("Bearer ")?U(u.slice(7)):void 0)===void 0?h(s,401,"Unauthorized",R.code,R.message):h(s,403,"Forbidden",v.code,v.message);return}z(n,s,p)}:(n,s,p)=>{const u=oe(n,o);if(u===void 0){h(s,401,"Unauthorized",R.code,R.message);return}if(u.ceiling!==null){h(s,403,"Forbidden",v.code,v.message);return}z(n,s,p)};y=F(l),y.on("upgrade",w),le(y),y.once("listening",()=>{const n=y?.address();if(n!==null&&typeof n=="object"){const{address:s,port:p}=n;i=_r(s,p)}}),y.listen(e.port,e.host)}}let D=!1;return{ready:ue,tcpAddress:a(()=>i,"tcpAddress"),close:a(async()=>{if(!D){D=!0,re(null),He.close(),await Promise.all([ie(_),y!==void 0?ie(y):Promise.resolve()]);try{H(m)&&G(m)}catch{}}},"close")}}a(Mt,"createApiServer");export{br as buildRouter,Mt as createApiServer,O as socketPrincipal};

package/dist/daemon/crtrd.js

@@ -1,17 +1,17 @@
-var $e=Object.defineProperty;var a=(n,s)=>$e(n,"name",{value:s,configurable:!0});import{startPeerOutbox as Ae}from"./peer/outbox.js";import{reportMachineStatus as Me}from"../core/peer/directory.js";import{createPeerRelay as Ne}from"./peer/relay-service.js";import{writeFileSync as Fe,readFileSync as Ge,rmSync as Oe,mkdirSync as ae,existsSync as P,chmodSync as Be}from"node:fs";import{createServer as se}from"node:http";import{dirname as He}from"node:path";import{envCrtrdTcp as je,envDocumentPort as qe}from"../shared/env.js";import{serveCanvasConversationStore as ze}from"../core/canvas/sessions.js";import{pollRunObservers as We}from"./runs/observer.js";import{randomBytes as ce}from"node:crypto";import{apiSocketPath as Ue,crtrHome as Ke}from"../core/canvas/paths.js";import{activeAppUsers as Je}from"../core/spaces/users.js";import{ensureAppSpace as Ve,ensureUserFiles as Qe}from"../core/spaces/space.js";import{LAUNCHER_SOCKET as x}from"../launcher/spec.js";import{launcherRequest as C}from"../launcher/client.js";import{installLauncherEventSink as Ye}from"./launcher-events.js";import{initializeEmptyLayout as Xe,layoutNeedsMigration as Ze,socketDir as de}from"../core/layout.js";import{migrateLooseKeys as er}from"../core/layout-migrate/loose-keys.js";import{relocateProfileFolders as rr}from"../core/profiles/relocate.js";import{getNode as tr,listNodesForSupervision as le,listParkedResidentsWithWakeMail as nr,setFrozen as pe}from"../core/canvas/index.js";import{createApiServer as or}from"./api/server.js";import{createDocumentListener as ir}from"./api/document-listener.js";import{documentSecret as ar}from"./api/document-secret.js";import{createAppListener as sr}from"./api/app-listener.js";import{registerMachineEnvironment as cr}from"../core/environments.js";import{resolvePerson as dr,retireLocalPerson as lr,setPersonId as pr}from"../core/canvas/person.js";import{onRunEventAppended as mr}from"../core/runs/events.js";import{runNotices as fr}from"./run-notices.js";import{createGrantSync as ur,GRANT_SYNC_INTERVAL_S as wr}from"../core/grants/sync.js";import{runRemovalCascades as hr}from"../core/grants/remove.js";import{sweepSandboxes as vr}from"../core/grants/on-sync.js";import{rebuildCronExecutions as gr}from"./cron/run-socket.js";import{hasSyncedGrants as yr}from"../core/grants/mirror.js";import{readConfig as me}from"../core/config.js";import{reconcileUndeliveredTickets as Sr}from"./human/sweep.js";import{resetHandedOffDeliveries as _r}from"../core/canvas/deliveries.js";import{resetHandedOffDaemonActions as br}from"../core/canvas/daemon-actions.js";import{sweepReviews as kr}from"./review/sweep.js";import{pidfilePath as U}from"./pidfile.js";import{rendererWarning as Pr}from"../core/runtime/package-health.js";import{DEFAULT_INTERVAL_MS as Er}from"./supervise-cadence.js";import{createResumeDetector as Rr}from"./resume-detector.js";import{setFatalFaultAnnouncer as Ir}from"../core/canvas/recovery.js";import{BrokerSupervisionReconciler as xr}from"./reconcilers/broker-supervision.js";import{ControllerDeathReconciler as Dr}from"./reconcilers/controller-death.js";import{NodeLifecycleReconciler as Tr}from"./reconcilers/node-lifecycle/tick.js";import{NodeDeadlineReconciler as Cr}from"./reconcilers/node-deadline.js";import{CronLaneReconciler as Lr}from"./reconcilers/cron-lane.js";import{DeliveryLaneReconciler as $r}from"./reconcilers/delivery-lane.js";import{ActionLaneReconciler as Ar}from"./reconcilers/action-lane.js";import{endLiveExecution as Mr,migrateLegacyExecutionIdentities as Nr}from"../core/canvas/executions.js";import{revokePriorEpochNodeTokens as Fr}from"../core/canvas/node-tokens.js";import{PendingReviewSubmitReconciler as Gr}from"./reconcilers/pending-review-submit.js";import{StorageMaintenanceReconciler as Or}from"./reconcilers/storage-maintenance.js";import{StorageDueWorkReconciler as Br}from"./reconcilers/storage-due-work.js";import{BashDeadlineReconciler as Hr}from"./reconcilers/bash-deadline.js";import{FaultRetryBackstopReconciler as jr}from"./reconcilers/fault-retry-backstop.js";import{StructuredRequestReconciler as qr}from"./reconcilers/structured-request-lane.js";import{reconcileStructuredRequestSidecars as zr}from"./structured-requests/boot.js";import{captureLivenessSnapshot as fe,capturePidCommand as Wr,captureTeardownSnapshot as ue,isPidAlive as Ur,isAnyPidAlive as we,killProcessTreePids as he}from"../core/canvas/pid.js";import{bindFleet as Kr,boundFleet as Jr}from"../core/runtime/fleet.js";import{bindDaemonControl as Vr,clearDaemonControl as Qr}from"./control.js";import{execDaemon as Yr,spawnDaemon as Xr}from"./manage.js";import{reconcileAndMigrateBoot as Zr}from"../core/canvas/boot.js";import{resolveInstallId as et}from"../core/canvas/install-id.js";import{setInstallId as rt}from"../core/runtime/nodes.js";import{claimDaemonOwnership as ve,daemonOwnershipClaimed as tt,releaseDaemonOwnership as ge}from"../core/canvas/daemon-owner.js";import{canvasDatabaseUrl as nt,closeAllDbs as K,openDb as ye,withCanvasWrite as ot}from"../core/canvas/db.js";import{importSqliteCanvasIfPresent as it}from"../core/canvas/import-sqlite.js";import{ensurePostgres as at,ensurePostgresHealthy as st,stopPostgres as ct,withPostgresStartLock as dt}from"./postgres/index.js";import{brokerSignalBus as J}from"./broker-signals/bus.js";import{brokerSignalStreams as lt}from"./api/handlers/broker-signals.js";import{reconcilePackages as pt}from"../core/graph/package-reconcile.js";import{startRepoSync as mt}from"../core/graph/repo-sync/index.js";import{prewarmRecentRecipes as ft,reapStaleSpares as ut}from"../core/runtime/warm-pool.js";import{DaemonFleet as wt}from"./fleet.js";import{BOOT_MIGRATIONS as ht}from"./boot-migrations.js";import{emitEvent as m}from"../core/events/emit.js";import{operationIdContext as _}from"../core/events/operation-id.js";import{bindDaemonEventSource as vt}from"../core/events/source.js";import{activateCanvasImport as gt,MigrationBlockedError as yt,runForcedCanvasImport as St}from"../migrations/activation.js";import{convertLegacyProviderStore as _t,convertLegacyScopedStore as bt}from"../core/scoped-state/migrate.js";import{userScopeRoot as kt}from"../core/scope.js";import{secretsDir as Pt}from"../core/layout.js";function V(n,s){return n.includes(` --canvas-home ${s} `)}a(V,"brokerCommandDeclaresCanvasHome");function Q(n){return/ --epoch (\S+) /.exec(n)?.[1]??null}a(Q,"brokerCommandEpoch");const Et=5e3,Se=150;async function Rt(n){const s=fe();if(s===null)throw m({level:"error",event:"daemon.census.snapshot_failed",fields:{invariant:"prior-epoch brokers are reaped before readiness"}}),new Error("prior-epoch broker census could not capture the process table");const l=Ke(),w=[];for(const[c,f]of s.processes){const S=f.command;if(f.zombie||!S.includes("broker-cli.js")||!V(S,l)||Q(S)===n)continue;const k=S.trim().split(/\s+/).at(-1)??"";k===""||k.endsWith("broker-cli.js")||w.push({pid:c,nodeId:k})}let d=0;const t=[];for(const c of w){const f=Wr(c.pid);if(f===null||!f.includes("broker-cli.js")||!V(f,l)||Q(f)===n||f.trim().split(/\s+/).at(-1)!==c.nodeId)continue;const S=ue(c.pid,null);if(!S.reused){try{process.platform==="linux"&&P(x)?await C({operation:"stop",pid:c.pid}):process.kill(c.pid,"SIGTERM")}catch{continue}d++,t.push({pid:c.pid,snap:S})}}const g=Date.now()+Et;for(;Date.now()<g&&t.some(c=>we(c.snap.tree.length>0?c.snap.tree:[c.pid]));)await new Promise(c=>setTimeout(c,Se));let h=0;for(const c of t){const f=c.snap.tree.length>0?c.snap.tree:[c.pid];we(f)&&(process.platform==="linux"&&P(x)?await C({operation:"stop",pid:c.pid}):he(f,"SIGKILL",c.snap.identities),h++)}h>0&&await new Promise(c=>setTimeout(c,Se));const u=fe();if(u===null)throw m({level:"error",event:"daemon.census.snapshot_failed",fields:{invariant:"prior-epoch brokers are reaped before readiness",stage:"final"}}),new Error("prior-epoch broker census could not capture the final process table");const i=[];for(const[c,f]of u.processes){const S=f.command;f.zombie||!S.includes("broker-cli.js")||V(S,l)&&Q(S)!==n&&i.push(c)}if(i.length>0)throw new Error(`prior-epoch broker census could not prove termination of pid(s): ${i.join(", ")}`);m({level:"info",event:"daemon.census.completed",fields:{prior_epoch_brokers:w.length,sigtermed:d,sigkilled:h}})}a(Rt,"reapPriorEpochBrokers");const It=5e3;async function xt(n){const s=Array.from(n.entries());if(s.length===0)return;for(const[t]of s){const g=(await tr(t))?.status;(g==="active"||g==="idle")&&await pe(t,new Date().toISOString())}const l=s.map(([,t])=>({pid:t.pid,snap:ue(t.pid,null),exited:t.handle.exited}));for(const t of l)if(!t.snap.reused)try{process.platform==="linux"&&P(x)?await C({operation:"stop",pid:t.pid}):process.kill(t.pid,"SIGTERM")}catch{}const w=new Promise(t=>{setTimeout(t,It).unref()});await Promise.allSettled(l.map(t=>Promise.race([t.exited.then(()=>{}),w])));const d=[];for(const t of l)Ur(t.pid)&&(process.platform==="linux"&&P(x)?await C({operation:"stop",pid:t.pid}):he(t.snap.tree.length>0?t.snap.tree:[t.pid],"SIGKILL",t.snap.identities),d.push(t));await Promise.all(d.map(t=>t.exited));for(const[t]of s)await Mr(t,{reason:"daemon-teardown"});m({level:"info",event:"daemon.fleet_teardown.completed",fields:{brokers:l.length,sigkilled:d.length}})}a(xt,"teardownFleet");function _e(){ae(He(U()),{recursive:!0}),Fe(U(),String(process.pid),"utf8")}a(_e,"writePidfile");function be(n){return typeof n=="object"&&n!==null&&n.code==="ENOENT"}a(be,"isMissingPathError");function ke(n){const s=U();let l;try{l=Ge(s,"utf8")}catch(w){if(be(w))return;throw w}if(l.trim()!==String(n))throw new Error(`daemon readiness mirror does not name this invocation (expected pid ${n})`);try{Oe(s)}catch(w){if(be(w))return;throw w}}a(ke,"removeOwnedPidfileMirror");const Dt={acceptsDetachedWork:a(()=>!0,"acceptsDetachedWork"),registerDetached:a(n=>{n.catch(()=>{})},"registerDetached")},B=new xr;Ir(n=>B.handleFatalFault(n,!1));const Tt=new Dr,Ct=new Tr,Lt=new Cr,$t=new Lr,At=new $r,Mt=new Ar,Nt=new Gr,Ft=new Or,Gt=new Br,Ot=new Hr,Bt=new jr,Ht=new qr;async function jt(n=Date.now(),s=Dt){const l=Jr(),w=await B.runFleetPreamble(l);let d,t;try{const h=await le();d=h.filter(i=>i.status==="active"||i.status==="idle"),t=h.filter(i=>i.status==="done"||i.status==="canceled"||i.status==="dead");const u=new Set(t.map(i=>i.node_id));t.push(...(await nr()).filter(i=>!u.has(i.node_id)))}catch(h){m({level:"error",event:"canvas.node_list.failed",error:h});return}await B.run(n,{rows:d,fleet:l,lifecycle:s}),await Tt.run(n,{rows:d});const g=await Ct.run(n,{rows:[...d,...t],fleet:l});await Lt.run(n),await Ht.run(n),await $t.run(n,{lifecycle:s}),await At.run(n,{lifecycle:s}),await Mt.run(n,{lifecycle:s}),await Nt.run(n,{lifecycle:s}),await Ft.run(n,{lifecycle:s,fleet:l}),Gt.run(n,{lifecycle:s}),await We(),Bt.run(n,{fleet:l,lifecycle:s}),await Ot.run(n,{rows:d}),B.warnIfSaturated({fleet:l,lifecycle:s,thresholds:w,frozen:g})}a(jt,"superviseTick");async function qt(n){ae(de(),{recursive:!0,mode:493}),process.platform==="linux"&&Be(de(),493);const s=Ue();if(P(s))throw new Error(`layout refusal cannot bind occupied socket: ${s}`);const l=se((u,i)=>{if(u.method==="GET"&&u.url==="/healthz"){i.writeHead(200,{"content-type":"application/json; charset=utf-8"}),i.end(JSON.stringify({ok:!1,daemon_up:!0,store_accessible:!1,brokers_reconciled:!1,startup_phase:"blocked",startup_blocked:"layout_migration_required"}));return}i.writeHead(503,{"content-type":"application/json; charset=utf-8"}),i.end(JSON.stringify({error:{code:"layout_migration_required",message:"run crtr sys migrate while the runtime is offline",type:"server_error",origin:"runtime",retryable:!1}}))});await new Promise((u,i)=>{l.once("error",i),l.listen(s,()=>{l.off("error",i),u()})});let w;const d=n.tcp??je();if(d){const u=/^(.*):(\d+)$/.exec(d);if(!u||Number(u[2])>65535)throw new Error(`invalid refusal TCP address: ${d}`);const i=se(l.listeners("request")[0]);await new Promise((c,f)=>{i.once("error",f),i.listen(Number(u[2]),u[1],()=>{i.off("error",f),c()})}),w=i}_e();let t;const g=a(()=>(t??=(async()=>{l.closeAllConnections(),w?.closeAllConnections(),await Promise.all([l,w].filter(u=>u!==void 0).map(u=>new Promise((i,c)=>u.close(f=>f?c(f):i())))),ke(process.pid),process.off("SIGINT",h),process.off("SIGTERM",h)})(),t),"cleanup"),h=a(()=>{g().then(()=>process.exit(0),u=>{process.stderr.write(`[crtrd] layout refusal cleanup failed: ${String(u)}
-`),process.exit(1)})},"onSignal");return process.on("SIGINT",h),process.on("SIGTERM",h),g}a(qt,"serveLayoutRefusal");async function zt(n={}){if(Ze())return qt(n);Xe();const s=a(r=>{process.stderr.write(`[crtrd] ${r}
-`)},"logPostgres"),l=!!process.env.CRTR_TEST_PG_URL,{database:w,ownership:d}=l?{database:{url:await nt()},ownership:await ve(ce(16).toString("hex"))}:await dt(async()=>({database:await at({log:s,startLockHeld:!0}),ownership:await ve(ce(16).toString("hex"))}));if(!d.claimed){if(d.reason==="incumbent_alive")process.stderr.write(`[crtrd] already running (pid ${d.incumbentPid??"?"})
-`);else{const r=[d.incumbentPid!==void 0?`pid ${d.incumbentPid}`:void 0,d.verdict!==void 0?`verdict ${d.verdict}`:void 0].filter(y=>y!==void 0),e=r.length>0?` (${r.join(", ")})`:"";process.stderr.write(`[crtrd] claim lost: ${d.reason}${e}
-`),d.reason==="own_identity_indeterminate"&&process.stderr.write("[crtrd] cannot read its own process identity. crouter needs /proc on Linux, or the `ps` command elsewhere (Debian/Ubuntu: apt-get install procps).\n"),(d.reason==="own_identity_indeterminate"||d.reason==="incumbent_malformed")&&(process.exitCode=1)}return async()=>{}}const t=d.claim;let g=null,h=null,u="";try{await Rt(t.token),bt({kind:"user",root:kt()});for(const e of rr())process.stderr.write(`[crtrd] ${e}
-`);if(process.platform==="darwin"){const{readConfig:e,updateConfig:y}=await import("../core/config.js");if(e("user").paths?.user_files===void 0){const{homedir:o}=await import("node:os");y("user",p=>{p.paths??={},p.paths.user_files??=o()})}}await _t(Pt());for(const e of er())process.stderr.write(`[crtrd] ${e}
-`);await ye(),await it(w.url,s),await J.listen(w.url);const r=await ot(async e=>await pt(e));for(const e of r.conflicts)process.stderr.write(`[crtrd] plugin documents not reconciled: ${e.message}
+var Ae=Object.defineProperty;var i=(n,s)=>Ae(n,"name",{value:s,configurable:!0});import{startPeerOutbox as Me}from"./peer/outbox.js";import{reportMachineStatus as Ne}from"../core/peer/directory.js";import{createPeerRelay as Fe}from"./peer/relay-service.js";import{writeFileSync as Ge,readFileSync as Oe,rmSync as Be,mkdirSync as se,existsSync as k,chmodSync as He}from"node:fs";import{createServer as ce}from"node:http";import{dirname as je}from"node:path";import{envCrtrdTcp as qe,envDocumentPort as ze}from"../shared/env.js";import{serveCanvasConversationStore as We}from"../core/canvas/sessions.js";import{pollRunObservers as Ue}from"./runs/observer.js";import{randomBytes as de}from"node:crypto";import{apiSocketPath as Ke,crtrHome as Je}from"../core/canvas/paths.js";import{activeAppUsers as Ve}from"../core/spaces/users.js";import{ensureAppSpace as Qe,ensureUserFiles as Ye}from"../core/spaces/space.js";import{LAUNCHER_SOCKET as x}from"../launcher/spec.js";import{launcherRequest as C}from"../launcher/client.js";import{installLauncherEventSink as Xe}from"./launcher-events.js";import{initializeEmptyLayout as Ze,layoutNeedsMigration as er,socketDir as le}from"../core/layout.js";import{migrateLooseKeys as rr}from"../core/layout-migrate/loose-keys.js";import{relocateProfileFolders as tr}from"../core/profiles/relocate.js";import{getNode as nr,listNodesForSupervision as pe,listParkedResidentsWithWakeMail as or,setFrozen as me}from"../core/canvas/index.js";import{createApiServer as ir}from"./api/server.js";import{createDocumentListener as ar}from"./api/document-listener.js";import{documentSecret as sr}from"./api/document-secret.js";import{createAppListener as cr}from"./api/app-listener.js";import{registerMachineEnvironment as dr}from"../core/environments.js";import{resolvePerson as lr,retireLocalPerson as pr,setPersonId as mr}from"../core/canvas/person.js";import{backfillNodeApps as fr,runPermissionsBoot as ur}from"../core/permissions/boot.js";import{onRunEventAppended as wr}from"../core/runs/events.js";import{runNotices as hr}from"./run-notices.js";import{createGrantSync as vr,GRANT_SYNC_INTERVAL_S as gr}from"../core/grants/sync.js";import{runRemovalCascades as yr}from"../core/grants/remove.js";import{sweepSandboxes as Sr}from"../core/grants/on-sync.js";import{rebuildCronExecutions as _r}from"./cron/run-socket.js";import{hasSyncedGrants as br}from"../core/grants/mirror.js";import{readConfig as fe}from"../core/config.js";import{reconcileUndeliveredTickets as kr}from"./human/sweep.js";import{resetHandedOffDeliveries as Pr}from"../core/canvas/deliveries.js";import{resetHandedOffDaemonActions as Er}from"../core/canvas/daemon-actions.js";import{sweepReviews as Rr}from"./review/sweep.js";import{pidfilePath as K}from"./pidfile.js";import{rendererWarning as Ir}from"../core/runtime/package-health.js";import{DEFAULT_INTERVAL_MS as xr}from"./supervise-cadence.js";import{createResumeDetector as Dr}from"./resume-detector.js";import{setFatalFaultAnnouncer as Tr}from"../core/canvas/recovery.js";import{BrokerSupervisionReconciler as Cr}from"./reconcilers/broker-supervision.js";import{ControllerDeathReconciler as Lr}from"./reconcilers/controller-death.js";import{NodeLifecycleReconciler as $r}from"./reconcilers/node-lifecycle/tick.js";import{NodeDeadlineReconciler as Ar}from"./reconcilers/node-deadline.js";import{CronLaneReconciler as Mr}from"./reconcilers/cron-lane.js";import{DeliveryLaneReconciler as Nr}from"./reconcilers/delivery-lane.js";import{ActionLaneReconciler as Fr}from"./reconcilers/action-lane.js";import{endLiveExecution as Gr,migrateLegacyExecutionIdentities as Or}from"../core/canvas/executions.js";import{revokePriorEpochNodeTokens as Br}from"../core/canvas/node-tokens.js";import{PendingReviewSubmitReconciler as Hr}from"./reconcilers/pending-review-submit.js";import{StorageMaintenanceReconciler as jr}from"./reconcilers/storage-maintenance.js";import{StorageDueWorkReconciler as qr}from"./reconcilers/storage-due-work.js";import{BashDeadlineReconciler as zr}from"./reconcilers/bash-deadline.js";import{FaultRetryBackstopReconciler as Wr}from"./reconcilers/fault-retry-backstop.js";import{StructuredRequestReconciler as Ur}from"./reconcilers/structured-request-lane.js";import{reconcileStructuredRequestSidecars as Kr}from"./structured-requests/boot.js";import{captureLivenessSnapshot as ue,capturePidCommand as Jr,captureTeardownSnapshot as we,isPidAlive as Vr,isAnyPidAlive as he,killProcessTreePids as ve}from"../core/canvas/pid.js";import{bindFleet as Qr,boundFleet as Yr}from"../core/runtime/fleet.js";import{bindDaemonControl as Xr,clearDaemonControl as Zr}from"./control.js";import{execDaemon as et,spawnDaemon as rt}from"./manage.js";import{reconcileAndMigrateBoot as tt}from"../core/canvas/boot.js";import{resolveInstallId as nt}from"../core/canvas/install-id.js";import{setInstallId as ot}from"../core/runtime/nodes.js";import{claimDaemonOwnership as ge,daemonOwnershipClaimed as it,releaseDaemonOwnership as ye}from"../core/canvas/daemon-owner.js";import{canvasDatabaseUrl as at,closeAllDbs as J,openDb as Se,withCanvasWrite as st}from"../core/canvas/db.js";import{importSqliteCanvasIfPresent as ct}from"../core/canvas/import-sqlite.js";import{ensurePostgres as dt,ensurePostgresHealthy as lt,stopPostgres as pt,withPostgresStartLock as mt}from"./postgres/index.js";import{brokerSignalBus as V}from"./broker-signals/bus.js";import{brokerSignalStreams as ft}from"./api/handlers/broker-signals.js";import{reconcilePackages as ut}from"../core/graph/package-reconcile.js";import{startRepoSync as wt}from"../core/graph/repo-sync/index.js";import{prewarmRecentRecipes as ht,reapStaleSpares as vt}from"../core/runtime/warm-pool.js";import{DaemonFleet as gt}from"./fleet.js";import{BOOT_MIGRATIONS as yt}from"./boot-migrations.js";import{emitEvent as m}from"../core/events/emit.js";import{operationIdContext as _}from"../core/events/operation-id.js";import{bindDaemonEventSource as St}from"../core/events/source.js";import{activateCanvasImport as _t,MigrationBlockedError as bt,runForcedCanvasImport as kt}from"../migrations/activation.js";import{convertLegacyProviderStore as Pt,convertLegacyScopedStore as Et}from"../core/scoped-state/migrate.js";import{userScopeRoot as Rt}from"../core/scope.js";import{secretsDir as It}from"../core/layout.js";function Q(n,s){return n.includes(` --canvas-home ${s} `)}i(Q,"brokerCommandDeclaresCanvasHome");function Y(n){return/ --epoch (\S+) /.exec(n)?.[1]??null}i(Y,"brokerCommandEpoch");const xt=5e3,_e=150;async function Dt(n){const s=ue();if(s===null)throw m({level:"error",event:"daemon.census.snapshot_failed",fields:{invariant:"prior-epoch brokers are reaped before readiness"}}),new Error("prior-epoch broker census could not capture the process table");const l=Je(),w=[];for(const[a,u]of s.processes){const y=u.command;if(u.zombie||!y.includes("broker-cli.js")||!Q(y,l)||Y(y)===n)continue;const P=y.trim().split(/\s+/).at(-1)??"";P===""||P.endsWith("broker-cli.js")||w.push({pid:a,nodeId:P})}let d=0;const t=[];for(const a of w){const u=Jr(a.pid);if(u===null||!u.includes("broker-cli.js")||!Q(u,l)||Y(u)===n||u.trim().split(/\s+/).at(-1)!==a.nodeId)continue;const y=we(a.pid,null);if(!y.reused){try{process.platform==="linux"&&k(x)?await C({operation:"stop",pid:a.pid}):process.kill(a.pid,"SIGTERM")}catch{continue}d++,t.push({pid:a.pid,snap:y})}}const g=Date.now()+xt;for(;Date.now()<g&&t.some(a=>he(a.snap.tree.length>0?a.snap.tree:[a.pid]));)await new Promise(a=>setTimeout(a,_e));let h=0;for(const a of t){const u=a.snap.tree.length>0?a.snap.tree:[a.pid];he(u)&&(process.platform==="linux"&&k(x)?await C({operation:"stop",pid:a.pid}):ve(u,"SIGKILL",a.snap.identities),h++)}h>0&&await new Promise(a=>setTimeout(a,_e));const f=ue();if(f===null)throw m({level:"error",event:"daemon.census.snapshot_failed",fields:{invariant:"prior-epoch brokers are reaped before readiness",stage:"final"}}),new Error("prior-epoch broker census could not capture the final process table");const c=[];for(const[a,u]of f.processes){const y=u.command;u.zombie||!y.includes("broker-cli.js")||Q(y,l)&&Y(y)!==n&&c.push(a)}if(c.length>0)throw new Error(`prior-epoch broker census could not prove termination of pid(s): ${c.join(", ")}`);m({level:"info",event:"daemon.census.completed",fields:{prior_epoch_brokers:w.length,sigtermed:d,sigkilled:h}})}i(Dt,"reapPriorEpochBrokers");const Tt=5e3;async function Ct(n){const s=Array.from(n.entries());if(s.length===0)return;for(const[t]of s){const g=(await nr(t))?.status;(g==="active"||g==="idle")&&await me(t,new Date().toISOString())}const l=s.map(([,t])=>({pid:t.pid,snap:we(t.pid,null),exited:t.handle.exited}));for(const t of l)if(!t.snap.reused)try{process.platform==="linux"&&k(x)?await C({operation:"stop",pid:t.pid}):process.kill(t.pid,"SIGTERM")}catch{}const w=new Promise(t=>{setTimeout(t,Tt).unref()});await Promise.allSettled(l.map(t=>Promise.race([t.exited.then(()=>{}),w])));const d=[];for(const t of l)Vr(t.pid)&&(process.platform==="linux"&&k(x)?await C({operation:"stop",pid:t.pid}):ve(t.snap.tree.length>0?t.snap.tree:[t.pid],"SIGKILL",t.snap.identities),d.push(t));await Promise.all(d.map(t=>t.exited));for(const[t]of s)await Gr(t,{reason:"daemon-teardown"});m({level:"info",event:"daemon.fleet_teardown.completed",fields:{brokers:l.length,sigkilled:d.length}})}i(Ct,"teardownFleet");function be(){se(je(K()),{recursive:!0}),Ge(K(),String(process.pid),"utf8")}i(be,"writePidfile");function ke(n){return typeof n=="object"&&n!==null&&n.code==="ENOENT"}i(ke,"isMissingPathError");function Pe(n){const s=K();let l;try{l=Oe(s,"utf8")}catch(w){if(ke(w))return;throw w}if(l.trim()!==String(n))throw new Error(`daemon readiness mirror does not name this invocation (expected pid ${n})`);try{Be(s)}catch(w){if(ke(w))return;throw w}}i(Pe,"removeOwnedPidfileMirror");const Lt={acceptsDetachedWork:i(()=>!0,"acceptsDetachedWork"),registerDetached:i(n=>{n.catch(()=>{})},"registerDetached")},H=new Cr;Tr(n=>H.handleFatalFault(n,!1));const $t=new Lr,At=new $r,Mt=new Ar,Nt=new Mr,Ft=new Nr,Gt=new Fr,Ot=new Hr,Bt=new jr,Ht=new qr,jt=new zr,qt=new Wr,zt=new Ur;async function Wt(n=Date.now(),s=Lt){const l=Yr(),w=await H.runFleetPreamble(l);let d,t;try{const h=await pe();d=h.filter(c=>c.status==="active"||c.status==="idle"),t=h.filter(c=>c.status==="done"||c.status==="canceled"||c.status==="dead");const f=new Set(t.map(c=>c.node_id));t.push(...(await or()).filter(c=>!f.has(c.node_id)))}catch(h){m({level:"error",event:"canvas.node_list.failed",error:h});return}await H.run(n,{rows:d,fleet:l,lifecycle:s}),await $t.run(n,{rows:d});const g=await At.run(n,{rows:[...d,...t],fleet:l});await Mt.run(n),await zt.run(n),await Nt.run(n,{lifecycle:s}),await Ft.run(n,{lifecycle:s}),await Gt.run(n,{lifecycle:s}),await Ot.run(n,{lifecycle:s}),await Bt.run(n,{lifecycle:s,fleet:l}),Ht.run(n,{lifecycle:s}),await Ue(),qt.run(n,{fleet:l,lifecycle:s}),await jt.run(n,{rows:d}),H.warnIfSaturated({fleet:l,lifecycle:s,thresholds:w,frozen:g})}i(Wt,"superviseTick");async function Ut(n){se(le(),{recursive:!0,mode:493}),process.platform==="linux"&&He(le(),493);const s=Ke();if(k(s))throw new Error(`layout refusal cannot bind occupied socket: ${s}`);const l=ce((f,c)=>{if(f.method==="GET"&&f.url==="/healthz"){c.writeHead(200,{"content-type":"application/json; charset=utf-8"}),c.end(JSON.stringify({ok:!1,daemon_up:!0,store_accessible:!1,brokers_reconciled:!1,startup_phase:"blocked",startup_blocked:"layout_migration_required"}));return}c.writeHead(503,{"content-type":"application/json; charset=utf-8"}),c.end(JSON.stringify({error:{code:"layout_migration_required",message:"run crtr sys migrate while the runtime is offline",type:"server_error",origin:"runtime",retryable:!1}}))});await new Promise((f,c)=>{l.once("error",c),l.listen(s,()=>{l.off("error",c),f()})});let w;const d=n.tcp??qe();if(d){const f=/^(.*):(\d+)$/.exec(d);if(!f||Number(f[2])>65535)throw new Error(`invalid refusal TCP address: ${d}`);const c=ce(l.listeners("request")[0]);await new Promise((a,u)=>{c.once("error",u),c.listen(Number(f[2]),f[1],()=>{c.off("error",u),a()})}),w=c}be();let t;const g=i(()=>(t??=(async()=>{l.closeAllConnections(),w?.closeAllConnections(),await Promise.all([l,w].filter(f=>f!==void 0).map(f=>new Promise((c,a)=>f.close(u=>u?a(u):c())))),Pe(process.pid),process.off("SIGINT",h),process.off("SIGTERM",h)})(),t),"cleanup"),h=i(()=>{g().then(()=>process.exit(0),f=>{process.stderr.write(`[crtrd] layout refusal cleanup failed: ${String(f)}
+`),process.exit(1)})},"onSignal");return process.on("SIGINT",h),process.on("SIGTERM",h),g}i(Ut,"serveLayoutRefusal");async function Kt(n={}){if(er())return Ut(n);Ze();const s=i(r=>{process.stderr.write(`[crtrd] ${r}
+`)},"logPostgres"),l=!!process.env.CRTR_TEST_PG_URL,{database:w,ownership:d}=l?{database:{url:await at()},ownership:await ge(de(16).toString("hex"))}:await mt(async()=>({database:await dt({log:s,startLockHeld:!0}),ownership:await ge(de(16).toString("hex"))}));if(!d.claimed){if(d.reason==="incumbent_alive")process.stderr.write(`[crtrd] already running (pid ${d.incumbentPid??"?"})
+`);else{const r=[d.incumbentPid!==void 0?`pid ${d.incumbentPid}`:void 0,d.verdict!==void 0?`verdict ${d.verdict}`:void 0].filter(S=>S!==void 0),e=r.length>0?` (${r.join(", ")})`:"";process.stderr.write(`[crtrd] claim lost: ${d.reason}${e}
+`),d.reason==="own_identity_indeterminate"&&process.stderr.write("[crtrd] cannot read its own process identity. crouter needs /proc on Linux, or the `ps` command elsewhere (Debian/Ubuntu: apt-get install procps).\n"),(d.reason==="own_identity_indeterminate"||d.reason==="incumbent_malformed")&&(process.exitCode=1)}return async()=>{}}const t=d.claim;let g=null,h=null,f=null,c="";try{await Dt(t.token),Et({kind:"user",root:Rt()});for(const e of tr())process.stderr.write(`[crtrd] ${e}
+`);if(process.platform==="darwin"){const{readConfig:e,updateConfig:S}=await import("../core/config.js");if(e("user").paths?.user_files===void 0){const{homedir:o}=await import("node:os");S("user",p=>{p.paths??={},p.paths.user_files??=o()})}}await Pt(It());for(const e of rr())process.stderr.write(`[crtrd] ${e}
+`);await Se(),await ct(w.url,s),await V.listen(w.url);const r=await st(async e=>(await fr(e),await ut(e)));for(const e of r.conflicts)process.stderr.write(`[crtrd] plugin documents not reconciled: ${e.message}
 `);for(const e of r.invalid)process.stderr.write(`[crtrd] package file is not a document: ${e.path}: ${e.error}
 `);for(const e of r.quarantined)process.stderr.write(`[crtrd] plugin "${e.name}" has a damaged ${e.file} (${e.reason}); ${e.movedTo!==void 0?`moved to ${e.movedTo}`:"left in place and skipped"}
 `);for(const e of r.kinds.refused)process.stderr.write(`[crtrd] plugin "${e.plugin}" kind ${e.kind} not registered: ${e.message}
 `);for(const e of r.kinds.invalid)process.stderr.write(`[crtrd] plugin "${e.plugin}" declares invalid object kinds or scopes; no kinds registered and no app token: ${e.error}
-`);u=await et(),rt(u),g=await dr(),g!==null&&(pr(g.id),h=await lr()),process.platform==="linux"&&P(x)&&(Ye(),await C({operation:"users.sync",users:await Je()})),await Fr(t.token)}catch(r){await J.close();try{const{released:e}=await ge(t);if(!e)throw new Error("daemon ownership claim was not released");await K()}catch(e){throw new AggregateError([r,e],"daemon startup failed and cleanup also failed")}throw r}let i=!0,c,f=Promise.resolve(),S=!1,k,D;const N=new Set;let H=!1,Y=!1,E,F,j,X=!1,G,L,$,A,q;const Pe=Rr();let R,v={phase:"initializing",message:"daemon startup is running the canvas import and normal services are unavailable",blockerPaths:[]},T="initial startup activation",Ee=null;function Re(){return v.phase==="ready"?null:{phase:v.phase,message:v.message,blockerPaths:v.blockerPaths}}a(Re,"startupBlock");function b(r){N.add(r),r.finally(()=>{N.delete(r)}).catch(()=>{})}a(b,"registerDetached");const Z={acceptsDetachedWork:a(()=>i,"acceptsDetachedWork"),registerDetached:b};await mt(Z,ye);async function Ie(){try{i=!1,lt.close(),await J.close(),k!==void 0&&(clearInterval(k),k=void 0),$!==void 0&&(clearInterval($),$=void 0),q?.(),q=void 0;let r;do r=f,await r;while(r!==f);for(;N.size>0;)await Promise.allSettled([...N]);if(D!==void 0&&(await xt(D),await D.exitsSettled(),D.dispose()),j!==void 0&&await j.close(),F!==void 0&&!X&&(X=!0,await F.close()),A!==void 0){const e=A;A=void 0,await e.stop()}if(L!==void 0){const e=L;L=void 0,await e.close()}if(G!==void 0){const e=G;G=void 0,await e.close()}if(H||(ke(process.pid),H=!0),H&&!Y){const{released:e}=await ge(t);if(!e)throw new Error("daemon ownership claim was not released");Y=!0,await K()}}finally{Qr(),process.off("SIGINT",te),process.off("SIGTERM",ne),process.off("exit",oe)}}a(Ie,"cleanupAttempt");const O=1e3;let ee=!1;function xe(){return ee?{graceMs:O}:(ee=!0,_.fresh(()=>{m({level:"info",event:"daemon.handover.armed",fields:{pid:process.pid,grace_ms:O}})}),setTimeout(()=>{De()},O),{graceMs:O})}a(xe,"requestHandover");async function De(){try{await I()}catch(r){const e=r instanceof Error?r.stack??r.message:String(r);process.stderr.write(`[crtrd] handover cleanup failed:
+`);c=await nt(),ot(c),g=await lr(),g!==null&&(mr(g.id),h=await pr(),f=await ur()),process.platform==="linux"&&k(x)&&(Xe(),await C({operation:"users.sync",users:await Ve()})),await Br(t.token)}catch(r){await V.close();try{const{released:e}=await ye(t);if(!e)throw new Error("daemon ownership claim was not released");await J()}catch(e){throw new AggregateError([r,e],"daemon startup failed and cleanup also failed")}throw r}let a=!0,u,y=Promise.resolve(),P=!1,N,D;const F=new Set;let j=!1,X=!1,E,G,q,Z=!1,O,L,$,A,z;const Ee=Dr();let R,v={phase:"initializing",message:"daemon startup is running the canvas import and normal services are unavailable",blockerPaths:[]},T="initial startup activation",Re=null;function Ie(){return v.phase==="ready"?null:{phase:v.phase,message:v.message,blockerPaths:v.blockerPaths}}i(Ie,"startupBlock");function b(r){F.add(r),r.finally(()=>{F.delete(r)}).catch(()=>{})}i(b,"registerDetached");const ee={acceptsDetachedWork:i(()=>a,"acceptsDetachedWork"),registerDetached:b};await wt(ee,Se);async function xe(){try{a=!1,ft.close(),await V.close(),N!==void 0&&(clearInterval(N),N=void 0),$!==void 0&&(clearInterval($),$=void 0),z?.(),z=void 0;let r;do r=y,await r;while(r!==y);for(;F.size>0;)await Promise.allSettled([...F]);if(D!==void 0&&(await Ct(D),await D.exitsSettled(),D.dispose()),q!==void 0&&await q.close(),G!==void 0&&!Z&&(Z=!0,await G.close()),A!==void 0){const e=A;A=void 0,await e.stop()}if(L!==void 0){const e=L;L=void 0,await e.close()}if(O!==void 0){const e=O;O=void 0,await e.close()}if(j||(Pe(process.pid),j=!0),j&&!X){const{released:e}=await ye(t);if(!e)throw new Error("daemon ownership claim was not released");X=!0,await J()}}finally{Zr(),process.off("SIGINT",ne),process.off("SIGTERM",oe),process.off("exit",ie)}}i(xe,"cleanupAttempt");const B=1e3;let re=!1;function De(){return re?{graceMs:B}:(re=!0,_.fresh(()=>{m({level:"info",event:"daemon.handover.armed",fields:{pid:process.pid,grace_ms:B}})}),setTimeout(()=>{Te()},B),{graceMs:B})}i(De,"requestHandover");async function Te(){try{await I()}catch(r){const e=r instanceof Error?r.stack??r.message:String(r);process.stderr.write(`[crtrd] handover cleanup failed:
 ${e}
-`),process.exit(1)}try{process.platform==="linux"&&P(x)&&(await C({operation:"daemon.handover"}),process.exit(0)),process.pid===1&&await Yr();const r=await Xr({waitForJoinLock:!0});_.fresh(()=>{m({level:"info",event:"daemon.handover.completed",fields:{predecessor_pid:process.pid,successor_pid:r.pid??r.existing_pid??null,spawned:r.started}})})}catch(r){_.fresh(()=>{m({level:"error",event:"daemon.handover.successor_failed",error:r})});const e=r instanceof Error?r.message:String(r);process.stderr.write(`[crtrd] handover successor failed to start: ${e}
-`),process.exit(1)}process.exit(0)}a(De,"performHandover");function I(){if(E!==void 0)return E;const r=Ie();return E=r,r.then(()=>{E===r&&(E=void 0)},()=>{E===r&&(E=void 0)}),r}a(I,"requestCleanup");async function re(r){try{await I(),await ct({claimed:a(async()=>{try{return await tt()}finally{await K()}},"claimed")}),process.exit(0)}catch(e){process.exitCode=1;const y=e instanceof Error?e.stack??`${e.name}: ${e.message}`:String(e);process.stderr.write(`[crtrd] ${r} cleanup failed:
-${y}
-`),process.exit(1)}}a(re,"handleSignal");function te(){re("SIGINT")}a(te,"onSigint");function ne(){re("SIGTERM")}a(ne,"onSigterm");function oe(){I().catch(()=>{})}a(oe,"onExit");async function z(r){i&&(f=f.then(r).then(()=>{},e=>{_.fresh(()=>{m({level:"error",event:"daemon.lane_job.failed",error:e})})}))}a(z,"enqueue");async function ie(){!i||S||(Pe.check()&&R&&(m({level:"info",event:"daemon.resume.detected"}),b(R().catch(()=>{}))),S=!0,await z(async()=>{if(S=!1,!!i)try{l||await st({log:s}),await jt(Date.now(),Z)}catch(r){_.fresh(()=>{m({level:"error",event:"daemon.tick.failed",error:r})})}}))}a(ie,"enqueueTick");let M=null;async function Te(){if(M!==null)throw{status:500,code:"admission_failed",message:`daemon admission previously failed: ${M instanceof Error?M.message:String(M)}`};if(v.phase==="ready")return{admitted:!1,already_admitted:!0,startup_phase:"ready"};if(v.phase!=="prepared"&&v.phase!=="recovering")throw{status:409,code:"not_prepared",message:v.message};const r=v.phase==="prepared";try{return await W(),v={phase:"ready",message:"",blockerPaths:[]},r?{admitted:!0,already_admitted:!1,startup_phase:"ready"}:{admitted:!1,already_admitted:!0,startup_phase:"ready"}}catch(e){throw M=e,{status:500,code:"admission_failed",message:`daemon admission failed: ${e instanceof Error?e.message:String(e)}`}}}a(Te,"admitStartup");async function Ce(r){if(T!==null)throw{status:409,code:"migration_in_progress",message:`the canvas import is already running (${T})`};T="repair";try{const e=await St({dryRun:r.dryRun});if(r.dryRun||e.pending||v.phase!=="blocked")return{result:e,resumed:!1};if(n.prepare)return v={phase:"prepared",message:"daemon storage is prepared and normal services are unavailable until admission",blockerPaths:[]},{result:e,resumed:!1};try{return await W(),v={phase:"ready",message:"",blockerPaths:[]},{result:e,resumed:!0}}catch(y){const o=y instanceof Error?y.message:String(y);return setTimeout(()=>{I().catch(()=>{})},1e3),{result:e,resumed:!1,resumeError:o}}}finally{T=null}}a(Ce,"repairMigrations");async function Le(){c=n.intervalMs??Er;const r=t.token;D=new wt({epoch:r,enqueue:z}),Kr(D),v={phase:"recovering",message:"daemon startup recovery is running and normal services are unavailable",blockerPaths:[]},_.fresh(()=>{m({level:"info",event:"daemon.started",fields:{pid:process.pid,interval_ms:c}})});const e=u;_.fresh(()=>{m({level:"info",event:"daemon.install_id.resolved",fields:{install_id:e}})});const y=await cr(e);if(_.fresh(()=>{m({level:"info",event:"daemon.environment.registered",fields:{environment_id:y.environmentId,created:y.created}})}),_.fresh(()=>{let o;try{o=Pr()}catch{return}o!==null&&m({level:"warn",event:"daemon.startup.warning",fields:{stage:"termrender",warning:o.slice(0,2048)}})}),await _.fresh(async()=>{await kr(),await Sr(),await _r(Date.now()),await br(Date.now())}),await _.fresh(async()=>{const{reconcile:o,migrated:p}=await Zr(Nr);o.changed&&m({level:"info",event:"daemon.boot_change.reconciled",fields:{cleared_count:o.cleared.length,same_boot_proven:o.sameBootProven}}),p.length>0&&m({level:"info",event:"daemon.pid_identity.migrated",fields:{migrated_count:p.length}})}),await _.fresh(async()=>{for(const o of await le())o.status!=="active"||o.pi_pid!=null||o.frozen_at!=null||o.respawn_not_before!=null||(await pe(o.node_id,new Date().toISOString()),m({level:"warn",event:"daemon.startup.launch_debt_recorded",node_id:o.node_id}))}),await _.fresh(async()=>{await zr();for(const o of ht){const p=o.apply();p.changed&&m({level:"info",event:"daemon.boot_migration.applied",fields:{migration:o.id,...p.summary}})}}),b(gr()),R){const o=a(()=>{b(R().catch(()=>{})),b(Me().then(p=>A?.observe(p)).then(()=>{},p=>{m({level:"warn",event:"daemon.peer.status_failed",error:p})}))},"refresh");b(hr().catch(()=>{})),b(vr().then(({completion:p})=>p).catch(p=>{m({level:"error",event:"daemon.grants.sweep_failed",error:p})})),o(),$=setInterval(o,wr*1e3),$.unref(),q=Ae({joined:!0,register:b})}await z(async()=>{await ut(),await ft()}),k=setInterval(()=>{ie().catch(o=>m({level:"error",event:"daemon.tick.failed",error:o}))},c),await ie()}a(Le,"completeStartup");function W(){return Ee??=Le().catch(r=>{throw v={phase:"initializing",message:"daemon startup recovery failed and normal services are unavailable",blockerPaths:[]},r})}a(W,"resumeStartup");try{process.on("SIGINT",te),process.on("SIGTERM",ne),process.on("exit",oe),vt(),g!==null&&m({level:"info",event:"daemon.person.resolved",fields:{person_id:g.id,source:g.source}}),h!==null&&m({level:"info",event:"daemon.person.retired",fields:{person_id:h.person,joined_from:h.joinedFrom,retired:h.retired,columns:h.columns}}),G=await ze();const r=t.token;Vr({epoch:r,requestHandover:xe,registerDetached:b,startupBlock:Re,admitStartup:Te,repairMigrations:Ce}),_e(),F=or({tcp:n.tcp}),await F.ready;const e=qe()??me("user").document_port,y=ir(e,ar());try{await y.ready,j=y}catch(p){m({level:"warn",event:"daemon.document_listener.bind_failed",fields:{port:e,error:p instanceof Error?p.message:String(p)}})}const o=me("user").runtime;o?.issuer&&(R=ur(o.issuer,b),o.unsandboxed===!0&&(A=Ne({syncGrants:R})),mr(p=>fr().appended(p))),o?.unsandboxed===!0&&o.listener!==void 0&&m({level:"warn",event:"daemon.app_listener.refused_unsandboxed",fields:{reason:"runtime.unsandboxed is set; runtime.listener is ignored"}}),o!==void 0&&o.listener!==void 0&&o.unsandboxed!==!0&&(L=await sr(o,async()=>await yr(o.issuer.replace(/\/$/,"")),R),await L.ready);try{await gt()}catch(p){if(T=null,p instanceof yt)return v={phase:"blocked",message:p.message,blockerPaths:p.blockerPaths},I;throw p}process.platform==="linux"&&P(x)&&(Qe(),await Ve("app:terminal"));try{n.prepare?v={phase:"prepared",message:"daemon storage is prepared and normal services are unavailable until admission",blockerPaths:[]}:(await W(),v={phase:"ready",message:"",blockerPaths:[]})}finally{T=null}return I}catch(r){try{await I()}catch(e){throw new AggregateError([r,e],"daemon startup failed and cleanup also failed")}throw r}}a(zt,"runDaemon");var Po=zt;export{V as brokerCommandDeclaresCanvasHome,Q as brokerCommandEpoch,Po as default,zt as runDaemon,jt as superviseTick,xt as teardownFleet};
+`),process.exit(1)}try{process.platform==="linux"&&k(x)&&(await C({operation:"daemon.handover"}),process.exit(0)),process.pid===1&&await et();const r=await rt({waitForJoinLock:!0});_.fresh(()=>{m({level:"info",event:"daemon.handover.completed",fields:{predecessor_pid:process.pid,successor_pid:r.pid??r.existing_pid??null,spawned:r.started}})})}catch(r){_.fresh(()=>{m({level:"error",event:"daemon.handover.successor_failed",error:r})});const e=r instanceof Error?r.message:String(r);process.stderr.write(`[crtrd] handover successor failed to start: ${e}
+`),process.exit(1)}process.exit(0)}i(Te,"performHandover");function I(){if(E!==void 0)return E;const r=xe();return E=r,r.then(()=>{E===r&&(E=void 0)},()=>{E===r&&(E=void 0)}),r}i(I,"requestCleanup");async function te(r){try{await I(),await pt({claimed:i(async()=>{try{return await it()}finally{await J()}},"claimed")}),process.exit(0)}catch(e){process.exitCode=1;const S=e instanceof Error?e.stack??`${e.name}: ${e.message}`:String(e);process.stderr.write(`[crtrd] ${r} cleanup failed:
+${S}
+`),process.exit(1)}}i(te,"handleSignal");function ne(){te("SIGINT")}i(ne,"onSigint");function oe(){te("SIGTERM")}i(oe,"onSigterm");function ie(){I().catch(()=>{})}i(ie,"onExit");async function W(r){a&&(y=y.then(r).then(()=>{},e=>{_.fresh(()=>{m({level:"error",event:"daemon.lane_job.failed",error:e})})}))}i(W,"enqueue");async function ae(){!a||P||(Ee.check()&&R&&(m({level:"info",event:"daemon.resume.detected"}),b(R().catch(()=>{}))),P=!0,await W(async()=>{if(P=!1,!!a)try{l||await lt({log:s}),await Wt(Date.now(),ee)}catch(r){_.fresh(()=>{m({level:"error",event:"daemon.tick.failed",error:r})})}}))}i(ae,"enqueueTick");let M=null;async function Ce(){if(M!==null)throw{status:500,code:"admission_failed",message:`daemon admission previously failed: ${M instanceof Error?M.message:String(M)}`};if(v.phase==="ready")return{admitted:!1,already_admitted:!0,startup_phase:"ready"};if(v.phase!=="prepared"&&v.phase!=="recovering")throw{status:409,code:"not_prepared",message:v.message};const r=v.phase==="prepared";try{return await U(),v={phase:"ready",message:"",blockerPaths:[]},r?{admitted:!0,already_admitted:!1,startup_phase:"ready"}:{admitted:!1,already_admitted:!0,startup_phase:"ready"}}catch(e){throw M=e,{status:500,code:"admission_failed",message:`daemon admission failed: ${e instanceof Error?e.message:String(e)}`}}}i(Ce,"admitStartup");async function Le(r){if(T!==null)throw{status:409,code:"migration_in_progress",message:`the canvas import is already running (${T})`};T="repair";try{const e=await kt({dryRun:r.dryRun});if(r.dryRun||e.pending||v.phase!=="blocked")return{result:e,resumed:!1};if(n.prepare)return v={phase:"prepared",message:"daemon storage is prepared and normal services are unavailable until admission",blockerPaths:[]},{result:e,resumed:!1};try{return await U(),v={phase:"ready",message:"",blockerPaths:[]},{result:e,resumed:!0}}catch(S){const o=S instanceof Error?S.message:String(S);return setTimeout(()=>{I().catch(()=>{})},1e3),{result:e,resumed:!1,resumeError:o}}}finally{T=null}}i(Le,"repairMigrations");async function $e(){u=n.intervalMs??xr;const r=t.token;D=new gt({epoch:r,enqueue:W}),Qr(D),v={phase:"recovering",message:"daemon startup recovery is running and normal services are unavailable",blockerPaths:[]},_.fresh(()=>{m({level:"info",event:"daemon.started",fields:{pid:process.pid,interval_ms:u}})});const e=c;_.fresh(()=>{m({level:"info",event:"daemon.install_id.resolved",fields:{install_id:e}})});const S=await dr(e);if(_.fresh(()=>{m({level:"info",event:"daemon.environment.registered",fields:{environment_id:S.environmentId,created:S.created}})}),_.fresh(()=>{let o;try{o=Ir()}catch{return}o!==null&&m({level:"warn",event:"daemon.startup.warning",fields:{stage:"termrender",warning:o.slice(0,2048)}})}),await _.fresh(async()=>{await Rr(),await kr(),await Pr(Date.now()),await Er(Date.now())}),await _.fresh(async()=>{const{reconcile:o,migrated:p}=await tt(Or);o.changed&&m({level:"info",event:"daemon.boot_change.reconciled",fields:{cleared_count:o.cleared.length,same_boot_proven:o.sameBootProven}}),p.length>0&&m({level:"info",event:"daemon.pid_identity.migrated",fields:{migrated_count:p.length}})}),await _.fresh(async()=>{for(const o of await pe())o.status!=="active"||o.pi_pid!=null||o.frozen_at!=null||o.respawn_not_before!=null||(await me(o.node_id,new Date().toISOString()),m({level:"warn",event:"daemon.startup.launch_debt_recorded",node_id:o.node_id}))}),await _.fresh(async()=>{await Kr();for(const o of yt){const p=o.apply();p.changed&&m({level:"info",event:"daemon.boot_migration.applied",fields:{migration:o.id,...p.summary}})}}),b(_r()),R){const o=i(()=>{b(R().catch(()=>{})),b(Ne().then(p=>A?.observe(p)).then(()=>{},p=>{m({level:"warn",event:"daemon.peer.status_failed",error:p})}))},"refresh");b(yr().catch(()=>{})),b(Sr().then(({completion:p})=>p).catch(p=>{m({level:"error",event:"daemon.grants.sweep_failed",error:p})})),o(),$=setInterval(o,gr*1e3),$.unref(),z=Me({joined:!0,register:b})}await W(async()=>{await vt(),await ht()}),N=setInterval(()=>{ae().catch(o=>m({level:"error",event:"daemon.tick.failed",error:o}))},u),await ae()}i($e,"completeStartup");function U(){return Re??=$e().catch(r=>{throw v={phase:"initializing",message:"daemon startup recovery failed and normal services are unavailable",blockerPaths:[]},r})}i(U,"resumeStartup");try{process.on("SIGINT",ne),process.on("SIGTERM",oe),process.on("exit",ie),St(),g!==null&&m({level:"info",event:"daemon.person.resolved",fields:{person_id:g.id,source:g.source}}),f!==null&&m({level:"info",event:"daemon.permissions.boot",fields:{...f}}),h!==null&&m({level:"info",event:"daemon.person.retired",fields:{person_id:h.person,joined_from:h.joinedFrom,retired:h.retired,columns:h.columns}}),O=await We();const r=t.token;Xr({epoch:r,requestHandover:De,registerDetached:b,startupBlock:Ie,admitStartup:Ce,repairMigrations:Le}),be(),G=ir({tcp:n.tcp}),await G.ready;const e=ze()??fe("user").document_port,S=ar(e,sr());try{await S.ready,q=S}catch(p){m({level:"warn",event:"daemon.document_listener.bind_failed",fields:{port:e,error:p instanceof Error?p.message:String(p)}})}const o=fe("user").runtime;o?.issuer&&(R=vr(o.issuer,b),o.unsandboxed===!0&&(A=Fe({syncGrants:R})),wr(p=>hr().appended(p))),o?.unsandboxed===!0&&o.listener!==void 0&&m({level:"warn",event:"daemon.app_listener.refused_unsandboxed",fields:{reason:"runtime.unsandboxed is set; runtime.listener is ignored"}}),o!==void 0&&o.listener!==void 0&&o.unsandboxed!==!0&&(L=await cr(o,async()=>await br(o.issuer.replace(/\/$/,"")),R),await L.ready);try{await _t()}catch(p){if(T=null,p instanceof bt)return v={phase:"blocked",message:p.message,blockerPaths:p.blockerPaths},I;throw p}process.platform==="linux"&&k(x)&&(Ye(),await Qe("app:terminal"));try{n.prepare?v={phase:"prepared",message:"daemon storage is prepared and normal services are unavailable until admission",blockerPaths:[]}:(await U(),v={phase:"ready",message:"",blockerPaths:[]})}finally{T=null}return I}catch(r){try{await I()}catch(e){throw new AggregateError([r,e],"daemon startup failed and cleanup also failed")}throw r}}i(Kt,"runDaemon");var xo=Kt;export{Q as brokerCommandDeclaresCanvasHome,Y as brokerCommandEpoch,xo as default,Kt as runDaemon,Wt as superviseTick,Ct as teardownFleet};

package/dist/daemon/reconcilers/delivery-lane.js

@@ -1,8 +1,8 @@
-var g=Object.defineProperty;var c=(e,t)=>g(e,"name",{value:t,configurable:!0});import{randomUUID as D}from"node:crypto";import{claimPushDelivery as h,duePushDeliveries as j,messageBodyForDelivery as N,pushDeliveryClaimIsCurrent as O,settleDelivery as d}from"../../core/canvas/deliveries.js";import{deliveryBackoffMs as f}from"../../core/canvas/delivery-contract.js";import{openDb as p}from"../../core/canvas/db.js";import{pushLineFor as u}from"../../core/graph/custom.js";import{postReceiverUrl as b}from"../../core/graph/receiver-url.js";import{emitEvent as l}from"../../core/events/emit.js";import{operationIdContext as m}from"../../core/events/operation-id.js";import{runDelivery as w,DELIVERY_TIMEOUT_MS as E}from"../delivery/run-delivery.js";const v=D();async function o(e,t,a){await d(e.deliveryId,e.attempts,t,{state:"permanent_failed",failure:{kind:"spawn_error",message:a}},Date.now())}c(o,"failed");async function T(e,t){const a=await(await p()).prepare(`SELECT o.type, o.name, c.receiver_json, c.payload_json, m.object_id, i.external_id AS app,
+var g=Object.defineProperty;var p=(e,t)=>g(e,"name",{value:t,configurable:!0});import{randomUUID as D}from"node:crypto";import{claimPushDelivery as h,duePushDeliveries as j,messageBodyForDelivery as N,pushDeliveryClaimIsCurrent as O,settleDelivery as d}from"../../core/canvas/deliveries.js";import{deliveryBackoffMs as f}from"../../core/canvas/delivery-contract.js";import{openDb as c}from"../../core/canvas/db.js";import{pushLineFor as u}from"../../core/graph/custom.js";import{postReceiverUrl as b}from"../../core/graph/receiver-url.js";import{emitEvent as l}from"../../core/events/emit.js";import{operationIdContext as m}from"../../core/events/operation-id.js";import{runDelivery as w,DELIVERY_TIMEOUT_MS as E}from"../delivery/run-delivery.js";const v=D();async function o(e,t,a){await d(e.deliveryId,e.attempts,t,{state:"permanent_failed",failure:{kind:"spawn_error",message:a}},Date.now())}p(o,"failed");async function T(e,t){const a=await(await c()).prepare(`SELECT o.type, o.name, c.receiver_json, c.payload_json, m.object_id, i.external_id AS app,
     d.message_id, owner.type AS owner_type, parent.external_id AS parent_app
     FROM deliveries d JOIN objects o ON o.id = d.destination_id
     JOIN custom_objects c ON c.object = o.id JOIN messages m ON m.message_id = d.message_id
     LEFT JOIN objects owner ON owner.id = o.owner
     LEFT JOIN identities i ON i.object = o.owner AND i.scheme = 'app'
     LEFT JOIN identities parent ON parent.object = owner.owner AND parent.scheme = 'app'
-    WHERE d.delivery_id = ?`).get(e.deliveryId);if(!a||!a.receiver_json){await o(e,t,`delivery ${e.deliveryId} has no supported receiver`);return}const i=JSON.parse(a.receiver_json);if(!await O(e,t)){await d(e.deliveryId,e.attempts,t,{state:"acknowledged"},Date.now());return}if(typeof i=="object"&&typeof i.url=="string"&&a.type!=="action"){const n=await u(await p(),e.deliveryId);if(!n){await o(e,t,`delivery ${e.deliveryId} has no event document`);return}try{const r=await b(i.url,JSON.stringify(n),{"Content-Type":"application/json","X-Crtr-Delivery":e.deliveryId,"X-Crtr-Event":a.message_id},E);r>=200&&r<300?await d(e.deliveryId,e.attempts,t,{state:"acknowledged"},Date.now()):r>=300&&r<400?await o(e,t,`url receiver returned HTTP ${r}; redirects are not followed \u2014 register the final URL`):r>=400&&r<500&&r!==408&&r!==429?await o(e,t,`url receiver returned HTTP ${r}`):await d(e.deliveryId,e.attempts,t,{state:"pending",nextAttemptAt:Date.now()+f(e.attempts),failure:{kind:"spawn_error",message:`url receiver returned HTTP ${r}`}},Date.now())}catch(r){await d(e.deliveryId,e.attempts,t,{state:"pending",nextAttemptAt:Date.now()+f(e.attempts),failure:{kind:"spawn_error",message:String(r)}},Date.now())}return}if(typeof i!="object"||!Array.isArray(i.argv)||typeof i.cwd!="string"){await o(e,t,`delivery ${e.deliveryId} has an invalid argv receiver`);return}if(a.type==="action"){if(typeof i.name!="string"||!a.object_id){await o(e,t,`delivery ${e.deliveryId} has an invalid argv receiver`);return}const n=await N(e.deliveryId);if(n===null){await o(e,t,`delivery ${e.deliveryId} has no message body`);return}const{push:r,...y}=n,I={...y,action:{name:i.name,payload:a.payload_json===null?null:JSON.parse(a.payload_json)}};await w({argv:i.argv,cwd:i.cwd,document:I,attempt:e.attempts,nodeId:a.object_id,...a.app?{app:a.app}:{}},async _=>{await d(e.deliveryId,e.attempts,t,_,Date.now())});return}const s=await u(await p(),e.deliveryId);if(!s){await o(e,t,`delivery ${e.deliveryId} has no event document`);return}await w({argv:i.argv,cwd:i.cwd,document:s,attempt:e.attempts,app:a.app??a.parent_app??"app:terminal",custom:{deliveryId:e.deliveryId,messageId:a.message_id}},async n=>{await d(e.deliveryId,e.attempts,t,n,Date.now())})}c(T,"deliverExternal");class P{static{c(this,"DeliveryLaneReconciler")}async run(t,a){if(!a.lifecycle.acceptsDetachedWork())return;let i;try{i=await j(t)}catch(s){m.fresh(()=>l({level:"error",event:"delivery.scan_failed",error:s}));return}for(const s of i)try{const n=await h(s.deliveryId,t,v);if(n===null)continue;a.lifecycle.registerDetached(T(n,v).catch(r=>{m.fresh(()=>l({level:"error",event:"delivery.failed",error:r,fields:{delivery_id:n.deliveryId}}))}))}catch(n){m.fresh(()=>l({level:"error",event:"delivery.claim_failed",error:n,fields:{delivery_id:s.deliveryId}}))}}}export{P as DeliveryLaneReconciler,v as deliveryDaemonInstanceId};
+    WHERE d.delivery_id = ?`).get(e.deliveryId);if(!a||!a.receiver_json){await o(e,t,`delivery ${e.deliveryId} has no supported receiver`);return}const i=JSON.parse(a.receiver_json);if(!await O(e,t)){await d(e.deliveryId,e.attempts,t,{state:"acknowledged"},Date.now());return}if(typeof i=="object"&&typeof i.url=="string"&&a.type!=="action"){const n=await u(await c(),e.deliveryId);if(!n){await o(e,t,`delivery ${e.deliveryId} has no event document`);return}try{const r=await b(i.url,JSON.stringify(n),{"Content-Type":"application/json","X-Crtr-Delivery":e.deliveryId,"X-Crtr-Event":a.message_id},E);r>=200&&r<300?await d(e.deliveryId,e.attempts,t,{state:"acknowledged"},Date.now()):r>=300&&r<400?await o(e,t,`url receiver returned HTTP ${r}; redirects are not followed \u2014 register the final URL`):r>=400&&r<500&&r!==408&&r!==429?await o(e,t,`url receiver returned HTTP ${r}`):await d(e.deliveryId,e.attempts,t,{state:"pending",nextAttemptAt:Date.now()+f(e.attempts),failure:{kind:"spawn_error",message:`url receiver returned HTTP ${r}`}},Date.now())}catch(r){await d(e.deliveryId,e.attempts,t,{state:"pending",nextAttemptAt:Date.now()+f(e.attempts),failure:{kind:"spawn_error",message:String(r)}},Date.now())}return}if(typeof i!="object"||!Array.isArray(i.argv)||typeof i.cwd!="string"){await o(e,t,`delivery ${e.deliveryId} has an invalid argv receiver`);return}if(a.type==="action"){if(typeof i.name!="string"||!a.object_id){await o(e,t,`delivery ${e.deliveryId} has an invalid argv receiver`);return}const n=await N(e.deliveryId);if(n===null){await o(e,t,`delivery ${e.deliveryId} has no message body`);return}const{push:r,...y}=n,I={...y,action:{name:i.name,payload:a.payload_json===null?null:JSON.parse(a.payload_json)}};await w({argv:i.argv,cwd:i.cwd,document:I,attempt:e.attempts,nodeId:a.object_id,...a.app??a.parent_app?{app:a.app??a.parent_app}:{}},async _=>{await d(e.deliveryId,e.attempts,t,_,Date.now())});return}const s=await u(await c(),e.deliveryId);if(!s){await o(e,t,`delivery ${e.deliveryId} has no event document`);return}await w({argv:i.argv,cwd:i.cwd,document:s,attempt:e.attempts,app:a.app??a.parent_app??"app:terminal",custom:{deliveryId:e.deliveryId,messageId:a.message_id}},async n=>{await d(e.deliveryId,e.attempts,t,n,Date.now())})}p(T,"deliverExternal");class P{static{p(this,"DeliveryLaneReconciler")}async run(t,a){if(!a.lifecycle.acceptsDetachedWork())return;let i;try{i=await j(t)}catch(s){m.fresh(()=>l({level:"error",event:"delivery.scan_failed",error:s}));return}for(const s of i)try{const n=await h(s.deliveryId,t,v);if(n===null)continue;a.lifecycle.registerDetached(T(n,v).catch(r=>{m.fresh(()=>l({level:"error",event:"delivery.failed",error:r,fields:{delivery_id:n.deliveryId}}))}))}catch(n){m.fresh(()=>l({level:"error",event:"delivery.claim_failed",error:n,fields:{delivery_id:s.deliveryId}}))}}}export{P as DeliveryLaneReconciler,v as deliveryDaemonInstanceId};

package/dist/migrations/004-canvas-documents/fields.d.ts

@@ -1,4 +1,4 @@
-import type { Privacy, RuleSpec } from '../../core/graph/types.js';
+import { type Privacy, type RuleSpec } from '../../core/graph/types.js';
 export type DocumentKind = 'knowledge' | 'preference' | 'report';
 export interface DocumentFields {
     kind: DocumentKind;

package/dist/migrations/004-canvas-documents/fields.js

@@ -1,2 +1,2 @@
-var c=Object.defineProperty;var r=(e,t)=>c(e,"name",{value:t,configurable:!0});import{rulesFromFrontmatter as u}from"../../core/graph/rules.js";const f=new Set(["kind","privacy","unlisted","lint-ignore","extensions","when-and-why-to-read","short-form","rationale","surfaces","gate","slash","origin","last-updated","name","namespace"]),p=["public","friends","private"],s=r(e=>typeof e=="string"&&e.trim()!==""?e.trim():null,"str");function m(e){for(const t of e.split(`
-`)){const i=t.trim().replace(/^#+\s*/,"").replace(/^[-*]\s+/,"").trim();if(i!==""&&i!=="---")return i}return""}r(m,"firstLine");function g(e,t,i){const n=e??{},o=Object.keys(n).filter(a=>!f.has(a));let l=i.kind??"knowledge";i.kind===void 0&&n.kind!==void 0&&(n.kind==="knowledge"||n.kind==="preference"?l=n.kind:o.push("kind"));const d=typeof n.privacy=="string"&&p.includes(n.privacy)?n.privacy:i.missingPrivacy;return{kind:l,privacy:d,preview:s(n["when-and-why-to-read"])?.replace(/\s+/g," ")??m(t),summary:s(n["short-form"]),whyItExists:s(n.rationale),unlisted:n.unlisted===!0,lintIgnore:n["lint-ignore"]??null,extensions:n.extensions??null,rules:u(n),dropped:o}}r(g,"documentFields");function h(e,t){return e.map(i=>({...i,if:i.if===void 0?t:{all:[i.if,t]}}))}r(h,"andIntoRules");export{h as andIntoRules,g as documentFields,m as firstLine};
+var u=Object.defineProperty;var r=(n,t)=>u(n,"name",{value:t,configurable:!0});import{rulesFromFrontmatter as f}from"../../core/graph/rules.js";import{readLegacyPrivacy as p}from"../../core/graph/types.js";const m=new Set(["kind","privacy","unlisted","lint-ignore","extensions","when-and-why-to-read","short-form","rationale","surfaces","gate","slash","origin","last-updated","name","namespace"]),g=["public","private"],o=r(n=>typeof n=="string"&&n.trim()!==""?n.trim():null,"str");function y(n){for(const t of n.split(`
+`)){const i=t.trim().replace(/^#+\s*/,"").replace(/^[-*]\s+/,"").trim();if(i!==""&&i!=="---")return i}return""}r(y,"firstLine");function v(n,t,i){const e=n??{},l=Object.keys(e).filter(c=>!m.has(c));let d=i.kind??"knowledge";i.kind===void 0&&e.kind!==void 0&&(e.kind==="knowledge"||e.kind==="preference"?d=e.kind:l.push("kind"));const s=p(e.privacy),a=typeof s=="string"&&g.includes(s)?s:i.missingPrivacy;return{kind:d,privacy:a,preview:o(e["when-and-why-to-read"])?.replace(/\s+/g," ")??y(t),summary:o(e["short-form"]),whyItExists:o(e.rationale),unlisted:e.unlisted===!0,lintIgnore:e["lint-ignore"]??null,extensions:e.extensions??null,rules:f(e),dropped:l}}r(v,"documentFields");function x(n,t){return n.map(i=>({...i,if:i.if===void 0?t:{all:[i.if,t]}}))}r(x,"andIntoRules");export{x as andIntoRules,v as documentFields,y as firstLine};

package/docs/apps/guides/files-and-documents.md

@@ -19,7 +19,7 @@ A non-2xx answer is thrown as an `APIError`, never returned as bytes. A bad `ran
 
 ## Read the person's public documents
 
-`runtime.memory` is a read-only view of the `knowledge` and `preference` documents the person owns (`memory` and the `/v1/memory` routes are the API's names for this). An app reads the person's `public` documents with `memory.list` and `memory.get`, and needs no scope to do it. Without more, it never sees a `friends` or `private` document and cannot tell one from a document that does not exist: both answer `404 not_found`. The optional scope [`crtr:memory:read_private:user`](#private-memory) adds `private`. The list is what the app's agents can read about the person, so an app can show the person exactly which of their documents it draws on.
+`runtime.memory` is a read-only view of the `knowledge` and `preference` documents the person owns (`memory` and the `/v1/memory` routes are the API's names for this). An app reads the person's `public` documents with `memory.list` and `memory.get`, and needs no scope to do it. Without more, it never sees a `private` document and cannot tell one from a document that does not exist: both answer `404 not_found`. The optional scope [`crtr:memory:read_private:user`](#private-memory) adds `private`. The list is what the app's agents can read about the person, so an app can show the person exactly which of their documents it draws on.
 
 ```ts
 const page = await runtime.memory.list({store: 'user'});
@@ -56,13 +56,13 @@ for await (const item of runtime.memory.listAll({store: 'user', path: 'work'}))
 
 - `body` is the current markdown as stored; `[[links]]` are not resolved. A body over 1 MiB is cut to its longest whole-character prefix of at most 1 MiB, with `truncated: true`; `size` is always the full length in UTF-8 bytes.
 - `grantee` is `app:<id>` of the app whose agent wrote the first revision, or `null` when the person wrote it.
-- An absent or deleted name, a `friends` name, and a `private` name without `crtr:memory:read_private:user` reject with `NotFoundError` (`code: 'not_found'`); a malformed field rejects with `BadRequestError`.
+- An absent or deleted name, and a `private` name without `crtr:memory:read_private:user` reject with `NotFoundError` (`code: 'not_found'`); a malformed field rejects with `BadRequestError`.
 
 ## Private memory
 
 `crtr:memory:read_private:user` is an [optional permission](/docs/guides/grant-changes#optional-permissions) that lets your app read the person's `private` documents. Declare it, then let the person switch it on from your app (sign-in request or `permissionUrl`).
 
-- **Read-only, and never `friends`.** With the scope `memory.list` and `memory.get` return `public` and `private` documents; a `friends` document still reads as absent, and the scope writes nothing. Each private document arrives with `privacy: 'private'`.
+- **Read-only.** With the scope `memory.list` and `memory.get` return `public` and `private` documents, and the scope writes nothing. Each private document arrives with `privacy: 'private'`.
 - **Both server reads and runs.** Your server's `memory` calls see private documents while the grant holds the scope. A run sees them only if it was started with the scope: `runs.start` `scopes` must cover `crtr:memory:read_private:user` (name it, or name `crtr:memory:manage:user` if the grant holds that) (a run with no `scopes` list gets what the grant holds), and the start is refused `403 scope_missing` while the grant lacks it. Add the scope to the runs that need it only while `resolved_scopes` holds it.
 - **The person can turn it off at any time.** Reads then stop returning private documents at once, including from a run that is still live. That run keeps what it already read in its context, so restart the runs that used it when the permission turns off (`watchGrants` tells you).
 - **Never show a private detail to anyone but the owner**, unless the owner asked your app to. A visitor, a guest or another user must not see a fact, quote or summary taken from a private document.

package/docs/apps/guides/many-users.md

@@ -46,7 +46,7 @@ A visitor chatting with B's clone starts an app run on **B's runtime and B's AI
 
 A run your app starts is **your app's agent**, not a continuation of another app's agent. It starts in `/apps/<app>/files`, uses the person's AI under `crtr:llm`, and reaches your app's own documents (owned by `app:<your app>`) without a `crtr:memory` scope. Other people's or apps' data is not shared merely because the app has many users. The grant's resolved permissions govern access to the person's files (`crtr:files:<access>:user:<dir>`), the person's documents (`crtr:memory:<access>:user`), another app's space (only where that app allows it), and another app's conversations (`crtr:conversations:read:app:<B>`).
 
-The exception is the person's **public** documents (owned by the person, read through `memory`; see [Files and documents](/docs/guides/files-and-documents)): an app with an active grant can read these even without a user-memory scope. A third-party app cannot see `friends` documents, and sees `private` ones only with the optional `crtr:memory:read_private:user` the person switched on; `crtr:memory:read:user` reveals neither. They look absent from lists, searches, reads and history. Only a holder of `crtr:memory:manage:user` (a first-party app), or the person, reads all three levels. A document without a privacy field reads as `private`. Public read access is not write access.
+The exception is the person's **public** documents (owned by the person, read through `memory`; see [Files and documents](/docs/guides/files-and-documents)): an app with an active grant can read these even without a user-memory scope. A third-party app sees `private` documents only with the optional `crtr:memory:read_private:user` the person switched on; `crtr:memory:read:user` does not reveal them. They look absent from lists, searches, reads and history. `crtr:memory:read_private:user` and `crtr:memory:manage:user` (a first-party app) widen the app's ceiling to `private`, and the app's schema and relation facts decide visibility within it. The person reads both levels. A document without a privacy field reads as `private`. Public read access is not write access.
 
 Every run is sandboxed: its shell runs as the app's OS user and sees only the app's space and the folders its permissions name. Normal runs have network access. Start a run with `isolated: true` when the agent should have **no network** and **no `/apps/<app>/files` mount**: its cwd is its own node folder, and all children inherit the restriction. The shell, stored conversation and model calls still work, and the run's `scopes` can narrow its commands. An isolated run cannot turn isolation off in a child or schedule, or use an outside cwd or worktree.
 

package/docs/apps/guides/test-your-app.md

@@ -117,7 +117,7 @@ In your callback handler, check `authorizationRefusalOf(url)` before reading `co
 
 ## Memory and providers
 
-`user.memory.put({name, body, privacy = 'public', kind = 'knowledge', ...})` and `remove(name)`. Without `crtr:memory:manage:user` in the grant, only `public` documents are listed and others read as 404, as on the runtime; `crtr:memory:read_private:user` adds `private` (never `friends`). FakeCloud applies the user's whole grant (`user.grant.set`), not the `scopes` a run was started with; test narrowed runs on the real runtime. List items carry the full `MemoryListItem` fields.
+`user.memory.put({name, body, privacy = 'public', kind = 'knowledge', ...})` and `remove(name)`. Without `crtr:memory:manage:user` in the grant, only `public` documents are listed and others read as 404, as on the runtime; `crtr:memory:read_private:user` adds `private`. FakeCloud applies the user's whole grant (`user.grant.set`), not the `scopes` a run was started with; test narrowed runs on the real runtime. List items carry the full `MemoryListItem` fields.
 
 ```ts
 cloud.providers.define('sms', { tools: { send: { group: 'send', handler: ({ userId, arguments: args }) => ({ sent: true }) } } });

package/docs/cli/documents-and-preferences.md

@@ -47,6 +47,6 @@ printf '%s\n' 'Production changes need an explicit approval.' | \
   crtr doc edit <name> --rationale "Updated the approval rule."
 ```
 
-`crtr doc edit` replaces the whole body you pipe; it does not append text. For a partial change, use `crtr doc edit <name> --rationale '…' --blocks <<'EOF'` with whole-line `<<<<<<< SEARCH`, `=======`, and `>>>>>>> REPLACE` markers around verbatim old and new text. An empty REPLACE deletes text. Scripts can still use `--replace '[{"old":"…","new":"…"}]'`. Read the document before you edit it; an edit made from an older revision is refused. Use `crtr doc history <name>` to read the revision history. If you want to create a document yourself, use `crtr doc write`; it takes a name, a preview sentence that tells agents when to read it, and the document body on stdin. `--kind knowledge|preference` (default `knowledge`) sets how agents use it, and `--owner node|user|profile|app|repo` chooses who owns it (default: the writing node; `profile:<name>` and `repo:<handle>` name a specific one). New documents are `privacy: public` unless `--privacy friends` or `--privacy private` is supplied; a repository owns only public documents. `crtr doc edit --privacy <level>` changes the level. An edit that changes only fields (privacy, preview, summary, rules, `--why-it-exists`) takes effect at once but makes no new revision: revisions are versions of the body, so the revision number does not move and `crtr doc history` shows nothing for it.
+`crtr doc edit` replaces the whole body you pipe; it does not append text. For a partial change, use `crtr doc edit <name> --rationale '…' --blocks <<'EOF'` with whole-line `<<<<<<< SEARCH`, `=======`, and `>>>>>>> REPLACE` markers around verbatim old and new text. An empty REPLACE deletes text. Scripts can still use `--replace '[{"old":"…","new":"…"}]'`. Read the document before you edit it; an edit made from an older revision is refused. Use `crtr doc history <name>` to read the revision history. If you want to create a document yourself, use `crtr doc write`; it takes a name, a preview sentence that tells agents when to read it, and the document body on stdin. `--kind knowledge|preference` (default `knowledge`) sets how agents use it, and `--owner node|user|profile|app|repo` chooses who owns it (default: the writing node; `profile:<name>` and `repo:<handle>` name a specific one). New documents are `privacy: public` unless `--privacy private` is supplied; a repository owns only public documents. `crtr doc edit --privacy <level>` changes the level. An edit that changes only fields (privacy, preview, summary, rules, `--why-it-exists`) takes effect at once and records a new revision with the body unchanged, attributed to you with the rationale: the revision number advances and `crtr doc history` lists it. Another reader that read the document earlier must read it again before its next body edit.
 
 Documents are for reusable current truth and durable instructions, not a transcript of one conversation. When a fact changes, update the existing document rather than saving a second version.

package/docs/concepts/documents.md

@@ -33,7 +33,7 @@ An installed plugin is an app named after the plugin, and the documentation that
 
 ## Who may read
 
-Each document is `public` (the default), `friends` or `private`. The person reads everything, a repo owns only public documents, and a reader that cannot see a document gets the same answer as for one that does not exist. A node's own owner space is open to it; an app's access to the person's documents is by privacy level and the scopes its grant holds (see [Scopes and trust](./scopes-and-trust.md)).
+Each document is `public` (the default) or `private`. The person reads everything, a repo owns only public documents, and a reader that cannot see a document gets the same answer as for one that does not exist. A node's own owner space is open to it; an app's access to the person's documents is by privacy level and the scopes its grant holds (see [Scopes and trust](./scopes-and-trust.md)).
 
 ```mermaid
 flowchart LR

package/docs/concepts/scopes-and-trust.md

@@ -15,7 +15,7 @@ Scope strings are prefixed with `crtr:`. These are the ones the daemon and CLI c
 | `crtr:act` | Creating, forking, reviving, closing and messaging nodes; `bash` and `files`; creating a human request or review (the `crtr human` commands are hidden from a run without it) |
 | `crtr:schedule` | Creating, pausing, resuming, running and deleting crons (the `crtr cron` commands are hidden without it) |
 | `crtr:memory:read:user[:path]`, `crtr:memory:rw:user[:path]`, `crtr:memory:manage:user` | The person's documents: reading, writing (`crtr doc`), and `manage` for every privacy level and every document |
-| `crtr:memory:read_private:user` | Read-only access to the person's `public` and `private` documents, never `friends`; no path suffix; an optional permission the person switches on; `manage:user` covers it, `read:user` and `rw:user` do not |
+| `crtr:memory:read_private:user` | Read-only access to the person's `public` and `private` documents; no path suffix; an optional permission the person switches on; `manage:user` covers it, `read:user` and `rw:user` do not |
 | `crtr:memory:read:app:<id>`, `crtr:memory:rw:app:<id>` | An app's documents; `…:profile:<profile>` narrows to one of its profiles. A run with no `scopes` list, and an app's own server, reads and writes its own app's space freely; a run started with a `scopes` list needs these for its own app too |
 | `crtr:files:read\|rw:user:<dir>`, `crtr:files:read\|rw:app:<id>:<dir>`, `crtr:files:share` | Host files the run may mount, and sharing files beyond the app's own space |
 | `crtr:conversations:read:app:<id>`, `crtr:objects:read:app:<id>` | Reading another app's conversations or node objects |
@@ -23,7 +23,7 @@ Scope strings are prefixed with `crtr:`. These are the ones the daemon and CLI c
 
 The `memory` in `crtr:memory:*` is the scope family's name for access to **documents** (see [Documents](./documents.md)); there is no separate memory store. The older short names (`ask`, `act`, `schedule`, `memory:read`, `memory:write`, `llm`) are not accepted by `crtr sys connect --scopes`. A node's own documents, and an app's documents for its own nodes, need no `crtr:memory` scope.
 
-This is an allow-list, not a claim that code will behave. The daemon checks the scope at the route that performs the action and rejects an unavailable one. The SDK’s [`nodes.create`](../sdk/nodes.md) `scopes` field narrows a run: a run's list must stay inside what its creator and grant hold, and `crtr:act` requires `crtr:llm`. `client.memory` is not scope-gated: it lists and reads the person's `knowledge` and `preference` documents, and the answer is filtered by privacy — an app sees `public` documents, a grant holding `crtr:memory:read_private:user` also sees `private` ones, and a grant holding `crtr:memory:manage:user` sees `friends` and `private` ones. Who may read any document is the owner-and-privacy model, not a per-call scope. The exception is a run started with a `scopes` list: it reads its own app's documents (including automatic delivery of them at boot) only with `crtr:memory:read:app:<id>` and writes or edits them only with `crtr:memory:rw:app:<id>`; a refused write answers `scope_missing` naming the scope. Such a run still publishes its own reports with `crtr push` and its promoted node still gets a roadmap, but cannot edit any other document through that path, and a child never regains a scope its parent's list dropped.
+This is an allow-list, not a claim that code will behave. The daemon checks the scope at the route that performs the action and rejects an unavailable one. The SDK’s [`nodes.create`](../sdk/nodes.md) `scopes` field narrows a run: a run's list must stay inside what its creator and grant hold, and `crtr:act` requires `crtr:llm`. `client.memory` is not scope-gated: it lists and reads the person's `knowledge` and `preference` documents, and the answer is filtered by privacy, which is `public` or `private`. An app's ceiling is `public` documents; a grant holding `crtr:memory:read_private:user` or `crtr:memory:manage:user` widens it to `private` ones. Within that ceiling, the app's registered schema and the relation facts it writes decide who may read a document, not a per-call scope. The exception is a run started with a `scopes` list: it reads its own app's documents (including automatic delivery of them at boot) only with `crtr:memory:read:app:<id>` and writes or edits them only with `crtr:memory:rw:app:<id>`; a refused write answers `scope_missing` naming the scope. Such a run still publishes its own reports with `crtr push` and its promoted node still gets a roadmap, but cannot edit any other document through that path, and a child never regains a scope its parent's list dropped.
 
 ```mermaid
 flowchart LR

package/docs/sdk/release-notes.md

@@ -7,6 +7,17 @@ description: Behavior changes in @north-light/sdk that an app must act on, newes
 
 Changes to `@north-light/sdk` that can change what an existing app sees. Newest first.
 
+## 0.3.550
+
+An app registers a permission schema for its own object types and decides who may read each object with relations. Additive, except that `friends` leaves the privacy levels and nodes move under their profile.
+
+- **Schemas, relations, check.** `client.schemas.register({ namespace, source })` (`POST /v1/schemas`) registers the schema for a namespace the app first claims; `client.relations.write | replace | list` (`/v1/relations`) writes and reads facts such as `firstlight/memory:<id>  editor  user:<id>`; `client.check(subject, permission, resource)` (`POST /v1/check`) answers whether a person may act. A type or relation outside the app's own namespace is refused `403 not_schema_owner`; a namespace another app registered first is refused `namespace_taken`.
+- **Typed documents.** `docs.write` takes `schema_type` (the app type the document is an instance of) and `relations` (facts written in the same transaction), and `owner: 'user'` writes under the person the call token names. `docs.get` returns `extensions` and `schema_type`. `docs.delete(ref)`, `docs.list(params)` and `docs.search(params)` are new; `list` and `search` filter by `schema_type` and by `extensions` inside the permission-filtered query, before the page limit. Document history entries carry `acting_app` and `acting_for`.
+- **`friends` is removed.** Privacy is `public` or `private`. A write naming `friends` is refused `400 invalid_request`. Existing `friends` documents became `private`; a `friends` value that arrives from an older source (a peer on an older release, a plugin package, a legacy canvas) is read as `private`.
+- **Nodes are owned by their profile.** A node started under a profile now has that profile object as its `owner`, where it used to have the app: `owner` on list, search, read and event payloads names the profile, and listing with `owner=<app>&type=node` no longer returns those nodes; list them with `owner=<profile>`. Events carry the node's app as `app`. A node with no profile stays under its app.
+- **A fields-only edit records a revision.** `docs.edit` with only fields (preview, summary, privacy, rules, …) now records a revision with the body unchanged, attributed to the editor with the rationale: the returned `revision` advances and `docs.history` lists it. Before, it changed the fields and left the revision alone.
+- **FakeCloud** serves the new routes in memory: it parses and validates a registered schema source, refuses facts the schema does not declare, and evaluates `check`, `list` and `search` against the schema the way the runtime does. Deleting a typed document removes the facts that name it.
+
 ## 0.3.548
 
 `canvas.watch` with a `watcher` that is a node of your own app now works under `crtr:objects:link:node`. It answered `404 not_found` (`watcher not found`) before. The node must be reachable from the caller under run confinement and must itself be able to read the object. A watch on a node of another machine now forwards every event level, and that node's own listening config decides how each is delivered, where an event below level 3 was dropped before it left the object's machine.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.549",
+  "version": "0.3.550",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",
@@ -140,7 +140,7 @@
   },
   "license": "UNLICENSED",
   "dependencies": {
-    "@north-light/identity": "0.3.549",
+    "@north-light/identity": "0.3.550",
     "@earendil-works/pi-agent-core": "1.1.0",
     "@earendil-works/pi-ai": "1.1.0",
     "@earendil-works/pi-coding-agent": "1.1.0",

package/packages/crouter-identity/dist/index.js

@@ -14,14 +14,27 @@ function validPath(path, directoryOnly = false) {
         !path.split('/').some((part, index, parts) => part === '.' || (part === '' && index !== parts.length - 1)) &&
         (!directoryOnly || !path.endsWith('/'));
 }
+// `covers` parses both sides on every call, and a grant can hold thousands of scopes: parse each string once. A parse is pure; a throw is not cached.
+const selectorCache = new Map();
+const SELECTOR_CACHE_MAX = 20_000;
 function selector(value) {
+    let s = selectorCache.get(value);
+    if (s === undefined) {
+        s = parseSelector(value);
+        if (selectorCache.size >= SELECTOR_CACHE_MAX)
+            selectorCache.clear();
+        selectorCache.set(value, s);
+    }
+    return s;
+}
+function parseSelector(value) {
     if (value === 'crtr:llm' || value === 'crtr:act' || value === 'crtr:schedule')
         return { kind: value.slice(5), value };
     if (value === 'crtr:files:share')
         return { kind: 'share', value };
     if (value === 'crtr:memory:manage:user')
         return { kind: 'memory', access: 'manage', holder: 'user' };
-    // Read-only access to the person's `public` and `private` memory (never `friends`). It names no document path.
+    // Read-only access to the person's `public` and `private` memory. It names no document path.
     if (value === 'crtr:memory:read_private:user')
         return { kind: 'memory', access: 'read_private', holder: 'user' };
     let match = /^crtr:memory:(read|rw):user(?::(.+))?$/.exec(value);

package/packages/crouter-identity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/identity",
-  "version": "0.3.549",
+  "version": "0.3.550",
   "description": "Northlight access-token verification and scope rules",
   "type": "module",
   "main": "./dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.549",
+  "version": "0.3.550",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/cli",
-      "version": "0.3.549",
+      "version": "0.3.550",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "workspaces": [
@@ -24,7 +24,7 @@
         "@milkdown/preset-gfm": "^7.22.3",
         "@milkdown/prose": "^7.22.3",
         "@milkdown/utils": "^7.22.3",
-        "@north-light/identity": "0.3.549",
+        "@north-light/identity": "0.3.550",
         "cron-parser": "^5.6.0",
         "esbuild": "^0.27.7",
         "jose": "^6.2.12",
@@ -12455,17 +12455,17 @@
     },
     "packages/crouter-api": {
       "name": "@north-light/api",
-      "version": "0.3.549",
+      "version": "0.3.550",
       "license": "UNLICENSED"
     },
     "packages/crouter-env-docker": {
       "name": "@north-light/env-docker",
-      "version": "0.3.549",
+      "version": "0.3.550",
       "license": "UNLICENSED"
     },
     "packages/crouter-identity": {
       "name": "@north-light/identity",
-      "version": "0.3.549",
+      "version": "0.3.550",
       "license": "UNLICENSED",
       "dependencies": {
         "jose": "^6.2.1"
@@ -12473,21 +12473,21 @@
     },
     "packages/crouter-plugin": {
       "name": "@north-light/plugin",
-      "version": "0.3.549",
+      "version": "0.3.550",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.549",
-        "@north-light/identity": "0.3.549"
+        "@north-light/api": "0.3.550",
+        "@north-light/identity": "0.3.550"
       }
     },
     "packages/crouter-sdk": {
       "name": "@north-light/sdk",
-      "version": "0.3.549",
+      "version": "0.3.550",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.549",
-        "@north-light/identity": "0.3.549",
-        "@north-light/plugin": "0.3.549",
+        "@north-light/api": "0.3.550",
+        "@north-light/identity": "0.3.550",
+        "@north-light/plugin": "0.3.550",
         "jose": "^6.2.1"
       },
       "bin": {

package/dist/core/graph/spaces/app.d.ts

@@ -1,3 +0,0 @@
-import type { Space } from './index.js';
-/** An app: its nodes (with their documents and jobs), its profiles and its app documents. */
-export declare const appSpace: Space;

package/dist/core/graph/spaces/app.js

@@ -1 +0,0 @@
-var S=Object.defineProperty;var l=(i,n)=>S(i,"name",{value:n,configurable:!0});import{covers as u}from"@north-light/identity";import{identityOf as a}from"./index.js";import{memoryScope as r,missingOwnMemoryScope as p}from"./own-memory.js";import{objectPlace as x,runPlace as f,runsSeeEachOther as O}from"../../runs/confinement.js";const M={sync:"runtime",async canRead(i,n,e,t,o){if(n.class==="person"||t.length===0)return!0;if(n.app.id===e.id)return await w(i,n,t)&&await p(i,n,e,t,o,"read")===null;const s=(await a(i,e)).external_id,c=l(y=>n.scopes!==null&&n.scopes.some(g=>u(g,y)),"held");return t[0].type==="node"?c(`crtr:objects:read:${s}`)||o.type==="document"&&o.kind==="report"&&c(`crtr:conversations:read:${s}`):c(await r(i,s,"read",t))},async canChange(i,n,e,t,o){if(n.class==="person")return!0;if(n.app.id===e.id)return t.length===0||await w(i,n,t)&&await p(i,n,e,t,o,"rw")===null;if(t.length===0||t[0].type==="node")return!1;const s=await r(i,(await a(i,e)).external_id,"rw",t);return n.scopes!==null&&n.scopes.some(c=>u(c,s))}},m=new WeakMap;async function w(i,n,e){if(n.class==="person"||e.length===0||e[0].type!=="node"||n.class==="app"&&n.place===void 0)return!0;let t=m.get(n);if(t===void 0&&(t=n.class==="app"?n.place:n.class==="node"?await f(n.node.id,i):n.place??await x(n.object.id,i),m.set(n,t)),t===null)return!0;const o=await f(e[0].id,i);return o===null?!t.isolated:O(t,o)}l(w,"runConfined");export{M as appSpace};