@north-light/crouter 0.3.317 → 0.3.319

package/dist/core/runtime/bin-contributions.js

@@ -1,186 +1,2 @@
-// Bare-binary contributions — the plain executables a node's bash can call by
-// name, with no `crtr` command leaf and no exec-command JSON protocol between
-// them and the agent.
-//
-// A plugin declares them in its manifest (`bin`), a user or project scope in
-// its own `config.json` (`bin`); both are a small name → root-relative-path
-// map. This module resolves those declarations across the same layering the
-// rest of the config uses (project stack > user, and within one root: that
-// root's own config > its enabled plugins), materializes one crouter-owned
-// shim directory of symlinks, and hands its path to the spawn-env boundary
-// (`spawn-env.ts`), which PREPENDS it to every broker child's PATH while
-// leaving the host PATH intact behind it.
-//
-// The shim directory exists so the declaration stays a per-name grant: crouter
-// links exactly the names that were declared, rather than putting a
-// contributor's whole `bin/` directory on the agent's PATH and admitting every
-// sibling file in it.
-//
-// These binaries are trusted local code running with the caller's authority —
-// the same authority the agent's bash tool already has. There is no sandbox,
-// no install hook, and no shell evaluation anywhere in this path. Containment
-// is checked while resolving the effective set; a contributor can change later
-// because it is trusted local code, not a sandboxed artifact.
-import { createHash } from 'node:crypto';
-import { existsSync, mkdirSync, realpathSync, renameSync, rmSync, statSync, symlinkSync } from 'node:fs';
-import { dirname, join, resolve, sep } from 'node:path';
-import { binDeclarationIssues, normalizeBin, readRawConfigAtRoot } from '../config.js';
-import { listInstalledPluginsInRoot } from '../installed-plugins.js';
-import { crtrHome } from '../canvas/paths.js';
-import { findProjectScopeRoots, scopeRoot } from '../scope.js';
-function contributorIssues(origin, scope, raw) {
-    return binDeclarationIssues(raw).map((issue) => ({ name: issue.name, origin, scope, message: issue.message }));
-}
-function pluginContributors(scope, root) {
-    return listInstalledPluginsInRoot(scope, root)
-        .filter((plugin) => plugin.enabled && plugin.manifest.bin !== undefined)
-        .sort((a, b) => a.name.localeCompare(b.name))
-        .map((plugin) => {
-        const origin = `plugin "${plugin.name}"`;
-        return { origin, scope, root: plugin.root, bin: normalizeBin(plugin.manifest.bin), issues: contributorIssues(origin, scope, plugin.manifest.bin) };
-    });
-}
-/** A scope's own `config.json` contributions. Paths resolve against the scope's
- *  AUTHORING root: the project directory for a project scope (so a repo writes
- *  `tools/repoctl`, where its tools actually live, not `../tools/repoctl` out
- *  of `.crouter/`), and `~/.crouter` itself for the user scope, which has no
- *  enclosing project. */
-function configContributor(scope, scopeRootPath) {
-    const raw = readRawConfigAtRoot(scopeRootPath)?.bin;
-    if (raw === undefined)
-        return [];
-    const origin = `config.json (${scopeRootPath})`;
-    const bin = normalizeBin(raw);
-    const root = scope === 'project' ? dirname(scopeRootPath) : scopeRootPath;
-    return [{ origin, scope, root, bin, issues: contributorIssues(origin, scope, raw) }];
-}
-/** The contribution LAYERS in ascending precedence: a later layer's entry
- *  replaces an earlier layer's same name. Within one root the root's own
- *  `config.json` outranks its plugins (the rule `layerPluginKinds` follows for
- *  `kinds`), and the project stack — nearest root last — outranks the user
- *  scope entirely. Contributors WITHIN one layer never outrank each other:
- *  two of them claiming one name is a collision, not a precedence question. */
-function contributionLayers(targetCwd, targetProfileId) {
-    const layers = [];
-    const userRoot = scopeRoot('user');
-    if (userRoot !== null) {
-        layers.push(pluginContributors('user', userRoot), configContributor('user', userRoot));
-    }
-    const projectRootsNearestFirst = findProjectScopeRoots(targetCwd, targetProfileId);
-    for (const root of [...projectRootsNearestFirst].reverse()) {
-        layers.push(pluginContributors('project', root), configContributor('project', root));
-    }
-    return layers.filter((layer) => layer.length > 0);
-}
-/** Resolve one declared path against its contributing root: it must stay
- *  inside that root, be a regular file, and carry a POSIX exec bit when the
- *  effective set is resolved. Returns the absolute real path, or the reason it
- *  is not usable. */
-function resolveTarget(root, relative) {
-    let rootReal;
-    let target;
-    try {
-        rootReal = realpathSync(root);
-        target = realpathSync(resolve(root, relative));
-    }
-    catch {
-        return { reason: `target does not exist: ${join(root, relative)}` };
-    }
-    if (target !== rootReal && !target.startsWith(rootReal + sep)) {
-        return { reason: `target escapes its contributing root: ${relative}` };
-    }
-    const stat = statSync(target);
-    if (!stat.isFile())
-        return { reason: `target is not a regular file: ${target}` };
-    if ((stat.mode & 0o111) === 0)
-        return { reason: `target lacks the POSIX exec bit: ${target}` };
-    return { target };
-}
-/** The effective bare-command set for one node's cwd/profile, plus every
- *  declaration that failed to become one.
- *
- *  Layers ascend in precedence (see `contributionLayers`). A name claimed by
- *  two contributors in the SAME layer selects no winner: it is reported and
- *  removed, so an ambiguous name resolves to nothing rather than to whichever
- *  plugin sorted first. A higher layer may still claim that name explicitly —
- *  that is an unambiguous choice, not a collision. */
-export function resolveBinContributions(targetCwd, targetProfileId) {
-    const bins = new Map();
-    const issues = [];
-    for (const layer of contributionLayers(targetCwd, targetProfileId)) {
-        const claims = new Map();
-        for (const contributor of layer) {
-            issues.push(...contributor.issues);
-            for (const name of Object.keys(contributor.bin)) {
-                const existing = claims.get(name);
-                if (existing === undefined)
-                    claims.set(name, [contributor]);
-                else
-                    existing.push(contributor);
-            }
-        }
-        for (const [name, claimants] of claims) {
-            if (claimants.length > 1) {
-                const origins = claimants.map((claimant) => claimant.origin).join(', ');
-                bins.delete(name);
-                for (const claimant of claimants) {
-                    issues.push({ name, origin: claimant.origin, scope: claimant.scope, message: `bare command "${name}" is claimed by ${origins} at the same precedence — no winner is selected and the name is not installed` });
-                }
-                continue;
-            }
-            const contributor = claimants[0];
-            const resolved = resolveTarget(contributor.root, contributor.bin[name]);
-            if ('reason' in resolved) {
-                issues.push({ name, origin: contributor.origin, scope: contributor.scope, message: resolved.reason });
-                continue;
-            }
-            bins.set(name, { name, target: resolved.target, origin: contributor.origin, scope: contributor.scope });
-        }
-    }
-    return { bins, issues };
-}
-/** Content address of one effective bare-command set — the shim directory's
- *  name. Because the address covers every name and target, an existing
- *  directory is already correct: nothing is ever rewritten in place, a changed
- *  set simply materializes beside the old one, and two processes racing the
- *  same set produce byte-identical trees. */
-function shimAddress(bins) {
-    const lines = [...bins.values()]
-        .sort((a, b) => a.name.localeCompare(b.name))
-        .map((bin) => `${bin.name}\u0000${bin.target}`)
-        .join('\n');
-    return createHash('sha256').update(lines).digest('hex').slice(0, 32);
-}
-/** Materialize (idempotently) the shim directory for one effective set and
- *  return its absolute path, or null when the set is empty. Built in a staging
- *  dir and renamed into place, so a concurrent launch either sees no directory
- *  or sees a complete one. */
-export function ensureBinShimDir(bins) {
-    if (bins.size === 0)
-        return null;
-    const dir = join(crtrHome(), 'bin-shims', shimAddress(bins));
-    if (existsSync(dir))
-        return dir;
-    const staging = `${dir}.staging-${process.pid}-${Date.now().toString(36)}`;
-    mkdirSync(staging, { recursive: true });
-    try {
-        for (const bin of bins.values())
-            symlinkSync(bin.target, join(staging, bin.name));
-        renameSync(staging, dir);
-    }
-    catch (error) {
-        rmSync(staging, { recursive: true, force: true });
-        // Another launch materializing the same address won the rename — its tree
-        // is identical by construction, so the address is still correct.
-        if (existsSync(dir))
-            return dir;
-        throw error;
-    }
-    return dir;
-}
-/** The shim directory to prepend to a target node's PATH, or null when that
- *  node's scopes declare no bare command. The one entry point the spawn-env
- *  boundary calls. */
-export function binShimDirFor(targetCwd, targetProfileId) {
-    return ensureBinShimDir(resolveBinContributions(targetCwd, targetProfileId).bins);
-}
+var S=Object.defineProperty;var i=(r,t)=>S(r,"name",{value:t,configurable:!0});import{createHash as j}from"node:crypto";import{existsSync as g,mkdirSync as x,realpathSync as p,renameSync as v,rmSync as w,statSync as C,symlinkSync as I}from"node:fs";import{dirname as R,join as l,resolve as k,sep as D}from"node:path";import{binDeclarationIssues as B,normalizeBin as d,readRawConfigAtRoot as F}from"../config.js";import{listInstalledPluginsInRoot as z}from"../installed-plugins.js";import{crtrHome as A}from"../canvas/paths.js";import{findProjectScopeRoots as H,scopeRoot as M}from"../scope.js";function b(r,t,e){return B(e).map(n=>({name:n.name,origin:r,scope:t,message:n.message}))}i(b,"contributorIssues");function h(r,t){return z(r,t).filter(e=>e.enabled&&e.manifest.bin!==void 0).sort((e,n)=>e.name.localeCompare(n.name)).map(e=>{const n=`plugin "${e.name}"`;return{origin:n,scope:r,root:e.root,bin:d(e.manifest.bin),issues:b(n,r,e.manifest.bin)}})}i(h,"pluginContributors");function y(r,t){const e=F(t)?.bin;if(e===void 0)return[];const n=`config.json (${t})`,c=d(e),s=r==="project"?R(t):t;return[{origin:n,scope:r,root:s,bin:c,issues:b(n,r,e)}]}i(y,"configContributor");function O(r,t){const e=[],n=M("user");n!==null&&e.push(h("user",n),y("user",n));const c=H(r,t);for(const s of[...c].reverse())e.push(h("project",s),y("project",s));return e.filter(s=>s.length>0)}i(O,"contributionLayers");function L(r,t){let e,n;try{e=p(r),n=p(k(r,t))}catch{return{reason:`target does not exist: ${l(r,t)}`}}if(n!==e&&!n.startsWith(e+D))return{reason:`target escapes its contributing root: ${t}`};const c=C(n);return c.isFile()?(c.mode&73)===0?{reason:`target lacks the POSIX exec bit: ${n}`}:{target:n}:{reason:`target is not a regular file: ${n}`}}i(L,"resolveTarget");function N(r,t){const e=new Map,n=[];for(const c of O(r,t)){const s=new Map;for(const o of c){n.push(...o.issues);for(const u of Object.keys(o.bin)){const a=s.get(u);a===void 0?s.set(u,[o]):a.push(o)}}for(const[o,u]of s){if(u.length>1){const $=u.map(m=>m.origin).join(", ");e.delete(o);for(const m of u)n.push({name:o,origin:m.origin,scope:m.scope,message:`bare command "${o}" is claimed by ${$} at the same precedence \u2014 no winner is selected and the name is not installed`});continue}const a=u[0],f=L(a.root,a.bin[o]);if("reason"in f){n.push({name:o,origin:a.origin,scope:a.scope,message:f.reason});continue}e.set(o,{name:o,target:f.target,origin:a.origin,scope:a.scope})}}return{bins:e,issues:n}}i(N,"resolveBinContributions");function T(r){const t=[...r.values()].sort((e,n)=>e.name.localeCompare(n.name)).map(e=>`${e.name}\0${e.target}`).join(`
+`);return j("sha256").update(t).digest("hex").slice(0,32)}i(T,"shimAddress");function W(r){if(r.size===0)return null;const t=l(A(),"bin-shims",T(r));if(g(t))return t;const e=`${t}.staging-${process.pid}-${Date.now().toString(36)}`;x(e,{recursive:!0});try{for(const n of r.values())I(n.target,l(e,n.name));v(e,t)}catch(n){if(w(e,{recursive:!0,force:!0}),g(t))return t;throw n}return t}i(W,"ensureBinShimDir");function U(r,t){return W(N(r,t).bins)}i(U,"binShimDirFor");export{U as binShimDirFor,W as ensureBinShimDir,N as resolveBinContributions};

package/dist/core/runtime/boot-root.js

@@ -1,107 +1 @@
-// boot-root.ts — the user-opened front door (bare `crtr`), canvas-free.
-//
-// bootRoot creates the resident root through crtrd (`createNode({root:true})`,
-// which the daemon serves at readiness 'await' — node birth, broker launch, and
-// view-socket readiness ALL happen server-side), then execs `crtr surface
-// attach` inline so THIS terminal becomes the broker's writable viewer.
-//
-// crtrd is the sole owner of canvas state (see crtrd-sole-state-owner), so this
-// module opens NO canvas.db: node creation and the viewer-focus row both route
-// through the /v1 API client. The only work that stays client-side is what
-// genuinely belongs to the user's terminal — the interactive startup profile
-// pick, the tmux-binding reconcile, and the inline attach exec. This is why the
-// front-door boot path (cli.js → front-door.js → here) reaches zero canvas code.
-import { spawn } from 'node:child_process';
-import { inTmux, currentTmux, viewerSplitEnv } from './placement-tmux.js';
-import { selectProfileForCwd } from '../profiles/select.js';
-import { cliClient } from '../../commands/api-client.js';
-import { mark } from '../timing.js';
-/** Boot the front-door root: create the resident root through crtrd (broker
- *  launched + view socket ready server-side), register THIS terminal's pane as
- *  its foreground viewer, then exec `crtr surface attach` inline so this terminal
- *  becomes a writable viewer. Does not return — it process.exit()s
- *  when the inline attach exits (detach leaves the resident broker running, to
- *  be reconnected later). */
-export async function bootRoot(opts) {
-    // crtr is tmux-only: the front door execs `crtr surface attach` inline in THIS
-    // pane to become the root's writable viewer, so there must be a tmux pane to
-    // anchor on. Outside tmux there is no viewer surface — throw with a friendly
-    // message rather than boot a root nobody can see.
-    if (!inTmux()) {
-        throw new Error('crtr must be started from inside a tmux session — start tmux first (e.g. `tmux new -s work`), then run `crtr` there.');
-    }
-    const kind = opts.kind;
-    // The front door's only source of profile identity — a root has no spawner to
-    // inherit from. Runs BEFORE the create call: explicit --profile > MRU profile
-    // covering cwd > a synchronous create-or-root-profile prompt (the stable root
-    // profile, headless). INTERACTIVE, so it must stay client-side; the resolved
-    // id is handed to crtrd so the server never re-runs the picker.
-    mark('boot_root.start');
-    const profileId = await selectProfileForCwd(opts.cwd, opts.profile, opts.pickProfile ?? false);
-    mark('boot_root.profile_resolved');
-    // Create the resident root through crtrd. `root:true` makes the daemon spawn
-    // it at readiness 'await' — the node row is born (base mode, resident
-    // lifecycle, spawned_by null), its detached broker engine is launched, and its
-    // view socket is bound before this returns. The starter prompt is persisted as
-    // the goal server-side (empty ⇒ no kickoff turn). No boot spinner: the attach
-    // viewer paints the crouton banner the instant the engine attaches (~1s),
-    // which is the real "we're up" signal.
-    const detail = await cliClient().createNode({
-        ...(kind !== undefined ? { kind } : {}),
-        mode: 'base',
-        prompt: opts.prompt,
-        profile: profileId,
-        cwd: opts.cwd,
-        ...(opts.name !== undefined ? { name: opts.name } : kind !== undefined ? { name: kind } : {}),
-        root: true,
-        // The front door is exactly the wait a warm spare exists to remove: a bare
-        // resident root with no kickoff. A miss costs nothing (cold spawn) and
-        // mints the spare that serves the next one.
-        prefer_warm: true,
-    });
-    const nodeId = detail.node_id;
-    mark('boot_root.node_created', { node: nodeId });
-    // The crouter-owned tmux bindings (including the inbox-toggle key folded into
-    // the same manifest sweep) are NOT reconciled here: that sweep is ~20
-    // sequential `spawnSync tmux` calls (measured ~150ms) and the attach viewer
-    // this boot is about to spawn already runs it a tick after its first paint
-    // (`refreshAttachBindingSnapshot` in viewer.ts). Doing it here only delays
-    // that viewer.
-    // This terminal becomes the root's attach VIEWER in the user's CURRENT session,
-    // so its window stays where the user already is. The node row carries NO
-    // presence — a broker node's pane/window/tmux_session stay NULL; the viewer
-    // pane lives in the focuses table. Register the FOREGROUND front-door pane as
-    // this node's focus (canvas write, routed through crtrd) so focus/nav can find
-    // it. Best-effort — attach works regardless.
-    const here = currentTmux();
-    if (here !== null) {
-        try {
-            await cliClient().registerFocus({ node_id: nodeId, pane: here.pane, session: here.session, window: here.window });
-        }
-        catch { /* best-effort */ }
-    }
-    // Broker is the only host: the root runs as a detached broker engine (already
-    // launched above), and THIS terminal execs `crtr surface attach` inline to
-    // become its writable viewer. The attach's own ensureAttach is an idempotent
-    // no-op on the already-live broker. CRTR_ATTACH_WAIT_MS tells the viewer to
-    // poll view.sock until it accepts instead of failing fast on a not-yet-bound
-    // socket. CRTR_ATTACH_BORROWED_PANE tells the viewer that its pane is the
-    // user's OWN pre-existing shell pane (not one crtr split open): on a
-    // detach-reap of an empty root it must delete the node WITHOUT kill-pane, else
-    // a plain ctrl+c closes the user's whole tmux pane.
-    const attachEnv = {
-        ...process.env,
-        ...viewerSplitEnv(),
-        CRTR_ATTACH_WAIT_MS: '30000',
-        ...(opts.prompt !== undefined && opts.prompt !== '' ? { CRTR_ATTACH_INITIAL_WHIP: '1' } : {}),
-    };
-    if (here !== null)
-        attachEnv['CRTR_ATTACH_BORROWED_PANE'] = here.pane;
-    mark('boot_root.viewer_spawn');
-    const attachChild = spawn('crtr', ['surface', 'attach', 'to', nodeId], { stdio: 'inherit', env: attachEnv });
-    const code = await new Promise((res) => {
-        attachChild.once('exit', (exitCode) => res(exitCode ?? 0));
-        attachChild.once('error', () => res(1));
-    });
-    process.exit(code);
-}
+var l=Object.defineProperty;var c=(e,o)=>l(e,"name",{value:o,configurable:!0});import{spawn as p}from"node:child_process";import{inTmux as u,currentTmux as _,viewerSplitEnv as T}from"./placement-tmux.js";import{selectProfileForCwd as h}from"../profiles/select.js";import{cliClient as s}from"../../commands/api-client.js";import{mark as t}from"../timing.js";async function k(e){if(!u())throw new Error("crtr must be started from inside a tmux session \u2014 start tmux first (e.g. `tmux new -s work`), then run `crtr` there.");const o=e.kind;t("boot_root.start");const m=await h(e.cwd,e.profile,e.pickProfile??!1);t("boot_root.profile_resolved");const n=(await s().createNode({...o!==void 0?{kind:o}:{},mode:"base",prompt:e.prompt,profile:m,cwd:e.cwd,...e.name!==void 0?{name:e.name}:o!==void 0?{name:o}:{},root:!0,prefer_warm:!0})).node_id;t("boot_root.node_created",{node:n});const r=_();if(r!==null)try{await s().registerFocus({node_id:n,pane:r.pane,session:r.session,window:r.window})}catch{}const i={...process.env,...T(),CRTR_ATTACH_WAIT_MS:"30000",...e.prompt!==void 0&&e.prompt!==""?{CRTR_ATTACH_INITIAL_WHIP:"1"}:{}};r!==null&&(i.CRTR_ATTACH_BORROWED_PANE=r.pane),t("boot_root.viewer_spawn");const a=p("crtr",["surface","attach","to",n],{stdio:"inherit",env:i}),f=await new Promise(d=>{a.once("exit",w=>d(w??0)),a.once("error",()=>d(1))});process.exit(f)}c(k,"bootRoot");export{k as bootRoot};

package/dist/core/runtime/branded-host.js

@@ -1,264 +1,2 @@
-// branded-host.ts — a crouter-branded copy of the `node` binary, so the
-// long-lived engine processes (brokers + the crtrd daemon) show "crouter" in
-// macOS' TCC / Full Disk Access list instead of the generic "node".
-//
-// WHY a real copied binary (not a symlink, not process.title): macOS keys a
-// Full Disk Access entry on the Mach-O binary's *filename* — not argv[0], not
-// process.title, and symlinks resolve to their realpath. So the ONLY way to show
-// a branded name is to launch the engine from a real Mach-O file whose filename
-// is the brand. We copy the node launcher to `~/.crouter/host/crouter`.
-//
-// WHY self-contained (libnode beside it): a Homebrew node is a small (~70 KB)
-// launcher that dynamically loads `@rpath/libnode.<abi>.dylib` (~70 MB). node's
-// LC_RPATH includes `@loader_path`, so a copy of that dylib placed *beside* the
-// branded binary resolves with no DYLD_* env var (which SIP can strip) and no
-// dependency on the Cellar path surviving — even after a `brew uninstall` of the
-// old keg, the branded copy keeps running. A statically-linked node (nodejs.org)
-// has no separate libnode; we just copy the binary. The remaining absolute
-// `/opt/homebrew/opt/...` deps resolve by their baked-in absolute paths.
-//
-// SELF-HEAL: ensureBrandedHost() rebuilds the copy whenever the live node drifts
-// (a `brew upgrade node` moves realpath(execPath) to a new Cellar version) or the
-// copy is missing. The drift check is a cheap marker compare — no subprocess, no
-// copy — on the happy path.
-import { copyFileSync, mkdirSync, existsSync, readFileSync, writeFileSync, chmodSync, readdirSync, renameSync, realpathSync, unlinkSync, rmSync, linkSync, } from 'node:fs';
-import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { CRTR_DIR_NAME } from '../../types.js';
-import { emitEvent } from '../events/emit.js';
-import { withExclusiveDirectoryLock } from '../exclusive-lock.js';
-/** The filename the FDA / TCC entry is shown under. */
-const BRANDED_BIN_NAME = 'crouter';
-/** Machine-global host dir. Deliberately NOT under `CRTR_HOME` (tests override
- *  that to an isolated temp): the branded binary is a per-machine artifact keyed
- *  to the installed node, shared across every canvas home. */
-export function brandedHostDir() {
-    return join(homedir(), CRTR_DIR_NAME, 'host');
-}
-export function brandedHostBin() {
-    return join(brandedHostDir(), BRANDED_BIN_NAME);
-}
-function markerPath() {
-    return join(brandedHostDir(), '.source.json');
-}
-/** Locate the `libnode.<abi>.dylib` a Homebrew node loads via `@rpath`. node's
- *  rpaths are `@loader_path` and `@loader_path/../lib`, so check the binary's own
- *  dir first, then the sibling `lib/`. Returns the absolute path, or null for a
- *  statically-linked node that has no separate libnode. */
-function findLibnode(nodeBin) {
-    const binDir = dirname(nodeBin);
-    for (const dir of [binDir, join(binDir, '..', 'lib')]) {
-        if (!existsSync(dir))
-            continue;
-        const hit = readdirSync(dir).find((f) => f.startsWith('libnode.') && f.endsWith('.dylib'));
-        if (hit !== undefined)
-            return join(dir, hit);
-    }
-    return null;
-}
-/** Copy `src` → `dst` via a unique temp + atomic rename, so a failed copy
- * never leaves a half-written artifact. Host-wide concurrency is serialized by
- * the dedicated reconcile lock below. */
-function atomicCopy(src, dst, mode) {
-    const tmp = `${dst}.tmp.${process.pid}.${Math.random().toString(36).slice(2)}`;
-    copyFileSync(src, tmp);
-    if (mode !== undefined)
-        chmodSync(tmp, mode);
-    renameSync(tmp, dst);
-}
-function readMarker(path = markerPath()) {
-    try {
-        return JSON.parse(readFileSync(path, 'utf8'));
-    }
-    catch {
-        return null;
-    }
-}
-const HOST_LOCK_TIMEOUT_MS = 30_000;
-/** Serialize reconciliation of the one machine-global host tuple. This lock is
- * deliberately separate from the immutable runtime-generation install lock. */
-function withBrandedHostLock(run) {
-    const root = join(homedir(), CRTR_DIR_NAME);
-    const lockPath = join(root, 'host.lock');
-    mkdirSync(root, { recursive: true });
-    return withExclusiveDirectoryLock(lockPath, run, {
-        timeoutMs: HOST_LOCK_TIMEOUT_MS,
-        timeoutError: () => new Error(`timed out waiting for branded host lock: ${lockPath}`),
-    });
-}
-/** macOS keys FDA grants on the Mach-O cdhash. A real developer identity
- *  keeps that hash stable across branded-host rebuilds; ad-hoc signing is the
- *  portable default for machines without a local signing certificate. */
-export function codesignIdentitiesForBrandedHost(opts = {}) {
-    const configured = opts.configured?.trim();
-    if (configured)
-        return [configured];
-    const discovered = opts.discovered?.trim();
-    return [discovered || '-'];
-}
-function discoverCodesignIdentity() {
-    if (process.platform !== 'darwin')
-        return null;
-    const res = spawnSync('security', ['find-identity', '-v', '-p', 'codesigning'], { stdio: ['pipe', 'pipe', 'pipe'] });
-    if (res.status !== 0)
-        return null;
-    const stdout = (res.stdout ?? '').toString();
-    const identities = stdout
-        .split('\n')
-        .map((line) => line.match(/\)\s+[A-Fa-f0-9]{40}\s+"([^"]+)"/)?.[1] ?? null)
-        .filter((identity) => identity !== null);
-    return identities.find((identity) => identity.startsWith('Apple Development:'))
-        ?? identities.find((identity) => identity.startsWith('Developer ID Application:'))
-        ?? identities[0]
-        ?? null;
-}
-function runCodesign(binPath, identity) {
-    const res = spawnSync('codesign', ['-s', identity, '--deep', '--force', binPath], { stdio: ['pipe', 'pipe', 'pipe'] });
-    return { ok: res.status === 0, stderr: (res.stderr ?? '').toString().trim() };
-}
-function signBrandedHost(binPath) {
-    if (process.platform !== 'darwin')
-        return;
-    const identities = codesignIdentitiesForBrandedHost({
-        configured: process.env['CRTR_CODESIGN_IDENTITY'],
-        discovered: discoverCodesignIdentity(),
-    });
-    let lastError = '';
-    for (const identity of identities) {
-        const res = runCodesign(binPath, identity);
-        if (res.ok)
-            return;
-        lastError = res.stderr;
-    }
-    if (lastError && !lastError.includes('valid on disk')) {
-        emitEvent({ event: 'host.codesign.failed', level: 'debug', error: lastError });
-    }
-    throw new Error(`codesign failed for ${binPath}: ${lastError || 'codesign did not exit successfully'}`);
-}
-export function signBrandedHostArtifacts(binPath, libnodePath, sign = signBrandedHost) {
-    if (libnodePath !== null)
-        sign(libnodePath);
-    sign(binPath);
-}
-export function brandedHostWorks(binPath, timeoutMs = 5_000) {
-    try {
-        const res = spawnSync(binPath, ['-e', ''], {
-            stdio: 'ignore',
-            timeout: timeoutMs,
-        });
-        return res.status === 0;
-    }
-    catch {
-        return false;
-    }
-}
-/** Ensure the branded host binary exists and matches the live node; return its
- *  absolute path. Idempotent and self-healing. Throws on a genuine build failure
- *  (disk full / permissions) — branding is load-bearing for FDA, so a failure is
- *  surfaced, never silently masked by falling back to `node`. */
-export function ensureBrandedHost() {
-    return withBrandedHostLock(() => {
-        const hostDir = brandedHostDir();
-        const dst = brandedHostBin();
-        const src = realpathSync(process.execPath);
-        // If THIS process is already running as the branded host (the daemon or a
-        // broker spawning a child), don't rebuild from ourselves — we can't see the
-        // real node from here, and the live process proves the copy works. Drift is
-        // healed by the next real-`node` CLI invocation.
-        if (existsSync(dst) && realpathSync(dst) === src)
-            return dst;
-        const marker = readMarker();
-        const libnodeSrc = findLibnode(src);
-        const libnodeName = libnodeSrc !== null ? libnodeSrc.split('/').pop() : null;
-        const tupleExists = (candidate) => existsSync(dst) &&
-            candidate !== null &&
-            candidate.version === 2 &&
-            (candidate.libnode === null || existsSync(join(hostDir, candidate.libnode)));
-        const tupleMatches = (candidate) => tupleExists(candidate) && candidate.source === src && candidate.libnode === libnodeName;
-        if (tupleMatches(marker) && brandedHostWorks(dst))
-            return dst;
-        // Build and validate a complete tuple privately. Failures before publication
-        // leave any previous valid host untouched.
-        mkdirSync(hostDir, { recursive: true });
-        const stageDir = join(hostDir, `.reconcile.${process.pid}.${Math.random().toString(36).slice(2)}`);
-        const backupDir = join(stageDir, 'previous');
-        mkdirSync(stageDir);
-        let publicationStarted = false;
-        const previousTupleIsValid = tupleExists(marker) && brandedHostWorks(dst);
-        try {
-            const stageBin = join(stageDir, BRANDED_BIN_NAME);
-            const stageLibnode = libnodeName !== null ? join(stageDir, libnodeName) : null;
-            if (libnodeSrc !== null && stageLibnode !== null)
-                atomicCopy(libnodeSrc, stageLibnode);
-            atomicCopy(src, stageBin, 0o755);
-            signBrandedHostArtifacts(stageBin, stageLibnode);
-            if (!brandedHostWorks(stageBin)) {
-                throw new Error(`rebuilt branded host failed its startup check: ${stageBin}`);
-            }
-            if (previousTupleIsValid)
-                backupHostTuple(backupDir, dst, marker);
-            publicationStarted = true;
-            if (stageLibnode !== null)
-                renameSync(stageLibnode, join(hostDir, libnodeName));
-            renameSync(stageBin, dst);
-            atomicCopyMarker({ version: 2, source: src, libnode: libnodeName });
-            if (!tupleMatches(readMarker()) || !brandedHostWorks(dst)) {
-                throw new Error(`published branded host tuple failed validation: ${dst}`);
-            }
-            // Cleanup follows successful marker-last publication and validation.
-            if (marker?.libnode != null && marker.libnode !== libnodeName) {
-                try {
-                    unlinkSync(join(hostDir, marker.libnode));
-                }
-                catch {
-                    /* best-effort */
-                }
-            }
-            return dst;
-        }
-        catch (error) {
-            if (publicationStarted && previousTupleIsValid)
-                restoreHostTuple(backupDir, dst, marker);
-            throw error;
-        }
-        finally {
-            rmSync(stageDir, { recursive: true, force: true });
-        }
-    });
-}
-function atomicCopyMarker(marker) {
-    const path = markerPath();
-    const tmp = `${path}.tmp.${process.pid}.${Math.random().toString(36).slice(2)}`;
-    writeFileSync(tmp, JSON.stringify(marker));
-    renameSync(tmp, path);
-}
-function backupHostTuple(backupDir, binPath, marker) {
-    mkdirSync(backupDir);
-    linkSync(binPath, join(backupDir, BRANDED_BIN_NAME));
-    if (marker.libnode !== null)
-        linkSync(join(brandedHostDir(), marker.libnode), join(backupDir, marker.libnode));
-    writeFileSync(join(backupDir, '.source.json'), JSON.stringify(marker));
-}
-function restoreHostTuple(backupDir, binPath, marker) {
-    if (marker.libnode !== null)
-        renameSync(join(backupDir, marker.libnode), join(brandedHostDir(), marker.libnode));
-    renameSync(join(backupDir, BRANDED_BIN_NAME), binPath);
-    renameSync(join(backupDir, '.source.json'), markerPath());
-    if (!brandedHostWorks(binPath))
-        throw new Error(`failed to restore previous branded host tuple: ${binPath}`);
-}
-/** The path the engine (broker / daemon) should be launched from. On macOS in a
- * compiled (production) build this is the validated branded host; otherwise —
- * non-darwin (TCC is macOS-only), source/tsx (dev + the test suite: never copy
- * 70 MB into the real ~/.crouter), or the explicit `CRTR_BRANDED_HOST=0`
- * opt-out — it is the live node. */
-export function hostExecPath() {
-    if (process.env['CRTR_BRANDED_HOST'] === '0')
-        return process.execPath;
-    if (process.platform !== 'darwin')
-        return process.execPath;
-    if (import.meta.url.endsWith('.ts'))
-        return process.execPath;
-    return ensureBrandedHost();
-}
+var B=Object.defineProperty;var o=(r,t)=>B(r,"name",{value:t,configurable:!0});import{copyFileSync as I,mkdirSync as m,existsSync as h,readFileSync as k,writeFileSync as $,chmodSync as C,readdirSync as R,renameSync as u,realpathSync as _,unlinkSync as A,rmSync as O,linkSync as H}from"node:fs";import{homedir as T}from"node:os";import{dirname as W,join as i}from"node:path";import{spawnSync as S}from"node:child_process";import{CRTR_DIR_NAME as D}from"../../types.js";import{emitEvent as F}from"../events/emit.js";import{withExclusiveDirectoryLock as L}from"../exclusive-lock.js";const y="crouter";function p(){return i(T(),D,"host")}o(p,"brandedHostDir");function j(){return i(p(),y)}o(j,"brandedHostBin");function g(){return i(p(),".source.json")}o(g,"markerPath");function J(r){const t=W(r);for(const e of[t,i(t,"..","lib")]){if(!h(e))continue;const n=R(e).find(c=>c.startsWith("libnode.")&&c.endsWith(".dylib"));if(n!==void 0)return i(e,n)}return null}o(J,"findLibnode");function M(r,t,e){const n=`${t}.tmp.${process.pid}.${Math.random().toString(36).slice(2)}`;I(r,n),e!==void 0&&C(n,e),u(n,t)}o(M,"atomicCopy");function N(r=g()){try{return JSON.parse(k(r,"utf8"))}catch{return null}}o(N,"readMarker");const P=3e4;function G(r){const t=i(T(),D),e=i(t,"host.lock");return m(t,{recursive:!0}),L(e,r,{timeoutMs:P,timeoutError:o(()=>new Error(`timed out waiting for branded host lock: ${e}`),"timeoutError")})}o(G,"withBrandedHostLock");function K(r={}){const t=r.configured?.trim();return t?[t]:[r.discovered?.trim()||"-"]}o(K,"codesignIdentitiesForBrandedHost");function U(){if(process.platform!=="darwin")return null;const r=S("security",["find-identity","-v","-p","codesigning"],{stdio:["pipe","pipe","pipe"]});if(r.status!==0)return null;const e=(r.stdout??"").toString().split(`
+`).map(n=>n.match(/\)\s+[A-Fa-f0-9]{40}\s+"([^"]+)"/)?.[1]??null).filter(n=>n!==null);return e.find(n=>n.startsWith("Apple Development:"))??e.find(n=>n.startsWith("Developer ID Application:"))??e[0]??null}o(U,"discoverCodesignIdentity");function V(r,t){const e=S("codesign",["-s",t,"--deep","--force",r],{stdio:["pipe","pipe","pipe"]});return{ok:e.status===0,stderr:(e.stderr??"").toString().trim()}}o(V,"runCodesign");function Y(r){if(process.platform!=="darwin")return;const t=K({configured:process.env.CRTR_CODESIGN_IDENTITY,discovered:U()});let e="";for(const n of t){const c=V(r,n);if(c.ok)return;e=c.stderr}throw e&&!e.includes("valid on disk")&&F({event:"host.codesign.failed",level:"debug",error:e}),new Error(`codesign failed for ${r}: ${e||"codesign did not exit successfully"}`)}o(Y,"signBrandedHost");function q(r,t,e=Y){t!==null&&e(t),e(r)}o(q,"signBrandedHostArtifacts");function a(r,t=5e3){try{return S(r,["-e",""],{stdio:"ignore",timeout:t}).status===0}catch{return!1}}o(a,"brandedHostWorks");function z(){return G(()=>{const r=p(),t=j(),e=_(process.execPath);if(h(t)&&_(t)===e)return t;const n=N(),c=J(e),d=c!==null?c.split("/").pop():null,b=o(s=>h(t)&&s!==null&&s.version===2&&(s.libnode===null||h(i(r,s.libnode))),"tupleExists"),v=o(s=>b(s)&&s.source===e&&s.libnode===d,"tupleMatches");if(v(n)&&a(t))return t;m(r,{recursive:!0});const l=i(r,`.reconcile.${process.pid}.${Math.random().toString(36).slice(2)}`),w=i(l,"previous");m(l);let E=!1;const x=b(n)&&a(t);try{const s=i(l,y),f=d!==null?i(l,d):null;if(c!==null&&f!==null&&M(c,f),M(e,s,493),q(s,f),!a(s))throw new Error(`rebuilt branded host failed its startup check: ${s}`);if(x&&X(w,t,n),E=!0,f!==null&&u(f,i(r,d)),u(s,t),Q({version:2,source:e,libnode:d}),!v(N())||!a(t))throw new Error(`published branded host tuple failed validation: ${t}`);if(n?.libnode!=null&&n.libnode!==d)try{A(i(r,n.libnode))}catch{}return t}catch(s){throw E&&x&&Z(w,t,n),s}finally{O(l,{recursive:!0,force:!0})}})}o(z,"ensureBrandedHost");function Q(r){const t=g(),e=`${t}.tmp.${process.pid}.${Math.random().toString(36).slice(2)}`;$(e,JSON.stringify(r)),u(e,t)}o(Q,"atomicCopyMarker");function X(r,t,e){m(r),H(t,i(r,y)),e.libnode!==null&&H(i(p(),e.libnode),i(r,e.libnode)),$(i(r,".source.json"),JSON.stringify(e))}o(X,"backupHostTuple");function Z(r,t,e){if(e.libnode!==null&&u(i(r,e.libnode),i(p(),e.libnode)),u(i(r,y),t),u(i(r,".source.json"),g()),!a(t))throw new Error(`failed to restore previous branded host tuple: ${t}`)}o(Z,"restoreHostTuple");function ut(){return process.env.CRTR_BRANDED_HOST==="0"||process.platform!=="darwin"||import.meta.url.endsWith(".ts")?process.execPath:z()}o(ut,"hostExecPath");export{j as brandedHostBin,p as brandedHostDir,a as brandedHostWorks,K as codesignIdentitiesForBrandedHost,z as ensureBrandedHost,ut as hostExecPath,q as signBrandedHostArtifacts};