@nowcrew/daemon 0.5.35 → 0.5.37

package/dist/managed-service-lifecycle.js

@@ -0,0 +1,189 @@
+import { randomUUID } from "node:crypto";
+import { acquireDaemonInstallationLease } from "./daemon-installation-lease.js";
+import { installService, ensureServiceEnabled, readServiceDescriptor, serviceAction, uninstallService, } from "./computer-service.js";
+import { ManagedServiceConflictError, ManagedServiceRegistryError, assertRegistryCoversDescriptors, listManagedServiceDescriptorPaths, managedServiceIdentityMatches, managedServiceConflict, normalizeManagedServiceRecord, serviceDescriptorSha256, withManagedServiceRegistryLock, } from "./managed-service-registry.js";
+function requirePortableManagedSpec(spec) {
+    if ((spec.platform !== "darwin" && spec.platform !== "linux")
+        || spec.descriptorPath === null
+        || spec.descriptor === null) {
+        throw new ManagedServiceRegistryError("Managed service registry supports launchd and systemd descriptors only");
+    }
+}
+export function buildManagedServiceRecord(input) {
+    requirePortableManagedSpec(input.spec);
+    return normalizeManagedServiceRecord({
+        version: 1,
+        generation: (input.generation ?? randomUUID)(),
+        platform: input.spec.platform,
+        serviceId: input.spec.id,
+        profile: input.spec.profile,
+        daemonHome: input.daemonHome,
+        agentsRoot: input.agentsRoot,
+        nodePath: input.nodePath,
+        entryPath: input.entryPath,
+        packageRoot: input.packageRoot,
+        npmPrefix: input.npmPrefix,
+        descriptorPath: input.spec.descriptorPath,
+        descriptorSha256: serviceDescriptorSha256(input.spec.descriptor),
+        createdAt: (input.now ?? (() => new Date()))().toISOString(),
+    });
+}
+function sameRecord(left, right) {
+    return JSON.stringify(left) === JSON.stringify(right);
+}
+function sameManagedIdentity(left, right) {
+    const { generation: _generation, createdAt: _createdAt, ...expected } = right;
+    return managedServiceIdentityMatches(left, expected);
+}
+function assertRecordDescribesSpec(input) {
+    requirePortableManagedSpec(input.spec);
+    const { spec, record } = input;
+    const normalizedDescriptorPath = normalizeManagedServiceRecord({
+        ...record,
+        descriptorPath: spec.descriptorPath,
+    }).descriptorPath;
+    if (record.platform !== spec.platform
+        || record.serviceId !== spec.id
+        || record.profile !== spec.profile
+        || record.descriptorPath !== normalizedDescriptorPath
+        || record.descriptorSha256 !== serviceDescriptorSha256(spec.descriptor)) {
+        throw new ManagedServiceRegistryError(`Managed service record does not describe '${spec.id}'`);
+    }
+}
+export async function installManagedService(input) {
+    assertRecordDescribesSpec(input);
+    requirePortableManagedSpec(input.spec);
+    const acquire = input.acquireInstallationLease ?? acquireDaemonInstallationLease;
+    await withManagedServiceRegistryLock(input.registry ?? {}, async ({ services, replace }) => {
+        const exact = services.find((record) => sameManagedIdentity(record, input.record));
+        if (exact !== undefined) {
+            const descriptor = await readServiceDescriptor(input.spec);
+            if (descriptor === input.spec.descriptor) {
+                await ensureServiceEnabled(input.spec, input.runner);
+                return;
+            }
+            if (descriptor !== null) {
+                throw new ManagedServiceRegistryError(`Installed descriptor for '${input.spec.id}' does not match its registry record`);
+            }
+            const lease = await acquire(input.record.npmPrefix, {
+                ...(input.registry?.userHome === undefined ? {} : { userHome: input.registry.userHome }),
+            });
+            try {
+                await installService(input.spec, input.runner);
+            }
+            finally {
+                await lease.close();
+            }
+            return;
+        }
+        const conflict = managedServiceConflict(services, input.record);
+        if (conflict !== null) {
+            throw new ManagedServiceConflictError(conflict.resource, input.record, conflict.owner);
+        }
+        const existingDescriptor = await readServiceDescriptor(input.spec);
+        if (existingDescriptor === input.spec.descriptor) {
+            await ensureServiceEnabled(input.spec, input.runner);
+            await replace([...services, input.record].sort((left, right) => left.serviceId.localeCompare(right.serviceId)));
+            return;
+        }
+        if (existingDescriptor !== null) {
+            throw new ManagedServiceRegistryError(`Existing descriptor for '${input.spec.id}' conflicts with the requested identity`);
+        }
+        const lease = await acquire(input.record.npmPrefix, {
+            ...(input.registry?.userHome === undefined ? {} : { userHome: input.registry.userHome }),
+        });
+        try {
+            const descriptor = await readServiceDescriptor(input.spec);
+            if (descriptor === null) {
+                await installService(input.spec, input.runner);
+                await input.hooks?.afterDescriptorInstall?.();
+            }
+            else if (descriptor !== input.spec.descriptor) {
+                throw new ManagedServiceRegistryError(`Existing descriptor for '${input.spec.id}' conflicts with the requested identity`);
+            }
+            await replace([...services, input.record].sort((left, right) => left.serviceId.localeCompare(right.serviceId)));
+        }
+        finally {
+            await lease.close();
+        }
+    });
+}
+export async function uninstallUnregisteredManagedService(input) {
+    requirePortableManagedSpec(input.spec);
+    await withManagedServiceRegistryLock(input.registry ?? {}, async ({ services }) => {
+        const registered = services.find((record) => record.serviceId === input.spec.id
+            || (record.daemonHome === input.daemonHome && record.profile === input.spec.profile)
+            || record.descriptorPath === input.spec.descriptorPath);
+        if (registered !== undefined) {
+            throw new ManagedServiceRegistryError(`Managed service '${input.spec.id}' became registered before removal`);
+        }
+        const descriptor = await readServiceDescriptor(input.spec);
+        if (descriptor !== input.spec.descriptor) {
+            throw new ManagedServiceRegistryError(`Managed service '${input.spec.id}' is not registered and its descriptor does not match the requested identity`);
+        }
+        await serviceAction(input.spec, "stop", input.runner);
+        const acquire = input.acquireInstallationLease ?? acquireDaemonInstallationLease;
+        const lease = await acquire(input.npmPrefix, {
+            ...(input.registry?.userHome === undefined ? {} : { userHome: input.registry.userHome }),
+        });
+        try {
+            await uninstallService(input.spec, input.runner);
+        }
+        finally {
+            await lease.close();
+        }
+    });
+}
+export async function uninstallManagedService(input) {
+    assertRecordDescribesSpec(input);
+    requirePortableManagedSpec(input.spec);
+    await withManagedServiceRegistryLock(input.registry ?? {}, async ({ services, replace }) => {
+        const index = services.findIndex((record) => record.serviceId === input.record.serviceId
+            && record.daemonHome === input.record.daemonHome
+            && record.profile === input.record.profile);
+        if (index < 0 || !sameRecord(services[index], input.record)) {
+            throw new ManagedServiceRegistryError(`Managed service '${input.spec.id}' identity changed before removal`);
+        }
+        const descriptor = await readServiceDescriptor(input.spec);
+        if (descriptor !== null && descriptor !== input.spec.descriptor) {
+            throw new ManagedServiceRegistryError(`Installed descriptor for '${input.spec.id}' does not match its registry record`);
+        }
+        const acquire = input.acquireInstallationLease ?? acquireDaemonInstallationLease;
+        if (descriptor !== null) {
+            await serviceAction(input.spec, "stop", input.runner);
+        }
+        const lease = await acquire(input.record.npmPrefix, {
+            ...(input.registry?.userHome === undefined ? {} : { userHome: input.registry.userHome }),
+        });
+        try {
+            if (descriptor !== null)
+                await uninstallService(input.spec, input.runner);
+            await replace(services.filter((_, candidateIndex) => candidateIndex !== index));
+        }
+        finally {
+            await lease.close();
+        }
+    });
+}
+export async function assertManagedServiceIdentity(input) {
+    assertRecordDescribesSpec({
+        ...input,
+        runner: async () => ({ exitCode: 0, stdout: "", stderr: "" }),
+    });
+    requirePortableManagedSpec(input.spec);
+    await withManagedServiceRegistryLock(input.registry ?? {}, async ({ services }) => {
+        assertRegistryCoversDescriptors(services, await listManagedServiceDescriptorPaths(input.spec.platform, input.registry?.userHome));
+        const registered = services.find((record) => record.serviceId === input.record.serviceId
+            || (record.daemonHome === input.record.daemonHome && record.profile === input.record.profile));
+        if (registered === undefined) {
+            throw new ManagedServiceRegistryError(`Managed service '${input.spec.id}' is not registered; run install first`);
+        }
+        if (!sameManagedIdentity(registered, input.record)) {
+            throw new ManagedServiceRegistryError(`Managed service '${input.spec.id}' identity does not match the registry`);
+        }
+        const descriptor = await readServiceDescriptor(input.spec);
+        if (descriptor !== input.spec.descriptor) {
+            throw new ManagedServiceRegistryError(`Installed descriptor for '${input.spec.id}' does not match its registry record`);
+        }
+    });
+}

package/dist/managed-service-registry.js

@@ -0,0 +1,285 @@
+import { createHash, randomUUID } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { chmod, mkdir, open, readFile, readdir, rename, rm } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, resolve } from "node:path";
+import { z } from "zod";
+import { acquireProfileSaveLock } from "./computer-profile-lock.js";
+const AbsolutePathSchema = z.string().min(1).refine(isAbsolute, "must be an absolute path");
+const ManagedServiceRecordSchema = z.object({
+    version: z.literal(1),
+    generation: z.string().uuid(),
+    platform: z.enum(["darwin", "linux"]),
+    serviceId: z.string().min(1).max(256),
+    profile: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,47}$/),
+    daemonHome: AbsolutePathSchema,
+    agentsRoot: AbsolutePathSchema,
+    nodePath: AbsolutePathSchema,
+    entryPath: AbsolutePathSchema,
+    packageRoot: AbsolutePathSchema,
+    npmPrefix: AbsolutePathSchema,
+    descriptorPath: AbsolutePathSchema,
+    descriptorSha256: z.string().regex(/^[0-9a-f]{64}$/),
+    createdAt: z.string().datetime({ offset: true }),
+}).strict();
+const ManagedServiceRegistrySchema = z.object({
+    version: z.literal(1),
+    services: z.array(ManagedServiceRecordSchema).max(256),
+}).strict();
+export class ManagedServiceRegistryError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "ManagedServiceRegistryError";
+    }
+}
+export class ManagedServiceConflictError extends ManagedServiceRegistryError {
+    resource;
+    owner;
+    constructor(resource, candidate, owner) {
+        super(`Managed service '${candidate.serviceId}' conflicts with '${owner.serviceId}' on ${resource}`);
+        this.name = "ManagedServiceConflictError";
+        this.resource = resource;
+        this.owner = owner;
+    }
+}
+function registryDirectory(userHome) {
+    return resolve(userHome, ".crew", "daemon", "managed-services");
+}
+export function managedServiceRegistryPath(userHome = homedir()) {
+    return resolve(registryDirectory(userHome), "registry.json");
+}
+export async function listManagedServiceDescriptorPaths(platform, userHome = homedir()) {
+    const directory = platform === "darwin"
+        ? resolve(userHome, "Library", "LaunchAgents")
+        : platform === "linux"
+            ? resolve(userHome, ".config", "systemd", "user")
+            : null;
+    if (directory === null)
+        return [];
+    const pattern = platform === "darwin"
+        ? /^com\.nowcrew\.daemon\.[a-z0-9][a-z0-9_-]{0,47}(?:\.[0-9a-f]{12})?\.plist$/
+        : /^nowcrew-daemon-[a-z0-9][a-z0-9_-]{0,47}(?:\.[0-9a-f]{12})?\.service$/;
+    try {
+        return (await readdir(directory, { withFileTypes: true }))
+            .filter((entry) => entry.isFile() && pattern.test(entry.name))
+            .map((entry) => resolve(directory, entry.name))
+            .sort();
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+}
+export function assertRegistryCoversDescriptors(services, descriptorPaths) {
+    const registered = new Set(services.map((record) => canonicalizePath(record.descriptorPath)));
+    const unregistered = descriptorPaths.map(canonicalizePath).find((path) => !registered.has(path));
+    if (unregistered !== undefined) {
+        throw new ManagedServiceRegistryError(`Unregistered NowCrew service descriptor: ${unregistered}`);
+    }
+}
+export function normalizeManagedServiceRecord(input) {
+    const record = ManagedServiceRecordSchema.parse(input);
+    return ManagedServiceRecordSchema.parse({
+        ...record,
+        daemonHome: canonicalizePath(record.daemonHome),
+        agentsRoot: canonicalizePath(record.agentsRoot),
+        nodePath: canonicalizePath(record.nodePath),
+        entryPath: canonicalizePath(record.entryPath),
+        packageRoot: canonicalizePath(record.packageRoot),
+        npmPrefix: canonicalizePath(record.npmPrefix),
+        descriptorPath: canonicalizePath(record.descriptorPath),
+    });
+}
+function canonicalizePath(path) {
+    const absolute = resolve(path);
+    try {
+        return realpathSync.native(absolute);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOTDIR")
+            return absolute;
+        if (code !== "ENOENT")
+            throw error;
+    }
+    const missing = [];
+    let ancestor = absolute;
+    for (;;) {
+        const parent = dirname(ancestor);
+        if (parent === ancestor)
+            return absolute;
+        missing.unshift(ancestor.slice(parent.length + (parent.endsWith("/") ? 0 : 1)));
+        ancestor = parent;
+        try {
+            return resolve(realpathSync.native(ancestor), ...missing);
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === "ENOTDIR")
+                return absolute;
+            if (code !== "ENOENT")
+                throw error;
+        }
+    }
+}
+function parseRegistry(path, raw) {
+    try {
+        const parsed = ManagedServiceRegistrySchema.parse(JSON.parse(raw));
+        const services = parsed.services.map(normalizeManagedServiceRecord);
+        for (let index = 0; index < services.length; index += 1) {
+            const candidate = services[index];
+            const conflict = managedServiceConflict(services.slice(0, index), candidate);
+            if (conflict !== null) {
+                throw new ManagedServiceConflictError(conflict.resource, candidate, conflict.owner);
+            }
+        }
+        return services;
+    }
+    catch (error) {
+        throw new ManagedServiceRegistryError(`Invalid managed service registry: ${path}`, { cause: error });
+    }
+}
+export function serviceDescriptorSha256(descriptor) {
+    return createHash("sha256").update(descriptor).digest("hex");
+}
+export function managedServiceIdentityMatches(record, expected) {
+    const normalized = normalizeManagedServiceRecord(record);
+    return normalized.version === expected.version
+        && normalized.platform === expected.platform
+        && normalized.serviceId === expected.serviceId
+        && normalized.profile === expected.profile
+        && normalized.daemonHome === canonicalizePath(expected.daemonHome)
+        && normalized.agentsRoot === canonicalizePath(expected.agentsRoot)
+        && normalized.nodePath === canonicalizePath(expected.nodePath)
+        && normalized.entryPath === canonicalizePath(expected.entryPath)
+        && normalized.packageRoot === canonicalizePath(expected.packageRoot)
+        && normalized.npmPrefix === canonicalizePath(expected.npmPrefix)
+        && normalized.descriptorPath === canonicalizePath(expected.descriptorPath)
+        && normalized.descriptorSha256 === expected.descriptorSha256;
+}
+async function readRegistryFile(path) {
+    try {
+        return parseRegistry(path, await readFile(path, "utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+}
+async function syncDirectory(path, platform) {
+    if (platform === "win32")
+        return;
+    const handle = await open(path, "r");
+    try {
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function writeRegistryFile(path, services) {
+    const directory = dirname(path);
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    await chmod(directory, 0o700);
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    let handle = null;
+    try {
+        handle = await open(temporary, "wx", 0o600);
+        await handle.writeFile(`${JSON.stringify({ version: 1, services }, null, 2)}\n`, "utf8");
+        await handle.sync();
+        await handle.close();
+        handle = null;
+        await rename(temporary, path);
+        await chmod(path, 0o600);
+        await syncDirectory(directory, process.platform);
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+        await rm(temporary, { force: true }).catch(() => undefined);
+    }
+}
+function sameRecord(left, right) {
+    return JSON.stringify(left) === JSON.stringify(right);
+}
+export function managedServiceConflict(services, candidate) {
+    for (const owner of services) {
+        if (owner.serviceId === candidate.serviceId)
+            return { resource: "serviceId", owner };
+        if (owner.daemonHome === candidate.daemonHome && owner.profile === candidate.profile) {
+            return { resource: "daemonProfile", owner };
+        }
+        if (owner.agentsRoot === candidate.agentsRoot)
+            return { resource: "agentsRoot", owner };
+        if (owner.npmPrefix === candidate.npmPrefix)
+            return { resource: "npmPrefix", owner };
+    }
+    return null;
+}
+export async function withManagedServiceRegistryLock(options, operation) {
+    const userHome = options.userHome ?? homedir();
+    const directory = registryDirectory(userHome);
+    const release = await acquireProfileSaveLock(directory, {
+        ...(options.lockTimeoutMs === undefined ? {} : { timeoutMs: options.lockTimeoutMs }),
+        ...(options.lockRetryMs === undefined ? {} : { retryMs: options.lockRetryMs }),
+    });
+    let operationError;
+    try {
+        const path = managedServiceRegistryPath(userHome);
+        const services = await readRegistryFile(path);
+        return await operation({
+            services,
+            replace: async (replacement) => {
+                const normalized = replacement.map(normalizeManagedServiceRecord);
+                for (let index = 0; index < normalized.length; index += 1) {
+                    const candidate = normalized[index];
+                    const conflict = managedServiceConflict(normalized.slice(0, index), candidate);
+                    if (conflict !== null) {
+                        throw new ManagedServiceConflictError(conflict.resource, candidate, conflict.owner);
+                    }
+                }
+                await writeRegistryFile(path, normalized);
+            },
+        });
+    }
+    catch (error) {
+        operationError = error;
+        throw error;
+    }
+    finally {
+        try {
+            await release();
+        }
+        catch (releaseError) {
+            if (operationError === undefined)
+                throw releaseError;
+        }
+    }
+}
+export async function readManagedServiceRegistry(options = {}) {
+    return readRegistryFile(managedServiceRegistryPath(options.userHome ?? homedir()));
+}
+export async function registerManagedService(input, options = {}) {
+    const candidate = normalizeManagedServiceRecord(input);
+    await withManagedServiceRegistryLock(options, async ({ services, replace }) => {
+        const conflict = managedServiceConflict(services, candidate);
+        if (conflict !== null)
+            throw new ManagedServiceConflictError(conflict.resource, candidate, conflict.owner);
+        await replace([...services, candidate].sort((left, right) => left.serviceId.localeCompare(right.serviceId)));
+    });
+}
+export async function unregisterManagedService(input, options = {}) {
+    const candidate = normalizeManagedServiceRecord(input);
+    await withManagedServiceRegistryLock(options, async ({ services, replace }) => {
+        const index = services.findIndex((record) => record.serviceId === candidate.serviceId
+            && record.daemonHome === candidate.daemonHome
+            && record.profile === candidate.profile);
+        if (index < 0)
+            throw new ManagedServiceRegistryError(`Managed service '${candidate.serviceId}' is not registered`);
+        if (!sameRecord(services[index], candidate)) {
+            throw new ManagedServiceRegistryError(`Managed service '${candidate.serviceId}' identity changed before removal`);
+        }
+        await replace(services.filter((_, candidateIndex) => candidateIndex !== index));
+    });
+}

package/dist/managed-service-startup.js

@@ -0,0 +1,86 @@
+import { homedir } from "node:os";
+import { resolve } from "node:path";
+import { buildServiceSpec, readServiceDescriptor } from "./computer-service.js";
+import { daemonGlobalInstallation } from "./daemon-installation.js";
+import { ManagedServiceRegistryError, assertRegistryCoversDescriptors, listManagedServiceDescriptorPaths, managedServiceIdentityMatches, readManagedServiceRegistry, serviceDescriptorSha256, } from "./managed-service-registry.js";
+export async function assertManagedServiceStartup(input) {
+    if (input.platform !== "darwin" && input.platform !== "linux")
+        return;
+    const spec = input.spec ?? buildServiceSpec({
+        platform: input.platform,
+        profile: input.profile,
+        userHome: input.userHome,
+        uid: input.uid,
+        nodePath: input.nodePath,
+        entryPath: input.entryPath,
+        profileHome: input.daemonHome,
+    });
+    const readRegistry = input.readManagedServices
+        ?? (() => readManagedServiceRegistry({ userHome: input.userHome }));
+    const listDescriptors = input.listManagedDescriptorPaths
+        ?? (() => listManagedServiceDescriptorPaths(input.platform, input.userHome));
+    const readDescriptor = input.readServiceDescriptor ?? readServiceDescriptor;
+    const [services, descriptorPaths, descriptor] = await Promise.all([
+        readRegistry(),
+        listDescriptors(),
+        readDescriptor(spec),
+    ]);
+    const registered = services.find((record) => record.serviceId === spec.id
+        || (record.daemonHome === input.daemonHome && record.profile === input.profile));
+    const defaultDaemonHome = resolve(input.userHome, ".crew", "daemon");
+    if (registered === undefined
+        && resolve(input.daemonHome) === defaultDaemonHome
+        && descriptor === spec.descriptor) {
+        return;
+    }
+    if (registered === undefined && descriptor === null) {
+        const legacySpec = buildServiceSpec({
+            platform: input.platform,
+            profile: input.profile,
+            userHome: input.userHome,
+            uid: input.uid,
+            nodePath: input.nodePath,
+            entryPath: input.entryPath,
+            profileHome: input.daemonHome,
+            legacyServiceId: true,
+        });
+        const legacyDescriptor = await readDescriptor(legacySpec);
+        if (legacyDescriptor === legacySpec.descriptor)
+            return;
+        if (descriptorPaths.length === 0)
+            return;
+    }
+    if (registered === undefined) {
+        throw new ManagedServiceRegistryError(`Managed service '${spec.id}' is installed but not registered`);
+    }
+    assertRegistryCoversDescriptors(services, descriptorPaths);
+    const installation = daemonGlobalInstallation(input.entryPath, input.platform);
+    if (installation === null || descriptor === null || spec.descriptorPath === null || spec.descriptor === null
+        || descriptor !== spec.descriptor
+        || !managedServiceIdentityMatches(registered, {
+            version: 1,
+            platform: input.platform,
+            serviceId: spec.id,
+            profile: input.profile,
+            daemonHome: input.daemonHome,
+            agentsRoot: input.agentsRoot,
+            nodePath: input.nodePath,
+            entryPath: input.entryPath,
+            packageRoot: installation.packageRoot,
+            npmPrefix: installation.npmPrefix,
+            descriptorPath: spec.descriptorPath,
+            descriptorSha256: serviceDescriptorSha256(descriptor),
+        })) {
+        throw new ManagedServiceRegistryError(`Managed service '${spec.id}' identity does not match its runtime`);
+    }
+}
+export function defaultManagedServiceStartupInput(input) {
+    return {
+        ...input,
+        platform: process.platform,
+        userHome: homedir(),
+        uid: process.getuid?.(),
+        nodePath: process.execPath,
+        entryPath: process.argv[1] ?? "",
+    };
+}

package/dist/memory-prune-diagnostics.js

@@ -0,0 +1,57 @@
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { stat } from "node:fs/promises";
+import { join } from "node:path";
+const TRACE_PATTERN = /\[memory-prune trace_id=([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\]/i;
+export const MEMORY_PRUNE_HASH_LIMIT_BYTES = 10 * 1024 * 1024;
+export function parseMemoryPruneTraceId(wakePrompt) {
+    return TRACE_PATTERN.exec(wakePrompt)?.[1] ?? null;
+}
+async function inspectFile(path) {
+    let metadata;
+    try {
+        metadata = await stat(path);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT")
+            return { exists: false };
+        return { exists: false, error: code ?? (error instanceof Error ? error.name : "unknown") };
+    }
+    const fact = { exists: true, size: metadata.size, mtime_ms: metadata.mtimeMs };
+    if (!metadata.isFile())
+        return { ...fact, hash_skipped_reason: "not_regular_file" };
+    if (metadata.size > MEMORY_PRUNE_HASH_LIMIT_BYTES) {
+        return { ...fact, hash_skipped_reason: "file_too_large" };
+    }
+    try {
+        const hash = createHash("sha256");
+        let bytesRead = 0;
+        const stream = createReadStream(path);
+        try {
+            for await (const chunk of stream) {
+                bytesRead += chunk.length;
+                if (bytesRead > MEMORY_PRUNE_HASH_LIMIT_BYTES) {
+                    return { ...fact, hash_skipped_reason: "grew_too_large" };
+                }
+                hash.update(chunk);
+            }
+        }
+        finally {
+            stream.destroy();
+        }
+        return { ...fact, sha256: hash.digest("hex") };
+    }
+    catch (error) {
+        const code = error.code;
+        return { ...fact, error: code ?? (error instanceof Error ? error.name : "unknown") };
+    }
+}
+export async function inspectMemoryPruneFiles(homeDir, workLogPath) {
+    const [memory, lessons, workLog] = await Promise.all([
+        inspectFile(join(homeDir, "MEMORY.md")),
+        inspectFile(join(homeDir, "notes", "lessons.md")),
+        inspectFile(workLogPath),
+    ]);
+    return { memory, lessons, work_log: workLog };
+}