@nowcrew/daemon 0.5.36 → 0.5.38

package/dist/daemon-installation.js

@@ -0,0 +1,38 @@
+import { realpathSync } from "node:fs";
+import { basename, dirname, resolve } from "node:path";
+function canonicalPath(path, realpath) {
+    try {
+        return realpath(path);
+    }
+    catch (error) {
+        const code = error.code;
+        return code === "ENOENT" || code === "ENOTDIR" ? resolve(path) : null;
+    }
+}
+export function daemonGlobalInstallation(entryPath, platform, realpath = realpathSync.native) {
+    if (platform !== "darwin" && platform !== "linux")
+        return null;
+    const packageRoot = resolve(dirname(entryPath), "..");
+    const globalNodeModules = resolve(packageRoot, "..", "..");
+    const libDirectory = dirname(globalNodeModules);
+    if (basename(globalNodeModules) !== "node_modules" || basename(libDirectory) !== "lib")
+        return null;
+    if (resolve(entryPath) !== resolve(packageRoot, "dist", "main.js"))
+        return null;
+    if (resolve(packageRoot) !== resolve(globalNodeModules, "@nowcrew", "daemon"))
+        return null;
+    const canonicalPackageRoot = canonicalPath(packageRoot, realpath);
+    const canonicalGlobalNodeModules = canonicalPath(globalNodeModules, realpath);
+    const canonicalNpmPrefix = canonicalPath(dirname(libDirectory), realpath);
+    if (canonicalPackageRoot === null || canonicalGlobalNodeModules === null || canonicalNpmPrefix === null)
+        return null;
+    if (canonicalPackageRoot !== resolve(canonicalGlobalNodeModules, "@nowcrew", "daemon"))
+        return null;
+    if (canonicalGlobalNodeModules !== resolve(canonicalNpmPrefix, "lib", "node_modules"))
+        return null;
+    return {
+        packageRoot: canonicalPackageRoot,
+        globalNodeModules: canonicalGlobalNodeModules,
+        npmPrefix: canonicalNpmPrefix,
+    };
+}

package/dist/daemon-update-controller.js

@@ -7,6 +7,7 @@ const DaemonUpdateMessageSchema = z.object({
 export function createDaemonUpdateController(deps) {
     const handled = new Set();
     let running = null;
+    let restartHandoff = null;
     const failed = (updateId, errorCode) => {
         deps.sendStatus({ type: "daemon:update-status", updateId, status: "failed", errorCode });
     };
@@ -19,6 +20,7 @@ export function createDaemonUpdateController(deps) {
         const installed = await deps.install({
             targetVersion: message.targetVersion,
             packageRoot: eligibility.packageRoot,
+            npmPrefix: eligibility.npmPrefix,
             onInstalling: () => {
                 deps.sendStatus({ type: "daemon:update-status", updateId: message.updateId, status: "installing" });
             },
@@ -27,16 +29,42 @@ export function createDaemonUpdateController(deps) {
             failed(message.updateId, installed.errorCode);
             return;
         }
+        let released = false;
+        const releaseOnce = async () => {
+            if (released)
+                return;
+            released = true;
+            await installed.release();
+        };
         deps.sendStatus({ type: "daemon:update-status", updateId: message.updateId, status: "restarting" });
         try {
-            deps.scheduleRestart(eligibility.serviceSpec);
+            const handoff = deps.scheduleRestart(eligibility.serviceSpec);
+            const state = {
+                release: releaseOnce,
+                shutdownBegun: false,
+                failureTask: Promise.resolve(),
+            };
+            state.failureTask = handoff.failed.then(async () => {
+                if (state.shutdownBegun)
+                    return;
+                await state.release();
+                failed(message.updateId, "restart_failed");
+            });
+            restartHandoff = state;
         }
         catch {
-            await installed.release();
+            await releaseOnce();
             failed(message.updateId, "restart_failed");
         }
     };
     return {
+        drain: async () => {
+            await running?.done;
+            if (restartHandoff !== null) {
+                restartHandoff.shutdownBegun = true;
+                await restartHandoff.release();
+            }
+        },
         handle: async (input) => {
             const parsed = DaemonUpdateMessageSchema.safeParse(input);
             if (!parsed.success)

package/dist/daemon-update-eligibility.js

@@ -1,12 +1,13 @@
 import { access } from "node:fs/promises";
 import { constants } from "node:fs";
 import { homedir } from "node:os";
-import { resolve } from "node:path";
-import { daemonHome, listProfiles } from "./computer-profile.js";
-import { builtDaemonEntry, isGlobalDaemonEntry } from "./computer-cli.js";
-import { buildServiceSpec, serviceStatus, systemCommandRunner, } from "./computer-service.js";
+import { daemonHome, loadProfile, resolveAgentsRoot } from "./computer-profile.js";
+import { builtDaemonEntry } from "./computer-cli.js";
+import { buildServiceSpec, readServiceDescriptor, serviceStatus, } from "./computer-service.js";
+import { daemonGlobalInstallation } from "./daemon-installation.js";
+import { daemonInstallationLeaseHeld } from "./daemon-installation-lease.js";
+import { assertRegistryCoversDescriptors, listManagedServiceDescriptorPaths, managedServiceIdentityMatches, readManagedServiceRegistry, serviceDescriptorSha256, } from "./managed-service-registry.js";
 function defaults() {
-    const npmCommand = process.platform === "win32" ? "npm.cmd" : "npm";
     return {
         platform: process.platform,
         profileHome: daemonHome(),
@@ -14,16 +15,13 @@ function defaults() {
         uid: process.getuid?.(),
         nodePath: process.execPath,
         entryPath: builtDaemonEntry(),
-        resolveGlobalNodeModules: async () => {
-            const result = await systemCommandRunner(npmCommand, ["root", "--global"]);
-            if (result.exitCode !== 0 || !result.stdout.trim()) {
-                throw new Error(result.stderr.trim() || "global npm root unavailable");
-            }
-            return result.stdout.trim();
-        },
-        listProfiles,
+        loadProfile,
+        readManagedServices: () => readManagedServiceRegistry(),
+        listManagedDescriptorPaths: () => listManagedServiceDescriptorPaths(process.platform, homedir()),
+        readServiceDescriptor,
         serviceStatus,
         assertWritable: (path) => access(path, constants.W_OK),
+        installationLeaseHeld: daemonInstallationLeaseHeld,
     };
 }
 export async function detectDaemonUpdateEligibility(profileName, overrides = {}) {
@@ -33,39 +31,73 @@ export async function detectDaemonUpdateEligibility(profileName, overrides = {})
     }
     if (!profileName)
         return { eligible: false, reason: "profile_required" };
-    let globalNodeModules;
+    const installation = daemonGlobalInstallation(deps.entryPath, deps.platform);
+    if (installation === null)
+        return { eligible: false, reason: "global_install_required" };
+    let profile;
     try {
-        globalNodeModules = await deps.resolveGlobalNodeModules();
+        profile = await deps.loadProfile(profileName, deps.profileHome, {
+            platform: deps.platform,
+            userHome: deps.userHome,
+        });
     }
     catch {
-        return { eligible: false, reason: "global_install_required" };
+        return { eligible: false, reason: "managed_service_identity_mismatch" };
     }
-    if (!isGlobalDaemonEntry(deps.entryPath, globalNodeModules)) {
-        return { eligible: false, reason: "global_install_required" };
+    const spec = buildServiceSpec({
+        platform: deps.platform,
+        profile: profileName,
+        userHome: deps.userHome,
+        uid: deps.uid,
+        nodePath: deps.nodePath,
+        entryPath: deps.entryPath,
+        profileHome: deps.profileHome,
+    });
+    const status = await deps.serviceStatus(spec);
+    if (!status.running)
+        return { eligible: false, reason: "service_not_running" };
+    let services;
+    try {
+        services = await deps.readManagedServices();
+    }
+    catch {
+        return { eligible: false, reason: "managed_service_registry_invalid" };
     }
-    const profiles = await deps.listProfiles(deps.profileHome);
-    const installed = [];
-    for (const profile of profiles) {
-        const spec = buildServiceSpec({
+    const registered = services.find((record) => record.serviceId === spec.id
+        || (record.daemonHome === deps.profileHome && record.profile === profileName));
+    if (registered === undefined) {
+        return { eligible: false, reason: "managed_service_not_registered" };
+    }
+    try {
+        assertRegistryCoversDescriptors(services, await deps.listManagedDescriptorPaths());
+    }
+    catch {
+        return { eligible: false, reason: "managed_service_registry_incomplete" };
+    }
+    const descriptor = await deps.readServiceDescriptor(spec).catch(() => null);
+    if (descriptor === null || spec.descriptorPath === null || spec.descriptor === null
+        || !managedServiceIdentityMatches(registered, {
+            version: 1,
             platform: deps.platform,
-            profile,
-            userHome: deps.userHome,
-            uid: deps.uid,
+            serviceId: spec.id,
+            profile: profileName,
+            daemonHome: deps.profileHome,
+            agentsRoot: resolveAgentsRoot(profile.agentsRoot, deps.userHome, deps.platform),
             nodePath: deps.nodePath,
             entryPath: deps.entryPath,
-            profileHome: deps.profileHome,
-        });
-        const status = await deps.serviceStatus(spec);
-        if (status.installed)
-            installed.push({ profile, spec, running: status.running });
+            packageRoot: installation.packageRoot,
+            npmPrefix: installation.npmPrefix,
+            descriptorPath: spec.descriptorPath,
+            descriptorSha256: serviceDescriptorSha256(descriptor),
+        })
+        || descriptor !== spec.descriptor) {
+        return { eligible: false, reason: "managed_service_identity_mismatch" };
+    }
+    if (!deps.installationLeaseHeld(installation.npmPrefix)) {
+        return { eligible: false, reason: "installation_lease_missing" };
     }
-    const current = installed.find((entry) => entry.profile === profileName);
-    if (!current?.running)
-        return { eligible: false, reason: "service_not_running" };
-    if (installed.length !== 1)
-        return { eligible: false, reason: "multiple_managed_profiles" };
     try {
-        await deps.assertWritable(globalNodeModules);
+        await deps.assertWritable(installation.globalNodeModules);
     }
     catch {
         return { eligible: false, reason: "global_root_not_writable" };
@@ -73,8 +105,7 @@ export async function detectDaemonUpdateEligibility(profileName, overrides = {})
     return {
         eligible: true,
         profileName,
-        globalNodeModules,
-        packageRoot: resolve(globalNodeModules, "@nowcrew", "daemon"),
-        serviceSpec: current.spec,
+        ...installation,
+        serviceSpec: spec,
     };
 }

package/dist/daemon-updater.js

@@ -1,6 +1,7 @@
 import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { systemCommandRunner } from "./computer-service.js";
+import { daemonGlobalInstallation } from "./daemon-installation.js";
 const RELEASED_VERSION_RE = /^\d+\.\d+\.\d+$/;
 async function readPackageVersion(packageRoot) {
     const body = JSON.parse(await readFile(resolve(packageRoot, "package.json"), "utf8"));
@@ -10,6 +11,12 @@ export async function installExactDaemonUpdate(input) {
     if (!RELEASED_VERSION_RE.test(input.targetVersion)) {
         return { ok: false, errorCode: "ineligible" };
     }
+    const installation = daemonGlobalInstallation(input.currentEntryPath ?? process.argv[1] ?? "", input.platform ?? process.platform);
+    if (installation === null
+        || installation.packageRoot !== input.packageRoot
+        || installation.npmPrefix !== input.npmPrefix) {
+        return { ok: false, errorCode: "ineligible" };
+    }
     const local = input.localSlots.tryAcquireExclusive();
     if (local === null)
         return { ok: false, errorCode: "runtime_busy" };
@@ -26,6 +33,13 @@ export async function installExactDaemonUpdate(input) {
         await host.release();
         local.release();
     };
+    const lockedInstallation = daemonGlobalInstallation(input.currentEntryPath ?? process.argv[1] ?? "", input.platform ?? process.platform);
+    if (lockedInstallation === null
+        || lockedInstallation.packageRoot !== input.packageRoot
+        || lockedInstallation.npmPrefix !== input.npmPrefix) {
+        await release();
+        return { ok: false, errorCode: "ineligible" };
+    }
     const runner = input.runner ?? systemCommandRunner;
     try {
         await input.onInstalling?.();
@@ -37,6 +51,8 @@ export async function installExactDaemonUpdate(input) {
     const result = await runner(process.platform === "win32" ? "npm.cmd" : "npm", [
         "install",
         "--global",
+        "--prefix",
+        input.npmPrefix,
         "--ignore-scripts",
         "--no-audit",
         "--no-fund",

package/dist/i18n.js

@@ -42,7 +42,7 @@ const zh = {
     "Saved profile '{{name}}' with private credentials.": "已保存配置 '{{name}}'，凭证仅私有可读。",
     "Service '{{id}}' is not installed": "服务 '{{id}}' 尚未安装",
     "Upgraded daemon and restart request accepted for '{{name}}'. Verify with status.": "daemon 已升级，并已请求重启 '{{name}}'；请用 status 确认。",
-    "Upgraded daemon but skipped restart for '{{name}}': {{reason}}": "daemon 已升级，但已跳过 '{{name}}' 的重启：{{reason}}",
+    "Refused daemon upgrade for '{{name}}': {{reason}}": "已拒绝升级 daemon '{{name}}'：{{reason}}",
     "Upgraded daemon. Installed services were not restarted; pass --profile to restart one.": "daemon 已升级；已安装服务尚未重启，可传入 --profile 重启指定服务。",
     "Service lifecycle requires the built daemon entry (.js), not a TypeScript development entry": "服务生命周期必须使用已构建的 daemon 入口（.js），不能使用 TypeScript 开发入口",
     "Installed '{{id}}'. Use status to confirm runtime state.": "已安装 '{{id}}'；请用 status 确认运行状态。",

package/dist/main.js

@@ -14,10 +14,13 @@ import { runAgent } from "./runner.js";
 import { serve } from "./serve.js";
 import { initSlog, flushSlog } from "./slog.js";
 import { formatDaemonLogLine } from "./log-format.js";
-import { applyProfileToEnv, assertProfileAgentsRootUnique, daemonHome, loadProfile, PROFILE_AGENTS_ROOT_CONFLICT_MESSAGE, ProfileAgentsRootConflictError, } from "./computer-profile.js";
-import { runComputerCommand } from "./computer-cli.js";
+import { applyProfileToEnv, assertProfileAgentsRootUnique, daemonHome, loadProfile, PROFILE_AGENTS_ROOT_CONFLICT_MESSAGE, ProfileAgentsRootConflictError, resolveAgentsRoot, } from "./computer-profile.js";
+import { builtDaemonEntry, runComputerCommand } from "./computer-cli.js";
 import { runServeLifecycle } from "./serve-lifecycle.js";
 import { formatDaemonStartupError } from "./daemon-startup-error.js";
+import { assertManagedServiceStartup } from "./managed-service-startup.js";
+import { daemonGlobalInstallation } from "./daemon-installation.js";
+import { acquireDaemonInstallationLease, runWithDaemonInstallationLease, } from "./daemon-installation-lease.js";
 async function main() {
     const computerResult = await runComputerCommand(process.argv.slice(2));
     if (computerResult !== null) {
@@ -57,8 +60,19 @@ async function main() {
     if (values.profile) {
         const home = daemonHome();
         const profile = await loadProfile(values.profile, home);
-        if (cmd === "serve")
+        if (cmd === "serve") {
             await assertProfileAgentsRootUnique(profile, home, homedir());
+            await assertManagedServiceStartup({
+                platform: process.platform,
+                profile: profile.name,
+                userHome: homedir(),
+                uid: process.getuid?.(),
+                daemonHome: home,
+                agentsRoot: resolveAgentsRoot(profile.agentsRoot, homedir(), process.platform),
+                nodePath: process.execPath,
+                entryPath: builtDaemonEntry(),
+            });
+        }
         applyProfileToEnv(profile, process.env);
     }
     // 命令行参数优先于环境变量,填回 env 供 loadConfig 读取
@@ -80,10 +94,18 @@ async function main() {
     }
     if (cmd === "serve") {
         process.stdout.write(formatDaemonLogLine(`🛰️  crew-daemon v${daemonVersion()} (cli v${cliVersion()}) ${td("resident, connecting to")} ${config.serverUrl} ${td("control plane")}...`) + "\n");
-        const service = serve(config, {
-            ...(values.profile === undefined ? {} : { profileName: values.profile }),
+        const installation = values.profile === undefined
+            ? null
+            : daemonGlobalInstallation(builtDaemonEntry(), process.platform);
+        const installationLease = installation === null
+            ? null
+            : await acquireDaemonInstallationLease(installation.npmPrefix);
+        await runWithDaemonInstallationLease(installationLease, async () => {
+            const service = serve(config, {
+                ...(values.profile === undefined ? {} : { profileName: values.profile }),
+            });
+            await runServeLifecycle(service);
         });
-        await runServeLifecycle(service);
         return;
     }
     if (!values.agent || !values.channel) {

package/dist/managed-service-diagnostics.js

@@ -0,0 +1,92 @@
+import { inspectDaemonInstallationLease } from "./daemon-installation-lease.js";
+import { readServiceDescriptor } from "./computer-service.js";
+import { assertRegistryCoversDescriptors, listManagedServiceDescriptorPaths, managedServiceIdentityMatches, readManagedServiceRegistry, } from "./managed-service-registry.js";
+function errorDetail(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+export async function inspectManagedServiceDiagnostics(input) {
+    const registry = input.registry ?? {};
+    const userHome = registry.userHome;
+    const readServices = input.readManagedServices
+        ?? (() => readManagedServiceRegistry(registry));
+    const listDescriptors = input.listManagedDescriptorPaths
+        ?? (() => listManagedServiceDescriptorPaths(input.spec.platform, userHome));
+    const readDescriptor = input.readDescriptor
+        ?? (() => readServiceDescriptor(input.spec));
+    const inspectLease = input.inspectInstallationLease
+        ?? (() => inspectDaemonInstallationLease(input.expectedRecord.npmPrefix, {
+            ...(userHome === undefined ? {} : { userHome }),
+        }));
+    let services = null;
+    let registryCheck;
+    try {
+        services = await readServices();
+        assertRegistryCoversDescriptors(services, await listDescriptors());
+        registryCheck = {
+            name: "managed-service-registry",
+            ok: true,
+            detail: `${services.length} registered service(s); all descriptors are covered`,
+        };
+    }
+    catch (error) {
+        registryCheck = {
+            name: "managed-service-registry",
+            ok: false,
+            detail: errorDetail(error),
+        };
+    }
+    let identityCheck;
+    const registered = services?.find((record) => record.serviceId === input.expectedRecord.serviceId
+        || (record.daemonHome === input.expectedRecord.daemonHome
+            && record.profile === input.expectedRecord.profile));
+    if (registered === undefined) {
+        identityCheck = {
+            name: "managed-service-identity",
+            ok: false,
+            detail: services === null
+                ? "identity unavailable because the registry is invalid"
+                : `managed service '${input.expectedRecord.serviceId}' is not registered`,
+        };
+    }
+    else {
+        try {
+            const { generation: _generation, createdAt: _createdAt, ...expectedIdentity } = input.expectedRecord;
+            const descriptor = await readDescriptor();
+            const matches = descriptor === input.spec.descriptor
+                && managedServiceIdentityMatches(registered, expectedIdentity);
+            identityCheck = {
+                name: "managed-service-identity",
+                ok: matches,
+                detail: matches
+                    ? `registry and descriptor match '${input.expectedRecord.serviceId}'`
+                    : `registry or descriptor identity does not match '${input.expectedRecord.serviceId}'`,
+            };
+        }
+        catch (error) {
+            identityCheck = {
+                name: "managed-service-identity",
+                ok: false,
+                detail: errorDetail(error),
+            };
+        }
+    }
+    let installationLease;
+    try {
+        installationLease = await inspectLease();
+    }
+    catch (error) {
+        installationLease = { status: "corrupt", detail: errorDetail(error) };
+    }
+    const leaseCheck = {
+        name: "installation-lease",
+        ok: installationLease.status === "owned" && installationLease.ownerAlive === true,
+        detail: installationLease.detail,
+    };
+    const checks = [registryCheck, identityCheck, leaseCheck];
+    return {
+        healthy: checks.every((check) => check.ok),
+        npmPrefix: input.expectedRecord.npmPrefix,
+        checks,
+        installationLease,
+    };
+}

package/dist/managed-service-lifecycle.js

@@ -0,0 +1,189 @@
+import { randomUUID } from "node:crypto";
+import { acquireDaemonInstallationLease } from "./daemon-installation-lease.js";
+import { installService, ensureServiceEnabled, readServiceDescriptor, serviceAction, uninstallService, } from "./computer-service.js";
+import { ManagedServiceConflictError, ManagedServiceRegistryError, assertRegistryCoversDescriptors, listManagedServiceDescriptorPaths, managedServiceIdentityMatches, managedServiceConflict, normalizeManagedServiceRecord, serviceDescriptorSha256, withManagedServiceRegistryLock, } from "./managed-service-registry.js";
+function requirePortableManagedSpec(spec) {
+    if ((spec.platform !== "darwin" && spec.platform !== "linux")
+        || spec.descriptorPath === null
+        || spec.descriptor === null) {
+        throw new ManagedServiceRegistryError("Managed service registry supports launchd and systemd descriptors only");
+    }
+}
+export function buildManagedServiceRecord(input) {
+    requirePortableManagedSpec(input.spec);
+    return normalizeManagedServiceRecord({
+        version: 1,
+        generation: (input.generation ?? randomUUID)(),
+        platform: input.spec.platform,
+        serviceId: input.spec.id,
+        profile: input.spec.profile,
+        daemonHome: input.daemonHome,
+        agentsRoot: input.agentsRoot,
+        nodePath: input.nodePath,
+        entryPath: input.entryPath,
+        packageRoot: input.packageRoot,
+        npmPrefix: input.npmPrefix,
+        descriptorPath: input.spec.descriptorPath,
+        descriptorSha256: serviceDescriptorSha256(input.spec.descriptor),
+        createdAt: (input.now ?? (() => new Date()))().toISOString(),
+    });
+}
+function sameRecord(left, right) {
+    return JSON.stringify(left) === JSON.stringify(right);
+}
+function sameManagedIdentity(left, right) {
+    const { generation: _generation, createdAt: _createdAt, ...expected } = right;
+    return managedServiceIdentityMatches(left, expected);
+}
+function assertRecordDescribesSpec(input) {
+    requirePortableManagedSpec(input.spec);
+    const { spec, record } = input;
+    const normalizedDescriptorPath = normalizeManagedServiceRecord({
+        ...record,
+        descriptorPath: spec.descriptorPath,
+    }).descriptorPath;
+    if (record.platform !== spec.platform
+        || record.serviceId !== spec.id
+        || record.profile !== spec.profile
+        || record.descriptorPath !== normalizedDescriptorPath
+        || record.descriptorSha256 !== serviceDescriptorSha256(spec.descriptor)) {
+        throw new ManagedServiceRegistryError(`Managed service record does not describe '${spec.id}'`);
+    }
+}
+export async function installManagedService(input) {
+    assertRecordDescribesSpec(input);
+    requirePortableManagedSpec(input.spec);
+    const acquire = input.acquireInstallationLease ?? acquireDaemonInstallationLease;
+    await withManagedServiceRegistryLock(input.registry ?? {}, async ({ services, replace }) => {
+        const exact = services.find((record) => sameManagedIdentity(record, input.record));
+        if (exact !== undefined) {
+            const descriptor = await readServiceDescriptor(input.spec);
+            if (descriptor === input.spec.descriptor) {
+                await ensureServiceEnabled(input.spec, input.runner);
+                return;
+            }
+            if (descriptor !== null) {
+                throw new ManagedServiceRegistryError(`Installed descriptor for '${input.spec.id}' does not match its registry record`);
+            }
+            const lease = await acquire(input.record.npmPrefix, {
+                ...(input.registry?.userHome === undefined ? {} : { userHome: input.registry.userHome }),
+            });
+            try {
+                await installService(input.spec, input.runner);
+            }
+            finally {
+                await lease.close();
+            }
+            return;
+        }
+        const conflict = managedServiceConflict(services, input.record);
+        if (conflict !== null) {
+            throw new ManagedServiceConflictError(conflict.resource, input.record, conflict.owner);
+        }
+        const existingDescriptor = await readServiceDescriptor(input.spec);
+        if (existingDescriptor === input.spec.descriptor) {
+            await ensureServiceEnabled(input.spec, input.runner);
+            await replace([...services, input.record].sort((left, right) => left.serviceId.localeCompare(right.serviceId)));
+            return;
+        }
+        if (existingDescriptor !== null) {
+            throw new ManagedServiceRegistryError(`Existing descriptor for '${input.spec.id}' conflicts with the requested identity`);
+        }
+        const lease = await acquire(input.record.npmPrefix, {
+            ...(input.registry?.userHome === undefined ? {} : { userHome: input.registry.userHome }),
+        });
+        try {
+            const descriptor = await readServiceDescriptor(input.spec);
+            if (descriptor === null) {
+                await installService(input.spec, input.runner);
+                await input.hooks?.afterDescriptorInstall?.();
+            }
+            else if (descriptor !== input.spec.descriptor) {
+                throw new ManagedServiceRegistryError(`Existing descriptor for '${input.spec.id}' conflicts with the requested identity`);
+            }
+            await replace([...services, input.record].sort((left, right) => left.serviceId.localeCompare(right.serviceId)));
+        }
+        finally {
+            await lease.close();
+        }
+    });
+}
+export async function uninstallUnregisteredManagedService(input) {
+    requirePortableManagedSpec(input.spec);
+    await withManagedServiceRegistryLock(input.registry ?? {}, async ({ services }) => {
+        const registered = services.find((record) => record.serviceId === input.spec.id
+            || (record.daemonHome === input.daemonHome && record.profile === input.spec.profile)
+            || record.descriptorPath === input.spec.descriptorPath);
+        if (registered !== undefined) {
+            throw new ManagedServiceRegistryError(`Managed service '${input.spec.id}' became registered before removal`);
+        }
+        const descriptor = await readServiceDescriptor(input.spec);
+        if (descriptor !== input.spec.descriptor) {
+            throw new ManagedServiceRegistryError(`Managed service '${input.spec.id}' is not registered and its descriptor does not match the requested identity`);
+        }
+        await serviceAction(input.spec, "stop", input.runner);
+        const acquire = input.acquireInstallationLease ?? acquireDaemonInstallationLease;
+        const lease = await acquire(input.npmPrefix, {
+            ...(input.registry?.userHome === undefined ? {} : { userHome: input.registry.userHome }),
+        });
+        try {
+            await uninstallService(input.spec, input.runner);
+        }
+        finally {
+            await lease.close();
+        }
+    });
+}
+export async function uninstallManagedService(input) {
+    assertRecordDescribesSpec(input);
+    requirePortableManagedSpec(input.spec);
+    await withManagedServiceRegistryLock(input.registry ?? {}, async ({ services, replace }) => {
+        const index = services.findIndex((record) => record.serviceId === input.record.serviceId
+            && record.daemonHome === input.record.daemonHome
+            && record.profile === input.record.profile);
+        if (index < 0 || !sameRecord(services[index], input.record)) {
+            throw new ManagedServiceRegistryError(`Managed service '${input.spec.id}' identity changed before removal`);
+        }
+        const descriptor = await readServiceDescriptor(input.spec);
+        if (descriptor !== null && descriptor !== input.spec.descriptor) {
+            throw new ManagedServiceRegistryError(`Installed descriptor for '${input.spec.id}' does not match its registry record`);
+        }
+        const acquire = input.acquireInstallationLease ?? acquireDaemonInstallationLease;
+        if (descriptor !== null) {
+            await serviceAction(input.spec, "stop", input.runner);
+        }
+        const lease = await acquire(input.record.npmPrefix, {
+            ...(input.registry?.userHome === undefined ? {} : { userHome: input.registry.userHome }),
+        });
+        try {
+            if (descriptor !== null)
+                await uninstallService(input.spec, input.runner);
+            await replace(services.filter((_, candidateIndex) => candidateIndex !== index));
+        }
+        finally {
+            await lease.close();
+        }
+    });
+}
+export async function assertManagedServiceIdentity(input) {
+    assertRecordDescribesSpec({
+        ...input,
+        runner: async () => ({ exitCode: 0, stdout: "", stderr: "" }),
+    });
+    requirePortableManagedSpec(input.spec);
+    await withManagedServiceRegistryLock(input.registry ?? {}, async ({ services }) => {
+        assertRegistryCoversDescriptors(services, await listManagedServiceDescriptorPaths(input.spec.platform, input.registry?.userHome));
+        const registered = services.find((record) => record.serviceId === input.record.serviceId
+            || (record.daemonHome === input.record.daemonHome && record.profile === input.record.profile));
+        if (registered === undefined) {
+            throw new ManagedServiceRegistryError(`Managed service '${input.spec.id}' is not registered; run install first`);
+        }
+        if (!sameManagedIdentity(registered, input.record)) {
+            throw new ManagedServiceRegistryError(`Managed service '${input.spec.id}' identity does not match the registry`);
+        }
+        const descriptor = await readServiceDescriptor(input.spec);
+        if (descriptor !== input.spec.descriptor) {
+            throw new ManagedServiceRegistryError(`Installed descriptor for '${input.spec.id}' does not match its registry record`);
+        }
+    });
+}