@nowcrew/daemon 0.6.67 → 0.6.68

package/dist/storage-worker-handoff.js

@@ -1,151 +0,0 @@
-import { execFile } from "node:child_process";
-import { readFile, rm } from "node:fs/promises";
-import { join, posix, resolve, win32 } from "node:path";
-import { promisify } from "node:util";
-import { z } from "zod";
-import { atomicPrivateWrite } from "./atomic-private-write.js";
-import { readStorageWorkerOperation } from "./storage-worker-operation.js";
-const AbsolutePathSchema = z.string().min(1).max(32768)
-    .refine((value) => !/[\0\r\n]/u.test(value), "path must be a single line")
-    .refine((value) => posix.isAbsolute(value) || win32.isAbsolute(value), "path must be absolute");
-const HandoffSchema = z.object({
-    version: z.literal(1),
-    migrationId: z.string().uuid(),
-    profile: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,47}$/u),
-    operationPath: AbsolutePathSchema,
-    operationSha256: z.string().regex(/^[0-9a-f]{64}$/u),
-}).strict();
-export async function writeStorageWorkerHandoff(raw, input) {
-    let handoff;
-    try {
-        handoff = HandoffSchema.parse(raw);
-        AbsolutePathSchema.parse(input.stateRoot);
-    }
-    catch (error) {
-        throw new Error("Invalid storage worker handoff", { cause: error });
-    }
-    const path = join(input.stateRoot, "migrations", handoff.migrationId, "handoff.json");
-    await atomicPrivateWrite(path, `${JSON.stringify(handoff, null, 2)}\n`);
-    return path;
-}
-export async function readStorageWorkerHandoff(path) {
-    try {
-        AbsolutePathSchema.parse(path);
-        return HandoffSchema.parse(JSON.parse(await readFile(path, "utf8")));
-    }
-    catch (error) {
-        throw new Error("Invalid storage worker handoff", { cause: error });
-    }
-}
-const execFileAsync = promisify(execFile);
-const systemSupervisorRun = async (command, args) => {
-    try {
-        const result = await execFileAsync(command, [...args], {
-            encoding: "utf8",
-            timeout: 15_000,
-            maxBuffer: 64 * 1024,
-        });
-        return { exitCode: 0, stdout: result.stdout, stderr: result.stderr };
-    }
-    catch (error) {
-        const failure = error;
-        return {
-            exitCode: typeof failure.code === "number" ? failure.code : 127,
-            stdout: failure.stdout ?? "",
-            stderr: failure.stderr ?? failure.message,
-        };
-    }
-};
-function workerUnitName(migrationId) {
-    return `nowwork-storage-migration-${migrationId}.service`;
-}
-function workerUnitPath(userHome, migrationId) {
-    return resolve(userHome, ".config", "systemd", "user", workerUnitName(migrationId));
-}
-function workerLaunchdLabel(migrationId) {
-    return `com.nowcrew.storage-migration.${migrationId}`;
-}
-function workerLaunchdPath(userHome, migrationId) {
-    return resolve(userHome, "Library", "LaunchAgents", `${workerLaunchdLabel(migrationId)}.plist`);
-}
-function xml(value) {
-    return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;")
-        .replaceAll('"', "&quot;").replaceAll("'", "&apos;");
-}
-function systemdArg(value) {
-    if (/[\0\r\n]/u.test(value))
-        throw new Error("storage worker service argument must be a single line");
-    return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("%", "%%")}"`;
-}
-async function checkedSupervisor(run, command, args) {
-    const result = await run(command, args);
-    if (result.exitCode !== 0)
-        throw new Error(result.stderr.trim() || result.stdout.trim() || `exit ${result.exitCode}`);
-}
-export async function launchStorageMigrationWorker(input, runSupervisor = systemSupervisorRun) {
-    AbsolutePathSchema.parse(input.entryPath);
-    AbsolutePathSchema.parse(input.handoffPath);
-    AbsolutePathSchema.parse(input.userHome);
-    const migrationId = z.string().uuid().parse(input.migrationId).toLowerCase();
-    const worker = [process.execPath, input.entryPath, "storage-migration-worker", "--job", input.handoffPath];
-    if (input.platform === "darwin") {
-        if (input.uid === undefined || !Number.isSafeInteger(input.uid) || input.uid < 0) {
-            throw new Error("Persistent storage migration launchd worker requires a numeric uid");
-        }
-        const label = workerLaunchdLabel(migrationId);
-        const path = workerLaunchdPath(input.userHome, migrationId);
-        const args = worker.map((arg) => `      <string>${xml(arg)}</string>`).join("\n");
-        const descriptor = `<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0">\n<dict>\n  <key>Label</key><string>${xml(label)}</string>\n  <key>ProgramArguments</key>\n  <array>\n${args}\n  </array>\n  <key>RunAtLoad</key><true/>\n  <key>KeepAlive</key>\n  <dict>\n    <key>SuccessfulExit</key><false/>\n  </dict>\n  <key>ProcessType</key><string>Background</string>\n</dict>\n</plist>\n`;
-        await atomicPrivateWrite(path, descriptor);
-        try {
-            await checkedSupervisor(runSupervisor, "launchctl", ["bootstrap", `gui/${input.uid}`, path]);
-        }
-        catch (error) {
-            await runSupervisor("launchctl", ["bootout", `gui/${input.uid}/${label}`]).catch(() => undefined);
-            await rm(path, { force: true });
-            throw new Error("Storage migration persistent service launch failed", { cause: error });
-        }
-        return;
-    }
-    const unit = workerUnitName(migrationId);
-    const path = workerUnitPath(input.userHome, migrationId);
-    const descriptor = `[Unit]\nDescription=NowWork storage migration ${migrationId}\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=exec\nExecStart=${worker.map(systemdArg).join(" ")}\nRestart=on-abnormal\nRestartSec=5\n\n[Install]\nWantedBy=default.target\n`;
-    await atomicPrivateWrite(path, descriptor);
-    try {
-        await checkedSupervisor(runSupervisor, "systemctl", ["--user", "daemon-reload"]);
-        await checkedSupervisor(runSupervisor, "systemctl", ["--user", "enable", "--now", unit]);
-    }
-    catch (error) {
-        await runSupervisor("systemctl", ["--user", "disable", "--now", unit]).catch(() => undefined);
-        await rm(path, { force: true });
-        await runSupervisor("systemctl", ["--user", "daemon-reload"]).catch(() => undefined);
-        throw new Error("Storage migration persistent service launch failed", { cause: error });
-    }
-}
-export async function completeStorageMigrationWorkerService(input, runSupervisor = systemSupervisorRun) {
-    const migrationId = z.string().uuid().parse(input.migrationId).toLowerCase();
-    AbsolutePathSchema.parse(input.userHome);
-    if (input.platform === "darwin") {
-        if (input.uid === undefined || !Number.isSafeInteger(input.uid) || input.uid < 0) {
-            throw new Error("Persistent storage migration launchd worker requires a numeric uid");
-        }
-        const label = workerLaunchdLabel(migrationId);
-        await rm(workerLaunchdPath(input.userHome, migrationId), { force: true });
-        await runSupervisor("launchctl", ["bootout", `gui/${input.uid}/${label}`]);
-        return;
-    }
-    const unit = workerUnitName(migrationId);
-    await checkedSupervisor(runSupervisor, "systemctl", ["--user", "disable", unit]);
-    await rm(workerUnitPath(input.userHome, migrationId), { force: true });
-    await checkedSupervisor(runSupervisor, "systemctl", ["--user", "daemon-reload"]);
-}
-export async function completeStorageMigrationWorkerServiceForHandoff(path) {
-    const handoff = await readStorageWorkerHandoff(path);
-    const operation = await readStorageWorkerOperation(handoff.operationPath, handoff.operationSha256);
-    await completeStorageMigrationWorkerService({
-        migrationId: operation.migrationId,
-        platform: operation.service.platform,
-        userHome: operation.service.userHome,
-        ...(operation.service.uid === undefined ? {} : { uid: operation.service.uid }),
-    });
-}

package/dist/storage-worker-operation.js

@@ -1,284 +0,0 @@
-import { createHash, timingSafeEqual } from "node:crypto";
-import { realpathSync } from "node:fs";
-import { readFile } from "node:fs/promises";
-import { basename, dirname, join, posix, win32 } from "node:path";
-import { z } from "zod";
-import { atomicPrivateWrite } from "./atomic-private-write.js";
-import { assertStorageControlMaterialTokenFree } from "./storage-credential-guard.js";
-import { storageLayout } from "./storage-layout.js";
-import { StorageMigrationWarningCodeSchema } from "./storage-migration-policy.js";
-const CONTROL = /[\0\r\n]/u;
-const PROFILE = /^[a-z0-9][a-z0-9_-]{0,47}$/u;
-const ENVIRONMENT = /^[a-z0-9][a-z0-9_-]{0,31}$/u;
-const HASH = /^[0-9a-f]{64}$/u;
-const AbsolutePathSchema = z.string().min(1).max(32768)
-    .refine((value) => !CONTROL.test(value), "path must be a single line")
-    .refine((value) => posix.isAbsolute(value) || win32.isAbsolute(value), "path must be absolute");
-const RelativePathSchema = z.string().min(1).max(32768)
-    .refine((value) => !CONTROL.test(value), "path must be a single line")
-    .refine((value) => !posix.isAbsolute(value) && !win32.isAbsolute(value), "path must be relative")
-    .refine((value) => !value.split(/[\\/]/u).some((segment) => segment === "" || segment === "." || segment === ".."), "path must be normalized");
-const SourceKindSchema = z.enum(["daemon-home", "agents-root", "legacy-agents-root"]);
-const PolicySchema = z.object({
-    exclusions: z.array(z.object({
-        sourceKind: SourceKindSchema,
-        sourcePath: RelativePathSchema,
-        reason: z.string().min(1).max(256),
-    }).strict()).max(100_000),
-    transformations: z.array(z.object({
-        sourceKind: SourceKindSchema,
-        sourcePath: RelativePathSchema,
-        logicalDestination: RelativePathSchema,
-        sourceSha256: z.string().regex(HASH),
-        targetSha256: z.string().regex(HASH),
-        targetMode: z.string().regex(/^[0-7]{4}$/u),
-        transform: z.literal("redact_live_like_tokens_v1"),
-    }).strict()).max(100_000),
-}).strict();
-const DoctorInputSchema = z.object({
-    migrationId: z.string().uuid(),
-    generatedAt: z.string().datetime({ offset: true }),
-    environment: z.string().regex(ENVIRONMENT),
-    workspaceId: z.string().uuid(),
-    profile: z.string().regex(PROFILE),
-    targetWorkspaceRoot: AbsolutePathSchema,
-    sources: z.array(z.object({
-        kind: SourceKindSchema,
-        root: AbsolutePathSchema,
-        logicalPrefix: RelativePathSchema,
-    }).strict()).min(1).max(3),
-    policy: PolicySchema,
-    manifestStoreRoot: AbsolutePathSchema.optional(),
-    state: z.object({
-        profileIdentityExact: z.boolean(),
-        duplicateWorkspaceMappings: z.number().int().nonnegative(),
-        activeAgentExecutions: z.number().int().nonnegative(),
-        activeScheduledRuns: z.number().int().nonnegative(),
-    }).strict(),
-    freeSpaceMultiplier: z.number().finite().min(1).max(10).optional(),
-}).strict();
-const ManagedServiceRecordSchema = z.object({
-    version: z.literal(1),
-    generation: z.string().uuid(),
-    platform: z.enum(["darwin", "linux"]),
-    serviceId: z.string().min(1).max(256),
-    profile: z.string().regex(PROFILE),
-    daemonHome: AbsolutePathSchema,
-    agentsRoot: AbsolutePathSchema,
-    nodePath: AbsolutePathSchema,
-    entryPath: AbsolutePathSchema,
-    packageRoot: AbsolutePathSchema,
-    npmPrefix: AbsolutePathSchema,
-    descriptorPath: AbsolutePathSchema,
-    descriptorSha256: z.string().regex(HASH),
-    createdAt: z.string().datetime({ offset: true }),
-}).strict();
-const InstallationRecordSchema = z.object({
-    version: z.literal(1),
-    installationId: z.string().uuid(),
-    profile: z.string().regex(PROFILE),
-    serverUrl: z.string().url().max(2048).refine((value) => {
-        const url = new URL(value);
-        return (url.protocol === "http:" || url.protocol === "https:") && !url.username && !url.password;
-    }, "serverUrl must be HTTP(S) without credentials"),
-    environment: z.string().regex(ENVIRONMENT),
-    workspaceId: z.string().uuid(),
-    storageId: z.string().min(1).max(128).regex(/^[A-Za-z0-9_-]+$/u),
-    nowworkHome: AbsolutePathSchema,
-    runtimeRoot: AbsolutePathSchema,
-    credentialRef: z.string().regex(/^profile:[a-z0-9][a-z0-9_-]{0,47}$/u),
-    storageMigrationId: z.string().uuid(),
-    createdAt: z.string().datetime({ offset: true }),
-    updatedAt: z.string().datetime({ offset: true }),
-}).strict();
-const StorageServiceEnvironmentSchema = z.object({
-    NOWWORK_HOME: AbsolutePathSchema.optional(),
-    NOWWORK_ENV_TAG: z.string().regex(ENVIRONMENT).optional(),
-    NOWWORK_STORAGE_POLICY_PATH: AbsolutePathSchema.optional(),
-}).strict();
-const OperationSchema = z.object({
-    version: z.literal(1),
-    migrationId: z.string().uuid(),
-    createdAt: z.string().datetime({ offset: true }),
-    environment: z.string().regex(ENVIRONMENT),
-    workspaceId: z.string().uuid(),
-    profile: z.string().regex(PROFILE),
-    expectedManifestDigest: z.string().regex(HASH),
-    doctorInput: DoctorInputSchema,
-    migration: z.object({
-        sourceRoots: z.object({
-            "daemon-home": AbsolutePathSchema.optional(),
-            "agents-root": AbsolutePathSchema.optional(),
-            "legacy-agents-root": AbsolutePathSchema.optional(),
-        }).strict(),
-        stagingWorkspaceRoot: AbsolutePathSchema,
-        targetWorkspaceRoot: AbsolutePathSchema,
-        backupsRoot: AbsolutePathSchema,
-        backupArtifacts: z.array(z.object({
-            name: z.string().regex(/^[a-z0-9][a-z0-9_.-]{0,127}$/u),
-            path: AbsolutePathSchema,
-        }).strict()).max(32),
-        acceptedWarnings: z.array(StorageMigrationWarningCodeSchema)
-            .max(StorageMigrationWarningCodeSchema.options.length),
-    }).strict(),
-    service: z.object({
-        platform: z.enum(["darwin", "linux"]),
-        userHome: AbsolutePathSchema,
-        uid: z.number().int().nonnegative().optional(),
-        serviceEnvironment: StorageServiceEnvironmentSchema.optional(),
-        sourceWasRunning: z.boolean(),
-        sourceRecord: ManagedServiceRecordSchema,
-        targetRecord: ManagedServiceRecordSchema,
-    }).strict(),
-    installation: z.object({
-        configRoot: AbsolutePathSchema,
-        target: InstallationRecordSchema,
-    }).strict(),
-}).strict();
-const pathsFor = (_platform) => posix;
-function canonicalPath(value, platform) {
-    const paths = pathsFor(platform);
-    const absolute = paths.resolve(value);
-    try {
-        return realpathSync.native(absolute);
-    }
-    catch (error) {
-        const code = error.code;
-        if (code === "ENOTDIR")
-            return absolute;
-        if (code !== "ENOENT")
-            throw error;
-    }
-    const missing = [];
-    let ancestor = absolute;
-    for (;;) {
-        const parent = paths.dirname(ancestor);
-        if (parent === ancestor)
-            return absolute;
-        missing.unshift(paths.basename(ancestor));
-        ancestor = parent;
-        try {
-            return paths.resolve(realpathSync.native(ancestor), ...missing);
-        }
-        catch (error) {
-            const code = error.code;
-            if (code === "ENOTDIR")
-                return absolute;
-            if (code !== "ENOENT")
-                throw error;
-        }
-    }
-}
-function samePath(left, right, platform) {
-    return canonicalPath(left, platform) === canonicalPath(right, platform);
-}
-function isInside(root, candidate, platform) {
-    const paths = pathsFor(platform);
-    const child = paths.relative(canonicalPath(root, platform), canonicalPath(candidate, platform));
-    return child === "" || (!child.startsWith("..") && !paths.isAbsolute(child));
-}
-function assertSemanticIdentity(operation) {
-    const identity = [operation.doctorInput, operation.installation.target];
-    if (identity.some((value) => value.workspaceId !== operation.workspaceId
-        || value.environment !== operation.environment || value.profile !== operation.profile)
-        || operation.doctorInput.migrationId !== operation.migrationId
-        || operation.installation.target.storageMigrationId !== operation.migrationId
-        || operation.installation.target.credentialRef !== `profile:${operation.profile}`) {
-        throw new Error("storage worker operation identity does not match");
-    }
-    if (operation.doctorInput.state.profileIdentityExact !== true
-        || operation.doctorInput.state.duplicateWorkspaceMappings !== 0
-        || operation.doctorInput.state.activeAgentExecutions !== 0
-        || operation.doctorInput.state.activeScheduledRuns !== 0) {
-        throw new Error("storage worker operation doctor state is not safe");
-    }
-    const { platform, sourceRecord, targetRecord } = operation.service;
-    if (sourceRecord.platform !== platform || targetRecord.platform !== platform
-        || sourceRecord.profile !== operation.profile || targetRecord.profile !== operation.profile
-        || sourceRecord.serviceId === targetRecord.serviceId
-        || !samePath(sourceRecord.nodePath, targetRecord.nodePath, platform)
-        || !samePath(sourceRecord.entryPath, targetRecord.entryPath, platform)
-        || !samePath(sourceRecord.packageRoot, targetRecord.packageRoot, platform)
-        || !samePath(sourceRecord.npmPrefix, targetRecord.npmPrefix, platform)
-        || !samePath(targetRecord.daemonHome, operation.installation.configRoot, platform)) {
-        throw new Error("storage worker service identity does not match");
-    }
-    const sourceKinds = new Set();
-    for (const source of operation.doctorInput.sources) {
-        if (sourceKinds.has(source.kind) || !samePath(operation.migration.sourceRoots[source.kind] ?? "", source.root, platform)) {
-            throw new Error("storage worker source roots do not match doctor input");
-        }
-        sourceKinds.add(source.kind);
-    }
-    const configuredSourceKinds = Object.entries(operation.migration.sourceRoots)
-        .filter(([, value]) => value !== undefined)
-        .map(([kind]) => kind);
-    if (configuredSourceKinds.length !== sourceKinds.size || configuredSourceKinds.some((kind) => !sourceKinds.has(kind))
-        || !samePath(operation.migration.sourceRoots["daemon-home"] ?? "", sourceRecord.daemonHome, platform)
-        || !samePath(operation.migration.sourceRoots["agents-root"] ?? "", sourceRecord.agentsRoot, platform)) {
-        throw new Error("storage worker source service roots do not match");
-    }
-    const projected = storageLayout({
-        nowworkHome: operation.installation.target.nowworkHome,
-        environment: operation.environment,
-        workspaceId: operation.workspaceId,
-        runtimeBase: join(operation.service.userHome, ".nowwork-worker-runtime-validation"),
-        platform,
-    });
-    if (!samePath(projected.workspaceRoot, operation.migration.targetWorkspaceRoot, platform)
-        || !samePath(projected.workspaceRoot, operation.doctorInput.targetWorkspaceRoot, platform)
-        || !samePath(projected.agentItemsRoot, targetRecord.agentsRoot, platform)) {
-        throw new Error("storage worker target layout does not match installation identity");
-    }
-    if (dirname(operation.migration.stagingWorkspaceRoot) !== dirname(operation.migration.targetWorkspaceRoot)
-        || !basename(operation.migration.stagingWorkspaceRoot).includes(operation.migrationId)) {
-        throw new Error("storage worker staging identity does not match target");
-    }
-    if (isInside(operation.installation.target.nowworkHome, operation.migration.backupsRoot, platform)
-        || isInside(operation.installation.target.nowworkHome, operation.installation.configRoot, platform)) {
-        throw new Error("storage worker local state must remain outside NOWWORK_HOME");
-    }
-}
-function parseOperation(raw) {
-    const operation = OperationSchema.parse(raw);
-    assertSemanticIdentity(operation);
-    return operation;
-}
-function sha256(value) {
-    return createHash("sha256").update(value).digest("hex");
-}
-export async function writeStorageWorkerOperation(raw, input) {
-    try {
-        const operation = parseOperation(raw);
-        const stateRoot = AbsolutePathSchema.parse(input.stateRoot);
-        const path = join(stateRoot, "migrations", operation.migrationId, "operation.json");
-        const serialized = `${JSON.stringify(operation, null, 2)}\n`;
-        assertStorageControlMaterialTokenFree(serialized, "storage worker operation");
-        await atomicPrivateWrite(path, serialized);
-        return Object.freeze({ path, sha256: sha256(serialized) });
-    }
-    catch (error) {
-        throw new Error("Invalid storage worker operation", { cause: error });
-    }
-}
-export async function readStorageWorkerOperation(path, expectedSha256) {
-    try {
-        AbsolutePathSchema.parse(path);
-        z.string().regex(HASH).parse(expectedSha256);
-        const raw = await readFile(path);
-        assertStorageControlMaterialTokenFree(raw.toString("utf8"), "storage worker operation");
-        const actual = Buffer.from(sha256(raw), "hex");
-        const expected = Buffer.from(expectedSha256, "hex");
-        if (!timingSafeEqual(actual, expected))
-            throw new Error("storage worker operation digest mismatch");
-        const operation = parseOperation(JSON.parse(raw.toString("utf8")));
-        if (basename(path) !== "operation.json" || basename(dirname(path)) !== operation.migrationId
-            || basename(dirname(dirname(path))) !== "migrations") {
-            throw new Error("storage worker operation path does not match migration identity");
-        }
-        return operation;
-    }
-    catch (error) {
-        throw new Error("Invalid storage worker operation", { cause: error });
-    }
-}

package/dist/storage-worker-status.js

@@ -1,232 +0,0 @@
-import { readFile, unlink } from "node:fs/promises";
-import { basename, dirname, isAbsolute, join } from "node:path";
-import { Worker } from "node:worker_threads";
-import { z } from "zod";
-import { atomicPrivateWrite } from "./atomic-private-write.js";
-const WorkerFailureSchema = z.object({
-    version: z.literal(1),
-    migrationId: z.string().uuid(),
-    status: z.literal("failed"),
-    errorCode: z.string().regex(/^[a-z0-9._-]{1,128}$/u),
-    errorMessage: z.string().min(1).max(512),
-    at: z.string().datetime({ offset: true }),
-}).strict();
-const WorkerHeartbeatSchema = z.object({
-    version: z.literal(1),
-    migrationId: z.string().uuid(),
-    pid: z.number().int().positive(),
-    at: z.string().datetime({ offset: true }),
-}).strict();
-const TOKEN = /(?:\bsk_(?:machine|user|agent)_[A-Za-z0-9_-]{4,}\b|\bbearer\s+[^\s]+|(?:password|secret|token)\s*[:=]\s*[^\s]+)/giu;
-const HEARTBEAT_WORKER_KIND = "nowwork-storage-worker-heartbeat-v1";
-async function unlinkHeartbeat(path) {
-    await unlink(path).catch((error) => {
-        if (error.code !== "ENOENT")
-            throw error;
-    });
-}
-/**
- * Keep the liveness writer in a worker with its own event loop. The source is
- * intentionally plain JavaScript because `new Worker(new URL(import.meta.url))`
- * cannot resolve the source tree's `.js` specifiers under tsx/Vitest; production
- * builds and tests therefore exercise the same isolated execution boundary.
- */
-const HEARTBEAT_WORKER_SOURCE = String.raw `
-const { parentPort, workerData } = require("node:worker_threads");
-const { mkdir, chmod, rename, rm, unlink, writeFile } = require("node:fs/promises");
-const { dirname } = require("node:path");
-const { randomUUID } = require("node:crypto");
-
-const atomicPrivateWrite = async (path, content) => {
-  const directory = dirname(path);
-  await mkdir(directory, { recursive: true, mode: 0o700 });
-  await chmod(directory, 0o700);
-  const temporary = path + "." + randomUUID() + ".tmp";
-  try {
-    await writeFile(temporary, content, { encoding: "utf8", mode: 0o600, flag: "wx" });
-    await rename(temporary, path);
-    await chmod(path, 0o600);
-  } finally {
-    await rm(temporary, { force: true });
-  }
-};
-const removeHeartbeat = async () => {
-  try { await unlink(workerData.path); } catch (error) {
-    if (error && error.code !== "ENOENT") throw error;
-  }
-};
-let pending = Promise.resolve();
-let stopping = false;
-let firstWrite = true;
-const write = () => {
-  const initial = firstWrite;
-  firstWrite = false;
-  pending = pending.catch(() => undefined).then(() => atomicPrivateWrite(workerData.path, JSON.stringify({
-    version: 1,
-    migrationId: workerData.migrationId,
-    pid: process.pid,
-    at: initial && workerData.initialAt ? workerData.initialAt : new Date().toISOString(),
-  }, null, 2) + "\n"));
-  return pending;
-};
-const report = (message) => { try { parentPort.postMessage(message); } catch {} };
-(async () => {
-  try { await write(); report({ type: "ready" }); }
-  catch (error) { report({ type: "error", message: error instanceof Error ? error.message : String(error) }); return; }
-  const timer = setInterval(() => {
-    if (!stopping) void write().catch((error) => report({ type: "error", message: error instanceof Error ? error.message : String(error) }));
-  }, workerData.intervalMs);
-  timer.unref?.();
-  parentPort.on("message", (message) => {
-    if (stopping || !message || message.type !== "stop") return;
-    stopping = true;
-    clearInterval(timer);
-    void pending.then(async () => { await removeHeartbeat(); report({ type: "stopped" }); }, async () => {
-      await removeHeartbeat().catch(() => undefined); report({ type: "stopped" });
-    });
-  });
-})();
-`;
-function identityFromHandoffPath(handoffPath) {
-    if (!isAbsolute(handoffPath) || basename(handoffPath) !== "handoff.json") {
-        throw new Error("storage worker handoff path is invalid");
-    }
-    const migrationDirectory = dirname(handoffPath);
-    const migrationsDirectory = dirname(migrationDirectory);
-    if (basename(migrationsDirectory) !== "migrations")
-        throw new Error("storage worker handoff path is invalid");
-    return {
-        stateRoot: dirname(migrationsDirectory),
-        migrationId: z.string().uuid().parse(basename(migrationDirectory)).toLowerCase(),
-    };
-}
-export function storageWorkerFailurePath(stateRoot, migrationId) {
-    if (!isAbsolute(stateRoot))
-        throw new Error("storage worker state root must be absolute");
-    return join(stateRoot, "migrations", z.string().uuid().parse(migrationId), "worker-status.json");
-}
-export function storageWorkerHeartbeatPath(stateRoot, migrationId) {
-    if (!isAbsolute(stateRoot))
-        throw new Error("storage worker state root must be absolute");
-    return join(stateRoot, "migrations", z.string().uuid().parse(migrationId), "worker-heartbeat.json");
-}
-export async function startStorageWorkerHeartbeat(handoffPath, input = {}) {
-    const identity = identityFromHandoffPath(handoffPath);
-    const intervalMs = z.number().int().min(100).max(60_000).parse(input.intervalMs ?? 5_000);
-    const path = storageWorkerHeartbeatPath(identity.stateRoot, identity.migrationId);
-    // The worker owns heartbeat I/O so a synchronous CPU-heavy scan in the
-    // migration process cannot delay the monitor's 30-second freshness window.
-    const worker = new Worker(HEARTBEAT_WORKER_SOURCE, {
-        eval: true,
-        // `--input-type=module` is inherited by workers launched from an eval
-        // smoke test; strip it so the plain CommonJS worker source can use require.
-        execArgv: process.execArgv.filter((arg) => !arg.startsWith("--input-type=")),
-        workerData: {
-            kind: HEARTBEAT_WORKER_KIND,
-            path,
-            migrationId: identity.migrationId,
-            intervalMs,
-            ...(input.now === undefined ? {} : { initialAt: input.now().toISOString() }),
-        },
-    });
-    worker.unref();
-    let startupSettled = false;
-    let heartbeatError = null;
-    let stopResolve = null;
-    const onWorkerMessage = (message) => {
-        if (message.type === "error") {
-            heartbeatError = new Error(`storage worker heartbeat failed: ${message.message}`);
-            if (!startupSettled)
-                startupReject?.(heartbeatError);
-        }
-        else if (message.type === "stopped") {
-            stopResolve?.();
-            stopResolve = null;
-        }
-    };
-    let startupReject = null;
-    worker.on("message", onWorkerMessage);
-    // Keep this listener for the entire worker lifetime. A heartbeat write may
-    // fail after startup; dropping the listener would turn that operational
-    // error into an unhandled Worker 'error' event and crash the parent.
-    const onWorkerError = (error) => {
-        heartbeatError = error;
-        if (!startupSettled)
-            startupReject?.(error);
-    };
-    worker.on("error", onWorkerError);
-    await new Promise((resolvePromise, reject) => {
-        startupReject = reject;
-        const onReady = (message) => {
-            if (message.type !== "ready")
-                return;
-            startupSettled = true;
-            worker.off("message", onReady);
-            resolvePromise();
-        };
-        worker.on("message", onReady);
-    }).catch(async (error) => {
-        startupSettled = true;
-        await worker.terminate().catch(() => undefined);
-        worker.off("message", onWorkerMessage);
-        worker.off("error", onWorkerError);
-        await unlinkHeartbeat(path).catch(() => undefined);
-        throw error;
-    });
-    let stopped = false;
-    return async () => {
-        if (stopped)
-            return;
-        stopped = true;
-        await new Promise((resolvePromise) => {
-            const onExit = () => {
-                worker.off("exit", onExit);
-                stopResolve = null;
-                resolvePromise();
-            };
-            stopResolve = resolvePromise;
-            worker.once("exit", onExit);
-            worker.postMessage({ type: "stop" });
-        });
-        await worker.terminate().catch(() => undefined);
-        worker.off("message", onWorkerMessage);
-        worker.off("error", onWorkerError);
-        await unlinkHeartbeat(path);
-    };
-}
-export async function writeStorageWorkerFailureStatus(handoffPath, error) {
-    const identity = identityFromHandoffPath(handoffPath);
-    const rawCode = error instanceof Error && "code" in error ? String(error.code) : "worker_failed";
-    const errorCode = /^[a-z0-9._-]{1,128}$/u.test(rawCode) ? rawCode : "worker_failed";
-    const rawMessage = error instanceof Error ? error.message : String(error);
-    const errorMessage = rawMessage.replaceAll(TOKEN, "<redacted>").slice(0, 512) || "storage worker failed";
-    const status = WorkerFailureSchema.parse({
-        version: 1,
-        migrationId: identity.migrationId,
-        status: "failed",
-        errorCode,
-        errorMessage,
-        at: new Date().toISOString(),
-    });
-    await atomicPrivateWrite(storageWorkerFailurePath(identity.stateRoot, identity.migrationId), `${JSON.stringify(status, null, 2)}\n`);
-}
-export async function readStorageWorkerFailureStatus(stateRoot, migrationId) {
-    try {
-        return WorkerFailureSchema.parse(JSON.parse(await readFile(storageWorkerFailurePath(stateRoot, migrationId), "utf8")));
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return null;
-        throw new Error("Invalid storage worker failure status", { cause: error });
-    }
-}
-export async function readStorageWorkerHeartbeat(stateRoot, migrationId) {
-    try {
-        return WorkerHeartbeatSchema.parse(JSON.parse(await readFile(storageWorkerHeartbeatPath(stateRoot, migrationId), "utf8")));
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return null;
-        throw new Error("Invalid storage worker heartbeat", { cause: error });
-    }
-}