@omnitron-dev/omnitron 0.3.0 → 0.3.2

package/dist/daemon/execution-launcher.js

@@ -0,0 +1,110 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { randomUUID } from 'node:crypto';
+import { fork } from 'node:child_process';
+import { expandPath } from '../shared/paths.js';
+import { PidManager } from './pid-manager.js';
+import { ExecutionClient } from './execution-client.js';
+import { ExecutionJournal } from './execution-journal.js';
+import { residentOwnerRefusal } from './execution-platform.js';
+import { readManagedRuntime, managedJobPid, verifyManagedIsolation } from './managed-runtime.js';
+import { assertExecutionCapabilities, REQUIRED_OWNER_CAPABILITIES } from './execution-capabilities.js';
+export function executionDirectory(dc) {
+    return expandPath(dc.executionHost?.directory ?? path.join(path.dirname(expandPath(dc.pidFile)), 'execution'));
+}
+export async function connectExecutionOwner(config, dc, logger, ticket) {
+    const managed = await readManagedRuntime();
+    const refusal = managed ? null : residentOwnerRefusal();
+    if (refusal)
+        throw new Error(refusal);
+    const directory = executionDirectory(dc);
+    if (Buffer.byteLength(path.join(directory, `c-${randomUUID()}.sock`)) > 100) {
+        throw new Error('Execution directory is too long for a private control socket; configure a shorter executionHost.directory');
+    }
+    await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+    const stat = await fs.lstat(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0 ||
+        (process.getuid && stat.uid !== process.getuid()))
+        throw new Error('Execution directory must be private and owned by this user');
+    const marker = new PidManager(path.join(directory, 'owner.pid'));
+    const reused = marker.isRunning();
+    if (managed) {
+        if (path.resolve(managed.directory) !== path.resolve(directory) || !reused)
+            throw new Error('The independently supervised execution owner is not ready');
+        await verifyManagedIsolation(managed, marker.getPid(), await managedJobPid(managed, 'backend'), process.pid);
+    }
+    if (!reused) {
+        if (ticket)
+            throw new Error('The execution owner died during handoff; refusing to restart or adopt applications silently');
+        const entry = fileURLToPath(new URL('./execution-entry.js', import.meta.url));
+        await fs.access(entry);
+        const boot = path.join(directory, `boot-${randomUUID()}.json`);
+        await fs.writeFile(boot, JSON.stringify({ directory, cwd: process.cwd(), config, daemonConfig: dc }, (_key, value) => {
+            if (typeof value === 'function' || typeof value === 'symbol' || typeof value === 'bigint') {
+                throw new Error('Execution configuration must be serializable; keep application code in its bootstrap module');
+            }
+            return value;
+        }), { flag: 'wx', mode: 0o600 });
+        const output = await fs.open(path.join(directory, 'owner.log'), 'a', 0o600);
+        try {
+            const child = fork(entry, [boot], { cwd: process.cwd(), detached: true, execArgv: [],
+                stdio: ['ignore', output.fd, output.fd, 'ipc'] });
+            await new Promise((resolve, reject) => {
+                const timer = setTimeout(() => finish(new Error(`Execution owner did not become ready; inspect ${directory}/owner.log. No running owner was terminated.`)), 30_000);
+                const finish = (error) => {
+                    clearTimeout(timer);
+                    child.off('error', onError);
+                    child.off('exit', onExit);
+                    child.off('message', onMessage);
+                    if (error)
+                        reject(error);
+                    else
+                        resolve();
+                };
+                const onError = (error) => finish(error);
+                const onExit = (code) => finish(new Error(`Execution owner exited ${code}; inspect ${directory}/owner.log`));
+                const onMessage = (message) => {
+                    const record = message;
+                    if (record.type === 'execution-ready' && record.owner?.pid === child.pid)
+                        finish();
+                };
+                child.once('error', onError);
+                child.once('exit', onExit);
+                child.on('message', onMessage);
+            });
+            child.unref();
+        }
+        finally {
+            await output.close();
+            await fs.unlink(boot);
+        }
+    }
+    const client = new ExecutionClient(path.join(directory, 'owner.sock'), logger, ticket?.to.controllerId);
+    try {
+        const snapshot = await client.connect();
+        assertExecutionCapabilities(snapshot.capabilities, REQUIRED_OWNER_CAPABILITIES);
+        const durable = await new ExecutionJournal(path.join(directory, 'controller.json')).read();
+        if (!durable || durable.owner.id !== snapshot.status.owner.id || durable.owner.pid !== marker.getPid()) {
+            throw new Error('Execution socket, process marker and journal disagree; adoption is refused');
+        }
+        if (ticket) {
+            if (ticket.ownerId !== durable.owner.id)
+                throw new Error('The handoff belongs to a different execution owner');
+            await client.accept(ticket, snapshot.inventoryDigest);
+        }
+        else {
+            if (reused && snapshot.apps.length > 0)
+                throw new Error('Resident applications are already running. Restore the saved backend handoff instead of running startup reconciliation.');
+            await client.acquire();
+        }
+        return { client, reused, ...(managed ? { supervision: { type: 'independent', guardianPid: process.ppid,
+                    ownerUnit: process.platform === 'darwin' ? managed.owner.label : managed.owner.unit,
+                    backendUnit: process.platform === 'darwin' ? managed.backend.label : managed.backend.unit } } : {}) };
+    }
+    catch (error) {
+        await client.close();
+        throw error;
+    }
+}
+//# sourceMappingURL=execution-launcher.js.map

package/dist/daemon/execution-launcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-launcher.js","sourceRoot":"","sources":["../../src/daemon/execution-launcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAI1C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEjG,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAEvG,MAAM,UAAU,kBAAkB,CAAC,EAAiB;IAClD,OAAO,UAAU,CAAC,EAAE,CAAC,aAAa,EAAE,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;AACjH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAwB,EAAE,EAAiB,EAAE,MAAe,EAAE,MAAsB;IAEpF,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC;IACxD,IAAI,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,UAAU,EAAE,OAAO,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,2GAA2G,CAAC,CAAC;IAC/H,CAAC;IACD,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QACzE,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IACrI,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAClC,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QACzJ,MAAM,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAG,EAAE,MAAM,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;QAC3H,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,sBAAsB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9E,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,UAAU,EAAE,OAAO,CAAC,CAAC;QAC/D,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,KAAc,EAAE,EAAE;YAC5H,IAAI,OAAO,KAAK,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC1F,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;YACjH,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5E,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gBAClF,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YACpD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iDAAiD,SAAS,8CAA8C,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;gBACpK,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;oBAC/B,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;oBAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;oBACxF,IAAI,KAAK;wBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;wBAAM,OAAO,EAAE,CAAC;gBAC3C,CAAC,CAAC;gBACF,MAAM,OAAO,GAAG,CAAC,KAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChD,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,IAAI,aAAa,SAAS,YAAY,CAAC,CAAC,CAAC;gBAC5H,MAAM,SAAS,GAAG,CAAC,OAAgB,EAAE,EAAE;oBACrC,MAAM,MAAM,GAAG,OAAsD,CAAC;oBACtE,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,IAAI,MAAM,CAAC,KAAK,EAAE,GAAG,KAAK,KAAK,CAAC,GAAG;wBAAE,MAAM,EAAE,CAAC;gBACrF,CAAC,CAAC;gBACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAAC,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC3F,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;gBAAS,CAAC;YAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;IACxG,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACxC,2BAA2B,CAAC,QAAQ,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;QAChF,MAAM,OAAO,GAAG,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3F,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACvG,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,KAAK,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YAC/G,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,IAAI,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,yHAAyH,CAAC,CAAC;YACnL,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,aAAsB,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI;oBAC7G,SAAS,EAAE,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI;oBACnF,WAAW,EAAE,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1G,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;AACxD,CAAC"}

package/dist/daemon/execution-main.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=execution-main.d.ts.map

package/dist/daemon/execution-main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-main.d.ts","sourceRoot":"","sources":["../../src/daemon/execution-main.ts"],"names":[],"mappings":""}

package/dist/daemon/execution-main.js

@@ -0,0 +1,48 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { LoggerService } from '@omnitron-dev/titan/module/logger';
+import { startExecutionOwner } from './execution-owner.js';
+import { PidManager } from './pid-manager.js';
+const bootFile = process.argv[2];
+if (!bootFile || !path.isAbsolute(bootFile))
+    throw new Error('An absolute execution boot record is required');
+const stat = await fs.lstat(bootFile);
+if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0 ||
+    (process.getuid && stat.uid !== process.getuid()))
+    throw new Error('Execution boot record must be private');
+const boot = JSON.parse(await fs.readFile(bootFile, 'utf8'));
+process.chdir(boot.cwd);
+const logger = new LoggerService({ level: 'info' }).child({ component: 'execution-owner' });
+let owner = null;
+let stopping = false;
+async function stop() {
+    if (stopping)
+        return;
+    stopping = true;
+    try {
+        await owner?.stop();
+        process.exitCode = 0;
+    }
+    catch (error) {
+        logger.error({ error }, 'Execution owner shutdown failed');
+        process.exitCode = 1;
+    }
+    finally {
+        process.exit(process.exitCode);
+    }
+}
+try {
+    owner = await startExecutionOwner({ ...boot, logger, onShutdownRequested: () => { setTimeout(() => { void stop(); }, 100); } });
+}
+catch (error) {
+    new PidManager(path.join(boot.directory, 'owner.pid')).removeOwned();
+    logger.error({ error }, 'Execution owner initialization failed; no applications were adopted');
+    process.exit(1);
+}
+process.on('SIGTERM', () => { void stop(); });
+process.on('SIGINT', () => { void stop(); });
+process.send?.({ type: 'execution-ready', owner: owner.service.fence.owner });
+// Losing a backend never ends the execution host. Its own signal handling
+// and worker parent-death watchdogs retain their ordinary semantics.
+process.disconnect?.();
+//# sourceMappingURL=execution-main.js.map

package/dist/daemon/execution-main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-main.js","sourceRoot":"","sources":["../../src/daemon/execution-main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;IAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;AAC9G,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AACtC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;IACpE,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;IAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;AAChH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAE1D,CAAC;AACF,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxB,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAC5F,IAAI,KAAK,GAA2D,IAAI,CAAC;AACzE,IAAI,QAAQ,GAAG,KAAK,CAAC;AACrB,KAAK,UAAU,IAAI;IACjB,IAAI,QAAQ;QAAE,OAAO;IACrB,QAAQ,GAAG,IAAI,CAAC;IAChB,IAAI,CAAC;QAAC,MAAM,KAAK,EAAE,IAAI,EAAE,CAAC;QAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IAAC,CAAC;IAClD,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,iCAAiC,CAAC,CAAC;QAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IAAC,CAAC;YAC3F,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;AAC7C,CAAC;AACD,IAAI,CAAC;IACH,KAAK,GAAG,MAAM,mBAAmB,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAClI,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,qEAAqE,CAAC,CAAC;IAC/F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;AAC9E,0EAA0E;AAC1E,qEAAqE;AACrE,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC"}

package/dist/daemon/execution-owner.d.ts

@@ -0,0 +1,16 @@
+import type { ILogger, LogSinkHealth } from '@omnitron-dev/titan/module/logger';
+import type { IEcosystemConfig, IDaemonConfig } from '../config/types.js';
+import { ExecutionHostService } from './execution-host.js';
+/** A resident process, separate from the replaceable backend and its system workers. */
+export declare function startExecutionOwner(options: {
+    directory: string;
+    config: IEcosystemConfig;
+    daemonConfig: IDaemonConfig;
+    logger: ILogger;
+    loggerHealth?: () => LogSinkHealth[];
+    onShutdownRequested?: () => void;
+}): Promise<{
+    stop(): Promise<void>;
+    service: ExecutionHostService;
+}>;
+//# sourceMappingURL=execution-owner.d.ts.map

package/dist/daemon/execution-owner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-owner.d.ts","sourceRoot":"","sources":["../../src/daemon/execution-owner.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAChF,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAO1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAI3D,wFAAwF;AACxF,wBAAsB,mBAAmB,CAAC,OAAO,EAAE;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,gBAAgB,CAAC;IACzB,YAAY,EAAE,aAAa,CAAC;IAC5B,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,aAAa,EAAE,CAAC;IACrC,mBAAmB,CAAC,EAAE,MAAM,IAAI,CAAC;CAClC,GAAG,OAAO,CAAC;IAAE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAAC,CA4EpE"}

package/dist/daemon/execution-owner.js

@@ -0,0 +1,97 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { Netron } from '@omnitron-dev/titan/netron';
+import { UnixSocketTransport } from '@omnitron-dev/titan/netron/transport/unix';
+import { AuthenticationManager, AuthorizationManager } from '@omnitron-dev/titan/netron/auth';
+import { ProcessManager, ControllerHandoff } from '@omnitron-dev/titan-pm';
+import { OrchestratorService } from '../orchestrator/orchestrator.service.js';
+import { FileWatcher } from '../orchestrator/file-watcher.js';
+import { StateStore } from './state-store.js';
+import { DaemonStateStore } from './daemon-state-store.service.js';
+import { PidManager } from './pid-manager.js';
+import { ExecutionJournal } from './execution-journal.js';
+import { ExecutionHostService } from './execution-host.js';
+import { executionProcessConfig, executionLogManager } from './execution-config.js';
+import { shutdownExecutionOwner } from './execution-shutdown.js';
+/** A resident process, separate from the replaceable backend and its system workers. */
+export async function startExecutionOwner(options) {
+    const { directory, logger, daemonConfig } = options;
+    let config = options.config;
+    await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+    const stat = await fs.lstat(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0 ||
+        (process.getuid && stat.uid !== process.getuid()))
+        throw new Error('Execution directory must be private and owned by this user');
+    const socket = path.join(directory, 'owner.sock');
+    const pid = new PidManager(path.join(directory, 'owner.pid'));
+    if (pid.isRunning())
+        throw new Error('Execution owner is already running; connect to it instead of replacing its processes');
+    pid.cleanupStale(socket);
+    pid.write();
+    const journal = new ExecutionJournal(path.join(directory, 'controller.json'));
+    const previous = await journal.read();
+    const identity = { id: randomUUID(), pid: process.pid, startedAt: new Date().toISOString() };
+    const grant = { ownerId: identity.id, controllerId: 'unclaimed', epoch: (previous?.grant.epoch ?? 0) + 1 };
+    if (!Number.isSafeInteger(grant.epoch))
+        throw new Error('Execution epoch exhausted');
+    await journal.write({ protocol: 1, owner: identity, grant });
+    const fence = new ControllerHandoff(identity, grant, next => journal.write({ protocol: 1, owner: identity, grant: next }));
+    const store = new DaemonStateStore(logger, path.join(directory, 'state.db'));
+    const state = new StateStore(store);
+    await state.init();
+    const pm = new ProcessManager(logger, executionProcessConfig(config));
+    const orchestrator = new OrchestratorService(logger, pm, state, undefined, { reapForeignOrphans: false, allowSdklessBootstrap: false });
+    orchestrator.setConfig(config);
+    const logs = executionLogManager(config, daemonConfig, orchestrator);
+    orchestrator.onAppLog((app, line, context) => logs.appendToFile(app, line, context));
+    let watcher = null;
+    const netron = new Netron(logger, { id: `execution-${identity.id}` });
+    netron.registerTransport('unix', () => new UnixSocketTransport());
+    netron.registerTransportServer('unix', { name: 'execution-owner', options: {
+            path: socket, force: false, mode: 0o600, requestTimeout: 10 * 60_000,
+        } });
+    netron.configureAuth(new AuthenticationManager(logger, {
+        authenticate: async () => { throw new Error('Execution control requires the private Unix socket'); },
+        validateToken: async () => { throw new Error('Execution control does not accept bearer tokens'); },
+        tokenCache: { enabled: false },
+    }), new AuthorizationManager(logger));
+    netron.setTransportAuthContext('unix', { userId: 'execution-local', roles: ['execution-controller'], permissions: [] });
+    const service = new ExecutionHostService(orchestrator, fence, journal, {
+        logs,
+        statePersistence: () => state.persistenceStatus(),
+        ...(options.loggerHealth && { loggerHealth: options.loggerHealth }),
+        watch(enabled, apps) {
+            watcher?.stop();
+            watcher = null;
+            if (enabled) {
+                watcher = new FileWatcher(logger, orchestrator, config, process.cwd());
+                watcher.start(apps);
+            }
+        },
+        retireWatches(apps) { for (const name of apps)
+            watcher?.removeApp(name); },
+        watchConfig(next) { config = next; watcher?.applyConfig(next); },
+        watchedApps: () => watcher?.getWatchedApps() ?? [],
+        ...(options.onShutdownRequested && { shutdown: options.onShutdownRequested }),
+    });
+    await netron.peer.exposeService(service);
+    await netron.start();
+    orchestrator.setTopologyDirectory(path.join(directory, 'topology'));
+    let stopping = null;
+    return { service, stop() {
+            stopping ??= Promise.resolve().then(() => shutdownExecutionOwner({
+                phase: stage => logger.info({ stage }, 'Execution owner shutdown stage'),
+                stopWatching: () => { watcher?.stop(); },
+                stopApplications: () => orchestrator.stopAll(false),
+                stopProcesses: () => pm.shutdown({ timeout: 30_000 }),
+                flushState: () => state.flush(),
+                flushLogs: () => logs.dispose(),
+                stopRpc: () => netron.stop(),
+                closeStorage: () => store.dispose(),
+                removePid: () => { pid.removeOwned(); },
+            }));
+            return stopping;
+        } };
+}
+//# sourceMappingURL=execution-owner.js.map

package/dist/daemon/execution-owner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-owner.js","sourceRoot":"","sources":["../../src/daemon/execution-owner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAG3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAOzC;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IACpD,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC5B,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QACzE,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IACrI,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAC9D,IAAI,GAAG,CAAC,SAAS,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;IAC7H,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACzB,GAAG,CAAC,KAAK,EAAE,CAAC;IAEZ,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC7F,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3G,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACrF,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3H,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACnB,MAAM,EAAE,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,IAAI,mBAAmB,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,CAAC;IACxI,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IACrE,YAAY,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACrF,IAAI,OAAO,GAAuB,IAAI,CAAC;IAEvC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,aAAa,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;IAClE,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE;YACzE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,MAAM;SACrE,EAAE,CAAC,CAAC;IACL,MAAM,CAAC,aAAa,CAAC,IAAI,qBAAqB,CAAC,MAAM,EAAE;QACrD,YAAY,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC,CAAC,CAAC;QACpG,aAAa,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC,CAAC;QAClG,UAAU,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;KAC/B,CAAC,EAAE,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,sBAAsB,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IACxH,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE;QACrE,IAAI;QACJ,gBAAgB,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE;QACjD,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;QACnE,KAAK,CAAC,OAAO,EAAE,IAAI;YACjB,OAAO,EAAE,IAAI,EAAE,CAAC;YAChB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,GAAG,IAAI,WAAW,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBACvE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,aAAa,CAAC,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,IAAI;YAAE,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1E,WAAW,CAAC,IAAI,IAAI,MAAM,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE;QAClD,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC;KAC9E,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACrB,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IACpE,IAAI,QAAQ,GAAyB,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,EAAE,IAAI;YACpB,QAAQ,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC;gBAC/D,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,gCAAgC,CAAC;gBACxE,YAAY,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACxC,gBAAgB,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;gBACnD,aAAa,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;gBACrD,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;gBAC/B,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE;gBAC/B,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE;gBAC5B,YAAY,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE;gBACnC,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;aACxC,CAAC,CAAC,CAAC;YACJ,OAAO,QAAQ,CAAC;QAClB,CAAC,EAAE,CAAC;AACN,CAAC"}

package/dist/daemon/execution-platform.d.ts

@@ -0,0 +1,3 @@
+/** A detached child still belongs to its parent's systemd cgroup. Fail closed. */
+export declare function residentOwnerRefusal(): string | null;
+//# sourceMappingURL=execution-platform.d.ts.map

package/dist/daemon/execution-platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-platform.d.ts","sourceRoot":"","sources":["../../src/daemon/execution-platform.ts"],"names":[],"mappings":"AAEA,kFAAkF;AAClF,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,IAAI,CAepD"}

package/dist/daemon/execution-platform.js

@@ -0,0 +1,23 @@
+import fs from 'node:fs';
+/** A detached child still belongs to its parent's systemd cgroup. Fail closed. */
+export function residentOwnerRefusal() {
+    if (process.platform === 'win32')
+        return 'Resident execution currently requires owner-only Unix sockets';
+    if (process.env['INVOCATION_ID'] || process.env['SYSTEMD_EXEC_PID'] ||
+        process.env['XPC_SERVICE_NAME']?.includes('omnitron')) {
+        return 'The backend runs under an OS service. Configure independent execution-owner supervision before transferring the backend; detaching does not isolate an OS service process group.';
+    }
+    if (process.platform === 'linux') {
+        try {
+            const cgroup = fs.readFileSync('/proc/self/cgroup', 'utf8');
+            if (/\/(?:system|user)\.slice\/.*\.service(?:\/|\n|$)/m.test(cgroup)) {
+                return 'The backend belongs to a systemd service cgroup; resident-owner activation needs a separate service cgroup';
+            }
+        }
+        catch {
+            return 'Cannot verify OS process-group isolation; resident-owner activation is refused';
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=execution-platform.js.map

package/dist/daemon/execution-platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-platform.js","sourceRoot":"","sources":["../../src/daemon/execution-platform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,kFAAkF;AAClF,MAAM,UAAU,oBAAoB;IAClC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,+DAA+D,CAAC;IACzG,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1D,OAAO,kLAAkL,CAAC;IAC5L,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;YAC5D,IAAI,mDAAmD,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrE,OAAO,4GAA4G,CAAC;YACtH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,gFAAgF,CAAC;QAAC,CAAC;IACtG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/daemon/execution-shutdown.d.ts

@@ -0,0 +1,13 @@
+/** Shutdown proof used before the managed owner may publish its clean receipt. */
+export declare function shutdownExecutionOwner(steps: {
+    phase(stage: string): void;
+    stopWatching(): void;
+    stopApplications(): Promise<unknown>;
+    stopProcesses(): Promise<void>;
+    flushState(): Promise<void>;
+    flushLogs(): Promise<void>;
+    stopRpc(): Promise<void>;
+    closeStorage(): Promise<void>;
+    removePid(): void;
+}): Promise<void>;
+//# sourceMappingURL=execution-shutdown.d.ts.map

package/dist/daemon/execution-shutdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-shutdown.d.ts","sourceRoot":"","sources":["../../src/daemon/execution-shutdown.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,IAAI,IAAI,CAAC;IACrB,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,SAAS,IAAI,IAAI,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB"}

package/dist/daemon/execution-shutdown.js

@@ -0,0 +1,30 @@
+/** Shutdown proof used before the managed owner may publish its clean receipt. */
+export async function shutdownExecutionOwner(steps) {
+    const failures = [];
+    const attempt = async (stage, work) => {
+        steps.phase(stage);
+        try {
+            await work();
+        }
+        catch (error) {
+            failures.push(new Error(`Execution owner shutdown ${stage} failed: ${String(error)}`, { cause: error }));
+        }
+    };
+    await attempt('watchers', () => steps.stopWatching());
+    await attempt('applications', () => steps.stopApplications());
+    // Application failures must not skip termination of remaining owned workers.
+    await attempt('processes', () => steps.stopProcesses());
+    if (failures.length)
+        throw new AggregateError(failures, 'Execution owner process termination is unconfirmed');
+    // Once processes are stopped, attempt every durable flush/close. A failed
+    // flush still forbids clean:true even if all other cleanup succeeds.
+    await attempt('state', () => steps.flushState());
+    await attempt('logs', () => steps.flushLogs());
+    await attempt('rpc', () => steps.stopRpc());
+    await attempt('storage', () => steps.closeStorage());
+    if (failures.length)
+        throw new AggregateError(failures, 'Execution owner persistence shutdown is incomplete');
+    steps.removePid();
+    steps.phase('complete');
+}
+//# sourceMappingURL=execution-shutdown.js.map

package/dist/daemon/execution-shutdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-shutdown.js","sourceRoot":"","sources":["../../src/daemon/execution-shutdown.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAU5C;IACC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,KAAK,EAAE,KAAa,EAAE,IAAmB,EAAE,EAAE;QAC3D,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnB,IAAI,CAAC;YAAC,MAAM,IAAI,EAAE,CAAC;QAAC,CAAC;QACrB,OAAO,KAAK,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,4BAA4B,KAAK,YAAY,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAAC,CAAC;IAC7H,CAAC,CAAC;IACF,MAAM,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IACtD,MAAM,OAAO,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC9D,6EAA6E;IAC7E,MAAM,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,cAAc,CAAC,QAAQ,EAAE,oDAAoD,CAAC,CAAC;IAC9G,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IACjD,MAAM,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/C,MAAM,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5C,MAAM,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,cAAc,CAAC,QAAQ,EAAE,oDAAoD,CAAC,CAAC;IAC9G,KAAK,CAAC,SAAS,EAAE,CAAC;IAClB,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AAC1B,CAAC"}

package/dist/daemon/managed-entry.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=managed-entry.d.ts.map

package/dist/daemon/managed-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-entry.d.ts","sourceRoot":"","sources":["../../src/daemon/managed-entry.ts"],"names":[],"mappings":""}

package/dist/daemon/managed-entry.js

@@ -0,0 +1,3 @@
+import { guardEntry } from './entry-guard.js';
+await guardEntry('runtime-launcher', () => import('./managed-main.js'));
+//# sourceMappingURL=managed-entry.js.map

package/dist/daemon/managed-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-entry.js","sourceRoot":"","sources":["../../src/daemon/managed-entry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,MAAM,UAAU,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC"}

package/dist/daemon/managed-main.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=managed-main.d.ts.map

package/dist/daemon/managed-main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-main.d.ts","sourceRoot":"","sources":["../../src/daemon/managed-main.ts"],"names":[],"mappings":""}

package/dist/daemon/managed-main.js

@@ -0,0 +1,29 @@
+// Minimal trusted launcher: verify bytes before importing the runtime closure.
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { verifyRuntimeArtifact } from '../shared/runtime-artifact.js';
+const mode = process.argv[2];
+if (mode !== 'owner' && mode !== 'backend')
+    throw new Error('Expected an owner or backend OS service entry');
+const home = path.resolve(process.env['OMNITRON_HOME'] ?? path.join(os.homedir(), '.omnitron'));
+const file = path.join(home, 'runtime', 'supervision.json');
+const stat = await fs.lstat(file);
+if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024 * 1024 || (stat.mode & 0o077) !== 0 ||
+    (process.getuid && stat.uid !== process.getuid()))
+    throw new Error('Supervision configuration must be private and bounded');
+const config = JSON.parse(await fs.readFile(file, 'utf8'));
+const id = config[mode]?.artifact;
+if (!id || !/^[a-f0-9]{64}$/.test(id))
+    throw new Error('Invalid supervised runtime identity');
+const root = path.join(home, 'runtime', 'releases', id);
+const manifest = await verifyRuntimeArtifact(root, id);
+if (manifest.nodeVersion !== process.version || await fs.realpath(process.execPath) !== path.join(await fs.realpath(root), 'node')) {
+    throw new Error('The OS service must use the Node binary sealed with its pinned runtime');
+}
+// Configuration files can be TypeScript. Install the verified loader only
+// after integrity validation, never through an unverified --import preload.
+(await import('tsx/esm/api')).register();
+await import(pathToFileURL(path.join(root, 'packages/0/dist/daemon', mode === 'owner' ? 'managed-owner-entry.js' : 'backend-supervisor-entry.js')).href);
+//# sourceMappingURL=managed-main.js.map

package/dist/daemon/managed-main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-main.js","sourceRoot":"","sources":["../../src/daemon/managed-main.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7B,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS;IAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;AAC7G,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;AAChG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAC5D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAClC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;IAC/F,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;IAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;AAChI,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAuE,CAAC;AACjI,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;AAClC,IAAI,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;IAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AAC9F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AACxD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvD,IAAI,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;IACnI,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;AAC5F,CAAC;AACD,0EAA0E;AAC1E,4EAA4E;AAC5E,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACzC,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,wBAAwB,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC"}

package/dist/daemon/managed-owner-build.d.ts

@@ -0,0 +1,17 @@
+import { type BuildStamp } from '../shared/build-stamp.js';
+/** On explicit legacy release admission, prove what the physical owner actually launched. */
+export declare function attestManagedOwnerRuntime(instanceHome: string, expected: {
+    id: string;
+    pid: number;
+    startedAt?: string;
+}): Promise<{
+    build: BuildStamp;
+    packageRoot: string;
+}>;
+/** Existing admission callers keep the original build-only contract. */
+export declare function attestManagedOwnerBuild(instanceHome: string, expected: {
+    id: string;
+    pid: number;
+    startedAt?: string;
+}): Promise<BuildStamp>;
+//# sourceMappingURL=managed-owner-build.d.ts.map

package/dist/daemon/managed-owner-build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-owner-build.d.ts","sourceRoot":"","sources":["../../src/daemon/managed-owner-build.ts"],"names":[],"mappings":"AAKA,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AA+E3E,6FAA6F;AAC7F,wBAAsB,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAsBpL;AAED,wEAAwE;AACxE,wBAAsB,uBAAuB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAElJ"}

package/dist/daemon/managed-owner-build.js

@@ -0,0 +1,108 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { verifyRuntimeArtifact } from '../shared/runtime-artifact.js';
+import { readBuildStamp } from '../shared/build-stamp.js';
+import { readHostBootIdentity } from '../shared/host-boot-identity.js';
+import { readManagedRuntime } from './managed-runtime.js';
+import { parseDarwinJob, parseDarwinProcesses } from './darwin-owner-evidence.js';
+import { ExecutionJournal } from './execution-journal.js';
+const exec = promisify(execFile);
+async function native(file, args) {
+    const result = await exec(file, args, { encoding: 'utf8', timeout: 5000, maxBuffer: 1024 * 1024,
+        env: { ...process.env, LC_ALL: 'C', TZ: 'UTC' } });
+    return result.stdout.trimEnd();
+}
+function requireProof(condition, reason) {
+    if (!condition)
+        throw Error('Resident owner build could not be verified: ' + reason);
+}
+async function trustedFile(file) {
+    const stat = await fs.lstat(file);
+    requireProof(stat.isFile() && (stat.mode & 0o022) === 0 && stat.uid === process.getuid() && await fs.realpath(file) === file, 'unsafe or noncanonical service file');
+    return stat;
+}
+/** launchd's registered argv, the unit on disk, and the process's native executable must all agree. */
+async function darwin(config, pid, argv, boot) {
+    const target = (config.scope === 'system' ? 'system' : 'gui/' + process.getuid()) + '/' + config.owner.label;
+    const job = await native('/bin/launchctl', ['print', target]);
+    const state = parseDarwinJob(job, target);
+    const file = job.match(/^\s*path = (.+)$/m)?.[1];
+    const loaded = job.match(/^[\t ]*arguments = \{\n([\s\S]*?)\n[\t ]*\}/m)?.[1]?.split('\n').map(s => s.trim());
+    requireProof(state.state === 'active' && state.mainPid === pid && file && path.isAbsolute(file) &&
+        job.match(/^\s*program = (.+)$/m)?.[1] === argv[0] && JSON.stringify(loaded) === JSON.stringify(argv), 'launchd binding differs');
+    const stat = await trustedFile(file);
+    requireProof(stat.size <= 128 * 1024, 'unexpected plist size');
+    const plist = JSON.parse(await native('/usr/bin/plutil', ['-convert', 'json', '-o', '-', '--', file]));
+    requireProof(plist.Label === config.owner.label && (!plist.Program || plist.Program === argv[0]) &&
+        JSON.stringify(plist.ProgramArguments) === JSON.stringify(argv), 'owner plist differs');
+    const [identity, args, opened] = await Promise.all([
+        native('/bin/ps', ['-ww', '-p', String(pid), '-o', 'pid=,ppid=,pgid=,uid=,lstart=,comm=']),
+        native('/bin/ps', ['-ww', '-p', String(pid), '-o', 'args=']),
+        native('/usr/sbin/lsof', ['-nP', '-a', '-p', String(pid), '-d', 'txt', '-F0fin']),
+    ]);
+    const row = parseDarwinProcesses(identity, boot)[0];
+    requireProof(row && row.pid === pid && row.ppid === 1 && row.uid === process.getuid() && row.executable === argv[0] &&
+        args.trim() === argv.join(' '), 'native macOS process differs');
+    const inode = (await fs.stat(argv[0], { bigint: true })).ino;
+    const texts = opened.split('\n').map(line => line.split('\0'));
+    requireProof(texts.some(fields => fields.includes('ftxt') && fields.includes('i' + inode) && fields.includes('n' + argv[0])), 'the executable mapped by the process differs from the sealed file');
+    const born = Date.parse(row.lifetime.slice((boot + ':utc:').length) + ' UTC');
+    requireProof(Number.isFinite(born), 'unknown macOS process birth');
+    return { token: row.lifetime, born, file, unitInode: stat.ino, unitCtime: stat.ctimeMs };
+}
+async function linux(config, pid, argv, boot) {
+    const { unit } = config.owner;
+    const details = await native('systemctl', [...(config.scope === 'user' ? ['--user'] : []), 'show', unit, '--all',
+        '--property=Id,MainPID,FragmentPath,ControlGroup,LoadState,ActiveState,NeedDaemonReload,DropInPaths,ExecStart']);
+    const values = Object.fromEntries(details.split('\n').map(line => { const i = line.indexOf('='); return [line.slice(0, i), line.slice(i + 1)]; }));
+    const group = values['ControlGroup'], file = values['FragmentPath'];
+    requireProof(values['Id'] === unit && values['MainPID'] === String(pid) && values['LoadState'] === 'loaded' &&
+        values['ActiveState'] === 'active' && values['NeedDaemonReload'] === 'no' && values['DropInPaths'] === '' && group &&
+        path.basename(group) === unit && file && path.isAbsolute(file) && path.basename(file) === unit, 'systemd binding differs');
+    const stat = await trustedFile(file);
+    requireProof(stat.size <= 128 * 1024 && values['ExecStart']?.includes('path=' + argv[0] + ' ; argv[]=' + argv.join(' ') + ' ;'), 'systemd owner command differs');
+    const proc = '/proc/' + pid;
+    const [actual, binary, inode, owner, cmd, groups, fields, cpu, times] = await Promise.all([
+        fs.realpath(proc + '/exe'), fs.stat(proc + '/exe', { bigint: true }), fs.stat(argv[0], { bigint: true }), fs.stat(proc),
+        fs.readFile(proc + '/cmdline', 'utf8'), fs.readFile(proc + '/cgroup', 'utf8'), fs.readFile(proc + '/stat', 'utf8'),
+        native('getconf', ['CLK_TCK']), fs.readFile('/proc/stat', 'utf8'),
+    ]);
+    requireProof(actual === argv[0] && binary.dev === inode.dev && binary.ino === inode.ino && owner.uid === process.getuid() &&
+        cmd === argv.join('\0') + '\0' && groups.split('\n').some(line => line.slice(line.indexOf(':', line.indexOf(':') + 1) + 1) === group), 'native Linux process differs');
+    const ticks = fields.slice(fields.lastIndexOf(')') + 2).split(' ')[19];
+    const bootSeconds = times.match(/^btime (\d+)$/m)?.[1];
+    requireProof(ticks && /^\d+$/.test(ticks) && /^\d+$/.test(cpu) && Number(cpu) > 0 && bootSeconds, 'unknown Linux process birth');
+    return { token: boot + ':' + ticks, born: Number(bootSeconds) * 1000 + Number(ticks) * 1000 / Number(cpu),
+        file, unitInode: stat.ino, unitCtime: stat.ctimeMs };
+}
+/** On explicit legacy release admission, prove what the physical owner actually launched. */
+export async function attestManagedOwnerRuntime(instanceHome, expected) {
+    requireProof(expected.id && Number.isSafeInteger(expected.pid) && expected.pid > 0, 'invalid owner identity');
+    const observe = async () => {
+        const config = await readManagedRuntime(instanceHome);
+        requireProof(config && await fs.realpath(instanceHome) === instanceHome, 'no canonical managed instance');
+        const record = await new ExecutionJournal(path.join(config.directory, 'controller.json')).read();
+        requireProof(record?.owner.id === expected.id && record.owner.pid === expected.pid &&
+            (!expected.startedAt || record.owner.startedAt === expected.startedAt), 'private execution journal differs');
+        const root = path.join(instanceHome, 'runtime/releases', config.owner.artifact);
+        const argv = [path.join(root, 'node'), path.join(root, 'packages/0/dist/daemon/managed-entry.js'), 'owner'];
+        requireProof(await fs.realpath(root) === root && await fs.realpath(argv[1]) === argv[1], 'noncanonical owner runtime');
+        const boot = readHostBootIdentity();
+        requireProof(process.platform === 'darwin' || process.platform === 'linux', 'unsupported native service manager');
+        const processIdentity = await (process.platform === 'darwin' ? darwin : linux)(config, expected.pid, argv, boot);
+        return { root, digest: config.owner.artifact, startedAt: record.owner.startedAt, ...processIdentity };
+    };
+    const before = await observe();
+    await verifyRuntimeArtifact(before.root, before.digest, before.born);
+    const stamp = readBuildStamp(path.join(before.root, 'packages/0/dist'));
+    requireProof(stamp && /^[a-f0-9]{40}$/.test(stamp.commit) && stamp.dirty === false, 'missing exact clean owner build');
+    requireProof(JSON.stringify(await observe()) === JSON.stringify(before), 'owner or service binding changed during verification');
+    return { build: stamp, packageRoot: path.join(before.root, 'packages/0') };
+}
+/** Existing admission callers keep the original build-only contract. */
+export async function attestManagedOwnerBuild(instanceHome, expected) {
+    return (await attestManagedOwnerRuntime(instanceHome, expected)).build;
+}
+//# sourceMappingURL=managed-owner-build.js.map