@openclaw/lobster 2026.9.4 → 2026.9.6

package/node_modules/@clawdbot/lobster/dist/src/state/store.js

@@ -1,17 +1,28 @@
+import { atomicWriteWasPublished, ensureDirectory, isAtomicExclusiveUnsupportedError, writeFileAtomic, writeFileAtomicExclusive, } from "./atomic_file.js";
+export { atomicWriteWasPublished, ensureDirectory, isAtomicExclusiveUnsupportedError, writeFileAtomic, writeFileAtomicExclusive, stripExtendedLengthPrefix, } from "./atomic_file.js";
 import os from "node:os";
 import path from "node:path";
 import { promises as fsp } from "node:fs";
 import { randomBytes } from "node:crypto";
+const CONSUMED_RESUME_STATE_TYPE = "lobster.consumed-resume-state.v1";
+export function isConsumedResumeState(value) {
+    return (value !== null &&
+        typeof value === "object" &&
+        value.type === CONSUMED_RESUME_STATE_TYPE);
+}
 export function defaultStateDir(env) {
     return ((env?.LOBSTER_STATE_DIR && String(env.LOBSTER_STATE_DIR).trim()) ||
         path.join(os.homedir(), ".lobster", "state"));
 }
 export function keyToPath(stateDir, key) {
-    const safe = String(key)
+    let safe = String(key)
         .toLowerCase()
         .replace(/[^a-z0-9._-]+/g, "_")
-        .replace(/_+/g, "_")
-        .replace(/^_+|_+$/g, "");
+        .replace(/_+/g, "_");
+    if (safe.startsWith("_"))
+        safe = safe.slice(1);
+    if (safe.endsWith("_"))
+        safe = safe.slice(0, -1);
     if (!safe)
         throw new Error("state key is empty/invalid");
     return path.join(stateDir, `${safe}.json`);
@@ -26,162 +37,295 @@ export function stableStringify(value) {
         return v;
     });
 }
-function isDirectorySyncUnsupportedError(err) {
-    return [
-        "EACCES",
-        "EBADF",
-        "EINVAL",
-        "EISDIR",
-        "ENOSYS",
-        "ENOTSUP",
-        "EOPNOTSUPP",
-        "EPERM",
-    ].includes(err?.code);
-}
-async function syncParentDir(filePath) {
-    await syncDirectory(path.dirname(filePath));
-}
-async function syncDirectory(dir) {
-    let handle;
+const STATE_LOCK_RETRY_MS = 10;
+const STATE_LOCK_ORPHAN_MS = 30_000;
+const STATE_LOCK_HEARTBEAT_MS = 250;
+const TERMINAL_RESUME_CLEANUP_TIMEOUT_MS = STATE_LOCK_RETRY_MS * 10;
+export function isJsonSyntaxError(err) {
+    return err instanceof SyntaxError;
+}
+async function waitForStateLock(signal) {
+    await new Promise((resolve, reject) => {
+        const onAbort = () => {
+            clearTimeout(timer);
+            try {
+                signal?.throwIfAborted();
+            }
+            catch (err) {
+                reject(err);
+            }
+        };
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, STATE_LOCK_RETRY_MS);
+        if (signal?.aborted) {
+            onAbort();
+            return;
+        }
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+function isProcessAlive(pid) {
     try {
-        handle = await fsp.open(dir, "r");
+        process.kill(pid, 0);
+        return true;
     }
     catch (err) {
-        if (isDirectorySyncUnsupportedError(err))
-            return;
+        return err?.code !== "ESRCH";
+    }
+}
+function parseStateLockOwner(ownerText) {
+    const parts = ownerText.trim().split(":");
+    if (parts.length !== 3)
+        return null;
+    const pid = Number(parts[0]);
+    const processStartIdentity = parts[1] || null;
+    const nonce = parts[2];
+    if (!Number.isInteger(pid) || pid <= 0 || !nonce)
+        return null;
+    return { pid, processStartIdentity, nonce };
+}
+async function readProcessStartIdentity(pid) {
+    if (process.platform !== "linux")
+        return null;
+    try {
+        const stat = await fsp.readFile(`/proc/${pid}/stat`, "utf8");
+        const closeParen = stat.lastIndexOf(")");
+        if (closeParen < 0)
+            return null;
+        // The remainder starts at procfs field 3; starttime is field 22.
+        const fields = stat
+            .slice(closeParen + 1)
+            .trim()
+            .split(/\s+/);
+        return fields[19] || null;
+    }
+    catch {
+        return null;
+    }
+}
+async function isStateLockOld(lockPath) {
+    try {
+        const stat = await fsp.stat(lockPath);
+        return Date.now() - stat.mtimeMs >= STATE_LOCK_ORPHAN_MS;
+    }
+    catch (err) {
+        if (err?.code === "ENOENT")
+            return true;
         throw err;
     }
+}
+async function hasExpiredStateLockLease(lockPath) {
+    let first;
     try {
-        await handle.sync();
+        first = await fsp.stat(lockPath);
     }
     catch (err) {
-        if (!isDirectorySyncUnsupportedError(err))
-            throw err;
+        if (err?.code === "ENOENT")
+            return true;
+        throw err;
     }
-    finally {
-        if (handle)
-            await handle.close().catch(() => { });
+    if (Date.now() - first.mtimeMs < STATE_LOCK_ORPHAN_MS)
+        return false;
+    await new Promise((resolve) => setTimeout(resolve, STATE_LOCK_HEARTBEAT_MS));
+    try {
+        const second = await fsp.stat(lockPath);
+        return second.mtimeMs === first.mtimeMs && Date.now() - second.mtimeMs >= STATE_LOCK_ORPHAN_MS;
     }
-}
-async function syncCreatedDirectoryChain(firstCreated, finalDir) {
-    const final = path.resolve(finalDir);
-    let current = path.resolve(firstCreated);
-    await syncDirectory(path.dirname(current));
-    while (current !== final) {
-        await syncDirectory(current);
-        const relative = path.relative(current, final);
-        const next = relative.split(path.sep)[0];
-        if (!next || next === "..")
-            break;
-        current = path.join(current, next);
+    catch (err) {
+        if (err?.code === "ENOENT")
+            return true;
+        throw err;
     }
 }
-export async function ensureDirectory(dir) {
-    const created = await fsp.mkdir(dir, { recursive: true });
-    if (created)
-        await syncCreatedDirectoryChain(created, dir);
-}
-export function isJsonSyntaxError(err) {
-    return err instanceof SyntaxError;
-}
-function isLinkUnsupportedError(err) {
-    return ["ENOSYS", "ENOTSUP", "EOPNOTSUPP", "EPERM", "EXDEV"].includes(err?.code);
-}
-export function isAtomicExclusiveUnsupportedError(err) {
-    return err?.code === "ENOTSUP" && err?.cause && isLinkUnsupportedError(err.cause);
-}
-function isOptionalApprovalIndexPersistenceError(err) {
-    return (isAtomicExclusiveUnsupportedError(err) ||
-        ["EACCES", "EDQUOT", "EIO", "ENOSPC", "EPERM", "EROFS"].includes(err?.code));
-}
-/**
- * Write a file atomically: stage to a sibling temp file, fsync, then rename
- * over the target. `rename(2)` is atomic on a single filesystem, so a reader
- * (or a crash) never observes a truncated/partial file — it sees either the
- * complete old content or the complete new content. Plain `fsp.writeFile`
- * truncates the target up front, leaving a corruption window on SIGKILL/OOM/
- * power loss. New state files are private by default; existing file modes are
- * preserved across replacement. The temp file is removed on any failed path.
- */
-export async function writeFileAtomic(filePath, data, options = {}) {
-    const renameFile = options.renameFile ?? fsp.rename;
-    const syncDir = options.syncParentDir ?? syncParentDir;
-    const dir = path.dirname(filePath);
-    const tmpPath = path.join(dir, `.${path.basename(filePath)}.${randomBytes(6).toString("hex")}.tmp`);
-    let mode = 0o600;
-    let handle;
-    let cleanup = true;
+async function reclaimOrphanedStateLock(lockPath) {
+    let observedLock;
     try {
-        try {
-            mode = (await fsp.stat(filePath)).mode & 0o777;
+        const stat = await fsp.lstat(lockPath);
+        observedLock = { dev: stat.dev, ino: stat.ino };
+    }
+    catch (err) {
+        if (err?.code === "ENOENT")
+            return true;
+        throw err;
+    }
+    const ownerPath = path.join(lockPath, "owner");
+    let observedOwner;
+    let stale = false;
+    try {
+        observedOwner = await fsp.readFile(ownerPath, "utf8");
+        const owner = parseStateLockOwner(observedOwner);
+        if (owner && isProcessAlive(owner.pid)) {
+            const processStartIdentity = await readProcessStartIdentity(owner.pid);
+            if (owner.processStartIdentity && processStartIdentity) {
+                stale = owner.processStartIdentity !== processStartIdentity;
+            }
+            else {
+                // A live PID without a matching process-instance identity may have
+                // been reused. Require a conservative expired lease and a second
+                // unchanged observation before reclaiming it.
+                stale = await hasExpiredStateLockLease(ownerPath);
+            }
         }
-        catch (err) {
-            if (err?.code !== "ENOENT")
-                throw err;
+        else if (owner) {
+            stale = true;
+        }
+        else {
+            stale = await isStateLockOld(lockPath);
         }
-        handle = await fsp.open(tmpPath, "wx", mode);
-        await handle.writeFile(data, "utf8");
-        await handle.chmod(mode);
-        await handle.sync();
-        await handle.close();
-        handle = undefined;
-        await renameFile(tmpPath, filePath);
-        await syncDir(filePath);
-        cleanup = false;
     }
-    finally {
-        if (handle)
-            await handle.close().catch(() => { });
-        if (cleanup)
-            await fsp.rm(tmpPath, { force: true }).catch(() => { });
-    }
-}
-export async function writeFileAtomicExclusive(filePath, data, options = {}) {
-    const linkFile = options.linkFile ?? fsp.link;
-    const syncDir = options.syncParentDir ?? syncParentDir;
-    const dir = path.dirname(filePath);
-    const tmpPath = path.join(dir, `.${path.basename(filePath)}.${randomBytes(6).toString("hex")}.tmp`);
-    let handle;
+    catch (err) {
+        if (err?.code === "ENOENT") {
+            stale = await isStateLockOld(lockPath);
+        }
+        else {
+            throw err;
+        }
+    }
+    if (!stale)
+        return false;
+    // Claim reclamation inside the observed directory before removing it. Renaming
+    // `lockPath` directly is unsafe: another reclaimer can replace that pathname
+    // with a live lock after the stale observation, and a later recursive cleanup
+    // would then delete the new owner's lock while it is in use.
+    const reclaimPath = path.join(lockPath, ".reclaiming");
+    try {
+        await fsp.mkdir(reclaimPath, { mode: 0o700 });
+    }
+    catch (err) {
+        if (err?.code === "ENOENT")
+            return true;
+        if (err?.code === "EEXIST")
+            return false;
+        throw err;
+    }
     try {
-        handle = await fsp.open(tmpPath, "wx", 0o600);
-        await handle.writeFile(data, "utf8");
-        await handle.chmod(0o600);
-        await handle.sync();
-        await handle.close();
-        handle = undefined;
+        const currentLock = await fsp.lstat(lockPath);
+        if (currentLock.dev !== observedLock.dev || currentLock.ino !== observedLock.ino) {
+            return false;
+        }
+        // A replacement directory can reuse the inode; its owner must still match too.
+        let currentOwner;
         try {
-            await linkFile(tmpPath, filePath);
+            currentOwner = await fsp.readFile(ownerPath, "utf8");
         }
         catch (err) {
-            if (!isLinkUnsupportedError(err))
+            if (err?.code !== "ENOENT")
                 throw err;
-            const unsupported = new Error("Atomic exclusive file creation requires hard-link support on this filesystem");
-            unsupported.code = "ENOTSUP";
-            unsupported.cause = err;
-            throw unsupported;
         }
+        if (currentOwner !== observedOwner)
+            return false;
+        await fsp.rm(lockPath, { recursive: true, force: true });
+    }
+    finally {
+        // If the path changed before the reclamation marker was claimed, leave the
+        // replacement lock intact and only remove our harmless marker.
+        await fsp.rmdir(reclaimPath).catch(() => { });
+    }
+    return true;
+}
+async function stillOwnsStateLock(ownerPath, owner) {
+    for (let attempt = 0; attempt < 2; attempt++) {
         try {
-            await fsp.unlink(tmpPath);
-            await syncDir(filePath);
+            return (await fsp.readFile(ownerPath, "utf8")) === owner;
         }
         catch (err) {
-            await fsp.unlink(filePath).catch(() => { });
-            await syncDir(filePath).catch(() => { });
-            throw err;
+            if (err?.code === "ENOENT" || attempt === 1)
+                return false;
+            await new Promise((resolve) => setTimeout(resolve, STATE_LOCK_RETRY_MS));
         }
     }
+    return false;
+}
+async function withStateKeyLock({ env, key, signal, task, }) {
+    const stateDir = defaultStateDir(env);
+    return withFileLock({
+        filePath: keyToPath(stateDir, key),
+        signal,
+        task,
+    });
+}
+/**
+ * Serialize a transition for an arbitrary durable file. Readers that need a
+ * publish-or-rollback decision use the same lock as writers, rather than
+ * observing an atomic rename that cancellation may still need to undo.
+ */
+export async function withFileLock({ filePath, signal, task, }) {
+    await ensureDirectory(path.dirname(filePath));
+    const lockPath = `${filePath}.lock`;
+    let acquired = false;
+    let owner;
+    let ownerWritten = false;
+    let heartbeat;
+    try {
+        while (!acquired) {
+            signal?.throwIfAborted();
+            try {
+                await fsp.mkdir(lockPath, { mode: 0o700 });
+                acquired = true;
+                const processStartIdentity = await readProcessStartIdentity(process.pid);
+                owner = `${process.pid}:${processStartIdentity ?? ""}:${randomBytes(6).toString("hex")}\n`;
+                await fsp.writeFile(path.join(lockPath, "owner"), owner, {
+                    encoding: "utf8",
+                    mode: 0o600,
+                });
+                ownerWritten = true;
+                const ownerPath = path.join(lockPath, "owner");
+                heartbeat = setInterval(() => {
+                    void fsp.utimes(ownerPath, new Date(), new Date()).catch(() => { });
+                }, STATE_LOCK_HEARTBEAT_MS);
+                heartbeat.unref?.();
+            }
+            catch (err) {
+                if (acquired)
+                    throw err;
+                if (err?.code !== "EEXIST")
+                    throw err;
+                if (!(await reclaimOrphanedStateLock(lockPath))) {
+                    await waitForStateLock(signal);
+                }
+            }
+        }
+        return await task();
+    }
     finally {
-        if (handle)
-            await handle.close().catch(() => { });
-        await fsp.rm(tmpPath, { force: true }).catch(() => { });
+        if (heartbeat)
+            clearInterval(heartbeat);
+        if (acquired) {
+            const ownerPath = path.join(lockPath, "owner");
+            if (!ownerWritten || !owner || (await stillOwnsStateLock(ownerPath, owner))) {
+                // Detach an owned lock before best-effort cleanup. If a filesystem error
+                // prevents removing the detached directory, the canonical lock path is
+                // already free for a subsequent operation; leaving it in place would
+                // instead look like a live lock owned by this still-running process.
+                const cleanupPath = `${lockPath}.release-${process.pid}-${randomBytes(6).toString("hex")}`;
+                try {
+                    await fsp.rename(lockPath, cleanupPath);
+                    await fsp.rm(cleanupPath, { recursive: true, force: true }).catch(() => { });
+                }
+                catch (err) {
+                    if (err?.code !== "ENOENT") {
+                        await fsp.rm(lockPath, { recursive: true, force: true }).catch(() => { });
+                    }
+                }
+            }
+        }
     }
 }
-export async function readStateJson({ env, key }) {
+function isOptionalApprovalIndexPersistenceError(err) {
+    return (isAtomicExclusiveUnsupportedError(err) ||
+        ["EACCES", "EDQUOT", "EIO", "ENOSPC", "EPERM", "EROFS"].includes(err?.code));
+}
+export async function readStateJson({ env, key, signal = undefined, }) {
+    signal?.throwIfAborted();
     const stateDir = defaultStateDir(env);
     const filePath = keyToPath(stateDir, key);
     try {
         const text = await fsp.readFile(filePath, "utf8");
-        return JSON.parse(text);
+        const value = JSON.parse(text);
+        signal?.throwIfAborted();
+        return value;
     }
     catch (err) {
         if (err?.code === "ENOENT")
@@ -189,13 +333,187 @@ export async function readStateJson({ env, key }) {
         throw err;
     }
 }
-export async function writeStateJson({ env, key, value }) {
+/**
+ * Read a state record only after any in-progress publish-or-rollback transition
+ * for the same key has settled. Callers that compose state with another durable
+ * resource use this to avoid observing a value that cancellation may undo.
+ */
+export async function readStateJsonWithLock({ env, key, signal = undefined, }) {
+    try {
+        return await withStateKeyLock({ env, key, signal, task: () => readStateJson({ env, key }) });
+    }
+    catch (err) {
+        // A readable state directory can deliberately be mounted read-only. In that
+        // case no writer can begin a paired publish-or-rollback transition, so use
+        // the non-mutating JSON read instead of requiring creation of a lock path.
+        if (["EACCES", "EPERM", "EROFS"].includes(err?.code)) {
+            return readStateJson({ env, key, signal });
+        }
+        throw err;
+    }
+}
+async function writeStateJsonUnlocked({ env, key, value, signal = undefined, atomicWriteOptions = undefined, }) {
     const stateDir = defaultStateDir(env);
     const filePath = keyToPath(stateDir, key);
     await ensureDirectory(stateDir);
-    await writeFileAtomic(filePath, JSON.stringify(value, null, 2) + "\n");
+    return writeFileAtomic(filePath, JSON.stringify(value, null, 2) + "\n", {
+        ...atomicWriteOptions,
+        signal,
+    });
+}
+export async function writeStateJson({ env, key, value, signal = undefined, atomicWriteOptions = undefined, }) {
+    return withStateKeyLock({
+        env,
+        key,
+        signal,
+        task: () => writeStateJsonUnlocked({ env, key, value, signal, atomicWriteOptions }),
+    });
+}
+/**
+ * Retire a resume capability before its first unsafe execution boundary. The
+ * replacement is deliberately persistent: a failed later unlink must not make
+ * the original token replayable.
+ */
+export async function consumeResumeState({ env, key, expectedState, signal = undefined, }) {
+    return withStateKeyLock({
+        env,
+        key,
+        signal,
+        task: async () => {
+            const currentState = await readStateJson({ env, key });
+            // A resume snapshot is loaded before command/workflow setup. Re-check it
+            // while holding the state lock so two callers cannot both turn the same
+            // approval into an executable invocation.
+            if (stableStringify(currentState) !== stableStringify(expectedState)) {
+                return { consumed: false };
+            }
+            const claimId = randomBytes(16).toString("hex");
+            try {
+                const result = await writeStateJsonUnlocked({
+                    env,
+                    key,
+                    value: {
+                        type: CONSUMED_RESUME_STATE_TYPE,
+                        consumedAt: new Date().toISOString(),
+                        claimId,
+                    },
+                    signal,
+                });
+                return {
+                    consumed: true,
+                    claimId,
+                    signalAbortedAfterCommit: result?.signalAbortedAfterCommit === true,
+                };
+            }
+            catch (err) {
+                if (atomicWriteWasPublished(err)) {
+                    const latest = await readStateJson({ env, key });
+                    if (isConsumedResumeState(latest) && latest.claimId === claimId) {
+                        await writeStateJsonUnlocked({ env, key, value: expectedState });
+                    }
+                }
+                throw err;
+            }
+        },
+    });
+}
+/**
+ * Undo a just-published consumed marker only when it is still owned by the
+ * caller's pre-dispatch claim. This never overwrites a replacement state or a
+ * concurrent claimant's marker.
+ */
+export async function restoreConsumedResumeState({ env, key, expectedState, claimId, }) {
+    return withStateKeyLock({
+        env,
+        key,
+        task: async () => {
+            const currentState = await readStateJson({ env, key });
+            if (!isConsumedResumeState(currentState) || currentState.claimId !== claimId) {
+                return false;
+            }
+            await writeStateJsonUnlocked({ env, key, value: expectedState });
+            return true;
+        },
+    });
 }
-export async function deleteStateJson({ env, key }) {
+/**
+ * Retire an unconsumed capability at a safe terminal boundary. The snapshot is
+ * first replaced by a caller-owned marker under the state lock, so a
+ * cancellation can restore only the state this caller claimed. A stale resume
+ * that merely observed an earlier snapshot can never recreate a state another
+ * resume has already settled.
+ */
+export async function deleteResumeStateWithRollback({ env, key, expectedState, signal = undefined, }) {
+    return withStateKeyLock({
+        env,
+        key,
+        signal,
+        task: async () => {
+            signal?.throwIfAborted();
+            const currentState = await readStateJson({ env, key });
+            if (stableStringify(currentState) !== stableStringify(expectedState))
+                return false;
+            const claimId = randomBytes(16).toString("hex");
+            let claimPublished = false;
+            let claimMayBePublished = false;
+            let deleted = false;
+            try {
+                let result;
+                try {
+                    result = await writeStateJsonUnlocked({
+                        env,
+                        key,
+                        value: {
+                            type: CONSUMED_RESUME_STATE_TYPE,
+                            consumedAt: new Date().toISOString(),
+                            claimId,
+                        },
+                        signal,
+                    });
+                }
+                catch (err) {
+                    claimMayBePublished = atomicWriteWasPublished(err);
+                    throw err;
+                }
+                claimPublished = true;
+                if (result?.signalAbortedAfterCommit)
+                    signal?.throwIfAborted();
+                signal?.throwIfAborted();
+                await deleteStateJsonUnlocked({ env, key });
+                deleted = true;
+                signal?.throwIfAborted();
+                return true;
+            }
+            catch (err) {
+                if ((signal?.aborted && claimPublished) || claimMayBePublished) {
+                    const latest = await readStateJson({ env, key });
+                    if ((deleted && latest === null) ||
+                        (isConsumedResumeState(latest) && latest.claimId === claimId)) {
+                        await writeStateJsonUnlocked({ env, key, value: expectedState });
+                    }
+                }
+                throw err;
+            }
+        },
+    });
+}
+/**
+ * Check physical state presence without parsing it. Cancellation uses this to
+ * retain the authoritative workflow spelling even if the state file is corrupt.
+ */
+export async function stateJsonExists({ env, key, }) {
+    const filePath = keyToPath(defaultStateDir(env), key);
+    try {
+        await fsp.access(filePath);
+        return true;
+    }
+    catch (err) {
+        if (err?.code === "ENOENT")
+            return false;
+        throw err;
+    }
+}
+async function deleteStateJsonUnlocked({ env, key }) {
     const stateDir = defaultStateDir(env);
     const filePath = keyToPath(stateDir, key);
     try {
@@ -207,6 +525,62 @@ export async function deleteStateJson({ env, key }) {
         throw err;
     }
 }
+export async function deleteStateJson({ env, key, signal = undefined, }) {
+    return withStateKeyLock({
+        env,
+        key,
+        signal,
+        task: () => deleteStateJsonUnlocked({ env, key }),
+    });
+}
+/**
+ * After an effect has started, its consumed marker already prevents replay.
+ * Give terminal cleanup a small, bounded opportunity to remove that marker,
+ * but never let a live state writer turn cancellation into an unbounded wait.
+ */
+export async function deleteStateJsonWithBoundedResumeCleanup({ env, key, }) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), TERMINAL_RESUME_CLEANUP_TIMEOUT_MS);
+    try {
+        await deleteStateJson({ env, key, signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+/**
+ * Retire a resume capability only while it is still a live, unclaimed state.
+ * A consumed marker belongs to a resume that has already started its atomic
+ * predecessor-to-successor handoff, so cancellation must not delete it and
+ * report success while that successor remains executable.
+ */
+export async function deleteUnconsumedResumeState({ env, key, signal = undefined, }) {
+    return withStateKeyLock({
+        env,
+        key,
+        signal,
+        task: async () => {
+            let currentState;
+            try {
+                currentState = await readStateJson({ env, key });
+            }
+            catch (err) {
+                // A corrupt state is not resumable, so explicit cancellation may still
+                // remove it. This keeps the legacy workflow-alias recovery behavior.
+                if (!isJsonSyntaxError(err))
+                    throw err;
+                await deleteStateJsonUnlocked({ env, key });
+                return "deleted";
+            }
+            if (currentState === null)
+                return "missing";
+            if (isConsumedResumeState(currentState))
+                return "claimed";
+            await deleteStateJsonUnlocked({ env, key });
+            return "deleted";
+        },
+    });
+}
 function sanitizeApprovalId(approvalId) {
     return approvalId.replace(/[^a-f0-9]/g, "");
 }
@@ -324,14 +698,54 @@ export async function cleanupApprovalIndexByStateKey({ env, stateKey, }) {
         }
     }
 }
-export async function diffAndStore({ env, key, value }) {
-    const before = await readStateJson({ env, key }).catch((err) => {
-        if (isJsonSyntaxError(err))
-            return null;
-        throw err;
+export async function diffAndStore({ env, key, value, signal = undefined, atomicWriteOptions = undefined, afterStore = undefined, }) {
+    return withStateKeyLock({
+        env,
+        key,
+        signal,
+        task: async () => {
+            const filePath = keyToPath(defaultStateDir(env), key);
+            let beforeExists = true;
+            try {
+                await fsp.access(filePath);
+            }
+            catch (err) {
+                if (err?.code !== "ENOENT")
+                    throw err;
+                beforeExists = false;
+            }
+            const before = await readStateJson({ env, key }).catch((err) => {
+                if (isJsonSyntaxError(err))
+                    return null;
+                throw err;
+            });
+            const changed = stableStringify(before) !== stableStringify(value);
+            const snapshot = { before, after: value, changed };
+            let stored = false;
+            try {
+                signal?.throwIfAborted();
+                await writeStateJsonUnlocked({ env, key, value, signal, atomicWriteOptions });
+                stored = true;
+                signal?.throwIfAborted();
+                await afterStore?.(snapshot);
+            }
+            catch (err) {
+                // A caller can publish another resource while this state lock is held.
+                // If that coordinated publication fails, restore the state snapshot before
+                // releasing the lock so readers never reuse a cancelled result.
+                const stateWasPublished = stored || atomicWriteWasPublished(err);
+                if (stateWasPublished && (signal?.aborted || afterStore || atomicWriteWasPublished(err))) {
+                    if (!beforeExists) {
+                        await deleteStateJsonUnlocked({ env, key });
+                    }
+                    else {
+                        await writeStateJsonUnlocked({ env, key, value: before });
+                    }
+                }
+                throw err;
+            }
+            return snapshot;
+        },
     });
-    const changed = stableStringify(before) !== stableStringify(value);
-    await writeStateJson({ env, key, value });
-    return { before, after: value, changed };
 }
 //# sourceMappingURL=store.js.map