@pnpm/exe 12.8.2 → 12.9.0

package/dist/wasm/host/filesystem.mjs

@@ -0,0 +1,318 @@
+import fs from 'node:fs'
+import { Buffer } from 'node:buffer'
+import path from 'node:path'
+import process from 'node:process'
+import { TextDecoder } from 'node:util'
+
+import { WASI } from '@tybys/wasm-util'
+
+import { createFileLocks } from './file-locks.mjs'
+import { hasExecutableMode } from './executable-mode.mjs'
+import { createPoll } from './poll.mjs'
+import { errno } from './wasi-errno.mjs'
+
+const readRights = 2n | 4n | 16n | 32n | 2097152n
+const writeRights = readRights | 1n | 64n | 4194304n
+// Node does not expose Linux O_PATH through fs.constants.
+const linuxOPath = 0o10000000
+
+export function createWasiFilesystem (options, memory) {
+  const locks = createFileLocks()
+  const leases = createDescriptorLeases(locks)
+  const sqliteFiles = new Map()
+  const randomDevices = new Set()
+  const descriptors = new Map([[0, 0], [1, 1], [2, 2]])
+  const rootDescriptor = Object.keys(options.preopens ?? {}).indexOf('/') + 3
+  const state = { leases, sqliteFiles, randomDevices, descriptors, constructing: true, nextPreopen: 3 }
+  const wasi = new WASI({ ...options, fs: createFilesystemAdapter(state) })
+  const polling = createPoll(memory)
+  wasi.wasiImport.poll_oneoff = polling.poll
+  state.constructing = false
+  const open = trackPathOpens(wasi, state, memory)
+  trackAbsoluteSymlinks(wasi, state, { options, memory })
+  trackDescriptorChanges(wasi, descriptors)
+  function resolveDescriptor (descriptor) {
+    const native = descriptors.get(descriptor)
+    if (native == null) throw Object.assign(new Error('Unknown WASI file descriptor'), { code: 'EBADF' })
+    return native
+  }
+  const imports = createFilesystemImports({ memory, resolveDescriptor, open, rootDescriptor, options, locks, sqliteFiles })
+  return { wasi, imports, resolveDescriptor, cancelPending: polling.close, acquireDescriptor (descriptor) {
+    return leases.acquire(resolveDescriptor(descriptor))
+  }, close () {
+    polling.close()
+    for (const descriptor of descriptors.keys()) {
+      if (descriptor > 2) wasi.wasiImport.fd_close(descriptor)
+    }
+  } }
+}
+
+function trackPathOpens (wasi, state, memory) {
+  const originalOpen = wasi.wasiImport.path_open
+  function open (args, mode) {
+    state.opening = { mode, follow: (args[1] & 1) !== 0 }
+    try {
+      new DataView(memory.buffer).getUint32(args[8] >>> 0, true)
+      const result = originalOpen(...args)
+      if (result === 0) {
+        const descriptor = new DataView(memory.buffer).getUint32(args[8], true)
+        state.descriptors.set(descriptor, state.opening.descriptor)
+      }
+      return result
+    } catch (error) {
+      return errorNumber(error)
+    } finally {
+      state.opening = undefined
+    }
+  }
+  wasi.wasiImport.path_open = (...args) => open(args)
+  return open
+}
+
+function trackAbsoluteSymlinks (wasi, state, { options, memory }) {
+  const symlink = wasi.wasiImport.path_symlink
+  wasi.wasiImport.path_symlink = (target, length, descriptor, link, linkLength) => {
+    if (options.preopens?.['/'] !== '/' || new Uint8Array(memory.buffer)[target >>> 0] !== 47) {
+      return symlink(target, length, descriptor, link, linkLength)
+    }
+    try {
+      state.symlinkTarget = new TextDecoder('utf-8', { fatal: true }).decode(Uint8Array.from(new Uint8Array(memory.buffer, target >>> 0, length >>> 0)))
+      return symlink(target + 1, length - 1, descriptor, link, linkLength)
+    } catch (error) {
+      return errorNumber(error)
+    } finally {
+      state.symlinkTarget = undefined
+    }
+  }
+}
+
+function createFilesystemAdapter (state) {
+  const { leases, sqliteFiles, randomDevices, descriptors } = state
+  return {
+    ...fs,
+    closeSync (descriptor) {
+      randomDevices.delete(descriptor)
+      leases.close(descriptor)
+    },
+    readSync (descriptor, buffer, offset, length, position) {
+      if (!randomDevices.has(descriptor)) return fs.readSync(descriptor, buffer, offset, length, position)
+      // WebContainer random devices use WebCrypto, which rejects shared views.
+      const temporary = Buffer.alloc(Math.min(length, 65536))
+      const count = fs.readSync(descriptor, temporary, 0, temporary.length, position)
+      buffer.set(temporary.subarray(0, count), offset)
+      return count
+    },
+    openSync (file, flags, mode) {
+      if (state.opening && !state.opening.follow) flags |= fs.constants.O_NOFOLLOW
+      const database = sqliteFiles.get(file)
+      const sqliteMode = database ? fs.statSync(database).mode & 0o777 : undefined
+      const descriptor = fs.openSync(file, flags, state.opening?.mode ?? sqliteMode ?? mode)
+      if (file === '/dev/urandom' || file === '/dev/random') randomDevices.add(descriptor)
+      if (state.constructing) descriptors.set(state.nextPreopen++, descriptor)
+      else if (state.opening) state.opening.descriptor = descriptor
+      return descriptor
+    },
+    symlinkSync (target, file, ...args) {
+      fs.symlinkSync(state.symlinkTarget ?? target, file, ...args)
+    },
+    readlinkSync (file, ...args) {
+      const target = fs.readlinkSync(file, ...args)
+      return state.opening?.follow ? path.resolve(path.dirname(file), target) : target
+    },
+  }
+}
+
+function createDescriptorLeases (locks) {
+  const active = new Map()
+  function close (descriptor) {
+    const state = active.get(descriptor)
+    if (state) {
+      state.closed = true
+      return
+    }
+    fs.closeSync(descriptor)
+    locks.release(descriptor)
+  }
+  return { close, acquire (descriptor) {
+    let state = active.get(descriptor)
+    if (!state) {
+      state = { count: 0, closed: false }
+      active.set(descriptor, state)
+    }
+    state.count++
+    let released = false
+    return { fd: descriptor, release () {
+      if (released) return
+      released = true
+      if (--state.count !== 0) return
+      active.delete(descriptor)
+      if (state.closed) close(descriptor)
+    } }
+  } }
+}
+
+function trackDescriptorChanges (wasi, descriptors) {
+  const close = wasi.wasiImport.fd_close
+  wasi.wasiImport.fd_close = descriptor => {
+    if (!descriptors.has(descriptor)) return errno.EBADF
+    const result = close(descriptor)
+    if (result === 0) {
+      descriptors.delete(descriptor)
+    }
+    return result
+  }
+  const renumber = wasi.wasiImport.fd_renumber
+  wasi.wasiImport.fd_renumber = (source, destination) => {
+    if (!descriptors.has(source) || !descriptors.has(destination)) return errno.EBADF
+    const result = renumber(source, destination)
+    if (result === 0 && source !== destination) {
+      descriptors.set(destination, descriptors.get(source))
+      descriptors.delete(source)
+    }
+    return result
+  }
+}
+
+function createFilesystemImports ({ memory, resolveDescriptor, open, rootDescriptor, options, locks, sqliteFiles }) {
+  function guestPath (pointer, length) {
+    const value = new TextDecoder('utf-8', { fatal: true }).decode(Uint8Array.from(new Uint8Array(memory.buffer, pointer >>> 0, length >>> 0)))
+    if (!value.startsWith('/') || value.includes('\0')) throw Object.assign(new Error('Expected an absolute guest path'), { code: 'EINVAL' })
+    const root = options.preopens?.['/']
+    if (root !== '/') throw Object.assign(new Error('Filesystem extensions require the host root preopen'), { code: 'EACCES' })
+    return path.resolve(root, `.${value}`)
+  }
+  function descendantComponents (directory, template) {
+    const suffix = path.relative(template, directory)
+    if (!suffix || suffix === '..' || suffix.startsWith(`..${path.sep}`) || path.isAbsolute(suffix)) {
+      throw Object.assign(new Error('Permission target is not below its template'), { code: 'EINVAL' })
+    }
+    return suffix.split(path.sep)
+  }
+  return {
+    ...createOpenImports({ options, rootDescriptor, open }),
+    open_directory_nofollow_beneath (pointer, length, templatePointer, templateLength, output) {
+      try {
+        const directory = guestPath(pointer, length)
+        const template = guestPath(templatePointer, templateLength)
+        let current = template
+        for (const component of descendantComponents(directory, template)) {
+          current = path.join(current, component)
+          const metadata = fs.lstatSync(current)
+          if (metadata.isSymbolicLink()) return errno.ELOOP
+          if (!metadata.isDirectory()) return errno.ENOTDIR
+        }
+        return open([rootDescriptor, 0, pointer, length, 0, readRights, 0n, 4, output])
+      } catch (error) {
+        return errorNumber(error)
+      }
+    },
+    grant_directory_mode_beneath (pointer, length, templatePointer, templateLength, extra) {
+      if ('webcontainer' in process.versions) return errno.ENOTSUP
+      if (process.platform !== 'linux' || !fs.existsSync('/proc/self/fd')) return errno.ENOTSUP
+      if (extra < 0 || extra > 0o7777) return errno.EINVAL
+      try {
+        const directory = guestPath(pointer, length)
+        const template = guestPath(templatePointer, templateLength)
+        const components = descendantComponents(directory, template)
+        let descriptor = fs.openSync(template, linuxOPath | fs.constants.O_DIRECTORY)
+        try {
+          for (const component of components) {
+            const child = fs.openSync(`/proc/self/fd/${descriptor}/${component}`, linuxOPath | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW)
+            fs.closeSync(descriptor)
+            descriptor = child
+          }
+          const metadata = fs.fstatSync(descriptor)
+          if (metadata.uid !== process.getuid()) return errno.EACCES
+          const current = metadata.mode & 0o7777
+          if ((current | extra) !== current) fs.chmodSync(`/proc/self/fd/${descriptor}`, current | extra)
+          return 0
+        } finally {
+          fs.closeSync(descriptor)
+        }
+      } catch (error) {
+        return errorNumber(error)
+      }
+    },
+    try_lock (descriptor, exclusive) {
+      try { return locks.tryLock(resolveDescriptor(descriptor), exclusive !== 0) } catch (error) { return errorNumber(error) }
+    },
+    sqlite_register: checked((pointer, length, registered) => {
+      const database = guestPath(pointer, length)
+      for (const suffix of ['-journal', '-wal', '-shm']) {
+        const file = database + suffix
+        if (registered) sqliteFiles.set(file, database)
+        else sqliteFiles.delete(file)
+      }
+    }),
+    path_access_executable: checked((pointer, length) => executableAccess(guestPath(pointer, length))),
+    check_owner: checked(descriptor => {
+      if (fs.fstatSync(resolveDescriptor(descriptor)).uid !== process.getuid()) {
+        throw Object.assign(new Error('WASM SQLite stores must belong to the current user'), { code: 'EACCES' })
+      }
+    }),
+    fchmod: checked((descriptor, mode) => fs.fchmodSync(resolveDescriptor(descriptor), mode)),
+    fmode: checked((descriptor, output) => {
+      new DataView(memory.buffer).setUint32(output >>> 0, fs.fstatSync(resolveDescriptor(descriptor)).mode, true)
+    }),
+    lmode: checked((pointer, length, output) => {
+      new DataView(memory.buffer).setUint32(output >>> 0, fs.lstatSync(guestPath(pointer, length)).mode, true)
+    }),
+    umask () { return process.umask() },
+    uid () { return process.getuid() },
+    secure_directory: checked((pointer, length) => secureDirectory(guestPath(pointer, length))),
+  }
+}
+
+function executableAccess (file) {
+  fs.accessSync(file, fs.constants.X_OK)
+  // WebContainer accessSync ignores X_OK, although stat exposes permission bits.
+  if (!hasExecutableMode(fs.statSync(file))) {
+    throw Object.assign(new Error(`File is not executable: ${file}`), { code: 'EACCES' })
+  }
+}
+
+function secureDirectory (directory) {
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 })
+  const descriptor = fs.openSync(directory, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW)
+  try {
+    const metadata = fs.fstatSync(descriptor)
+    if (metadata.uid !== process.getuid()) throw Object.assign(new Error('Lock directory has a different owner'), { code: 'EACCES' })
+    fs.fchmodSync(descriptor, 0o700)
+  } finally {
+    fs.closeSync(descriptor)
+  }
+}
+
+function createOpenImports ({ options, rootDescriptor, open }) {
+  return {
+    create_new (pointer, length, mode, output) {
+      if (mode < 0 || mode > 0o7777) return errno.EINVAL
+      if (options.preopens?.['/'] !== '/') return errno.EACCES
+      return open([rootDescriptor, 0, pointer, length, 1 | 4, writeRights, 0n, 0, output], mode)
+    },
+    open_nofollow (pointer, length, output) {
+      if (options.preopens?.['/'] !== '/') return errno.EACCES
+      return open([rootDescriptor, 0, pointer, length, 0, readRights, 0n, 4, output])
+    },
+    open_lock (pointer, length, output) {
+      if (options.preopens?.['/'] !== '/') return errno.EACCES
+      return open([rootDescriptor, 0, pointer, length, 0, writeRights, 0n, 4, output])
+    },
+  }
+}
+
+function checked (operation) {
+  return (...args) => {
+    try {
+      operation(...args)
+      return 0
+    } catch (error) {
+      return errorNumber(error)
+    }
+  }
+}
+
+function errorNumber (error) {
+  if (error instanceof RangeError) return errno.EFAULT
+  return errno[error.code] ?? errno.EIO
+}

package/dist/wasm/host/guest-imports.mjs

@@ -0,0 +1,45 @@
+import { RESPONSE_CAPACITY } from './protocol.mjs'
+import { waitForReply } from './wait-for-reply.mjs'
+
+export function createGuestImports (memory, postMessage, checkCancelled) {
+  const buffer = new SharedArrayBuffer(RESPONSE_CAPACITY + 12)
+  const header = new Int32Array(buffer, 0, 3)
+
+  function call (method, args) {
+    Atomics.store(header, 0, 0)
+    postMessage({ pnpmHostRpc: { method, args, buffer } })
+    waitForReply(header, 0, checkCancelled)
+    return Atomics.load(header, 1)
+  }
+
+  function view (pointer, length) {
+    return new Uint8Array(memory.buffer, pointer >>> 0, length >>> 0)
+  }
+
+  return {
+    operation_start (pointer, length) {
+      if ((length >>> 0) > RESPONSE_CAPACITY) return -2
+      const bytes = Uint8Array.from(view(pointer, length))
+      const request = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes))
+      return call('start', [request])
+    },
+    response_len (id) {
+      return call('length', [id])
+    },
+    response_read (id, pointer, length) {
+      const target = view(pointer, length)
+      const result = call('read', [id, target.length])
+      if (result >= 0) target.set(new Uint8Array(buffer, 12, Atomics.load(header, 2)))
+      return result
+    },
+    operation_cancel (id) {
+      call('cancel', [id])
+    },
+    resource_close (handle) {
+      return call('close-resource', [handle])
+    },
+    wait_completion () {
+      return call('wait', [])
+    },
+  }
+}

package/dist/wasm/host/guest-operations.mjs

@@ -0,0 +1,148 @@
+import { createHostServices } from './operations.mjs'
+import { RESPONSE_CAPACITY } from './protocol.mjs'
+
+export function createGuestOperations (services = createHostServices()) {
+  const pending = new Map()
+  const completed = []
+  const waiters = []
+  const inFlight = new Set()
+  const cleanupErrors = []
+  let nextId = 1
+  let closed = false
+
+  function start (request) {
+    if (closed || nextId > 0x7fffffff) return -2
+    const id = nextId++
+    const entry = { controller: new AbortController(), response: null, operation: request.operation, result: null }
+    pending.set(id, entry)
+    if (request.operation === 'process.write') request.bytes = Uint8Array.from(request.bytes)
+    if (request.operation === 'network.request' && Array.isArray(request.body)) request.body = Uint8Array.from(request.body)
+    const task = Promise.resolve().then(() => services.dispatch(request, { signal: entry.controller.signal })).then(
+      value => settle(id, entry, { ok: true, value }),
+      error => settle(id, entry, { ok: false, error: { message: error.message, code: errorCode(error) } }),
+    )
+    track(task)
+    return id
+  }
+
+  function track (task) {
+    inFlight.add(task)
+    task.then(() => inFlight.delete(task), error => {
+      inFlight.delete(task)
+      cleanupErrors.push(error)
+    })
+  }
+
+  async function releaseResult (operation, result) {
+    if (!result?.ok) return
+    const handles = ['network.request', 'upload.create', 'terminal.open'].includes(operation) ? [result.value.handle]
+      : ['process.spawn', 'shell.spawn'].includes(operation) ? [result.value.stdout, result.value.stderr, result.value.handle] : []
+    await Promise.all(handles.filter(handle => handle != null)
+      .map(handle => services.dispatch({ operation: 'resource.close', handle })))
+  }
+
+  async function settle (id, entry, result) {
+    if (!pending.has(id)) return closed ? undefined : releaseResult(entry.operation, result)
+    let bytes
+    try {
+      bytes = new TextEncoder().encode(JSON.stringify(result, (_key, value) => value instanceof Uint8Array ? [...value] : value))
+      if (bytes.length > RESPONSE_CAPACITY) throw new Error('WASM host response exceeds the transfer limit')
+    } catch (error) {
+      try {
+        await releaseResult(entry.operation, result)
+      } catch (cleanupError) {
+        cleanupErrors.push(cleanupError)
+      }
+      result = { ok: false, error: { message: error.message } }
+      bytes = new TextEncoder().encode(JSON.stringify(result))
+    }
+    if (!pending.has(id)) return
+    entry.result = result
+    entry.response = bytes
+    const waiter = waiters.shift()
+    if (waiter) waiter(id)
+    else completed.push(id)
+  }
+
+  async function dispatch (method, args) {
+    switch (method) {
+    case 'start': return start(args[0])
+    case 'length': return pending.get(args[0])?.response?.length ?? (pending.has(args[0]) ? -1 : -2)
+    case 'read': {
+      const entry = pending.get(args[0])
+      if (!entry?.response || entry.response.length > args[1]) return -2
+      pending.delete(args[0])
+      return entry.response
+    }
+    case 'cancel': {
+      const entry = pending.get(args[0])
+      pending.delete(args[0])
+      entry?.controller.abort()
+      if (entry?.result) await releaseResult(entry.operation, entry.result)
+      return 0
+    }
+    case 'close-resource': {
+      await services.dispatch({ operation: 'resource.close', handle: args[0] })
+      return 0
+    }
+    case 'wait': {
+      while (completed.length > 0) {
+        const id = completed.shift()
+        if (pending.has(id)) return id
+      }
+      return closed ? 0 : new Promise(resolve => waiters.push(resolve))
+    }
+    default: throw new Error(`Unknown guest operation: ${method}`)
+    }
+  }
+
+  return {
+    dispatch,
+    attach (worker) {
+      const listener = message => {
+        if (!message.pnpmHostRpc) return
+        const { method, args, buffer } = message.pnpmHostRpc
+        respond(buffer, dispatch(method, args)).catch(error => worker.emit('error', error))
+      }
+      worker.on('message', listener)
+      return () => worker.off('message', listener)
+    },
+    async close () {
+      closed = true
+      for (const entry of pending.values()) entry.controller.abort()
+      pending.clear()
+      for (const waiter of waiters.splice(0)) waiter(0)
+      try {
+        await services.close()
+      } finally {
+        await Promise.allSettled([...inFlight])
+      }
+      if (cleanupErrors.length) throw new AggregateError(cleanupErrors, 'Failed to clean up cancelled WASM operations')
+    },
+  }
+}
+
+async function respond (buffer, response) {
+  const header = new Int32Array(buffer, 0, 3)
+  Atomics.store(header, 1, -2)
+  Atomics.store(header, 2, 0)
+  try {
+    const value = await response
+    if (value instanceof Uint8Array) {
+      new Uint8Array(buffer, 12).set(value)
+      Atomics.store(header, 1, value.length)
+      Atomics.store(header, 2, value.length)
+    } else {
+      Atomics.store(header, 1, value)
+      Atomics.store(header, 2, 0)
+    }
+  } finally {
+    Atomics.store(header, 0, 1)
+    Atomics.notify(header, 0)
+  }
+}
+
+function errorCode (error) {
+  const code = error.code ?? error.cause?.code
+  return typeof code === 'string' ? code : undefined
+}

package/dist/wasm/host/lock-registry.mjs

@@ -0,0 +1,167 @@
+import { randomUUID } from 'node:crypto'
+import fs from 'node:fs'
+import { createConnection, createServer } from 'node:net'
+import os from 'node:os'
+import path from 'node:path'
+import process from 'node:process'
+
+const mutexPort = 29753
+const tokens = new Set()
+let listener
+let acquiring = 0
+
+// The rendezvous port protects only registry updates. Held file locks use
+// ephemeral ports, so unrelated nested locks cannot collide or reverse order.
+export async function acquireFileLease (identity, exclusive, previous) {
+  acquiring++
+  try {
+    return await acquireRegisteredLease(identity, exclusive, previous)
+  } finally {
+    acquiring--
+    closeIdleListener()
+  }
+}
+
+async function acquireRegisteredLease (identity, exclusive, previous) {
+  const mutex = await listen(createServer(socket => socket.destroy()), mutexPort)
+  if (!mutex) return undefined
+  let token
+  try {
+    const file = registryPath(identity)
+    const owners = await liveOwners(file)
+    if (owners.some(owner => owner.token !== previous?.token && (exclusive || owner.exclusive))) return undefined
+    const server = await leaseListener()
+    token = previous?.token ?? randomUUID()
+    tokens.add(token)
+    const owner = { port: server.address().port, token, exclusive, pid: process.pid }
+    writeOwners(file, [...owners.filter(entry => entry.token !== token), owner])
+    return { token, exclusive, release () { tokens.delete(token); closeIdleListener() } }
+  } catch (error) {
+    if (token && token !== previous?.token) tokens.delete(token)
+    throw error
+  } finally {
+    await new Promise(resolve => mutex.close(resolve))
+  }
+}
+
+function registryPath (identity) {
+  const directory = path.join(os.tmpdir(), `pnpm-wasm-file-locks-${process.getuid()}`)
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 })
+  const descriptor = fs.openSync(directory, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW)
+  try {
+    if (fs.fstatSync(descriptor).uid !== process.getuid()) throw new Error('WASM lock registry belongs to another user')
+    fs.fchmodSync(descriptor, 0o700)
+  } finally {
+    fs.closeSync(descriptor)
+  }
+  return path.join(directory, identity.replace(':', '-'))
+}
+
+async function liveOwners (file) {
+  let descriptor
+  try {
+    descriptor = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK)
+  } catch (error) {
+    if (error.code === 'ENOENT') return []
+    throw error
+  }
+  let owners
+  try {
+    const metadata = fs.fstatSync(descriptor)
+    if (!metadata.isFile() || metadata.size > 1024 * 1024) throw new Error('Invalid WASM lock ownership record')
+    owners = JSON.parse(fs.readFileSync(descriptor, 'utf8'))
+  } finally {
+    fs.closeSync(descriptor)
+  }
+  if (!Array.isArray(owners) || owners.length > 4096 || !owners.every(validOwner)) throw new Error('Invalid WASM lock ownership record')
+  const live = await Promise.all(owners.map(async owner => await isAlive(owner) ? owner : undefined))
+  return live.filter(Boolean)
+}
+
+function validOwner (owner) {
+  return Number.isInteger(owner?.port) && owner.port > 0 && owner.port < 65536 &&
+    typeof owner.token === 'string' && /^[\da-f-]{36}$/.test(owner.token) && typeof owner.exclusive === 'boolean' &&
+    (owner.pid == null || (Number.isSafeInteger(owner.pid) && owner.pid > 0))
+}
+
+function writeOwners (file, owners) {
+  const temporary = `${file}.${randomUUID()}`
+  try {
+    fs.writeFileSync(temporary, JSON.stringify(owners), { flag: 'wx', mode: 0o600 })
+    fs.renameSync(temporary, file)
+  } catch (error) {
+    try { fs.unlinkSync(temporary) } catch (cleanup) { if (cleanup.code !== 'ENOENT') throw cleanup }
+    throw error
+  }
+}
+
+async function leaseListener () {
+  listener ??= listen(createServer(socket => {
+    let request = ''
+    socket.setTimeout(1000, () => socket.destroy())
+    socket.on('error', () => { /* A probing process may exit before receiving the response. */ })
+    socket.on('data', chunk => {
+      request += chunk.toString()
+      if (request.length > 37) return socket.destroy()
+      if (request.endsWith('\n')) socket.end(tokens.has(request.trim()) ? 'alive\n' : 'released\n')
+    })
+  }), 0)
+  return listener
+}
+
+function listen (server, port) {
+  return new Promise((resolve, reject) => {
+    server.once('error', error => {
+      if (error.code === 'EADDRINUSE') resolve(undefined)
+      else reject(error)
+    })
+    server.listen({ host: '127.0.0.1', port, exclusive: true }, () => {
+      server.unref()
+      resolve(server)
+    })
+  })
+}
+
+function isAlive (owner) {
+  if (owner.pid != null && processIsAbsent(owner.pid)) return Promise.resolve(false)
+  return new Promise((resolve, reject) => {
+    const socket = createConnection({ host: '127.0.0.1', port: owner.port })
+    let response = ''
+    function finish (value) {
+      socket.destroy()
+      resolve(value)
+    }
+    // A slow live owner must never be reaped. Only refusal or an explicit
+    // different token proves that this ownership record is abandoned.
+    socket.setTimeout(1000, () => finish(true))
+    socket.on('connect', () => socket.write(`${owner.token}\n`))
+    socket.on('data', chunk => {
+      response += chunk.toString()
+      if (response.endsWith('\n') || response.length > 32) finish(response !== 'released\n')
+    })
+    socket.on('end', () => finish(response !== 'released\n'))
+    socket.on('error', error => {
+      socket.destroy()
+      if (error.code === 'ECONNREFUSED') resolve(false)
+      else if (error.code === 'ECONNRESET') resolve(true)
+      else reject(error)
+    })
+  })
+}
+
+function processIsAbsent (pid) {
+  try {
+    process.kill(pid, 0)
+  } catch (error) {
+    if (error.code === 'ESRCH') return true
+    if (!['EPERM', 'EINVAL', 'ENOSYS'].includes(error.code)) throw error
+  }
+  return false
+}
+
+function closeIdleListener () {
+  if (tokens.size || acquiring || !listener) return
+  const closing = listener
+  listener = undefined
+  void closing.then(server => server.close(), () => { /* The acquisition already reports a failed listener. */ })
+}