@runweave/server-linux-x64 0.1.4 → 0.1.6

package/payload/server/index.cjs

@@ -7347,21 +7347,57 @@ var ConfigurationError = class extends Error {
 
 // packages/config-node/src/private-file.ts
 var import_node_fs = require("node:fs");
+
+// packages/config-node/src/windows-permissions.ts
+var import_node_child_process = require("node:child_process");
+function assertWindowsPrivatePath(file) {
+  if (process.platform !== "win32") return;
+  const script = `
+$ErrorActionPreference = 'Stop'
+# Use .NET directly: a parent pwsh may export a PSModulePath incompatible with Windows PowerShell.
+$acl = if ([IO.Directory]::Exists($env:RUNWEAVE_PRIVATE_PATH)) {
+  [IO.Directory]::GetAccessControl($env:RUNWEAVE_PRIVATE_PATH)
+} else { [IO.File]::GetAccessControl($env:RUNWEAVE_PRIVATE_PATH) }
+$sid = [Security.Principal.WindowsIdentity]::GetCurrent().User
+$allowed = @($sid.Value, 'S-1-5-18', 'S-1-5-32-544')
+if ($acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -notin $allowed) { throw 'owner' }
+foreach ($rule in $acl.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])) {
+  if ($rule.AccessControlType -eq 'Allow' -and $rule.IdentityReference.Value -notin $allowed) { throw 'access' }
+}
+`;
+  try {
+    (0, import_node_child_process.execFileSync)("powershell.exe", ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], {
+      env: { ...process.env, RUNWEAVE_PRIVATE_PATH: file },
+      stdio: "ignore",
+      timeout: 1e4,
+      windowsHide: true
+    });
+  } catch {
+    throw new ConfigurationError("CONFIG_WINDOWS_ACL_NOT_PRIVATE", [file]);
+  }
+}
+
+// packages/config-node/src/private-file.ts
 function assertPrivateDirectory(directory) {
   const stat = (0, import_node_fs.lstatSync)(directory);
-  if (!stat.isDirectory() || stat.isSymbolicLink() || stat.mode & 63 || typeof process.getuid === "function" && stat.uid !== process.getuid()) throw new ConfigurationError("CONFIG_ROOT_PERMISSIONS_INVALID");
+  if (!stat.isDirectory() || stat.isSymbolicLink() || process.platform !== "win32" && stat.mode & 63 || typeof process.getuid === "function" && stat.uid !== process.getuid()) throw new ConfigurationError("CONFIG_ROOT_PERMISSIONS_INVALID");
+  assertWindowsPrivatePath(directory);
 }
-function assertPrivateDescriptor(fd, maxBytes = 1024 * 1024) {
+function assertPrivateDescriptor(fd, maxBytes = 1024 * 1024, file) {
   const stat = (0, import_node_fs.fstatSync)(fd);
   if (!stat.isFile() || stat.nlink !== 1) throw new ConfigurationError("CONFIG_FILE_NOT_PRIVATE_REGULAR");
   if (typeof process.getuid === "function" && stat.uid !== process.getuid()) throw new ConfigurationError("CONFIG_FILE_OWNER_MISMATCH");
-  if (stat.mode & 63) throw new ConfigurationError("CONFIG_FILE_PERMISSIONS_INVALID");
+  if (process.platform !== "win32" && stat.mode & 63) throw new ConfigurationError("CONFIG_FILE_PERMISSIONS_INVALID");
+  if (process.platform === "win32") {
+    if (!file) throw new ConfigurationError("CONFIG_PRIVATE_PATH_REQUIRED");
+    assertWindowsPrivatePath(file);
+  }
   if (stat.size > maxBytes) throw new ConfigurationError("CONFIG_FILE_TOO_LARGE");
 }
 function readPrivateFile(file, maxBytes = 1024 * 1024) {
   const fd = (0, import_node_fs.openSync)(file, import_node_fs.constants.O_RDONLY | import_node_fs.constants.O_NOFOLLOW);
   try {
-    assertPrivateDescriptor(fd, maxBytes);
+    assertPrivateDescriptor(fd, maxBytes, file);
     const source = (0, import_node_fs.readFileSync)(fd, "utf8");
     if (Buffer.byteLength(source) > maxBytes) throw new ConfigurationError("CONFIG_FILE_TOO_LARGE");
     return source;
@@ -7439,15 +7475,40 @@ function assertOwnedPath(context, value) {
   }
 }
 
-// packages/config-node/src/owner.ts
+// packages/config-node/src/platform.ts
+var import_node_child_process2 = require("node:child_process");
 var import_node_fs3 = require("node:fs");
+function processStartIdentity(pid) {
+  if (!Number.isSafeInteger(pid) || pid < 1) return null;
+  try {
+    return (0, import_node_child_process2.execFileSync)(
+      process.platform === "win32" ? "powershell.exe" : "ps",
+      process.platform === "win32" ? ["-NoProfile", "-NonInteractive", "-Command", `[Diagnostics.Process]::GetProcessById(${pid}).StartTime.ToUniversalTime().Ticks`] : ["-p", String(pid), "-o", "lstart="],
+      { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5e3, windowsHide: true }
+    ).trim() || null;
+  } catch {
+    return null;
+  }
+}
+function syncDirectory(directory) {
+  if (process.platform === "win32") return;
+  const fd = (0, import_node_fs3.openSync)(directory, "r");
+  try {
+    (0, import_node_fs3.fsyncSync)(fd);
+  } finally {
+    (0, import_node_fs3.closeSync)(fd);
+  }
+}
+
+// packages/config-node/src/owner.ts
+var import_node_fs4 = require("node:fs");
 var import_node_path2 = __toESM(require("node:path"), 1);
 var import_node_os2 = __toESM(require("node:os"), 1);
 var import_node_crypto = require("node:crypto");
 var import_fs_native_extensions = require("fs-native-extensions");
 function ownerDirectory(context) {
   const directory = context.kind === "stable" ? import_node_path2.default.join(import_node_os2.default.userInfo().homedir, ".runweave", "runtime") : import_node_path2.default.join(context.configRoot, "runtime");
-  (0, import_node_fs3.mkdirSync)(directory, { recursive: true, mode: 448 });
+  (0, import_node_fs4.mkdirSync)(directory, { recursive: true, mode: 448 });
   assertPrivateDirectory(import_node_path2.default.dirname(directory));
   assertPrivateDirectory(directory);
   return directory;
@@ -7456,11 +7517,11 @@ function registerStableConfigurationRoot(context) {
   if (context.kind !== "stable") return;
   const directory = ownerDirectory(context);
   const registry = import_node_path2.default.join(directory, "stable-root.json");
-  const registryFd = (0, import_node_fs3.openSync)(import_node_path2.default.join(directory, "stable-root.lock"), import_node_fs3.constants.O_CREAT | import_node_fs3.constants.O_RDWR | import_node_fs3.constants.O_NOFOLLOW, 384);
+  const registryFd = (0, import_node_fs4.openSync)(import_node_path2.default.join(directory, "stable-root.lock"), import_node_fs4.constants.O_CREAT | import_node_fs4.constants.O_RDWR | import_node_fs4.constants.O_NOFOLLOW, 384);
   try {
-    assertPrivateDescriptor(registryFd);
+    assertPrivateDescriptor(registryFd, void 0, import_node_path2.default.join(directory, "stable-root.lock"));
     if (!(0, import_fs_native_extensions.tryLock)(registryFd)) throw new ConfigurationError("CONFIG_ROOT_REGISTRATION_BUSY");
-    if ((0, import_node_fs3.existsSync)(registry)) {
+    if ((0, import_node_fs4.existsSync)(registry)) {
       let stored;
       try {
         stored = JSON.parse(readPrivateFile(registry));
@@ -7470,34 +7531,29 @@ function registerStableConfigurationRoot(context) {
       if (!stored || typeof stored !== "object" || !("root" in stored) || stored.root !== canonicalPath(context.configRoot)) throw new ConfigurationError("CONFIG_STABLE_ROOT_CONFLICT");
     } else {
       const temporary = `${registry}.${(0, import_node_crypto.randomUUID)()}.tmp`;
-      const file = (0, import_node_fs3.openSync)(temporary, "wx", 384);
-      try {
-        (0, import_node_fs3.writeFileSync)(file, JSON.stringify({ root: canonicalPath(context.configRoot) }));
-        (0, import_node_fs3.fsyncSync)(file);
-      } finally {
-        (0, import_node_fs3.closeSync)(file);
-      }
-      (0, import_node_fs3.renameSync)(temporary, registry);
-      const parent = (0, import_node_fs3.openSync)(directory, "r");
+      const file = (0, import_node_fs4.openSync)(temporary, "wx", 384);
       try {
-        (0, import_node_fs3.fsyncSync)(parent);
+        (0, import_node_fs4.writeFileSync)(file, JSON.stringify({ root: canonicalPath(context.configRoot) }));
+        (0, import_node_fs4.fsyncSync)(file);
       } finally {
-        (0, import_node_fs3.closeSync)(parent);
+        (0, import_node_fs4.closeSync)(file);
       }
+      (0, import_node_fs4.renameSync)(temporary, registry);
+      syncDirectory(directory);
     }
   } finally {
-    (0, import_node_fs3.closeSync)(registryFd);
+    (0, import_node_fs4.closeSync)(registryFd);
   }
 }
 function withUpgradeGate(context, shared, run) {
   const directory = ownerDirectory(context);
-  const fd = (0, import_node_fs3.openSync)(import_node_path2.default.join(directory, "configuration-upgrade.lock"), import_node_fs3.constants.O_CREAT | import_node_fs3.constants.O_RDWR | import_node_fs3.constants.O_NOFOLLOW, 384);
+  const fd = (0, import_node_fs4.openSync)(import_node_path2.default.join(directory, "configuration-upgrade.lock"), import_node_fs4.constants.O_CREAT | import_node_fs4.constants.O_RDWR | import_node_fs4.constants.O_NOFOLLOW, 384);
   try {
-    assertPrivateDescriptor(fd);
+    assertPrivateDescriptor(fd, void 0, import_node_path2.default.join(directory, "configuration-upgrade.lock"));
     if (!(0, import_fs_native_extensions.tryLock)(fd, 0, 0, { shared })) throw new ConfigurationError("CONFIG_UPGRADE_BUSY");
     return run();
   } finally {
-    (0, import_node_fs3.closeSync)(fd);
+    (0, import_node_fs4.closeSync)(fd);
   }
 }
 function withConfigurationUpgradeOwnership(context, run, ignoredRoles = []) {
@@ -7505,16 +7561,16 @@ function withConfigurationUpgradeOwnership(context, run, ignoredRoles = []) {
     const directory = ownerDirectory(context);
     const held = [];
     try {
-      for (const file of (0, import_node_fs3.readdirSync)(directory).filter((name) => name.endsWith(".owner.lock"))) {
+      for (const file of (0, import_node_fs4.readdirSync)(directory).filter((name) => name.endsWith(".owner.lock"))) {
         if (ignoredRoles.includes(file.replace(/\.owner\.lock$/, ""))) continue;
-        const fd = (0, import_node_fs3.openSync)(import_node_path2.default.join(directory, file), import_node_fs3.constants.O_RDWR | import_node_fs3.constants.O_NOFOLLOW);
+        const fd = (0, import_node_fs4.openSync)(import_node_path2.default.join(directory, file), import_node_fs4.constants.O_RDWR | import_node_fs4.constants.O_NOFOLLOW);
         held.push(fd);
-        assertPrivateDescriptor(fd);
+        assertPrivateDescriptor(fd, void 0, import_node_path2.default.join(directory, file));
         if (!(0, import_fs_native_extensions.tryLock)(fd)) throw new ConfigurationError("CONFIG_UPGRADE_CONSUMER_RUNNING", [file.replace(/\.owner\.lock$/, "")]);
       }
       return run();
     } finally {
-      for (const fd of held) (0, import_node_fs3.closeSync)(fd);
+      for (const fd of held) (0, import_node_fs4.closeSync)(fd);
     }
   });
 }
@@ -7832,7 +7888,7 @@ function migrateConfigurationDocument(document) {
 }
 
 // packages/config-node/src/store.ts
-var import_node_fs4 = require("node:fs");
+var import_node_fs5 = require("node:fs");
 var import_node_path4 = __toESM(require("node:path"), 1);
 var import_node_crypto2 = require("node:crypto");
 var import_yaml = __toESM(require_dist(), 1);
@@ -8026,10 +8082,11 @@ function parseConfigurationYaml(source, context) {
   return { document, value, digest: (0, import_node_crypto2.createHash)("sha256").update(source).digest("hex"), issues: validateDomains(value, context) };
 }
 function assertPrivateFile(file, fd) {
-  const stat = fd === void 0 ? (0, import_node_fs4.lstatSync)(file) : (0, import_node_fs4.fstatSync)(fd);
+  const stat = fd === void 0 ? (0, import_node_fs5.lstatSync)(file) : (0, import_node_fs5.fstatSync)(fd);
   if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) throw new ConfigurationError("CONFIG_FILE_NOT_PRIVATE_REGULAR");
   if (typeof process.getuid === "function" && stat.uid !== process.getuid()) throw new ConfigurationError("CONFIG_FILE_OWNER_MISMATCH");
-  if ((stat.mode & 63) !== 0) throw new ConfigurationError("CONFIG_FILE_PERMISSIONS_INVALID");
+  if (process.platform !== "win32" && (stat.mode & 63) !== 0) throw new ConfigurationError("CONFIG_FILE_PERMISSIONS_INVALID");
+  assertWindowsPrivatePath(file);
   if (stat.size > MAX_BYTES) throw new ConfigurationError("CONFIG_FILE_TOO_LARGE", [], { line: 1, column: 1 });
 }
 var ConfigurationStore = class {
@@ -8039,30 +8096,29 @@ var ConfigurationStore = class {
   }
   file;
   read() {
-    if (!(0, import_node_fs4.existsSync)(this.file)) throw new ConfigurationError("CONFIG_MIGRATION_REQUIRED");
-    const root = (0, import_node_fs4.lstatSync)(this.context.configRoot);
-    if (!root.isDirectory() || root.isSymbolicLink() || root.mode & 63 || typeof process.getuid === "function" && root.uid !== process.getuid()) throw new ConfigurationError("CONFIG_ROOT_PERMISSIONS_INVALID");
+    if (!(0, import_node_fs5.existsSync)(this.file)) throw new ConfigurationError("CONFIG_MIGRATION_REQUIRED");
+    assertPrivateDirectory(this.context.configRoot);
     assertPrivateFile(this.file);
-    const fd = (0, import_node_fs4.openSync)(this.file, import_node_fs4.constants.O_RDONLY | import_node_fs4.constants.O_NOFOLLOW);
+    const fd = (0, import_node_fs5.openSync)(this.file, import_node_fs5.constants.O_RDONLY | import_node_fs5.constants.O_NOFOLLOW);
     try {
       assertPrivateFile(this.file, fd);
-      return parseConfigurationYaml((0, import_node_fs4.readFileSync)(fd, "utf8"), this.context);
+      return parseConfigurationYaml((0, import_node_fs5.readFileSync)(fd, "utf8"), this.context);
     } finally {
-      (0, import_node_fs4.closeSync)(fd);
+      (0, import_node_fs5.closeSync)(fd);
     }
   }
   locked(run) {
-    (0, import_node_fs4.mkdirSync)(this.context.configRoot, { recursive: true, mode: 448 });
-    const dirStat = (0, import_node_fs4.lstatSync)(this.context.configRoot);
+    (0, import_node_fs5.mkdirSync)(this.context.configRoot, { recursive: true, mode: 448 });
+    const dirStat = (0, import_node_fs5.lstatSync)(this.context.configRoot);
     if (!dirStat.isDirectory() || dirStat.isSymbolicLink() || typeof process.getuid === "function" && dirStat.uid !== process.getuid()) throw new ConfigurationError("CONFIG_ROOT_OWNER_MISMATCH");
-    if ((dirStat.mode & 63) !== 0) throw new ConfigurationError("CONFIG_ROOT_PERMISSIONS_INVALID");
-    const fd = (0, import_node_fs4.openSync)(import_node_path4.default.join(this.context.configRoot, "settings.lock"), import_node_fs4.constants.O_CREAT | import_node_fs4.constants.O_RDWR | import_node_fs4.constants.O_NOFOLLOW, 384);
+    assertPrivateDirectory(this.context.configRoot);
+    const fd = (0, import_node_fs5.openSync)(import_node_path4.default.join(this.context.configRoot, "settings.lock"), import_node_fs5.constants.O_CREAT | import_node_fs5.constants.O_RDWR | import_node_fs5.constants.O_NOFOLLOW, 384);
     try {
       assertPrivateFile(import_node_path4.default.join(this.context.configRoot, "settings.lock"), fd);
       if (!(0, import_fs_native_extensions2.tryLock)(fd)) throw new ConfigurationError("CONFIG_WRITE_BUSY");
       return run();
     } finally {
-      (0, import_node_fs4.closeSync)(fd);
+      (0, import_node_fs5.closeSync)(fd);
     }
   }
   publish(document, previous, backupId) {
@@ -8072,41 +8128,35 @@ var ConfigurationStore = class {
     const temporary = `${this.file}.${(0, import_node_crypto2.randomUUID)()}.tmp`;
     if (previous !== void 0) {
       const backupRoot = import_node_path4.default.join(this.context.configRoot, "config-backups");
-      (0, import_node_fs4.mkdirSync)(backupRoot, { recursive: true, mode: 448 });
-      const backupStat = (0, import_node_fs4.lstatSync)(backupRoot);
-      if (!backupStat.isDirectory() || backupStat.isSymbolicLink() || backupStat.mode & 63 || typeof process.getuid === "function" && backupStat.uid !== process.getuid()) throw new ConfigurationError("CONFIG_BACKUP_ROOT_INVALID");
+      (0, import_node_fs5.mkdirSync)(backupRoot, { recursive: true, mode: 448 });
+      assertPrivateDirectory(backupRoot);
       const backup = import_node_path4.default.join(backupRoot, backupId ?? `${Date.now()}-${(0, import_node_crypto2.randomUUID)()}.yaml`);
-      const fd2 = (0, import_node_fs4.openSync)(backup, "wx", 384);
+      const fd2 = (0, import_node_fs5.openSync)(backup, "wx", 384);
       try {
-        (0, import_node_fs4.writeFileSync)(fd2, previous);
-        (0, import_node_fs4.fsyncSync)(fd2);
+        (0, import_node_fs5.writeFileSync)(fd2, previous);
+        (0, import_node_fs5.fsyncSync)(fd2);
       } finally {
-        (0, import_node_fs4.closeSync)(fd2);
+        (0, import_node_fs5.closeSync)(fd2);
       }
     }
-    const fd = (0, import_node_fs4.openSync)(temporary, "wx", 384);
+    const fd = (0, import_node_fs5.openSync)(temporary, "wx", 384);
     try {
-      (0, import_node_fs4.writeFileSync)(fd, source);
-      (0, import_node_fs4.fsyncSync)(fd);
+      (0, import_node_fs5.writeFileSync)(fd, source);
+      (0, import_node_fs5.fsyncSync)(fd);
     } finally {
-      (0, import_node_fs4.closeSync)(fd);
+      (0, import_node_fs5.closeSync)(fd);
     }
     try {
-      (0, import_node_fs4.renameSync)(temporary, this.file);
-      const parent = (0, import_node_fs4.openSync)(this.context.configRoot, "r");
-      try {
-        (0, import_node_fs4.fsyncSync)(parent);
-      } finally {
-        (0, import_node_fs4.closeSync)(parent);
-      }
+      (0, import_node_fs5.renameSync)(temporary, this.file);
+      syncDirectory(this.context.configRoot);
     } finally {
-      if ((0, import_node_fs4.existsSync)(temporary)) (0, import_node_fs4.unlinkSync)(temporary);
+      if ((0, import_node_fs5.existsSync)(temporary)) (0, import_node_fs5.unlinkSync)(temporary);
     }
     return checked;
   }
   initialize(value) {
     return this.locked(() => {
-      if ((0, import_node_fs4.existsSync)(this.file)) throw new ConfigurationError("CONFIG_ALREADY_EXISTS");
+      if ((0, import_node_fs5.existsSync)(this.file)) throw new ConfigurationError("CONFIG_ALREADY_EXISTS");
       validateEnvelope(value, this.context);
       const issues = validateDomains(value, this.context);
       if (Object.keys(issues).length) throw new ConfigurationError("CONFIG_VALIDATION_FAILED", Object.values(issues).flat().map((item) => item.path));
@@ -8146,9 +8196,9 @@ var ConfigurationStore = class {
   }
   backups() {
     const root = import_node_path4.default.join(this.context.configRoot, "config-backups");
-    if (!(0, import_node_fs4.existsSync)(root)) return [];
+    if (!(0, import_node_fs5.existsSync)(root)) return [];
     assertPrivateDirectory(root);
-    return (0, import_node_fs4.readdirSync)(root).filter((id) => /^\d+-[a-f0-9-]+\.yaml$/.test(id)).sort().reverse().map((id) => {
+    return (0, import_node_fs5.readdirSync)(root).filter((id) => /^\d+-[a-f0-9-]+\.yaml$/.test(id)).sort().reverse().map((id) => {
       try {
         const backup = this.readBackup(id);
         return { id, revision: backup.value.revision, schemaVersion: backup.value.schemaVersion, compatible: true };
@@ -8226,23 +8276,18 @@ var ConfigurationStore = class {
   recordUpgrade(value) {
     const file = import_node_path4.default.join(this.context.configRoot, "config-upgrade.json");
     const temporary = `${file}.${(0, import_node_crypto2.randomUUID)()}.tmp`;
-    const fd = (0, import_node_fs4.openSync)(temporary, "wx", 384);
+    const fd = (0, import_node_fs5.openSync)(temporary, "wx", 384);
     try {
-      (0, import_node_fs4.writeFileSync)(fd, JSON.stringify(value, null, 2) + "\n");
-      (0, import_node_fs4.fsyncSync)(fd);
+      (0, import_node_fs5.writeFileSync)(fd, JSON.stringify(value, null, 2) + "\n");
+      (0, import_node_fs5.fsyncSync)(fd);
     } finally {
-      (0, import_node_fs4.closeSync)(fd);
+      (0, import_node_fs5.closeSync)(fd);
     }
     try {
-      (0, import_node_fs4.renameSync)(temporary, file);
-      const parent = (0, import_node_fs4.openSync)(this.context.configRoot, "r");
-      try {
-        (0, import_node_fs4.fsyncSync)(parent);
-      } finally {
-        (0, import_node_fs4.closeSync)(parent);
-      }
+      (0, import_node_fs5.renameSync)(temporary, file);
+      syncDirectory(this.context.configRoot);
     } finally {
-      if ((0, import_node_fs4.existsSync)(temporary)) (0, import_node_fs4.unlinkSync)(temporary);
+      if ((0, import_node_fs5.existsSync)(temporary)) (0, import_node_fs5.unlinkSync)(temporary);
     }
   }
   upgrade(expected) {
@@ -8251,7 +8296,7 @@ var ConfigurationStore = class {
       if (preview.expectedRevision !== expected.revision || preview.expectedDigest !== expected.digest) throw new ConfigurationError("CONFIG_REVISION_CONFLICT");
       if (!preview.changed) {
         const receiptFile = import_node_path4.default.join(this.context.configRoot, "config-upgrade.json");
-        if ((0, import_node_fs4.existsSync)(receiptFile)) {
+        if ((0, import_node_fs5.existsSync)(receiptFile)) {
           const receipt = JSON.parse(readPrivateFile(receiptFile));
           if (isConfigurationObject(receipt) && receipt.phase === "prepared" && receipt.plannedDigest === expected.digest)
             this.recordUpgrade({ ...receipt, phase: "committed", savedRevision: expected.revision, digest: expected.digest });
@@ -8285,9 +8330,9 @@ var ConfigurationStore = class {
   previous(keys) {
     const current = this.read();
     const root = import_node_path4.default.join(this.context.configRoot, "config-backups");
-    if (!(0, import_node_fs4.existsSync)(root)) throw new ConfigurationError("CONFIG_BACKUP_UNAVAILABLE");
+    if (!(0, import_node_fs5.existsSync)(root)) throw new ConfigurationError("CONFIG_BACKUP_UNAVAILABLE");
     assertPrivateDirectory(root);
-    const candidates = (0, import_node_fs4.readdirSync)(root).filter((file) => /^\d+-[a-f0-9-]+\.yaml$/.test(file)).sort().reverse();
+    const candidates = (0, import_node_fs5.readdirSync)(root).filter((file) => /^\d+-[a-f0-9-]+\.yaml$/.test(file)).sort().reverse();
     for (const candidate of candidates) {
       const file = import_node_path4.default.join(root, candidate);
       const previous = parseConfigurationYaml(readPrivateFile(file), this.context);
@@ -8299,7 +8344,7 @@ var ConfigurationStore = class {
   }
   migrate(value, expected) {
     return this.locked(() => {
-      const current = (0, import_node_fs4.existsSync)(this.file) ? this.read() : null;
+      const current = (0, import_node_fs5.existsSync)(this.file) ? this.read() : null;
       if (current ? !expected || current.value.revision !== expected.revision || current.digest !== expected.digest : expected !== null) throw new ConfigurationError("CONFIG_REVISION_CONFLICT");
       validateEnvelope(value, this.context);
       const issues = validateDomains(value, this.context);
@@ -8514,7 +8559,7 @@ function configurationPath(key, relativeDefault) {
 
 // packages/config-node/src/app-server/runtime-release.ts
 var import_node_crypto3 = require("node:crypto");
-var import_node_fs5 = require("node:fs");
+var import_node_fs6 = require("node:fs");
 var import_node_path7 = __toESM(require("node:path"), 1);
 
 // packages/shared/src/app-server/types.ts
@@ -8538,7 +8583,7 @@ function installAppServerRuntimeRelease(options) {
     throw new Error(`Invalid app-server releaseId: ${options.releaseId}`);
   }
   const sourceEntry = import_node_path7.default.resolve(options.entry);
-  if (!(0, import_node_fs5.existsSync)(sourceEntry)) {
+  if (!(0, import_node_fs6.existsSync)(sourceEntry)) {
     throw new Error(`App-server entry does not exist: ${sourceEntry}`);
   }
   const capability = readJsonFile(import_node_path7.default.join(import_node_path7.default.dirname(sourceEntry), "configuration-compatibility.json"));
@@ -8550,12 +8595,16 @@ function installAppServerRuntimeRelease(options) {
   const releaseDir = import_node_path7.default.join(releasesDir, options.releaseId);
   const tempReleaseDir = import_node_path7.default.join(releasesDir, `${options.releaseId}.tmp`);
   const targetEntry = import_node_path7.default.join(tempReleaseDir, "app-server", "index.cjs");
-  (0, import_node_fs5.rmSync)(tempReleaseDir, { recursive: true, force: true });
-  (0, import_node_fs5.mkdirSync)(import_node_path7.default.dirname(targetEntry), { recursive: true });
-  (0, import_node_fs5.cpSync)(sourceEntry, targetEntry);
+  (0, import_node_fs6.rmSync)(tempReleaseDir, { recursive: true, force: true });
+  (0, import_node_fs6.mkdirSync)(import_node_path7.default.dirname(targetEntry), { recursive: true });
+  (0, import_node_fs6.cpSync)(sourceEntry, targetEntry);
   const nativeModules = import_node_path7.default.join(import_node_path7.default.dirname(sourceEntry), "node_modules");
-  if (!(0, import_node_fs5.existsSync)(nativeModules)) throw new Error("CONFIG_NATIVE_LOCK_RUNTIME_MISSING");
-  (0, import_node_fs5.cpSync)(nativeModules, import_node_path7.default.join(import_node_path7.default.dirname(targetEntry), "node_modules"), { recursive: true });
+  if (!(0, import_node_fs6.existsSync)(nativeModules)) throw new Error("CONFIG_NATIVE_LOCK_RUNTIME_MISSING");
+  (0, import_node_fs6.cpSync)(nativeModules, import_node_path7.default.join(import_node_path7.default.dirname(targetEntry), "node_modules"), {
+    recursive: true,
+    // Avoid Node 22's native recursive-copy crash on Windows Unicode paths.
+    ...process.platform === "win32" ? { filter: () => true } : {}
+  });
   const manifest = {
     configuration: capability,
     schemaVersion: APP_SERVER_RUNTIME_SCHEMA_VERSION,
@@ -8566,18 +8615,18 @@ function installAppServerRuntimeRelease(options) {
     },
     files: runtimeFiles(tempReleaseDir).map((file) => ({ path: file, sha256: sha256(import_node_path7.default.join(tempReleaseDir, file)) }))
   };
-  (0, import_node_fs5.writeFileSync)(
+  (0, import_node_fs6.writeFileSync)(
     import_node_path7.default.join(tempReleaseDir, "manifest.json"),
     `${JSON.stringify(manifest, null, 2)}
 `
   );
-  (0, import_node_fs5.mkdirSync)(releasesDir, { recursive: true });
-  (0, import_node_fs5.rmSync)(releaseDir, { recursive: true, force: true });
-  (0, import_node_fs5.renameSync)(tempReleaseDir, releaseDir);
+  (0, import_node_fs6.mkdirSync)(releasesDir, { recursive: true });
+  (0, import_node_fs6.rmSync)(releaseDir, { recursive: true, force: true });
+  (0, import_node_fs6.renameSync)(tempReleaseDir, releaseDir);
   const currentPath = import_node_path7.default.join(runtimeRoot, "current.json");
   const currentTemp = `${currentPath}.tmp`;
-  (0, import_node_fs5.mkdirSync)(runtimeRoot, { recursive: true });
-  (0, import_node_fs5.writeFileSync)(
+  (0, import_node_fs6.mkdirSync)(runtimeRoot, { recursive: true });
+  (0, import_node_fs6.writeFileSync)(
     currentTemp,
     `${JSON.stringify(
       {
@@ -8589,7 +8638,7 @@ function installAppServerRuntimeRelease(options) {
     )}
 `
   );
-  (0, import_node_fs5.renameSync)(currentTemp, currentPath);
+  (0, import_node_fs6.renameSync)(currentTemp, currentPath);
   return {
     source: "global",
     releaseId: options.releaseId,
@@ -8600,13 +8649,13 @@ function installAppServerRuntimeRelease(options) {
 }
 function readJsonFile(filePath) {
   try {
-    return JSON.parse((0, import_node_fs5.readFileSync)(filePath, "utf8"));
+    return JSON.parse((0, import_node_fs6.readFileSync)(filePath, "utf8"));
   } catch {
     return null;
   }
 }
 function sha256(filePath) {
-  return (0, import_node_crypto3.createHash)("sha256").update((0, import_node_fs5.readFileSync)(filePath)).digest("hex");
+  return (0, import_node_crypto3.createHash)("sha256").update((0, import_node_fs6.readFileSync)(filePath)).digest("hex");
 }
 function isSafeRelativePath(value) {
   if (typeof value !== "string") {
@@ -8622,7 +8671,7 @@ function isSafeReleaseId(value) {
   return isSafeRelativePath(value) && !String(value).includes("/") && !String(value).includes("\\");
 }
 function runtimeFiles(root, prefix = "") {
-  return (0, import_node_fs5.readdirSync)(import_node_path7.default.join(root, prefix), { withFileTypes: true }).flatMap((entry) => {
+  return (0, import_node_fs6.readdirSync)(import_node_path7.default.join(root, prefix), { withFileTypes: true }).flatMap((entry) => {
     const relative = import_node_path7.default.posix.join(prefix, entry.name);
     if (entry.isSymbolicLink()) throw new Error("CONFIG_RUNTIME_SYMLINK_FORBIDDEN");
     return entry.isDirectory() ? runtimeFiles(root, relative) : [relative];
@@ -8631,22 +8680,21 @@ function runtimeFiles(root, prefix = "") {
 
 // packages/runweave-server/src/runtime.ts
 var import_node_module = require("node:module");
-var import_node_child_process = require("node:child_process");
-var import_node_fs6 = require("node:fs");
+var import_node_fs7 = require("node:fs");
 var import_node_crypto4 = require("node:crypto");
 var import_node_path8 = __toESM(require("node:path"));
-var readJson = (file) => JSON.parse((0, import_node_fs6.readFileSync)(file, "utf8"));
+var readJson = (file) => JSON.parse((0, import_node_fs7.readFileSync)(file, "utf8"));
 function writeJson(file, value) {
   const temporary = `${file}.${(0, import_node_crypto4.randomUUID)()}`;
-  (0, import_node_fs6.writeFileSync)(temporary, JSON.stringify(value, null, 2) + "\n", {
+  (0, import_node_fs7.writeFileSync)(temporary, JSON.stringify(value, null, 2) + "\n", {
     mode: 384
   });
-  (0, import_node_fs6.renameSync)(temporary, file);
+  (0, import_node_fs7.renameSync)(temporary, file);
 }
 function processStart(pid) {
-  return (0, import_node_child_process.execFileSync)("ps", ["-p", String(pid), "-o", "lstart="], {
-    encoding: "utf8"
-  }).trim();
+  const identity = processStartIdentity(pid);
+  if (!identity) throw new Error("Cannot identify Server process start time");
+  return identity;
 }
 async function waitForAppServer() {
   const deadline = Date.now() + 3e4;
@@ -8669,6 +8717,16 @@ async function waitForAppServer() {
   throw new Error("App Server did not become healthy");
 }
 async function runComponent(ctx, name) {
+  if (process.platform === "win32") {
+    const shutdown = () => {
+      if (process.listenerCount("SIGTERM") === 0) process.exit(0);
+      process.emit("SIGTERM");
+    };
+    process.on("message", (message) => {
+      if (message === "runweave:shutdown") shutdown();
+    });
+    process.once("disconnect", shutdown);
+  }
   delete process.env.RUNWEAVE_APP_SERVER_URL;
   delete process.env.RUNWEAVE_APP_SERVER_TOKEN;
   delete process.env.RUNWEAVE_HOOK_TOKEN;
@@ -8716,7 +8774,7 @@ async function runComponent(ctx, name) {
       "node_modules/node-pty"
     );
     process.env.RUNWEAVE_RUNTIME_RELEASE_ID = ctx.manifest.version;
-    process.env.RUNWEAVE_CLI_BIN = import_node_path8.default.join(ctx.home, "rw");
+    process.env.RUNWEAVE_CLI_BIN = import_node_path8.default.join(ctx.home, process.platform === "win32" ? "rw.cmd" : "rw");
     nativeRequire(import_node_path8.default.join(backend, "index.cjs"));
   } else {
     const entry = import_node_path8.default.join(ctx.release, "app-server/index.cjs");
@@ -8789,7 +8847,7 @@ async function runServerRuntime(args) {
       await waitForAppServer();
     }
     const home = import_node_path8.default.join(context.configRoot, "server");
-    (0, import_node_fs6.mkdirSync)(home, { recursive: true, mode: 448 });
+    (0, import_node_fs7.mkdirSync)(home, { recursive: true, mode: 448 });
     await runComponent({ home, release, manifest }, component);
   });
 }

package/payload/frontend/dist/assets/channel-CExZE0tD.js

@@ -1 +0,0 @@
-import{U as a,M as n}from"./index-Cf9Vl4GJ.js";const t=(r,o)=>a.lang.round(n.parse(r)[o]);export{t as c};

package/payload/frontend/dist/assets/classDiagram-6PBFFD2Q-DNOAkizi.js

@@ -1 +0,0 @@
-import{s as a,c as s,a as e,C as t}from"./chunk-4TB4RGXK-ByjQ1_yc.js";import{_ as i}from"./index-Cf9Vl4GJ.js";import"./chunk-FMBD7UC4-D3J3ERtV.js";import"./chunk-YZCP3GAM-KD19-lMa.js";import"./chunk-55IACEB6-D-KjMbGJ.js";import"./chunk-EDXVE4YY-tAgLMZ4w.js";import"./main-DwDuhfcr.js";import"./index-D9-cSGu-.js";import"./record-content-Bewq09_f.js";var b={parser:e,get db(){return new t},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{b as diagram};

package/payload/frontend/dist/assets/classDiagram-v2-HSJHXN6E-DNOAkizi.js

@@ -1 +0,0 @@
-import{s as a,c as s,a as e,C as t}from"./chunk-4TB4RGXK-ByjQ1_yc.js";import{_ as i}from"./index-Cf9Vl4GJ.js";import"./chunk-FMBD7UC4-D3J3ERtV.js";import"./chunk-YZCP3GAM-KD19-lMa.js";import"./chunk-55IACEB6-D-KjMbGJ.js";import"./chunk-EDXVE4YY-tAgLMZ4w.js";import"./main-DwDuhfcr.js";import"./index-D9-cSGu-.js";import"./record-content-Bewq09_f.js";var b={parser:e,get db(){return new t},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{b as diagram};

package/payload/frontend/dist/assets/clone-CzOxlTa8.js

@@ -1 +0,0 @@
-import{b as r}from"./graph-DakNuFNs.js";var e=4;function a(o){return r(o,e)}export{a as c};