@songsid/agend 2.3.5-alpha.4 → 2.3.5-alpha.5

package/dist/runtime-update-journal.js

@@ -0,0 +1,121 @@
+/** Private, code-update-only recovery state. Pairing credentials and task ledgers are never copied or restored. */
+import { join } from "node:path";
+import { atomicWriteFileSync } from "./atomic-write.js";
+import { validateRuntimeServer } from "./runtime-client-store.js";
+import { compareRuntimeVersions, parseRuntimeUpdateMetadata } from "./runtime-update-artifact.js";
+import { assertRuntimeInstallDirectory, readRuntimeInstallFile } from "./runtime-update-lock.js";
+const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;
+const HASH = /^[a-f0-9]{64}$/;
+const PHASES = ["prepared", "handoff", "trial", "activating", "active", "rollback"];
+export class RuntimeUpdateJournalError extends Error {
+    reason;
+    constructor(reason) {
+        super(`Runtime update journal ${reason}`);
+        this.reason = reason;
+    }
+}
+function object(value) { return !!value && typeof value === "object" && !Array.isArray(value); }
+function keys(value, required, optional = []) {
+    return required.every(key => Object.hasOwn(value, key)) && Object.keys(value).every(key => required.includes(key) || optional.includes(key));
+}
+function binding(value) {
+    if (!object(value) || !keys(value, ["origin", "machineId", "installId"]) || typeof value.origin !== "string" || validateRuntimeServer(value.origin).origin !== value.origin
+        || typeof value.machineId !== "string" || !UUID.test(value.machineId) || typeof value.installId !== "string" || !UUID.test(value.installId))
+        throw new RuntimeUpdateJournalError("unsafe");
+    return { origin: value.origin, machineId: value.machineId, installId: value.installId };
+}
+function program(value) {
+    if (!object(value) || !keys(value, ["folder", "version", "sha256", "buildId"]) || typeof value.buildId !== "string" || !HASH.test(value.buildId))
+        throw new RuntimeUpdateJournalError("unsafe");
+    const parsed = parseRuntimeUpdateMetadata({ version: value.version, sha256: value.sha256, bytes: 1 });
+    if (value.folder !== `${parsed.version}+${parsed.sha256.slice(0, 8)}`)
+        throw new RuntimeUpdateJournalError("unsafe");
+    return { folder: value.folder, version: parsed.version, sha256: parsed.sha256, buildId: value.buildId };
+}
+export function parseRuntimeUpdateState(value) {
+    if (!object(value) || !keys(value, ["version", "revision", "binding"], ["failed", "attempt"]) || value.version !== 1
+        || !Number.isSafeInteger(value.revision) || value.revision < 0 || value.revision >= Number.MAX_SAFE_INTEGER)
+        throw new RuntimeUpdateJournalError("unsafe");
+    const result = { version: 1, revision: value.revision, binding: binding(value.binding) };
+    if (Object.hasOwn(value, "failed")) {
+        if (!object(value.failed) || !keys(value.failed, ["version", "sha256"]))
+            throw new RuntimeUpdateJournalError("unsafe");
+        const { version, sha256 } = parseRuntimeUpdateMetadata({ ...value.failed, bytes: 1 });
+        result.failed = { version, sha256 };
+    }
+    if (Object.hasOwn(value, "attempt")) {
+        const a = value.attempt;
+        if (!object(a) || !keys(a, ["id", "ownerId", "phase", "old", "next"]) || typeof a.id !== "string" || !UUID.test(a.id)
+            || typeof a.ownerId !== "string" || !UUID.test(a.ownerId) || !PHASES.includes(a.phase))
+            throw new RuntimeUpdateJournalError("unsafe");
+        const old = program(a.old), next = program(a.next);
+        if (old.sha256 === next.sha256 || compareRuntimeVersions(next.version, old.version) < 0)
+            throw new RuntimeUpdateJournalError("unsafe");
+        result.attempt = { id: a.id, ownerId: a.ownerId, phase: a.phase, old, next };
+    }
+    return result;
+}
+/** Callers hold the shared install lock, and the exact registered controller owns all writes. */
+export class RuntimeUpdateJournal {
+    directory;
+    file;
+    expected;
+    constructor(directory, expected) {
+        this.directory = directory;
+        assertRuntimeInstallDirectory(directory);
+        this.file = join(directory, "runtime-update.json");
+        this.expected = binding(expected);
+        this.read();
+    }
+    read() {
+        assertRuntimeInstallDirectory(this.directory);
+        const file = readRuntimeInstallFile(this.file, 16 * 1024);
+        const state = file ? parseRuntimeUpdateState(JSON.parse(file.text)) : { version: 1, revision: 0, binding: this.expected };
+        if (JSON.stringify(state.binding) !== JSON.stringify(this.expected))
+            throw new RuntimeUpdateJournalError("changed");
+        return structuredClone(state);
+    }
+    commit(before, next, current) {
+        const checked = parseRuntimeUpdateState({ ...next, revision: before.revision + 1 });
+        const file = readRuntimeInstallFile(this.file, 16 * 1024);
+        const assert = () => {
+            if (current() !== undefined)
+                throw new RuntimeUpdateJournalError("unsafe");
+            const now = readRuntimeInstallFile(this.file, 16 * 1024);
+            if (JSON.stringify(this.read()) !== JSON.stringify(before) || now?.text !== file?.text || now?.stat.ino !== file?.stat.ino || now?.stat.dev !== file?.stat.dev)
+                throw new RuntimeUpdateJournalError("changed");
+        };
+        assert();
+        atomicWriteFileSync(this.file, JSON.stringify(checked), { mode: 0o600, beforeRename: assert });
+        return structuredClone(checked);
+    }
+    begin(id, ownerId, old, next, current) {
+        const before = this.read();
+        if (before.attempt || before.failed?.sha256 === next.sha256)
+            throw new RuntimeUpdateJournalError("transition");
+        return this.commit(before, { ...before, attempt: { id, ownerId, phase: "prepared", old, next } }, current);
+    }
+    advance(id, phase, current) {
+        const before = this.read(), attempt = before.attempt;
+        const transitions = { prepared: ["handoff", "rollback"], handoff: ["trial", "rollback"], trial: ["activating", "rollback"], activating: ["active"], active: [], rollback: [] };
+        if (!attempt || attempt.id !== id || !transitions[attempt.phase].includes(phase))
+            throw new RuntimeUpdateJournalError("transition");
+        return this.commit(before, { ...before, attempt: { ...attempt, phase } }, current);
+    }
+    fail(id, current) {
+        const before = this.read(), attempt = before.attempt;
+        if (!attempt || attempt.id !== id)
+            throw new RuntimeUpdateJournalError("transition");
+        if (["activating", "active"].includes(attempt.phase))
+            throw new RuntimeUpdateJournalError("uncertain");
+        const { attempt: _, ...rest } = before;
+        return this.commit(before, { ...rest, failed: { version: attempt.next.version, sha256: attempt.next.sha256 } }, current);
+    }
+    complete(id, current) {
+        const before = this.read();
+        if (before.attempt?.id !== id || before.attempt.phase !== "active")
+            throw new RuntimeUpdateJournalError("transition");
+        return this.commit(before, { version: 1, revision: before.revision, binding: before.binding }, current);
+    }
+}
+//# sourceMappingURL=runtime-update-journal.js.map

package/dist/runtime-update-journal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-update-journal.js","sourceRoot":"","sources":["../src/runtime-update-journal.ts"],"names":[],"mappings":"AAAA,mHAAmH;AACnH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAClG,OAAO,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAGjG,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAC/E,MAAM,IAAI,GAAG,gBAAgB,CAAC;AAC9B,MAAM,MAAM,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAU,CAAC;AAS7F,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAC7B,MAAM;IAA3B,YAAqB,MAAyD;QAAI,KAAK,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC;sBAAvG,MAAM;IAAkG,CAAC;CAC/H;AACD,SAAS,MAAM,CAAC,KAAc,IAAsC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC3I,SAAS,IAAI,CAAC,KAA8B,EAAE,QAAkB,EAAE,QAAQ,GAAa,EAAE;IACvF,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/I,CAAC;AACD,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;WACtK,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC7L,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;AAC1F,CAAC;AACD,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAChM,MAAM,MAAM,GAAG,0BAA0B,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACtG,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QAAE,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACrH,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAgB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AACpH,CAAC;AACD,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC;WAC/G,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAK,KAAK,CAAC,QAAmB,GAAG,CAAC,IAAK,KAAK,CAAC,QAAmB,IAAI,MAAM,CAAC,gBAAgB;QAAE,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACrL,MAAM,MAAM,GAAuB,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAkB,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IACvH,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAAE,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACvH,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,0BAA0B,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAAC,MAAM,CAAC,MAAM,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7H,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;eAChH,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAA2B,CAAC;YAAE,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAC9J,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QACvI,MAAM,CAAC,OAAO,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAA2B,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACrG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,iGAAiG;AACjG,MAAM,OAAO,oBAAoB;IAGF,SAAS;IAFrB,IAAI,CAAS;IACb,QAAQ,CAAuB;IAChD,YAA6B,SAAiB,EAAE,QAA8B;yBAAjD,SAAS;QACpC,6BAA6B,CAAC,SAAS,CAAC,CAAC;QAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;QAAC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/I,CAAC;IACD,IAAI;QACF,6BAA6B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAU,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnI,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACpH,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACO,MAAM,CAAC,MAA0B,EAAE,IAAwB,EAAE,OAAmB;QACtF,MAAM,OAAO,GAAG,uBAAuB,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,IAAK,OAAO,EAAc,KAAK,SAAS;gBAAE,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,CAAC;YACxF,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;YACzD,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,IAAI,GAAG,EAAE,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,GAAG,EAAE,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACjN,CAAC,CAAC;QACF,MAAM,EAAE,CAAC;QAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QAAC,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAC5I,CAAC;IACD,KAAK,CAAC,EAAU,EAAE,OAAe,EAAE,GAA4B,EAAE,IAA6B,EAAE,OAAmB;QACjH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,yBAAyB,CAAC,YAAY,CAAC,CAAC;QAC/G,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,CAAC,EAAU,EAAE,KAAyB,EAAE,OAAmB;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACrD,MAAM,WAAW,GAA8D,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC1O,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,yBAAyB,CAAC,YAAY,CAAC,CAAC;QACpI,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,EAAU,EAAE,OAAmB;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACrD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,EAAE;YAAE,MAAM,IAAI,yBAAyB,CAAC,YAAY,CAAC,CAAC;QACrF,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,yBAAyB,CAAC,WAAW,CAAC,CAAC;QACvG,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QACvC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC3H,CAAC;IACD,QAAQ,CAAC,EAAU,EAAE,OAAmB;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,yBAAyB,CAAC,YAAY,CAAC,CAAC;QACtH,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IAC1G,CAAC;CACF"}

package/dist/runtime-update-lock.d.ts

@@ -0,0 +1,48 @@
+import { type Stats } from "node:fs";
+export declare const RUNTIME_INSTALL_LOCK = ".agend-runtime-install.lock";
+export interface RuntimeProcessProof {
+    pid: number;
+    birth: string;
+    boot: string;
+}
+export type RuntimeProcessObservation = {
+    state: "alive";
+    proof: RuntimeProcessProof;
+} | {
+    state: "gone";
+} | {
+    state: "unknown";
+};
+export interface RuntimeInstallLockRecord extends RuntimeProcessProof {
+    version: 1;
+    type: "installer" | "supervisor";
+    nonce: string;
+}
+export declare class RuntimeInstallLockError extends Error {
+    readonly reason: "held" | "unsafe" | "changed" | "unknown";
+    constructor(reason: "held" | "unsafe" | "changed" | "unknown");
+}
+export declare function parseRuntimeInstallLock(value: unknown): RuntimeInstallLockRecord;
+/** Fixed local query; no command line, profile, account, credential or response-provided program is read. */
+export declare function observeRuntimeProcess(pid: number): Promise<RuntimeProcessObservation>;
+export declare function runtimeProcessMatches(expected: RuntimeProcessProof, observed: RuntimeProcessObservation): boolean | undefined;
+export declare function assertRuntimeInstallDirectory(path: string): Stats;
+/** Only ENOENT is absence; malformed, writable or changed files never become an empty installation. */
+export declare function readRuntimeInstallBytes(path: string, max?: number): {
+    bytes: Buffer;
+    stat: Stats;
+} | undefined;
+export declare function readRuntimeInstallFile(path: string, max?: number): {
+    text: string;
+    stat: Stats;
+} | undefined;
+export interface RuntimeInstallLock {
+    readonly record: RuntimeInstallLockRecord;
+    assert(): void;
+    release(): void;
+}
+export declare function acquireRuntimeInstallLock(root: string, options?: {
+    type?: RuntimeInstallLockRecord["type"];
+    ownProof?: RuntimeProcessProof;
+    observe?: (pid: number) => Promise<RuntimeProcessObservation>;
+}): Promise<RuntimeInstallLock>;

package/dist/runtime-update-lock.js

@@ -0,0 +1,217 @@
+/** Shared installer/supervisor lock. Process observation never sends a termination signal. */
+import { randomUUID } from "node:crypto";
+import { closeSync, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readSync, rmdirSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { execFile } from "./child-process.js";
+import { paneSystemBootId } from "./runtime-pane-boot.js";
+import { nativeCliEnvironment } from "./windows-cli-worker.js";
+export const RUNTIME_INSTALL_LOCK = ".agend-runtime-install.lock";
+export class RuntimeInstallLockError extends Error {
+    reason;
+    constructor(reason) {
+        super(`Runtime install lock ${reason}`);
+        this.reason = reason;
+    }
+}
+const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;
+function proof(value) {
+    const p = value;
+    return !!p && Number.isSafeInteger(p.pid) && p.pid > 0 && typeof p.birth === "string" && /^\d{17,20}$/.test(p.birth) && typeof p.boot === "string" && /^[a-f0-9]{64}$/.test(p.boot);
+}
+export function parseRuntimeInstallLock(value) {
+    const v = value;
+    if (!proof(v) || !v || Array.isArray(v) || Object.keys(v).length !== 6 || Object.keys(v).some(k => !["version", "type", "nonce", "pid", "birth", "boot"].includes(k))
+        || v.version !== 1 || !["installer", "supervisor"].includes(v.type) || typeof v.nonce !== "string" || !UUID.test(v.nonce))
+        throw new RuntimeInstallLockError("unsafe");
+    return { version: 1, type: v.type, nonce: v.nonce, pid: v.pid, birth: v.birth, boot: v.boot };
+}
+/** Fixed local query; no command line, profile, account, credential or response-provided program is read. */
+export async function observeRuntimeProcess(pid) {
+    if (process.platform !== "win32" || !Number.isSafeInteger(pid) || pid < 1)
+        return { state: "unknown" };
+    try {
+        process.kill(pid, 0);
+    }
+    catch (error) {
+        return { state: error.code === "ESRCH" ? "gone" : "unknown" };
+    }
+    try {
+        const script = `$ErrorActionPreference='Stop'; $ProgressPreference='SilentlyContinue'; $p=Get-Process -Id ${pid} -ErrorAction Stop; $o=Get-CimInstance Win32_OperatingSystem -ErrorAction Stop; [Console]::Write((@{birth=[string]$p.StartTime.ToUniversalTime().Ticks;boot=[string]$o.LastBootUpTime.ToUniversalTime().Ticks}|ConvertTo-Json -Compress))`;
+        const result = await promisify(execFile)(join(process.env.SystemRoot || "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe"), ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], { timeout: 10_000, maxBuffer: 4096, windowsHide: true, env: nativeCliEnvironment() });
+        const value = JSON.parse(result.stdout.trim()), candidate = { pid, birth: value.birth, boot: paneSystemBootId(value.boot) };
+        return proof(candidate) ? { state: "alive", proof: candidate } : { state: "unknown" };
+    }
+    catch {
+        return { state: "unknown" };
+    }
+}
+export function runtimeProcessMatches(expected, observed) {
+    if (!proof(expected) || observed.state === "unknown")
+        return undefined;
+    if (observed.state === "gone")
+        return false;
+    if (!proof(observed.proof) || observed.proof.pid !== expected.pid)
+        return undefined;
+    return observed.proof.birth === expected.birth && observed.proof.boot === expected.boot;
+}
+function sameFile(a, b) { return a.ino === b.ino && a.dev === b.dev && a.uid === b.uid; }
+export function assertRuntimeInstallDirectory(path) {
+    const stat = lstatSync(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || process.getuid && (stat.uid !== process.getuid() || (stat.mode & 0o022)))
+        throw new RuntimeInstallLockError("unsafe");
+    return stat;
+}
+/** Only ENOENT is absence; malformed, writable or changed files never become an empty installation. */
+export function readRuntimeInstallBytes(path, max = 8192) {
+    if (!Number.isSafeInteger(max) || max < 1 || max > 8 * 1024 * 1024)
+        throw new RuntimeInstallLockError("unsafe");
+    let before;
+    try {
+        before = lstatSync(path);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+    if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1 || before.size > max || process.getuid && (before.uid !== process.getuid() || (before.mode & 0o022)))
+        throw new RuntimeInstallLockError("unsafe");
+    const fd = openSync(path, "r");
+    try {
+        const opened = fstatSync(fd);
+        if (!sameFile(before, opened) || opened.nlink !== 1 || opened.size > max)
+            throw new RuntimeInstallLockError("changed");
+        const bytes = Buffer.alloc(max + 1);
+        let length = 0, count;
+        while (length < bytes.length && (count = readSync(fd, bytes, length, bytes.length - length, null)) > 0)
+            length += count;
+        if (length > max || !sameFile(opened, lstatSync(path)))
+            throw new RuntimeInstallLockError("changed");
+        return { bytes: bytes.subarray(0, length), stat: opened };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export function readRuntimeInstallFile(path, max = 8192) {
+    const result = readRuntimeInstallBytes(path, max);
+    return result ? { text: new TextDecoder("utf-8", { fatal: true }).decode(result.bytes), stat: result.stat } : undefined;
+}
+function snapshot(path) {
+    const directory = assertRuntimeInstallDirectory(path), file = readRuntimeInstallFile(join(path, "owner.json"), 2048);
+    if (!file)
+        throw new RuntimeInstallLockError("unknown");
+    return { directory, record: parseRuntimeInstallLock(JSON.parse(file.text)), text: file.text, file: file.stat };
+}
+function current(path, expected) {
+    const now = snapshot(path);
+    return sameFile(now.directory, expected.directory) && sameFile(now.file, expected.file) && now.text === expected.text;
+}
+export async function acquireRuntimeInstallLock(root, options = {}) {
+    assertRuntimeInstallDirectory(root);
+    const type = options.type ?? "supervisor";
+    if (type !== "installer" && type !== "supervisor")
+        throw new RuntimeInstallLockError("unsafe");
+    const observe = options.observe ?? observeRuntimeProcess;
+    const own = options.ownProof ? { state: "alive", proof: options.ownProof } : await observe(process.pid);
+    if (own.state !== "alive" || !proof(own.proof) || own.proof.pid !== process.pid)
+        throw new RuntimeInstallLockError("unknown");
+    const path = join(root, RUNTIME_INSTALL_LOCK);
+    let created = false;
+    try {
+        mkdirSync(path, { mode: 0o700 });
+        created = true;
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+    }
+    if (!created) {
+        const before = snapshot(path), match = runtimeProcessMatches(before.record, await observe(before.record.pid));
+        if (match !== false)
+            throw new RuntimeInstallLockError(match ? "held" : "unknown");
+        const reclaim = join(path, "reclaim");
+        try {
+            mkdirSync(reclaim, { mode: 0o700 });
+        }
+        catch {
+            throw new RuntimeInstallLockError("held");
+        }
+        const guard = lstatSync(reclaim);
+        try {
+            if (!current(path, before))
+                throw new RuntimeInstallLockError("changed");
+            if (readdirSync(path).some(name => name !== "owner.json" && name !== "reclaim"))
+                throw new RuntimeInstallLockError("held");
+            unlinkSync(join(path, "owner.json"));
+            rmdirSync(reclaim);
+            rmdirSync(path);
+        }
+        finally {
+            try {
+                if (sameFile(lstatSync(reclaim), guard))
+                    rmdirSync(reclaim);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+        }
+        // Another acquirer may win after the stale directory is removed. Never remove or overwrite its new owner.
+        try {
+            mkdirSync(path, { mode: 0o700 });
+            created = true;
+        }
+        catch {
+            throw new RuntimeInstallLockError("held");
+        }
+    }
+    const record = { version: 1, type, nonce: randomUUID(), pid: own.proof.pid, birth: own.proof.birth, boot: own.proof.boot };
+    try {
+        writeFileSync(join(path, "owner.json"), JSON.stringify(record), { flag: "wx", mode: 0o600 });
+    }
+    catch (error) {
+        try {
+            rmdirSync(path);
+        }
+        catch { }
+        throw error;
+    }
+    let owned = snapshot(path), released = false;
+    const assert = () => { if (released || !current(path, owned))
+        throw new RuntimeInstallLockError("changed"); };
+    return { record, assert, release: () => {
+            if (released)
+                return;
+            assert();
+            // A concurrent stale observer may briefly own a reclamation marker. Retain this lease and permit a later retry.
+            try {
+                lstatSync(join(path, "reclaim"));
+                throw new RuntimeInstallLockError("held");
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+            if (readdirSync(path).some(name => name !== "owner.json"))
+                throw new RuntimeInstallLockError("held");
+            unlinkSync(join(path, "owner.json"));
+            try {
+                rmdirSync(path);
+                released = true;
+            }
+            catch (error) {
+                // A failed directory removal must not silently discard this process's ownership or prevent a positive retry.
+                try {
+                    if (sameFile(lstatSync(path), owned.directory) && !readRuntimeInstallFile(join(path, "owner.json"))) {
+                        writeFileSync(join(path, "owner.json"), owned.text, { flag: "wx", mode: 0o600 });
+                        owned = snapshot(path);
+                    }
+                }
+                catch { /* absence/changed ownership remains unconfirmed, never a successful release */ }
+                throw error;
+            }
+        } };
+}
+//# sourceMappingURL=runtime-update-lock.js.map

package/dist/runtime-update-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-update-lock.js","sourceRoot":"","sources":["../src/runtime-update-lock.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAc,MAAM,SAAS,CAAC;AACxJ,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAIlE,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAAwB,MAAM;IAA3B,YAAqB,MAAiD;QAAI,KAAK,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC;sBAA7F,MAAM;IAAwF,CAAC;CAAE;AAC3K,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAC/E,SAAS,KAAK,CAAC,KAAc;IAC3B,MAAM,CAAC,GAAG,KAA4B,CAAC;IACvC,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACtL,CAAC;AACD,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,MAAM,CAAC,GAAG,KAAiC,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;WAChK,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACzK,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAChG,CAAC;AACD,6GAA6G;AAC7G,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAW;IACrD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACvG,IAAI,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAC3C,OAAO,EAAE,KAAK,EAAG,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,6FAA6F,GAAG,2OAA2O,CAAC;QAC3V,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAC/I,CAAC,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EACvG,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACxF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5H,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAAC,CAAC;AAC1C,CAAC;AACD,MAAM,UAAU,qBAAqB,CAAC,QAA6B,EAAE,QAAmC;IACtG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACvE,IAAI,QAAQ,CAAC,KAAK,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IACpF,OAAO,QAAQ,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC;AAC1F,CAAC;AACD,SAAS,QAAQ,CAAC,CAAQ,EAAE,CAAQ,IAAa,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAChH,MAAM,UAAU,6BAA6B,CAAC,IAAY;IACxD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC1K,OAAO,IAAI,CAAC;AACd,CAAC;AACD,uGAAuG;AACvG,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,GAAG,GAAG,IAAI;IAC9D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;QAAE,MAAM,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAChH,IAAI,MAAa,CAAC;IAClB,IAAI,CAAC;QAAC,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;IAC1I,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,GAAG,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACxN,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,GAAG;YAAE,MAAM,IAAI,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACrJ,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAAC,IAAI,MAAM,GAAG,CAAC,EAAE,KAAa,CAAC;QACnE,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC;QACxH,IAAI,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACrG,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC5D,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AAC9B,CAAC;AACD,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,GAAG,GAAG,IAAI;IAC7D,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1H,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,SAAS,GAAG,6BAA6B,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;IACrH,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AACjH,CAAC;AACD,SAAS,OAAO,CAAC,IAAY,EAAE,QAAkB;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC;AACxH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAAY,EAAE,OAAO,GAIjE,EAAE;IACJ,6BAA6B,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC;IAC1C,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,YAAY;QAAE,MAAM,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,qBAAqB,CAAC;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAgB,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjH,IAAI,GAAG,CAAC,KAAK,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;QAAE,MAAM,IAAI,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAC9H,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC9C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QAAC,SAAS,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,OAAO,GAAG,IAAI,CAAC;IAAC,CAAC;IACzD,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IAAC,CAAC;IACtF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9G,IAAI,KAAK,KAAK,KAAK;YAAE,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC;YAAC,SAAS,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QACjG,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;gBAAE,MAAM,IAAI,uBAAuB,CAAC,SAAS,CAAC,CAAC;YACzE,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,SAAS,CAAC;gBAAE,MAAM,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAC3H,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;YAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5E,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;oBAAE,SAAS,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YACpE,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;YAAC,CAAC;QACxF,CAAC;QACD,0GAA0G;QAC1G,IAAI,CAAC;YAAC,SAAS,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;IAChH,CAAC;IACD,MAAM,MAAM,GAA6B,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACrJ,IAAI,CAAC;QAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAAC,CAAC;IACrG,OAAO,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;IAChE,IAAI,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC7C,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9G,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE;YACrC,IAAI,QAAQ;gBAAE,OAAO;YACrB,MAAM,EAAE,CAAC;YACT,gHAAgH;YAChH,IAAI,CAAC;gBAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;gBAAC,MAAM,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAAC,CAAC;YACpF,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;YAAC,CAAC;YACtF,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,CAAC;gBAAE,MAAM,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;YACrG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC;gBAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,CAAC;YACzC,OAAO,KAAK,EAAE,CAAC;gBACb,6GAA6G;gBAC7G,IAAI,CAAC;oBACH,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;wBACpG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;wBAAC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAC3G,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAC,+EAA+E,CAAC,CAAC;gBAC3F,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,EAAE,CAAC;AACN,CAAC"}

package/dist/runtime-update-owners.d.ts

@@ -0,0 +1,29 @@
+import { type RuntimeInstallLock, type RuntimeProcessObservation, type RuntimeProcessProof } from "./runtime-update-lock.js";
+export interface RuntimeInstallOwner {
+    version: 1;
+    id: string;
+    installId: string;
+    origin: string;
+    parent: RuntimeProcessProof;
+    child?: RuntimeProcessProof;
+}
+export declare class RuntimeInstallOwnerError extends Error {
+    readonly reason: "unsafe" | "changed" | "shared" | "owned" | "unknown" | "unmanaged";
+    constructor(reason: "unsafe" | "changed" | "shared" | "owned" | "unknown" | "unmanaged");
+}
+export declare function parseRuntimeInstallOwner(value: unknown): RuntimeInstallOwner;
+/** Must commit BEFORE spawning; the child remains IPC-gated until its exact proof is committed below. */
+export declare function registerRuntimeInstallOwner(root: string, origin: string, lock: RuntimeInstallLock, observe?: (pid: number) => Promise<RuntimeProcessObservation>): Promise<RuntimeInstallOwner>;
+export declare function attachRuntimeInstallChild(root: string, expected: RuntimeInstallOwner, child: RuntimeProcessProof, lock: RuntimeInstallLock, observe?: (pid: number) => Promise<RuntimeProcessObservation>): Promise<RuntimeInstallOwner>;
+/** Other live supervisors (even for the same origin), retained children and unknown observations defer. */
+export declare function assertRuntimeInstallExclusive(root: string, expected: RuntimeInstallOwner, lock: RuntimeInstallLock, observe?: (pid: number) => Promise<RuntimeProcessObservation>): Promise<void>;
+export declare function releaseRuntimeInstallOwner(root: string, expected: RuntimeInstallOwner, lock: RuntimeInstallLock, observe?: (pid: number) => Promise<RuntimeProcessObservation>): Promise<void>;
+/** Read-only recovery evidence. Possessing a row never grants process or update authority. */
+export declare function readRuntimeInstallOwner(root: string, id: string): RuntimeInstallOwner;
+/** An already registered child may adopt its own row only after positive parent absence.
+ * Used by the temporary handoff helper and by a task-capable candidate whose helper died;
+ * IPC loss and an unknown observation are never proof of parent exit. */
+export declare function adoptRuntimeInstallOwner(root: string, expected: RuntimeInstallOwner, lock: RuntimeInstallLock, observe?: (pid: number) => Promise<RuntimeProcessObservation>): Promise<RuntimeInstallOwner>;
+/** After positive activation, the helper transfers ownership to the exact registered live child.
+ * The child independently verifies the resulting row before starting its next update loop. */
+export declare function transferRuntimeInstallOwner(root: string, expected: RuntimeInstallOwner, lock: RuntimeInstallLock, observe?: (pid: number) => Promise<RuntimeProcessObservation>): Promise<RuntimeInstallOwner>;