@timurproko/a1 0.2.7-dev.1249 → 0.2.7-dev.1255

package/dist/foundation/release/cohort-selection.js

@@ -1,67 +0,0 @@
-export function selectCohortLaunch(candidate, state, endpoint, probe) {
-    if (endpoint && probe === "live-verified") {
-        const retained = state.releases[endpoint.releaseId];
-        if (!retained || retained.releaseRoot !== endpoint.releaseRoot || retained.contentDigest !== endpoint.contentDigest) {
-            return {
-                action: "blocked",
-                releaseId: endpoint.releaseId,
-                releaseRoot: endpoint.releaseRoot,
-                reason: "live supervisor identity does not match a retained verified release record",
-                pid: endpoint.pid,
-            };
-        }
-        if (endpoint.releaseId !== candidate.releaseId && endpoint.ownership.liveInstanceIds.length === 0) {
-            return {
-                action: "replace-idle-cohort",
-                releaseId: candidate.releaseId,
-                releaseRoot: candidate.releaseRoot,
-                reason: "older cohort is idle and can release ownership for verified candidate activation",
-                pid: endpoint.pid,
-            };
-        }
-        return {
-            action: "launch-retained-ui",
-            releaseId: endpoint.releaseId,
-            releaseRoot: endpoint.releaseRoot,
-            reason: endpoint.releaseId === candidate.releaseId
-                ? "live supervisor already owns the installed release cohort"
-                : "live supervisor owns a non-resumable generation; candidate remains pending",
-            recordPending: endpoint.releaseId !== candidate.releaseId,
-        };
-    }
-    if (endpoint && probe === "unresponsive") {
-        // Security: even an empty persisted list cannot authorize killing an unresponsive process.
-        return {
-            action: "blocked",
-            releaseId: endpoint.releaseId,
-            releaseRoot: endpoint.releaseRoot,
-            reason: "the background service did not respond after automatic recovery; retry shortly",
-            pid: endpoint.pid,
-        };
-    }
-    if (endpoint && probe === "identity-mismatch") {
-        return {
-            action: "blocked",
-            releaseId: endpoint.releaseId,
-            releaseRoot: endpoint.releaseRoot,
-            reason: "endpoint handshake, boot nonce, or process start identity did not match durable ownership metadata",
-            pid: endpoint.pid,
-        };
-    }
-    const active = state.references.active ? state.releases[state.references.active] : undefined;
-    const approvedCandidate = state.releases[candidate.releaseId]?.approval === "approved";
-    if (approvedCandidate || !active) {
-        return {
-            action: "activate-candidate",
-            releaseId: candidate.releaseId,
-            releaseRoot: candidate.releaseRoot,
-            reason: approvedCandidate ? "approved candidate can become the active cohort" : "initial verified release can be certified and activated",
-        };
-    }
-    return {
-        action: "start-active",
-        releaseId: active.releaseId,
-        releaseRoot: active.releaseRoot,
-        reason: "candidate is not approved; retaining the active release",
-    };
-}

package/dist/foundation/release/endpoint-lock.d.ts

@@ -1,2 +0,0 @@
-/** Serialize endpoint publication and retirement using a lock released by the OS on process death. */
-export declare function withEndpointLock<T>(metadataPath: string, operation: () => Promise<T>): Promise<T>;

package/dist/foundation/release/endpoint-lock.js

@@ -1,37 +0,0 @@
-import { mkdir, realpath } from "node:fs/promises";
-import { basename, dirname, join } from "node:path";
-import { setTimeout as delay } from "node:timers/promises";
-import { acquireSupervisorGate } from "./supervisor-identity.js";
-/** Serialize endpoint publication and retirement using a lock released by the OS on process death. */
-export async function withEndpointLock(metadataPath, operation) {
-    let authority;
-    try {
-        await mkdir(dirname(metadataPath), { recursive: true, mode: 0o700 });
-        authority = join(await realpath(dirname(metadataPath)), `${basename(metadataPath)}.authority`);
-    }
-    catch (cause) {
-        throw Object.assign(new Error("cannot access A1 startup state; check runtime-directory permissions and free disk space", { cause }), { code: "SUPERVISOR_RECOVERY_UNAVAILABLE" });
-    }
-    const deadline = Date.now() + 3_000;
-    for (;;) {
-        let gate;
-        try {
-            gate = acquireSupervisorGate(authority);
-        }
-        catch (cause) {
-            throw Object.assign(new Error("cannot access A1 startup coordination; check installation and runtime-directory permissions", { cause }), { code: "SUPERVISOR_RECOVERY_UNAVAILABLE" });
-        }
-        if (gate.acquired) {
-            try {
-                return await operation();
-            }
-            finally {
-                gate.release();
-            }
-        }
-        gate.release();
-        if (Date.now() >= deadline)
-            throw Object.assign(new Error("another A1 startup is still preparing; retry shortly"), { code: "SUPERVISOR_RECOVERY_BUSY" });
-        await delay(20);
-    }
-}

package/dist/foundation/release/endpoint-recovery.d.ts

@@ -1,10 +0,0 @@
-import type { SupervisorEndpointMetadata } from "./cohort-state.js";
-interface SupervisorRecoveryOptions {
-    readonly metadataPath: string;
-    readonly endpoint: string;
-    readonly matches: (metadata: SupervisorEndpointMetadata) => boolean;
-    readonly startAndWait: () => Promise<void>;
-}
-/** Recover all launch routes identically; a retry never grants permission to kill a live process. */
-export declare function recoverSupervisorEndpoint(options: SupervisorRecoveryOptions): Promise<void>;
-export {};

package/dist/foundation/release/endpoint-recovery.js

@@ -1,45 +0,0 @@
-import { writeFile } from "node:fs/promises";
-import { probeOwnership, readEndpointMetadata, removeEndpointArtifacts } from "./endpoints.js";
-/** Recover all launch routes identically; a retry never grants permission to kill a live process. */
-export async function recoverSupervisorEndpoint(options) {
-    const { metadataPath, endpoint } = options;
-    let recovered = false;
-    for (let attempt = 0; attempt < 3; attempt++) {
-        const metadata = await readEndpointMetadata(metadataPath);
-        if (metadata) {
-            const probe = await probeOwnership(metadata);
-            if (probe === "live-verified" && options.matches(metadata)) {
-                if (recovered)
-                    await diagnostic(metadataPath, "recovered", attempt + 1);
-                return;
-            }
-            // Concurrency: another owner may have published while an earlier identity probe was pending.
-            if (JSON.stringify(await readEndpointMetadata(metadataPath)) !== JSON.stringify(metadata))
-                continue;
-            if (probe !== "dead") {
-                await diagnostic(metadataPath, probe, attempt + 1);
-                throw Object.assign(new Error(probe === "unresponsive"
-                    ? "A1's background service is not responding; retry shortly. Your sessions have been preserved."
-                    : "A1's background service identity changed; retry startup. Your sessions have been preserved."), {
-                    code: "SUPERVISOR_RECOVERY_BLOCKED",
-                });
-            }
-            recovered = true;
-            if (!await removeEndpointArtifacts(metadataPath, endpoint, metadata))
-                continue;
-            await diagnostic(metadataPath, "stale-owner-retired", attempt + 1);
-        }
-        // Concurrency: the child takes the same endpoint gate before binding/publication. If another launch wins,
-        // startAndWait joins its authenticated endpoint; it never unlinks that winner's socket.
-        await options.startAndWait();
-        if (recovered)
-            await diagnostic(metadataPath, "recovered", attempt + 1);
-        return;
-    }
-    await diagnostic(metadataPath, "ownership-changing", 3);
-    throw Object.assign(new Error("A1 startup changed repeatedly; retry shortly"), { code: "SUPERVISOR_RECOVERY_BUSY" });
-}
-async function diagnostic(path, reason, attempts) {
-    // Security: one bounded summary per endpoint, no raw metadata, user paths, or session content.
-    await writeFile(`${path}.recovery.json`, JSON.stringify({ reason, attempts, at: new Date().toISOString() }), { mode: 0o600 }).catch(() => undefined);
-}

package/dist/foundation/release/endpoints.d.ts

@@ -1,32 +0,0 @@
-import type { OwnershipProbe } from "./cohort-selection.js";
-import { type ObserveSupervisorProcess } from "./supervisor-identity.js";
-import type { SupervisorEndpointMetadata } from "./cohort-state.js";
-import type { CohortEndpointPaths, ProductPaths } from "../lifecycle/index.js";
-export interface RecordedEndpoint {
-    readonly metadata: SupervisorEndpointMetadata;
-    readonly paths: CohortEndpointPaths;
-}
-/**
- * Every endpoint recorded under this runtime directory: one per cohort, plus the single
- * endpoint published by releases that predate cohort-scoped identity. More than one can be
- * live at a time, and each is validated on its own identity rather than by being the only one.
- */
-export declare function listRecordedEndpoints(paths: ProductPaths): Promise<readonly RecordedEndpoint[]>;
-/**
- * Removes the records of cohorts whose processes are gone. A record left by a cohort that
- * exited without cleaning up is not evidence of ownership, and a later launch should not have
- * to reason about it. Returns the release ids whose records were removed.
- */
-export declare function sweepDeadEndpoints(paths: ProductPaths): Promise<readonly string[]>;
-/** The releases that an identity-verified live cohort runs from and that must be retained. */
-export declare function liveReleaseIds(paths: ProductPaths): Promise<readonly string[]>;
-export declare function readEndpointMetadata(path: string): Promise<SupervisorEndpointMetadata | null>;
-export interface OwnershipProbeOptions {
-    readonly observe?: ObserveSupervisorProcess;
-    readonly attempts?: number;
-    readonly timeoutMs?: number;
-}
-/** Reprobe transient failures; only native absence or a replaced generation establishes death. */
-export declare function probeOwnership(metadata: SupervisorEndpointMetadata, options?: OwnershipProbeOptions): Promise<OwnershipProbe>;
-/** Retire only a still-dead exact publication. Socket removal belongs to the gated listener. */
-export declare function removeEndpointArtifacts(metadataPath: string, endpoint: string, expected: SupervisorEndpointMetadata): Promise<boolean>;

package/dist/foundation/release/endpoints.js

@@ -1,152 +0,0 @@
-import { readdir, readFile, rm } from "node:fs/promises";
-import { connect } from "node:net";
-import { resolve } from "node:path";
-import { PRODUCT_IDENTITY } from "../../product-identity.js";
-import { encodeFrame, LineFrameDecoder } from "../protocol/index.js";
-import { supervisorProcessState } from "./supervisor-identity.js";
-import { withEndpointLock } from "./endpoint-lock.js";
-/**
- * Every endpoint recorded under this runtime directory: one per cohort, plus the single
- * endpoint published by releases that predate cohort-scoped identity. More than one can be
- * live at a time, and each is validated on its own identity rather than by being the only one.
- */
-export async function listRecordedEndpoints(paths) {
-    const recorded = [];
-    // Compatibility: a cohort listener passes its scoped paths here; legacy discovery still
-    // names the runtime directory's fixed metadata path, not that listener's own record.
-    const legacyPath = resolve(paths.runtimeDir, PRODUCT_IDENTITY.endpoint.metadataFilename);
-    const legacy = await readEndpointMetadata(legacyPath);
-    if (legacy) {
-        recorded.push({ metadata: legacy, paths: { endpoint: legacy.endpoint, endpointMetadataPath: legacyPath } });
-    }
-    const names = await readdir(paths.endpointsDir).catch(() => []);
-    for (const name of names) {
-        if (!name.endsWith(".json"))
-            continue;
-        const endpointMetadataPath = resolve(paths.endpointsDir, name);
-        const metadata = await readEndpointMetadata(endpointMetadataPath);
-        if (metadata)
-            recorded.push({ metadata, paths: { endpoint: metadata.endpoint, endpointMetadataPath } });
-    }
-    return recorded;
-}
-/**
- * Removes the records of cohorts whose processes are gone. A record left by a cohort that
- * exited without cleaning up is not evidence of ownership, and a later launch should not have
- * to reason about it. Returns the release ids whose records were removed.
- */
-export async function sweepDeadEndpoints(paths) {
-    const swept = [];
-    for (const recorded of await listRecordedEndpoints(paths)) {
-        if (await supervisorProcessState(recorded.metadata) !== "gone")
-            continue;
-        if (await removeEndpointArtifacts(recorded.paths.endpointMetadataPath, recorded.paths.endpoint, recorded.metadata)) {
-            swept.push(recorded.metadata.releaseId);
-        }
-    }
-    return swept;
-}
-/** The releases that an identity-verified live cohort runs from and that must be retained. */
-export async function liveReleaseIds(paths) {
-    const recorded = await listRecordedEndpoints(paths);
-    const ownership = await Promise.all(recorded.map(async (endpoint) => ({
-        releaseId: endpoint.metadata.releaseId,
-        probe: await probeOwnership(endpoint.metadata),
-    })));
-    return [...new Set(ownership.filter(item => item.probe === "live-verified").map(item => item.releaseId))].sort();
-}
-export async function readEndpointMetadata(path) {
-    try {
-        const value = JSON.parse(await readFile(path, "utf8"));
-        const ownership = value.ownership;
-        const liveInstanceIds = Array.isArray(ownership?.liveInstanceIds)
-            ? ownership.liveInstanceIds
-            : Array.isArray(ownership?.liveGenerationIds) ? ownership.liveGenerationIds : null;
-        const nonResumableInstanceIds = Array.isArray(ownership?.nonResumableInstanceIds)
-            ? ownership.nonResumableInstanceIds
-            : Array.isArray(ownership?.nonResumableGenerationIds) ? ownership.nonResumableGenerationIds : null;
-        const uncertainInstanceIds = Array.isArray(ownership?.uncertainInstanceIds) ? ownership.uncertainInstanceIds : [];
-        if (!value || value.schema !== PRODUCT_IDENTITY.protocol.supervisorSchema || typeof value.supervisorId !== "string" || typeof value.endpoint !== "string" || !Number.isSafeInteger(value.pid)
-            || typeof value.pidStartIdentity !== "string" || typeof value.bootNonce !== "string" || typeof value.releaseId !== "string"
-            || typeof value.releaseRoot !== "string" || typeof value.contentDigest !== "string" || !ownership
-            || !isStringArray(liveInstanceIds) || !isStringArray(nonResumableInstanceIds) || !isStringArray(uncertainInstanceIds)) {
-            return null;
-        }
-        return {
-            ...value,
-            ownership: {
-                ...ownership,
-                liveInstanceIds,
-                nonResumableInstanceIds,
-                uncertainInstanceIds,
-            },
-        };
-    }
-    catch {
-        return null;
-    }
-}
-/** Reprobe transient failures; only native absence or a replaced generation establishes death. */
-export async function probeOwnership(metadata, options = {}) {
-    const attempts = options.attempts ?? 3;
-    for (let attempt = 0; attempt < attempts; attempt++) {
-        const identity = await requestIdentity(metadata.endpoint, options.timeoutMs ?? 500);
-        if (identity) {
-            return identity.supervisorId === metadata.supervisorId
-                && identity.bootNonce === metadata.bootNonce
-                && identity.pidStartIdentity === metadata.pidStartIdentity
-                && identity.releaseId === metadata.releaseId
-                ? "live-verified" : "identity-mismatch";
-        }
-        if (await supervisorProcessState(metadata, options.observe) === "gone")
-            return "dead";
-        if (attempt + 1 < attempts)
-            await new Promise(resolvePromise => setTimeout(resolvePromise, 50));
-    }
-    return "unresponsive";
-}
-async function requestIdentity(endpoint, timeoutMs) {
-    return await new Promise(resolvePromise => {
-        const socket = connect(endpoint);
-        const decoder = new LineFrameDecoder();
-        let settled = false;
-        const finish = (value) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timer);
-            socket.destroy();
-            resolvePromise(value);
-        };
-        socket.once("error", () => finish(null));
-        socket.once("connect", () => socket.write(encodeFrame({ type: "identity-probe" })));
-        socket.on("data", chunk => {
-            try {
-                const message = decoder.push(chunk)[0];
-                if (message?.type === "identity" && typeof message.supervisorId === "string" && typeof message.bootNonce === "string"
-                    && typeof message.pidStartIdentity === "string" && typeof message.releaseId === "string") {
-                    finish({ supervisorId: message.supervisorId, bootNonce: message.bootNonce, pidStartIdentity: message.pidStartIdentity, releaseId: message.releaseId });
-                }
-            }
-            catch {
-                finish(null);
-            }
-        });
-        const timer = setTimeout(() => finish(null), timeoutMs);
-    });
-}
-function isStringArray(value) {
-    return Array.isArray(value) && value.every(item => typeof item === "string" && item.length > 0);
-}
-/** Retire only a still-dead exact publication. Socket removal belongs to the gated listener. */
-export async function removeEndpointArtifacts(metadataPath, endpoint, expected) {
-    return await withEndpointLock(metadataPath, async () => {
-        const current = await readEndpointMetadata(metadataPath);
-        if (!current || current.endpoint !== endpoint || JSON.stringify(current) !== JSON.stringify(expected))
-            return false;
-        if (await supervisorProcessState(current) !== "gone" || await probeOwnership(current, { attempts: 1 }) !== "dead")
-            return false;
-        await rm(metadataPath, { force: true });
-        return true;
-    });
-}

package/dist/foundation/release/prepared-update-activation.d.ts

@@ -1,3 +0,0 @@
-import { type UpdateActivationCallbacks, type UpdateActivationRequest } from "./update-activation.js";
-/** Retry only the selection boundary for an exact candidate already materialized and certified. */
-export declare function activatePreparedRelease(request: Omit<UpdateActivationRequest, "packageRoot">, callbacks: UpdateActivationCallbacks): Promise<void>;

package/dist/foundation/release/prepared-update-activation.js

@@ -1,27 +0,0 @@
-import { resolve } from "node:path";
-import { PRODUCT_IDENTITY } from "../../product-identity.js";
-import { assertContinuityOrBlock } from "./update-activation.js";
-import { ensureSupervisor } from "./bootstrap.js";
-import { CohortStateStore } from "./cohort-state.js";
-import { resolveProductPaths } from "../lifecycle/index.js";
-import { readCertifiedReleaseManifest } from "./release-store.js";
-/** Retry only the selection boundary for an exact candidate already materialized and certified. */
-export async function activatePreparedRelease(request, callbacks) {
-    const stateStore = new CohortStateStore(request.dataDir);
-    const state = await stateStore.read();
-    const releaseId = state.references.pending;
-    const record = releaseId === null ? undefined : state.releases[releaseId];
-    if (record === undefined || record.approval !== "approved" || record.packageVersion !== request.targetVersion
-        || state.references.approved !== releaseId) {
-        throw new Error(`no certified prepared release matches target ${request.targetVersion}`);
-    }
-    const candidate = await readCertifiedReleaseManifest(record, resolve(request.dataDir, "releases"));
-    const paths = resolveProductPaths(request.environment);
-    const continuity = { releaseRoot: candidate.releaseRoot, dataDir: request.dataDir, environment: request.environment,
-        profileRoot: request.environment[PRODUCT_IDENTITY.environment.profileHome] ?? paths.configDir, runtimeDir: paths.runtimeDir };
-    await assertContinuityOrBlock(continuity);
-    await ensureSupervisor(candidate, request.environment);
-    await assertContinuityOrBlock(continuity);
-    await stateStore.activate(candidate.releaseId);
-    await callbacks.phase("active-reference-committed");
-}

package/dist/foundation/release/process-cleanup.d.ts

@@ -1,14 +0,0 @@
-import type { SupervisorEndpointMetadata } from "./cohort-state.js";
-export interface CleanupDiagnostics {
-    readonly pid: number;
-    readonly attempted: readonly string[];
-    readonly terminated: boolean;
-    readonly elapsedMs: number;
-}
-export declare function processIsAlive(pid: number): boolean;
-export declare function cleanupProvenIdleOwner(metadata: SupervisorEndpointMetadata, graceMs?: number): Promise<CleanupDiagnostics>;
-export declare function cleanupVerifiedOwner(metadata: SupervisorEndpointMetadata, options?: {
-    readonly graceMs?: number;
-    readonly allowLiveInstances?: boolean;
-    readonly reason?: "stale-idle-owner" | "explicit-update" | "legacy-mutable-install";
-}): Promise<CleanupDiagnostics>;

package/dist/foundation/release/process-cleanup.js

@@ -1,76 +0,0 @@
-import { spawn } from "node:child_process";
-import { supervisorProcessState } from "./supervisor-identity.js";
-export function processIsAlive(pid) {
-    if (!Number.isSafeInteger(pid) || pid <= 0)
-        return false;
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (error) {
-        return error instanceof Error && "code" in error && error.code === "EPERM";
-    }
-}
-export async function cleanupProvenIdleOwner(metadata, graceMs = 1_500) {
-    return await cleanupVerifiedOwner(metadata, { graceMs, allowLiveInstances: false });
-}
-export async function cleanupVerifiedOwner(metadata, options = {}) {
-    const graceMs = options.graceMs ?? 1_500;
-    if (!options.allowLiveInstances && (metadata.ownership.liveInstanceIds.length > 0 || metadata.ownership.nonResumableInstanceIds.length > 0 || metadata.ownership.uncertainInstanceIds.length > 0)) {
-        throw new Error("refusing to terminate an owner with recorded live generations");
-    }
-    const started = Date.now();
-    const attempted = [];
-    const state = await supervisorProcessState(metadata);
-    if (state === "gone")
-        return { pid: metadata.pid, attempted: ["owner-already-dead"], terminated: true, elapsedMs: Date.now() - started };
-    // Security: ordinary recovery never signals a live owner, even with an empty durable list.
-    // Explicit update cleanup also needs the exact native generation, not merely an old handshake.
-    if (!options.allowLiveInstances || state !== "same") {
-        return { pid: metadata.pid, attempted: ["live-owner-preserved"], terminated: false, elapsedMs: Date.now() - started };
-    }
-    attempted.push("graceful-termination");
-    await terminate(metadata.pid, false);
-    if (await waitUntilDead(metadata.pid, graceMs))
-        return { pid: metadata.pid, attempted, terminated: true, elapsedMs: Date.now() - started };
-    if (await supervisorProcessState(metadata) !== "same") {
-        return { pid: metadata.pid, attempted, terminated: await supervisorProcessState(metadata) === "gone", elapsedMs: Date.now() - started };
-    }
-    attempted.push("forced-process-tree-termination");
-    await terminate(metadata.pid, true);
-    const terminated = await waitUntilDead(metadata.pid, graceMs);
-    return { pid: metadata.pid, attempted, terminated, elapsedMs: Date.now() - started };
-}
-async function terminate(pid, force) {
-    if (process.platform === "win32") {
-        await new Promise(resolvePromise => {
-            const child = spawn("taskkill.exe", ["/PID", String(pid), "/T", ...(force ? ["/F"] : [])], {
-                shell: false,
-                windowsHide: true,
-                stdio: "ignore",
-            });
-            child.once("error", () => resolvePromise());
-            child.once("close", () => resolvePromise());
-        });
-        return;
-    }
-    const signal = force ? "SIGKILL" : "SIGTERM";
-    try {
-        process.kill(-pid, signal);
-    }
-    catch {
-        try {
-            process.kill(pid, signal);
-        }
-        catch { }
-    }
-}
-async function waitUntilDead(pid, timeoutMs) {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-        if (!processIsAlive(pid))
-            return true;
-        await new Promise(resolvePromise => setTimeout(resolvePromise, 25));
-    }
-    return !processIsAlive(pid);
-}

package/dist/foundation/release/supervisor-identity.d.ts

@@ -1,15 +0,0 @@
-import type { NativeProcessIdentity } from "../lifecycle/index.js";
-import type { SupervisorEndpointMetadata } from "./cohort-state.js";
-export type SupervisorProcessState = "same" | "gone" | "unknown";
-export type ObserveSupervisorProcess = (pid: number) => Promise<NativeProcessIdentity | null>;
-/** Inspection code comes from this runtime, never from a path in a stale endpoint record. */
-export declare function observeSupervisorProcess(pid: number): Promise<NativeProcessIdentity | null>;
-/** New supervisors use a native creation token as their opaque handshake identity as well. */
-export declare function currentSupervisorStartIdentity(): string;
-/** The current runtime also owns the OS gate ABI; metadata cannot choose a different addon. */
-export declare function acquireSupervisorGate(path: string): {
-    readonly acquired: boolean;
-    release(): void;
-};
-/** A failed inspection is uncertainty, never permission to erase a possibly live owner. */
-export declare function supervisorProcessState(metadata: SupervisorEndpointMetadata, observe?: ObserveSupervisorProcess): Promise<SupervisorProcessState>;

package/dist/foundation/release/supervisor-identity.js

@@ -1,63 +0,0 @@
-import { fileURLToPath } from "node:url";
-import { createNativeProcessInspector, loadProcessGuardianAddon, resolveProcessGuardianPath } from "../process-containment/index.js";
-const ownRoot = fileURLToPath(new URL("../../../", import.meta.url));
-/** Inspection code comes from this runtime, never from a path in a stale endpoint record. */
-export async function observeSupervisorProcess(pid) {
-    return await (await createNativeProcessInspector(process.env, process.platform, ownRoot)).observe(pid);
-}
-/** New supervisors use a native creation token as their opaque handshake identity as well. */
-export function currentSupervisorStartIdentity() {
-    try {
-        const token = loadProcessGuardianAddon(resolveProcessGuardianPath(ownRoot, process.env)).inspectProcessStart(process.pid);
-        if (!validNativeToken(token))
-            throw new Error("native process identity is unavailable");
-        return token;
-    }
-    catch (cause) {
-        throw Object.assign(new Error("cannot verify A1's background service process; check installation and process-inspection permissions", { cause }), { code: "SUPERVISOR_RECOVERY_UNAVAILABLE" });
-    }
-}
-/** The current runtime also owns the OS gate ABI; metadata cannot choose a different addon. */
-export function acquireSupervisorGate(path) {
-    const addon = loadProcessGuardianAddon(resolveProcessGuardianPath(ownRoot, process.env));
-    if (!addon.tryAcquireProcessGate)
-        throw new Error("this installation lacks startup recovery support; update or repair A1");
-    return addon.tryAcquireProcessGate(path);
-}
-/** A failed inspection is uncertainty, never permission to erase a possibly live owner. */
-export async function supervisorProcessState(metadata, observe = observeSupervisorProcess) {
-    let identity;
-    try {
-        identity = await observe(metadata.pid);
-    }
-    catch {
-        return "unknown";
-    }
-    if (identity === null)
-        return "gone";
-    if (identity.pid !== metadata.pid)
-        return "unknown";
-    if (metadata.nativeStartIdentity !== undefined) {
-        // Compatibility: only compare tokens of the same native format, not an old Node timestamp.
-        if (!validNativeToken(metadata.nativeStartIdentity) || !validNativeToken(identity.startIdentity)
-            || identity.startIdentity.split(":")[0] !== metadata.nativeStartIdentity.split(":")[0])
-            return "unknown";
-        return identity.startIdentity === metadata.nativeStartIdentity ? "same" : "gone";
-    }
-    // Compatibility: legacy publication happened after process creation. A native creation time
-    // strictly later than that publication (with a one-second clock margin) disproves ownership;
-    // a near timestamp is NOT proof of ownership. Linux tick-only tokens cannot prove this.
-    const published = Date.parse(metadata.startedAt);
-    const created = nativeCreationTime(identity.startIdentity);
-    return Number.isFinite(published) && created !== null && created > published + 1_000 ? "gone" : "unknown";
-}
-function validNativeToken(value) {
-    return typeof value === "string" && /^(?:windows-filetime:\d{1,20}|linux-proc-start:\d{1,20}|darwin-proc-start:\d{1,20}:\d{1,6})$/.test(value);
-}
-function nativeCreationTime(identity) {
-    const windows = /^windows-filetime:(\d+)$/.exec(identity);
-    if (windows)
-        return Number(BigInt(windows[1]) / 10000n - 11644473600000n);
-    const darwin = /^darwin-proc-start:(\d+):(\d+)$/.exec(identity);
-    return darwin ? Number(darwin[1]) * 1_000 + Number(darwin[2]) / 1_000 : null;
-}

package/dist/foundation/resident-tabs/boot-identity.d.ts

@@ -1,6 +0,0 @@
-/**
- * Mirrors the native boot matching rule. Legacy `macos-boot:<sec>:<usec>` records drift on clock
- * corrections, so two of them match within the tolerance; only the native host can prove one
- * against a current identity.
- */
-export declare function sameBootIdentity(left: string, right: string): boolean;

package/dist/foundation/resident-tabs/boot-identity.js

@@ -1,16 +0,0 @@
-/** Seconds a legacy clock-derived boot identity may drift and still name the same boot. */
-const LEGACY_BOOT_TOLERANCE_SECONDS = 2;
-const LEGACY_MACOS_BOOT = /^macos-boot:(\d+):\d+$/u;
-/**
- * Mirrors the native boot matching rule. Legacy `macos-boot:<sec>:<usec>` records drift on clock
- * corrections, so two of them match within the tolerance; only the native host can prove one
- * against a current identity.
- */
-export function sameBootIdentity(left, right) {
-    if (left === right)
-        return true;
-    const first = LEGACY_MACOS_BOOT.exec(left)?.[1];
-    const second = LEGACY_MACOS_BOOT.exec(right)?.[1];
-    return first !== undefined && second !== undefined
-        && Math.abs(Number(first) - Number(second)) <= LEGACY_BOOT_TOLERANCE_SECONDS;
-}

package/dist/foundation/resident-tabs/bounded-host-command.d.ts

@@ -1,20 +0,0 @@
-import type { TerminalHostCommand } from "./ensure-terminal-host.js";
-export interface BoundedHostCommandResult {
-    readonly code: number;
-    readonly stdout: string;
-    /** The command's last diagnostic line, bounded and stripped of control characters; never parsed. */
-    readonly stderr: string;
-}
-export interface BoundedHostCommandLimits {
-    /** Output beyond this many bytes fails the exchange instead of being parsed. */
-    readonly maxStdoutBytes: number;
-    readonly timeoutMs: number;
-    /** Names the exchange in the timeout error. */
-    readonly label: string;
-    readonly environment?: NodeJS.ProcessEnv;
-}
-/**
- * Runs one terminal-host command whose report is small. An oversized report kills the command and
- * reports a failed exchange; a command that outlives its deadline is killed and rejected.
- */
-export declare function runBoundedHostCommand(command: TerminalHostCommand, arguments_: readonly string[], limits: BoundedHostCommandLimits): Promise<BoundedHostCommandResult>;