@tinycloud/operations 0.3.4-beta.6 → 0.4.0-beta.8

package/dist/artifacts.cjs

@@ -188,6 +188,7 @@ var require_decrypt_transport_response_error = __commonJS({
 var artifacts_exports = {};
 __export(artifacts_exports, {
   DelegationImportArtifactSchema: () => DelegationImportArtifactSchema,
+  DelegationRequestBindingSchema: () => DelegationRequestBindingSchema,
   PermissionEntrySchema: () => PermissionEntrySchema,
   PermissionRequestArtifactSchema: () => PermissionRequestArtifactSchema,
   buildPermissionRequestArtifact: () => buildPermissionRequestArtifact,
@@ -6956,17 +6957,33 @@ var TEST_LOCK_PUBLISH_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_PUBLISH_BARRIER_DIR";
 var TEST_LOCK_RELEASE_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_RELEASE_BARRIER_DIR";
 var TEST_LOCK_CLAIM_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_CLAIM_BARRIER_DIR";
 var TEST_LOCK_CLAIMED_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_CLAIMED_BARRIER_DIR";
-var TEST_LOCK_FENCED_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_FENCED_BARRIER_DIR";
 var TEST_LOCK_VERIFIED_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_VERIFIED_BARRIER_DIR";
-var invocationStateRoot = new import_node_async_hooks.AsyncLocalStorage();
-var heldProfileLocks = new import_node_async_hooks.AsyncLocalStorage();
+var TEST_LOCK_MOVED_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_MOVED_BARRIER_DIR";
+var TEST_LOCK_TURN_PUBLISH_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_TURN_PUBLISH_BARRIER_DIR";
+var TEST_LOCK_TURN_SETTLE_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_TURN_SETTLE_BARRIER_DIR";
+var TEST_LOCK_TURN_COLLECT_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_TURN_COLLECT_BARRIER_DIR";
+function processWideContext(key) {
+  var _a2;
+  const registry = globalThis;
+  return registry[_a2 = Symbol.for(key)] ?? (registry[_a2] = new import_node_async_hooks.AsyncLocalStorage());
+}
+var invocationStateRoot = processWideContext("tinycloud.operations.invocationStateRoot.v1");
+var heldProfileLocks = processWideContext("tinycloud.operations.heldProfileLocks.v2");
 var ProfileLockTimeoutError = class extends Error {
-  constructor(profile, timeoutMs) {
-    super(`Timed out waiting for the profile lock for "${profile}" after ${timeoutMs}ms.`);
+  /** `detail` names the cause when it is not simply another process holding the lock. */
+  constructor(profile, timeoutMs, detail) {
+    super(`Timed out waiting for the profile lock for "${profile}" after ${timeoutMs}ms.${detail ? ` ${detail}` : ""}`);
     this.code = "PROFILE_LOCK_TIMEOUT";
     this.name = "ProfileLockTimeoutError";
   }
 };
+var ProfileDeletedError = class extends Error {
+  constructor(profile) {
+    super(`Profile "${profile}" was deleted while this change waited for its lock, so the change was not written.`);
+    this.code = "PROFILE_NOT_FOUND";
+    this.name = "ProfileDeletedError";
+  }
+};
 function tinycloudHomePath() {
   const home = invocationStateRoot.getStore() ?? process.env.TC_HOME ?? process.env.HOME ?? process.env.USERPROFILE ?? (0, import_node_os.homedir)();
   return (0, import_node_path.join)(home, ".tinycloud");
@@ -6977,6 +6994,9 @@ function profilesPath() {
 function profilePath(profile) {
   return (0, import_node_path.join)(profilesPath(), validateProfileName(profile));
 }
+function profileConfigPath(profile) {
+  return (0, import_node_path.join)(profilePath(profile), "profile.json");
+}
 function profileStorePath(profile, store) {
   return (0, import_node_path.join)(profilePath(profile), `${store}.json`);
 }
@@ -6986,6 +7006,9 @@ function profileStoreMetadataPath(profile, store) {
 function profileLockPath(profile) {
   return (0, import_node_path.join)(profilePath(profile), ".lock");
 }
+function profileTurnLockPath(profile) {
+  return (0, import_node_path.join)(tinycloudHomePath(), "profile-locks", validateProfileName(profile));
+}
 async function readJson(filePath) {
   try {
     return JSON.parse(await (0, import_promises.readFile)(filePath, "utf8"));
@@ -6995,6 +7018,9 @@ async function readJson(filePath) {
   }
 }
 async function writeJsonAtomic(filePath, value) {
+  await replaceJson(filePath, value, false);
+}
+async function replaceJson(filePath, value, durable) {
   const directory = (0, import_node_path.dirname)(filePath);
   const temporaryPath = (0, import_node_path.join)(
     directory,
@@ -7004,13 +7030,25 @@ async function writeJsonAtomic(filePath, value) {
 `;
   await (0, import_promises.mkdir)(directory, { recursive: true, mode: PRIVATE_DIR_MODE });
   try {
-    await (0, import_promises.writeFile)(temporaryPath, contents, { encoding: "utf8", mode: PRIVATE_FILE_MODE });
+    if (durable) await writeFileDurably(temporaryPath, contents);
+    else await (0, import_promises.writeFile)(temporaryPath, contents, { encoding: "utf8", mode: PRIVATE_FILE_MODE });
     await (0, import_promises.rename)(temporaryPath, filePath);
   } catch (error) {
     await (0, import_promises.rm)(temporaryPath, { force: true }).catch(() => void 0);
     throw error;
   }
 }
+async function writeFileDurably(path, contents) {
+  const handle = await (0, import_promises.open)(path, "wx", PRIVATE_FILE_MODE);
+  try {
+    if (contents) {
+      await handle.writeFile(contents, "utf8");
+      await handle.datasync();
+    }
+  } finally {
+    await handle.close();
+  }
+}
 async function readAuthRequests(profile) {
   return (await readProfileStore(profile, "auth-requests")).records;
 }
@@ -7037,15 +7075,28 @@ async function withProfileLock(profile, action, options = {}) {
   const lockPath = profileLockPath(normalizedProfile);
   const held = (heldProfileLocks.getStore() ?? []).filter((ownership2) => ownership2.active);
   if (held.some((ownership2) => ownership2.lockPath === lockPath)) return action();
-  const release = await acquireProfileLock(normalizedProfile, options);
-  const ownership = { lockPath, active: true };
+  const acquired = await acquireProfileLock(normalizedProfile, options);
+  const ownership = {
+    lockPath,
+    turnSlot: acquired.turnSlot,
+    deletedWhileWaiting: acquired.deletedWhileWaiting,
+    active: true
+  };
   try {
     return await heldProfileLocks.run([...held, ownership], action);
   } finally {
     ownership.active = false;
-    await release();
+    await acquired.release();
+    if (acquired.deletedWhileWaiting) await (0, import_promises.rmdir)(profilePath(normalizedProfile)).catch(() => void 0);
   }
 }
+async function refuseWriteToDeletedProfile(profile) {
+  const lockPath = profileLockPath(profile);
+  const ownership = (heldProfileLocks.getStore() ?? []).find((candidate) => candidate.active && candidate.lockPath === lockPath);
+  if (!ownership?.deletedWhileWaiting) return;
+  if (await exists(profileConfigPath(profile))) return;
+  throw new ProfileDeletedError(profile);
+}
 async function updateProfileStore(profile, store, update, options = {}) {
   return withProfileLock(
     profile,
@@ -7054,6 +7105,7 @@ async function updateProfileStore(profile, store, update, options = {}) {
   );
 }
 async function updateProfileStoreWhileLocked(profile, store, update) {
+  await refuseWriteToDeletedProfile(profile);
   const current = await readProfileStore(profile, store);
   const next = await update(current.records);
   await writeJsonAtomic(profileStorePath(profile, store), next.records);
@@ -7064,32 +7116,277 @@ async function writeFormatOneMetadata(profile, store) {
   await writeJsonAtomic(profileStoreMetadataPath(profile, store), { formatVersion: 1 });
 }
 async function acquireProfileLock(profile, options) {
-  const timeoutMs = options.timeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS;
-  const retryMs = options.retryMs ?? DEFAULT_LOCK_RETRY_MS;
+  const deadline = {
+    startedAt: Date.now(),
+    timeoutMs: options.timeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS,
+    retryMs: options.retryMs ?? DEFAULT_LOCK_RETRY_MS
+  };
   const staleAfterMs = options.staleAfterMs ?? DEFAULT_STALE_LOCK_MS;
-  const startedAt = Date.now();
   const lockPath = profileLockPath(profile);
+  const turnDirectory = profileTurnLockPath(profile);
   const directory = profilePath(profile);
   await (0, import_promises.mkdir)(directory, { recursive: true, mode: PRIVATE_DIR_MODE });
+  await (0, import_promises.mkdir)((0, import_node_path.dirname)(turnDirectory), { recursive: true, mode: PRIVATE_DIR_MODE });
   for (const path of [tinycloudHomePath(), profilesPath(), directory]) {
     await (0, import_promises.chmod)(path, PRIVATE_DIR_MODE).catch((error) => {
       if (path !== directory || !isErrno(error, "ENOENT")) throw error;
     });
   }
-  while (true) {
-    const token = (0, import_node_crypto.randomUUID)();
-    if (await publishProfileLock(profile, lockPath, token)) {
-      return async () => {
-        await releaseProfileLock(profile, lockPath, token);
-      };
+  const { turn, firstWaitedTurn } = await acquireTurn(profile, turnDirectory, deadline);
+  try {
+    const deletion = await readJson((0, import_node_path.join)(turnDirectory, "deleted.json")).catch(() => null);
+    const deletedWhileWaiting = typeof deletion?.slot === "number" && deletion.slot >= firstWaitedTurn;
+    while (true) {
+      const token = (0, import_node_crypto.randomUUID)();
+      if (await publishProfileLock(profile, lockPath, token)) {
+        return {
+          deletedWhileWaiting,
+          turnSlot: turn.slot,
+          release: async () => {
+            try {
+              await releaseProfileLock(profile, lockPath, token);
+            } finally {
+              await releaseTurn(profile, turn);
+            }
+          }
+        };
+      }
+      await signalTestLockContention(profile);
+      if (await recoverStaleLock(profile, lockPath, staleAfterMs)) continue;
+      await waitOrTimeOut(profile, deadline);
     }
-    await signalTestLockContention(profile);
-    if (await recoverStaleLock(profile, lockPath, staleAfterMs)) continue;
-    const elapsedMs = Date.now() - startedAt;
-    if (elapsedMs >= timeoutMs) {
-      throw new ProfileLockTimeoutError(profile, timeoutMs);
+  } catch (error) {
+    await releaseTurn(profile, turn);
+    throw error;
+  }
+}
+function checkDeadline(profile, deadline, detail) {
+  if (Date.now() - deadline.startedAt >= deadline.timeoutMs) {
+    throw new ProfileLockTimeoutError(profile, deadline.timeoutMs, detail);
+  }
+}
+async function waitOrTimeOut(profile, deadline, detail) {
+  checkDeadline(profile, deadline, detail);
+  await sleep(Math.min(deadline.retryMs, deadline.timeoutMs - (Date.now() - deadline.startedAt)));
+}
+var TURN = /^(?:0|[1-9][0-9]*)$/;
+var _a;
+var relinquishedTurns = globalThis[_a = /* @__PURE__ */ Symbol.for("tinycloud.operations.relinquishedProfileTurns.v1")] ?? (globalThis[_a] = /* @__PURE__ */ new Set());
+var MARKER_RETRY_DELAYS_MS = [10, 50, 250];
+var SETTLE_RETRY_MS = 1e3;
+var SETTLE_RETRIES = 300;
+async function acquireTurn(profile, directory, deadline) {
+  let firstWaitedTurn;
+  let problem;
+  const damaged = (what) => `The turn lock ${directory} ${what}, so no process can take it. If no tc or MCP process is using profile "${profile}", remove that directory.`;
+  for (let first = true; ; first = false) {
+    if (!first) checkDeadline(profile, deadline, problem);
+    problem = void 0;
+    const latest = await readLatestTurn(directory);
+    if (latest === "missing") {
+      await createTurnDirectory(directory);
+      continue;
+    }
+    if (latest === "empty") {
+      problem = damaged("has no turns");
+      await waitOrTimeOut(profile, deadline, problem);
+      continue;
+    }
+    if (latest === null) continue;
+    if (typeof latest === "number") {
+      problem = damaged(`has an unreadable turn ${latest}`);
+      await waitOrTimeOut(profile, deadline, problem);
+      continue;
+    }
+    firstWaitedTurn ?? (firstWaitedTurn = latest.done ? latest.slot + 1 : latest.slot);
+    if (latest.held && latest.done) {
+      const turn = await takeTurn(profile, directory, latest);
+      if (turn !== null) return { turn, firstWaitedTurn };
+      await waitOrTimeOut(profile, deadline);
+    } else if (latest.done) {
+      problem = damaged(`ends with turn ${latest.slot}, which was never granted`);
+      await waitOrTimeOut(profile, deadline, problem);
+    } else if (latest.pid === process.pid ? relinquishedTurns.has(latest.token) : !isProcessAlive(latest.pid)) {
+      await waitForTestBarrier(TEST_LOCK_TURN_SETTLE_BARRIER_DIR, profile);
+      await settleAbandonedTurn(directory, latest);
+      relinquishedTurns.delete(latest.token);
+    } else {
+      await signalTestLockContention(profile);
+      await waitOrTimeOut(profile, deadline);
+    }
+  }
+}
+async function readLatestTurn(directory) {
+  let names;
+  try {
+    names = await (0, import_promises.readdir)(directory);
+  } catch (error) {
+    if (isErrno(error, "ENOENT")) return "missing";
+    throw error;
+  }
+  const slots = names.filter((name) => TURN.test(name)).map(Number);
+  if (slots.length === 0) return "empty";
+  const slot = Math.max(...slots);
+  const turn = await readTurn(directory, slot);
+  return turn === "damaged" ? slot : turn;
+}
+async function readTurn(directory, slot) {
+  const path = (0, import_node_path.join)(directory, String(slot));
+  let text;
+  try {
+    text = await (0, import_promises.readFile)((0, import_node_path.join)(path, "owner.json"), "utf8");
+  } catch (error) {
+    if (!isErrno(error, "ENOENT") && !isErrno(error, "ENOTDIR")) throw error;
+    return await exists(path) ? "damaged" : null;
+  }
+  let owner;
+  try {
+    owner = JSON.parse(text);
+  } catch {
+    return "damaged";
+  }
+  if (owner === null || typeof owner !== "object" || typeof owner.token !== "string" || typeof owner.pid !== "number") {
+    return "damaged";
+  }
+  const done = await exists((0, import_node_path.join)(path, `${owner.token}.done`));
+  const held = await exists((0, import_node_path.join)(path, `${owner.token}.held`));
+  return {
+    slot,
+    token: owner.token,
+    pid: owner.pid,
+    after: typeof owner.after === "string" ? owner.after : null,
+    held,
+    done
+  };
+}
+async function isFinishedTurn(directory, slot, token) {
+  const turn = await readTurn(directory, slot);
+  if (turn === "damaged") throw new Error(`Turn ${slot} of the turn lock ${directory} is unreadable.`);
+  return turn !== null && turn.token === token && turn.held && turn.done;
+}
+async function takeTurn(profile, directory, latest) {
+  const token = (0, import_node_crypto.randomUUID)();
+  const slot = latest.slot + 1;
+  const path = (0, import_node_path.join)(directory, String(slot));
+  const owner = { pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, after: latest.token };
+  let published = false;
+  try {
+    published = await publishDirectory(
+      (0, import_node_path.join)(directory, `.stage-${process.pid}-${token}`),
+      path,
+      { "owner.json": `${JSON.stringify(owner, null, 2)}
+` },
+      () => waitForTestBarrier(TEST_LOCK_TURN_PUBLISH_BARRIER_DIR, profile)
+    );
+    if (published && await isFinishedTurn(directory, latest.slot, latest.token) && await markTurn(path, token, "held")) {
+      return { directory, slot, token };
+    }
+    if (published) await markTurn(path, token, "done");
+    return null;
+  } catch (error) {
+    if (published) settleOwnTurn(directory, slot, token);
+    throw error;
+  }
+}
+async function settleAbandonedTurn(directory, abandoned) {
+  const path = (0, import_node_path.join)(directory, String(abandoned.slot));
+  if (!abandoned.held && abandoned.after !== null && await isFinishedTurn(directory, abandoned.slot - 1, abandoned.after)) {
+    await markTurn(path, abandoned.token, "held");
+  }
+  await markTurn(path, abandoned.token, "done");
+}
+function settleOwnTurn(directory, slot, token, retries = SETTLE_RETRIES) {
+  relinquishedTurns.add(token);
+  void (async () => {
+    try {
+      const turn = await readTurn(directory, slot);
+      if (turn !== null && turn !== "damaged" && turn.token === token && !turn.done) await settleAbandonedTurn(directory, turn);
+      relinquishedTurns.delete(token);
+    } catch {
+      if (retries > 0) setTimeout(() => settleOwnTurn(directory, slot, token, retries - 1), SETTLE_RETRY_MS).unref();
+    }
+  })();
+}
+async function markTurn(path, token, kind) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      await (0, import_promises.writeFile)((0, import_node_path.join)(path, `${token}.${kind}`), "", { mode: PRIVATE_FILE_MODE, flag: "wx" });
+      return true;
+    } catch (error) {
+      if (isErrno(error, "EEXIST")) return true;
+      if (isErrno(error, "ENOENT")) return false;
+      if (attempt >= MARKER_RETRY_DELAYS_MS.length) throw error;
+      await sleep(MARKER_RETRY_DELAYS_MS[attempt]);
+    }
+  }
+}
+async function createTurnDirectory(directory) {
+  const token = (0, import_node_crypto.randomUUID)();
+  const owner = { pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, after: null };
+  await publishDirectory((0, import_node_path.join)((0, import_node_path.dirname)(directory), `.stage-${(0, import_node_path.basename)(directory)}-${process.pid}-${token}`), directory, {
+    "0/owner.json": `${JSON.stringify(owner, null, 2)}
+`,
+    [`0/${token}.held`]: "",
+    [`0/${token}.done`]: ""
+  });
+}
+async function publishDirectory(stage, target, files, beforeRename) {
+  try {
+    for (const [name, contents] of Object.entries(files)) {
+      await (0, import_promises.mkdir)((0, import_node_path.dirname)((0, import_node_path.join)(stage, name)), { recursive: true, mode: PRIVATE_DIR_MODE });
+      await writeFileDurably((0, import_node_path.join)(stage, name), contents);
+    }
+    await beforeRename?.();
+    await (0, import_promises.rename)(stage, target);
+    return true;
+  } catch (error) {
+    if (["ENOTEMPTY", "EEXIST", "ENOENT"].some((code) => isErrno(error, code)) || await exists(target)) return false;
+    throw error;
+  } finally {
+    await (0, import_promises.rm)(stage, { recursive: true, force: true }).catch(() => void 0);
+  }
+}
+async function releaseTurn(profile, turn) {
+  try {
+    await markTurn((0, import_node_path.join)(turn.directory, String(turn.slot)), turn.token, "done");
+  } catch {
+    settleOwnTurn(turn.directory, turn.slot, turn.token);
+    return;
+  }
+  await collectTurns(profile, turn).catch(() => void 0);
+}
+function isAbandonedTurnEntry(name) {
+  if (name.startsWith(".trash-")) return true;
+  const writer = /^\.(?:stage|deleted\.json)[-.]([0-9]+)[-.]/.exec(name)?.[1];
+  return writer !== void 0 && !isProcessAlive(Number(writer));
+}
+function isAbandonedTurnDirectoryStage(name) {
+  const writer = /^\.stage-.+-([0-9]+)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.exec(name)?.[1];
+  return writer !== void 0 && !isProcessAlive(Number(writer));
+}
+async function collectTurns(profile, turn) {
+  for (const [directory, abandoned] of [
+    [turn.directory, isAbandonedTurnEntry],
+    [(0, import_node_path.dirname)(turn.directory), isAbandonedTurnDirectoryStage]
+  ]) {
+    for (const name of (await (0, import_promises.readdir)(directory)).filter(abandoned)) {
+      await (0, import_promises.rm)((0, import_node_path.join)(directory, name), { recursive: true, force: true }).catch(() => void 0);
+    }
+  }
+  const older = (await (0, import_promises.readdir)(turn.directory)).filter((name) => TURN.test(name)).map(Number).filter((slot) => slot < turn.slot).sort((left, right) => left - right);
+  for (const slot of older) {
+    const candidate = await readTurn(turn.directory, slot);
+    if (candidate === null || candidate === "damaged" || !candidate.done) continue;
+    if (candidate.held) {
+      if (await exists((0, import_node_path.join)(turn.directory, String(slot - 1)))) continue;
+      const next = await readTurn(turn.directory, slot + 1);
+      if (next === null || next === "damaged" || !next.held || !next.done) continue;
+    }
+    await waitForTestBarrier(TEST_LOCK_TURN_COLLECT_BARRIER_DIR, profile);
+    const trash = (0, import_node_path.join)(turn.directory, `.trash-${(0, import_node_crypto.randomUUID)()}`);
+    if (await (0, import_promises.rename)((0, import_node_path.join)(turn.directory, String(slot)), trash).then(() => true, () => false)) {
+      await (0, import_promises.rm)(trash, { recursive: true, force: true }).catch(() => void 0);
     }
-    await sleep(Math.min(retryMs, timeoutMs - elapsedMs));
   }
 }
 async function publishProfileLock(profile, lockPath, token) {
@@ -7102,12 +7399,18 @@ async function publishProfileLock(profile, lockPath, token) {
     return false;
   }
   await waitForTestBarrier(TEST_LOCK_PUBLISH_BARRIER_DIR, profile);
+  const ownerPath = (0, import_node_path.join)(lockPath, "owner.json");
   const staged = (0, import_node_path.join)((0, import_node_path.dirname)(lockPath), `.lock-owner-${token}.tmp`);
-  const owner = { pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token };
+  const owner = `${JSON.stringify({ pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token }, null, 2)}
+`;
   try {
-    await (0, import_promises.writeFile)(staged, `${JSON.stringify(owner, null, 2)}
-`, { encoding: "utf8", mode: PRIVATE_FILE_MODE, flag: "wx" });
-    await (0, import_promises.link)(staged, (0, import_node_path.join)(lockPath, "owner.json"));
+    await (0, import_promises.writeFile)(staged, owner, { encoding: "utf8", mode: PRIVATE_FILE_MODE, flag: "wx" });
+    try {
+      await (0, import_promises.link)(staged, ownerPath);
+    } catch (error) {
+      if (!lacksHardLinks(error)) throw error;
+      await (0, import_promises.writeFile)(ownerPath, owner, { encoding: "utf8", mode: PRIVATE_FILE_MODE, flag: "wx" });
+    }
     return true;
   } catch (error) {
     if (isErrno(error, "EEXIST") || isErrno(error, "ENOENT")) return false;
@@ -7117,6 +7420,10 @@ async function publishProfileLock(profile, lockPath, token) {
     await (0, import_promises.rm)(staged, { force: true }).catch(() => void 0);
   }
 }
+var NO_HARD_LINK_ERRORS = /* @__PURE__ */ new Set(["EPERM", "ENOTSUP", "EOPNOTSUPP", "ENOSYS", "EISDIR", "EMLINK"]);
+function lacksHardLinks(error) {
+  return typeof error === "object" && error !== null && "code" in error && NO_HARD_LINK_ERRORS.has(String(error.code));
+}
 async function releaseProfileLock(profile, lockPath, token) {
   const ownerPath = (0, import_node_path.join)(lockPath, "owner.json");
   const owner = await readJson(ownerPath).catch(() => null);
@@ -7140,9 +7447,10 @@ async function signalTestLockContention(profile) {
 `, { encoding: "utf8", flag: "wx" }).catch(() => void 0);
 }
 async function recoverOwnerlessLock(profile, lockPath, staleAfterMs) {
+  let aged;
   try {
     const { mtimeMs } = await (0, import_promises.stat)(lockPath);
-    if (Date.now() - mtimeMs < staleAfterMs) return false;
+    aged = Date.now() - mtimeMs >= staleAfterMs;
   } catch {
     return false;
   }
@@ -7151,7 +7459,16 @@ async function recoverOwnerlessLock(profile, lockPath, staleAfterMs) {
   try {
     const entries = await (0, import_promises.readdir)(lockPath);
     if (entries.includes("owner.json")) return false;
-    if (recoveryFenced(checkedAt, staleAfterMs)) return false;
+    const onlyOrphanedClaims = entries.length > 0 && entries.every((entry) => RECOVERY_CLAIM.test(entry));
+    if (!onlyOrphanedClaims && (!aged || recoveryFenced(checkedAt, staleAfterMs))) return false;
+    for (const name of entries.filter((entry) => RECOVERY_CLAIM.test(entry))) {
+      const claimPath = (0, import_node_path.join)(lockPath, name);
+      if (await hasLiveRecoveryOwner(claimPath)) {
+        if (!await exists((0, import_node_path.join)(lockPath, "owner.json"))) await (0, import_promises.rename)(claimPath, (0, import_node_path.join)(lockPath, "owner.json"));
+        return false;
+      }
+      await (0, import_promises.rm)(claimPath, { force: true });
+    }
     for (const name of entries.filter((entry) => ABANDONED_CLAIM.test(entry))) {
       await (0, import_promises.rm)((0, import_node_path.join)(lockPath, name), { force: true });
     }
@@ -7162,10 +7479,28 @@ async function recoverOwnerlessLock(profile, lockPath, staleAfterMs) {
   await removeAgedOwnerFiles(lockPath, staleAfterMs);
   return true;
 }
+async function hasLiveRecoveryOwner(claimPath) {
+  let contents;
+  try {
+    contents = await (0, import_promises.readFile)(claimPath, "utf8");
+  } catch (error) {
+    if (isErrno(error, "ENOENT")) return false;
+    throw error;
+  }
+  let owner;
+  try {
+    owner = JSON.parse(contents);
+  } catch {
+    return false;
+  }
+  const pid = typeof owner === "object" && owner !== null && "pid" in owner ? owner.pid : null;
+  return typeof pid === "number" && Number.isInteger(pid) && pid > 0 && isProcessAlive(pid);
+}
 function recoveryFenced(since, staleAfterMs) {
   return performance.now() - since >= staleAfterMs / 2;
 }
 var ABANDONED_CLAIM = /^\.(?:release|stale)-[0-9a-f-]+\.json$/;
+var RECOVERY_CLAIM = /^\.recover-[0-9a-f-]+\.json$/;
 var STAGED_OWNER = /^\.lock-owner-[0-9a-f-]+\.tmp$/;
 async function removeAgedOwnerFiles(lockPath, staleAfterMs) {
   const directory = (0, import_node_path.dirname)(lockPath);
@@ -7178,37 +7513,57 @@ async function removeAgedOwnerFiles(lockPath, staleAfterMs) {
 }
 async function recoverStaleLock(profile, lockPath, staleAfterMs) {
   const ownerPath = (0, import_node_path.join)(lockPath, "owner.json");
-  const owner = await readJson(ownerPath).catch(() => null);
-  if (owner === null) return recoverOwnerlessLock(profile, lockPath, staleAfterMs);
-  if (!isStaleOwner(owner, staleAfterMs)) return false;
-  const observedToken = typeof owner?.token === "string" && owner.token.length > 0 ? owner.token : "legacy";
+  const observed = await (0, import_promises.readFile)(ownerPath, "utf8").catch(() => null);
+  if (observed === null) return recoverOwnerlessLock(profile, lockPath, staleAfterMs);
+  if (!await isAbandonedOwner(observed, ownerPath, staleAfterMs)) return false;
   await waitForTestBarrier(TEST_LOCK_RECOVERY_BARRIER_DIR, profile);
-  const claimPath = (0, import_node_path.join)(lockPath, `.stale-${(0, import_node_crypto.randomUUID)()}.json`);
+  const claimPath = (0, import_node_path.join)(lockPath, `.recover-${(0, import_node_crypto.randomUUID)()}.json`);
+  let moved = false;
   try {
     await (0, import_promises.link)(ownerPath, claimPath);
-  } catch {
-    return false;
+  } catch (error) {
+    if (!lacksHardLinks(error)) return false;
+    try {
+      await (0, import_promises.rename)(ownerPath, claimPath);
+      moved = true;
+    } catch {
+      return false;
+    }
   }
-  const claimedAt = performance.now();
-  await waitForTestBarrier(TEST_LOCK_CLAIM_BARRIER_DIR, profile);
-  const claimed = await readJson(claimPath).catch(() => null);
-  const sameInstance = claimed !== null && (observedToken === "legacy" ? claimed.token === void 0 : claimed.token === observedToken);
+  if (moved) await waitForTestBarrier(TEST_LOCK_MOVED_BARRIER_DIR, profile);
+  const sameInstance = await (0, import_promises.readFile)(claimPath, "utf8").then((claimed) => claimed === observed, () => false);
   await waitForTestBarrier(TEST_LOCK_VERIFIED_BARRIER_DIR, profile);
-  if (sameInstance && recoveryFenced(claimedAt, staleAfterMs)) {
-    await (0, import_promises.rm)(claimPath, { force: true });
-    await waitForTestBarrier(TEST_LOCK_FENCED_BARRIER_DIR, profile);
+  if (!sameInstance) {
+    if (moved) {
+      await (0, import_promises.rename)(claimPath, ownerPath).catch(() => void 0);
+    } else {
+      await (0, import_promises.unlink)(claimPath).catch(() => void 0);
+    }
     return false;
   }
-  if (sameInstance) {
-    await (0, import_promises.rm)(ownerPath, { force: true });
-    await waitForTestBarrier(TEST_LOCK_CLAIMED_BARRIER_DIR, profile);
+  if (!moved) await (0, import_promises.rm)(ownerPath, { force: true });
+  await waitForTestBarrier(TEST_LOCK_CLAIM_BARRIER_DIR, profile);
+  await waitForTestBarrier(TEST_LOCK_CLAIMED_BARRIER_DIR, profile);
+  for (const name of (await (0, import_promises.readdir)(lockPath).catch(() => [])).filter((entry) => RECOVERY_CLAIM.test(entry))) {
+    if ((0, import_node_path.join)(lockPath, name) !== claimPath) await (0, import_promises.rm)((0, import_node_path.join)(lockPath, name), { force: true });
   }
-  await (0, import_promises.rm)(claimPath, { force: true });
-  await (0, import_promises.rmdir)(lockPath).catch(() => void 0);
-  if (!sameInstance) return false;
+  if (await (0, import_promises.unlink)(claimPath).then(() => true, () => false)) await (0, import_promises.rmdir)(lockPath).catch(() => void 0);
   await removeAgedOwnerFiles(lockPath, staleAfterMs);
   return true;
 }
+async function isAbandonedOwner(observed, ownerPath, staleAfterMs) {
+  let owner;
+  try {
+    owner = JSON.parse(observed);
+  } catch {
+    owner = null;
+  }
+  if (typeof owner === "object" && owner !== null && "pid" in owner) {
+    return isStaleOwner(owner, staleAfterMs);
+  }
+  const modifiedAt = await (0, import_promises.stat)(ownerPath).then(({ mtimeMs }) => mtimeMs, () => Number.NaN);
+  return Date.now() - modifiedAt >= staleAfterMs;
+}
 async function waitForTestBarrier(environmentName, profile) {
   if (process.env.NODE_ENV !== "test") return;
   const barrierDirectory = process.env[environmentName];
@@ -7235,6 +7590,15 @@ function isStaleOwner(owner, staleAfterMs) {
   }
   return !isProcessAlive(owner.pid);
 }
+async function exists(path) {
+  try {
+    await (0, import_promises.stat)(path);
+    return true;
+  } catch (error) {
+    if (isErrno(error, "ENOENT") || isErrno(error, "ENOTDIR")) return false;
+    throw error;
+  }
+}
 function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -7323,6 +7687,7 @@ var DelegationImportArtifactSchema = import_zod2.z.object({
   expiry: import_zod2.z.string().datetime({ offset: true }).optional(),
   prompted: import_zod2.z.boolean().optional()
 }).strict();
+var DelegationRequestBindingSchema = PermissionRequestArtifactSchema.pick({ requestId: true, requested: true }).strict();
 function validatePermissionRequestArtifact(value) {
   return PermissionRequestArtifactSchema.parse(value);
 }
@@ -7536,6 +7901,7 @@ function defaultRequestId(now) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   DelegationImportArtifactSchema,
+  DelegationRequestBindingSchema,
   PermissionEntrySchema,
   PermissionRequestArtifactSchema,
   buildPermissionRequestArtifact,