@tinycloud/operations 0.4.0-beta.7 → 0.4.0-beta.8

package/dist/state.js

@@ -5,12 +5,14 @@ import {
   chmod,
   link,
   mkdir,
+  open,
   readFile,
   readdir,
   rename,
   rmdir,
   rm,
   stat,
+  unlink,
   writeFile
 } from "fs/promises";
 import { homedir } from "os";
@@ -28,22 +30,33 @@ var TEST_LOCK_PUBLISH_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_PUBLISH_BARRIER_DIR";
 var TEST_LOCK_RELEASE_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_RELEASE_BARRIER_DIR";
 var TEST_LOCK_CLAIM_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_CLAIM_BARRIER_DIR";
 var TEST_LOCK_CLAIMED_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_CLAIMED_BARRIER_DIR";
-var TEST_LOCK_FENCED_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_FENCED_BARRIER_DIR";
 var TEST_LOCK_VERIFIED_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_VERIFIED_BARRIER_DIR";
+var TEST_LOCK_MOVED_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_MOVED_BARRIER_DIR";
+var TEST_LOCK_TURN_PUBLISH_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_TURN_PUBLISH_BARRIER_DIR";
+var TEST_LOCK_TURN_SETTLE_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_TURN_SETTLE_BARRIER_DIR";
+var TEST_LOCK_TURN_COLLECT_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_TURN_COLLECT_BARRIER_DIR";
 function processWideContext(key) {
-  var _a;
+  var _a2;
   const registry = globalThis;
-  return registry[_a = Symbol.for(key)] ?? (registry[_a] = new AsyncLocalStorage());
+  return registry[_a2 = Symbol.for(key)] ?? (registry[_a2] = new AsyncLocalStorage());
 }
 var invocationStateRoot = processWideContext("tinycloud.operations.invocationStateRoot.v1");
-var heldProfileLocks = processWideContext("tinycloud.operations.heldProfileLocks.v1");
+var heldProfileLocks = processWideContext("tinycloud.operations.heldProfileLocks.v2");
 var ProfileLockTimeoutError = class extends Error {
-  constructor(profile, timeoutMs) {
-    super(`Timed out waiting for the profile lock for "${profile}" after ${timeoutMs}ms.`);
+  /** `detail` names the cause when it is not simply another process holding the lock. */
+  constructor(profile, timeoutMs, detail) {
+    super(`Timed out waiting for the profile lock for "${profile}" after ${timeoutMs}ms.${detail ? ` ${detail}` : ""}`);
     this.code = "PROFILE_LOCK_TIMEOUT";
     this.name = "ProfileLockTimeoutError";
   }
 };
+var ProfileDeletedError = class extends Error {
+  constructor(profile) {
+    super(`Profile "${profile}" was deleted while this change waited for its lock, so the change was not written.`);
+    this.code = "PROFILE_NOT_FOUND";
+    this.name = "ProfileDeletedError";
+  }
+};
 function tinycloudHomePath() {
   const home = invocationStateRoot.getStore() ?? process.env.TC_HOME ?? process.env.HOME ?? process.env.USERPROFILE ?? homedir();
   return join(home, ".tinycloud");
@@ -88,6 +101,9 @@ function profileLockPath(profile) {
 function profileLockMetadataPath(profile) {
   return join(profileLockPath(profile), "owner.json");
 }
+function profileTurnLockPath(profile) {
+  return join(tinycloudHomePath(), "profile-locks", validateProfileName(profile));
+}
 async function readJson(filePath) {
   try {
     return JSON.parse(await readFile(filePath, "utf8"));
@@ -97,6 +113,9 @@ async function readJson(filePath) {
   }
 }
 async function writeJsonAtomic(filePath, value) {
+  await replaceJson(filePath, value, false);
+}
+async function replaceJson(filePath, value, durable) {
   const directory = dirname(filePath);
   const temporaryPath = join(
     directory,
@@ -106,13 +125,25 @@ async function writeJsonAtomic(filePath, value) {
 `;
   await mkdir(directory, { recursive: true, mode: PRIVATE_DIR_MODE });
   try {
-    await writeFile(temporaryPath, contents, { encoding: "utf8", mode: PRIVATE_FILE_MODE });
+    if (durable) await writeFileDurably(temporaryPath, contents);
+    else await writeFile(temporaryPath, contents, { encoding: "utf8", mode: PRIVATE_FILE_MODE });
     await rename(temporaryPath, filePath);
   } catch (error) {
     await rm(temporaryPath, { force: true }).catch(() => void 0);
     throw error;
   }
 }
+async function writeFileDurably(path, contents) {
+  const handle = await open(path, "wx", PRIVATE_FILE_MODE);
+  try {
+    if (contents) {
+      await handle.writeFile(contents, "utf8");
+      await handle.datasync();
+    }
+  } finally {
+    await handle.close();
+  }
+}
 async function readProfile(profile) {
   return readJson(profileConfigPath(profile));
 }
@@ -149,18 +180,38 @@ async function withProfileLock(profile, action, options = {}) {
   const lockPath = profileLockPath(normalizedProfile);
   const held = (heldProfileLocks.getStore() ?? []).filter((ownership2) => ownership2.active);
   if (held.some((ownership2) => ownership2.lockPath === lockPath)) return action();
-  const release = await acquireProfileLock(normalizedProfile, options);
-  const ownership = { lockPath, active: true };
+  const acquired = await acquireProfileLock(normalizedProfile, options);
+  const ownership = {
+    lockPath,
+    turnSlot: acquired.turnSlot,
+    deletedWhileWaiting: acquired.deletedWhileWaiting,
+    active: true
+  };
   try {
     return await heldProfileLocks.run([...held, ownership], action);
   } finally {
     ownership.active = false;
-    await release();
+    await acquired.release();
+    if (acquired.deletedWhileWaiting) await rmdir(profilePath(normalizedProfile)).catch(() => void 0);
   }
 }
+async function recordProfileDeletion(profile) {
+  const lockPath = profileLockPath(profile);
+  const ownership = (heldProfileLocks.getStore() ?? []).find((candidate) => candidate.active && candidate.lockPath === lockPath);
+  if (!ownership) throw new Error(`Recording the deletion of profile "${profile}" requires holding its lock.`);
+  await replaceJson(join(profileTurnLockPath(profile), "deleted.json"), { slot: ownership.turnSlot }, true);
+}
+async function refuseWriteToDeletedProfile(profile) {
+  const lockPath = profileLockPath(profile);
+  const ownership = (heldProfileLocks.getStore() ?? []).find((candidate) => candidate.active && candidate.lockPath === lockPath);
+  if (!ownership?.deletedWhileWaiting) return;
+  if (await exists(profileConfigPath(profile))) return;
+  throw new ProfileDeletedError(profile);
+}
 async function upsertProfileRecord(profile, store, key, record, getKey, options = {}) {
   if (!key) throw new TypeError("A non-empty record key is required.");
   return withProfileLock(profile, async () => {
+    await refuseWriteToDeletedProfile(profile);
     const current = (await readProfileStore(profile, store)).records;
     const next = current.filter((candidate) => getKey(candidate) !== key);
     next.push(record);
@@ -177,6 +228,7 @@ async function updateProfileStore(profile, store, update, options = {}) {
   );
 }
 async function updateProfileStoreWhileLocked(profile, store, update) {
+  await refuseWriteToDeletedProfile(profile);
   const current = await readProfileStore(profile, store);
   const next = await update(current.records);
   await writeJsonAtomic(profileStorePath(profile, store), next.records);
@@ -185,6 +237,7 @@ async function updateProfileStoreWhileLocked(profile, store, update) {
 }
 async function writeSession(profile, session, options = {}) {
   await withProfileLock(profile, async () => {
+    await refuseWriteToDeletedProfile(profile);
     await readStoreMetadata(profile, "session");
     await writeJsonAtomic(sessionPath(profile), session);
     await writeFormatOneMetadata(profile, "session");
@@ -200,32 +253,277 @@ async function writeFormatOneMetadata(profile, store) {
   await writeJsonAtomic(profileStoreMetadataPath(profile, store), { formatVersion: 1 });
 }
 async function acquireProfileLock(profile, options) {
-  const timeoutMs = options.timeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS;
-  const retryMs = options.retryMs ?? DEFAULT_LOCK_RETRY_MS;
+  const deadline = {
+    startedAt: Date.now(),
+    timeoutMs: options.timeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS,
+    retryMs: options.retryMs ?? DEFAULT_LOCK_RETRY_MS
+  };
   const staleAfterMs = options.staleAfterMs ?? DEFAULT_STALE_LOCK_MS;
-  const startedAt = Date.now();
   const lockPath = profileLockPath(profile);
+  const turnDirectory = profileTurnLockPath(profile);
   const directory = profilePath(profile);
   await mkdir(directory, { recursive: true, mode: PRIVATE_DIR_MODE });
+  await mkdir(dirname(turnDirectory), { recursive: true, mode: PRIVATE_DIR_MODE });
   for (const path of [tinycloudHomePath(), profilesPath(), directory]) {
     await chmod(path, PRIVATE_DIR_MODE).catch((error) => {
       if (path !== directory || !isErrno(error, "ENOENT")) throw error;
     });
   }
-  while (true) {
-    const token = randomUUID();
-    if (await publishProfileLock(profile, lockPath, token)) {
-      return async () => {
-        await releaseProfileLock(profile, lockPath, token);
-      };
+  const { turn, firstWaitedTurn } = await acquireTurn(profile, turnDirectory, deadline);
+  try {
+    const deletion = await readJson(join(turnDirectory, "deleted.json")).catch(() => null);
+    const deletedWhileWaiting = typeof deletion?.slot === "number" && deletion.slot >= firstWaitedTurn;
+    while (true) {
+      const token = randomUUID();
+      if (await publishProfileLock(profile, lockPath, token)) {
+        return {
+          deletedWhileWaiting,
+          turnSlot: turn.slot,
+          release: async () => {
+            try {
+              await releaseProfileLock(profile, lockPath, token);
+            } finally {
+              await releaseTurn(profile, turn);
+            }
+          }
+        };
+      }
+      await signalTestLockContention(profile);
+      if (await recoverStaleLock(profile, lockPath, staleAfterMs)) continue;
+      await waitOrTimeOut(profile, deadline);
+    }
+  } catch (error) {
+    await releaseTurn(profile, turn);
+    throw error;
+  }
+}
+function checkDeadline(profile, deadline, detail) {
+  if (Date.now() - deadline.startedAt >= deadline.timeoutMs) {
+    throw new ProfileLockTimeoutError(profile, deadline.timeoutMs, detail);
+  }
+}
+async function waitOrTimeOut(profile, deadline, detail) {
+  checkDeadline(profile, deadline, detail);
+  await sleep(Math.min(deadline.retryMs, deadline.timeoutMs - (Date.now() - deadline.startedAt)));
+}
+var TURN = /^(?:0|[1-9][0-9]*)$/;
+var _a;
+var relinquishedTurns = globalThis[_a = /* @__PURE__ */ Symbol.for("tinycloud.operations.relinquishedProfileTurns.v1")] ?? (globalThis[_a] = /* @__PURE__ */ new Set());
+var MARKER_RETRY_DELAYS_MS = [10, 50, 250];
+var SETTLE_RETRY_MS = 1e3;
+var SETTLE_RETRIES = 300;
+async function acquireTurn(profile, directory, deadline) {
+  let firstWaitedTurn;
+  let problem;
+  const damaged = (what) => `The turn lock ${directory} ${what}, so no process can take it. If no tc or MCP process is using profile "${profile}", remove that directory.`;
+  for (let first = true; ; first = false) {
+    if (!first) checkDeadline(profile, deadline, problem);
+    problem = void 0;
+    const latest = await readLatestTurn(directory);
+    if (latest === "missing") {
+      await createTurnDirectory(directory);
+      continue;
+    }
+    if (latest === "empty") {
+      problem = damaged("has no turns");
+      await waitOrTimeOut(profile, deadline, problem);
+      continue;
+    }
+    if (latest === null) continue;
+    if (typeof latest === "number") {
+      problem = damaged(`has an unreadable turn ${latest}`);
+      await waitOrTimeOut(profile, deadline, problem);
+      continue;
+    }
+    firstWaitedTurn ?? (firstWaitedTurn = latest.done ? latest.slot + 1 : latest.slot);
+    if (latest.held && latest.done) {
+      const turn = await takeTurn(profile, directory, latest);
+      if (turn !== null) return { turn, firstWaitedTurn };
+      await waitOrTimeOut(profile, deadline);
+    } else if (latest.done) {
+      problem = damaged(`ends with turn ${latest.slot}, which was never granted`);
+      await waitOrTimeOut(profile, deadline, problem);
+    } else if (latest.pid === process.pid ? relinquishedTurns.has(latest.token) : !isProcessAlive(latest.pid)) {
+      await waitForTestBarrier(TEST_LOCK_TURN_SETTLE_BARRIER_DIR, profile);
+      await settleAbandonedTurn(directory, latest);
+      relinquishedTurns.delete(latest.token);
+    } else {
+      await signalTestLockContention(profile);
+      await waitOrTimeOut(profile, deadline);
+    }
+  }
+}
+async function readLatestTurn(directory) {
+  let names;
+  try {
+    names = await readdir(directory);
+  } catch (error) {
+    if (isErrno(error, "ENOENT")) return "missing";
+    throw error;
+  }
+  const slots = names.filter((name) => TURN.test(name)).map(Number);
+  if (slots.length === 0) return "empty";
+  const slot = Math.max(...slots);
+  const turn = await readTurn(directory, slot);
+  return turn === "damaged" ? slot : turn;
+}
+async function readTurn(directory, slot) {
+  const path = join(directory, String(slot));
+  let text;
+  try {
+    text = await readFile(join(path, "owner.json"), "utf8");
+  } catch (error) {
+    if (!isErrno(error, "ENOENT") && !isErrno(error, "ENOTDIR")) throw error;
+    return await exists(path) ? "damaged" : null;
+  }
+  let owner;
+  try {
+    owner = JSON.parse(text);
+  } catch {
+    return "damaged";
+  }
+  if (owner === null || typeof owner !== "object" || typeof owner.token !== "string" || typeof owner.pid !== "number") {
+    return "damaged";
+  }
+  const done = await exists(join(path, `${owner.token}.done`));
+  const held = await exists(join(path, `${owner.token}.held`));
+  return {
+    slot,
+    token: owner.token,
+    pid: owner.pid,
+    after: typeof owner.after === "string" ? owner.after : null,
+    held,
+    done
+  };
+}
+async function isFinishedTurn(directory, slot, token) {
+  const turn = await readTurn(directory, slot);
+  if (turn === "damaged") throw new Error(`Turn ${slot} of the turn lock ${directory} is unreadable.`);
+  return turn !== null && turn.token === token && turn.held && turn.done;
+}
+async function takeTurn(profile, directory, latest) {
+  const token = randomUUID();
+  const slot = latest.slot + 1;
+  const path = join(directory, String(slot));
+  const owner = { pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, after: latest.token };
+  let published = false;
+  try {
+    published = await publishDirectory(
+      join(directory, `.stage-${process.pid}-${token}`),
+      path,
+      { "owner.json": `${JSON.stringify(owner, null, 2)}
+` },
+      () => waitForTestBarrier(TEST_LOCK_TURN_PUBLISH_BARRIER_DIR, profile)
+    );
+    if (published && await isFinishedTurn(directory, latest.slot, latest.token) && await markTurn(path, token, "held")) {
+      return { directory, slot, token };
+    }
+    if (published) await markTurn(path, token, "done");
+    return null;
+  } catch (error) {
+    if (published) settleOwnTurn(directory, slot, token);
+    throw error;
+  }
+}
+async function settleAbandonedTurn(directory, abandoned) {
+  const path = join(directory, String(abandoned.slot));
+  if (!abandoned.held && abandoned.after !== null && await isFinishedTurn(directory, abandoned.slot - 1, abandoned.after)) {
+    await markTurn(path, abandoned.token, "held");
+  }
+  await markTurn(path, abandoned.token, "done");
+}
+function settleOwnTurn(directory, slot, token, retries = SETTLE_RETRIES) {
+  relinquishedTurns.add(token);
+  void (async () => {
+    try {
+      const turn = await readTurn(directory, slot);
+      if (turn !== null && turn !== "damaged" && turn.token === token && !turn.done) await settleAbandonedTurn(directory, turn);
+      relinquishedTurns.delete(token);
+    } catch {
+      if (retries > 0) setTimeout(() => settleOwnTurn(directory, slot, token, retries - 1), SETTLE_RETRY_MS).unref();
     }
-    await signalTestLockContention(profile);
-    if (await recoverStaleLock(profile, lockPath, staleAfterMs)) continue;
-    const elapsedMs = Date.now() - startedAt;
-    if (elapsedMs >= timeoutMs) {
-      throw new ProfileLockTimeoutError(profile, timeoutMs);
+  })();
+}
+async function markTurn(path, token, kind) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      await writeFile(join(path, `${token}.${kind}`), "", { mode: PRIVATE_FILE_MODE, flag: "wx" });
+      return true;
+    } catch (error) {
+      if (isErrno(error, "EEXIST")) return true;
+      if (isErrno(error, "ENOENT")) return false;
+      if (attempt >= MARKER_RETRY_DELAYS_MS.length) throw error;
+      await sleep(MARKER_RETRY_DELAYS_MS[attempt]);
+    }
+  }
+}
+async function createTurnDirectory(directory) {
+  const token = randomUUID();
+  const owner = { pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, after: null };
+  await publishDirectory(join(dirname(directory), `.stage-${basename(directory)}-${process.pid}-${token}`), directory, {
+    "0/owner.json": `${JSON.stringify(owner, null, 2)}
+`,
+    [`0/${token}.held`]: "",
+    [`0/${token}.done`]: ""
+  });
+}
+async function publishDirectory(stage, target, files, beforeRename) {
+  try {
+    for (const [name, contents] of Object.entries(files)) {
+      await mkdir(dirname(join(stage, name)), { recursive: true, mode: PRIVATE_DIR_MODE });
+      await writeFileDurably(join(stage, name), contents);
+    }
+    await beforeRename?.();
+    await rename(stage, target);
+    return true;
+  } catch (error) {
+    if (["ENOTEMPTY", "EEXIST", "ENOENT"].some((code) => isErrno(error, code)) || await exists(target)) return false;
+    throw error;
+  } finally {
+    await rm(stage, { recursive: true, force: true }).catch(() => void 0);
+  }
+}
+async function releaseTurn(profile, turn) {
+  try {
+    await markTurn(join(turn.directory, String(turn.slot)), turn.token, "done");
+  } catch {
+    settleOwnTurn(turn.directory, turn.slot, turn.token);
+    return;
+  }
+  await collectTurns(profile, turn).catch(() => void 0);
+}
+function isAbandonedTurnEntry(name) {
+  if (name.startsWith(".trash-")) return true;
+  const writer = /^\.(?:stage|deleted\.json)[-.]([0-9]+)[-.]/.exec(name)?.[1];
+  return writer !== void 0 && !isProcessAlive(Number(writer));
+}
+function isAbandonedTurnDirectoryStage(name) {
+  const writer = /^\.stage-.+-([0-9]+)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.exec(name)?.[1];
+  return writer !== void 0 && !isProcessAlive(Number(writer));
+}
+async function collectTurns(profile, turn) {
+  for (const [directory, abandoned] of [
+    [turn.directory, isAbandonedTurnEntry],
+    [dirname(turn.directory), isAbandonedTurnDirectoryStage]
+  ]) {
+    for (const name of (await readdir(directory)).filter(abandoned)) {
+      await rm(join(directory, name), { recursive: true, force: true }).catch(() => void 0);
+    }
+  }
+  const older = (await readdir(turn.directory)).filter((name) => TURN.test(name)).map(Number).filter((slot) => slot < turn.slot).sort((left, right) => left - right);
+  for (const slot of older) {
+    const candidate = await readTurn(turn.directory, slot);
+    if (candidate === null || candidate === "damaged" || !candidate.done) continue;
+    if (candidate.held) {
+      if (await exists(join(turn.directory, String(slot - 1)))) continue;
+      const next = await readTurn(turn.directory, slot + 1);
+      if (next === null || next === "damaged" || !next.held || !next.done) continue;
+    }
+    await waitForTestBarrier(TEST_LOCK_TURN_COLLECT_BARRIER_DIR, profile);
+    const trash = join(turn.directory, `.trash-${randomUUID()}`);
+    if (await rename(join(turn.directory, String(slot)), trash).then(() => true, () => false)) {
+      await rm(trash, { recursive: true, force: true }).catch(() => void 0);
     }
-    await sleep(Math.min(retryMs, timeoutMs - elapsedMs));
   }
 }
 async function publishProfileLock(profile, lockPath, token) {
@@ -238,12 +536,18 @@ async function publishProfileLock(profile, lockPath, token) {
     return false;
   }
   await waitForTestBarrier(TEST_LOCK_PUBLISH_BARRIER_DIR, profile);
+  const ownerPath = join(lockPath, "owner.json");
   const staged = join(dirname(lockPath), `.lock-owner-${token}.tmp`);
-  const owner = { pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token };
+  const owner = `${JSON.stringify({ pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token }, null, 2)}
+`;
   try {
-    await writeFile(staged, `${JSON.stringify(owner, null, 2)}
-`, { encoding: "utf8", mode: PRIVATE_FILE_MODE, flag: "wx" });
-    await link(staged, join(lockPath, "owner.json"));
+    await writeFile(staged, owner, { encoding: "utf8", mode: PRIVATE_FILE_MODE, flag: "wx" });
+    try {
+      await link(staged, ownerPath);
+    } catch (error) {
+      if (!lacksHardLinks(error)) throw error;
+      await writeFile(ownerPath, owner, { encoding: "utf8", mode: PRIVATE_FILE_MODE, flag: "wx" });
+    }
     return true;
   } catch (error) {
     if (isErrno(error, "EEXIST") || isErrno(error, "ENOENT")) return false;
@@ -253,6 +557,10 @@ async function publishProfileLock(profile, lockPath, token) {
     await rm(staged, { force: true }).catch(() => void 0);
   }
 }
+var NO_HARD_LINK_ERRORS = /* @__PURE__ */ new Set(["EPERM", "ENOTSUP", "EOPNOTSUPP", "ENOSYS", "EISDIR", "EMLINK"]);
+function lacksHardLinks(error) {
+  return typeof error === "object" && error !== null && "code" in error && NO_HARD_LINK_ERRORS.has(String(error.code));
+}
 async function releaseProfileLock(profile, lockPath, token) {
   const ownerPath = join(lockPath, "owner.json");
   const owner = await readJson(ownerPath).catch(() => null);
@@ -276,9 +584,10 @@ async function signalTestLockContention(profile) {
 `, { encoding: "utf8", flag: "wx" }).catch(() => void 0);
 }
 async function recoverOwnerlessLock(profile, lockPath, staleAfterMs) {
+  let aged;
   try {
     const { mtimeMs } = await stat(lockPath);
-    if (Date.now() - mtimeMs < staleAfterMs) return false;
+    aged = Date.now() - mtimeMs >= staleAfterMs;
   } catch {
     return false;
   }
@@ -287,7 +596,16 @@ async function recoverOwnerlessLock(profile, lockPath, staleAfterMs) {
   try {
     const entries = await readdir(lockPath);
     if (entries.includes("owner.json")) return false;
-    if (recoveryFenced(checkedAt, staleAfterMs)) return false;
+    const onlyOrphanedClaims = entries.length > 0 && entries.every((entry) => RECOVERY_CLAIM.test(entry));
+    if (!onlyOrphanedClaims && (!aged || recoveryFenced(checkedAt, staleAfterMs))) return false;
+    for (const name of entries.filter((entry) => RECOVERY_CLAIM.test(entry))) {
+      const claimPath = join(lockPath, name);
+      if (await hasLiveRecoveryOwner(claimPath)) {
+        if (!await exists(join(lockPath, "owner.json"))) await rename(claimPath, join(lockPath, "owner.json"));
+        return false;
+      }
+      await rm(claimPath, { force: true });
+    }
     for (const name of entries.filter((entry) => ABANDONED_CLAIM.test(entry))) {
       await rm(join(lockPath, name), { force: true });
     }
@@ -298,10 +616,28 @@ async function recoverOwnerlessLock(profile, lockPath, staleAfterMs) {
   await removeAgedOwnerFiles(lockPath, staleAfterMs);
   return true;
 }
+async function hasLiveRecoveryOwner(claimPath) {
+  let contents;
+  try {
+    contents = await readFile(claimPath, "utf8");
+  } catch (error) {
+    if (isErrno(error, "ENOENT")) return false;
+    throw error;
+  }
+  let owner;
+  try {
+    owner = JSON.parse(contents);
+  } catch {
+    return false;
+  }
+  const pid = typeof owner === "object" && owner !== null && "pid" in owner ? owner.pid : null;
+  return typeof pid === "number" && Number.isInteger(pid) && pid > 0 && isProcessAlive(pid);
+}
 function recoveryFenced(since, staleAfterMs) {
   return performance.now() - since >= staleAfterMs / 2;
 }
 var ABANDONED_CLAIM = /^\.(?:release|stale)-[0-9a-f-]+\.json$/;
+var RECOVERY_CLAIM = /^\.recover-[0-9a-f-]+\.json$/;
 var STAGED_OWNER = /^\.lock-owner-[0-9a-f-]+\.tmp$/;
 async function removeAgedOwnerFiles(lockPath, staleAfterMs) {
   const directory = dirname(lockPath);
@@ -314,37 +650,57 @@ async function removeAgedOwnerFiles(lockPath, staleAfterMs) {
 }
 async function recoverStaleLock(profile, lockPath, staleAfterMs) {
   const ownerPath = join(lockPath, "owner.json");
-  const owner = await readJson(ownerPath).catch(() => null);
-  if (owner === null) return recoverOwnerlessLock(profile, lockPath, staleAfterMs);
-  if (!isStaleOwner(owner, staleAfterMs)) return false;
-  const observedToken = typeof owner?.token === "string" && owner.token.length > 0 ? owner.token : "legacy";
+  const observed = await readFile(ownerPath, "utf8").catch(() => null);
+  if (observed === null) return recoverOwnerlessLock(profile, lockPath, staleAfterMs);
+  if (!await isAbandonedOwner(observed, ownerPath, staleAfterMs)) return false;
   await waitForTestBarrier(TEST_LOCK_RECOVERY_BARRIER_DIR, profile);
-  const claimPath = join(lockPath, `.stale-${randomUUID()}.json`);
+  const claimPath = join(lockPath, `.recover-${randomUUID()}.json`);
+  let moved = false;
   try {
     await link(ownerPath, claimPath);
-  } catch {
-    return false;
+  } catch (error) {
+    if (!lacksHardLinks(error)) return false;
+    try {
+      await rename(ownerPath, claimPath);
+      moved = true;
+    } catch {
+      return false;
+    }
   }
-  const claimedAt = performance.now();
-  await waitForTestBarrier(TEST_LOCK_CLAIM_BARRIER_DIR, profile);
-  const claimed = await readJson(claimPath).catch(() => null);
-  const sameInstance = claimed !== null && (observedToken === "legacy" ? claimed.token === void 0 : claimed.token === observedToken);
+  if (moved) await waitForTestBarrier(TEST_LOCK_MOVED_BARRIER_DIR, profile);
+  const sameInstance = await readFile(claimPath, "utf8").then((claimed) => claimed === observed, () => false);
   await waitForTestBarrier(TEST_LOCK_VERIFIED_BARRIER_DIR, profile);
-  if (sameInstance && recoveryFenced(claimedAt, staleAfterMs)) {
-    await rm(claimPath, { force: true });
-    await waitForTestBarrier(TEST_LOCK_FENCED_BARRIER_DIR, profile);
+  if (!sameInstance) {
+    if (moved) {
+      await rename(claimPath, ownerPath).catch(() => void 0);
+    } else {
+      await unlink(claimPath).catch(() => void 0);
+    }
     return false;
   }
-  if (sameInstance) {
-    await rm(ownerPath, { force: true });
-    await waitForTestBarrier(TEST_LOCK_CLAIMED_BARRIER_DIR, profile);
+  if (!moved) await rm(ownerPath, { force: true });
+  await waitForTestBarrier(TEST_LOCK_CLAIM_BARRIER_DIR, profile);
+  await waitForTestBarrier(TEST_LOCK_CLAIMED_BARRIER_DIR, profile);
+  for (const name of (await readdir(lockPath).catch(() => [])).filter((entry) => RECOVERY_CLAIM.test(entry))) {
+    if (join(lockPath, name) !== claimPath) await rm(join(lockPath, name), { force: true });
   }
-  await rm(claimPath, { force: true });
-  await rmdir(lockPath).catch(() => void 0);
-  if (!sameInstance) return false;
+  if (await unlink(claimPath).then(() => true, () => false)) await rmdir(lockPath).catch(() => void 0);
   await removeAgedOwnerFiles(lockPath, staleAfterMs);
   return true;
 }
+async function isAbandonedOwner(observed, ownerPath, staleAfterMs) {
+  let owner;
+  try {
+    owner = JSON.parse(observed);
+  } catch {
+    owner = null;
+  }
+  if (typeof owner === "object" && owner !== null && "pid" in owner) {
+    return isStaleOwner(owner, staleAfterMs);
+  }
+  const modifiedAt = await stat(ownerPath).then(({ mtimeMs }) => mtimeMs, () => Number.NaN);
+  return Date.now() - modifiedAt >= staleAfterMs;
+}
 async function waitForTestBarrier(environmentName, profile) {
   if (process.env.NODE_ENV !== "test") return;
   const barrierDirectory = process.env[environmentName];
@@ -371,6 +727,15 @@ function isStaleOwner(owner, staleAfterMs) {
   }
   return !isProcessAlive(owner.pid);
 }
+async function exists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch (error) {
+    if (isErrno(error, "ENOENT") || isErrno(error, "ENOTDIR")) return false;
+    throw error;
+  }
+}
 function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -393,6 +758,7 @@ function sleep(milliseconds) {
 }
 export {
   DEFAULT_PROFILE,
+  ProfileDeletedError,
   ProfileLockTimeoutError,
   additionalDelegationsPath,
   authRequestsPath,
@@ -402,6 +768,7 @@ export {
   profilePath,
   profileStoreMetadataPath,
   profileStorePath,
+  profileTurnLockPath,
   profilesPath,
   readAdditionalDelegations,
   readAuthRequests,
@@ -410,6 +777,8 @@ export {
   readProfileStore,
   readSession,
   readStoreMetadata,
+  recordProfileDeletion,
+  refuseWriteToDeletedProfile,
   removeSession,
   sessionPath,
   tinycloudConfigPath,