@tinycloud/operations 0.5.0-beta.0 → 0.5.0-beta.10

package/dist/delegation-binding.d.cts

@@ -1,7 +1,7 @@
 import { PermissionEntry, ValidatedRuntimeDelegation, RuntimeDelegationActivator, PortableDelegation } from '@tinycloud/node-sdk';
 import { O as OperationSpaceResolver } from './authority-ofwbEqmj.cjs';
-import { S as StoredGrantSkipReason, b as OperationWarning } from './contract-DfyrluLB.cjs';
-export { c as STORED_GRANT_SKIP_REASONS } from './contract-DfyrluLB.cjs';
+import { S as StoredGrantSkipReason, b as OperationWarning } from './contract-zRklonbR.cjs';
+export { c as STORED_GRANT_SKIP_REASONS } from './contract-zRklonbR.cjs';
 import '@tinycloud/sdk-core';
 
 /** Creates the one owner-aware resolver shared by operation matching paths. */
@@ -130,6 +130,18 @@ declare function replayProfileDelegations(profile: string, node: RuntimeDelegati
     installed: ValidatedRuntimeDelegation[];
     warnings: OperationWarning[];
 }>;
+/**
+ * Replays the profile's stored records as they are, under the replay rule,
+ * without migrating: no lock, no store or marker write. Runtimes that must
+ * never write profile state (the `"restored"` runtime) call only this.
+ */
+declare function replayStoredDelegationRecords(profile: string, node: RuntimeDelegationActivator, options: {
+    readonly host: string;
+    readonly resolveSpace: OperationSpaceResolver;
+}): Promise<{
+    installed: ValidatedRuntimeDelegation[];
+    warnings: OperationWarning[];
+}>;
 /** Return an audience only after the exact compact bytes, CID and signature verify. */
 declare function verifiedCompactAudience(node: RuntimeDelegationActivator, delegation: PortableDelegation): string | undefined;
 /** Only a verified signed audience and matching transport audience can identify a foreign grant. */
@@ -171,4 +183,4 @@ declare function inspectStoredDelegation(entry: unknown, options?: {
 /** An unreadable marker counts as migrated: a damaged marker never reopens migration. */
 declare function bindingMigrationRecorded(profile: string): Promise<boolean>;
 
-export { BINDING_NOTES, type BindingSource, OperationWarning, type StoredDelegationInspection, type StoredDelegationReplay, type StoredDelegationSource, StoredGrantSkipReason, activateUnboundImport, bindCliGrant, bindingMigrationPath, bindingMigrationRecorded, inspectStoredDelegation, mergeDelegationsWithoutRequest, operationSpaceResolver, prepareStoredDelegationReplay, replayLimit, replayProfileDelegations, replayStoredDelegation, storedDelegationForAnotherKey, storedDelegationKind, storedDelegationSource, verifiedCompactAudience, verifiedStoredCid, withoutBearer };
+export { BINDING_NOTES, type BindingSource, OperationWarning, type StoredDelegationInspection, type StoredDelegationReplay, type StoredDelegationSource, StoredGrantSkipReason, activateUnboundImport, bindCliGrant, bindingMigrationPath, bindingMigrationRecorded, inspectStoredDelegation, mergeDelegationsWithoutRequest, operationSpaceResolver, prepareStoredDelegationReplay, replayLimit, replayProfileDelegations, replayStoredDelegation, replayStoredDelegationRecords, storedDelegationForAnotherKey, storedDelegationKind, storedDelegationSource, verifiedCompactAudience, verifiedStoredCid, withoutBearer };

package/dist/delegation-binding.d.ts

@@ -1,7 +1,7 @@
 import { PermissionEntry, ValidatedRuntimeDelegation, RuntimeDelegationActivator, PortableDelegation } from '@tinycloud/node-sdk';
 import { O as OperationSpaceResolver } from './authority-ofwbEqmj.js';
-import { S as StoredGrantSkipReason, b as OperationWarning } from './contract-DfyrluLB.js';
-export { c as STORED_GRANT_SKIP_REASONS } from './contract-DfyrluLB.js';
+import { S as StoredGrantSkipReason, b as OperationWarning } from './contract-zRklonbR.js';
+export { c as STORED_GRANT_SKIP_REASONS } from './contract-zRklonbR.js';
 import '@tinycloud/sdk-core';
 
 /** Creates the one owner-aware resolver shared by operation matching paths. */
@@ -130,6 +130,18 @@ declare function replayProfileDelegations(profile: string, node: RuntimeDelegati
     installed: ValidatedRuntimeDelegation[];
     warnings: OperationWarning[];
 }>;
+/**
+ * Replays the profile's stored records as they are, under the replay rule,
+ * without migrating: no lock, no store or marker write. Runtimes that must
+ * never write profile state (the `"restored"` runtime) call only this.
+ */
+declare function replayStoredDelegationRecords(profile: string, node: RuntimeDelegationActivator, options: {
+    readonly host: string;
+    readonly resolveSpace: OperationSpaceResolver;
+}): Promise<{
+    installed: ValidatedRuntimeDelegation[];
+    warnings: OperationWarning[];
+}>;
 /** Return an audience only after the exact compact bytes, CID and signature verify. */
 declare function verifiedCompactAudience(node: RuntimeDelegationActivator, delegation: PortableDelegation): string | undefined;
 /** Only a verified signed audience and matching transport audience can identify a foreign grant. */
@@ -171,4 +183,4 @@ declare function inspectStoredDelegation(entry: unknown, options?: {
 /** An unreadable marker counts as migrated: a damaged marker never reopens migration. */
 declare function bindingMigrationRecorded(profile: string): Promise<boolean>;
 
-export { BINDING_NOTES, type BindingSource, OperationWarning, type StoredDelegationInspection, type StoredDelegationReplay, type StoredDelegationSource, StoredGrantSkipReason, activateUnboundImport, bindCliGrant, bindingMigrationPath, bindingMigrationRecorded, inspectStoredDelegation, mergeDelegationsWithoutRequest, operationSpaceResolver, prepareStoredDelegationReplay, replayLimit, replayProfileDelegations, replayStoredDelegation, storedDelegationForAnotherKey, storedDelegationKind, storedDelegationSource, verifiedCompactAudience, verifiedStoredCid, withoutBearer };
+export { BINDING_NOTES, type BindingSource, OperationWarning, type StoredDelegationInspection, type StoredDelegationReplay, type StoredDelegationSource, StoredGrantSkipReason, activateUnboundImport, bindCliGrant, bindingMigrationPath, bindingMigrationRecorded, inspectStoredDelegation, mergeDelegationsWithoutRequest, operationSpaceResolver, prepareStoredDelegationReplay, replayLimit, replayProfileDelegations, replayStoredDelegation, replayStoredDelegationRecords, storedDelegationForAnotherKey, storedDelegationKind, storedDelegationSource, verifiedCompactAudience, verifiedStoredCid, withoutBearer };

package/dist/delegation-binding.js

@@ -3624,10 +3624,10 @@ function evaluateOperationAuthority(granted, required, resolveSpace) {
   const canonicalRequired = canonicalizeOperationCapabilities(required, resolveSpace);
   const missing = [];
   for (const requested of canonicalRequired) {
-    const covered = canonicalGranted.some(
-      (candidate) => candidate.service === requested.service && operationSpacesEqual(candidate.space, requested.space) && isCapabilitySubset([requested], [candidate]).subset
+    const sameScope = canonicalGranted.filter(
+      (candidate) => candidate.service === requested.service && operationSpacesEqual(candidate.space, requested.space)
     );
-    if (!covered) missing.push(requested);
+    if (!isCapabilitySubset([requested], sameScope).subset) missing.push(requested);
   }
   return {
     satisfied: missing.length === 0,
@@ -3704,9 +3704,11 @@ function canonicalizeCaveats(caveats) {
 // src/state.ts
 import { randomUUID } from "crypto";
 import { AsyncLocalStorage } from "async_hooks";
+import { readFileSync, readlinkSync } from "fs";
 import {
   chmod,
   link,
+  lstat,
   mkdir,
   open,
   readFile,
@@ -3718,6 +3720,7 @@ import {
   unlink,
   writeFile
 } from "fs/promises";
+import { connect, createServer } from "net";
 import { homedir } from "os";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "path";
 var DEFAULT_LOCK_TIMEOUT_MS = 2e3;
@@ -3737,13 +3740,171 @@ var TEST_LOCK_MOVED_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_MOVED_BARRIER_DIR";
 var TEST_LOCK_TURN_PUBLISH_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_TURN_PUBLISH_BARRIER_DIR";
 var TEST_LOCK_TURN_SETTLE_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_TURN_SETTLE_BARRIER_DIR";
 var TEST_LOCK_TURN_COLLECT_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_TURN_COLLECT_BARRIER_DIR";
+var TEST_LOCK_LIVENESS_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_LIVENESS_BARRIER_DIR";
 function processWideContext(key) {
-  var _a3;
+  var _a4;
   const registry = globalThis;
-  return registry[_a3 = Symbol.for(key)] ?? (registry[_a3] = new AsyncLocalStorage());
+  return registry[_a4 = Symbol.for(key)] ?? (registry[_a4] = new AsyncLocalStorage());
 }
 var invocationStateRoot = processWideContext("tinycloud.operations.invocationStateRoot.v1");
 var heldProfileLocks = processWideContext("tinycloud.operations.heldProfileLocks.v2");
+var _a2;
+var processInstanceId = globalThis[_a2 = /* @__PURE__ */ Symbol.for("tinycloud.operations.profileLockInstance.v1")] ?? (globalThis[_a2] = randomUUID());
+var cachedProcessOrigin;
+function processOrigin() {
+  if (cachedProcessOrigin !== void 0) return cachedProcessOrigin;
+  if (process.platform !== "linux") return cachedProcessOrigin = null;
+  try {
+    const bootId = readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim();
+    const pidNamespace = readlinkSync("/proc/self/ns/pid");
+    const processStat = readFileSync("/proc/self/stat", "utf8");
+    const closingParen = processStat.lastIndexOf(") ");
+    const processStartTime = closingParen < 0 ? void 0 : processStat.slice(closingParen + 2).trim().split(/\s+/)[19];
+    if (!/^[0-9a-f-]{36}$/.test(bootId) || !/^pid:\[[0-9]+\]$/.test(pidNamespace) || !processStartTime || !/^[0-9]+$/.test(processStartTime)) {
+      return cachedProcessOrigin = null;
+    }
+    return cachedProcessOrigin = { bootId, pidNamespace, processStartTime };
+  } catch {
+    return cachedProcessOrigin = null;
+  }
+}
+function processOwner(liveness) {
+  return { instanceId: processInstanceId, ...processOrigin(), ...liveness ? { liveness: liveness.record } : {} };
+}
+var LIVENESS_SOCKET = /^\.live-([0-9a-f]+)-([0-9a-f]+)-[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}(\.new)?$/;
+var LIVENESS_PROBE_TIMEOUT_MS = 1e3;
+function socketDirectory(name) {
+  const match = LIVENESS_SOCKET.exec(name);
+  return match ? `${match[1]}-${match[2]}` : null;
+}
+async function pinDirectory(directory) {
+  const handle = await open(directory, "r");
+  try {
+    const { dev, ino } = await handle.stat({ bigint: true });
+    return {
+      identity: `${dev.toString(16)}-${ino.toString(16)}`,
+      path: (name) => `/proc/self/fd/${handle.fd}/${name}`,
+      close: () => handle.close()
+    };
+  } catch (error) {
+    await handle.close();
+    throw error;
+  }
+}
+async function bindLiveness(directory) {
+  if (!processOrigin()) return null;
+  let pinned;
+  try {
+    pinned = await pinDirectory(directory);
+  } catch {
+    return null;
+  }
+  const socket = `.live-${pinned.identity}-${randomUUID()}`;
+  const server = createServer((connection) => connection.destroy());
+  let bound = false;
+  try {
+    await new Promise((resolve2, reject) => {
+      server.once("error", reject);
+      server.listen({ path: pinned.path(`${socket}.new`), exclusive: true }, () => {
+        server.off("error", reject);
+        resolve2();
+      });
+    });
+    bound = true;
+    server.on("error", () => void 0);
+    server.unref();
+    await rename(pinned.path(`${socket}.new`), pinned.path(socket));
+    const stats = await lstat(pinned.path(socket), { bigint: true });
+    if (!stats.isSocket()) throw new Error(`${socket} is not a socket`);
+    await waitForTestBarrier(TEST_LOCK_LIVENESS_BARRIER_DIR, basename(directory));
+    return { record: { socket, dev: String(stats.dev), ino: String(stats.ino) }, path: join(directory, socket), server };
+  } catch {
+    if (bound) {
+      server.close();
+      for (const name of [`${socket}.new`, socket]) await unlink(pinned.path(name)).catch(() => void 0);
+    }
+    return null;
+  } finally {
+    await pinned.close();
+  }
+}
+async function ensureLiveness(acquisition) {
+  if (acquisition.held === void 0) acquisition.held = await bindLiveness(acquisition.directory);
+  return acquisition.held;
+}
+async function closeLiveness(held) {
+  held.server.close();
+  await unlink(held.path).catch(() => void 0);
+}
+function parseLiveness(value) {
+  if (typeof value !== "object" || value === null) return null;
+  const { socket, dev, ino } = value;
+  const name = typeof socket === "string" ? LIVENESS_SOCKET.exec(socket) : null;
+  return name !== null && name[3] === void 0 && typeof dev === "string" && /^[0-9]+$/.test(dev) && typeof ino === "string" && /^[0-9]+$/.test(ino) ? { socket: name[0], dev, ino } : null;
+}
+async function controlIn(pinned, acquisition) {
+  const own = await ensureLiveness(acquisition);
+  if (!own || socketDirectory(own.record.socket) !== pinned.identity) return null;
+  const stats = await lstat(pinned.path(own.record.socket), { bigint: true }).catch(() => null);
+  return stats?.isSocket() && String(stats.dev) === own.record.dev && String(stats.ino) === own.record.ino ? own : null;
+}
+async function tryConnect(path) {
+  return new Promise((resolve2) => {
+    const probe = connect({ path });
+    const settle = (outcome) => {
+      clearTimeout(timer);
+      probe.destroy();
+      resolve2(outcome);
+    };
+    const timer = setTimeout(() => settle("other"), LIVENESS_PROBE_TIMEOUT_MS);
+    probe.once("connect", () => settle("connected"));
+    probe.once("error", (error) => settle(isErrno(error, "ECONNREFUSED") ? "refused" : "other"));
+  });
+}
+async function kernelRefuses(pinned, name, control) {
+  if (process.versions.bun !== void 0) return false;
+  return await tryConnect(pinned.path(name)) === "refused" && await tryConnect(pinned.path(control.record.socket)) === "connected";
+}
+async function probeLiveness(liveness, acquisition) {
+  let pinned;
+  try {
+    pinned = await pinDirectory(acquisition.directory);
+  } catch {
+    return "unknown";
+  }
+  try {
+    if (socketDirectory(liveness.socket) !== pinned.identity) return "unknown";
+    const control = await controlIn(pinned, acquisition);
+    if (!control) return "unknown";
+    let stats;
+    try {
+      stats = await lstat(pinned.path(liveness.socket), { bigint: true });
+    } catch (error) {
+      return isErrno(error, "ENOENT") ? "gone" : "unknown";
+    }
+    if (!stats.isSocket() || String(stats.dev) !== liveness.dev || String(stats.ino) !== liveness.ino) return "unknown";
+    return await kernelRefuses(pinned, liveness.socket, control) ? "refused" : "unknown";
+  } finally {
+    await pinned.close();
+  }
+}
+async function sweepLiveness(acquisition) {
+  if (process.versions.bun !== void 0 || !acquisition.held) return;
+  const pinned = await pinDirectory(acquisition.directory);
+  try {
+    const control = await controlIn(pinned, acquisition);
+    if (!control) return;
+    for (const name of await readdir(pinned.path("."))) {
+      if (name === control.record.socket || socketDirectory(name) !== pinned.identity) continue;
+      const stats = await lstat(pinned.path(name)).catch(() => null);
+      if (stats?.isSocket() && await kernelRefuses(pinned, name, control)) {
+        await unlink(pinned.path(name)).catch(() => void 0);
+      }
+    }
+  } finally {
+    await pinned.close();
+  }
+}
 var ProfileLockTimeoutError = class extends Error {
   /** `detail` names the cause when it is not simply another process holding the lock. */
   constructor(profile, timeoutMs, detail) {
@@ -3915,7 +4076,18 @@ async function acquireProfileLock(profile, options) {
       if (path !== directory || !isErrno(error, "ENOENT")) throw error;
     });
   }
-  const { turn, firstWaitedTurn } = await acquireTurn(profile, turnDirectory, deadline);
+  const liveness = { directory: turnDirectory, held: void 0 };
+  const closeAcquisitionLiveness = async () => {
+    if (liveness.held) await closeLiveness(liveness.held);
+  };
+  let taken;
+  try {
+    taken = await acquireTurn(profile, turnDirectory, deadline, liveness);
+  } catch (error) {
+    await closeAcquisitionLiveness();
+    throw error;
+  }
+  const { turn, firstWaitedTurn } = taken;
   try {
     if (options.requireProfile && !await exists(profileConfigPath(profile))) {
       await rmdir(directory).catch(() => void 0);
@@ -3925,7 +4097,7 @@ async function acquireProfileLock(profile, options) {
     const deletedWhileWaiting = typeof deletion?.slot === "number" && deletion.slot >= firstWaitedTurn;
     while (true) {
       const token = randomUUID();
-      if (await publishProfileLock(profile, lockPath, token, options.requireProfile === true)) {
+      if (await publishProfileLock(profile, lockPath, token, options.requireProfile === true, liveness.held ?? null)) {
         return {
           deletedWhileWaiting,
           turnSlot: turn.slot,
@@ -3933,17 +4105,19 @@ async function acquireProfileLock(profile, options) {
             try {
               await releaseProfileLock(profile, lockPath, token);
             } finally {
-              await releaseTurn(profile, turn);
+              await releaseTurn(profile, turn, liveness);
+              await closeAcquisitionLiveness();
             }
           }
         };
       }
       await signalTestLockContention(profile);
-      if (await recoverStaleLock(profile, lockPath, staleAfterMs)) continue;
+      if (await recoverStaleLock(profile, lockPath, liveness, staleAfterMs)) continue;
       await waitOrTimeOut(profile, deadline);
     }
   } catch (error) {
-    await releaseTurn(profile, turn);
+    await releaseTurn(profile, turn, liveness);
+    await closeAcquisitionLiveness();
     throw error;
   }
 }
@@ -3957,12 +4131,12 @@ async function waitOrTimeOut(profile, deadline, detail) {
   await sleep(Math.min(deadline.retryMs, deadline.timeoutMs - (Date.now() - deadline.startedAt)));
 }
 var TURN = /^(?:0|[1-9][0-9]*)$/;
-var _a2;
-var relinquishedTurns = globalThis[_a2 = /* @__PURE__ */ Symbol.for("tinycloud.operations.relinquishedProfileTurns.v1")] ?? (globalThis[_a2] = /* @__PURE__ */ new Set());
+var _a3;
+var relinquishedTurns = globalThis[_a3 = /* @__PURE__ */ Symbol.for("tinycloud.operations.relinquishedProfileTurns.v1")] ?? (globalThis[_a3] = /* @__PURE__ */ new Set());
 var MARKER_RETRY_DELAYS_MS = [10, 50, 250];
 var SETTLE_RETRY_MS = 1e3;
 var SETTLE_RETRIES = 300;
-async function acquireTurn(profile, directory, deadline) {
+async function acquireTurn(profile, directory, deadline, liveness) {
   let firstWaitedTurn;
   let problem;
   const damaged = (what) => `The turn lock ${directory} ${what}, so no process can take it. If no tc or MCP process is using profile "${profile}", remove that directory.`;
@@ -3987,13 +4161,13 @@ async function acquireTurn(profile, directory, deadline) {
     }
     firstWaitedTurn ?? (firstWaitedTurn = latest.done ? latest.slot + 1 : latest.slot);
     if (latest.held && latest.done) {
-      const turn = await takeTurn(profile, directory, latest);
+      const turn = await takeTurn(profile, directory, latest, await ensureLiveness(liveness));
       if (turn !== null) return { turn, firstWaitedTurn };
       await waitOrTimeOut(profile, deadline);
     } else if (latest.done) {
       problem = damaged(`ends with turn ${latest.slot}, which was never granted`);
       await waitOrTimeOut(profile, deadline, problem);
-    } else if (latest.pid === process.pid ? relinquishedTurns.has(latest.token) : !isProcessAlive(latest.pid)) {
+    } else if (latest.pid === process.pid && relinquishedTurns.has(latest.token) || !await isRecordedProcessAlive(latest, liveness)) {
       await waitForTestBarrier(TEST_LOCK_TURN_SETTLE_BARRIER_DIR, profile);
       await settleAbandonedTurn(directory, latest);
       relinquishedTurns.delete(latest.token);
@@ -4038,6 +4212,7 @@ async function readTurn(directory, slot) {
   const done = await exists(join(path, `${owner.token}.done`));
   const held = await exists(join(path, `${owner.token}.held`));
   return {
+    ...owner,
     slot,
     token: owner.token,
     pid: owner.pid,
@@ -4051,11 +4226,11 @@ async function isFinishedTurn(directory, slot, token) {
   if (turn === "damaged") throw new Error(`Turn ${slot} of the turn lock ${directory} is unreadable.`);
   return turn !== null && turn.token === token && turn.held && turn.done;
 }
-async function takeTurn(profile, directory, latest) {
+async function takeTurn(profile, directory, latest, liveness) {
   const token = randomUUID();
   const slot = latest.slot + 1;
   const path = join(directory, String(slot));
-  const owner = { pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, after: latest.token };
+  const owner = { pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, after: latest.token, ...processOwner(liveness) };
   let published = false;
   try {
     published = await publishDirectory(
@@ -4109,7 +4284,7 @@ async function markTurn(path, token, kind) {
 }
 async function createTurnDirectory(directory) {
   const token = randomUUID();
-  const owner = { pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, after: null };
+  const owner = { pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, after: null, ...processOwner(null) };
   await publishDirectory(join(dirname(directory), `.stage-${basename(directory)}-${process.pid}-${token}`), directory, {
     "0/owner.json": `${JSON.stringify(owner, null, 2)}
 `,
@@ -4133,31 +4308,39 @@ async function publishDirectory(stage, target, files, beforeRename) {
     await rm(stage, { recursive: true, force: true }).catch(() => void 0);
   }
 }
-async function releaseTurn(profile, turn) {
+async function releaseTurn(profile, turn, liveness) {
   try {
     await markTurn(join(turn.directory, String(turn.slot)), turn.token, "done");
   } catch {
     settleOwnTurn(turn.directory, turn.slot, turn.token);
     return;
   }
-  await collectTurns(profile, turn).catch(() => void 0);
+  await collectTurns(profile, turn, liveness).catch(() => void 0);
 }
-function isAbandonedTurnEntry(name) {
+async function isAbandonedTurnEntry(directory, name, liveness) {
   if (name.startsWith(".trash-")) return true;
   const writer = /^\.(?:stage|deleted\.json)[-.]([0-9]+)[-.]/.exec(name)?.[1];
-  return writer !== void 0 && !isProcessAlive(Number(writer));
+  if (writer === void 0) return false;
+  if (Number(writer) !== process.pid) return !await isRecordedProcessAlive({ pid: Number(writer) }, liveness);
+  return name.startsWith(".stage-") && await isStagedOwnerGone(join(directory, name, "owner.json"), liveness);
 }
-function isAbandonedTurnDirectoryStage(name) {
+async function isAbandonedTurnDirectoryStage(directory, name, liveness) {
   const writer = /^\.stage-.+-([0-9]+)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.exec(name)?.[1];
-  return writer !== void 0 && !isProcessAlive(Number(writer));
+  if (writer === void 0) return false;
+  if (Number(writer) !== process.pid) return !await isRecordedProcessAlive({ pid: Number(writer) }, liveness);
+  return isStagedOwnerGone(join(directory, name, "0", "owner.json"), liveness);
+}
+async function isStagedOwnerGone(recordPath, liveness) {
+  const owner = await readJson(recordPath).catch(() => null);
+  return typeof owner === "object" && owner !== null && owner.pid === process.pid && !await isRecordedProcessAlive(owner, liveness);
 }
-async function collectTurns(profile, turn) {
+async function collectTurns(profile, turn, liveness) {
   for (const [directory, abandoned] of [
     [turn.directory, isAbandonedTurnEntry],
     [dirname(turn.directory), isAbandonedTurnDirectoryStage]
   ]) {
-    for (const name of (await readdir(directory)).filter(abandoned)) {
-      await rm(join(directory, name), { recursive: true, force: true }).catch(() => void 0);
+    for (const name of await readdir(directory)) {
+      if (await abandoned(directory, name, liveness)) await rm(join(directory, name), { recursive: true, force: true }).catch(() => void 0);
     }
   }
   const older = (await readdir(turn.directory)).filter((name) => TURN.test(name)).map(Number).filter((slot) => slot < turn.slot).sort((left, right) => left - right);
@@ -4175,8 +4358,9 @@ async function collectTurns(profile, turn) {
       await rm(trash, { recursive: true, force: true }).catch(() => void 0);
     }
   }
+  await sweepLiveness(liveness);
 }
-async function publishProfileLock(profile, lockPath, token, requireProfile) {
+async function publishProfileLock(profile, lockPath, token, requireProfile, liveness) {
   try {
     await mkdir(lockPath, { mode: PRIVATE_DIR_MODE });
   } catch (error) {
@@ -4189,7 +4373,7 @@ async function publishProfileLock(profile, lockPath, token, requireProfile) {
   await waitForTestBarrier(TEST_LOCK_PUBLISH_BARRIER_DIR, profile);
   const ownerPath = join(lockPath, "owner.json");
   const staged = join(dirname(lockPath), `.lock-owner-${token}.tmp`);
-  const owner = `${JSON.stringify({ pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token }, null, 2)}
+  const owner = `${JSON.stringify({ pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, ...processOwner(liveness) }, null, 2)}
 `;
   try {
     await writeFile(staged, owner, { encoding: "utf8", mode: PRIVATE_FILE_MODE, flag: "wx" });
@@ -4234,7 +4418,7 @@ async function signalTestLockContention(profile) {
   await writeFile(signalPath, `${profile}
 `, { encoding: "utf8", flag: "wx" }).catch(() => void 0);
 }
-async function recoverOwnerlessLock(profile, lockPath, staleAfterMs) {
+async function recoverOwnerlessLock(profile, lockPath, liveness, staleAfterMs) {
   let aged;
   try {
     const { mtimeMs } = await stat(lockPath);
@@ -4251,7 +4435,7 @@ async function recoverOwnerlessLock(profile, lockPath, staleAfterMs) {
     if (!onlyOrphanedClaims && (!aged || recoveryFenced(checkedAt, staleAfterMs))) return false;
     for (const name of entries.filter((entry) => RECOVERY_CLAIM.test(entry))) {
       const claimPath = join(lockPath, name);
-      if (await hasLiveRecoveryOwner(claimPath)) {
+      if (await hasLiveRecoveryOwner(claimPath, liveness)) {
         if (!await exists(join(lockPath, "owner.json"))) await rename(claimPath, join(lockPath, "owner.json"));
         return false;
       }
@@ -4267,7 +4451,7 @@ async function recoverOwnerlessLock(profile, lockPath, staleAfterMs) {
   await removeAgedOwnerFiles(lockPath, staleAfterMs);
   return true;
 }
-async function hasLiveRecoveryOwner(claimPath) {
+async function hasLiveRecoveryOwner(claimPath, liveness) {
   let contents;
   try {
     contents = await readFile(claimPath, "utf8");
@@ -4281,8 +4465,8 @@ async function hasLiveRecoveryOwner(claimPath) {
   } catch {
     return false;
   }
-  const pid = typeof owner === "object" && owner !== null && "pid" in owner ? owner.pid : null;
-  return typeof pid === "number" && Number.isInteger(pid) && pid > 0 && isProcessAlive(pid);
+  const record = typeof owner === "object" && owner !== null && "pid" in owner ? owner : null;
+  return typeof record?.pid === "number" && Number.isInteger(record.pid) && record.pid > 0 && await isRecordedProcessAlive(record, liveness);
 }
 function recoveryFenced(since, staleAfterMs) {
   return performance.now() - since >= staleAfterMs / 2;
@@ -4299,11 +4483,11 @@ async function removeAgedOwnerFiles(lockPath, staleAfterMs) {
     if (aged) await rm(path, { force: true }).catch(() => void 0);
   }
 }
-async function recoverStaleLock(profile, lockPath, staleAfterMs) {
+async function recoverStaleLock(profile, lockPath, liveness, staleAfterMs) {
   const ownerPath = join(lockPath, "owner.json");
   const observed = await readFile(ownerPath, "utf8").catch(() => null);
-  if (observed === null) return recoverOwnerlessLock(profile, lockPath, staleAfterMs);
-  if (!await isAbandonedOwner(observed, ownerPath, staleAfterMs)) return false;
+  if (observed === null) return recoverOwnerlessLock(profile, lockPath, liveness, staleAfterMs);
+  if (!await isAbandonedOwner(observed, ownerPath, liveness, staleAfterMs)) return false;
   await waitForTestBarrier(TEST_LOCK_RECOVERY_BARRIER_DIR, profile);
   const claimPath = join(lockPath, `.recover-${randomUUID()}.json`);
   let moved = false;
@@ -4339,7 +4523,7 @@ async function recoverStaleLock(profile, lockPath, staleAfterMs) {
   await removeAgedOwnerFiles(lockPath, staleAfterMs);
   return true;
 }
-async function isAbandonedOwner(observed, ownerPath, staleAfterMs) {
+async function isAbandonedOwner(observed, ownerPath, liveness, staleAfterMs) {
   let owner;
   try {
     owner = JSON.parse(observed);
@@ -4347,7 +4531,7 @@ async function isAbandonedOwner(observed, ownerPath, staleAfterMs) {
     owner = null;
   }
   if (typeof owner === "object" && owner !== null && "pid" in owner) {
-    return isStaleOwner(owner, staleAfterMs);
+    return isStaleOwner(owner, liveness, staleAfterMs);
   }
   const modifiedAt = await stat(ownerPath).then(({ mtimeMs }) => mtimeMs, () => Number.NaN);
   return Date.now() - modifiedAt >= staleAfterMs;
@@ -4369,14 +4553,14 @@ async function waitForTestBarrier(environmentName, profile) {
     }
   }
 }
-function isStaleOwner(owner, staleAfterMs) {
+async function isStaleOwner(owner, liveness, staleAfterMs) {
   const now = Date.now();
   const createdAt = typeof owner?.createdAt === "string" ? Date.parse(owner.createdAt) : Number.NaN;
   if (!Number.isFinite(createdAt) || now - createdAt < staleAfterMs) return false;
   if (typeof owner?.pid !== "number" || !Number.isInteger(owner.pid) || owner.pid <= 0) {
     return false;
   }
-  return !isProcessAlive(owner.pid);
+  return !await isRecordedProcessAlive(owner, liveness);
 }
 async function exists(path) {
   try {
@@ -4387,13 +4571,22 @@ async function exists(path) {
     throw error;
   }
 }
-function isProcessAlive(pid) {
+async function isRecordedProcessAlive(owner, acquisition) {
+  const pid = owner.pid;
+  if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0) return true;
   try {
     process.kill(pid, 0);
-    return true;
   } catch (error) {
     return !isErrno(error, "ESRCH");
   }
+  if (pid !== process.pid || typeof owner.instanceId !== "string" || !/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/.test(owner.instanceId) || owner.instanceId === processInstanceId) return true;
+  const origin = processOrigin();
+  if (!origin || owner.bootId !== origin.bootId || typeof owner.pidNamespace !== "string" || !/^pid:\[[0-9]+\]$/.test(owner.pidNamespace)) return true;
+  if (owner.pidNamespace === origin.pidNamespace) {
+    return typeof owner.processStartTime !== "string" || !/^[0-9]+$/.test(owner.processStartTime) || owner.processStartTime === origin.processStartTime;
+  }
+  const liveness = parseLiveness(owner.liveness);
+  return liveness === null || await probeLiveness(liveness, acquisition) === "unknown";
 }
 function validateProfileName(profile) {
   if (!profile || profile === "." || profile === ".." || profile.includes("/") || profile.includes("\\") || profile.includes("\0")) {
@@ -4493,6 +4686,8 @@ var STORED_GRANT_SKIP_REASONS = [
   "resources_mismatch",
   "unsupported",
   "activation_rejected",
+  "activation_unavailable",
+  "activation_unauthenticated",
   "invalid"
 ];
 var DELEGATION_CID_PATTERN = "^bafkr4i[a-z2-7]{52}$";
@@ -4726,6 +4921,9 @@ function skipped(reason) {
 }
 async function replayProfileDelegations(profile, node, options) {
   await prepareStoredDelegationReplay(profile, node, { host: options.host, migrate: options.migrate });
+  return replayStoredDelegationRecords(profile, node, options);
+}
+async function replayStoredDelegationRecords(profile, node, options) {
   const installed = [];
   const warnings = [];
   const seen = /* @__PURE__ */ new Set();
@@ -4916,6 +5114,7 @@ export {
   replayLimit,
   replayProfileDelegations,
   replayStoredDelegation,
+  replayStoredDelegationRecords,
   storedDelegationForAnotherKey,
   storedDelegationKind,
   storedDelegationSource,