@tinycloud/operations 0.5.0-beta.1 → 0.5.0-beta.10

package/dist/{contract-DfyrluLB.d.cts → contract-zRklonbR.d.cts}

@@ -1,4 +1,4 @@
-declare const OPERATION_ERROR_CODES: readonly ["INPUT_INVALID", "OPERATION_NOT_FOUND", "OPERATION_VERSION_UNSUPPORTED", "PROFILE_NOT_FOUND", "PROFILE_POSTURE_NOT_ALLOWED", "PROFILE_OWNER_OPT_IN_REQUIRED", "AUTH_REQUIRED", "PERMISSION_DENIED", "SESSION_NOT_FOUND", "PERMISSION_HINT_INVALID", "DELEGATION_ARTIFACT_INVALID", "DELEGATION_EXPIRED", "DELEGATION_AUDIENCE_MISMATCH", "DELEGATION_HOST_MISMATCH", "DELEGATION_REJECTED", "ENCRYPTION_NETWORK_UNRESOLVED", "NODE_UNREACHABLE", "NODE_ERROR", "STORAGE_QUOTA_EXCEEDED", "KV_NOT_FOUND", "KV_PRECONDITION_FAILED", "KV_CONFLICT", "KV_RESPONSE_TOO_LARGE", "SQL_QUERY_INVALID", "SQL_EXECUTION_FAILED", "SQL_RESULT_LIMIT_EXCEEDED", "SQL_VALUE_UNSAFE", "SECRET_READ_FAILED", "SECRET_DECRYPT_FAILED", "OUTPUT_INVALID", "INTERNAL_ERROR"];
+declare const OPERATION_ERROR_CODES: readonly ["INPUT_INVALID", "OPERATION_NOT_FOUND", "OPERATION_VERSION_UNSUPPORTED", "PROFILE_NOT_FOUND", "PROFILE_POSTURE_NOT_ALLOWED", "PROFILE_OWNER_OPT_IN_REQUIRED", "PROFILE_MIGRATION_REQUIRED", "AUTH_REQUIRED", "PERMISSION_DENIED", "SESSION_NOT_FOUND", "PERMISSION_HINT_INVALID", "DELEGATION_ARTIFACT_INVALID", "DELEGATION_EXPIRED", "DELEGATION_AUDIENCE_MISMATCH", "DELEGATION_HOST_MISMATCH", "DELEGATION_REJECTED", "ENCRYPTION_NETWORK_UNRESOLVED", "NODE_UNREACHABLE", "NODE_ERROR", "STORAGE_QUOTA_EXCEEDED", "KV_NOT_FOUND", "KV_PRECONDITION_FAILED", "KV_CONFLICT", "KV_RESPONSE_TOO_LARGE", "SQL_QUERY_INVALID", "SQL_EXECUTION_FAILED", "SQL_RESULT_LIMIT_EXCEEDED", "SQL_VALUE_UNSAFE", "SECRET_READ_FAILED", "SECRET_DECRYPT_FAILED", "OUTPUT_INVALID", "INTERNAL_ERROR"];
 type OperationErrorCode = (typeof OPERATION_ERROR_CODES)[number];
 interface OperationError {
     readonly code: OperationErrorCode;
@@ -29,9 +29,12 @@ interface OperationContextSummary {
  * Why a stored grant was not used. A fixed vocabulary: diagnostics never
  * carry exception text, node responses, URLs or other stored transport data.
  * `unbound`: the record has no valid request binding where one is required;
- * `outside_request`: its signed authority exceeds its binding.
+ * `outside_request`: its signed authority exceeds its binding;
+ * `activation_unavailable`: the node could not be reached, timed out, was
+ * rate limited or failed (transport, 408, 429, 5xx) while activating it;
+ * `activation_unauthenticated`: the node answered 401 while activating it.
  */
-declare const STORED_GRANT_SKIP_REASONS: readonly ["malformed", "unbound", "outside_request", "host_mismatch", "expired", "cid_mismatch", "authority_invalid", "proof_missing", "proof_invalid", "owner_mismatch", "audience_mismatch", "resources_mismatch", "unsupported", "activation_rejected", "invalid"];
+declare const STORED_GRANT_SKIP_REASONS: readonly ["malformed", "unbound", "outside_request", "host_mismatch", "expired", "cid_mismatch", "authority_invalid", "proof_missing", "proof_invalid", "owner_mismatch", "audience_mismatch", "resources_mismatch", "unsupported", "activation_rejected", "activation_unavailable", "activation_unauthenticated", "invalid"];
 type StoredGrantSkipReason = typeof STORED_GRANT_SKIP_REASONS[number];
 /**
  * A non-fatal diagnostic attached to a result. `STORED_GRANT_SKIPPED`: a

package/dist/{contract-DfyrluLB.d.ts → contract-zRklonbR.d.ts}

@@ -1,4 +1,4 @@
-declare const OPERATION_ERROR_CODES: readonly ["INPUT_INVALID", "OPERATION_NOT_FOUND", "OPERATION_VERSION_UNSUPPORTED", "PROFILE_NOT_FOUND", "PROFILE_POSTURE_NOT_ALLOWED", "PROFILE_OWNER_OPT_IN_REQUIRED", "AUTH_REQUIRED", "PERMISSION_DENIED", "SESSION_NOT_FOUND", "PERMISSION_HINT_INVALID", "DELEGATION_ARTIFACT_INVALID", "DELEGATION_EXPIRED", "DELEGATION_AUDIENCE_MISMATCH", "DELEGATION_HOST_MISMATCH", "DELEGATION_REJECTED", "ENCRYPTION_NETWORK_UNRESOLVED", "NODE_UNREACHABLE", "NODE_ERROR", "STORAGE_QUOTA_EXCEEDED", "KV_NOT_FOUND", "KV_PRECONDITION_FAILED", "KV_CONFLICT", "KV_RESPONSE_TOO_LARGE", "SQL_QUERY_INVALID", "SQL_EXECUTION_FAILED", "SQL_RESULT_LIMIT_EXCEEDED", "SQL_VALUE_UNSAFE", "SECRET_READ_FAILED", "SECRET_DECRYPT_FAILED", "OUTPUT_INVALID", "INTERNAL_ERROR"];
+declare const OPERATION_ERROR_CODES: readonly ["INPUT_INVALID", "OPERATION_NOT_FOUND", "OPERATION_VERSION_UNSUPPORTED", "PROFILE_NOT_FOUND", "PROFILE_POSTURE_NOT_ALLOWED", "PROFILE_OWNER_OPT_IN_REQUIRED", "PROFILE_MIGRATION_REQUIRED", "AUTH_REQUIRED", "PERMISSION_DENIED", "SESSION_NOT_FOUND", "PERMISSION_HINT_INVALID", "DELEGATION_ARTIFACT_INVALID", "DELEGATION_EXPIRED", "DELEGATION_AUDIENCE_MISMATCH", "DELEGATION_HOST_MISMATCH", "DELEGATION_REJECTED", "ENCRYPTION_NETWORK_UNRESOLVED", "NODE_UNREACHABLE", "NODE_ERROR", "STORAGE_QUOTA_EXCEEDED", "KV_NOT_FOUND", "KV_PRECONDITION_FAILED", "KV_CONFLICT", "KV_RESPONSE_TOO_LARGE", "SQL_QUERY_INVALID", "SQL_EXECUTION_FAILED", "SQL_RESULT_LIMIT_EXCEEDED", "SQL_VALUE_UNSAFE", "SECRET_READ_FAILED", "SECRET_DECRYPT_FAILED", "OUTPUT_INVALID", "INTERNAL_ERROR"];
 type OperationErrorCode = (typeof OPERATION_ERROR_CODES)[number];
 interface OperationError {
     readonly code: OperationErrorCode;
@@ -29,9 +29,12 @@ interface OperationContextSummary {
  * Why a stored grant was not used. A fixed vocabulary: diagnostics never
  * carry exception text, node responses, URLs or other stored transport data.
  * `unbound`: the record has no valid request binding where one is required;
- * `outside_request`: its signed authority exceeds its binding.
+ * `outside_request`: its signed authority exceeds its binding;
+ * `activation_unavailable`: the node could not be reached, timed out, was
+ * rate limited or failed (transport, 408, 429, 5xx) while activating it;
+ * `activation_unauthenticated`: the node answered 401 while activating it.
  */
-declare const STORED_GRANT_SKIP_REASONS: readonly ["malformed", "unbound", "outside_request", "host_mismatch", "expired", "cid_mismatch", "authority_invalid", "proof_missing", "proof_invalid", "owner_mismatch", "audience_mismatch", "resources_mismatch", "unsupported", "activation_rejected", "invalid"];
+declare const STORED_GRANT_SKIP_REASONS: readonly ["malformed", "unbound", "outside_request", "host_mismatch", "expired", "cid_mismatch", "authority_invalid", "proof_missing", "proof_invalid", "owner_mismatch", "audience_mismatch", "resources_mismatch", "unsupported", "activation_rejected", "activation_unavailable", "activation_unauthenticated", "invalid"];
 type StoredGrantSkipReason = typeof STORED_GRANT_SKIP_REASONS[number];
 /**
  * A non-fatal diagnostic attached to a result. `STORED_GRANT_SKIPPED`: a

package/dist/delegation-binding.cjs

@@ -730,6 +730,7 @@ __export(delegation_binding_exports, {
   replayLimit: () => replayLimit,
   replayProfileDelegations: () => replayProfileDelegations,
   replayStoredDelegation: () => replayStoredDelegation,
+  replayStoredDelegationRecords: () => replayStoredDelegationRecords,
   storedDelegationForAnotherKey: () => storedDelegationForAnotherKey,
   storedDelegationKind: () => storedDelegationKind,
   storedDelegationSource: () => storedDelegationSource,
@@ -3653,10 +3654,10 @@ function evaluateOperationAuthority(granted, required, resolveSpace) {
   const canonicalRequired = canonicalizeOperationCapabilities(required, resolveSpace);
   const missing = [];
   for (const requested of canonicalRequired) {
-    const covered = canonicalGranted.some(
-      (candidate) => candidate.service === requested.service && operationSpacesEqual(candidate.space, requested.space) && isCapabilitySubset([requested], [candidate]).subset
+    const sameScope = canonicalGranted.filter(
+      (candidate) => candidate.service === requested.service && operationSpacesEqual(candidate.space, requested.space)
     );
-    if (!covered) missing.push(requested);
+    if (!isCapabilitySubset([requested], sameScope).subset) missing.push(requested);
   }
   return {
     satisfied: missing.length === 0,
@@ -3733,7 +3734,9 @@ function canonicalizeCaveats(caveats) {
 // src/state.ts
 var import_node_crypto = require("crypto");
 var import_node_async_hooks = require("async_hooks");
+var import_node_fs = require("fs");
 var import_promises = require("fs/promises");
+var import_node_net = require("net");
 var import_node_os = require("os");
 var import_node_path = require("path");
 var DEFAULT_LOCK_TIMEOUT_MS = 2e3;
@@ -3753,13 +3756,171 @@ var TEST_LOCK_MOVED_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_MOVED_BARRIER_DIR";
 var TEST_LOCK_TURN_PUBLISH_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_TURN_PUBLISH_BARRIER_DIR";
 var TEST_LOCK_TURN_SETTLE_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_TURN_SETTLE_BARRIER_DIR";
 var TEST_LOCK_TURN_COLLECT_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_TURN_COLLECT_BARRIER_DIR";
+var TEST_LOCK_LIVENESS_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_LIVENESS_BARRIER_DIR";
 function processWideContext(key) {
-  var _a3;
+  var _a4;
   const registry = globalThis;
-  return registry[_a3 = Symbol.for(key)] ?? (registry[_a3] = new import_node_async_hooks.AsyncLocalStorage());
+  return registry[_a4 = Symbol.for(key)] ?? (registry[_a4] = new import_node_async_hooks.AsyncLocalStorage());
 }
 var invocationStateRoot = processWideContext("tinycloud.operations.invocationStateRoot.v1");
 var heldProfileLocks = processWideContext("tinycloud.operations.heldProfileLocks.v2");
+var _a2;
+var processInstanceId = globalThis[_a2 = /* @__PURE__ */ Symbol.for("tinycloud.operations.profileLockInstance.v1")] ?? (globalThis[_a2] = (0, import_node_crypto.randomUUID)());
+var cachedProcessOrigin;
+function processOrigin() {
+  if (cachedProcessOrigin !== void 0) return cachedProcessOrigin;
+  if (process.platform !== "linux") return cachedProcessOrigin = null;
+  try {
+    const bootId = (0, import_node_fs.readFileSync)("/proc/sys/kernel/random/boot_id", "utf8").trim();
+    const pidNamespace = (0, import_node_fs.readlinkSync)("/proc/self/ns/pid");
+    const processStat = (0, import_node_fs.readFileSync)("/proc/self/stat", "utf8");
+    const closingParen = processStat.lastIndexOf(") ");
+    const processStartTime = closingParen < 0 ? void 0 : processStat.slice(closingParen + 2).trim().split(/\s+/)[19];
+    if (!/^[0-9a-f-]{36}$/.test(bootId) || !/^pid:\[[0-9]+\]$/.test(pidNamespace) || !processStartTime || !/^[0-9]+$/.test(processStartTime)) {
+      return cachedProcessOrigin = null;
+    }
+    return cachedProcessOrigin = { bootId, pidNamespace, processStartTime };
+  } catch {
+    return cachedProcessOrigin = null;
+  }
+}
+function processOwner(liveness) {
+  return { instanceId: processInstanceId, ...processOrigin(), ...liveness ? { liveness: liveness.record } : {} };
+}
+var LIVENESS_SOCKET = /^\.live-([0-9a-f]+)-([0-9a-f]+)-[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}(\.new)?$/;
+var LIVENESS_PROBE_TIMEOUT_MS = 1e3;
+function socketDirectory(name) {
+  const match = LIVENESS_SOCKET.exec(name);
+  return match ? `${match[1]}-${match[2]}` : null;
+}
+async function pinDirectory(directory) {
+  const handle = await (0, import_promises.open)(directory, "r");
+  try {
+    const { dev, ino } = await handle.stat({ bigint: true });
+    return {
+      identity: `${dev.toString(16)}-${ino.toString(16)}`,
+      path: (name) => `/proc/self/fd/${handle.fd}/${name}`,
+      close: () => handle.close()
+    };
+  } catch (error) {
+    await handle.close();
+    throw error;
+  }
+}
+async function bindLiveness(directory) {
+  if (!processOrigin()) return null;
+  let pinned;
+  try {
+    pinned = await pinDirectory(directory);
+  } catch {
+    return null;
+  }
+  const socket = `.live-${pinned.identity}-${(0, import_node_crypto.randomUUID)()}`;
+  const server = (0, import_node_net.createServer)((connection) => connection.destroy());
+  let bound = false;
+  try {
+    await new Promise((resolve2, reject) => {
+      server.once("error", reject);
+      server.listen({ path: pinned.path(`${socket}.new`), exclusive: true }, () => {
+        server.off("error", reject);
+        resolve2();
+      });
+    });
+    bound = true;
+    server.on("error", () => void 0);
+    server.unref();
+    await (0, import_promises.rename)(pinned.path(`${socket}.new`), pinned.path(socket));
+    const stats = await (0, import_promises.lstat)(pinned.path(socket), { bigint: true });
+    if (!stats.isSocket()) throw new Error(`${socket} is not a socket`);
+    await waitForTestBarrier(TEST_LOCK_LIVENESS_BARRIER_DIR, (0, import_node_path.basename)(directory));
+    return { record: { socket, dev: String(stats.dev), ino: String(stats.ino) }, path: (0, import_node_path.join)(directory, socket), server };
+  } catch {
+    if (bound) {
+      server.close();
+      for (const name of [`${socket}.new`, socket]) await (0, import_promises.unlink)(pinned.path(name)).catch(() => void 0);
+    }
+    return null;
+  } finally {
+    await pinned.close();
+  }
+}
+async function ensureLiveness(acquisition) {
+  if (acquisition.held === void 0) acquisition.held = await bindLiveness(acquisition.directory);
+  return acquisition.held;
+}
+async function closeLiveness(held) {
+  held.server.close();
+  await (0, import_promises.unlink)(held.path).catch(() => void 0);
+}
+function parseLiveness(value) {
+  if (typeof value !== "object" || value === null) return null;
+  const { socket, dev, ino } = value;
+  const name = typeof socket === "string" ? LIVENESS_SOCKET.exec(socket) : null;
+  return name !== null && name[3] === void 0 && typeof dev === "string" && /^[0-9]+$/.test(dev) && typeof ino === "string" && /^[0-9]+$/.test(ino) ? { socket: name[0], dev, ino } : null;
+}
+async function controlIn(pinned, acquisition) {
+  const own = await ensureLiveness(acquisition);
+  if (!own || socketDirectory(own.record.socket) !== pinned.identity) return null;
+  const stats = await (0, import_promises.lstat)(pinned.path(own.record.socket), { bigint: true }).catch(() => null);
+  return stats?.isSocket() && String(stats.dev) === own.record.dev && String(stats.ino) === own.record.ino ? own : null;
+}
+async function tryConnect(path) {
+  return new Promise((resolve2) => {
+    const probe = (0, import_node_net.connect)({ path });
+    const settle = (outcome) => {
+      clearTimeout(timer);
+      probe.destroy();
+      resolve2(outcome);
+    };
+    const timer = setTimeout(() => settle("other"), LIVENESS_PROBE_TIMEOUT_MS);
+    probe.once("connect", () => settle("connected"));
+    probe.once("error", (error) => settle(isErrno(error, "ECONNREFUSED") ? "refused" : "other"));
+  });
+}
+async function kernelRefuses(pinned, name, control) {
+  if (process.versions.bun !== void 0) return false;
+  return await tryConnect(pinned.path(name)) === "refused" && await tryConnect(pinned.path(control.record.socket)) === "connected";
+}
+async function probeLiveness(liveness, acquisition) {
+  let pinned;
+  try {
+    pinned = await pinDirectory(acquisition.directory);
+  } catch {
+    return "unknown";
+  }
+  try {
+    if (socketDirectory(liveness.socket) !== pinned.identity) return "unknown";
+    const control = await controlIn(pinned, acquisition);
+    if (!control) return "unknown";
+    let stats;
+    try {
+      stats = await (0, import_promises.lstat)(pinned.path(liveness.socket), { bigint: true });
+    } catch (error) {
+      return isErrno(error, "ENOENT") ? "gone" : "unknown";
+    }
+    if (!stats.isSocket() || String(stats.dev) !== liveness.dev || String(stats.ino) !== liveness.ino) return "unknown";
+    return await kernelRefuses(pinned, liveness.socket, control) ? "refused" : "unknown";
+  } finally {
+    await pinned.close();
+  }
+}
+async function sweepLiveness(acquisition) {
+  if (process.versions.bun !== void 0 || !acquisition.held) return;
+  const pinned = await pinDirectory(acquisition.directory);
+  try {
+    const control = await controlIn(pinned, acquisition);
+    if (!control) return;
+    for (const name of await (0, import_promises.readdir)(pinned.path("."))) {
+      if (name === control.record.socket || socketDirectory(name) !== pinned.identity) continue;
+      const stats = await (0, import_promises.lstat)(pinned.path(name)).catch(() => null);
+      if (stats?.isSocket() && await kernelRefuses(pinned, name, control)) {
+        await (0, import_promises.unlink)(pinned.path(name)).catch(() => void 0);
+      }
+    }
+  } finally {
+    await pinned.close();
+  }
+}
 var ProfileLockTimeoutError = class extends Error {
   /** `detail` names the cause when it is not simply another process holding the lock. */
   constructor(profile, timeoutMs, detail) {
@@ -3931,7 +4092,18 @@ async function acquireProfileLock(profile, options) {
       if (path !== directory || !isErrno(error, "ENOENT")) throw error;
     });
   }
-  const { turn, firstWaitedTurn } = await acquireTurn(profile, turnDirectory, deadline);
+  const liveness = { directory: turnDirectory, held: void 0 };
+  const closeAcquisitionLiveness = async () => {
+    if (liveness.held) await closeLiveness(liveness.held);
+  };
+  let taken;
+  try {
+    taken = await acquireTurn(profile, turnDirectory, deadline, liveness);
+  } catch (error) {
+    await closeAcquisitionLiveness();
+    throw error;
+  }
+  const { turn, firstWaitedTurn } = taken;
   try {
     if (options.requireProfile && !await exists(profileConfigPath(profile))) {
       await (0, import_promises.rmdir)(directory).catch(() => void 0);
@@ -3941,7 +4113,7 @@ async function acquireProfileLock(profile, options) {
     const deletedWhileWaiting = typeof deletion?.slot === "number" && deletion.slot >= firstWaitedTurn;
     while (true) {
       const token = (0, import_node_crypto.randomUUID)();
-      if (await publishProfileLock(profile, lockPath, token, options.requireProfile === true)) {
+      if (await publishProfileLock(profile, lockPath, token, options.requireProfile === true, liveness.held ?? null)) {
         return {
           deletedWhileWaiting,
           turnSlot: turn.slot,
@@ -3949,17 +4121,19 @@ async function acquireProfileLock(profile, options) {
             try {
               await releaseProfileLock(profile, lockPath, token);
             } finally {
-              await releaseTurn(profile, turn);
+              await releaseTurn(profile, turn, liveness);
+              await closeAcquisitionLiveness();
             }
           }
         };
       }
       await signalTestLockContention(profile);
-      if (await recoverStaleLock(profile, lockPath, staleAfterMs)) continue;
+      if (await recoverStaleLock(profile, lockPath, liveness, staleAfterMs)) continue;
       await waitOrTimeOut(profile, deadline);
     }
   } catch (error) {
-    await releaseTurn(profile, turn);
+    await releaseTurn(profile, turn, liveness);
+    await closeAcquisitionLiveness();
     throw error;
   }
 }
@@ -3973,12 +4147,12 @@ async function waitOrTimeOut(profile, deadline, detail) {
   await sleep(Math.min(deadline.retryMs, deadline.timeoutMs - (Date.now() - deadline.startedAt)));
 }
 var TURN = /^(?:0|[1-9][0-9]*)$/;
-var _a2;
-var relinquishedTurns = globalThis[_a2 = /* @__PURE__ */ Symbol.for("tinycloud.operations.relinquishedProfileTurns.v1")] ?? (globalThis[_a2] = /* @__PURE__ */ new Set());
+var _a3;
+var relinquishedTurns = globalThis[_a3 = /* @__PURE__ */ Symbol.for("tinycloud.operations.relinquishedProfileTurns.v1")] ?? (globalThis[_a3] = /* @__PURE__ */ new Set());
 var MARKER_RETRY_DELAYS_MS = [10, 50, 250];
 var SETTLE_RETRY_MS = 1e3;
 var SETTLE_RETRIES = 300;
-async function acquireTurn(profile, directory, deadline) {
+async function acquireTurn(profile, directory, deadline, liveness) {
   let firstWaitedTurn;
   let problem;
   const damaged = (what) => `The turn lock ${directory} ${what}, so no process can take it. If no tc or MCP process is using profile "${profile}", remove that directory.`;
@@ -4003,13 +4177,13 @@ async function acquireTurn(profile, directory, deadline) {
     }
     firstWaitedTurn ?? (firstWaitedTurn = latest.done ? latest.slot + 1 : latest.slot);
     if (latest.held && latest.done) {
-      const turn = await takeTurn(profile, directory, latest);
+      const turn = await takeTurn(profile, directory, latest, await ensureLiveness(liveness));
       if (turn !== null) return { turn, firstWaitedTurn };
       await waitOrTimeOut(profile, deadline);
     } else if (latest.done) {
       problem = damaged(`ends with turn ${latest.slot}, which was never granted`);
       await waitOrTimeOut(profile, deadline, problem);
-    } else if (latest.pid === process.pid ? relinquishedTurns.has(latest.token) : !isProcessAlive(latest.pid)) {
+    } else if (latest.pid === process.pid && relinquishedTurns.has(latest.token) || !await isRecordedProcessAlive(latest, liveness)) {
       await waitForTestBarrier(TEST_LOCK_TURN_SETTLE_BARRIER_DIR, profile);
       await settleAbandonedTurn(directory, latest);
       relinquishedTurns.delete(latest.token);
@@ -4054,6 +4228,7 @@ async function readTurn(directory, slot) {
   const done = await exists((0, import_node_path.join)(path, `${owner.token}.done`));
   const held = await exists((0, import_node_path.join)(path, `${owner.token}.held`));
   return {
+    ...owner,
     slot,
     token: owner.token,
     pid: owner.pid,
@@ -4067,11 +4242,11 @@ async function isFinishedTurn(directory, slot, token) {
   if (turn === "damaged") throw new Error(`Turn ${slot} of the turn lock ${directory} is unreadable.`);
   return turn !== null && turn.token === token && turn.held && turn.done;
 }
-async function takeTurn(profile, directory, latest) {
+async function takeTurn(profile, directory, latest, liveness) {
   const token = (0, import_node_crypto.randomUUID)();
   const slot = latest.slot + 1;
   const path = (0, import_node_path.join)(directory, String(slot));
-  const owner = { pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, after: latest.token };
+  const owner = { pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, after: latest.token, ...processOwner(liveness) };
   let published = false;
   try {
     published = await publishDirectory(
@@ -4125,7 +4300,7 @@ async function markTurn(path, token, kind) {
 }
 async function createTurnDirectory(directory) {
   const token = (0, import_node_crypto.randomUUID)();
-  const owner = { pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, after: null };
+  const owner = { pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, after: null, ...processOwner(null) };
   await publishDirectory((0, import_node_path.join)((0, import_node_path.dirname)(directory), `.stage-${(0, import_node_path.basename)(directory)}-${process.pid}-${token}`), directory, {
     "0/owner.json": `${JSON.stringify(owner, null, 2)}
 `,
@@ -4149,31 +4324,39 @@ async function publishDirectory(stage, target, files, beforeRename) {
     await (0, import_promises.rm)(stage, { recursive: true, force: true }).catch(() => void 0);
   }
 }
-async function releaseTurn(profile, turn) {
+async function releaseTurn(profile, turn, liveness) {
   try {
     await markTurn((0, import_node_path.join)(turn.directory, String(turn.slot)), turn.token, "done");
   } catch {
     settleOwnTurn(turn.directory, turn.slot, turn.token);
     return;
   }
-  await collectTurns(profile, turn).catch(() => void 0);
+  await collectTurns(profile, turn, liveness).catch(() => void 0);
 }
-function isAbandonedTurnEntry(name) {
+async function isAbandonedTurnEntry(directory, name, liveness) {
   if (name.startsWith(".trash-")) return true;
   const writer = /^\.(?:stage|deleted\.json)[-.]([0-9]+)[-.]/.exec(name)?.[1];
-  return writer !== void 0 && !isProcessAlive(Number(writer));
+  if (writer === void 0) return false;
+  if (Number(writer) !== process.pid) return !await isRecordedProcessAlive({ pid: Number(writer) }, liveness);
+  return name.startsWith(".stage-") && await isStagedOwnerGone((0, import_node_path.join)(directory, name, "owner.json"), liveness);
 }
-function isAbandonedTurnDirectoryStage(name) {
+async function isAbandonedTurnDirectoryStage(directory, name, liveness) {
   const writer = /^\.stage-.+-([0-9]+)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.exec(name)?.[1];
-  return writer !== void 0 && !isProcessAlive(Number(writer));
+  if (writer === void 0) return false;
+  if (Number(writer) !== process.pid) return !await isRecordedProcessAlive({ pid: Number(writer) }, liveness);
+  return isStagedOwnerGone((0, import_node_path.join)(directory, name, "0", "owner.json"), liveness);
+}
+async function isStagedOwnerGone(recordPath, liveness) {
+  const owner = await readJson(recordPath).catch(() => null);
+  return typeof owner === "object" && owner !== null && owner.pid === process.pid && !await isRecordedProcessAlive(owner, liveness);
 }
-async function collectTurns(profile, turn) {
+async function collectTurns(profile, turn, liveness) {
   for (const [directory, abandoned] of [
     [turn.directory, isAbandonedTurnEntry],
     [(0, import_node_path.dirname)(turn.directory), isAbandonedTurnDirectoryStage]
   ]) {
-    for (const name of (await (0, import_promises.readdir)(directory)).filter(abandoned)) {
-      await (0, import_promises.rm)((0, import_node_path.join)(directory, name), { recursive: true, force: true }).catch(() => void 0);
+    for (const name of await (0, import_promises.readdir)(directory)) {
+      if (await abandoned(directory, name, liveness)) await (0, import_promises.rm)((0, import_node_path.join)(directory, name), { recursive: true, force: true }).catch(() => void 0);
     }
   }
   const older = (await (0, import_promises.readdir)(turn.directory)).filter((name) => TURN.test(name)).map(Number).filter((slot) => slot < turn.slot).sort((left, right) => left - right);
@@ -4191,8 +4374,9 @@ async function collectTurns(profile, turn) {
       await (0, import_promises.rm)(trash, { recursive: true, force: true }).catch(() => void 0);
     }
   }
+  await sweepLiveness(liveness);
 }
-async function publishProfileLock(profile, lockPath, token, requireProfile) {
+async function publishProfileLock(profile, lockPath, token, requireProfile, liveness) {
   try {
     await (0, import_promises.mkdir)(lockPath, { mode: PRIVATE_DIR_MODE });
   } catch (error) {
@@ -4205,7 +4389,7 @@ async function publishProfileLock(profile, lockPath, token, requireProfile) {
   await waitForTestBarrier(TEST_LOCK_PUBLISH_BARRIER_DIR, profile);
   const ownerPath = (0, import_node_path.join)(lockPath, "owner.json");
   const staged = (0, import_node_path.join)((0, import_node_path.dirname)(lockPath), `.lock-owner-${token}.tmp`);
-  const owner = `${JSON.stringify({ pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token }, null, 2)}
+  const owner = `${JSON.stringify({ pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, ...processOwner(liveness) }, null, 2)}
 `;
   try {
     await (0, import_promises.writeFile)(staged, owner, { encoding: "utf8", mode: PRIVATE_FILE_MODE, flag: "wx" });
@@ -4250,7 +4434,7 @@ async function signalTestLockContention(profile) {
   await (0, import_promises.writeFile)(signalPath, `${profile}
 `, { encoding: "utf8", flag: "wx" }).catch(() => void 0);
 }
-async function recoverOwnerlessLock(profile, lockPath, staleAfterMs) {
+async function recoverOwnerlessLock(profile, lockPath, liveness, staleAfterMs) {
   let aged;
   try {
     const { mtimeMs } = await (0, import_promises.stat)(lockPath);
@@ -4267,7 +4451,7 @@ async function recoverOwnerlessLock(profile, lockPath, staleAfterMs) {
     if (!onlyOrphanedClaims && (!aged || recoveryFenced(checkedAt, staleAfterMs))) return false;
     for (const name of entries.filter((entry) => RECOVERY_CLAIM.test(entry))) {
       const claimPath = (0, import_node_path.join)(lockPath, name);
-      if (await hasLiveRecoveryOwner(claimPath)) {
+      if (await hasLiveRecoveryOwner(claimPath, liveness)) {
         if (!await exists((0, import_node_path.join)(lockPath, "owner.json"))) await (0, import_promises.rename)(claimPath, (0, import_node_path.join)(lockPath, "owner.json"));
         return false;
       }
@@ -4283,7 +4467,7 @@ async function recoverOwnerlessLock(profile, lockPath, staleAfterMs) {
   await removeAgedOwnerFiles(lockPath, staleAfterMs);
   return true;
 }
-async function hasLiveRecoveryOwner(claimPath) {
+async function hasLiveRecoveryOwner(claimPath, liveness) {
   let contents;
   try {
     contents = await (0, import_promises.readFile)(claimPath, "utf8");
@@ -4297,8 +4481,8 @@ async function hasLiveRecoveryOwner(claimPath) {
   } catch {
     return false;
   }
-  const pid = typeof owner === "object" && owner !== null && "pid" in owner ? owner.pid : null;
-  return typeof pid === "number" && Number.isInteger(pid) && pid > 0 && isProcessAlive(pid);
+  const record = typeof owner === "object" && owner !== null && "pid" in owner ? owner : null;
+  return typeof record?.pid === "number" && Number.isInteger(record.pid) && record.pid > 0 && await isRecordedProcessAlive(record, liveness);
 }
 function recoveryFenced(since, staleAfterMs) {
   return performance.now() - since >= staleAfterMs / 2;
@@ -4315,11 +4499,11 @@ async function removeAgedOwnerFiles(lockPath, staleAfterMs) {
     if (aged) await (0, import_promises.rm)(path, { force: true }).catch(() => void 0);
   }
 }
-async function recoverStaleLock(profile, lockPath, staleAfterMs) {
+async function recoverStaleLock(profile, lockPath, liveness, staleAfterMs) {
   const ownerPath = (0, import_node_path.join)(lockPath, "owner.json");
   const observed = await (0, import_promises.readFile)(ownerPath, "utf8").catch(() => null);
-  if (observed === null) return recoverOwnerlessLock(profile, lockPath, staleAfterMs);
-  if (!await isAbandonedOwner(observed, ownerPath, staleAfterMs)) return false;
+  if (observed === null) return recoverOwnerlessLock(profile, lockPath, liveness, staleAfterMs);
+  if (!await isAbandonedOwner(observed, ownerPath, liveness, staleAfterMs)) return false;
   await waitForTestBarrier(TEST_LOCK_RECOVERY_BARRIER_DIR, profile);
   const claimPath = (0, import_node_path.join)(lockPath, `.recover-${(0, import_node_crypto.randomUUID)()}.json`);
   let moved = false;
@@ -4355,7 +4539,7 @@ async function recoverStaleLock(profile, lockPath, staleAfterMs) {
   await removeAgedOwnerFiles(lockPath, staleAfterMs);
   return true;
 }
-async function isAbandonedOwner(observed, ownerPath, staleAfterMs) {
+async function isAbandonedOwner(observed, ownerPath, liveness, staleAfterMs) {
   let owner;
   try {
     owner = JSON.parse(observed);
@@ -4363,7 +4547,7 @@ async function isAbandonedOwner(observed, ownerPath, staleAfterMs) {
     owner = null;
   }
   if (typeof owner === "object" && owner !== null && "pid" in owner) {
-    return isStaleOwner(owner, staleAfterMs);
+    return isStaleOwner(owner, liveness, staleAfterMs);
   }
   const modifiedAt = await (0, import_promises.stat)(ownerPath).then(({ mtimeMs }) => mtimeMs, () => Number.NaN);
   return Date.now() - modifiedAt >= staleAfterMs;
@@ -4385,14 +4569,14 @@ async function waitForTestBarrier(environmentName, profile) {
     }
   }
 }
-function isStaleOwner(owner, staleAfterMs) {
+async function isStaleOwner(owner, liveness, staleAfterMs) {
   const now = Date.now();
   const createdAt = typeof owner?.createdAt === "string" ? Date.parse(owner.createdAt) : Number.NaN;
   if (!Number.isFinite(createdAt) || now - createdAt < staleAfterMs) return false;
   if (typeof owner?.pid !== "number" || !Number.isInteger(owner.pid) || owner.pid <= 0) {
     return false;
   }
-  return !isProcessAlive(owner.pid);
+  return !await isRecordedProcessAlive(owner, liveness);
 }
 async function exists(path) {
   try {
@@ -4403,13 +4587,22 @@ async function exists(path) {
     throw error;
   }
 }
-function isProcessAlive(pid) {
+async function isRecordedProcessAlive(owner, acquisition) {
+  const pid = owner.pid;
+  if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0) return true;
   try {
     process.kill(pid, 0);
-    return true;
   } catch (error) {
     return !isErrno(error, "ESRCH");
   }
+  if (pid !== process.pid || typeof owner.instanceId !== "string" || !/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/.test(owner.instanceId) || owner.instanceId === processInstanceId) return true;
+  const origin = processOrigin();
+  if (!origin || owner.bootId !== origin.bootId || typeof owner.pidNamespace !== "string" || !/^pid:\[[0-9]+\]$/.test(owner.pidNamespace)) return true;
+  if (owner.pidNamespace === origin.pidNamespace) {
+    return typeof owner.processStartTime !== "string" || !/^[0-9]+$/.test(owner.processStartTime) || owner.processStartTime === origin.processStartTime;
+  }
+  const liveness = parseLiveness(owner.liveness);
+  return liveness === null || await probeLiveness(liveness, acquisition) === "unknown";
 }
 function validateProfileName(profile) {
   if (!profile || profile === "." || profile === ".." || profile.includes("/") || profile.includes("\\") || profile.includes("\0")) {
@@ -4509,6 +4702,8 @@ var STORED_GRANT_SKIP_REASONS = [
   "resources_mismatch",
   "unsupported",
   "activation_rejected",
+  "activation_unavailable",
+  "activation_unauthenticated",
   "invalid"
 ];
 var DELEGATION_CID_PATTERN = "^bafkr4i[a-z2-7]{52}$";
@@ -4742,6 +4937,9 @@ function skipped(reason) {
 }
 async function replayProfileDelegations(profile, node, options) {
   await prepareStoredDelegationReplay(profile, node, { host: options.host, migrate: options.migrate });
+  return replayStoredDelegationRecords(profile, node, options);
+}
+async function replayStoredDelegationRecords(profile, node, options) {
   const installed = [];
   const warnings = [];
   const seen = /* @__PURE__ */ new Set();
@@ -4933,6 +5131,7 @@ function isRecord(value) {
   replayLimit,
   replayProfileDelegations,
   replayStoredDelegation,
+  replayStoredDelegationRecords,
   storedDelegationForAnotherKey,
   storedDelegationKind,
   storedDelegationSource,