@tinycloud/operations 0.6.1-beta.0 → 0.6.1-beta.10

package/dist/cli-runtime.cjs

@@ -274,6 +274,18 @@ function storageFullOperationError(error) {
     { retryable: false, ...account === void 0 ? {} : { details: { account } } }
   );
 }
+function nodeRetryOperationError(error) {
+  const code = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+  if (code === "OUTCOME_UNKNOWN") {
+    return operationError(
+      "NODE_ERROR",
+      "The TinyCloud node may have applied the write; read the data back before retrying.",
+      { retryable: false }
+    );
+  }
+  if (code !== "NODE_BUSY" && code !== "REQUEST_TIMEOUT") return void 0;
+  return operationError("NODE_ERROR", "The TinyCloud node was busy and applied nothing; try again shortly.", { retryable: true });
+}
 function isOperationErrorCode(value) {
   return typeof value === "string" && OPERATION_ERROR_CODES.includes(value);
 }
@@ -1045,6 +1057,7 @@ var init_manifest = __esm({
     DEFAULT_MANIFEST_SPACE = "applications";
     SERVICE_SHORT_TO_LONG = Object.freeze({
       kv: "tinycloud.kv",
+      space: "tinycloud.space",
       sql: "tinycloud.sql",
       duckdb: "tinycloud.duckdb",
       capabilities: "tinycloud.capabilities",
@@ -4245,9 +4258,9 @@ var init_authority = __esm({
 
 // src/state.ts
 function processWideContext(key) {
-  var _a4;
+  var _a5;
   const registry = globalThis;
-  return registry[_a4 = Symbol.for(key)] ?? (registry[_a4] = new import_node_async_hooks.AsyncLocalStorage());
+  return registry[_a5 = Symbol.for(key)] ?? (registry[_a5] = new import_node_async_hooks.AsyncLocalStorage());
 }
 function processOrigin() {
   if (cachedProcessOrigin !== void 0) return cachedProcessOrigin;
@@ -4418,9 +4431,14 @@ function tinycloudConfigPath() {
 function profilesPath() {
   return (0, import_node_path2.join)(tinycloudHomePath(), "profiles");
 }
-function profilePath(profile) {
+function namedProfilePath(profile) {
   return (0, import_node_path2.join)(profilesPath(), validateProfileName(profile));
 }
+function profilePath(profile) {
+  const named = namedProfilePath(profile);
+  const pinned = pinnedProfiles.getStore()?.get(named);
+  return pinned ? livePinnedPath(profile, pinned) : named;
+}
 function profileConfigPath(profile) {
   return (0, import_node_path2.join)(profilePath(profile), "profile.json");
 }
@@ -4437,10 +4455,12 @@ function profileStoreMetadataPath(profile, store) {
   return `${profileStorePath(profile, store)}.metadata.json`;
 }
 function profileLockPath(profile) {
-  return (0, import_node_path2.join)(profilePath(profile), ".lock");
+  return (0, import_node_path2.join)(namedProfilePath(profile), ".lock");
 }
 function profileTurnLockPath(profile) {
-  return (0, import_node_path2.join)(tinycloudHomePath(), "profile-locks", validateProfileName(profile));
+  const home = tinycloudHomePath();
+  const pinned = pinnedHomes.getStore()?.get(home);
+  return (0, import_node_path2.join)(pinned ? livePinnedPath(profile, pinned) : home, "profile-locks", validateProfileName(profile));
 }
 async function readJson(filePath) {
   try {
@@ -4450,6 +4470,44 @@ async function readJson(filePath) {
     throw error;
   }
 }
+async function readProfileJson(profile, filePath) {
+  const before = process.platform !== "linux" ? await (0, import_promises.lstat)(filePath, { bigint: true }).catch((error) => {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }) : null;
+  if (process.platform !== "linux" && !before) return null;
+  if (before && !before.isFile()) throw new ProfileSymlinkError(profile);
+  const dev = before && exactFileId(before.dev);
+  const ino = before && exactFileId(before.ino);
+  try {
+    const handle = await (0, import_promises.open)(filePath, import_node_fs.constants.O_RDONLY | (import_node_fs.constants.O_NOFOLLOW ?? 0));
+    try {
+      if (before) {
+        const opened = await handle.stat({ bigint: true });
+        if (!opened.isFile() || dev === null || ino === null || dev !== exactFileId(opened.dev) || ino !== exactFileId(opened.ino)) {
+          throw new ProfileSymlinkError(profile, "changed while opening its file");
+        }
+      }
+      const contents = await handle.readFile("utf8");
+      if (before) {
+        const named = await (0, import_promises.lstat)(filePath, { bigint: true }).catch((error) => {
+          if (error.code === "ENOENT") return null;
+          throw error;
+        });
+        if (!named?.isFile() || dev !== exactFileId(named.dev) || ino !== exactFileId(named.ino)) {
+          throw new ProfileSymlinkError(profile, "changed while reading its file");
+        }
+      }
+      return JSON.parse(contents);
+    } finally {
+      await handle.close();
+    }
+  } catch (error) {
+    if (isErrno(error, "ENOENT")) return null;
+    if (isErrno(error, "ELOOP") || isErrno(error, "ENOTDIR")) throw new ProfileSymlinkError(profile);
+    throw error;
+  }
+}
 async function writeJsonAtomic(filePath, value) {
   await replaceJson(filePath, value, false);
 }
@@ -4483,11 +4541,14 @@ async function writeFileDurably(path, contents) {
   }
 }
 async function readProfile(profile) {
-  return readJson(profileConfigPath(profile));
+  return withPinnedProfileDirectory(profile, (directory) => directory ? readProfileJson(profile, (0, import_node_path2.join)(directory, "profile.json")) : Promise.resolve(null));
 }
 async function readSession(profile) {
-  await readStoreMetadata(profile, "session");
-  return readJson(sessionPath(profile));
+  return withPinnedProfileDirectory(profile, async (directory) => {
+    if (!directory) return null;
+    await readStoreMetadata(profile, "session");
+    return readProfileJson(profile, sessionPath(profile));
+  });
 }
 async function readAdditionalDelegations(profile) {
   return (await readProfileStore(profile, "additional-delegations")).records;
@@ -4496,43 +4557,187 @@ async function readAuthRequests(profile) {
   return (await readProfileStore(profile, "auth-requests")).records;
 }
 async function readStoreMetadata(profile, store) {
-  const metadata = await readJson(profileStoreMetadataPath(profile, store));
-  if (metadata === null) return { formatVersion: 1 };
-  if (typeof metadata !== "object" || metadata.formatVersion !== 1) {
-    throw new TypeError(`Unsupported store format for "${store}".`);
-  }
-  return metadata;
+  return withPinnedProfileDirectory(profile, async (directory) => {
+    const metadata = directory ? await readProfileJson(profile, profileStoreMetadataPath(profile, store)) : null;
+    if (metadata === null) return { formatVersion: 1 };
+    if (typeof metadata !== "object" || metadata.formatVersion !== 1) {
+      throw new TypeError(`Unsupported store format for "${store}".`);
+    }
+    return metadata;
+  });
 }
 async function readProfileStore(profile, store) {
-  const [metadata, raw] = await Promise.all([
-    readStoreMetadata(profile, store),
-    readJson(profileStorePath(profile, store))
-  ]);
-  return {
-    formatVersion: metadata.formatVersion,
-    records: Array.isArray(raw) ? raw : []
-  };
+  return withPinnedProfileDirectory(profile, async (directory) => {
+    if (!directory) return { formatVersion: 1, records: [] };
+    const [metadata, raw] = await Promise.all([
+      readStoreMetadata(profile, store),
+      readProfileJson(profile, profileStorePath(profile, store))
+    ]);
+    return {
+      formatVersion: metadata.formatVersion,
+      records: Array.isArray(raw) ? raw : []
+    };
+  });
 }
-async function withProfileLock(profile, action, options = {}) {
-  const normalizedProfile = validateProfileName(profile);
-  const lockPath = profileLockPath(normalizedProfile);
-  const held = (heldProfileLocks.getStore() ?? []).filter((ownership2) => ownership2.active);
-  if (held.some((ownership2) => ownership2.lockPath === lockPath)) return action();
-  const acquired = await acquireProfileLock(normalizedProfile, options);
-  const ownership = {
-    lockPath,
-    turnSlot: acquired.turnSlot,
-    deletedWhileWaiting: acquired.deletedWhileWaiting,
-    active: true
-  };
+function exactFileId(value) {
+  if (typeof value === "bigint") return value >= 0n ? value : null;
+  return Number.isSafeInteger(value) && value >= 0 ? BigInt(value) : null;
+}
+function isPinnedLive(pinned) {
+  if (!pinned.active) return false;
+  try {
+    const stats = (0, import_node_fs.fstatSync)(pinned.fd, { bigint: true });
+    return exactFileId(stats.dev) === pinned.dev && exactFileId(stats.ino) === pinned.ino;
+  } catch {
+    return false;
+  }
+}
+function livePinnedPath(profile, pinned) {
+  if (isPinnedLive(pinned)) return pinned.path;
+  throw new ProfileSymlinkError(profile, "its pinned directory is no longer active or changed during use");
+}
+async function withPinnedProfileDirectory(profile, action, options = {}) {
+  const named = namedProfilePath(profile);
+  const existing = pinnedProfiles.getStore()?.get(named);
+  if (existing) return action(livePinnedPath(profile, existing));
+  if (process.platform !== "linux") {
+    if (options.create) await (0, import_promises.mkdir)(named, { recursive: true, mode: PRIVATE_DIR_MODE });
+    const stats = await (0, import_promises.lstat)(named).catch((error) => {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    });
+    if (!stats) return action(null);
+    if (!stats.isDirectory() || stats.isSymbolicLink()) throw new ProfileSymlinkError(profile);
+    return action(named);
+  }
+  const home = tinycloudHomePath();
+  const handles = [];
+  const fdPath = (fd) => `/proc/self/fd/${fd}`;
+  const flags = import_node_fs.constants.O_RDONLY | import_node_fs.constants.O_DIRECTORY | import_node_fs.constants.O_NOFOLLOW;
   try {
-    return await heldProfileLocks.run([...held, ownership], action);
+    if (options.create) await (0, import_promises.mkdir)(home, { recursive: true, mode: PRIVATE_DIR_MODE });
+    const resolved = canonicalHomes.get(home) ?? await (0, import_promises.realpath)(home).catch((error) => {
+      if (error.code === "ENOENT" && !options.create) return null;
+      if (error.code === "ELOOP" || error.code === "ENOTDIR") throw new ProfileSymlinkError(profile);
+      throw error;
+    });
+    if (!resolved) return await action(null);
+    const root = canonicalHomes.get(home) ?? resolved;
+    canonicalHomes.set(home, root);
+    const segments = [root, "profiles", validateProfileName(profile)];
+    for (let index = 0; index < segments.length; index++) {
+      const path = handles.length ? (0, import_node_path2.join)(fdPath(handles[handles.length - 1].fd), segments[index]) : segments[index];
+      if (options.create && handles.length) {
+        await (0, import_promises.mkdir)(path, { mode: PRIVATE_DIR_MODE }).catch((error) => {
+          if (error.code !== "EEXIST") throw error;
+        });
+      }
+      const handle = await (0, import_promises.open)(path, index === 1 ? flags & ~import_node_fs.constants.O_NOFOLLOW : flags).catch((error) => {
+        if (error.code === "ENOENT" && !options.create) return null;
+        if (error.code === "ELOOP" || error.code === "ENOTDIR") throw new ProfileSymlinkError(profile);
+        throw error;
+      });
+      if (!handle) return await action(null);
+      handles.push(handle);
+      if (options.create) await handle.chmod(PRIVATE_DIR_MODE);
+    }
+    const opened = handles[2];
+    const [actual, namedStats] = await Promise.all([opened.stat({ bigint: true }), (0, import_promises.lstat)(named, { bigint: true })]);
+    const dev = exactFileId(actual.dev);
+    const ino = exactFileId(actual.ino);
+    if (!namedStats.isDirectory() || dev === null || ino === null || dev !== exactFileId(namedStats.dev) || ino !== exactFileId(namedStats.ino)) {
+      throw new ProfileSymlinkError(profile, "changed while opening its directory");
+    }
+    const directory = fdPath(opened.fd);
+    const pinned = {
+      path: directory,
+      fd: opened.fd,
+      dev,
+      ino,
+      active: true
+    };
+    const homeHandle = handles[0];
+    const homeStats = await homeHandle.stat({ bigint: true });
+    const homeDev = exactFileId(homeStats.dev);
+    const homeIno = exactFileId(homeStats.ino);
+    if (homeDev === null || homeIno === null) throw new ProfileSymlinkError(profile, "has an unverified home directory identity");
+    const homePinned = {
+      path: fdPath(homeHandle.fd),
+      fd: homeHandle.fd,
+      dev: homeDev,
+      ino: homeIno,
+      active: true
+    };
+    const context = new Map(pinnedProfiles.getStore());
+    context.set(named, pinned);
+    const homes = new Map(pinnedHomes.getStore());
+    homes.set(home, homePinned);
+    try {
+      return await pinnedHomes.run(homes, () => pinnedProfiles.run(context, () => action(directory)));
+    } finally {
+      pinned.active = false;
+      homePinned.active = false;
+    }
   } finally {
-    ownership.active = false;
-    await acquired.release();
-    if (acquired.deletedWhileWaiting) await (0, import_promises.rmdir)(profilePath(normalizedProfile)).catch(() => void 0);
+    for (const handle of handles.reverse()) await handle.close();
   }
 }
+async function assertRealProfileDirectory(profile) {
+  const named = namedProfilePath(profile);
+  const pinned = pinnedProfiles.getStore()?.get(named);
+  if (pinned) {
+    livePinnedPath(profile, pinned);
+    return;
+  }
+  const stats = await (0, import_promises.lstat)(named).catch((error) => {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  });
+  if (stats && (!stats.isDirectory() || stats.isSymbolicLink())) throw new ProfileSymlinkError(profile);
+}
+async function withProfileLock(profile, action, options = {}) {
+  const normalizedProfile = validateProfileName(profile);
+  const lockPath = profileLockPath(normalizedProfile);
+  const held = (heldProfileLocks.getStore() ?? []).filter((ownership) => ownership.active);
+  if (held.some((ownership) => ownership.lockPath === lockPath)) {
+    await assertRealProfileDirectory(normalizedProfile);
+    return action();
+  }
+  const named = namedProfilePath(normalizedProfile);
+  const inherited = pinnedProfiles.getStore()?.get(named);
+  if (inherited && !isPinnedLive(inherited)) {
+    const profiles = new Map(pinnedProfiles.getStore());
+    profiles.delete(named);
+    const homes = new Map(pinnedHomes.getStore());
+    homes.delete(tinycloudHomePath());
+    return pinnedHomes.run(homes, () => pinnedProfiles.run(profiles, () => withProfileLock(normalizedProfile, action, options)));
+  }
+  return withPinnedProfileDirectory(normalizedProfile, async (directory) => {
+    if (!directory) throw new ProfileDeletedError(normalizedProfile);
+    const acquired = await acquireProfileLock(normalizedProfile, options);
+    const ownership = {
+      lockPath,
+      turnSlot: acquired.turnSlot,
+      deletedWhileWaiting: acquired.deletedWhileWaiting,
+      active: true
+    };
+    try {
+      return await heldProfileLocks.run([...held, ownership], action);
+    } finally {
+      ownership.active = false;
+      await acquired.release();
+      if (ownership.deletedProfile || acquired.deletedWhileWaiting) {
+        const current = await (0, import_promises.lstat)(namedProfilePath(normalizedProfile), { bigint: true }).catch(() => null);
+        const original = await (0, import_promises.stat)(directory, { bigint: true }).catch(() => null);
+        const currentDev = current && exactFileId(current.dev);
+        const currentIno = current && exactFileId(current.ino);
+        if (currentDev !== null && currentIno !== null && original && currentDev === exactFileId(original.dev) && currentIno === exactFileId(original.ino)) {
+          await (0, import_promises.rmdir)(namedProfilePath(normalizedProfile)).catch(() => void 0);
+        }
+      }
+    }
+  }, { create: !options.requireProfile });
+}
 async function refuseWriteToDeletedProfile(profile) {
   const lockPath = profileLockPath(profile);
   const ownership = (heldProfileLocks.getStore() ?? []).find((candidate) => candidate.active && candidate.lockPath === lockPath);
@@ -4565,17 +4770,15 @@ async function acquireProfileLock(profile, options) {
     retryMs: options.retryMs ?? DEFAULT_LOCK_RETRY_MS
   };
   const staleAfterMs = options.staleAfterMs ?? DEFAULT_STALE_LOCK_MS;
-  const lockPath = profileLockPath(profile);
+  const lockPath = (0, import_node_path2.join)(profilePath(profile), ".lock");
   const turnDirectory = profileTurnLockPath(profile);
   const directory = profilePath(profile);
+  await assertRealProfileDirectory(profile);
   if (options.requireProfile && !await exists(profileConfigPath(profile))) throw new ProfileDeletedError(profile);
   if (!options.requireProfile) await (0, import_promises.mkdir)(directory, { recursive: true, mode: PRIVATE_DIR_MODE });
+  await assertRealProfileDirectory(profile);
   await (0, import_promises.mkdir)((0, import_node_path2.dirname)(turnDirectory), { recursive: true, mode: PRIVATE_DIR_MODE });
-  for (const path of [tinycloudHomePath(), profilesPath(), directory]) {
-    await (0, import_promises.chmod)(path, PRIVATE_DIR_MODE).catch((error) => {
-      if (path !== directory || !isErrno(error, "ENOENT")) throw error;
-    });
-  }
+  await (0, import_promises.chmod)(directory, PRIVATE_DIR_MODE);
   const liveness = { directory: turnDirectory, held: void 0 };
   const closeAcquisitionLiveness = async () => {
     if (liveness.held) await closeLiveness(liveness.held);
@@ -4595,6 +4798,7 @@ async function acquireProfileLock(profile, options) {
     }
     const deletion = await readJson((0, import_node_path2.join)(turnDirectory, "deleted.json")).catch(() => null);
     const deletedWhileWaiting = typeof deletion?.slot === "number" && deletion.slot >= firstWaitedTurn;
+    if (deletedWhileWaiting && !await exists(profileConfigPath(profile))) throw new ProfileDeletedError(profile);
     while (true) {
       const token = (0, import_node_crypto.randomUUID)();
       if (await publishProfileLock(profile, lockPath, token, options.requireProfile === true, liveness.held ?? null)) {
@@ -4740,7 +4944,7 @@ async function takeTurn(profile, directory, latest, liveness) {
     if (published) await markTurn(path, token, "done");
     return null;
   } catch (error) {
-    if (published) settleOwnTurn(directory, slot, token);
+    if (published) await settleOwnTurn(directory, slot, token);
     throw error;
   }
 }
@@ -4751,17 +4955,25 @@ async function settleAbandonedTurn(directory, abandoned) {
   }
   await markTurn(path, abandoned.token, "done");
 }
-function settleOwnTurn(directory, slot, token, retries = SETTLE_RETRIES) {
+async function settleOwnTurn(directory, slot, token) {
   relinquishedTurns.add(token);
-  void (async () => {
-    try {
-      const turn = await readTurn(directory, slot);
-      if (turn !== null && turn !== "damaged" && turn.token === token && !turn.done) await settleAbandonedTurn(directory, turn);
-      relinquishedTurns.delete(token);
-    } catch {
-      if (retries > 0) setTimeout(() => settleOwnTurn(directory, slot, token, retries - 1), SETTLE_RETRY_MS).unref();
-    }
-  })();
+  const pinned = await pinDirectory(directory).catch(() => null);
+  const path = pinned?.path(".") ?? directory;
+  let retries = SETTLE_RETRIES;
+  const attempt = () => {
+    void (async () => {
+      try {
+        const turn = await readTurn(path, slot);
+        if (turn !== null && turn !== "damaged" && turn.token === token && !turn.done) await settleAbandonedTurn(path, turn);
+        relinquishedTurns.delete(token);
+        await pinned?.close();
+      } catch {
+        if (retries-- > 0) setTimeout(attempt, SETTLE_RETRY_MS).unref();
+        else await pinned?.close();
+      }
+    })();
+  };
+  attempt();
 }
 async function markTurn(path, token, kind) {
   for (let attempt = 0; ; attempt++) {
@@ -4806,7 +5018,7 @@ async function releaseTurn(profile, turn, liveness) {
   try {
     await markTurn((0, import_node_path2.join)(turn.directory, String(turn.slot)), turn.token, "done");
   } catch {
-    settleOwnTurn(turn.directory, turn.slot, turn.token);
+    await settleOwnTurn(turn.directory, turn.slot, turn.token);
     return;
   }
   await collectTurns(profile, turn, liveness).catch(() => void 0);
@@ -5090,7 +5302,7 @@ function isErrno(error, code) {
 function sleep(milliseconds) {
   return new Promise((resolve2) => setTimeout(resolve2, milliseconds));
 }
-var import_node_crypto, import_node_async_hooks, import_node_fs, import_promises, import_node_net, import_node_os, import_node_path2, DEFAULT_PROFILE, DEFAULT_LOCK_TIMEOUT_MS, DEFAULT_LOCK_RETRY_MS, DEFAULT_STALE_LOCK_MS, TEST_LOCK_CONTENTION_SIGNAL_PATH, PRIVATE_FILE_MODE, PRIVATE_DIR_MODE, TEST_LOCK_RECOVERY_BARRIER_DIR, TEST_LOCK_OWNERLESS_BARRIER_DIR, TEST_LOCK_PUBLISH_BARRIER_DIR, TEST_LOCK_RELEASE_BARRIER_DIR, TEST_LOCK_CLAIM_BARRIER_DIR, TEST_LOCK_CLAIMED_BARRIER_DIR, TEST_LOCK_VERIFIED_BARRIER_DIR, TEST_LOCK_MOVED_BARRIER_DIR, TEST_LOCK_TURN_PUBLISH_BARRIER_DIR, TEST_LOCK_TURN_SETTLE_BARRIER_DIR, TEST_LOCK_TURN_COLLECT_BARRIER_DIR, TEST_LOCK_LIVENESS_BARRIER_DIR, invocationStateRoot, heldProfileLocks, _a2, processInstanceId, cachedProcessOrigin, LIVENESS_SOCKET, LIVENESS_PROBE_TIMEOUT_MS, ProfileLockTimeoutError, ProfileDeletedError, TURN, _a3, relinquishedTurns, MARKER_RETRY_DELAYS_MS, SETTLE_RETRY_MS, SETTLE_RETRIES, NO_HARD_LINK_ERRORS, ABANDONED_CLAIM, RECOVERY_CLAIM, STAGED_OWNER;
+var import_node_crypto, import_node_async_hooks, import_node_fs, import_promises, import_node_net, import_node_os, import_node_path2, DEFAULT_PROFILE, DEFAULT_LOCK_TIMEOUT_MS, DEFAULT_LOCK_RETRY_MS, DEFAULT_STALE_LOCK_MS, TEST_LOCK_CONTENTION_SIGNAL_PATH, PRIVATE_FILE_MODE, PRIVATE_DIR_MODE, TEST_LOCK_RECOVERY_BARRIER_DIR, TEST_LOCK_OWNERLESS_BARRIER_DIR, TEST_LOCK_PUBLISH_BARRIER_DIR, TEST_LOCK_RELEASE_BARRIER_DIR, TEST_LOCK_CLAIM_BARRIER_DIR, TEST_LOCK_CLAIMED_BARRIER_DIR, TEST_LOCK_VERIFIED_BARRIER_DIR, TEST_LOCK_MOVED_BARRIER_DIR, TEST_LOCK_TURN_PUBLISH_BARRIER_DIR, TEST_LOCK_TURN_SETTLE_BARRIER_DIR, TEST_LOCK_TURN_COLLECT_BARRIER_DIR, TEST_LOCK_LIVENESS_BARRIER_DIR, invocationStateRoot, heldProfileLocks, pinnedProfiles, pinnedHomes, _a2, canonicalHomes, _a3, processInstanceId, cachedProcessOrigin, LIVENESS_SOCKET, LIVENESS_PROBE_TIMEOUT_MS, ProfileLockTimeoutError, ProfileDeletedError, ProfileSymlinkError, TURN, _a4, relinquishedTurns, MARKER_RETRY_DELAYS_MS, SETTLE_RETRY_MS, SETTLE_RETRIES, NO_HARD_LINK_ERRORS, ABANDONED_CLAIM, RECOVERY_CLAIM, STAGED_OWNER;
 var init_state = __esm({
   "src/state.ts"() {
     "use strict";
@@ -5122,7 +5334,10 @@ var init_state = __esm({
     TEST_LOCK_LIVENESS_BARRIER_DIR = "TC_TEST_PROFILE_LOCK_LIVENESS_BARRIER_DIR";
     invocationStateRoot = processWideContext("tinycloud.operations.invocationStateRoot.v1");
     heldProfileLocks = processWideContext("tinycloud.operations.heldProfileLocks.v2");
-    processInstanceId = globalThis[_a2 = /* @__PURE__ */ Symbol.for("tinycloud.operations.profileLockInstance.v1")] ?? (globalThis[_a2] = (0, import_node_crypto.randomUUID)());
+    pinnedProfiles = processWideContext("tinycloud.operations.pinnedProfiles.v2");
+    pinnedHomes = processWideContext("tinycloud.operations.pinnedHomes.v2");
+    canonicalHomes = globalThis[_a2 = /* @__PURE__ */ Symbol.for("tinycloud.operations.canonicalHomes.v1")] ?? (globalThis[_a2] = /* @__PURE__ */ new Map());
+    processInstanceId = globalThis[_a3 = /* @__PURE__ */ Symbol.for("tinycloud.operations.profileLockInstance.v1")] ?? (globalThis[_a3] = (0, import_node_crypto.randomUUID)());
     LIVENESS_SOCKET = /^\.live-([0-9a-f]+)-([0-9a-f]+)-[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}(\.new)?$/;
     LIVENESS_PROBE_TIMEOUT_MS = 1e3;
     ProfileLockTimeoutError = class extends Error {
@@ -5140,8 +5355,15 @@ var init_state = __esm({
         this.name = "ProfileDeletedError";
       }
     };
+    ProfileSymlinkError = class extends Error {
+      constructor(profile, detail = "must be a real directory, not a symlink or another file type") {
+        super(`Profile "${profile}" ${detail}.`);
+        this.code = "PROFILE_SYMLINK";
+        this.name = "ProfileSymlinkError";
+      }
+    };
     TURN = /^(?:0|[1-9][0-9]*)$/;
-    relinquishedTurns = globalThis[_a3 = /* @__PURE__ */ Symbol.for("tinycloud.operations.relinquishedProfileTurns.v1")] ?? (globalThis[_a3] = /* @__PURE__ */ new Set());
+    relinquishedTurns = globalThis[_a4 = /* @__PURE__ */ Symbol.for("tinycloud.operations.relinquishedProfileTurns.v1")] ?? (globalThis[_a4] = /* @__PURE__ */ new Set());
     MARKER_RETRY_DELAYS_MS = [10, 50, 250];
     SETTLE_RETRY_MS = 1e3;
     SETTLE_RETRIES = 300;
@@ -6325,6 +6547,8 @@ function appsFailure(error) {
   if (auth?.status === "error") return auth.error;
   const storage = storageFullOperationError(error);
   if (storage) return storage;
+  const nodeRetry = nodeRetryOperationError(error);
+  if (nodeRetry) return nodeRetry;
   const code = typeof error === "object" && error !== null ? error.code : void 0;
   if (code === "SPACE_NOT_HOSTED") return operationError("NODE_ERROR", "Your TinyCloud default space is not set up. Try again in a minute; if it still fails, ask for help setting up the space.", { details: { reason: "space_not_hosted" } });
   if (isOperationErrorCode(code)) return operationError(code, "The node could not complete this personal-record operation.");
@@ -7798,16 +8022,8 @@ function kvFailure(error, action) {
   if (error.code === "KV_PRECONDITION_FAILED") {
     return { status: "error", error: operationError("KV_PRECONDITION_FAILED", "The TinyCloud KV object changed or already exists.") };
   }
-  if (error.code === "KV_CONFLICT") {
-    return {
-      status: "error",
-      error: operationError(
-        "KV_CONFLICT",
-        "A database serialization conflict prevented the conditional KV mutation; re-read the key state, which may still be absent, before deciding whether to retry.",
-        { retryable: true }
-      )
-    };
-  }
+  const nodeRetry = nodeRetryOperationError(error);
+  if (nodeRetry) return { status: "error", error: nodeRetry };
   if (error.code === "KV_RESPONSE_TOO_LARGE") {
     return { status: "error", error: operationError("KV_RESPONSE_TOO_LARGE", `The TinyCloud KV value exceeds ${MAX_KV_VALUE_BYTES} bytes.`) };
   }