@wirecat/cli-core 0.20.0 → 0.263.0

package/dist/background/folders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"folders.js","sourceRoot":"","sources":["../../src/background/folders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,qBAAqB,EAAc,MAAM,mBAAmB,CAAA;AAE/F,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAUxE,+GAA+G;AAC/G,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU,EAAE,GAAsB,EAAE,EAAE;IAC1F,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAA;IAC9D,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAM;IAC/B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,OAAO,SAAS,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,GAAG,CAAC;YAAE,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAC3F,CAAC;AACH,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,GAA2D,EAC3D,OAAO,GAAkB,EAAE,EAC3B,EAAE;IACF,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAA;IAClF,MAAM,MAAM,GAAG;QACb,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC;QAC5B,CAAC,eAAe,EAAE,WAAW,CAAC;QAC9B,CAAC,YAAY,EAAE,YAAY,CAAC;KACpB,CAAA;IACV,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YAC3F,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBACpB,MAAM,IAAI,QAAQ,CAAC,qBAAqB,EAAE,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;YACjH,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;YAC3G,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAA;YACzD,IAAI,KAAK;gBAAE,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;YAC3C,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAoB;gBAChE,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBAAE,GAAG,CAAC,GAAG,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;YACzF,IAAI,CAAC,GAAG,GAAG,CAAC,OAAO,UAAU,OAAO,mCAAoC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAA;QACpG,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACpF,sBAAsB,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;AACvF,CAAC,CAAA"}

package/dist/background/index.d.ts

@@ -0,0 +1,6 @@
+export { type FolderOptions, migrateFolders } from "./folders.js";
+export { holdLock, type Lock, lockPath, readLock, releaseLock, servingProfiles, takeLock } from "./lock.js";
+export { alive, carries, holdersOf } from "./processes.js";
+export { type Ran, runProgram, type ServerSystem, thisMachine } from "./system.js";
+export { launchd, locationVariables, noUnits, type Platform, platformFor, systemd, tail, type Unit, unitScope, } from "./units.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/background/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/background/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AACjE,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAC3G,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,EAAE,KAAK,GAAG,EAAE,UAAU,EAAE,KAAK,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAClF,OAAO,EACL,OAAO,EACP,iBAAiB,EACjB,OAAO,EACP,KAAK,QAAQ,EACb,WAAW,EACX,OAAO,EACP,IAAI,EACJ,KAAK,IAAI,EACT,SAAS,GACV,MAAM,YAAY,CAAA"}

package/dist/background/index.js

@@ -0,0 +1,6 @@
+export { migrateFolders } from "./folders.js";
+export { holdLock, lockPath, readLock, releaseLock, servingProfiles, takeLock } from "./lock.js";
+export { alive, carries, holdersOf } from "./processes.js";
+export { runProgram, thisMachine } from "./system.js";
+export { launchd, locationVariables, noUnits, platformFor, systemd, tail, unitScope, } from "./units.js";
+//# sourceMappingURL=index.js.map

package/dist/background/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/background/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,cAAc,EAAE,MAAM,cAAc,CAAA;AACjE,OAAO,EAAE,QAAQ,EAAa,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAC3G,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,EAAY,UAAU,EAAqB,WAAW,EAAE,MAAM,aAAa,CAAA;AAClF,OAAO,EACL,OAAO,EACP,iBAAiB,EACjB,OAAO,EAEP,WAAW,EACX,OAAO,EACP,IAAI,EAEJ,SAAS,GACV,MAAM,YAAY,CAAA"}

package/dist/background/lock.d.ts

@@ -0,0 +1,23 @@
+import type { AppIdentity } from "../cli/app.js";
+export interface Lock {
+    pid: number;
+    startedAt: string;
+    /** Set once the connection is open and updates arrive — before it, `serve` is still starting. */
+    listeningAt?: string;
+    /** The CLI version this serve runs: after an update it goes on running the old code until restarted. */
+    version?: string;
+}
+export declare const lockPath: (app: AppIdentity, profile: string, env: NodeJS.ProcessEnv) => string;
+export declare const readLock: (path: string) => Lock | undefined;
+export declare const holdLock: (path: string, lock: Lock) => void;
+/**
+ * Takes the lock unless a live process holds it, and then answers that holder. The lock appears by
+ * `link`, which fails if the file exists, and appears already written: two serves started in the same
+ * instant cannot both pass, and none reads a half-written lock as stale.
+ */
+export declare const takeLock: (path: string, lock: Lock) => Lock | undefined;
+/** Only the process that holds the lock removes it: one refused as a second serve must not free it. */
+export declare const releaseLock: (path: string, pid?: number) => void;
+/** The profiles a serve is running for now — what an update must restart for its new code to run. */
+export declare const servingProfiles: (app: AppIdentity, env: NodeJS.ProcessEnv) => string[];
+//# sourceMappingURL=lock.d.ts.map

package/dist/background/lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../src/background/lock.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAGhD,MAAM,WAAW,IAAI;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,iGAAiG;IACjG,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,wGAAwG;IACxG,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,eAAO,MAAM,QAAQ,QAAS,WAAW,WAAW,MAAM,OAAO,MAAM,CAAC,UAAU,WAC0B,CAAA;AAE5G,eAAO,MAAM,QAAQ,SAAU,MAAM,KAAG,IAAI,GAAG,SAO9C,CAAA;AAED,eAAO,MAAM,QAAQ,SAAU,MAAM,QAAQ,IAAI,SAA4D,CAAA;AAE7G;;;;GAIG;AACH,eAAO,MAAM,QAAQ,SAAU,MAAM,QAAQ,IAAI,KAAG,IAAI,GAAG,SAoB1D,CAAA;AAED,uGAAuG;AACvG,eAAO,MAAM,WAAW,SAAU,MAAM,uBAEvC,CAAA;AAED,qGAAqG;AACrG,eAAO,MAAM,eAAe,QAAS,WAAW,OAAO,MAAM,CAAC,UAAU,KAAG,MAAM,EAUhF,CAAA"}

package/dist/background/lock.js

@@ -0,0 +1,64 @@
+import { existsSync, linkSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { resolvePaths, writeSecurely } from "@wirecat/cli-base";
+import { alive } from "./processes.js";
+export const lockPath = (app, profile, env) => join(resolvePaths({ appName: app.appName, prefix: app.envPrefix, env }).state, "serve", `${profile}.lock`);
+export const readLock = (path) => {
+    try {
+        const lock = JSON.parse(readFileSync(path, "utf8"));
+        return typeof lock.pid === "number" && typeof lock.startedAt === "string" ? lock : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+export const holdLock = (path, lock) => writeSecurely(path, `${JSON.stringify(lock)}\n`, 0o600);
+/**
+ * Takes the lock unless a live process holds it, and then answers that holder. The lock appears by
+ * `link`, which fails if the file exists, and appears already written: two serves started in the same
+ * instant cannot both pass, and none reads a half-written lock as stale.
+ */
+export const takeLock = (path, lock) => {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const draft = `${path}.${lock.pid}.tmp`;
+    writeFileSync(draft, `${JSON.stringify(lock)}\n`, { mode: 0o600 });
+    try {
+        for (let attempt = 0; attempt < 5; attempt++) {
+            try {
+                linkSync(draft, path);
+                return undefined;
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+            }
+            const held = readLock(path);
+            if (held && held.pid !== lock.pid && alive(held.pid))
+                return held;
+            rmSync(path, { force: true });
+        }
+        throw new Error(`could not take the lock ${path}: it keeps changing`);
+    }
+    finally {
+        rmSync(draft, { force: true });
+    }
+};
+/** Only the process that holds the lock removes it: one refused as a second serve must not free it. */
+export const releaseLock = (path, pid = process.pid) => {
+    if (readLock(path)?.pid === pid)
+        rmSync(path, { force: true });
+};
+/** The profiles a serve is running for now — what an update must restart for its new code to run. */
+export const servingProfiles = (app, env) => {
+    const dir = dirname(lockPath(app, "default", env));
+    if (!existsSync(dir))
+        return [];
+    return readdirSync(dir)
+        .filter((name) => name.endsWith(".lock"))
+        .map((name) => name.slice(0, -".lock".length))
+        .filter((profile) => {
+        const lock = readLock(lockPath(app, profile, env));
+        return lock !== undefined && alive(lock.pid);
+    });
+};
+//# sourceMappingURL=lock.js.map

package/dist/background/lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../src/background/lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC3G,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAE/D,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAWtC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAsB,EAAE,EAAE,CACpF,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,OAAO,CAAC,CAAA;AAE5G,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAoB,EAAE;IACzD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAkB,CAAA;QACpE,OAAO,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAa,CAAC,CAAC,CAAC,SAAS,CAAA;IACxG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,IAAU,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AAE7G;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,IAAU,EAAoB,EAAE;IACrE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1D,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,MAAM,CAAA;IACvC,aAAa,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAClE,IAAI,CAAC;QACH,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;gBACrB,OAAO,SAAS,CAAA;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAA;YACrE,CAAC;YACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;YAC3B,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YACjE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,qBAAqB,CAAC,CAAA;IACvE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAChC,CAAC;AACH,CAAC,CAAA;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE;IAC7D,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,GAAG;QAAE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AAChE,CAAC,CAAA;AAED,qGAAqG;AACrG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAgB,EAAE,GAAsB,EAAY,EAAE;IACpF,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAA;IAClD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAA;IAC/B,OAAO,WAAW,CAAC,GAAG,CAAC;SACpB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;SAC7C,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;QAClB,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;AACN,CAAC,CAAA"}

package/dist/background/processes.d.ts

@@ -0,0 +1,15 @@
+/** Signal 0 checks that the process exists without touching it. */
+export declare const alive: (pid: number) => boolean;
+/**
+ * Whether `pid` is alive **and** carries `marker` (`NAME=value`) in its environment. A PID is handed
+ * out again once its process is gone — after a crash or a reboot a recorded number may belong to
+ * somebody else, who must never be signalled. Only the owner of a process may read its environment.
+ */
+export declare const carries: (pid: number, marker: string) => boolean;
+/**
+ * The other processes that have any of `paths` open, whichever app they belong to — a `serve` keeps
+ * its lock under its own app's directory, where the other CLI cannot look. `undefined` when this
+ * system cannot tell: no `/proc`, no `lsof`. `paths` must be real paths, as the kernel reports them.
+ */
+export declare const holdersOf: (paths: string[]) => number[] | undefined;
+//# sourceMappingURL=processes.d.ts.map

package/dist/background/processes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"processes.d.ts","sourceRoot":"","sources":["../../src/background/processes.ts"],"names":[],"mappings":"AAGA,mEAAmE;AACnE,eAAO,MAAM,KAAK,QAAS,MAAM,KAAG,OAOnC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,OAAO,QAAS,MAAM,UAAU,MAAM,KAAG,OAgBrD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,SAAS,UAAW,MAAM,EAAE,KAAG,MAAM,EAAE,GAAG,SAiCtD,CAAA"}

package/dist/background/processes.js

@@ -0,0 +1,78 @@
+import { execFileSync } from "node:child_process";
+import { readdirSync, readFileSync, readlinkSync } from "node:fs";
+/** Signal 0 checks that the process exists without touching it. */
+export const alive = (pid) => {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+};
+/**
+ * Whether `pid` is alive **and** carries `marker` (`NAME=value`) in its environment. A PID is handed
+ * out again once its process is gone — after a crash or a reboot a recorded number may belong to
+ * somebody else, who must never be signalled. Only the owner of a process may read its environment.
+ */
+export const carries = (pid, marker) => {
+    // PID 0 would ask about this whole process group.
+    if (pid <= 0 || !alive(pid))
+        return false;
+    try {
+        if (process.platform === "linux") {
+            return readFileSync(`/proc/${pid}/environ`, "latin1")
+                .split("\0")
+                .some((entry) => entry.endsWith(marker));
+        }
+        if (process.platform === "darwin") {
+            return execFileSync("ps", ["eww", "-o", "command=", "-p", String(pid)], { encoding: "utf8" }).includes(marker);
+        }
+    }
+    catch {
+        return false;
+    }
+    return false;
+};
+/**
+ * The other processes that have any of `paths` open, whichever app they belong to — a `serve` keeps
+ * its lock under its own app's directory, where the other CLI cannot look. `undefined` when this
+ * system cannot tell: no `/proc`, no `lsof`. `paths` must be real paths, as the kernel reports them.
+ */
+export const holdersOf = (paths) => {
+    if (process.platform === "linux") {
+        const wanted = new Set(paths);
+        return readdirSync("/proc")
+            .filter((entry) => /^\d+$/.test(entry) && Number(entry) !== process.pid)
+            .filter((pid) => {
+            try {
+                return readdirSync(`/proc/${pid}/fd`).some((fd) => {
+                    try {
+                        return wanted.has(readlinkSync(`/proc/${pid}/fd/${fd}`));
+                    }
+                    catch {
+                        return false;
+                    }
+                });
+            }
+            catch {
+                return false;
+            }
+        })
+            .map(Number);
+    }
+    const pids = (listed) => listed
+        .split("\n")
+        .filter(Boolean)
+        .map(Number)
+        .filter((pid) => pid !== process.pid);
+    try {
+        return pids(execFileSync("lsof", ["-t", "--", ...paths], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }));
+    }
+    catch (error) {
+        // lsof exits 1 when some file is open by nobody, and fails to start when it is not installed.
+        const { status, stdout } = error;
+        return status === 1 ? pids(stdout ?? "") : undefined;
+    }
+};
+//# sourceMappingURL=processes.js.map

package/dist/background/processes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"processes.js","sourceRoot":"","sources":["../../src/background/processes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAEjE,mEAAmE;AACnE,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,GAAW,EAAW,EAAE;IAC5C,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAA;IAC1D,CAAC;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,MAAc,EAAW,EAAE;IAC9D,kDAAkD;IAClD,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACzC,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,OAAO,YAAY,CAAC,SAAS,GAAG,UAAU,EAAE,QAAQ,CAAC;iBAClD,KAAK,CAAC,IAAI,CAAC;iBACX,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QAC5C,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAChH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAe,EAAwB,EAAE;IACjE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC7B,OAAO,WAAW,CAAC,OAAO,CAAC;aACxB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC;aACvE,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YACd,IAAI,CAAC;gBACH,OAAO,WAAW,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;oBAChD,IAAI,CAAC;wBACH,OAAO,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,GAAG,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;oBAC1D,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,KAAK,CAAA;oBACd,CAAC;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC,CAAC;aACD,GAAG,CAAC,MAAM,CAAC,CAAA;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE,CAC9B,MAAM;SACH,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,MAAM,CAAC;SACX,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAA;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;IACtH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,8FAA8F;QAC9F,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAA6C,CAAA;QACxE,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACtD,CAAC;AACH,CAAC,CAAA"}

package/dist/background/renamed-paths.d.ts

@@ -0,0 +1,3 @@
+/** A job or schedule saved before `store fetch` became `messages sync` (2026-10-12) runs under the new path. */
+export declare const currentArgv: (argv: readonly string[]) => string[];
+//# sourceMappingURL=renamed-paths.d.ts.map

package/dist/background/renamed-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"renamed-paths.d.ts","sourceRoot":"","sources":["../../src/background/renamed-paths.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,eAAO,MAAM,WAAW,SAAU,SAAS,MAAM,EAAE,KAAG,MAAM,EAG3D,CAAA"}

package/dist/background/renamed-paths.js

@@ -0,0 +1,6 @@
+/** A job or schedule saved before `store fetch` became `messages sync` (2026-10-12) runs under the new path. */
+export const currentArgv = (argv) => {
+    const at = argv.slice(0, 2).findIndex((word, index) => word === "store" && argv[index + 1] === "fetch");
+    return at === -1 ? [...argv] : [...argv.slice(0, at), "messages", "sync", ...argv.slice(at + 2)];
+};
+//# sourceMappingURL=renamed-paths.js.map

package/dist/background/renamed-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"renamed-paths.js","sourceRoot":"","sources":["../../src/background/renamed-paths.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAuB,EAAY,EAAE;IAC/D,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,OAAO,CAAC,CAAA;IACvG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;AAClG,CAAC,CAAA"}

package/dist/background/schedules.d.ts

@@ -0,0 +1,63 @@
+import type { AppIdentity } from "../cli/app.js";
+import type { ServerSystem } from "./system.js";
+/** Minutes between runs, a daily local time, or one local moment. */
+export type When = {
+    every: number;
+} | {
+    daily: string;
+} | {
+    once: string;
+};
+export interface Schedule {
+    name: string;
+    kind: "command" | "agent";
+    /** What runs: for a command the CLI's own words after its name, for an agent the harness and its arguments. */
+    argv: string[];
+    when: When;
+    /** The variables the run gets on top of the timer's: the profile, where the files are, PATH. Never a credential. */
+    environment: Record<string, string>;
+    createdAt: string;
+}
+export interface LastRun {
+    at: string;
+    exitCode: number;
+    /** The run's output file: an agent's report, a command's log. */
+    output: string;
+}
+export declare const scheduleName: (name: string) => string;
+export declare const schedulesDir: (state: string) => string;
+export declare const scheduleFile: (state: string, name: string) => string;
+export declare const readSchedule: (file: string) => Schedule;
+export declare const lastRun: (file: string) => LastRun | undefined;
+export declare const listSchedules: (state: string) => Schedule[];
+export declare const describeWhen: (when: When) => string;
+/** How one operating system starts `argv` at the schedule's times. Every timer runs the same thing: `<cli> schedule exec <file>`. */
+export interface Timer {
+    install: (schedule: Schedule, argv: string[]) => Promise<void>;
+    remove: (name: string) => Promise<void>;
+    /** Where the timer lives, for the owner to look at. */
+    where: (name: string) => string;
+}
+export declare const systemdTimer: (app: AppIdentity, system: ServerSystem, env: NodeJS.ProcessEnv, home: string) => Timer;
+export declare const launchdTimer: (app: AppIdentity, system: ServerSystem, env: NodeJS.ProcessEnv, home: string) => Timer;
+/**
+ * Task Scheduler through PowerShell's ScheduledTasks module. The values travel in variables, never in
+ * the script, so nothing needs quoting for PowerShell; Windows has no per-task environment, which is why
+ * the runner reads its variables from the schedule file.
+ */
+export declare const windowsTimer: (app: AppIdentity, system: ServerSystem, env: NodeJS.ProcessEnv) => Timer;
+export declare const timerFor: (app: AppIdentity, system: ServerSystem, env: NodeJS.ProcessEnv) => Timer;
+/** A desktop notification; a machine without one loses only the notice, never the run. */
+export declare const notify: (system: ServerSystem, env: NodeJS.ProcessEnv, title: string, body: string) => Promise<boolean>;
+/** Finds a program on PATH, as the timer will not have the shell's PATH to find it by. */
+export declare const findProgram: (name: string, env: NodeJS.ProcessEnv, platform: NodeJS.Platform) => string | undefined;
+/**
+ * One run: the command or the agent with the schedule's variables, its output kept beside the schedule,
+ * the last result in `last.json`. An agent runs under `<PREFIX>_READ_ONLY`, so nothing it is talked
+ * into can send. A one-off removes itself afterwards.
+ */
+export declare const runSchedule: (app: AppIdentity, system: ServerSystem, env: NodeJS.ProcessEnv, file: string, { now, timer }?: {
+    now?: () => Date;
+    timer?: Timer;
+}) => Promise<LastRun>;
+//# sourceMappingURL=schedules.d.ts.map

package/dist/background/schedules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schedules.d.ts","sourceRoot":"","sources":["../../src/background/schedules.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C,qEAAqE;AACrE,MAAM,MAAM,IAAI,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3E,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,SAAS,GAAG,OAAO,CAAA;IACzB,+GAA+G;IAC/G,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,IAAI,EAAE,IAAI,CAAA;IACV,oHAAoH;IACpH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAA;CACf;AAID,eAAO,MAAM,YAAY,SAAU,MAAM,KAAG,MAK3C,CAAA;AAED,eAAO,MAAM,YAAY,UAAW,MAAM,WAA6B,CAAA;AACvE,eAAO,MAAM,YAAY,UAAW,MAAM,QAAQ,MAAM,WAAqD,CAAA;AAE7G,eAAO,MAAM,YAAY,SAAU,MAAM,KAAG,QAG3C,CAAA;AAED,eAAO,MAAM,OAAO,SAAU,MAAM,KAAG,OAAO,GAAG,SAGhD,CAAA;AAED,eAAO,MAAM,aAAa,UAAW,MAAM,KAAG,QAAQ,EAO9C,CAAA;AAER,eAAO,MAAM,YAAY,SAAU,IAAI,KAAG,MAKZ,CAAA;AAS9B,qIAAqI;AACrI,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC,uDAAuD;IACvD,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;CAChC;AAeD,eAAO,MAAM,YAAY,QAAS,WAAW,UAAU,YAAY,OAAO,MAAM,CAAC,UAAU,QAAQ,MAAM,KAAG,KAgD3G,CAAA;AAED,eAAO,MAAM,YAAY,QAAS,WAAW,UAAU,YAAY,OAAO,MAAM,CAAC,UAAU,QAAQ,MAAM,KAAG,KAsD3G,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,YAAY,QAAS,WAAW,UAAU,YAAY,OAAO,MAAM,CAAC,UAAU,KAAG,KA4C7F,CAAA;AAED,eAAO,MAAM,QAAQ,QAAS,WAAW,UAAU,YAAY,OAAO,MAAM,CAAC,UAAU,KAAG,KASzF,CAAA;AAED,0FAA0F;AAC1F,eAAO,MAAM,MAAM,WAAkB,YAAY,OAAO,MAAM,CAAC,UAAU,SAAS,MAAM,QAAQ,MAAM,qBAwCrG,CAAA;AAED,0FAA0F;AAC1F,eAAO,MAAM,WAAW,SAAU,MAAM,OAAO,MAAM,CAAC,UAAU,YAAY,MAAM,CAAC,QAAQ,KAAG,MAAM,GAAG,SAUtG,CAAA;AAID;;;;GAIG;AACH,eAAO,MAAM,WAAW,QACjB,WAAW,UACR,YAAY,OACf,MAAM,CAAC,UAAU,QAChB,MAAM,mBACuB;IAAE,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,KACrE,OAAO,CAAC,OAAO,CA2DjB,CAAA"}

package/dist/background/schedules.js

@@ -0,0 +1,313 @@
+import { spawn } from "node:child_process";
+import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { CliError, writeSecurely } from "@wirecat/cli-base";
+import { currentArgv } from "./renamed-paths.js";
+const NAME = /^[a-z0-9][a-z0-9-]{0,39}$/;
+export const scheduleName = (name) => {
+    if (!NAME.test(name)) {
+        throw new CliError("validation_error", `a schedule name is lowercase letters, digits and dashes — not "${name}"`);
+    }
+    return name;
+};
+export const schedulesDir = (state) => join(state, "schedules");
+export const scheduleFile = (state, name) => join(schedulesDir(state), name, "schedule.json");
+export const readSchedule = (file) => {
+    if (!existsSync(file))
+        throw new CliError("not_found", `no schedule at ${file}`);
+    return JSON.parse(readFileSync(file, "utf8"));
+};
+export const lastRun = (file) => {
+    const path = join(file, "..", "last.json");
+    return existsSync(path) ? JSON.parse(readFileSync(path, "utf8")) : undefined;
+};
+export const listSchedules = (state) => existsSync(schedulesDir(state))
+    ? readdirSync(schedulesDir(state))
+        .map((name) => scheduleFile(state, name))
+        .filter((file) => existsSync(file))
+        .map(readSchedule)
+        .sort((a, b) => a.name.localeCompare(b.name))
+    : [];
+export const describeWhen = (when) => "every" in when
+    ? `every ${when.every % 1440 === 0 ? `${when.every / 1440}d` : when.every % 60 === 0 ? `${when.every / 60}h` : `${when.every}m`}`
+    : "daily" in when
+        ? `daily at ${when.daily}`
+        : `once at ${when.once}`;
+/** A local wall-clock time, as both systemd's `OnCalendar=` and PowerShell's parser take it. */
+const localStamp = (iso) => {
+    const at = new Date(iso);
+    const two = (n) => String(n).padStart(2, "0");
+    return `${at.getFullYear()}-${two(at.getMonth() + 1)}-${two(at.getDate())} ${two(at.getHours())}:${two(at.getMinutes())}:${two(at.getSeconds())}`;
+};
+const systemdQuote = (value) => `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("%", "%%").replaceAll("$", "$$$$")}"`;
+const xml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+const checked = async (system, env, argv, allowFailure = false) => {
+    const ran = await system.run(argv, env);
+    if (ran.code !== 0 && !allowFailure) {
+        throw new CliError("configuration_error", `${argv[0]} failed: ${(ran.stderr || ran.stdout).trim()}`);
+    }
+    return ran;
+};
+export const systemdTimer = (app, system, env, home) => {
+    const folder = join(env.XDG_CONFIG_HOME ?? join(home, ".config"), "systemd", "user");
+    const unit = (name) => `${app.command}-schedule-${name}`;
+    return {
+        where: (name) => join(folder, `${unit(name)}.timer`),
+        install: async (schedule, argv) => {
+            const { when } = schedule;
+            writeSecurely(join(folder, `${unit(schedule.name)}.service`), [
+                "[Unit]",
+                `Description=${app.command} schedule ${schedule.name}`,
+                "",
+                "[Service]",
+                "Type=oneshot",
+                `ExecStart=${argv.map(systemdQuote).join(" ")}`,
+                "",
+            ].join("\n"), 0o644);
+            writeSecurely(join(folder, `${unit(schedule.name)}.timer`), [
+                "[Unit]",
+                `Description=${app.command} schedule ${schedule.name} — ${describeWhen(when)}`,
+                "",
+                "[Timer]",
+                ...("every" in when
+                    ? [`OnActiveSec=${when.every}min`, `OnUnitActiveSec=${when.every}min`]
+                    : // Persistent: a run missed while the machine slept happens when it wakes.
+                        [`OnCalendar=${"daily" in when ? `*-*-* ${when.daily}:00` : localStamp(when.once)}`, "Persistent=true"]),
+                "",
+                "[Install]",
+                "WantedBy=timers.target",
+                "",
+            ].join("\n"), 0o644);
+            await checked(system, env, ["systemctl", "--user", "daemon-reload"]);
+            await checked(system, env, ["systemctl", "--user", "enable", "--now", `${unit(schedule.name)}.timer`]);
+        },
+        remove: async (name) => {
+            await checked(system, env, ["systemctl", "--user", "disable", "--now", `${unit(name)}.timer`], true);
+            rmSync(join(folder, `${unit(name)}.timer`), { force: true });
+            rmSync(join(folder, `${unit(name)}.service`), { force: true });
+            await checked(system, env, ["systemctl", "--user", "daemon-reload"]);
+        },
+    };
+};
+export const launchdTimer = (app, system, env, home) => {
+    const folder = join(home, "Library", "LaunchAgents");
+    const label = (name) => `${app.appName}.schedule.${name}`;
+    const plist = (name) => join(folder, `${label(name)}.plist`);
+    const domain = `gui/${system.uid}`;
+    const calendar = (when) => {
+        if ("every" in when)
+            return [`  <key>StartInterval</key><integer>${when.every * 60}</integer>`];
+        const [hour, minute] = ("daily" in when ? when.daily : localStamp(when.once).slice(11, 16)).split(":").map(Number);
+        const once = "once" in when ? new Date(when.once) : undefined;
+        return [
+            "  <key>StartCalendarInterval</key>",
+            "  <dict>",
+            // launchd has no year: a one-off is a yearly date, and the run removes it.
+            ...(once
+                ? [
+                    `    <key>Month</key><integer>${once.getMonth() + 1}</integer>`,
+                    `    <key>Day</key><integer>${once.getDate()}</integer>`,
+                ]
+                : []),
+            `    <key>Hour</key><integer>${hour}</integer>`,
+            `    <key>Minute</key><integer>${minute}</integer>`,
+            "  </dict>",
+        ];
+    };
+    return {
+        where: plist,
+        install: async (schedule, argv) => {
+            await checked(system, env, ["launchctl", "bootout", `${domain}/${label(schedule.name)}`], true);
+            writeSecurely(plist(schedule.name), [
+                '<?xml version="1.0" encoding="UTF-8"?>',
+                '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+                '<plist version="1.0">',
+                "<dict>",
+                `  <key>Label</key><string>${xml(label(schedule.name))}</string>`,
+                "  <key>ProgramArguments</key>",
+                "  <array>",
+                ...argv.map((word) => `    <string>${xml(word)}</string>`),
+                "  </array>",
+                ...calendar(schedule.when),
+                "</dict>",
+                "</plist>",
+                "",
+            ].join("\n"), 0o644);
+            await checked(system, env, ["launchctl", "bootstrap", domain, plist(schedule.name)]);
+        },
+        remove: async (name) => {
+            await checked(system, env, ["launchctl", "bootout", `${domain}/${label(name)}`], true);
+            rmSync(plist(name), { force: true });
+        },
+    };
+};
+/**
+ * Task Scheduler through PowerShell's ScheduledTasks module. The values travel in variables, never in
+ * the script, so nothing needs quoting for PowerShell; Windows has no per-task environment, which is why
+ * the runner reads its variables from the schedule file.
+ */
+export const windowsTimer = (app, system, env) => {
+    const path = `\\${app.appName}\\`;
+    const powershell = (script, values, allowFailure = false) => checked(system, { ...env, ...values }, ["powershell.exe", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", script], allowFailure);
+    return {
+        where: (name) => `Task Scheduler ${path}${name}`,
+        install: async (schedule, [exe = "", ...args]) => {
+            const { when } = schedule;
+            await powershell([
+                "$ErrorActionPreference = 'Stop'",
+                "$action = New-ScheduledTaskAction -Execute $env:WIRECAT_EXE -Argument $env:WIRECAT_ARGS",
+                "$trigger = switch ($env:WIRECAT_KIND) {",
+                "  'every' { New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes ([int]$env:WIRECAT_MINUTES)) }",
+                "  'daily' { New-ScheduledTaskTrigger -Daily -At $env:WIRECAT_AT }",
+                "  'once' { New-ScheduledTaskTrigger -Once -At ([datetime]::ParseExact($env:WIRECAT_AT, 'yyyy-MM-dd HH:mm:ss', $null)) }",
+                "}",
+                "$settings = New-ScheduledTaskSettingsSet -StartWhenAvailable -MultipleInstances IgnoreNew",
+                "Register-ScheduledTask -TaskName $env:WIRECAT_NAME -TaskPath $env:WIRECAT_PATH -Action $action -Trigger $trigger -Settings $settings -Force | Out-Null",
+            ].join("\n"), {
+                WIRECAT_EXE: exe,
+                WIRECAT_ARGS: args.map((word) => `"${word.replaceAll('"', '\\"')}"`).join(" "),
+                WIRECAT_KIND: "every" in when ? "every" : "daily" in when ? "daily" : "once",
+                WIRECAT_MINUTES: "every" in when ? String(when.every) : "",
+                WIRECAT_AT: "daily" in when ? when.daily : "once" in when ? localStamp(when.once) : "",
+                WIRECAT_NAME: schedule.name,
+                WIRECAT_PATH: path,
+            });
+        },
+        remove: async (name) => {
+            await powershell("Unregister-ScheduledTask -TaskName $env:WIRECAT_NAME -TaskPath $env:WIRECAT_PATH -Confirm:$false", { WIRECAT_NAME: name, WIRECAT_PATH: path }, true);
+        },
+    };
+};
+export const timerFor = (app, system, env) => {
+    if (system.platform === "win32")
+        return windowsTimer(app, system, env);
+    if (!env.HOME)
+        throw new CliError("configuration_error", "HOME is not set, so there is nowhere to put the timer");
+    if (system.platform === "linux")
+        return systemdTimer(app, system, env, env.HOME);
+    if (system.platform === "darwin")
+        return launchdTimer(app, system, env, env.HOME);
+    throw new CliError("validation_error", `${app.command} schedule knows Linux, macOS and Windows, not ${system.platform}`);
+};
+/** A desktop notification; a machine without one loses only the notice, never the run. */
+export const notify = async (system, env, title, body) => {
+    const argv = system.platform === "linux"
+        ? ["notify-send", "--app-name", title, title, body]
+        : system.platform === "darwin"
+            ? [
+                "osascript",
+                "-e",
+                "on run argv",
+                "-e",
+                "display notification (item 2 of argv) with title (item 1 of argv)",
+                "-e",
+                "end run",
+                title,
+                body,
+            ]
+            : system.platform === "win32"
+                ? [
+                    "powershell.exe",
+                    "-NoProfile",
+                    "-NonInteractive",
+                    "-Command",
+                    [
+                        "[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null",
+                        "$xml = [Windows.UI.Notifications.ToastNotificationManager]::GetTemplateContent([Windows.UI.Notifications.ToastTemplateType]::ToastText02)",
+                        "$text = $xml.GetElementsByTagName('text')",
+                        "$text.Item(0).AppendChild($xml.CreateTextNode($env:WIRECAT_TITLE)) | Out-Null",
+                        "$text.Item(1).AppendChild($xml.CreateTextNode($env:WIRECAT_BODY)) | Out-Null",
+                        // Windows shows a toast only for a registered app; PowerShell's own id is always there.
+                        "$app = '{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\WindowsPowerShell\\v1.0\\powershell.exe'",
+                        "[Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier($app).Show([Windows.UI.Notifications.ToastNotification]::new($xml))",
+                    ].join("\n"),
+                ]
+                : undefined;
+    if (!argv)
+        return false;
+    try {
+        return (await system.run(argv, { ...env, WIRECAT_TITLE: title, WIRECAT_BODY: body })).code === 0;
+    }
+    catch {
+        return false;
+    }
+};
+/** Finds a program on PATH, as the timer will not have the shell's PATH to find it by. */
+export const findProgram = (name, env, platform) => {
+    const separator = platform === "win32" ? ";" : ":";
+    const extensions = platform === "win32" ? ["", ".exe"] : [""];
+    for (const folder of (env.PATH ?? env.Path ?? "").split(separator).filter(Boolean)) {
+        for (const extension of extensions) {
+            const path = join(folder, `${name}${extension}`);
+            if (existsSync(path))
+                return path;
+        }
+    }
+    return undefined;
+};
+const KEEP_RUNS = 30;
+/**
+ * One run: the command or the agent with the schedule's variables, its output kept beside the schedule,
+ * the last result in `last.json`. An agent runs under `<PREFIX>_READ_ONLY`, so nothing it is talked
+ * into can send. A one-off removes itself afterwards.
+ */
+export const runSchedule = async (app, system, env, file, { now = () => new Date(), timer } = {}) => {
+    const schedule = readSchedule(file);
+    const folder = join(file, "..");
+    const runs = join(folder, "runs");
+    mkdirSync(runs, { recursive: true, mode: 0o700 });
+    const stamp = now()
+        .toISOString()
+        .replaceAll(":", "-")
+        .replace(/\.\d+Z$/, "Z");
+    const agent = schedule.kind === "agent";
+    const output = join(runs, `${stamp}.${agent ? "md" : "log"}`);
+    const log = agent ? join(runs, `${stamp}.log`) : output;
+    const [program = "", ...args] = agent ? schedule.argv : [...system.entry, ...currentArgv(schedule.argv)];
+    const childEnv = {
+        ...env,
+        ...schedule.environment,
+        ...(agent ? { [`${app.envPrefix}_READ_ONLY`]: "1" } : {}),
+    };
+    const exitCode = await new Promise((resolve) => {
+        const child = spawn(program, args, { env: childEnv, cwd: folder, stdio: ["ignore", "pipe", "pipe"] });
+        const out = [];
+        const err = [];
+        child.stdout.on("data", (chunk) => out.push(chunk));
+        child.stderr.on("data", (chunk) => err.push(chunk));
+        child.on("error", (error) => {
+            err.push(Buffer.from(String(error)));
+            resolve(127);
+        });
+        child.on("close", (code) => {
+            writeFileSync(output, Buffer.concat(agent ? out : [...out, ...err]), { mode: 0o600 });
+            if (agent)
+                writeFileSync(log, Buffer.concat(err), { mode: 0o600 });
+            resolve(code ?? 1);
+        });
+    });
+    const last = { at: now().toISOString(), exitCode, output };
+    writeFileSync(join(folder, "last.json"), `${JSON.stringify(last, null, 2)}\n`, { mode: 0o600 });
+    if (agent && exitCode === 0)
+        copyFileSync(output, join(folder, "latest.md"));
+    for (const old of readdirSync(runs)
+        .sort()
+        .slice(0, -KEEP_RUNS * 2))
+        rmSync(join(runs, old), { force: true });
+    const title = `${app.command} ${schedule.name}`;
+    if (agent && exitCode === 0) {
+        const first = readFileSync(output, "utf8")
+            .split("\n")
+            .find((line) => line.trim()) ?? "report ready";
+        await notify(system, env, title, `${first.trim().slice(0, 180)}\n${join(folder, "latest.md")}`);
+    }
+    else if (exitCode !== 0) {
+        await notify(system, env, title, `failed (exit ${exitCode}) — ${agent ? log : output}`);
+    }
+    if ("once" in schedule.when) {
+        await timer?.remove(schedule.name);
+        rmSync(file, { force: true });
+    }
+    return last;
+};
+//# sourceMappingURL=schedules.js.map