@with-logic/elwood 0.1.3 → 0.2.0

package/dist/runtime/update/owner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner.d.ts","sourceRoot":"","sources":["../../../src/runtime/update/owner.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAC9C,6EAA6E;AAC7E,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAEhD,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnD,CAAC;AAEF,yEAAyE;AACzE,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAMhF;AAYD,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAc7E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIxD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAGvD;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOlD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGvE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,OAAO,CAAC,IAAI,CAAC,CAcf;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAWjF"}

package/dist/runtime/update/owner.js

@@ -0,0 +1,131 @@
+/**
+ * Update lease owner records: identity, liveness, and generation-checked release.
+ * Implements PRD §9.2 / C-PERF-04: cleanup removes only the generation it owns.
+ */
+import { randomUUID } from "node:crypto";
+import { readFile, rename, rm, unlink, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { ElwoodError, errnoCode } from "../../core/errors.js";
+import { processGroupGone } from "../probe-cleanup.js";
+export const ownerFile = "owner";
+/** Marks a lease directory already retired by its owner and awaiting deletion. */
+export const retiredLeaseInfix = ".released.";
+/** Prefix of a record being written but not yet committed into the lease. */
+export const pendingOwnerPrefix = "owner.next.";
+const ownerPattern = /^(\d+):([0-9a-f-]+)(?::(\d+(?:,\d+)*))?$/;
+/** File contents, or undefined when absent/unreadable (never throws). */
+export async function readOptionalText(path) {
+    try {
+        return await readFile(path, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+const isSignalTarget = (value) => Number.isSafeInteger(value) && value > 0;
+/**
+ * Stricter than a pid: a group is only ever read back as `process.kill(-id, 0)`, and `-1`
+ * is the broadcast target — every process this user may signal. A record naming group 1
+ * would therefore look alive for as long as the user has any process at all, holding the
+ * lease forever. Group 1 is init's group and never an updater's, so rejecting it costs
+ * nothing real.
+ */
+const isProcessGroupId = (value) => isSignalTarget(value) && value > 1;
+export async function readOwner(path) {
+    const match = ownerPattern.exec((await readOptionalText(join(path, ownerFile))) ?? "");
+    if (!match)
+        return undefined;
+    const pid = Number(match[1]);
+    const ownedProcessGroupIds = match[3]?.split(",").map(Number);
+    // An identity no signal probe can safely evaluate is malformed, not live; like any
+    // unreadable record it fails safe rather than reaching process.kill.
+    if (!(isSignalTarget(pid) && (ownedProcessGroupIds ?? []).every(isProcessGroupId)))
+        return undefined;
+    return {
+        pid,
+        token: match[2],
+        ...(ownedProcessGroupIds === undefined ? {} : { ownedProcessGroupIds }),
+    };
+}
+export function serializeOwner(owner) {
+    const groups = owner.ownedProcessGroupIds === undefined ? "" : `:${owner.ownedProcessGroupIds.join(",")}`;
+    return `${owner.pid}:${owner.token}${groups}`;
+}
+/**
+ * Lease liveness, not owner-process liveness. A record naming process groups is held by
+ * those groups alone, so it ends with them rather than with the process that wrote it —
+ * that is what lets an update's surviving children keep the lease past their parent. No
+ * record names groups until something records them, so this is `parentIsAlive` until then.
+ */
+export function leaseIsAlive(owner) {
+    if (owner.ownedProcessGroupIds === undefined)
+        return parentIsAlive(owner.pid);
+    return owner.ownedProcessGroupIds.some((id) => !processGroupGone(id));
+}
+export function parentIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return errnoCode(error) !== "ESRCH";
+    }
+}
+/**
+ * The process group an aborted update probe could not confirm gone, taken from its typed
+ * error. A probe that cleaned up after itself names no group and retains no lease.
+ */
+export function unresolvedProbeGroup(error) {
+    const group = error instanceof ElwoodError ? error.details["cleanupProcessGroupId"] : undefined;
+    return typeof group === "number" && isProcessGroupId(group) ? group : undefined;
+}
+/**
+ * Replaces this generation's owner record, naming the process groups that now hold the
+ * lease. The write lands on a per-write temporary name and is committed by rename, so a
+ * late or concurrent write can neither clobber nor unlink another write's pending record,
+ * and a write that outlives its lease cannot replace a successor generation's record.
+ *
+ * Rejects rather than publishes a record it could not read back. An empty list serializes
+ * to a trailing colon that `readOwner` refuses, which would make the lease unreadable and
+ * so unreleasable; an out-of-range group would either do the same or, for group 1, hold
+ * the lease against every process this user owns. A caller with no valid surviving group
+ * has nothing to retain and should release instead.
+ */
+export async function retainProbeOwner(path, owner, processGroupIds) {
+    if (processGroupIds.length === 0 || !processGroupIds.every(isProcessGroupId))
+        throw new Error("An update lease can only be retained for valid process groups.");
+    const temporary = join(path, `${pendingOwnerPrefix}${randomUUID()}`);
+    try {
+        const record = { ...owner, ownedProcessGroupIds: processGroupIds };
+        await writeFile(temporary, serializeOwner(record), { mode: 0o600 });
+        if ((await readOwner(path))?.token !== owner.token)
+            throw new Error("The update lease belongs to another generation.");
+        await rename(temporary, join(path, ownerFile));
+    }
+    catch (error) {
+        await unlink(temporary).catch(() => undefined);
+        throw error;
+    }
+}
+/**
+ * Retires the lease atomically by renaming it away before deleting it. Removing the record
+ * and then the directory would expose an ownerless lease in between, which a polling
+ * contender recovers as stale and follows with a duplicate update.
+ *
+ * A rename that fails outright must still not leave this owner's lease standing: the owner
+ * is alive, so contenders would read a live pid and wait for an update that already
+ * finished — forever, on that host. The fallback removes the lease where it is instead,
+ * which briefly exposes the ownerless window for that one release. That is the lesser of
+ * the two: a duplicate update is recoverable, an update no one can ever run is not.
+ */
+export async function releaseLease(path, owner) {
+    const current = await readOwner(path);
+    if (current?.token !== owner.token)
+        return;
+    const retired = `${path}${retiredLeaseInfix}${owner.token}`;
+    const renamed = await rename(path, retired).then(() => true, () => false);
+    // One recursive removal either way: of the retired copy when the rename worked, or of the
+    // lease in place when it did not. Removing the directory takes the owner record with it.
+    await rm(renamed ? retired : path, { recursive: true, force: true }).catch(() => undefined);
+}
+//# sourceMappingURL=owner.js.map

package/dist/runtime/update/owner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner.js","sourceRoot":"","sources":["../../../src/runtime/update/owner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AACjC,kFAAkF;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAC9C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAChD,MAAM,YAAY,GAAG,0CAA0C,CAAC;AAQhE,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAC5F;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AAExF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY;IAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,oBAAoB,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9D,mFAAmF;IACnF,qEAAqE;IACrE,IAAI,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAChF,OAAO,SAAS,CAAC;IACnB,OAAO;QACL,GAAG;QACH,KAAK,EAAE,KAAK,CAAC,CAAC,CAAW;QACzB,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,MAAM,MAAM,GACV,KAAK,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7F,OAAO,GAAG,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,KAAK,GAAG,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,IAAI,KAAK,CAAC,oBAAoB,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9E,OAAO,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,MAAM,KAAK,GAAG,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,KAAiB,EACjB,eAAkC;IAElC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,kBAAkB,GAAG,UAAU,EAAE,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,CAAC;QACnE,MAAM,SAAS,CAAC,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,KAAK,CAAC,KAAK;YAChD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,KAAiB;IAChE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,OAAO,EAAE,KAAK,KAAK,KAAK,CAAC,KAAK;QAAE,OAAO;IAC3C,MAAM,OAAO,GAAG,GAAG,IAAI,GAAG,iBAAiB,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAC9C,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;IACF,0FAA0F;IAC1F,yFAAyF;IACzF,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC9F,CAAC"}

package/dist/runtime/update/retained-lease.d.ts

@@ -0,0 +1,13 @@
+import { type LeaseOwner } from "./owner.ts";
+/**
+ * Records the surviving groups as the lease's only holders, so the lease outlives this
+ * process and a contender waits for the groups rather than for a pid that has moved on.
+ *
+ * When that write fails the lease still names this live process, which contenders would
+ * honour for as long as this host runs — long after the groups exit. This process therefore
+ * keeps the obligation itself: it retries the record and, as soon as the groups are gone,
+ * releases the lease. The timer is unreferenced, so a host that is shutting down is never
+ * held open by it.
+ */
+export declare function retainLease(path: string, owner: LeaseOwner, processGroupIds: readonly number[], retryMs: number): Promise<void>;
+//# sourceMappingURL=retained-lease.d.ts.map

package/dist/runtime/update/retained-lease.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retained-lease.d.ts","sourceRoot":"","sources":["../../../src/runtime/update/retained-lease.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,UAAU,EAAkC,MAAM,YAAY,CAAC;AAE7E;;;;;;;;;GASG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,SAAS,MAAM,EAAE,EAClC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAMf"}

package/dist/runtime/update/retained-lease.js

@@ -0,0 +1,40 @@
+/**
+ * Hands a lease whose updater groups outlived the update callback over to those groups.
+ * Implements PRD §9.2 / C-PERF-04: a cleanup record that cannot be written never strands
+ * the lease for the owner host's lifetime.
+ */
+import { setTimeout as delay } from "node:timers/promises";
+import { processGroupGone } from "../probe-cleanup.js";
+import { releaseLease, retainProbeOwner } from "./owner.js";
+/**
+ * Records the surviving groups as the lease's only holders, so the lease outlives this
+ * process and a contender waits for the groups rather than for a pid that has moved on.
+ *
+ * When that write fails the lease still names this live process, which contenders would
+ * honour for as long as this host runs — long after the groups exit. This process therefore
+ * keeps the obligation itself: it retries the record and, as soon as the groups are gone,
+ * releases the lease. The timer is unreferenced, so a host that is shutting down is never
+ * held open by it.
+ */
+export async function retainLease(path, owner, processGroupIds, retryMs) {
+    try {
+        await retainProbeOwner(path, owner, processGroupIds);
+    }
+    catch {
+        void retainUntilRecorded(path, owner, processGroupIds, retryMs);
+    }
+}
+async function retainUntilRecorded(path, owner, processGroupIds, retryMs) {
+    for (;;) {
+        await delay(retryMs, undefined, { ref: false });
+        const live = processGroupIds.filter((id) => !processGroupGone(id));
+        // `releaseLease` is generation-checked and contains its own filesystem failures, so a
+        // successor that has since claimed the lease is never disturbed by this.
+        if (live.length === 0)
+            return releaseLease(path, owner);
+        const recorded = await retainProbeOwner(path, owner, live).then(() => true, () => false);
+        if (recorded)
+            return;
+    }
+}
+//# sourceMappingURL=retained-lease.js.map

package/dist/runtime/update/retained-lease.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retained-lease.js","sourceRoot":"","sources":["../../../src/runtime/update/retained-lease.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAmB,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE7E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAY,EACZ,KAAiB,EACjB,eAAkC,EAClC,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,IAAY,EACZ,KAAiB,EACjB,eAAkC,EAClC,OAAe;IAEf,SAAS,CAAC;QACR,MAAM,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;QACnE,sFAAsF;QACtF,yEAAyE;QACzE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAC7D,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;QACF,IAAI,QAAQ;YAAE,OAAO;IACvB,CAAC;AACH,CAAC"}

package/dist/runtime/update/waiting.d.ts

@@ -0,0 +1,4 @@
+export declare function waitForOwner(path: string, pollMs: number, staleMs: number, waitUntilMs: number): Promise<"released" | "stale_removed" | "wait_expired" | "cleanup_pending">;
+export declare function recoveryPath(path: string): string;
+export declare function pathExists(path: string): Promise<boolean>;
+//# sourceMappingURL=waiting.d.ts.map

package/dist/runtime/update/waiting.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waiting.d.ts","sourceRoot":"","sources":["../../../src/runtime/update/waiting.ts"],"names":[],"mappings":"AASA,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,UAAU,GAAG,eAAe,GAAG,cAAc,GAAG,iBAAiB,CAAC,CA2B5E;AAuCD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO/D"}

package/dist/runtime/update/waiting.js

@@ -0,0 +1,95 @@
+/**
+ * Bounded update contention and generation-safe recovery of a dead owner's lease.
+ * Implements PRD §9.2 / C-PERF-04; time alone never evicts a live updater.
+ */
+import { opendir, rename, rmdir, stat, unlink } from "node:fs/promises";
+import { join } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { leaseIsAlive, ownerFile, pendingOwnerPrefix, readOwner } from "./owner.js";
+export async function waitForOwner(path, pollMs, staleMs, waitUntilMs) {
+    for (;;) {
+        if (performance.now() >= waitUntilMs)
+            return "wait_expired";
+        let lease;
+        try {
+            lease = await stat(path);
+        }
+        catch {
+            if (await restoreRecovery(path))
+                continue;
+            return "released";
+        }
+        const current = await readOwner(path);
+        // Presence of the record only, not proof that any of those groups still runs; the
+        // liveness question is asked separately below.
+        const hasRecordedProcessGroups = current?.ownedProcessGroupIds !== undefined;
+        // A lease held by a surviving updater group is not worth waiting out: those groups may
+        // outlive any bound this contender could set, so it says so and moves on.
+        if (hasRecordedProcessGroups && current !== undefined && leaseIsAlive(current))
+            return "cleanup_pending";
+        // Groups, unlike a parent process, are confirmed gone rather than merely quiet, so a
+        // lease whose every group has exited is dead whatever its age says.
+        if (hasRecordedProcessGroups || Date.now() - lease.mtimeMs >= staleMs) {
+            const recovered = await recoverStaleLease(path);
+            if (recovered === "removed")
+                return "stale_removed";
+            if (recovered === "unrecoverable")
+                return "released";
+        }
+        await delay(pollMs);
+    }
+}
+async function recoverStaleLease(path) {
+    const expected = await readOwner(path);
+    if (expected !== undefined && leaseIsAlive(expected))
+        return "alive";
+    const recovery = recoveryPath(path);
+    try {
+        await rename(path, recovery);
+    }
+    catch {
+        return (await pathExists(recovery)) ? "alive" : "unrecoverable";
+    }
+    const moved = await readOwner(recovery);
+    if (expected?.token !== moved?.token || (moved !== undefined && leaseIsAlive(moved))) {
+        return "unrecoverable";
+    }
+    try {
+        if (moved !== undefined)
+            await unlink(join(recovery, ownerFile));
+        // A record being written when its owner died is named uniquely and commits by rename,
+        // so any left here belongs to this dead generation and would otherwise block `rmdir`.
+        // Streamed rather than materialized: a lease that collected many interrupted writes
+        // must not make recovery's memory grow with them.
+        for await (const entry of await opendir(recovery))
+            if (entry.name.startsWith(pendingOwnerPrefix))
+                await unlink(join(recovery, entry.name));
+        await rmdir(recovery);
+        return "removed";
+    }
+    catch {
+        return "unrecoverable";
+    }
+}
+async function restoreRecovery(path) {
+    try {
+        await rename(recoveryPath(path), path);
+        return true;
+    }
+    catch {
+        return pathExists(path);
+    }
+}
+export function recoveryPath(path) {
+    return `${path}.recovery`;
+}
+export async function pathExists(path) {
+    try {
+        await stat(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=waiting.js.map

package/dist/runtime/update/waiting.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"waiting.js","sourceRoot":"","sources":["../../../src/runtime/update/waiting.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEpF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,MAAc,EACd,OAAe,EACf,WAAmB;IAEnB,SAAS,CAAC;QACR,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,WAAW;YAAE,OAAO,cAAc,CAAC;QAC5D,IAAI,KAAuC,CAAC;QAC5C,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,MAAM,eAAe,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC1C,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,kFAAkF;QAClF,+CAA+C;QAC/C,MAAM,wBAAwB,GAAG,OAAO,EAAE,oBAAoB,KAAK,SAAS,CAAC;QAC7E,uFAAuF;QACvF,0EAA0E;QAC1E,IAAI,wBAAwB,IAAI,OAAO,KAAK,SAAS,IAAI,YAAY,CAAC,OAAO,CAAC;YAC5E,OAAO,iBAAiB,CAAC;QAC3B,qFAAqF;QACrF,oEAAoE;QACpE,IAAI,wBAAwB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;YACtE,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,eAAe,CAAC;YACpD,IAAI,SAAS,KAAK,eAAe;gBAAE,OAAO,UAAU,CAAC;QACvD,CAAC;QACD,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,YAAY,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IACrE,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,QAAQ,EAAE,KAAK,KAAK,KAAK,EAAE,KAAK,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACrF,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,CAAC;QACH,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;QACjE,sFAAsF;QACtF,sFAAsF;QACtF,oFAAoF;QACpF,kDAAkD;QAClD,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,QAAQ,CAAC;YAC/C,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;gBAAE,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1F,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,GAAG,IAAI,WAAW,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/state/canonical-path.d.ts

@@ -0,0 +1,2 @@
+export declare function canonicalStatePath(path: string): string;
+//# sourceMappingURL=canonical-path.d.ts.map

package/dist/state/canonical-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-path.d.ts","sourceRoot":"","sources":["../../src/state/canonical-path.ts"],"names":[],"mappings":"AAMA,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAavD"}

package/dist/state/canonical-path.js

@@ -0,0 +1,22 @@
+/** Canonical identity after no-follow validation, including absent state paths (PRD §8.1). */
+import { realpathSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+import { errnoCode } from "../core/errors.js";
+import { assertStatePath } from "./directories.js";
+export function canonicalStatePath(path) {
+    let current = resolve(path);
+    assertStatePath(current);
+    const missing = [];
+    for (;;) {
+        try {
+            return join(realpathSync(current), ...missing.reverse());
+        }
+        catch (error) {
+            if (errnoCode(error) !== "ENOENT")
+                throw error;
+            missing.push(basename(current));
+            current = dirname(current);
+        }
+    }
+}
+//# sourceMappingURL=canonical-path.js.map

package/dist/state/canonical-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-path.js","sourceRoot":"","sources":["../../src/state/canonical-path.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAChC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/state/launch-ownership.d.ts

@@ -0,0 +1,21 @@
+export type LaunchOwnership = {
+    /** Exclusive authority for startup publication and destructive cleanup. */
+    readonly current: () => boolean;
+    /** Ordinary loop and record writes may continue on a predecessor while resume is pending. */
+    readonly canPersist: () => boolean;
+    readonly persistFile: (path: string, text: string) => void;
+    readonly publishFile: (path: string, text: string) => void;
+    readonly release: () => void;
+    readonly onCommit: (activate: () => void) => void;
+    readonly onRevoked: (pause: () => void) => void;
+    readonly waitForCleanup: () => Promise<void>;
+};
+export type LaunchReservation = LaunchOwnership & {
+    readonly commit: () => void;
+    readonly rollback: () => void;
+};
+/** Reserve before startup yields; failure restores only the still-current predecessor. */
+export declare function reserveLaunchOwnership(inputPath: string): LaunchReservation;
+/** CLI identity cleanup cannot remove a live or pending same-process launch's state. */
+export declare function hasLaunchOwner(sessionDir: string): boolean;
+//# sourceMappingURL=launch-ownership.d.ts.map

package/dist/state/launch-ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch-ownership.d.ts","sourceRoot":"","sources":["../../src/state/launch-ownership.ts"],"names":[],"mappings":"AA2BA,MAAM,MAAM,eAAe,GAAG;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC;IAChC,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,EAAE,MAAM,OAAO,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3D,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3D,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;IAClD,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;IAChD,QAAQ,CAAC,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C,CAAC;AACF,MAAM,MAAM,iBAAiB,GAAG,eAAe,GAAG;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC;CAC/B,CAAC;AAEF,0FAA0F;AAC1F,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,CA8F3E;AAED,wFAAwF;AACxF,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAE1D"}

package/dist/state/launch-ownership.js

@@ -0,0 +1,154 @@
+/** Same-process launch ownership for shared session state (PRD §8.1, C-API-20). */
+import { elwoodError } from "../core/errors.js";
+import { canonicalStatePath } from "./canonical-path.js";
+import { writePrivateFileAtomic } from "./files.js";
+import { LaunchPublication } from "./launch-publication.js";
+const generations = new Map();
+const collected = new FinalizationRegistry((entry) => {
+    if (generations.get(entry.path) === entry)
+        generations.delete(entry.path);
+});
+class Generation {
+    entry;
+    publication = new LaunchPublication();
+    phase = "pending";
+    previous;
+    settled = Promise.withResolvers();
+    activation = [];
+    revoked = [];
+    constructor(path) {
+        this.entry = { path, generation: new WeakRef(this) };
+        this.previous = generations.get(path)?.generation.deref();
+    }
+}
+/** Reserve before startup yields; failure restores only the still-current predecessor. */
+export function reserveLaunchOwnership(inputPath) {
+    const path = canonicalStatePath(inputPath);
+    const token = new Generation(path);
+    const publication = token.publication;
+    generations.set(path, token.entry);
+    collected.register(token, token.entry, token);
+    const current = () => generations.get(path) === token.entry;
+    let retryOwner;
+    let failedPublications = [];
+    const canPersist = () => {
+        if (token.phase === "failed")
+            return false;
+        let owner = generations.get(path)?.generation.deref();
+        while (owner) {
+            if (owner === token)
+                return true;
+            if (owner.phase === "active")
+                return false;
+            owner = owner.previous;
+        }
+        return false;
+    };
+    return {
+        current,
+        canPersist,
+        persistFile: (file, text) => {
+            if (!canPersist())
+                throw elwoodError("session_not_running", "Launch was superseded.");
+            if (token.phase === "pending")
+                publication.write(file, text);
+            else
+                writePrivateFileAtomic(file, text);
+        },
+        publishFile: (file, text) => {
+            if (!current())
+                throw elwoodError("session_not_running", "Launch was superseded.");
+            if (token.phase === "pending")
+                publication.write(file, text);
+            else
+                writePrivateFileAtomic(file, text);
+        },
+        onCommit: (activate) => {
+            token.activation.push(activate);
+        },
+        onRevoked: (pause) => {
+            token.revoked.push(pause);
+        },
+        waitForCleanup: async () => {
+            let owner = generations.get(path)?.generation.deref();
+            while (owner && owner !== token && owner.phase === "pending") {
+                await owner.settled.promise;
+                owner = generations.get(path)?.generation.deref();
+            }
+        },
+        release: () => {
+            if (current()) {
+                generations.delete(path);
+                collected.unregister(token);
+                token.settled.resolve();
+            }
+        },
+        commit: () => {
+            if (!canPersist())
+                throw elwoodError("session_not_running", "Launch was superseded.");
+            // Activation rereads durable loops synchronously before ownership changes.
+            for (const activate of token.activation)
+                activate();
+            publication.clear();
+            token.phase = "active";
+            let previous = token.previous;
+            token.previous = undefined;
+            while (previous) {
+                for (const pause of previous.revoked)
+                    pause();
+                previous = previous.previous;
+            }
+            token.settled.resolve();
+        },
+        rollback: () => {
+            if (token.phase === "failed") {
+                if (retryOwner && generations.get(path) === retryOwner)
+                    restoreAll(failedPublications);
+                return;
+            }
+            try {
+                if (current()) {
+                    let previous = token.previous;
+                    failedPublications = [publication];
+                    while (previous?.phase === "failed") {
+                        failedPublications.push(previous.publication);
+                        previous = previous.previous;
+                    }
+                    retryOwner = previous?.entry;
+                    try {
+                        restoreAll(failedPublications);
+                    }
+                    finally {
+                        if (previous)
+                            generations.set(path, previous.entry);
+                        else
+                            generations.delete(path);
+                    }
+                }
+            }
+            finally {
+                token.phase = "failed";
+                collected.unregister(token);
+                token.settled.resolve();
+            }
+        },
+    };
+}
+/** CLI identity cleanup cannot remove a live or pending same-process launch's state. */
+export function hasLaunchOwner(sessionDir) {
+    return generations.get(canonicalStatePath(sessionDir))?.generation.deref() !== undefined;
+}
+function restoreAll(publications) {
+    let failure;
+    for (const publication of publications) {
+        try {
+            publication.rollback();
+        }
+        catch (error) {
+            failure ??= error;
+        }
+    }
+    if (failure !== undefined)
+        throw failure;
+}
+//# sourceMappingURL=launch-ownership.js.map

package/dist/state/launch-ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch-ownership.js","sourceRoot":"","sources":["../../src/state/launch-ownership.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAI5D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAiB,CAAC;AAC7C,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAQ,CAAC,KAAK,EAAE,EAAE;IAC1D,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK;QAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEH,MAAM,UAAU;IACL,KAAK,CAAQ;IACb,WAAW,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAC/C,KAAK,GAAU,SAAS,CAAC;IACzB,QAAQ,CAAyB;IACxB,OAAO,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;IACxC,UAAU,GAAmB,EAAE,CAAC;IAChC,OAAO,GAAmB,EAAE,CAAC;IACtC,YAAY,IAAY;QACtB,IAAI,CAAC,KAAK,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;IAC5D,CAAC;CACF;AAmBD,0FAA0F;AAC1F,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACnC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC;IAC5D,IAAI,UAA6B,CAAC;IAClC,IAAI,kBAAkB,GAAwB,EAAE,CAAC;IACjD,MAAM,UAAU,GAAG,GAAG,EAAE;QACtB,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC3C,IAAI,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;QACtD,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,KAAK,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC3C,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC;QACzB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,OAAO;QACL,OAAO;QACP,UAAU;QACV,WAAW,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;YAC1B,IAAI,CAAC,UAAU,EAAE;gBAAE,MAAM,WAAW,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,CAAC;YACtF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;;gBACxD,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,WAAW,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;YAC1B,IAAI,CAAC,OAAO,EAAE;gBAAE,MAAM,WAAW,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,CAAC;YACnF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;;gBACxD,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE;YACrB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QACD,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACnB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,cAAc,EAAE,KAAK,IAAI,EAAE;YACzB,IAAI,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;YACtD,OAAO,KAAK,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC7D,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC5B,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;YACpD,CAAC;QACH,CAAC;QACD,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,OAAO,EAAE,EAAE,CAAC;gBACd,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACzB,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBAC5B,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,MAAM,EAAE,GAAG,EAAE;YACX,IAAI,CAAC,UAAU,EAAE;gBAAE,MAAM,WAAW,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,CAAC;YACtF,2EAA2E;YAC3E,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,UAAU;gBAAE,QAAQ,EAAE,CAAC;YACpD,WAAW,CAAC,KAAK,EAAE,CAAC;YACpB,KAAK,CAAC,KAAK,GAAG,QAAQ,CAAC;YACvB,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;YAC9B,KAAK,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC3B,OAAO,QAAQ,EAAE,CAAC;gBAChB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO;oBAAE,KAAK,EAAE,CAAC;gBAC9C,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;YAC/B,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;QACD,QAAQ,EAAE,GAAG,EAAE;YACb,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC7B,IAAI,UAAU,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,UAAU;oBAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;gBACvF,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,OAAO,EAAE,EAAE,CAAC;oBACd,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;oBAC9B,kBAAkB,GAAG,CAAC,WAAW,CAAC,CAAC;oBACnC,OAAO,QAAQ,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;wBACpC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;wBAC9C,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;oBAC/B,CAAC;oBACD,UAAU,GAAG,QAAQ,EAAE,KAAK,CAAC;oBAC7B,IAAI,CAAC;wBACH,UAAU,CAAC,kBAAkB,CAAC,CAAC;oBACjC,CAAC;4BAAS,CAAC;wBACT,IAAI,QAAQ;4BAAE,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;;4BAC/C,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBAChC,CAAC;gBACH,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,KAAK,CAAC,KAAK,GAAG,QAAQ,CAAC;gBACvB,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBAC5B,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,OAAO,WAAW,CAAC,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,EAAE,KAAK,SAAS,CAAC;AAC3F,CAAC;AAED,SAAS,UAAU,CAAC,YAA0C;IAC5D,IAAI,OAAgB,CAAC;IACrB,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,WAAW,CAAC,QAAQ,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,KAAK,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC;AAC3C,CAAC"}

package/dist/state/launch-publication.d.ts

@@ -0,0 +1,7 @@
+export declare class LaunchPublication {
+    private readonly files;
+    write(path: string, text: string): void;
+    clear(): void;
+    rollback(): void;
+}
+//# sourceMappingURL=launch-publication.d.ts.map

package/dist/state/launch-publication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch-publication.d.ts","sourceRoot":"","sources":["../../src/state/launch-publication.ts"],"names":[],"mappings":"AAUA,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoC;IAE1D,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAYvC,KAAK,IAAI,IAAI;IAIb,QAAQ,IAAI,IAAI;CAoBjB"}

package/dist/state/launch-publication.js

@@ -0,0 +1,53 @@
+/** Restore only unchanged files published by one failed launch (PRD §8.1, C-API-20). */
+import { rmSync } from "node:fs";
+import { dirname } from "node:path";
+import { elwoodError } from "../core/errors.js";
+import { assertStatePath } from "./directories.js";
+import { fsyncDir, writePrivateFileAtomic } from "./files.js";
+import { currentFileOwner, readPrivateFile } from "./private-read.js";
+export class LaunchPublication {
+    files = new Map();
+    write(path, text) {
+        const current = read(path);
+        const entry = this.files.get(path) ?? { before: current, written: [current] };
+        // Preserve a predecessor's intervening record update across our next write.
+        if (!entry.written.includes(current))
+            entry.before = current;
+        // A failed write can leave either version: rename precedes directory fsync.
+        entry.written = [current, text];
+        this.files.set(path, entry);
+        writePrivateFileAtomic(path, text);
+        entry.written = [text];
+    }
+    clear() {
+        this.files.clear();
+    }
+    rollback() {
+        let failed = false;
+        for (const [path, entry] of this.files) {
+            try {
+                if (entry.written.includes(read(path))) {
+                    // A restoration can itself fail after rename/unlink but before directory fsync.
+                    entry.written = [...new Set([...entry.written, entry.before])];
+                    if (entry.before === undefined) {
+                        rmSync(path, { force: true });
+                        fsyncDir(dirname(path));
+                    }
+                    else
+                        writePrivateFileAtomic(path, entry.before);
+                }
+                this.files.delete(path);
+            }
+            catch {
+                failed = true;
+            }
+        }
+        if (failed)
+            throw elwoodError("state_corrupt", "Could not restore state after failed session startup.");
+    }
+}
+function read(path) {
+    assertStatePath(path);
+    return readPrivateFile(path, currentFileOwner(), () => elwoodError("state_corrupt", "Launch state is not a valid private file."));
+}
+//# sourceMappingURL=launch-publication.js.map

package/dist/state/launch-publication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch-publication.js","sourceRoot":"","sources":["../../src/state/launch-publication.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAItE,MAAM,OAAO,iBAAiB;IACX,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE1D,KAAK,CAAC,IAAY,EAAE,IAAY;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,4EAA4E;QAC5E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC;QAC7D,4EAA4E;QAC5E,KAAK,CAAC,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5B,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnC,KAAK,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,QAAQ;QACN,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBACvC,gFAAgF;oBAChF,KAAK,CAAC,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;wBAC/B,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;wBAC9B,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC1B,CAAC;;wBAAM,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACpD,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;QACD,IAAI,MAAM;YACR,MAAM,WAAW,CAAC,eAAe,EAAE,uDAAuD,CAAC,CAAC;IAChG,CAAC;CACF;AAED,SAAS,IAAI,CAAC,IAAY;IACxB,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,eAAe,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,GAAG,EAAE,CACpD,WAAW,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAC1E,CAAC;AACJ,CAAC"}

package/dist/state/private-read.js

@@ -29,7 +29,8 @@ export function readPrivateFile(path, owner, corrupt) {
 function inspect(path, owner) {
     let fd;
     try {
-        fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+        // O_NONBLOCK: opening a FIFO read-only would otherwise block until a writer appears.
+        fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
         const fault = privacyFault(fstatSync(fd), owner);
         return fault === undefined ? { text: readFileSync(fd, "utf8") } : { fault };
     }