@yijiancaotang/cli 0.0.0-stage → 1.1.0

package/dist/knowledge-growth.js

@@ -0,0 +1,85 @@
+import { knowledgeGrowthMetadata } from "./generated/knowledge-growth.js";
+const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+// Presentation only: the API remains the source of enums and read projections.
+// No recursive status search, fallback enum, request, or permission expansion.
+function readable(row, parent, event = false) {
+    for (const scope of [parent, row]) {
+        const value = scope.missing_sections;
+        if (value === undefined)
+            continue;
+        if (!Array.isArray(value))
+            return false;
+        for (const item of value) {
+            const missing = record(item);
+            if (!missing)
+                return false;
+            const capability = missing.required_capability ?? missing.capability;
+            if (capability === "read_knowledge")
+                return false;
+            // Daily items are already visibility-filtered; an aggregate draft gap
+            // describes excluded records, not the readable event returned here.
+            if (capability === "read_drafts" && row.publication_status !== "published" && !(event && scope === parent))
+                return false;
+        }
+    }
+    return true;
+}
+function card(value, parent) {
+    const row = record(value);
+    if (!row || typeof row.id !== "string" || !row.id || !readable(row, parent))
+        return value;
+    const growth = knowledgeGrowthMetadata(row.internalization_status);
+    return growth ? { ...row, growth } : value;
+}
+function field(body, key, list = false) {
+    const value = body[key];
+    const mapped = list && Array.isArray(value) ? value.map(row => card(row, body)) : list ? value : card(value, body);
+    return mapped === value || Array.isArray(value) && Array.isArray(mapped) && value.every((row, i) => row === mapped[i])
+        ? body : { ...body, [key]: mapped };
+}
+export function withKnowledgeGrowth(path, value, status) {
+    const body = record(value);
+    if (!body || ![200, 201].includes(status))
+        return value;
+    const route = path.split("?")[0].replace(/^\/api\/v1\/agent/, "");
+    if (route === "/m1/knowledge")
+        return field(body, "items", true);
+    if (/^\/m1\/knowledge\/[^/]+$/.test(route))
+        return field(body, "card");
+    if (/^\/m1\/projects\/[^/]+$/.test(route))
+        return field(body, "knowledge", true);
+    if (route === "/m1/workbench")
+        return field(body, "recent_knowledge", true);
+    if (route === "/m1/activity/daily" && Array.isArray(body.items)) {
+        let changed = false;
+        const items = body.items.map(value => {
+            const row = record(value);
+            if (!row || row.kind !== "knowledge_growth" || typeof row.id !== "string" || !row.id
+                || typeof row.knowledge_card_id !== "string" || !row.knowledge_card_id || !readable(row, body, true))
+                return value;
+            const from = knowledgeGrowthMetadata(row.from_status), to = knowledgeGrowthMetadata(row.to_status);
+            if (!from || !to)
+                return value;
+            changed = true;
+            return { ...row, from_growth: from, to_growth: to };
+        });
+        return changed ? { ...body, items } : value;
+    }
+    if (/^\/m2\/knowledge-cards(?:\/[^/]+(?:\/project-link(?:\/[^/]+)?)?)?$/.test(route)
+        || /^\/m2\/knowledge-cards\/[^/]+\/stage$/.test(route)) {
+        if (body.original_receipt === true || body.write_status !== undefined && body.write_status !== "succeeded"
+            || body.moderation_pending === true || body.write_pending === true || body.moderation_status === "pending_review"
+            || ["failed", "rejected", "unknown", "drafted"].includes(String(body.action_status))
+            || ["failed", "rejected", "unknown", "drafted"].includes(String(record(body.action_log)?.action_status)))
+            return value;
+        if (route.endsWith("/stage")) {
+            const detail = record(body.knowledge);
+            if (!detail || !readable(detail, body))
+                return value;
+            const knowledge = field(detail, "card");
+            return knowledge === detail ? value : { ...body, knowledge };
+        }
+        return field(body, "knowledge_card");
+    }
+    return value;
+}

package/dist/local-commands.js

@@ -0,0 +1,229 @@
+import { shellWord } from "./agent-identity.js";
+import { constants } from "node:fs";
+import { open } from "node:fs/promises";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { authLogin } from "./auth.js";
+import { doctor } from "./doctor.js";
+import { CliError, asRecord } from "./errors.js";
+import { inspectLocalInstallation, inspectManagedOrigins, installLocal } from "./installation.js";
+import { isPlatformId, platformSupported } from "./local-types.js";
+import { detectPlatforms, knownSkillTargets } from "./platforms.js";
+import { loadSkillAssets } from "./skill-assets.js";
+import { LocalRecords } from "./local-records.js";
+import { defaultConnectionNames, inspectAccountState, onboardingMessage } from "./onboarding.js";
+import { connectionCopy, setupFailureMessage } from "./connection-copy.js";
+const root = () => fileURLToPath(new URL("../", import.meta.url));
+const invalid = () => new CliError("invalid_arguments", "命令或参数无效。", "运行 --help；平台支持claude-code、codex、openclaw，以及仅macOS支持的kimi-code、kimi-work和workbuddy。");
+export function selectedPlatforms(value, operatingSystem = process.platform) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string")
+        throw invalid();
+    const values = value.split(",").map(item => item.trim());
+    if (!values.length || new Set(values).size !== values.length || values.some(item => !isPlatformId(item)))
+        throw invalid();
+    if (values.some(id => !platformSupported(id, operatingSystem)))
+        throw new CliError("platform_unsupported", "所选新增平台尚不支持当前系统。", "kimi-code、kimi-work和workbuddy仅支持macOS本机安装；不要套用或猜测其它系统的技能目录。");
+    return values;
+}
+export async function localVersion(packageRoot = root()) {
+    const failed = () => new CliError("version_unavailable", "无法核对当前命令行版本。", "请使用完整的一间草堂命令行构建；不要运行不明升级脚本。", 7);
+    try {
+        const file = await open(join(packageRoot, "package.json"), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const info = await file.stat();
+            if (!info.isFile() || info.nlink !== 1 || info.size < 1 || info.size > 32768)
+                throw failed();
+            const bytes = Buffer.alloc(32769), { bytesRead } = await file.read(bytes, 0, bytes.length, 0);
+            if (bytesRead !== info.size || bytesRead > 32768)
+                throw failed();
+            const data = asRecord(JSON.parse(bytes.subarray(0, bytesRead).toString("utf8")));
+            if (data?.name !== "@yijiancaotang/cli" || (data.private !== true && asRecord(data.publishConfig)?.access !== "public") || typeof data.version !== "string" || !/^\d+\.\d+\.\d+(?:-[a-z0-9.-]+)?$/i.test(data.version))
+                throw failed();
+            return { status: 200, body: { brand: "一间草堂", name: data.name, version: data.version, node_version: process.versions.node, release_status: "released", update_policy: "manual" } };
+        }
+        finally {
+            await file.close();
+        }
+    }
+    catch {
+        throw failed();
+    }
+}
+export function manualUpdateInstructions() {
+    return { status: 200, body: { operation: "update", update_policy: "manual", next_action: "运行 npx @yijiancaotang/cli@latest setup --agent <你的名字> 更新到最新版。" } };
+}
+function connectionTimeInBeijing(value) {
+    if (!value)
+        return undefined;
+    const timestamp = Date.parse(value);
+    if (!Number.isFinite(timestamp))
+        return undefined;
+    const parts = new Intl.DateTimeFormat("en-GB", {
+        timeZone: "Asia/Shanghai", year: "numeric", month: "2-digit", day: "2-digit",
+        hour: "2-digit", minute: "2-digit", hourCycle: "h23",
+    }).formatToParts(timestamp);
+    const fields = Object.fromEntries(parts.map(part => [part.type, part.value]));
+    return `${fields.year}-${fields.month}-${fields.day} ${fields.hour}:${fields.minute}`;
+}
+const recordsFor = (ctx) => ctx.agent ? new LocalRecords(ctx.homeDir, ctx.agent, ctx.auth.environment ?? "production", new URL(ctx.auth.api.baseUrl).origin) : undefined;
+async function targetsFor(ctx, ids, setup, assets, recorded) {
+    const inspect = (targets) => inspectManagedOrigins({ ...ctx, agentName: ctx.agent?.key, assets, targets });
+    if (ctx.agent) {
+        if (ids && ids.length !== 1)
+            throw new CliError("invalid_arguments", "每次接入只给一个 AI 平台安装技能。", "请带自己的 --agent 名字，一次只选一个 --platform；其它 AI 分别接入。");
+        if (ids === undefined && recorded.length === 0) {
+            const candidates = await knownSkillTargets({ ...ctx, skipInvalidCandidates: true }), origins = await inspect(candidates);
+            const own = candidates.filter(target => origins.platforms.some(platform => platform.id === target.id && platform.skill_directory === target.skillDirectory && platform.ownKnownCount > 0))
+                .map(target => ({ ...target, detected: true, evidence: "skills" }));
+            if (own.length > 0 || !ctx.agent.platform)
+                return { targets: own, origins };
+        }
+        ids = ids ?? (recorded.length ? recorded.map(target => target.id) : ctx.agent.platform ? [ctx.agent.platform] : []);
+    }
+    const redirected = (id) => id === "claude-code" ? ctx.env.CLAUDE_CONFIG_DIR !== undefined
+        : id === "openclaw" ? ctx.env.OPENCLAW_STATE_DIR !== undefined || ctx.env.OPENCLAW_HOME !== undefined
+            : id === "kimi-code" && ctx.env.KIMI_CODE_HOME !== undefined;
+    const preferred = recorded.filter(target => (!ids || ids.includes(target.id)) && !redirected(target.id));
+    if (preferred.some(target => !platformSupported(target.id, ctx.operatingSystem)))
+        throw new CliError("platform_unsupported", "已记录的技能平台不支持当前系统。", "请在原支持的系统上检查该平台；不会猜测新目录或搬动技能。", 2);
+    const discoveryIds = ids?.filter(id => !preferred.some(target => target.id === id));
+    // A recorded custom target must not cause inspection of an unrelated default
+    // directory just to rediscover the same platform.
+    const discovered = discoveryIds?.length === 0 ? [] : await detectPlatforms({ homeDir: ctx.homeDir, env: ctx.env, applicationRoots: ctx.applicationRoots, operatingSystem: ctx.operatingSystem, platformIds: discoveryIds });
+    const all = [...preferred.map(target => ({ ...target })), ...discovered];
+    const origins = await inspect(all);
+    for (const target of all) {
+        if (ctx.agent && !target.detected && origins.platforms.some(platform => platform.id === target.id && platform.skill_directory === target.skillDirectory && platform.ownKnownCount > 0)) {
+            target.detected = true;
+            target.evidence = "skills";
+        }
+    }
+    return { targets: ids ? all.filter(target => ids.includes(target.id)) : setup ? all.filter(target => target.detected) : all, origins };
+}
+export async function localDoctor(ctx, flags, authFailure) {
+    return doctor({
+        auth: ctx.auth, authFailure, agent: ctx.agent,
+        inspectLocal: async () => {
+            const assets = await loadSkillAssets(ctx.packageRoot ?? root());
+            const recorded = await recordsFor(ctx)?.targets() ?? [];
+            const selection = await targetsFor(ctx, selectedPlatforms(flags.platform, ctx.operatingSystem), false, assets, recorded);
+            const inspected = await inspectLocalInstallation({ ...ctx, agentName: ctx.agent?.key, assets, targets: selection.targets });
+            const platforms = inspected.platforms.map(platform => {
+                const origin = selection.origins.platforms.find(origin => origin.id === platform.id && origin.skill_directory === platform.skill_directory);
+                return origin ? { ...platform, skills: origin.skills } : platform;
+            });
+            const issues = inspected.issues.filter(issue => !["skill_missing", "skill_modified", "skill_unsafe"].includes(issue.code));
+            let command = inspected.command;
+            if (selection.origins.command.legacyManaged) {
+                command = { ...command, installed: true, ...selection.origins.command };
+                for (let index = issues.length - 1; index >= 0; index--)
+                    if (issues[index].code === "command_modified")
+                        issues.splice(index, 1);
+                issues.push({ code: "command_outdated", message: "已核对为旧版受管命令行，需要更新。", next_action: "沿用原来的名字运行 npx @yijiancaotang/cli@latest setup --agent <你的名字> 更新，不需要重新批准连接。" });
+            }
+            const skillPlatforms = selection.targets.filter(target => recorded.some(record => record.id === target.id)
+                || selection.origins.platforms.some(origin => origin.id === target.id && origin.skill_directory === target.skillDirectory && origin.ownKnownCount > 0)).map(target => target.id);
+            return { ...inspected, command, platforms, issues, skill_platforms: skillPlatforms };
+        },
+    });
+}
+export async function localSetup(ctx, flags) {
+    const records = recordsFor(ctx), recorded = await records?.targets() ?? [];
+    const assets = await loadSkillAssets(ctx.packageRoot ?? root()), { targets } = await targetsFor(ctx, selectedPlatforms(flags.platform, ctx.operatingSystem), true, assets, recorded);
+    const local = { ...ctx, agentName: ctx.agent?.key, assets, targets };
+    const installed = await installLocal(local);
+    await records?.rememberInstallation(targets, assets, installed.bundleSha);
+    for (const target of targets) {
+        if (!target.detected) {
+            target.detected = true;
+            target.evidence = "skills";
+        }
+    }
+    const newEntries = installed.newlyInstalledPlatforms;
+    let authFailure;
+    let authorizationAttempted = false;
+    const currentSecrets = new Set(ctx.auth.tokenOverride ? [ctx.auth.tokenOverride] : []);
+    // Observe the actual start request after authLogin's credential/abort checks.
+    // Validation and doctor requests do not constitute a new authorization attempt.
+    const observedAuth = {
+        ...ctx.auth,
+        api: {
+            baseUrl: ctx.auth.api.baseUrl,
+            request(path, options) {
+                if (path === "/api/v1/agent/device-auth/start" && options?.method === "POST")
+                    authorizationAttempted = true;
+                if (path === "/api/v1/agent/mcp-token/validate" && typeof options?.token === "string")
+                    currentSecrets.add(options.token);
+                return ctx.auth.api.request(path, options);
+            },
+            upload: (url, headers, bytes) => ctx.auth.api.upload(url, headers, bytes),
+            outputSecrets: () => ctx.auth.api.outputSecrets?.() ?? [],
+        },
+    };
+    let newAuthorizationOwner;
+    let loginIdentity;
+    let loginResult = null;
+    const names = defaultConnectionNames(targets.map(target => target.id), ctx.computerName, ctx.agent?.name);
+    try {
+        const login = await authLogin(observedAuth, { device_name: flags["device-name"] ?? names.deviceName, client_name: flags["client-name"] ?? names.clientName, noOpen: flags["no-open"] === true });
+        const who = asRecord(login.body);
+        loginResult = who;
+        if (typeof who?.user_id === "string" && typeof who.token_id === "string" && (who.kind === "manual" || who.kind === "device") && (who.scope === "read_only" || who.scope === "read_write")) {
+            loginIdentity = { userId: who.user_id, tokenId: who.token_id, kind: who.kind, scope: who.scope };
+        }
+        if (who?.new_authorization_confirmed === true && typeof who.user_id === "string")
+            newAuthorizationOwner = who.user_id;
+    }
+    catch (error) {
+        authFailure = error instanceof CliError ? error : new CliError("authorization_delivery_unknown", "无法确认授权操作的结果。", "先在网页核对并吊销未保存的设备，不要自动重新签发。", 6);
+    }
+    let checkedIdentity;
+    const report = await doctor({ auth: ctx.auth, authFailure, agent: ctx.agent, inspectLocal: async () => ({ ...await inspectLocalInstallation(local), skill_platforms: targets.map(target => target.id) }), onIdentity: who => { checkedIdentity = who; } });
+    const body = asRecord(report.result.body);
+    if (!body)
+        throw new CliError("diagnostic_unavailable", "本地安装已执行，但无法确认最终诊断。", "先运行doctor只读核对，不要直接重新授权。", 7);
+    const sameConnection = loginIdentity && checkedIdentity && ["userId", "tokenId", "kind", "scope"].every(key => loginIdentity[key] === checkedIdentity[key]);
+    const identityChanged = body.ready === true && !sameConnection;
+    if (identityChanged) {
+        const issue = { code: "authorization_identity_changed", message: "接入前后的连接核对不一致，尚不能确认接好。", next_action: "请先在网页 Agent 管理和本机 auth status 核对连接；不自动切换账号、重新授权或写入。" };
+        body.ready = false;
+        body.auth = { status: "unknown" };
+        body.issues = [...(Array.isArray(body.issues) ? body.issues : []), issue];
+        body.next_actions = [...(Array.isArray(body.next_actions) ? body.next_actions : []), issue.next_action];
+        report.exitCode = 6;
+    }
+    const confirmed = authorizationAttempted && newAuthorizationOwner !== undefined && report.exitCode === 0 && body.ready === true;
+    const accountState = newEntries.length && body.ready === true && checkedIdentity ? await inspectAccountState(ctx.auth, checkedIdentity.userId) : "unknown";
+    const greeting = body.ready === true && checkedIdentity ? onboardingMessage(newEntries, accountState, checkedIdentity.scope)
+        : { account_state: "unknown", onboarding: { action: "none", newly_connected_platforms: [] }, user_message: setupFailureMessage(identityChanged ? "authorization_identity_changed" : authFailure?.code) };
+    const reused = Boolean(sameConnection && loginResult?.reused_existing === true);
+    let connection;
+    if (sameConnection && ctx.agent && checkedIdentity) {
+        if (reused) {
+            connection = ctx.auth.tokenOverride !== undefined ? { connection_name: ctx.agent.key, connection_name_source: "environment_override" }
+                : await records?.connection(checkedIdentity.tokenId, [...currentSecrets]) ?? { connection_name: ctx.agent.key, connection_name_source: "local_agent_key" };
+        }
+        else if (body.ready === true && loginResult?.new_authorization_confirmed === true && typeof loginResult.connection_name === "string" && typeof loginResult.connected_at === "string") {
+            connection = { connection_name: loginResult.connection_name, connection_name_source: "local_authorization_record", connected_at: loginResult.connected_at, connection_time_source: "device_authorization" };
+            await records?.rememberConnection(checkedIdentity.tokenId, connection, [...currentSecrets]);
+        }
+    }
+    const onboardingCopy = reused && checkedIdentity && (connection?.connection_name_source !== "environment_override"
+        ? greeting.onboarding.action !== "none" || checkedIdentity.scope === "read_only"
+        : greeting.onboarding.action === "none" && checkedIdentity.scope === "read_only")
+        ? { onboarding_message: greeting.onboarding.action !== "none" ? greeting.user_message : connectionCopy.read_only } : {};
+    const connectionDisplayTime = connectionTimeInBeijing(connection?.connected_at);
+    const reuseCopy = reused && connection && connection.connection_name_source !== "environment_override" ? {
+        user_message: "这个名字已经接过了，沿用原来的连接，不用再批准。",
+        next_action: `已沿用名为 ${connection.connection_name} 的连接${connectionDisplayTime ? `（${connectionDisplayTime} 接入）` : ""}。如果你不是它，请用你自己的名字重新运行 setup --agent <你的名字>，不要继续用这条连接。`,
+        ...(connection.connection_name_source === "local_agent_key" ? { connection_name_note: "本机仅记有规范化名字，原连接名称和接入时间未记录。" } : {}),
+    } : reused && connection?.connection_name_source === "environment_override" ? {
+        reuse_notice: "本次沿用环境中提供的授权，不是本机保存的同名连接。若要独立接入，请由本人先处理环境授权覆盖，再用自己的名字运行 setup --agent <你的名字>。",
+    } : {};
+    return { exitCode: report.exitCode, result: { status: 200, body: { ...body, operation: "setup", local_installation: { changed: installed.changed, bundle_sha: installed.bundleSha }, authorization_attempted: authorizationAttempted,
+                new_authorization_confirmed: confirmed, ...(confirmed ? { new_authorization_owner_id: newAuthorizationOwner } : {}), reused_existing: reused, ...connection, ...greeting, ...onboardingCopy, ...reuseCopy,
+                ...(ctx.agent && !targets.length ? { generic_usage: { message: "暂未定位到这个名字的专用技能；若曾使用自定义目录，请保留原目录参数再检查。仍可按下列命令使用自己的连接。", commands: ["doctor", "context --start", "projects", "knowledge", "search", "auth status"].map(command => `caotang --agent ${shellWord(ctx.agent.name)} ${command}`) } } : {}),
+                ...(body.ready === true ? { next_conversation: "请开新对话说‘开工了’。" } : {}) } } };
+}

package/dist/local-lock.js

@@ -0,0 +1,245 @@
+import { constants, openSync, closeSync, lstatSync, fstatSync, readSync, writeSync, fsyncSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { basename, dirname } from "node:path";
+import { asRecord } from "./errors.js";
+const same = (a, b) => a.dev === b.dev && a.ino === b.ino;
+const chunkSize = 65536;
+const recordLimit = 256;
+export function deletionDenied(error) {
+    return ["EPERM", "EACCES", "EROFS"].includes(String(asRecord(error)?.code))
+        || (error instanceof Error && error.message.includes("[safe-delete] broker denied delete"));
+}
+function dead(pid) {
+    try {
+        process.kill(pid, 0);
+        return false;
+    }
+    catch (error) {
+        return asRecord(error)?.code === "ESRCH";
+    }
+}
+// Local regular files only: a single O_APPEND write orders each ticket. The first
+// unreleased live/unknown ticket owns the lock. Never replace or truncate this
+// inode: delayed contenders must see the same history, even after a crash.
+// File count is constant; journal bytes grow with use. Do not mix with the old
+// rename/compaction protocol or put this journal on a network filesystem.
+export function acquireLocalLock(path, parent, failures) {
+    const { busy, unsafe } = failures, name = basename(path);
+    const ticket = { op: "acquire", pid: process.pid, id: randomUUID() };
+    let fd = -1, identity, appended = false;
+    const check = (info) => {
+        if (!info.isFile() || typeof process.getuid !== "function" || info.uid !== process.getuid()
+            || (info.nlink !== 1 && info.nlink !== 0) || (info.mode & 0o7777) !== 0o600
+            || !Number.isSafeInteger(info.size) || info.size < 0)
+            throw unsafe();
+        if (info.nlink === 0)
+            throw busy();
+    };
+    const pinned = (action) => {
+        const original = process.cwd();
+        try {
+            process.chdir(parent.path);
+            const info = lstatSync(".");
+            if (dirname(path) !== parent.path || !info.isDirectory() || !same(info, parent.identity)
+                || info.uid !== parent.identity.uid || (info.mode & 0o7777) !== 0o700)
+                throw unsafe();
+            return action();
+        }
+        finally {
+            process.chdir(original);
+        }
+    };
+    const current = () => {
+        const opened = fstatSync(fd);
+        check(opened);
+        let named;
+        try {
+            named = lstatSync(name);
+        }
+        catch (error) {
+            if (asRecord(error)?.code === "ENOENT")
+                throw busy();
+            throw error;
+        }
+        check(named);
+        if (!same(opened, identity) || !same(named, identity))
+            throw busy();
+    };
+    const decode = (line) => {
+        if (!line.length || Buffer.byteLength(line) > recordLimit)
+            throw busy();
+        let entry;
+        try {
+            entry = JSON.parse(line);
+        }
+        catch {
+            throw busy();
+        }
+        if (!entry || Object.keys(entry).sort().join(",") !== "id,op,pid"
+            || !["acquire", "release"].includes(entry.op) || !Number.isSafeInteger(entry.pid)
+            || entry.pid <= 0 || entry.pid > 2147483647 || typeof entry.id !== "string"
+            || !/^[a-f0-9-]{36}$/.test(entry.id))
+            throw busy();
+        return entry;
+    };
+    const legacyMarkers = () => {
+        for (const legacy of [...Array.from({ length: 16 }, (_, index) => `${name}.admission-${index}`), `${name}.admission-released`, `${name}.next`]) {
+            let before;
+            try {
+                before = lstatSync(legacy);
+            }
+            catch (error) {
+                if (asRecord(error)?.code === "ENOENT")
+                    continue;
+                throw error;
+            }
+            check(before);
+            if (before.size > recordLimit)
+                throw unsafe();
+            const reader = openSync(legacy, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+            try {
+                const opened = fstatSync(reader);
+                check(opened);
+                if (opened.size > recordLimit)
+                    throw unsafe();
+                if (!same(opened, before))
+                    throw busy();
+                const bytes = Buffer.alloc(recordLimit + 1);
+                let count = 0;
+                while (count < bytes.length) {
+                    const read = readSync(reader, bytes, count, bytes.length - count, count);
+                    if (!read)
+                        break;
+                    count += read;
+                }
+                const after = fstatSync(reader);
+                check(after);
+                let named;
+                try {
+                    named = lstatSync(legacy);
+                }
+                catch (error) {
+                    if (asRecord(error)?.code === "ENOENT")
+                        throw busy();
+                    throw error;
+                }
+                check(named);
+                if (count > recordLimit || after.size > recordLimit || named.size > recordLimit)
+                    throw unsafe();
+                if (!same(after, opened) || !same(after, named) || before.size !== after.size
+                    || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs || count !== after.size)
+                    throw busy();
+                if (!count || bytes[count - 1] !== 10)
+                    throw busy();
+                const entry = decode(bytes.subarray(0, count - 1).toString("utf8"));
+                if (entry.op !== "release" && !dead(entry.pid))
+                    throw busy();
+            }
+            finally {
+                closeSync(reader);
+            }
+        }
+    };
+    const pending = () => {
+        current();
+        const before = fstatSync(fd), buffer = Buffer.alloc(chunkSize);
+        const active = new Map(), seen = new Set();
+        let offset = 0, remainder = "";
+        while (offset < before.size) {
+            const count = readSync(fd, buffer, 0, Math.min(buffer.length, before.size - offset), offset);
+            if (!count)
+                throw busy();
+            offset += count;
+            const lines = (remainder + buffer.subarray(0, count).toString("utf8")).split("\n");
+            remainder = lines.pop();
+            if (Buffer.byteLength(remainder) > recordLimit)
+                throw busy();
+            for (const line of lines) {
+                const entry = decode(line);
+                if (entry.op === "acquire") {
+                    if (seen.has(entry.id))
+                        throw busy();
+                    seen.add(entry.id);
+                    active.set(entry.id, entry);
+                }
+                else {
+                    if (active.get(entry.id)?.pid !== entry.pid)
+                        throw busy();
+                    active.delete(entry.id);
+                }
+            }
+        }
+        current();
+        const after = fstatSync(fd);
+        if (remainder || after.size < before.size
+            || (after.size === before.size && (after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs)))
+            throw busy();
+        return [...active.values()].filter(entry => !dead(entry.pid));
+    };
+    const append = (entry) => {
+        current();
+        const bytes = Buffer.from(JSON.stringify(entry) + "\n");
+        if (bytes.length > recordLimit || writeSync(fd, bytes) !== bytes.length)
+            throw busy();
+        fsyncSync(fd);
+        current();
+    };
+    try {
+        pinned(() => {
+            let created = false;
+            try {
+                fd = openSync(name, constants.O_RDWR | constants.O_CREAT | constants.O_EXCL | constants.O_APPEND | constants.O_NOFOLLOW, 0o600);
+                created = true;
+            }
+            catch (error) {
+                if (asRecord(error)?.code !== "EEXIST")
+                    throw error;
+                const before = lstatSync(name);
+                if (before.isDirectory())
+                    throw busy();
+                check(before);
+                fd = openSync(name, constants.O_RDWR | constants.O_APPEND | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+                check(fstatSync(fd));
+                if (!same(before, fstatSync(fd)))
+                    throw busy();
+            }
+            identity = fstatSync(fd);
+            current();
+            legacyMarkers();
+            if (created ? identity.size !== 0 : pending().length > 0)
+                throw busy();
+            append(ticket);
+            appended = true;
+            if (pending()[0]?.id !== ticket.id)
+                throw busy();
+            current();
+        });
+    }
+    catch (error) {
+        if (appended) {
+            try {
+                pinned(() => append({ ...ticket, op: "release" }));
+            }
+            catch { /* Keep uncertain ownership closed. */ }
+        }
+        if (fd !== -1)
+            closeSync(fd);
+        throw error;
+    }
+    let released = false;
+    return () => {
+        if (released)
+            throw busy();
+        released = true;
+        try {
+            pinned(() => {
+                if (pending()[0]?.id !== ticket.id)
+                    throw busy();
+                append({ ...ticket, op: "release" });
+            });
+        }
+        finally {
+            closeSync(fd);
+        }
+    };
+}