agent-hitch 0.1.1 → 0.2.1

package/dist/src/controller-runtime/store.js

@@ -0,0 +1,318 @@
+/**
+ * Controller runtime store: staging, promotion, cache lookup, and verified
+ * use of shared read-only controller runtime bundles (spec §4).
+ *
+ * New eval directories do not contain a complete Hitch runtime; they hold a
+ * durable `runtime.ref.json` reference. The shared bundle lives under
+ * `<hitch-root>/store/controller-runtimes/sha256/<64-hex>/`.
+ */
+import { randomBytes } from "node:crypto";
+import { createHash } from "node:crypto";
+import { cp, mkdir, readFile, readdir, rename, rm, stat, chmod, open } from "node:fs/promises";
+import path from "node:path";
+import { HitchError, SCHEMA_VERSION, atomicWriteJSON, delay, ensureDir, packageRoot, readJSON, reclaimStaleLock, removeIfExists, statePaths } from "../foundation/index.js";
+import { ControllerRuntimeIntegrityError, RUNTIME_PAYLOAD_RULES, canonicalEncodeManifest, hashRuntimePayload, verifyRuntimePayload, } from "./hash.js";
+import { validateControllerRuntimeManifest } from "../domain/index.js";
+/** The Hitch package root whose compiled payload is packaged as a controller runtime. */
+export const PACKAGE_ROOT = packageRoot();
+/**
+ * Ensure the shared controller runtime bundle for the current Hitch payload
+ * exists and is verified; returns its cache path and identity.
+ */
+export async function ensureControllerRuntime({ root, payloadRoot = PACKAGE_ROOT, rules = RUNTIME_PAYLOAD_RULES }) {
+    if (!root)
+        throw new HitchError("a Hitch state root is required for the controller runtime", { code: "invalid_input", exitCode: 2 });
+    const paths = statePaths(root);
+    // Stage inside the state root's tmp/ directory so promotion is a same-
+    // filesystem atomic rename (spec §4.2 `tmp/runtime-staging-*`, §4.5).
+    const stagingBase = path.join(paths.temporary, "controller-runtime");
+    // Stage a fresh copy, hash it, and promote under a runtime-id lock.
+    const staging = await stagePayload(payloadRoot, rules, stagingBase);
+    try {
+        return await withRuntimeLock(paths, staging.runtimeId, async () => {
+            return promoteStagedRuntime(paths, staging);
+        });
+    }
+    finally {
+        await rm(staging.directory, { recursive: true, force: true }).catch(() => { });
+    }
+}
+async function stagePayload(payloadRoot, rules, stagingBase) {
+    const payloadRootReal = path.resolve(payloadRoot);
+    const hashResult = await hashRuntimePayload({ payloadRoot: payloadRootReal, rules });
+    const runtimeId = hashResult.runtimeId.replace("sha256:", "");
+    await ensureDir(stagingBase);
+    const staging = path.join(stagingBase, `runtime-staging-${runtimeId.slice(0, 12)}-${randomBytes(6).toString("hex")}`);
+    await mkdir(staging, { recursive: true });
+    // Copy the allowlisted payload into staging. Never hardlink from the
+    // development or installed package tree (spec §4.5).
+    const payloadDestination = path.join(staging, "payload");
+    await mkdir(payloadDestination, { recursive: true });
+    await copyPayload(payloadRootReal, payloadDestination, rules);
+    // Hash the staged payload and write its manifest; the complete tree is
+    // verified a second time during promotion.
+    const stagedHash = await hashRuntimePayload({ payloadRoot: payloadDestination, rules });
+    if (stagedHash.runtimeId !== hashResult.runtimeId) {
+        throw new ControllerRuntimeIntegrityError("staged runtime payload hash changed during staging");
+    }
+    await atomicWriteJSON(path.join(staging, "manifest.json"), stagedHash.manifest);
+    return { directory: staging, runtimeId };
+}
+async function copyPayload(sourceRoot, destinationRoot, rules) {
+    for (const rule of rules) {
+        const relative = rule.path || rule.directory || "";
+        const source = path.join(sourceRoot, ...relative.split("/"));
+        const destination = path.join(destinationRoot, ...relative.split("/"));
+        await ensureDir(path.dirname(destination));
+        await cp(source, destination, { recursive: true, force: false, errorOnExist: true });
+    }
+}
+async function promoteStagedRuntime(paths, staging) {
+    await ensureDir(paths.controllerRuntimes);
+    const destination = path.join(paths.controllerRuntimes, staging.runtimeId);
+    // If a valid bundle already exists, discard staging and return the cache hit
+    // (spec §4.5). Check first so a same-filesystem rename is never attempted
+    // onto an existing directory (POSIX rejects it).
+    if (await pathExists(destination)) {
+        try {
+            return await useControllerRuntimeById(paths, staging.runtimeId);
+        }
+        catch (error) {
+            if (error?.code !== "controller_runtime_integrity_mismatch")
+                throw error;
+            // The destination is corrupt: quarantine it before promoting the fresh
+            // staged bundle with the same runtime id (spec §4.5). The replacement
+            // carries the exact same bytes, so the id is never relabeled.
+            await quarantineInvalidRuntime(paths, destination, staging.runtimeId);
+        }
+    }
+    let promoted = false;
+    try {
+        await rename(staging.directory, destination);
+        promoted = true;
+    }
+    catch (error) {
+        if (error?.code !== "ENOTEMPTY" && error?.code !== "EEXIST")
+            throw error;
+        // A concurrent first use promoted first; validate the existing bundle.
+    }
+    if (promoted) {
+        const manifest = await loadManifest(destination);
+        await applyReadOnlyPermissions(destination, manifest.entrypoints.cli.path);
+        // Verify the promoted tree a second time before it can be used.
+        await verifyRuntimePayload(path.join(destination, "payload"), manifest);
+        return {
+            runtime_id: `sha256:${staging.runtimeId}`,
+            directory: destination,
+            manifest,
+            cache_hit: false,
+            manifest_digest: manifestDigest(manifest),
+        };
+    }
+    return useControllerRuntimeById(paths, staging.runtimeId);
+}
+async function quarantineInvalidRuntime(paths, destination, runtimeId) {
+    const quarantine = path.join(paths.temporary, `invalid-runtime-${runtimeId}-${randomBytes(6).toString("hex")}`);
+    await ensureDir(path.dirname(quarantine));
+    await rm(quarantine, { recursive: true, force: true }).catch(() => { });
+    try {
+        // The promoted bundle tree is read-only (0555/0444); make the root
+        // writable so the rename into quarantine is permitted on all platforms.
+        await chmod(destination, 0o755).catch(() => { });
+        await rename(destination, quarantine);
+    }
+    catch (error) {
+        if (error?.code === "ENOENT")
+            return;
+        throw error;
+    }
+    // Do not remove the quarantine eagerly; keep the corrupt bytes for
+    // diagnostics. A future GC command may reclaim it.
+}
+async function pathExists(file) {
+    try {
+        await stat(file);
+        return true;
+    }
+    catch (error) {
+        if (error?.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+async function applyReadOnlyPermissions(directory, cliEntrypoint) {
+    if (process.platform === "win32")
+        return;
+    const stack = [directory];
+    while (stack.length > 0) {
+        const current = stack.pop();
+        const entries = await readdir(current, { withFileTypes: true });
+        for (const entry of entries) {
+            const absolute = path.join(current, entry.name);
+            if (entry.isDirectory()) {
+                stack.push(absolute);
+            }
+            else if (entry.isFile()) {
+                const payloadRelative = relativeToPayload(directory, absolute);
+                // Only the declared CLI entrypoint becomes executable (0555); sibling
+                // files such as .map sources stay read-only (0444) (spec §4.5).
+                const isEntrypoint = payloadRelative === cliEntrypoint;
+                await chmod(absolute, isEntrypoint ? 0o555 : 0o444);
+            }
+        }
+        await chmod(current, 0o555);
+    }
+}
+function relativeToPayload(directory, absolute) {
+    return path.relative(path.join(directory, "payload"), absolute);
+}
+async function withRuntimeLock(paths, runtimeId, operation) {
+    await ensureDir(paths.controllerRuntimeLocks);
+    const file = path.join(paths.controllerRuntimeLocks, `${runtimeId}.lock`);
+    const owner = randomBytes(12).toString("hex");
+    let handle;
+    for (let attempt = 0; attempt < 3_000; attempt += 1) {
+        try {
+            handle = await open(file, "wx", 0o600);
+            try {
+                await handle.writeFile(`${JSON.stringify({ owner, pid: process.pid, created_at: new Date().toISOString() })}\n`);
+            }
+            catch (error) {
+                await handle.close().catch(() => { });
+                handle = undefined;
+                await removeIfExists(file);
+                throw error;
+            }
+            break;
+        }
+        catch (error) {
+            if (error?.code !== "EEXIST")
+                throw error;
+            if (await staleRuntimeLock(file)) {
+                if (!await reclaimStaleLock(file, staleRuntimeLock))
+                    await delay(100);
+                continue;
+            }
+            await delay(100);
+        }
+    }
+    if (!handle) {
+        throw new HitchError("timed out waiting for controller runtime lock", {
+            code: "controller_runtime_locked",
+            exitCode: 5,
+        });
+    }
+    try {
+        return await operation();
+    }
+    finally {
+        await handle.close().catch(() => { });
+        const current = await readJSON(file, null).catch(() => null);
+        if (current?.owner === owner)
+            await removeIfExists(file);
+    }
+}
+async function staleRuntimeLock(file) {
+    let lock;
+    try {
+        lock = JSON.parse(await readFile(file, "utf8"));
+    }
+    catch {
+        try {
+            return Date.now() - (await stat(file)).mtimeMs > 2_000;
+        }
+        catch {
+            return true;
+        }
+    }
+    if (!Number.isInteger(lock?.pid))
+        return true;
+    try {
+        process.kill(lock.pid, 0);
+        return false;
+    }
+    catch (error) {
+        return error?.code === "ESRCH";
+    }
+}
+async function loadManifest(directory) {
+    const raw = await readJSON(path.join(directory, "manifest.json"), null);
+    if (raw === null) {
+        throw new ControllerRuntimeIntegrityError(`controller runtime bundle is missing its manifest: ${directory}`);
+    }
+    return validateControllerRuntimeManifest(raw);
+}
+function manifestDigest(manifest) {
+    const encoding = canonicalEncodeManifest({ entrypoints: manifest.entrypoints, files: manifest.files });
+    return `sha256:${createHash("sha256").update(encoding).digest("hex")}`;
+}
+/**
+ * Verify and return a controller runtime bundle by id. A missing or corrupt
+ * expected runtime must not silently fall back to the installed Hitch version
+ * (spec §4.6) — it fails with `controller_runtime_integrity_mismatch`.
+ *
+ * The canonical manifest digest must equal BOTH the manifest's declared
+ * `runtime_id` and the directory id, so a runtime id can never be rebound to a
+ * different payload: editing the payload and rewriting the manifest's digest
+ * field is rejected because the recomputed digest no longer matches the
+ * declared `runtime_id` (spec §4.4, §11.1).
+ */
+export async function useControllerRuntimeById(paths, runtimeId) {
+    const directory = path.join(paths.controllerRuntimes, runtimeId);
+    const manifest = await loadManifest(directory).catch(() => {
+        throw new HitchError(`controller runtime integrity mismatch for ${runtimeId}`, {
+            code: "controller_runtime_integrity_mismatch",
+            exitCode: 5,
+        });
+    });
+    const expectedId = `sha256:${runtimeId}`;
+    const recomputedDigest = manifestDigest(manifest);
+    if (manifest.runtime_id !== expectedId || recomputedDigest !== expectedId || recomputedDigest !== manifest.runtime_id) {
+        throw new HitchError(`controller runtime integrity mismatch for ${runtimeId}: manifest runtime_id ${manifest.runtime_id} does not match the recomputed identity ${recomputedDigest}`, { code: "controller_runtime_integrity_mismatch", exitCode: 5 });
+    }
+    try {
+        await verifyRuntimePayload(path.join(directory, "payload"), manifest);
+    }
+    catch (error) {
+        throw new HitchError(`controller runtime integrity mismatch for ${runtimeId}: ${error.message}`, {
+            code: "controller_runtime_integrity_mismatch",
+            exitCode: 5,
+            cause: error,
+        });
+    }
+    return {
+        runtime_id: `sha256:${runtimeId}`,
+        directory,
+        manifest,
+        cache_hit: true,
+        manifest_digest: manifestDigest(manifest),
+    };
+}
+export async function writeRuntimeReference(evalDirectory, use) {
+    const ref = {
+        schema_version: SCHEMA_VERSION,
+        storage: "controller-runtime-ref-v1",
+        runtime_id: use.runtime_id,
+        manifest_digest: use.manifest_digest,
+        created_at: new Date().toISOString(),
+    };
+    const file = path.join(evalDirectory, "runtime.ref.json");
+    await atomicWriteJSON(file, ref);
+    return file;
+}
+/** Detect which runtime storage kind an eval record uses (spec §4.7, §9). */
+export async function inspectEvalRuntimeKind(evalDirectory) {
+    const ref = await readJSON(path.join(evalDirectory, "runtime.ref.json"), null);
+    if (ref?.storage === "controller-runtime-ref-v1")
+        return "controller-runtime-ref-v1";
+    try {
+        const info = await stat(path.join(evalDirectory, "runtime"));
+        if (info.isDirectory())
+            return "embedded-runtime-v1";
+    }
+    catch {
+        // Not an embedded runtime.
+    }
+    return "none";
+}
+//# sourceMappingURL=store.js.map

package/dist/src/controller-runtime/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/controller-runtime/store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAE5K,OAAO,EACL,+BAA+B,EAC/B,qBAAqB,EACrB,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,iCAAiC,EAAE,MAAM,oBAAoB,CAAC;AAGvE,yFAAyF;AACzF,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,EAAE,CAAC;AAkB1C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,EAAE,IAAI,EAAE,WAAW,GAAG,YAAY,EAAE,KAAK,GAAG,qBAAqB,EAA4B;IAE7F,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,UAAU,CAAC,2DAA2D,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACrI,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,uEAAuE;IACvE,sEAAsE;IACtE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IACrE,oEAAoE;IACpE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,OAAO,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YAChE,OAAO,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAOD,KAAK,UAAU,YAAY,CAAC,WAAmB,EAAE,KAA2B,EAAE,WAAmB;IAC/F,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAE9D,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtH,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1C,qEAAqE;IACrE,qDAAqD;IACrD,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACzD,MAAM,KAAK,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,WAAW,CAAC,eAAe,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC;IAE9D,uEAAuE;IACvE,2CAA2C;IAC3C,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,IAAI,UAAU,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,+BAA+B,CAAC,oDAAoD,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAChF,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,UAAkB,EAAE,eAAuB,EAAE,KAA2B;IACjG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACvE,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3C,MAAM,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAAiB,EAAE,OAAsB;IAC3E,MAAM,SAAS,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,iDAAiD;IACjD,IAAI,MAAM,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,MAAM,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAAoB,EAAE,IAAI,KAAK,uCAAuC;gBAAE,MAAM,KAAK,CAAC;YACzF,uEAAuE;YACvE,sEAAsE;YACtE,8DAA8D;YAC9D,MAAM,wBAAwB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC7C,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,EAAE,IAAI,KAAK,WAAW,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QAC/H,uEAAuE;IACzE,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QACjD,MAAM,wBAAwB,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3E,gEAAgE;QAChE,MAAM,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;QACxE,OAAO;YACL,UAAU,EAAE,UAAU,OAAO,CAAC,SAAS,EAAE;YACzC,SAAS,EAAE,WAAW;YACtB,QAAQ;YACR,SAAS,EAAE,KAAK;YAChB,eAAe,EAAE,cAAc,CAAC,QAAQ,CAAC;SAC1C,CAAC;IACJ,CAAC;IACD,OAAO,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,KAAiB,EAAE,WAAmB,EAAE,SAAiB;IAC/F,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,mBAAmB,SAAS,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChH,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1C,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,mEAAmE;QACnE,wEAAwE;QACxE,MAAM,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAChD,MAAM,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO;QAChE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,mEAAmE;IACnE,mDAAmD;AACrD,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACtE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,SAAiB,EAAE,aAAqB;IAC9E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IACzC,MAAM,KAAK,GAAa,CAAC,SAAS,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAY,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,MAAM,eAAe,GAAG,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBAC/D,sEAAsE;gBACtE,gEAAgE;gBAChE,MAAM,YAAY,GAAG,eAAe,KAAK,aAAa,CAAC;gBACvD,MAAM,KAAK,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB,EAAE,QAAgB;IAC5D,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,eAAe,CAAI,KAAiB,EAAE,SAAiB,EAAE,SAA2B;IACjG,MAAM,SAAS,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,MAAoD,CAAC;IACzD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YACnH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACrC,MAAM,GAAG,SAAS,CAAC;gBACnB,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACrE,IAAI,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,CAAC;oBAAE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;gBACtE,SAAS;YACX,CAAC;YACD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,UAAU,CAAC,+CAA+C,EAAE;YACpE,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAA6B,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACzF,IAAI,OAAO,EAAE,KAAK,KAAK,KAAK;YAAE,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,IAAI,IAA8B,CAAC;IACnC,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAsB,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAa,EAAE,CAAC,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,EAAE,IAAI,KAAK,OAAO,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,SAAiB;IAC3C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAU,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,CAAC;IACjF,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,+BAA+B,CAAC,sDAAsD,SAAS,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,OAAO,iCAAiC,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,cAAc,CAAC,QAAmC;IACzD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IACvG,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAAiB,EAAE,SAAiB;IACjF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACxD,MAAM,IAAI,UAAU,CAAC,6CAA6C,SAAS,EAAE,EAAE;YAC7E,IAAI,EAAE,uCAAuC;YAC7C,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,UAAU,SAAS,EAAE,CAAC;IACzC,MAAM,gBAAgB,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU,IAAI,gBAAgB,KAAK,UAAU,IAAI,gBAAgB,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QACtH,MAAM,IAAI,UAAU,CAClB,6CAA6C,SAAS,yBAAyB,QAAQ,CAAC,UAAU,2CAA2C,gBAAgB,EAAE,EAC/J,EAAE,IAAI,EAAE,uCAAuC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,UAAU,CAAC,6CAA6C,SAAS,KAAM,KAAe,CAAC,OAAO,EAAE,EAAE;YAC1G,IAAI,EAAE,uCAAuC;YAC7C,QAAQ,EAAE,CAAC;YACX,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,UAAU,EAAE,UAAU,SAAS,EAAE;QACjC,SAAS;QACT,QAAQ;QACR,SAAS,EAAE,IAAI;QACf,eAAe,EAAE,cAAc,CAAC,QAAQ,CAAC;KAC1C,CAAC;AACJ,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,aAAqB,EAAE,GAA+B;IAChG,MAAM,GAAG,GAA+B;QACtC,cAAc,EAAE,cAAc;QAC9B,OAAO,EAAE,2BAA2B;QACpC,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;IAC1D,MAAM,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,aAAqB;IAChE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAA+B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7G,IAAI,GAAG,EAAE,OAAO,KAAK,2BAA2B;QAAE,OAAO,2BAA2B,CAAC;IACrF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,qBAAqB,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/daemon/auth.js

@@ -0,0 +1,108 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { open, readFile, rm } from "node:fs/promises";
+import { HitchError, SCHEMA_VERSION, reclaimStaleLock, writePrivateFile } from "../foundation/index.js";
+export async function acquireInstanceLock(file, instanceId) {
+    const owner = {
+        schema_version: SCHEMA_VERSION,
+        instance_id: instanceId,
+        pid: process.pid,
+        created_at: new Date().toISOString(),
+    };
+    for (let attempt = 0; attempt < 4; attempt += 1) {
+        try {
+            const handle = await open(file, "wx", 0o600);
+            try {
+                await handle.writeFile(`${JSON.stringify(owner)}\n`);
+                await handle.sync();
+            }
+            finally {
+                await handle.close();
+            }
+            return;
+        }
+        catch (error) {
+            if (error?.code !== "EEXIST")
+                throw error;
+            let existing;
+            try {
+                existing = JSON.parse(await readFile(file, "utf8"));
+            }
+            catch (readError) {
+                if (attempt < 3) {
+                    await new Promise((resolve) => setTimeout(resolve, 25));
+                    continue;
+                }
+                throw new HitchError("daemon lock exists but its owner record is unreadable", { code: "daemon_lock_invalid", exitCode: 12, cause: readError });
+            }
+            if (processIsAlive(existing.pid)) {
+                throw new HitchError(`another daemon owns this root (pid ${existing.pid})`, { code: "already_running", exitCode: 2 });
+            }
+            const reclaimed = await reclaimStaleLock(file, async (candidate) => {
+                let current;
+                try {
+                    current = JSON.parse(await readFile(candidate, "utf8"));
+                }
+                catch (readError) {
+                    if (readError?.code === "ENOENT")
+                        return false;
+                    throw new HitchError("daemon lock exists but its owner record is unreadable", {
+                        code: "daemon_lock_invalid",
+                        exitCode: 12,
+                        cause: readError,
+                    });
+                }
+                return !processIsAlive(current.pid);
+            });
+            if (!reclaimed)
+                await new Promise((resolve) => setTimeout(resolve, 25));
+        }
+    }
+    throw new HitchError("could not acquire daemon root lock", { code: "daemon_lock_failed", exitCode: 12 });
+}
+export async function releaseInstanceLock(file, instanceId) {
+    let owner;
+    try {
+        owner = JSON.parse(await readFile(file, "utf8"));
+    }
+    catch (error) {
+        if (error?.code === "ENOENT")
+            return;
+        return;
+    }
+    if (owner.instance_id === instanceId)
+        await rm(file, { force: true });
+}
+function processIsAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error?.code === "EPERM";
+    }
+}
+export async function ensureToken(file) {
+    try {
+        const existing = (await readFile(file, "utf8")).trim();
+        if (existing.length >= 32)
+            return existing;
+    }
+    catch (error) {
+        if (error?.code !== "ENOENT")
+            throw error;
+    }
+    const token = randomBytes(32).toString("hex");
+    await writePrivateFile(file, `${token}\n`);
+    return token;
+}
+export function authorized(request, token) {
+    const value = request.headers.authorization || "";
+    if (!value.startsWith("Bearer "))
+        return false;
+    const supplied = Buffer.from(value.slice(7));
+    const expected = Buffer.from(token);
+    return supplied.length === expected.length && timingSafeEqual(supplied, expected);
+}
+//# sourceMappingURL=auth.js.map

package/dist/src/daemon/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/daemon/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAExG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,UAAkB;IACxE,MAAM,KAAK,GAAG;QACZ,cAAc,EAAE,cAAc;QAC9B,WAAW,EAAE,UAAU;QACvB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC;IACF,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACrD,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACtB,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YACD,OAAO;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACrE,IAAI,QAAkC,CAAC;YACvC,IAAI,CAAC;gBACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAsB,CAAC;YAC3E,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACnB,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;oBAChB,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;oBACxD,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,UAAU,CAAC,uDAAuD,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YACjJ,CAAC;YACD,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,UAAU,CAAC,sCAAsC,QAAQ,CAAC,GAAG,GAAG,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;YACxH,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;gBACjE,IAAI,OAAiC,CAAC;gBACtC,IAAI,CAAC;oBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAsB,CAAC;gBAC/E,CAAC;gBAAC,OAAO,SAAS,EAAE,CAAC;oBACnB,IAAK,SAAmC,EAAE,IAAI,KAAK,QAAQ;wBAAE,OAAO,KAAK,CAAC;oBAC1E,MAAM,IAAI,UAAU,CAAC,uDAAuD,EAAE;wBAC5E,IAAI,EAAE,qBAAqB;wBAC3B,QAAQ,EAAE,EAAE;wBACZ,KAAK,EAAE,SAAS;qBACjB,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACtC,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,MAAM,IAAI,UAAU,CAAC,oCAAoC,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;AAC3G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,UAAkB;IACxE,IAAI,KAAgC,CAAC;IACrC,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAA8B,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO;QAChE,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU;QAAE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAK,GAAc,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAa,EAAE,CAAC,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,EAAE,IAAI,KAAK,OAAO,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE;YAAE,OAAO,QAAQ,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,gBAAgB,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAwB,EAAE,KAAa;IAChE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACpF,CAAC"}

package/dist/src/daemon/client.js

@@ -0,0 +1,76 @@
+import { readFile } from "node:fs/promises";
+import { HitchError, readJSON, statePaths } from "../foundation/index.js";
+export async function daemonClient(root) {
+    const paths = statePaths(root);
+    const state = await readJSON(paths.daemon, null);
+    if (!state?.port)
+        throw new Error("daemon is not running");
+    const token = (await readFile(paths.token, "utf8")).trim();
+    const performRequest = async (pathname, options = {}) => {
+        const headers = new Headers(options.headers);
+        headers.set("authorization", `Bearer ${token}`);
+        if (options.body && !headers.has("content-type"))
+            headers.set("content-type", "application/json");
+        const response = await fetch(`http://127.0.0.1:${state.port}${pathname}`, { ...options, headers });
+        const contentType = response.headers.get("content-type") || "";
+        const mediaType = (contentType.split(";", 1)[0] || "").trim().toLowerCase();
+        const isJSONDocument = mediaType === "application/json" || mediaType.endsWith("+json");
+        const payload = isJSONDocument ? await response.json() : await response.text();
+        if (!response.ok) {
+            const errorPayload = typeof payload === "object" && payload !== null ? payload : {};
+            const message = errorPayload.error?.message || `daemon request failed (${response.status})`;
+            const error = new HitchError(message, {
+                code: errorPayload.error?.code || httpErrorCode(response.status),
+                exitCode: Number.isInteger(errorPayload.error?.exit_code)
+                    ? errorPayload.error.exit_code
+                    : httpExitCode(response.status),
+            });
+            error.status = response.status;
+            throw error;
+        }
+        return { payload, headers: response.headers, status: response.status };
+    };
+    const request = async (pathname, options) => (await performRequest(pathname, options)).payload;
+    return { state, request, requestWithMetadata: performRequest };
+}
+export async function probeDaemonHealth(root) {
+    const state = await readJSON(statePaths(root).daemon, null);
+    if (!state?.port)
+        return null;
+    try {
+        const response = await fetch(`http://127.0.0.1:${state.port}/health`, { signal: AbortSignal.timeout(1_000) });
+        if (!response.ok)
+            return null;
+        const health = await response.json();
+        return health.instance_id === state.instance_id ? health : null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function readDaemonLogs(root, lines) {
+    let content = "";
+    try {
+        content = await readFile(statePaths(root).log, "utf8");
+    }
+    catch (error) {
+        if (error?.code !== "ENOENT")
+            throw error;
+    }
+    return content.trimEnd().split(/\r?\n/).slice(-lines).join("\n");
+}
+function httpExitCode(status) {
+    if (status === 400)
+        return 2;
+    if (status === 404)
+        return 3;
+    return 12;
+}
+function httpErrorCode(status) {
+    if (status === 400)
+        return "invalid_input";
+    if (status === 404)
+        return "not_found";
+    return "daemon_request_failed";
+}
+//# sourceMappingURL=client.js.map

package/dist/src/daemon/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/daemon/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAY1E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAiD,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjG,IAAI,CAAC,KAAK,EAAE,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,cAAc,GAAG,KAAK,EAAE,QAAgB,EAAE,UAAuB,EAAE,EAAE,EAAE;QAC3E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClG,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oBAAoB,KAAK,CAAC,IAAc,GAAG,QAAQ,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7G,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5E,MAAM,cAAc,GAAG,SAAS,KAAK,kBAAkB,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvF,MAAM,OAAO,GAAqC,cAAc,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5I,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,YAAY,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,MAAM,OAAO,GAAI,YAAY,CAAC,KAA0C,EAAE,OAAO,IAAI,0BAA0B,QAAQ,CAAC,MAAM,GAAG,CAAC;YAClI,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE;gBACpC,IAAI,EAAG,YAAY,CAAC,KAAuC,EAAE,IAAI,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACnG,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAE,YAAY,CAAC,KAA6C,EAAE,SAAS,CAAC;oBAChG,CAAC,CAAE,YAAY,CAAC,KAA+B,CAAC,SAAS;oBACzD,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;aAClC,CAAC,CAAC;YACF,KAA6B,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YACxD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACzE,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,EAAE,QAAgB,EAAE,OAAqB,EAAE,EAAE,CAAC,CAAC,MAAM,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAkC,CAAC;IAChJ,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAClD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAiD,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5G,IAAI,CAAC,KAAK,EAAE,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oBAAoB,KAAK,CAAC,IAAI,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9G,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAwD,CAAC;QAC3F,OAAO,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,MAAe,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,KAAa;IAC9D,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IACvE,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,eAAe,CAAC;IAC3C,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACvC,OAAO,uBAAuB,CAAC;AACjC,CAAC"}

package/dist/src/daemon/index.js

@@ -0,0 +1,5 @@
+export { Scheduler } from "./scheduler.js";
+export { DaemonServer } from "./server.js";
+export { daemonClient, probeDaemonHealth, readDaemonLogs } from "./client.js";
+export { startDetachedDaemon } from "./launcher.js";
+//# sourceMappingURL=index.js.map

package/dist/src/daemon/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/daemon/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC"}

package/dist/src/daemon/launcher.js

@@ -0,0 +1,24 @@
+import { spawn } from "node:child_process";
+import { openSync } from "node:fs";
+import { ensureDir, statePaths } from "../foundation/index.js";
+export async function startDetachedDaemon(options) {
+    const { root, executable, port, maxConcurrent } = options;
+    const paths = statePaths(root);
+    await ensureDir(root);
+    const stdout = openSync(paths.log, "a", 0o600);
+    const stderr = openSync(paths.errorLog, "a", 0o600);
+    const child = spawn(process.execPath, [
+        executable,
+        "--root", root,
+        "daemon", "serve",
+        "--port", String(port),
+        "--max-concurrent", String(maxConcurrent),
+    ], {
+        detached: true,
+        stdio: ["ignore", stdout, stderr],
+        windowsHide: true,
+    });
+    child.unref();
+    return { pid: child.pid, errorLog: paths.errorLog };
+}
+//# sourceMappingURL=launcher.js.map

package/dist/src/daemon/launcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launcher.js","sourceRoot":"","sources":["../../../src/daemon/launcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAS/D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAA8B;IACtE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAC1D,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE;QACpC,UAAU;QACV,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC;QACtB,kBAAkB,EAAE,MAAM,CAAC,aAAa,CAAC;KAC1C,EAAE;QACD,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;AACtD,CAAC"}