anhedral 0.6.0 → 0.7.0

package/dist/transaction.js

@@ -140,7 +140,7 @@ function fingerprintEntry(target) {
 }
 function isUnsupportedDirectorySync(error, operation) {
     const code = error.code;
-    if (code === 'ENOTSUP' || code === 'EOPNOTSUPP')
+    if (['ENOTSUP', 'EOPNOTSUPP'].includes(code ?? ''))
         return true;
     // Some filesystems expose directories as readable handles but reject fsync.
     // Windows may reject opening or syncing directory handles altogether. Keep
@@ -149,9 +149,8 @@ function isUnsupportedDirectorySync(error, operation) {
         return true;
     if (process.platform !== 'win32')
         return false;
-    if (operation === 'open')
-        return code === 'EISDIR' || code === 'EPERM';
-    return code === 'EBADF' || code === 'EPERM';
+    const windowsCodes = operation === 'open' ? ['EISDIR', 'EPERM'] : ['EBADF', 'EPERM'];
+    return windowsCodes.includes(code ?? '');
 }
 function syncDirectory(directory) {
     let descriptor;
@@ -280,7 +279,79 @@ function isProcessAlive(pid) {
         throw error;
     }
 }
-function acquireTransactionLock(root) {
+function cleanupTemporaryLocks(root, owner, temporaryPath) {
+    for (const entry of readdirSync(root)) {
+        if (!entry.startsWith(`${LOCK_FILE}.`) || !entry.endsWith('.tmp'))
+            continue;
+        const staleTemporaryPath = path.join(root, entry);
+        if (staleTemporaryPath === temporaryPath)
+            continue;
+        let temporaryOwner;
+        try {
+            temporaryOwner = parseLockOwner(staleTemporaryPath);
+        }
+        catch (error) {
+            throw new Error(`Cannot safely classify transaction lock artifact at ${staleTemporaryPath}; inspect it manually before retrying.`, { cause: error });
+        }
+        if (temporaryOwner.hostname !== owner.hostname) {
+            throw new Error(`Transaction lock artifact at ${staleTemporaryPath} belongs to another host; inspect it manually before retrying.`);
+        }
+        if (!isProcessAlive(temporaryOwner.pid)) {
+            unlinkSync(staleTemporaryPath);
+        }
+    }
+}
+function claimReclamation(lockPath, reclaimPath, temporaryPath, owner) {
+    try {
+        linkSync(temporaryPath, reclaimPath);
+    }
+    catch (error) {
+        if (error.code === 'EEXIST') {
+            const reclaimer = readLockOwnerIfPresent(reclaimPath);
+            if (!reclaimer) {
+                return false;
+            }
+            if (reclaimer.hostname === owner.hostname && !isProcessAlive(reclaimer.pid)) {
+                unlinkSync(reclaimPath);
+                return false;
+            }
+            throw new Error(`A stale Anhedral lock is being recovered (${lockPath}, pid ${reclaimer.pid} on ${reclaimer.hostname}); retry the command.`);
+        }
+        throw error;
+    }
+    return true;
+}
+function reclaimTransactionLock(lockPath, reclaimPath, temporaryPath, owner) {
+    const existing = readLockOwnerIfPresent(lockPath);
+    if (!existing) {
+        return 'retry';
+    }
+    if (existing.hostname !== owner.hostname || isProcessAlive(existing.pid)) {
+        throw new Error(`Another Anhedral operation is already running (${lockPath}, pid ${existing.pid} on ${existing.hostname}).`);
+    }
+    if (!claimReclamation(lockPath, reclaimPath, temporaryPath, owner))
+        return 'retry';
+    try {
+        if (!pathEntryExists(lockPath))
+            return 'next';
+        const current = parseLockOwner(lockPath);
+        if (current.token !== existing.token)
+            return 'next';
+        if (current.hostname !== owner.hostname || isProcessAlive(current.pid)) {
+            throw new Error(`Another Anhedral operation is already running (${lockPath}, pid ${current.pid} on ${current.hostname}).`);
+        }
+        unlinkSync(lockPath);
+    }
+    finally {
+        if (pathEntryExists(reclaimPath)) {
+            const reclaimer = parseLockOwner(reclaimPath);
+            if (reclaimer.token === owner.token)
+                unlinkSync(reclaimPath);
+        }
+    }
+    return 'next';
+}
+function assertLockRoot(root) {
     const rootStat = lstatIfPresent(root);
     if (!rootStat)
         throw new Error(`Transaction root is not a directory: ${root}`);
@@ -289,6 +360,37 @@ function acquireTransactionLock(root) {
     }
     if (!rootStat.isDirectory())
         throw new Error(`Transaction root is not a directory: ${root}`);
+}
+function clearDeadReclaimer(lockPath, reclaimPath, owner) {
+    const activeReclaimer = readLockOwnerIfPresent(reclaimPath);
+    if (activeReclaimer) {
+        if (activeReclaimer.hostname === owner.hostname && !isProcessAlive(activeReclaimer.pid)) {
+            try {
+                unlinkSync(reclaimPath);
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+            return true;
+        }
+        throw new Error(`An Anhedral lock is being recovered (${lockPath}, pid ${activeReclaimer.pid} on ${activeReclaimer.hostname}); retry the command.`);
+    }
+    return false;
+}
+function cleanupAcquiredLock(root, lockPath, owner, temporaryPath) {
+    try {
+        cleanupTemporaryLocks(root, owner, temporaryPath);
+    }
+    catch (error) {
+        const current = readLockOwnerIfPresent(lockPath);
+        if (current?.token === owner.token)
+            unlinkSync(lockPath);
+        throw error;
+    }
+}
+function acquireTransactionLock(root) {
+    assertLockRoot(root);
     const lockPath = path.join(root, LOCK_FILE);
     const reclaimPath = `${lockPath}.reclaim`;
     const owner = {
@@ -302,102 +404,21 @@ function acquireTransactionLock(root) {
     writeFileSync(temporaryPath, JSON.stringify(owner) + '\n', { encoding: 'utf8', flag: 'wx', mode: 0o600 });
     try {
         for (let attempt = 0; attempt < 3; attempt += 1) {
-            const activeReclaimer = readLockOwnerIfPresent(reclaimPath);
-            if (activeReclaimer) {
-                if (activeReclaimer.hostname === owner.hostname && !isProcessAlive(activeReclaimer.pid)) {
-                    try {
-                        unlinkSync(reclaimPath);
-                    }
-                    catch (error) {
-                        if (error.code !== 'ENOENT')
-                            throw error;
-                    }
-                    attempt -= 1;
-                    continue;
-                }
-                throw new Error(`An Anhedral lock is being recovered (${lockPath}, pid ${activeReclaimer.pid} on ${activeReclaimer.hostname}); retry the command.`);
+            if (clearDeadReclaimer(lockPath, reclaimPath, owner)) {
+                attempt -= 1;
+                continue;
             }
             try {
                 linkSync(temporaryPath, lockPath);
-                try {
-                    for (const entry of readdirSync(root)) {
-                        if (!entry.startsWith(`${LOCK_FILE}.`) || !entry.endsWith('.tmp'))
-                            continue;
-                        const staleTemporaryPath = path.join(root, entry);
-                        if (staleTemporaryPath === temporaryPath)
-                            continue;
-                        let temporaryOwner;
-                        try {
-                            temporaryOwner = parseLockOwner(staleTemporaryPath);
-                        }
-                        catch (error) {
-                            throw new Error(`Cannot safely classify transaction lock artifact at ${staleTemporaryPath}; inspect it manually before retrying.`, { cause: error });
-                        }
-                        if (temporaryOwner.hostname !== owner.hostname) {
-                            throw new Error(`Transaction lock artifact at ${staleTemporaryPath} belongs to another host; inspect it manually before retrying.`);
-                        }
-                        if (!isProcessAlive(temporaryOwner.pid)) {
-                            unlinkSync(staleTemporaryPath);
-                        }
-                    }
-                }
-                catch (error) {
-                    const current = readLockOwnerIfPresent(lockPath);
-                    if (current?.token === owner.token)
-                        unlinkSync(lockPath);
-                    throw error;
-                }
+                cleanupAcquiredLock(root, lockPath, owner, temporaryPath);
                 return { lockPath, owner };
             }
             catch (error) {
                 if (error.code !== 'EEXIST')
                     throw error;
             }
-            const existing = readLockOwnerIfPresent(lockPath);
-            if (!existing) {
+            if (reclaimTransactionLock(lockPath, reclaimPath, temporaryPath, owner) === 'retry')
                 attempt -= 1;
-                continue;
-            }
-            if (existing.hostname !== owner.hostname || isProcessAlive(existing.pid)) {
-                throw new Error(`Another Anhedral operation is already running (${lockPath}, pid ${existing.pid} on ${existing.hostname}).`);
-            }
-            try {
-                linkSync(temporaryPath, reclaimPath);
-            }
-            catch (error) {
-                if (error.code === 'EEXIST') {
-                    const reclaimer = readLockOwnerIfPresent(reclaimPath);
-                    if (!reclaimer) {
-                        attempt -= 1;
-                        continue;
-                    }
-                    if (reclaimer.hostname === owner.hostname && !isProcessAlive(reclaimer.pid)) {
-                        unlinkSync(reclaimPath);
-                        attempt -= 1;
-                        continue;
-                    }
-                    throw new Error(`A stale Anhedral lock is being recovered (${lockPath}, pid ${reclaimer.pid} on ${reclaimer.hostname}); retry the command.`);
-                }
-                throw error;
-            }
-            try {
-                if (!pathEntryExists(lockPath))
-                    continue;
-                const current = parseLockOwner(lockPath);
-                if (current.token !== existing.token)
-                    continue;
-                if (current.hostname !== owner.hostname || isProcessAlive(current.pid)) {
-                    throw new Error(`Another Anhedral operation is already running (${lockPath}, pid ${current.pid} on ${current.hostname}).`);
-                }
-                unlinkSync(lockPath);
-            }
-            finally {
-                if (pathEntryExists(reclaimPath)) {
-                    const reclaimer = parseLockOwner(reclaimPath);
-                    if (reclaimer.token === owner.token)
-                        unlinkSync(reclaimPath);
-                }
-            }
         }
     }
     finally {
@@ -448,20 +469,13 @@ function assertNoSymlinksRecursively(target) {
     for (const entry of readdirSync(target))
         assertNoSymlinksRecursively(path.join(target, entry));
 }
-function validateJournal(root, value) {
-    if (!isRecord(value) || value.version !== JOURNAL_VERSION) {
-        throw new Error(`Cannot recover unsupported transaction journal at ${path.join(root, JOURNAL_FILE)}`);
-    }
-    assertExactObjectKeys(value, ['version', 'backupRoot', 'stageRoot', 'entries', 'createdDirectories'], 'transaction journal');
-    if (typeof value.backupRoot !== 'string' || typeof value.stageRoot !== 'string' || !Array.isArray(value.entries)) {
-        throw new Error(`Invalid transaction journal at ${path.join(root, JOURNAL_FILE)}`);
-    }
-    const backupIdentity = assertExpectedTempRoot(root, value.backupRoot, 'backup');
-    const stageIdentity = assertExpectedTempRoot(root, value.stageRoot, 'stage');
+function assertJournalRoots(root, backupRoot, stageRoot) {
+    const backupIdentity = assertExpectedTempRoot(root, backupRoot, 'backup');
+    const stageIdentity = assertExpectedTempRoot(root, stageRoot, 'stage');
     if (backupIdentity.token !== stageIdentity.token) {
         throw new Error('Transaction stage and backup roots do not share one token.');
     }
-    for (const temporaryRoot of [value.backupRoot, value.stageRoot]) {
+    for (const temporaryRoot of [backupRoot, stageRoot]) {
         const stat = lstatIfPresent(temporaryRoot);
         if (stat) {
             if (stat.isSymbolicLink() || !stat.isDirectory()) {
@@ -469,6 +483,16 @@ function validateJournal(root, value) {
             }
         }
     }
+}
+function validateJournal(root, value) {
+    if (!isRecord(value) || value.version !== JOURNAL_VERSION) {
+        throw new Error(`Cannot recover unsupported transaction journal at ${path.join(root, JOURNAL_FILE)}`);
+    }
+    assertExactObjectKeys(value, ['version', 'backupRoot', 'stageRoot', 'entries', 'createdDirectories'], 'transaction journal');
+    if (typeof value.backupRoot !== 'string' || typeof value.stageRoot !== 'string' || !Array.isArray(value.entries)) {
+        throw new Error(`Invalid transaction journal at ${path.join(root, JOURNAL_FILE)}`);
+    }
+    assertJournalRoots(root, value.backupRoot, value.stageRoot);
     const seen = new Set();
     const entries = value.entries.map((entry, index) => {
         if (!isRecord(entry) || typeof entry.relativePath !== 'string' || typeof entry.installed !== 'boolean') {
@@ -561,7 +585,8 @@ function removeEmptyTransactionDirectory(root) {
     }
     catch (error) {
         const code = error.code;
-        if (!['ENOENT', 'ENOTEMPTY', 'EEXIST'].includes(code ?? ''))
+        // Preserve rejected files/symlinks and the original namespace validation error.
+        if (!['ENOENT', 'ENOTDIR', 'ENOTEMPTY', 'EEXIST'].includes(code ?? ''))
             throw error;
     }
 }
@@ -588,27 +613,30 @@ function cleanupOrphanTransactionRoots(root) {
     }
     removeEmptyTransactionDirectory(root);
 }
+function restoreInstalledEntry(root, journal, entry, target) {
+    if (entry.installed) {
+        if (pathEntryExists(target)) {
+            if (entry.installedFingerprint === null) {
+                throw new Error(`Installed transaction path has no trusted fingerprint: ${entry.relativePath}. `
+                    + 'Recovery stopped without modifying it; inspect the journal, target, and backup manually.');
+            }
+            const actualFingerprint = fingerprintEntry(target);
+            if (actualFingerprint !== entry.installedFingerprint) {
+                throw new Error(`Installed transaction path changed after an interrupted commit: ${entry.relativePath}. `
+                    + 'Recovery stopped without modifying it; inspect the journal, target, and backup manually.');
+            }
+        }
+        removeEntryDurably(target);
+        entry.installed = false;
+        entry.installedFingerprint = null;
+        writeJournal(root, journal);
+    }
+}
 function restoreJournal(root, journal) {
     for (const entry of [...journal.entries].reverse()) {
         assertNoSymlinkComponents(root, entry.relativePath);
         const target = resolveTransactionPath(root, entry.relativePath);
-        if (entry.installed) {
-            if (pathEntryExists(target)) {
-                if (entry.installedFingerprint === null) {
-                    throw new Error(`Installed transaction path has no trusted fingerprint: ${entry.relativePath}. `
-                        + 'Recovery stopped without modifying it; inspect the journal, target, and backup manually.');
-                }
-                const actualFingerprint = fingerprintEntry(target);
-                if (actualFingerprint !== entry.installedFingerprint) {
-                    throw new Error(`Installed transaction path changed after an interrupted commit: ${entry.relativePath}. `
-                        + 'Recovery stopped without modifying it; inspect the journal, target, and backup manually.');
-                }
-            }
-            removeEntryDurably(target);
-            entry.installed = false;
-            entry.installedFingerprint = null;
-            writeJournal(root, journal);
-        }
+        restoreInstalledEntry(root, journal, entry, target);
         if (entry.backupPath) {
             assertNoSymlinkComponents(journal.backupRoot, entry.relativePath);
             if (pathEntryExists(entry.backupPath)) {
@@ -675,6 +703,90 @@ export class PostCommitError extends Error {
         this.committedPaths = Object.freeze([...committedPaths]);
     }
 }
+function assertTransactionNamespace(transactionDirectory) {
+    const namespaceStat = lstatIfPresent(transactionDirectory);
+    if (namespaceStat && (namespaceStat.isSymbolicLink() || !namespaceStat.isDirectory())) {
+        throw new Error(`Unsafe reserved transaction namespace requires manual inspection: ${transactionDirectory}`);
+    }
+    if (!namespaceStat)
+        return;
+    for (const entry of readdirSync(transactionDirectory)) {
+        const candidate = path.join(transactionDirectory, entry);
+        const stat = lstatIfPresent(candidate);
+        if (!LOCAL_TRANSACTION_ROOT_PATTERN.test(entry) || !stat || stat.isSymbolicLink() || !stat.isDirectory()) {
+            throw new Error(`Unknown or unsafe artifact in reserved transaction namespace requires manual inspection: ${candidate}`);
+        }
+    }
+}
+function seedTransaction(root, stageRoot, seedPaths) {
+    for (const relativePath of seedPaths) {
+        assertRelativePath(relativePath);
+        assertNoSymlinkComponents(root, relativePath);
+        const source = resolveTransactionPath(root, relativePath);
+        if (!pathEntryExists(source))
+            continue;
+        assertNoSymlinksRecursively(source);
+        const target = resolveTransactionPath(stageRoot, relativePath);
+        mkdirSync(path.dirname(target), { recursive: true });
+        cpSync(source, target, { recursive: true, preserveTimestamps: true });
+    }
+}
+function ensureTransactionParents(root, entry, journal, createdDirectorySet) {
+    const segments = entry.relativePath.split('/').slice(0, -1);
+    let cursor = root;
+    let relativeDirectory = '';
+    const missingDirectories = [];
+    for (const segment of segments) {
+        cursor = path.join(cursor, segment);
+        relativeDirectory = relativeDirectory ? `${relativeDirectory}/${segment}` : segment;
+        if (!pathEntryExists(cursor))
+            missingDirectories.push(relativeDirectory);
+        else if (!lstatSync(cursor).isDirectory()) {
+            throw new Error(`Transaction parent is not a directory: ${relativeDirectory}`);
+        }
+    }
+    const newDirectories = missingDirectories.filter((directory) => !createdDirectorySet.has(directory));
+    if (newDirectories.length > 0) {
+        journal.createdDirectories.push(...newDirectories);
+        for (const directory of newDirectories)
+            createdDirectorySet.add(directory);
+        writeJournal(root, journal);
+    }
+}
+function commitJournal(root, journal, deletePaths) {
+    const { stageRoot, backupRoot } = journal;
+    const createdDirectorySet = new Set(journal.createdDirectories);
+    for (const entry of journal.entries) {
+        const source = resolveTransactionPath(stageRoot, entry.relativePath);
+        const deleting = deletePaths.has(entry.relativePath);
+        if (!deleting && !pathEntryExists(source)) {
+            throw new Error(`Staged output is missing declared path: ${entry.relativePath}`);
+        }
+        if (deleting && pathEntryExists(source))
+            throw new Error(`Deleted transaction path still exists in staging: ${entry.relativePath}`);
+        assertNoSymlinkComponents(root, entry.relativePath);
+        if (!deleting) {
+            assertNoSymlinksRecursively(source);
+            syncEntryRecursively(source);
+        }
+        const target = resolveTransactionPath(root, entry.relativePath);
+        if (pathEntryExists(target)) {
+            const backup = resolveTransactionPath(backupRoot, entry.relativePath);
+            mkdirSync(path.dirname(backup), { recursive: true });
+            entry.backupPath = backup;
+            writeJournal(root, journal);
+            renameDurably(target, backup, root);
+        }
+        if (!deleting) {
+            ensureTransactionParents(root, entry, journal, createdDirectorySet);
+            mkdirSync(path.dirname(target), { recursive: true });
+            entry.installedFingerprint = fingerprintEntry(source);
+            entry.installed = true;
+            writeJournal(root, journal);
+            renameDurably(source, target, root);
+        }
+    }
+}
 /**
  * Build changes away from the destination and install only the declared paths.
  * Every replaced path is journaled first, so errors and later invocations can
@@ -686,6 +798,7 @@ export async function runStagedTransaction(root, options) {
     const transactionDirectory = path.join(path.resolve(root), TRANSACTION_DIRECTORY);
     const stageRoot = path.join(transactionDirectory, `stage-${token}`);
     const backupRoot = path.join(transactionDirectory, `backup-${token}`);
+    let namespaceValidated = false;
     try {
         if (options.dryRun && pathEntryExists(path.join(root, JOURNAL_FILE))) {
             throw new Error('Dry-run cannot recover an interrupted transaction. Re-run the original command without --dry-run first.');
@@ -695,32 +808,11 @@ export async function runStagedTransaction(root, options) {
             cleanupOrphanTransactionRoots(root);
         if (await options.prepare?.() === false)
             return Object.freeze([]);
-        const namespaceStat = lstatIfPresent(transactionDirectory);
-        if (namespaceStat && (namespaceStat.isSymbolicLink() || !namespaceStat.isDirectory())) {
-            throw new Error(`Unsafe reserved transaction namespace requires manual inspection: ${transactionDirectory}`);
-        }
-        if (namespaceStat) {
-            for (const entry of readdirSync(transactionDirectory)) {
-                const candidate = path.join(transactionDirectory, entry);
-                const stat = lstatIfPresent(candidate);
-                if (!LOCAL_TRANSACTION_ROOT_PATTERN.test(entry) || !stat || stat.isSymbolicLink() || !stat.isDirectory()) {
-                    throw new Error(`Unknown or unsafe artifact in reserved transaction namespace requires manual inspection: ${candidate}`);
-                }
-            }
-        }
+        assertTransactionNamespace(transactionDirectory);
+        namespaceValidated = true;
         mkdirSync(stageRoot, { recursive: true, mode: 0o700 });
         mkdirSync(backupRoot, { recursive: true, mode: 0o700 });
-        for (const relativePath of options.seedPaths ?? []) {
-            assertRelativePath(relativePath);
-            assertNoSymlinkComponents(root, relativePath);
-            const source = resolveTransactionPath(root, relativePath);
-            if (!pathEntryExists(source))
-                continue;
-            assertNoSymlinksRecursively(source);
-            const target = resolveTransactionPath(stageRoot, relativePath);
-            mkdirSync(path.dirname(target), { recursive: true });
-            cpSync(source, target, { recursive: true, preserveTimestamps: true });
-        }
+        seedTransaction(root, stageRoot, options.seedPaths ?? []);
         await options.build(stageRoot);
         const normalizedPaths = normalizeTransactionPaths(options.commitPaths, options.deletePaths ?? []);
         const deletePaths = new Set(normalizedPaths.deletePaths);
@@ -738,58 +830,9 @@ export async function runStagedTransaction(root, options) {
                 return { relativePath, backupPath: null, installed: false, installedFingerprint: null };
             }),
         };
-        const createdDirectorySet = new Set(journal.createdDirectories);
         writeJournal(root, journal);
         try {
-            for (const entry of journal.entries) {
-                const source = resolveTransactionPath(stageRoot, entry.relativePath);
-                const deleting = deletePaths.has(entry.relativePath);
-                if (!deleting && !pathEntryExists(source)) {
-                    throw new Error(`Staged output is missing declared path: ${entry.relativePath}`);
-                }
-                if (deleting && pathEntryExists(source))
-                    throw new Error(`Deleted transaction path still exists in staging: ${entry.relativePath}`);
-                assertNoSymlinkComponents(root, entry.relativePath);
-                if (!deleting) {
-                    assertNoSymlinksRecursively(source);
-                    syncEntryRecursively(source);
-                }
-                const target = resolveTransactionPath(root, entry.relativePath);
-                if (pathEntryExists(target)) {
-                    const backup = resolveTransactionPath(backupRoot, entry.relativePath);
-                    mkdirSync(path.dirname(backup), { recursive: true });
-                    entry.backupPath = backup;
-                    writeJournal(root, journal);
-                    renameDurably(target, backup, root);
-                }
-                if (!deleting) {
-                    const segments = entry.relativePath.split('/').slice(0, -1);
-                    let cursor = root;
-                    let relativeDirectory = '';
-                    const missingDirectories = [];
-                    for (const segment of segments) {
-                        cursor = path.join(cursor, segment);
-                        relativeDirectory = relativeDirectory ? `${relativeDirectory}/${segment}` : segment;
-                        if (!pathEntryExists(cursor))
-                            missingDirectories.push(relativeDirectory);
-                        else if (!lstatSync(cursor).isDirectory()) {
-                            throw new Error(`Transaction parent is not a directory: ${relativeDirectory}`);
-                        }
-                    }
-                    const newDirectories = missingDirectories.filter((directory) => !createdDirectorySet.has(directory));
-                    if (newDirectories.length > 0) {
-                        journal.createdDirectories.push(...newDirectories);
-                        for (const directory of newDirectories)
-                            createdDirectorySet.add(directory);
-                        writeJournal(root, journal);
-                    }
-                    mkdirSync(path.dirname(target), { recursive: true });
-                    entry.installedFingerprint = fingerprintEntry(source);
-                    entry.installed = true;
-                    writeJournal(root, journal);
-                    renameDurably(source, target, root);
-                }
-            }
+            commitJournal(root, journal, deletePaths);
         }
         catch (error) {
             restoreJournal(root, journal);
@@ -809,7 +852,7 @@ export async function runStagedTransaction(root, options) {
     }
     finally {
         try {
-            if (!pathEntryExists(path.join(root, JOURNAL_FILE))) {
+            if (namespaceValidated && !pathEntryExists(path.join(root, JOURNAL_FILE))) {
                 rmSync(stageRoot, { recursive: true, force: true });
                 rmSync(backupRoot, { recursive: true, force: true });
                 removeEmptyTransactionDirectory(root);

package/dist/util.js

@@ -1,4 +1,5 @@
 import { chmodSync, closeSync, existsSync, fstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, rmSync, writeFileSync, } from 'node:fs';
+import { resolveCommand } from './command.js';
 import { spawnSync } from 'node:child_process';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
@@ -50,11 +51,12 @@ function dumpFailure(cmd, status, stdoutPath, stderrPath, spawnError) {
     throw new Error(`Command failed (exit ${status ?? '?'}): ${cmd}`, spawnError ? { cause: spawnError } : undefined);
 }
 export function execFile(executable, args, cwd) {
+    const invocation = resolveCommand(executable, args);
     const quiet = process.env.ANHEDRAL_QUIET === '1';
     const display = [executable, ...args].join(' ');
     if (process.env.ANHEDRAL_VERBOSE === '1' && !quiet) {
         console.log(`  $ ${display}`);
-        const result = spawnSync(executable, [...args], { cwd, stdio: 'inherit', shell: false });
+        const result = spawnSync(invocation.command, invocation.args, { cwd, stdio: 'inherit', shell: false });
         if (result.error || result.status !== 0) {
             throw new Error(`Command failed (exit ${result.status ?? '?'}): ${display}`, result.error ? { cause: result.error } : undefined);
         }
@@ -66,7 +68,7 @@ export function execFile(executable, args, cwd) {
     const stdout = openSync(stdoutPath, 'w');
     const stderr = openSync(stderrPath, 'w');
     try {
-        const result = spawnSync(executable, [...args], {
+        const result = spawnSync(invocation.command, invocation.args, {
             cwd,
             shell: false,
             stdio: ['ignore', stdout, stderr],

package/dist/version.d.ts

@@ -1,2 +1 @@
-/** Kept in sync with package.json by tests/release checks. */
-export declare const GENERATOR_VERSION = "0.6.0";
+export declare const GENERATOR_VERSION = "0.7.0";

package/dist/version.js

@@ -1,2 +1 @@
-/** Kept in sync with package.json by tests/release checks. */
-export const GENERATOR_VERSION = '0.6.0';
+export const GENERATOR_VERSION = '0.7.0';

package/docs/application-stack-standard.md

@@ -45,9 +45,9 @@ Human approval is required for paid activation, material spending, architecture
 |**Scheduled work**|**Cron Triggers**|—|Recurring scheduled work.|
 |**Durable workflows**|**Workflows**|—|Resumable multi-step processes.|
 |**AI**|**OpenAI SDK or AI SDK**|Workers AI|OpenAI SDK for direct OpenAI use; AI SDK for streaming/tools/provider abstraction; Workers AI when Cloudflare inference is advantageous.|
-|**Outbound email**|**Resend**|—|Transactional application email.|
-|**Inbound email**|**Cloudflare Email Routing**|—|Incoming domain-email forwarding.|
-|**Business email**|**Existing provider**|Future Cloudflare offering|Reconsider when Cloudflare's offering is GA/free and preferable.|
+|**Domain**|**GoDaddy broker + Cloudflare nameservers**|—|Use GoDaddy for domain registration/brokerage and Cloudflare for authoritative DNS.|
+|**Inbound Mail**|**Cloudflare Email Routing**|—|Incoming domain-email routing for business and application mail.|
+|**Outbound Mail**|**Cloudflare Email Sending**|Resend|Business and application mail; use Resend when selected as the alternative sending provider.|
 |**Payments**|**Stripe**|RevenueCat + Stripe|Add RevenueCat when web/App Store/Play Store entitlements need unified management.|
 |**Operational telemetry**|**Cloudflare Observability**|Sentry|Add Sentry when additional crash/runtime diagnostics are required.|
 |**Product analytics**|**Basin**|PostHog|PostHog when replay, experiments, funnels, or other required capabilities justify it.|
@@ -519,21 +519,23 @@ AI Gateway and related Cloudflare AI services may be selected when their routing
 
 ---
 
-# 13. Email
+# 13. Domain and mail
 
 Use:
 
 ```
-Outbound application email → Resend
-Inbound email             → Cloudflare Email Routing
-Business mailbox          → existing provider
+Domain        → GoDaddy broker + Cloudflare nameservers
+Inbound Mail  → Cloudflare Email Routing
+Outbound Mail → Cloudflare Email Sending (default) / Resend (alternative)
 ```
 
-Treat these as separate concerns.
+Purchase the domain through GoDaddy registration/brokerage in the client's account. The client owns registration, renewal, billing, and recovery access.
 
-Do not migrate business email solely for provider consolidation.
+Then add the domain as a zone in the client's Cloudflare account, verify its DNS records, and set the registrar's nameservers to those assigned by Cloudflare. Verify the zone is active before connecting application domains and mail. Registration remains with the registrar; Cloudflare manages authoritative DNS.
 
-Reconsider Cloudflare business email when its offering is generally available or free and actually preferable.
+Use Cloudflare Email Routing for inbound mail and Cloudflare Email Sending for outbound business and application mail. Resend is an alternative outbound sending provider when selected for the project.
+
+Configure domain verification, routing destinations, sender authentication, and environment-specific sending credentials or bindings for the selected provider.
 
 ---
 
@@ -692,6 +694,7 @@ macOS
 Configure only the services selected by the project.
 
 - **Cloudflare:** client-owned account, account ID, authorized plugin/OAuth or scoped API token, and a plan supporting the selected services. Add billing or DNS access only when required.
+- **Domain and mail:** client-owned GoDaddy domain access, Cloudflare nameservers/DNS access, Email Routing destinations, and Cloudflare Email Sending setup or Resend credentials when selected.
 - **Neon / Hyperdrive:** authorized Neon project access, database connection credentials, separate migration/runtime roles, and Hyperdrive origin configuration.
 - **Private R2 / Pipelines:** Worker bindings for application storage; authorized sink writes to the selected private bucket. Cloudflare's managed setup requires the Workers Pipelines app's **Pipelines Setup** grant. Keep ingestion private unless an authorized public endpoint is required.
 - **Auth and optional providers:** Better Auth secret/URL or Clerk keys; selected AI, email, payments, analytics, and observability credentials, domains, and webhooks.