borgmcp 5.4.1 → 5.6.0

package/dist/representative-owner.js

@@ -0,0 +1,107 @@
+/** Lifecycle adapter for the existing stream lease; no separate lock protocol. */
+import { createHash, randomUUID } from 'node:crypto';
+import { join } from 'node:path';
+import { borgConfigRoot, borgHomeRoot } from './private-root.js';
+import { acquireStreamLease, readOwnershipSnapshot, STREAM_OWNER_STALE_MS, } from './stream-owner.js';
+import { RepresentativeError } from './representative-core.js';
+export function representativeOwnerDeps(binding) {
+    const authority = createHash('sha256').update(JSON.stringify([binding.origin, binding.trustIdentity])).digest('hex');
+    return {
+        // Separate from stream-locks, which borg_stream-status inspects. One lease
+        // across all worktrees using this authority/cube/drone, never one per host.
+        locksDir: join(borgConfigRoot(), 'representative-host-locks', authority),
+        privateRoot: { root: borgConfigRoot(), boundary: borgHomeRoot() },
+        worktree: binding.worktree, droneLabel: binding.representativeLabel, cubeName: binding.cubeName,
+    };
+}
+export function representativeOwnership(binding) {
+    return privateStorage(() => readOwnershipSnapshot(binding.cubeId, binding.representativeDroneId, representativeOwnerDeps(binding)));
+}
+async function privateStorage(operation) {
+    try {
+        return await operation();
+    }
+    catch (error) {
+        if (error instanceof RepresentativeError)
+            throw error;
+        const message = error instanceof Error ? error.message : 'invalid private state';
+        // Only this exact directory-mode refusal permits manual permission recovery.
+        // Symlink, ownership and other failures must not suggest chmod through a path.
+        const looseDirectory = /^Borg credential store root (.+) has insecure permissions; expected 0700$/s.exec(message);
+        const detail = looseDirectory
+            ? `directory ${looseDirectory[1]} has insecure permissions; expected 0700. ` +
+                'Check that the named path is a real directory you own and not a symlink, then set it to 0700 and retry. ' +
+                'Restart a process that had already lost ownership.'
+            : message.replace(/^Borg credential store /, '');
+        throw new RepresentativeError('REPRESENTATIVE_OWNERSHIP_REQUIRED', 'Representative lease storage refused: ' + detail);
+    }
+}
+export function createRepresentativeOwner(heartbeatIntervalMs = 20_000) {
+    let lease = null;
+    let selected;
+    let deps;
+    let lost = false, closed = false;
+    let timer;
+    let tail = Promise.resolve();
+    const processNonce = randomUUID();
+    // Serialize lease mutations, including heartbeats, but NOT tool execution:
+    // overlapping sends still use the existing atomic request reservation.
+    const serial = (op) => {
+        const result = tail.then(op);
+        tail = result.catch(() => { });
+        return result;
+    };
+    const snapshot = (binding) => privateStorage(() => readOwnershipSnapshot(binding.cubeId, binding.representativeDroneId, { ...representativeOwnerDeps(binding), processNonce }));
+    const refuse = async (binding) => {
+        const owner = await snapshot(binding);
+        throw new RepresentativeError('REPRESENTATIVE_OWNERSHIP_REQUIRED', `This representative is owned by another MCP process (pid ${owner.pid ?? 'unknown'}, started ${owner.startedAt ?? 'unknown'}), ` +
+            'or this process lost its lease. Use the owning host; after it exits or its lease expires, retry from the intended host. ' +
+            'Restart a process that lost ownership before using it again. Status remains available.', { owner });
+    };
+    const refresh = async () => {
+        try {
+            if (!lease || !await lease.refresh())
+                lost = true;
+        }
+        catch {
+            lost = true;
+        }
+        if (lost && timer) {
+            clearInterval(timer);
+            timer = undefined;
+        }
+    };
+    return {
+        snapshot,
+        ensure: (binding) => serial(async () => {
+            if (selected && (selected.origin !== binding.origin || selected.trustIdentity !== binding.trustIdentity ||
+                selected.cubeId !== binding.cubeId || selected.representativeDroneId !== binding.representativeDroneId))
+                lost = true;
+            if (closed || lost)
+                return refuse(binding);
+            if (lease) {
+                await refresh();
+                if (lost)
+                    return refuse(binding);
+                return;
+            }
+            deps = { ...representativeOwnerDeps(binding), processNonce };
+            lease = await privateStorage(() => acquireStreamLease(binding.cubeId, binding.representativeDroneId, STREAM_OWNER_STALE_MS, deps));
+            if (!lease)
+                return refuse(binding);
+            selected = binding;
+            timer = setInterval(() => { void serial(refresh); }, heartbeatIntervalMs);
+            timer.unref();
+        }),
+        close: () => serial(async () => {
+            closed = true;
+            if (timer) {
+                clearInterval(timer);
+                timer = undefined;
+            }
+            await lease?.release();
+            lease = null;
+        }),
+    };
+}
+//# sourceMappingURL=representative-owner.js.map

package/dist/representative-owner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"representative-owner.js","sourceRoot":"","sources":["../src/representative-owner.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EACL,kBAAkB,EAAE,qBAAqB,EAAE,qBAAqB,GAEjE,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAG/D,MAAM,UAAU,uBAAuB,CAAC,OAA8B;IACpE,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrH,OAAO;QACL,2EAA2E;QAC3E,4EAA4E;QAC5E,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,2BAA2B,EAAE,SAAS,CAAC;QACxE,WAAW,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE;QACjE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,mBAAmB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAChG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAA8B;IACpE,OAAO,cAAc,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACtI,CAAC;AAED,KAAK,UAAU,cAAc,CAAI,SAA2B;IAC1D,IAAI,CAAC;QAAC,OAAO,MAAM,SAAS,EAAE,CAAC;IAAC,CAAC;IACjC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,mBAAmB;YAAE,MAAM,KAAK,CAAC;QACtD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;QACjF,6EAA6E;QAC7E,+EAA+E;QAC/E,MAAM,cAAc,GAAG,4EAA4E,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClH,MAAM,MAAM,GAAG,cAAc;YAC3B,CAAC,CAAC,aAAa,cAAc,CAAC,CAAC,CAAC,4CAA4C;gBAC1E,0GAA0G;gBAC1G,oDAAoD;YACtD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,EAC/D,wCAAwC,GAAG,MAAM,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,mBAAmB,GAAG,MAAM;IACpE,IAAI,KAAK,GAAuB,IAAI,CAAC;IACrC,IAAI,QAA2C,CAAC;IAChD,IAAI,IAAqB,CAAC;IAC1B,IAAI,IAAI,GAAG,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IACjC,IAAI,KAAiD,CAAC;IACtD,IAAI,IAAI,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC/C,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;IAClC,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,MAAM,GAAG,CAAI,EAAoB,EAAc,EAAE;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,OAA8B,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAC7F,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,qBAAqB,EAC7C,EAAE,GAAG,uBAAuB,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,CACtD,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,KAAK,EAAE,OAA8B,EAAkB,EAAE;QACtE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,IAAI,mBAAmB,CAC3B,mCAAmC,EACnC,4DAA4D,KAAK,CAAC,GAAG,IAAI,SAAS,aAAa,KAAK,CAAC,SAAS,IAAI,SAAS,KAAK;YAChI,0HAA0H;YAC1H,wFAAwF,EACxF,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,KAAK,CAAC,OAAO,EAAE;gBAAE,IAAI,GAAG,IAAI,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC;QAAC,CAAC;QACxB,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;YAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAAC,KAAK,GAAG,SAAS,CAAC;QAAC,CAAC;IACjE,CAAC,CAAC;IACF,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,CAAC,OAA8B,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5D,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa;gBACnG,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,qBAAqB,KAAK,OAAO,CAAC,qBAAqB,CAAC;gBAAE,IAAI,GAAG,IAAI,CAAC;YACzH,IAAI,MAAM,IAAI,IAAI;gBAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,OAAO,EAAE,CAAC;gBAChB,IAAI,IAAI;oBAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;gBACjC,OAAO;YACT,CAAC;YACD,IAAI,GAAG,EAAE,GAAG,uBAAuB,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;YAC7D,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC,CAAC;YACnI,IAAI,CAAC,KAAK;gBAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;YACnC,QAAQ,GAAG,OAAO,CAAC;YACnB,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;YAC1E,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC,CAAC;QACF,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,GAAG,IAAI,CAAC;YACd,IAAI,KAAK,EAAE,CAAC;gBAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBAAC,KAAK,GAAG,SAAS,CAAC;YAAC,CAAC;YACvD,MAAM,KAAK,EAAE,OAAO,EAAE,CAAC;YACvB,KAAK,GAAG,IAAI,CAAC;QACf,CAAC,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/representative-store.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Private on-disk state for the human representative connection.
+ *
+ * One 0600 file under the Borg config root holds, per representative worktree:
+ * - the BINDING: the one explicit cube + Coordinator drone this worktree's
+ *   dedicated seat may talk to. Changing it requires an explicit operator rebind.
+ * - the REQUEST LEDGER: one record per sent request id, so a retry never becomes
+ *   a second message and an ambiguous send survives a reconnect.
+ *
+ * The file never holds a bearer (the seat store owns credentials) and never
+ * holds message text (only a payload digest).
+ */
+export declare function isRepresentativeUuid(value: unknown): value is string;
+/**
+ * Host fence for one binding generation: hex SHA-256 of the canonical JSON array
+ * [origin, trustIdentity, cubeId, representativeDroneId, coordinatorDroneId,
+ * boundAt]. It changes on every rebind (boundAt) and trust change, and carries
+ * no path or credential.
+ */
+export declare function bindingFingerprint(binding: RepresentativeBinding): string;
+export interface RepresentativeBinding {
+    /** Canonical worktree holding the dedicated representative seat. */
+    worktree: string;
+    origin: string;
+    trustIdentity: string;
+    cubeId: string;
+    cubeName: string;
+    representativeDroneId: string;
+    representativeLabel: string;
+    representativeRoleName: string;
+    coordinatorDroneId: string;
+    coordinatorLabel: string;
+    coordinatorRoleName: string;
+    repositoryOrigin?: string;
+    boundAt: string;
+}
+export declare function representativeRecoveryCommand(binding: RepresentativeBinding): string;
+export type RepresentativeRequestState = 'pending' | 'ambiguous' | 'sent' | 'rejected';
+export interface RepresentativeRequestRecord {
+    /** Stable request identity; also the protocol `post_id` idempotency key. */
+    requestId: string;
+    /** sha256 of kind, authorization, message, cube and Coordinator — never the text. */
+    payloadDigest: string;
+    kind: string;
+    authorization: string;
+    state: RepresentativeRequestState;
+    entryId?: string;
+    /** An attempt under this id may have reached the log; a later refusal must not clear that. */
+    maybeStored?: boolean;
+    createdAt: string;
+    updatedAt: string;
+}
+export declare class RepresentativeStoreError extends Error {
+    readonly code: 'BINDING_CONFLICT';
+    constructor(code: 'BINDING_CONFLICT', message: string);
+}
+export interface RepresentativeStore {
+    getBinding(worktree: string): Promise<RepresentativeBinding | null>;
+    readRequests(worktree: string): Promise<RepresentativeRequestRecord[]>;
+    saveBinding(binding: RepresentativeBinding, options: {
+        rebind: boolean;
+    }): Promise<'created' | 'unchanged' | 'rebound'>;
+    /** Read-compare-write over one worktree's ledger under the store lock. */
+    transactRequests<T>(worktree: string, op: (records: RepresentativeRequestRecord[]) => T): Promise<T>;
+}
+export declare function representativeStorePath(): string;
+export declare function createRepresentativeStore(storePath?: string): RepresentativeStore;
+//# sourceMappingURL=representative-store.d.ts.map

package/dist/representative-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"representative-store.d.ts","sourceRoot":"","sources":["../src/representative-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEpE;AAGD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAKzE;AAED,MAAM,WAAW,qBAAqB;IACpC,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAEpF;AAED,MAAM,MAAM,0BAA0B,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,GAAG,UAAU,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC1C,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,0BAA0B,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8FAA8F;IAC9F,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAQD,qBAAa,wBAAyB,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB;gBAAxB,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM;CAI/D;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACpE,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,EAAE,CAAC,CAAC;IACvE,WAAW,CACT,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,GAC3B,OAAO,CAAC,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC,CAAC;IAChD,0EAA0E;IAC1E,gBAAgB,CAAC,CAAC,EAChB,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,CAAC,OAAO,EAAE,2BAA2B,EAAE,KAAK,CAAC,GAChD,OAAO,CAAC,CAAC,CAAC,CAAC;CACf;AAoED,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD;AAED,wBAAgB,yBAAyB,CAAC,SAAS,GAAE,MAAkC,GAAG,mBAAmB,CAkD5G"}

package/dist/representative-store.js

@@ -0,0 +1,173 @@
+/**
+ * Private on-disk state for the human representative connection.
+ *
+ * One 0600 file under the Borg config root holds, per representative worktree:
+ * - the BINDING: the one explicit cube + Coordinator drone this worktree's
+ *   dedicated seat may talk to. Changing it requires an explicit operator rebind.
+ * - the REQUEST LEDGER: one record per sent request id, so a retry never becomes
+ *   a second message and an ambiguous send survives a reconnect.
+ *
+ * The file never holds a bearer (the seat store owns credentials) and never
+ * holds message text (only a payload digest).
+ */
+import { decodeUuid } from 'borgmcp-shared/protocol';
+import { createHash } from 'node:crypto';
+import { join } from 'node:path';
+import { borgConfigRoot } from './private-root.js';
+import { shellEscape } from './shell-escape.js';
+import { readStoreFile, withStore } from './seat-store.js';
+export function isRepresentativeUuid(value) {
+    try {
+        decodeUuid(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const SETTLED_REQUEST_LIMIT = 200;
+/**
+ * Host fence for one binding generation: hex SHA-256 of the canonical JSON array
+ * [origin, trustIdentity, cubeId, representativeDroneId, coordinatorDroneId,
+ * boundAt]. It changes on every rebind (boundAt) and trust change, and carries
+ * no path or credential.
+ */
+export function bindingFingerprint(binding) {
+    return createHash('sha256').update(JSON.stringify([
+        binding.origin, binding.trustIdentity, binding.cubeId,
+        binding.representativeDroneId, binding.coordinatorDroneId, binding.boundAt,
+    ])).digest('hex');
+}
+export function representativeRecoveryCommand(binding) {
+    return `cd ${shellEscape(binding.worktree)} && borg representative prepare --coordinator ${shellEscape(binding.coordinatorLabel)} --role ${shellEscape(binding.representativeRoleName)} --rebind`;
+}
+export class RepresentativeStoreError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'RepresentativeStoreError';
+    }
+}
+const BINDING_STRING_FIELDS = [
+    'worktree', 'origin', 'trustIdentity', 'cubeId', 'cubeName',
+    'representativeDroneId', 'representativeLabel', 'representativeRoleName',
+    'coordinatorDroneId', 'coordinatorLabel', 'coordinatorRoleName', 'boundAt',
+];
+function validBinding(value, key) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const binding = value;
+    return BINDING_STRING_FIELDS.every((field) => typeof binding[field] === 'string' && binding[field] !== '') &&
+        binding.worktree === key &&
+        isRepresentativeUuid(binding.cubeId) &&
+        isRepresentativeUuid(binding.representativeDroneId) &&
+        isRepresentativeUuid(binding.coordinatorDroneId) &&
+        binding.representativeDroneId !== binding.coordinatorDroneId &&
+        (binding.repositoryOrigin === undefined || typeof binding.repositoryOrigin === 'string');
+}
+function validRequest(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const record = value;
+    return isRepresentativeUuid(String(record.requestId ?? '')) &&
+        typeof record.payloadDigest === 'string' &&
+        typeof record.kind === 'string' &&
+        typeof record.authorization === 'string' &&
+        ['pending', 'ambiguous', 'sent', 'rejected'].includes(record.state) &&
+        (record.entryId === undefined || typeof record.entryId === 'string') &&
+        (record.maybeStored === undefined || typeof record.maybeStored === 'boolean') &&
+        typeof record.createdAt === 'string' &&
+        typeof record.updatedAt === 'string';
+}
+function parseFile(raw) {
+    const parsed = JSON.parse(raw);
+    if (parsed === null || typeof parsed !== 'object' || parsed.version !== 1 ||
+        parsed.bindings === null || typeof parsed.bindings !== 'object' || Array.isArray(parsed.bindings) ||
+        parsed.requests === null || typeof parsed.requests !== 'object' || Array.isArray(parsed.requests))
+        return null;
+    for (const [key, binding] of Object.entries(parsed.bindings)) {
+        if (!validBinding(binding, key))
+            return null;
+    }
+    for (const records of Object.values(parsed.requests)) {
+        if (!Array.isArray(records) || !records.every(validRequest))
+            return null;
+    }
+    return parsed;
+}
+const emptyFile = () => ({ version: 1, bindings: {}, requests: {} });
+function sameSelection(a, b) {
+    return a.origin === b.origin &&
+        a.trustIdentity === b.trustIdentity &&
+        a.cubeId === b.cubeId &&
+        a.representativeDroneId === b.representativeDroneId &&
+        a.coordinatorDroneId === b.coordinatorDroneId;
+}
+/** Settled history is bounded; unresolved (pending/ambiguous) records are never dropped. */
+function pruneSettled(records) {
+    const settled = records.filter((record) => record.state === 'sent' || record.state === 'rejected');
+    if (settled.length <= SETTLED_REQUEST_LIMIT)
+        return records;
+    const drop = new Set(settled.slice(0, settled.length - SETTLED_REQUEST_LIMIT).map((record) => record.requestId));
+    return records.filter((record) => !drop.has(record.requestId));
+}
+export function representativeStorePath() {
+    return join(borgConfigRoot(), 'representative.json');
+}
+export function createRepresentativeStore(storePath = representativeStorePath()) {
+    // Atomic writer renames make a single read a complete snapshot, without a
+    // store-lock write or pruning settled history during read-only status.
+    const read = async () => {
+        const raw = await readStoreFile(storePath);
+        if (raw === null)
+            return emptyFile();
+        let data;
+        try {
+            data = parseFile(raw);
+        }
+        catch {
+            data = null;
+        }
+        if (!data)
+            throw new Error('Borg representative store is malformed or unsupported; refusing to read it');
+        return data;
+    };
+    return {
+        getBinding: async (worktree) => (await read()).bindings[worktree] ?? null,
+        readRequests: async (worktree) => (await read()).requests[worktree] ?? [],
+        saveBinding: (binding, options) => withStore(storePath, emptyFile, parseFile, async (txn) => {
+            if (!validBinding(binding, binding.worktree)) {
+                throw new Error('Refusing to save an invalid representative binding');
+            }
+            const existing = txn.data.bindings[binding.worktree];
+            // An explicit rebind always starts a new generation (new boundAt, so a new
+            // binding_fingerprint), even for the same selection.
+            if (existing && sameSelection(existing, binding) && !options.rebind)
+                return 'unchanged';
+            if (existing && !options.rebind) {
+                throw new RepresentativeStoreError('BINDING_CONFLICT', `This worktree is already bound to Coordinator ${existing.coordinatorLabel} in cube ${existing.cubeName}. ` +
+                    `To confirm the new selection, run \`${representativeRecoveryCommand(binding)}\`.`);
+            }
+            txn.data.bindings[binding.worktree] = binding;
+            // A different selection invalidates the old ledger: its post ids belong to
+            // another cube/Coordinator conversation.
+            if (existing && !sameSelection(existing, binding))
+                delete txn.data.requests[binding.worktree];
+            await txn.commit();
+            return existing ? 'rebound' : 'created';
+        }),
+        transactRequests: (worktree, op) => withStore(storePath, emptyFile, parseFile, async (txn) => {
+            const records = txn.data.requests[worktree] ?? [];
+            const before = JSON.stringify(records);
+            const result = op(records);
+            const next = pruneSettled(records);
+            if (JSON.stringify(next) !== before) {
+                txn.data.requests[worktree] = next;
+                await txn.commit();
+            }
+            return result;
+        }),
+    };
+}
+//# sourceMappingURL=representative-store.js.map

package/dist/representative-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"representative-store.js","sourceRoot":"","sources":["../src/representative-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE3D,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC;QAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACjE,CAAC;AACD,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA8B;IAC/D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QAChD,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM;QACrD,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC,kBAAkB,EAAE,OAAO,CAAC,OAAO;KAC3E,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAmBD,MAAM,UAAU,6BAA6B,CAAC,OAA8B;IAC1E,OAAO,MAAM,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,iDAAiD,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,WAAW,CAAC,OAAO,CAAC,sBAAsB,CAAC,WAAW,CAAC;AACpM,CAAC;AAyBD,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAC5B;IAArB,YAAqB,IAAwB,EAAE,OAAe;QAC5D,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,SAAI,GAAJ,IAAI,CAAoB;QAE3C,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAgBD,MAAM,qBAAqB,GAAG;IAC5B,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU;IAC3D,uBAAuB,EAAE,qBAAqB,EAAE,wBAAwB;IACxE,oBAAoB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,SAAS;CAClE,CAAC;AAEX,SAAS,YAAY,CAAC,KAAc,EAAE,GAAW;IAC/C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,OAAO,GAAG,KAAgC,CAAC;IACjD,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACxG,OAAO,CAAC,QAAQ,KAAK,GAAG;QACxB,oBAAoB,CAAC,OAAO,CAAC,MAAgB,CAAC;QAC9C,oBAAoB,CAAC,OAAO,CAAC,qBAA+B,CAAC;QAC7D,oBAAoB,CAAC,OAAO,CAAC,kBAA4B,CAAC;QAC1D,OAAO,CAAC,qBAAqB,KAAK,OAAO,CAAC,kBAAkB;QAC5D,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;QACxC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC/B,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;QACxC,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAe,CAAC;QAC7E,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC;QACpE,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC;QAC7E,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC;AACzC,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuC,CAAC;IACrE,IACE,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;QACrE,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjG,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjG,OAAO,IAAI,CAAC;IACd,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/C,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3E,CAAC;IACD,OAAO,MAA4B,CAAC;AACtC,CAAC;AAED,MAAM,SAAS,GAAG,GAAuB,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;AAEzF,SAAS,aAAa,CAAC,CAAwB,EAAE,CAAwB;IACvE,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAC1B,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,aAAa;QACnC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QACrB,CAAC,CAAC,qBAAqB,KAAK,CAAC,CAAC,qBAAqB;QACnD,CAAC,CAAC,kBAAkB,KAAK,CAAC,CAAC,kBAAkB,CAAC;AAClD,CAAC;AAED,4FAA4F;AAC5F,SAAS,YAAY,CAAC,OAAsC;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC;IACnG,IAAI,OAAO,CAAC,MAAM,IAAI,qBAAqB;QAAE,OAAO,OAAO,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACjH,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,qBAAqB,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,YAAoB,uBAAuB,EAAE;IACrF,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,SAAS,EAAE,CAAC;QACrC,IAAI,IAA+B,CAAC;QACpC,IAAI,CAAC;YAAC,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC;QAAC,CAAC;QACrD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QACzG,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,OAAO;QACL,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI;QACzE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QAEzE,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1F,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrD,2EAA2E;YAC3E,qDAAqD;YACrD,IAAI,QAAQ,IAAI,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,OAAO,WAAoB,CAAC;YACjG,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAChC,MAAM,IAAI,wBAAwB,CAChC,kBAAkB,EAClB,iDAAiD,QAAQ,CAAC,gBAAgB,YAAY,QAAQ,CAAC,QAAQ,IAAI;oBACzG,uCAAuC,6BAA6B,CAAC,OAAO,CAAC,KAAK,CACrF,CAAC;YACJ,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC;YAC9C,2EAA2E;YAC3E,yCAAyC;YACzC,IAAI,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC9F,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,QAAQ,CAAC,CAAC,CAAC,SAAkB,CAAC,CAAC,CAAC,SAAkB,CAAC;QAC5D,CAAC,CAAC;QAEF,gBAAgB,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC3F,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAClD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;YAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;gBACpC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;gBACnC,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;YACrB,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/seat-probe.d.ts

@@ -24,6 +24,7 @@ import type { ActiveCube } from './cubes.js';
  *                        delete or a seat reset
  */
 export type SeatStatus = 'evicted' | 'revoked' | 'rejected' | 'live' | 'credential-rejected' | 'trust-mismatch' | 'unreachable' | 'endpoint-mismatch' | 'server-failure' | 'indeterminate';
+export declare function isTransportFailure(err: unknown): boolean;
 /**
  * Default seat probe: a lightweight drone-authed `whoami` with the seat's OWN
  * saved token. authedFetch throws TYPED errors on the authoritative outcomes

package/dist/seat-probe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seat-probe.d.ts","sourceRoot":"","sources":["../src/seat-probe.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAS7C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,SAAS,GACT,UAAU,GACV,MAAM,GACN,qBAAqB,GACrB,gBAAgB,GAChB,aAAa,GACb,mBAAmB,GACnB,gBAAgB,GAChB,eAAe,CAAC;AA2BpB;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,CAAC,CAwBrB"}
+{"version":3,"file":"seat-probe.d.ts","sourceRoot":"","sources":["../src/seat-probe.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAS7C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,SAAS,GACT,UAAU,GACV,MAAM,GACN,qBAAqB,GACrB,gBAAgB,GAChB,aAAa,GACb,mBAAmB,GACnB,gBAAgB,GAChB,eAAe,CAAC;AAmBpB,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAMxD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,CAAC,CAwBrB"}

package/dist/seat-probe.js

@@ -23,7 +23,7 @@ const TRANSPORT_ERRNOS = new Set([
     'UND_ERR_SOCKET',
     'ABORT_ERR',
 ]);
-function isTransportFailure(err) {
+export function isTransportFailure(err) {
     if (err instanceof BorgServerUnreachableError)
         return true;
     const e = err;

package/dist/seat-probe.js.map

@@ -1 +1 @@
-{"version":3,"file":"seat-probe.js","sourceRoot":"","sources":["../src/seat-probe.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,0EAA0E;AAE1E,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAsC5B,gFAAgF;AAChF,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,cAAc;IACd,YAAY;IACZ,WAAW;IACX,cAAc;IACd,aAAa;IACb,WAAW;IACX,WAAW;IACX,OAAO;IACP,yBAAyB;IACzB,yBAAyB;IACzB,gBAAgB;IAChB,WAAW;CACZ,CAAC,CAAC;AAEH,SAAS,kBAAkB,CAAC,GAAY;IACtC,IAAI,GAAG,YAAY,0BAA0B;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,CAAC,GAAG,GAAkE,CAAC;IAC7E,IAAI,CAAC,EAAE,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC;IACvC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB;YAAE,OAAO,SAAS,CAAC;QACvD,gFAAgF;QAChF,mEAAmE;QACnE,IAAI,GAAG,YAAY,oBAAoB;YAAE,OAAO,gBAAgB,CAAC;QACjE,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;YACnC,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB;gBAAE,OAAO,SAAS,CAAC;YACrD,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB;gBAAE,OAAO,UAAU,CAAC;YACvD,sEAAsE;YACtE,oEAAoE;YACpE,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB;gBAAE,OAAO,qBAAqB,CAAC;QACvE,CAAC;QACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,mBAAmB,CAAC;YACnD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;gBAAE,OAAO,gBAAgB,CAAC;YACpE,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,IAAI,kBAAkB,CAAC,GAAG,CAAC;YAAE,OAAO,aAAa,CAAC;QAClD,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC"}
+{"version":3,"file":"seat-probe.js","sourceRoot":"","sources":["../src/seat-probe.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,0EAA0E;AAE1E,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAsC5B,gFAAgF;AAChF,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,cAAc;IACd,YAAY;IACZ,WAAW;IACX,cAAc;IACd,aAAa;IACb,WAAW;IACX,WAAW;IACX,OAAO;IACP,yBAAyB;IACzB,yBAAyB;IACzB,gBAAgB;IAChB,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,IAAI,GAAG,YAAY,0BAA0B;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,CAAC,GAAG,GAAkE,CAAC;IAC7E,IAAI,CAAC,EAAE,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC;IACvC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB;YAAE,OAAO,SAAS,CAAC;QACvD,gFAAgF;QAChF,mEAAmE;QACnE,IAAI,GAAG,YAAY,oBAAoB;YAAE,OAAO,gBAAgB,CAAC;QACjE,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;YACnC,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB;gBAAE,OAAO,SAAS,CAAC;YACrD,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB;gBAAE,OAAO,UAAU,CAAC;YACvD,sEAAsE;YACtE,oEAAoE;YACpE,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB;gBAAE,OAAO,qBAAqB,CAAC;QACvE,CAAC;QACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,mBAAmB,CAAC;YACnD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;gBAAE,OAAO,gBAAgB,CAAC;YACpE,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,IAAI,kBAAkB,CAAC,GAAG,CAAC;YAAE,OAAO,aAAa,CAAC;QAClD,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/seat-store.d.ts

@@ -33,7 +33,15 @@
 export interface SecureStoreOptions {
     secureRoot?: string;
     rootMode?: 'private' | 'owner-controlled';
+    /** Harden leaf publication for private lease records; default store behavior is unchanged. */
+    verifyLeafIdentity?: boolean;
+    /** Publish without replacing an existing leaf (lease takeover marker). */
+    exclusive?: boolean;
+    /** Read-only lease inspection must not recreate a directory moved by its owner. */
+    createRoot?: boolean;
 }
+/** Shared directory policy; create=false validates without mutating and returns false if absent. */
+export declare function assertSecureRoot(root: string, rootMode?: SecureStoreOptions['rootMode'], create?: boolean): Promise<boolean>;
 /**
  * Atomic 0600 write (checklist #1 + #2): write to a same-dir temp opened
  * O_CREAT|O_EXCL at mode 0600 (never write-then-chmod), fsync the data, then
@@ -41,6 +49,11 @@ export interface SecureStoreOptions {
  * cleans up the temp so no leftover file ever holds the secret.
  */
 export declare function atomicWrite0600(filePath: string, data: string, options?: SecureStoreOptions): Promise<void>;
+/** Identity drift is retryable only when inspecting an acquisition lock. */
+export declare class StoreFileIdentityChangedError extends Error {
+    readonly code = "STORE_FILE_IDENTITY_CHANGED";
+    constructor();
+}
 /**
  * Read the store file, or null when it does not exist (ONLY the missing-file
  * no-op path initializes empty). When the file exists, the 0600-store + 0700-parent

package/dist/seat-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seat-store.d.ts","sourceRoot":"","sources":["../src/seat-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAiBH,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,SAAS,GAAG,kBAAkB,CAAC;CAC3C;AA+JD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAkCD;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmDxB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,CAAC,EACnC,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,kBAAuB,GACrE,OAAO,CAAC,CAAC,CAAC,CAkFZ;AAED,2DAA2D;AAC3D,MAAM,WAAW,QAAQ,CAAC,CAAC;IACzB,gFAAgF;IAChF,IAAI,EAAE,CAAC,CAAC;IACR,6EAA6E;IAC7E,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAAE,CAAC,EAClC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,CAAC,EACnB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,GAAG,IAAI,EAChC,EAAE,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,EACpC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,CAAC,CAAC,CAgCZ"}
+{"version":3,"file":"seat-store.d.ts","sourceRoot":"","sources":["../src/seat-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAiBH,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,SAAS,GAAG,kBAAkB,CAAC;IAC1C,8FAA8F;IAC9F,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,0EAA0E;IAC1E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,mFAAmF;IACnF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAMD,oGAAoG;AACpG,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,kBAAkB,CAAC,UAAU,CAAa,EACpD,MAAM,UAAO,GACZ,OAAO,CAAC,OAAO,CAAC,CA+BlB;AA2HD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAwDf;AAkCD,4EAA4E;AAC5E,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,QAAQ,CAAC,IAAI,iCAAiC;;CAK/C;AAOD;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmDxB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,CAAC,EACnC,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,kBAAuB,GACrE,OAAO,CAAC,CAAC,CAAC,CAkFZ;AAED,2DAA2D;AAC3D,MAAM,WAAW,QAAQ,CAAC,CAAC;IACzB,gFAAgF;IAChF,IAAI,EAAE,CAAC,CAAC;IACR,6EAA6E;IAC7E,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAAE,CAAC,EAClC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,CAAC,EACnB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,GAAG,IAAI,EAChC,EAAE,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,EACpC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,CAAC,CAAC,CAgCZ"}

package/dist/seat-store.js

@@ -40,7 +40,8 @@ const LOCK_ATTEMPTS = 500;
 function expectedUid() {
     return typeof process.getuid === 'function' ? process.getuid() : null;
 }
-async function assertSecureRoot(root, rootMode = 'private') {
+/** Shared directory policy; create=false validates without mutating and returns false if absent. */
+export async function assertSecureRoot(root, rootMode = 'private', create = true) {
     if (!isCanonicalPath(root)) {
         throw new Error(`Borg credential store path ${root} is not canonical`);
     }
@@ -51,6 +52,8 @@ async function assertSecureRoot(root, rootMode = 'private') {
     catch (error) {
         if (error.code !== 'ENOENT')
             throw error;
+        if (!create)
+            return false;
         await mkdir(root, { recursive: true, mode: 0o700 });
         metadata = await lstat(root);
     }
@@ -69,6 +72,7 @@ async function assertSecureRoot(root, rootMode = 'private') {
     if (!isCanonicalPath(root)) {
         throw new Error(`Borg credential store root ${root} is not canonical or contains a symlink`);
     }
+    return true;
 }
 async function assertSecureFile(filePath) {
     let metadata;
@@ -97,7 +101,9 @@ async function assertSecurePath(filePath, options) {
     if (!isAbsolute(filePath) || resolve(filePath) !== filePath || dirname(filePath) !== secureRoot) {
         throw new Error(`Borg credential store file path ${filePath} is not canonical`);
     }
-    await assertSecureRoot(secureRoot, options.rootMode);
+    if (!await assertSecureRoot(secureRoot, options.rootMode, options.createRoot !== false)) {
+        throw Object.assign(new Error('Borg private store directory disappeared'), { code: 'ENOENT' });
+    }
 }
 /**
  * Liveness check for the alive/dead branch (RULED option b). `process.kill(pid, 0)`
@@ -199,14 +205,30 @@ export async function atomicWrite0600(filePath, data, options = {}) {
     if (options.secureRoot)
         await assertSecureFile(filePath);
     const tmp = `${filePath}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`;
-    const handle = await open(tmp, 'wx', 0o600);
+    const handle = await open(tmp, options.verifyLeafIdentity
+        ? constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW
+        : 'wx', 0o600);
+    let opened = null;
+    const cleanup = async () => {
+        if (options.verifyLeafIdentity) {
+            const current = await lstat(tmp).catch(() => null);
+            if (!opened || !current || current.dev !== opened.dev || current.ino !== opened.ino)
+                return;
+        }
+        await unlink(tmp).catch(() => { });
+    };
     try {
+        opened = options.verifyLeafIdentity ? await handle.stat() : null;
+        if (opened && (!opened.isFile() || (opened.mode & 0o777) !== 0o600 ||
+            (expectedUid() !== null && opened.uid !== expectedUid()))) {
+            throw new Error('Borg private store temporary file is not private');
+        }
         await handle.writeFile(data);
         await handle.sync();
     }
     catch (err) {
         await handle.close().catch(() => { });
-        await unlink(tmp).catch(() => { });
+        await cleanup();
         throw err;
     }
     await handle.close();
@@ -215,7 +237,19 @@ export async function atomicWrite0600(filePath, data, options = {}) {
             await assertSecurePath(filePath, options);
             await assertSecureFile(filePath);
         }
-        await rename(tmp, filePath);
+        if (opened) {
+            const current = await lstat(tmp);
+            if (!current.isFile() || current.dev !== opened.dev || current.ino !== opened.ino ||
+                current.uid !== opened.uid || (current.mode & 0o777) !== 0o600) {
+                throw new Error('Borg private store temporary file identity changed');
+            }
+        }
+        if (options.exclusive) {
+            await link(tmp, filePath);
+            await unlink(tmp);
+        }
+        else
+            await rename(tmp, filePath);
         const parent = await open(dirname(filePath), 'r');
         try {
             await parent.sync();
@@ -225,7 +259,7 @@ export async function atomicWrite0600(filePath, data, options = {}) {
         }
     }
     catch (err) {
-        await unlink(tmp).catch(() => { });
+        await cleanup();
         throw err;
     }
 }
@@ -255,6 +289,17 @@ async function assertSecureStorePerms(filePath, fileMode) {
             `(0${(dirStat.mode & 0o777).toString(8)}, expected 0700); refusing to read a credential under it`);
     }
 }
+/** Identity drift is retryable only when inspecting an acquisition lock. */
+export class StoreFileIdentityChangedError extends Error {
+    code = 'STORE_FILE_IDENTITY_CHANGED';
+    constructor() {
+        super('Borg credential store file changed while it was being opened');
+    }
+}
+function isLockTurnover(error) {
+    const code = error.code;
+    return code === 'ENOENT' || code === 'STORE_FILE_IDENTITY_CHANGED';
+}
 /**
  * Read the store file, or null when it does not exist (ONLY the missing-file
  * no-op path initializes empty). When the file exists, the 0600-store + 0700-parent
@@ -283,7 +328,7 @@ export async function readStoreFile(filePath, options = {}) {
         try {
             const opened = await handle.stat();
             if (opened.dev !== before.dev || opened.ino !== before.ino) {
-                throw new Error('Borg credential store file changed while it was being opened');
+                throw new StoreFileIdentityChangedError();
             }
             const raw = await handle.readFile('utf8');
             const after = await handle.stat();
@@ -376,8 +421,8 @@ export async function withStoreLock(lockPath, op, opts = {}) {
                     raw = stored;
                 }
                 catch (readErr) {
-                    if (readErr.code === 'ENOENT')
-                        continue; // released — retry
+                    if (isLockTurnover(readErr))
+                        continue; // released or replaced — retry
                     throw readErr;
                 }
                 const held = parseLockPayload(raw);
@@ -398,7 +443,7 @@ export async function withStoreLock(lockPath, op, opts = {}) {
                         : {});
                 }
                 catch (readErr) {
-                    if (readErr.code === 'ENOENT')
+                    if (isLockTurnover(readErr))
                         continue;
                     throw readErr;
                 }