grepmax 0.26.63 → 0.26.65

package/dist/lib/store/lance-cleanup.js

@@ -0,0 +1,425 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCleanupProcess = runCleanupProcess;
+exports.prepareCleanupRuntime = prepareCleanupRuntime;
+exports.pruneVersions = pruneVersions;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const config_1 = require("../../config");
+const prune_state_1 = require("./prune-state");
+const recovery_admission_1 = require("./recovery-admission");
+const store_lease_1 = require("./store-lease");
+const project = path.resolve(__dirname, "../../../lance-maintenance");
+const MAX_OUTPUT_BYTES = 128 * 1024;
+const MAX_HELPER_MS = 120000;
+/** No shell, inherited service credentials, Python path hooks or source builds.
+ * Thread settings apply before Arrow/Lance imports in the child. */
+function helperEnvironment() {
+    const env = {};
+    for (const name of [
+        "PATH",
+        "HOME",
+        "TMPDIR",
+        "TEMP",
+        "SystemRoot",
+        "LOCALAPPDATA",
+        "SSL_CERT_FILE",
+        "SSL_CERT_DIR",
+    ]) {
+        if (process.env[name] !== undefined)
+            env[name] = process.env[name];
+    }
+    return Object.assign(Object.assign({}, env), { RAYON_NUM_THREADS: "1", TOKIO_WORKER_THREADS: "1", OMP_NUM_THREADS: "1", OPENBLAS_NUM_THREADS: "1", MKL_NUM_THREADS: "1", NUMEXPR_NUM_THREADS: "1", UV_CONCURRENT_DOWNLOADS: "1", UV_CONCURRENT_INSTALLS: "1", UV_CONCURRENT_BUILDS: "1", UV_PYTHON_DOWNLOADS: "never" });
+}
+/** Settle only after close, including abort/timeout. Releasing an exclusive lease
+ * on AbortError before the child exits would let writers race native deletion. */
+function runCleanupProcess(executable, args, options = {}) {
+    var _a;
+    if ((_a = options.signal) === null || _a === void 0 ? void 0 : _a.aborted)
+        return Promise.reject(new Error("Cleanup cancelled before launch"));
+    return new Promise((resolve, reject) => {
+        var _a, _b, _c;
+        var _d;
+        const child = (0, node_child_process_1.spawn)(executable, args, {
+            env: Object.assign(Object.assign({}, helperEnvironment()), options.env),
+            stdio: [options.admission ? "pipe" : "ignore", "pipe", "pipe"],
+            windowsHide: true,
+        });
+        let output = "";
+        let diagnostics = "";
+        let bytes = 0;
+        let failure;
+        let approved = false;
+        let launched = false;
+        let readyBuffer = "";
+        let monitor;
+        let forceKill;
+        const stop = (reason) => {
+            failure !== null && failure !== void 0 ? failure : (failure = new Error(`${reason}; cleanup completion is uncertain`));
+            child.kill("SIGTERM");
+            forceKill !== null && forceKill !== void 0 ? forceKill : (forceKill = setTimeout(() => child.kill("SIGKILL"), 1000));
+        };
+        const abort = () => stop("Cleanup cancelled");
+        const timeout = setTimeout(() => stop("Cleanup timed out"), Math.min((_d = options.timeoutMs) !== null && _d !== void 0 ? _d : MAX_HELPER_MS, MAX_HELPER_MS));
+        (_a = options.signal) === null || _a === void 0 ? void 0 : _a.addEventListener("abort", abort, { once: true });
+        // stderr is deliberately not returned: child diagnostics may contain paths,
+        // tokens or registry URLs. Retain a concrete bounded exit/signal/error code.
+        for (const stream of [child.stdout, child.stderr]) {
+            stream.on("data", (chunk) => {
+                bytes += chunk.length;
+                if (bytes > MAX_OUTPUT_BYTES)
+                    stop("Cleanup output exceeded limit");
+                else if (stream === child.stdout) {
+                    if (options.admission && !approved) {
+                        readyBuffer += chunk.toString("utf8");
+                        let end = readyBuffer.indexOf("\n");
+                        while (end >= 0 && !approved && !failure) {
+                            try {
+                                const phase = JSON.parse(readyBuffer.slice(0, end)).admission;
+                                readyBuffer = readyBuffer.slice(end + 1);
+                                if (phase === "launch" && !launched) {
+                                    if (!child.stdin)
+                                        throw Error();
+                                    child.stdin.write(`${options.admission.nonce}\n`);
+                                    launched = true;
+                                }
+                                else if (phase === "ready" && launched) {
+                                    options.admission.approve();
+                                    child.stdin.end(`${options.admission.nonce}\n`);
+                                    approved = true;
+                                    output += readyBuffer;
+                                    readyBuffer = "";
+                                }
+                                else
+                                    throw Error();
+                            }
+                            catch (_a) {
+                                stop("Prune deletion admission refused");
+                            }
+                            end = readyBuffer.indexOf("\n");
+                        }
+                    }
+                    else
+                        output += chunk.toString("utf8");
+                }
+                else
+                    diagnostics += chunk.toString("utf8");
+            });
+        }
+        child.on("error", (error) => {
+            var _a;
+            failure !== null && failure !== void 0 ? failure : (failure = new Error(`Cleanup process could not start (${(_a = error.code) !== null && _a !== void 0 ? _a : "unknown"})`));
+        });
+        child.once("close", (code, signal) => {
+            var _a, _b;
+            var _c;
+            clearTimeout(timeout);
+            if (forceKill)
+                clearTimeout(forceKill);
+            if (monitor)
+                clearInterval(monitor);
+            try {
+                (_a = options.admission) === null || _a === void 0 ? void 0 : _a.close();
+            }
+            catch (_d) {
+                failure !== null && failure !== void 0 ? failure : (failure = new Error("Prune ownership/resource close failed; completion is uncertain"));
+            }
+            if (options.admission && !approved)
+                failure !== null && failure !== void 0 ? failure : (failure = new Error("Prune deletion was not admitted; completion is uncertain"));
+            (_b = options.signal) === null || _b === void 0 ? void 0 : _b.removeEventListener("abort", abort);
+            if (failure)
+                reject(failure);
+            else if (code !== 0) {
+                // Whitelist categories, never repeat registry credentials, file paths,
+                // full traceback text or arbitrary diagnostics from a subprocess.
+                const detail = /lockfile.*(?:needs|updated|out.of.date)|locked.*(?:changed|update)/i.test(diagnostics)
+                    ? "locked project/runtime mismatch"
+                    : /no space left|ENOSPC/i.test(diagnostics)
+                        ? "disk full"
+                        : /no (?:python|interpreter)|python.*(?:not found|unavailable)/i.test(diagnostics)
+                            ? "compatible Python unavailable"
+                            : /failed to (?:download|fetch)|connection refused|network|cache missing/i.test(diagnostics)
+                                ? "download, network or cache unavailable"
+                                : /exclusive (?:lease|ownership)|shared store owners/i.test(diagnostics)
+                                    ? "exclusive ownership verification failed"
+                                    : /protected state|table changed|state.*changed/i.test(diagnostics)
+                                        ? "current/protected state verification failed"
+                                        : "unclassified child failure";
+                reject(new Error(`Cleanup process exited (${(_c = signal !== null && signal !== void 0 ? signal : code) !== null && _c !== void 0 ? _c : "unknown"}): ${detail}; cleanup completion is uncertain`));
+            }
+            else
+                resolve(output);
+        });
+        (_b = child.stdin) === null || _b === void 0 ? void 0 : _b.on("error", () => stop("Prune admission pipe failed"));
+        if (options.admission) {
+            try {
+                if (!child.pid)
+                    throw Error();
+                options.admission.start(child.pid);
+                monitor = setInterval(() => {
+                    try {
+                        options.admission.check();
+                    }
+                    catch (_a) {
+                        stop("Prune host/resource admission changed");
+                    }
+                }, 5000);
+            }
+            catch (_e) {
+                stop("Prune helper launch admission refused");
+            }
+        }
+        if ((_c = options.signal) === null || _c === void 0 ? void 0 : _c.aborted)
+            abort();
+    });
+}
+let preparation;
+/** Explicit recovery only. Containment has no automatic caller of this setup. */
+function prepareCleanupRuntime(signal) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (signal === null || signal === void 0 ? void 0 : signal.aborted)
+            throw new Error("Cleanup setup cancelled");
+        if (process.platform !== "darwin" && process.platform !== "linux")
+            throw new Error("Prune-only runtime currently supports macOS and Linux");
+        if (!preparation) {
+            preparation = (() => __awaiter(this, void 0, void 0, function* () {
+                const stdout = yield runCleanupProcess("uv", ["--version"], {
+                    signal,
+                    timeoutMs: 10000,
+                });
+                const match = /^uv (\d+)\.(\d+)\.(\d+)/.exec(stdout);
+                if (!match ||
+                    (Number(match[1]) === 0 &&
+                        (Number(match[2]) < 12 ||
+                            (Number(match[2]) === 12 && Number(match[3]) < 18)))) {
+                    throw new Error("Prune-only runtime requires uv >=0.12.18");
+                }
+                const hash = (0, node_crypto_1.createHash)("sha256")
+                    .update(fs.readFileSync(path.join(project, "pyproject.toml")))
+                    .update(fs.readFileSync(path.join(project, "uv.lock")))
+                    .digest("hex")
+                    .slice(0, 16);
+                const root = path.join(config_1.PATHS.sharedRoot, "runtimes");
+                fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+                if (fs.lstatSync(root).isSymbolicLink())
+                    throw new Error("Unverified cleanup runtime directory");
+                fs.chmodSync(root, 0o700);
+                const environment = path.join(root, `lance-cleanup-${hash}`);
+                const python = path.join(environment, process.platform === "win32" ? "Scripts/python.exe" : "bin/python");
+                if (fs.existsSync(environment)) {
+                    if (!fs.lstatSync(environment).isDirectory() ||
+                        fs.lstatSync(environment).isSymbolicLink())
+                        throw new Error("Unverified cleanup environment");
+                    yield runCleanupProcess("uv", [
+                        "sync",
+                        "--check",
+                        "--locked",
+                        "--offline",
+                        "--project",
+                        project,
+                        "--no-dev",
+                        "--no-python-downloads",
+                        "--no-build",
+                    ], {
+                        signal,
+                        timeoutMs: 10000,
+                        env: { UV_PROJECT_ENVIRONMENT: environment },
+                    });
+                    return { python, script: path.join(project, "prune.py") };
+                }
+                const available = fs.statfsSync(root);
+                const freeBytes = available.bavail * available.bsize;
+                if (!Number.isFinite(freeBytes) || freeBytes < 512 * Math.pow(1024, 2)) {
+                    throw new Error("Cleanup runtime setup refused: less than 512MiB free");
+                }
+                yield runCleanupProcess("uv", [
+                    "sync",
+                    "--locked",
+                    "--project",
+                    project,
+                    "--no-dev",
+                    "--no-python-downloads",
+                    "--no-build",
+                ], {
+                    signal,
+                    env: { UV_PROJECT_ENVIRONMENT: environment },
+                });
+                fs.chmodSync(environment, 0o700);
+                return {
+                    python,
+                    script: path.join(project, "prune.py"),
+                };
+            }))().catch((error) => {
+                preparation = undefined;
+                throw error;
+            });
+        }
+        return preparation;
+    });
+}
+/** Explicit recovery only. Caller must have drained local work/readers before
+ * acquiring the exclusive lease. The lease cannot be released during this call. */
+function pruneVersions(runtime, store, version, cutoff, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (!((options === null || options === void 0 ? void 0 : options.lease) instanceof store_lease_1.StoreLease))
+            throw new Error("Pruning requires a verified StoreLease token");
+        if (!Number.isSafeInteger(version) ||
+            version < 1 ||
+            !Number.isSafeInteger(cutoff.getTime()) ||
+            cutoff.getTime() > Date.now()) {
+            throw new Error("Invalid prune version or future cutoff");
+        }
+        const table = fs.realpathSync(store);
+        if (!table.endsWith(".lance") || !fs.statSync(table).isDirectory())
+            throw new Error("Pruning requires a local Lance table");
+        const storeDir = path.dirname(table);
+        if ((_a = options.signal) === null || _a === void 0 ? void 0 : _a.aborted)
+            throw new Error("Cleanup cancelled before launch");
+        let attempt;
+        let admission;
+        try {
+            const result = yield options.lease.withExclusiveUse(storeDir, () => __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                const previous = (0, prune_state_1.readPruneState)(storeDir);
+                if ((previous === null || previous === void 0 ? void 0 : previous.outcome) === "uncertain" &&
+                    options.acknowledgeUncertain !== previous.attemptId)
+                    throw new Error(`Previous prune completion is uncertain; explicit acknowledgement required for attempt ${previous.attemptId}`);
+                admission = (_a = options.admission) !== null && _a !== void 0 ? _a : (0, recovery_admission_1.admitPrune)(storeDir);
+                attempt = {
+                    schemaVersion: 1,
+                    storeIdentity: fs.realpathSync(storeDir),
+                    attemptId: (0, node_crypto_1.randomUUID)(),
+                    version,
+                    cutoffMs: cutoff.getTime(),
+                    startedAt: Date.now(),
+                    outcome: "running",
+                    previousUncertainAttemptId: (previous === null || previous === void 0 ? void 0 : previous.outcome) === "uncertain"
+                        ? previous.attemptId
+                        : previous === null || previous === void 0 ? void 0 : previous.previousUncertainAttemptId,
+                };
+                (0, prune_state_1.writePruneState)(attempt);
+                let unpin;
+                const stdout = yield runCleanupProcess(runtime.python, [
+                    "-I",
+                    runtime.script,
+                    "--store",
+                    table,
+                    "--version",
+                    String(version),
+                    "--cutoff-ms",
+                    String(cutoff.getTime()),
+                    "--lease-owner",
+                    (0, store_lease_1.storeLeasePaths)(storeDir).intentOwnerFile,
+                    "--lease-nonce",
+                    options.lease.owner.nonce,
+                    "--require-admission",
+                ], {
+                    signal: options.signal,
+                    admission: {
+                        nonce: options.lease.owner.nonce,
+                        start: (pid) => {
+                            unpin = options.lease.pinExclusiveHelper(pid);
+                            admission.start(pid);
+                        },
+                        approve: () => admission.approve(),
+                        check: () => admission.check(),
+                        close: () => {
+                            try {
+                                unpin === null || unpin === void 0 ? void 0 : unpin();
+                            }
+                            finally {
+                                admission.close();
+                                admission = undefined;
+                            }
+                        },
+                    },
+                });
+                const result = JSON.parse(stdout);
+                if (result.engine !== "12.0.0" ||
+                    result.version !== version ||
+                    result.rewritten !== false ||
+                    ![
+                        "fragments",
+                        "bytesRemoved",
+                        "versionsRemoved",
+                        "fileBytesBefore",
+                        "fileBytesAfter",
+                        "allocatedBytesBefore",
+                        "allocatedBytesAfter",
+                        "freeBytesBefore",
+                        "freeBytesAfter",
+                    ].every((key) => {
+                        const value = result[key];
+                        return (typeof value === "number" &&
+                            Number.isSafeInteger(value) &&
+                            value >= 0);
+                    }))
+                    throw new Error("Invalid prune-only cleanup result; cleanup completion is uncertain");
+                return result;
+            }));
+            // withExclusiveUse verifies ownership again before this synchronous write.
+            // The caller still holds the lease; it cannot release it during the helper.
+            (0, prune_state_1.writePruneState)(Object.assign(Object.assign({}, attempt), { outcome: "completed", finishedAt: Date.now(), result }));
+            return result;
+        }
+        catch (error) {
+            if (attempt) {
+                try {
+                    (0, prune_state_1.writePruneState)(Object.assign(Object.assign({}, attempt), { outcome: "uncertain", finishedAt: Date.now() }));
+                }
+                catch (_b) {
+                    throw new Error("Prune completion is uncertain; durable outcome could not be recorded");
+                }
+            }
+            throw error;
+        }
+        finally {
+            admission === null || admission === void 0 ? void 0 : admission.close();
+        }
+    });
+}

package/dist/lib/store/prune-state.js

@@ -0,0 +1,113 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pruneStatePath = pruneStatePath;
+exports.readPruneState = readPruneState;
+exports.writePruneState = writePruneState;
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+function pruneStatePath(storeDir) {
+    return path.join(storeDir, ".gmax-prune-state.json");
+}
+/** A running receipt survives parent death. Readers must treat it as uncertain,
+ * never as successful cleanup or permission to launch automatic maintenance. */
+function readPruneState(storeDir) {
+    var _a, _b, _c;
+    const identity = fs.realpathSync(storeDir);
+    const target = pruneStatePath(identity);
+    let stat;
+    try {
+        stat = fs.lstatSync(target);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+    if (!stat.isFile() || stat.size > 16 * 1024)
+        throw new Error("Prune state is unverified or oversized");
+    const state = JSON.parse(fs.readFileSync(target, "utf8"));
+    if (state.schemaVersion !== 1 ||
+        state.storeIdentity !== identity ||
+        typeof state.attemptId !== "string" ||
+        !state.attemptId ||
+        !Number.isSafeInteger(state.version) ||
+        state.version < 1 ||
+        !Number.isSafeInteger(state.cutoffMs) ||
+        !Number.isSafeInteger(state.startedAt) ||
+        !["running", "uncertain", "completed"].includes(state.outcome) ||
+        (state.outcome === "completed" &&
+            (!Number.isSafeInteger(state.finishedAt) ||
+                ((_a = state.result) === null || _a === void 0 ? void 0 : _a.version) !== state.version ||
+                ((_b = state.result) === null || _b === void 0 ? void 0 : _b.engine) !== "12.0.0" ||
+                ((_c = state.result) === null || _c === void 0 ? void 0 : _c.rewritten) !== false)))
+        throw new Error("Prune state is invalid; cleanup remains pending");
+    return state.outcome === "running"
+        ? Object.assign(Object.assign({}, state), { outcome: "uncertain" }) : state;
+}
+/** Persist and sync before native deletion. Failure refuses the operation;
+ * failed final writes leave a running/uncertain receipt for the next reader. */
+function writePruneState(state) {
+    const target = pruneStatePath(state.storeIdentity);
+    if (fs.existsSync(target)) {
+        const stat = fs.lstatSync(target);
+        if (!stat.isFile() || stat.size > 16 * 1024)
+            throw new Error("Prune state is unverified or oversized");
+    }
+    const temporary = path.join(state.storeIdentity, `.gmax-prune-${(0, node_crypto_1.randomUUID)()}.tmp`);
+    try {
+        const descriptor = fs.openSync(temporary, "wx", 0o600);
+        try {
+            fs.writeFileSync(descriptor, `${JSON.stringify(state)}\n`);
+            fs.fsyncSync(descriptor);
+        }
+        finally {
+            fs.closeSync(descriptor);
+        }
+        fs.renameSync(temporary, target);
+        const directory = fs.openSync(state.storeIdentity, "r");
+        try {
+            fs.fsyncSync(directory);
+        }
+        finally {
+            fs.closeSync(directory);
+        }
+    }
+    finally {
+        if (fs.existsSync(temporary))
+            fs.unlinkSync(temporary);
+    }
+}

package/dist/lib/store/recovery-admission.js

@@ -0,0 +1,92 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRUNE_METADATA_HEADROOM_BYTES = void 0;
+exports.createRecoveryBudget = createRecoveryBudget;
+exports.assertRecoveryAdmission = assertRecoveryAdmission;
+exports.admitPrune = admitPrune;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const resource_budget_1 = require("../utils/resource-budget");
+const safety_latch_1 = require("../utils/safety-latch");
+const maintenance_policy_1 = require("./maintenance-policy");
+exports.PRUNE_METADATA_HEADROOM_BYTES = 1024 * 1024;
+/** Explicit recovery has aggregate admission without changing normal service
+ * policy. Offline autostart containment is allowed; a host safety stop is not. */
+function createRecoveryBudget() {
+    return new resource_budget_1.ResourceBudget({
+        policy: () => "strict",
+        quarantine: safety_latch_1.safetyStopReason,
+        requireClientRegistration: false,
+        samplerOverrides: { sampleTimeoutMs: 8000, kernelProbeTimeoutMs: 5000 },
+        sampleMaxAgeMs: 10000,
+    });
+}
+function assertRecoveryAdmission(storeDir, budget) {
+    const marker = path.join(path.dirname(fs.realpathSync(storeDir)), "autostart-disabled");
+    const stat = fs.lstatSync(marker, { throwIfNoEntry: false });
+    if (!(stat === null || stat === void 0 ? void 0 : stat.isFile()) || stat.isSymbolicLink())
+        throw new Error("Recovery requires a persistent autostart-disabled file in the store home; close store owners separately");
+    const disk = (0, maintenance_policy_1.availableStoreDiskBytes)(storeDir);
+    if (!Number.isFinite(disk) || disk < exports.PRUNE_METADATA_HEADROOM_BYTES)
+        throw new Error("Prune metadata disk headroom is low or unknown");
+    const snapshot = budget.check();
+    if ((snapshot === null || snapshot === void 0 ? void 0 : snapshot.platform) !== "darwin")
+        throw new Error("Production recovery admission currently requires macOS host measurements");
+    if (snapshot.physicalFreeMb === null ||
+        !Number.isFinite(snapshot.physicalFreeMb) ||
+        snapshot.physicalFreeMb < resource_budget_1.HELPER_RESOURCE_RESERVE_MB)
+        throw new Error("Insufficient measured physical headroom for prune helper");
+    return snapshot;
+}
+function admitPrune(storeDir, budget = createRecoveryBudget()) {
+    assertRecoveryAdmission(storeDir, budget);
+    const reserve = budget.reserve(resource_budget_1.HELPER_RESOURCE_RESERVE_MB, "prune-helper");
+    let snapshot;
+    try {
+        snapshot = assertRecoveryAdmission(storeDir, budget);
+    }
+    catch (error) {
+        reserve.release();
+        throw error;
+    }
+    return {
+        snapshot,
+        start: (pid) => reserve.attach(pid),
+        approve: () => assertRecoveryAdmission(storeDir, budget),
+        check: () => assertRecoveryAdmission(storeDir, budget),
+        close: () => reserve.release(),
+    };
+}