negotium 0.1.11 → 0.1.13

package/dist/chunk-4q966ttx.js

@@ -1,371 +0,0 @@
-// @bun
-import"./chunk-93krf6ng.js";
-import"./chunk-fswhzdf5.js";
-import"./chunk-cxa7yghg.js";
-import"./chunk-59d0shyj.js";
-import"./chunk-rbvctv1n.js";
-import"./chunk-1k7t7bnx.js";
-import"./chunk-g144wdrs.js";
-import"./chunk-91ckrvk8.js";
-import"./chunk-66y0hr8c.js";
-import"./chunk-h9vbhhgr.js";
-import"./chunk-f361dwba.js";
-import"./chunk-8cahx7xc.js";
-import"./chunk-6d4fmea5.js";
-import"./chunk-61px0717.js";
-import"./chunk-tsstrcfc.js";
-import"./chunk-6ah5farg.js";
-import"./chunk-41ygvg5k.js";
-import"./chunk-m9e3tbr8.js";
-import"./chunk-mh5mexsf.js";
-import {
-  DATA_DIR
-} from "./chunk-qwy57177.js";
-import"./chunk-j0kjscb7.js";
-import"./chunk-h980hb2n.js";
-import {
-  logger
-} from "./chunk-ffefbd3r.js";
-import"./chunk-pg1azh6n.js";
-import"./chunk-1a6kv9vt.js";
-import"./chunk-f5xgprg1.js";
-import"./chunk-hwy3n31w.js";
-
-// ../../adapters/otium/src/join.ts
-import { createHash, randomUUID } from "crypto";
-import {
-  chmodSync,
-  closeSync,
-  existsSync,
-  fsyncSync,
-  linkSync,
-  lstatSync,
-  mkdirSync,
-  openSync,
-  readFileSync,
-  renameSync,
-  rmSync,
-  statSync,
-  unlinkSync,
-  writeFileSync
-} from "fs";
-import { dirname, resolve } from "path";
-
-// ../../adapters/otium/src/secure-transport.ts
-function isLoopbackHostname(hostname) {
-  const normalized = hostname.toLowerCase();
-  if (normalized === "localhost" || normalized === "::1" || normalized === "[::1]")
-    return true;
-  const octets = normalized.split(".");
-  return octets.length === 4 && octets[0] === "127" && octets.every((octet) => /^\d{1,3}$/.test(octet) && Number(octet) <= 255);
-}
-function credentialTransportUrl(value, label) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new Error(`${label} is not a valid URL`);
-  }
-  if (url.username || url.password)
-    throw new Error(`${label} must not contain URL credentials`);
-  return url;
-}
-function assertSecureCentralUrl(value) {
-  const url = credentialTransportUrl(value, "Otium central URL");
-  if (url.protocol === "https:")
-    return;
-  if (url.protocol === "http:" && isLoopbackHostname(url.hostname))
-    return;
-  throw new Error("Otium central requires HTTPS or loopback HTTP");
-}
-function assertSecureRelayUrl(value) {
-  const url = credentialTransportUrl(value, "Otium relay URL");
-  if (url.protocol === "https:" || url.protocol === "wss:")
-    return;
-  if ((url.protocol === "http:" || url.protocol === "ws:") && isLoopbackHostname(url.hostname)) {
-    return;
-  }
-  throw new Error("Otium relay requires HTTPS/WSS or loopback HTTP/WS");
-}
-
-// ../../adapters/otium/src/join.ts
-function joinFilePath() {
-  return resolve(DATA_DIR, "otium-join.json");
-}
-function isHttpUrl(value) {
-  return /^https?:\/\//.test(value);
-}
-function isRelayUrl(value) {
-  return /^(?:https?|wss?):\/\//.test(value);
-}
-function normalizeJoin(raw) {
-  const central = typeof raw.central === "string" ? raw.central.trim().replace(/\/+$/, "") : "";
-  const relay = typeof raw.relay === "string" ? raw.relay.trim().replace(/\/+$/, "") : "";
-  const cellId = typeof raw.cellId === "string" ? raw.cellId.trim() : "";
-  const secret = typeof raw.secret === "string" ? raw.secret.trim() : "";
-  if (!central || !isHttpUrl(central)) {
-    throw new Error("invite code is missing a valid http(s) central URL");
-  }
-  if (relay && !isRelayUrl(relay))
-    throw new Error("invite code has an invalid relay URL");
-  if (!cellId)
-    throw new Error("invite code is missing cellId");
-  if (!secret)
-    throw new Error("invite code is missing secret");
-  assertSecureCentralUrl(central);
-  if (relay)
-    assertSecureRelayUrl(relay);
-  return {
-    ...typeof raw.v === "number" ? { v: raw.v } : {},
-    central,
-    ...relay ? { relay } : {},
-    cellId,
-    secret
-  };
-}
-function parseInviteCode(code) {
-  const trimmed = code.trim();
-  if (!trimmed)
-    throw new Error("invite code is empty");
-  let decoded;
-  try {
-    decoded = Buffer.from(trimmed, "base64url").toString("utf-8");
-  } catch {
-    throw new Error("invite code is not valid base64url");
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(decoded);
-  } catch {
-    throw new Error("invite code does not decode to JSON");
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("invite code does not decode to a JSON object");
-  }
-  return normalizeJoin(parsed);
-}
-var JOIN_LOCK_STALE_MS = 30000;
-function joinLockPath() {
-  return resolve(DATA_DIR, ".otium-join.lock");
-}
-function processIsAlive(pid) {
-  if (!Number.isSafeInteger(pid) || pid <= 0)
-    return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return error.code !== "ESRCH";
-  }
-}
-function withJoinCredentialLock(operation) {
-  const lockPath = joinLockPath();
-  const ownerPath = resolve(lockPath, "owner.json");
-  const owner = { pid: process.pid, token: randomUUID() };
-  mkdirSync(dirname(lockPath), { recursive: true });
-  for (let attempt = 0;; attempt += 1) {
-    let created = false;
-    try {
-      mkdirSync(lockPath, { mode: 448 });
-      created = true;
-      writeFileSync(ownerPath, `${JSON.stringify(owner)}
-`, { mode: 384 });
-      const ownerFd = openSync(ownerPath, "r");
-      try {
-        fsyncSync(ownerFd);
-      } finally {
-        closeSync(ownerFd);
-      }
-      break;
-    } catch (error) {
-      if (created) {
-        rmSync(lockPath, { recursive: true, force: true });
-        throw error;
-      }
-      if (error.code !== "EEXIST")
-        throw error;
-      let current = null;
-      try {
-        current = JSON.parse(readFileSync(ownerPath, "utf8"));
-      } catch {}
-      let ageMs;
-      try {
-        ageMs = Date.now() - statSync(lockPath).mtimeMs;
-      } catch (statError) {
-        if (statError.code === "ENOENT")
-          continue;
-        throw statError;
-      }
-      if (current && processIsAlive(current.pid) || !current && ageMs <= JOIN_LOCK_STALE_MS) {
-        throw new Error(`another Otium join credential operation is in progress at ${lockPath}`);
-      }
-      if (attempt > 0) {
-        throw new Error(`could not recover stale Otium join credential lock at ${lockPath}`);
-      }
-      const stalePath = `${lockPath}.stale.${process.pid}.${randomUUID()}`;
-      try {
-        renameSync(lockPath, stalePath);
-        rmSync(stalePath, { recursive: true, force: true });
-      } catch (staleError) {
-        if (staleError.code !== "ENOENT")
-          throw staleError;
-      }
-    }
-  }
-  try {
-    return operation();
-  } finally {
-    try {
-      const current = JSON.parse(readFileSync(ownerPath, "utf8"));
-      if (current.pid === owner.pid && current.token === owner.token) {
-        rmSync(lockPath, { recursive: true, force: true });
-      }
-    } catch {}
-  }
-}
-function joinsEqual(left, right) {
-  return left.central === right.central && left.relay === right.relay && left.cellId === right.cellId && left.secret === right.secret;
-}
-function normalizedJoin(join) {
-  return normalizeJoin({
-    v: join.v,
-    central: join.central,
-    relay: join.relay,
-    cellId: join.cellId,
-    secret: join.secret
-  });
-}
-function joinCredentialDigest(join) {
-  return createHash("sha256").update(JSON.stringify(normalizedJoin(join))).digest("base64url");
-}
-function readPersistedJoin(path = joinFilePath()) {
-  if (!existsSync(path))
-    return null;
-  const parsed = JSON.parse(readFileSync(path, "utf-8"));
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error("persisted join credentials are not a JSON object");
-  }
-  return normalizeJoin(parsed);
-}
-function isJoinPersisted(join) {
-  try {
-    const persisted = readPersistedJoin();
-    return persisted !== null && joinsEqual(persisted, normalizedJoin(join));
-  } catch {
-    return false;
-  }
-}
-function saveJoinWhileLocked(join, options = {}) {
-  const path = joinFilePath();
-  const directory = dirname(path);
-  const normalized = normalizedJoin(join);
-  mkdirSync(directory, { recursive: true });
-  if (existsSync(path)) {
-    if (lstatSync(path).isSymbolicLink()) {
-      throw new Error(`refusing to replace symlinked Otium join file at ${path}`);
-    }
-    let existing = null;
-    try {
-      existing = readPersistedJoin(path);
-    } catch (error) {
-      if (!options.replaceExisting) {
-        throw new Error(`existing Otium join file at ${path} is invalid; pass --replace to replace it`, { cause: error });
-      }
-    }
-    if (existing && joinsEqual(existing, normalized)) {
-      chmodSync(path, 384);
-      const fileFd = openSync(path, "r");
-      try {
-        fsyncSync(fileFd);
-      } finally {
-        closeSync(fileFd);
-      }
-      const directoryFd = openSync(directory, "r");
-      try {
-        fsyncSync(directoryFd);
-      } finally {
-        closeSync(directoryFd);
-      }
-      return path;
-    }
-    if (!options.replaceExisting) {
-      throw new Error(`this node is already joined${existing ? ` as ${existing.cellId}` : " with an invalid join file"}; pass --replace to replace its credentials`);
-    }
-  }
-  const temporaryPath = resolve(directory, `.otium-join.json.${process.pid}.${randomUUID()}.tmp`);
-  let fd;
-  try {
-    fd = openSync(temporaryPath, "wx", 384);
-    writeFileSync(fd, `${JSON.stringify(normalized, null, 2)}
-`, "utf8");
-    fsyncSync(fd);
-    closeSync(fd);
-    fd = undefined;
-    if (options.replaceExisting) {
-      renameSync(temporaryPath, path);
-    } else {
-      linkSync(temporaryPath, path);
-      unlinkSync(temporaryPath);
-    }
-    chmodSync(path, 384);
-    const directoryFd = openSync(directory, "r");
-    try {
-      fsyncSync(directoryFd);
-    } finally {
-      closeSync(directoryFd);
-    }
-  } catch (error) {
-    if (fd !== undefined)
-      closeSync(fd);
-    if (existsSync(temporaryPath))
-      unlinkSync(temporaryPath);
-    throw error;
-  }
-  return path;
-}
-function saveJoin(join, options = {}) {
-  return withJoinCredentialLock(() => saveJoinWhileLocked(join, options));
-}
-function loadJoin() {
-  const central = process.env.OTIUM_CENTRAL_URL?.trim();
-  const cellId = process.env.OTIUM_CELL_ID?.trim();
-  const secret = process.env.OTIUM_CELL_SECRET?.trim();
-  const relay = process.env.OTIUM_RELAY_URL?.trim();
-  if (central && cellId && secret) {
-    try {
-      return normalizeJoin({ central, relay, cellId, secret });
-    } catch (err) {
-      logger.warn({ err }, "otium: invalid OTIUM_CENTRAL_URL/OTIUM_CELL_ID/OTIUM_CELL_SECRET env");
-      return null;
-    }
-  }
-  if (central || cellId || secret) {
-    logger.warn("otium: OTIUM_CENTRAL_URL, OTIUM_CELL_ID, OTIUM_CELL_SECRET must be set together \u2014 ignoring partial env");
-  }
-  const path = joinFilePath();
-  if (!existsSync(path))
-    return null;
-  try {
-    const parsed = JSON.parse(readFileSync(path, "utf-8"));
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-      return null;
-    return normalizeJoin(parsed);
-  } catch (err) {
-    logger.warn({ err, path }, "otium: failed to read join file");
-    return null;
-  }
-}
-export {
-  withJoinCredentialLock,
-  saveJoinWhileLocked,
-  saveJoin,
-  parseInviteCode,
-  loadJoin,
-  joinFilePath,
-  joinCredentialDigest,
-  isJoinPersisted
-};
-
-export { assertSecureCentralUrl, assertSecureRelayUrl, joinFilePath, parseInviteCode, withJoinCredentialLock, joinCredentialDigest, isJoinPersisted, saveJoinWhileLocked, saveJoin, loadJoin };
-
-//# debugId=4EF2651906A11C3664756E2164756E21

package/dist/chunk-4q966ttx.js.map

@@ -1,11 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../adapters/otium/src/join.ts", "../../../adapters/otium/src/secure-transport.ts"],
-  "sourcesContent": [
-    "/**\n * otium node join credentials — the v0 \"invite code\" is a base64url JSON\n * bundle `{ v, central, cellId, secret }` produced by the hub operator\n * (scripts/otium-experiment/hub-setup.ts). `negotium otium join <code>` decodes it\n * and persists it under `${DATA_DIR}/otium-join.json` (0600); `serve` mounts\n * the peer routes whenever that file (or the env triple) is present.\n */\n\nimport { createHash, randomUUID } from \"node:crypto\";\nimport {\n  chmodSync,\n  closeSync,\n  existsSync,\n  fsyncSync,\n  linkSync,\n  lstatSync,\n  mkdirSync,\n  openSync,\n  readFileSync,\n  renameSync,\n  rmSync,\n  statSync,\n  unlinkSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport { DATA_DIR, logger } from \"@negotium/core\";\nimport { assertSecureCentralUrl, assertSecureRelayUrl } from \"@/secure-transport\";\n\nexport interface OtiumJoin {\n  /** Invite code format version (v0 bundles carry 1). */\n  v?: number;\n  /** central-api origin, e.g. \"http://127.0.0.1:4600\". */\n  central: string;\n  /** Optional relay origin used for outbound NAT traversal. */\n  relay?: string;\n  /** This node's runtime cell id (cell_…). */\n  cellId: string;\n  /** This node's runtime cell secret (rcs_…) — never leaves this process. */\n  secret: string;\n}\n\nexport function joinFilePath(): string {\n  return resolve(DATA_DIR, \"otium-join.json\");\n}\n\nfunction isHttpUrl(value: string): boolean {\n  return /^https?:\\/\\//.test(value);\n}\n\nfunction isRelayUrl(value: string): boolean {\n  return /^(?:https?|wss?):\\/\\//.test(value);\n}\n\nfunction normalizeJoin(raw: Record<string, unknown>): OtiumJoin {\n  const central = typeof raw.central === \"string\" ? raw.central.trim().replace(/\\/+$/, \"\") : \"\";\n  const relay = typeof raw.relay === \"string\" ? raw.relay.trim().replace(/\\/+$/, \"\") : \"\";\n  const cellId = typeof raw.cellId === \"string\" ? raw.cellId.trim() : \"\";\n  const secret = typeof raw.secret === \"string\" ? raw.secret.trim() : \"\";\n  if (!central || !isHttpUrl(central)) {\n    throw new Error(\"invite code is missing a valid http(s) central URL\");\n  }\n  if (relay && !isRelayUrl(relay)) throw new Error(\"invite code has an invalid relay URL\");\n  if (!cellId) throw new Error(\"invite code is missing cellId\");\n  if (!secret) throw new Error(\"invite code is missing secret\");\n  assertSecureCentralUrl(central);\n  if (relay) assertSecureRelayUrl(relay);\n  return {\n    ...(typeof raw.v === \"number\" ? { v: raw.v } : {}),\n    central,\n    ...(relay ? { relay } : {}),\n    cellId,\n    secret,\n  };\n}\n\n/** Decode a v0 invite code: base64url(JSON {v, central, cellId, secret}). */\nexport function parseInviteCode(code: string): OtiumJoin {\n  const trimmed = code.trim();\n  if (!trimmed) throw new Error(\"invite code is empty\");\n  let decoded: string;\n  try {\n    decoded = Buffer.from(trimmed, \"base64url\").toString(\"utf-8\");\n  } catch {\n    throw new Error(\"invite code is not valid base64url\");\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(decoded);\n  } catch {\n    throw new Error(\"invite code does not decode to JSON\");\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\"invite code does not decode to a JSON object\");\n  }\n  return normalizeJoin(parsed as Record<string, unknown>);\n}\n\nexport interface SaveJoinOptions {\n  /** Explicitly replace credentials for a different cell/workspace. */\n  replaceExisting?: boolean;\n}\n\ninterface JoinLockOwner {\n  pid: number;\n  token: string;\n}\n\nconst JOIN_LOCK_STALE_MS = 30_000;\n\nfunction joinLockPath(): string {\n  return resolve(DATA_DIR, \".otium-join.lock\");\n}\n\nfunction processIsAlive(pid: number): boolean {\n  if (!Number.isSafeInteger(pid) || pid <= 0) return false;\n  try {\n    process.kill(pid, 0);\n    return true;\n  } catch (error) {\n    return (error as NodeJS.ErrnoException).code !== \"ESRCH\";\n  }\n}\n\n/** @internal Cross-process critical section for join/enrollment credential state. */\nexport function withJoinCredentialLock<T>(operation: () => T): T {\n  const lockPath = joinLockPath();\n  const ownerPath = resolve(lockPath, \"owner.json\");\n  const owner: JoinLockOwner = { pid: process.pid, token: randomUUID() };\n  mkdirSync(dirname(lockPath), { recursive: true });\n\n  for (let attempt = 0; ; attempt += 1) {\n    let created = false;\n    try {\n      mkdirSync(lockPath, { mode: 0o700 });\n      created = true;\n      writeFileSync(ownerPath, `${JSON.stringify(owner)}\\n`, { mode: 0o600 });\n      const ownerFd = openSync(ownerPath, \"r\");\n      try {\n        fsyncSync(ownerFd);\n      } finally {\n        closeSync(ownerFd);\n      }\n      break;\n    } catch (error) {\n      if (created) {\n        rmSync(lockPath, { recursive: true, force: true });\n        throw error;\n      }\n      if ((error as NodeJS.ErrnoException).code !== \"EEXIST\") throw error;\n      let current: JoinLockOwner | null = null;\n      try {\n        current = JSON.parse(readFileSync(ownerPath, \"utf8\")) as JoinLockOwner;\n      } catch {\n        // A live acquirer may be between mkdir and owner write. Only recover an\n        // ownerless lock after it has been stale long enough.\n      }\n      let ageMs: number;\n      try {\n        ageMs = Date.now() - statSync(lockPath).mtimeMs;\n      } catch (statError) {\n        if ((statError as NodeJS.ErrnoException).code === \"ENOENT\") continue;\n        throw statError;\n      }\n      if ((current && processIsAlive(current.pid)) || (!current && ageMs <= JOIN_LOCK_STALE_MS)) {\n        throw new Error(`another Otium join credential operation is in progress at ${lockPath}`);\n      }\n      if (attempt > 0) {\n        throw new Error(`could not recover stale Otium join credential lock at ${lockPath}`);\n      }\n      const stalePath = `${lockPath}.stale.${process.pid}.${randomUUID()}`;\n      try {\n        renameSync(lockPath, stalePath);\n        rmSync(stalePath, { recursive: true, force: true });\n      } catch (staleError) {\n        if ((staleError as NodeJS.ErrnoException).code !== \"ENOENT\") throw staleError;\n      }\n    }\n  }\n\n  try {\n    return operation();\n  } finally {\n    try {\n      const current = JSON.parse(readFileSync(ownerPath, \"utf8\")) as JoinLockOwner;\n      if (current.pid === owner.pid && current.token === owner.token) {\n        rmSync(lockPath, { recursive: true, force: true });\n      }\n    } catch {\n      // Never remove a lock whose ownership can no longer be proven.\n    }\n  }\n}\n\nfunction joinsEqual(left: OtiumJoin, right: OtiumJoin): boolean {\n  return (\n    left.central === right.central &&\n    left.relay === right.relay &&\n    left.cellId === right.cellId &&\n    left.secret === right.secret\n  );\n}\n\nfunction normalizedJoin(join: OtiumJoin): OtiumJoin {\n  return normalizeJoin({\n    v: join.v,\n    central: join.central,\n    relay: join.relay,\n    cellId: join.cellId,\n    secret: join.secret,\n  });\n}\n\n/** Stable digest used to bind pending enrollment material to one exact join. */\nexport function joinCredentialDigest(join: OtiumJoin): string {\n  return createHash(\"sha256\")\n    .update(JSON.stringify(normalizedJoin(join)))\n    .digest(\"base64url\");\n}\n\nfunction readPersistedJoin(path = joinFilePath()): OtiumJoin | null {\n  if (!existsSync(path)) return null;\n  const parsed = JSON.parse(readFileSync(path, \"utf-8\"));\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\"persisted join credentials are not a JSON object\");\n  }\n  return normalizeJoin(parsed as Record<string, unknown>);\n}\n\n/** True only when the join file on disk contains these exact credentials. */\nexport function isJoinPersisted(join: OtiumJoin): boolean {\n  try {\n    const persisted = readPersistedJoin();\n    return persisted !== null && joinsEqual(persisted, normalizedJoin(join));\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Persist join credentials atomically (0600 — the cell secret is a bearer\n * credential). Re-saving the same join is idempotent. Replacing a different\n * join must be explicit so an enrollment retry cannot silently detach a node.\n */\n/** @internal Caller must hold withJoinCredentialLock. */\nexport function saveJoinWhileLocked(join: OtiumJoin, options: SaveJoinOptions = {}): string {\n  const path = joinFilePath();\n  const directory = dirname(path);\n  const normalized = normalizedJoin(join);\n  mkdirSync(directory, { recursive: true });\n\n  if (existsSync(path)) {\n    if (lstatSync(path).isSymbolicLink()) {\n      throw new Error(`refusing to replace symlinked Otium join file at ${path}`);\n    }\n    let existing: OtiumJoin | null = null;\n    try {\n      existing = readPersistedJoin(path)!;\n    } catch (error) {\n      if (!options.replaceExisting) {\n        throw new Error(\n          `existing Otium join file at ${path} is invalid; pass --replace to replace it`,\n          { cause: error },\n        );\n      }\n    }\n    if (existing && joinsEqual(existing, normalized)) {\n      chmodSync(path, 0o600);\n      const fileFd = openSync(path, \"r\");\n      try {\n        fsyncSync(fileFd);\n      } finally {\n        closeSync(fileFd);\n      }\n      const directoryFd = openSync(directory, \"r\");\n      try {\n        fsyncSync(directoryFd);\n      } finally {\n        closeSync(directoryFd);\n      }\n      return path;\n    }\n    if (!options.replaceExisting) {\n      throw new Error(\n        `this node is already joined${existing ? ` as ${existing.cellId}` : \" with an invalid join file\"}; pass --replace to replace its credentials`,\n      );\n    }\n  }\n\n  const temporaryPath = resolve(directory, `.otium-join.json.${process.pid}.${randomUUID()}.tmp`);\n  let fd: number | undefined;\n  try {\n    fd = openSync(temporaryPath, \"wx\", 0o600);\n    writeFileSync(fd, `${JSON.stringify(normalized, null, 2)}\\n`, \"utf8\");\n    fsyncSync(fd);\n    closeSync(fd);\n    fd = undefined;\n    if (options.replaceExisting) {\n      renameSync(temporaryPath, path);\n    } else {\n      // Unlike rename(), link fails when another process won the initial join\n      // race, so a non-explicit save can never overwrite its credentials.\n      linkSync(temporaryPath, path);\n      unlinkSync(temporaryPath);\n    }\n    chmodSync(path, 0o600);\n    const directoryFd = openSync(directory, \"r\");\n    try {\n      fsyncSync(directoryFd);\n    } finally {\n      closeSync(directoryFd);\n    }\n  } catch (error) {\n    if (fd !== undefined) closeSync(fd);\n    if (existsSync(temporaryPath)) unlinkSync(temporaryPath);\n    throw error;\n  }\n  return path;\n}\n\nexport function saveJoin(join: OtiumJoin, options: SaveJoinOptions = {}): string {\n  return withJoinCredentialLock(() => saveJoinWhileLocked(join, options));\n}\n\n/**\n * Load join credentials. Env triple (OTIUM_CENTRAL_URL / OTIUM_CELL_ID /\n * OTIUM_CELL_SECRET) wins when all three are set — same values `negotium\n * join` persists, useful for tests and multi-node-on-one-box. Fail-closed:\n * a partial env triple or a corrupt file yields null (worker stays off).\n */\nexport function loadJoin(): OtiumJoin | null {\n  const central = process.env.OTIUM_CENTRAL_URL?.trim();\n  const cellId = process.env.OTIUM_CELL_ID?.trim();\n  const secret = process.env.OTIUM_CELL_SECRET?.trim();\n  const relay = process.env.OTIUM_RELAY_URL?.trim();\n  if (central && cellId && secret) {\n    try {\n      return normalizeJoin({ central, relay, cellId, secret });\n    } catch (err) {\n      logger.warn({ err }, \"otium: invalid OTIUM_CENTRAL_URL/OTIUM_CELL_ID/OTIUM_CELL_SECRET env\");\n      return null;\n    }\n  }\n  if (central || cellId || secret) {\n    logger.warn(\n      \"otium: OTIUM_CENTRAL_URL, OTIUM_CELL_ID, OTIUM_CELL_SECRET must be set together — ignoring partial env\",\n    );\n  }\n  const path = joinFilePath();\n  if (!existsSync(path)) return null;\n  try {\n    const parsed = JSON.parse(readFileSync(path, \"utf-8\"));\n    if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) return null;\n    return normalizeJoin(parsed as Record<string, unknown>);\n  } catch (err) {\n    logger.warn({ err, path }, \"otium: failed to read join file\");\n    return null;\n  }\n}\n",
-    "function isLoopbackHostname(hostname: string): boolean {\n  const normalized = hostname.toLowerCase();\n  if (normalized === \"localhost\" || normalized === \"::1\" || normalized === \"[::1]\") return true;\n  const octets = normalized.split(\".\");\n  return (\n    octets.length === 4 &&\n    octets[0] === \"127\" &&\n    octets.every((octet) => /^\\d{1,3}$/.test(octet) && Number(octet) <= 255)\n  );\n}\n\nfunction credentialTransportUrl(value: string, label: string): URL {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error(`${label} is not a valid URL`);\n  }\n  if (url.username || url.password) throw new Error(`${label} must not contain URL credentials`);\n  return url;\n}\n\nexport function assertSecureCentralUrl(value: string): void {\n  const url = credentialTransportUrl(value, \"Otium central URL\");\n  if (url.protocol === \"https:\") return;\n  if (url.protocol === \"http:\" && isLoopbackHostname(url.hostname)) return;\n  throw new Error(\"Otium central requires HTTPS or loopback HTTP\");\n}\n\nexport function assertSecureRelayUrl(value: string): void {\n  const url = credentialTransportUrl(value, \"Otium relay URL\");\n  if (url.protocol === \"https:\" || url.protocol === \"wss:\") return;\n  if ((url.protocol === \"http:\" || url.protocol === \"ws:\") && isLoopbackHostname(url.hostname)) {\n    return;\n  }\n  throw new Error(\"Otium relay requires HTTPS/WSS or loopback HTTP/WS\");\n}\n"
-  ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA;AACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgBA;;;ACzBA,SAAS,kBAAkB,CAAC,UAA2B;AAAA,EACrD,MAAM,aAAa,SAAS,YAAY;AAAA,EACxC,IAAI,eAAe,eAAe,eAAe,SAAS,eAAe;AAAA,IAAS,OAAO;AAAA,EACzF,MAAM,SAAS,WAAW,MAAM,GAAG;AAAA,EACnC,OACE,OAAO,WAAW,KAClB,OAAO,OAAO,SACd,OAAO,MAAM,CAAC,UAAU,YAAY,KAAK,KAAK,KAAK,OAAO,KAAK,KAAK,GAAG;AAAA;AAI3E,SAAS,sBAAsB,CAAC,OAAe,OAAoB;AAAA,EACjE,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,MAAM,IAAI,IAAI,KAAK;AAAA,IACnB,MAAM;AAAA,IACN,MAAM,IAAI,MAAM,GAAG,0BAA0B;AAAA;AAAA,EAE/C,IAAI,IAAI,YAAY,IAAI;AAAA,IAAU,MAAM,IAAI,MAAM,GAAG,wCAAwC;AAAA,EAC7F,OAAO;AAAA;AAGF,SAAS,sBAAsB,CAAC,OAAqB;AAAA,EAC1D,MAAM,MAAM,uBAAuB,OAAO,mBAAmB;AAAA,EAC7D,IAAI,IAAI,aAAa;AAAA,IAAU;AAAA,EAC/B,IAAI,IAAI,aAAa,WAAW,mBAAmB,IAAI,QAAQ;AAAA,IAAG;AAAA,EAClE,MAAM,IAAI,MAAM,+CAA+C;AAAA;AAG1D,SAAS,oBAAoB,CAAC,OAAqB;AAAA,EACxD,MAAM,MAAM,uBAAuB,OAAO,iBAAiB;AAAA,EAC3D,IAAI,IAAI,aAAa,YAAY,IAAI,aAAa;AAAA,IAAQ;AAAA,EAC1D,KAAK,IAAI,aAAa,WAAW,IAAI,aAAa,UAAU,mBAAmB,IAAI,QAAQ,GAAG;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,MAAM,IAAI,MAAM,oDAAoD;AAAA;;;ADO/D,SAAS,YAAY,GAAW;AAAA,EACrC,OAAO,QAAQ,UAAU,iBAAiB;AAAA;AAG5C,SAAS,SAAS,CAAC,OAAwB;AAAA,EACzC,OAAO,eAAe,KAAK,KAAK;AAAA;AAGlC,SAAS,UAAU,CAAC,OAAwB;AAAA,EAC1C,OAAO,wBAAwB,KAAK,KAAK;AAAA;AAG3C,SAAS,aAAa,CAAC,KAAyC;AAAA,EAC9D,MAAM,UAAU,OAAO,IAAI,YAAY,WAAW,IAAI,QAAQ,KAAK,EAAE,QAAQ,QAAQ,EAAE,IAAI;AAAA,EAC3F,MAAM,QAAQ,OAAO,IAAI,UAAU,WAAW,IAAI,MAAM,KAAK,EAAE,QAAQ,QAAQ,EAAE,IAAI;AAAA,EACrF,MAAM,SAAS,OAAO,IAAI,WAAW,WAAW,IAAI,OAAO,KAAK,IAAI;AAAA,EACpE,MAAM,SAAS,OAAO,IAAI,WAAW,WAAW,IAAI,OAAO,KAAK,IAAI;AAAA,EACpE,KAAK,YAAY,UAAU,OAAO,GAAG;AAAA,IACnC,MAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AAAA,EACA,IAAI,UAAU,WAAW,KAAK;AAAA,IAAG,MAAM,IAAI,MAAM,sCAAsC;AAAA,EACvF,KAAK;AAAA,IAAQ,MAAM,IAAI,MAAM,+BAA+B;AAAA,EAC5D,KAAK;AAAA,IAAQ,MAAM,IAAI,MAAM,+BAA+B;AAAA,EAC5D,uBAAuB,OAAO;AAAA,EAC9B,IAAI;AAAA,IAAO,qBAAqB,KAAK;AAAA,EACrC,OAAO;AAAA,OACD,OAAO,IAAI,MAAM,WAAW,EAAE,GAAG,IAAI,EAAE,IAAI,CAAC;AAAA,IAChD;AAAA,OACI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IACzB;AAAA,IACA;AAAA,EACF;AAAA;AAIK,SAAS,eAAe,CAAC,MAAyB;AAAA,EACvD,MAAM,UAAU,KAAK,KAAK;AAAA,EAC1B,KAAK;AAAA,IAAS,MAAM,IAAI,MAAM,sBAAsB;AAAA,EACpD,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,UAAU,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,OAAO;AAAA,IAC5D,MAAM;AAAA,IACN,MAAM,IAAI,MAAM,oCAAoC;AAAA;AAAA,EAEtD,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,SAAS,KAAK,MAAM,OAAO;AAAA,IAC3B,MAAM;AAAA,IACN,MAAM,IAAI,MAAM,qCAAqC;AAAA;AAAA,EAEvD,KAAK,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAAA,IAClE,MAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AAAA,EACA,OAAO,cAAc,MAAiC;AAAA;AAaxD,IAAM,qBAAqB;AAE3B,SAAS,YAAY,GAAW;AAAA,EAC9B,OAAO,QAAQ,UAAU,kBAAkB;AAAA;AAG7C,SAAS,cAAc,CAAC,KAAsB;AAAA,EAC5C,KAAK,OAAO,cAAc,GAAG,KAAK,OAAO;AAAA,IAAG,OAAO;AAAA,EACnD,IAAI;AAAA,IACF,QAAQ,KAAK,KAAK,CAAC;AAAA,IACnB,OAAO;AAAA,IACP,OAAO,OAAO;AAAA,IACd,OAAQ,MAAgC,SAAS;AAAA;AAAA;AAK9C,SAAS,sBAAyB,CAAC,WAAuB;AAAA,EAC/D,MAAM,WAAW,aAAa;AAAA,EAC9B,MAAM,YAAY,QAAQ,UAAU,YAAY;AAAA,EAChD,MAAM,QAAuB,EAAE,KAAK,QAAQ,KAAK,OAAO,WAAW,EAAE;AAAA,EACrE,UAAU,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAAA,EAEhD,SAAS,UAAU,IAAK,WAAW,GAAG;AAAA,IACpC,IAAI,UAAU;AAAA,IACd,IAAI;AAAA,MACF,UAAU,UAAU,EAAE,MAAM,IAAM,CAAC;AAAA,MACnC,UAAU;AAAA,MACV,cAAc,WAAW,GAAG,KAAK,UAAU,KAAK;AAAA,GAAO,EAAE,MAAM,IAAM,CAAC;AAAA,MACtE,MAAM,UAAU,SAAS,WAAW,GAAG;AAAA,MACvC,IAAI;AAAA,QACF,UAAU,OAAO;AAAA,gBACjB;AAAA,QACA,UAAU,OAAO;AAAA;AAAA,MAEnB;AAAA,MACA,OAAO,OAAO;AAAA,MACd,IAAI,SAAS;AAAA,QACX,OAAO,UAAU,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,QACjD,MAAM;AAAA,MACR;AAAA,MACA,IAAK,MAAgC,SAAS;AAAA,QAAU,MAAM;AAAA,MAC9D,IAAI,UAAgC;AAAA,MACpC,IAAI;AAAA,QACF,UAAU,KAAK,MAAM,aAAa,WAAW,MAAM,CAAC;AAAA,QACpD,MAAM;AAAA,MAIR,IAAI;AAAA,MACJ,IAAI;AAAA,QACF,QAAQ,KAAK,IAAI,IAAI,SAAS,QAAQ,EAAE;AAAA,QACxC,OAAO,WAAW;AAAA,QAClB,IAAK,UAAoC,SAAS;AAAA,UAAU;AAAA,QAC5D,MAAM;AAAA;AAAA,MAER,IAAK,WAAW,eAAe,QAAQ,GAAG,MAAQ,WAAW,SAAS,oBAAqB;AAAA,QACzF,MAAM,IAAI,MAAM,6DAA6D,UAAU;AAAA,MACzF;AAAA,MACA,IAAI,UAAU,GAAG;AAAA,QACf,MAAM,IAAI,MAAM,yDAAyD,UAAU;AAAA,MACrF;AAAA,MACA,MAAM,YAAY,GAAG,kBAAkB,QAAQ,OAAO,WAAW;AAAA,MACjE,IAAI;AAAA,QACF,WAAW,UAAU,SAAS;AAAA,QAC9B,OAAO,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,QAClD,OAAO,YAAY;AAAA,QACnB,IAAK,WAAqC,SAAS;AAAA,UAAU,MAAM;AAAA;AAAA;AAAA,EAGzE;AAAA,EAEA,IAAI;AAAA,IACF,OAAO,UAAU;AAAA,YACjB;AAAA,IACA,IAAI;AAAA,MACF,MAAM,UAAU,KAAK,MAAM,aAAa,WAAW,MAAM,CAAC;AAAA,MAC1D,IAAI,QAAQ,QAAQ,MAAM,OAAO,QAAQ,UAAU,MAAM,OAAO;AAAA,QAC9D,OAAO,UAAU,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,MACnD;AAAA,MACA,MAAM;AAAA;AAAA;AAMZ,SAAS,UAAU,CAAC,MAAiB,OAA2B;AAAA,EAC9D,OACE,KAAK,YAAY,MAAM,WACvB,KAAK,UAAU,MAAM,SACrB,KAAK,WAAW,MAAM,UACtB,KAAK,WAAW,MAAM;AAAA;AAI1B,SAAS,cAAc,CAAC,MAA4B;AAAA,EAClD,OAAO,cAAc;AAAA,IACnB,GAAG,KAAK;AAAA,IACR,SAAS,KAAK;AAAA,IACd,OAAO,KAAK;AAAA,IACZ,QAAQ,KAAK;AAAA,IACb,QAAQ,KAAK;AAAA,EACf,CAAC;AAAA;AAII,SAAS,oBAAoB,CAAC,MAAyB;AAAA,EAC5D,OAAO,WAAW,QAAQ,EACvB,OAAO,KAAK,UAAU,eAAe,IAAI,CAAC,CAAC,EAC3C,OAAO,WAAW;AAAA;AAGvB,SAAS,iBAAiB,CAAC,OAAO,aAAa,GAAqB;AAAA,EAClE,KAAK,WAAW,IAAI;AAAA,IAAG,OAAO;AAAA,EAC9B,MAAM,SAAS,KAAK,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,EACrD,KAAK,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAAA,IAClE,MAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AAAA,EACA,OAAO,cAAc,MAAiC;AAAA;AAIjD,SAAS,eAAe,CAAC,MAA0B;AAAA,EACxD,IAAI;AAAA,IACF,MAAM,YAAY,kBAAkB;AAAA,IACpC,OAAO,cAAc,QAAQ,WAAW,WAAW,eAAe,IAAI,CAAC;AAAA,IACvE,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAUJ,SAAS,mBAAmB,CAAC,MAAiB,UAA2B,CAAC,GAAW;AAAA,EAC1F,MAAM,OAAO,aAAa;AAAA,EAC1B,MAAM,YAAY,QAAQ,IAAI;AAAA,EAC9B,MAAM,aAAa,eAAe,IAAI;AAAA,EACtC,UAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AAAA,EAExC,IAAI,WAAW,IAAI,GAAG;AAAA,IACpB,IAAI,UAAU,IAAI,EAAE,eAAe,GAAG;AAAA,MACpC,MAAM,IAAI,MAAM,oDAAoD,MAAM;AAAA,IAC5E;AAAA,IACA,IAAI,WAA6B;AAAA,IACjC,IAAI;AAAA,MACF,WAAW,kBAAkB,IAAI;AAAA,MACjC,OAAO,OAAO;AAAA,MACd,KAAK,QAAQ,iBAAiB;AAAA,QAC5B,MAAM,IAAI,MACR,+BAA+B,iDAC/B,EAAE,OAAO,MAAM,CACjB;AAAA,MACF;AAAA;AAAA,IAEF,IAAI,YAAY,WAAW,UAAU,UAAU,GAAG;AAAA,MAChD,UAAU,MAAM,GAAK;AAAA,MACrB,MAAM,SAAS,SAAS,MAAM,GAAG;AAAA,MACjC,IAAI;AAAA,QACF,UAAU,MAAM;AAAA,gBAChB;AAAA,QACA,UAAU,MAAM;AAAA;AAAA,MAElB,MAAM,cAAc,SAAS,WAAW,GAAG;AAAA,MAC3C,IAAI;AAAA,QACF,UAAU,WAAW;AAAA,gBACrB;AAAA,QACA,UAAU,WAAW;AAAA;AAAA,MAEvB,OAAO;AAAA,IACT;AAAA,IACA,KAAK,QAAQ,iBAAiB;AAAA,MAC5B,MAAM,IAAI,MACR,8BAA8B,WAAW,OAAO,SAAS,WAAW,yEACtE;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,QAAQ,WAAW,oBAAoB,QAAQ,OAAO,WAAW,OAAO;AAAA,EAC9F,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,KAAK,SAAS,eAAe,MAAM,GAAK;AAAA,IACxC,cAAc,IAAI,GAAG,KAAK,UAAU,YAAY,MAAM,CAAC;AAAA,GAAO,MAAM;AAAA,IACpE,UAAU,EAAE;AAAA,IACZ,UAAU,EAAE;AAAA,IACZ,KAAK;AAAA,IACL,IAAI,QAAQ,iBAAiB;AAAA,MAC3B,WAAW,eAAe,IAAI;AAAA,IAChC,EAAO;AAAA,MAGL,SAAS,eAAe,IAAI;AAAA,MAC5B,WAAW,aAAa;AAAA;AAAA,IAE1B,UAAU,MAAM,GAAK;AAAA,IACrB,MAAM,cAAc,SAAS,WAAW,GAAG;AAAA,IAC3C,IAAI;AAAA,MACF,UAAU,WAAW;AAAA,cACrB;AAAA,MACA,UAAU,WAAW;AAAA;AAAA,IAEvB,OAAO,OAAO;AAAA,IACd,IAAI,OAAO;AAAA,MAAW,UAAU,EAAE;AAAA,IAClC,IAAI,WAAW,aAAa;AAAA,MAAG,WAAW,aAAa;AAAA,IACvD,MAAM;AAAA;AAAA,EAER,OAAO;AAAA;AAGF,SAAS,QAAQ,CAAC,MAAiB,UAA2B,CAAC,GAAW;AAAA,EAC/E,OAAO,uBAAuB,MAAM,oBAAoB,MAAM,OAAO,CAAC;AAAA;AASjE,SAAS,QAAQ,GAAqB;AAAA,EAC3C,MAAM,UAAU,QAAQ,IAAI,mBAAmB,KAAK;AAAA,EACpD,MAAM,SAAS,QAAQ,IAAI,eAAe,KAAK;AAAA,EAC/C,MAAM,SAAS,QAAQ,IAAI,mBAAmB,KAAK;AAAA,EACnD,MAAM,QAAQ,QAAQ,IAAI,iBAAiB,KAAK;AAAA,EAChD,IAAI,WAAW,UAAU,QAAQ;AAAA,IAC/B,IAAI;AAAA,MACF,OAAO,cAAc,EAAE,SAAS,OAAO,QAAQ,OAAO,CAAC;AAAA,MACvD,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK,EAAE,IAAI,GAAG,sEAAsE;AAAA,MAC3F,OAAO;AAAA;AAAA,EAEX;AAAA,EACA,IAAI,WAAW,UAAU,QAAQ;AAAA,IAC/B,OAAO,KACL,6GACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,aAAa;AAAA,EAC1B,KAAK,WAAW,IAAI;AAAA,IAAG,OAAO;AAAA,EAC9B,IAAI;AAAA,IACF,MAAM,SAAS,KAAK,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,IACrD,KAAK,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM;AAAA,MAAG,OAAO;AAAA,IAC3E,OAAO,cAAc,MAAiC;AAAA,IACtD,OAAO,KAAK;AAAA,IACZ,OAAO,KAAK,EAAE,KAAK,KAAK,GAAG,iCAAiC;AAAA,IAC5D,OAAO;AAAA;AAAA;",
-  "debugId": "4EF2651906A11C3664756E2164756E21",
-  "names": []
-}