openmeld 0.3.42

package/dist/daemon-runtime-lease-B9LdD-he.js

@@ -0,0 +1,702 @@
+#!/usr/bin/env node
+
+import { H as acquireLock, Ht as resolveOpenMeldPresetOwnedPathInput, Jt as systemDir, K as readLockMeta, Q as tryCleanupStaleLock, Ut as resolveOpenMeldRootDir, Vt as resolveOpenMeldEnvPreset, Wt as runtimeDir, Z as runWithHeldLock, hn as __exportAll, q as releaseLock } from "./base-url-Bdqmyw0D.js";
+import { n as daemonServiceControllerSchema } from "./service-contract-DZWQdPz5.js";
+import { tmpdir } from "node:os";
+import { z } from "zod/v4";
+import { dirname, join } from "node:path";
+import { createHash, randomBytes } from "node:crypto";
+import { chmod, mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region ../../packages/schemas/dist/schemas/daemon/runtime-lease.js
+const daemonRuntimeLeaseModeSchema = z.enum(["foreground", "background"]);
+const daemonRuntimeLeaseSchema = z.strictObject({
+	schema: z.literal("openmeld-daemon-runtime-lease-v1"),
+	v: z.literal(1),
+	generation: z.int().nonnegative(),
+	bundleId: z.string().min(1),
+	pid: z.int().positive(),
+	mode: daemonRuntimeLeaseModeSchema,
+	startedAt: z.string().min(1),
+	updatedAt: z.string().min(1),
+	heartbeatAt: z.string().nullable(),
+	serviceController: daemonServiceControllerSchema,
+	managedBySystemService: z.boolean()
+});
+//#endregion
+//#region src/config/daemon-local-state-file.ts
+async function readDaemonLocalStateFile(input) {
+	const raw = await readFile(input.path, "utf8").catch((error) => {
+		if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return null;
+		throw error;
+	});
+	if (raw === null) return null;
+	const parsedJson = safeParseJson(raw);
+	if (parsedJson === null) return null;
+	const parsed = input.schema.safeParse(parsedJson);
+	return parsed.success ? parsed.data : null;
+}
+async function writeDaemonLocalStateFile(input) {
+	const parsed = input.schema.safeParse(input.value);
+	if (!parsed.success) throw new Error(`invalid daemon local state for ${input.path}`);
+	await mkdir(dirname(input.path), { recursive: true });
+	const tempPath = `${input.path}.tmp-${process.pid}-${Date.now()}`;
+	let shouldCleanupTemp = true;
+	try {
+		await writeFile(tempPath, `${JSON.stringify(parsed.data, null, 2)}\n`, {
+			encoding: "utf8",
+			...typeof input.mode === "number" ? { mode: input.mode } : {}
+		});
+		await rename(tempPath, input.path);
+		if (typeof input.mode === "number") await chmod(input.path, input.mode);
+		shouldCleanupTemp = false;
+	} finally {
+		if (shouldCleanupTemp) await rm(tempPath, { force: true }).catch(() => void 0);
+	}
+}
+function safeParseJson(raw) {
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/config/daemon-state.ts
+const DAEMON_STATE_SCHEMA = "openmeld-daemon-install-v1";
+const DAEMON_SERVICE_RUNTIME_STATE_SCHEMA = "openmeld-daemon-service-state-v1";
+const DAEMON_SERVICE_RUNTIME_MODE_ENV = "OPENMELD_DAEMON_RUNTIME_MODE";
+const DAEMON_SERVICE_RUNTIME_DETACHED_ENV = "OPENMELD_DAEMON_RUNTIME_DETACHED";
+const DAEMON_SERVICE_RUNTIME_CONTROLLER_ENV = "OPENMELD_DAEMON_SERVICE_CONTROLLER";
+const DAEMON_SERVICE_RUNTIME_AUTO_START_ENV = "OPENMELD_DAEMON_SERVICE_AUTO_START";
+const DAEMON_SERVICE_RUNTIME_SYSTEM_SERVICE_ENV = "OPENMELD_DAEMON_RUNTIME_SYSTEM_SERVICE";
+const DAEMON_TOKEN_SCHEMA = "openmeld-daemon-token-v1";
+const DAEMON_TOKEN_ROTATE_MAX_AGE_MS = 1440 * 60 * 1e3;
+const DAEMON_HEARTBEAT_STALE_MS = 180 * 1e3;
+const DAEMON_ACTIVE_BUNDLE_STATE_FILENAME = "active-bundle.json";
+const DAEMON_DISPATCH_JOURNAL_FILENAME = "daemon-dispatch-journal.jsonl";
+const DAEMON_LIFECYCLE_JOURNAL_FILENAME = "daemon-lifecycle-journal.jsonl";
+const DAEMON_REPAIR_JOURNAL_FILENAME = "repair-journal.json";
+const DAEMON_SERVICE_LOCK_PROFILE = "daemon-service";
+const DAEMON_SERVICE_LOCK_KEY = "daemon-service-run";
+const daemonServiceLifecycleLockContext = new AsyncLocalStorage();
+const DAEMON_STABLE_LAUNCHER_FILENAME = "daemon-service-launcher.mjs";
+const DAEMON_SERVICE_EXECUTABLE_WRAPPER_FILENAME_BY_PRESET = {
+	prod: "OpenMeld Service",
+	"dev-local": "OpenMeld Service Dev",
+	canary: "OpenMeld Service Canary"
+};
+const DAEMON_SERVICE_LEGACY_EXECUTABLE_WRAPPER_FILENAME_BY_PRESET = {
+	prod: "openmeld-service",
+	"dev-local": "openmeld-dev-service",
+	canary: "openmeld-canary-service"
+};
+const DAEMON_SERVICE_LIFECYCLE_LOCK_PROFILE = DAEMON_SERVICE_LOCK_PROFILE;
+const DAEMON_SERVICE_LIFECYCLE_LOCK_KEY = DAEMON_SERVICE_LOCK_KEY;
+async function getDaemonStatus(pathInput = {}) {
+	const [state, runtimeExists] = await Promise.all([readDaemonInstallState(pathInput), pathExists(daemonRuntimeRootPath(pathInput))]);
+	if (state && runtimeExists) return {
+		installed: true,
+		state
+	};
+	return {
+		installed: false,
+		state: null
+	};
+}
+async function getDaemonRuntimeStatus(pathInput = {}) {
+	const state = await readDaemonServiceRuntimeState(pathInput);
+	if (!state) return {
+		status: "not_running",
+		mode: null,
+		pid: null,
+		startedAt: null,
+		updatedAt: null,
+		managedBySystemService: false,
+		serviceController: "unknown",
+		autoStart: false
+	};
+	if (!Number.isInteger(state.pid) || state.pid <= 0) return {
+		status: "stale",
+		mode: state.mode,
+		pid: state.pid,
+		startedAt: state.startedAt,
+		updatedAt: state.updatedAt,
+		managedBySystemService: state.managedBySystemService,
+		serviceController: state.serviceController,
+		autoStart: state.autoStart,
+		reason: "invalid_pid"
+	};
+	if (!isPidAlive(state.pid)) return {
+		status: "stale",
+		mode: state.mode,
+		pid: state.pid,
+		startedAt: state.startedAt,
+		updatedAt: state.updatedAt,
+		managedBySystemService: state.managedBySystemService,
+		serviceController: state.serviceController,
+		autoStart: state.autoStart,
+		reason: "process_not_alive"
+	};
+	if (isDaemonServiceRuntimeHeartbeatStale(state)) return {
+		status: "stale",
+		mode: state.mode,
+		pid: state.pid,
+		startedAt: state.startedAt,
+		updatedAt: state.updatedAt,
+		managedBySystemService: state.managedBySystemService,
+		serviceController: state.serviceController,
+		autoStart: state.autoStart,
+		reason: "heartbeat_stale"
+	};
+	return {
+		status: "running",
+		mode: state.mode,
+		pid: state.pid,
+		startedAt: state.startedAt,
+		updatedAt: state.updatedAt,
+		managedBySystemService: state.managedBySystemService,
+		serviceController: state.serviceController,
+		autoStart: state.autoStart
+	};
+}
+async function readDaemonServiceRuntimeSnapshot(pathInput = {}) {
+	return await readDaemonServiceRuntimeState(pathInput);
+}
+function resolveDaemonServiceRuntimeMetadata(input = {}) {
+	const env = input.env ?? process.env;
+	const managedBySystemService = input.managedBySystemService === true || env["OPENMELD_DAEMON_RUNTIME_SYSTEM_SERVICE"] === "1";
+	const serviceControllerInput = typeof input.serviceController === "string" && input.serviceController.length > 0 ? input.serviceController : env[DAEMON_SERVICE_RUNTIME_CONTROLLER_ENV];
+	const autoStart = input.autoStart === true || env["OPENMELD_DAEMON_SERVICE_AUTO_START"] === "1";
+	return {
+		managedBySystemService,
+		serviceController: parseDaemonServiceController(serviceControllerInput),
+		autoStart
+	};
+}
+async function setDaemonServiceRuntimeState(state, pathInput = {}) {
+	await writeDaemonServiceRuntimeState(state, pathInput);
+}
+async function clearDaemonServiceRuntimeState(pathInput = {}) {
+	const { clearDaemonRuntimeLease } = await Promise.resolve().then(() => daemon_runtime_lease_exports);
+	await Promise.all([rm(daemonServiceRuntimeStatePath(pathInput), { force: true }), clearDaemonRuntimeLease(pathInput)]);
+}
+function withDaemonServiceRunLock(callback, meta = {
+	intent: "run_background",
+	command: "openmeld service start"
+}) {
+	return withDaemonServiceLifecycleLock(meta, callback);
+}
+async function acquireDaemonServiceLifecycleLock(meta = {
+	intent: "run_background",
+	command: "openmeld service start"
+}, pathResolution = resolveOpenMeldPresetOwnedPathInput()) {
+	return await acquireLock({
+		openMeldProfileId: DAEMON_SERVICE_LIFECYCLE_LOCK_PROFILE,
+		key: DAEMON_SERVICE_LIFECYCLE_LOCK_KEY,
+		meta,
+		pathResolution
+	});
+}
+async function releaseDaemonServiceLifecycleLock(lock) {
+	await releaseLock(lock);
+}
+function withDaemonServiceStopLock(callback, meta = {
+	intent: "stop",
+	command: "openmeld service stop"
+}) {
+	return withDaemonServiceLifecycleLock(meta, callback);
+}
+function withDaemonServiceReconcileLock(callback, meta = {
+	intent: "upgrade_reconcile",
+	command: "openmeld service update"
+}) {
+	return withDaemonServiceLifecycleLock(meta, callback);
+}
+function withDaemonServiceRegistrationMutationLock(callback, meta) {
+	return withDaemonServiceLifecycleLock(meta, callback);
+}
+function withDaemonServiceLifecycleLock(meta, callback) {
+	const pathResolution = resolveOpenMeldPresetOwnedPathInput();
+	const ownerRoot = resolveOpenMeldRootDir(pathResolution);
+	const currentContext = daemonServiceLifecycleLockContext.getStore();
+	if (currentContext?.active && currentContext.ownerRoot === ownerRoot) {
+		let operation;
+		try {
+			operation = callback();
+		} catch (error) {
+			operation = Promise.reject(error);
+		}
+		let trackedOperation;
+		trackedOperation = operation.then(() => void 0, (error) => {
+			currentContext.failures.push(error);
+		}).finally(() => {
+			currentContext.pendingOperations.delete(trackedOperation);
+		});
+		currentContext.pendingOperations.add(trackedOperation);
+		return operation;
+	}
+	return withDaemonServiceLifecycleOwnerLock({
+		callback,
+		meta,
+		ownerRoot,
+		pathResolution
+	});
+}
+async function withDaemonServiceLifecycleOwnerLock(input) {
+	return await runWithHeldLock({
+		lock: await acquireDaemonServiceLifecycleLock(input.meta, input.pathResolution),
+		run: async () => {
+			const context = {
+				active: true,
+				failures: [],
+				ownerRoot: input.ownerRoot,
+				pendingOperations: /* @__PURE__ */ new Set()
+			};
+			let outcome;
+			try {
+				outcome = {
+					ok: true,
+					value: await daemonServiceLifecycleLockContext.run(context, input.callback)
+				};
+			} catch (error) {
+				outcome = {
+					ok: false,
+					error
+				};
+			} finally {
+				while (context.pendingOperations.size > 0) await Promise.all([...context.pendingOperations]);
+				context.active = false;
+			}
+			const failures = [...outcome.ok ? [] : [outcome.error], ...context.failures].filter((failure, index, allFailures) => allFailures.indexOf(failure) === index);
+			if (failures.length === 1) throw failures[0];
+			if (failures.length > 1) throw new AggregateError(failures, "daemon service lifecycle mutation failed in more than one operation");
+			if (!outcome.ok) throw outcome.error;
+			return outcome.value;
+		},
+		releaseContext: {
+			command: input.meta.command,
+			component: "daemon_service_lifecycle",
+			intent: input.meta.intent,
+			lockKey: DAEMON_SERVICE_LIFECYCLE_LOCK_KEY,
+			openMeldProfileId: DAEMON_SERVICE_LIFECYCLE_LOCK_PROFILE
+		}
+	});
+}
+async function readDaemonServiceLifecycleLockMeta() {
+	const meta = await readLockMeta({
+		openMeldProfileId: DAEMON_SERVICE_LIFECYCLE_LOCK_PROFILE,
+		key: DAEMON_SERVICE_LIFECYCLE_LOCK_KEY,
+		pathResolution: resolveOpenMeldPresetOwnedPathInput()
+	});
+	if (!meta) return null;
+	const intent = typeof meta.intent === "string" ? normalizeDaemonLifecycleIntent(meta.intent) : null;
+	const command = typeof meta.command === "string" ? meta.command.trim() : "";
+	if (!intent || command.length === 0) return null;
+	const pid = typeof meta.pid === "number" ? meta.pid : void 0;
+	const sessionId = typeof meta.sessionId === "string" && meta.sessionId.trim().length > 0 ? meta.sessionId.trim() : void 0;
+	const at = typeof meta.at === "string" && meta.at.trim().length > 0 ? meta.at.trim() : void 0;
+	return {
+		intent,
+		command,
+		...typeof pid === "number" ? { pid } : {},
+		...sessionId ? { sessionId } : {},
+		...at ? { at } : {}
+	};
+}
+async function readDaemonServiceLifecycleLockMetaWithCleanup() {
+	await tryCleanupStaleLock({
+		openMeldProfileId: DAEMON_SERVICE_LIFECYCLE_LOCK_PROFILE,
+		key: DAEMON_SERVICE_LIFECYCLE_LOCK_KEY,
+		pathResolution: resolveOpenMeldPresetOwnedPathInput()
+	});
+	return await readDaemonServiceLifecycleLockMeta();
+}
+async function installDaemon(input) {
+	const existingState = await readDaemonInstallState();
+	const runtimeExists = await pathExists(daemonRuntimeRootPath());
+	if (existingState && runtimeExists && existingState.daemonVersion === input.daemonVersion) {
+		await ensureDaemonTokenState();
+		return {
+			status: "already_installed",
+			state: existingState
+		};
+	}
+	await ensureDaemonRuntimeLayout();
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const nextState = {
+		v: 1,
+		schema: DAEMON_STATE_SCHEMA,
+		daemonVersion: input.daemonVersion,
+		installSource: input.source,
+		installedAt: existingState?.installedAt ?? now,
+		updatedAt: now
+	};
+	await writeDaemonInstallState(nextState);
+	await ensureDaemonTokenState();
+	return {
+		status: "installed",
+		state: nextState
+	};
+}
+async function uninstallDaemon(pathInput = {}) {
+	const [hasState, hasRuntimeDir, hasToken] = await Promise.all([
+		pathExists(daemonStatePath(pathInput)),
+		pathExists(daemonRuntimeRootPath(pathInput)),
+		pathExists(daemonTokenPath(pathInput))
+	]);
+	await Promise.all([
+		rm(daemonStatePath(pathInput), { force: true }),
+		rm(daemonTokenPath(pathInput), { force: true }),
+		rm(daemonServiceRuntimeStatePath(pathInput), { force: true }),
+		rm(daemonRuntimeRootPath(pathInput), {
+			recursive: true,
+			force: true
+		})
+	]);
+	return { removed: hasState || hasRuntimeDir || hasToken };
+}
+function daemonStatePath(pathInput = {}) {
+	return join(systemDir(pathInput), "daemon-install.json");
+}
+function daemonRuntimeRootPath(pathInput = {}) {
+	return join(runtimeDir(pathInput), "daemon");
+}
+function daemonServiceRuntimeStatePath(pathInput = {}) {
+	return join(daemonRuntimeRootPath(pathInput), "service-runtime.json");
+}
+function daemonRuntimeDataPath(pathInput = {}) {
+	return join(daemonRuntimeRootPath(pathInput), "data");
+}
+function daemonRuntimeBundlesPath(pathInput = {}) {
+	return join(daemonRuntimeRootPath(pathInput), "bundles");
+}
+function daemonRuntimeStateRootPath(pathInput = {}) {
+	return join(daemonRuntimeRootPath(pathInput), "state");
+}
+function daemonLifecycleJournalPath(pathInput = {}) {
+	return join(daemonRuntimeRootPath(pathInput), "logs", DAEMON_LIFECYCLE_JOURNAL_FILENAME);
+}
+function daemonDispatchJournalPath(pathInput = {}) {
+	return join(daemonRuntimeRootPath(pathInput), "logs", DAEMON_DISPATCH_JOURNAL_FILENAME);
+}
+function daemonServiceActiveBundleStatePath(pathInput = {}) {
+	return join(daemonRuntimeStateRootPath(pathInput), DAEMON_ACTIVE_BUNDLE_STATE_FILENAME);
+}
+function daemonServiceRepairJournalPath(pathInput = {}) {
+	return join(daemonRuntimeStateRootPath(pathInput), DAEMON_REPAIR_JOURNAL_FILENAME);
+}
+function daemonRuntimeServiceManagerPath(pathInput = {}) {
+	return join(daemonRuntimeRootPath(pathInput), "service-manager");
+}
+function daemonServiceStableLauncherPath(pathInput = {}) {
+	return join(daemonRuntimeServiceManagerPath(pathInput), DAEMON_STABLE_LAUNCHER_FILENAME);
+}
+function daemonServiceStableExecutableWrapperPath(pathInput = {}) {
+	const preset = resolveOpenMeldEnvPreset(pathInput);
+	return join(daemonRuntimeServiceManagerPath(pathInput), DAEMON_SERVICE_EXECUTABLE_WRAPPER_FILENAME_BY_PRESET[preset]);
+}
+function daemonServiceLegacyExecutableWrapperPath(pathInput = {}) {
+	const preset = resolveOpenMeldEnvPreset(pathInput);
+	return join(daemonRuntimeServiceManagerPath(pathInput), DAEMON_SERVICE_LEGACY_EXECUTABLE_WRAPPER_FILENAME_BY_PRESET[preset]);
+}
+function daemonServiceRecognizedExecutableWrapperPaths(pathInput = {}) {
+	return [daemonServiceStableExecutableWrapperPath(pathInput), daemonServiceLegacyExecutableWrapperPath(pathInput)];
+}
+function daemonTokenPath(pathInput = {}) {
+	return join(systemDir(pathInput), "daemon-token.json");
+}
+async function restoreDaemonInstallStateSnapshot(snapshot, pathInput = {}) {
+	if (!snapshot) {
+		await rm(daemonStatePath(pathInput), { force: true });
+		return;
+	}
+	await writeDaemonInstallState(snapshot, pathInput);
+}
+function resolveDaemonControlPlaneEndpoint(pathInput = {}) {
+	const runtimeRoot = daemonRuntimeRootPath(pathInput);
+	const suffix = createHash("sha256").update(runtimeRoot).digest("hex").slice(0, 24);
+	if (process.platform === "win32") return `\\\\.\\pipe\\openmeld-daemon-control-${suffix}`;
+	return join(tmpdir(), `openmeld-daemon-control-${suffix}.sock`);
+}
+async function ensureDaemonControlPlaneToken(pathInput = {}) {
+	return (await ensureDaemonTokenState(pathInput)).token;
+}
+async function readDaemonControlPlaneToken(pathInput = {}) {
+	return (await readDaemonTokenState(pathInput))?.token ?? null;
+}
+function isPidAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return !(error instanceof Error && error.code === "ESRCH");
+	}
+}
+async function readDaemonServiceRuntimeState(pathInput = {}) {
+	const raw = await readFile(daemonServiceRuntimeStatePath(pathInput), "utf8").catch((error) => {
+		if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return null;
+		throw error;
+	});
+	if (raw === null) return null;
+	return parseDaemonServiceRuntimeState(raw);
+}
+function parseDaemonServiceRuntimeState(raw) {
+	try {
+		const parsed = JSON.parse(raw);
+		if (!isDaemonServiceRuntimeStateObject(parsed)) return null;
+		return {
+			v: 1,
+			schema: DAEMON_SERVICE_RUNTIME_STATE_SCHEMA,
+			status: "running",
+			pid: parsed.pid,
+			mode: parsed.mode,
+			command: parsed.command,
+			gatewayUrl: parseNullableString(parsed.gatewayUrl),
+			openMeldProfileId: resolveStoredDaemonServiceOpenMeldProfileId(parsed),
+			stopRequestedAt: parseNullableString(parsed.stopRequestedAt),
+			heartbeatAt: parseNullableString(parsed.heartbeatAt),
+			startedAt: parsed.startedAt,
+			updatedAt: parsed.updatedAt,
+			managedBySystemService: parsed.managedBySystemService === true,
+			serviceController: parseDaemonServiceController(parsed.serviceController),
+			autoStart: parsed.autoStart === true
+		};
+	} catch {
+		return null;
+	}
+}
+function isDaemonServiceRuntimeStateObject(value) {
+	if (!value || typeof value !== "object") return false;
+	const candidate = value;
+	return candidate.v === 1 && candidate.schema === "openmeld-daemon-service-state-v1" && candidate.status === "running" && typeof candidate.pid === "number" && candidate.pid > 0 && (candidate.mode === "foreground" || candidate.mode === "background") && typeof candidate.command === "string" && candidate.command.length > 0 && isValidNullableString(candidate.gatewayUrl) && isValidOptionalNullableString(candidate.openMeldProfileId) && isValidOptionalNullableString(candidate.profile) && isValidNullableString(candidate.stopRequestedAt) && isValidNullableString(candidate.heartbeatAt) && typeof candidate.startedAt === "string" && candidate.startedAt.length > 0 && typeof candidate.updatedAt === "string" && candidate.updatedAt.length > 0;
+}
+function parseDaemonServiceController(value) {
+	if (value === "launchd" || value === "systemd" || value === "windows-service" || value === "legacy-detached" || value === "unknown") return value;
+	return "unknown";
+}
+function isValidNullableString(value) {
+	return value === null || typeof value === "string";
+}
+function isValidOptionalNullableString(value) {
+	return value === void 0 || value === null || typeof value === "string";
+}
+function parseNullableString(value) {
+	if (value === null) return null;
+	if (typeof value !== "string") return null;
+	return value;
+}
+function resolveStoredDaemonServiceOpenMeldProfileId(input) {
+	const openMeldProfileId = parseNullableString(input.openMeldProfileId);
+	const legacyProfile = parseNullableString(input.profile);
+	if (openMeldProfileId && legacyProfile && openMeldProfileId !== legacyProfile) throw new Error("conflicting openMeldProfileId values");
+	return openMeldProfileId ?? legacyProfile;
+}
+function isDaemonServiceRuntimeHeartbeatStale(state) {
+	const latestSignalAt = Math.max(parseIsoTimestampOrZero(state.heartbeatAt), parseIsoTimestampOrZero(state.updatedAt));
+	if (latestSignalAt <= 0) return false;
+	return Date.now() - latestSignalAt > DAEMON_HEARTBEAT_STALE_MS;
+}
+function parseIsoTimestampOrZero(value) {
+	if (!value) return 0;
+	const parsed = Date.parse(value);
+	return Number.isFinite(parsed) ? parsed : 0;
+}
+async function writeDaemonServiceRuntimeState(state, pathInput = {}) {
+	const path = daemonServiceRuntimeStatePath(pathInput);
+	await mkdir(daemonRuntimeRootPath(pathInput), { recursive: true });
+	const tempPath = `${path}.tmp-${process.pid}-${Date.now()}`;
+	let shouldCleanupTemp = true;
+	try {
+		await writeFile(tempPath, `${JSON.stringify(state, null, 2)}\n`, {
+			encoding: "utf8",
+			mode: 384
+		});
+		await rename(tempPath, path);
+		await chmod(path, 384);
+		shouldCleanupTemp = false;
+	} finally {
+		if (shouldCleanupTemp) await rm(tempPath, { force: true }).catch(() => void 0);
+	}
+}
+async function ensureDaemonRuntimeLayout() {
+	await Promise.all([
+		mkdir(systemDir(), { recursive: true }),
+		mkdir(join(daemonRuntimeRootPath(), "bin"), { recursive: true }),
+		mkdir(daemonRuntimeBundlesPath(), { recursive: true }),
+		mkdir(join(daemonRuntimeRootPath(), "data"), { recursive: true }),
+		mkdir(join(daemonRuntimeRootPath(), "logs"), { recursive: true }),
+		mkdir(daemonRuntimeStateRootPath(), { recursive: true }),
+		mkdir(daemonRuntimeServiceManagerPath(), { recursive: true })
+	]);
+}
+function normalizeDaemonLifecycleIntent(value) {
+	switch (value) {
+		case "run_background":
+		case "run_foreground":
+		case "stop":
+		case "autostart":
+		case "status_cleanup":
+		case "startup_check":
+		case "start":
+		case "reinstall":
+		case "uninstall":
+		case "upgrade_reconcile": return value;
+		default: return null;
+	}
+}
+async function ensureDaemonTokenState(pathInput = {}) {
+	const current = await readDaemonTokenState(pathInput);
+	if (current && !isDaemonTokenExpired(current)) {
+		await chmod(daemonTokenPath(pathInput), 384).catch(() => void 0);
+		return current;
+	}
+	const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+	const next = {
+		v: 1,
+		schema: DAEMON_TOKEN_SCHEMA,
+		token: createDaemonTokenValue(),
+		issuedAt: nowIso,
+		updatedAt: nowIso
+	};
+	await writeDaemonTokenState(next, pathInput);
+	return next;
+}
+async function readDaemonInstallState(pathInput = {}) {
+	const raw = await readFile(daemonStatePath(pathInput), "utf8").catch((error) => {
+		if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return null;
+		throw error;
+	});
+	if (raw === null) return null;
+	return parseDaemonInstallState(raw);
+}
+function parseDaemonInstallState(raw) {
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed.v !== 1) return null;
+		if (parsed.schema !== DAEMON_STATE_SCHEMA) return null;
+		if (typeof parsed.daemonVersion !== "string" || !parsed.daemonVersion) return null;
+		if (!isDaemonInstallSource(parsed.installSource)) return null;
+		if (typeof parsed.installedAt !== "string" || !parsed.installedAt) return null;
+		if (typeof parsed.updatedAt !== "string" || !parsed.updatedAt) return null;
+		return {
+			v: 1,
+			schema: DAEMON_STATE_SCHEMA,
+			daemonVersion: parsed.daemonVersion,
+			installSource: parsed.installSource,
+			installedAt: parsed.installedAt,
+			updatedAt: parsed.updatedAt
+		};
+	} catch {
+		return null;
+	}
+}
+function isDaemonInstallSource(value) {
+	return value === "cli.auto_check" || value === "daemon.command.install";
+}
+async function writeDaemonInstallState(state, pathInput = {}) {
+	const path = daemonStatePath(pathInput);
+	await mkdir(systemDir(pathInput), { recursive: true });
+	const tempPath = `${path}.tmp-${process.pid}-${Date.now()}`;
+	let shouldCleanupTemp = true;
+	try {
+		await writeFile(tempPath, `${JSON.stringify(state, null, 2)}\n`, "utf8");
+		await rename(tempPath, path);
+		shouldCleanupTemp = false;
+	} finally {
+		if (shouldCleanupTemp) await rm(tempPath, { force: true }).catch(() => void 0);
+	}
+}
+async function readDaemonTokenState(pathInput = {}) {
+	const raw = await readFile(daemonTokenPath(pathInput), "utf8").catch((error) => {
+		if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return null;
+		throw error;
+	});
+	if (raw === null) return null;
+	return parseDaemonTokenState(raw);
+}
+function parseDaemonTokenState(raw) {
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed.v !== 1 || parsed.schema !== DAEMON_TOKEN_SCHEMA) return null;
+		if (typeof parsed.token !== "string" || parsed.token.length < 16) return null;
+		if (typeof parsed.issuedAt !== "string" || !parsed.issuedAt) return null;
+		if (typeof parsed.updatedAt !== "string" || !parsed.updatedAt) return null;
+		return {
+			v: 1,
+			schema: DAEMON_TOKEN_SCHEMA,
+			token: parsed.token,
+			issuedAt: parsed.issuedAt,
+			updatedAt: parsed.updatedAt
+		};
+	} catch {
+		return null;
+	}
+}
+async function writeDaemonTokenState(state, pathInput = {}) {
+	const path = daemonTokenPath(pathInput);
+	await mkdir(systemDir(pathInput), { recursive: true });
+	const tempPath = `${path}.tmp-${process.pid}-${Date.now()}`;
+	let shouldCleanupTemp = true;
+	try {
+		await writeFile(tempPath, `${JSON.stringify(state, null, 2)}\n`, {
+			encoding: "utf8",
+			mode: 384
+		});
+		await rename(tempPath, path);
+		await chmod(path, 384);
+		shouldCleanupTemp = false;
+	} finally {
+		if (shouldCleanupTemp) await rm(tempPath, { force: true }).catch(() => void 0);
+	}
+}
+function isDaemonTokenExpired(state) {
+	const updatedAtMs = Date.parse(state.updatedAt);
+	if (!Number.isFinite(updatedAtMs)) return true;
+	return Date.now() - updatedAtMs >= DAEMON_TOKEN_ROTATE_MAX_AGE_MS;
+}
+function createDaemonTokenValue() {
+	return randomBytes(32).toString("base64url");
+}
+async function pathExists(path) {
+	try {
+		await stat(path);
+		return true;
+	} catch (error) {
+		if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return false;
+		throw error;
+	}
+}
+//#endregion
+//#region src/config/daemon-runtime-lease.ts
+var daemon_runtime_lease_exports = /* @__PURE__ */ __exportAll({
+	clearDaemonRuntimeLease: () => clearDaemonRuntimeLease,
+	daemonRuntimeLeasePath: () => daemonRuntimeLeasePath,
+	readDaemonRuntimeLease: () => readDaemonRuntimeLease,
+	writeDaemonRuntimeLease: () => writeDaemonRuntimeLease
+});
+const DAEMON_RUNTIME_LEASE_FILENAME = "runtime-lease.json";
+function daemonRuntimeLeasePath(pathInput = {}) {
+	return join(daemonRuntimeStateRootPath(pathInput), DAEMON_RUNTIME_LEASE_FILENAME);
+}
+async function readDaemonRuntimeLease(pathInput = {}) {
+	return await readDaemonLocalStateFile({
+		path: daemonRuntimeLeasePath(pathInput),
+		schema: daemonRuntimeLeaseSchema
+	});
+}
+async function writeDaemonRuntimeLease(lease, pathInput = {}) {
+	await writeDaemonLocalStateFile({
+		path: daemonRuntimeLeasePath(pathInput),
+		schema: daemonRuntimeLeaseSchema,
+		value: lease,
+		mode: 384
+	});
+}
+async function clearDaemonRuntimeLease(pathInput = {}) {
+	await rm(daemonRuntimeLeasePath(pathInput), { force: true });
+}
+//#endregion
+export { isDaemonServiceRuntimeHeartbeatStale as A, uninstallDaemon as B, daemonServiceStableExecutableWrapperPath as C, getDaemonRuntimeStatus as D, ensureDaemonControlPlaneToken as E, releaseDaemonServiceLifecycleLock as F, readDaemonLocalStateFile as G, withDaemonServiceRegistrationMutationLock as H, resolveDaemonControlPlaneEndpoint as I, writeDaemonLocalStateFile as K, resolveDaemonServiceRuntimeMetadata as L, readDaemonServiceLifecycleLockMeta as M, readDaemonServiceLifecycleLockMetaWithCleanup as N, getDaemonStatus as O, readDaemonServiceRuntimeSnapshot as P, restoreDaemonInstallStateSnapshot as R, daemonServiceRepairJournalPath as S, daemonStatePath as T, withDaemonServiceRunLock as U, withDaemonServiceReconcileLock as V, withDaemonServiceStopLock as W, daemonRuntimeServiceManagerPath as _, DAEMON_SERVICE_RUNTIME_CONTROLLER_ENV as a, daemonServiceLegacyExecutableWrapperPath as b, DAEMON_SERVICE_RUNTIME_STATE_SCHEMA as c, clearDaemonServiceRuntimeState as d, daemonDispatchJournalPath as f, daemonRuntimeRootPath as g, daemonRuntimeDataPath as h, DAEMON_SERVICE_RUNTIME_AUTO_START_ENV as i, readDaemonControlPlaneToken as j, installDaemon as k, DAEMON_SERVICE_RUNTIME_SYSTEM_SERVICE_ENV as l, daemonRuntimeBundlesPath as m, writeDaemonRuntimeLease as n, DAEMON_SERVICE_RUNTIME_DETACHED_ENV as o, daemonLifecycleJournalPath as p, DAEMON_HEARTBEAT_STALE_MS as r, DAEMON_SERVICE_RUNTIME_MODE_ENV as s, readDaemonRuntimeLease as t, acquireDaemonServiceLifecycleLock as u, daemonRuntimeStateRootPath as v, daemonServiceStableLauncherPath as w, daemonServiceRecognizedExecutableWrapperPaths as x, daemonServiceActiveBundleStatePath as y, setDaemonServiceRuntimeState as z };
+
+//# sourceMappingURL=daemon-runtime-lease-B9LdD-he.js.map