pi-daddy 0.43.0 → 0.44.0

package/dist/governance/workspace-acceptance.js

@@ -40,8 +40,9 @@
  *
  * Keyed by registry path, not by project: accepting an id is a statement about the operator's registry.
  */
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { mkdir, rename, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
+import { readAuthorityText } from "../kernel/authority-text.js";
 import { acceptedWorkspacesPath } from "../kernel/project-paths.js";
 function parse(text) {
     let parsed;
@@ -66,12 +67,23 @@ function parse(text) {
  * `grant-store.ts` takes for a malformed grant, and for the same reason: the file is the record of a decision,
  * so an unreadable one means the decision is unknown, not that anything goes.
  */
-export async function reconcileAcceptedWorkspaces(registryPath, registryIds, env = process.env) {
+export async function reconcileAcceptedWorkspaces(registryPath, registryIds, env = process.env, 
+/** Trusted physical-read dependency; never supplied by a registry or requester. */
+read = readAuthorityText, assertHealthy) {
+    assertHealthy?.();
     const path = acceptedWorkspacesPath(registryPath, env);
-    const text = await readFile(path, "utf8").catch(() => undefined);
+    const text = await read(path).catch((error) => {
+        // Unknown decisions are not first use; preserve physical failures and their recovery capabilities.
+        if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT")
+            throw error;
+        assertHealthy?.();
+        return undefined;
+    });
+    assertHealthy?.();
     if (text === undefined) {
         const accepted = [...registryIds].sort();
-        await write(path, { version: 1, registry: registryPath, accepted });
+        await write(path, { version: 1, registry: registryPath, accepted }, assertHealthy);
+        assertHealthy?.();
         return { accepted, firstUse: true, unaccepted: [] };
     }
     const stored = parse(text);
@@ -92,10 +104,14 @@ export async function acceptWorkspaces(registryPath, registryIds, env = process.
     return accepted;
 }
 /** Atomic, for the reason every other store here is: a half-written record reads as a narrower decision. */
-async function write(path, body) {
+async function write(path, body, assertHealthy) {
+    assertHealthy?.();
     await mkdir(dirname(path), { recursive: true });
+    assertHealthy?.();
     const temp = join(dirname(path), `.${Math.random().toString(36).slice(2)}.tmp`);
     await writeFile(temp, `${JSON.stringify(body, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    assertHealthy?.();
     await rename(temp, path);
+    assertHealthy?.();
 }
 //# sourceMappingURL=workspace-acceptance.js.map

package/dist/governance/workspace-acceptance.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-acceptance.js","sourceRoot":"","sources":["../../src/governance/workspace-acceptance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAiBpE,SAAS,KAAK,CAAC,IAAY;IACzB,IAAI,MAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA8B,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QAC5G,OAAO,IAAI,CAAC;IACd,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,YAAoB,EACpB,WAA8B,EAC9B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,IAAI,GAAG,sBAAsB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACtD,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,0GAA0G;IAC1G,8CAA8C;IAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO;QACL,QAAQ;QACR,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;KACrE,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,YAAoB,EACpB,WAA8B,EAC9B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,KAAK,CAAC,sBAAsB,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzG,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4GAA4G;AAC5G,KAAK,UAAU,KAAK,CAAC,IAAY,EAAE,IAAsB;IACvD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAChF,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/F,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"workspace-acceptance.js","sourceRoot":"","sources":["../../src/governance/workspace-acceptance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAiBpE,SAAS,KAAK,CAAC,IAAY;IACzB,IAAI,MAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA8B,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QAC5G,OAAO,IAAI,CAAC;IACd,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,YAAoB,EACpB,WAA8B,EAC9B,MAAyB,OAAO,CAAC,GAAG;AACpC,mFAAmF;AACnF,OAA0C,iBAAiB,EAC3D,aAA0B;IAE1B,aAAa,EAAE,EAAE,CAAC;IAClB,MAAM,IAAI,GAAG,sBAAsB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACrD,mGAAmG;QACnG,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QAC5F,aAAa,EAAE,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,aAAa,EAAE,EAAE,CAAC;IAClB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,aAAa,CAAC,CAAC;QACnF,aAAa,EAAE,EAAE,CAAC;QAClB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACtD,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,0GAA0G;IAC1G,8CAA8C;IAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO;QACL,QAAQ;QACR,QAAQ,EAAE,KAAK;QACf,UAAU,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;KACrE,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,YAAoB,EACpB,WAA8B,EAC9B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,KAAK,CAAC,sBAAsB,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzG,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4GAA4G;AAC5G,KAAK,UAAU,KAAK,CAAC,IAAY,EAAE,IAAsB,EAAE,aAA0B;IACnF,aAAa,EAAE,EAAE,CAAC;IAClB,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,aAAa,EAAE,EAAE,CAAC;IAClB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAChF,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/F,aAAa,EAAE,EAAE,CAAC;IAClB,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,aAAa,EAAE,EAAE,CAAC;AACpB,CAAC"}

package/dist/governance/workspace-lease.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-lease.d.ts","sourceRoot":"","sources":["../../src/governance/workspace-lease.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAK7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGlF,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,wBAAgB,wBAAwB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAErF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,mBAAmB,GAAG,UAAU,EACzC,MAAM,EAAE,MAAM,GACb,SAAS,GAAG,UAAU,GAAG,qBAAqB,GAAG,MAAM,GAAG,UAAU,GAAG,aAAa,CAQtF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,GAAG,OAAO,EACxB,SAAS,EAAE,OAAO,GAAG,SAAS,GAC7B,UAAU,GAAG,aAAa,GAAG,WAAW,CAG1C;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,SAAS,EAAE,kBAAkB,CAAC;IAC9B,MAAM,EAAE,eAAe,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kGAAkG;IAClG,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,cAAc,CAAC,CAgW1B"}
+{"version":3,"file":"workspace-lease.d.ts","sourceRoot":"","sources":["../../src/governance/workspace-lease.ts"],"names":[],"mappings":"AAQA,OAAO,EAKL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAK7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGlF,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,wBAAgB,wBAAwB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAErF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,mBAAmB,GAAG,UAAU,EACzC,MAAM,EAAE,MAAM,GACb,SAAS,GAAG,UAAU,GAAG,qBAAqB,GAAG,MAAM,GAAG,UAAU,GAAG,aAAa,CAQtF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,GAAG,OAAO,EACxB,SAAS,EAAE,OAAO,GAAG,SAAS,GAC7B,UAAU,GAAG,aAAa,GAAG,WAAW,CAG1C;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,SAAS,EAAE,kBAAkB,CAAC;IAC9B,MAAM,EAAE,eAAe,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kGAAkG;IAClG,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,cAAc,CAAC,CAmZ1B"}

package/dist/governance/workspace-lease.js

@@ -1,3 +1,4 @@
+import { readCapturedWorkerReceipt, matchesWorkerWorkspace, readWorkerRecord, sameWorkerIdentity, isCapturedWorkerIdentity, } from "./captured-worker-record.js";
 import { createHash, randomUUID } from "node:crypto";
 import { atomicMetadata, leasePaths, readMetadata, } from "./lease-record.js";
 import { once } from "node:events";
@@ -54,6 +55,7 @@ export async function acquireWorkspaceLease(input) {
             ownerId: input.ownerId,
             recovered: false,
             attachProcess: () => { },
+            attachCapturedWorker: async () => { },
             attachHerdrTab: () => { },
             // A read lease took no kernel lock, so there is nothing to keep: `not-held` is the same answer
             // `release()` gives, and it is the truth rather than a retention that never happened (R-152).
@@ -170,8 +172,17 @@ export async function acquireWorkspaceLease(input) {
         throw error;
     }
     const previous = await readMetadata(paths.metadata);
+    // A free kernel lock cannot establish settlement of an earlier captured subtree.
+    if (previous === "malformed" ||
+        (previous?.captured_worker &&
+            (!(await matchesWorkerWorkspace(previous.captured_worker, input.workspace.root)) ||
+                !(await readCapturedWorkerReceipt(previous.captured_worker)))) ||
+        (previous?.state === "active" && !previous.captured_worker)) {
+        holder.stdin?.end();
+        throw new GovernanceRefusal(refusal("WORKSPACE_LEASE_STALE", "predecessor workspace ownership is unresolved; original matching worker settlement evidence is required", { workspace_id: input.workspace.workspaceId, root: input.workspace.root }));
+    }
     // "malformed" is not "no prior owner": an unreadable record cannot prove a clean handover (R-100).
-    const recovered = previous === "malformed" ? "unknown" : previous?.state === "active";
+    const recovered = previous?.state === "active";
     const token = randomUUID();
     const metadata = {
         version: 1,
@@ -218,6 +229,26 @@ export async function acquireWorkspaceLease(input) {
         access: "write",
         ownerId: input.ownerId,
         recovered,
+        async attachCapturedWorker(identity) {
+            if (releasing || holder.exitCode !== null || holder.signalCode !== null)
+                throw new Error("writer lease lost before captured ownership persistence");
+            if (!isCapturedWorkerIdentity(identity) || !(await matchesWorkerWorkspace(identity, input.workspace.root)))
+                throw new Error("captured identity does not match leased workspace");
+            const current = await readMetadata(paths.metadata);
+            if (current === "malformed" || current?.token !== token)
+                throw new Error("writer ownership record changed before captured attachment");
+            if (metadata.captured_worker && !sameWorkerIdentity(metadata.captured_worker, identity))
+                throw new Error("writer lease already owns another captured execution");
+            const record = (await readWorkerRecord(identity.ownershipPath));
+            if (record.state !== "ready" ||
+                !isCapturedWorkerIdentity(record.identity) ||
+                !sameWorkerIdentity(identity, record.identity))
+                throw new Error("captured readiness record mismatch");
+            metadata.captured_worker = identity;
+            await atomicMetadata(paths.metadata, metadata);
+            if (holder.exitCode !== null || holder.signalCode !== null)
+                throw new Error("writer lease lost during captured ownership persistence");
+        },
         attachProcess(pid) {
             attach({ process_pid: pid });
         },
@@ -307,6 +338,18 @@ export async function acquireWorkspaceLease(input) {
         async release(reason = "completed") {
             // Memoized, not a boolean. A second call used to answer "released" whatever the first returned, so a
             // retry — or a `finally` after an explicit release — read a clean handover that never happened.
+            if (metadata.captured_worker) {
+                const receipt = await readCapturedWorkerReceipt(metadata.captured_worker);
+                if (!receipt) {
+                    holder.unref();
+                    unrefStream(holder.stdout);
+                    unrefStream(holder.stderr);
+                    return (settled = "retained");
+                }
+                // Only original matching receipt can reconcile a previously uncertain captured worker.
+                if (settled === "retained")
+                    settled = undefined;
+            }
             if (settled)
                 return settled;
             releasing = true;

package/dist/governance/workspace-lease.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-lease.js","sourceRoot":"","sources":["../../src/governance/workspace-lease.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,cAAc,EACd,UAAU,EACV,YAAY,GAIb,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEnE,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,MAAM,UAAU,wBAAwB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC3E,OAAO,GAAG,CAAC,uBAAuB,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAyC,EACzC,MAAc;IAEd,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IAC9C,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACtC,IAAI,OAAO,KAAK,qBAAqB;QAAE,OAAO,qBAAqB,CAAC;IACpE,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,aAAa,CAAC;IACjD,0GAA0G;IAC1G,4DAA4D;IAC5D,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAwB,EACxB,SAA8B;IAE9B,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC;IAC5C,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAgB3C;IACC,qEAAqE;IACrE,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK;YAChB,aAAa,EAAE,GAAG,EAAE,GAAE,CAAC;YACvB,cAAc,EAAE,GAAG,EAAE,GAAE,CAAC;YACxB,+FAA+F;YAC/F,8FAA8F;YAC9F,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,UAAmB;YAC7C,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;YAClC,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;YAC3B,yFAAyF;YACzF,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,UAAU;SAChC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC1B,MAAM,IAAI,iBAAiB,CACzB,OAAO,CACL,0BAA0B,EAC1B,oBAAoB,KAAK,CAAC,SAAS,CAAC,WAAW,mCAAmC,CACnF,CACF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,KAAK,CAClB,KAAK,CAAC,YAAY,IAAI,OAAO,EAC7B;QACE,aAAa;QACb,YAAY;QACZ,sBAAsB;QACtB,IAAI;QACJ,KAAK,CAAC,IAAI;QACV,OAAO,CAAC,QAAQ;QAChB,qBAAqB;QACrB,IAAI;QACJ,aAAa;KACd,EACD;QACE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAC/B,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,qBAAqB,EAAE,KAAK,CAAC,MAAM;YACnC,6BAA6B,EAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;YACrE,+BAA+B,EAAE,MAAM,CAAC,KAAK,CAAC,mBAAmB,IAAI,MAAM,CAAC;SAC7E;QACD,oGAAoG;QACpG,iGAAiG;QACjG,mGAAmG;QACnG,iBAAiB;QACjB,QAAQ,EAAE,IAAI;KACf,CACF,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,CAAC,oBAAoB,IAAI,IAAI,CAAC;IACrD,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,SAA6B,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB;;;;;;;OAOG;IACH,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,kGAAkG;QAClG,kGAAkG;QAClG,+FAA+F;QAC/F,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBACrC,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB;YAClB,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,SAAU,EAAE,SAAS,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC,CAAC;IACF,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;QAClC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE;YACpD,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CACH,WAAW,CACT,IAAI,iBAAiB,CACnB,OAAO,CAAC,uBAAuB,EAAE,mDAAmD,SAAS,IAAI,CAAC,CACnG,CACF,EACH,SAAS,CACV,CAAC;YACF,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACtD,CAAC,CAAC;YACF,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,WAAW,CACT,IAAI,iBAAiB,CACnB,OAAO,CACL,0BAA0B,EAC1B,oBAAoB,KAAK,CAAC,SAAS,CAAC,WAAW,mCAAmC,CACnF,CACF,CACF,CAAC;YACJ,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC7B,OAAO,EAAE,CAAC;gBACV,WAAW,CACT,IAAI,iBAAiB,CACnB,OAAO,CACL,uBAAuB,EACvB,4DAA4D,MAAM,CAAC,KAAK,CAAC,GAAG,CAC7E,CACF,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC5B,IAAI,KAAK;oBAAE,OAAO;gBAClB,OAAO,EAAE,CAAC;gBACV,MAAM,QAAQ,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,uBAAuB,CAAC;gBACpF,WAAW,CACT,IAAI,iBAAiB,CACnB,OAAO,CACL,QAAQ,EACR,IAAI,KAAK,EAAE;oBACT,CAAC,CAAC,aAAa,KAAK,CAAC,SAAS,CAAC,WAAW,iDAAiD;oBAC3F,CAAC,CAAC,mDAAmD,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAC5F,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAC1E,CACF,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBAClC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK;oBAAE,OAAO;gBACnD,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3E,KAAK,GAAG,IAAI,CAAC;gBACb,OAAO,EAAE,CAAC;gBACV,YAAY,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,EAAE,CAAC;QACX,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpD,mGAAmG;IACnG,MAAM,SAAS,GAAwB,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,KAAK,QAAQ,CAAC;IAC3G,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAkB;QAC9B,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,QAAQ;QACf,KAAK;QACL,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW;QACzC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI;QAC1B,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QAC3E,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CACzB,OAAO,CACL,uBAAuB,EACvB,mEAAmE,MAAM,CAAC,KAAK,CAAC,GAAG,EACnF,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAC1E,CACF,CAAC;IACJ,CAAC;IAED,qGAAqG;IACrG,wGAAwG;IACxG,uGAAuG;IACvG,+FAA+F;IAC/F,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,OAAwC,CAAC;IAC7C,IAAI,IAA6B,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAQ,CAAC,WAAW,EAAE,EAAE;QAC9C,IAAI,GAAG,WAAW,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,4CAA4C,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7G,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;QACxB,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;QAAE,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACpG,MAAM,MAAM,GAAG,CAAC,KAAsD,EAAE,EAAE;QACxE,IAAI,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;YACnG,MAAM,IAAI,iBAAiB,CACzB,OAAO,CACL,uBAAuB,EACvB,oBAAoB,KAAK,CAAC,SAAS,CAAC,WAAW,mCAAmC,CACnF,CACF,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC,CAAC;IACF,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS;QACT,aAAa,CAAC,GAAG;YACf,MAAM,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,cAAc,CAAC,KAAK;YAClB,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI;QACJ,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,UAAU;YACpC,iGAAiG;YACjG,8CAA8C;YAC9C,EAAE;YACF,wFAAwF;YACxF,EAAE;YACF,oGAAoG;YACpG,uGAAuG;YACvG,gGAAgG;YAChG,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;YAC5B,mGAAmG;YACnG,uGAAuG;YACvG,yEAAyE;YACzE,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;gBAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC;YACtF,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,EAAE,KAAK,KAAK,KAAK,EAAE,CAAC;gBACxD,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE;oBAC9C,GAAG,QAAQ;oBACX,KAAK,EAAE,UAAU;oBACjB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACrC,cAAc,EAAE,YAAY,MAAM,EAAE;iBACrC,CAAC,CAAC,IAAI,CACL,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;YACJ,CAAC;YACD;;;;;;;;;;;;;;;;;;;;;eAqBG;YACH;;;;;;;;;eASG;YACH,SAAS,GAAG,IAAI,CAAC;YACjB,sGAAsG;YACtG,kGAAkG;YAClG,wGAAwG;YACxG,kGAAkG;YAClG,mGAAmG;YACnG,IAAI,QAAQ;gBAAE,OAAO,GAAG,UAAU,CAAC;YACnC,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,KAAK,CAAC,gBAAgB;YACpB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAA2C,CAAC;YACpG,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,WAAW;YAChC,qGAAqG;YACrG,gGAAgG;YAChG,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;YAC5B,SAAS,GAAG,IAAI,CAAC;YACjB,8FAA8F;YAC9F,mFAAmF;YACnF,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;gBAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC;YAEtF,kGAAkG;YAClG,mGAAmG;YACnG,mGAAmG;YACnG,mGAAmG;YACnG,wCAAwC;YACxC,4FAA4F;YAC5F,mGAAmG;YACnG,0CAA0C;YAC1C,IAAI,GAAG,GAAwB,qBAAqB,CAAC;YACrD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,EAAE,KAAK,KAAK,KAAK,EAAE,CAAC;gBACxD,IAAI,CAAC;oBACH,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE;wBACnC,GAAG,QAAQ;wBACX,KAAK,EAAE,UAAU;wBACjB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACrC,cAAc,EAAE,MAAM;qBACvB,CAAC,CAAC;oBACH,GAAG,GAAG,UAAU,CAAC;gBACnB,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,GAAG,qBAAqB,CAAC;gBAC9B,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACvD,gGAAgG;gBAChG,GAAG,GAAG,qBAAqB,CAAC;YAC9B,CAAC;YAED,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC9D,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;YACpB,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBAC3D,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3G,CAAC;YACD,4FAA4F;YAC5F,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;gBAAE,QAAQ,EAAE,CAAC;YACvE,OAAO,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"workspace-lease.js","sourceRoot":"","sources":["../../src/governance/workspace-lease.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,cAAc,EACd,UAAU,EACV,YAAY,GAIb,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEnE,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,MAAM,UAAU,wBAAwB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC3E,OAAO,GAAG,CAAC,uBAAuB,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAyC,EACzC,MAAc;IAEd,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IAC9C,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACtC,IAAI,OAAO,KAAK,qBAAqB;QAAE,OAAO,qBAAqB,CAAC;IACpE,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,aAAa,CAAC;IACjD,0GAA0G;IAC1G,4DAA4D;IAC5D,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAwB,EACxB,SAA8B;IAE9B,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC;IAC5C,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAgB3C;IACC,qEAAqE;IACrE,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK;YAChB,aAAa,EAAE,GAAG,EAAE,GAAE,CAAC;YACvB,oBAAoB,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;YACpC,cAAc,EAAE,GAAG,EAAE,GAAE,CAAC;YACxB,+FAA+F;YAC/F,8FAA8F;YAC9F,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,UAAmB;YAC7C,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;YAClC,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;YAC3B,yFAAyF;YACzF,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,UAAU;SAChC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC1B,MAAM,IAAI,iBAAiB,CACzB,OAAO,CACL,0BAA0B,EAC1B,oBAAoB,KAAK,CAAC,SAAS,CAAC,WAAW,mCAAmC,CACnF,CACF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,KAAK,CAClB,KAAK,CAAC,YAAY,IAAI,OAAO,EAC7B;QACE,aAAa;QACb,YAAY;QACZ,sBAAsB;QACtB,IAAI;QACJ,KAAK,CAAC,IAAI;QACV,OAAO,CAAC,QAAQ;QAChB,qBAAqB;QACrB,IAAI;QACJ,aAAa;KACd,EACD;QACE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAC/B,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,qBAAqB,EAAE,KAAK,CAAC,MAAM;YACnC,6BAA6B,EAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;YACrE,+BAA+B,EAAE,MAAM,CAAC,KAAK,CAAC,mBAAmB,IAAI,MAAM,CAAC;SAC7E;QACD,oGAAoG;QACpG,iGAAiG;QACjG,mGAAmG;QACnG,iBAAiB;QACjB,QAAQ,EAAE,IAAI;KACf,CACF,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,CAAC,oBAAoB,IAAI,IAAI,CAAC;IACrD,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,SAA6B,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB;;;;;;;OAOG;IACH,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,kGAAkG;QAClG,kGAAkG;QAClG,+FAA+F;QAC/F,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBACrC,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB;YAClB,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,SAAU,EAAE,SAAS,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC,CAAC;IACF,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;QAClC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE;YACpD,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CACH,WAAW,CACT,IAAI,iBAAiB,CACnB,OAAO,CAAC,uBAAuB,EAAE,mDAAmD,SAAS,IAAI,CAAC,CACnG,CACF,EACH,SAAS,CACV,CAAC;YACF,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACtD,CAAC,CAAC;YACF,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,WAAW,CACT,IAAI,iBAAiB,CACnB,OAAO,CACL,0BAA0B,EAC1B,oBAAoB,KAAK,CAAC,SAAS,CAAC,WAAW,mCAAmC,CACnF,CACF,CACF,CAAC;YACJ,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC7B,OAAO,EAAE,CAAC;gBACV,WAAW,CACT,IAAI,iBAAiB,CACnB,OAAO,CACL,uBAAuB,EACvB,4DAA4D,MAAM,CAAC,KAAK,CAAC,GAAG,CAC7E,CACF,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC5B,IAAI,KAAK;oBAAE,OAAO;gBAClB,OAAO,EAAE,CAAC;gBACV,MAAM,QAAQ,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,uBAAuB,CAAC;gBACpF,WAAW,CACT,IAAI,iBAAiB,CACnB,OAAO,CACL,QAAQ,EACR,IAAI,KAAK,EAAE;oBACT,CAAC,CAAC,aAAa,KAAK,CAAC,SAAS,CAAC,WAAW,iDAAiD;oBAC3F,CAAC,CAAC,mDAAmD,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAC5F,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAC1E,CACF,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBAClC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK;oBAAE,OAAO;gBACnD,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3E,KAAK,GAAG,IAAI,CAAC;gBACb,OAAO,EAAE,CAAC;gBACV,YAAY,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,EAAE,CAAC;QACX,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpD,iFAAiF;IACjF,IACE,QAAQ,KAAK,WAAW;QACxB,CAAC,QAAQ,EAAE,eAAe;YACxB,CAAC,CAAC,CAAC,MAAM,sBAAsB,CAAC,QAAQ,CAAC,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC9E,CAAC,CAAC,MAAM,yBAAyB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAClE,CAAC,QAAQ,EAAE,KAAK,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAC3D,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CACzB,OAAO,CACL,uBAAuB,EACvB,yGAAyG,EACzG,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAC1E,CACF,CAAC;IACJ,CAAC;IACD,mGAAmG;IACnG,MAAM,SAAS,GAAG,QAAQ,EAAE,KAAK,KAAK,QAAQ,CAAC;IAC/C,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAkB;QAC9B,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,QAAQ;QACf,KAAK;QACL,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW;QACzC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI;QAC1B,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QAC3E,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CACzB,OAAO,CACL,uBAAuB,EACvB,mEAAmE,MAAM,CAAC,KAAK,CAAC,GAAG,EACnF,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAC1E,CACF,CAAC;IACJ,CAAC;IAED,qGAAqG;IACrG,wGAAwG;IACxG,uGAAuG;IACvG,+FAA+F;IAC/F,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,OAAwC,CAAC;IAC7C,IAAI,IAA6B,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAQ,CAAC,WAAW,EAAE,EAAE;QAC9C,IAAI,GAAG,WAAW,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,4CAA4C,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7G,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;QACxB,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;QAAE,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACpG,MAAM,MAAM,GAAG,CAAC,KAAsD,EAAE,EAAE;QACxE,IAAI,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;YACnG,MAAM,IAAI,iBAAiB,CACzB,OAAO,CACL,uBAAuB,EACvB,oBAAoB,KAAK,CAAC,SAAS,CAAC,WAAW,mCAAmC,CACnF,CACF,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC,CAAC;IACF,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS;QACT,KAAK,CAAC,oBAAoB,CAAC,QAAQ;YACjC,IAAI,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;gBACrE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC7E,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACxG,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,EAAE,KAAK,KAAK,KAAK;gBACrD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAChF,IAAI,QAAQ,CAAC,eAAe,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC;gBACrF,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC1E,MAAM,MAAM,GAAG,CAAC,MAAM,gBAAgB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAA4C,CAAC;YAC3G,IACE,MAAM,CAAC,KAAK,KAAK,OAAO;gBACxB,CAAC,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAC1C,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;gBAE9C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,QAAQ,CAAC,eAAe,GAAG,QAAQ,CAAC;YACpC,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC/C,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;gBACxD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC/E,CAAC;QACD,aAAa,CAAC,GAAG;YACf,MAAM,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,cAAc,CAAC,KAAK;YAClB,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI;QACJ,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,UAAU;YACpC,iGAAiG;YACjG,8CAA8C;YAC9C,EAAE;YACF,wFAAwF;YACxF,EAAE;YACF,oGAAoG;YACpG,uGAAuG;YACvG,gGAAgG;YAChG,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;YAC5B,mGAAmG;YACnG,uGAAuG;YACvG,yEAAyE;YACzE,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;gBAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC;YACtF,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,EAAE,KAAK,KAAK,KAAK,EAAE,CAAC;gBACxD,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE;oBAC9C,GAAG,QAAQ;oBACX,KAAK,EAAE,UAAU;oBACjB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACrC,cAAc,EAAE,YAAY,MAAM,EAAE;iBACrC,CAAC,CAAC,IAAI,CACL,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;YACJ,CAAC;YACD;;;;;;;;;;;;;;;;;;;;;eAqBG;YACH;;;;;;;;;eASG;YACH,SAAS,GAAG,IAAI,CAAC;YACjB,sGAAsG;YACtG,kGAAkG;YAClG,wGAAwG;YACxG,kGAAkG;YAClG,mGAAmG;YACnG,IAAI,QAAQ;gBAAE,OAAO,GAAG,UAAU,CAAC;YACnC,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,KAAK,CAAC,gBAAgB;YACpB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAA2C,CAAC;YACpG,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,WAAW;YAChC,qGAAqG;YACrG,gGAAgG;YAChG,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;gBAC1E,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBAC3B,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBAC3B,OAAO,CAAC,OAAO,GAAG,UAAU,CAAC,CAAC;gBAChC,CAAC;gBACD,uFAAuF;gBACvF,IAAI,OAAO,KAAK,UAAU;oBAAE,OAAO,GAAG,SAAS,CAAC;YAClD,CAAC;YACD,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;YAC5B,SAAS,GAAG,IAAI,CAAC;YACjB,8FAA8F;YAC9F,mFAAmF;YACnF,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;gBAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC;YAEtF,kGAAkG;YAClG,mGAAmG;YACnG,mGAAmG;YACnG,mGAAmG;YACnG,wCAAwC;YACxC,4FAA4F;YAC5F,mGAAmG;YACnG,0CAA0C;YAC1C,IAAI,GAAG,GAAwB,qBAAqB,CAAC;YACrD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,EAAE,KAAK,KAAK,KAAK,EAAE,CAAC;gBACxD,IAAI,CAAC;oBACH,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE;wBACnC,GAAG,QAAQ;wBACX,KAAK,EAAE,UAAU;wBACjB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACrC,cAAc,EAAE,MAAM;qBACvB,CAAC,CAAC;oBACH,GAAG,GAAG,UAAU,CAAC;gBACnB,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,GAAG,qBAAqB,CAAC;gBAC9B,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACvD,gGAAgG;gBAChG,GAAG,GAAG,qBAAqB,CAAC;YAC9B,CAAC;YAED,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC9D,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;YACpB,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBAC3D,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3G,CAAC;YACD,4FAA4F;YAC5F,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;gBAAE,QAAQ,EAAE,CAAC;YACvE,OAAO,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/kernel/authority-text.d.ts

@@ -0,0 +1,3 @@
+export declare function readAuthorityText(path: string): Promise<string>;
+export declare function readOptionalAuthorityText(path: string): Promise<string | undefined>;
+//# sourceMappingURL=authority-text.d.ts.map

package/dist/kernel/authority-text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-text.d.ts","sourceRoot":"","sources":["../../src/kernel/authority-text.ts"],"names":[],"mappings":"AAEA,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMrE;AACD,wBAAsB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAOzF"}

package/dist/kernel/authority-text.js

@@ -0,0 +1,22 @@
+/** Authority metadata: only ENOENT is absence; damage and unresolved cleanup preserve failure. */
+import { readBoundedFile } from "./bounded-read.js";
+export async function readAuthorityText(path) {
+    const read = await readBoundedFile(path, { maxBytes: 1024 * 1024, timeoutMs: 2_000 });
+    if (read.ok)
+        return read.text;
+    const error = new Error(`Cannot read ${path}: ${read.why} (${read.detail})`);
+    if ("code" in read && read.code)
+        Object.assign(error, { code: read.code });
+    throw error;
+}
+export async function readOptionalAuthorityText(path) {
+    try {
+        return await readAuthorityText(path);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+//# sourceMappingURL=authority-text.js.map

package/dist/kernel/authority-text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-text.js","sourceRoot":"","sources":["../../src/kernel/authority-text.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAClD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACtF,IAAI,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7E,IAAI,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI;QAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3E,MAAM,KAAK,CAAC;AACd,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAAY;IAC1D,IAAI,CAAC;QACH,OAAO,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/kernel/bounded-read-failures.d.ts

@@ -0,0 +1,9 @@
+import { BoundedReadCleanupError } from "./bounded-read.ts";
+/** Independent failed readers remain typed, with every original recovery capability intact. */
+export declare class CollectedBoundedReadCleanupError extends BoundedReadCleanupError {
+    readonly errors: readonly BoundedReadCleanupError[];
+    constructor(errors: readonly BoundedReadCleanupError[]);
+}
+/** Preserve singleton identity; flatten only our typed collection, never arbitrary caller errors. */
+export declare function collectBoundedReadFailures(errors: readonly unknown[]): BoundedReadCleanupError | undefined;
+//# sourceMappingURL=bounded-read-failures.d.ts.map

package/dist/kernel/bounded-read-failures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-read-failures.d.ts","sourceRoot":"","sources":["../../src/kernel/bounded-read-failures.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,+FAA+F;AAC/F,qBAAa,gCAAiC,SAAQ,uBAAuB;IAC3E,QAAQ,CAAC,MAAM,EAAE,SAAS,uBAAuB,EAAE,CAAC;gBACxC,MAAM,EAAE,SAAS,uBAAuB,EAAE;CAWvD;AAED,qGAAqG;AACrG,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,GAAG,uBAAuB,GAAG,SAAS,CAsB1G"}

package/dist/kernel/bounded-read-failures.js

@@ -0,0 +1,33 @@
+import { BoundedReadCleanupError } from "./bounded-read.js";
+/** Independent failed readers remain typed, with every original recovery capability intact. */
+export class CollectedBoundedReadCleanupError extends BoundedReadCleanupError {
+    errors;
+    constructor(errors) {
+        const members = Object.freeze([...errors]);
+        super(members, async () => {
+            const outcomes = await Promise.allSettled(members.map((error) => error.cleanup()));
+            const failed = members.filter((_error, index) => outcomes[index].status === "rejected");
+            if (failed.length)
+                throw collectBoundedReadFailures(failed);
+        });
+        this.name = "CollectedBoundedReadCleanupError";
+        this.message = `${members.length} bounded reader descriptor cleanups unresolved; retain and explicitly retry`;
+        this.errors = members;
+    }
+}
+/** Preserve singleton identity; flatten only our typed collection, never arbitrary caller errors. */
+export function collectBoundedReadFailures(errors) {
+    const members = [
+        ...new Set(errors.flatMap((error) => error instanceof CollectedBoundedReadCleanupError
+            ? error.errors
+            : error instanceof BoundedReadCleanupError
+                ? [error]
+                : [])),
+    ];
+    const existing = errors.find((error) => error instanceof CollectedBoundedReadCleanupError &&
+        error.errors.length === members.length &&
+        error.errors.every((member, index) => member === members[index]));
+    return (existing ??
+        (members.length > 1 ? new CollectedBoundedReadCleanupError(members) : members[0]));
+}
+//# sourceMappingURL=bounded-read-failures.js.map

package/dist/kernel/bounded-read-failures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-read-failures.js","sourceRoot":"","sources":["../../src/kernel/bounded-read-failures.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,+FAA+F;AAC/F,MAAM,OAAO,gCAAiC,SAAQ,uBAAuB;IAClE,MAAM,CAAqC;IACpD,YAAY,MAA0C;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;QAC3C,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACxB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACnF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;YACxF,IAAI,MAAM,CAAC,MAAM;gBAAE,MAAM,0BAA0B,CAAC,MAAM,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,6EAA6E,CAAC;QAC9G,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;IACxB,CAAC;CACF;AAED,qGAAqG;AACrG,MAAM,UAAU,0BAA0B,CAAC,MAA0B;IACnE,MAAM,OAAO,GAAG;QACd,GAAG,IAAI,GAAG,CACR,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACvB,KAAK,YAAY,gCAAgC;YAC/C,CAAC,CAAC,KAAK,CAAC,MAAM;YACd,CAAC,CAAC,KAAK,YAAY,uBAAuB;gBACxC,CAAC,CAAC,CAAC,KAAK,CAAC;gBACT,CAAC,CAAC,EAAE,CACT,CACF;KACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAC1B,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,YAAY,gCAAgC;QACjD,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QACtC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,CACnE,CAAC;IACF,OAAO,CACJ,QAAyD;QAC1D,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,gCAAgC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAClF,CAAC;AACJ,CAAC"}

package/dist/kernel/bounded-read-sync.d.ts

@@ -0,0 +1,24 @@
+/** Bounded synchronous reads for the synchronous planner/settings seams. */
+import { openSync, closeSync, fstatSync, readSync } from "node:fs";
+import { BoundedReadCleanupError } from "./bounded-read.ts";
+export interface SyncReadPorts {
+    open: typeof openSync;
+    close: typeof closeSync;
+    stat: typeof fstatSync;
+    read: typeof readSync;
+    realpath: (path: string) => string;
+}
+/** Diagnostic owners only: a numeric fd cannot safely be retried after close failed and may have been reused. */
+export declare function unresolvedSyncReadCleanups(): readonly BoundedReadCleanupError[];
+export declare function readBoundedTextSync(path: string, options: {
+    maxBytes: number;
+    timeoutMs?: number;
+    prefix?: boolean;
+    confinedRoot?: string;
+    now?: () => number;
+}, io?: SyncReadPorts): {
+    text: string;
+    truncated: boolean;
+    size: number;
+};
+//# sourceMappingURL=bounded-read-sync.d.ts.map

package/dist/kernel/bounded-read-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-read-sync.d.ts","sourceRoot":"","sources":["../../src/kernel/bounded-read-sync.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,OAAO,EAAa,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAgB,MAAM,SAAS,CAAC;AAE5F,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,QAAQ,CAAC;IACtB,KAAK,EAAE,OAAO,SAAS,CAAC;IACxB,IAAI,EAAE,OAAO,SAAS,CAAC;IACvB,IAAI,EAAE,OAAO,QAAQ,CAAC;IACtB,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACpC;AASD,iHAAiH;AACjH,wBAAgB,0BAA0B,IAAI,SAAS,uBAAuB,EAAE,CAE/E;AACD,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,EACD,EAAE,GAAE,aAAqB,GACxB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAoDpD"}

package/dist/kernel/bounded-read-sync.js

@@ -0,0 +1,75 @@
+/** Bounded synchronous reads for the synchronous planner/settings seams. */
+import { constants, openSync, closeSync, fstatSync, readSync, realpathSync } from "node:fs";
+import { isAbsolute, relative } from "node:path";
+import { BoundedReadCleanupError } from "./bounded-read.js";
+const ports = {
+    open: openSync,
+    close: closeSync,
+    stat: fstatSync,
+    read: readSync,
+    realpath: realpathSync,
+};
+const unresolved = new Set();
+/** Diagnostic owners only: a numeric fd cannot safely be retried after close failed and may have been reused. */
+export function unresolvedSyncReadCleanups() {
+    return [...unresolved];
+}
+export function readBoundedTextSync(path, options, io = ports) {
+    const now = options.now ?? Date.now;
+    const deadline = now() + (options.timeoutMs ?? 2_000);
+    const fd = io.open(path, constants.O_RDONLY | constants.O_NONBLOCK | (constants.O_NOFOLLOW ?? 0));
+    try {
+        const stat = io.stat(fd);
+        if (!stat.isFile())
+            throw new Error("not a regular file");
+        // Linux /proc resolves the held object, including ancestor substitutions between realpath and open.
+        // If this proof is unavailable, named context files are refused rather than trusting the earlier path.
+        if (options.confinedRoot) {
+            const held = io.realpath(`/proc/self/fd/${fd}`);
+            const within = relative(options.confinedRoot, held);
+            if (!within || within === ".." || within.startsWith("../") || isAbsolute(within))
+                throw new Error("held file is outside this session's working directory");
+        }
+        if (!options.prefix && stat.size > options.maxBytes)
+            throw new Error("file exceeds byte limit");
+        const bytes = Buffer.alloc(options.maxBytes + 1);
+        let offset = 0;
+        while (offset < bytes.length) {
+            if (now() > deadline)
+                throw new Error("bounded read timed out");
+            const count = io.read(fd, bytes, offset, Math.min(64 * 1024, bytes.length - offset), offset);
+            if (!count)
+                break;
+            offset += count;
+        }
+        const truncated = offset > options.maxBytes;
+        if (truncated && !options.prefix)
+            throw new Error("file grew beyond byte limit");
+        // stream:true accepts only an incomplete final codepoint at a deliberately truncated boundary.
+        // Malformed bytes in the retained prefix still throw; valid replacement characters remain intact.
+        let text;
+        try {
+            text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes.subarray(0, Math.min(offset, options.maxBytes)), { stream: truncated });
+        }
+        catch (cause) {
+            throw new Error("invalid UTF-8", { cause });
+        }
+        return { text, truncated, size: stat.size };
+    }
+    finally {
+        try {
+            io.close(fd);
+        }
+        catch (cause) {
+            let failure;
+            failure = new BoundedReadCleanupError(cause, async () => {
+                throw failure;
+            });
+            failure.message =
+                "synchronous reader close failed; descriptor ownership is unresolved; automatic retry is unsafe";
+            unresolved.add(failure);
+            throw failure;
+        }
+    }
+}
+//# sourceMappingURL=bounded-read-sync.js.map

package/dist/kernel/bounded-read-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-read-sync.js","sourceRoot":"","sources":["../../src/kernel/bounded-read-sync.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAS5D,MAAM,KAAK,GAAkB;IAC3B,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,YAAY;CACvB,CAAC;AACF,MAAM,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;AACtD,iHAAiH;AACjH,MAAM,UAAU,0BAA0B;IACxC,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;AACzB,CAAC;AACD,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,OAMC,EACD,KAAoB,KAAK;IAEzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;IACtD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;IAClG,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC1D,oGAAoG;QACpG,uGAAuG;QACvG,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC;gBAC9E,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAChG,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QACjD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7B,IAAI,GAAG,EAAE,GAAG,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAChE,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7F,IAAI,CAAC,KAAK;gBAAE,MAAM;YAClB,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC5C,IAAI,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjF,+FAA+F;QAC/F,kGAAkG;QAClG,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CACtE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,EACrD,EAAE,MAAM,EAAE,SAAS,EAAE,CACtB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAgC,CAAC;YACrC,OAAO,GAAG,IAAI,uBAAuB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;gBACtD,MAAM,OAAO,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,OAAO;gBACb,gGAAgG,CAAC;YACnG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM,OAAO,CAAC;QAChB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/kernel/bounded-read.d.ts

@@ -1,3 +1,25 @@
+import { type FileHandle } from "node:fs/promises";
+/** Explicitly trusted per-read I/O ports, never requester/environment input. */
+export interface BoundedReadPorts {
+    open(path: string, flags: number): Promise<FileHandle>;
+    read(handle: FileHandle, buffer: Buffer, offset: number, length: number, position: number): Promise<{
+        bytesRead: number;
+    }>;
+    close(handle: FileHandle): Promise<void>;
+}
+/** A failed read stays failed even after this explicit recovery capability succeeds. */
+export declare class BoundedReadCleanupError extends Error {
+    readonly cleanup: () => Promise<void>;
+    /** Latest physical failure, including falsy rejections; cause remains the original failure. */
+    lastCause: unknown;
+    constructor(cause: unknown, cleanup: () => Promise<void>);
+}
+/** Trusted diagnostics/recovery only; not admission, a quota, or a Root-wide shutdown join. */
+export declare function retainedBoundedReadCleanups(): readonly BoundedReadCleanupOwner[];
+export interface BoundedReadCleanupOwner {
+    readonly handle: FileHandle | undefined;
+    cleanup(): Promise<void>;
+}
 export interface BoundedReadLimits {
     /** Refuse anything at or over this, before allocating it. */
     maxBytes: number;
@@ -16,6 +38,7 @@ export interface BoundedReadLimits {
 export type BoundedReadFailure = {
     why: "unopenable";
     detail: string;
+    code?: string;
 } | {
     why: "not-a-regular-file";
     detail: string;
@@ -29,9 +52,13 @@ export type BoundedReadFailure = {
 } | {
     why: "timed-out";
     detail: string;
+} | {
+    why: "invalid-utf8";
+    detail: string;
 } | {
     why: "unreadable";
     detail: string;
+    code?: string;
 };
 export type BoundedReadResult = {
     ok: true;
@@ -52,6 +79,6 @@ export type BoundedReadBytes = {
  * UTF-8 round trip unchanged — a latin-1 byte that decodes to U+FFFD changes the file's digest, and that
  * check is only possible against the original buffer. Decoding here and re-encoding there would defeat it.
  */
-export declare function readBoundedFile(path: string, limits: BoundedReadLimits): Promise<BoundedReadResult>;
-export declare function readBoundedBytes(path: string, limits: BoundedReadLimits): Promise<BoundedReadBytes>;
+export declare function readBoundedFile(path: string, limits: BoundedReadLimits, ports?: BoundedReadPorts): Promise<BoundedReadResult>;
+export declare function readBoundedBytes(path: string, limits: BoundedReadLimits, ports?: BoundedReadPorts): Promise<BoundedReadBytes>;
 //# sourceMappingURL=bounded-read.d.ts.map

package/dist/kernel/bounded-read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bounded-read.d.ts","sourceRoot":"","sources":["../../src/kernel/bounded-read.ts"],"names":[],"mappings":"AAmCA,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,GAAG,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,GAAG,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,GAAG,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,GAAG,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,GAAG,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,GAAG,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,MAAM,MAAM,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,CAAC;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,GAAG,kBAAkB,CAAC,CAAC;AAClG,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,CAAC;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,GAAG,kBAAkB,CAAC,CAAC;AAElG;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAGzG;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAkDzG"}
+{"version":3,"file":"bounded-read.d.ts","sourceRoot":"","sources":["../../src/kernel/bounded-read.ts"],"names":[],"mappings":"AAiCA,OAAO,EAAQ,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEzD,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,CACF,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClC,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AACD,wFAAwF;AACxF,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,+FAA+F;IAC/F,SAAS,EAAE,OAAO,CAAC;gBACP,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;CAMzD;AAGD,+FAA+F;AAC/F,wBAAgB,2BAA2B,IAAI,SAAS,uBAAuB,EAAE,CAEhF;AACD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IACxC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AA0DD,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,GAAG,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,GAAG,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,GAAG,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,GAAG,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,GAAG,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,GAAG,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,GAAG,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,MAAM,MAAM,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,CAAC;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,GAAG,kBAAkB,CAAC,CAAC;AAClG,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,CAAC;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,GAAG,kBAAkB,CAAC,CAAC;AAElG;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,iBAAiB,EACzB,KAAK,GAAE,gBAAmC,GACzC,OAAO,CAAC,iBAAiB,CAAC,CAQ5B;AASD,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,iBAAiB,EACzB,KAAK,GAAE,gBAAmC,GACzC,OAAO,CAAC,gBAAgB,CAAC,CAuD3B"}

package/dist/kernel/bounded-read.js

@@ -32,6 +32,77 @@
  */
 import { constants } from "node:fs";
 import { open } from "node:fs/promises";
+/** A failed read stays failed even after this explicit recovery capability succeeds. */
+export class BoundedReadCleanupError extends Error {
+    cleanup;
+    /** Latest physical failure, including falsy rejections; cause remains the original failure. */
+    lastCause;
+    constructor(cause, cleanup) {
+        super("bounded reader descriptor cleanup unresolved; retain and explicitly retry", { cause });
+        this.name = "BoundedReadCleanupError";
+        this.lastCause = cause;
+        this.cleanup = cleanup;
+    }
+}
+const retained = new Set();
+/** Trusted diagnostics/recovery only; not admission, a quota, or a Root-wide shutdown join. */
+export function retainedBoundedReadCleanups() {
+    return [...retained];
+}
+class BoundedReadCleanup {
+    held;
+    active;
+    failure;
+    finish;
+    reading = new Promise((resolve) => (this.finish = resolve));
+    close;
+    constructor(close) {
+        this.close = close;
+        retained.add(this);
+    }
+    acquired(handle) {
+        this.held = handle;
+    }
+    get handle() {
+        return this.held;
+    }
+    readSettled() {
+        this.finish();
+    }
+    cleanup() {
+        if (this.active)
+            return this.active;
+        // Publish before calling any trusted port: reentrant/concurrent cleanup shares this operation.
+        const operation = this.reading.then(async () => {
+            if (!this.held) {
+                retained.delete(this);
+                return;
+            }
+            try {
+                await this.close(this.held);
+            }
+            catch (cause) {
+                this.failure ??= new BoundedReadCleanupError(cause, () => this.cleanup());
+                this.failure.lastCause = cause;
+                throw this.failure;
+            }
+            this.held = undefined;
+            retained.delete(this);
+        });
+        this.active = operation;
+        void operation.then(() => {
+            this.active = undefined;
+        }, () => {
+            this.active = undefined;
+        });
+        return operation;
+    }
+}
+const boundedReadPorts = {
+    open,
+    read: (handle, buffer, offset, length, position) => handle.read(buffer, offset, length, position),
+    close: (handle) => handle.close(),
+};
 /**
  * The same read, handing back raw bytes.
  *
@@ -39,18 +110,35 @@ import { open } from "node:fs/promises";
  * UTF-8 round trip unchanged — a latin-1 byte that decodes to U+FFFD changes the file's digest, and that
  * check is only possible against the original buffer. Decoding here and re-encoding there would defeat it.
  */
-export async function readBoundedFile(path, limits) {
-    const read = await readBoundedBytes(path, limits);
-    return read.ok ? { ok: true, text: read.bytes.toString("utf8") } : read;
+export async function readBoundedFile(path, limits, ports = boundedReadPorts) {
+    const read = await readBoundedBytes(path, limits, ports);
+    if (!read.ok)
+        return read;
+    try {
+        return { ok: true, text: new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(read.bytes) };
+    }
+    catch {
+        return { ok: false, why: "invalid-utf8", detail: `${path} is not valid UTF-8` };
+    }
+}
+/** Preserve typed I/O evidence; a caller must not classify absence by searching diagnostic prose. */
+function ioCode(error) {
+    if (error && typeof error === "object" && "code" in error && typeof error.code === "string")
+        return { code: error.code };
+    return {};
 }
-export async function readBoundedBytes(path, limits) {
+export async function readBoundedBytes(path, limits, ports = boundedReadPorts) {
     const now = limits.now ?? Date.now;
     let handle;
+    const cleanup = new BoundedReadCleanup((held) => ports.close(held));
     try {
-        handle = await open(path, constants.O_RDONLY | constants.O_NONBLOCK);
+        handle = await ports.open(path, constants.O_RDONLY | constants.O_NONBLOCK);
+        cleanup.acquired(handle);
     }
     catch (error) {
-        return { ok: false, why: "unopenable", detail: String(error) };
+        cleanup.readSettled();
+        await cleanup.cleanup();
+        return { ok: false, why: "unopenable", detail: String(error), ...ioCode(error) };
     }
     try {
         const info = await handle.stat();
@@ -77,7 +165,7 @@ export async function readBoundedBytes(path, limits) {
                     why: "timed-out",
                     detail: `${path} did not finish reading within ${limits.timeoutMs}ms`,
                 };
-            const { bytesRead } = await handle.read(buffer, filled, buffer.length - filled, filled);
+            const { bytesRead } = await ports.read(handle, buffer, filled, buffer.length - filled, filled);
             if (bytesRead === 0)
                 break;
             filled += bytesRead;
@@ -91,10 +179,11 @@ export async function readBoundedBytes(path, limits) {
         return { ok: true, bytes: buffer.subarray(0, filled) };
     }
     catch (error) {
-        return { ok: false, why: "unreadable", detail: String(error) };
+        return { ok: false, why: "unreadable", detail: String(error), ...ioCode(error) };
     }
     finally {
-        await handle.close().catch(() => { });
+        cleanup.readSettled();
+        await cleanup.cleanup();
     }
 }
 //# sourceMappingURL=bounded-read.js.map