stitchkit 0.103.8 → 0.103.10

package/dist/{index-v4a2fjtk.js → index-sybedc8b.js}

@@ -2,15 +2,19 @@ import {
   ManagedFilePathSchema2,
   ManagedFileRefSchema2
 } from "./index-xqhede6x.js";
+import {
+  AtomicFilePublicationError2,
+  publishAtomicFile
+} from "./index-8a9ksm91.js";
 import {
   isWithinDir2
 } from "./index-5cc6r990.js";
 
 // src/files/boundary.ts
 import { randomUUID } from "node:crypto";
-import { constants } from "node:fs";
-import { link, mkdir, open, realpath, rename, stat, unlink } from "node:fs/promises";
-import { basename, dirname, resolve } from "node:path";
+import { constants as constants2 } from "node:fs";
+import { mkdir, open as open2, realpath, stat, unlink } from "node:fs/promises";
+import { basename as basename2, dirname, resolve } from "node:path";
 
 // src/files/file-io.ts
 var ManagedFileInspectionSchema = ManagedFileRefSchema2.pick({
@@ -70,22 +74,29 @@ function inspectedRef(path, size, inspection, fallback = {}) {
 async function readHandle(handle, maxBytes, signal) {
   const chunks = [];
   let total = 0;
-  while (true) {
-    signal?.throwIfAborted();
+  let ended = false;
+  while (!ended) {
     const capacity = Math.min(64 * 1024, maxBytes + 1 - total);
-    if (capacity <= 0) {
+    if (capacity <= 0)
       throw new ManagedFileError2("FILE_TOO_LARGE", `file exceeds the ${maxBytes}-byte cap`);
-    }
     const chunk = new Uint8Array(capacity);
-    const { bytesRead } = await handle.read(chunk, 0, capacity);
-    if (bytesRead === 0)
-      break;
-    total += bytesRead;
-    if (total > maxBytes) {
-      throw new ManagedFileError2("FILE_TOO_LARGE", `file exceeds the ${maxBytes}-byte cap`);
+    let filled = 0;
+    while (filled < capacity) {
+      signal?.throwIfAborted();
+      const { bytesRead } = await handle.read(chunk, filled, capacity - filled);
+      if (bytesRead === 0) {
+        ended = true;
+        break;
+      }
+      filled += bytesRead;
+      total += bytesRead;
+      if (total > maxBytes)
+        throw new ManagedFileError2("FILE_TOO_LARGE", `file exceeds the ${maxBytes}-byte cap`);
     }
-    chunks.push(chunk.subarray(0, bytesRead));
+    if (filled > 0)
+      chunks.push(chunk.subarray(0, filled));
   }
+  signal?.throwIfAborted();
   const bytes = new Uint8Array(total);
   let offset = 0;
   for (const chunk of chunks) {
@@ -149,13 +160,77 @@ async function writeSource(handle, source, maxBytes, inspectionBytes, signal) {
   return { size, prefix };
 }
 
+// src/files/read.ts
+import { constants } from "node:fs";
+import { open } from "node:fs/promises";
+import { basename } from "node:path";
+async function readManagedDescriptor(target, path, maxBytes, options, inspection, openDescriptor = open) {
+  if (options.rejectSymlinks && !constants.O_NOFOLLOW)
+    throw new ManagedFileError2("FILE_UNSUPPORTED", "strict leaf nofollow is unavailable");
+  const flags = constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0);
+  const handle = await openDescriptor(target, flags);
+  let failed = false;
+  let failure;
+  let source;
+  try {
+    options.signal?.throwIfAborted();
+    const before = await handle.stat();
+    if (!before.isFile())
+      throw new ManagedFileError2("FILE_NOT_REGULAR", "managed path is not a regular file");
+    if (options.singleLink && before.nlink !== 1)
+      throw new ManagedFileError2("FILE_UNSAFE_LINK", "managed file has multiple links");
+    if (before.size > maxBytes)
+      throw new ManagedFileError2("FILE_TOO_LARGE", `file exceeds the ${maxBytes}-byte cap`);
+    const bytes = await readHandle(handle, maxBytes, options.signal);
+    const after = options.stable || options.observe ? await handle.stat() : before;
+    if (options.stable && (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs || before.nlink !== after.nlink || bytes.length !== after.size))
+      throw new ManagedFileError2("FILE_CHANGED", "managed file changed during read");
+    options.signal?.throwIfAborted();
+    const inspected = await inspectFile(inspection.inspect, {
+      prefix: bytes.slice(0, inspection.bytes),
+      name: basename(path)
+    }, inspection.timeoutMs, options.signal);
+    source = {
+      ref: inspectedRef(path, bytes.byteLength, inspected),
+      bytes,
+      ...options.observe ? {
+        observation: {
+          dev: after.dev,
+          ino: after.ino,
+          size: after.size,
+          nlink: after.nlink,
+          mtimeMs: after.mtimeMs,
+          ctimeMs: after.ctimeMs
+        }
+      } : {}
+    };
+  } catch (error) {
+    failed = true;
+    failure = error;
+  } finally {
+    try {
+      await handle.close();
+    } catch (error) {
+      if (!failed) {
+        failed = true;
+        failure = error;
+      }
+    }
+  }
+  if (failed)
+    throw failure;
+  if (source === undefined)
+    throw new Error("Read completed without a result");
+  return source;
+}
+
 // src/files/boundary.ts
 var DEFAULT_MAX_BYTES = 100 * 1024 * 1024;
 var DEFAULT_INSPECTION_BYTES = 64 * 1024;
 var DEFAULT_INSPECTION_TIMEOUT_MS = 15000;
 var nofollowFlag;
 var noFollow = () => {
-  nofollowFlag ??= constants.O_NOFOLLOW ?? 0;
+  nofollowFlag ??= constants2.O_NOFOLLOW ?? 0;
   return nofollowFlag;
 };
 
@@ -271,41 +346,35 @@ async function createManagedFileBoundary2(config) {
     async read(path, options = {}) {
       const resolved = targetFor(path);
       options.signal?.throwIfAborted();
-      const realTarget = await realpathOrNull(resolved.target, "failed to resolve managed file");
-      if (realTarget === null) {
-        throw new ManagedFileError2("FILE_NOT_FOUND", "managed file not found");
-      }
-      if (!isWithinDir2(root, realTarget)) {
-        throw new ManagedFileError2("FILE_OUTSIDE_ROOT", "managed-file path escapes its boundary");
+      let readTarget;
+      if (options.rejectSymlinks) {
+        const parent = await existingParent(root, resolved.target);
+        readTarget = resolve(parent, basename2(resolved.target));
+      } else {
+        const realTarget = await realpathOrNull(resolved.target, "failed to resolve managed file");
+        if (realTarget === null)
+          throw new ManagedFileError2("FILE_NOT_FOUND", "managed file not found");
+        if (!isWithinDir2(root, realTarget))
+          throw new ManagedFileError2("FILE_OUTSIDE_ROOT", "managed-file path escapes its boundary");
+        readTarget = realTarget;
       }
       const maxBytes = positiveLimit(options.maxBytes, maxReadBytes, "maxBytes");
-      let handle;
       try {
-        handle = await open(realTarget, constants.O_RDONLY | noFollow());
-        const info = await handle.stat();
-        if (!info.isFile()) {
-          throw new ManagedFileError2("FILE_NOT_REGULAR", "managed path is not a regular file");
-        }
-        const bytes = await readHandle(handle, maxBytes, options.signal);
-        const inspection = await inspectFile(config.inspect, {
-          prefix: bytes.slice(0, inspectionBytes),
-          name: basename(resolved.path)
-        }, inspectionTimeoutMs, options.signal);
-        return {
-          ref: inspectedRef(resolved.path, bytes.byteLength, inspection),
-          bytes
-        };
+        return await readManagedDescriptor(readTarget, resolved.path, maxBytes, options, {
+          inspect: config.inspect,
+          bytes: inspectionBytes,
+          timeoutMs: inspectionTimeoutMs
+        });
       } catch (error) {
-        if (options.signal?.aborted && error === options.signal.reason)
-          throw error;
-        if (errorCode(error) === "ENOENT") {
+        if (options.signal?.aborted)
+          throw options.signal.reason;
+        if (errorCode(error) === "ELOOP")
+          throw new ManagedFileError2("FILE_UNSAFE_LINK", "managed file leaf is a symlink", {
+            cause: error
+          });
+        if (errorCode(error) === "ENOENT")
           throw new ManagedFileError2("FILE_NOT_FOUND", "managed file not found");
-        }
         throw ioError("failed to read managed file", error);
-      } finally {
-        await handle?.close().catch(() => {
-          return;
-        });
       }
     },
     async write(path, source, options = {}) {
@@ -318,7 +387,7 @@ async function createManagedFileBoundary2(config) {
       let committed = false;
       let size = 0;
       try {
-        handle = await open(temporary, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | noFollow(), 384);
+        handle = await open2(temporary, constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY | noFollow(), 384);
         const written = await writeSource(handle, source, maxBytes, inspectionBytes, options.signal);
         size = written.size;
         if (options.durable)
@@ -328,28 +397,28 @@ async function createManagedFileBoundary2(config) {
         const inspection = await inspectFile(config.inspect, {
           prefix: written.prefix,
           ...options.mediaType ? { declaredMediaType: options.mediaType } : {},
-          name: options.name ?? basename(resolved.path)
+          name: options.name ?? basename2(resolved.path)
         }, inspectionTimeoutMs, options.signal);
         options.signal?.throwIfAborted();
-        if (options.replace) {
-          await rename(temporary, resolved.target);
+        try {
+          await publishAtomicFile(temporary, resolved.target, options.replace ?? false, options.durable ?? false);
           committed = true;
-        } else {
-          try {
-            await link(temporary, resolved.target);
+        } catch (error) {
+          if (error instanceof AtomicFilePublicationError2) {
             committed = true;
-          } catch (error) {
-            if (errorCode(error) === "EEXIST") {
-              throw new ManagedFileError2("FILE_EXISTS", "managed file already exists");
-            }
             throw error;
           }
+          if (errorCode(error) === "EEXIST")
+            throw new ManagedFileError2("FILE_EXISTS", "managed file already exists");
+          throw error;
         }
         return inspectedRef(resolved.path, size, inspection, {
           mediaType: options.mediaType,
           name: options.name
         });
       } catch (error) {
+        if (error instanceof AtomicFilePublicationError2)
+          throw error;
         if (options.signal?.aborted && error === options.signal.reason)
           throw error;
         throw ioError("failed to write managed file", error);

package/dist/internal/abort-race.d.ts

@@ -0,0 +1,3 @@
+/** Releases an await on cancellation without assuming a callback cooperates with its signal. */
+export declare function raceAbort<T>(operation: Promise<T>, signal: AbortSignal): Promise<T>;
+//# sourceMappingURL=abort-race.d.ts.map

package/dist/internal/abort-race.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"abort-race.d.ts","sourceRoot":"","sources":["../../src/internal/abort-race.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,wBAAgB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAsBnF"}

package/dist/internal/atomic-file.d.ts

@@ -29,14 +29,32 @@ export interface WriteFileAtomicOptions {
      * caller states, never one a default makes for them.
      */
     mode?: number;
+    /** Replace by default; false atomically refuses any existing file or link. */
+    replace?: boolean;
+    /** Default file: fsync bytes. directory also syncs the parent after publication. */
+    durability?: 'none' | 'file' | 'directory';
 }
 /**
  * Write `data` to `target` atomically: a reader sees the old contents or the
  * new ones, never part of either, and the new file has `mode` from its first
- * visible moment. A failed write leaves the target untouched and no staging
- * file behind.
+ * visible moment. A failure before publication leaves the target untouched. Directory-sync or
+ * staging-link cleanup failure after publication throws AtomicFilePublicationError
+ * with published=true; do not blindly repeat an external action.
  */
 export declare function writeFileAtomic(target: string, data: Uint8Array | string, options?: WriteFileAtomicOptions): Promise<void>;
+interface AtomicFileWriteIO {
+    open(path: string, flags: 'wx', mode: number): Promise<{
+        writeFile(bytes: Uint8Array): Promise<void>;
+        chmod(mode: number): Promise<void>;
+        sync(): Promise<void>;
+        close(): Promise<void>;
+    }>;
+    unlink(path: string): Promise<void>;
+    publish(staged: string, target: string, replace: boolean, directorySync: boolean): Promise<void>;
+}
+/** Internal syscall seam for publication-order and precommit fault controls. */
+export declare function writeAtomicFileData(target: string, data: Uint8Array | string, options: WriteFileAtomicOptions, io?: AtomicFileWriteIO): Promise<void>;
 /** The synchronous form of {@link writeFileAtomic}, with the same guarantees in the same order. */
 export declare function writeFileAtomicSync(target: string, data: Uint8Array | string, options?: WriteFileAtomicOptions): void;
+export {};
 //# sourceMappingURL=atomic-file.d.ts.map

package/dist/internal/atomic-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"atomic-file.d.ts","sourceRoot":"","sources":["../../src/internal/atomic-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAeH,0EAA0E;AAC1E,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAYD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GAAG,MAAM,EACzB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED,mGAAmG;AACnG,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GAAG,MAAM,EACzB,OAAO,GAAE,sBAA2B,GACnC,IAAI,CA6BN"}
+{"version":3,"file":"atomic-file.d.ts","sourceRoot":"","sources":["../../src/internal/atomic-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAQH,0EAA0E;AAC1E,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,CAAC;CAC5C;AAYD;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GAAG,MAAM,EACzB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,UAAU,iBAAiB;IACzB,IAAI,CACF,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,IAAI,EACX,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QACT,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;KACxB,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,CACL,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,OAAO,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,gFAAgF;AAChF,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GAAG,MAAM,EACzB,OAAO,EAAE,sBAAsB,EAC/B,EAAE,GAAE,iBAAgE,GACnE,OAAO,CAAC,IAAI,CAAC,CAqCf;AAED,mGAAmG;AACnG,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GAAG,MAAM,EACzB,OAAO,GAAE,sBAA2B,GACnC,IAAI,CAiDN"}

package/dist/internal/atomic-publication.d.ts

@@ -0,0 +1,19 @@
+/** The new target is visible; failure is not evidence that publication did not occur. */
+export declare class AtomicFilePublicationError extends Error {
+    readonly phase: 'cleanup' | 'directory-sync' | 'directory-close';
+    readonly published = true;
+    constructor(phase: 'cleanup' | 'directory-sync' | 'directory-close', cause: unknown);
+}
+/** Native publication syscalls; injectable only at this internal IO boundary for fault controls. */
+export interface PublicationIO {
+    rename(from: string, to: string): Promise<void>;
+    link(from: string, to: string): Promise<void>;
+    unlink(path: string): Promise<void>;
+    open(path: string, flags: 'r'): Promise<{
+        sync(): Promise<void>;
+        close(): Promise<void>;
+    }>;
+}
+export declare function publishAtomicFile(staged: string, target: string, replace: boolean, directorySync: boolean, io?: PublicationIO): Promise<void>;
+export declare function publishAtomicFileSync(staged: string, target: string, replace: boolean, directorySync: boolean): void;
+//# sourceMappingURL=atomic-publication.d.ts.map

package/dist/internal/atomic-publication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-publication.d.ts","sourceRoot":"","sources":["../../src/internal/atomic-publication.ts"],"names":[],"mappings":"AAIA,yFAAyF;AACzF,qBAAa,0BAA2B,SAAQ,KAAK;aAGjC,KAAK,EAAE,SAAS,GAAG,gBAAgB,GAAG,iBAAiB;IAFzE,QAAQ,CAAC,SAAS,QAAQ;IAC1B,YACkB,KAAK,EAAE,SAAS,GAAG,gBAAgB,GAAG,iBAAiB,EACvE,KAAK,EAAE,OAAO,EAIf;CACF;AAED,oGAAoG;AACpG,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,OAAO,CAAC;QAAE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC,CAAC;CAC5F;AAGD,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,OAAO,EACtB,EAAE,GAAE,aAAsB,GACzB,OAAO,CAAC,IAAI,CAAC,CAqCf;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,OAAO,GACrB,IAAI,CAmCN"}

package/dist/internal/exclusive-lock.d.ts

@@ -23,6 +23,7 @@ export interface ExclusiveLockDiagnosis {
     readonly liveness: 'alive' | 'gone' | 'not-probed';
     readonly identity?: ProcessOwnerEvidence['identity'];
     readonly owner: ExclusiveLockOwner | null;
+    readonly cause?: unknown;
 }
 /** A lock this process holds. */
 export interface HeldExclusiveLock {
@@ -42,7 +43,7 @@ export interface ExclusiveLockAttemptOptions {
      * How old a lock with no readable owner must be before it is taken. Absent,
      * an ownerless lock is never taken — it may predate owner records.
      */
-    readonly ownerlessGraceMs?: number;
+    readonly ownerlessGraceMs?: number | null;
 }
 export type ExclusiveLockAttempt = {
     readonly held: HeldExclusiveLock;

package/dist/internal/exclusive-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exclusive-lock.d.ts","sourceRoot":"","sources":["../../src/internal/exclusive-lock.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,KAAK,oBAAoB,EAG1B,MAAM,oBAAoB,CAAC;AAK5B,gDAAgD;AAChD,QAAA,MAAM,wBAAwB;;;;;;;;;;;;;;iBAO5B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,wCAAwC;AACxC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,cAAc,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;IAC5E,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,YAAY,CAAC;IACnD,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAC3C;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,kFAAkF;IAClF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,uFAAuF;IACvF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IACE,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC;CAC7C,CAAC;AAmLN;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAe/B;AAED,gFAAgF;AAChF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAEpC"}
+{"version":3,"file":"exclusive-lock.d.ts","sourceRoot":"","sources":["../../src/internal/exclusive-lock.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,KAAK,oBAAoB,EAG1B,MAAM,oBAAoB,CAAC;AAK5B,gDAAgD;AAChD,QAAA,MAAM,wBAAwB;;;;;;;;;;;;;;iBAO5B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,wCAAwC;AACxC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,cAAc,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;IAC5E,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,YAAY,CAAC;IACnD,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACrD,QAAQ,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,kFAAkF;IAClF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,uFAAuF;IACvF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IACE,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC;CAC7C,CAAC;AAmLN;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAqB/B;AAED,gFAAgF;AAChF,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAEpC"}

package/dist/internal/json-data.d.ts

@@ -0,0 +1,8 @@
+/** Validation shared by durable JSON and canonical JSON; serialization has one separate owner. */
+export declare function isJsonData(value: unknown, limits: {
+    maxDepth: number;
+    maxNodes: number;
+    maxBytes: number;
+    omitObjectUndefined: boolean;
+}): boolean;
+//# sourceMappingURL=json-data.d.ts.map

package/dist/internal/json-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-data.d.ts","sourceRoot":"","sources":["../../src/internal/json-data.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,wBAAgB,UAAU,CACxB,KAAK,EAAE,OAAO,EACd,MAAM,EAAE;IACN,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,OAAO,CAAC;CAC9B,GACA,OAAO,CA0DT"}

package/dist/internal/process-instance.d.ts

@@ -1,5 +1,4 @@
 import { z } from 'zod';
-import { probeLiveness } from './process-identity.js';
 export declare const ProcessInstanceSchema: z.ZodObject<{
     platform: z.ZodEnum<{
         darwin: "darwin";
@@ -10,17 +9,55 @@ export declare const ProcessInstanceSchema: z.ZodObject<{
     startId: z.ZodString;
 }, z.core.$strict>;
 export type ProcessInstance = z.infer<typeof ProcessInstanceSchema>;
+/** An unavailable observation preserves its native or validation cause; it never proves death. */
+declare const ProcessInstanceObservationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    state: z.ZodLiteral<"observed">;
+    instance: z.ZodObject<{
+        platform: z.ZodEnum<{
+            darwin: "darwin";
+            linux: "linux";
+        }>;
+        bootId: z.ZodString;
+        namespace: z.ZodString;
+        startId: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strip>, z.ZodObject<{
+    state: z.ZodLiteral<"unavailable">;
+    cause: z.ZodUnknown;
+}, z.core.$strip>], "state">;
+export type ProcessInstanceObservation = z.infer<typeof ProcessInstanceObservationSchema>;
+export declare function observeProcessInstance(pid: number): Promise<ProcessInstanceObservation>;
 /** /proc stat field 22 follows a command name that may itself contain spaces and parentheses. */
 export declare function linuxProcessStart(stat: string, pid: number): string | null;
 /** @internal procRoot permits kernel-format fixtures without changing a real process or boot. */
 export declare function readProcessInstance(pid: number, procRoot?: string): Promise<ProcessInstance | null>;
-export interface ProcessOwnerEvidence {
-    readonly liveness: 'alive' | 'gone' | 'not-probed';
-    readonly identity: 'matched' | 'different-boot' | 'reused-pid' | 'pid-gone' | 'legacy' | 'unavailable';
-}
+/** @internal The fixture root is never a public owner option. */
+export declare function observeProcessInstanceAt(pid: number, procRoot: string): Promise<ProcessInstanceObservation>;
+declare const ProcessOwnerEvidenceSchema: z.ZodObject<{
+    liveness: z.ZodEnum<{
+        alive: "alive";
+        gone: "gone";
+        "not-probed": "not-probed";
+    }>;
+    identity: z.ZodEnum<{
+        "different-boot": "different-boot";
+        legacy: "legacy";
+        matched: "matched";
+        "pid-gone": "pid-gone";
+        "reused-pid": "reused-pid";
+        unavailable: "unavailable";
+    }>;
+    cause: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strip>;
+export type ProcessOwnerEvidence = z.infer<typeof ProcessOwnerEvidenceSchema>;
 /** Compare identities only inside one machine (the caller establishes that boundary). */
-export declare function probeProcessOwner(pid: number, recorded: ProcessInstance | null | undefined, probes?: {
-    read: typeof readProcessInstance;
-    liveness: typeof probeLiveness;
-}): Promise<ProcessOwnerEvidence>;
+export declare function probeProcessOwner(pid: number, recorded: ProcessInstance | null | undefined): Promise<ProcessOwnerEvidence>;
+interface ProcessOwnerProbes {
+    read(pid: number): Promise<ProcessInstance | null>;
+    liveness(pid: number): Promise<'alive' | 'gone'>;
+    observe?(pid: number): Promise<ProcessInstanceObservation>;
+}
+/** @internal Injection is for kernel-format controls, not a public ownership assertion. */
+export declare function probeProcessOwnerWith(pid: number, recorded: ProcessInstance | null | undefined, probes?: ProcessOwnerProbes): Promise<ProcessOwnerEvidence>;
+export {};
 //# sourceMappingURL=process-instance.d.ts.map

package/dist/internal/process-instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-instance.d.ts","sourceRoot":"","sources":["../../src/internal/process-instance.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,eAAO,MAAM,qBAAqB;;;;;;;;kBAOvB,CAAC;AACZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS1E;AAED,iGAAiG;AACjG,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,EACX,QAAQ,SAAU,GACjB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CA6CjC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,YAAY,CAAC;IACnD,QAAQ,CAAC,QAAQ,EACb,SAAS,GACT,gBAAgB,GAChB,YAAY,GACZ,UAAU,GACV,QAAQ,GACR,aAAa,CAAC;CACnB;AAED,yFAAyF;AACzF,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC5C,MAAM;IAAK,IAAI;IAAuB,QAAQ;CAAiB,GAC9D,OAAO,CAAC,oBAAoB,CAAC,CAyB/B"}
+{"version":3,"file":"process-instance.d.ts","sourceRoot":"","sources":["../../src/internal/process-instance.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,qBAAqB;;;;;;;;kBAOvB,CAAC;AACZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,kGAAkG;AAClG,QAAA,MAAM,gCAAgC;;;;;;;;;;;;;;4BAGpC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,0BAA0B,CAAC,CAGrC;AAED,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS1E;AAED,iGAAiG;AACjG,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,EACX,QAAQ,SAAU,GACjB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAGjC;AAED,iEAAiE;AACjE,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,0BAA0B,CAAC,CAsDrC;AAED,QAAA,MAAM,0BAA0B;;;;;;;;;;;;;;;iBAW9B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,yFAAyF;AACzF,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,GAC3C,OAAO,CAAC,oBAAoB,CAAC,CAQ/B;AAED,UAAU,kBAAkB;IAC1B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACnD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAC5D;AAED,2FAA2F;AAC3F,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC5C,MAAM,GAAE,kBAA2E,GAClF,OAAO,CAAC,oBAAoB,CAAC,CA2C/B"}

package/dist/internal/with-exclusive-lock.d.ts

@@ -18,7 +18,7 @@ export interface ExclusiveLockOptions {
     timeoutMs?: number;
     /** Stops the wait; an abort while waiting rejects at once with its reason as the cause. */
     signal?: AbortSignal;
-    /** Permission bits of the lock file. Default `0o600`. */
+    /** Exact permission bits, independent of umask. Default `0o600`. Shared readers need a common group and traversable parents. */
     mode?: number;
     /**
      * This machine's identity, for a platform that offers none (`/etc/machine-id`
@@ -29,9 +29,10 @@ export interface ExclusiveLockOptions {
     /**
      * How old a lock with no readable owner must be before it is taken — the one
      * case where time decides, left by a process that died between creating the
-     * file and recording itself. Default 5 000.
+     * file and recording itself. Default 5 000; `null` disables age-based reclaim,
+     * including abandoned ownerless reclaim guards.
      */
-    ownerlessGraceMs?: number;
+    ownerlessGraceMs?: number | null;
 }
 /** The lock `run` executes under. */
 export interface ExclusiveLock {

package/dist/internal/with-exclusive-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-exclusive-lock.d.ts","sourceRoot":"","sources":["../../src/internal/with-exclusive-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,qEAAqE;AACrE,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI;IALnC,IAAI,SAAwB;IACrC,YACW,IAAI,EAAE,cAAc,GAAG,cAAc,EACrC,KAAK,EAAE,MAAM;IACtB,wFAAwF;IAC/E,MAAM,EAAE,kBAAkB,GAAG,IAAI,EAC1C,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAG9B;CACF;AAyCD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAC5C,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,CAAC,CAAC,CAwDZ"}
+{"version":3,"file":"with-exclusive-lock.d.ts","sourceRoot":"","sources":["../../src/internal/with-exclusive-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,gIAAgI;IAChI,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,qEAAqE;AACrE,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI;IALnC,IAAI,SAAwB;IACrC,YACW,IAAI,EAAE,cAAc,GAAG,cAAc,EACrC,KAAK,EAAE,MAAM;IACtB,wFAAwF;IAC/E,MAAM,EAAE,kBAAkB,GAAG,IAAI,EAC1C,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAG9B;CACF;AAyCD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAC5C,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,CAAC,CAAC,CA4DZ"}

package/dist/primitives/canonical-json.d.ts

@@ -0,0 +1,11 @@
+import { z } from 'zod';
+declare const CanonicalJsonOptionsSchema: z.ZodObject<{
+    maxDepth: z.ZodDefault<z.ZodNumber>;
+    maxNodes: z.ZodDefault<z.ZodNumber>;
+    maxBytes: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;
+export type CanonicalJsonOptions = z.input<typeof CanonicalJsonOptionsSchema>;
+/** Bounded plain JSON, UTF-16 sorted keys; undefined object members are omitted. */
+export declare function canonicalJson(value: unknown, options?: CanonicalJsonOptions): string;
+export {};
+//# sourceMappingURL=canonical-json.d.ts.map

package/dist/primitives/canonical-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.d.ts","sourceRoot":"","sources":["../../src/primitives/canonical-json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,QAAA,MAAM,0BAA0B;;;;kBAQ9B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,oBAAyB,GAAG,MAAM,CAOxF"}

package/dist/primitives/index.d.ts

@@ -1,4 +1,5 @@
 export { type AuditOmitPolicy, type AuditPolicy, type AuditRecord, type AuditRecordPolicy, AuditRecordSchema, assertAuditDeclared, audit, type CreateAuditRecordInput, createAuditRecord, } from './audit.js';
+export { type CanonicalJsonOptions, canonicalJson } from './canonical-json.js';
 export { type DeadlineResult, DeadlineResultSchema, defineDeadlinePolicy, } from './deadline.js';
 export { type DomainEventDeliveryClaim, DomainEventDeliveryClaimSchema, type DomainEventDeliveryOutcome, DomainEventDeliveryOutcomeSchema, type DomainEventDeliveryPlan, type DomainEventDestination, DomainEventDestinationSchema, type DomainEventDispatchResult, type DomainEventOutbox, type DomainEventRoute, type DomainEventTransport, defineDomainEventDelivery, } from './delivery.js';
 export { createDomainEventSchema, type DomainEvent, type DomainEventActor, DomainEventActorSchema, DomainEventSchema, type DomainEventSubject, DomainEventSubjectSchema, } from './event.js';

package/dist/primitives/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/primitives/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,EACL,KAAK,sBAAsB,EAC3B,iBAAiB,GAClB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,KAAK,cAAc,EACnB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,wBAAwB,EAC7B,8BAA8B,EAC9B,KAAK,0BAA0B,EAC/B,gCAAgC,EAChC,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,EACvB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,8BAA8B,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,GAChC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,UAAU,EACf,KAAK,UAAU,EACf,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,QAAQ,EACR,iBAAiB,EACjB,WAAW,EACX,KAAK,KAAK,EACV,KAAK,UAAU,EACf,KAAK,UAAU,EACf,aAAa,EACb,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,KAAK,QAAQ,EACb,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/primitives/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,EACL,KAAK,sBAAsB,EAC3B,iBAAiB,GAClB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,KAAK,oBAAoB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EACL,KAAK,cAAc,EACnB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,wBAAwB,EAC7B,8BAA8B,EAC9B,KAAK,0BAA0B,EAC/B,gCAAgC,EAChC,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,EACvB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,wBAAwB,GACzB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,8BAA8B,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,GAChC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,UAAU,EACf,KAAK,UAAU,EACf,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,QAAQ,EACR,iBAAiB,EACjB,WAAW,EACX,KAAK,KAAK,EACV,KAAK,UAAU,EACf,KAAK,UAAU,EACf,aAAa,EACb,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,KAAK,QAAQ,EACb,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,YAAY,CAAC"}

package/dist/process/command-owner.d.ts

@@ -0,0 +1,13 @@
+import { type ChildProcessWithoutNullStreams } from 'node:child_process';
+import { type NativeCommandOptions } from './contract.js';
+/** One-shot native execution; sandbox policy/admission is composed above this owner. */
+export declare function startNativeCommand(input: NativeCommandOptions, onSpawn?: (child: ChildProcessWithoutNullStreams) => void): {
+    result: Promise<{
+        exitCode: number | null;
+        signal: string | null;
+        stdout: Uint8Array<ArrayBuffer>;
+        stderr: Uint8Array<ArrayBuffer>;
+    }>;
+    stop(): Promise<void>;
+};
+//# sourceMappingURL=command-owner.d.ts.map

package/dist/process/command-owner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-owner.d.ts","sourceRoot":"","sources":["../../src/process/command-owner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,8BAA8B,EAAS,MAAM,oBAAoB,CAAC;AAGhF,OAAO,EAEL,KAAK,oBAAoB,EAI1B,MAAM,YAAY,CAAC;AAIpB,wFAAwF;AACxF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,IAAI;;;;;;;;EA+J1D"}

package/dist/process/command.d.ts

@@ -0,0 +1,3 @@
+import type { NativeCommandOptions, NativeCommandResult } from './contract.js';
+export declare function runNativeCommand(input: NativeCommandOptions): Promise<NativeCommandResult>;
+//# sourceMappingURL=command.d.ts.map

package/dist/process/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/process/command.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE5E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAE1F"}

package/dist/process/contract.d.ts

@@ -0,0 +1,45 @@
+import { z } from 'zod';
+declare const NativeCommandSettlementSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"exit">;
+    exitCode: z.ZodNullable<z.ZodNumber>;
+    signal: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"error">;
+    cause: z.ZodUnknown;
+}, z.core.$strip>], "kind">;
+export type NativeCommandSettlement = z.infer<typeof NativeCommandSettlementSchema>;
+export declare const NativeCommandOptionsSchema: z.ZodObject<{
+    executable: z.ZodString;
+    args: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    cwd: z.ZodOptional<z.ZodString>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    envPolicy: z.ZodDefault<z.ZodEnum<{
+        ambient: "ambient";
+        "declared-only": "declared-only";
+    }>>;
+    signal: z.ZodOptional<z.ZodCustom<AbortSignal, AbortSignal>>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    maxOutputBytes: z.ZodOptional<z.ZodNumber>;
+    capture: z.ZodDefault<z.ZodBoolean>;
+    stdin: z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBufferLike>, Uint8Array<ArrayBufferLike>>>;
+    maxStdinBytes: z.ZodDefault<z.ZodNumber>;
+    onOutput: z.ZodOptional<z.ZodCustom<(bytes: Uint8Array, channel: 'stdout' | 'stderr', signal: AbortSignal) => void | Promise<void>, (bytes: Uint8Array, channel: 'stdout' | 'stderr', signal: AbortSignal) => void | Promise<void>>>;
+    onLeaderSettled: z.ZodOptional<z.ZodCustom<(event: NativeCommandSettlement, signal: AbortSignal) => void | Promise<void>, (event: NativeCommandSettlement, signal: AbortSignal) => void | Promise<void>>>;
+    killGraceMs: z.ZodDefault<z.ZodNumber>;
+    cleanupTimeoutMs: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;
+export type NativeCommandOptions = z.input<typeof NativeCommandOptionsSchema>;
+export type ParsedNativeCommandOptions = z.output<typeof NativeCommandOptionsSchema>;
+declare const NativeCommandResultSchema: z.ZodObject<{
+    exitCode: z.ZodNullable<z.ZodNumber>;
+    signal: z.ZodNullable<z.ZodString>;
+    stdout: z.ZodInstanceOf<Uint8Array<ArrayBuffer>>;
+    stderr: z.ZodInstanceOf<Uint8Array<ArrayBuffer>>;
+}, z.core.$strip>;
+export type NativeCommandResult = z.infer<typeof NativeCommandResultSchema>;
+export declare class NativeCommandError extends Error {
+    readonly code: 'COMMAND_LIMIT' | 'COMMAND_UNAVAILABLE' | 'COMMAND_CLEANUP';
+    constructor(code: 'COMMAND_LIMIT' | 'COMMAND_UNAVAILABLE' | 'COMMAND_CLEANUP', message: string, options?: ErrorOptions);
+}
+export {};
+//# sourceMappingURL=contract.d.ts.map

package/dist/process/contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../src/process/contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,QAAA,MAAM,6BAA6B;;;;;;;2BAOjC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;gDAoBtB,UAAU,WACR,QAAQ,GAAG,QAAQ,UACpB,WAAW,KAChB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;uDAKX,uBAAuB,UAAU,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;;;kBAiBvF,CAAC;AACL,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;AACrF,QAAA,MAAM,yBAAyB;;;;;iBAK7B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,qBAAa,kBAAmB,SAAQ,KAAK;aAEzB,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB;IADnF,YACkB,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB,EACjF,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY,EAIvB;CACF"}

package/dist/process/group.d.ts

@@ -0,0 +1,6 @@
+import { NativeCommandError } from './contract.js';
+export declare function signalGroup(pid: number | undefined, signal: NodeJS.Signals): void;
+export declare function stopCommandGroup(pid: number | undefined, graceMs: number, cleanupTimeoutMs?: number): Promise<void>;
+export declare function commandCleanupError(cause: unknown): NativeCommandError;
+export declare function waitForCommandClose<T>(closed: Promise<T>, timeoutMs: number): Promise<T>;
+//# sourceMappingURL=group.d.ts.map

package/dist/process/group.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group.d.ts","sourceRoot":"","sources":["../../src/process/group.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAWhD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAOjF;AAiCD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,OAAO,EAAE,MAAM,EACf,gBAAgB,SAAO,GACtB,OAAO,CAAC,IAAI,CAAC,CASf;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CAItE;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAExF"}

package/dist/process/leader-settlement.d.ts

@@ -0,0 +1,4 @@
+import type { NativeCommandSettlement, ParsedNativeCommandOptions } from './contract.js';
+/** One bounded external resource settlement, shared by observed exit and terminal failure. */
+export declare function createLeaderSettlement(options: ParsedNativeCommandOptions, signal: AbortSignal): (event: NativeCommandSettlement) => Promise<void>;
+//# sourceMappingURL=leader-settlement.d.ts.map

package/dist/process/leader-settlement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"leader-settlement.d.ts","sourceRoot":"","sources":["../../src/process/leader-settlement.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAGtF,8FAA8F;AAC9F,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,0BAA0B,EACnC,MAAM,EAAE,WAAW,WAGJ,uBAAuB,KAAG,OAAO,CAAC,IAAI,CAAC,CA+BvD"}