thinkpool-pair 0.7.364 → 0.7.366

package/scheduled-run-admission.mjs

@@ -1,364 +1 @@
-// Host-wide scheduled-run admission for account-served room bridge children.
-//
-// Every room bridge is a separate process, so a process-local count/window cannot
-// enforce the laptop safety boundary. This ledger serializes admissions under
-// TP_PAIR_ROOT. It stores only hashes and millisecond timestamps: never room codes,
-// prompts, provider/model names, credentials, endpoints, or host paths.
-
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { createHash, randomUUID } from 'node:crypto'
-import { SPAWN } from './cross-terminal.mjs'
-
-const VERSION = 1
-const LEDGER_NAME = 'scheduled-run-admission.json'
-const LOCK_NAME = '.scheduled-run-admission.lock'
-const MAX_LEDGER_BYTES = 128 * 1024
-const DEFAULT_LOCK_WAIT_MS = 1_000
-const DEFAULT_STALE_LOCK_MS = 30_000
-const DEFAULT_RETRY_MS = 12
-const DEFAULT_MAX_LEASE_MS = 31 * 60 * 1_000
-const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._:@-]{0,255}$/
-
-const rootPath = (root) => path.resolve(root || process.env.TP_PAIR_ROOT || path.join(os.homedir(), '.thinkpool-pair'))
-const pathsFor = (root) => {
-  const dir = rootPath(root)
-  return {
-    dir,
-    ledger: path.join(dir, LEDGER_NAME),
-    lock: path.join(dir, LOCK_NAME),
-  }
-}
-const digest = (value) => createHash('sha256').update(String(value)).digest('hex')
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
-const finiteInt = (value) => Number.isSafeInteger(value) && value >= 0
-const exactKeys = (value, expected) =>
-  value && typeof value === 'object' &&
-  Object.keys(value).sort().join('\0') === [...expected].sort().join('\0')
-
-function normalizeLimits (limits = {}) {
-  const machineMax = Number.isSafeInteger(limits.machineMax) && limits.machineMax > 0 ? limits.machineMax : SPAWN.machineMax
-  const perWindowCap = Number.isSafeInteger(limits.perWindowCap) && limits.perWindowCap > 0 ? limits.perWindowCap : SPAWN.perWindowCap
-  const windowMs = Number.isSafeInteger(limits.windowMs) && limits.windowMs > 0 ? limits.windowMs : SPAWN.windowMs
-  const maxLeaseMs = Number.isSafeInteger(limits.maxLeaseMs) && limits.maxLeaseMs > 0 ? limits.maxLeaseMs : DEFAULT_MAX_LEASE_MS
-  return Object.freeze({ machineMax, perWindowCap, windowMs, maxLeaseMs })
-}
-
-function emptyLedger () {
-  return { version: VERSION, leases: [], spawnTimes: [] }
-}
-
-function validLease (lease) {
-  return Boolean(exactKeys(lease, ['runKey', 'terminalKey', 'tokenHash', 'acquiredAt', 'expiresAt']) &&
-    /^[a-f0-9]{64}$/.test(lease.runKey) &&
-    /^[a-f0-9]{64}$/.test(lease.terminalKey) &&
-    /^[a-f0-9]{64}$/.test(lease.tokenHash) &&
-    finiteInt(lease.acquiredAt) &&
-    finiteInt(lease.expiresAt) &&
-    lease.expiresAt > lease.acquiredAt)
-}
-
-function readLedger (file, limits) {
-  let fd = null
-  let raw
-  try {
-    fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0))
-    const stat = fs.fstatSync(fd)
-    if (!stat.isFile() || stat.size > MAX_LEDGER_BYTES) throw new Error('invalid_admission_ledger')
-    raw = fs.readFileSync(fd, 'utf8')
-  } catch (error) {
-    if (error?.code === 'ENOENT') return emptyLedger()
-    throw error
-  } finally {
-    if (fd != null) fs.closeSync(fd)
-  }
-  const parsed = JSON.parse(raw)
-  if (!exactKeys(parsed, ['version', 'leases', 'spawnTimes']) || parsed.version !== VERSION || !Array.isArray(parsed.leases) || !Array.isArray(parsed.spawnTimes)) throw new Error('invalid_admission_ledger')
-  // Generous parse bounds let a future lower configured cap prune an older
-  // snapshot, while still refusing attacker-sized or corrupted structures.
-  if (parsed.leases.length > Math.max(64, limits.machineMax * 4) || parsed.spawnTimes.length > Math.max(128, limits.perWindowCap * 8)) throw new Error('unbounded_admission_ledger')
-  if (!parsed.leases.every(validLease) || !parsed.spawnTimes.every(finiteInt)) throw new Error('invalid_admission_ledger')
-  if (new Set(parsed.leases.map((lease) => lease.runKey)).size !== parsed.leases.length ||
-      new Set(parsed.leases.map((lease) => lease.terminalKey)).size !== parsed.leases.length) throw new Error('duplicate_admission_ledger')
-  return parsed
-}
-
-function pruneLedger (ledger, now, limits) {
-  // Never truncate still-active leases merely because a later process starts
-  // with a lower cap. Every active lease continues to consume capacity until
-  // exact release or expiry.
-  const leases = ledger.leases.filter((lease) => lease.expiresAt > now)
-  const spawnTimes = ledger.spawnTimes
-    .filter((at) => at > now - limits.windowMs && at <= now)
-    .sort((a, b) => a - b)
-  return {
-    ledger: { version: VERSION, leases, spawnTimes },
-    changed: leases.length !== ledger.leases.length || spawnTimes.length !== ledger.spawnTimes.length,
-  }
-}
-
-let tempSerial = 0
-function atomicWriteLedger (file, ledger) {
-  const serialized = `${JSON.stringify(ledger)}\n`
-  if (Buffer.byteLength(serialized) > MAX_LEDGER_BYTES) throw new Error('unbounded_admission_ledger')
-  const tmp = path.join(path.dirname(file), `.${path.basename(file)}.tmp.${process.pid}.${Date.now()}.${tempSerial++}`)
-  let fd = null
-  try {
-    fd = fs.openSync(tmp, 'wx', 0o600)
-    const bytes = Buffer.from(serialized)
-    for (let offset = 0; offset < bytes.length;) {
-      const written = fs.writeSync(fd, bytes, offset, bytes.length - offset)
-      if (written <= 0) throw new Error('short_admission_write')
-      offset += written
-    }
-    fs.fsyncSync(fd)
-    fs.closeSync(fd)
-    fd = null
-    fs.renameSync(tmp, file)
-    fs.chmodSync(file, 0o600)
-    // Persist the directory entry where the host filesystem supports it.
-    let dirFd = null
-    try {
-      dirFd = fs.openSync(path.dirname(file), 'r')
-      fs.fsyncSync(dirFd)
-    } catch {
-      // Windows and some network filesystems reject directory fsync. The
-      // replacement file itself was still fsynced before the atomic rename.
-    } finally {
-      if (dirFd != null) fs.closeSync(dirFd)
-    }
-  } catch (error) {
-    try { if (fd != null) fs.closeSync(fd) } catch { /* best effort */ }
-    try { fs.rmSync(tmp, { force: true }) } catch { /* best effort */ }
-    throw error
-  }
-}
-
-function ensureRoot (dir) {
-  fs.mkdirSync(dir, { recursive: true, mode: 0o700 })
-  const stat = fs.lstatSync(dir)
-  if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error('invalid_pair_root')
-}
-
-function readLockOwner (lock) {
-  const file = path.join(lock, 'owner')
-  const stat = fs.lstatSync(file)
-  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1_024) return null
-  const owner = JSON.parse(fs.readFileSync(file, 'utf8'))
-  if (!exactKeys(owner, ['pid', 'token', 'createdAt']) ||
-      !Number.isSafeInteger(owner.pid) || owner.pid < 1 ||
-      typeof owner.token !== 'string' || !/^[a-f0-9-]{36}$/.test(owner.token) ||
-      !finiteInt(owner.createdAt)) return null
-  return owner
-}
-
-function ownerProcessState (pid) {
-  try {
-    process.kill(pid, 0)
-    return 'live'
-  } catch (error) {
-    if (error?.code === 'ESRCH') return 'dead'
-    // EPERM and every unknown platform error fail closed.
-    return 'unknown'
-  }
-}
-
-function recoverStaleLock (lock, staleLockMs, now) {
-  const stat = fs.lstatSync(lock)
-  if (!stat.isDirectory() || stat.isSymbolicLink() || now - stat.mtimeMs <= staleLockMs) return false
-  let owner = null
-  try { owner = readLockOwner(lock) } catch { return false }
-  if (!owner || ownerProcessState(owner.pid) !== 'dead') return false
-  // Rename is the recovery claim. Only the process that atomically moves this
-  // exact stale directory may remove it; contenders see ENOENT and retry. A
-  // live, permission-unknown, or malformed owner is never stolen.
-  const stale = `${lock}.stale.${process.pid}.${randomUUID()}`
-  fs.renameSync(lock, stale)
-  fs.rmSync(stale, { recursive: true, force: true })
-  return true
-}
-
-async function acquireLock ({ dir, lock }, { lockWaitMs = DEFAULT_LOCK_WAIT_MS, staleLockMs = DEFAULT_STALE_LOCK_MS, retryMs = DEFAULT_RETRY_MS } = {}) {
-  ensureRoot(dir)
-  const startedAt = Date.now()
-  while (Date.now() - startedAt <= lockWaitMs) {
-    const owner = Object.freeze({ pid: process.pid, token: randomUUID(), createdAt: Date.now() })
-    try {
-      fs.mkdirSync(lock, { mode: 0o700 })
-      fs.writeFileSync(path.join(lock, 'owner'), JSON.stringify(owner), { flag: 'wx', mode: 0o600 })
-      return owner
-    } catch (error) {
-      if (error?.code !== 'EEXIST') {
-        // If mkdir succeeded but writing the ownership marker failed, remove
-        // only the markerless lock we just created.
-        try {
-          if (fs.existsSync(lock) && !fs.existsSync(path.join(lock, 'owner'))) fs.rmdirSync(lock)
-        } catch { /* a contender/stale recovery may own the path now */ }
-        throw error
-      }
-      try {
-        if (recoverStaleLock(lock, staleLockMs, Date.now())) continue
-      } catch (recoveryError) {
-        if (!['ENOENT', 'EEXIST'].includes(recoveryError?.code)) throw recoveryError
-      }
-      await sleep(Math.max(1, retryMs))
-    }
-  }
-  throw new Error('admission_lock_timeout')
-}
-
-async function withLedgerLock (options, operation) {
-  const paths = pathsFor(options?.root)
-  let lockOwner = null
-  try {
-    lockOwner = await acquireLock(paths, options)
-    return await operation(paths)
-  } finally {
-    if (lockOwner) {
-      try {
-        // A paused process may resume after its stale lock was recovered. Never
-        // let that old holder remove the new holder's lock.
-        const ownerFile = path.join(paths.lock, 'owner')
-        const currentOwner = readLockOwner(paths.lock)
-        if (currentOwner?.pid === lockOwner.pid && currentOwner?.token === lockOwner.token) {
-          fs.rmSync(ownerFile, { force: true })
-          fs.rmdirSync(paths.lock)
-        }
-      } catch { /* stale recovery/host cleanup owns it */ }
-    }
-  }
-}
-
-function invalidIdentity (runId, terminalId) {
-  return typeof runId !== 'string' || !SAFE_ID.test(runId) || typeof terminalId !== 'string' || !SAFE_ID.test(terminalId)
-}
-
-// Acquire before the database claim and local spawn. `runId` may be the
-// deterministic occurrence key (schedule-id + next-run-at) because the database
-// UUID does not exist until claim_due_code_schedule succeeds.
-export async function acquireScheduledRunAdmission ({
-  runId,
-  terminalId,
-  deadlineAt,
-  now = Date.now(),
-  root,
-  limits,
-  lockWaitMs,
-  staleLockMs,
-  retryMs,
-} = {}) {
-  const policy = normalizeLimits(limits)
-  if (invalidIdentity(runId, terminalId) || !finiteInt(now) || !finiteInt(deadlineAt) || deadlineAt <= now || deadlineAt - now > policy.maxLeaseMs) {
-    return Object.freeze({ ok: false, code: 'invalid_admission_request' })
-  }
-  const token = randomUUID()
-  const runKey = digest(runId)
-  const terminalKey = digest(terminalId)
-  try {
-    return await withLedgerLock({ root, lockWaitMs, staleLockMs, retryMs }, ({ ledger: file }) => {
-      const loaded = readLedger(file, policy)
-      const { ledger, changed } = pruneLedger(loaded, now, policy)
-      const sameRun = ledger.leases.find((lease) => lease.runKey === runKey)
-      const sameTerminal = ledger.leases.find((lease) => lease.terminalKey === terminalKey)
-      if (sameRun || sameTerminal) {
-        if (changed) atomicWriteLedger(file, ledger)
-        return Object.freeze({
-          ok: false,
-          code: sameRun && sameTerminal && sameRun === sameTerminal
-            ? 'duplicate_lease'
-            : sameRun ? 'duplicate_run' : 'duplicate_terminal',
-        })
-      }
-      if (ledger.leases.length >= policy.machineMax) {
-        if (changed) atomicWriteLedger(file, ledger)
-        return Object.freeze({ ok: false, code: 'machine_cap' })
-      }
-      if (ledger.spawnTimes.length >= policy.perWindowCap) {
-        if (changed) atomicWriteLedger(file, ledger)
-        return Object.freeze({ ok: false, code: 'burst_cap', retryAt: ledger.spawnTimes[0] + policy.windowMs })
-      }
-      ledger.leases.push({ runKey, terminalKey, tokenHash: digest(token), acquiredAt: now, expiresAt: deadlineAt })
-      ledger.spawnTimes.push(now)
-      atomicWriteLedger(file, ledger)
-      return Object.freeze({
-        ok: true,
-        code: 'admitted',
-        lease: Object.freeze({ runId, terminalId, token, expiresAt: deadlineAt }),
-      })
-    })
-  } catch {
-    return Object.freeze({ ok: false, code: 'admission_unavailable' })
-  }
-}
-
-// Exact-pair + one-time token release makes outcome/close cleanup idempotent
-// without allowing one room child to free another child's active lease.
-export async function releaseScheduledRunAdmission ({
-  runId,
-  terminalId,
-  token,
-  now = Date.now(),
-  root,
-  limits,
-  lockWaitMs,
-  staleLockMs,
-  retryMs,
-} = {}) {
-  const policy = normalizeLimits(limits)
-  if (invalidIdentity(runId, terminalId) || typeof token !== 'string' || token.length < 16 || token.length > 128 || !finiteInt(now)) {
-    return Object.freeze({ ok: false, code: 'invalid_release_request' })
-  }
-  const runKey = digest(runId)
-  const terminalKey = digest(terminalId)
-  const tokenHash = digest(token)
-  try {
-    return await withLedgerLock({ root, lockWaitMs, staleLockMs, retryMs }, ({ ledger: file }) => {
-      const loaded = readLedger(file, policy)
-      const { ledger, changed } = pruneLedger(loaded, now, policy)
-      const index = ledger.leases.findIndex((lease) => lease.runKey === runKey && lease.terminalKey === terminalKey)
-      if (index < 0) {
-        if (ledger.leases.some((lease) => lease.runKey === runKey || lease.terminalKey === terminalKey)) {
-          return Object.freeze({ ok: false, code: 'lease_mismatch' })
-        }
-        if (changed) atomicWriteLedger(file, ledger)
-        return Object.freeze({ ok: true, code: 'already_released' })
-      }
-      if (ledger.leases[index].tokenHash !== tokenHash) return Object.freeze({ ok: false, code: 'lease_mismatch' })
-      ledger.leases.splice(index, 1)
-      atomicWriteLedger(file, ledger)
-      return Object.freeze({ ok: true, code: 'released' })
-    })
-  } catch {
-    return Object.freeze({ ok: false, code: 'admission_unavailable' })
-  }
-}
-
-// Secret-free diagnostics/tests: counts and expiry only.
-export async function inspectScheduledRunAdmissions ({
-  now = Date.now(),
-  root,
-  limits,
-  lockWaitMs,
-  staleLockMs,
-  retryMs,
-} = {}) {
-  const policy = normalizeLimits(limits)
-  if (!finiteInt(now)) return Object.freeze({ ok: false, code: 'invalid_inspection_request' })
-  try {
-    return await withLedgerLock({ root, lockWaitMs, staleLockMs, retryMs }, ({ ledger: file }) => {
-      const loaded = readLedger(file, policy)
-      const { ledger, changed } = pruneLedger(loaded, now, policy)
-      if (changed) atomicWriteLedger(file, ledger)
-      return Object.freeze({
-        ok: true,
-        code: 'inspected',
-        active: ledger.leases.length,
-        burst: ledger.spawnTimes.length,
-        nextExpiryAt: ledger.leases.length ? Math.min(...ledger.leases.map((lease) => lease.expiresAt)) : null,
-      })
-    })
-  } catch {
-    return Object.freeze({ ok: false, code: 'admission_unavailable' })
-  }
-}
+import e from"node:fs";import n from"node:os";import t from"node:path";import{createHash as r,randomUUID as s}from"node:crypto";import{SPAWN as i}from"./cross-terminal.mjs";const o=131072,a=/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,255}$/,c=e=>r("sha256").update(String(e)).digest("hex"),l=e=>new Promise(n=>setTimeout(n,e)),d=e=>Number.isSafeInteger(e)&&e>=0,u=(e,n)=>e&&"object"==typeof e&&Object.keys(e).sort().join("\0")===[...n].sort().join("\0");function m(e={}){const n=Number.isSafeInteger(e.machineMax)&&e.machineMax>0?e.machineMax:i.machineMax,t=Number.isSafeInteger(e.perWindowCap)&&e.perWindowCap>0?e.perWindowCap:i.perWindowCap,r=Number.isSafeInteger(e.windowMs)&&e.windowMs>0?e.windowMs:i.windowMs,s=Number.isSafeInteger(e.maxLeaseMs)&&e.maxLeaseMs>0?e.maxLeaseMs:186e4;return Object.freeze({machineMax:n,perWindowCap:t,windowMs:r,maxLeaseMs:s})}function f(e){return Boolean(u(e,["runKey","terminalKey","tokenHash","acquiredAt","expiresAt"])&&/^[a-f0-9]{64}$/.test(e.runKey)&&/^[a-f0-9]{64}$/.test(e.terminalKey)&&/^[a-f0-9]{64}$/.test(e.tokenHash)&&d(e.acquiredAt)&&d(e.expiresAt)&&e.expiresAt>e.acquiredAt)}function y(n,t){let r,s=null;try{s=e.openSync(n,e.constants.O_RDONLY|(e.constants.O_NOFOLLOW||0));const t=e.fstatSync(s);if(!t.isFile()||t.size>o)throw new Error("invalid_admission_ledger");r=e.readFileSync(s,"utf8")}catch(e){if("ENOENT"===e?.code)return{version:1,leases:[],spawnTimes:[]};throw e}finally{null!=s&&e.closeSync(s)}const i=JSON.parse(r);if(!u(i,["version","leases","spawnTimes"])||1!==i.version||!Array.isArray(i.leases)||!Array.isArray(i.spawnTimes))throw new Error("invalid_admission_ledger");if(i.leases.length>Math.max(64,4*t.machineMax)||i.spawnTimes.length>Math.max(128,8*t.perWindowCap))throw new Error("unbounded_admission_ledger");if(!i.leases.every(f)||!i.spawnTimes.every(d))throw new Error("invalid_admission_ledger");if(new Set(i.leases.map(e=>e.runKey)).size!==i.leases.length||new Set(i.leases.map(e=>e.terminalKey)).size!==i.leases.length)throw new Error("duplicate_admission_ledger");return i}function p(e,n,t){const r=e.leases.filter(e=>e.expiresAt>n),s=e.spawnTimes.filter(e=>e>n-t.windowMs&&e<=n).sort((e,n)=>e-n);return{ledger:{version:1,leases:r,spawnTimes:s},changed:r.length!==e.leases.length||s.length!==e.spawnTimes.length}}let w=0;function h(n,r){const s=`${JSON.stringify(r)}\n`;if(Buffer.byteLength(s)>o)throw new Error("unbounded_admission_ledger");const i=t.join(t.dirname(n),`.${t.basename(n)}.tmp.${process.pid}.${Date.now()}.${w++}`);let a=null;try{a=e.openSync(i,"wx",384);const r=Buffer.from(s);for(let n=0;n<r.length;){const t=e.writeSync(a,r,n,r.length-n);if(t<=0)throw new Error("short_admission_write");n+=t}e.fsyncSync(a),e.closeSync(a),a=null,e.renameSync(i,n),e.chmodSync(n,384);let o=null;try{o=e.openSync(t.dirname(n),"r"),e.fsyncSync(o)}catch{}finally{null!=o&&e.closeSync(o)}}catch(n){try{null!=a&&e.closeSync(a)}catch{}try{e.rmSync(i,{force:!0})}catch{}throw n}}function k(n){const r=t.join(n,"owner"),s=e.lstatSync(r);if(!s.isFile()||s.isSymbolicLink()||s.size>1024)return null;const i=JSON.parse(e.readFileSync(r,"utf8"));return u(i,["pid","token","createdAt"])&&Number.isSafeInteger(i.pid)&&!(i.pid<1)&&"string"==typeof i.token&&/^[a-f0-9-]{36}$/.test(i.token)&&d(i.createdAt)?i:null}function g(n,t,r){const i=e.lstatSync(n);if(!i.isDirectory()||i.isSymbolicLink()||r-i.mtimeMs<=t)return!1;let o=null;try{o=k(n)}catch{return!1}if(!o||"dead"!==function(e){try{return process.kill(e,0),"live"}catch(e){return"ESRCH"===e?.code?"dead":"unknown"}}(o.pid))return!1;const a=`${n}.stale.${process.pid}.${s()}`;return e.renameSync(n,a),e.rmSync(a,{recursive:!0,force:!0}),!0}async function S(r,i){const o=(e=>{const r=(e=>t.resolve(e||process.env.TP_PAIR_ROOT||t.join(n.homedir(),".thinkpool-pair")))(e);return{dir:r,ledger:t.join(r,"scheduled-run-admission.json"),lock:t.join(r,".scheduled-run-admission.lock")}})(r?.root);let a=null;try{return a=await async function({dir:n,lock:r},{lockWaitMs:i=1e3,staleLockMs:o=3e4,retryMs:a=12}={}){!function(n){e.mkdirSync(n,{recursive:!0,mode:448});const t=e.lstatSync(n);if(!t.isDirectory()||t.isSymbolicLink())throw new Error("invalid_pair_root")}(n);const c=Date.now();for(;Date.now()-c<=i;){const n=Object.freeze({pid:process.pid,token:s(),createdAt:Date.now()});try{return e.mkdirSync(r,{mode:448}),e.writeFileSync(t.join(r,"owner"),JSON.stringify(n),{flag:"wx",mode:384}),n}catch(n){if("EEXIST"!==n?.code){try{e.existsSync(r)&&!e.existsSync(t.join(r,"owner"))&&e.rmdirSync(r)}catch{}throw n}try{if(g(r,o,Date.now()))continue}catch(e){if(!["ENOENT","EEXIST"].includes(e?.code))throw e}await l(Math.max(1,a))}}throw new Error("admission_lock_timeout")}(o,r),await i(o)}finally{if(a)try{const n=t.join(o.lock,"owner"),r=k(o.lock);r?.pid===a.pid&&r?.token===a.token&&(e.rmSync(n,{force:!0}),e.rmdirSync(o.lock))}catch{}}}function M(e,n){return"string"!=typeof e||!a.test(e)||"string"!=typeof n||!a.test(n)}export async function acquireScheduledRunAdmission({runId:e,terminalId:n,deadlineAt:t,now:r=Date.now(),root:i,limits:o,lockWaitMs:a,staleLockMs:l,retryMs:u}={}){const f=m(o);if(M(e,n)||!d(r)||!d(t)||t<=r||t-r>f.maxLeaseMs)return Object.freeze({ok:!1,code:"invalid_admission_request"});const w=s(),k=c(e),g=c(n);try{return await S({root:i,lockWaitMs:a,staleLockMs:l,retryMs:u},({ledger:s})=>{const i=y(s,f),{ledger:o,changed:a}=p(i,r,f),l=o.leases.find(e=>e.runKey===k),d=o.leases.find(e=>e.terminalKey===g);return l||d?(a&&h(s,o),Object.freeze({ok:!1,code:l&&d&&l===d?"duplicate_lease":l?"duplicate_run":"duplicate_terminal"})):o.leases.length>=f.machineMax?(a&&h(s,o),Object.freeze({ok:!1,code:"machine_cap"})):o.spawnTimes.length>=f.perWindowCap?(a&&h(s,o),Object.freeze({ok:!1,code:"burst_cap",retryAt:o.spawnTimes[0]+f.windowMs})):(o.leases.push({runKey:k,terminalKey:g,tokenHash:c(w),acquiredAt:r,expiresAt:t}),o.spawnTimes.push(r),h(s,o),Object.freeze({ok:!0,code:"admitted",lease:Object.freeze({runId:e,terminalId:n,token:w,expiresAt:t})}))})}catch{return Object.freeze({ok:!1,code:"admission_unavailable"})}}export async function releaseScheduledRunAdmission({runId:e,terminalId:n,token:t,now:r=Date.now(),root:s,limits:i,lockWaitMs:o,staleLockMs:a,retryMs:l}={}){const u=m(i);if(M(e,n)||"string"!=typeof t||t.length<16||t.length>128||!d(r))return Object.freeze({ok:!1,code:"invalid_release_request"});const f=c(e),w=c(n),k=c(t);try{return await S({root:s,lockWaitMs:o,staleLockMs:a,retryMs:l},({ledger:e})=>{const n=y(e,u),{ledger:t,changed:s}=p(n,r,u),i=t.leases.findIndex(e=>e.runKey===f&&e.terminalKey===w);return i<0?t.leases.some(e=>e.runKey===f||e.terminalKey===w)?Object.freeze({ok:!1,code:"lease_mismatch"}):(s&&h(e,t),Object.freeze({ok:!0,code:"already_released"})):t.leases[i].tokenHash!==k?Object.freeze({ok:!1,code:"lease_mismatch"}):(t.leases.splice(i,1),h(e,t),Object.freeze({ok:!0,code:"released"}))})}catch{return Object.freeze({ok:!1,code:"admission_unavailable"})}}export async function inspectScheduledRunAdmissions({now:e=Date.now(),root:n,limits:t,lockWaitMs:r,staleLockMs:s,retryMs:i}={}){const o=m(t);if(!d(e))return Object.freeze({ok:!1,code:"invalid_inspection_request"});try{return await S({root:n,lockWaitMs:r,staleLockMs:s,retryMs:i},({ledger:n})=>{const t=y(n,o),{ledger:r,changed:s}=p(t,e,o);return s&&h(n,r),Object.freeze({ok:!0,code:"inspected",active:r.leases.length,burst:r.spawnTimes.length,nextExpiryAt:r.leases.length?Math.min(...r.leases.map(e=>e.expiresAt)):null})})}catch{return Object.freeze({ok:!1,code:"admission_unavailable"})}}