@ai-coders/installer 0.3.0

package/dist/products/second-brain/service.js

@@ -0,0 +1,806 @@
+/**
+ * Real wiring behind the installer HTTP API: SSH sessions, source archiving,
+ * state persistence, the install pipelines, and the optional GitHub client.
+ */
+import { execFile } from "node:child_process";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { promisify } from "node:util";
+import { z } from "zod";
+import { runInstall, runLocalDeploy } from "./apply.js";
+import { GitHubClient } from "./github.js";
+import { HostingerActionFailedError, HostingerActionOutcomeUnknownError, HostingerActionTimeoutError, HostingerApiError, HostingerClient, HostingerPasswordValidationError, } from "./hostinger.js";
+import { defaultLanguage } from "./i18n.js";
+import { generateDeployKey } from "./keys.js";
+import { sealForGitHubSecret } from "./sealed-box.js";
+import { SshSession } from "./ssh.js";
+import { provisionBearerToken } from "./bearer.js";
+import { buildOwnerBootstrapInput, ownerBootstrapCommand, interpretBootstrapResult, waitEngineCommand, } from "./bootstrap.js";
+import { normalizeDomain } from "./envfile.js";
+import { recoverExistingInstallation } from "./recovery.js";
+import { deleteState, loadState, saveState, } from "./state.js";
+import { checkDns, verifyDeployment } from "./verify.js";
+const execFileAsync = promisify(execFile);
+const installInputSchema = z.object({
+    language: z.enum(["en", "pt-BR"]).default(defaultLanguage),
+    vps: z.object({
+        host: z.string().min(1),
+        port: z.number().int().min(1).max(65535).default(22),
+        username: z.string().min(1).default("root"),
+    }),
+    vpsProof: z.string().min(16),
+    domain: z
+        .string()
+        .min(3)
+        .transform((value, context) => {
+        try {
+            return normalizeDomain(value);
+        }
+        catch (error) {
+            context.addIssue({
+                code: "custom",
+                message: error instanceof Error ? error.message : String(error),
+            });
+            return z.NEVER;
+        }
+    }),
+    openRouterApiKey: z.string().min(1),
+    ownerEmail: z.string().email(),
+    ownerPassword: z.string().min(12),
+    enableBearerToken: z.boolean().default(false),
+});
+const bearerInputSchema = z.object({
+    email: z.string().email(),
+});
+const hostingerConnectInputSchema = z.object({
+    token: z.string().trim().min(1),
+});
+const hostingerPreparePasswordResetSchema = z.object({
+    virtualMachineId: z.number().int().positive().safe(),
+});
+const hostingerCommitPasswordResetSchema = z.object({
+    confirmationToken: z.string().min(16).max(256),
+    confirmationText: z.string().min(1).max(255),
+    password: z.string().min(1),
+});
+const sshTestInputSchema = z.object({
+    host: z.string().trim().min(1),
+    port: z.number().int().min(1).max(65535),
+    username: z.string().trim().min(1),
+    password: z.string().min(1),
+});
+const recoveryInputSchema = z.object({
+    language: z.enum(["en", "pt-BR"]).default(defaultLanguage),
+    vps: z.object({
+        host: z.string().trim().min(1),
+        port: z.number().int().min(1).max(65535).default(22),
+        username: z.string().trim().min(1).default("root"),
+    }),
+    vpsPassword: z.string().min(1),
+});
+function secureTokenEqual(received, expected) {
+    const left = Buffer.from(received, "utf8");
+    const right = Buffer.from(expected, "utf8");
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+function isIpv4Address(value) {
+    const parts = value.split(".");
+    return (parts.length === 4 &&
+        parts.every((part) => {
+            if (!/^\d{1,3}$/.test(part))
+                return false;
+            const number = Number(part);
+            return number >= 0 && number <= 255 && String(number) === part;
+        }));
+}
+function rootPasswordTarget(machine) {
+    if (machine === undefined ||
+        machine.state !== "running" ||
+        machine.actionsLock !== "unlocked") {
+        return null;
+    }
+    const address = machine.ipv4.find((candidate) => isIpv4Address(candidate.address));
+    if (address === undefined)
+        return null;
+    return {
+        virtualMachineId: machine.id,
+        hostname: machine.hostname,
+        ipv4Id: address.id,
+        ipv4: address.address,
+    };
+}
+function publicHostingerError(error) {
+    if (error instanceof HostingerActionOutcomeUnknownError) {
+        return {
+            ok: false,
+            errorCode: "action_outcome_unknown",
+            ...(error.correlationId === null
+                ? {}
+                : { correlationId: error.correlationId }),
+        };
+    }
+    if (error instanceof HostingerPasswordValidationError) {
+        return { ok: false, errorCode: "password_policy_rejected" };
+    }
+    if (error instanceof HostingerActionFailedError) {
+        return {
+            ok: false,
+            errorCode: "action_failed",
+            ...(error.correlationId === null
+                ? {}
+                : { correlationId: error.correlationId }),
+        };
+    }
+    if (error instanceof HostingerActionTimeoutError) {
+        return { ok: false, errorCode: "action_timeout" };
+    }
+    if (error instanceof HostingerApiError) {
+        const errorCode = error.code === "unauthorized"
+            ? "hostinger_unauthorized"
+            : error.code === "rate_limited"
+                ? "hostinger_rate_limited"
+                : error.code === "validation_failed"
+                    ? error.validationFields.includes("password")
+                        ? "password_policy_rejected"
+                        : "hostinger_request_rejected"
+                    : error.code === "invalid_response"
+                        ? "hostinger_invalid_response"
+                        : "hostinger_unavailable";
+        return {
+            ok: false,
+            errorCode,
+            ...(error.correlationId === null
+                ? {}
+                : { correlationId: error.correlationId }),
+            ...(error.retryAfterMs === null
+                ? {}
+                : { retryAfterMs: error.retryAfterMs }),
+        };
+    }
+    return { ok: false, errorCode: "hostinger_unavailable" };
+}
+export function createInstallerService(options) {
+    let state = options.initialState;
+    let installRunning = false;
+    let installFinished = false;
+    let installOk = null;
+    let installSteps = [];
+    let installBearerToken = null;
+    let bearerProvisionRunning = false;
+    let recoveryRunning = false;
+    let hostingerOperationRunning = false;
+    let hostingerConnectAttempt = 0;
+    let hostingerConnectingClient = null;
+    let hostingerSession = null;
+    let rootPasswordConfirmation = null;
+    let verifiedSshAccess = null;
+    const now = options.dependencies?.now ?? (() => new Date());
+    const randomToken = options.dependencies?.randomToken ??
+        (() => randomBytes(24).toString("base64url"));
+    const connectSsh = options.dependencies?.connectSsh ??
+        ((credentials) => SshSession.connect(credentials));
+    const createHostingerClient = options.dependencies?.createHostingerClient ??
+        ((token) => new HostingerClient({ token }));
+    const requireState = () => {
+        if (state === null) {
+            throw new Error("The installer has no saved settings yet.");
+        }
+        return state;
+    };
+    const requireGitHub = () => {
+        const current = requireState();
+        const repository = current.repository ?? options.detectedRepository;
+        if (current.githubToken === undefined || repository === null) {
+            throw new Error("GitHub is not connected yet.");
+        }
+        return { githubToken: current.githubToken, repository };
+    };
+    const gitHubClient = (connection) => new GitHubClient({
+        token: connection.githubToken,
+        owner: connection.repository.owner,
+        repo: connection.repository.repo,
+        sealSecret: sealForGitHubSecret,
+    });
+    const archiveSource = async () => {
+        const { stdout } = await execFileAsync("git", ["archive", "--format=tar.gz", "HEAD"], { cwd: options.repoRoot, encoding: "buffer", maxBuffer: 256 * 1024 * 1024 });
+        return stdout;
+    };
+    const isSourceDirty = async () => {
+        try {
+            const { stdout } = await execFileAsync("git", ["status", "--porcelain"], { cwd: options.repoRoot });
+            return stdout.trim() !== "";
+        }
+        catch {
+            return false;
+        }
+    };
+    const pipelineDependencies = {
+        generateKey: generateDeployKey,
+        connectSsh,
+        archiveSource,
+        isSourceDirty,
+        verifyDeployment: (publicUrl) => verifyDeployment(publicUrl),
+        saveState: async (nextState) => {
+            await saveState(options.statePath, nextState);
+            state = nextState;
+        },
+        now,
+        sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    };
+    const trackPipeline = (pipeline) => {
+        if (installRunning ||
+            recoveryRunning ||
+            hostingerOperationRunning ||
+            bearerProvisionRunning) {
+            return { started: false };
+        }
+        installRunning = true;
+        installFinished = false;
+        installOk = null;
+        installSteps = [];
+        installBearerToken = null;
+        void pipeline((steps) => {
+            installSteps = steps;
+        })
+            .then((outcome) => {
+            installOk = outcome.ok;
+            installSteps = outcome.steps;
+            installBearerToken = outcome.bearerToken ?? null;
+        })
+            .catch(() => {
+            installOk = false;
+        })
+            .finally(() => {
+            installRunning = false;
+            installFinished = true;
+        });
+        return { started: true };
+    };
+    return {
+        context() {
+            return {
+                mode: state === null ? "wizard" : "dashboard",
+                language: state?.language ?? defaultLanguage,
+                repository: state?.repository ?? options.detectedRepository ?? null,
+                domain: state?.domain ?? null,
+                vpsHost: state?.vps.host ?? null,
+                ownerEmail: state?.ownerEmail ?? null,
+                githubConnected: state?.githubToken !== undefined,
+            };
+        },
+        async connectHostinger(input) {
+            if (installRunning || recoveryRunning || hostingerOperationRunning) {
+                return { ok: false, errorCode: "operation_conflict" };
+            }
+            const parsed = hostingerConnectInputSchema.safeParse(input);
+            if (!parsed.success) {
+                return { ok: false, errorCode: "invalid_input" };
+            }
+            const attempt = ++hostingerConnectAttempt;
+            hostingerConnectingClient?.close?.();
+            hostingerConnectingClient = null;
+            hostingerSession?.client.close?.();
+            hostingerSession = null;
+            rootPasswordConfirmation = null;
+            verifiedSshAccess = null;
+            let client = null;
+            try {
+                client = createHostingerClient(parsed.data.token);
+                hostingerConnectingClient = client;
+                const virtualMachines = await client.listVirtualMachines();
+                if (attempt !== hostingerConnectAttempt) {
+                    client.close?.();
+                    return { ok: false, errorCode: "operation_conflict" };
+                }
+                if (hostingerConnectingClient === client) {
+                    hostingerConnectingClient = null;
+                }
+                hostingerSession = {
+                    generation: randomToken(),
+                    client,
+                    virtualMachines,
+                };
+                return { ok: true, virtualMachines };
+            }
+            catch (error) {
+                client?.close?.();
+                if (hostingerConnectingClient === client) {
+                    hostingerConnectingClient = null;
+                }
+                if (attempt === hostingerConnectAttempt)
+                    hostingerSession = null;
+                return publicHostingerError(error);
+            }
+        },
+        async disconnectHostinger() {
+            if (hostingerOperationRunning) {
+                return { ok: false, errorCode: "operation_conflict" };
+            }
+            hostingerConnectAttempt += 1;
+            hostingerConnectingClient?.close?.();
+            hostingerConnectingClient = null;
+            hostingerSession?.client.close?.();
+            hostingerSession = null;
+            rootPasswordConfirmation = null;
+            verifiedSshAccess = null;
+            return { ok: true };
+        },
+        async refreshHostinger() {
+            if (installRunning || recoveryRunning || hostingerOperationRunning) {
+                return { ok: false, errorCode: "operation_conflict" };
+            }
+            const session = hostingerSession;
+            if (session === null) {
+                return { ok: false, errorCode: "hostinger_not_connected" };
+            }
+            hostingerOperationRunning = true;
+            try {
+                const virtualMachines = await session.client.listVirtualMachines();
+                if (hostingerSession === null ||
+                    hostingerSession.generation !== session.generation) {
+                    return { ok: false, errorCode: "target_changed" };
+                }
+                session.virtualMachines = virtualMachines;
+                rootPasswordConfirmation = null;
+                verifiedSshAccess = null;
+                return { ok: true, virtualMachines };
+            }
+            catch (error) {
+                const publicError = publicHostingerError(error);
+                if (publicError.errorCode === "hostinger_unauthorized") {
+                    session.client.close?.();
+                    hostingerSession = null;
+                    rootPasswordConfirmation = null;
+                }
+                return publicError;
+            }
+            finally {
+                hostingerOperationRunning = false;
+            }
+        },
+        async prepareHostingerRootPasswordReset(input) {
+            if (installRunning || recoveryRunning || hostingerOperationRunning) {
+                return { ok: false, errorCode: "operation_conflict" };
+            }
+            const parsed = hostingerPreparePasswordResetSchema.safeParse(input);
+            if (!parsed.success) {
+                return { ok: false, errorCode: "invalid_input" };
+            }
+            const session = hostingerSession;
+            if (session === null) {
+                return { ok: false, errorCode: "hostinger_not_connected" };
+            }
+            if (!session.virtualMachines.some((machine) => machine.id === parsed.data.virtualMachineId)) {
+                return { ok: false, errorCode: "target_changed" };
+            }
+            hostingerOperationRunning = true;
+            try {
+                const virtualMachines = await session.client.listVirtualMachines();
+                if (hostingerSession === null ||
+                    hostingerSession.generation !== session.generation) {
+                    return { ok: false, errorCode: "target_changed" };
+                }
+                const target = rootPasswordTarget(virtualMachines.find((machine) => machine.id === parsed.data.virtualMachineId));
+                if (target === null) {
+                    return { ok: false, errorCode: "target_unavailable" };
+                }
+                session.virtualMachines = virtualMachines;
+                const confirmationToken = randomToken();
+                rootPasswordConfirmation = {
+                    token: confirmationToken,
+                    connectionGeneration: session.generation,
+                    ...target,
+                    expiresAt: now().getTime() + 5 * 60_000,
+                };
+                return {
+                    ok: true,
+                    confirmationToken,
+                    target,
+                };
+            }
+            catch (error) {
+                return publicHostingerError(error);
+            }
+            finally {
+                hostingerOperationRunning = false;
+            }
+        },
+        async resetHostingerRootPassword(input) {
+            if (installRunning || recoveryRunning || hostingerOperationRunning) {
+                return { ok: false, errorCode: "operation_conflict" };
+            }
+            const parsed = hostingerCommitPasswordResetSchema.safeParse(input);
+            if (!parsed.success) {
+                return { ok: false, errorCode: "invalid_input" };
+            }
+            const session = hostingerSession;
+            const confirmation = rootPasswordConfirmation;
+            if (session === null) {
+                return { ok: false, errorCode: "hostinger_not_connected" };
+            }
+            if (confirmation === null ||
+                confirmation.connectionGeneration !== session.generation ||
+                !secureTokenEqual(parsed.data.confirmationToken, confirmation.token)) {
+                return { ok: false, errorCode: "confirmation_invalid" };
+            }
+            if (confirmation.expiresAt <= now().getTime()) {
+                rootPasswordConfirmation = null;
+                return { ok: false, errorCode: "confirmation_expired" };
+            }
+            if (parsed.data.confirmationText !== confirmation.hostname) {
+                return { ok: false, errorCode: "confirmation_invalid" };
+            }
+            hostingerOperationRunning = true;
+            try {
+                const virtualMachines = await session.client.listVirtualMachines();
+                const current = rootPasswordTarget(virtualMachines.find((machine) => machine.id === confirmation.virtualMachineId));
+                if (hostingerSession === null ||
+                    hostingerSession.generation !== confirmation.connectionGeneration ||
+                    current === null ||
+                    current.hostname !== confirmation.hostname ||
+                    current.ipv4Id !== confirmation.ipv4Id ||
+                    current.ipv4 !== confirmation.ipv4) {
+                    rootPasswordConfirmation = null;
+                    return { ok: false, errorCode: "target_changed" };
+                }
+                session.virtualMachines = virtualMachines;
+                // Consume before the mutating request. A retry must go through both
+                // confirmation stages again, including when the outcome is unknown.
+                rootPasswordConfirmation = null;
+                const action = await session.client.setRootPassword(confirmation.virtualMachineId, parsed.data.password);
+                return { ok: true, actionId: action.id };
+            }
+            catch (error) {
+                if (error instanceof HostingerApiError && error.status === 0) {
+                    return { ok: false, errorCode: "action_outcome_unknown" };
+                }
+                return publicHostingerError(error);
+            }
+            finally {
+                hostingerOperationRunning = false;
+            }
+        },
+        async validateGitHub(input) {
+            const client = new GitHubClient({
+                token: input.token,
+                owner: input.owner,
+                repo: input.repo,
+                sealSecret: sealForGitHubSecret,
+            });
+            return client.validate();
+        },
+        async connectGitHub(input) {
+            const current = requireState();
+            const repository = input.owner !== undefined && input.repo !== undefined
+                ? { owner: input.owner, repo: input.repo }
+                : (current.repository ?? options.detectedRepository);
+            if (repository === null || repository === undefined) {
+                throw new Error("The repository could not be determined.");
+            }
+            const client = new GitHubClient({
+                token: input.token,
+                owner: repository.owner,
+                repo: repository.repo,
+                sealSecret: sealForGitHubSecret,
+            });
+            const validation = await client.validate();
+            if (!validation.ok)
+                return validation;
+            await client.putSecret("VPS_HOST", current.vps.host);
+            await client.putSecret("VPS_USER", current.vps.username);
+            const privateKey = current.deployKey.privateKey.endsWith("\n")
+                ? current.deployKey.privateKey
+                : `${current.deployKey.privateKey}\n`;
+            await client.putSecret("VPS_SSH_KEY", privateKey);
+            if (current.vps.port !== 22) {
+                await client.putSecret("VPS_PORT", String(current.vps.port));
+            }
+            state = {
+                ...current,
+                repository,
+                githubToken: input.token,
+                updatedAt: new Date().toISOString(),
+            };
+            await saveState(options.statePath, state);
+            return { ok: true };
+        },
+        async testSsh(input) {
+            if (installRunning || recoveryRunning || hostingerOperationRunning) {
+                return { ok: false, message: "Another installer operation is already running." };
+            }
+            const parsed = sshTestInputSchema.safeParse(input);
+            if (!parsed.success) {
+                return { ok: false, message: "The server access details are invalid." };
+            }
+            hostingerOperationRunning = true;
+            verifiedSshAccess = null;
+            try {
+                const session = await connectSsh({
+                    host: parsed.data.host,
+                    port: parsed.data.port,
+                    username: parsed.data.username,
+                    auth: { kind: "password", password: parsed.data.password },
+                });
+                session.close();
+                const proof = randomToken();
+                verifiedSshAccess = {
+                    proof,
+                    host: parsed.data.host,
+                    port: parsed.data.port,
+                    username: parsed.data.username,
+                    password: parsed.data.password,
+                    expiresAt: now().getTime() + 15 * 60_000,
+                };
+                hostingerConnectAttempt += 1;
+                hostingerConnectingClient?.close?.();
+                hostingerConnectingClient = null;
+                hostingerSession?.client.close?.();
+                hostingerSession = null;
+                rootPasswordConfirmation = null;
+                return { ok: true, proof };
+            }
+            catch {
+                return {
+                    ok: false,
+                    message: "The server connection could not be verified.",
+                };
+            }
+            finally {
+                hostingerOperationRunning = false;
+            }
+        },
+        async recoverExisting(body) {
+            if (state !== null) {
+                return {
+                    ok: false,
+                    error: "This computer already has installer settings.",
+                };
+            }
+            if (installRunning || recoveryRunning || hostingerOperationRunning) {
+                return {
+                    ok: false,
+                    error: "Another installer operation is already running.",
+                };
+            }
+            const parsed = recoveryInputSchema.safeParse(body);
+            if (!parsed.success) {
+                return {
+                    ok: false,
+                    error: parsed.error.issues[0]?.message ??
+                        "The recovery details are invalid.",
+                };
+            }
+            recoveryRunning = true;
+            verifiedSshAccess = null;
+            hostingerConnectAttempt += 1;
+            hostingerConnectingClient?.close?.();
+            hostingerConnectingClient = null;
+            hostingerSession?.client.close?.();
+            hostingerSession = null;
+            rootPasswordConfirmation = null;
+            try {
+                return await recoverExistingInstallation({
+                    language: parsed.data.language,
+                    ...(options.detectedRepository === null
+                        ? {}
+                        : { repository: options.detectedRepository }),
+                    vps: parsed.data.vps,
+                    vpsAuth: {
+                        kind: "password",
+                        password: parsed.data.vpsPassword,
+                    },
+                }, pipelineDependencies);
+            }
+            finally {
+                recoveryRunning = false;
+            }
+        },
+        checkDns(input) {
+            let domain;
+            try {
+                domain = normalizeDomain(input.domain);
+            }
+            catch {
+                return Promise.resolve({
+                    matches: false,
+                    domainAddresses: [],
+                    vpsAddresses: [],
+                });
+            }
+            return checkDns(domain, input.host);
+        },
+        startInstall(body) {
+            if (installRunning || recoveryRunning || hostingerOperationRunning) {
+                return {
+                    started: false,
+                    error: "Another installer operation is already running.",
+                };
+            }
+            const parsed = installInputSchema.safeParse(body);
+            if (!parsed.success) {
+                const issue = parsed.error.issues[0];
+                return {
+                    started: false,
+                    ...(issue === undefined ? {} : { error: issue.message }),
+                };
+            }
+            const input = parsed.data;
+            const access = verifiedSshAccess;
+            if (access === null ||
+                access.expiresAt <= now().getTime() ||
+                !secureTokenEqual(input.vpsProof, access.proof) ||
+                access.host !== input.vps.host ||
+                access.port !== input.vps.port ||
+                access.username !== input.vps.username) {
+                verifiedSshAccess = null;
+                return {
+                    started: false,
+                    error: "The server connection must be tested again.",
+                };
+            }
+            const result = trackPipeline((onProgress) => runInstall({
+                language: input.language,
+                ...(options.detectedRepository === null
+                    ? {}
+                    : { repository: options.detectedRepository }),
+                vps: input.vps,
+                vpsAuth: { kind: "password", password: access.password },
+                domain: input.domain,
+                openRouterApiKey: input.openRouterApiKey,
+                ownerEmail: input.ownerEmail,
+                ownerPassword: input.ownerPassword,
+                enableBearerToken: input.enableBearerToken,
+            }, pipelineDependencies, onProgress));
+            if (result.started) {
+                verifiedSshAccess = null;
+                hostingerConnectAttempt += 1;
+                hostingerConnectingClient?.close?.();
+                hostingerConnectingClient = null;
+                hostingerSession?.client.close?.();
+                hostingerSession = null;
+                rootPasswordConfirmation = null;
+            }
+            return result;
+        },
+        deployLocal() {
+            const current = requireState();
+            return trackPipeline((onProgress) => runLocalDeploy({
+                vps: current.vps,
+                privateKey: current.deployKey.privateKey,
+                domain: current.domain,
+            }, pipelineDependencies, onProgress));
+        },
+        progress() {
+            return {
+                running: installRunning,
+                finished: installFinished,
+                ok: installOk,
+                steps: installSteps,
+                ...(installBearerToken === null
+                    ? {}
+                    : { bearerToken: installBearerToken }),
+            };
+        },
+        async deploy(input) {
+            const client = gitHubClient(requireGitHub());
+            const dispatchedAt = await client.dispatchDeploy(input.imageTag === undefined || input.imageTag === ""
+                ? undefined
+                : input.imageTag, new Date());
+            await client.findDispatchedRun(dispatchedAt, { attempts: 6 });
+            return { ok: true };
+        },
+        async listRuns() {
+            return gitHubClient(requireGitHub()).listRuns();
+        },
+        async bootstrapOwner(input) {
+            const current = requireState();
+            const session = await SshSession.connect({
+                host: current.vps.host,
+                port: current.vps.port,
+                username: current.vps.username,
+                auth: { kind: "key", privateKey: current.deployKey.privateKey },
+            });
+            try {
+                const result = await session.exec(ownerBootstrapCommand, buildOwnerBootstrapInput(input.email, input.password));
+                const outcome = interpretBootstrapResult(result);
+                if (outcome.kind !== "failed") {
+                    state = {
+                        ...current,
+                        ownerEmail: input.email,
+                        updatedAt: new Date().toISOString(),
+                    };
+                    await saveState(options.statePath, state);
+                }
+                return outcome.kind === "failed"
+                    ? { kind: outcome.kind, message: outcome.message }
+                    : { kind: outcome.kind };
+            }
+            finally {
+                session.close();
+            }
+        },
+        async verify() {
+            const current = requireState();
+            return verifyDeployment(`https://${current.domain}`);
+        },
+        async provisionBearer(input) {
+            if (installRunning ||
+                recoveryRunning ||
+                hostingerOperationRunning ||
+                bearerProvisionRunning) {
+                return {
+                    ok: false,
+                    error: "Another installer operation is already running.",
+                };
+            }
+            const current = state;
+            if (current === null) {
+                return { ok: false, error: "The installer has no saved settings yet." };
+            }
+            const parsed = bearerInputSchema.safeParse(input);
+            if (!parsed.success) {
+                return { ok: false, error: "The owner email is invalid." };
+            }
+            bearerProvisionRunning = true;
+            try {
+                const session = await connectSsh({
+                    host: current.vps.host,
+                    port: current.vps.port,
+                    username: current.vps.username,
+                    auth: { kind: "key", privateKey: current.deployKey.privateKey },
+                });
+                try {
+                    const bearerToken = await provisionBearerToken(session, parsed.data.email);
+                    // Recreate the engine so it starts with the stored credential.
+                    const wait = await session.exec(waitEngineCommand);
+                    if (wait.code !== 0) {
+                        return {
+                            ok: false,
+                            error: "The token was stored, but the engine did not come back healthy.",
+                        };
+                    }
+                    return { ok: true, bearerToken };
+                }
+                finally {
+                    session.close();
+                }
+            }
+            catch (error) {
+                return {
+                    ok: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
+            finally {
+                bearerProvisionRunning = false;
+            }
+        },
+        async reset() {
+            if (installRunning || recoveryRunning || hostingerOperationRunning) {
+                return { ok: false, errorCode: "operation_conflict" };
+            }
+            hostingerConnectAttempt += 1;
+            hostingerConnectingClient?.close?.();
+            hostingerConnectingClient = null;
+            hostingerSession?.client.close?.();
+            hostingerSession = null;
+            rootPasswordConfirmation = null;
+            verifiedSshAccess = null;
+            await deleteState(options.statePath);
+            state = null;
+            return { ok: true };
+        },
+        shutdown() {
+            hostingerConnectAttempt += 1;
+            hostingerConnectingClient?.close?.();
+            hostingerConnectingClient = null;
+            hostingerSession?.client.close?.();
+            hostingerSession = null;
+            rootPasswordConfirmation = null;
+            verifiedSshAccess = null;
+        },
+    };
+}
+export async function loadInitialState(statePath) {
+    return loadState(statePath);
+}
+//# sourceMappingURL=service.js.map