@alexberardi/jarvis-admin 0.1.65 → 0.1.67

package/server/dist/services/generators/env-generator.js

@@ -1,6 +1,6 @@
 import { getCoreServices, getRecommendedServices, getOptionalServices, getRequiredInfrastructure, } from './service-registry.js';
 import { serviceIdToPortVar } from './port-utils.js';
-import { SECRET_KEYS } from './secret-generator.js';
+import { SECRET_KEYS, generateHexSecret } from './secret-generator.js';
 export function generateEnv(state, registry) {
     const lines = [];
     lines.push('# Jarvis Configuration');
@@ -9,7 +9,11 @@ export function generateEnv(state, registry) {
     // Secrets
     lines.push('# --- Secrets ---');
     for (const key of SECRET_KEYS) {
-        const value = state.secrets[key] ?? '';
+        // Never emit an empty secret: with JARVIS_ENV=production the boot-time secret
+        // guard would refuse to start. A reconstructed install carries its existing
+        // value through; a genuinely missing one gets a fresh strong secret (passwords
+        // 16 bytes, tokens/keys 32 — matching generateAllSecrets).
+        const value = state.secrets[key] || generateHexSecret(key.includes('PASSWORD') ? 16 : 32);
         lines.push(`${key}=${value}`);
     }
     lines.push('');
@@ -106,6 +110,17 @@ export function generateEnv(state, registry) {
     lines.push('# --- Release Track ---');
     lines.push(`JARVIS_IMAGE_TAG=${state.releaseTrack === 'dev' ? 'dev' : 'latest'}`);
     lines.push('');
+    // MQTT broker lock. Fresh installs lock the broker from the first boot
+    // (allow_anonymous=false): the command-center reads MQTT_PASSWORD from its
+    // env and every node fetches broker creds over authenticated HTTP *before* it
+    // ever opens an MQTT connection, so there's no anonymous client to strand.
+    // The transition window (true) is reserved for in-place UPGRADES of fleets
+    // whose nodes predate credential auto-fetch — handled in the compose-upgrader,
+    // not here. Compose still defaults `${MQTT_ALLOW_ANON:-true}` as a safety
+    // fallback if this line is ever missing.
+    lines.push('# --- MQTT Broker ---');
+    lines.push('MQTT_ALLOW_ANON=false');
+    lines.push('');
     // Native services (macOS only). Comma-separated list of service IDs the user
     // opted to run as LaunchAgents instead of in Docker. Read back by
     // state-reconstructor so reconcile flows keep them out of compose.

package/server/dist/services/generators/env-generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-generator.js","sourceRoot":"","sources":["../../../src/services/generators/env-generator.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAEnD,MAAM,UAAU,WAAW,CAAC,KAAkB,EAAE,QAAyB;IACvE,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;IACpC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;IACzC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEd,UAAU;IACV,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAC/B,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QACtC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAA;IAC/B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEd,WAAW;IACX,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;IAChC,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEd,gBAAgB;IAChB,MAAM,YAAY,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,kBAAkB,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACvE,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CACpC,CAAA;IACD,MAAM,eAAe,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACjE,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CACpC,CAAA;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,YAAY,EAAE,GAAG,kBAAkB,EAAE,GAAG,eAAe,CAAC,CAAA;IAE/E,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAA;IACrC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC1C,0EAA0E;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,kEAAkE;QAClE,MAAM,WAAW,GAAG,GAAG,CAAC,EAAE,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAA;QAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,WAAW,CAAA;QACvD,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEd,uBAAuB;IACvB,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC9C,MAAM,KAAK,GAAG,yBAAyB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;IAE7D,uBAAuB;IACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAA;IACnE,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnB,CAAC;IAED,qCAAqC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAA;IAClD,MAAM,OAAO,GAAG,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAA;IACvE,IAAI,OAAO,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACrB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAA;IAC5C,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAA;QACzD,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEd,0BAA0B;IAC1B,IAAI,KAAK,CAAC,cAAc,KAAK,YAAY,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;QACvC,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,wBAAwB,KAAK,CAAC,YAAY,EAAE,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,sBAAsB,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAA;QAC5D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChB,CAAC;IAED,eAAe;IACf,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACpC,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK,CAAC,QAAQ,IAAI,mCAAmC,EAAE,CAAC,CAAA;QACvF,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,KAAK,CAAC,IAAI,CAAC,8BAA8B,KAAK,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC,CAAA;QACzE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChB,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,kDAAkD;IAClD,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACrD,KAAK,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAA;QAC5D,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,UAAU,CAAC,CAAA;QACxC,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,qEAAqE;QACrE,wEAAwE;QACxE,mEAAmE;QACnE,uEAAuE;QACvE,KAAK,CAAC,IAAI,CAAC,sBAAsB,IAAI,iBAAiB,CAAC,CAAA;QACvD,qEAAqE;QACrE,qEAAqE;QACrE,yEAAyE;QACzE,mEAAmE;QACnE,2DAA2D;QAC3D,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,aAAa,CAAC,CAAA;QAC7C,KAAK,CAAC,IAAI,CAAC,sBAAsB,IAAI,cAAc,CAAC,CAAA;QACpD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChB,CAAC;IAED,gBAAgB;IAChB,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAA;IACrC,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IACjF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEd,6EAA6E;IAC7E,kEAAkE;IAClE,mEAAmE;IACnE,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAA;QAC/C,KAAK,CAAC,IAAI,CAAC,0BAA0B,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACtE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChB,CAAC;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,8DAA8D;IAC9D,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAA;IACrC,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;IACvC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEd,mEAAmE;IACnE,KAAK,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;IACtE,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;QAC9E,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,GAAG,CAAC,CAAA;QACtC,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,GAAG,CAAC,CAAA;IACzC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEd,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC"}
+{"version":3,"file":"env-generator.js","sourceRoot":"","sources":["../../../src/services/generators/env-generator.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAEtE,MAAM,UAAU,WAAW,CAAC,KAAkB,EAAE,QAAyB;IACvE,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;IACpC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;IACzC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEd,UAAU;IACV,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAC/B,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,8EAA8E;QAC9E,4EAA4E;QAC5E,+EAA+E;QAC/E,2DAA2D;QAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACzF,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAA;IAC/B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEd,WAAW;IACX,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;IAChC,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEd,gBAAgB;IAChB,MAAM,YAAY,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,kBAAkB,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACvE,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CACpC,CAAA;IACD,MAAM,eAAe,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACjE,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CACpC,CAAA;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,YAAY,EAAE,GAAG,kBAAkB,EAAE,GAAG,eAAe,CAAC,CAAA;IAE/E,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAA;IACrC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC1C,0EAA0E;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,kEAAkE;QAClE,MAAM,WAAW,GAAG,GAAG,CAAC,EAAE,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAA;QAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,WAAW,CAAA;QACvD,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEd,uBAAuB;IACvB,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC9C,MAAM,KAAK,GAAG,yBAAyB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;IAE7D,uBAAuB;IACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAA;IACnE,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnB,CAAC;IAED,qCAAqC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAA;IAClD,MAAM,OAAO,GAAG,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAA;IACvE,IAAI,OAAO,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACrB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAA;IAC5C,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAA;QACzD,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEd,0BAA0B;IAC1B,IAAI,KAAK,CAAC,cAAc,KAAK,YAAY,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;QACvC,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,wBAAwB,KAAK,CAAC,YAAY,EAAE,CAAC,CAAA;QAC1D,CAAC;QACD,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,sBAAsB,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAA;QAC5D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChB,CAAC;IAED,eAAe;IACf,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACpC,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK,CAAC,QAAQ,IAAI,mCAAmC,EAAE,CAAC,CAAA;QACvF,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,KAAK,CAAC,IAAI,CAAC,8BAA8B,KAAK,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC,CAAA;QACzE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChB,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,kDAAkD;IAClD,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACrD,KAAK,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAA;QAC5D,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,UAAU,CAAC,CAAA;QACxC,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,qEAAqE;QACrE,wEAAwE;QACxE,mEAAmE;QACnE,uEAAuE;QACvE,KAAK,CAAC,IAAI,CAAC,sBAAsB,IAAI,iBAAiB,CAAC,CAAA;QACvD,qEAAqE;QACrE,qEAAqE;QACrE,yEAAyE;QACzE,mEAAmE;QACnE,2DAA2D;QAC3D,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,aAAa,CAAC,CAAA;QAC7C,KAAK,CAAC,IAAI,CAAC,sBAAsB,IAAI,cAAc,CAAC,CAAA;QACpD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChB,CAAC;IAED,gBAAgB;IAChB,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAA;IACrC,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IACjF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEd,uEAAuE;IACvE,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,+EAA+E;IAC/E,0EAA0E;IAC1E,yCAAyC;IACzC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;IACnC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;IACnC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEd,6EAA6E;IAC7E,kEAAkE;IAClE,mEAAmE;IACnE,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAA;QAC/C,KAAK,CAAC,IAAI,CAAC,0BAA0B,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACtE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChB,CAAC;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,8DAA8D;IAC9D,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAA;IACrC,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;IACvC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEd,mEAAmE;IACnE,KAAK,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;IACtE,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;QAC9E,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,GAAG,CAAC,CAAA;QACtC,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,GAAG,CAAC,CAAA;IACzC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEd,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC"}

package/server/dist/services/generators/secret-generator.d.ts

@@ -2,7 +2,7 @@
  * Generates a cryptographically secure hex string using Node.js crypto.
  */
 export declare function generateHexSecret(byteLength?: number): string;
-export declare const SECRET_KEYS: readonly ["AUTH_SECRET_KEY", "JARVIS_CONFIG_ADMIN_TOKEN", "JARVIS_AUTH_ADMIN_TOKEN", "POSTGRES_PASSWORD", "REDIS_PASSWORD", "ADMIN_API_KEY"];
+export declare const SECRET_KEYS: readonly ["AUTH_SECRET_KEY", "JARVIS_CONFIG_ADMIN_TOKEN", "JARVIS_AUTH_ADMIN_TOKEN", "POSTGRES_PASSWORD", "REDIS_PASSWORD", "ADMIN_API_KEY", "MODEL_SERVICE_TOKEN", "MQTT_PASSWORD", "GRAFANA_ADMIN_PASSWORD"];
 export type SecretKey = (typeof SECRET_KEYS)[number];
 /**
  * Generates all required secrets.

package/server/dist/services/generators/secret-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-generator.d.ts","sourceRoot":"","sources":["../../../src/services/generators/secret-generator.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,GAAE,MAAW,GAAG,MAAM,CAEjE;AAED,eAAO,MAAM,WAAW,8IAOd,CAAA;AAEV,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpD;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAO9D"}
+{"version":3,"file":"secret-generator.d.ts","sourceRoot":"","sources":["../../../src/services/generators/secret-generator.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,GAAE,MAAW,GAAG,MAAM,CAEjE;AAED,eAAO,MAAM,WAAW,gNAsBd,CAAA;AAEV,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpD;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAO9D"}

package/server/dist/services/generators/secret-generator.js

@@ -12,6 +12,21 @@ export const SECRET_KEYS = [
     'POSTGRES_PASSWORD',
     'REDIS_PASSWORD',
     'ADMIN_API_KEY',
+    // Internal auth between the llm-proxy API/worker and its model service (:7705).
+    // The model service 503s ALL inference when this is unset (while /health stays
+    // green), so it must be generated + injected on every install. No 'PASSWORD' in
+    // the name -> 32 bytes / 64 hex, matching the installer.
+    'MODEL_SERVICE_TOKEN',
+    // Shared MQTT broker credential (username is the literal 'jarvis'). The
+    // mosquitto container hashes this into a password_file at startup; every MQTT
+    // client (command-center, nodes) authenticates with it. 'PASSWORD' in the name
+    // -> 16 bytes / 32 hex. Preserved across regen so nodes keep authenticating.
+    'MQTT_PASSWORD',
+    // Grafana admin password. Without this the registry default was the well-known
+    // literal 'jarvis' on a 0.0.0.0:3000 bind — any LAN client could log in and read
+    // all Loki logs (voice transcripts / PII) + SSRF-pivot via the datasource proxy.
+    // 'PASSWORD' in the name -> 16 bytes / 32 hex.
+    'GRAFANA_ADMIN_PASSWORD',
 ];
 /**
  * Generates all required secrets.

package/server/dist/services/generators/secret-generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-generator.js","sourceRoot":"","sources":["../../../src/services/generators/secret-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,aAAqB,EAAE;IACvD,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,iBAAiB;IACjB,2BAA2B;IAC3B,yBAAyB;IACzB,mBAAmB;IACnB,gBAAgB;IAChB,eAAe;CACP,CAAA;AAIV;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACrD,OAAO,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,OAAoC,CAAA;AAC7C,CAAC"}
+{"version":3,"file":"secret-generator.js","sourceRoot":"","sources":["../../../src/services/generators/secret-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,aAAqB,EAAE;IACvD,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,iBAAiB;IACjB,2BAA2B;IAC3B,yBAAyB;IACzB,mBAAmB;IACnB,gBAAgB;IAChB,eAAe;IACf,gFAAgF;IAChF,+EAA+E;IAC/E,gFAAgF;IAChF,yDAAyD;IACzD,qBAAqB;IACrB,wEAAwE;IACxE,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,eAAe;IACf,+EAA+E;IAC/E,iFAAiF;IACjF,iFAAiF;IACjF,+CAA+C;IAC/C,wBAAwB;CAChB,CAAA;AAIV;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACrD,OAAO,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,OAAoC,CAAA;AAC7C,CAAC"}

package/server/dist/services/upgrade/compose-upgrader.d.ts

@@ -1,4 +1,43 @@
 import type { FastifyInstance } from 'fastify';
+import type { ServiceRegistry } from '../../types/service-registry.js';
+import type { WhisperBackend } from '../../types/wizard.js';
+import { type ImageDigestMap } from '../generators/compose-generator.js';
+export declare function loadEnvFile(composePath: string): Record<string, string>;
+export interface UpgradedComposeFiles {
+    compose: string;
+    env: string;
+    initDb: string;
+}
+/**
+ * PURE regeneration core: reconstruct the wizard state from an existing install's
+ * env and produce the upgraded compose / .env / init-db.sh as STRINGS. Writes
+ * nothing. Both the in-place upgrader and the download/CLI path build on this so
+ * they can never diverge.
+ *
+ * Secrets and user config are preserved because they're recovered from
+ * ``existingEnv`` (via reconstructWizardState + mergeEnv); named data volumes are
+ * matched by Docker on ``up`` since the generator emits stable names, and
+ * bind-mount host paths come from env too. A regenerated file is CANONICAL — any
+ * hand-edits to the original compose are intentionally not carried over.
+ */
+export declare function buildUpgradedComposeFiles(existingEnv: Record<string, string>, registry: ServiceRegistry, overrides?: UpgradeOverrides, hostComposePath?: string, digests?: ImageDigestMap): UpgradedComposeFiles;
+/**
+ * Non-destructive regeneration for the "download / hand it to the user" flow:
+ * read the existing install's env from ``composePath`` and return the upgraded
+ * files as strings WITHOUT touching anything on disk. Used by the compose-mode
+ * migrator (installer CLI) and the admin download endpoint.
+ */
+export declare function regenerateComposeFiles(composePath: string, overrides?: UpgradeOverrides, hostComposePath?: string): UpgradedComposeFiles;
+/**
+ * Like {@link regenerateComposeFiles}, but first refreshes the pinned image
+ * digests from GHCR so the downloaded compose points at the NEWEST published
+ * build (the bundled map is frozen at admin-build time). Async — the refresh is
+ * a network round-trip; a resolver failure degrades to the bundled map and never
+ * throws. Backs the "Update stack to latest" download: the operator applies it
+ * themselves with `docker compose pull && docker compose up -d` (so it can also
+ * update jarvis-admin, which the in-place reconcile can't recreate from itself).
+ */
+export declare function regenerateComposeFilesLatest(composePath: string, overrides?: UpgradeOverrides, hostComposePath?: string): Promise<UpgradedComposeFiles>;
 /**
  * Upgrade the compose + env files in place, preserving secrets and user config.
  *
@@ -15,7 +54,15 @@ export interface UpgradeOverrides {
     relayEnabled?: boolean;
     relayUrl?: string;
     whisperModelPath?: string;
+    whisperBackend?: WhisperBackend;
     releaseTrack?: 'stable' | 'dev';
+    /**
+     * Flip the MQTT broker's ``allow_anonymous`` (the transition→lockdown control).
+     * ``false`` locks the broker to authenticated clients only; ``true`` re-opens
+     * it. Undefined leaves the current state untouched. This is an operational
+     * flag, not user config, so an explicit value wins over env preservation.
+     */
+    mqttAllowAnon?: boolean;
 }
 export declare function upgradeCompose(_app: FastifyInstance, overrides?: UpgradeOverrides): Promise<void>;
 //# sourceMappingURL=compose-upgrader.d.ts.map

package/server/dist/services/upgrade/compose-upgrader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compose-upgrader.d.ts","sourceRoot":"","sources":["../../../src/services/upgrade/compose-upgrader.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AA2B9C;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,YAAY,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAA;CAChC;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,eAAe,EACrB,SAAS,CAAC,EAAE,gBAAgB,GAC3B,OAAO,CAAC,IAAI,CAAC,CA8Df"}
+{"version":3,"file":"compose-upgrader.d.ts","sourceRoot":"","sources":["../../../src/services/upgrade/compose-upgrader.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAA0C,KAAK,cAAc,EAAE,MAAM,oCAAoC,CAAA;AAyBhH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYvE;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,QAAQ,EAAE,eAAe,EACzB,SAAS,CAAC,EAAE,gBAAgB,EAC5B,eAAe,CAAC,EAAE,MAAM,EACxB,OAAO,CAAC,EAAE,cAAc,GACvB,oBAAoB,CAkDtB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,gBAAgB,EAC5B,eAAe,CAAC,EAAE,MAAM,GACvB,oBAAoB,CAItB;AAED;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAChD,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,gBAAgB,EAC5B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,oBAAoB,CAAC,CAW/B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,YAAY,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAA;IAC/B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,eAAe,EACrB,SAAS,CAAC,EAAE,gBAAgB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAoDf"}

package/server/dist/services/upgrade/compose-upgrader.js

@@ -5,12 +5,26 @@ import { generateEnv } from '../generators/env-generator.js';
 import { generateInitDbScript } from '../generators/init-db-generator.js';
 import { parseRegistry } from '../generators/service-registry.js';
 import { reconstructWizardState } from './state-reconstructor.js';
+import { refreshDigestsForTrack } from './image-digest-resolver.js';
 import { mergeEnv } from './env-merger.js';
 import { VERSION } from '../../version.js';
 import { getComposePath } from '../compose-path.js';
 import { getHostComposePath } from '../host-paths.js';
 import registryData from '../../data/service-registry.json' with { type: 'json' };
-function loadEnvFile(composePath) {
+/**
+ * Set ``key=value`` in a .env string: replace the line in place if the key
+ * exists, otherwise append it. Used for operational flags (e.g. the broker lock)
+ * that must win over the merge preservation rule.
+ */
+function upsertEnvVar(env, key, value) {
+    const line = `${key}=${value}`;
+    const pattern = new RegExp(`^${key}=.*$`, 'm');
+    if (pattern.test(env))
+        return env.replace(pattern, line);
+    const base = env.endsWith('\n') ? env : env + '\n';
+    return base + line + '\n';
+}
+export function loadEnvFile(composePath) {
     const envFile = join(composePath, '.env');
     if (!existsSync(envFile))
         return {};
@@ -26,23 +40,19 @@ function loadEnvFile(composePath) {
     }
     return vars;
 }
-export async function upgradeCompose(_app, overrides) {
-    const composePath = getComposePath();
-    const registry = parseRegistry(registryData);
-    // Step 1: Backup
-    const backupDir = join(composePath, `backup-${VERSION}`);
-    if (!existsSync(backupDir)) {
-        mkdirSync(backupDir, { recursive: true });
-        for (const file of ['docker-compose.yml', '.env', 'init-db.sh']) {
-            const src = join(composePath, file);
-            if (existsSync(src)) {
-                cpSync(src, join(backupDir, file));
-            }
-        }
-    }
-    // Step 2: Load existing env
-    const existingEnv = loadEnvFile(composePath);
-    // Step 3: Reconstruct state, apply overrides from reconcile options
+/**
+ * PURE regeneration core: reconstruct the wizard state from an existing install's
+ * env and produce the upgraded compose / .env / init-db.sh as STRINGS. Writes
+ * nothing. Both the in-place upgrader and the download/CLI path build on this so
+ * they can never diverge.
+ *
+ * Secrets and user config are preserved because they're recovered from
+ * ``existingEnv`` (via reconstructWizardState + mergeEnv); named data volumes are
+ * matched by Docker on ``up`` since the generator emits stable names, and
+ * bind-mount host paths come from env too. A regenerated file is CANONICAL — any
+ * hand-edits to the original compose are intentionally not carried over.
+ */
+export function buildUpgradedComposeFiles(existingEnv, registry, overrides, hostComposePath, digests) {
     const state = reconstructWizardState(existingEnv, registry);
     if (overrides?.enabledModules) {
         state.enabledModules = overrides.enabledModules;
@@ -56,30 +66,109 @@ export async function upgradeCompose(_app, overrides) {
     if (overrides?.whisperModelPath) {
         state.whisperModelPath = overrides.whisperModelPath;
     }
+    if (overrides?.whisperBackend) {
+        state.whisperBackend = overrides.whisperBackend;
+    }
     if (overrides?.releaseTrack) {
         state.releaseTrack = overrides.releaseTrack;
     }
-    // When admin runs in docker, fetch the absolute host path of the compose
-    // dir we were mounted at. env-generator uses it to write MODELS_DIR so
-    // bind mounts in the regenerated compose resolve on the host (otherwise
-    // they resolve to /host/compose/.models — a path that exists in the admin
-    // container but not on the host, so the daemon binds an empty directory).
-    const hostPath = await getHostComposePath();
-    if (hostPath) {
-        state.hostComposePath = hostPath;
+    if (hostComposePath) {
+        state.hostComposePath = hostComposePath;
     }
-    // Step 4: Generate new compose
-    const newCompose = generateCompose(state, registry);
-    writeFileSync(join(composePath, 'docker-compose.yml'), newCompose);
-    // Step 5: Generate new env template, merge
+    const compose = generateCompose(state, registry, digests);
     const newEnvTemplate = generateEnv(state, registry);
-    const mergedEnv = mergeEnv(existingEnv, newEnvTemplate);
-    writeFileSync(join(composePath, '.env'), mergedEnv);
-    // Step 6: Regenerate init-db.sh
+    let env = mergeEnv(existingEnv, newEnvTemplate);
+    // Broker lock flag is operational, not user config.
+    //  - An explicit override always wins over mergeEnv's "existing value wins".
+    //  - A previously-written MQTT_ALLOW_ANON is preserved by mergeEnv, so a lock
+    //    stays locked (and an open transition stays open) across routine regens.
+    //  - The fresh-install template now sets MQTT_ALLOW_ANON=false, but an UPGRADE
+    //    of an install that predates that change (no MQTT_ALLOW_ANON in its .env)
+    //    must NOT inherit the locked default — its nodes may not have fetched
+    //    broker creds yet, and locking would drop the whole fleet. Force the
+    //    transition window (true) in that case; the operator locks explicitly from
+    //    the admin UI once nodes have migrated.
+    if (overrides?.mqttAllowAnon !== undefined) {
+        env = upsertEnvVar(env, 'MQTT_ALLOW_ANON', String(overrides.mqttAllowAnon));
+    }
+    else if (existingEnv['MQTT_ALLOW_ANON'] === undefined) {
+        env = upsertEnvVar(env, 'MQTT_ALLOW_ANON', 'true');
+    }
     const enabledServices = getAllEnabledServices(state, registry);
     const primaryDb = registry.infrastructure.find((i) => i.id === 'postgres')
         ?.envVars.find((e) => e.name === 'POSTGRES_DB')?.default ?? 'jarvis_config';
     const initDb = generateInitDbScript(enabledServices, primaryDb);
+    return { compose, env, initDb };
+}
+/**
+ * Non-destructive regeneration for the "download / hand it to the user" flow:
+ * read the existing install's env from ``composePath`` and return the upgraded
+ * files as strings WITHOUT touching anything on disk. Used by the compose-mode
+ * migrator (installer CLI) and the admin download endpoint.
+ */
+export function regenerateComposeFiles(composePath, overrides, hostComposePath) {
+    const registry = parseRegistry(registryData);
+    const existingEnv = loadEnvFile(composePath);
+    return buildUpgradedComposeFiles(existingEnv, registry, overrides, hostComposePath);
+}
+/**
+ * Like {@link regenerateComposeFiles}, but first refreshes the pinned image
+ * digests from GHCR so the downloaded compose points at the NEWEST published
+ * build (the bundled map is frozen at admin-build time). Async — the refresh is
+ * a network round-trip; a resolver failure degrades to the bundled map and never
+ * throws. Backs the "Update stack to latest" download: the operator applies it
+ * themselves with `docker compose pull && docker compose up -d` (so it can also
+ * update jarvis-admin, which the in-place reconcile can't recreate from itself).
+ */
+export async function regenerateComposeFilesLatest(composePath, overrides, hostComposePath) {
+    const registry = parseRegistry(registryData);
+    const existingEnv = loadEnvFile(composePath);
+    // dev floats (no digest pins), so only the stable track needs a refresh.
+    const track = overrides?.releaseTrack === 'dev' ||
+        (overrides?.releaseTrack === undefined && existingEnv.JARVIS_IMAGE_TAG === 'dev')
+        ? 'dev'
+        : 'latest';
+    const digests = track === 'latest' ? await refreshDigestsForTrack('latest') : undefined;
+    return buildUpgradedComposeFiles(existingEnv, registry, overrides, hostComposePath, digests);
+}
+export async function upgradeCompose(_app, overrides) {
+    const composePath = getComposePath();
+    const registry = parseRegistry(registryData);
+    // Step 1: Backup
+    const backupDir = join(composePath, `backup-${VERSION}`);
+    if (!existsSync(backupDir)) {
+        mkdirSync(backupDir, { recursive: true });
+        for (const file of ['docker-compose.yml', '.env', 'init-db.sh']) {
+            const src = join(composePath, file);
+            if (existsSync(src)) {
+                cpSync(src, join(backupDir, file));
+            }
+        }
+    }
+    // Step 2: Load existing env
+    const existingEnv = loadEnvFile(composePath);
+    // Refresh the pinned image digests from GHCR so the regenerated compose points
+    // at the newest published build and `docker compose pull` actually fetches it
+    // (the bundled digest map is frozen at admin-build time, which otherwise makes
+    // pull a no-op and deadlocks updates). Only the stable track pins — dev floats
+    // — and a resolver failure degrades to the bundled map, so this never blocks
+    // an upgrade.
+    const track = overrides?.releaseTrack === 'dev' ||
+        (overrides?.releaseTrack === undefined && existingEnv.JARVIS_IMAGE_TAG === 'dev')
+        ? 'dev'
+        : 'latest';
+    const digests = track === 'latest' ? await refreshDigestsForTrack('latest') : undefined;
+    // Step 3-6: Reconstruct + regenerate via the shared pure core.
+    //
+    // When admin runs in docker, fetch the absolute host path of the compose
+    // dir we were mounted at. env-generator uses it to write MODELS_DIR so
+    // bind mounts in the regenerated compose resolve on the host (otherwise
+    // they resolve to /host/compose/.models — a path that exists in the admin
+    // container but not on the host, so the daemon binds an empty directory).
+    const hostPath = await getHostComposePath();
+    const { compose, env, initDb } = buildUpgradedComposeFiles(existingEnv, registry, overrides, hostPath || undefined, digests);
+    writeFileSync(join(composePath, 'docker-compose.yml'), compose);
+    writeFileSync(join(composePath, '.env'), env);
     writeFileSync(join(composePath, 'init-db.sh'), initDb, { mode: 0o755 });
 }
 //# sourceMappingURL=compose-upgrader.js.map

package/server/dist/services/upgrade/compose-upgrader.js.map

@@ -1 +1 @@
-{"version":3,"file":"compose-upgrader.js","sourceRoot":"","sources":["../../../src/services/upgrade/compose-upgrader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AACpF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAGhC,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAA;AAC3F,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAA;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAA;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAA;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,YAAY,MAAM,kCAAkC,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAEjF,SAAS,WAAW,CAAC,WAAmB;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IACzC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAA;IACnC,MAAM,IAAI,GAA2B,EAAE,CAAA;IACvC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QACjD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAQ;QAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAqBD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAqB,EACrB,SAA4B;IAE5B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAA;IACpC,MAAM,QAAQ,GAAoB,aAAa,CAAC,YAAY,CAAC,CAAA;IAE7D,iBAAiB;IACjB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,OAAO,EAAE,CAAC,CAAA;IACxD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACzC,KAAK,MAAM,IAAI,IAAI,CAAC,oBAAoB,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;YAChE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;YACnC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAA;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;IAE5C,oEAAoE;IACpE,MAAM,KAAK,GAAG,sBAAsB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IAC3D,IAAI,SAAS,EAAE,cAAc,EAAE,CAAC;QAC9B,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC,cAAc,CAAA;IACjD,CAAC;IACD,IAAI,SAAS,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;QAC1C,KAAK,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAA;IAC7C,CAAC;IACD,IAAI,SAAS,EAAE,QAAQ,EAAE,CAAC;QACxB,KAAK,CAAC,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAA;IACrC,CAAC;IACD,IAAI,SAAS,EAAE,gBAAgB,EAAE,CAAC;QAChC,KAAK,CAAC,gBAAgB,GAAG,SAAS,CAAC,gBAAgB,CAAA;IACrD,CAAC;IACD,IAAI,SAAS,EAAE,YAAY,EAAE,CAAC;QAC5B,KAAK,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAA;IAC7C,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAA;IAC3C,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,eAAe,GAAG,QAAQ,CAAA;IAClC,CAAC;IAED,+BAA+B;IAC/B,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACnD,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,EAAE,UAAU,CAAC,CAAA;IAElE,2CAA2C;IAC3C,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACnD,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;IACvD,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAA;IAEnD,gCAAgC;IAChC,MAAM,eAAe,GAAG,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC9D,MAAM,SAAS,GAAG,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC;QACxE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,EAAE,OAAO,IAAI,eAAe,CAAA;IAC7E,MAAM,MAAM,GAAG,oBAAoB,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;IAC/D,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;AACzE,CAAC"}
+{"version":3,"file":"compose-upgrader.js","sourceRoot":"","sources":["../../../src/services/upgrade/compose-upgrader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AACpF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAIhC,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAuB,MAAM,oCAAoC,CAAA;AAChH,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAA;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAA;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAA;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,YAAY,MAAM,kCAAkC,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAEjF;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAW,EAAE,GAAW,EAAE,KAAa;IAC3D,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,KAAK,EAAE,CAAA;IAC9B,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9C,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IACxD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAA;IAClD,OAAO,IAAI,GAAG,IAAI,GAAG,IAAI,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,WAAmB;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IACzC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAA;IACnC,MAAM,IAAI,GAA2B,EAAE,CAAA;IACvC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QACjD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAQ;QAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAQD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAAmC,EACnC,QAAyB,EACzB,SAA4B,EAC5B,eAAwB,EACxB,OAAwB;IAExB,MAAM,KAAK,GAAG,sBAAsB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IAC3D,IAAI,SAAS,EAAE,cAAc,EAAE,CAAC;QAC9B,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC,cAAc,CAAA;IACjD,CAAC;IACD,IAAI,SAAS,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;QAC1C,KAAK,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAA;IAC7C,CAAC;IACD,IAAI,SAAS,EAAE,QAAQ,EAAE,CAAC;QACxB,KAAK,CAAC,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAA;IACrC,CAAC;IACD,IAAI,SAAS,EAAE,gBAAgB,EAAE,CAAC;QAChC,KAAK,CAAC,gBAAgB,GAAG,SAAS,CAAC,gBAAgB,CAAA;IACrD,CAAC;IACD,IAAI,SAAS,EAAE,cAAc,EAAE,CAAC;QAC9B,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC,cAAc,CAAA;IACjD,CAAC;IACD,IAAI,SAAS,EAAE,YAAY,EAAE,CAAC;QAC5B,KAAK,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAA;IAC7C,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,KAAK,CAAC,eAAe,GAAG,eAAe,CAAA;IACzC,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;IACzD,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACnD,IAAI,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;IAE/C,oDAAoD;IACpD,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,0EAA0E;IAC1E,yEAAyE;IACzE,+EAA+E;IAC/E,4CAA4C;IAC5C,IAAI,SAAS,EAAE,aAAa,KAAK,SAAS,EAAE,CAAC;QAC3C,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAA;IAC7E,CAAC;SAAM,IAAI,WAAW,CAAC,iBAAiB,CAAC,KAAK,SAAS,EAAE,CAAC;QACxD,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAA;IACpD,CAAC;IAED,MAAM,eAAe,GAAG,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC9D,MAAM,SAAS,GAAG,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC;QACxE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,EAAE,OAAO,IAAI,eAAe,CAAA;IAC7E,MAAM,MAAM,GAAG,oBAAoB,CAAC,eAAe,EAAE,SAAS,CAAC,CAAA;IAE/D,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAmB,EACnB,SAA4B,EAC5B,eAAwB;IAExB,MAAM,QAAQ,GAAoB,aAAa,CAAC,YAAY,CAAC,CAAA;IAC7D,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;IAC5C,OAAO,yBAAyB,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,CAAC,CAAA;AACrF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,WAAmB,EACnB,SAA4B,EAC5B,eAAwB;IAExB,MAAM,QAAQ,GAAoB,aAAa,CAAC,YAAY,CAAC,CAAA;IAC7D,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;IAC5C,yEAAyE;IACzE,MAAM,KAAK,GACT,SAAS,EAAE,YAAY,KAAK,KAAK;QACjC,CAAC,SAAS,EAAE,YAAY,KAAK,SAAS,IAAI,WAAW,CAAC,gBAAgB,KAAK,KAAK,CAAC;QAC/E,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,QAAQ,CAAA;IACd,MAAM,OAAO,GAAG,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACvF,OAAO,yBAAyB,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,CAAC,CAAA;AAC9F,CAAC;AA6BD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAqB,EACrB,SAA4B;IAE5B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAA;IACpC,MAAM,QAAQ,GAAoB,aAAa,CAAC,YAAY,CAAC,CAAA;IAE7D,iBAAiB;IACjB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,OAAO,EAAE,CAAC,CAAA;IACxD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACzC,KAAK,MAAM,IAAI,IAAI,CAAC,oBAAoB,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;YAChE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;YACnC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAA;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;IAE5C,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,6EAA6E;IAC7E,cAAc;IACd,MAAM,KAAK,GACT,SAAS,EAAE,YAAY,KAAK,KAAK;QACjC,CAAC,SAAS,EAAE,YAAY,KAAK,SAAS,IAAI,WAAW,CAAC,gBAAgB,KAAK,KAAK,CAAC;QAC/E,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,QAAQ,CAAA;IACd,MAAM,OAAO,GACX,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAEzE,+DAA+D;IAC/D,EAAE;IACF,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAA;IAC3C,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,yBAAyB,CACxD,WAAW,EACX,QAAQ,EACR,SAAS,EACT,QAAQ,IAAI,SAAS,EACrB,OAAO,CACR,CAAA;IAED,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,EAAE,OAAO,CAAC,CAAA;IAC/D,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IAC7C,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;AACzE,CAAC"}

package/server/dist/services/upgrade/image-digest-resolver.d.ts

@@ -0,0 +1,16 @@
+import type { ImageDigestMap } from '../generators/compose-generator.js';
+/**
+ * Resolve one `repo:tag` to its manifest digest via the GHCR HTTP API. Returns
+ * null on any failure (unpublished tag, rate limit, network error, malformed
+ * digest) — the caller falls back to the bundled digest, so a refresh is never
+ * worse than today's frozen map.
+ */
+export declare function resolveManifestDigest(repo: string, tag: string, fetchImpl?: typeof fetch): Promise<string | null>;
+/**
+ * Return a fresh digest map for the active `track`: every bundled `(repo, tag)`
+ * whose tag belongs to that track is re-resolved against GHCR; any that fails to
+ * resolve keeps its bundled digest. Other tracks' entries are copied through
+ * untouched. Never throws.
+ */
+export declare function refreshDigestsForTrack(track: 'latest' | 'dev', base?: ImageDigestMap, fetchImpl?: typeof fetch): Promise<ImageDigestMap>;
+//# sourceMappingURL=image-digest-resolver.d.ts.map

package/server/dist/services/upgrade/image-digest-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-digest-resolver.d.ts","sourceRoot":"","sources":["../../../src/services/upgrade/image-digest-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AA2BxE;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwBxB;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,QAAQ,GAAG,KAAK,EACvB,IAAI,GAAE,cAAiD,EACvD,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,cAAc,CAAC,CAsBzB"}

package/server/dist/services/upgrade/image-digest-resolver.js

@@ -0,0 +1,80 @@
+import bundledDigests from '../../data/image-digests.json' with { type: 'json' };
+// The compose generator pins first-party images to a `@sha256` digest from the
+// bundled image-digests.json, which is frozen at admin-build time. That makes
+// `docker compose pull` a no-op — it re-pulls the exact digest already running,
+// so services (including admin itself) can never update. This resolver refreshes
+// those digests from GHCR at update time so a regenerated compose points at the
+// newest published image and `docker compose pull` actually fetches it.
+//
+// Resolution uses the plain GHCR HTTP registry API (anonymous pull token, then
+// the manifest's Docker-Content-Digest header) — no docker CLI dependency, and
+// fully mockable in tests. Multi-arch repos publish a manifest LIST whose
+// top-level digest covers every arch, so one pinned digest works cross-arch.
+const REGISTRY_HOST = 'ghcr.io';
+const REGISTRY_NAMESPACE = 'alexberardi';
+const DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
+const TIMEOUT_MS = 15_000;
+const MANIFEST_ACCEPT = [
+    'application/vnd.oci.image.index.v1+json',
+    'application/vnd.docker.distribution.manifest.list.v2+json',
+    'application/vnd.oci.image.manifest.v1+json',
+    'application/vnd.docker.distribution.manifest.v2+json',
+].join(', ');
+/**
+ * Resolve one `repo:tag` to its manifest digest via the GHCR HTTP API. Returns
+ * null on any failure (unpublished tag, rate limit, network error, malformed
+ * digest) — the caller falls back to the bundled digest, so a refresh is never
+ * worse than today's frozen map.
+ */
+export async function resolveManifestDigest(repo, tag, fetchImpl = fetch) {
+    try {
+        const tokenRes = await fetchImpl(`https://${REGISTRY_HOST}/token?service=${REGISTRY_HOST}&scope=repository:${REGISTRY_NAMESPACE}/${repo}:pull`, { signal: AbortSignal.timeout(TIMEOUT_MS) });
+        if (!tokenRes.ok)
+            return null;
+        const token = (await tokenRes.json()).token;
+        if (!token)
+            return null;
+        const manifestRes = await fetchImpl(`https://${REGISTRY_HOST}/v2/${REGISTRY_NAMESPACE}/${repo}/manifests/${tag}`, {
+            method: 'HEAD',
+            headers: { Authorization: `Bearer ${token}`, Accept: MANIFEST_ACCEPT },
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+        if (!manifestRes.ok)
+            return null;
+        const digest = manifestRes.headers.get('docker-content-digest');
+        return digest && DIGEST_RE.test(digest) ? digest : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Return a fresh digest map for the active `track`: every bundled `(repo, tag)`
+ * whose tag belongs to that track is re-resolved against GHCR; any that fails to
+ * resolve keeps its bundled digest. Other tracks' entries are copied through
+ * untouched. Never throws.
+ */
+export async function refreshDigestsForTrack(track, base = bundledDigests, fetchImpl = fetch) {
+    const result = {};
+    const jobs = [];
+    for (const [repo, tags] of Object.entries(base)) {
+        result[repo] = { ...tags };
+        for (const tag of Object.keys(tags)) {
+            // Only the active track is used by the generator (the other track's pins
+            // are dead weight), so don't spend network calls resolving it.
+            if (tag !== track && !tag.startsWith(`${track}-`))
+                continue;
+            // Resolve concurrently. Sequential await-per-tag made a refresh cost the
+            // SUM of ~17 round-trips — seconds per upgrade, and it blew unit-test
+            // timeouts under load. resolveManifestDigest self-contains its errors +
+            // timeout (returns null), so Promise.all never rejects.
+            jobs.push(resolveManifestDigest(repo, tag, fetchImpl).then((fresh) => {
+                if (fresh)
+                    result[repo][tag] = fresh;
+            }));
+        }
+    }
+    await Promise.all(jobs);
+    return result;
+}
+//# sourceMappingURL=image-digest-resolver.js.map

package/server/dist/services/upgrade/image-digest-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-digest-resolver.js","sourceRoot":"","sources":["../../../src/services/upgrade/image-digest-resolver.ts"],"names":[],"mappings":"AACA,OAAO,cAAc,MAAM,+BAA+B,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAEhF,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAChF,wEAAwE;AACxE,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,0EAA0E;AAC1E,6EAA6E;AAE7E,MAAM,aAAa,GAAG,SAAS,CAAA;AAC/B,MAAM,kBAAkB,GAAG,aAAa,CAAA;AACxC,MAAM,SAAS,GAAG,uBAAuB,CAAA;AACzC,MAAM,UAAU,GAAG,MAAM,CAAA;AAEzB,MAAM,eAAe,GAAG;IACtB,yCAAyC;IACzC,2DAA2D;IAC3D,4CAA4C;IAC5C,sDAAsD;CACvD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEZ;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAY,EACZ,GAAW,EACX,YAA0B,KAAK;IAE/B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,WAAW,aAAa,kBAAkB,aAAa,qBAAqB,kBAAkB,IAAI,IAAI,OAAO,EAC7G,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAC5C,CAAA;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QAC7B,MAAM,KAAK,GAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC,KAAK,CAAA;QACnE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QAEvB,MAAM,WAAW,GAAG,MAAM,SAAS,CACjC,WAAW,aAAa,OAAO,kBAAkB,IAAI,IAAI,cAAc,GAAG,EAAE,EAC5E;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE;YACtE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;SACxC,CACF,CAAA;QACD,IAAI,CAAC,WAAW,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QAChC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;QAC/D,OAAO,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAuB,EACvB,OAAuB,cAAgC,EACvD,YAA0B,KAAK;IAE/B,MAAM,MAAM,GAAmB,EAAE,CAAA;IACjC,MAAM,IAAI,GAAoB,EAAE,CAAA;IAChC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAA;QAC1B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,yEAAyE;YACzE,+DAA+D;YAC/D,IAAI,GAAG,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC;gBAAE,SAAQ;YAC3D,yEAAyE;YACzE,sEAAsE;YACtE,wEAAwE;YACxE,wDAAwD;YACxD,IAAI,CAAC,IAAI,CACP,qBAAqB,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;gBACzD,IAAI,KAAK;oBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACtC,CAAC,CAAC,CACH,CAAA;QACH,CAAC;IACH,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACvB,OAAO,MAAM,CAAA;AACf,CAAC"}

package/server/dist/services/upgrade/minisign.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Verify a minisign signature over `artifact` against `publicKeyB64` (the base64
+ * line of a minisign public key). Returns true ONLY for a valid signature by
+ * that key. Supports minisign's prehashed (BLAKE2b-512) and legacy modes.
+ * In-language (Node crypto) — no `minisign` binary dependency.
+ */
+export declare function verifyMinisign(publicKeyB64: string, minisigContent: string, artifact: Buffer): boolean;
+/**
+ * Parse a `sha256sum`-format checksums file into filename → lowercase-hex-digest.
+ * Handles both text (`hash␠␠name`) and binary (`hash␠*name`) lines; ignores any
+ * malformed line. Only 64-hex digests are accepted, so a truncated/garbage line
+ * can never masquerade as a valid checksum.
+ */
+export declare function parseChecksums(content: string): Map<string, string>;
+export type UpdateVerificationInput = {
+    /** The trusted minisign public key (base64 line) baked into the client. */
+    publicKeyB64: string;
+    /** Raw bytes of the release's `checksums.txt`, or null if it couldn't be fetched. */
+    checksums: Buffer | null;
+    /** Contents of the release's `checksums.txt.minisig`, or null if absent. */
+    minisigContent: string | null;
+    /** Each downloaded artifact + its bytes, keyed by the filename in checksums.txt. */
+    artifacts: {
+        filename: string;
+        data: Buffer;
+    }[];
+    /** Operator opt-in (JARVIS_ALLOW_UNSIGNED_UPDATE) to accept an UNSIGNED release. */
+    allowUnsigned: boolean;
+};
+export type UpdateVerificationResult = {
+    allow: true;
+    signed: boolean;
+    note?: string;
+} | {
+    allow: false;
+    reason: string;
+};
+/**
+ * The self-update trust policy — pure, so it can be exhaustively tested without
+ * touching the network or the filesystem.
+ *
+ *   - No signature material  → UNSIGNED. Allowed only if the operator opted in
+ *     via `allowUnsigned`; we never fabricate trust.
+ *   - Signature present but invalid for our key → refuse. This is a tampering /
+ *     wrong-signer signal and is **not** overridable by `allowUnsigned` (the
+ *     escape hatch covers "no signature", never "bad signature").
+ *   - Signature valid → every artifact must be listed in checksums.txt AND match
+ *     its SHA-256. Any missing/mismatched artifact → refuse (also not
+ *     overridable — a validly-signed manifest that doesn't match the bytes we
+ *     downloaded means the download was tampered).
+ */
+export declare function decideUpdateVerification(input: UpdateVerificationInput): UpdateVerificationResult;
+//# sourceMappingURL=minisign.d.ts.map

package/server/dist/services/upgrade/minisign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"minisign.d.ts","sourceRoot":"","sources":["../../../src/services/upgrade/minisign.ts"],"names":[],"mappings":"AA6CA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAmBtG;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAOnE;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,2EAA2E;IAC3E,YAAY,EAAE,MAAM,CAAA;IACpB,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,4EAA4E;IAC5E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,oFAAoF;IACpF,SAAS,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC/C,oFAAoF;IACpF,aAAa,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,uBAAuB,GAAG,wBAAwB,CA0BjG"}