@amalgm/shell 0.1.162 → 0.1.164-main.34182640231

package/dist/service/windows.js

@@ -0,0 +1,65 @@
+/** Windows Task Scheduler owns a hidden action in the current account's
+ * logged-in lifetime; that action applies Core's controller recovery policy. */
+import { existsSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { windowsStartupScriptPath } from '@amalgm/core/supervision';
+import { atomicJson } from '../filesystem.js';
+import { keepaliveStatus, stopKeepalive } from './control.js';
+import { keepaliveCommand, osCommand } from './adapter.js';
+import { powershellExecutable, windowsControllerAction, windowsTaskOperation } from './windows-task.js';
+const definition = (identity) => join(identity.serviceDir, 'windows-task.json');
+const task = (identity, operation, action) => osCommand(powershellExecutable(), ['-NoProfile', '-NonInteractive', '-EncodedCommand', windowsTaskOperation({
+        operation, name: identity.label, ...(action ? { action } : {}),
+    })]);
+async function waitForController(identity) {
+    const deadline = Date.now() + 15_000;
+    while (Date.now() < deadline) {
+        if ((await keepaliveStatus(identity))?.alive)
+            return;
+        await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+    throw new Error(`The Windows task for ${identity.label} did not report an authenticated controller; see ${identity.serviceDir}`);
+}
+export const windowsOwner = {
+    backend: 'windows',
+    files: (identity) => ({ task: definition(identity) }),
+    async install(identity, launcher, keepaliveArgs) {
+        await stopKeepalive(identity);
+        const action = windowsControllerAction(keepaliveCommand(launcher, keepaliveArgs), identity.home);
+        task(identity, 'install', action);
+        await waitForController(identity);
+        atomicJson(definition(identity), { name: identity.label, action, binding: identity.binding });
+        // Retire only the known previous registration after the new owner is live.
+        rmSync(windowsStartupScriptPath(identity.labelScope, { home: identity.home, appData: process.env.APPDATA }), { force: true });
+    },
+    async start(identity) {
+        if ((await keepaliveStatus(identity))?.alive)
+            return;
+        task(identity, 'start');
+        await waitForController(identity);
+    },
+    async stop(identity) {
+        task(identity, 'disable');
+        await stopKeepalive(identity);
+        task(identity, 'stop');
+    },
+    async status(identity) {
+        const native = JSON.parse(task(identity, 'status').stdout);
+        const controller = await keepaliveStatus(identity);
+        return {
+            registered: native.registered && existsSync(definition(identity)), loaded: native.registered,
+            state: controller?.alive ? 'running' : native.state?.toLowerCase() || 'not registered',
+            pid: controller?.alive ? controller.bootstrapPid ?? controller.pid : null,
+            ...(native.lastResult ? { detail: `Task Scheduler result: ${native.lastResult}` } : {}),
+        };
+    },
+    async uninstall(identity) {
+        task(identity, 'disable');
+        await stopKeepalive(identity);
+        task(identity, 'stop');
+        task(identity, 'uninstall');
+        rmSync(definition(identity), { force: true });
+        rmSync(windowsStartupScriptPath(identity.labelScope, { home: identity.home, appData: process.env.APPDATA }), { force: true });
+    },
+};
+//# sourceMappingURL=windows.js.map

package/dist/service/windows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows.js","sourceRoot":"","sources":["../../src/service/windows.ts"],"names":[],"mappings":"AAAA;gFACgF;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE9D,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAqB,MAAM,cAAc,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,oBAAoB,EAA6B,MAAM,mBAAmB,CAAC;AAEnI,MAAM,UAAU,GAAG,CAAC,QAAyB,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;AACjG,MAAM,IAAI,GAAG,CAAC,QAAyB,EAAE,SAA+B,EAAE,MAAe,EAAE,EAAE,CAAC,SAAS,CACrG,oBAAoB,EAAE,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,CAAC;QAChG,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC,CACJ,CAAC;AAEF,KAAK,UAAU,iBAAiB,CAAC,QAAyB;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK;YAAE,OAAO;QACrD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,KAAK,oDAAoD,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;AACnI,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;IACrD,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa;QAC7C,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjG,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAClC,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAClC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9F,2EAA2E;QAC3E,MAAM,CAAC,wBAAwB,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChI,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,QAAQ;QAClB,IAAI,CAAC,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK;YAAE,OAAO;QACrD,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACxB,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,QAAQ;QACjB,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1B,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,QAAQ;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAiE,CAAC;QAC3H,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU;YAC5F,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,gBAAgB;YACtF,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YACzE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,0BAA0B,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,QAAQ;QACtB,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1B,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvB,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC5B,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,wBAAwB,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChI,CAAC;CACF,CAAC"}

package/dist/sqlite.d.ts

@@ -0,0 +1,4 @@
+import Database from 'better-sqlite3';
+/** Every persistent SQLite handle names the same OS file as Node's filesystem.
+ * The Windows namespace prefix bypasses legacy Win32 MAX_PATH interpretation. */
+export declare function openFileDatabase(file: string, options?: Database.Options): Database.Database;

package/dist/sqlite.js

@@ -0,0 +1,16 @@
+import Database from 'better-sqlite3';
+import { resolve, toNamespacedPath } from 'node:path';
+/** Every persistent SQLite handle names the same OS file as Node's filesystem.
+ * The Windows namespace prefix bypasses legacy Win32 MAX_PATH interpretation. */
+export function openFileDatabase(file, options) {
+    const filename = toNamespacedPath(resolve(file));
+    try {
+        return new Database(filename, options);
+    }
+    catch (error) {
+        if (error instanceof Error)
+            error.message = `SQLite ${JSON.stringify(file)}: ${error.message}`;
+        throw error;
+    }
+}
+//# sourceMappingURL=sqlite.js.map

package/dist/sqlite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite.js","sourceRoot":"","sources":["../src/sqlite.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAEtD;iFACiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAA0B;IACvE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC;QAAC,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAAC,CAAC;IAC/C,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,KAAK;YAAE,KAAK,CAAC,OAAO,GAAG,UAAU,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QAC/F,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/updates/artifacts.d.ts

@@ -0,0 +1,40 @@
+import type { AcceptedRuntimeRelease } from '@amalgm/core/supervision';
+import type { ServiceIdentity } from '../service/registration.js';
+export declare class RuntimeDownloadError extends Error {
+}
+export declare class RuntimeCommandError extends Error {
+    readonly stdout: string;
+    readonly exitCode: number | null;
+    constructor(message: string, stdout: string, exitCode: number | null);
+}
+/** Only npm's structured top-level error classifies dependency transport.
+ * Script diagnostics, integrity failures and preflight output never do. */
+export declare function classifyNpmFailure(error: unknown): unknown;
+export declare const RUNTIME_CONTRACT: Readonly<{
+    schema: 1;
+    controllerProtocol: 1;
+    nodeMajor: 24;
+    platforms: string[];
+    protocol: 1;
+    stores: Readonly<{
+        id: "installation";
+        reads: {
+            min: number;
+            max: number;
+        };
+        writes: 1;
+    }>[];
+}>;
+export declare function managedPackage(root?: string): boolean;
+export declare function artifactDirectory(identity: ServiceIdentity, release: AcceptedRuntimeRelease): string;
+export declare function hashFile(file: string): Promise<string>;
+export declare function examineArchive(file: string, directory: string): Promise<readonly string[]>;
+export declare function runIsolated(node: string, args: readonly string[], cwd: string, signal: AbortSignal, timeout?: number): Promise<string>;
+/** New generations never overwrite packages that an existing process can read.
+ * The receipt is written only after strict installation and isolated preflight. */
+export declare function stageRuntime(identity: ServiceIdentity, release: AcceptedRuntimeRelease, node: string, signal: AbortSignal, installedBaseline?: string): Promise<string>;
+export declare function collectRuntimeArtifacts(identity: ServiceIdentity, retained: readonly string[]): Promise<void>;
+/** Called only after the new controller owns the exclusive controller lease,
+ * before discovery or staging starts. An isolated command's own lease remains
+ * authoritative even if the controller that spawned it has already exited. */
+export declare function collectAbandonedUpdateWork(identity: ServiceIdentity): Promise<void>;

package/dist/updates/artifacts.js

@@ -0,0 +1,299 @@
+import { spawn } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import { createServer } from 'node:net';
+import { createRequire } from 'node:module';
+import { createReadStream, existsSync } from 'node:fs';
+import { lstat, mkdir, mkdtemp, readFile, readdir, rename, rm, writeFile } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+import { extract, list } from 'tar';
+import { BaseFetcher } from 'tuf-js';
+import { acquireProcessLease } from '../installation/lease.js';
+import { installedPackage, packageRoot, RUNTIME_FORMAT, CONTROLLER_PROTOCOL } from './store.js';
+const require = createRequire(import.meta.url);
+export class RuntimeDownloadError extends Error {
+}
+export class RuntimeCommandError extends Error {
+    stdout;
+    exitCode;
+    constructor(message, stdout, exitCode) {
+        super(message);
+        this.stdout = stdout;
+        this.exitCode = exitCode;
+    }
+}
+const npmTransportCodes = new Set(['ECONNRESET', 'ECONNREFUSED', 'ETIMEDOUT', 'ESOCKETTIMEDOUT', 'EAI_AGAIN',
+    'ENOTFOUND', 'ENETUNREACH', 'EHOSTUNREACH', 'E408', 'E429', 'E500', 'E502', 'E503', 'E504']);
+/** Only npm's structured top-level error classifies dependency transport.
+ * Script diagnostics, integrity failures and preflight output never do. */
+export function classifyNpmFailure(error) {
+    if (!(error instanceof RuntimeCommandError) || error.exitCode === null)
+        return error;
+    let code;
+    try {
+        code = JSON.parse(error.stdout).error?.code;
+    }
+    catch {
+        return error;
+    }
+    return typeof code === 'string' && npmTransportCodes.has(code)
+        ? new RuntimeDownloadError(`Runtime dependency transport failed (${code})`, { cause: error }) : error;
+}
+export const RUNTIME_CONTRACT = Object.freeze({ schema: 1, controllerProtocol: CONTROLLER_PROTOCOL, nodeMajor: 24,
+    platforms: ['darwin-arm64', 'darwin-x64', 'linux-x64', 'win32-x64'],
+    protocol: 1, stores: [RUNTIME_FORMAT] });
+export function managedPackage(root = packageRoot) {
+    const pkg = installedPackage(root);
+    return pkg.name === 'amalgm' && ['main', 'preview'].includes(pkg.amalgmSource?.branch ?? '');
+}
+export function artifactDirectory(identity, release) {
+    return join(identity.serviceDir, 'generations', release.digest, 'package');
+}
+export async function hashFile(file) {
+    const hash = createHash('sha512');
+    for await (const bytes of createReadStream(file))
+        hash.update(bytes);
+    return hash.digest('hex');
+}
+class RegistryFetcher extends BaseFetcher {
+    signal;
+    constructor(signal) {
+        super();
+        this.signal = signal;
+    }
+    async fetch(url) {
+        const target = new URL(url);
+        if (target.origin !== 'https://registry.npmjs.org')
+            throw new Error('Runtime archive escaped the npm registry');
+        try {
+            const response = await fetch(target, { signal: this.signal, redirect: 'error' });
+            if (!response.ok || !response.body) {
+                const message = `Runtime archive returned HTTP ${response.status}`;
+                if (response.status >= 500 || response.status === 429 || response.status === 404)
+                    throw new RuntimeDownloadError(message);
+                throw new Error(message);
+            }
+            // BaseFetcher consumes this body after fetch() returns. Classify failures
+            // at the transport reader, before archive integrity or disk effects run.
+            const reader = response.body.getReader();
+            return new ReadableStream({
+                async pull(controller) {
+                    try {
+                        const next = await reader.read();
+                        if (next.done) {
+                            reader.releaseLock();
+                            controller.close();
+                        }
+                        else
+                            controller.enqueue(next.value);
+                    }
+                    catch (error) {
+                        reader.releaseLock();
+                        controller.error(new RuntimeDownloadError('Runtime archive transfer was interrupted', { cause: error }));
+                    }
+                },
+                async cancel(reason) { try {
+                    await reader.cancel(reason);
+                }
+                finally {
+                    reader.releaseLock();
+                } },
+            });
+        }
+        catch (error) {
+            if (error instanceof TypeError || error.name === 'TimeoutError')
+                throw new RuntimeDownloadError(String(error));
+            throw error;
+        }
+    }
+}
+export async function examineArchive(file, directory) {
+    const paths = new Set();
+    let size = 0;
+    let invalid = null;
+    await list({ file, strict: true, onReadEntry(entry) {
+            if (invalid)
+                return;
+            const parts = entry.path.replace(/\/$/, '').split('/');
+            if (parts[0] !== 'package' || parts.some(part => !part || part === '.' || part === '..') || entry.path.includes('\\')
+                || !['File', 'Directory'].includes(entry.type) || paths.has(entry.path) || paths.size >= 20_000) {
+                invalid = 'Runtime archive has unsafe or ambiguous entries';
+                return;
+            }
+            paths.add(entry.path);
+            size += entry.size;
+            if (size > 256 * 1024 * 1024)
+                invalid = 'Runtime archive exceeds its expanded bound';
+        } });
+    if (invalid)
+        throw new Error(invalid);
+    await extract({ file, cwd: directory, strict: true, preservePaths: false, noChmod: true });
+    return [...paths].filter(path => !path.endsWith('/'));
+}
+export async function runIsolated(node, args, cwd, signal, timeout = 600_000) {
+    const ownerFile = join(cwd, '.isolated-command.sqlite');
+    const token = randomBytes(32).toString('hex');
+    const streams = new Set();
+    const lifetime = createServer(stream => {
+        streams.add(stream);
+        stream.once('close', () => streams.delete(stream));
+        stream.on('error', () => { });
+        stream.setTimeout(5_000, () => stream.destroy());
+        let admission = '';
+        stream.on('data', bytes => {
+            admission += bytes.toString('utf8');
+            if (admission.length > 65 || !(token + '\n').startsWith(admission))
+                stream.destroy();
+            else if (admission === token + '\n') {
+                stream.setTimeout(0);
+                stream.write('start\n');
+            }
+        });
+    });
+    lifetime.maxConnections = 1;
+    await new Promise((resolveReady, reject) => { lifetime.once('error', reject); lifetime.listen(0, '127.0.0.1', resolveReady); });
+    const address = lifetime.address();
+    if (!address || typeof address === 'string')
+        throw new Error('The isolated command has no parent lifetime address');
+    const env = { ...process.env, npm_config_userconfig: join(cwd, '.release-npmrc'), npm_config_audit: 'false', npm_config_fund: 'false',
+        AMALGM_ISOLATED_COMMAND_LIFETIME: JSON.stringify({ file: ownerFile, timeout, port: address.port, token }) };
+    delete env.NODE_AUTH_TOKEN;
+    delete env.NPM_TOKEN;
+    delete env.NODE_OPTIONS;
+    return await new Promise((resolveResult, reject) => {
+        const child = spawn(node, ['--import', new URL('./isolated-command-lifetime.js', import.meta.url).href, ...args], { cwd, env, stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
+        let bytes = '';
+        let outputBytes = '';
+        let complete = false;
+        let drain;
+        const cancel = () => child.kill('SIGKILL');
+        const timer = setTimeout(cancel, timeout);
+        signal.addEventListener('abort', cancel, { once: true });
+        const clean = () => { clearTimeout(timer); clearTimeout(drain); signal.removeEventListener('abort', cancel); };
+        const output = (chunk) => { bytes = (bytes + chunk.toString('utf8')).slice(-64 * 1024); };
+        child.stdout.on('data', (chunk) => { outputBytes = (outputBytes + chunk.toString('utf8')).slice(-64 * 1024); output(chunk); });
+        child.stderr.on('data', output);
+        child.once('exit', () => {
+            // A script descendant retaining stdout cannot keep the direct command's
+            // result pending after that command has actually exited.
+            drain = setTimeout(() => { child.stdout?.destroy(); child.stderr?.destroy(); }, 1_000);
+            drain.unref();
+        });
+        child.on('error', error => { if (!child.pid) {
+            complete = true;
+            clean();
+            reject(error);
+        } });
+        child.on('close', code => { if (complete)
+            return; clean(); if (code === 0 && !signal.aborted)
+            resolveResult(outputBytes);
+        else
+            reject(new RuntimeCommandError(`Isolated runtime command failed (${code}): ${bytes.slice(-4_000)}`, outputBytes, code)); });
+        if (signal.aborted)
+            cancel();
+    }).finally(async () => {
+        for (const stream of streams)
+            stream.destroy();
+        await new Promise(resolveClosed => lifetime.close(() => resolveClosed()));
+    });
+}
+async function verifyPackage(root, release) {
+    const artifact = release.target.release.units[0].artifact;
+    const pkg = installedPackage(root);
+    if (pkg.name !== artifact.name || pkg.version !== artifact.version
+        || ['repository', 'branch', 'commit'].some(key => Reflect.get(pkg.amalgmSource ?? {}, key) !== Reflect.get(artifact.source, key))
+        || await hashFile(join(root, 'npm-shrinkwrap.json')) !== artifact.lockSha512)
+        throw new Error('Runtime package differs from the signed composition');
+}
+/** New generations never overwrite packages that an existing process can read.
+ * The receipt is written only after strict installation and isolated preflight. */
+export async function stageRuntime(identity, release, node, signal, installedBaseline) {
+    const destination = artifactDirectory(identity, release);
+    if (!installedBaseline && existsSync(join(dirname(destination), 'verified.json'))) {
+        await verifyPackage(destination, release);
+        return destination;
+    }
+    const parent = dirname(dirname(destination));
+    await mkdir(parent, { recursive: true, mode: 0o700 });
+    const scratch = await mkdtemp(join(parent, '.stage-'));
+    try {
+        const artifact = release.target.release.units[0].artifact;
+        const archive = join(scratch, 'runtime.tgz');
+        const fetcher = new RegistryFetcher(AbortSignal.any([signal, AbortSignal.timeout(120_000)]));
+        await fetcher.downloadFile(`https://registry.npmjs.org/amalgm/-/amalgm-${artifact.version}.tgz`, 128 * 1024 * 1024, async (file) => {
+            if (await hashFile(file) !== artifact.sha512)
+                throw new Error('Runtime archive integrity differs from its signed target');
+            await writeFile(archive, await readFile(file));
+        });
+        const files = await examineArchive(archive, scratch);
+        const root = join(scratch, 'package');
+        await verifyPackage(root, release);
+        if (installedBaseline) {
+            await verifyPackage(installedBaseline, release);
+            for (const path of files) {
+                const source = resolve(scratch, path);
+                const relative = path.slice('package/'.length);
+                const stat = await lstat(source);
+                if (stat.isFile() && await hashFile(source) !== await hashFile(join(installedBaseline, relative)))
+                    throw new Error('Installed baseline contains different package bytes');
+            }
+        }
+        await writeFile(join(root, '.release-npmrc'), 'registry=https://registry.npmjs.org/\nstrict-allow-scripts=true\n');
+        const npm = join(dirname(require.resolve('npm/package.json')), 'bin/npm-cli.js');
+        try {
+            await runIsolated(node, [npm, 'ci', '--json', '--omit=dev', '--strict-allow-scripts', '--no-audit', '--no-fund'], root, signal);
+        }
+        catch (error) {
+            throw classifyNpmFailure(error);
+        }
+        const result = await runIsolated(node, [join(root, 'dist/main.js'), 'version', '--runtime-contract'], root, signal, 30_000);
+        const contract = JSON.parse(result.trim());
+        const declared = release.target.release;
+        if (contract.controllerProtocol !== declared.controllerProtocol || contract.nodeMajor !== declared.nodeMajor
+            || contract.protocol !== declared.units[0].protocol || JSON.stringify(contract.stores) !== JSON.stringify(declared.units[0].stores))
+            throw new Error('Runtime preflight contract differs from its signed recipe');
+        await rm(archive);
+        await rm(join(root, '.release-npmrc'));
+        await rm(join(root, '.isolated-command.sqlite'));
+        await writeFile(join(scratch, 'verified.json'), JSON.stringify({ digest: release.digest }));
+        if (existsSync(dirname(destination))) {
+            await verifyPackage(destination, release);
+            return destination;
+        }
+        await rename(scratch, dirname(destination));
+        return destination;
+    }
+    finally {
+        await rm(scratch, { recursive: true, force: true });
+    }
+}
+export async function collectRuntimeArtifacts(identity, retained) {
+    const parent = join(identity.serviceDir, 'generations');
+    for (const entry of await readdir(parent).catch(() => [])) {
+        if (/^[a-f0-9]{64}$/.test(entry) && !retained.includes(entry))
+            await rm(join(parent, entry), { recursive: true, force: true });
+    }
+}
+/** Called only after the new controller owns the exclusive controller lease,
+ * before discovery or staging starts. An isolated command's own lease remains
+ * authoritative even if the controller that spawned it has already exited. */
+export async function collectAbandonedUpdateWork(identity) {
+    const parent = join(identity.serviceDir, 'generations');
+    for (const entry of await readdir(parent, { withFileTypes: true }).catch(() => [])) {
+        if (!entry.isDirectory() || !/^\.stage-[A-Za-z0-9]+$/.test(entry.name))
+            continue;
+        const directory = join(parent, entry.name);
+        const owner = join(directory, 'package', '.isolated-command.sqlite');
+        if (existsSync(owner)) {
+            const lease = acquireProcessLease(owner);
+            if (!lease)
+                continue;
+            lease.close();
+        }
+        await rm(directory, { recursive: true, force: true });
+    }
+    for (const entry of await readdir(identity.serviceDir, { withFileTypes: true })) {
+        if (entry.isDirectory() && /^trust-refresh-[A-Za-z0-9]+$/.test(entry.name))
+            await rm(join(identity.serviceDir, entry.name), { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=artifacts.js.map

package/dist/updates/artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifacts.js","sourceRoot":"","sources":["../../src/updates/artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAAe,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAErC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEhG,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,OAAO,oBAAqB,SAAQ,KAAK;CAAG;AAClD,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACN;IAAyB;IAA/D,YAAY,OAAe,EAAW,MAAc,EAAW,QAAuB;QAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAAnE,WAAM,GAAN,MAAM,CAAQ;QAAW,aAAQ,GAAR,QAAQ,CAAe;IAAoB,CAAC;CAC5G;AACD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,WAAW;IAC1G,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE/F;2EAC2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,CAAC,CAAC,KAAK,YAAY,mBAAmB,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACrF,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IAC5E,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;QAC5D,CAAC,CAAC,IAAI,oBAAoB,CAAC,wCAAwC,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1G,CAAC;AACD,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE;IAC/G,SAAS,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC;IACnE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;AAE3C,MAAM,UAAU,cAAc,CAAC,IAAI,GAAG,WAAW;IAC/C,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;AAC/F,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,QAAyB,EAAE,OAA+B;IAC1F,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC7E,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAY;IACzC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AACD,MAAM,eAAgB,SAAQ,WAAW;IAClB;IAArB,YAAqB,MAAmB;QAAI,KAAK,EAAE,CAAC;QAA/B,WAAM,GAAN,MAAM,CAAa;IAAa,CAAC;IACtD,KAAK,CAAC,KAAK,CAAC,GAAW;QACrB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,MAAM,KAAK,4BAA4B;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAChH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YACjF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,MAAM,OAAO,GAAG,iCAAiC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACnE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;oBAAE,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;gBAC1H,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3B,CAAC;YACD,0EAA0E;YAC1E,yEAAyE;YACzE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACzC,OAAO,IAAI,cAAc,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,UAAU;oBACnB,IAAI,CAAC;wBACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;wBACjC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;4BAAC,MAAM,CAAC,WAAW,EAAE,CAAC;4BAAC,UAAU,CAAC,KAAK,EAAE,CAAC;wBAAC,CAAC;;4BACvD,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACtC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,MAAM,CAAC,WAAW,EAAE,CAAC;wBACrB,UAAU,CAAC,KAAK,CAAC,IAAI,oBAAoB,CAAC,0CAA0C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;oBAC3G,CAAC;gBACH,CAAC;gBACD,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC;oBAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAAC,CAAC;wBAAS,CAAC;oBAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBAAC,CAAC,CAAC,CAAC;aAChG,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,SAAS,IAAK,KAA2B,CAAC,IAAI,KAAK,cAAc;gBAAE,MAAM,IAAI,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACtI,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF;AACD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,SAAiB;IAClE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAAC,IAAI,IAAI,GAAG,CAAC,CAAC;IAAC,IAAI,OAAO,GAAkB,IAAI,CAAC;IACjF,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK;YAChD,IAAI,OAAO;gBAAE,OAAO;YACpB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;mBAChH,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;gBAAC,OAAO,GAAG,iDAAiD,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC3K,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC;YAC1C,IAAI,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI;gBAAE,OAAO,GAAG,4CAA4C,CAAC;QACvF,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACxD,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAuB,EAAE,GAAW,EAAE,MAAmB,EAAE,OAAO,GAAG,OAAO;IAC1H,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtG,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;YACxB,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,MAAM,CAAC,OAAO,EAAE,CAAC;iBAChF,IAAI,SAAS,KAAK,KAAK,GAAG,IAAI,EAAE,CAAC;gBAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;QACzF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC;IAC5B,MAAM,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtI,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACpH,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,qBAAqB,EAAE,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO;QACtJ,gCAAgC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC9G,OAAO,GAAG,CAAC,eAAe,CAAC;IAAC,OAAO,GAAG,CAAC,SAAS,CAAC;IAAC,OAAO,GAAG,CAAC,YAAY,CAAC;IAC1E,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,GAAG,CAAC,gCAAgC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,EAC9G,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,KAAK,GAAG,EAAE,CAAC;QAAC,IAAI,WAAW,GAAG,EAAE,CAAC;QAAC,IAAI,QAAQ,GAAG,KAAK,CAAC;QAC3D,IAAI,KAAgD,CAAC;QACrD,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACpG,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/G,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,GAAG,KAAK,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClG,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,WAAW,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxI,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YACtB,wEAAwE;YACxE,yDAAyD;YACzD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACxG,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,KAAK,EAAE,CAAC;YAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ;YAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,aAAa,CAAC,WAAW,CAAC,CAAC;;YAAM,MAAM,CAAC,IAAI,mBAAmB,CAAC,oCAAoC,IAAI,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3P,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;QACpB,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/C,MAAM,IAAI,OAAO,CAAO,aAAa,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC;AACD,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,OAA+B;IACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1D,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;WAC7D,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;WAC9H,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,KAAK,QAAQ,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;AACzJ,CAAC;AAED;mFACmF;AACnF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAyB,EAAE,OAA+B,EAAE,IAAY,EAAE,MAAmB,EAC9H,iBAA0B;IAC1B,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,iBAAiB,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAAC,OAAO,WAAW,CAAC;IAChE,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAAC,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpG,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,MAAM,OAAO,CAAC,YAAY,CAAC,8CAA8C,QAAQ,CAAC,OAAO,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,KAAK,EAAC,IAAI,EAAC,EAAE;YAC/H,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;YAC1H,MAAM,SAAS,CAAC,OAAO,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAAC,MAAM,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1E,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,aAAa,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;YAChD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBACtF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;gBACjC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,MAAM,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YAC5K,CAAC;QACH,CAAC;QACD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,mEAAmE,CAAC,CAAC;QACnH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACjF,IAAI,CAAC;YAAC,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,wBAAwB,EAAE,YAAY,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QACxI,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,SAAS,EAAE,oBAAoB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5H,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QACxC,IAAI,QAAQ,CAAC,kBAAkB,KAAK,QAAQ,CAAC,kBAAkB,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;eACvG,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QACpN,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;QAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC,CAAC;QAC5G,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5F,IAAI,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAAC,MAAM,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAAC,OAAO,WAAW,CAAC;QAAC,CAAC;QACxG,MAAM,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;QAC5C,OAAO,WAAW,CAAC;IACrB,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AACpE,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAAyB,EAAE,QAA2B;IAClG,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACxD,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1D,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjI,CAAC;AACH,CAAC;AAED;;8EAE8E;AAC9E,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,QAAyB;IACxE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACxD,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QACnF,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACjF,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,0BAA0B,CAAC,CAAC;QACrE,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAChF,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChK,CAAC;AACH,CAAC"}

package/dist/updates/bootstrap.d.ts

@@ -0,0 +1,48 @@
+export interface LaunchCommand {
+    node: string;
+    bin: string;
+    args: string[];
+}
+export interface LaunchLimits {
+    maxAttempts: number;
+    initialDelayMs: number;
+    maxDelayMs: number;
+    stableAfterMs: number;
+    readyTimeoutMs: number;
+    healthIntervalMs: number;
+    healthTimeoutMs: number;
+    maxHealthFailures: number;
+    stopGraceMs: number;
+}
+export interface LaunchState extends LaunchLimits {
+    schema: 1;
+    current: LaunchCommand;
+    pending: null | {
+        token: string;
+        candidate: LaunchCommand;
+        recovery: LaunchCommand;
+        attempted: boolean;
+        recoveryAttempted: boolean;
+    };
+    attempts: number;
+}
+export declare function validateLaunchState(value: unknown): LaunchState;
+/** Reinstall can repair a missing bootstrap file, but never resets selected
+ * release, in-flight handover, or spent recovery allowance. */
+export declare function initializeBootstrap(input: {
+    serviceDir: string;
+    controllerLease: string;
+    current: LaunchCommand;
+    limits: LaunchLimits;
+}): {
+    node: string;
+    bin: string;
+    args: string[];
+    current: LaunchCommand;
+};
+/** Explicit operator retry restores control through known recovery code. It
+ * never chooses the failed candidate or changes the Core policy/quarantine. */
+export declare function retryBootstrap(databaseFile: string): boolean;
+/** One stable owner waits for the installation lease to drain, charges every
+ * launch durably, and parks rather than asking its OS parent for more attempts. */
+export declare function runBootstrap(databaseFile: string, controllerLeaseFile: string): Promise<number>;