@aopslabs/aops 0.3.6 → 0.3.8

package/dist/commands/doc.js

@@ -1,6 +1,6 @@
-import { createHash } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { readFileSync } from 'node:fs';
-import { mkdir, readFile, readdir, stat, writeFile } from 'node:fs/promises';
+import { mkdir, readFile, readdir, rename, stat, unlink, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { Command } from 'commander';
 import { logError, logInfo, logSuccess } from '@aopslabs/xf-cli-ui';
@@ -887,14 +887,39 @@ function recordVersion(record) {
     const parsed = Number(record.version);
     return Number.isFinite(parsed) ? Math.trunc(parsed) : 0;
 }
-function selectLatestDocumentVersion(versions) {
-    const candidates = versions.filter((version) => recordId(version, 'documentVersionId'));
-    const currentVersion = candidates.find((version) => version.isCurrent === true);
-    if (currentVersion)
-        return currentVersion;
-    return candidates
-        .slice()
-        .sort((left, right) => recordVersion(right) - recordVersion(left))[0];
+export function selectCurrentPublishedDocumentVersion(versions, documentId) {
+    const normalizedDocumentId = normalizeNonEmpty(documentId);
+    if (!normalizedDocumentId)
+        throw new Error('Mirror version selection requires a document id.');
+    if (versions.length === 0) {
+        throw new Error(`Docman document ${normalizedDocumentId} has no version rows; mirror pull stopped before writing files.`);
+    }
+    const seenVersionIds = new Set();
+    for (const version of versions) {
+        const rowDocumentId = normalizeNonEmpty(version.documentId);
+        if (rowDocumentId !== normalizedDocumentId) {
+            throw new Error(`Docman version list returned a foreign row for document ${normalizedDocumentId}: ` +
+                `row ${recordId(version, 'documentVersionId') ?? '<missing-id>'} belongs to ${rowDocumentId ?? '<missing-document-id>'}.`);
+        }
+        const versionId = recordId(version, 'documentVersionId');
+        if (!versionId) {
+            throw new Error(`Docman document ${normalizedDocumentId} returned a version row without an id.`);
+        }
+        if (seenVersionIds.has(versionId)) {
+            throw new Error(`Docman document ${normalizedDocumentId} returned duplicate version id ${versionId}.`);
+        }
+        seenVersionIds.add(versionId);
+    }
+    const current = versions.filter((version) => version.isCurrent === true);
+    if (current.length !== 1) {
+        throw new Error(`Docman document ${normalizedDocumentId} must have exactly one current version; received ${current.length}. ` +
+            'Mirror pull does not fall back to the highest version.');
+    }
+    const selected = current[0];
+    if (normalizeNonEmpty(selected.status)?.toLowerCase() !== 'published') {
+        throw new Error(`Docman document ${normalizedDocumentId} current version ${recordId(selected, 'documentVersionId') ?? '<missing-id>'} is not published.`);
+    }
+    return selected;
 }
 function findVersionBySourceHash(versions, sourceHash) {
     const shortHash = sourceHash.slice(0, 12);
@@ -1521,7 +1546,7 @@ function buildGroupPath(document, groupsById, groupsByUid) {
     }
     return path.join(...(segments.length > 0 ? segments : ['ungrouped']));
 }
-async function writeDocMirrorFile(params) {
+function buildDocMirrorFile(params) {
     const documentSlug = normalizeNonEmpty(params.document.slug) ??
         pathSegmentSlug(normalizeNonEmpty(params.document.title), normalizeNonEmpty(params.document.id) ?? 'document');
     const filePath = path.join(params.outputRoot, params.groupPath, `${pathSegmentSlug(documentSlug, 'document')}.md`);
@@ -1544,11 +1569,12 @@ async function writeDocMirrorFile(params) {
         target: params.target,
         pulledAt: new Date().toISOString(),
     });
-    await mkdir(path.dirname(filePath), { recursive: true });
-    await writeFile(filePath, `${frontmatter}<!-- READ-ONLY MIRROR: update Docman/source docs, then run aops-cli doc mirror pull. -->\n\n${params.content}`, 'utf8');
-    return filePath;
+    return {
+        filePath,
+        content: `${frontmatter}<!-- READ-ONLY MIRROR: update Docman/source docs, then run aops-cli doc mirror pull. -->\n\n${params.content}`,
+    };
 }
-async function writeDocMirrorIndex(params) {
+function buildDocMirrorIndex(params) {
     const indexPath = path.join(params.outputRoot, 'index.md');
     const frontmatter = renderFrontmatter({
         schemaVersion: 1,
@@ -1575,9 +1601,79 @@ async function writeDocMirrorIndex(params) {
         }),
         '',
     ];
-    await mkdir(params.outputRoot, { recursive: true });
-    await writeFile(indexPath, lines.join('\n'), 'utf8');
-    return indexPath;
+    return { filePath: indexPath, content: lines.join('\n') };
+}
+export async function stageMirrorFile(targetPath, content, sequence) {
+    await mkdir(path.dirname(targetPath), { recursive: true });
+    const temporaryPath = `${targetPath}.aops-stage-${process.pid}-${sequence}-${randomUUID()}`;
+    await writeFile(temporaryPath, content, 'utf8');
+    return { targetPath, temporaryPath };
+}
+function isFileSystemError(error, code) {
+    return Boolean(error && typeof error === 'object' && 'code' in error && error.code === code);
+}
+async function replaceStagedMirrorFile(file) {
+    const backupPath = `${file.temporaryPath}.previous`;
+    let movedExistingTarget = false;
+    try {
+        try {
+            await rename(file.targetPath, backupPath);
+            movedExistingTarget = true;
+        }
+        catch (error) {
+            if (!isFileSystemError(error, 'ENOENT'))
+                throw error;
+        }
+        try {
+            await rename(file.temporaryPath, file.targetPath);
+        }
+        catch (error) {
+            if (movedExistingTarget) {
+                try {
+                    await rename(backupPath, file.targetPath);
+                }
+                catch (restoreError) {
+                    throw new AggregateError([error, restoreError], `Docman mirror replacement failed and could not restore ${file.targetPath}.`);
+                }
+            }
+            throw error;
+        }
+        return { ...file, backupPath, targetExisted: movedExistingTarget };
+    }
+    catch (error) {
+        await unlink(file.temporaryPath).catch(() => undefined);
+        throw error;
+    }
+}
+export async function commitStagedMirrorFiles(files) {
+    const committed = [];
+    try {
+        for (const file of files) {
+            committed.push(await replaceStagedMirrorFile(file));
+        }
+    }
+    catch (error) {
+        const rollbackErrors = [];
+        for (const file of [...committed].reverse()) {
+            try {
+                await unlink(file.targetPath).catch((unlinkError) => {
+                    if (!isFileSystemError(unlinkError, 'ENOENT'))
+                        throw unlinkError;
+                });
+                if (file.targetExisted)
+                    await rename(file.backupPath, file.targetPath);
+            }
+            catch (rollbackError) {
+                rollbackErrors.push(rollbackError);
+            }
+        }
+        await Promise.all(files.map((file) => unlink(file.temporaryPath).catch(() => undefined)));
+        if (rollbackErrors.length > 0) {
+            throw new AggregateError([error, ...rollbackErrors], 'Docman mirror commit failed and rollback was incomplete.');
+        }
+        throw error;
+    }
+    await Promise.all(committed.filter((file) => file.targetExisted).map((file) => unlink(file.backupPath).catch(() => undefined)));
 }
 async function listDocMirrorIndexEntries(outputRoot) {
     const files = await listLocalMirrorMarkdownFiles(outputRoot);
@@ -2120,6 +2216,11 @@ function normalizeDocImportSlugStrategy(options) {
         return explicit;
     throw new Error('Invalid --slug-strategy. Expected one of: hash-suffix-on-collision, kebab-from-title.');
 }
+export function resolveDocImportToolId(dryRun) {
+    return dryRun
+        ? 'docman.document-version.import-headings.plan'
+        : 'docman.document-version.import-headings';
+}
 export async function runDocImportMarkdown(options = {}) {
     try {
         if (options.fromMarkdown !== true) {
@@ -2143,6 +2244,10 @@ export async function runDocImportMarkdown(options = {}) {
             })
             : undefined;
         const dryRun = options.dryRun === true || options.preview === true || options.apply !== true;
+        const planToken = normalizeNonEmpty(options.planToken);
+        if (dryRun && planToken) {
+            throw new Error('--plan-token is only valid with --apply.');
+        }
         const auditFields = await resolveDocAuditFields(apiState, options, {}, 'create');
         const importOptions = compactPayload({
             dryRun,
@@ -2167,13 +2272,14 @@ export async function runDocImportMarkdown(options = {}) {
                 nodes,
             },
             options: importOptions,
+            ...(!dryRun && planToken ? { planToken } : {}),
             ...auditFields,
         });
         if (baselineGuard?.status === 'blocked' && !dryRun && options.confirm !== true) {
             throw new Error(`Doc import baseline guard blocked ${baselineGuard.blockingDeltaCount} unrelated markdown deltas. ` +
                 'Run the command with --dry-run --json to inspect result.baselineGuard, add --guard-target for the intended heading, or use --confirm only after reviewing the full-import delta.');
         }
-        const toolId = 'docman.document-version.import-headings';
+        const toolId = resolveDocImportToolId(dryRun);
         const invokeInput = compactPayload({
             pathParams: { id: documentVersionId },
             body: input,
@@ -2407,6 +2513,36 @@ export async function runDocMirrorPull(options = {}) {
         }), compactPayload({
             limit: toInteger(options.limit, '--limit'),
         }));
+        const expectedGroup = groupUid ? groupsByUid.get(groupUid) : undefined;
+        const expectedGroupId = normalizeNonEmpty(expectedGroup?.id);
+        const expectedStatus = normalizeNonEmpty(options.status)?.toLowerCase();
+        const expectedScopeId = normalizeNonEmpty(resolvedContext.scopeId);
+        const seenDocumentIds = new Set();
+        for (const document of allDocuments) {
+            const documentId = recordId(document, 'documentId');
+            if (!documentId) {
+                throw new Error('Docman document list returned a row without a document id; mirror pull stopped before writing files.');
+            }
+            if (seenDocumentIds.has(documentId)) {
+                throw new Error(`Docman document list returned duplicate document id ${documentId}.`);
+            }
+            seenDocumentIds.add(documentId);
+            const rowScopeId = normalizeNonEmpty(document.scopeId);
+            if (expectedScopeId && rowScopeId && rowScopeId !== expectedScopeId) {
+                throw new Error(`Docman document list returned foreign-scope row ${documentId} (${rowScopeId}, expected ${expectedScopeId}).`);
+            }
+            if (groupUid) {
+                const rowGroupUid = normalizeNonEmpty(document.groupUid);
+                const rowGroupId = normalizeNonEmpty(document.groupId);
+                if (rowGroupUid !== groupUid && (!expectedGroupId || rowGroupId !== expectedGroupId)) {
+                    throw new Error(`Docman document list returned foreign-group row ${documentId}; expected group ${groupUid}.`);
+                }
+            }
+            const rowStatus = normalizeNonEmpty(document.status)?.toLowerCase();
+            if (expectedStatus && rowStatus !== expectedStatus) {
+                throw new Error(`Docman document list returned foreign-status row ${documentId}; expected ${expectedStatus}, received ${rowStatus ?? '<missing>'}.`);
+            }
+        }
         const documents = documentSlugFilters.size > 0
             ? allDocuments.filter((document) => {
                 const documentSlug = normalizeSlugFilter(document.slug);
@@ -2419,22 +2555,30 @@ export async function runDocMirrorPull(options = {}) {
             throw new Error(`No Docman documents matched --document-slug ${[...documentSlugFilters].join(', ')}.`);
         }
         const plans = [];
+        const seenVersionIds = new Set();
+        const seenMirrorPaths = new Set();
         for (const document of documents) {
             const documentId = recordId(document, 'documentId');
-            if (!documentId) {
-                plans.push({ title: document.title, skipped: true, reason: 'missing-document-id' });
-                continue;
-            }
+            if (!documentId)
+                throw new Error('Docman document row lost its validated id unexpectedly.');
             const versions = await listDocumentVersions(apiState, options, resolvedContext, documentId);
-            const latest = selectLatestDocumentVersion(versions);
+            const latest = selectCurrentPublishedDocumentVersion(versions, documentId);
             const documentVersionId = recordId(latest, 'documentVersionId');
-            if (!latest || !documentVersionId) {
-                plans.push({ documentId, title: document.title, skipped: true, reason: 'missing-document-version' });
-                continue;
+            if (!documentVersionId)
+                throw new Error(`Docman document ${documentId} current published version is missing its id.`);
+            if (seenVersionIds.has(documentVersionId)) {
+                throw new Error(`Docman mirror plan contains duplicate version id ${documentVersionId}.`);
             }
+            seenVersionIds.add(documentVersionId);
             const groupPath = buildGroupPath(document, groupsById, groupsByUid);
             const documentSlug = normalizeNonEmpty(document.slug) ??
                 pathSegmentSlug(normalizeNonEmpty(document.title), normalizeNonEmpty(documentId) ?? 'document');
+            const mirrorPath = path.join(groupPath, `${pathSegmentSlug(documentSlug, 'document')}.md`);
+            const canonicalMirrorPath = path.resolve(outputRoot, mirrorPath).toLowerCase();
+            if (seenMirrorPaths.has(canonicalMirrorPath)) {
+                throw new Error(`Docman mirror plan contains duplicate output path ${mirrorPath}.`);
+            }
+            seenMirrorPaths.add(canonicalMirrorPath);
             plans.push({
                 documentId,
                 documentVersionId,
@@ -2442,7 +2586,7 @@ export async function runDocMirrorPull(options = {}) {
                 title: document.title,
                 slug: documentSlug,
                 groupPath,
-                mirrorPath: path.join(groupPath, `${pathSegmentSlug(documentSlug, 'document')}.md`),
+                mirrorPath,
             });
         }
         const input = compactPayload({
@@ -2462,16 +2606,16 @@ export async function runDocMirrorPull(options = {}) {
             input,
         }))
             return;
-        const written = [];
+        const materializedPlans = [];
         for (const plan of plans) {
             const documentId = normalizeNonEmpty(plan.documentId);
             const documentVersionId = normalizeNonEmpty(plan.documentVersionId);
-            if (!documentId || !documentVersionId) {
-                written.push(plan);
-                continue;
-            }
-            const document = documents.find((entry) => recordId(entry, 'documentId') === documentId) ?? {};
-            const latest = { id: documentVersionId, version: plan.documentVersion };
+            if (!documentId || !documentVersionId)
+                throw new Error('Validated mirror plan lost a document or version id.');
+            const document = documents.find((entry) => recordId(entry, 'documentId') === documentId);
+            if (!document)
+                throw new Error(`Validated mirror plan references unknown document ${documentId}.`);
+            const documentVersion = { id: documentVersionId, documentId, version: plan.documentVersion, status: 'published', isCurrent: true };
             const materialized = await callDocmanVersionRoute(apiState, options, resolvedContext, {
                 documentVersionId,
                 suffix: 'materialize',
@@ -2483,30 +2627,62 @@ export async function runDocMirrorPull(options = {}) {
                     fallbackLocale: normalizeNonEmpty(options.fallbackLocale),
                 }),
             });
+            const materializedPayload = unwrapResultData(materialized);
+            const returnedVersionId = normalizeNonEmpty(materializedPayload?.documentVersionId);
+            if (returnedVersionId !== documentVersionId) {
+                throw new Error(`Docman materialize returned version ${returnedVersionId ?? '<missing>'}; expected ${documentVersionId}. ` +
+                    'Mirror pull stopped before replacing any destination file.');
+            }
             const content = materializedContent(materialized);
-            const outputPath = await writeDocMirrorFile({
+            materializedPlans.push({ plan, document, documentVersion, content });
+        }
+        const existingIndexEntries = await listDocMirrorIndexEntries(outputRoot);
+        const written = [];
+        const artifacts = materializedPlans.map(({ plan, document, documentVersion, content }) => {
+            const artifact = buildDocMirrorFile({
                 outputRoot,
                 groupPath: normalizeNonEmpty(plan.groupPath) ?? 'ungrouped',
                 document,
-                documentVersion: latest,
+                documentVersion,
                 resolvedContext,
                 target,
                 content,
             });
             written.push({
                 ...plan,
-                outputPath,
+                outputPath: artifact.filePath,
             });
+            return artifact;
+        });
+        const indexEntriesByPath = new Map();
+        for (const entry of existingIndexEntries) {
+            const mirrorPath = normalizeNonEmpty(entry.mirrorPath);
+            if (mirrorPath)
+                indexEntriesByPath.set(mirrorPath.toLowerCase(), entry);
         }
-        const localIndexEntries = await listDocMirrorIndexEntries(outputRoot);
-        const indexEntries = localIndexEntries.length > 0
-            ? localIndexEntries
-            : written.filter((entry) => normalizeNonEmpty(entry.outputPath));
-        const indexPath = await writeDocMirrorIndex({
+        for (const entry of written) {
+            const mirrorPath = normalizeNonEmpty(entry.mirrorPath);
+            if (mirrorPath)
+                indexEntriesByPath.set(mirrorPath.toLowerCase(), entry);
+        }
+        const indexArtifact = buildDocMirrorIndex({
             outputRoot,
             resolvedContext,
-            entries: indexEntries,
+            entries: [...indexEntriesByPath.values()],
         });
+        const staged = [];
+        try {
+            for (const [index, artifact] of artifacts.entries()) {
+                staged.push(await stageMirrorFile(artifact.filePath, artifact.content, index));
+            }
+            staged.push(await stageMirrorFile(indexArtifact.filePath, indexArtifact.content, artifacts.length));
+        }
+        catch (error) {
+            await Promise.all(staged.map((file) => unlink(file.temporaryPath).catch(() => undefined)));
+            throw error;
+        }
+        await commitStagedMirrorFiles(staged);
+        const indexPath = indexArtifact.filePath;
         await emitDocResult({
             options,
             command: 'doc.mirror.pull',
@@ -2517,7 +2693,7 @@ export async function runDocMirrorPull(options = {}) {
                 outputRoot,
                 indexPath,
                 writtenCount: written.filter((entry) => normalizeNonEmpty(entry.outputPath)).length,
-                skippedCount: written.filter((entry) => Boolean(entry.skipped)).length,
+                skippedCount: 0,
                 documents: written,
             },
             artifacts: {
@@ -5097,6 +5273,7 @@ export function makeDocCommand() {
         .option('--baseline <path>', 'Prior materialized markdown path used to guard against unrelated body loss')
         .option('--guard-target <heading>', 'Heading path/title allowed to change when --baseline is provided (repeatable)', collectRepeatedOption, [])
         .option('--dry-run', 'Execute service-side import planning without mutating rows')
+        .option('--plan-token <token>', 'Apply only if this server-issued import plan is still current')
         .option('--existing-graph-policy <policy>', 'Existing graph policy: error, append, replace', 'error')
         .option('--append-existing-graph', 'Append into an existing graph explicitly')
         .option('--replace-existing-graph', 'Request explicit replace semantics')
@@ -5117,6 +5294,7 @@ export function makeDocCommand() {
             'In JSON, warning codes are under result.summary.warnings[].code, or result.import.summary.warnings[].code when baselineGuard wraps the import result.',
             'Use --synthesize-overview-pages when direct H2/H3 body text must become child Overview pages, then verify the mirror after publish/pull.',
             'Use --baseline and --guard-target for full-document imports; apply is blocked on unrelated deltas unless --confirm is explicit.',
+            'A dry-run returns a short-lived planToken. Pass it to --apply --plan-token <token> to reject source or graph drift; apply without a token remains supported.',
         ],
     }));
     const mirror = cmd.command('mirror').description('Docman mirror pull and markdown import helpers');

package/dist/lib/tui-launcher.js

@@ -1,11 +1,21 @@
 import { spawn } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { accessSync, constants, existsSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 const SUPPORTED_TUI_TARGETS = new Set([
     'darwin-arm64',
     'win32-x64',
 ]);
+const TUI_REINSTALL_MESSAGE = 'The bundled AOPS TUI is not executable. Reinstall @aopslabs/aops or use aops --help.';
+function isExecutableFile(filePath) {
+    try {
+        accessSync(filePath, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 function packageRootFromModule() {
     return fileURLToPath(new URL('../../', import.meta.url));
 }
@@ -41,10 +51,17 @@ export async function launchBundledTui(options = {}) {
     if (!fileExists(invocation.command)) {
         throw new Error('The bundled AOPS TUI is missing. Reinstall @aopslabs/aops or use aops --help.');
     }
+    const platform = options.platform ?? process.platform;
+    const fileExecutable = options.fileExecutable ?? isExecutableFile;
+    if (platform !== 'win32' && !fileExecutable(invocation.command)) {
+        throw new Error(TUI_REINSTALL_MESSAGE);
+    }
     const spawnProcess = options.spawnProcess ?? spawn;
     const child = spawnProcess(invocation.command, [...invocation.args], invocation.options);
     return await new Promise((resolve, reject) => {
-        child.once('error', reject);
+        child.once('error', (error) => {
+            reject(error.code === 'EACCES' ? new Error(TUI_REINSTALL_MESSAGE) : error);
+        });
         child.once('exit', (code, signal) => {
             if (signal) {
                 reject(new Error(`The AOPS TUI stopped after receiving ${signal}.`));

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@aopslabs/aops",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "type": "module",
   "description": "AOPS CLI and terminal setup application.",
-  "aopsDockerServerVersion": "0.2.8",
+  "aopsDockerServerVersion": "0.2.9",
   "license": "SEE LICENSE IN LICENSE",
   "repository": {
     "type": "git",
@@ -39,7 +39,7 @@
     "test:commercial-license": "node --test test/commercial-license.test.mjs",
     "test:commercial-runbook": "node --test test/commercial-runbook.test.mjs",
     "test:commercial-performance": "node --test test/commercial-performance.test.mjs",
-    "test:package-identity": "node --test test/package-identity.test.mjs",
+    "test:package-identity": "node --test test/package-identity.test.mjs test/npm-tar-entry-mode.test.mjs",
     "test:tui-launcher": "node --test test/tui-launcher.test.mjs",
     "test:skill-discovery": "node --test test/skill-discovery.test.mjs",
     "test:target-auth": "node --test test/target-auth.test.mjs test/device-login.test.mjs",
@@ -48,24 +48,25 @@
     "test:r6-auth-cutover": "node --test test/r6-auth-cutover.test.mjs",
     "test:container-runtime": "node --test test/container-runtime.test.mjs test/community-native-postgres.test.mjs",
     "test:kernel-alignment": "node --test test/kernel-alignment.test.mjs",
+    "test:hosted-contract-hardening": "node --test test/hosted-contract-hardening.test.mjs",
     "test:home": "node --test test/home-menu.test.mjs",
     "test:launchers": "node --test test/terminal-launchers.test.mjs",
-    "test:shortcuts": "pnpm run test:home && pnpm run test:cockpit && pnpm run test:launchers && pnpm run test:assets-menu && pnpm run test:agent-assets-content && pnpm run test:setup-install && pnpm run test:container-runtime && pnpm run test:native-lifecycle && pnpm run test:operation-journal && pnpm run test:commercial-canonical-order && pnpm run test:commercial-runtime-closure && pnpm run test:commercial-artifact && pnpm run test:commercial-final-readiness && pnpm run test:commercial-admission && pnpm run test:commercial-license && pnpm run test:commercial-runbook && pnpm run test:package-identity && pnpm run test:skill-discovery && pnpm run test:target-transport && pnpm run test:target-auth && pnpm run test:r6-auth-cutover && pnpm run test:r6-cutover-baseline",
+    "test:shortcuts": "pnpm run test:home && pnpm run test:cockpit && pnpm run test:launchers && pnpm run test:assets-menu && pnpm run test:agent-assets-content && pnpm run test:setup-install && pnpm run test:container-runtime && pnpm run test:native-lifecycle && pnpm run test:operation-journal && pnpm run test:commercial-canonical-order && pnpm run test:commercial-runtime-closure && pnpm run test:commercial-artifact && pnpm run test:commercial-final-readiness && pnpm run test:commercial-admission && pnpm run test:commercial-license && pnpm run test:commercial-runbook && pnpm run test:package-identity && pnpm run test:skill-discovery && pnpm run test:target-transport && pnpm run test:target-auth && pnpm run test:r6-auth-cutover && pnpm run test:r6-cutover-baseline && pnpm run test:hosted-contract-hardening",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "start": "node dist/main.js"
   },
   "dependencies": {
-    "@aopslabs/aops-server": "0.2.8",
-    "@aopslabs/artifact-trust-contracts": "0.3.0",
+    "@aopslabs/aops-server": "0.2.9",
+    "@aopslabs/artifact-trust-contracts": "0.3.1",
     "@aopslabs/cli-kit": "0.1.0",
-    "@aopslabs/aops-host-registration": "0.2.0",
-    "@aopslabs/aops-pg-bootstrap": "0.2.1",
-    "@aopslabs/aops-runtime-config": "0.2.0",
+    "@aopslabs/aops-host-registration": "0.2.1",
+    "@aopslabs/aops-pg-bootstrap": "0.2.2",
+    "@aopslabs/aops-runtime-config": "0.2.1",
     "@sigstore/bundle": "4.0.0",
     "@sigstore/protobuf-specs": "0.5.1",
     "@sigstore/tuf": "4.0.2",
     "@sigstore/verify": "3.1.1",
-    "@aopslabs/api-client": "0.2.0",
+    "@aopslabs/api-client": "0.2.1",
     "@aopslabs/domain-product-client-chatv3": "0.2.2",
     "@aopslabs/xf-cli-ui": "0.2.0",
     "commander": "14.0.3",