@askexenow/exe-os 0.9.299 → 0.9.301

package/dist/chunk-VWUQFZFB.js

@@ -0,0 +1,395 @@
+import {
+  EXE_AI_DIR
+} from "./chunk-R36FAN53.js";
+
+// src/lib/db-backup.ts
+import { existsSync, readdirSync, unlinkSync, statSync, statfsSync } from "fs";
+import { copyFile, mkdir, unlink, rename } from "fs/promises";
+import path from "path";
+var BACKUP_DIR = path.join(EXE_AI_DIR, "backups");
+var DEFAULT_KEEP_DAYS = 3;
+var DB_NAMES = ["memories.db", "exe-mem.db", "exe-os.db", "exe.db"];
+var REASON_COUNT_CAP = {
+  // Bug 727b7b1e: a daemon OOM crash loop made a ~1.5GB pre-restart backup on
+  // EVERY restart. 22 crashes = 11GB of pre-restart snapshots with no rotation.
+  // Keep only the 2 newest — enough to recover, small enough not to fill disk.
+  "pre-restart": 2,
+  "pre-consolidation": 5,
+  "pre-fix": 5,
+  "pre-restore": 5,
+  // Bug 91b1b167: daily snapshots are full uncompressed SQLCipher copies
+  // (~2-3GB apiece on large enterprise DBs). Time-based rotation alone left
+  // 19GB accumulating when mtimes drifted / the disk guard tripped. A hard
+  // count cap is a belt-and-braces safety net on top of day-based rotation.
+  "daily": 3
+};
+var MIN_FREE_BYTES = 5 * 1024 * 1024 * 1024;
+var STALE_TMP_MAX_AGE_MS = 60 * 60 * 1e3;
+function findActiveDb() {
+  for (const name of DB_NAMES) {
+    const p = path.join(EXE_AI_DIR, name);
+    if (existsSync(p)) return p;
+  }
+  return null;
+}
+async function createBackup(reason = "manual") {
+  return createBackupAsync(reason);
+}
+async function createBackupAsync(reason = "manual", opts = {}) {
+  const dbPath = findActiveDb();
+  if (!dbPath) return null;
+  await mkdir(BACKUP_DIR, { recursive: true });
+  try {
+    let dbSize = 0;
+    try {
+      dbSize = statSync(dbPath).size;
+    } catch {
+    }
+    const freeBytes = getFreeBytes(BACKUP_DIR);
+    if (!hasEnoughDiskSpace(freeBytes, dbSize)) {
+      process.stderr.write(
+        `[db-backup] DISK GUARD: skipping "${reason}" backup \u2014 ${Math.round(freeBytes / 1024 / 1024)}MB free, need >${Math.round(Math.max(MIN_FREE_BYTES, dbSize * 2) / 1024 / 1024)}MB. Disk is nearly full; refusing to make it worse.
+`
+      );
+      return null;
+    }
+  } catch {
+  }
+  const dbName = path.basename(dbPath, ".db");
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
+  const backupName = `${dbName}-${reason}-${timestamp}.db`;
+  const backupPath = path.join(BACKUP_DIR, backupName);
+  const tmpBackupPath = `${backupPath}.tmp`;
+  const checkpointMode = opts.checkpointMode ?? "TRUNCATE";
+  try {
+    const { getClient } = await import("./lib/database.js");
+    const client = getClient();
+    await client.execute(`PRAGMA wal_checkpoint(${checkpointMode})`);
+  } catch {
+    try {
+      const { execFile: execFileCb } = await import("child_process");
+      const { promisify } = await import("util");
+      const execFileAsync = promisify(execFileCb);
+      await execFileAsync("sqlite3", [dbPath, `PRAGMA wal_checkpoint(${checkpointMode});`], { timeout: 3e4 });
+    } catch {
+      process.stderr.write(`[db-backup] WAL checkpoint skipped \u2014 proceeding with copy (backup may include stale WAL)
+`);
+    }
+  }
+  try {
+    await unlink(tmpBackupPath);
+  } catch {
+  }
+  await copyFile(dbPath, tmpBackupPath);
+  await rename(tmpBackupPath, backupPath);
+  try {
+    const { getClient } = await import("./lib/database.js");
+    const client = getClient();
+    const chk = await client.execute("PRAGMA quick_check;");
+    const result = String(chk.rows[0]?.quick_check ?? chk.rows[0]?.[0] ?? "").trim();
+    if (result && result !== "ok") {
+      process.stderr.write(`[db-backup] WARNING: backup source failed quick_check (${reason}): ${result}
+`);
+      try {
+        await unlink(backupPath);
+      } catch {
+      }
+      return null;
+    }
+  } catch {
+    process.stderr.write(`[db-backup] Backup validation skipped (encrypted DB or CLI context) \u2014 proceeding with checkpoint-consistent copy.
+`);
+  }
+  const walPath = dbPath + "-wal";
+  if (existsSync(walPath)) {
+    try {
+      await copyFile(walPath, backupPath + "-wal.tmp");
+      await rename(backupPath + "-wal.tmp", backupPath + "-wal");
+    } catch {
+    }
+  }
+  const shmPath = dbPath + "-shm";
+  if (existsSync(shmPath)) {
+    try {
+      await copyFile(shmPath, backupPath + "-shm.tmp");
+      await rename(backupPath + "-shm.tmp", backupPath + "-shm");
+    } catch {
+    }
+  }
+  return backupPath;
+}
+function rotateBackups(keepDays = DEFAULT_KEEP_DAYS) {
+  if (!existsSync(BACKUP_DIR)) return 0;
+  const cutoff = Date.now() - keepDays * 24 * 60 * 60 * 1e3;
+  let deleted = 0;
+  try {
+    const files = readdirSync(BACKUP_DIR);
+    for (const file of files) {
+      if (file.endsWith(".tmp")) continue;
+      if (!file.endsWith(".db") && !file.endsWith(".db-wal") && !file.endsWith(".db-shm")) continue;
+      const filePath = path.join(BACKUP_DIR, file);
+      try {
+        const stat = statSync(filePath);
+        if (stat.mtimeMs < cutoff) {
+          unlinkSync(filePath);
+          deleted++;
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return deleted;
+}
+function selectBackupsToDelete(backups, keep) {
+  if (keep < 0) keep = 0;
+  const sorted = [...backups].sort((a, b) => b.mtimeMs - a.mtimeMs);
+  return sorted.slice(keep).map((b) => b.path);
+}
+function selectStaleTmpFiles(tmpFiles, cutoffMs) {
+  return tmpFiles.filter((f) => f.mtimeMs < cutoffMs).map((f) => f.path);
+}
+function cleanupStaleTmp(maxAgeMs = STALE_TMP_MAX_AGE_MS) {
+  if (!existsSync(BACKUP_DIR)) return 0;
+  const cutoffMs = Date.now() - maxAgeMs;
+  let deleted = 0;
+  try {
+    const candidates = [];
+    for (const file of readdirSync(BACKUP_DIR)) {
+      if (!file.endsWith(".tmp")) continue;
+      const filePath = path.join(BACKUP_DIR, file);
+      try {
+        candidates.push({ path: filePath, mtimeMs: statSync(filePath).mtimeMs });
+      } catch {
+      }
+    }
+    for (const target of selectStaleTmpFiles(candidates, cutoffMs)) {
+      try {
+        unlinkSync(target);
+        deleted++;
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return deleted;
+}
+function hasEnoughDiskSpace(freeBytes, backupSizeBytes, minFreeBytes = MIN_FREE_BYTES) {
+  const required = Math.max(minFreeBytes, backupSizeBytes * 2);
+  return freeBytes >= required;
+}
+function getFreeBytes(dir) {
+  try {
+    const s = statfsSync(dir);
+    return s.bavail * s.bsize;
+  } catch {
+    return Number.POSITIVE_INFINITY;
+  }
+}
+async function quickCheckBackupSource(source) {
+  try {
+    const { execFile: execFileCb } = await import("child_process");
+    const { promisify } = await import("util");
+    const execFileAsync = promisify(execFileCb);
+    const { stdout } = await execFileAsync("sqlite3", [source, "PRAGMA quick_check;"], { timeout: 3e4 });
+    const result = String(stdout ?? "").trim();
+    if (result !== "ok") {
+      throw new Error(result || "quick_check returned no result");
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (/file is not a database|not an error/i.test(msg)) {
+      process.stderr.write(`[db-backup] Backup source quick_check unavailable for encrypted backup (${path.basename(source)}); proceeding with atomic restore.
+`);
+      return;
+    }
+    throw new Error(`Backup source failed quick_check: ${msg}`);
+  }
+}
+function rotateBackupsByReason(reason, keep) {
+  if (!existsSync(BACKUP_DIR)) return 0;
+  let deleted = 0;
+  try {
+    const files = readdirSync(BACKUP_DIR);
+    const matches = [];
+    for (const file of files) {
+      if (file.endsWith(".tmp")) continue;
+      if (!file.endsWith(".db")) continue;
+      if (!file.includes(`-${reason}-`)) continue;
+      const filePath = path.join(BACKUP_DIR, file);
+      try {
+        matches.push({ path: filePath, mtimeMs: statSync(filePath).mtimeMs });
+      } catch {
+      }
+    }
+    for (const target of selectBackupsToDelete(matches, keep)) {
+      for (const p of [target, target + "-wal", target + "-shm"]) {
+        try {
+          if (existsSync(p)) {
+            unlinkSync(p);
+            if (p === target) deleted++;
+          }
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
+  return deleted;
+}
+function enforceRetention(reason, keepDays = DEFAULT_KEEP_DAYS) {
+  let deleted = rotateBackups(keepDays);
+  const cap = REASON_COUNT_CAP[reason];
+  if (typeof cap === "number") {
+    deleted += rotateBackupsByReason(reason, cap);
+  }
+  deleted += cleanupStaleTmp();
+  return deleted;
+}
+var QUARANTINE_KEEP = 2;
+function pruneCorruptQuarantine(keep = QUARANTINE_KEEP) {
+  if (!existsSync(EXE_AI_DIR)) return 0;
+  let deleted = 0;
+  try {
+    const matches = [];
+    for (const file of readdirSync(EXE_AI_DIR)) {
+      if (!/\.corrupt-\d+$/.test(file)) continue;
+      const filePath = path.join(EXE_AI_DIR, file);
+      try {
+        matches.push({ path: filePath, mtimeMs: statSync(filePath).mtimeMs });
+      } catch {
+      }
+    }
+    for (const target of selectBackupsToDelete(matches, keep)) {
+      for (const p of [target, target + "-wal", target + "-shm"]) {
+        try {
+          if (existsSync(p)) {
+            unlinkSync(p);
+            if (p === target) deleted++;
+          }
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
+  return deleted;
+}
+function cleanupCrashDebris() {
+  let deleted = 0;
+  deleted += rotateBackupsByReason("pre-restart", REASON_COUNT_CAP["pre-restart"] ?? 2);
+  deleted += cleanupStaleTmp();
+  deleted += pruneCorruptQuarantine();
+  return deleted;
+}
+function listBackups() {
+  if (!existsSync(BACKUP_DIR)) return [];
+  try {
+    const files = readdirSync(BACKUP_DIR).filter((f) => f.endsWith(".db") && !f.endsWith(".tmp") && !f.endsWith("-wal") && !f.endsWith("-shm"));
+    return files.map((name) => {
+      const p = path.join(BACKUP_DIR, name);
+      const stat = statSync(p);
+      return { path: p, name, size: stat.size, date: stat.mtime };
+    }).sort((a, b) => b.date.getTime() - a.date.getTime());
+  } catch {
+    return [];
+  }
+}
+function hasBackupToday(reason) {
+  const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const backups = listBackups();
+  return backups.some((b) => b.name.includes(reason) && b.name.includes(today.replace(/-/g, "-")));
+}
+function hasRecentBackup(reason, withinMs) {
+  try {
+    if (!existsSync(BACKUP_DIR)) return false;
+    const now = Date.now();
+    for (const file of readdirSync(BACKUP_DIR)) {
+      if (file.endsWith(".tmp")) continue;
+      if (!file.endsWith(".db")) continue;
+      if (!file.includes(`-${reason}-`)) continue;
+      try {
+        if (now - statSync(path.join(BACKUP_DIR, file)).mtimeMs <= withinMs) return true;
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return false;
+}
+function getLatestBackup() {
+  const backups = listBackups();
+  return backups.length > 0 ? backups[0].path : null;
+}
+async function restoreBackup(backupPath) {
+  const dbPath = findActiveDb();
+  if (!dbPath) {
+    const target = path.join(EXE_AI_DIR, DB_NAMES[0]);
+    const source2 = backupPath ?? getLatestBackup();
+    if (!source2 || !existsSync(source2)) return null;
+    await copyFile(source2, target);
+    return { restored: path.basename(source2), preRestoreBackup: null };
+  }
+  const source = backupPath ?? getLatestBackup();
+  if (!source || !existsSync(source)) return null;
+  if (path.resolve(source) === path.resolve(dbPath)) return null;
+  await quickCheckBackupSource(source);
+  const preRestoreBackup = await createBackup("pre-restore");
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const tmpDb = `${dbPath}.restore-${stamp}.tmp`;
+  const oldDb = `${dbPath}.pre-restore-active-${stamp}`;
+  await copyFile(source, tmpDb);
+  const walPath = source + "-wal";
+  const shmPath = source + "-shm";
+  const tmpWal = `${tmpDb}-wal`;
+  const tmpShm = `${tmpDb}-shm`;
+  if (existsSync(walPath)) {
+    try {
+      await copyFile(walPath, tmpWal);
+    } catch {
+    }
+  }
+  if (existsSync(shmPath)) {
+    try {
+      await copyFile(shmPath, tmpShm);
+    } catch {
+    }
+  }
+  try {
+    unlinkSync(dbPath + "-wal");
+  } catch {
+  }
+  try {
+    unlinkSync(dbPath + "-shm");
+  } catch {
+  }
+  await rename(dbPath, oldDb);
+  await rename(tmpDb, dbPath);
+  if (existsSync(tmpWal)) await rename(tmpWal, dbPath + "-wal");
+  if (existsSync(tmpShm)) await rename(tmpShm, dbPath + "-shm");
+  return { restored: path.basename(source), preRestoreBackup };
+}
+function getBackupDir() {
+  return BACKUP_DIR;
+}
+
+export {
+  findActiveDb,
+  createBackup,
+  createBackupAsync,
+  rotateBackups,
+  selectBackupsToDelete,
+  selectStaleTmpFiles,
+  cleanupStaleTmp,
+  hasEnoughDiskSpace,
+  rotateBackupsByReason,
+  enforceRetention,
+  pruneCorruptQuarantine,
+  cleanupCrashDebris,
+  listBackups,
+  hasBackupToday,
+  hasRecentBackup,
+  getLatestBackup,
+  restoreBackup,
+  getBackupDir
+};

package/dist/chunk-W77GRCNA.js

@@ -0,0 +1,85 @@
+import {
+  PLATFORM_PROCEDURES,
+  PLATFORM_PROCEDURE_TITLES
+} from "./chunk-VUH67PT4.js";
+import {
+  getClient
+} from "./chunk-V6LOEOXG.js";
+
+// src/lib/global-procedures.ts
+import { randomUUID } from "crypto";
+var _customerCache = "";
+var _cacheLoaded = false;
+var _platformCache = PLATFORM_PROCEDURES.map((p) => `### ${p.title}
+${p.content}`).join("\n\n");
+async function loadGlobalProcedures() {
+  const client = getClient();
+  const result = await client.execute({
+    sql: "SELECT * FROM company_procedures WHERE active = 1 ORDER BY priority ASC, created_at ASC",
+    args: []
+  });
+  const allRows = result.rows;
+  const customerOnly = allRows.filter((p) => {
+    if (PLATFORM_PROCEDURE_TITLES.has(p.title)) return false;
+    const title = (p.title ?? "").trim();
+    const content = (p.content ?? "").trim();
+    if (!title || title === "(untitled)") return false;
+    if (!content) return false;
+    return true;
+  });
+  const values = customerOnly.filter((p) => p.kind === "value");
+  const procedures = customerOnly.filter((p) => p.kind !== "value");
+  const parts = [];
+  if (values.length > 0) {
+    parts.push("### Company Values\n" + values.map((v) => `- **${v.title}:** ${v.content}`).join("\n"));
+  }
+  if (procedures.length > 0) {
+    parts.push(procedures.map((p) => `### ${p.title}
+${p.content}`).join("\n\n"));
+  }
+  _customerCache = parts.join("\n\n");
+  _cacheLoaded = true;
+  return customerOnly;
+}
+function getGlobalProceduresBlock() {
+  const sections = [];
+  if (_platformCache) sections.push(_platformCache);
+  if (_cacheLoaded && _customerCache) sections.push(_customerCache);
+  if (sections.length === 0) return "";
+  return `## Organization-Wide Procedures (MANDATORY \u2014 supersedes all other rules)
+
+${sections.join("\n\n")}
+`;
+}
+async function storeGlobalProcedure(input) {
+  if (!input.title?.trim() || !input.content?.trim()) {
+    throw new Error("storeGlobalProcedure requires a non-empty title and content");
+  }
+  const id = randomUUID();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const client = getClient();
+  await client.execute({
+    sql: `INSERT INTO company_procedures (id, title, content, priority, domain, kind, active, created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, 1, ?, ?)`,
+    args: [id, input.title, input.content, input.priority ?? "p0", input.domain ?? null, input.kind ?? "procedure", now, now]
+  });
+  await loadGlobalProcedures();
+  return id;
+}
+async function deactivateGlobalProcedure(id) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const client = getClient();
+  const result = await client.execute({
+    sql: "UPDATE company_procedures SET active = 0, updated_at = ? WHERE id = ?",
+    args: [now, id]
+  });
+  await loadGlobalProcedures();
+  return result.rowsAffected > 0;
+}
+
+export {
+  loadGlobalProcedures,
+  getGlobalProceduresBlock,
+  storeGlobalProcedure,
+  deactivateGlobalProcedure
+};

package/dist/chunk-WB2B25UM.js

@@ -0,0 +1,230 @@
+// src/bin/vps-health-gate.ts
+import { spawnSync } from "child_process";
+import { appendFileSync, existsSync, mkdirSync, readdirSync } from "fs";
+import http from "http";
+import path from "path";
+var DEPLOY_LOG = "/opt/exe-stack/deploy-log.jsonl";
+var BACKUP_DIR = "/opt/exe-stack/backups";
+async function checkCRM() {
+  const start = Date.now();
+  try {
+    const status = await httpGet("http://localhost:3000/api");
+    return {
+      check: "crm",
+      status: status >= 200 && status < 400 ? "pass" : "fail",
+      message: status >= 200 && status < 400 ? `CRM healthy (HTTP ${status})` : `CRM unhealthy (HTTP ${status})`,
+      durationMs: Date.now() - start
+    };
+  } catch (err) {
+    return {
+      check: "crm",
+      status: "fail",
+      message: `CRM unreachable: ${err instanceof Error ? err.message : err}`,
+      durationMs: Date.now() - start
+    };
+  }
+}
+async function checkGateway() {
+  const start = Date.now();
+  try {
+    const status = await httpGet("http://localhost:3100/health");
+    return {
+      check: "gateway",
+      status: status >= 200 && status < 300 ? "pass" : "fail",
+      message: status >= 200 && status < 300 ? `Gateway healthy (HTTP ${status})` : `Gateway unhealthy (HTTP ${status})`,
+      durationMs: Date.now() - start
+    };
+  } catch (err) {
+    return {
+      check: "gateway",
+      status: "fail",
+      message: `Gateway unreachable: ${err instanceof Error ? err.message : err}`,
+      durationMs: Date.now() - start
+    };
+  }
+}
+function checkPostgres() {
+  const start = Date.now();
+  const databaseUrl = process.env.DATABASE_URL || "postgres://exe@localhost:5432/exedb";
+  const result = spawnSync("psql", [databaseUrl, "-c", "SELECT 1"], {
+    encoding: "utf8",
+    stdio: ["pipe", "pipe", "pipe"],
+    timeout: 1e4
+  });
+  return {
+    check: "postgres",
+    status: result.status === 0 ? "pass" : "fail",
+    message: result.status === 0 ? "Postgres responding" : `Postgres failed: ${result.stderr?.trim() || `exit ${result.status}`}`,
+    durationMs: Date.now() - start
+  };
+}
+function checkRawEvents() {
+  const start = Date.now();
+  const databaseUrl = process.env.DATABASE_URL || "postgres://exe@localhost:5432/exedb";
+  const result = spawnSync(
+    "psql",
+    [databaseUrl, "-t", "-c", "SELECT count(*) FROM raw.raw_events"],
+    {
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 1e4
+    }
+  );
+  if (result.status !== 0) {
+    return {
+      check: "raw_events",
+      status: "fail",
+      message: `raw.raw_events query failed: ${result.stderr?.trim() || `exit ${result.status}`}`,
+      durationMs: Date.now() - start
+    };
+  }
+  const count = parseInt(result.stdout?.trim() || "0", 10);
+  return {
+    check: "raw_events",
+    status: count > 0 ? "pass" : "fail",
+    message: count > 0 ? `raw.raw_events has ${count} rows` : "raw.raw_events is empty",
+    durationMs: Date.now() - start
+  };
+}
+async function checkGoTrue() {
+  const start = Date.now();
+  try {
+    const status = await httpGet("http://localhost:9999/health");
+    return {
+      check: "gotrue",
+      status: status >= 200 && status < 300 ? "pass" : "fail",
+      message: status >= 200 && status < 300 ? `GoTrue healthy (HTTP ${status})` : `GoTrue unhealthy (HTTP ${status})`,
+      durationMs: Date.now() - start
+    };
+  } catch (err) {
+    return {
+      check: "gotrue",
+      status: "fail",
+      message: `GoTrue unreachable: ${err instanceof Error ? err.message : err}`,
+      durationMs: Date.now() - start
+    };
+  }
+}
+async function runHealthGate() {
+  console.log("[health-gate] Running post-deploy health checks...\n");
+  const results = [];
+  results.push(checkPostgres());
+  results.push(checkRawEvents());
+  results.push(await checkCRM());
+  results.push(await checkGateway());
+  results.push(await checkGoTrue());
+  const passed = results.every((r) => r.status === "pass");
+  for (const r of results) {
+    const icon = r.status === "pass" ? "\u2713" : "\u2717";
+    const color = r.status === "pass" ? "\x1B[32m" : "\x1B[31m";
+    console.log(`  ${color}${icon}\x1B[0m ${r.check.padEnd(12)} ${r.message} (${r.durationMs}ms)`);
+  }
+  console.log("");
+  const result = {
+    passed,
+    results,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  return result;
+}
+function logResult(result) {
+  mkdirSync(path.dirname(DEPLOY_LOG), { recursive: true });
+  const line = JSON.stringify({
+    ...result,
+    type: "health_gate"
+  }) + "\n";
+  try {
+    appendFileSync(DEPLOY_LOG, line);
+    console.log(`[health-gate] Result logged to ${DEPLOY_LOG}`);
+  } catch (err) {
+    console.warn(`[health-gate] Failed to write deploy log: ${err instanceof Error ? err.message : err}`);
+  }
+}
+function restorePreDeployBackup() {
+  if (!existsSync(BACKUP_DIR)) return false;
+  const backups = readdirSync(BACKUP_DIR).filter((f) => f.startsWith("pg-pre-deploy-") && f.endsWith(".dump")).sort().reverse();
+  if (backups.length === 0) {
+    console.warn("[health-gate] No pre-deploy backup found to restore");
+    return false;
+  }
+  const latest = backups[0];
+  const filepath = path.join(BACKUP_DIR, latest);
+  const databaseUrl = process.env.DATABASE_URL || "postgres://exe@localhost:5432/exedb";
+  console.log(`[health-gate] Restoring pre-deploy backup: ${latest}`);
+  const result = spawnSync("pg_restore", ["-d", databaseUrl, "--clean", "--if-exists", filepath], {
+    encoding: "utf8",
+    stdio: ["pipe", "pipe", "pipe"],
+    timeout: 3e5
+  });
+  if (result.status !== 0) {
+    console.error(`[health-gate] pg_restore failed: ${result.stderr?.trim() || `exit ${result.status}`}`);
+    return false;
+  }
+  console.log("[health-gate] \u2713 Pre-deploy backup restored");
+  return true;
+}
+function httpGet(url) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(url, { method: "GET", timeout: 1e4 }, (res) => {
+      res.resume();
+      resolve(res.statusCode ?? 0);
+    });
+    req.on("timeout", () => req.destroy(new Error("timeout")));
+    req.on("error", reject);
+    req.end();
+  });
+}
+async function main(args) {
+  if (args.includes("--help") || args.includes("-h")) {
+    console.log(`
+  exe-os vps-health-gate \u2014 Post-deploy health checks
+
+  Runs 5 checks: Postgres, raw_events, CRM, Gateway, GoTrue.
+  If any check fails, triggers rollback and exits with code 1.
+
+  Usage:
+    exe-os vps-health-gate              Run health gate
+    exe-os vps-health-gate --check-only Run checks without rollback on failure
+`);
+    return;
+  }
+  const checkOnly = args.includes("--check-only");
+  const result = await runHealthGate();
+  logResult(result);
+  if (result.passed) {
+    console.log("[health-gate] \u2713 All checks passed \u2014 deploy is healthy");
+    return;
+  }
+  const failed = result.results.filter((r) => r.status === "fail");
+  console.error(`[health-gate] \u2717 ${failed.length} check(s) failed`);
+  if (checkOnly) {
+    process.exitCode = 1;
+    return;
+  }
+  console.log("[health-gate] Starting rollback...");
+  restorePreDeployBackup();
+  try {
+    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-5VSGG36W.js");
+    const paths = defaultStackPaths();
+    await rollbackStackUpdate({
+      manifestRef: paths.manifestRef,
+      composeFile: paths.composeFile,
+      envFile: paths.envFile
+    });
+    console.log("[health-gate] \u2713 Stack rolled back to previous version");
+  } catch (err) {
+    console.error(`[health-gate] Stack rollback failed: ${err instanceof Error ? err.message : err}`);
+  }
+  process.exitCode = 1;
+}
+
+export {
+  checkCRM,
+  checkGateway,
+  checkPostgres,
+  checkRawEvents,
+  checkGoTrue,
+  runHealthGate,
+  logResult,
+  main
+};