@askexenow/exe-os 0.9.346 → 0.9.348

package/dist/{chunk-QS6KVXUN.js → chunk-6JQTSKDR.js}

@@ -1,6 +1,6 @@
 import {
   loadLicense
-} from "./chunk-BUDVHNV2.js";
+} from "./chunk-MMOONM6D.js";
 
 // src/lib/stack-update.ts
 import { execFileSync, spawnSync } from "child_process";
@@ -299,6 +299,8 @@ async function rollbackStackUpdate(options) {
   } catch {
   }
   const backupComposeFile = lockData?.backupComposeFile;
+  const backupComposeOverrideFile = lockData?.backupComposeOverrideFile;
+  const composeOverrideFile = composeOverrideFileFor(options.composeFile);
   if (!options.serviceName) {
     try {
       if (existsSync(options.composeFile)) {
@@ -307,27 +309,41 @@ async function rollbackStackUpdate(options) {
     } catch {
     }
     if (backupComposeFile && existsSync(backupComposeFile)) {
-      console.log(
-        `[stack-update] Keeping current (superset) docker-compose.yml for recovery so newly-added services are not dropped; rolling back image tags via .env. Previous compose preserved at ${backupComposeFile}.`
-      );
+      copyFileSync(backupComposeFile, options.composeFile);
+      console.log(`[stack-update] Restored docker-compose.yml from ${backupComposeFile}`);
     } else {
       console.log("[stack-update] No backed-up docker-compose.yml in lock \u2014 rolling back image tags via .env on the current compose.");
     }
+    try {
+      if (backupComposeOverrideFile && existsSync(backupComposeOverrideFile)) {
+        copyFileSync(backupComposeOverrideFile, composeOverrideFile);
+        console.log(`[stack-update] Restored docker-compose.override.yml from ${backupComposeOverrideFile}`);
+      } else if (lockData?.hadComposeOverrideFile === false && existsSync(composeOverrideFile)) {
+        rmSync(composeOverrideFile, { force: true });
+        console.log("[stack-update] Removed docker-compose.override.yml because it was absent from the pre-update snapshot.");
+      }
+    } catch (overrideErr) {
+      const reason = overrideErr instanceof Error ? overrideErr.message : String(overrideErr);
+      console.warn(`[stack-update] Could not restore docker-compose.override.yml (${reason}); continuing rollback.`);
+    }
   }
   const scopedServiceNames = options.serviceName ? Object.entries(lockData?.services ?? {}).filter(([name, service]) => name === options.serviceName || (service.composeService ?? name) === options.serviceName).map(([name]) => name) : [];
   const rollbackEnvRaw = readFileSync(rollbackEnv, "utf8");
   if (scopedServiceNames.length > 0 && lockData?.services) {
     const rollbackEnvMap = parseEnv(rollbackEnvRaw);
+    const scopedEnvKeys = scopedServiceNames.map((serviceName) => lockData.services[serviceName].env).filter((key) => Boolean(key));
+    const mutatedEnvKeys = lockData.mutatedEnvKeys ?? [];
+    const restoreEnvKeys = [.../* @__PURE__ */ new Set([...scopedEnvKeys, ...mutatedEnvKeys])];
     const scopedUpdates = Object.fromEntries(
-      scopedServiceNames.map((serviceName) => lockData.services[serviceName].env).filter((key) => Boolean(key)).map((key) => [key, rollbackEnvMap.get(key) ?? ""])
+      restoreEnvKeys.map((key) => [key, rollbackEnvMap.get(key) ?? ""])
     );
-    console.log(`[stack-update] Restoring env keys for service ${scopedServiceNames.join(", ")} from ${rollbackEnv}`);
+    console.log(`[stack-update] Restoring env keys for service ${scopedServiceNames.join(", ")} from ${rollbackEnv}: ${restoreEnvKeys.join(", ")}`);
     writeSecretFile(options.envFile, patchEnv(readFileSync(options.envFile, "utf8"), scopedUpdates));
   } else {
     console.log(`[stack-update] Restoring env from ${rollbackEnv}`);
     writeSecretFile(options.envFile, rollbackEnvRaw);
   }
-  const composeArgs = ["compose", "--file", options.composeFile, "--env-file", options.envFile];
+  const composeArgs = composeArgsForStack(options.composeFile, options.envFile);
   if (lockData?.services) {
     for (const [serviceName, service] of Object.entries(lockData.services)) {
       if (scopedServiceNames.length > 0 && !scopedServiceNames.includes(serviceName)) continue;
@@ -440,6 +456,22 @@ function manifestImagesForPull(release) {
     Object.values(release.services).map((service) => imagePullRef(service.image.trim())).filter(Boolean)
   ));
 }
+var COMPOSE_SIDECARS = {
+  // exe-crm-worker uses the same CRM_IMAGE_TAG as exe-crm but is a distinct
+  // compose service. Pull/restart it whenever the CRM API image changes so the
+  // API and worker cannot drift to different versions. (bug 9e324fd2)
+  "exe-crm": ["exe-crm-worker"],
+  "exe-erp": ["exe-erp-nginx", "exe-erp-websocket", "exe-erp-queue", "exe-erp-scheduler"]
+};
+function expandComposeServicesWithSidecars(primaryComposeServices) {
+  const expanded = [...primaryComposeServices];
+  for (const primary of primaryComposeServices) {
+    for (const sidecar of COMPOSE_SIDECARS[primary] ?? []) {
+      if (!expanded.includes(sidecar)) expanded.push(sidecar);
+    }
+  }
+  return expanded;
+}
 function cloneReleaseWithServices(release, serviceNames) {
   const wanted = new Set(serviceNames);
   const services = {};
@@ -463,6 +495,18 @@ function readStackUpdateLock(lockFile) {
 function writeStackUpdateLock(lockFile, data) {
   writeFileSync(lockFile, JSON.stringify(data, null, 2) + "\n");
 }
+function composeOverrideFileFor(composeFile) {
+  return path.join(path.dirname(composeFile), "docker-compose.override.yml");
+}
+function composeArgsForStack(composeFile, envFile, includeOverride = true) {
+  const args = ["compose", "--file", composeFile];
+  const overrideFile = composeOverrideFileFor(composeFile);
+  if (includeOverride && existsSync(overrideFile)) {
+    args.push("--file", overrideFile);
+  }
+  args.push("--env-file", envFile);
+  return args;
+}
 function buildInitialServiceStatus(plan, envRaw, now, activeServices) {
   const env = parseEnv(envRaw);
   const at = now().toISOString();
@@ -991,26 +1035,64 @@ function parseManualRegistryCredentials(raw, sampleImage) {
   if (!username || !password) return void 0;
   return { registry: registryFromImage(sampleImage ?? ""), username, password };
 }
+async function resolveStackImageCredentials(options, release) {
+  const images = release ? manifestImagesForPull(release) : [];
+  const sampleImage = images.find((image) => image.startsWith("update.askexe.com/")) ?? images.find((image) => image.startsWith("ghcr.io/")) ?? images[0] ?? "";
+  const fetched = await fetchImageCredentials(options);
+  if (fetched) return fetched;
+  const manual = parseManualRegistryCredentials(options.registryCredentials || process.env.EXE_REGISTRY_CREDENTIALS, sampleImage);
+  if (manual) return manual;
+  if (images.some((image) => image.startsWith("update.askexe.com/"))) {
+    const stackEnvPullTokensRaw = process.env.EXE_REGISTRY_PROXY_PULL_TOKENS || (options.envFile && existsSync(options.envFile) ? (() => {
+      const envMap = parseEnv(readFileSync(options.envFile, "utf8"));
+      return envMap.get("EXE_REGISTRY_PROXY_PULL_TOKENS") ?? "";
+    })() : "");
+    const firstPullToken = stackEnvPullTokensRaw.split(/[\n,]/).map((s) => s.trim()).find(Boolean);
+    if (firstPullToken) {
+      return { registry: "update.askexe.com", username: "token", password: firstPullToken };
+    }
+    const licenseKey = options.manifestAuthToken || options.licenseKey || process.env.EXE_LICENSE_KEY;
+    if (licenseKey) {
+      return { registry: "update.askexe.com", username: "license", password: licenseKey };
+    }
+  }
+  return null;
+}
 async function verifyManifestImagesAvailable(plan, options) {
   const exec = options.exec ?? defaultExec;
   const images = manifestImagesForPull(plan.release);
-  const sampleImage = images[0];
+  const maxAttempts = Math.max(1, Math.floor(options.verifyImageMaxAttempts ?? 3));
+  const baseDelayMs = Math.max(0, Math.floor(options.verifyImageRetryBaseDelayMs ?? 1e3));
   let registryForLogout;
-  const creds = await fetchImageCredentials(options) ?? parseManualRegistryCredentials(options.registryCredentials || process.env.EXE_REGISTRY_CREDENTIALS, sampleImage);
+  const creds = await resolveStackImageCredentials(options, plan.release);
   if (creds) {
     (options.dockerLogin ?? defaultDockerLogin)(creds);
     registryForLogout = creds.registry;
   }
   try {
-    return images.map((image) => {
-      try {
-        exec("docker", ["manifest", "inspect", image]);
-        return { image, ok: true };
-      } catch (err) {
-        const reason = err instanceof Error ? err.message : String(err);
-        return { image, ok: false, error: reason };
+    const results = [];
+    for (const image of images) {
+      let lastError = "";
+      let ok = false;
+      for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+        try {
+          exec("docker", ["manifest", "inspect", image]);
+          ok = true;
+          break;
+        } catch (err) {
+          lastError = err instanceof Error ? err.message : String(err);
+          if (attempt < maxAttempts) {
+            const delayMs = baseDelayMs * Math.pow(2, attempt - 1);
+            console.warn(
+              `[stack-update] manifest inspect failed for ${image} (attempt ${attempt}/${maxAttempts}): ${lastError}. Retrying in ${delayMs}ms.`
+            );
+            if (delayMs > 0) await new Promise((resolve) => setTimeout(resolve, delayMs));
+          }
+        }
       }
-    });
+      results.push(ok ? { image, ok: true } : { image, ok: false, error: `manifest inspect failed after ${maxAttempts} attempt(s): ${lastError}` });
+    }
+    return results;
   } finally {
     if (registryForLogout) {
       try {
@@ -1020,6 +1102,54 @@ async function verifyManifestImagesAvailable(plan, options) {
     }
   }
 }
+function servicesForPullImage(release, image) {
+  return Object.entries(release.services).filter(([, service]) => imagePullRef(service.image) === image).map(([serviceName, service]) => {
+    const composeService = service.composeService ?? serviceName;
+    return composeService === serviceName ? serviceName : `${serviceName} (${composeService})`;
+  });
+}
+function serviceListForPullImage(release, image) {
+  const services = servicesForPullImage(release, image);
+  return services.length > 0 ? services.join(", ") : "unknown service";
+}
+function allServiceList(release) {
+  return Object.keys(release.services).join(", ") || "unknown service";
+}
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function packagedComposeTemplatePath(options) {
+  return options.composeTemplateFileForUpdate ?? path.join(resolvePackageRoot(), "deploy", "compose", "docker-compose.yml");
+}
+function readStagedComposeTemplate(options, currentComposeRaw) {
+  const templatePath = packagedComposeTemplatePath(options);
+  if (!existsSync(templatePath)) {
+    return { raw: currentComposeRaw, templatePath, templateFound: false, shouldRefresh: false };
+  }
+  const raw = readFileSync(templatePath, "utf8");
+  return { raw, templatePath, templateFound: true, shouldRefresh: raw !== currentComposeRaw };
+}
+async function assertPreDeployImagesPullable(plan, options) {
+  let results;
+  try {
+    results = await verifyManifestImagesAvailable(plan, options);
+  } catch (err) {
+    throw new Error(
+      `Pre-deploy registry authentication check failed before any production service was changed. Aborting stack update for service(s) ${allServiceList(plan.release)}: ${errorMessage(err)}`
+    );
+  }
+  const failed = results.filter((r) => !r.ok);
+  if (failed.length === 0) return;
+  const details = failed.map((failure) => {
+    const services = serviceListForPullImage(plan.release, failure.image);
+    return `  - ${services}: ${failure.image}${failure.error ? ` \u2014 ${failure.error}` : ""}`;
+  }).join("\n");
+  throw new Error(
+    `Pre-deploy image pullability check failed \u2014 aborting before any production service was changed.
+${details}
+Fix registry authentication or publish the missing image(s), then re-run stack-update.`
+  );
+}
 function commandSucceeds(cmd, args = []) {
   const res = spawnSync(cmd, args, { stdio: "ignore" });
   return res.status === 0;
@@ -1179,6 +1309,18 @@ function backupStackConfig(stackDir, composeFile, envRaw, now = () => /* @__PURE
   } catch {
     backupComposeFile = void 0;
   }
+  const composeOverrideFile = composeOverrideFileFor(composeFile);
+  const hadComposeOverrideFile = existsSync(composeOverrideFile);
+  let backupComposeOverrideFile;
+  try {
+    if (hadComposeOverrideFile) {
+      backupComposeOverrideFile = path.join(updateBackupDir, "docker-compose.override.yml.bak");
+      copyFileSync(composeOverrideFile, backupComposeOverrideFile);
+      copyFileSync(composeOverrideFile, path.join(updateBackupDir, "docker-compose.override.yml"));
+    }
+  } catch {
+    backupComposeOverrideFile = void 0;
+  }
   for (const f of [...PROTECTED_CONFIG_FILES, ...BOOTSTRAP_OVERWRITTEN_CONFIG_FILES]) {
     const src = path.join(stackDir, f);
     try {
@@ -1212,7 +1354,7 @@ function backupStackConfig(stackDir, composeFile, envRaw, now = () => /* @__PURE
   } catch {
   }
   console.log(`[stack-update] Config backed up to ${updateBackupDir}`);
-  return { updateBackupDir, backupEnvFile, backupComposeFile };
+  return { updateBackupDir, backupEnvFile, backupComposeFile, backupComposeOverrideFile, hadComposeOverrideFile };
 }
 function installDockerUbuntu(exec) {
   if (process.platform !== "linux") throw new Error("Docker auto-install is only supported on Linux. Install Docker manually, then retry.");
@@ -1584,7 +1726,7 @@ function hardenSsh(exec, result) {
 }
 function areStackContainersRunning(composeFile, envFile) {
   try {
-    const result = spawnSync("docker", ["compose", "--file", composeFile, "--env-file", envFile, "ps", "-q"], {
+    const result = spawnSync("docker", [...composeArgsForStack(composeFile, envFile), "ps", "-q"], {
       stdio: ["pipe", "pipe", "pipe"],
       timeout: 15e3
     });
@@ -1795,6 +1937,7 @@ async function runStackUpdate(options) {
   const scopedServiceNames = options.serviceName ? [options.serviceName] : resumeServices;
   const effectiveTargetVersion = options.targetVersion ?? resumeLock?.stackVersion;
   const composeRaw = readFileSync(options.composeFile, "utf8");
+  const stagedCompose = readStagedComposeTemplate(options, composeRaw);
   const plan = createStackUpdatePlan(manifest, envRaw, effectiveTargetVersion, scopedServiceNames, serviceSelection, composeRaw);
   const fullTargetPlan = scopedServiceNames.length > 0 ? createStackUpdatePlan(manifest, envRaw, effectiveTargetVersion, void 0, serviceSelection, composeRaw) : plan;
   assertRolloutStageAllowed(plan, {
@@ -1803,7 +1946,20 @@ async function runStackUpdate(options) {
   });
   assertBreakingChangesAllowed(plan, options.allowedBreakingChangeIds ?? []);
   assertDeploymentScopeAllowed(plan, options.deploymentPersona ?? "customer");
-  const plannedEnvRaw = patchEnv(envRaw, Object.fromEntries(plan.changes.map((c) => [c.key, c.after])));
+  const requiredEnvValidation = options.dryRun ? { derived: {}, unresolvable: [] } : detectMissingRequiredEnvVars(stagedCompose.raw, envRaw);
+  const migratedEnvVars = requiredEnvValidation.derived;
+  if (requiredEnvValidation.unresolvable.length > 0) {
+    const lines = requiredEnvValidation.unresolvable.map((r) => `  - ${r.key}${r.message ? ` (${r.message})` : ""}`);
+    throw new Error(
+      `Stack update aborted before any changes: the updated compose template requires env vars that are missing from ${options.envFile} and cannot be derived automatically.
+Set these in ${options.envFile}, then re-run stack-update:
+${lines.join("\n")}`
+    );
+  }
+  const plannedEnvRaw = patchEnv(envRaw, {
+    ...migratedEnvVars,
+    ...Object.fromEntries(plan.changes.map((c) => [c.key, c.after]))
+  });
   assertProductionDeployGate(plan, plannedEnvRaw, composeRaw, {
     breakGlassReason: options.breakGlassReason,
     breakGlassAuditFile: options.breakGlassAuditFile,
@@ -1830,6 +1986,11 @@ async function runStackUpdate(options) {
   if (options.dryRun || !options.resume && plan.changes.length === 0 && containersRunning) {
     return { status: "planned", targetVersion: plan.targetVersion, changes: plan.changes, lockFile };
   }
+  if (!options.skipImageAvailabilityCheck) {
+    console.log("[stack-update] Pre-deploy image auth/pullability check started");
+    await assertPreDeployImagesPullable(plan, options);
+    console.log("[stack-update] \u2713 Pre-deploy image auth/pullability check passed");
+  }
   await postDeployAudit(options, "started", plan.targetVersion, previousVersion);
   try {
     if (!options.preDeployBackup) {
@@ -1843,13 +2004,13 @@ async function runStackUpdate(options) {
   const updateBackupDir = configBackup.updateBackupDir;
   const backupEnvFile = configBackup.backupEnvFile;
   const backupComposeFile = configBackup.backupComposeFile;
+  const backupComposeOverrideFile = configBackup.backupComposeOverrideFile;
+  const hadComposeOverrideFile = configBackup.hadComposeOverrideFile;
   try {
-    const templateCompose = path.join(resolvePackageRoot(), "deploy", "compose", "docker-compose.yml");
-    if (existsSync(templateCompose)) {
-      const templateRaw = readFileSync(templateCompose, "utf8");
-      if (templateRaw !== composeRaw) {
+    if (stagedCompose.templateFound) {
+      if (stagedCompose.shouldRefresh) {
         const tmpCompose = `${options.composeFile}.tmp-${process.pid}`;
-        writeFileSync(tmpCompose, templateRaw, { mode: 420 });
+        writeFileSync(tmpCompose, stagedCompose.raw, { mode: 420 });
         renameSync(tmpCompose, options.composeFile);
         console.log(
           `[stack-update] Refreshed docker-compose.yml from packaged template (old saved to ${path.join(updateBackupDir, "docker-compose.yml")}). Customer overrides should live in docker-compose.override.yml.`
@@ -1857,44 +2018,19 @@ async function runStackUpdate(options) {
       }
     } else {
       console.warn(
-        `[stack-update] Packaged compose template not found at ${templateCompose}; keeping existing docker-compose.yml. Shipped compose fixes will not apply.`
+        `[stack-update] Packaged compose template not found at ${stagedCompose.templatePath}; keeping existing docker-compose.yml. Shipped compose fixes will not apply.`
       );
     }
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
     console.warn(`[stack-update] Could not refresh docker-compose.yml (${reason}); using existing compose.`);
   }
-  let migratedEnvVars = {};
-  try {
-    const refreshedComposeRaw = readFileSync(options.composeFile, "utf8");
-    const { derived, unresolvable } = detectMissingRequiredEnvVars(refreshedComposeRaw, envRaw);
-    if (unresolvable.length > 0) {
-      const lines = unresolvable.map((r) => `  - ${r.key}${r.message ? ` (${r.message})` : ""}`);
-      throw new Error(
-        `Stack update aborted before any changes: the updated compose template requires env vars that are missing from ${options.envFile} and cannot be derived automatically.
-Set these in ${options.envFile}, then re-run stack-update:
-${lines.join("\n")}`
-      );
-    }
-    migratedEnvVars = derived;
-    if (Object.keys(derived).length > 0) {
-      console.log(
-        `[stack-update] Migrating ${Object.keys(derived).length} newly-required env var(s) into ${options.envFile} with derived defaults: ${Object.keys(derived).join(", ")}`
-      );
-    }
-  } catch (err) {
-    throw err instanceof Error ? err : new Error(String(err));
+  if (Object.keys(migratedEnvVars).length > 0) {
+    console.log(
+      `[stack-update] Migrating ${Object.keys(migratedEnvVars).length} newly-required env var(s) into ${options.envFile} with derived defaults: ${Object.keys(migratedEnvVars).join(", ")}`
+    );
   }
   const initialServiceStatus = options.resume && resumeLock?.serviceStatus ? resumeLock.serviceStatus : buildInitialServiceStatus(fullTargetPlan, envRaw, now, new Set(Object.keys(plan.release.services)));
-  writeStackUpdateLock(lockFile, {
-    stackVersion: plan.targetVersion,
-    previousVersion,
-    updatedAt: now().toISOString(),
-    backupEnvFile: resumeLock?.backupEnvFile ?? backupEnvFile,
-    backupComposeFile: resumeLock?.backupComposeFile ?? backupComposeFile,
-    services: { ...fullTargetPlan.release.services, ...resumeLock?.services ?? {}, ...plan.release.services },
-    serviceStatus: initialServiceStatus
-  });
   try {
     const { spawnSync: sp } = await import("child_process");
     const backupSh = path.join(stackDir, "backup.sh");
@@ -1939,6 +2075,19 @@ ${lines.join("\n")}`
     if (overrideResolution.warn) console.warn(overrideResolution.notice);
     else console.log(overrideResolution.notice);
   }
+  const mutatedEnvKeys = Object.keys(updates);
+  writeStackUpdateLock(lockFile, {
+    stackVersion: plan.targetVersion,
+    previousVersion,
+    updatedAt: now().toISOString(),
+    backupEnvFile: resumeLock?.backupEnvFile ?? backupEnvFile,
+    backupComposeFile: resumeLock?.backupComposeFile ?? backupComposeFile,
+    backupComposeOverrideFile: resumeLock?.backupComposeOverrideFile ?? backupComposeOverrideFile,
+    hadComposeOverrideFile: resumeLock?.hadComposeOverrideFile ?? hadComposeOverrideFile,
+    mutatedEnvKeys: [.../* @__PURE__ */ new Set([...resumeLock?.mutatedEnvKeys ?? [], ...mutatedEnvKeys])],
+    services: { ...fullTargetPlan.release.services, ...resumeLock?.services ?? {}, ...plan.release.services },
+    serviceStatus: initialServiceStatus
+  });
   const patched = patchEnv(envRaw, updates);
   const tmp = `${options.envFile}.tmp-${process.pid}`;
   writeSecretFile(tmp, patched);
@@ -1946,47 +2095,19 @@ ${lines.join("\n")}`
   for (const serviceName of Object.keys(plan.release.services)) {
     updateServiceStatus(lockFile, serviceName, "env_patched", now);
   }
-  const composeArgs = ["compose", "--file", options.composeFile, "--env-file", options.envFile];
+  const composeArgs = composeArgsForStack(options.composeFile, options.envFile);
   let registryForLogout;
   try {
     let credsLogged = false;
     const resolveRegistryCredentials = async () => {
-      let resolved = await fetchImageCredentials(options);
-      if (!resolved) {
-        const manual = options.registryCredentials || process.env.EXE_REGISTRY_CREDENTIALS;
-        if (manual) {
-          const [username, ...rest] = manual.split(":");
-          const password = rest.join(":");
-          if (username && password) {
-            const sampleImage = Object.values(plan.release.services)[0]?.image ?? "";
-            const registry = sampleImage.startsWith("update.askexe.com") ? "update.askexe.com" : "ghcr.io";
-            resolved = { registry, username, password };
-            if (!credsLogged) console.log(`[stack-update] Using manual registry credentials for ${registry}.`);
-          }
-        }
-      }
-      if (!resolved) {
-        const sampleImage = Object.values(plan.release.services)[0]?.image ?? "";
-        if (sampleImage.startsWith("update.askexe.com")) {
-          const stackEnvPullTokensRaw = process.env.EXE_REGISTRY_PROXY_PULL_TOKENS || (existsSync(options.envFile) ? (() => {
-            const envMap = parseEnv(readFileSync(options.envFile, "utf8"));
-            return envMap.get("EXE_REGISTRY_PROXY_PULL_TOKENS") ?? "";
-          })() : "");
-          const firstPullToken = stackEnvPullTokensRaw.split(/[\n,]/).map((s) => s.trim()).find(Boolean);
-          if (firstPullToken) {
-            resolved = { registry: "update.askexe.com", username: "token", password: firstPullToken };
-            if (!credsLogged) console.log("[stack-update] Using EXE_REGISTRY_PROXY_PULL_TOKENS for update.askexe.com registry auth.");
-          }
-        }
-      }
-      if (!resolved) {
-        const sampleImage = Object.values(plan.release.services)[0]?.image ?? "";
-        if (sampleImage.startsWith("update.askexe.com")) {
-          const licenseKey = options.manifestAuthToken || options.licenseKey || process.env.EXE_LICENSE_KEY;
-          if (licenseKey) {
-            resolved = { registry: "update.askexe.com", username: "license", password: licenseKey };
-            if (!credsLogged) console.log("[stack-update] Using license key for update.askexe.com registry auth.");
-          }
+      const resolved = await resolveStackImageCredentials(options, plan.release);
+      if (resolved && !credsLogged) {
+        if (options.registryCredentials || process.env.EXE_REGISTRY_CREDENTIALS) {
+          console.log(`[stack-update] Using manual registry credentials for ${resolved.registry}.`);
+        } else if (resolved.registry === "update.askexe.com" && resolved.username === "token") {
+          console.log("[stack-update] Using EXE_REGISTRY_PROXY_PULL_TOKENS for update.askexe.com registry auth.");
+        } else if (resolved.registry === "update.askexe.com" && resolved.username === "license") {
+          console.log("[stack-update] Using license key for update.askexe.com registry auth.");
         }
       }
       if (resolved) credsLogged = true;
@@ -1994,7 +2115,13 @@ ${lines.join("\n")}`
     };
     let creds = await resolveRegistryCredentials();
     if (creds) {
-      (options.dockerLogin ?? defaultDockerLogin)(creds);
+      try {
+        (options.dockerLogin ?? defaultDockerLogin)(creds);
+      } catch (err) {
+        throw new Error(
+          `Docker registry login failed for ${creds.registry}; aborting before image pull for service(s) ${allServiceList(plan.release)}: ${errorMessage(err)}`
+        );
+      }
       registryForLogout = creds.registry;
     }
     const runImageAvailabilityCheck = !options.skipImageAvailabilityCheck && !options.exec;
@@ -2029,10 +2156,19 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
           (options.dockerLogin ?? defaultDockerLogin)(fresh);
           creds = fresh;
           registryForLogout = fresh.registry;
-        } catch {
+        } catch (err) {
+          throw new Error(
+            `Docker registry re-login failed before pulling ${image} for service(s) ${serviceListForPullImage(plan.release, image)}; aborting before container swap: ${errorMessage(err)}`
+          );
         }
       }
-      exec("docker", ["pull", image]);
+      try {
+        exec("docker", ["pull", image]);
+      } catch (err) {
+        throw new Error(
+          `Image pull failed before container swap for service(s) ${serviceListForPullImage(plan.release, image)} using ${image}: ${errorMessage(err)}`
+        );
+      }
       for (const [serviceName, service] of Object.entries(plan.release.services)) {
         if (imagePullRef(service.image) === image) updateServiceStatus(lockFile, serviceName, "pulled", now);
       }
@@ -2045,14 +2181,25 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
         (options.dockerLogin ?? defaultDockerLogin)(fresh);
         creds = fresh;
         registryForLogout = fresh.registry;
-      } catch {
+      } catch (err) {
+        throw new Error(
+          `Docker registry re-login failed before docker compose pull for service(s) ${allServiceList(plan.release)}; aborting before container swap: ${errorMessage(err)}`
+        );
       }
     }
-    const composePullTargets = Object.entries(plan.release.services).map(([name, svc]) => svc.composeService ?? name);
-    if (composePullTargets.length > 0) {
-      exec("docker", [...composeArgs, "pull", ...composePullTargets]);
-    } else {
-      exec("docker", [...composeArgs, "pull"]);
+    const composePullTargets = expandComposeServicesWithSidecars(
+      Object.entries(plan.release.services).map(([name, svc]) => svc.composeService ?? name)
+    );
+    try {
+      if (composePullTargets.length > 0) {
+        exec("docker", [...composeArgs, "pull", ...composePullTargets]);
+      } else {
+        exec("docker", [...composeArgs, "pull"]);
+      }
+    } catch (err) {
+      throw new Error(
+        `Docker compose pull failed before container swap for service(s) ${allServiceList(plan.release)}: ${errorMessage(err)}`
+      );
     }
     endComposePull();
     progress.endPhase();
@@ -2154,16 +2301,8 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
       "cloudflared"
       // tunnel — restarted last so services are healthy before it connects
     ];
-    const COMPOSE_SIDECARS = {
-      "exe-erp": ["exe-erp-nginx", "exe-erp-websocket", "exe-erp-queue", "exe-erp-scheduler"]
-    };
     const primaryComposeServices = Object.entries(plan.release.services).map(([serviceName, service]) => service.composeService ?? serviceName);
-    const scopedComposeServices = [...primaryComposeServices];
-    for (const primary of primaryComposeServices) {
-      for (const sidecar of COMPOSE_SIDECARS[primary] ?? []) {
-        if (!scopedComposeServices.includes(sidecar)) scopedComposeServices.push(sidecar);
-      }
-    }
+    const scopedComposeServices = expandComposeServicesWithSidecars(primaryComposeServices);
     const restartOrder = [
       ...RESTART_ORDER.filter((service) => scopedComposeServices.includes(service)),
       ...scopedComposeServices.filter((service) => !RESTART_ORDER.includes(service))
@@ -2329,7 +2468,18 @@ Fix these before the stack is safe to operate.`);
     progress.logOverallSummary();
     printPhaseSummary();
     const finalLock = readStackUpdateLock(lockFile) ?? {};
-    writeStackUpdateLock(lockFile, { ...finalLock, stackVersion: plan.targetVersion, previousVersion, updatedAt: now().toISOString(), backupEnvFile: finalLock.backupEnvFile ?? backupEnvFile, services: { ...fullTargetPlan.release.services, ...finalLock.services ?? {}, ...plan.release.services } });
+    writeStackUpdateLock(lockFile, {
+      ...finalLock,
+      stackVersion: plan.targetVersion,
+      previousVersion,
+      updatedAt: now().toISOString(),
+      backupEnvFile: finalLock.backupEnvFile ?? backupEnvFile,
+      backupComposeFile: finalLock.backupComposeFile ?? backupComposeFile,
+      backupComposeOverrideFile: finalLock.backupComposeOverrideFile ?? backupComposeOverrideFile,
+      hadComposeOverrideFile: finalLock.hadComposeOverrideFile ?? hadComposeOverrideFile,
+      mutatedEnvKeys: finalLock.mutatedEnvKeys ?? mutatedEnvKeys,
+      services: { ...fullTargetPlan.release.services, ...finalLock.services ?? {}, ...plan.release.services }
+    });
     await postDeployAudit(options, "success", plan.targetVersion, previousVersion, void 0, { changes: plan.changes.length });
     return { status: "updated", targetVersion: plan.targetVersion, changes: plan.changes, backupEnvFile, lockFile, serviceStatus: readStackUpdateLock(lockFile)?.serviceStatus };
   } catch (err) {
@@ -2866,6 +3016,8 @@ export {
   buildReleaseMigrationArgs,
   runReleaseMigrations,
   isExecFormMigration,
+  expandComposeServicesWithSidecars,
+  composeArgsForStack,
   parseStackManifest,
   loadStackManifest,
   parseEnv,

package/dist/{chunk-QCM3YWL7.js → chunk-6QRS3IZF.js}

@@ -4,7 +4,7 @@ import {
 import {
   flushBatch,
   writeMemory
-} from "./chunk-GGHH54QD.js";
+} from "./chunk-H5QNVWU4.js";
 import {
   redactSecrets
 } from "./chunk-4QCFFW2H.js";

package/dist/{chunk-X2PLFBVG.js → chunk-6WFXNQDJ.js}

@@ -1,6 +1,6 @@
 import {
   listBehaviors
-} from "./chunk-4JDRUXQV.js";
+} from "./chunk-MGMXYI7Y.js";
 import {
   loadConfigSync
 } from "./chunk-BCZF3AGJ.js";

package/dist/{chunk-LUQ57SRM.js → chunk-7QRMFYOV.js}

@@ -1,3 +1,7 @@
+import {
+  isPostgresBackendEnabled
+} from "./chunk-YMUZWC33.js";
+
 // src/lib/db-write-worker-client.ts
 import { fork } from "child_process";
 import { existsSync } from "fs";
@@ -10,6 +14,18 @@ var _spawnAttempts = 0;
 var MAX_SPAWN_ATTEMPTS = 5;
 var WRITE_TIMEOUT_MS = 6e4;
 var _pending = /* @__PURE__ */ new Map();
+function buildDbWriteWorkerEnv(dbPath, encryptionKey, source = process.env) {
+  const env = {
+    ...source,
+    EXE_IS_DAEMON: "",
+    EXE_DB_DIRECT: "1",
+    EXE_BOOT_FAST: "1",
+    EXE_DB_NO_CHECKPOINT_TIMER: "1"
+  };
+  if (dbPath) env.EXE_DB_WRITE_WORKER_PATH = dbPath;
+  if (encryptionKey) env.EXE_DB_WRITE_WORKER_KEY = encryptionKey;
+  return env;
+}
 function rejectAllPending(reason) {
   for (const [id, cb] of _pending) {
     clearTimeout(cb.timer);
@@ -31,15 +47,12 @@ function spawnDbWriteWorker(dbPath, encryptionKey) {
 `);
     return;
   }
-  const env = {
-    ...process.env,
-    EXE_DB_WRITE_WORKER_PATH: dbPath,
-    EXE_IS_DAEMON: "",
-    EXE_DB_DIRECT: "1",
-    EXE_BOOT_FAST: "1",
-    EXE_DB_NO_CHECKPOINT_TIMER: "1"
-  };
-  if (encryptionKey) env.EXE_DB_WRITE_WORKER_KEY = encryptionKey;
+  const env = buildDbWriteWorkerEnv(dbPath, encryptionKey);
+  if (!isPostgresBackendEnabled(env) && !env.EXE_DB_WRITE_WORKER_PATH) {
+    process.stderr.write("[db-write-worker-client] no SQLite db path for write worker - memory writes will run on the event loop.\n");
+    _spawnAttempts = Math.max(0, _spawnAttempts - 1);
+    return;
+  }
   try {
     _worker = fork(workerPath, [], { stdio: ["ignore", "ignore", "inherit", "ipc"], env });
   } catch (err) {
@@ -118,6 +131,7 @@ function disposeDbWriteWorker() {
 }
 
 export {
+  buildDbWriteWorkerEnv,
   isWriteWorkerEnabled,
   spawnDbWriteWorker,
   isDbWriteWorkerReady,