@askexenow/exe-os 0.9.410 → 0.9.412

package/dist/{chunk-LZS2B2JT.js → chunk-RIKFXHLE.js}

@@ -19,10 +19,10 @@ import {
 } from "./chunk-RT57D7C4.js";
 import {
   loadLicense
-} from "./chunk-KNEEOZWN.js";
+} from "./chunk-EOWJXCYC.js";
 
 // src/lib/stack-update.ts
-import { execFileSync, spawnSync as spawnSync2 } from "child_process";
+import { execFileSync as execFileSync2, spawnSync as spawnSync2 } from "child_process";
 import { createHash, createVerify, randomBytes, verify as verifySignature } from "crypto";
 import { chmodSync, closeSync, copyFileSync, existsSync, lstatSync, mkdirSync, openSync, realpathSync, readdirSync, readFileSync, renameSync, rmSync, statSync, unlinkSync, utimesSync, writeFileSync } from "fs";
 import http from "http";
@@ -32,6 +32,183 @@ import path from "path";
 import { fileURLToPath } from "url";
 import { parseDocument as parseYamlDocument } from "yaml";
 
+// src/lib/stack-worker-migration.ts
+import { isScalar, parseDocument } from "yaml";
+var LEGACY_IMAGE = "${EXE_OS_WORKER_IMAGE_TAG:-ghcr.io/askexe/exe-os-worker:v0.9.311}";
+var DISABLED_IMAGE = "${EXE_OS_WORKER_IMAGE_TAG:-}";
+var WORKER = "exe-os-worker";
+function planLegacyWorkerMigration(input) {
+  const unchanged = { raw: input.composeRaw, changed: false };
+  if (!input.composeRaw.includes(LEGACY_IMAGE)) return unchanged;
+  const doc = parseDocument(input.composeRaw, { uniqueKeys: true });
+  if (doc.errors.length) throw new Error("Cannot inspect legacy worker migration: invalid Compose YAML");
+  const image = doc.getIn(["services", WORKER, "image"], true);
+  if (!isScalar(image) || image.value !== LEGACY_IMAGE) return unchanged;
+  const refuse = (reason) => {
+    throw new Error(`Cannot migrate the legacy embeddings worker: ${reason}. Keep the signed-manifest and digest checks enabled.`);
+  };
+  const worker = doc.getIn(["services", WORKER]);
+  const definition = worker.toJSON();
+  if (definition.extends || !Array.isArray(definition.profiles) || definition.profiles.length !== 1 || definition.profiles[0] !== "embeddings") {
+    refuse("the worker is not the shipped embeddings-only service");
+  }
+  const processEnv = input.processEnv ?? process.env;
+  const unquote = (value) => value.trim().replace(/\s+#.*$/, "").replace(/^(["'])(.*)\1$/, "$2").trim();
+  for (const value of [input.env.get("COMPOSE_PROFILES") ?? "", processEnv.COMPOSE_PROFILES ?? ""]) {
+    const profiles = unquote(value).split(",").map((profile) => profile.trim()).filter(Boolean);
+    if (profiles.some((profile) => !/^(?:[a-zA-Z0-9][a-zA-Z0-9_.-]*|\*)$/.test(profile))) {
+      refuse("enabled profiles could not be determined");
+    }
+    if (profiles.includes("embeddings") || profiles.includes("*")) refuse("embeddings are enabled");
+  }
+  if ([input.env.get("EXE_OS_WORKER_IMAGE_TAG") ?? "", processEnv.EXE_OS_WORKER_IMAGE_TAG ?? ""].some((value) => unquote(value))) {
+    refuse("an explicit worker image is configured; it must be covered by a signed release");
+  }
+  if (input.hostServicesUnavailable) refuse("the host's running services could not be observed");
+  if (input.hostServices.includes(WORKER)) refuse("the worker exists on the host");
+  if (input.overrideRaw) {
+    const override = parseDocument(input.overrideRaw, { uniqueKeys: true });
+    if (override.errors.length) refuse("the customer override could not be inspected");
+    if (override.hasIn(["services", WORKER])) refuse("the customer override defines the worker");
+  }
+  const targetComposeRaw = typeof input.targetComposeRaw === "function" ? input.targetComposeRaw() : input.targetComposeRaw;
+  if (!targetComposeRaw) refuse("the packaged replacement template is missing");
+  const target = parseDocument(targetComposeRaw, { uniqueKeys: true });
+  if (target.errors.length || target.getIn(["services", WORKER, "image"]) !== DISABLED_IMAGE) {
+    refuse("the packaged replacement does not contain the current disabled worker slot");
+  }
+  if (!image.range) refuse("the legacy image location is unavailable");
+  return {
+    raw: input.composeRaw.slice(0, image.range[0]) + JSON.stringify(DISABLED_IMAGE) + input.composeRaw.slice(image.range[1]),
+    changed: true
+  };
+}
+
+// src/lib/monitor-rollback.ts
+import { execFileSync } from "child_process";
+var LEGACY_HUB_DIGEST = "sha256:1af31893cc8b1e51892be7d7705fa6c6b3108af8366b1fa8da2879d8ae21ec88";
+var runDocker = (args) => execFileSync("docker", args, {
+  encoding: "utf8",
+  timeout: 12e4,
+  maxBuffer: 1024 * 1024
+});
+function restoreLegacyMonitorOwnership(composeArgs, run = runDocker) {
+  const configured = JSON.parse(
+    run([...composeArgs, "config", "--format", "json"])
+  ).services?.["exe-monitor-hub"];
+  if (!configured || typeof configured.image !== "string" || !configured.image.trim())
+    return false;
+  if (configured.user != null && String(configured.user).trim() && !["65532", "65532:65532"].includes(String(configured.user)))
+    return false;
+  const ids = run([...composeArgs, "ps", "--all", "--quiet", "exe-monitor-hub"]).trim().split(/\s+/).filter(Boolean);
+  if (ids.length === 0) return false;
+  if (ids.length !== 1 || !/^[a-f0-9]{12,64}$/.test(ids[0])) {
+    throw new Error("Cannot attribute the installed monitor container safely");
+  }
+  const image = JSON.parse(run(["image", "inspect", configured.image]))[0];
+  if (!image?.RepoDigests?.some(
+    (ref) => ref.endsWith("@" + LEGACY_HUB_DIGEST)
+  ))
+    return false;
+  if (image.Config?.User !== "65532:65532")
+    throw new Error(
+      "Legacy monitor runtime identity differs from its verified artifact"
+    );
+  const hub = JSON.parse(run(["inspect", ids[0]]))[0];
+  if (typeof hub?.Id !== "string" || !hub.Id.startsWith(ids[0]))
+    throw new Error("Monitor observation changed before recovery");
+  const project = hub?.Config?.Labels?.["com.docker.compose.project"];
+  const mount = hub?.Mounts?.find(
+    (m) => m.Destination === "/app/exe-monitor_data"
+  );
+  if (!project || hub.Config.Labels["com.docker.compose.service"] !== "exe-monitor-hub" || mount?.Type !== "volume" || typeof mount.Name !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(mount.Name)) {
+    throw new Error(
+      "Legacy monitor recovery requires its managed named data volume"
+    );
+  }
+  const volume = JSON.parse(run(["volume", "inspect", mount.Name]))[0];
+  if (volume?.Name !== mount.Name || volume.Labels?.["com.docker.compose.project"] !== project || volume.Labels["com.docker.compose.volume"] !== "monitor_hub_data") {
+    throw new Error(
+      "Legacy monitor data-volume ownership is not attributable to this stack"
+    );
+  }
+  const db = JSON.parse(run(["inspect", "exe-db"]))[0];
+  if (db?.Config?.Labels?.["com.docker.compose.project"] !== project || db.Config.Labels["com.docker.compose.service"] !== "exe-db" || !/^sha256:[a-f0-9]{64}$/.test(db.Image)) {
+    throw new Error(
+      "Legacy monitor recovery requires this stack's immutable database helper image"
+    );
+  }
+  let helper = JSON.parse(run(["image", "inspect", db.Image]))[0];
+  let helperId = db.Image;
+  if (!helper?.Os || !helper?.Architecture) {
+    const descriptor = db.ImageManifestDescriptor;
+    const platform = descriptor?.platform;
+    if (!/^sha256:[a-f0-9]{64}$/.test(descriptor?.digest ?? "") || platform?.os !== "linux" || !["amd64", "arm64"].includes(platform.architecture))
+      throw new Error("Cannot resolve native recovery helper platform");
+    helper = JSON.parse(
+      run([
+        "image",
+        "inspect",
+        "--platform",
+        `linux/${platform.architecture}`,
+        db.Image
+      ])
+    )[0];
+    helperId = descriptor.digest;
+    if (helper?.Architecture !== platform.architecture)
+      throw new Error("Recovery helper differs from the running DB platform");
+  }
+  if (helper?.Id !== helperId || helper.Os !== "linux" || !["amd64", "arm64"].includes(helper.Architecture)) {
+    throw new Error("Legacy monitor recovery helper metadata is inconsistent");
+  }
+  const base = [
+    "run",
+    "--rm",
+    "--network",
+    "none",
+    "--read-only",
+    "--user",
+    "0:0",
+    "--platform",
+    `linux/${helper.Architecture}`,
+    "--label",
+    `com.askexe.monitor-recovery=${project}`
+  ];
+  const owner = run([
+    ...base,
+    "--entrypoint",
+    "stat",
+    "--mount",
+    `type=volume,src=${mount.Name},dst=/recovery,readonly`,
+    db.Image,
+    "-c",
+    "%u:%g",
+    "/recovery"
+  ]).trim();
+  if (owner === "65532:65532") return false;
+  if (!/^\d+:\d+$/.test(owner))
+    throw new Error("Cannot observe legacy monitor data ownership safely");
+  run([...composeArgs, "stop", "--timeout", "10", "exe-monitor-hub"]);
+  run([
+    ...base,
+    "--cap-drop",
+    "ALL",
+    "--cap-add",
+    "CHOWN",
+    "--cap-add",
+    "DAC_OVERRIDE",
+    "--entrypoint",
+    "chown",
+    "--mount",
+    `type=volume,src=${mount.Name},dst=/recovery`,
+    db.Image,
+    "-Rh",
+    "65532:65532",
+    "/recovery"
+  ]);
+  return true;
+}
+
 // src/lib/askexe-image-prefixes.ts
 var ASKEXE_IMAGE_PREFIXES = ["ghcr.io/askexe/", "update.askexe.com/askexe/"];
 function isAskExeHostedImageRef(trimmedImage) {
@@ -1292,6 +1469,11 @@ async function rollbackStackUpdate(options) {
   if (options.retainCompose && !(scopedServiceNames.length === 1 && lockData?.services)) {
     throw new Error("--retain-compose rollback refused an unscoped restart; restore the selected service from backup manually");
   }
+  if (!options.exec && (scopedServiceNames.length === 0 || scopedServiceNames.includes("monitorHub"))) {
+    if (restoreLegacyMonitorOwnership(composeArgs)) {
+      console.log("[stack-update] Restored legacy monitor data ownership before rollback restart");
+    }
+  }
   if (scopedServiceNames.length > 0 && lockData?.services) {
     const scopedComposeServices = scopedComposeImageServices(
       scopedServiceNames.map((serviceName) => lockData.services[serviceName]?.composeService ?? serviceName),
@@ -1936,6 +2118,7 @@ var MONITOR_IMAGE_TAG_ENV = {
   monitorHub: "MONITOR_HUB_IMAGE_TAG",
   monitorAgent: "MONITOR_AGENT_IMAGE_TAG"
 };
+var OBSERVED_ROOT_AGENT_DIGEST = "sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a";
 var STOCK_BESZEL_MONITOR_VERSIONS = /* @__PURE__ */ new Set(["0.9.5"]);
 function monitorImageVersion(imageRef) {
   const noDigest = imageRef.split("@")[0] ?? imageRef;
@@ -1950,6 +2133,7 @@ function isStockBeszelMonitorImage(imageRef) {
   return version !== void 0 && STOCK_BESZEL_MONITOR_VERSIONS.has(version);
 }
 function monitorHealthBinForImage(serviceKey, imageRef) {
+  if (serviceKey === "monitorAgent" && imageRef.endsWith(`@${OBSERVED_ROOT_AGENT_DIGEST}`)) return "/agent";
   const stock = isStockBeszelMonitorImage(imageRef);
   if (serviceKey === "monitorHub") return stock ? "/beszel" : "/app/beszel";
   return stock ? "/agent" : "/app/beszel-agent";
@@ -2202,14 +2386,17 @@ function collectImageAvailabilityIssues(plan) {
       try {
         const result = spawnSync2("docker", ["manifest", "inspect", manifestInspectRef(image), "--verbose"], {
           stdio: ["ignore", "pipe", "pipe"],
-          timeout: 3e4
+          // Multi-platform official images can require dozens of child-manifest
+          // requests through the proxy. A valid Redis index took 68s in the
+          // legacy-upgrade rehearsal; 30s misreported it as an absent image.
+          timeout: 12e4
         });
         if (result.status === 0) {
           inspected = true;
           inspectOutput = result.stdout?.toString() ?? "";
           break;
         }
-        lastStderr = result.stderr?.toString().trim() ?? "";
+        lastStderr = result.error?.message || result.stderr?.toString().trim() || "manifest inspection failed";
         if (attempt < maxAttempts) {
           const delayMs = baseDelayMs * Math.pow(2, attempt - 1);
           console.log(
@@ -2232,13 +2419,14 @@ function collectImageAvailabilityIssues(plan) {
     try {
       const parsed = JSON.parse(inspectOutput);
       const manifests = Array.isArray(parsed) ? parsed : [parsed];
+      const platformOf = (m) => m.platform ?? m.Descriptor?.platform;
       const hasAmd64 = manifests.some((m) => {
-        const platform = m.platform;
+        const platform = platformOf(m);
         return platform?.architecture === "amd64" && platform?.os === "linux";
       });
-      if (!hasAmd64 && manifests.length > 0 && manifests[0]?.platform) {
+      if (!hasAmd64 && manifests.some((m) => platformOf(m))) {
         const platforms = manifests.map((m) => {
-          const p = m.platform;
+          const p = platformOf(m);
           return `${p?.os ?? "?"}/${p?.architecture ?? "?"}`;
         }).join(", ");
         issues.push({
@@ -3904,6 +4092,9 @@ async function runStackUpdate(options) {
   return withStackUpdateOperationLock(options.envFile, () => runStackUpdateUnlocked(options));
 }
 async function runStackUpdateUnlocked(options) {
+  if (options.rollback && (options.dryRun || options.verifyImages)) {
+    throw new Error("Rollback cannot be combined with a read-only preview; no rollback was performed.");
+  }
   const exec = options.exec ?? defaultExec;
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   const phaseDurations = [];
@@ -3925,17 +4116,17 @@ async function runStackUpdateUnlocked(options) {
   };
   if (options.rollback) return rollbackStackUpdate(options);
   let preBootstrapBackup;
-  if (!options.dryRun && existsSync(options.envFile)) {
+  if (!options.dryRun && !options.verifyImages && existsSync(options.envFile)) {
     const preBootstrapEnvRaw = readFileSync(options.envFile, "utf8");
     preBootstrapBackup = backupStackConfig(path.dirname(options.envFile), options.composeFile, preBootstrapEnvRaw, now);
   }
-  if (options.bootstrap !== false) {
+  if (options.bootstrap !== false && !options.dryRun && !options.verifyImages) {
     const report = bootstrapStackHost({ ...options, installDocker: options.installDocker ?? !!options.yes });
     if (!options.dryRun) assertHostReadyForApply(report);
   }
   assertBindMountsExist(path.dirname(options.envFile));
   warnLegacyDaemonVolume(options.volumeExists);
-  if (!options.dryRun) {
+  if (!options.dryRun && !options.verifyImages) {
     try {
       const endPhase = startPhase("preflight");
       if (!options.preflight) {
@@ -3962,7 +4153,7 @@ async function runStackUpdateUnlocked(options) {
   const hubUrl = options.monitorHubUrl || parseEnv(readFileSync(options.envFile, "utf8")).get("MONITOR_HUB_URL") || "";
   const pairLicense = options.licenseKey || process.env.EXE_LICENSE_KEY || loadLicense() || "";
   const pairDomain = options.domain || process.env.EXE_STACK_DOMAIN || process.env.CUSTOMER_DOMAIN || "";
-  if (!options.retainCompose && hubUrl && pairLicense && pairDomain) {
+  if (!options.dryRun && !options.verifyImages && !options.retainCompose && hubUrl && pairLicense && pairDomain) {
     const envBefore = readFileSync(options.envFile, "utf8");
     const parsedEnvBefore = parseEnv(envBefore);
     const monitorToken = parsedEnvBefore.get("MONITOR_AGENT_TOKEN") ?? "";
@@ -3990,6 +4181,7 @@ async function runStackUpdateUnlocked(options) {
   );
   reportStackManifestSource(manifestLoad);
   const manifest = manifestLoad.manifest;
+  let previewServiceSelection;
   if (options.addService || options.removeService) {
     const effectiveVersion = options.targetVersion ?? manifest.latest;
     const manifestRelease = manifest.stacks[effectiveVersion];
@@ -4013,11 +4205,16 @@ async function runStackUpdateUnlocked(options) {
       currentServices.delete(options.removeService);
       console.log(`[stack-update] Removed service: ${options.removeService}`);
     }
-    saveServiceSelection(options.envFile, [...currentServices]);
-    console.log(`[stack-update] Saved service selection: ${[...currentServices].join(", ")}`);
+    if (options.dryRun || options.verifyImages) {
+      previewServiceSelection = runScopedServiceSelection([...currentServices], now);
+      console.log(`[stack-update] Planned service selection (not saved): ${[...currentServices].join(", ")}`);
+    } else {
+      saveServiceSelection(options.envFile, [...currentServices]);
+      console.log(`[stack-update] Saved service selection: ${[...currentServices].join(", ")}`);
+    }
   }
   const isRunScoped = Boolean(options.services && options.services.length > 0);
-  const serviceSelection = isRunScoped ? runScopedServiceSelection(options.services, now) : loadServiceSelection(options.envFile);
+  const serviceSelection = isRunScoped ? runScopedServiceSelection(options.services, now) : previewServiceSelection ?? loadServiceSelection(options.envFile);
   if (isRunScoped) {
     console.log(
       `[stack-update] Service scope for THIS RUN ONLY: ${options.services.join(", ")} (the managed set in ${serviceSelectionPath(options.envFile)} is unchanged)`
@@ -4094,7 +4291,22 @@ ${lines.join("\n")}`
       `[stack-update] Synced monitor healthcheck bin path(s) into the deploy environment: ${[...processHealthBins.pinned, ...processHealthBins.cleared].join(", ")}`
     );
   }
-  assertProductionDeployGate(plan, plannedEnvRaw, composeRaw, {
+  const hostState = listHostComposeServices(
+    composeArgsForStack(options.composeFile, options.envFile),
+    options.composePsCapture ?? defaultComposePsCapture
+  );
+  const overrideFile = composeOverrideFileFor(options.composeFile);
+  const workerMigration = options.retainCompose ? { raw: composeRaw, changed: false } : planLegacyWorkerMigration({
+    composeRaw,
+    targetComposeRaw: stagedCompose.templateFound ? stagedCompose.raw : null,
+    env: parseEnv(plannedEnvRaw),
+    hostServices: hostState.services,
+    hostServicesUnavailable: hostState.unavailable,
+    overrideRaw: existsSync(overrideFile) ? readFileSync(overrideFile, "utf8") : null
+  });
+  const composeRawForGate = workerMigration.raw;
+  if (workerMigration.changed) console.log("[stack-update] Planned configuration migration: clear the unused legacy embeddings-worker image default.");
+  assertProductionDeployGate(plan, plannedEnvRaw, composeRawForGate, {
     breakGlassReason: options.breakGlassReason,
     breakGlassAuditFile: options.breakGlassAuditFile,
     strictDigest: options.strictDigest,
@@ -4139,14 +4351,10 @@ ${lines.join("\n")}`
         );
       }
     }
-    const hostState = listHostComposeServices(
-      composeArgsForStack(options.composeFile, options.envFile),
-      options.composePsCapture ?? defaultComposePsCapture
-    );
     assertSignedManifestDeliveryGate({
       release: manifest.stacks[plan.targetVersion],
       targetVersion: plan.targetVersion,
-      composeRaw,
+      composeRaw: composeRawForGate,
       envRaw: plannedEnvRaw,
       hostServices: hostState.services,
       hostServicesUnavailable: hostState.unavailable,
@@ -4263,7 +4471,9 @@ ${lines.join("\n")}`
     }
   };
   const containersRunning = plan.changes.length === 0 ? (options.stackContainersRunning ?? areStackContainersRunning)(options.composeFile, options.envFile) : true;
-  if (options.dryRun || !options.resume && plan.changes.length === 0 && containersRunning) {
+  const managedTargetPlan = isRunScoped ? createStackUpdatePlan(manifest, envRaw, effectiveTargetVersion, void 0, loadServiceSelection(options.envFile), composeRaw) : fullTargetPlan;
+  const versionOnlyUpgrade = Boolean(options.targetVersion && previousVersion && previousVersion !== plan.targetVersion && managedTargetPlan.changes.length === 0);
+  if (options.dryRun || !options.resume && plan.changes.length === 0 && containersRunning && !versionOnlyUpgrade && !workerMigration.changed) {
     const ssoOutcome = skipSsoEdgeReconcileForRetainScope ? { attempted: false, delivered: true } : await reconcileSsoEdge({ apply: !options.dryRun });
     if (!options.dryRun && !ssoOutcome.delivered) {
       throw new Error(
@@ -4341,6 +4551,7 @@ ${lines.join("\n")}`
     }
   } catch (err) {
     if (options.retainCompose) throw err;
+    if (workerMigration.changed) throw new Error(`Could not install the validated legacy worker migration: ${err instanceof Error ? err.message : String(err)}`);
     const reason = err instanceof Error ? err.message : String(err);
     console.warn(`[stack-update] Could not refresh docker-compose.yml (${reason}); using existing compose.`);
   }
@@ -5292,25 +5503,28 @@ function listHostComposeServices(composeArgs, capture = defaultComposePsCapture)
   if (trimmed.startsWith("[")) {
     try {
       const parsed = JSON.parse(trimmed);
-      if (Array.isArray(parsed)) records.push(...parsed);
+      if (!Array.isArray(parsed)) return { services: [], unavailable: true };
+      records.push(...parsed);
     } catch {
+      return { services: [], unavailable: true };
     }
-  }
-  if (records.length === 0) {
+  } else {
     for (const line of trimmed.split("\n")) {
       const l = line.trim();
       if (!l) continue;
       try {
         records.push(JSON.parse(l));
       } catch {
+        return { services: [], unavailable: true };
       }
     }
   }
-  if (records.length === 0) return { services: [], unavailable: true };
   const services = /* @__PURE__ */ new Set();
   for (const obj of records) {
-    const service = String(obj.Service ?? "").trim();
-    if (service) services.add(service);
+    if (!obj || typeof obj !== "object" || Array.isArray(obj) || typeof obj.Service !== "string" || !obj.Service.trim()) {
+      return { services: [], unavailable: true };
+    }
+    services.add(obj.Service.trim());
   }
   return { services: [...services], unavailable: false };
 }
@@ -5663,16 +5877,16 @@ function httpStatus(urlString, hostHeader) {
   });
 }
 function defaultExec(cmd, args, opts) {
-  execFileSync(cmd, args, { stdio: "inherit", cwd: opts?.cwd });
+  execFileSync2(cmd, args, { stdio: "inherit", cwd: opts?.cwd });
 }
 function defaultDockerLogin(creds) {
-  execFileSync("docker", ["login", creds.registry, "-u", creds.username, "--password-stdin"], {
+  execFileSync2("docker", ["login", creds.registry, "-u", creds.username, "--password-stdin"], {
     input: creds.password,
     stdio: ["pipe", "inherit", "inherit"]
   });
 }
 function defaultDockerLogout(registry) {
-  execFileSync("docker", ["logout", registry], { stdio: "ignore" });
+  execFileSync2("docker", ["logout", registry], { stdio: "ignore" });
 }
 async function defaultFetchText(ref, authToken) {
   const res = await fetch(ref, {
@@ -5895,7 +6109,7 @@ function removeDanglingVolumes(volumes, scope) {
       continue;
     }
     try {
-      execFileSync("docker", ["volume", "rm", vol.name], {
+      execFileSync2("docker", ["volume", "rm", vol.name], {
         stdio: ["pipe", "pipe", "pipe"],
         timeout: 3e4
       });
@@ -5963,6 +6177,7 @@ export {
   retainedCompletedDependencies,
   retainedContainerIsHealthy,
   assessRetainedHealthBefore,
+  planLegacyWorkerMigration,
   resolveServiceHealthTimeout,
   serviceSelectionPath,
   loadServiceSelection,
@@ -6042,6 +6257,7 @@ export {
   assertRolloutStageAllowed,
   assertBreakingChangesAllowed,
   verifyManifestImagesAvailable,
+  readStagedComposeTemplate,
   assertRetainedComposePlan,
   verifyPreDeployImages,
   collectImageProvenanceIssues,

package/dist/{chunk-6TOV7UVU.js → chunk-RJIH7JXM.js}

@@ -1,12 +1,12 @@
 import {
   sendMessage
-} from "./chunk-RWM6TZH6.js";
+} from "./chunk-7KPZQ65I.js";
 import {
   getActiveAgent
-} from "./chunk-IHBYJG7N.js";
+} from "./chunk-GL5ZG72X.js";
 import {
   resolveExeSession
-} from "./chunk-WSYIQKZ6.js";
+} from "./chunk-GM4UEZDE.js";
 import {
   getDispatcherSession
 } from "./chunk-PCV52RYM.js";
@@ -16,7 +16,7 @@ import {
 import {
   getCoordinatorName,
   isCoordinatorName
-} from "./chunk-LBEBSXZA.js";
+} from "./chunk-L5JFVK5T.js";
 
 // src/mcp/tools/send-message.ts
 import { z } from "zod";

package/dist/{chunk-2Q2U3NB2.js → chunk-RMC2A6EE.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-LBEBSXZA.js";
+} from "./chunk-L5JFVK5T.js";
 
 // src/lib/boot-generation.ts
 var SYNC_META_KEY = "daemon_boot_generation";

package/dist/{chunk-FUEKSCTN.js → chunk-RYMXD2NT.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-WCGNCH3Q.js";
 import {
   registerAllTools
-} from "./chunk-47UBJKS3.js";
+} from "./chunk-6HJF7IA3.js";
 
 // src/mcp/mcp-surface-hash.ts
 function computeMcpSurfaceHash() {

package/dist/{chunk-MNWN3SQ3.js → chunk-RYYFFCJG.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-LBEBSXZA.js";
+} from "./chunk-L5JFVK5T.js";
 import {
   loadConfig
 } from "./chunk-MMS2HBRT.js";