@askexenow/exe-os 0.9.411 → 0.9.412

package/dist/{chunk-WHUQ44F2.js → chunk-RIKFXHLE.js}

@@ -22,7 +22,7 @@ import {
 } from "./chunk-EOWJXCYC.js";
 
 // src/lib/stack-update.ts
-import { execFileSync, spawnSync as spawnSync2 } from "child_process";
+import { execFileSync as execFileSync2, spawnSync as spawnSync2 } from "child_process";
 import { createHash, createVerify, randomBytes, verify as verifySignature } from "crypto";
 import { chmodSync, closeSync, copyFileSync, existsSync, lstatSync, mkdirSync, openSync, realpathSync, readdirSync, readFileSync, renameSync, rmSync, statSync, unlinkSync, utimesSync, writeFileSync } from "fs";
 import http from "http";
@@ -32,6 +32,183 @@ import path from "path";
 import { fileURLToPath } from "url";
 import { parseDocument as parseYamlDocument } from "yaml";
 
+// src/lib/stack-worker-migration.ts
+import { isScalar, parseDocument } from "yaml";
+var LEGACY_IMAGE = "${EXE_OS_WORKER_IMAGE_TAG:-ghcr.io/askexe/exe-os-worker:v0.9.311}";
+var DISABLED_IMAGE = "${EXE_OS_WORKER_IMAGE_TAG:-}";
+var WORKER = "exe-os-worker";
+function planLegacyWorkerMigration(input) {
+  const unchanged = { raw: input.composeRaw, changed: false };
+  if (!input.composeRaw.includes(LEGACY_IMAGE)) return unchanged;
+  const doc = parseDocument(input.composeRaw, { uniqueKeys: true });
+  if (doc.errors.length) throw new Error("Cannot inspect legacy worker migration: invalid Compose YAML");
+  const image = doc.getIn(["services", WORKER, "image"], true);
+  if (!isScalar(image) || image.value !== LEGACY_IMAGE) return unchanged;
+  const refuse = (reason) => {
+    throw new Error(`Cannot migrate the legacy embeddings worker: ${reason}. Keep the signed-manifest and digest checks enabled.`);
+  };
+  const worker = doc.getIn(["services", WORKER]);
+  const definition = worker.toJSON();
+  if (definition.extends || !Array.isArray(definition.profiles) || definition.profiles.length !== 1 || definition.profiles[0] !== "embeddings") {
+    refuse("the worker is not the shipped embeddings-only service");
+  }
+  const processEnv = input.processEnv ?? process.env;
+  const unquote = (value) => value.trim().replace(/\s+#.*$/, "").replace(/^(["'])(.*)\1$/, "$2").trim();
+  for (const value of [input.env.get("COMPOSE_PROFILES") ?? "", processEnv.COMPOSE_PROFILES ?? ""]) {
+    const profiles = unquote(value).split(",").map((profile) => profile.trim()).filter(Boolean);
+    if (profiles.some((profile) => !/^(?:[a-zA-Z0-9][a-zA-Z0-9_.-]*|\*)$/.test(profile))) {
+      refuse("enabled profiles could not be determined");
+    }
+    if (profiles.includes("embeddings") || profiles.includes("*")) refuse("embeddings are enabled");
+  }
+  if ([input.env.get("EXE_OS_WORKER_IMAGE_TAG") ?? "", processEnv.EXE_OS_WORKER_IMAGE_TAG ?? ""].some((value) => unquote(value))) {
+    refuse("an explicit worker image is configured; it must be covered by a signed release");
+  }
+  if (input.hostServicesUnavailable) refuse("the host's running services could not be observed");
+  if (input.hostServices.includes(WORKER)) refuse("the worker exists on the host");
+  if (input.overrideRaw) {
+    const override = parseDocument(input.overrideRaw, { uniqueKeys: true });
+    if (override.errors.length) refuse("the customer override could not be inspected");
+    if (override.hasIn(["services", WORKER])) refuse("the customer override defines the worker");
+  }
+  const targetComposeRaw = typeof input.targetComposeRaw === "function" ? input.targetComposeRaw() : input.targetComposeRaw;
+  if (!targetComposeRaw) refuse("the packaged replacement template is missing");
+  const target = parseDocument(targetComposeRaw, { uniqueKeys: true });
+  if (target.errors.length || target.getIn(["services", WORKER, "image"]) !== DISABLED_IMAGE) {
+    refuse("the packaged replacement does not contain the current disabled worker slot");
+  }
+  if (!image.range) refuse("the legacy image location is unavailable");
+  return {
+    raw: input.composeRaw.slice(0, image.range[0]) + JSON.stringify(DISABLED_IMAGE) + input.composeRaw.slice(image.range[1]),
+    changed: true
+  };
+}
+
+// src/lib/monitor-rollback.ts
+import { execFileSync } from "child_process";
+var LEGACY_HUB_DIGEST = "sha256:1af31893cc8b1e51892be7d7705fa6c6b3108af8366b1fa8da2879d8ae21ec88";
+var runDocker = (args) => execFileSync("docker", args, {
+  encoding: "utf8",
+  timeout: 12e4,
+  maxBuffer: 1024 * 1024
+});
+function restoreLegacyMonitorOwnership(composeArgs, run = runDocker) {
+  const configured = JSON.parse(
+    run([...composeArgs, "config", "--format", "json"])
+  ).services?.["exe-monitor-hub"];
+  if (!configured || typeof configured.image !== "string" || !configured.image.trim())
+    return false;
+  if (configured.user != null && String(configured.user).trim() && !["65532", "65532:65532"].includes(String(configured.user)))
+    return false;
+  const ids = run([...composeArgs, "ps", "--all", "--quiet", "exe-monitor-hub"]).trim().split(/\s+/).filter(Boolean);
+  if (ids.length === 0) return false;
+  if (ids.length !== 1 || !/^[a-f0-9]{12,64}$/.test(ids[0])) {
+    throw new Error("Cannot attribute the installed monitor container safely");
+  }
+  const image = JSON.parse(run(["image", "inspect", configured.image]))[0];
+  if (!image?.RepoDigests?.some(
+    (ref) => ref.endsWith("@" + LEGACY_HUB_DIGEST)
+  ))
+    return false;
+  if (image.Config?.User !== "65532:65532")
+    throw new Error(
+      "Legacy monitor runtime identity differs from its verified artifact"
+    );
+  const hub = JSON.parse(run(["inspect", ids[0]]))[0];
+  if (typeof hub?.Id !== "string" || !hub.Id.startsWith(ids[0]))
+    throw new Error("Monitor observation changed before recovery");
+  const project = hub?.Config?.Labels?.["com.docker.compose.project"];
+  const mount = hub?.Mounts?.find(
+    (m) => m.Destination === "/app/exe-monitor_data"
+  );
+  if (!project || hub.Config.Labels["com.docker.compose.service"] !== "exe-monitor-hub" || mount?.Type !== "volume" || typeof mount.Name !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(mount.Name)) {
+    throw new Error(
+      "Legacy monitor recovery requires its managed named data volume"
+    );
+  }
+  const volume = JSON.parse(run(["volume", "inspect", mount.Name]))[0];
+  if (volume?.Name !== mount.Name || volume.Labels?.["com.docker.compose.project"] !== project || volume.Labels["com.docker.compose.volume"] !== "monitor_hub_data") {
+    throw new Error(
+      "Legacy monitor data-volume ownership is not attributable to this stack"
+    );
+  }
+  const db = JSON.parse(run(["inspect", "exe-db"]))[0];
+  if (db?.Config?.Labels?.["com.docker.compose.project"] !== project || db.Config.Labels["com.docker.compose.service"] !== "exe-db" || !/^sha256:[a-f0-9]{64}$/.test(db.Image)) {
+    throw new Error(
+      "Legacy monitor recovery requires this stack's immutable database helper image"
+    );
+  }
+  let helper = JSON.parse(run(["image", "inspect", db.Image]))[0];
+  let helperId = db.Image;
+  if (!helper?.Os || !helper?.Architecture) {
+    const descriptor = db.ImageManifestDescriptor;
+    const platform = descriptor?.platform;
+    if (!/^sha256:[a-f0-9]{64}$/.test(descriptor?.digest ?? "") || platform?.os !== "linux" || !["amd64", "arm64"].includes(platform.architecture))
+      throw new Error("Cannot resolve native recovery helper platform");
+    helper = JSON.parse(
+      run([
+        "image",
+        "inspect",
+        "--platform",
+        `linux/${platform.architecture}`,
+        db.Image
+      ])
+    )[0];
+    helperId = descriptor.digest;
+    if (helper?.Architecture !== platform.architecture)
+      throw new Error("Recovery helper differs from the running DB platform");
+  }
+  if (helper?.Id !== helperId || helper.Os !== "linux" || !["amd64", "arm64"].includes(helper.Architecture)) {
+    throw new Error("Legacy monitor recovery helper metadata is inconsistent");
+  }
+  const base = [
+    "run",
+    "--rm",
+    "--network",
+    "none",
+    "--read-only",
+    "--user",
+    "0:0",
+    "--platform",
+    `linux/${helper.Architecture}`,
+    "--label",
+    `com.askexe.monitor-recovery=${project}`
+  ];
+  const owner = run([
+    ...base,
+    "--entrypoint",
+    "stat",
+    "--mount",
+    `type=volume,src=${mount.Name},dst=/recovery,readonly`,
+    db.Image,
+    "-c",
+    "%u:%g",
+    "/recovery"
+  ]).trim();
+  if (owner === "65532:65532") return false;
+  if (!/^\d+:\d+$/.test(owner))
+    throw new Error("Cannot observe legacy monitor data ownership safely");
+  run([...composeArgs, "stop", "--timeout", "10", "exe-monitor-hub"]);
+  run([
+    ...base,
+    "--cap-drop",
+    "ALL",
+    "--cap-add",
+    "CHOWN",
+    "--cap-add",
+    "DAC_OVERRIDE",
+    "--entrypoint",
+    "chown",
+    "--mount",
+    `type=volume,src=${mount.Name},dst=/recovery`,
+    db.Image,
+    "-Rh",
+    "65532:65532",
+    "/recovery"
+  ]);
+  return true;
+}
+
 // src/lib/askexe-image-prefixes.ts
 var ASKEXE_IMAGE_PREFIXES = ["ghcr.io/askexe/", "update.askexe.com/askexe/"];
 function isAskExeHostedImageRef(trimmedImage) {
@@ -1292,6 +1469,11 @@ async function rollbackStackUpdate(options) {
   if (options.retainCompose && !(scopedServiceNames.length === 1 && lockData?.services)) {
     throw new Error("--retain-compose rollback refused an unscoped restart; restore the selected service from backup manually");
   }
+  if (!options.exec && (scopedServiceNames.length === 0 || scopedServiceNames.includes("monitorHub"))) {
+    if (restoreLegacyMonitorOwnership(composeArgs)) {
+      console.log("[stack-update] Restored legacy monitor data ownership before rollback restart");
+    }
+  }
   if (scopedServiceNames.length > 0 && lockData?.services) {
     const scopedComposeServices = scopedComposeImageServices(
       scopedServiceNames.map((serviceName) => lockData.services[serviceName]?.composeService ?? serviceName),
@@ -1936,6 +2118,7 @@ var MONITOR_IMAGE_TAG_ENV = {
   monitorHub: "MONITOR_HUB_IMAGE_TAG",
   monitorAgent: "MONITOR_AGENT_IMAGE_TAG"
 };
+var OBSERVED_ROOT_AGENT_DIGEST = "sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a";
 var STOCK_BESZEL_MONITOR_VERSIONS = /* @__PURE__ */ new Set(["0.9.5"]);
 function monitorImageVersion(imageRef) {
   const noDigest = imageRef.split("@")[0] ?? imageRef;
@@ -1950,6 +2133,7 @@ function isStockBeszelMonitorImage(imageRef) {
   return version !== void 0 && STOCK_BESZEL_MONITOR_VERSIONS.has(version);
 }
 function monitorHealthBinForImage(serviceKey, imageRef) {
+  if (serviceKey === "monitorAgent" && imageRef.endsWith(`@${OBSERVED_ROOT_AGENT_DIGEST}`)) return "/agent";
   const stock = isStockBeszelMonitorImage(imageRef);
   if (serviceKey === "monitorHub") return stock ? "/beszel" : "/app/beszel";
   return stock ? "/agent" : "/app/beszel-agent";
@@ -2202,14 +2386,17 @@ function collectImageAvailabilityIssues(plan) {
       try {
         const result = spawnSync2("docker", ["manifest", "inspect", manifestInspectRef(image), "--verbose"], {
           stdio: ["ignore", "pipe", "pipe"],
-          timeout: 3e4
+          // Multi-platform official images can require dozens of child-manifest
+          // requests through the proxy. A valid Redis index took 68s in the
+          // legacy-upgrade rehearsal; 30s misreported it as an absent image.
+          timeout: 12e4
         });
         if (result.status === 0) {
           inspected = true;
           inspectOutput = result.stdout?.toString() ?? "";
           break;
         }
-        lastStderr = result.stderr?.toString().trim() ?? "";
+        lastStderr = result.error?.message || result.stderr?.toString().trim() || "manifest inspection failed";
         if (attempt < maxAttempts) {
           const delayMs = baseDelayMs * Math.pow(2, attempt - 1);
           console.log(
@@ -2232,13 +2419,14 @@ function collectImageAvailabilityIssues(plan) {
     try {
       const parsed = JSON.parse(inspectOutput);
       const manifests = Array.isArray(parsed) ? parsed : [parsed];
+      const platformOf = (m) => m.platform ?? m.Descriptor?.platform;
       const hasAmd64 = manifests.some((m) => {
-        const platform = m.platform;
+        const platform = platformOf(m);
         return platform?.architecture === "amd64" && platform?.os === "linux";
       });
-      if (!hasAmd64 && manifests.length > 0 && manifests[0]?.platform) {
+      if (!hasAmd64 && manifests.some((m) => platformOf(m))) {
         const platforms = manifests.map((m) => {
-          const p = m.platform;
+          const p = platformOf(m);
           return `${p?.os ?? "?"}/${p?.architecture ?? "?"}`;
         }).join(", ");
         issues.push({
@@ -3904,6 +4092,9 @@ async function runStackUpdate(options) {
   return withStackUpdateOperationLock(options.envFile, () => runStackUpdateUnlocked(options));
 }
 async function runStackUpdateUnlocked(options) {
+  if (options.rollback && (options.dryRun || options.verifyImages)) {
+    throw new Error("Rollback cannot be combined with a read-only preview; no rollback was performed.");
+  }
   const exec = options.exec ?? defaultExec;
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   const phaseDurations = [];
@@ -3925,17 +4116,17 @@ async function runStackUpdateUnlocked(options) {
   };
   if (options.rollback) return rollbackStackUpdate(options);
   let preBootstrapBackup;
-  if (!options.dryRun && existsSync(options.envFile)) {
+  if (!options.dryRun && !options.verifyImages && existsSync(options.envFile)) {
     const preBootstrapEnvRaw = readFileSync(options.envFile, "utf8");
     preBootstrapBackup = backupStackConfig(path.dirname(options.envFile), options.composeFile, preBootstrapEnvRaw, now);
   }
-  if (options.bootstrap !== false) {
+  if (options.bootstrap !== false && !options.dryRun && !options.verifyImages) {
     const report = bootstrapStackHost({ ...options, installDocker: options.installDocker ?? !!options.yes });
     if (!options.dryRun) assertHostReadyForApply(report);
   }
   assertBindMountsExist(path.dirname(options.envFile));
   warnLegacyDaemonVolume(options.volumeExists);
-  if (!options.dryRun) {
+  if (!options.dryRun && !options.verifyImages) {
     try {
       const endPhase = startPhase("preflight");
       if (!options.preflight) {
@@ -3962,7 +4153,7 @@ async function runStackUpdateUnlocked(options) {
   const hubUrl = options.monitorHubUrl || parseEnv(readFileSync(options.envFile, "utf8")).get("MONITOR_HUB_URL") || "";
   const pairLicense = options.licenseKey || process.env.EXE_LICENSE_KEY || loadLicense() || "";
   const pairDomain = options.domain || process.env.EXE_STACK_DOMAIN || process.env.CUSTOMER_DOMAIN || "";
-  if (!options.retainCompose && hubUrl && pairLicense && pairDomain) {
+  if (!options.dryRun && !options.verifyImages && !options.retainCompose && hubUrl && pairLicense && pairDomain) {
     const envBefore = readFileSync(options.envFile, "utf8");
     const parsedEnvBefore = parseEnv(envBefore);
     const monitorToken = parsedEnvBefore.get("MONITOR_AGENT_TOKEN") ?? "";
@@ -3990,6 +4181,7 @@ async function runStackUpdateUnlocked(options) {
   );
   reportStackManifestSource(manifestLoad);
   const manifest = manifestLoad.manifest;
+  let previewServiceSelection;
   if (options.addService || options.removeService) {
     const effectiveVersion = options.targetVersion ?? manifest.latest;
     const manifestRelease = manifest.stacks[effectiveVersion];
@@ -4013,11 +4205,16 @@ async function runStackUpdateUnlocked(options) {
       currentServices.delete(options.removeService);
       console.log(`[stack-update] Removed service: ${options.removeService}`);
     }
-    saveServiceSelection(options.envFile, [...currentServices]);
-    console.log(`[stack-update] Saved service selection: ${[...currentServices].join(", ")}`);
+    if (options.dryRun || options.verifyImages) {
+      previewServiceSelection = runScopedServiceSelection([...currentServices], now);
+      console.log(`[stack-update] Planned service selection (not saved): ${[...currentServices].join(", ")}`);
+    } else {
+      saveServiceSelection(options.envFile, [...currentServices]);
+      console.log(`[stack-update] Saved service selection: ${[...currentServices].join(", ")}`);
+    }
   }
   const isRunScoped = Boolean(options.services && options.services.length > 0);
-  const serviceSelection = isRunScoped ? runScopedServiceSelection(options.services, now) : loadServiceSelection(options.envFile);
+  const serviceSelection = isRunScoped ? runScopedServiceSelection(options.services, now) : previewServiceSelection ?? loadServiceSelection(options.envFile);
   if (isRunScoped) {
     console.log(
       `[stack-update] Service scope for THIS RUN ONLY: ${options.services.join(", ")} (the managed set in ${serviceSelectionPath(options.envFile)} is unchanged)`
@@ -4094,7 +4291,22 @@ ${lines.join("\n")}`
       `[stack-update] Synced monitor healthcheck bin path(s) into the deploy environment: ${[...processHealthBins.pinned, ...processHealthBins.cleared].join(", ")}`
     );
   }
-  assertProductionDeployGate(plan, plannedEnvRaw, composeRaw, {
+  const hostState = listHostComposeServices(
+    composeArgsForStack(options.composeFile, options.envFile),
+    options.composePsCapture ?? defaultComposePsCapture
+  );
+  const overrideFile = composeOverrideFileFor(options.composeFile);
+  const workerMigration = options.retainCompose ? { raw: composeRaw, changed: false } : planLegacyWorkerMigration({
+    composeRaw,
+    targetComposeRaw: stagedCompose.templateFound ? stagedCompose.raw : null,
+    env: parseEnv(plannedEnvRaw),
+    hostServices: hostState.services,
+    hostServicesUnavailable: hostState.unavailable,
+    overrideRaw: existsSync(overrideFile) ? readFileSync(overrideFile, "utf8") : null
+  });
+  const composeRawForGate = workerMigration.raw;
+  if (workerMigration.changed) console.log("[stack-update] Planned configuration migration: clear the unused legacy embeddings-worker image default.");
+  assertProductionDeployGate(plan, plannedEnvRaw, composeRawForGate, {
     breakGlassReason: options.breakGlassReason,
     breakGlassAuditFile: options.breakGlassAuditFile,
     strictDigest: options.strictDigest,
@@ -4139,14 +4351,10 @@ ${lines.join("\n")}`
         );
       }
     }
-    const hostState = listHostComposeServices(
-      composeArgsForStack(options.composeFile, options.envFile),
-      options.composePsCapture ?? defaultComposePsCapture
-    );
     assertSignedManifestDeliveryGate({
       release: manifest.stacks[plan.targetVersion],
       targetVersion: plan.targetVersion,
-      composeRaw,
+      composeRaw: composeRawForGate,
       envRaw: plannedEnvRaw,
       hostServices: hostState.services,
       hostServicesUnavailable: hostState.unavailable,
@@ -4263,7 +4471,9 @@ ${lines.join("\n")}`
     }
   };
   const containersRunning = plan.changes.length === 0 ? (options.stackContainersRunning ?? areStackContainersRunning)(options.composeFile, options.envFile) : true;
-  if (options.dryRun || !options.resume && plan.changes.length === 0 && containersRunning) {
+  const managedTargetPlan = isRunScoped ? createStackUpdatePlan(manifest, envRaw, effectiveTargetVersion, void 0, loadServiceSelection(options.envFile), composeRaw) : fullTargetPlan;
+  const versionOnlyUpgrade = Boolean(options.targetVersion && previousVersion && previousVersion !== plan.targetVersion && managedTargetPlan.changes.length === 0);
+  if (options.dryRun || !options.resume && plan.changes.length === 0 && containersRunning && !versionOnlyUpgrade && !workerMigration.changed) {
     const ssoOutcome = skipSsoEdgeReconcileForRetainScope ? { attempted: false, delivered: true } : await reconcileSsoEdge({ apply: !options.dryRun });
     if (!options.dryRun && !ssoOutcome.delivered) {
       throw new Error(
@@ -4341,6 +4551,7 @@ ${lines.join("\n")}`
     }
   } catch (err) {
     if (options.retainCompose) throw err;
+    if (workerMigration.changed) throw new Error(`Could not install the validated legacy worker migration: ${err instanceof Error ? err.message : String(err)}`);
     const reason = err instanceof Error ? err.message : String(err);
     console.warn(`[stack-update] Could not refresh docker-compose.yml (${reason}); using existing compose.`);
   }
@@ -5292,25 +5503,28 @@ function listHostComposeServices(composeArgs, capture = defaultComposePsCapture)
   if (trimmed.startsWith("[")) {
     try {
       const parsed = JSON.parse(trimmed);
-      if (Array.isArray(parsed)) records.push(...parsed);
+      if (!Array.isArray(parsed)) return { services: [], unavailable: true };
+      records.push(...parsed);
     } catch {
+      return { services: [], unavailable: true };
     }
-  }
-  if (records.length === 0) {
+  } else {
     for (const line of trimmed.split("\n")) {
       const l = line.trim();
       if (!l) continue;
       try {
         records.push(JSON.parse(l));
       } catch {
+        return { services: [], unavailable: true };
       }
     }
   }
-  if (records.length === 0) return { services: [], unavailable: true };
   const services = /* @__PURE__ */ new Set();
   for (const obj of records) {
-    const service = String(obj.Service ?? "").trim();
-    if (service) services.add(service);
+    if (!obj || typeof obj !== "object" || Array.isArray(obj) || typeof obj.Service !== "string" || !obj.Service.trim()) {
+      return { services: [], unavailable: true };
+    }
+    services.add(obj.Service.trim());
   }
   return { services: [...services], unavailable: false };
 }
@@ -5663,16 +5877,16 @@ function httpStatus(urlString, hostHeader) {
   });
 }
 function defaultExec(cmd, args, opts) {
-  execFileSync(cmd, args, { stdio: "inherit", cwd: opts?.cwd });
+  execFileSync2(cmd, args, { stdio: "inherit", cwd: opts?.cwd });
 }
 function defaultDockerLogin(creds) {
-  execFileSync("docker", ["login", creds.registry, "-u", creds.username, "--password-stdin"], {
+  execFileSync2("docker", ["login", creds.registry, "-u", creds.username, "--password-stdin"], {
     input: creds.password,
     stdio: ["pipe", "inherit", "inherit"]
   });
 }
 function defaultDockerLogout(registry) {
-  execFileSync("docker", ["logout", registry], { stdio: "ignore" });
+  execFileSync2("docker", ["logout", registry], { stdio: "ignore" });
 }
 async function defaultFetchText(ref, authToken) {
   const res = await fetch(ref, {
@@ -5895,7 +6109,7 @@ function removeDanglingVolumes(volumes, scope) {
       continue;
     }
     try {
-      execFileSync("docker", ["volume", "rm", vol.name], {
+      execFileSync2("docker", ["volume", "rm", vol.name], {
         stdio: ["pipe", "pipe", "pipe"],
         timeout: 3e4
       });
@@ -5963,6 +6177,7 @@ export {
   retainedCompletedDependencies,
   retainedContainerIsHealthy,
   assessRetainedHealthBefore,
+  planLegacyWorkerMigration,
   resolveServiceHealthTimeout,
   serviceSelectionPath,
   loadServiceSelection,
@@ -6042,6 +6257,7 @@ export {
   assertRolloutStageAllowed,
   assertBreakingChangesAllowed,
   verifyManifestImagesAvailable,
+  readStagedComposeTemplate,
   assertRetainedComposePlan,
   verifyPreDeployImages,
   collectImageProvenanceIssues,

package/dist/{chunk-DRHTRVDT.js → chunk-VBYSAQJD.js}

@@ -212,7 +212,7 @@ async function main(args) {
   console.log("[health-gate] Starting rollback...");
   restorePreDeployBackup();
   try {
-    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-XXDRKGGR.js");
+    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-EBATTQPP.js");
     const paths = defaultStackPaths();
     await rollbackStackUpdate({
       manifestRef: paths.manifestRef,

package/dist/{chunk-54STF27U.js → chunk-W3ABSZ6G.js}

@@ -140,7 +140,7 @@ async function assertManifestSignature(manifest, publicKeyPem) {
       "manifest carries no `signature`. Fleets that enforce EXE_STACK_PUBLIC_KEY reject unsigned manifests, so publishing one would ship a release no host can install. Re-sign with the custodied key: node scripts/sign-stack-manifest.mjs deploy/stack-manifests/v0.9.json"
     );
   }
-  const { verifyStackManifestSignature } = await import("./stack-update-XXDRKGGR.js");
+  const { verifyStackManifestSignature } = await import("./stack-update-EBATTQPP.js");
   try {
     verifyStackManifestSignature(manifest, publicKeyPem);
   } catch (err) {

package/dist/hooks/manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "generatedAt": "2026-10-12T18:45:23.939Z",
+  "generatedAt": "2026-10-14T20:24:44.425Z",
   "hashes": {
     "bug-report-worker.js": "0d9712cf7c03fd8eb3c9dc83e7b17b4df8f396787a9eb49e5108172f2ea741a4",
     "codex-stop-task-finalizer.js": "6f9fecf94aa63e22c5ed78f29faa6b9f6e6b6dc2c4685fddd6725983dfba818a",

package/dist/lib/registry-proxy.js

@@ -11,7 +11,7 @@ import {
   resolveRegistryProxyBuildIdentity,
   resolveStackManifestChannel,
   runRegistryProxy
-} from "../chunk-54STF27U.js";
+} from "../chunk-W3ABSZ6G.js";
 import "../chunk-MLKGABMK.js";
 export {
   SERVED_VERSION_PATH,

package/dist/{stack-generate-manifest-SU6OFFY7.js → stack-generate-manifest-MVJDTU4F.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-WC44PNZU.js";
-import "./chunk-WHUQ44F2.js";
+} from "./chunk-5DLZJ3MY.js";
+import "./chunk-RIKFXHLE.js";
 import "./chunk-EC5H53YD.js";
 import "./chunk-YYRI2AGK.js";
 import "./chunk-L25OAFOU.js";
@@ -120,7 +120,7 @@ var STACK_SERVICE_SPECS = Object.freeze([
     releaseWorkflowFile: "ci.yml",
     imageName: "update.askexe.com/askexe/exe-auth",
     env: "AUTH_IMAGE_TAG",
-    healthUrl: "http://127.0.0.1:3300/api/health",
+    healthUrl: "http://127.0.0.1:3300/",
     category: "auth",
     description: "Shared SSO sign-in/sign-up"
   },
@@ -141,7 +141,7 @@ var STACK_SERVICE_SPECS = Object.freeze([
     sourceImageName: "ghcr.io/askexe/exe-erp",
     env: "ERP_IMAGE_TAG",
     healthUrl: "http://127.0.0.1:8069/api/method/ping",
-    healthHost: "erp.askexe.com",
+    healthHost: "${ERP_SITE_NAME:-erp.localhost}",
     required: false,
     category: "app",
     description: "Enterprise resource planning"
@@ -182,40 +182,16 @@ var STACK_SERVICE_SPECS = Object.freeze([
     composeServices: ["exe-dashboard"],
     origin: "askexe-release",
     deployment: "stack",
-    // SOURCE IS KNOWN: exe-dashboard is built from THIS repo (AskExe/exe-os),
-    // build context dashboard-page/, by .github/workflows/dashboard-image.yml.
-    // Production's sha256:950699473914… came from exe-os commit 1d5b69cffa8d
-    // (#703, 2026-08-13), confirmed in build run 31714341386.
-    ghRepo: "AskExe/exe-os",
-    // …but it is OUTSIDE THE RELEASE LANE: that workflow pushes only
-    // `:sha-<sha>` and `:main`, sets no org.opencontainers.image.version, and
-    // neither stack.release.json nor the stack manifest mentions it. Production
-    // is three builds stale and nothing auto-deploys it.
-    // FAIL-CLOSED DEFAULT ONLY (bug 61e7096e) — this is stale as of
-    // 2026-09-08: release-dashboard-image.yml now calls release-service.yml@v1
-    // and stack.release.json's `components.dashboard` describes it. Leaving
-    // "none" here is deliberate anyway: a constant like this one is exactly
-    // what went stale last time, so it must never by itself be trusted to stay
-    // OPEN — it is trusted only to stay CLOSED. The CLI derives the real
-    // answer from stack.release.json at run time (`releaseLaneWired` in
-    // ServiceFacts) and that is what actually decides Guard 2. If the
-    // descriptor entry is ever removed, this default is what re-closes the
-    // gate without anyone having to remember to flip a flag back.
-    releaseLane: "none",
-    // Wired ahead of the release lane itself (bug e49ac42b): once dashboard is
-    // flipped into the release lane, its producer is `.github/workflows/
-    // release-dashboard-image.yml` ("Release dashboard image", id 338670900) —
-    // a DIFFERENT workflow than exe-os's own "Release stack image"
-    // (id 274190265), even though both live in this repo, both match
-    // /release/i, and both can run at the same tag commit during a stack
-    // release. This is the concrete scenario adversarial review flagged: name
-    // matching would let exe-os's release stand in for dashboard's own.
+    // The standalone repository owns publication after the dashboard extraction.
+    // Its producer must pass its own gates; an exe-os release cannot stand in.
+    ghRepo: "AskExe/exe-dashboard",
     releaseWorkflowFile: "release-dashboard-image.yml",
-    imageName: "ghcr.io/askexe/exe-dashboard",
+    imageName: "update.askexe.com/askexe/exe-dashboard",
+    sourceImageName: "ghcr.io/askexe/exe-dashboard",
     env: "DASHBOARD_IMAGE_TAG",
+    healthUrl: "http://127.0.0.1:3301/health",
     category: "app",
-    description: "Customer dashboard (credits, usage, keys, billing)",
-    note: "Release lane wiring is now DERIVED from stack.release.json's components.dashboard entry (bug 61e7096e), not asserted here. Dashboard may still fail generation for other, real reasons \u2014 e.g. bug d85b98c7 (the release stamp step refuses to publish from an unclean tree, so no v* dashboard image has ever actually been produced) \u2014 but it will fail with an accurate reason from a later guard, not with a stale claim that the lane doesn't exist."
+    description: "Customer dashboard (credits, usage, keys, billing)"
   },
   {
     key: "exe-build",

package/dist/{stack-promote-MJF436JD.js → stack-promote-BMGEY6SQ.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-WC44PNZU.js";
-import "./chunk-WHUQ44F2.js";
+} from "./chunk-5DLZJ3MY.js";
+import "./chunk-RIKFXHLE.js";
 import "./chunk-EC5H53YD.js";
 import "./chunk-YYRI2AGK.js";
 import "./chunk-L25OAFOU.js";