@aui.io/apollo 0.1.89 → 0.1.90

package/node_modules/@aui.io/apollo-core/dist/src/services/auth.js

@@ -1,7 +1,7 @@
 import { homedir } from "node:os";
 import { browserLogin } from "../api/identity.js";
 import { readCredentials, readUserConfig, writeCredentials, writeUserConfig, } from "../config/index.js";
-import { AuthError } from "../errors/index.js";
+import { AuthError, ConfigError } from "../errors/index.js";
 function claims(token) {
     try {
         const payload = token.split(".")[1];
@@ -80,4 +80,45 @@ export async function logout(context, homeDir = homedir()) {
     }
     await writeCredentials(homeDir, all);
 }
+/**
+ * A run on APOLLO_TOKEN has no saved session of its own: the saved login for
+ * this profile is another identity as far as this run is concerned, so a token
+ * this run is handed (an organization switch) is never written over it (S7).
+ */
+export function assertSavedSession(context, act) {
+    if (context.tokenSource !== "env")
+        return;
+    throw new ConfigError(`APOLLO_TOKEN is set, so ${act} has no saved session to change.`, "Unset APOLLO_TOKEN to change your saved login, or set APOLLO_TOKEN to a token for the organization you want.");
+}
+/**
+ * Who this run acts as — answered by identity, not read off the token. The
+ * one call refreshes a saved login the way every command does (or refuses an
+ * APOLLO_TOKEN the server no longer takes), so a session that answers here is
+ * one the next command can use.
+ */
+export async function whoami(context, identity, homeDir = homedir()) {
+    if (context.token === undefined) {
+        throw new AuthError(`Not logged in to ${context.environment} (profile "${context.profile}").`, "Run `apollo login`, or set APOLLO_TOKEN.");
+    }
+    const user = await identity.me();
+    const source = context.tokenSource ?? "credentials";
+    // A refresh during the call above rewrote the saved login: read it back, so
+    // the expiry shown is the one in use now.
+    const saved = source === "credentials"
+        ? (await readCredentials(homeDir))[context.profile]?.[context.environment]
+        : undefined;
+    const token = claims(saved?.access_token ?? context.token);
+    return {
+        environment: context.environment,
+        profile: context.profile,
+        user_id: user._id ?? user.id ?? context.userId ?? null,
+        email: user.email ?? token.email ?? null,
+        organization_id: context.orgId ?? token.organizationId ?? null,
+        token_organization_id: token.organizationId ?? null,
+        project_id: context.projectId ?? null,
+        token_source: source,
+        expires_at: token.exp ? new Date(token.exp * 1_000).toISOString() : null,
+        refreshable: saved?.refresh_token !== undefined,
+    };
+}
 //# sourceMappingURL=auth.js.map

package/node_modules/@aui.io/apollo-core/dist/src/services/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/services/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,YAAY,EAAyC,MAAM,oBAAoB,CAAC;AACzF,OAAO,EACL,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAU/C,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,OAAO;YACZ,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAe;YAC/E,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,WAAmB,EACnB,YAAqB,EACrB,MAAe;IAEf,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACxC,OAAO;QACL,YAAY,EAAE,WAAW;QACzB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,GAAG;YACjD,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,IAAI,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE;YAC9D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,WAAW,CAAC,GAAG;YACjB,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,OAAgB,EAChB,KAAiB,EACjB,OAAO,GAAG,OAAO,EAAE;IAEnB,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC7C,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IAC5B,GAAG,CAAC,OAAO,CAAC,OAAO,CAAE,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC;IACnD,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC;QAC9B,8EAA8E;QAC9E,gEAAgE;QAChE,eAAe,CAAC,OAAO,EAAE;YACvB,GAAG,MAAM;YACT,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,KAAa,EACb,OAAgB;IAEhB,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,WAAW,CAAC,GAAG,IAAI,WAAW,CAAC,GAAG,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,SAAS,CAAC,+BAA+B,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,QAAwB,EACxB,KAAa,EACb,GAAW,EACX,OAAgB;IAEhB,MAAM,MAAM,GAAgB,MAAM,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,UAAU,CACtB,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAClC,CAAC;IACF,MAAM,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAwB,EAAE,KAAa;IACtE,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB,EAChB,aAAqB,EACrB,OAAgB;IAEhB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;IACpC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5D,MAAM,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,OAAgB,EAChB,OAAO,GAAG,OAAO,EAAE;IAEnB,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/services/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,YAAY,EAAyC,MAAM,oBAAoB,CAAC;AACzF,OAAO,EACL,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,eAAe,GAGhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAU5D,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,OAAO;YACZ,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAe;YAC/E,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,WAAmB,EACnB,YAAqB,EACrB,MAAe;IAEf,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACxC,OAAO;QACL,YAAY,EAAE,WAAW;QACzB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,GAAG;YACjD,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,IAAI,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE;YAC9D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,WAAW,CAAC,GAAG;YACjB,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,OAAgB,EAChB,KAAiB,EACjB,OAAO,GAAG,OAAO,EAAE;IAEnB,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC7C,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IAC5B,GAAG,CAAC,OAAO,CAAC,OAAO,CAAE,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC;IACnD,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC;QAC9B,8EAA8E;QAC9E,gEAAgE;QAChE,eAAe,CAAC,OAAO,EAAE;YACvB,GAAG,MAAM;YACT,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB,EAChB,KAAa,EACb,OAAgB;IAEhB,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,WAAW,CAAC,GAAG,IAAI,WAAW,CAAC,GAAG,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,SAAS,CAAC,+BAA+B,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,QAAwB,EACxB,KAAa,EACb,GAAW,EACX,OAAgB;IAEhB,MAAM,MAAM,GAAgB,MAAM,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,UAAU,CACtB,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAClC,CAAC;IACF,MAAM,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAwB,EAAE,KAAa;IACtE,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB,EAChB,aAAqB,EACrB,OAAgB;IAEhB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;IACpC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5D,MAAM,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,OAAgB,EAChB,OAAO,GAAG,OAAO,EAAE;IAEnB,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAqC,EAAE,GAAW;IACnF,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK;QAAE,OAAO;IAC1C,MAAM,IAAI,WAAW,CACnB,2BAA2B,GAAG,kCAAkC,EAChE,8GAA8G,CAC/G,CAAC;AACJ,CAAC;AAkBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,OAAgB,EAChB,QAAwB,EACxB,OAAO,GAAG,OAAO,EAAE;IAEnB,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CACjB,oBAAoB,OAAO,CAAC,WAAW,cAAc,OAAO,CAAC,OAAO,KAAK,EACzE,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,IAAI,aAAa,CAAC;IACpD,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAM,KAAK,GACT,MAAM,KAAK,aAAa;QACtB,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;QAC1E,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3D,OAAO;QACL,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI;QACtD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,IAAI;QACxC,eAAe,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,cAAc,IAAI,IAAI;QAC9D,qBAAqB,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;QACnD,UAAU,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACrC,YAAY,EAAE,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;QACxE,WAAW,EAAE,KAAK,EAAE,aAAa,KAAK,SAAS;KAChD,CAAC;AACJ,CAAC"}

package/node_modules/@aui.io/apollo-core/dist/src/services/bundles.d.ts

@@ -3,6 +3,7 @@ import { type AgentVersion, type ManagementClient, type VersionPull, type Versio
 import type { BuilderApiClient, BundleAudit, BundleFix, Certificate, EraCensus, OrphanCensus } from "../api/builder-api.js";
 import type { RuntimeApiClient } from "../api/runtime-api.js";
 import { type BaselineCheckout, type FileDiff } from "../bundle/baseline.js";
+import { type ContentDiff } from "../bundle/patch.js";
 import { type ValidationResult } from "../bundle/validate.js";
 import { type Context, type ProjectBinding } from "../config/index.js";
 import { type SkillTarget } from "../skills/install.js";
@@ -62,6 +63,8 @@ export declare function pullBundle(context: Context, clients: {
     live?: string;
     /** Secret files the pulled commit still carries on the server — never written. */
     serverSecretFiles?: string[];
+    /** The engine build the pulled branch's newest commit was pushed for. */
+    recordedRuntime?: string;
 }>;
 export declare function importBundle(context: Context, clients: {
     management: ManagementClient;
@@ -69,8 +72,12 @@ export declare function importBundle(context: Context, clients: {
 }, agentId: string, destination: string, options?: {
     tag?: string;
     homeDir?: string;
-    /** The engine build to pin the new checkout to (see `runtime-version/`). */
+    /** The engine build to pin the new checkout to (see `runtime-version/`):
+     *  the fallback when the imported branch records none. */
     runtimeVersion?: string;
+    /** `runtimeVersion` came from --runtime-version / APOLLO_RUNTIME_VERSION:
+     *  it wins over the branch's own record. */
+    runtimeVersionExplicit?: boolean;
     /** Injected for tests; used for the signed-URL build-file downloads. */
     fetch?: typeof globalThis.fetch;
 }): Promise<{
@@ -84,6 +91,36 @@ export declare function importBundle(context: Context, clients: {
     /** Secret files the imported commit still carries on the server — never written. */
     serverSecretFiles?: string[];
 }>;
+/** What `seedCheckout` put into a new agent's directory. */
+export interface SeededCheckout {
+    /** The commit checked out. */
+    tag: string;
+    /** The commit's program files (secret files left out) — what the baseline records. */
+    files: Record<string, string>;
+    /** Program files written from the commit. */
+    written: string[];
+    /** Files the directory already held, left as they were: they read as changes against the commit. */
+    kept: string[];
+    /** Written only into an empty build area. */
+    build?: BuildAreaSync;
+    /** Secret files the commit still carries on the server — never written. */
+    serverSecretFiles?: string[];
+}
+/**
+ * Check one commit out into the directory of an agent just created, with a
+ * baseline that records it — WITHOUT replacing anything the directory already
+ * holds: `agent create --dir` may name a folder with a program in it, so a
+ * file already there is kept and reads as a change against the commit, and
+ * nothing is removed. The build area is written only when it is empty; the
+ * baseline records the commit's build bundle either way.
+ */
+export declare function seedCheckout(context: Context, clients: {
+    management: ManagementClient;
+    agentSettings: AgentSettingsClient;
+}, agentId: string, directory: string, tag: string, options?: {
+    homeDir?: string;
+    fetch?: typeof globalThis.fetch;
+}): Promise<SeededCheckout>;
 /** Skill packs a checkout gets unless the caller narrows or disables them. */
 export declare const DEFAULT_SKILL_TARGETS: SkillTarget[];
 /**
@@ -143,6 +180,8 @@ export interface PullCheckoutResult {
     removed: string[];
     /** Secret files the pulled commit still carries on the server — never written. */
     serverSecretFiles?: string[];
+    /** The engine build the pulled branch's newest commit was pushed for. */
+    recordedRuntime?: string;
     /** The build area sync, when the agent has a build bundle. */
     build?: BuildAreaSync;
     /** The commit customers get, when the pull followed `live` to its branch. */
@@ -195,7 +234,7 @@ export declare function localDiff(context: Context, root?: string, homeDir?: str
  *  hashes, so a remote build diff would download the whole bundle to say
  *  anything. `apollo pull` (whose dirty guard covers the area) is the
  *  honest tool there. */
-export declare function remoteDiff(context: Context, management: ManagementClient, root?: string): Promise<FileDiff>;
+export declare function remoteDiff(context: Context, management: ManagementClient, root?: string): Promise<ContentDiff>;
 /** Named for symmetry with `PullCheckoutResult`. */
 export interface PushCheckoutResult {
     /** The program lane (`bundle/src/**` vs the baseline). */
@@ -203,6 +242,8 @@ export interface PushCheckoutResult {
     /** The build lane (`bundle/build/**` vs the baseline), bare relative paths. */
     buildDiff: FileDiff;
     push?: VersionPush;
+    /** The push's answer was lost, and its commit was confirmed on the branch. */
+    recovered?: boolean;
     /** The commit customers still get, when the push landed on the branch it is on. */
     live?: string;
     /** The branch this push started, which the checkout now works on; `closed` is the bound branch when it took no commits. */
@@ -243,6 +284,16 @@ export interface PushCheckoutResult {
      * formed and consistent. Every error here refused the push; warnings ride.
      */
     bundle?: BundleAudit;
+    /**
+     * `--restamp` on an unchanged program: the runtime the branch recorded
+     * (`from`, null when none) and the pin it records now (`to`). `pushed` is
+     * false when the branch already recorded the pin, or on a dry run.
+     */
+    restamp?: {
+        from: string | null;
+        to: string;
+        pushed: boolean;
+    };
 }
 /**
  * Publish the checkout, both lanes: a changed program becomes a new agent
@@ -272,6 +323,12 @@ export declare function pushBundle(context: Context, clients: {
      *  based on — the second way out when the version moved (or any time
      *  the author wants a line of their own). A string names it. */
     newVersion?: string | boolean;
+    /** Push even when that moves the branch to an older runtime family, or
+     *  strips its runtime stamp (R6). */
+    allowRuntimeDowngrade?: boolean;
+    /** Commit the program even when it did not change, so the branch records
+     *  this checkout's runtime pin (A6). */
+    restamp?: boolean;
 }): Promise<PushCheckoutResult>;
 export declare function validateProgramBundle(runtime: RuntimeApiClient, files: Record<string, string>, 
 /** The agent whose vault resolves the connections' secret names. */

package/node_modules/@aui.io/apollo-core/dist/src/services/bundles.js

@@ -1,16 +1,21 @@
+import { createHash } from "node:crypto";
 import { mkdir, unlink, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import path from "node:path";
 import YAML from "yaml";
 import { branchName, continuedName, findLiveVersion, isLiveRef, liveCommitTag, parseVersionTag, } from "../api/management.js";
+import { downloadBytes } from "../api/download.js";
+import { DOWNLOAD_CONCURRENCY } from "../api/timeouts.js";
 import { diffHashes, diffHashMaps, isClean, readBaseline, writeBaseline, } from "../bundle/baseline.js";
 import { CERTIFICATION_FILE, hashBuildFiles, readBuildFiles, writeBuildFiles, } from "../bundle/build-area.js";
 import { hashFiles, readProgramFiles } from "../bundle/files.js";
-import { assembleFlatBundle, bundleFileLayout, bundleFiles, bundleSecretFiles, withoutSecretBundleFiles, writeBundleFiles, } from "../bundle/materialize.js";
+import { contentDiff } from "../bundle/patch.js";
+import { assembleFlatBundle, bundleFileLayout, bundleFiles, bundleSecretFiles, resolveInside, withoutSecretBundleFiles, writeBundleFiles, } from "../bundle/materialize.js";
 import { assertPushableBundle, assertValidProgram, mapRuntimeValidation, } from "../bundle/validate.js";
 import { patchBinding, requireUserId, writeBinding, } from "../config/index.js";
-import { ApiError, CliError, ConfigError, NotABranchError, ValidationError, versionMovedFrom, } from "../errors/index.js";
+import { ApiError, CliError, ConfigError, NotABranchError, PushOutcomeUnknownError, RuntimeDowngradeError, ValidationError, versionMovedFrom, } from "../errors/index.js";
 import { personName } from "../output/index.js";
+import { compareRuntimeFamilies, familyOf } from "../runtime-version/index.js";
 import { tagParts } from "../bundle/lineage.js";
 import { checkoutSchemasDir, installSchemas } from "../schemas/install.js";
 import { installAgentsPage } from "../skills/agents-page.js";
@@ -146,6 +151,75 @@ function buildProvenance(got, asked) {
  * gave, and the caller reports a fallback rather than quietly writing
  * material from another save into the checkout.
  */
+/** A failure after which a write may or may not have landed: a timeout, a
+ *  gateway 502/503/504, or fetch's own transport error. */
+function isOutcomeUnknown(error) {
+    if (error instanceof CliError && error.code === "REQUEST_TIMEOUT")
+        return true;
+    if (error instanceof ApiError)
+        return error.status === 502 || error.status === 503 || error.status === 504;
+    return error instanceof TypeError;
+}
+/**
+ * After a push whose answer was lost: its commit, when the branch's newest
+ * commit is this user's CLI push of exactly these files. Anything else —
+ * no new commit, someone else's, different files, or a lookup that fails
+ * too — is `undefined`: the caller reports the outcome as unknown rather
+ * than guess.
+ */
+async function findLandedPush(management, agentId, versionId, pushBase, actor, sent, runtimeVersion) {
+    try {
+        const { results } = await management.listRevisions(agentId, versionId, 1);
+        const newest = results[0];
+        if (newest === undefined || newest.version_tag === pushBase)
+            return undefined;
+        if (newest.created_by !== actor || newest.caller !== "cli")
+            return undefined;
+        // A re-stamp sends the files its base already has: the stamp is what
+        // tells this push's commit apart, wherever the listing reports it.
+        const stamped = newest.schema_stats?.runtime_version;
+        if (stamped !== undefined && stamped !== (runtimeVersion ?? null))
+            return undefined;
+        const landed = await management.pullVersion(agentId, versionId, newest.version_tag);
+        if (!sameHashes(hashFiles(bundleFiles(landed.bundle)), hashFiles(sent)))
+            return undefined;
+        return {
+            agent_id: agentId,
+            version_id: versionId,
+            new_version_revision_number: parseVersionTag(newest.version_tag)?.revision ?? 0,
+            new_version_tag: newest.version_tag,
+            revision_id: newest.id,
+            created_at: newest.created_at,
+            commit_message: newest.commit_message ?? null,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+function sameHashes(left, right) {
+    const keys = Object.keys(left);
+    return keys.length === Object.keys(right).length && keys.every((key) => left[key] === right[key]);
+}
+/** Run `task` over `items`, at most `limit` at a time; the first failure
+ *  stops new work and rejects. */
+async function inPool(items, limit, task) {
+    let next = 0;
+    let failed = false;
+    const worker = async () => {
+        while (!failed && next < items.length) {
+            const item = items[next++];
+            try {
+                await task(item);
+            }
+            catch (error) {
+                failed = true;
+                throw error;
+            }
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+}
 async function downloadBuildBundle(agentSettings, agentId, fetchImpl, programVersionTag) {
     let response;
     try {
@@ -159,14 +233,24 @@ async function downloadBuildBundle(agentSettings, agentId, fetchImpl, programVer
         throw error;
     }
     const entries = Object.entries(response.file_urls ?? {}).filter((entry) => typeof entry[1] === "string" && entry[1].length > 0);
+    // The hash agent-settings lists for each file, when the deployment sends it.
+    const expected = new Map((response.bundle.files ?? []).flatMap((file) => typeof file.sha256 === "string" && file.sha256 !== ""
+        ? [[file.path, file.sha256.toLowerCase()]]
+        : []));
     const files = {};
-    await Promise.all(entries.map(async ([relativePath, signedUrl]) => {
-        const download = await fetchImpl(signedUrl);
-        if (!download.ok) {
-            throw new CliError(`Failed to download build file "${relativePath}": ${String(download.status)} ${download.statusText}`);
+    // A few at a time, each under its own timeout (`downloadBytes`), and each
+    // checked against its listed hash — all before the caller writes anything.
+    await inPool(entries, DOWNLOAD_CONCURRENCY, async ([relativePath, signedUrl]) => {
+        const bytes = Buffer.from(await downloadBytes(signedUrl, { fetch: fetchImpl }));
+        const want = expected.get(relativePath);
+        if (want !== undefined && createHash("sha256").update(bytes).digest("hex") !== want) {
+            throw new CliError(`Build file "${relativePath}" does not match the checksum its bundle lists — nothing was written.`, {
+                code: "DOWNLOAD_INTEGRITY",
+                suggestion: "Re-run the command; if it happens again, the stored copy is damaged — report it.",
+            });
         }
-        files[relativePath] = Buffer.from(await download.arrayBuffer());
-    }));
+        files[relativePath] = bytes;
+    });
     const pinned = response.bundle.program_version_tag ?? undefined;
     return { version: response.bundle.version, files, ...(pinned ? { programVersionTag: pinned } : {}) };
 }
@@ -237,10 +321,13 @@ export async function pullBundle(context, clients, options = {}) {
         ...(buildSync ? { build: buildSync } : {}),
         ...(target.live ? { live: target.live } : {}),
         ...(serverSecretFiles.length ? { serverSecretFiles } : {}),
+        ...(target.version.blob_stats?.runtime_version
+            ? { recordedRuntime: target.version.blob_stats.runtime_version }
+            : {}),
     };
 }
 export async function importBundle(context, clients, agentId, destination, options = {}) {
-    const { tag, runtimeVersion } = options;
+    const { tag } = options;
     const { management } = clients;
     const homeDir = options.homeDir ?? homedir();
     const agent = await management.getAgent(agentId);
@@ -261,6 +348,11 @@ export async function importBundle(context, clients, agentId, destination, optio
     const serverSecretFiles = bundleSecretFiles(pull.bundle);
     // What the result echoes: a secret the commit still holds never reaches output.
     const pulled = { ...pull, bundle: withoutSecretBundleFiles(pull.bundle) };
+    // The checkout pins the engine the imported BRANCH was last pushed for: the
+    // agent-wide record is the live branch's, which another branch need not
+    // share (R6). An explicit --runtime-version / APOLLO_RUNTIME_VERSION wins.
+    const branchStamp = target.version.blob_stats?.runtime_version?.trim() || undefined;
+    const runtimeVersion = options.runtimeVersionExplicit === true ? options.runtimeVersion : (branchStamp ?? options.runtimeVersion);
     const sourceRoot = bundleSourceRoot(context, destination);
     await writeBundleFiles(sourceRoot, files);
     const buildSync = remoteBuild
@@ -292,6 +384,54 @@ export async function importBundle(context, clients, agentId, destination, optio
         ...(serverSecretFiles.length ? { serverSecretFiles } : {}),
     };
 }
+/**
+ * Check one commit out into the directory of an agent just created, with a
+ * baseline that records it — WITHOUT replacing anything the directory already
+ * holds: `agent create --dir` may name a folder with a program in it, so a
+ * file already there is kept and reads as a change against the commit, and
+ * nothing is removed. The build area is written only when it is empty; the
+ * baseline records the commit's build bundle either way.
+ */
+export async function seedCheckout(context, clients, agentId, directory, tag, options = {}) {
+    const { version } = await clients.management.resolveRef(agentId, tag);
+    const [pull, remoteBuild] = await Promise.all([
+        clients.management.pullVersion(agentId, version.id, tag),
+        downloadBuildBundle(clients.agentSettings, agentId, options.fetch ?? globalThis.fetch, tag),
+    ]);
+    const files = bundleFiles(pull.bundle);
+    const serverSecretFiles = bundleSecretFiles(pull.bundle);
+    const sourceRoot = path.resolve(bundleSourceRoot(context, directory));
+    const local = (await readProgramFiles(sourceRoot)).files;
+    const written = [];
+    for (const relativePath of Object.keys(files).sort()) {
+        if (relativePath in local)
+            continue;
+        const target = resolveInside(sourceRoot, relativePath);
+        await mkdir(path.dirname(target), { recursive: true });
+        await writeFile(target, files[relativePath] ?? "", "utf8");
+        written.push(relativePath);
+    }
+    let build;
+    if (remoteBuild) {
+        const buildRoot = buildAreaRoot(sourceRoot);
+        if (Object.keys((await readBuildFiles(buildRoot)).files).length === 0) {
+            build = {
+                version: remoteBuild.version,
+                ...(await writeBuildFiles(buildRoot, remoteBuild.files)),
+                ...buildProvenance(remoteBuild.programVersionTag, pull.version_tag),
+            };
+        }
+    }
+    await writeBaseline(options.homeDir ?? homedir(), agentId, directory, pull.version_tag, files, bundleFileLayout(pull.bundle), remoteBuild ? hashBuildFiles(remoteBuild.files) : {});
+    return {
+        tag: pull.version_tag,
+        files,
+        written,
+        kept: Object.keys(local).sort(),
+        ...(build ? { build } : {}),
+        ...(serverSecretFiles.length ? { serverSecretFiles } : {}),
+    };
+}
 /** Skill packs a checkout gets unless the caller narrows or disables them. */
 export const DEFAULT_SKILL_TARGETS = ["cursor", "claude"];
 /**
@@ -490,7 +630,7 @@ export async function remoteDiff(context, management, root = bundleSourceRoot(co
     const pull = await management.pullVersion(agentId, version.id);
     const remote = bundleFiles(pull.bundle);
     const current = await readProgramFiles(root);
-    return diffHashes(hashFiles(remote), current.files);
+    return contentDiff(remote, current.files);
 }
 /** agent-settings enforces this per uploaded build file. */
 const MAX_BUILD_FILE_BYTES = 5 * 1024 * 1024;
@@ -556,7 +696,23 @@ export async function pushBundle(context, clients, options = {}) {
     const pinned = context.runtimeVersion
         ? { runtimeVersion: context.runtimeVersion }
         : {};
-    if (options.dryRun || (isClean(diff) && isClean(buildDiff))) {
+    // `--restamp` (A6): a branch records the runtime its newest commit was
+    // pushed for, and only a commit records it — so an unchanged program is
+    // committed again, under this checkout's pin. A changed program stamps
+    // the pin anyway; there is nothing extra to do.
+    let restamp;
+    if (options.restamp === true) {
+        const pin = context.runtimeVersion;
+        if (pin === undefined) {
+            throw new ConfigError("Nothing to re-stamp: this checkout has no runtime pin.", "`apollo runtime use <version>` pins one; `apollo push --restamp` then records it on the branch.");
+        }
+        if (isClean(diff)) {
+            const branch = await clients.management.resolveVersion(agentId, requireTag(context));
+            restamp = { from: branch.blob_stats?.runtime_version?.trim() || null, to: pin, pushed: false };
+        }
+    }
+    const restampProgram = restamp !== undefined && restamp.from !== restamp.to;
+    if (options.dryRun || (isClean(diff) && isClean(buildDiff) && !restampProgram)) {
         return {
             diff,
             buildDiff,
@@ -564,14 +720,16 @@ export async function pushBundle(context, clients, options = {}) {
             bundle: bundleAudit,
             ...pinned,
             ...(validationLane === "builder" ? { validationLane } : {}),
+            ...(restamp ? { restamp } : {}),
         };
     }
     let push;
+    let recovered = false;
     let live;
     let newBranch;
     let versionTag = baseline?.versionTag ?? requireTag(context);
     let fileLayout = baseline?.fileLayout;
-    if (!isClean(diff)) {
+    if (!isClean(diff) || restampProgram) {
         const baseTag = requireTag(context);
         const [base, agent] = await Promise.all([
             clients.management.resolveVersion(agentId, baseTag),
@@ -600,6 +758,20 @@ export async function pushBundle(context, clients, options = {}) {
         // The branch the changes came from: the bound one, or the other branch
         // whose commit a new version is cut from.
         const from = basedOnThisLine ? base : await clients.management.resolveVersion(agentId, basedOn);
+        // The branch records the engine its newest commit was pushed for, and a
+        // push stamps this checkout's pin instead. An older family — or no pin at
+        // all — would silently move the branch's routing backwards (R6).
+        const recorded = from.blob_stats?.runtime_version?.trim() || undefined;
+        if (recorded !== undefined && options.allowRuntimeDowngrade !== true) {
+            const pin = context.runtimeVersion;
+            const family = familyOf(recorded);
+            if (pin === undefined) {
+                throw new RuntimeDowngradeError({ branch: branchName(from), recorded, ...(family ? { family } : {}) });
+            }
+            if ((compareRuntimeFamilies(recorded, pin) ?? 0) > 0) {
+                throw new RuntimeDowngradeError({ branch: branchName(from), recorded, pinned: pin, ...(family ? { family } : {}) });
+            }
+        }
         const newVersionName = typeof options.newVersion === "string" && options.newVersion.trim()
             ? options.newVersion.trim()
             : continuedName(from);
@@ -622,7 +794,8 @@ export async function pushBundle(context, clients, options = {}) {
         // (flag > env > `.apollorc`) rides the push body as `runtime_version`,
         // the same value the pre-flight validate above was routed to.
         try {
-            push = await clients.management.pushVersion(agentId, draft.id, bundle, actor, options.commitMessage, context.runtimeVersion, pushBase);
+            push = await clients.management.pushVersion(agentId, draft.id, bundle, actor, options.commitMessage ??
+                (restampProgram && restamp ? `Re-stamp runtime ${restamp.from ?? "(none)"} -> ${restamp.to}` : undefined), context.runtimeVersion, pushBase);
         }
         catch (error) {
             // Someone pushed after this checkout started: the refusal names the
@@ -630,7 +803,15 @@ export async function pushBundle(context, clients, options = {}) {
             const moved = versionMovedFrom(error, { newVersionName, me: actor });
             if (moved)
                 throw moved;
-            throw error;
+            // No answer is not a no: the server can commit after the answer is lost
+            // (apollo-api's own upstream limit, a gateway 504, a dropped socket).
+            // Look at the branch before calling it a failure — and never push twice.
+            if (!isOutcomeUnknown(error))
+                throw error;
+            push = await findLandedPush(clients.management, agentId, draft.id, pushBase, actor, program.files, context.runtimeVersion);
+            if (push === undefined)
+                throw new PushOutcomeUnknownError(branchName(draft), error);
+            recovered = true;
         }
         versionTag = push.new_version_tag;
         live = liveLeftBehind(agent, draft);
@@ -677,6 +858,7 @@ export async function pushBundle(context, clients, options = {}) {
         diff,
         buildDiff,
         ...(push ? { push } : {}),
+        ...(recovered ? { recovered } : {}),
         ...(live ? { live } : {}),
         ...(newBranch ? { newBranch } : {}),
         ...(buildPush ? { buildPush } : {}),
@@ -684,6 +866,7 @@ export async function pushBundle(context, clients, options = {}) {
         bundle: bundleAudit,
         ...pinned,
         ...(validationLane === "builder" ? { validationLane } : {}),
+        ...(restamp ? { restamp: { ...restamp, pushed: restampProgram && push !== undefined } } : {}),
     };
 }
 export async function validateProgramBundle(runtime, files,