@dzhechkov/cloudru-hub 0.1.16 → 0.1.17

package/.dz-manifest.json

@@ -5,7 +5,7 @@
     "files": [
       {
         "path": "CHANGELOG.md",
-        "sha256": "56ba17ee84afe937d3f13c17387b26090e42217b1c8ffd9eee175a5512a14091"
+        "sha256": "70bc9263f657739464a56bf220ce370da7baa73dae086565417ccf62b6806078"
       },
       {
         "path": "LICENSE",
@@ -13,7 +13,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "bfd1c00de39c986cebad2e3fb00fa072ad0b4ecb3cb07f744920bf80474ecb47"
+        "sha256": "0ca9b07e9194d91645194140c23d715b741a4503ad261305bf1b8af28470c494"
       },
       {
         "path": "THIRD_PARTY_NOTICES.md",
@@ -33,11 +33,11 @@
       },
       {
         "path": "data/tools-classification.json",
-        "sha256": "a4bf5a2e76d4f9bd686bec704919ab3380bb22ff46a399b058dc5b3e71a64dd1"
+        "sha256": "0f09cb2fffd2feebfa5e7e97e8503a47ae1b63d1035e309540a4211f0bace477"
       },
       {
         "path": "data/tools-list-snapshot.json",
-        "sha256": "6864bb944ebf780454d266fe7ad47e9cec12969fb66fa9e9a1963b547944e10f"
+        "sha256": "247fe8a6d9c47d3b7c4d218d1047df842e41e3b1880594d7dbc7b3f5e6ce52ed"
       },
       {
         "path": "docs/COST-COMPARE.md",
@@ -49,7 +49,7 @@
       },
       {
         "path": "docs/LOCAL-TESTING.md",
-        "sha256": "7f5cc32d5f089c66246f8349f86fc72dfe6397de7a63edf51692da8583231b41"
+        "sha256": "6b2f6b18f863a9a467ad08977b14de4fdf3285a70ae5a35ce855c4f143c05958"
       },
       {
         "path": "docs/WEB-IMAGE.md",
@@ -61,7 +61,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "94247888df4287a6077204c369ccb685a51b1d943635d51c6228dc1f8fe54635"
+        "sha256": "7fe766354e40487c5dd90461d41edcde781cf4775d46376daad9c5abbaf8b314"
       },
       {
         "path": "src/classification.js",
@@ -165,7 +165,7 @@
       },
       {
         "path": "test/resolve.test.mjs",
-        "sha256": "b447a8755c67bcbfc3db63c909235f34414721139c7bc7fdf0658ab0638e7980"
+        "sha256": "dcaede3dea29d98d93f3c902b8f9f389f24dc7b9a84665d1c206263915282f06"
       },
       {
         "path": "test/safe-mcp.test.mjs",
@@ -173,5 +173,5 @@
       }
     ]
   },
-  "signature": "uCRif8l/EX1KMduryC76GpbzVdYNOCth1Zq9ssM2PoWD6EvqNnFlsK1lDoalJERQi5Rly6hZNmFwixIY0n54Dw=="
+  "signature": "H9IFrg1rkdQ36/YEY4aH9uYXFczQB7h+PSmA5LV+mwEkF08uYlis6QAArIaDBpz6d85no/YvOS97A2rneTFbDw=="
 }

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog — @dzhechkov/cloudru-hub
 
+## 0.1.17 — 2026-10-29
+
+- Pin the matched Linux/x64 engine `0.2.8-20261029` (SHA-256
+  `0095d3911da7e3a93f1d2ee064708820b9b9c50bfc5cbd99fc46c7da6db8be08`)
+  as the exact `@dzhechkov/cloudru-vm-linux-x64@0.2.8` optional dependency.
+  The local `tools/list` observation retains the 146 ordered registered catalog
+  names and gate flags; classification permissions and tool schemas are unchanged.
+- Add the source-reviewed, exclusive shared-local project/VM-name claim before
+  VM or static-site security-group mutation. Retain uncertain, partial and empty
+  claims across restart; no expiry, unlock or blind replay. Different roots,
+  hosts, older clients and direct API calls are outside coordination.
+- Add action-scoped, immutable configured-project/exact-cluster delete intent
+  before `k8s_delete`. Duplicate or uncertain attempts refuse another DELETE.
+  Receipt recovery is GET-only; accepted operation and operation completion do
+  not prove cluster absence or cleanup. Existing create/nodepool behavior remains.
+  Both corrections have local synthetic controls, not new paid-cloud acceptance.
+
 ## 0.1.16 — 2026-10-29
 
 - Pin the matched Linux/x64 engine `0.2.7-20261029` (SHA-256

package/README.md

@@ -2,16 +2,16 @@
 
 Site: https://aicoding.space · Source: https://github.com/djd1m/dz-harness/tree/main/packages/cloudru-hub
 
-> **Linux/x64:** version 0.1.16 names the exact optional engine
-> package `@dzhechkov/cloudru-vm-linux-x64@0.2.7`. The `dz guard` `licence-hold`
+> **Linux/x64:** version 0.1.17 names the exact optional engine
+> package `@dzhechkov/cloudru-vm-linux-x64@0.2.8`. The `dz guard` `licence-hold`
 > rule continues to check LICENSE, notices and SPDX on publish.
 
 > **Unofficial. NOT affiliated with, endorsed, or supported by Cloud.ru.** "Cloud.ru" is a
 > trademark of its owner; this launcher merely talks to the public Cloud.ru Evolution API
 > through the `cloudru-vm` engine.
 
-Thin JS launcher for the **`cloudru-vm` MCP engine** — a Go MCP server with **146 tools**
-(MEASURED — live `tools/list` probe, `data/tools-list-snapshot.json`) for Cloud.ru
+Thin JS launcher for the **`cloudru-vm` MCP engine** — a Go MCP server with **146 registered catalog tools**
+(MEASURED — local `tools/list` probe, `data/tools-list-snapshot.json`; this is not 146 live Cloud.ru API tests) for Cloud.ru
 Evolution: VMs, k8s, PostgreSQL/Kafka/Redis, DNS, S3, certificates, billing/FinOps, and a
 docker-compose deploy wizard.
 
@@ -19,11 +19,11 @@ The launcher archive contains no engine binary. npm installs the exact optional
 platform package with the pinned Go engine on Linux/x64. Run:
 
 ```bash
-npm install -g @dzhechkov/cloudru-hub@0.1.16
+npm install -g @dzhechkov/cloudru-hub@0.1.17
 cloudru-hub self-test
 ```
 
-The self-test verifies the engine SHA-256, version, 146 live MCP tools and their
+The self-test verifies the engine SHA-256, version, 146 registered MCP catalog tools and their
 classification without Cloud.ru credentials. On another platform, or if optional
 dependencies were disabled, provide a trusted binary with the same SHA-256.
 
@@ -82,7 +82,7 @@ node bin/cloudru-hub.js self-test
 ```
 
 Expected: 5 green steps ending `self-test: ALL GREEN` (resolution, sha256 match against
-the pinned baseline `94fdba4f…bfabc03`, engine version, 146 live tools, full
+the pinned baseline `0095d391…db8be08`, engine version, 146 registered catalog tools, full
 classification coverage). Full walkthrough incl. `npm link` and MCP registration:
 [`docs/LOCAL-TESTING.md`](docs/LOCAL-TESTING.md).
 
@@ -90,11 +90,13 @@ Host setup, checks and limits: [`docs/HERMES-CODEX.md`](docs/HERMES-CODEX.md). T
 
 For billing through `mcp-safe`, add the optional `"agreement_id":"…"` to the owner-only `~/.config/cloudru-hub/credentials.json` alongside `key_id`, `secret` and `project_id`. The proxy forwards it to the Go child as `CLOUDRU_AGREEMENT_ID`. Existing environment-only billing setups remain supported when no credential file is configured. The current consumption tool reports the agreement-wide total; its output should not be presented as a per-project bill. See the [Cloud.ru instructions for locating the agreement ID](https://cloud.ru/docs/billing/ug/topics/faq__api_id_agreement).
 
-The `vm-deploy` and `k8s-deploy` profiles are opt-in previews requiring a matching pinned Go binary and credentials in a private local file. `deploy_plan` resolves a VM and a compute/disk estimate; `deploy_preflight(plan_id)` observes live name collisions and available quota usage, naming unknown create rights, capacity and billed tariffs. After an exact-plan approval, `deploy_apply` writes a private run intent before VM creation. If the API outcome is uncertain, `deploy_reconcile(plan_id)` reads the receipt and project inventory; it never adopts a same-name VM or authorizes a retry. A prior receipt for the same project and VM name also blocks a new plan, even if the cloud inventory has not caught up; inspect the prior run and choose a new name. The static-site route still snapshots approved HTML/ZIP bytes, uses fixed Cloud-init and a dedicated TCP-80 group, and reports verified only after exact-byte HTTP checks against the approved IP. Every public file must be reviewed; a public IP may incur additional charges. Static sites do not grant `vm_exec` SSH access. See `features/cloudru-cli-vm-deploy/SNAKE-ACCEPTANCE.md` in the private source tree for the earlier live acceptance.
+The `vm-deploy` and `k8s-deploy` profiles are opt-in previews requiring a matching pinned Go binary and credentials in a private local file. `deploy_plan` resolves a VM and a compute/disk estimate; `deploy_preflight(plan_id)` observes live name collisions and available quota usage, naming unknown create rights, capacity and billed tariffs. After an exact-plan approval, `deploy_apply` writes a private run intent before VM creation. If the API outcome is uncertain, `deploy_reconcile(plan_id)` reads the receipt and project inventory; it never adopts a same-name VM or authorizes a retry. A prior receipt for the same project and VM name also blocks a new plan, even if the cloud inventory has not caught up; inspect the prior run and choose a new name. The static-site route still snapshots approved HTML/ZIP bytes, uses fixed Cloud-init and a dedicated TCP-80 group, and reports verified only after exact-byte HTTP checks against the approved IP. Every public file must be reviewed; a public IP may incur additional charges. Static sites do not grant `vm_exec` SSH access.
 
-Concurrent distinct VM plans for the same project and VM name are not serialized. Avoid launching those plans together; the prior-receipt check protects sequential submissions and is not an atomic name reservation.
+**Published versions `cloudru-hub@0.1.16` and `cloudru-vm-linux-x64@0.2.7`:** concurrent distinct VM plans for the same project and VM name are not serialized. Avoid launching those plans together; the prior-receipt check protects sequential submissions and is not an atomic name reservation.
 
-In the matched `0.2.7-20261029` engine, operator `k8s_plan` resolves a supported zone name or ID to `zone_id`/`zones`, and `k8s_create` explicitly sends that ID for control-plane placement. The VIP subnet must match the same zone. This does not establish why a worker pool may fail to register nodes.
+**Matched `cloudru-hub@0.1.17` / `cloudru-vm-linux-x64@0.2.8`:** the initial deployment checkpoint exclusively claims the exact project/VM-name pair in private shared local state before either a VM or static-site security group is mutated. The claim remains after process exit, an uncertain provider response, or a later checkpoint failure; even an empty or partial claim blocks another plan. There is no TTL, unlock, forced replay or name-based adoption. Inspect the retained claim and run receipt in the shared state root, reconcile live project inventory and known resource IDs, then choose a new name for a separate deployment if needed. Coordination covers upgraded processes sharing one local state root. Old clients, raw engine paths, different roots or hosts, and direct Cloud.ru API calls remain outside it; this is not distributed idempotency. Local synthetic race, restart and I/O-fault controls cover this correction; no new live VM creation was used for these controls.
+
+In the previous `0.2.7-20261029` engine (retained in `0.2.8-20261029`), operator `k8s_plan` resolves a supported zone name or ID to `zone_id`/`zones`, and `k8s_create` explicitly sends that ID for control-plane placement. The VIP subnet must match the same zone. This does not establish why a worker pool may fail to register nodes.
 
 The matched engine also accepts `k8s_plan` with
 `{"preflight":true}` to collect read-only observations before a possible paid
@@ -121,13 +123,13 @@ balancer and traffic, then run `cloudru-hub cost-compare --input <json> --json`
 separately with verified tariff inputs. This diagnostic does not create an
 approval or unlock a retry.
 
-Kubernetes recovery is included in the matched `0.2.7-20261029` engine.
+Kubernetes create/nodepool recovery was included in the previous `0.2.7-20261029` engine and is retained in `0.2.8-20261029`.
 The operator flow records a private durable intent before
 `k8s_create` or `k8s_add_nodepool`, then saves known operation/resource IDs.
 After a lost reply, `k8s_get` supports `receipt_id`, `operation_id` and
 bounded `receipts:true` discovery in addition to its existing cluster lookup.
 These observations distinguish provider operation state from resource presence;
-they do not check Ready Nodes or application HTTP. This candidate has no new
+they do not check Ready Nodes or application HTTP. This release adds no new
 live Kubernetes deployment or `web-image` acceptance result.
 
 The first recovery increment keeps the same project/kind/parent/name blocked
@@ -137,7 +139,26 @@ automatic retry, force flag or receipt-removal procedure. A different name is a
 separate deployment with possible duplicate cost. Diagnostics do not create a
 cluster, and existing guarded profiles still deny infrastructure create tools.
 
-The Kubernetes preview has two explicit profiles. The default `snake` profile retains its exact ConfigMap, non-root Deployment and ClusterIP Service. `web-image` accepts one reviewed digest-pinned OCI image in a bounded one-pod Deployment and internal ClusterIP Service. It requires a `/health` endpoint on port 8080, a dedicated namespace, non-root UID 10001, a read-only root filesystem and bounded CPU/RAM. The image must already be built, pushed and pullable by the existing cluster. This package does not build code from a repository or prove that an image digest corresponds to a source commit. `k8s-approve` binds exact manifest bytes, cluster, namespace, project and a ten-minute single-use approval. The proxy uses `create_only=true`; inspect partial resources before retrying because Kubernetes multi-document create is not transactional. Neither profile creates a cluster, namespace, nodes, NAT, ingress or load balancer. The four-host live acceptance in `features/cloudru-k8s-snake-deploy/` covers only Snake; `web-image` currently has deterministic local tests.
+**Matched `cloudru-hub@0.1.17` / `cloudru-vm-linux-x64@0.2.8`:**
+before one confirmed `k8s_delete` DELETE, the engine writes a private, durable
+`cluster-delete` intent scoped to the action, configured project and exact
+cluster ID. That target is immutable. A duplicate call or restart after an
+uncertain outcome refuses another DELETE through the shared store, including
+when the receipt is unreadable. A valid accepted response reports `deleting`;
+malformed or uncertain responses report `unknown_outcome` and retain only
+unambiguous operation correlation. For `unknown_outcome` or
+`recovery_required`, inspect `k8s_get(receipt_id)` or bounded `receipts:true`
+discovery. Recovery is GET-only for the exact target and any known operation
+under the configured project. A scoped exact-cluster 404 observes absence;
+403, errors, malformed or mismatched JSON remain unknown. Operation `done`
+does not prove cluster absence, application readiness, dependent cleanup or
+zero cost. There is no TTL, receipt removal, forced retry or distributed
+guarantee; other hosts, state roots and direct API callers do not coordinate.
+Existing create and nodepool recovery behavior is retained. Local synthetic
+replay, restart and I/O-fault controls cover this correction; no new paid-cluster
+test was used. Broader operation recovery remains work in progress.
+
+The Kubernetes preview has two explicit profiles. The default `snake` profile retains its exact ConfigMap, non-root Deployment and ClusterIP Service. `web-image` accepts one reviewed digest-pinned OCI image in a bounded one-pod Deployment and internal ClusterIP Service. It requires a `/health` endpoint on port 8080, a dedicated namespace, non-root UID 10001, a read-only root filesystem and bounded CPU/RAM. The image must already be built, pushed and pullable by the existing cluster. This package does not build code from a repository or prove that an image digest corresponds to a source commit. `k8s-approve` binds exact manifest bytes, cluster, namespace, project and a ten-minute single-use approval. The proxy uses `create_only=true`; inspect partial resources before retrying because Kubernetes multi-document create is not transactional. Neither profile creates a cluster, namespace, nodes, NAT, ingress or load balancer. Earlier four-host live application acceptance covered only Snake; `web-image` currently has deterministic local tests.
 
 See the [web-image procedure](docs/WEB-IMAGE.md) for authored code and pinned repository inputs.
 
@@ -182,7 +203,7 @@ protections proven:
 
 ## Platform package status
 
-The separate `@dzhechkov/cloudru-vm-linux-x64@0.2.7` package is installed
+The separate `@dzhechkov/cloudru-vm-linux-x64@0.2.8` package is installed
 automatically on Linux/x64 unless optional dependencies are disabled. Its static
 build reproduces the pinned SHA-256 and bundles the license and NOTICE files
 of linked Go modules. `CLOUDRU_VM_BIN` and `~/.cloudru-hub/config.json` remain

package/data/tools-classification.json

@@ -1,6 +1,6 @@
 {
   "$comment": "Golden classification of every cloudru-vm engine tool. allow requires a BEHAVIOUR audit of the handler at the pinned engine SHA proving both axes: (1) observational with no cloud mutation, job advancement or secret return (a local plan write is disclosed), and (2) no user-controlled argument reaching shell/exec/SSH. Shell-reaching tools remain ask even when arguments are quoted. Schema shape alone never proves allow. The old baseline had two hazards: stack_status advanced planned jobs into paid actions and logs inserted an unescaped service into a shell command. In the pinned engine, stack_status reads persisted state only; stack_apply explicitly advances jobs, and logs shell-quotes service. The specific regression tests are in go/cloudru-vm/internal/mcp/stack_status_test.go and internal/engine/logs_test.go. Any unknown live tool fails drift checks; deny by default.",
-  "engineSha256": "94fdba4fe4d1a71e684be998c3d2f94f374ff4e4054db2683bcc04d72bfabc03",
+  "engineSha256": "0095d3911da7e3a93f1d2ee064708820b9b9c50bfc5cbd99fc46c7da6db8be08",
   "toolCount": 146,
   "counts": {
     "ask": 64,

package/data/tools-list-snapshot.json

@@ -1,7 +1,7 @@
 {
   "capturedAt": "2026-10-29",
-  "engineVersion": "cloudru-vm 0.2.7-20261029",
-  "engineSha256": "94fdba4fe4d1a71e684be998c3d2f94f374ff4e4054db2683bcc04d72bfabc03",
+  "engineVersion": "cloudru-vm 0.2.8-20261029",
+  "engineSha256": "0095d3911da7e3a93f1d2ee064708820b9b9c50bfc5cbd99fc46c7da6db8be08",
   "method": "JSON-RPC tools/list via src/probe-child.js against locally built private engine",
   "toolCount": 146,
   "tools": [

package/docs/LOCAL-TESTING.md

@@ -19,8 +19,8 @@ EOF
 # c) no override: the installed Linux/x64 optional platform package
 ```
 
-The pinned binary identifies itself as `cloudru-vm 0.2.7-20261029` and has SHA-256
-`94fdba4fe4d1a71e684be998c3d2f94f374ff4e4054db2683bcc04d72bfabc03`.
+The pinned binary identifies itself as `cloudru-vm 0.2.8-20261029` and has SHA-256
+`0095d3911da7e3a93f1d2ee064708820b9b9c50bfc5cbd99fc46c7da6db8be08`.
 
 ## 2. Self-test (end-to-end, no credentials required)
 
@@ -29,18 +29,26 @@ cd packages/@dzhechkov/cloudru-hub
 node bin/cloudru-hub.js self-test
 ```
 
-Expected output for the current private build:
+Example output from the verified engine (installation path varies):
 
 ```
 ✓ resolve: …/cloudru-vm-linux-x64/native/cloudru-vm (source: env)
-✓ sha256: 94fdba4fe4d1a71e684be998c3d2f94f374ff4e4054db2683bcc04d72bfabc03 — MATCHES pinned baseline
-✓ engine-version: cloudru-vm 0.2.7-20261029
+✓ sha256: 0095d3911da7e3a93f1d2ee064708820b9b9c50bfc5cbd99fc46c7da6db8be08 — MATCHES pinned baseline
+✓ engine-version: cloudru-vm 0.2.8-20261029
 ✓ tools-list: 146 tools live (snapshot: 146)
 ✓ classification-coverage: every live tool is classified (146 golden entries)
 self-test: ALL GREEN
 ```
 
-`tools/list` needs no Cloud.ru credentials. For `--toolsets vm-deploy`, place temporary keys in the owner-only JSON file described in `HERMES-CODEX.md`; the proxy maps them to the Go child's environment without shell evaluation.
+The tool's word “live” means a real local MCP catalog observation: 146
+registered tools, without Cloud.ru credentials or cloud API calls. It does
+not mean 146 cloud operations were exercised. A sandbox that prohibits child
+processes can instead report `spawnSync /usr/bin/node EPERM`; run the same
+self-test where the engine can start, rather than treating that refusal as a pass.
+
+For `--toolsets vm-deploy`, place
+temporary keys in the owner-only JSON file described in `HERMES-CODEX.md`;
+the proxy maps them to the Go child's environment without shell evaluation.
 
 ## 3. Optional: `npm link` for a global `cloudru-hub`
 
@@ -66,4 +74,4 @@ appears; note which prefix spelling the runtime used.
 
 ## 5. Testing from another server (`npm install` path)
 
-On Linux/x64, install `@dzhechkov/cloudru-hub@0.1.16` normally and run `cloudru-hub self-test` without setting `CLOUDRU_VM_BIN`. npm installs the exact optional engine package. If optional dependencies were disabled or the platform is unsupported, provide a matching trusted binary explicitly.
+On Linux/x64, install `@dzhechkov/cloudru-hub@0.1.17` normally and run `cloudru-hub self-test` without setting `CLOUDRU_VM_BIN`. npm installs the exact `@dzhechkov/cloudru-vm-linux-x64@0.2.8` optional engine package. If optional dependencies were disabled or the platform is unsupported, provide a matching trusted binary explicitly.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/cloudru-hub",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "licenseHold": {
     "adr": "features/hermes-claude-adaptation/03_adr/001-licence-and-provenance-precondition.md",
     "note": "SATISFIED hold. Timur is credited for substantial Cloud.ru API testing. The 2026-10-20 correction is in the historical grant record. This field keeps the dz guard licence-hold rule checking LICENSE, THIRD_PARTY_NOTICES and SPDX on every publish."
@@ -26,9 +26,9 @@
   ],
   "cloudruHub": {
     "binaryHashes": {
-      "linux-x64": "94fdba4fe4d1a71e684be998c3d2f94f374ff4e4054db2683bcc04d72bfabc03"
+      "linux-x64": "0095d3911da7e3a93f1d2ee064708820b9b9c50bfc5cbd99fc46c7da6db8be08"
     },
-    "engineVersion": "cloudru-vm 0.2.7-20261029",
+    "engineVersion": "cloudru-vm 0.2.8-20261029",
     "platformPackages": {
       "linux-x64": "@dzhechkov/cloudru-vm-linux-x64"
     }
@@ -53,7 +53,7 @@
     "yaml": "^2.9.0"
   },
   "optionalDependencies": {
-    "@dzhechkov/cloudru-vm-linux-x64": "0.2.7"
+    "@dzhechkov/cloudru-vm-linux-x64": "0.2.8"
   },
   "repository": {
     "type": "git",

package/sbom.json

@@ -15,7 +15,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "56ba17ee84afe937d3f13c17387b26090e42217b1c8ffd9eee175a5512a14091"
+          "content": "70bc9263f657739464a56bf220ce370da7baa73dae086565417ccf62b6806078"
         }
       ]
     },
@@ -35,7 +35,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "bfd1c00de39c986cebad2e3fb00fa072ad0b4ecb3cb07f744920bf80474ecb47"
+          "content": "0ca9b07e9194d91645194140c23d715b741a4503ad261305bf1b8af28470c494"
         }
       ]
     },
@@ -85,7 +85,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a4bf5a2e76d4f9bd686bec704919ab3380bb22ff46a399b058dc5b3e71a64dd1"
+          "content": "0f09cb2fffd2feebfa5e7e97e8503a47ae1b63d1035e309540a4211f0bace477"
         }
       ]
     },
@@ -95,7 +95,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6864bb944ebf780454d266fe7ad47e9cec12969fb66fa9e9a1963b547944e10f"
+          "content": "247fe8a6d9c47d3b7c4d218d1047df842e41e3b1880594d7dbc7b3f5e6ce52ed"
         }
       ]
     },
@@ -125,7 +125,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7f5cc32d5f089c66246f8349f86fc72dfe6397de7a63edf51692da8583231b41"
+          "content": "6b2f6b18f863a9a467ad08977b14de4fdf3285a70ae5a35ce855c4f143c05958"
         }
       ]
     },
@@ -159,7 +159,7 @@
         },
         {
           "name": "dz:canonical-json-sha256-v2",
-          "value": "94247888df4287a6077204c369ccb685a51b1d943635d51c6228dc1f8fe54635"
+          "value": "7fe766354e40487c5dd90461d41edcde781cf4775d46376daad9c5abbaf8b314"
         }
       ]
     },
@@ -419,7 +419,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b447a8755c67bcbfc3db63c909235f34414721139c7bc7fdf0658ab0638e7980"
+          "content": "dcaede3dea29d98d93f3c902b8f9f389f24dc7b9a84665d1c206263915282f06"
         }
       ]
     },

package/test/resolve.test.mjs

@@ -125,6 +125,6 @@ test('sha256File matches node crypto', () => {
 test('the pinned linux-x64 hash is the rebuilt private engine sha256', () => {
   assert.equal(
     PKG.cloudruHub.binaryHashes['linux-x64'],
-    '94fdba4fe4d1a71e684be998c3d2f94f374ff4e4054db2683bcc04d72bfabc03',
+    '0095d3911da7e3a93f1d2ee064708820b9b9c50bfc5cbd99fc46c7da6db8be08',
   );
 });