@event4u/agent-config 16.5.0 → 17.0.0

package/dist/cli-delegate/cmd_validate.js

@@ -3,30 +3,33 @@ import { createRequire as __acCreateRequire } from 'node:module'; const require
 import {
   PROJECT_BRIDGE_MARKERS,
   USER_SCOPE_PATHS
-} from "./chunk-T7XSJSUQ.js";
-import "./chunk-6SRJTYJS.js";
-import "./chunk-WOKWX5PL.js";
-import "./chunk-523HCFYO.js";
-import "./chunk-G5VVIZRC.js";
-import "./chunk-6YQC2HLF.js";
+} from "./chunk-SIOMDAKL.js";
+import "./chunk-4SHNERBL.js";
+import "./chunk-BKALSTBZ.js";
+import "./chunk-NTM7G2V4.js";
+import "./chunk-IROAQ77A.js";
+import "./chunk-F7HLSW6P.js";
+import "./chunk-JHMMWNJ2.js";
+import "./chunk-LF2KKJ4Q.js";
 import "./chunk-A4QJ6ENT.js";
-import "./chunk-MDPPKQCQ.js";
-import "./chunk-DMSZHXZS.js";
+import "./chunk-GOMILC3O.js";
+import "./chunk-7DRWULEQ.js";
 import "./chunk-ULQRUR23.js";
+import "./chunk-PV7S5DPJ.js";
 import {
   current_package_version
 } from "./chunk-LQOCRFWT.js";
+import {
+  resolve_project_root
+} from "./chunk-XLY5G3CM.js";
 import "./chunk-DEIV7XP7.js";
+import "./chunk-J2SJZICO.js";
 import {
   manifest_path,
   read_manifest
-} from "./chunk-OKJUIAPS.js";
+} from "./chunk-4E2W63DA.js";
 import "./chunk-MWRD5YOH.js";
 import "./chunk-OY53J6II.js";
-import "./chunk-LF2KKJ4Q.js";
-import {
-  resolve_project_root
-} from "./chunk-H76PHZBI.js";
 import "./chunk-T6BP34WI.js";
 import "./chunk-MCJYCQPF.js";
 import "./chunk-J55WI3RR.js";

package/dist/cli-delegate/cmd_versions.js

@@ -2,7 +2,7 @@ import { createRequire as __acCreateRequire } from 'node:module'; const require
 import {
   project_settings_path,
   resolve_project_root
-} from "./chunk-H76PHZBI.js";
+} from "./chunk-XLY5G3CM.js";
 import "./chunk-T6BP34WI.js";
 import {
   resolvePackageRoot

package/dist/cli-delegate/dashboard_mode.js

@@ -5,7 +5,7 @@ import {
   isTrackedInGit,
   parseModeToken,
   reportCheckVerdict
-} from "./chunk-7XGD2OEU.js";
+} from "./chunk-UXWHY6CQ.js";
 import "./chunk-JO25G5H7.js";
 export {
   evaluateDashboardOnDisk,

package/dist/cli-delegate/gate_execute.js

@@ -6,12 +6,13 @@ import {
   consentLine,
   execute,
   locate
-} from "./chunk-KXXWJTDO.js";
-import "./chunk-PHD7OOLE.js";
+} from "./chunk-WMNYVIYX.js";
+import "./chunk-MQ2UDEGV.js";
+import "./chunk-DSY6LLCQ.js";
 import "./chunk-ULET4BYS.js";
 import "./chunk-5EK5WQN6.js";
 import "./chunk-YWVXLR44.js";
-import "./chunk-7XGD2OEU.js";
+import "./chunk-UXWHY6CQ.js";
 import "./chunk-ED7KCMLB.js";
 import "./chunk-YDQSHTD7.js";
 import "./chunk-JO25G5H7.js";

package/dist/cli-delegate/roadmap_age.js

@@ -0,0 +1,22 @@
+import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
+import {
+  STALL_DAYS,
+  collect_ages,
+  days_between,
+  is_park_proposal,
+  parse_age_log,
+  render_age_section,
+  renewal_date,
+  strip_age_section
+} from "./chunk-DSY6LLCQ.js";
+import "./chunk-JO25G5H7.js";
+export {
+  STALL_DAYS,
+  collect_ages,
+  days_between,
+  is_park_proposal,
+  parse_age_log,
+  render_age_section,
+  renewal_date,
+  strip_age_section
+};

package/dist/cli-delegate/roadmap_gates.js

@@ -5,18 +5,19 @@ import {
 } from "./chunk-ZZQBUHFK.js";
 import {
   execute
-} from "./chunk-KXXWJTDO.js";
+} from "./chunk-WMNYVIYX.js";
 import {
   blocker_class,
   blocker_needs_user,
   collect
-} from "./chunk-PHD7OOLE.js";
+} from "./chunk-MQ2UDEGV.js";
+import "./chunk-DSY6LLCQ.js";
 import "./chunk-ULET4BYS.js";
 import {
   isCliEntry
 } from "./chunk-5EK5WQN6.js";
 import "./chunk-YWVXLR44.js";
-import "./chunk-7XGD2OEU.js";
+import "./chunk-UXWHY6CQ.js";
 import "./chunk-ED7KCMLB.js";
 import "./chunk-YDQSHTD7.js";
 import "./chunk-JO25G5H7.js";

package/dist/cli-delegate/update_roadmap_progress.js

@@ -25,11 +25,12 @@ import {
   pending_iron_law_3,
   render,
   unarchived_complete
-} from "./chunk-PHD7OOLE.js";
+} from "./chunk-MQ2UDEGV.js";
+import "./chunk-DSY6LLCQ.js";
 import "./chunk-ULET4BYS.js";
 import "./chunk-5EK5WQN6.js";
 import "./chunk-YWVXLR44.js";
-import "./chunk-7XGD2OEU.js";
+import "./chunk-UXWHY6CQ.js";
 import "./chunk-YDQSHTD7.js";
 import "./chunk-JO25G5H7.js";
 export {

package/dist/cli-delegate/upgrade_unattended-VVL6JLSX.js

@@ -0,0 +1,541 @@
+import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
+import {
+  any_live_session,
+  global_register_dir
+} from "./chunk-XCY5KKUC.js";
+import {
+  classifyUpdate,
+  originForPackageRoot
+} from "./chunk-2Y5AMLMY.js";
+import "./chunk-UUYEKXKR.js";
+import "./chunk-5VO3RTMV.js";
+import "./chunk-IAYTIIQW.js";
+import {
+  read_lockfile
+} from "./chunk-LQOCRFWT.js";
+import "./chunk-MWRD5YOH.js";
+import {
+  event4u_root,
+  write_target
+} from "./chunk-T6BP34WI.js";
+import {
+  resolvePackageRoot
+} from "./chunk-MCJYCQPF.js";
+import "./chunk-J55WI3RR.js";
+
+// src/scripts/_cli/upgrade_unattended.ts
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { spawnSync } from "node:child_process";
+import process from "node:process";
+
+// src/scripts/_lib/provenance_verify.ts
+var EXPECTED_WORKFLOW_REF = ".github/workflows/publish-npm.yml";
+var EXPECTED_REPOSITORY = "https://github.com/event4u-app/agent-config";
+function asRecord(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v) ? v : null;
+}
+function decode_payload(doc) {
+  const list = asRecord(doc)?.["attestations"];
+  if (!Array.isArray(list) || list.length === 0) return null;
+  for (const entry of list) {
+    const payload = asRecord(asRecord(asRecord(entry)?.["bundle"])?.["dsseEnvelope"])?.["payload"];
+    if (typeof payload !== "string" || payload === "") continue;
+    try {
+      const parsed = JSON.parse(Buffer.from(payload, "base64").toString("utf8"));
+      const rec = asRecord(parsed);
+      if (rec !== null) return rec;
+    } catch {
+    }
+  }
+  return null;
+}
+function external_workflow(doc) {
+  const payload = decode_payload(doc);
+  if (payload === null) return null;
+  const predicate = asRecord(payload["predicate"]);
+  const external = asRecord(asRecord(predicate?.["buildDefinition"])?.["externalParameters"]);
+  return asRecord(external?.["workflow"]);
+}
+function attestation_workflow_ref(doc) {
+  const path_value = external_workflow(doc)?.["path"];
+  return typeof path_value === "string" && path_value !== "" ? path_value : null;
+}
+function provenance_matches_publish(doc) {
+  return payload_names_publish(decode_payload(doc));
+}
+function payload_names_publish(payload) {
+  const predicate = asRecord(payload?.["predicate"]);
+  const workflow = asRecord(asRecord(asRecord(predicate?.["buildDefinition"])?.["externalParameters"])?.["workflow"]);
+  if (workflow?.["path"] !== EXPECTED_WORKFLOW_REF) return false;
+  const repo = workflow["repository"];
+  if (typeof repo !== "string" || repo === "") return false;
+  return repo.replace(/\.git$/, "").replace(/\/$/, "") === EXPECTED_REPOSITORY;
+}
+function san_names_workflow(san) {
+  return san.split(/,\s*/).some((e) => e.startsWith(`URI:${SAN_WORKFLOW_MARKER}@`));
+}
+var SAN_WORKFLOW_MARKER = `${EXPECTED_REPOSITORY}/${EXPECTED_WORKFLOW_REF}`;
+function dssePae(payloadType, payload) {
+  const type = Buffer.from(payloadType, "utf8");
+  return Buffer.concat([
+    Buffer.from(`DSSEv1 ${String(type.length)} `, "utf8"),
+    type,
+    Buffer.from(` ${String(payload.length)} `, "utf8"),
+    payload
+  ]);
+}
+function readEnvelope(entry) {
+  const bundle = asRecord(asRecord(entry)?.["bundle"]);
+  const dsse = asRecord(bundle?.["dsseEnvelope"]);
+  if (dsse === null) return null;
+  const payloadB64 = dsse["payload"];
+  const payloadType = dsse["payloadType"];
+  const sigs = dsse["signatures"];
+  if (typeof payloadB64 !== "string" || typeof payloadType !== "string" || !Array.isArray(sigs) || sigs.length === 0) return null;
+  const sigB64 = asRecord(sigs[0])?.["sig"];
+  if (typeof sigB64 !== "string" || sigB64 === "") return null;
+  const material = asRecord(bundle?.["verificationMaterial"]);
+  const single = asRecord(material?.["certificate"])?.["rawBytes"];
+  const chain = asRecord(material?.["x509CertificateChain"])?.["certificates"];
+  const first = Array.isArray(chain) ? asRecord(chain[0])?.["rawBytes"] : void 0;
+  const certB64 = typeof single === "string" ? single : typeof first === "string" ? first : null;
+  if (certB64 === null || certB64 === "") return null;
+  return {
+    payloadType,
+    payload: Buffer.from(payloadB64, "base64"),
+    sig: Buffer.from(sigB64, "base64"),
+    certDer: Buffer.from(certB64, "base64")
+  };
+}
+async function verify_attestation_signature(doc) {
+  const list = asRecord(doc)?.["attestations"];
+  if (!Array.isArray(list) || list.length === 0) return "the attestation bundle carries no attestations";
+  const crypto = await import("node:crypto");
+  let lastReason = "no attestation carried a readable DSSE envelope";
+  for (const entry of list) {
+    const env = readEnvelope(entry);
+    if (env === null) continue;
+    let cert;
+    try {
+      cert = new crypto.X509Certificate(env.certDer);
+    } catch {
+      lastReason = "the signing certificate could not be parsed";
+      continue;
+    }
+    const san = cert.subjectAltName ?? "";
+    if (!san_names_workflow(san)) {
+      lastReason = `the signing certificate names ${san === "" ? "no identity" : san}, not ${SAN_WORKFLOW_MARKER}`;
+      continue;
+    }
+    let ok = false;
+    try {
+      ok = crypto.verify(null, dssePae(env.payloadType, env.payload), cert.publicKey, env.sig);
+    } catch {
+      ok = false;
+    }
+    if (!ok) {
+      lastReason = "the DSSE signature does not verify against the certificate in the bundle";
+      continue;
+    }
+    let verified = null;
+    try {
+      verified = asRecord(JSON.parse(env.payload.toString("utf8")));
+    } catch {
+      verified = null;
+    }
+    if (!payload_names_publish(verified)) {
+      lastReason = "the signed payload does not name this package's publish workflow";
+      continue;
+    }
+    return null;
+  }
+  return lastReason;
+}
+
+// src/scripts/_lib/unattended_gates.ts
+var UNATTENDED_MIN_RELEASE_AGE_HOURS = 72;
+function asRecord2(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v) ? v : null;
+}
+function read_candidate(packument) {
+  const doc = asRecord2(packument);
+  const version = asRecord2(doc?.["dist-tags"])?.["latest"];
+  if (typeof version !== "string" || version === "") return null;
+  const manifest = asRecord2(asRecord2(doc?.["versions"])?.[version]);
+  if (manifest === null) return null;
+  const published = asRecord2(doc?.["time"])?.[version];
+  const attestations = asRecord2(asRecord2(manifest["dist"])?.["attestations"]);
+  const predicate = asRecord2(attestations?.["provenance"])?.["predicateType"];
+  return {
+    version,
+    publishedAt: typeof published === "string" ? published : null,
+    deprecated: manifest["deprecated"],
+    engines: manifest["engines"],
+    provenance: typeof predicate === "string" && predicate.startsWith("https://slsa.dev/provenance/"),
+    impactMap: asRecord2(manifest["agentConfig"])?.["impact"] ?? null,
+    attestationsUrl: typeof attestations?.["url"] === "string" ? attestations["url"] : null
+  };
+}
+function unattended_decision(input) {
+  if (input.skipped.includes(input.candidate.version)) {
+    return { install: false, reasons: [`${input.candidate.version} is on the skip list`] };
+  }
+  const verdict = classifyUpdate({
+    installed: input.installed,
+    candidate: input.candidate.version,
+    origin: input.origin,
+    env: { ...input.env, interactive: true },
+    impactMap: input.candidate.impactMap,
+    engines: input.candidate.engines,
+    publishedAt: input.candidate.publishedAt,
+    deprecated: input.candidate.deprecated,
+    provenance: input.candidate.provenance,
+    settings: { mode: "auto", projectPin: null, minReleaseAgeHours: UNATTENDED_MIN_RELEASE_AGE_HOURS }
+  });
+  return verdict.action === "auto" ? { install: true, reasons: verdict.reasons } : { install: false, reasons: verdict.reasons };
+}
+
+// src/scripts/_cli/upgrade_unattended.ts
+var PACKAGE_NAME = "@event4u/agent-config";
+var PACKUMENT_URL = `https://registry.npmjs.org/${PACKAGE_NAME}`;
+var LOCK_TTL_MS = 30 * 60 * 1e3;
+var EXIT_REFUSED = 3;
+var EXIT_RESTORE_FAILED = 4;
+var LOCK_FILE = "upgrade-unattended.lock";
+var SKIP_FILE = "upgrade-skip.json";
+var ACTIVATION_BLOCKED = "swapping the global install under a running session breaks its hooks \u2014 a session is live on this machine right now; run `agent-config upgrade` yourself once none is open";
+function activation_blocked_reason(env) {
+  return any_live_session(global_register_dir(env)) ? ACTIVATION_BLOCKED : null;
+}
+var PREFIX = "agent-config upgrade --unattended";
+function say(sink, line) {
+  sink.write(line + "\n");
+}
+function read_skips(skipPath) {
+  try {
+    const data = JSON.parse(fs.readFileSync(skipPath, "utf-8"));
+    const list = data?.skip;
+    return Array.isArray(list) ? list.filter((v) => typeof v === "string") : [];
+  } catch {
+    return [];
+  }
+}
+function record_skip(skipPath, version) {
+  const skips = read_skips(skipPath);
+  if (!skips.includes(version)) skips.push(version);
+  fs.mkdirSync(path.dirname(skipPath), { recursive: true });
+  fs.writeFileSync(skipPath, JSON.stringify({ skip: skips.sort() }, null, 2) + "\n", "utf-8");
+}
+function read_text(p) {
+  try {
+    return fs.readFileSync(p, "utf-8");
+  } catch {
+    return null;
+  }
+}
+function acquire_lock(deps) {
+  const record = { pid: deps.pid, started_at: deps.now().toISOString(), ttl_ms: LOCK_TTL_MS };
+  const mine = `${deps.lockPath}.${deps.pid}.${process.hrtime.bigint()}`;
+  try {
+    fs.mkdirSync(path.dirname(deps.lockPath), { recursive: true });
+    fs.writeFileSync(mine, JSON.stringify(record) + "\n", { flag: "wx" });
+  } catch (exc) {
+    return `cannot write the lock: ${String(exc)}`;
+  }
+  try {
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+      try {
+        fs.linkSync(mine, deps.lockPath);
+        return null;
+      } catch (exc) {
+        if (exc.code !== "EEXIST") return `cannot write the lock: ${String(exc)}`;
+      }
+      const judged = read_text(deps.lockPath);
+      let held = {};
+      try {
+        held = JSON.parse(judged ?? "");
+      } catch {
+      }
+      if (typeof held.pid === "number" && deps.isAlive(held.pid)) {
+        const age = deps.now().getTime() - Date.parse(String(held.started_at));
+        const overdue = age >= (held.ttl_ms ?? LOCK_TTL_MS) ? ` for longer than its ${LOCK_TTL_MS / 6e4} min TTL` : "";
+        return `another unattended upgrade holds the lock (pid ${held.pid})${overdue}`;
+      }
+      const tomb = `${mine}.stale`;
+      try {
+        fs.renameSync(deps.lockPath, tomb);
+      } catch {
+        continue;
+      }
+      if (read_text(tomb) !== judged) {
+        try {
+          fs.linkSync(tomb, deps.lockPath);
+        } catch {
+        }
+        fs.rmSync(tomb, { force: true });
+        return "another unattended upgrade took the lock over first";
+      }
+      fs.rmSync(tomb, { force: true });
+    }
+    return "the lock could not be taken";
+  } finally {
+    fs.rmSync(mine, { force: true });
+  }
+}
+function release_lock(deps) {
+  try {
+    const held = JSON.parse(fs.readFileSync(deps.lockPath, "utf-8"));
+    if (held.pid === deps.pid) fs.unlinkSync(deps.lockPath);
+  } catch {
+  }
+}
+function install_steps(version, deps) {
+  return [
+    ["npm", "install", "-g", `${PACKAGE_NAME}@${version}`],
+    [deps.agentConfigBin, "global", "--no-ui"],
+    ...deps.globalSettings.map((target) => [deps.agentConfigBin, "settings:sync", "--path", target])
+  ];
+}
+function run_steps(steps, deps, honourSignal = true) {
+  for (const cmd of steps) {
+    say(deps.out, "\u2192 " + cmd.join(" "));
+    const result = deps.run(cmd);
+    if (result.rc !== 0) return { ok: false, cmd, result };
+    if (honourSignal && deps.interrupted()) return { ok: false, cmd, result: { rc: 143, stderr: "SIGTERM received" } };
+  }
+  return { ok: true };
+}
+function restore(previous, deps) {
+  const back = run_steps(install_steps(previous, deps).slice(0, 2), deps, false);
+  const lock = deps.readInstalled();
+  const binary = deps.readBinary();
+  if (back.ok && lock === previous && binary === previous) {
+    say(deps.err, `${PREFIX}: restored ${previous}. Run \`agent-config upgrade\` to retry by hand.`);
+    return 1;
+  }
+  say(
+    deps.err,
+    `\u274C  ${PREFIX}: the restore did not reach ${previous} (installed.lock: ${lock || "unknown"}, binary: ${binary || "unreadable"}). Run \`npm install -g ${PACKAGE_NAME}@${previous}\` then \`agent-config global --no-ui\`.`
+  );
+  return EXIT_RESTORE_FAILED;
+}
+async function decide(installed, deps) {
+  const fetched = await deps.fetchPackument();
+  if (!fetched.ok) return { refused: [`registry unavailable: ${fetched.reason}`] };
+  const candidate = read_candidate(fetched.doc);
+  if (candidate === null) return { refused: ["registry document carries no latest version"] };
+  const decision = unattended_decision({
+    installed,
+    candidate,
+    origin: deps.origin,
+    skipped: read_skips(deps.skipPath),
+    env: { ...deps.env, now: deps.now().toISOString() }
+  });
+  if (!decision.install) return { refused: [...decision.reasons] };
+  const provenance = await deps.verifyProvenance(candidate);
+  if (provenance !== null) return { refused: [provenance] };
+  return { candidate };
+}
+async function verify_provenance_default(candidate, fetch_impl = fetch, timeoutMs = 1e4) {
+  if (candidate.attestationsUrl === null) {
+    return `${candidate.version} carries no attestation bundle to verify`;
+  }
+  let origin;
+  try {
+    origin = new URL(candidate.attestationsUrl).origin;
+  } catch {
+    origin = "";
+  }
+  if (origin !== new URL(PACKUMENT_URL).origin) {
+    return `${candidate.version}: attestation url is not on ${new URL(PACKUMENT_URL).origin}`;
+  }
+  let doc;
+  try {
+    const resp = await fetch_impl(candidate.attestationsUrl, {
+      signal: AbortSignal.timeout(timeoutMs),
+      headers: { accept: "application/json" },
+      redirect: "error"
+    });
+    if (!resp.ok) return `attestation fetch failed: HTTP ${resp.status}`;
+    doc = await resp.json();
+  } catch (err) {
+    return `attestation fetch failed: ${err instanceof Error ? err.message : String(err)}`;
+  }
+  if (!provenance_matches_publish(doc)) {
+    const named = attestation_workflow_ref(doc);
+    return named === null ? `${candidate.version} has no readable provenance workflow in its attestation` : `${candidate.version} was built by ${named}, not ${EXPECTED_WORKFLOW_REF}`;
+  }
+  const signature = await verify_attestation_signature(doc);
+  if (signature !== null) return `${candidate.version}: ${signature}`;
+  return null;
+}
+function quiet_context(deps) {
+  if (deps.env.ci) return "suppressed: CI";
+  if (deps.env.noUpdateCheck) return "suppressed: AGENT_CONFIG_NO_UPDATE_CHECK=1";
+  if (deps.origin === "source-checkout") return "suppressed: source checkout";
+  return null;
+}
+async function run_unattended(deps) {
+  const quiet = quiet_context(deps);
+  if (quiet !== null) {
+    say(deps.out, `\u2139\uFE0F  ${PREFIX}: not installing \u2014 ${quiet}.`);
+    return EXIT_REFUSED;
+  }
+  const previous = deps.readInstalled();
+  if (previous === "") {
+    say(deps.err, `${PREFIX}: not installing \u2014 the installed version is unknown, so nothing could be restored.`);
+    return EXIT_REFUSED;
+  }
+  const locked = acquire_lock(deps);
+  if (locked !== null) {
+    say(deps.err, `${PREFIX}: not installing \u2014 ${locked}.`);
+    return EXIT_REFUSED;
+  }
+  try {
+    const verdict = await decide(previous, deps);
+    if ("refused" in verdict) {
+      say(deps.out, `\u2139\uFE0F  ${PREFIX}: not installing (installed: ${previous}) \u2014 ${verdict.refused.join("; ")}.`);
+      return EXIT_REFUSED;
+    }
+    const target = verdict.candidate.version;
+    const steps = install_steps(target, deps);
+    if (deps.activationBlocked !== null) {
+      const how = deps.dryRun ? "dry run: a real run would not install" : "not installing";
+      say(deps.out, `\u2139\uFE0F  ${PREFIX}: every gate passed for ${target}, but ${how} \u2014 ${deps.activationBlocked}.`);
+      return EXIT_REFUSED;
+    }
+    if (deps.dryRun) {
+      say(deps.out, `${PREFIX} \u2014 dry run, every gate passed for ${target}; would execute:`);
+      for (const cmd of steps) say(deps.out, "  " + cmd.join(" "));
+      return 0;
+    }
+    const ran = run_steps(steps, deps);
+    if (ran.ok) {
+      say(deps.out, `\u2705  agent-config upgraded unattended: ${previous} \u2192 ${target}.`);
+      return 0;
+    }
+    const what = `${ran.cmd.join(" ")} (exit ${ran.result.rc})`;
+    if (/\bEACCES\b/.test(ran.result.stderr)) {
+      say(
+        deps.err,
+        `\u274C  ${PREFIX}: permission denied on ${what}. agent-config never runs sudo; run this yourself with the right permissions: ${ran.cmd.join(" ")}`
+      );
+      const untouched = ran.cmd === steps[0] && deps.readInstalled() === previous && deps.readBinary() === previous;
+      if (untouched) return 1;
+      return restore(previous, deps);
+    }
+    say(deps.err, `\u274C  ${PREFIX}: step failed: ${what} \u2014 restoring ${previous}.`);
+    return restore(previous, deps);
+  } finally {
+    release_lock(deps);
+  }
+}
+async function fetch_packument(fetch_impl = fetch, timeoutMs = 1e4) {
+  try {
+    const resp = await fetch_impl(PACKUMENT_URL, {
+      headers: { Accept: "application/json", "User-Agent": "agent-config-upgrade-unattended" },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!resp.ok) return { ok: false, reason: `HTTP ${resp.status}` };
+    return { ok: true, doc: await resp.json() };
+  } catch (exc) {
+    return { ok: false, reason: exc instanceof Error ? exc.message : String(exc) };
+  }
+}
+function default_run(cmd, err) {
+  const r = spawnSync(cmd[0], cmd.slice(1), { stdio: ["ignore", "inherit", "pipe"], encoding: "utf-8" });
+  const stderr = r.stderr ?? "";
+  if (stderr) err.write(stderr);
+  if (r.error) return { rc: 127, stderr: stderr + String(r.error) };
+  return { rc: r.status ?? (r.signal === "SIGTERM" ? 143 : 1), stderr };
+}
+function is_alive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (exc) {
+    return exc.code === "EPERM";
+  }
+}
+function running_origin() {
+  return originForPackageRoot(resolvePackageRoot(import.meta.url));
+}
+function skip_version(version, out) {
+  record_skip(write_target(SKIP_FILE), version);
+  say(out, `\u2139\uFE0F  agent-config upgrade --unattended will never install ${version}.`);
+  return 0;
+}
+async function run_unattended_default(options) {
+  const globalSettings = path.join(event4u_root(), "settings", ".agent-settings.yml");
+  const packageJson = path.join(resolvePackageRoot(import.meta.url), "package.json");
+  let terminated = false;
+  const onTerm = () => {
+    terminated = true;
+  };
+  process.on("SIGTERM", onTerm);
+  try {
+    return await run_unattended_wired(options, globalSettings, packageJson, () => terminated);
+  } finally {
+    process.off("SIGTERM", onTerm);
+  }
+}
+function run_unattended_wired(options, globalSettings, packageJson, interrupted) {
+  return run_unattended({
+    readBinary: () => {
+      try {
+        const v = JSON.parse(fs.readFileSync(packageJson, "utf-8")).version;
+        return typeof v === "string" ? v : "";
+      } catch {
+        return "";
+      }
+    },
+    interrupted,
+    fetchPackument: () => fetch_packument(),
+    verifyProvenance: (c) => verify_provenance_default(c),
+    run: (cmd) => default_run(cmd, options.err),
+    readInstalled: () => {
+      const v = read_lockfile()?.agent_config_version;
+      return typeof v === "string" ? v.trim().replace(/^v+/, "") : "";
+    },
+    origin: running_origin(),
+    agentConfigBin: options.agentConfigBin,
+    globalSettings: fs.existsSync(globalSettings) ? [globalSettings] : [],
+    lockPath: write_target(LOCK_FILE),
+    skipPath: write_target(SKIP_FILE),
+    env: {
+      ci: !["", "0", "false"].includes((process.env["CI"] ?? "").trim().toLowerCase()),
+      noUpdateCheck: process.env["AGENT_CONFIG_NO_UPDATE_CHECK"] === "1",
+      nodeVersion: process.version
+    },
+    now: () => /* @__PURE__ */ new Date(),
+    pid: process.pid,
+    isAlive: is_alive,
+    dryRun: options.dryRun,
+    activationBlocked: activation_blocked_reason(),
+    out: options.out,
+    err: options.err
+  });
+}
+export {
+  ACTIVATION_BLOCKED,
+  EXIT_REFUSED,
+  EXIT_RESTORE_FAILED,
+  LOCK_FILE,
+  LOCK_TTL_MS,
+  PACKAGE_NAME,
+  PACKUMENT_URL,
+  SKIP_FILE,
+  acquire_lock,
+  activation_blocked_reason,
+  default_run,
+  fetch_packument,
+  is_alive,
+  originForPackageRoot,
+  read_skips,
+  record_skip,
+  run_unattended,
+  run_unattended_default,
+  skip_version,
+  verify_provenance_default
+};