@jwilleke/ngdpbase-types 5.35.0 → 5.36.0

package/lib/src/ice/ledger.d.ts

@@ -1,5 +1,13 @@
 import type { IceLedger, LedgerFileEntry } from './types.js';
+/**
+ * The ledger file form (#2013). A scope is bound to its receiver and user
+ * (`boundScope`); a file without this form was written before that binding,
+ * under a scope any caller could name, so it belongs to nobody: it is read
+ * as empty, never as anyone's history, and its files are imported once more.
+ */
+export declare const LEDGER_FORM = 2;
 interface ScopeFile {
+    form?: number;
     scope: string;
     files: LedgerFileEntry[];
     items: string[];

package/lib/src/ice/runImport.d.ts

@@ -21,8 +21,24 @@ export interface IceRunDeps {
 }
 /** The id of the receiver that keeps an original when the chosen receiver does not keep its own (D11). */
 export declare const FILES_RECEIVER = "core.files";
-/** The scope a run's fingerprints are checked in, unless the caller names one. */
-export declare function defaultScope(receiverId: string, ctx: ActorContext): string;
+/**
+ * The engine's key for an item of a file it stored, so a retry of that file
+ * skips it (#2010): the file's fingerprint, the chain, and a hash of the
+ * item's content (kind, text, data, bytes). Never its position: a shim that
+ * changes or orders its output differently cannot make a retry skip the
+ * wrong item. `seen` is how many identical items came before it in this file.
+ */
+export declare function itemKeyOf(sha256: string, chain: string[], item: IceItem, seen: number): string;
+/** The form of a bound scope (#2013). Scopes written before it never match one. */
+export declare const SCOPE_FORM = "ice2";
+/**
+ * The scope a run's fingerprints, per-file status and item keys live in
+ * (#2013): bound to the receiver and to the user the run is for, by their
+ * identity `@id` (else their username, #2041). The engine works it out from
+ * the caller's context; a request cannot name another user's. A caller's own
+ * `sub` (phr's source id) narrows it within that user's scope, never outside.
+ */
+export declare function boundScope(receiverId: string, owner: string, sub?: string): string;
 export interface ChainLeaf {
     item: IceItem;
     chain: string[];

package/lib/src/ice/types.d.ts

@@ -201,7 +201,13 @@ export interface IceReceiver {
     label?: string;
     /** The kinds it takes, e.g. `['ncm']`, `['file']`, `['phr.health-record']`. */
     accepts: IceKind[];
-    /** May this context use this receiver? Its existing permission — the import screen shows only these (D5). */
+    /**
+     * May this context use this receiver? Its existing permission (D5). The
+     * import screen shows only these, and the engine asks it before any work
+     * of a run (#2012): a no refuses every file before anything is unpacked,
+     * read by a shim, kept or fetched. Answer no whenever `receive` would
+     * refuse this context outright; `receive` still checks each item.
+     */
     mayUse(ctx: ActorContext): Promise<boolean>;
     /** Hand one item to the receiver's own door. */
     receive(item: IceItem, ctx: ActorContext, info: ReceiveInfo): Promise<ReceiveOutcome>;
@@ -252,10 +258,13 @@ export interface IceRunRequest {
     /** D11. Default `ngdpbase.import.engine.default-original`. */
     original?: OriginalChoice;
     /**
-     * Whose fingerprints and item keys this run is checked against. Default
-     * `<receiver>/<username>`: the same file imported again by the same person
-     * into the same receiver is skipped. A caller with its own notion of a
-     * source (phr's source id) passes it.
+     * A narrower ledger scope within the caller's own (#2013). The engine binds
+     * every run's scope to the receiver and to the user it runs as (their
+     * identity `@id`, else their username): the same file imported again by
+     * the same user into the same receiver is skipped. A caller with its own
+     * notion of a source (phr's source id) passes it to keep those apart; it
+     * can never reach another user's or another receiver's scope. Never pass a
+     * value a client sent.
      */
     scope?: string;
 }

package/lib/src/managers/AddonsManager.d.ts

@@ -12,6 +12,7 @@
  */
 import { type ActorContext } from '../context/ActorContext.js';
 import type { BackupFolder } from './BaseManager.js';
+import { type UpdateCheck, type UpdateOutcome } from '../utils/addonInstaller.js';
 import BaseManager from './BaseManager.js';
 import type { BackupData } from './BaseManager.js';
 import type { WikiEngine } from '../types/WikiEngine.js';
@@ -302,6 +303,9 @@ export interface AddonDashboardCard {
     /** URL of the add-on's admin page */
     adminUrl: string;
 }
+/** #2100: the PDP refused an administrator's add-on Update or Check. */
+export declare class AddonUpdateForbiddenError extends Error {
+}
 /**
  * Status information returned by getStatus()
  */
@@ -344,6 +348,10 @@ declare class AddonsManager extends BaseManager {
     private installedDir;
     /** #1830: the installed add-ons verified this boot — the only ones loaded from `installedDir`. */
     private verifiedInstalled;
+    /** #2100: installed add-ons this start switched to an Update's release; settled after the load pass. */
+    private updatedThisStart;
+    /** #2100: Updates run one at a time, so two never write the lock file at once. */
+    private updateQueue;
     /** Stylesheets registered by add-ons via registerStylesheet() */
     private registeredStylesheets;
     /** Dashboard cards registered by add-ons via registerDashboardCard() */
@@ -374,6 +382,14 @@ declare class AddonsManager extends BaseManager {
      * this boot, not the next.
      */
     private installConfiguredAddons;
+    /**
+     * The installer's options for this site (#1830, #2100): the registry and the
+     * limits from configuration, and every request — registry, attestations, the
+     * Sigstore TUF repository — through the guarded client and the egress policy
+     * (#1139). `timeoutKey` is the `…install.<key>` that bounds each request: the
+     * boot install's, or the shorter one an admin page waits on.
+     */
+    private installerOptions;
     /**
      * `addon-install` (#1830): written after every check passed and before
      * anything is written to disk. on-failure: refuse — code does not join the
@@ -381,6 +397,47 @@ declare class AddonsManager extends BaseManager {
      * (recordSystemAction throws, and the installer writes nothing).
      */
     private recordAddonInstall;
+    /**
+     * #2100: after the load pass, settle each add-on this start switched to an
+     * Update's release. Loaded (or switched off, so there was nothing to try):
+     * the previous release's folder and tarball go. Not loaded: the previous
+     * release is restored on disk and in the lock, so the next start runs it.
+     * Core cannot unload an add-on that failed half-way (its modules, routes and
+     * jobs stay), so the restored release is not loaded in this process.
+     */
+    private settleUpdatedAddons;
+    /**
+     * `addon-update` (#2100) for a fall-back: core moved an installed add-on back
+     * from `from` to `to` because `from` did not load. on-failure: continue for
+     * this record — the fall-back has already happened on disk, and a lost
+     * record must not undo it.
+     */
+    private recordFallback;
+    /** #2100: the door for the admin's add-on questions. Throws when the PDP refuses. */
+    private requireAddonPermission;
+    /**
+     * #2100: for each add-on in `ngdpbase.addons.install`, the pinned release,
+     * the configured range, and the newest release in it that is newer — asked
+     * of the registry now. Called when an administrator opens the add-ons page
+     * or presses Check; never at start. Registry unreachable is an answer
+     * (`registryUnreachable`), not an error.
+     */
+    checkInstalledUpdates(ctx: ActorContext): Promise<UpdateCheck[]>;
+    /**
+     * #2100: an administrator's Update. Downloads `version` of the installed
+     * add-on `slug`, checks it exactly as a first install is checked (sha512,
+     * provenance, contents, `ngdpbase.minVersion`) and stages it: it runs from
+     * the next start. Asks the PDP for `config-manage`. Recorded as
+     * `addon-update` (who, the add-on, from and to) before anything is written;
+     * a record that cannot be written stops the Update.
+     */
+    updateInstalledAddon(ctx: ActorContext, slug: string, version: string): Promise<UpdateOutcome>;
+    /**
+     * `addon-update` (#2100): an administrator's Update, written after every
+     * check passed and before anything is written to disk. on-failure: refuse —
+     * a record that cannot be written stops the Update.
+     */
+    private recordAddonUpdate;
     /**
      * `addon-verify-failed` (#1830): an integrity, provenance, tarball, manifest,
      * lock or folder check refused (or, for a repaired folder, found it changed).

package/lib/src/managers/ImportManager.d.ts

@@ -382,6 +382,18 @@ declare class ImportManager extends BaseManager {
     importRunsFor(ctx: ActorContext): IceRunReport[];
     /** Use this ledger instead of the file one: a test's, or a database table's. */
     setImportLedger(ledger: IceLedger): void;
+    /**
+     * The ledger scope a run uses (#2013): bound to the receiver and to the user
+     * `ctx` names, by their identity `@id`; their username only when the
+     * identity store answers that there is no record for them (#2041). Never a
+     * scope the caller names: a request's `scope` only narrows within this
+     * user's own.
+     *
+     * @throws IdentityStoreUnavailableError when the identity store cannot
+     *   answer: the run does not start, and nothing is recorded, rather than
+     *   land in a scope the user's other runs do not use
+     */
+    private importScope;
     private newRunReport;
     private executeRun;
     /** What a run, or keeping at upload, works with. */

package/lib/src/utils/addonInstaller.d.ts

@@ -85,6 +85,12 @@ export type InstallStatus =
  | 'verified'
 /** Already installed; the folder differed from its verified tarball and was rewritten. */
  | 'repaired'
+/**
+ * #2100: switched to the release an administrator's Update staged; the
+ * previous release is kept until AddonsManager confirms this one loaded
+ * ({@link confirmUpdate}) or falls back to it ({@link rollBackUpdate}).
+ */
+ | 'updated'
 /** Not installed (and not loaded); `reason` says why. */
  | 'skipped';
 /** Which verification refused, for `addon-verify-failed`. */
@@ -99,6 +105,20 @@ export interface InstallOutcome {
     registryUnreachable?: boolean;
     /** Set when a verification refused, or (for `repaired`) found the folder changed. */
     failedCheck?: FailedCheck;
+    /** For `updated`: the release it replaced. */
+    previousVersion?: string;
+    /**
+     * #2100: a switch an earlier start made and never confirmed (the new release
+     * did not load, or the process stopped before it could) was undone at this
+     * start, before anything loaded: `from` is the release given up, `to` the
+     * one restored.
+     */
+    rolledBack?: {
+        from: string;
+        to: string;
+    };
+    /** #2100: something admins should hear about a staged Update, such as one discarded. */
+    notice?: string;
 }
 /** `sha512-<base64>` of `data`. */
 export declare function sha512Integrity(data: Buffer): string;
@@ -107,3 +127,73 @@ export declare function sha512Integrity(data: Buffer): string;
  * Never throws for one add-on's problem: each outcome says what happened.
  */
 export declare function installConfiguredAddons(specs: Record<string, unknown>, opts: InstallerOptions): Promise<InstallOutcome[]>;
+/**
+ * The switched-to release loaded (or the add-on is off, so there is nothing to
+ * try): the previous release's folder and tarball go. No-op when nothing waits.
+ */
+export declare function confirmUpdate(addonsDir: string, slug: string): Promise<void>;
+/**
+ * The switched-to release did not load: restore the previous release on disk
+ * and in the lock, so the next start runs it. The new folder is set aside
+ * (`.rejected-…`) for inspection. Undefined when there is nothing to undo.
+ */
+export declare function rollBackUpdate(addonsDir: string, slug: string, now?: Date): Promise<{
+    from: string;
+    to: string;
+} | undefined>;
+/** Why an Update is refused while the last one is not settled (`previous` still in the lock). */
+export declare const FINISH_LAST_UPDATE = "finish the last update first: restart the site";
+/** What the admin page shows for one add-on in `ngdpbase.addons.install`. */
+export interface UpdateCheck {
+    slug: string;
+    package?: string;
+    /** The configured range (`version` in the entry). */
+    range?: string;
+    /** The release the lock pins: what runs. Absent when not installed. */
+    pinned?: string;
+    /** A release an Update downloaded, used from the next start. */
+    pending?: string;
+    /** The newest release in the range, whether or not this core can run it. */
+    newest?: string;
+    /** The newest release in the range, newer than what is pinned or staged, that this core can run: what Update installs. */
+    available?: string;
+    /** The newest release in the range, newer than what is pinned or staged, when it needs a newer ngdpbase. */
+    needsCore?: {
+        version: string;
+        minVersion: string;
+    };
+    registryUnreachable?: boolean;
+    /** Why there is nothing to compare: not installed, or a configuration problem. */
+    problem?: string;
+    /** The last update is not settled (the lock still names the release it replaced): no Update until a restart. */
+    blocked?: string;
+}
+/**
+ * Ask the registry, for every installed add-on, which releases in its range
+ * are newer than the one pinned. Reads the packument only; writes nothing.
+ * Called only when an administrator opens the add-ons page or presses Check,
+ * never at start.
+ */
+export declare function checkForUpdates(specs: Record<string, unknown>, opts: InstallerOptions): Promise<UpdateCheck[]>;
+/** What an Update did. */
+export interface UpdateOutcome {
+    slug: string;
+    /** `staged`: verified and downloaded; it runs from the next start. `refused`: nothing changed; `reason` says why. */
+    status: 'staged' | 'refused';
+    package?: string;
+    version?: string;
+    /** The release that runs until the next start. */
+    previousVersion?: string;
+    reason?: string;
+    registryUnreachable?: boolean;
+    failedCheck?: FailedCheck;
+}
+/**
+ * Download `version` of an installed add-on and stage it for the next start
+ * (#2100). It must be a release in the configured range, newer than the
+ * pinned one, that this core can run, and it passes the same checks as a
+ * first install ({@link fetchVerified}): sha512, provenance, contents,
+ * package.json. `beforeInstall` (the audit record) runs after the checks and
+ * before anything is written. The running add-on's folder is not touched.
+ */
+export declare function stageUpdate(slug: string, rawSpec: unknown, version: string, opts: InstallerOptions): Promise<UpdateOutcome>;

package/lib/src/utils/addonLock.d.ts

@@ -7,9 +7,8 @@
  * folders in `<data>/addons` are installed add-ons at all: a folder the lock
  * does not name is never an add-on, whatever it contains.
  */
-/** What the lock records for one installed add-on. */
-export interface LockEntry {
-    package: string;
+/** One verified release of an add-on: what it is and what it was accepted on. */
+export interface PinnedVersion {
     version: string;
     integrity: string;
     installedAt: string;
@@ -19,6 +18,23 @@ export interface LockEntry {
         verifiedAt: string;
     };
 }
+/** What the lock records for one installed add-on. */
+export interface LockEntry extends PinnedVersion {
+    package: string;
+    /**
+     * #2100: a newer release an administrator's Update downloaded and verified.
+     * Its tarball waits in `.packages/`; the next start switches to it. Nothing
+     * else reads it, so until then the site runs `version`.
+     */
+    pending?: PinnedVersion;
+    /**
+     * #2100: the release this one replaced at the start that switched to it,
+     * kept (its folder as `.previous-<slug>`, its tarball in `.packages/`) until
+     * this one has loaded. Present at a later start only when that start never
+     * confirmed the switch, so the installer falls back to it.
+     */
+    previous?: PinnedVersion;
+}
 export interface LockFile {
     lockfileVersion: 1;
     addons: Record<string, LockEntry>;
@@ -26,6 +42,8 @@ export interface LockFile {
 export declare const LOCK_FILE_NAME = "addons-lock.json";
 /** Verified tarballs, kept so a restart needs no registry. Dot-named: discovery skips it. */
 export declare const PACKAGES_DIR_NAME = ".packages";
+/** #2100: the folder a switched-from release waits in until the new one has loaded. Dot-named: discovery skips it. */
+export declare const PREVIOUS_DIR_PREFIX = ".previous-";
 export declare function lockFilePath(addonsDir: string): string;
 /** The lock file, or an empty one when there is none. Throws when it exists and is not JSON. */
 export declare function readLockSync(addonsDir: string): LockFile;

package/lib/src/utils/addonLock.js

@@ -12,6 +12,8 @@ import path from 'path';
 export const LOCK_FILE_NAME = 'addons-lock.json';
 /** Verified tarballs, kept so a restart needs no registry. Dot-named: discovery skips it. */
 export const PACKAGES_DIR_NAME = '.packages';
+/** #2100: the folder a switched-from release waits in until the new one has loaded. Dot-named: discovery skips it. */
+export const PREVIOUS_DIR_PREFIX = '.previous-';
 export function lockFilePath(addonsDir) {
     return path.join(addonsDir, LOCK_FILE_NAME);
 }

package/lib/src/utils/auditEventNames.generated.d.ts

@@ -4,7 +4,7 @@ export declare const AUDIT_EVENT_NAME_PATTERN: RegExp;
 export declare const AUDIT_EVENT: {
     /** An add-on named in ngdpbase.addons.install installed into the data folder: package, version, sha512 and the repository its provenance names; recorded before it is written, which cannot proceed without it (#1830) */
     readonly ADDON_INSTALL: "addon-install";
-    /** An installed add-on moved to another version by an administrator's Update: who, and from which version to which (#1830; the Update action is not built yet) */
+    /** The release an installed add-on runs changed: an administrator's Update (who, the add-on, from and to version), recorded before the release is written, which cannot proceed without it; or core falling back to the previous release because the new one did not load (#2100) */
     readonly ADDON_UPDATE: "addon-update";
     /** An add-on refused or set aside by a check: its sha512, provenance, tarball contents, package.json, the lock file, or a changed installed folder (#1830) */
     readonly ADDON_VERIFY_FAILED: "addon-verify-failed";

package/lib/src/utils/auditEventNames.generated.js

@@ -11,7 +11,7 @@ export const AUDIT_EVENT_NAME_PATTERN = /^[a-z]+(-[a-z]+)+$/;
 export const AUDIT_EVENT = {
     /** An add-on named in ngdpbase.addons.install installed into the data folder: package, version, sha512 and the repository its provenance names; recorded before it is written, which cannot proceed without it (#1830) */
     ADDON_INSTALL: 'addon-install',
-    /** An installed add-on moved to another version by an administrator's Update: who, and from which version to which (#1830; the Update action is not built yet) */
+    /** The release an installed add-on runs changed: an administrator's Update (who, the add-on, from and to version), recorded before the release is written, which cannot proceed without it; or core falling back to the previous release because the new one did not load (#2100) */
     ADDON_UPDATE: 'addon-update',
     /** An add-on refused or set aside by a check: its sha512, provenance, tarball contents, package.json, the lock file, or a changed installed folder (#1830) */
     ADDON_VERIFY_FAILED: 'addon-verify-failed',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jwilleke/ngdpbase-types",
-  "version": "5.35.0",
+  "version": "5.36.0",
   "description": "TypeScript types for ngdpbase add-ons, and a test kit of core's own values. A dev dependency, versioned with ngdpbase.",
   "license": "Apache-2.0",
   "author": "Jim Willeke",