@knowzai/cli 0.4.0 → 0.5.1

package/dist/lib/runtime-backup-archive.js

@@ -0,0 +1,269 @@
+import { createReadStream, rmSync, statSync } from 'node:fs';
+import { createPrivateTempDirectory, ensurePrivateDirectory } from '@knowzai/core';
+import { createHash } from 'node:crypto';
+import { createGunzip } from 'node:zlib';
+import { join, resolve } from 'node:path';
+import { tmpdir } from 'node:os';
+import { KnowzError, ExitCode } from '@knowzai/core';
+import { BACKUP_ARTIFACTS, decryptStream, parseAndValidateManifest } from './platform-backup.js';
+export const SELFHOSTED_BACKUP_ARTIFACTS = [
+    'pg/knowz_selfhosted.dump',
+    'volumes/knowz-file-storage.tar.gz',
+    'volumes/knowz-protected-keys.tar.gz',
+    'runtime/.env',
+    'runtime/state.json',
+];
+export const MAX_BACKUP_BYTES = 100 * 1024 ** 3;
+const allowed = new Set([
+    'manifest.json',
+    ...BACKUP_ARTIFACTS,
+    ...SELFHOSTED_BACKUP_ARTIFACTS,
+]);
+const invalid = (message) => {
+    throw new KnowzError(message, ExitCode.Usage);
+};
+/** Bounded streaming ustar intake. No paths are extracted until names, types, declared sizes and all hashes pass. */
+async function scanArchive(path, volume = false) {
+    const entries = {};
+    let buffer = Buffer.alloc(0);
+    let left = 0;
+    let padding = 0;
+    let total = 0;
+    let decompressedBytes = 0;
+    let headers = 0;
+    let entryCount = 0;
+    let name = '';
+    let hash = createHash('sha256');
+    let manifestBytes = [];
+    let manifestText = '';
+    let end = false;
+    let pax = false;
+    let paxChunks = [];
+    let paxPath;
+    const stream = createReadStream(path).pipe(createGunzip());
+    for await (const raw of stream) {
+        decompressedBytes += raw.length;
+        if (decompressedBytes > MAX_BACKUP_BYTES)
+            invalid('Backup decompression exceeds the 100 GiB limit.');
+        buffer = Buffer.concat([buffer, raw]);
+        while (buffer.length) {
+            if (left) {
+                const n = Math.min(left, buffer.length);
+                const chunk = buffer.subarray(0, n);
+                hash.update(chunk);
+                if (pax)
+                    paxChunks.push(chunk);
+                else if (!volume && name === 'manifest.json')
+                    manifestBytes.push(chunk);
+                buffer = buffer.subarray(n);
+                left -= n;
+                if (left)
+                    continue;
+                if (pax) {
+                    const data = Buffer.concat(paxChunks);
+                    let cursor = 0;
+                    while (cursor < data.length) {
+                        const space = data.indexOf(32, cursor);
+                        if (space < 0)
+                            invalid('Invalid PAX metadata.');
+                        const length = Number(data.subarray(cursor, space).toString());
+                        if (!Number.isSafeInteger(length) ||
+                            length <= space - cursor + 1 ||
+                            cursor + length > data.length)
+                            invalid('Invalid PAX record size.');
+                        const record = data.subarray(space + 1, cursor + length - 1).toString('utf8');
+                        const eq = record.indexOf('=');
+                        const key = record.slice(0, eq);
+                        const value = record.slice(eq + 1);
+                        if (key === 'path')
+                            paxPath = value;
+                        else if (![
+                            'mtime',
+                            'atime',
+                            'ctime',
+                            'creationtime',
+                            'LIBARCHIVE.creationtime',
+                            'LIBARCHIVE.xattr.com.apple.provenance',
+                            'SCHILY.xattr.com.apple.provenance',
+                        ].includes(key))
+                            invalid(`Unsupported PAX metadata field: ${key}`);
+                        cursor += length;
+                    }
+                    pax = false;
+                }
+                else {
+                    entries[name].sha256 = 'sha256:' + hash.digest('hex');
+                    if (!volume && name === 'manifest.json')
+                        manifestText = Buffer.concat(manifestBytes).toString('utf8');
+                }
+            }
+            if (padding) {
+                const n = Math.min(padding, buffer.length);
+                buffer = buffer.subarray(n);
+                padding -= n;
+                if (padding || !buffer.length)
+                    continue;
+            }
+            if (buffer.length < 512)
+                break;
+            if (++headers > 100000)
+                invalid('Backup exceeds the 100000 archive header limit.');
+            const header = buffer.subarray(0, 512);
+            buffer = buffer.subarray(512);
+            if (header.every((byte) => byte === 0)) {
+                end = true;
+                continue;
+            }
+            if (end)
+                invalid('Archive contains data after its end marker.');
+            const string = (start, length) => header
+                .subarray(start, start + length)
+                .toString('utf8')
+                .replace(/\0.*$/s, '');
+            const octal = (start, length) => {
+                const text = string(start, length).trim();
+                if (!/^[0-7]+$/.test(text))
+                    invalid('Invalid archive size/checksum field.');
+                return Number.parseInt(text, 8);
+            };
+            const sum = [...header].reduce((acc, byte, index) => acc + (index >= 148 && index < 156 ? 32 : byte), 0);
+            if (sum !== octal(148, 8))
+                invalid('Invalid tar header checksum.');
+            const prefix = string(345, 155);
+            name = (prefix ? prefix + '/' : '') + string(0, 100);
+            name = name.replace(/^\.\//, '').replace(/\/$/, '');
+            const type = string(156, 1);
+            const size = octal(124, 12);
+            total += size;
+            if (total > MAX_BACKUP_BYTES || size > MAX_BACKUP_BYTES)
+                invalid('Backup exceeds the supported 100 GiB uncompressed size limit.');
+            if (type === 'x') {
+                if (size > 65536 || size === 0)
+                    invalid('Invalid or oversized PAX metadata.');
+                pax = true;
+                paxChunks = [];
+                left = size;
+                padding = (512 - (size % 512)) % 512;
+                hash = createHash('sha256');
+                continue;
+            }
+            if (paxPath !== undefined) {
+                name = paxPath.replace(/^\.\//, '').replace(/\/$/, '');
+                paxPath = undefined;
+            }
+            const safePath = !name.startsWith('/') &&
+                !name.includes('\\') &&
+                !name.split('/').includes('..') &&
+                !/^[A-Za-z]:/.test(name);
+            if (!safePath)
+                invalid('Unsafe archive path.');
+            if (type === '5' &&
+                (volume || name === '' || name === '.' || ['pg', 'volumes', 'runtime'].includes(name)) &&
+                size === 0)
+                continue;
+            if (type !== '' && type !== '0')
+                invalid('Backup contains a link or unsupported archive entry type.');
+            const metadataName = name.replace(/(^|\/)\._/g, '$1');
+            const appleMetadata = !volume &&
+                metadataName !== name &&
+                (allowed.has(metadataName) || ['pg', 'volumes', 'runtime'].includes(metadataName));
+            if (appleMetadata && size > 1024 * 1024)
+                invalid('Archive metadata exceeds size limit.');
+            if ((!volume && !allowed.has(name) && !appleMetadata) ||
+                name in entries ||
+                entryCount >= 100000)
+                invalid(`Unsafe, duplicate or unexpected archive entry: ${name}`);
+            if (!volume && name === 'manifest.json' && size > 1024 * 1024)
+                invalid('Backup manifest is too large.');
+            entryCount++;
+            entries[name] = { bytes: size, sha256: '' };
+            hash = createHash('sha256');
+            manifestBytes = [];
+            left = size;
+            padding = (512 - (size % 512)) % 512;
+            if (!size) {
+                entries[name].sha256 = 'sha256:' + hash.digest('hex');
+            }
+        }
+    }
+    if (left || padding || !end || (!volume && !manifestText))
+        invalid('Truncated archive or missing manifest.');
+    if (volume)
+        return { edition: 'selfhosted', manifest: {}, entries };
+    for (const entry of Object.keys(entries))
+        if (entry.split('/').some((part) => part.startsWith('._')))
+            delete entries[entry];
+    const manifest = (() => {
+        try {
+            return JSON.parse(manifestText);
+        }
+        catch {
+            return invalid('Backup manifest is not valid JSON.');
+        }
+    })();
+    if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest))
+        invalid('Invalid backup manifest.');
+    const edition = manifest.edition === 'selfhosted' && manifest.formatVersion === 2
+        ? 'selfhosted'
+        : manifest.schemaVersion === 1 && (!manifest.edition || manifest.edition === 'portable')
+            ? 'portable'
+            : invalid('Unsupported backup edition/database/format. Legacy SQL archives require the matching legacy recovery tools.');
+    if (edition === 'portable')
+        parseAndValidateManifest(manifestText);
+    const sizes = manifest.sizes;
+    const checksums = manifest.checksums;
+    const payloads = edition === 'selfhosted' ? SELFHOSTED_BACKUP_ARTIFACTS : BACKUP_ARTIFACTS;
+    for (const payload of payloads) {
+        if (edition === 'selfhosted' &&
+            (!Number.isSafeInteger(sizes?.[payload]) || sizes?.[payload] !== entries[payload]?.bytes))
+            invalid(`Backup payload size does not match ${payload}.`);
+        if (!entries[payload] || checksums?.[payload] !== entries[payload]?.sha256)
+            invalid(`Backup checksum validation failed for ${payload}.`);
+    }
+    if (Object.keys(entries).length !== payloads.length + 1)
+        invalid('Archive contains payloads from a different edition.');
+    return { edition, manifest, entries };
+}
+export async function withRuntimeBackup(input, consume) {
+    const source = statSync(resolve(input.archive));
+    if (!source.isFile() || source.size > MAX_BACKUP_BYTES)
+        invalid('Backup input exceeds the supported file size limit.');
+    const temp = createPrivateTempDirectory(tmpdir(), 'knowz-backup-intake-');
+    try {
+        let archive = resolve(input.archive);
+        if (archive.endsWith('.enc')) {
+            if (!input.passphrase)
+                throw new KnowzError('A passphrase is required for this encrypted archive.', ExitCode.Auth);
+            const plain = join(temp, 'archive.tar.gz');
+            await decryptStream(archive, plain, input.passphrase);
+            archive = plain;
+        }
+        const backup = await scanArchive(archive);
+        const extracted = join(temp, 'payload');
+        ensurePrivateDirectory(extracted);
+        const result = await input.runner('tar', [
+            '-xzf',
+            archive,
+            '--exclude=._*',
+            '--exclude=*/._*',
+            '--no-xattrs',
+            '--no-same-owner',
+            '--no-same-permissions',
+            '-C',
+            extracted,
+        ], { cwd: temp, shell: false });
+        if (result.status !== 0)
+            invalid('Could not extract validated backup archive.');
+        if (backup.edition === 'selfhosted')
+            for (const volume of ['knowz-file-storage', 'knowz-protected-keys'])
+                await scanArchive(join(extracted, `volumes/${volume}.tar.gz`), true);
+        return await consume(backup, extracted);
+    }
+    finally {
+        rmSync(temp, { recursive: true, force: true });
+    }
+}
+export async function inspectRuntimeBackup(input) {
+    return withRuntimeBackup(input, async (backup) => backup);
+}
+//# sourceMappingURL=runtime-backup-archive.js.map

package/dist/lib/runtime-backup-archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-backup-archive.js","sourceRoot":"","sources":["../../src/lib/runtime-backup-archive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEjG,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,0BAA0B;IAC1B,mCAAmC;IACnC,qCAAqC;IACrC,cAAc;IACd,oBAAoB;CACZ,CAAC;AACX,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC;AAChD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS;IAC9B,eAAe;IACf,GAAG,gBAAgB;IACnB,GAAG,2BAA2B;CAC/B,CAAC,CAAC;AACH,MAAM,OAAO,GAAG,CAAC,OAAe,EAAS,EAAE;IACzC,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC,CAAC;AAWF,qHAAqH;AACrH,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,MAAM,GAAG,KAAK;IACrD,MAAM,OAAO,GAA+B,EAAE,CAAC;IAC/C,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,aAAa,GAAa,EAAE,CAAC;IACjC,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,IAAI,SAAS,GAAa,EAAE,CAAC;IAC7B,IAAI,OAA2B,CAAC;IAChC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3D,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QAC/B,iBAAiB,IAAK,GAAc,CAAC,MAAM,CAAC;QAC5C,IAAI,iBAAiB,GAAG,gBAAgB;YACtC,OAAO,CAAC,iDAAiD,CAAC,CAAC;QAC7D,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,GAAa,CAAC,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC;YACrB,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;gBACxC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnB,IAAI,GAAG;oBAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;qBAC1B,IAAI,CAAC,MAAM,IAAI,IAAI,KAAK,eAAe;oBAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACxE,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC5B,IAAI,IAAI,CAAC,CAAC;gBACV,IAAI,IAAI;oBAAE,SAAS;gBACnB,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBACtC,IAAI,MAAM,GAAG,CAAC,CAAC;oBACf,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;wBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;wBACvC,IAAI,KAAK,GAAG,CAAC;4BAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC;wBAChD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;wBAC/D,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;4BAC7B,MAAM,IAAI,KAAK,GAAG,MAAM,GAAG,CAAC;4BAC5B,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,MAAM;4BAE7B,OAAO,CAAC,0BAA0B,CAAC,CAAC;wBACtC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;wBAC9E,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;wBAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAChC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;wBACnC,IAAI,GAAG,KAAK,MAAM;4BAAE,OAAO,GAAG,KAAK,CAAC;6BAC/B,IACH,CAAC;4BACC,OAAO;4BACP,OAAO;4BACP,OAAO;4BACP,cAAc;4BACd,yBAAyB;4BACzB,uCAAuC;4BACvC,mCAAmC;yBACpC,CAAC,QAAQ,CAAC,GAAG,CAAC;4BAEf,OAAO,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC;wBACpD,MAAM,IAAI,MAAM,CAAC;oBACnB,CAAC;oBACD,GAAG,GAAG,KAAK,CAAC;gBACd,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAE,CAAC,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACvD,IAAI,CAAC,MAAM,IAAI,IAAI,KAAK,eAAe;wBACrC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC3C,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC5B,OAAO,IAAI,CAAC,CAAC;gBACb,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM;oBAAE,SAAS;YAC1C,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;gBAAE,MAAM;YAC/B,IAAI,EAAE,OAAO,GAAG,MAAM;gBAAE,OAAO,CAAC,iDAAiD,CAAC,CAAC;YACnF,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACvC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;gBACvC,GAAG,GAAG,IAAI,CAAC;gBACX,SAAS;YACX,CAAC;YACD,IAAI,GAAG;gBAAE,OAAO,CAAC,6CAA6C,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,EAAE,CAC/C,MAAM;iBACH,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC;iBAC/B,QAAQ,CAAC,MAAM,CAAC;iBAChB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC3B,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,EAAE;gBAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,CAAC,sCAAsC,CAAC,CAAC;gBAC5E,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAClC,CAAC,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAC5B,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,IAAI,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EACrE,CAAC,CACF,CAAC;YACF,IAAI,GAAG,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;gBAAE,OAAO,CAAC,8BAA8B,CAAC,CAAC;YACnE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAChC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACrD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC5B,KAAK,IAAI,IAAI,CAAC;YACd,IAAI,KAAK,GAAG,gBAAgB,IAAI,IAAI,GAAG,gBAAgB;gBACrD,OAAO,CAAC,+DAA+D,CAAC,CAAC;YAC3E,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,IAAI,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC;oBAAE,OAAO,CAAC,oCAAoC,CAAC,CAAC;gBAC9E,GAAG,GAAG,IAAI,CAAC;gBACX,SAAS,GAAG,EAAE,CAAC;gBACf,IAAI,GAAG,IAAI,CAAC;gBACZ,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;gBACrC,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACvD,OAAO,GAAG,SAAS,CAAC;YACtB,CAAC;YACD,MAAM,QAAQ,GACZ,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBACrB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACpB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC/B,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC,QAAQ;gBAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAC/C,IACE,IAAI,KAAK,GAAG;gBACZ,CAAC,MAAM,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACtF,IAAI,KAAK,CAAC;gBAEV,SAAS;YACX,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG;gBAC7B,OAAO,CAAC,2DAA2D,CAAC,CAAC;YACvE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YACtD,MAAM,aAAa,GACjB,CAAC,MAAM;gBACP,YAAY,KAAK,IAAI;gBACrB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;YACrF,IAAI,aAAa,IAAI,IAAI,GAAG,IAAI,GAAG,IAAI;gBAAE,OAAO,CAAC,sCAAsC,CAAC,CAAC;YACzF,IACE,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;gBACjD,IAAI,IAAI,OAAO;gBACf,UAAU,IAAI,MAAM;gBAEpB,OAAO,CAAC,kDAAkD,IAAI,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,GAAG,IAAI,GAAG,IAAI;gBAC3D,OAAO,CAAC,+BAA+B,CAAC,CAAC;YAC3C,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC5C,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC5B,aAAa,GAAG,EAAE,CAAC;YACnB,IAAI,GAAG,IAAI,CAAC;YACZ,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;YACrC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,IAAI,CAAE,CAAC,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC;QACvD,OAAO,CAAC,wCAAwC,CAAC,CAAC;IACpD,IAAI,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IACpE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QACtC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE;QACrB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAA4B,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC,oCAAoC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,CAAC,QAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACvE,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACtC,MAAM,OAAO,GACX,QAAQ,CAAC,OAAO,KAAK,YAAY,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC;QAC/D,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,QAAQ,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,KAAK,UAAU,CAAC;YACtF,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,OAAO,CACL,6GAA6G,CAC9G,CAAC;IACV,IAAI,OAAO,KAAK,UAAU;QAAE,wBAAwB,CAAC,YAAY,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAA2C,CAAC;IACnE,MAAM,SAAS,GAAG,QAAQ,CAAC,SAA+C,CAAC;IAC3E,MAAM,QAAQ,GAAG,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAC3F,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IACE,OAAO,KAAK,YAAY;YACxB,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;YAEzF,OAAO,CAAC,sCAAsC,OAAO,GAAG,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,SAAS,EAAE,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM;YACxE,OAAO,CAAC,yCAAyC,OAAO,GAAG,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC;QACrD,OAAO,CAAC,qDAAqD,CAAC,CAAC;IACjE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACxC,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAY,EACZ,OAAmE;IAEnE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,gBAAgB;QACpD,OAAO,CAAC,qDAAqD,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,0BAA0B,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,IAAI,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,UAAU;gBACnB,MAAM,IAAI,UAAU,CAAC,sDAAsD,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9F,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YAC3C,MAAM,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YACtD,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACxC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAC/B,KAAK,EACL;YACE,MAAM;YACN,OAAO;YACP,eAAe;YACf,iBAAiB;YACjB,aAAa;YACb,iBAAiB;YACjB,uBAAuB;YACvB,IAAI;YACJ,SAAS;SACV,EACD,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAC5B,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,6CAA6C,CAAC,CAAC;QAChF,IAAI,MAAM,CAAC,OAAO,KAAK,YAAY;YACjC,KAAK,MAAM,MAAM,IAAI,CAAC,oBAAoB,EAAE,sBAAsB,CAAC;gBACjE,MAAM,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,MAAM,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;QACzE,OAAO,MAAM,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAY;IACrD,OAAO,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;AAC5D,CAAC"}

package/dist/lib/runtime-command.d.ts

@@ -0,0 +1,37 @@
+import { BaseCommand } from '../base-command.js';
+import { type RuntimeAction } from './runtime-operations.js';
+import type { PlatformEdition } from './platform-edition.js';
+export declare const runtimeIdentityFlags: {
+    edition: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    name: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+    'config-dir': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+};
+export interface RuntimeFlags {
+    name: string;
+    'config-dir'?: string;
+    edition?: string;
+    version?: string;
+    yes?: boolean;
+    'purge-profile'?: boolean;
+    tail?: number;
+}
+/** Human/JSON rendering shared by edition-aware commands and explicit portable aliases. */
+export declare abstract class RuntimeCommand extends BaseCommand {
+    protected runOperation(action: RuntimeAction, flags: RuntimeFlags, explicitEdition?: PlatformEdition): Promise<{
+        output: string;
+        action: RuntimeAction;
+        name: string;
+        edition: "selfhosted" | "portable";
+        installedVersion: string;
+        runtimeDir: string;
+        engine: import("./container-engine.js").ContainerEngineId;
+    } | {
+        action: RuntimeAction;
+        name: string;
+        error: {
+            code: string;
+            message: string;
+        };
+    }>;
+}
+//# sourceMappingURL=runtime-command.d.ts.map

package/dist/lib/runtime-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-command.d.ts","sourceRoot":"","sources":["../../src/lib/runtime-command.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAElF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,eAAO,MAAM,oBAAoB;;;;CAMhC,CAAC;AACF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AACD,2FAA2F;AAC3F,8BAAsB,cAAe,SAAQ,WAAW;cACtC,YAAY,CAC1B,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,YAAY,EACnB,eAAe,CAAC,EAAE,eAAe;;;;;;;;;;;;;;;;CAiCpC"}

package/dist/lib/runtime-command.js

@@ -0,0 +1,50 @@
+import { exitCodeForError, logger } from '@knowzai/core';
+import { Flags } from '@oclif/core';
+import { BaseCommand } from '../base-command.js';
+import { runRuntimeOperation } from './runtime-operations.js';
+import { platformIdentityFlags } from './platform-command-shared.js';
+export const runtimeIdentityFlags = {
+    ...platformIdentityFlags,
+    edition: Flags.string({
+        description: 'Runtime edition (required when both editions have this name)',
+        options: ['selfhosted', 'portable'],
+    }),
+};
+/** Human/JSON rendering shared by edition-aware commands and explicit portable aliases. */
+export class RuntimeCommand extends BaseCommand {
+    async runOperation(action, flags, explicitEdition) {
+        try {
+            const result = await runRuntimeOperation(action, {
+                name: flags.name,
+                configDir: flags['config-dir'],
+                edition: explicitEdition ?? flags.edition,
+                version: flags.version,
+                confirmed: flags.yes,
+                purgeProfile: flags['purge-profile'],
+                tail: flags.tail,
+            });
+            if (!this.jsonEnabled() && result.output)
+                this.log(result.output);
+            if (action === 'doctor' && 'checks' in result && result.checks.some((check) => !check.ok))
+                process.exitCode = 1;
+            return result;
+        }
+        catch (error) {
+            if (!this.jsonEnabled())
+                throw error;
+            process.exitCode = exitCodeForError(error);
+            const code = error && typeof error === 'object' && 'code' in error && typeof error.code === 'string'
+                ? error.code
+                : 'RUNTIME_ERROR';
+            return {
+                action,
+                name: flags.name,
+                error: {
+                    code,
+                    message: logger.redact(error instanceof Error ? error.message : String(error)),
+                },
+            };
+        }
+    }
+}
+//# sourceMappingURL=runtime-command.js.map

package/dist/lib/runtime-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-command.js","sourceRoot":"","sources":["../../src/lib/runtime-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAsB,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAGrE,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,GAAG,qBAAqB;IACxB,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,8DAA8D;QAC3E,OAAO,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC;KACpC,CAAC;CACH,CAAC;AAUF,2FAA2F;AAC3F,MAAM,OAAgB,cAAe,SAAQ,WAAW;IAC5C,KAAK,CAAC,YAAY,CAC1B,MAAqB,EACrB,KAAmB,EACnB,eAAiC;QAEjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE;gBAC/C,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC;gBAC9B,OAAO,EAAE,eAAe,IAAK,KAAK,CAAC,OAAuC;gBAC1E,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,GAAG;gBACpB,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC;gBACpC,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,MAAM;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClE,IAAI,MAAM,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACvB,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;gBAAE,MAAM,KAAK,CAAC;YACrC,OAAO,CAAC,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,IAAI,GACR,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;gBACrF,CAAC,CAAC,KAAK,CAAC,IAAI;gBACZ,CAAC,CAAC,eAAe,CAAC;YACtB,OAAO;gBACL,MAAM;gBACN,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE;oBACL,IAAI;oBACJ,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;iBAC/E;aACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/lib/runtime-discovery.d.ts

@@ -0,0 +1,18 @@
+import type { EngineStatus } from './container-engine.js';
+import { type PlatformPaths, type PlatformState } from './platform-runtime.js';
+import type { PlatformEdition } from './platform-edition.js';
+export interface InstalledRuntime {
+    edition: PlatformEdition;
+    paths: PlatformPaths;
+    state: PlatformState;
+    engine?: EngineStatus;
+    hasHealthyState?: boolean;
+    attemptStatus?: string;
+}
+/** One selector for setup, terminal and lifecycle commands. Unknown/corrupt state is never a fresh install. */
+export declare function discoverRuntime(input: {
+    name: string;
+    configDir?: string;
+    edition?: PlatformEdition;
+}): InstalledRuntime | undefined;
+//# sourceMappingURL=runtime-discovery.d.ts.map

package/dist/lib/runtime-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-discovery.d.ts","sourceRoot":"","sources":["../../src/lib/runtime-discovery.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAG1D,OAAO,EAAmF,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEhK,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAAG,OAAO,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,aAAa,CAAC;IAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE;AAEpL,+GAA+G;AAC/G,wBAAgB,eAAe,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,eAAe,CAAA;CAAE,GAAG,gBAAgB,GAAG,SAAS,CAuCpI"}

package/dist/lib/runtime-discovery.js

@@ -0,0 +1,56 @@
+import { savedLocalEngine } from './local-engine-context.js';
+import { join } from 'node:path';
+import { existsSync, readFileSync } from 'node:fs';
+import { resolvePlatformPaths, validatePort, validateProjectName, validateProviderPreset } from './platform-runtime.js';
+import { resolveSelfHostedPaths } from './selfhosted-lifecycle.js';
+/** One selector for setup, terminal and lifecycle commands. Unknown/corrupt state is never a fresh install. */
+export function discoverRuntime(input) {
+    validateProjectName(input.name);
+    const candidates = (input.edition ? [input.edition] : ['selfhosted', 'portable']).map(edition => {
+        const sh = resolveSelfHostedPaths(input.name, input.configDir);
+        const paths = edition === 'portable' ? resolvePlatformPaths(input.name, input.configDir) : {
+            runtimeDir: sh.root, composeFile: sh.composeFile, envFile: sh.envFile, stateFile: sh.stateFile, postgresInitDir: sh.root,
+        };
+        return { edition, paths };
+    }).filter(candidate => existsSync(candidate.paths.stateFile) || existsSync(join(candidate.paths.runtimeDir, 'attempt.json')));
+    if (candidates.length > 1)
+        throw new Error(`Runtime '${input.name}' exists in both editions. Select --edition selfhosted or --edition portable.`);
+    if (!candidates.length)
+        return undefined;
+    const { edition, paths } = candidates[0];
+    try {
+        const hasHealthyState = existsSync(paths.stateFile);
+        const attemptPath = join(paths.runtimeDir, 'attempt.json');
+        const attempt = existsSync(attemptPath) ? JSON.parse(readFileSync(attemptPath, 'utf8')) : undefined;
+        const parsed = (hasHealthyState ? JSON.parse(readFileSync(paths.stateFile, 'utf8')) : attempt?.state);
+        if (parsed.name !== input.name || typeof parsed.version !== 'string' || !/^\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?$/.test(parsed.version) || !parsed.ports)
+            throw new Error('Missing name, version or ports');
+        if (parsed.edition && parsed.edition !== edition)
+            throw new Error('Edition does not match runtime directory');
+        const ports = { api: validatePort(parsed.ports.api), web: validatePort(parsed.ports.web), mcp: validatePort(parsed.ports.mcp), publicSite: validatePort(parsed.ports.publicSite ?? (edition === 'selfhosted' ? parsed.ports.web : 3002)) };
+        const safeUrl = (value, port) => {
+            if (typeof value !== 'string')
+                return `http://localhost:${port}`;
+            const url = new URL(value);
+            if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password)
+                throw new Error('Invalid service URL');
+            return value;
+        };
+        const state = {
+            schemaVersion: 1, name: input.name, version: parsed.version,
+            provider: validateProviderPreset(parsed.provider ?? 'offline'),
+            storage: parsed.storage === 'minio' ? 'minio' : 'filesystem', imageFlavor: parsed.imageFlavor === '-gcp' ? '-gcp' : '',
+            axes: { ai: undefined, docIntelligence: 'None', vision: 'None', transcription: 'None' },
+            ports,
+            serviceUrls: { api: safeUrl(parsed.serviceUrls?.api, ports.api), web: safeUrl(parsed.serviceUrls?.web, ports.web), mcp: safeUrl(parsed.serviceUrls?.mcp, ports.mcp), publicSite: safeUrl(parsed.serviceUrls?.publicSite, ports.publicSite) },
+            components: { mcp: parsed.components?.mcp !== false, publicSite: edition === 'portable' && parsed.components?.publicSite === true },
+            imageMode: parsed.imageMode === 'preloaded' || parsed.imageMode === 'build' ? parsed.imageMode : 'pull',
+            updatedAt: typeof parsed.updatedAt === 'string' ? parsed.updatedAt : '',
+        };
+        return { edition, paths, state, hasHealthyState: hasHealthyState && parsed.healthPassed !== false, ...(attempt?.status ? { attemptStatus: attempt.status } : {}), ...(parsed.engine === undefined ? {} : { engine: savedLocalEngine(parsed.engine) }) };
+    }
+    catch (error) {
+        throw new Error(`Invalid ${edition} runtime state at ${paths.stateFile}: ${error instanceof Error ? error.message : 'unreadable state'}. Repair or restore this state before continuing.`);
+    }
+}
+//# sourceMappingURL=runtime-discovery.js.map

package/dist/lib/runtime-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-discovery.js","sourceRoot":"","sources":["../../src/lib/runtime-discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,mBAAmB,EAAE,sBAAsB,EAA0C,MAAM,uBAAuB,CAAC;AAChK,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAKnE,+GAA+G;AAC/G,MAAM,UAAU,eAAe,CAAC,KAAsE;IACpG,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,UAAU,CAAU,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QACvG,MAAM,EAAE,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACzF,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,eAAe,EAAE,EAAE,CAAC,IAAI;SACzH,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IAC9H,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,CAAC,IAAI,+EAA+E,CAAC,CAAC;IAClJ,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAyC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5I,MAAM,MAAM,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAA4F,CAAC;QACjM,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,4CAA4C,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC/M,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9G,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC3O,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,IAAY,EAAE,EAAE;YAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,oBAAoB,IAAI,EAAE,CAAC;YACjE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACxH,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,MAAM,KAAK,GAAkB;YAC3B,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO;YAC3D,QAAQ,EAAE,sBAAsB,CAAC,MAAM,CAAC,QAAQ,IAAI,SAAS,CAAC;YAC9D,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YACtH,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE;YACvF,KAAK;YACL,WAAW,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE;YAC5O,UAAU,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,KAAK,KAAK,EAAE,UAAU,EAAE,OAAO,KAAK,UAAU,IAAI,MAAM,CAAC,UAAU,EAAE,UAAU,KAAK,IAAI,EAAE;YACnI,SAAS,EAAE,MAAM,CAAC,SAAS,KAAK,WAAW,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;YACvG,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;SACxE,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,eAAe,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1P,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,WAAW,OAAO,qBAAqB,KAAK,CAAC,SAAS,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,mDAAmD,CAAC,CAAC;IAAC,CAAC;AACjN,CAAC"}

package/dist/lib/runtime-lock.d.ts

@@ -0,0 +1,3 @@
+/** Exclusive local mutation lease. Stale leases are removed only after the recorded process has exited. */
+export declare function acquireRuntimeLock(runtimeDir: string): () => void;
+//# sourceMappingURL=runtime-lock.d.ts.map

package/dist/lib/runtime-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-lock.d.ts","sourceRoot":"","sources":["../../src/lib/runtime-lock.ts"],"names":[],"mappings":"AAIA,2GAA2G;AAC3G,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,IAAI,CAwBjE"}

package/dist/lib/runtime-lock.js

@@ -0,0 +1,50 @@
+import { closeSync, mkdirSync, openSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+/** Exclusive local mutation lease. Stale leases are removed only after the recorded process has exited. */
+export function acquireRuntimeLock(runtimeDir) {
+    const path = join(runtimeDir, '.operation.lock');
+    mkdirSync(dirname(path), { recursive: true });
+    const token = randomUUID();
+    for (let attempt = 0; attempt < 2; attempt++) {
+        try {
+            const fd = openSync(path, 'wx', 0o600);
+            try {
+                writeFileSync(fd, JSON.stringify({ pid: process.pid, token }));
+            }
+            finally {
+                closeSync(fd);
+            }
+            return () => {
+                try {
+                    if (JSON.parse(readFileSync(path, 'utf8')).token === token)
+                        unlinkSync(path);
+                }
+                catch { /* Already released. */ }
+            };
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            let pid;
+            try {
+                pid = JSON.parse(readFileSync(path, 'utf8')).pid;
+            }
+            catch { /* Unknown owner remains locked. */ }
+            if (typeof pid === 'number' && Number.isSafeInteger(pid) && pid > 0) {
+                try {
+                    process.kill(pid, 0);
+                }
+                catch (probeError) {
+                    if (probeError.code === 'ESRCH' && attempt === 0) {
+                        unlinkSync(path);
+                        continue;
+                    }
+                }
+            }
+            throw Object.assign(new Error('This runtime is busy with another operation. Wait for it to finish, then retry.'), { code: 'RUNTIME_BUSY', exitCode: 3 });
+        }
+    }
+    throw new Error('Unable to acquire runtime lock.');
+}
+//# sourceMappingURL=runtime-lock.js.map

package/dist/lib/runtime-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-lock.js","sourceRoot":"","sources":["../../src/lib/runtime-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,2GAA2G;AAC3G,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACjD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC;gBAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;oBAAS,CAAC;gBAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAClG,OAAO,GAAG,EAAE;gBACV,IAAI,CAAC;oBAAC,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK;wBAAE,UAAU,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;YACzH,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,mCAAmC,CAAC,CAAC;YACvG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;gBACpE,IAAI,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBAChD,IAAK,UAAoC,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;wBAAC,UAAU,CAAC,IAAI,CAAC,CAAC;wBAAC,SAAS;oBAAC,CAAC;gBAC9G,CAAC;YACH,CAAC;YACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iFAAiF,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3J,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACrD,CAAC"}

package/dist/lib/runtime-operations.d.ts

@@ -0,0 +1,98 @@
+import { type CredentialStore, type KnowzConfig } from '@knowzai/core';
+import type { PlatformEdition } from './platform-edition.js';
+import { applyPlatform } from './platform-lifecycle.js';
+import { applySelfHostedAsync } from './selfhosted-lifecycle.js';
+import { type EngineStatus } from './container-engine.js';
+import { type ProcessRunner, type AsyncProcessRunner } from './platform-runtime.js';
+import { type RuntimeProviderProbeDeps } from './runtime-provider.js';
+export { parseComposeStatus } from './compose-status.js';
+export type RuntimeAction = 'status' | 'logs' | 'doctor' | 'down' | 'destroy' | 'upgrade';
+export interface RuntimeOperationInput {
+    name: string;
+    configDir?: string;
+    edition?: PlatformEdition;
+    version?: string;
+    confirmed?: boolean;
+    purgeProfile?: boolean;
+    tail?: number;
+}
+export interface RuntimeOperationDeps extends RuntimeProviderProbeDeps {
+    runner?: ProcessRunner | AsyncProcessRunner;
+    engine?: EngineStatus;
+    /** Injectable observed engine endpoint; production reads Docker's context or the Podman socket. */
+    contextHost?: string;
+    env?: Readonly<Record<string, string | undefined>>;
+    applyPortable?: typeof applyPlatform;
+    applySelfHosted?: typeof applySelfHostedAsync;
+    selfHostedAssetsDir?: string;
+    loadConfig?: () => KnowzConfig;
+    saveConfig?: (config: KnowzConfig) => void;
+    credentialStore?: () => Promise<CredentialStore>;
+}
+export declare function runRuntimeOperation(action: RuntimeAction, input: RuntimeOperationInput, deps?: RuntimeOperationDeps): Promise<{
+    installedVersion: string;
+    upgraded: boolean;
+    output: string;
+    action: RuntimeAction;
+    name: string;
+    edition: "selfhosted" | "portable";
+    runtimeDir: string;
+    engine: import("./container-engine.js").ContainerEngineId;
+} | {
+    destroyed: boolean;
+    volumesDeleted: boolean;
+    profilePurged: boolean;
+    output: string;
+    action: RuntimeAction;
+    name: string;
+    edition: "selfhosted" | "portable";
+    installedVersion: string;
+    runtimeDir: string;
+    engine: import("./container-engine.js").ContainerEngineId;
+} | {
+    stopped: boolean;
+    volumesPreserved: boolean;
+    output: string;
+    action: RuntimeAction;
+    name: string;
+    edition: "selfhosted" | "portable";
+    installedVersion: string;
+    runtimeDir: string;
+    engine: import("./container-engine.js").ContainerEngineId;
+} | {
+    output: string;
+    action: RuntimeAction;
+    name: string;
+    edition: "selfhosted" | "portable";
+    installedVersion: string;
+    runtimeDir: string;
+    engine: import("./container-engine.js").ContainerEngineId;
+} | {
+    output: string;
+    provider: {
+        mode: "offline" | "azure" | "gcp" | "knowz-cloud" | "openai-compatible";
+        configured: boolean;
+        connectivity: "not-checked";
+        detail: string;
+    } | {
+        connectivity: "unavailable" | "reachable";
+        authentication: "not-checked";
+        model: "not-checked";
+        mode: "offline" | "azure" | "gcp" | "knowz-cloud" | "openai-compatible";
+        configured: boolean;
+        detail: string;
+    };
+    desiredVersion?: string | undefined;
+    versionSources: import("./platform-lifecycle.js").PlatformVersionSources;
+    versionConsistent: boolean;
+    status: string;
+    checks: import("./runtime-status.js").RuntimeCheck[];
+    services: import("./compose-status.js").ComposeStatusRow[];
+    action: RuntimeAction;
+    name: string;
+    edition: "selfhosted" | "portable";
+    installedVersion: string;
+    runtimeDir: string;
+    engine: import("./container-engine.js").ContainerEngineId;
+}>;
+//# sourceMappingURL=runtime-operations.d.ts.map