@lifeaitools/clauth 1.30.25 → 1.31.1

package/supabase/migrations/001_clauth_schema.sql

@@ -1,32 +1,32 @@
--- ============================================================
--- clauth schema
--- Migration: 001_clauth_schema.sql
--- ============================================================
-
--- Enable vault extension (Supabase enables by default, but guard)
--- vault.secrets is already available in Supabase projects
-
--- ============================================================
--- Service Registry
--- ============================================================
-create table if not exists public.clauth_services (
-  id            uuid primary key default gen_random_uuid(),
-  name          text not null unique,           -- e.g. 'github', 'r2'
-  label         text not null,                  -- human display name
-  key_type      text not null                   -- 'token' | 'keypair' | 'connstring' | 'oauth'
-                check (key_type in ('token','keypair','connstring','oauth')),
-  enabled       boolean not null default false,
-  vault_key     text,                           -- vault secret name: 'clauth.<name>'
-  description   text,
-  last_retrieved timestamptz,
-  last_rotated   timestamptz,
-  created_at    timestamptz not null default now(),
-  updated_at    timestamptz not null default now()
-);
-
--- ============================================================
--- Machine Registry (hardware fingerprints — hashed only)
--- ============================================================
+-- ============================================================
+-- clauth schema
+-- Migration: 001_clauth_schema.sql
+-- ============================================================
+
+-- Enable vault extension (Supabase enables by default, but guard)
+-- vault.secrets is already available in Supabase projects
+
+-- ============================================================
+-- Service Registry
+-- ============================================================
+create table if not exists public.clauth_services (
+  id            uuid primary key default gen_random_uuid(),
+  name          text not null unique,           -- e.g. 'github', 'r2'
+  label         text not null,                  -- human display name
+  key_type      text not null                   -- 'token' | 'keypair' | 'connstring' | 'oauth'
+                check (key_type in ('token','keypair','connstring','oauth')),
+  enabled       boolean not null default false,
+  vault_key     text,                           -- vault secret name: 'clauth.<name>'
+  description   text,
+  last_retrieved timestamptz,
+  last_rotated   timestamptz,
+  created_at    timestamptz not null default now(),
+  updated_at    timestamptz not null default now()
+);
+
+-- ============================================================
+-- Machine Registry (hardware fingerprints — hashed only)
+-- ============================================================
 create table if not exists public.clauth_machines (
   id              uuid primary key default gen_random_uuid(),
   install_id      text not null default 'default', -- logical vault install / owner group
@@ -39,68 +39,68 @@ create table if not exists public.clauth_machines (
   created_at      timestamptz not null default now(),
   last_seen       timestamptz
 );
-
--- ============================================================
--- Audit Log
--- ============================================================
-create table if not exists public.clauth_audit (
-  id           uuid primary key default gen_random_uuid(),
-  machine_hash text,
-  service_name text,
-  action       text not null,    -- 'retrieve' | 'enable' | 'disable' | 'rotate' | 'revoke' | 'add' | 'remove'
-  result       text not null,    -- 'success' | 'fail' | 'denied'
-  detail       text,
-  created_at   timestamptz not null default now()
-);
-
--- ============================================================
--- Seed: built-in service definitions (no keys — just registry)
--- ============================================================
-insert into public.clauth_services (name, label, key_type, description) values
-  ('github',           'GitHub PAT',                  'token',     'GitHub Personal Access Token — repo, workflow, org'),
-  ('supabase-anon',    'Supabase Anon Key',            'token',     'Supabase public anon key (RLS-gated)'),
-  ('supabase-service', 'Supabase Service Role Key',    'token',     'Supabase service_role — bypasses RLS'),
-  ('supabase-db',      'Supabase DB Connection',       'connstring','PostgreSQL connection string (pooled + direct)'),
-  ('vercel',           'Vercel API Token',             'keypair',   'Vercel API token + Team ID'),
-  ('namecheap',        'Namecheap API',                'keypair',   'Namecheap API key + username'),
-  ('neo4j',            'Neo4j Aura',                   'connstring','Neo4j Aura URI + credentials'),
-  ('anthropic',        'Anthropic API Key',            'token',     'Claude API — sk-ant-...'),
-  ('r2',               'Cloudflare R2 Keypair',        'keypair',   'R2 Access Key ID + Secret Access Key'),
-  ('r2-bucket',        'Cloudflare R2 Bucket Config',  'connstring','R2 bucket name + endpoint URL'),
-  ('cloudflare',       'Cloudflare API Token',         'token',     'Cloudflare zone/DNS/admin token'),
-  ('rocketreach',      'RocketReach API Key',          'token',     'RocketReach contact intelligence API')
-on conflict (name) do nothing;
-
--- ============================================================
--- RLS — lock down all tables
--- ============================================================
-alter table public.clauth_services  enable row level security;
-alter table public.clauth_machines  enable row level security;
-alter table public.clauth_audit     enable row level security;
-
--- service_role bypasses RLS — all access from Edge Function only
--- No direct anon access to any clauth table
-do $$ begin
-  if not exists (select 1 from pg_policies where policyname = 'no_anon_services' and tablename = 'clauth_services') then
-    create policy "no_anon_services" on public.clauth_services for all using (false);
-  end if;
-  if not exists (select 1 from pg_policies where policyname = 'no_anon_machines' and tablename = 'clauth_machines') then
-    create policy "no_anon_machines" on public.clauth_machines for all using (false);
-  end if;
-  if not exists (select 1 from pg_policies where policyname = 'no_anon_audit' and tablename = 'clauth_audit') then
-    create policy "no_anon_audit" on public.clauth_audit for all using (false);
-  end if;
-end $$;
-
--- ============================================================
--- Updated_at trigger
--- ============================================================
-create or replace function public.clauth_touch_updated()
-returns trigger language plpgsql as $$
-begin new.updated_at = now(); return new; end;
-$$;
-
-drop trigger if exists clauth_services_updated on public.clauth_services;
-create trigger clauth_services_updated
-  before update on public.clauth_services
-  for each row execute procedure public.clauth_touch_updated();
+
+-- ============================================================
+-- Audit Log
+-- ============================================================
+create table if not exists public.clauth_audit (
+  id           uuid primary key default gen_random_uuid(),
+  machine_hash text,
+  service_name text,
+  action       text not null,    -- 'retrieve' | 'enable' | 'disable' | 'rotate' | 'revoke' | 'add' | 'remove'
+  result       text not null,    -- 'success' | 'fail' | 'denied'
+  detail       text,
+  created_at   timestamptz not null default now()
+);
+
+-- ============================================================
+-- Seed: built-in service definitions (no keys — just registry)
+-- ============================================================
+insert into public.clauth_services (name, label, key_type, description) values
+  ('github',           'GitHub PAT',                  'token',     'GitHub Personal Access Token — repo, workflow, org'),
+  ('supabase-anon',    'Supabase Anon Key',            'token',     'Supabase public anon key (RLS-gated)'),
+  ('supabase-service', 'Supabase Service Role Key',    'token',     'Supabase service_role — bypasses RLS'),
+  ('supabase-db',      'Supabase DB Connection',       'connstring','PostgreSQL connection string (pooled + direct)'),
+  ('vercel',           'Vercel API Token',             'keypair',   'Vercel API token + Team ID'),
+  ('namecheap',        'Namecheap API',                'keypair',   'Namecheap API key + username'),
+  ('neo4j',            'Neo4j Aura',                   'connstring','Neo4j Aura URI + credentials'),
+  ('anthropic',        'Anthropic API Key',            'token',     'Claude API — sk-ant-...'),
+  ('r2',               'Cloudflare R2 Keypair',        'keypair',   'R2 Access Key ID + Secret Access Key'),
+  ('r2-bucket',        'Cloudflare R2 Bucket Config',  'connstring','R2 bucket name + endpoint URL'),
+  ('cloudflare',       'Cloudflare API Token',         'token',     'Cloudflare zone/DNS/admin token'),
+  ('rocketreach',      'RocketReach API Key',          'token',     'RocketReach contact intelligence API')
+on conflict (name) do nothing;
+
+-- ============================================================
+-- RLS — lock down all tables
+-- ============================================================
+alter table public.clauth_services  enable row level security;
+alter table public.clauth_machines  enable row level security;
+alter table public.clauth_audit     enable row level security;
+
+-- service_role bypasses RLS — all access from Edge Function only
+-- No direct anon access to any clauth table
+do $$ begin
+  if not exists (select 1 from pg_policies where policyname = 'no_anon_services' and tablename = 'clauth_services') then
+    create policy "no_anon_services" on public.clauth_services for all using (false);
+  end if;
+  if not exists (select 1 from pg_policies where policyname = 'no_anon_machines' and tablename = 'clauth_machines') then
+    create policy "no_anon_machines" on public.clauth_machines for all using (false);
+  end if;
+  if not exists (select 1 from pg_policies where policyname = 'no_anon_audit' and tablename = 'clauth_audit') then
+    create policy "no_anon_audit" on public.clauth_audit for all using (false);
+  end if;
+end $$;
+
+-- ============================================================
+-- Updated_at trigger
+-- ============================================================
+create or replace function public.clauth_touch_updated()
+returns trigger language plpgsql as $$
+begin new.updated_at = now(); return new; end;
+$$;
+
+drop trigger if exists clauth_services_updated on public.clauth_services;
+create trigger clauth_services_updated
+  before update on public.clauth_services
+  for each row execute procedure public.clauth_touch_updated();

package/supabase/migrations/002_vault_helpers.sql

@@ -1,90 +1,90 @@
--- ============================================================
--- Vault helper functions
--- Migration: 002_vault_helpers.sql
--- These wrap vault.create_secret / vault.update_secret 
--- so Edge Functions don't need direct vault schema access
--- ============================================================
-
--- Upsert a secret (create or update)
-create or replace function public.vault_upsert_secret(
-  secret_name text,
-  secret_value text
-)
-returns void
-language plpgsql
-security definer
-as $$
-declare
-  existing_id uuid;
-begin
-  select id into existing_id
-  from vault.secrets
-  where name = secret_name
-  limit 1;
-
-  if existing_id is not null then
-    perform vault.update_secret(existing_id, secret_value);
-  else
-    perform vault.create_secret(secret_value, secret_name);
-  end if;
-end;
-$$;
-
--- Decrypt and return a secret value by name
-create or replace function public.vault_decrypt_secret(
-  secret_name text
-)
-returns text
-language plpgsql
-security definer
-as $$
-declare
-  result text;
-begin
-  select decrypted_secret into result
-  from vault.decrypted_secrets
-  where name = secret_name
-  limit 1;
-  return result;
-end;
-$$;
-
--- Delete a secret by name
-create or replace function public.vault_delete_secret(
-  secret_name text
-)
-returns void
-language plpgsql
-security definer
-as $$
-declare
-  target_id uuid;
-begin
-  select id into target_id
-  from vault.secrets
-  where name = secret_name
-  limit 1;
-
-  if target_id is not null then
-    delete from vault.secrets where id = target_id;
-  end if;
-end;
-$$;
-
--- List all clauth secrets (names only — never values)
-create or replace function public.vault_list_clauth_secrets()
-returns table(name text, created_at timestamptz, updated_at timestamptz)
-language sql
-security definer
-as $$
-  select name, created_at, updated_at
-  from vault.secrets
-  where name like 'clauth.%'
-  order by name;
-$$;
-
--- Revoke execute from public, grant to service_role only
-revoke execute on function public.vault_upsert_secret from public;
-revoke execute on function public.vault_decrypt_secret from public;
-revoke execute on function public.vault_delete_secret from public;
-revoke execute on function public.vault_list_clauth_secrets from public;
+-- ============================================================
+-- Vault helper functions
+-- Migration: 002_vault_helpers.sql
+-- These wrap vault.create_secret / vault.update_secret 
+-- so Edge Functions don't need direct vault schema access
+-- ============================================================
+
+-- Upsert a secret (create or update)
+create or replace function public.vault_upsert_secret(
+  secret_name text,
+  secret_value text
+)
+returns void
+language plpgsql
+security definer
+as $$
+declare
+  existing_id uuid;
+begin
+  select id into existing_id
+  from vault.secrets
+  where name = secret_name
+  limit 1;
+
+  if existing_id is not null then
+    perform vault.update_secret(existing_id, secret_value);
+  else
+    perform vault.create_secret(secret_value, secret_name);
+  end if;
+end;
+$$;
+
+-- Decrypt and return a secret value by name
+create or replace function public.vault_decrypt_secret(
+  secret_name text
+)
+returns text
+language plpgsql
+security definer
+as $$
+declare
+  result text;
+begin
+  select decrypted_secret into result
+  from vault.decrypted_secrets
+  where name = secret_name
+  limit 1;
+  return result;
+end;
+$$;
+
+-- Delete a secret by name
+create or replace function public.vault_delete_secret(
+  secret_name text
+)
+returns void
+language plpgsql
+security definer
+as $$
+declare
+  target_id uuid;
+begin
+  select id into target_id
+  from vault.secrets
+  where name = secret_name
+  limit 1;
+
+  if target_id is not null then
+    delete from vault.secrets where id = target_id;
+  end if;
+end;
+$$;
+
+-- List all clauth secrets (names only — never values)
+create or replace function public.vault_list_clauth_secrets()
+returns table(name text, created_at timestamptz, updated_at timestamptz)
+language sql
+security definer
+as $$
+  select name, created_at, updated_at
+  from vault.secrets
+  where name like 'clauth.%'
+  order by name;
+$$;
+
+-- Revoke execute from public, grant to service_role only
+revoke execute on function public.vault_upsert_secret from public;
+revoke execute on function public.vault_decrypt_secret from public;
+revoke execute on function public.vault_delete_secret from public;
+revoke execute on function public.vault_list_clauth_secrets from public;

package/supabase/migrations/20260317_lockout.sql

@@ -1,26 +1,26 @@
--- Migration: add fail_count and locked to clauth_machines
--- Run via: clauth install (picks this up automatically) or apply manually
-
-ALTER TABLE clauth_machines
-  ADD COLUMN IF NOT EXISTS fail_count  INTEGER NOT NULL DEFAULT 0,
-  ADD COLUMN IF NOT EXISTS locked      BOOLEAN NOT NULL DEFAULT false;
-
--- Index for fast lockout checks
-CREATE INDEX IF NOT EXISTS idx_clauth_machines_locked
-  ON clauth_machines (machine_hash, locked);
-
--- Admin helper: unlock a machine
--- Usage: SELECT clauth_unlock_machine('your_machine_hash');
-CREATE OR REPLACE FUNCTION clauth_unlock_machine(p_machine_hash TEXT)
-RETURNS void
-LANGUAGE plpgsql
-SECURITY DEFINER
-AS $$
-BEGIN
-  UPDATE clauth_machines
-  SET locked = false, fail_count = 0
-  WHERE machine_hash = p_machine_hash;
-END;
-$$;
-
-REVOKE EXECUTE ON FUNCTION clauth_unlock_machine(TEXT) FROM PUBLIC;
+-- Migration: add fail_count and locked to clauth_machines
+-- Run via: clauth install (picks this up automatically) or apply manually
+
+ALTER TABLE clauth_machines
+  ADD COLUMN IF NOT EXISTS fail_count  INTEGER NOT NULL DEFAULT 0,
+  ADD COLUMN IF NOT EXISTS locked      BOOLEAN NOT NULL DEFAULT false;
+
+-- Index for fast lockout checks
+CREATE INDEX IF NOT EXISTS idx_clauth_machines_locked
+  ON clauth_machines (machine_hash, locked);
+
+-- Admin helper: unlock a machine
+-- Usage: SELECT clauth_unlock_machine('your_machine_hash');
+CREATE OR REPLACE FUNCTION clauth_unlock_machine(p_machine_hash TEXT)
+RETURNS void
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+BEGIN
+  UPDATE clauth_machines
+  SET locked = false, fail_count = 0
+  WHERE machine_hash = p_machine_hash;
+END;
+$$;
+
+REVOKE EXECUTE ON FUNCTION clauth_unlock_machine(TEXT) FROM PUBLIC;

package/cli/commands/ops-install.js

@@ -1,211 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import pm2 from "pm2";
-
-const DEFAULT_PORT = 52439;
-const DEFAULT_NAME = "clauth-deployment";
-const INSTALLER_MARKER = "clauth.ops.install.v1";
-const OPS_ENV_KEYS = new Set([
-  "CLAUTH_OPS_INSTALLER_MARKER", "CLAUTH_OPS_ENABLED", "CLAUTH_OPS_APPLICATIONS", "CLAUTH_OPS_ADMIN_ENABLED",
-  "CLAUTH_OPS_ADMIN_APPLICATIONS", "CLAUTH_OPS_ALLOW_HOST_WIDE", "CLAUTH_OPS_DEPLOYMENTS", "CLAUTH_COOLIFY_PROMOTE_UUIDS",
-]);
-const RUNTIME_ENV_KEYS = new Set(["PATH", "Path", "HOME", "USERPROFILE", "APPDATA", "LOCALAPPDATA", "SystemRoot", "SYSTEMROOT", "ComSpec", "TMP", "TEMP"]);
-const RESTORABLE_PM2_KEYS = ["node_args", "exec_mode", "instances", "namespace", "watch", "kill_retry_time", "merge_logs", "windowsHide", "stop_exit_codes"];
-
-function requiredString(value, label) {
-  if (typeof value !== "string" || !value.trim()) throw new Error(`${label} is required`);
-  return value.trim();
-}
-
-function stringList(value, label) {
-  if (value == null) return [];
-  if (!Array.isArray(value) || !value.every((item) => typeof item === "string" && item.trim())) throw new Error(`${label} must be an array of non-empty strings`);
-  return value.map((item) => item.trim());
-}
-
-function applicationPolicy(value, label) {
-  if (value == null) return {};
-  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-  return Object.fromEntries(Object.entries(value).map(([operation, targets]) => [operation, stringList(targets, `${label}.${operation}`)]));
-}
-
-/**
- * An operation is only usable when it ALSO has a target allowlist.
- *
- * `createOperationPolicy` reads the allowlist from `applications[operation]` and
- * rejects with `service_not_available` when it is empty (operation-policy.js,
- * the `!allowed.length` guard). That code reads like the service is down, but
- * it actually means "no targets configured" — so a config carrying only
- * `agent_enabled` installs cleanly, passes the health and bearer-gate probes,
- * and then rejects every authenticated call. That exact combination shipped to
- * the canary and was misdiagnosed for a day as a missing credential.
- *
- * Read operations (`list`, `describe`, `ping`, `logs`, …) are affected too: the
- * `!allowed.length` guard runs before the read/mutate distinction, so a read op
- * with no allowlist is rejected just the same.
- *
- * Fail at install instead, naming the operations that would silently break.
- */
-function assertEnabledOperationsHaveTargets(enabled, applications, label) {
-  const missing = enabled.filter((operation) => !(applications[operation] || []).length);
-  if (!missing.length) return;
-  const applicationsLabel = label.replace("_enabled", "_applications");
-  throw new Error(
-    `${label}: ${missing.join(", ")} enabled but absent from ${applicationsLabel}. An enabled operation with no target allowlist is rejected at runtime with service_not_available. Add a target list (e.g. {"${missing[0]}": ["*"]}) or remove it from the enabled list.`,
-  );
-}
-
-export function loadOpsInstallConfig(configPath) {
-  const raw = JSON.parse(fs.readFileSync(configPath, "utf8"));
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new Error("ops installer config must be a JSON object");
-  const port = raw.port == null ? DEFAULT_PORT : Number(raw.port);
-  if (!Number.isInteger(port) || port < 1024 || port > 65535) throw new Error("port must be an integer from 1024 through 65535");
-  const pm2Name = raw.pm2_name == null ? DEFAULT_NAME : requiredString(raw.pm2_name, "pm2_name");
-  const operations = raw.operations && typeof raw.operations === "object" && !Array.isArray(raw.operations) ? raw.operations : {};
-
-  const enabled = stringList(operations.agent_enabled, "operations.agent_enabled");
-  const applications = applicationPolicy(operations.agent_applications, "operations.agent_applications");
-  const adminEnabled = stringList(operations.admin_enabled, "operations.admin_enabled");
-  const adminApplications = applicationPolicy(operations.admin_applications, "operations.admin_applications");
-
-  assertEnabledOperationsHaveTargets(enabled, applications, "operations.agent_enabled");
-  assertEnabledOperationsHaveTargets(adminEnabled, adminApplications, "operations.admin_enabled");
-
-  return {
-    port,
-    pm2Name,
-    enabled,
-    applications,
-    adminEnabled,
-    adminApplications,
-    allowHostWide: operations.allow_host_wide === true,
-    deployments: raw.deployments && typeof raw.deployments === "object" && !Array.isArray(raw.deployments) ? raw.deployments : {},
-    coolifyPromoteUuids: stringList(raw.coolify_promote_uuids, "coolify_promote_uuids"),
-  };
-}
-
-export function buildOpsServiceSpec({ config, rootDir }) {
-  const cli = path.join(rootDir, "cli", "index.js");
-  const runtimeEnv = Object.fromEntries([...RUNTIME_ENV_KEYS].flatMap((key) => process.env[key] == null ? [] : [[key, process.env[key]]]));
-  return {
-    name: config.pm2Name,
-    script: cli,
-    args: `serve foreground --port ${config.port} --isolated`,
-    cwd: rootDir,
-    autorestart: true,
-    restart_delay: 1000,
-    max_restarts: 20,
-    // Do not inherit the invoking agent or shell environment: PM2 otherwise
-    // stores every inherited value in its process metadata.
-    // PM2 only activates filtering for a non-empty array.  Exclude every
-    // inherited key, then explicitly add the small runtime allowlist above.
-    filter_env: Object.keys(process.env),
-    env: {
-      ...runtimeEnv,
-      CLAUTH_OPS_INSTALLER_MARKER: INSTALLER_MARKER,
-      CLAUTH_OPS_ENABLED: [...config.enabled, ...(Object.keys(config.deployments).length ? ["deploy"] : []), ...(config.coolifyPromoteUuids.length ? ["coolify_promote"] : [])].join(","),
-      CLAUTH_OPS_APPLICATIONS: JSON.stringify(config.applications),
-      CLAUTH_OPS_ADMIN_ENABLED: config.adminEnabled.join(","),
-      CLAUTH_OPS_ADMIN_APPLICATIONS: JSON.stringify(config.adminApplications),
-      CLAUTH_OPS_ALLOW_HOST_WIDE: config.allowHostWide ? "1" : "0",
-      CLAUTH_OPS_DEPLOYMENTS: JSON.stringify(config.deployments),
-      CLAUTH_COOLIFY_PROMOTE_UUIDS: JSON.stringify(config.coolifyPromoteUuids),
-    },
-  };
-}
-
-function pm2Call(method, ...args) {
-  return new Promise((resolve, reject) => pm2[method](...args, (error, value) => error ? reject(error) : resolve(value)));
-}
-
-async function probe(endpoint) {
-  const health = await fetch(`${endpoint}/health`, { signal: AbortSignal.timeout(5000) });
-  const healthBody = health.ok ? await health.json() : null;
-  if (healthBody?.status !== "ok") throw new Error(`health probe failed at ${endpoint}`);
-  const catalog = await fetch(`${endpoint}/v1/ops/catalog`, { signal: AbortSignal.timeout(5000) });
-  if (catalog.status !== 401) throw new Error(`bearer gate probe failed: expected HTTP 401, received ${catalog.status}`);
-  return { health_status: health.status, bearer_gate_status: catalog.status, listening_port: healthBody.listening_port, process_id: healthBody.process_id };
-}
-
-function argsFor(entry) {
-  const value = entry?.pm2_env?.args ?? entry?.args ?? "";
-  return Array.isArray(value) ? value.join(" ") : String(value || "");
-}
-
-function ownedService(entry, spec) {
-  const env = entry?.pm2_env || {};
-  return env.CLAUTH_OPS_INSTALLER_MARKER === INSTALLER_MARKER
-    && path.resolve(env.pm_exec_path || "") === path.resolve(spec.script)
-    && path.resolve(env.pm_cwd || "") === path.resolve(spec.cwd)
-    && argsFor(entry) === spec.args;
-}
-
-export function previousSpec(entry) {
-  const env = entry.pm2_env || {};
-  const restored = {
-    name: env.name,
-    script: env.pm_exec_path,
-    args: argsFor(entry),
-    cwd: env.pm_cwd,
-    autorestart: env.autorestart !== false,
-    restart_delay: env.restart_delay || 1000,
-    max_restarts: env.max_restarts || 20,
-    filter_env: Object.keys(process.env),
-    env: Object.fromEntries(Object.entries(env).filter(([key]) => OPS_ENV_KEYS.has(key) || RUNTIME_ENV_KEYS.has(key))),
-  };
-  if (env.exec_interpreter !== undefined) restored.interpreter = env.exec_interpreter;
-  for (const key of RESTORABLE_PM2_KEYS) if (env[key] !== undefined) restored[key] = env[key];
-  return restored;
-}
-
-async function rollback(previous, name) {
-  try { await pm2Call("delete", name); } catch {}
-  if (previous) await pm2Call("start", previous);
-}
-
-export async function runOpsInstall(opts = {}) {
-  const configPath = path.resolve(requiredString(opts.config, "--config"));
-  const config = loadOpsInstallConfig(configPath);
-  const rootDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
-  const spec = buildOpsServiceSpec({ config, rootDir });
-  const endpoint = `http://127.0.0.1:${config.port}`;
-  if (opts.dryRun) {
-    process.stdout.write(`${JSON.stringify({ action: "install", dry_run: true, platform: process.platform, endpoint, pm2_name: config.pm2Name, policy_file: configPath, operations: Object.keys(config.applications).sort() }, null, 2)}\n`);
-    return;
-  }
-  await new Promise((resolve, reject) => pm2.connect(false, (error) => error ? reject(error) : resolve()));
-  let result;
-  let previous = null;
-  try {
-    const existing = (await pm2Call("list")).find((entry) => (entry.name || entry.pm2_env?.name) === config.pm2Name);
-    // PM2 rejects an inline `env` object on restart-by-name.  Replacing only
-    // this dedicated control-plane process is the supported way to apply a
-    // changed server policy without touching any managed application.
-    if (existing && !ownedService(existing, spec)) throw new Error(`refusing to replace non-installer PM2 process: ${config.pm2Name}`);
-    previous = existing ? previousSpec(existing) : null;
-    if (existing) await pm2Call("delete", config.pm2Name);
-    await pm2Call("start", spec);
-    for (let attempt = 0; attempt < 20; attempt += 1) {
-      try {
-        result = await probe(endpoint);
-        const current = (await pm2Call("list")).find((entry) => (entry.name || entry.pm2_env?.name) === config.pm2Name);
-        const pid = current?.pid ?? current?.pm2_env?.pm_pid;
-        const status = current?.pm2_env?.status ?? current?.status;
-        if (status !== "online" || !Number.isInteger(pid) || result.process_id !== pid || result.listening_port !== config.port) {
-          throw new Error("new PM2 process does not own the verified control-plane endpoint");
-        }
-        break;
-      } catch (error) {
-        if (attempt === 19) throw error;
-        await new Promise((resolve) => setTimeout(resolve, 250));
-      }
-    }
-  } catch (error) {
-    await rollback(previous, config.pm2Name);
-    throw error;
-  } finally {
-    await new Promise((resolve) => pm2.disconnect(() => resolve()));
-  }
-  process.stdout.write(`${JSON.stringify({ action: "install", platform: process.platform, endpoint, pm2_name: config.pm2Name, policy_file: configPath, health_status: result.health_status, bearer_gate_status: result.bearer_gate_status }, null, 2)}\n`);
-}