@mcsherrylabs/pi-meerkat 0.8.0 → 0.11.0

package/dist/installer-runtime/dist/src/env.js

@@ -86,8 +86,8 @@ export const CHAIN_NAME_RE = /^[a-z0-9][a-z0-9._-]{0,31}$/;
  *  `??` is the wrong operator for these. Compose renders a pass-through variable as
  *  PRESENT-AND-EMPTY rather than omitting it (`EVOLVER_DEVNET_URL: ${EVOLVER_DEVNET_URL:-}`),
  *  and `process.env.X ?? default` only falls back on undefined — so an empty value WINS and
- *  the default never applies. That is not hypothetical: `docker-compose.remote.yml` was the
- *  first caller to pass these through, devnet's url resolved to the empty string, and the
+ *  the default never applies. That is not hypothetical: a pass-through deploy that rendered
+ *  these present-and-empty once made devnet's url resolve to the empty string, and the
  *  deployment failed with `chain not ready at  (target 'devnet')`. Every optional variable
  *  in this project goes through here. */
 export function optionalEnv(k) {
@@ -350,42 +350,57 @@ export function registryChannel() {
 export function registryChannelOperator() {
     return optionalEnv("REGISTRY_CHANNEL_OPERATOR");
 }
-// ── 004-event-processor-inbox ─────────────────────────────────────────────────
-/** A setting 004 renamed. It is REFUSED, not read: see `processorHttpPort`. */
+/**
+ * Opt-in READ-ONLY registry mode (the installer always sets this; the published app image and the
+ * real-estate operator deployment must NOT).
+ *
+ * In this mode the registry never claims or signs with any identity, submits nothing, and its role
+ * decision can never yield `owner`. Owned+open+operator-matches reads back `reader`; an unclaimed
+ * channel drains nothing and `wait`s; an owner different from the pinned operator or a non-open
+ * write policy is `unusable`. Without this flag the existing owner path is byte-for-byte unchanged.
+ */
+export function registryReadOnly() {
+    return optionalEnv("REGISTRY_READ_ONLY") === "1";
+}
+// ── 004-event-processor-inbox / 177-managed-processor-shell ───────────────────
+/** A retired setting that the managed shell no longer reads. A non-empty value is REFUSED, not
+ *  read, so a stale deployment cannot silently diverge (processing with no node control, or
+ *  serving nothing). See `refuseRetiredSettings`. */
 export class RenamedSettingError extends Error {
 }
+/** `registryStatePath(target)` moves here beside [[ensureStateDir]] — the shell owns the store
+ *  path, and both `src/service.ts` and `scripts/recover-owner.ts` need it. */
+export function registryStatePath(target) {
+    return join(target.stateDir, "registry.db");
+}
 /**
- * THE SWITCH BETWEEN THE APP'S TWO SHAPES, and the event processor's read-server port.
+ * FR-031 — the managed shell reads ONLY the binding (`EVOLVER_CHAIN_ID`, `APP_NODE_ID`) from the
+ * environment. Every other retired Meerkat setting is a fixed container default or an explicit
+ * option, and a non-empty value must REFUSE startup. A compose `${X:-}` renders present-and-EMPTY,
+ * so an empty string is NOT a refusal (it is "unset"); only a non-empty value refuses. The message
+ * names the offending variable.
  *
- * `> 0` is the SERVICE shape: the event processor with the registry module, serving its routes
- * on this port, until stopped. Unset or `0` is the DEMO shape: the event processor with the demo
- * module, for as long as the template's steps take. Both shapes have exactly one consumer of
- * the node's stream — the processor — and both keep what nobody handles in the inbox.
- *
- * ⚠️ IT STAYS ONE SWITCH BECAUSE THE NODE READS IT TOO. `node-join.sh` decides from the same
- * value whether the node subscribes to `REGISTRY_CHANNEL`, and phase M of the command suite
- * fails the build if the two are keyed on anything else. A second "which modules" setting could
- * disagree with the node's channel list, and the registry would then index nothing (research R1).
- *
- * `0` = no read server, mirroring `https.port`'s convention in the node — the port IS the switch,
- * so there is no second `enabled` flag.
- *
- * ⚠️ `REGISTRY_HTTP_PORT`, its name before 004, is REFUSED whenever it is set — not read, not
- * aliased. Ignoring it would be worse than either: a registry deployment whose environment still
- * says `REGISTRY_HTTP_PORT=8090` would start as the template DEMO, drain its node with the wrong
- * module and serve nothing, and say so nowhere. The refusal names the fix.
+ * `EVOLVER_MANAGED_NODE_CONTAINER` is evolver-mcp's node container_name and is deliberately NOT on
+ * this list.
  */
-export function processorHttpPort() {
-    const old = optionalEnv("REGISTRY_HTTP_PORT");
-    if (old !== undefined)
-        throw new RenamedSettingError(`REGISTRY_HTTP_PORT is set (${old}), but it was renamed PROCESSOR_HTTP_PORT and is no longer read.\n` +
-            `  Set PROCESSOR_HTTP_PORT=${old} and remove REGISTRY_HTTP_PORT. Left as it is, this deployment\n` +
-            `  would start as the template demo instead of the registry.`);
-    const port = Number(optionalEnv("PROCESSOR_HTTP_PORT") ?? 0);
-    if (!Number.isSafeInteger(port) || port < 0 || port > 65535)
-        throw new TargetError("invalid PROCESSOR_HTTP_PORT");
-    return port;
+export function refuseRetiredSettings(env = process.env) {
+    for (const name of RETIRED_SETTINGS) {
+        const value = env[name];
+        if (value !== undefined && value !== "") {
+            throw new RenamedSettingError(`${name} is set (${value}), but it is a retired Meerkat setting and is no longer read:\n` +
+                `  the managed processor shell fixes every setting as a container default or an explicit\n` +
+                `  option, reading only EVOLVER_CHAIN_ID / APP_NODE_ID from the environment. Unset ${name}\n` +
+                `  and start again; reading it would let a stale deployment silently diverge.`);
+        }
+    }
 }
+const RETIRED_SETTINGS = [
+    "EVOLVER_PROCESSOR_CONTROL_SOCKET",
+    "PROCESSOR_HTTP_PORT",
+    "REGISTRY_HTTP_PORT",
+    "PROCESSOR_READ_HOST",
+    "EVOLVER_SUBSCRIPTIONS_FILE",
+];
 /** The lease ceiling, in ROUNDS, measured from the round an announcement is ordered.
  *
  * ⚠️ Rounds, never wall-clock: devnet commits on a ~600 ms floor when busy and a 300-second

package/dist/installer-runtime/dist/src/registry/index.js

@@ -2,7 +2,7 @@
 // the SDK. Signing keys and chain provisioning remain in this parent, never worker options.
 import { isValidNodeId } from "@mcsherrylabs/evolver-client";
 import { registryChannel, registryChannelOperator, registryContentUrl, registryDenyList, registryMaxLeaseRounds, } from "../env.js";
-import { provisionRegistryChannel } from "./provision.js";
+import { provisionRegistryChannel, provisionRegistryChannelReadOnly } from "./provision.js";
 import { REGISTRY_MODULE_NAME } from "./worker-module.js";
 export function registryModule(args) {
     if (!isValidNodeId(args.operator))
@@ -13,6 +13,7 @@ export function registryModule(args) {
         maxLeaseRounds: registryMaxLeaseRounds(), deny: [...registryDenyList()],
         chainUrl: args.chainUrl, contentUrl: registryContentUrl(),
     };
+    const pinnedOperator = registryChannelOperator();
     return {
         // Production starts emitted JS. No tsx worker remapping, test factory or remote discovery.
         worker: { url: new URL("./worker-module.js", import.meta.url).href, options },
@@ -20,13 +21,21 @@ export function registryModule(args) {
             name: REGISTRY_MODULE_NAME, channels: [channel],
             async setup(context) {
                 await args.beforeProvision?.();
+                if (args.readOnly) {
+                    const provisioned = await provisionRegistryChannelReadOnly({
+                        chainAgreedUrl: args.chainAgreedUrl, channel, nodeIdentity: args.nodeIdentity,
+                        say: args.say, operator: pinnedOperator ?? args.operator,
+                    });
+                    args.say(`   registry ${provisioned.role}: ${channel}`);
+                    return;
+                }
                 const { sender, signer } = await args.identity();
                 if (sender.nodeId !== args.operator)
                     throw new Error("registry signing identity differs from fixed worker operator");
                 const provisioned = await provisionRegistryChannel({
                     node: args.node, chainUrl: args.chainUrl, chainAgreedUrl: args.chainAgreedUrl,
                     channel, owner: sender, signer, nodeIdentity: args.nodeIdentity,
-                    say: args.say, operator: registryChannelOperator(),
+                    say: args.say, operator: pinnedOperator,
                     pace: async () => { await context.pace(); },
                 });
                 args.say(`   registry ${provisioned.role}: ${channel}`);

package/dist/installer-runtime/dist/src/registry/provision.js

@@ -29,7 +29,28 @@
 import { buildSignedTx, claimBody, updateChannelWritePolicyBody, LEDGER } from "@mcsherrylabs/evolver-client";
 import { channelTerms, submitAndConfirm, updateChannelDaBody, } from "../announcements.js";
 export function decideRegistryRole(args) {
-    const { terms, self, operator } = args;
+    const { terms, self, operator, readOnly } = args;
+    // READ-ONLY: the installer's registry never claims or signs with any identity. `self` is the
+    // PINNED operator name, not this deployment's (nonexistent) identity, and it must NEVER yield
+    // `owner` — a read-only indexer submitting a Claim for a channel someone else owns poisons the
+    // chain's tx queue (evolver#85). Decision folds entirely onto the pinned operator.
+    if (readOnly) {
+        if (terms.owners.length === 0) {
+            return { kind: "waiting", why: `'${terms.ledgerId}' is UNCLAIMED and this read-only registry will not claim it (owned ` +
+                    `by '${operator ?? "(no operator pinned)"}', not by this deployment). Draining the cursor ` +
+                    `and indexing nothing until the operator provisions it.` };
+        }
+        const holder = terms.owners.map((o) => o.name).join(", ");
+        if (operator && !terms.owners.some((o) => o.name === operator))
+            return { kind: "unusable", why: `'${terms.ledgerId}' is owned by ${holder}, but REGISTRY_CHANNEL_OPERATOR pins ` +
+                    `'${operator}'. Either the operator changed — update the pin — or this name was taken by ` +
+                    `somebody else. Refusing to index a channel whose terms are set by a party this deployment ` +
+                    `was not told to trust.` };
+        if (terms.writePolicy !== "open")
+            return { kind: "unusable", why: `'${terms.ledgerId}' is owned by ${holder} and its write policy is ` +
+                    `'${terms.writePolicy}', not 'open'. Every announcement would be a permanent miss.` };
+        return { kind: "reader", holder };
+    }
     // ALREADY OURS — see "keeping is not acquiring" above. Note this is the IDENTITY name,
     // matching what the claim/converge path below can actually sign for: a channel owned by a
     // group we happen to belong to is deliberately NOT treated as ours, because this app holds
@@ -178,3 +199,27 @@ export async function provisionRegistryChannel(args) {
         say(`   '${channel}' already has the terms this registry needs — nothing to submit`);
     return { role: "owner", channel, member: nodeIdentity, writes };
 }
+/**
+ * READ-ONLY provisioning: decide the role from the chain-agreed terms and NEVER submit, claim or
+ * sign. Used only by the installer's registry (`REGISTRY_READ_ONLY=1`), where no identity exists to
+ * sign with and the pinned operator (`REGISTRY_CHANNEL_OPERATOR`) is the only authority trusted.
+ */
+export async function provisionRegistryChannelReadOnly(args) {
+    const { chainAgreedUrl, channel, nodeIdentity, operator, say } = args;
+    const read = await channelTerms(chainAgreedUrl, channel);
+    if (!read.ok)
+        throw new Error(`could not read the terms of '${channel}' from ${chainAgreedUrl}: ${read.why}\n` +
+            `  Refusing to guess — an unreadable answer is "not yet", never a licence to index unverified terms.`);
+    const role = decideRegistryRole({ terms: read.terms, self: operator ?? "", operator, readOnly: true });
+    if (role.kind === "unusable")
+        throw new Error(role.why);
+    if (role.kind === "waiting") {
+        say(`   ⚠ ${role.why}`);
+        return { role: "waiting", channel, member: nodeIdentity, writes: 0 };
+    }
+    if (role.kind !== "reader")
+        throw new Error(`read-only registry resolved an impossible owner role — refusing to index`);
+    say(`   '${channel}' is owned by ${role.holder} — running as a READ-ONLY reader`);
+    say(`   nothing will be claimed, provisioned or submitted here`);
+    return { role: "reader", channel, member: nodeIdentity, writes: 0 };
+}

package/dist/installer-runtime/dist/src/service.js

@@ -0,0 +1,151 @@
+// The registry service: application configuration + module registration only (FR-004, SC-001).
+// All generic cursor/storage/config/control/lifecycle ownership lives in the SDK managed shell
+// (`startManagedProcessor`); this file wires the registry module, its routes, the state path, the
+// own-node client and the operator identity to that shell. No processor-composition code of its
+// own remains here.
+import { fileURLToPath } from "node:url";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { isValidNodeId, NodeClient } from "@mcsherrylabs/evolver-client";
+import { deadlineFetch, MANAGED_PROCESSOR_DEFAULTS, startManagedProcessor, } from "@mcsherrylabs/evolver-client/processor";
+import { ensureStateDir, refuseRetiredSettings, registryChannelOperator, registryReadOnly, registryStatePath, ROOT, } from "./env.js";
+import * as store from "./store.js";
+import { identityPrefix } from "../scripts/versions.mjs";
+import { CHAIN_TIMEOUT_MS } from "./chainfetch.js";
+import { registryModule, registryReadRoutes } from "./registry/index.js";
+/** The operator identity name the registry claims/signs as. Resolved BEFORE any network: from
+ *  saved state, else a freshly derived name, always carrying the per-target suffix on a shared
+ *  chain so two deployments never collide on one name. */
+function nameFor(target, prefix, suffix) {
+    return target.chainIsEphemeral ? `${prefix}A` : `${prefix}A${suffix()}`;
+}
+function devnetSuffixFor(target, prefix) {
+    let cached = null;
+    return () => {
+        if (cached)
+            return cached;
+        for (const { nodeId } of store.summary(target)) {
+            const m = new RegExp(`^${prefix}A(\\d+)$`).exec(nodeId);
+            if (m)
+                return (cached = m[1]);
+        }
+        return (cached = String(Date.now()).slice(-6));
+    };
+}
+/**
+ * The registry service: refuse retired settings, build the own-node client (never the target's node URL,
+ * FR-012), claim/resolve the operator identity, register the registry module with the SDK shell,
+ * and start it. Everything the shell owns (owner lock, banner, control socket, stale-socket
+ * recovery, node-control restart, signals) is the SDK's.
+ */
+export async function startRegistryService(options) {
+    refuseRetiredSettings(); // FR-031
+    const nodeUrl = options.shell?.nodeUrl ?? MANAGED_PROCESSOR_DEFAULTS.nodeUrl; // FR-012: never the target's node URL
+    const node = new NodeClient({ baseUrl: nodeUrl, fetch: deadlineFetch(CHAIN_TIMEOUT_MS) });
+    // ── operator identity + read-only mode (ported from the old service branch of src/app.ts) ──
+    const readOnly = registryReadOnly();
+    // READ-ONLY: the installer's registry never claims or signs with any identity. The operator is
+    // the PINNED channel operator; no sender identity is ever loaded or claimed, so the identity()
+    // claim path is never reached in this mode. A read-only registry without a valid pinned operator
+    // has nobody to trust the channel's terms to, so it refuses at startup rather than proceeding
+    // owner-less.
+    const pinnedOperator = registryChannelOperator();
+    if (readOnly && !pinnedOperator)
+        throw new Error("REGISTRY_READ_ONLY=1 requires a valid REGISTRY_CHANNEL_OPERATOR naming the identity " +
+            "that owns the index channel; the installer's rendered compose always sets both.");
+    // This app's own name, from package.json — never a literal, so a rename cannot leave a stale one.
+    const appName = (() => {
+        try {
+            return JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8")).name ?? "app";
+        }
+        catch {
+            return "app";
+        }
+    })();
+    const prefix = identityPrefix(appName);
+    const suffix = devnetSuffixFor(options.target, prefix);
+    const operator = readOnly ? pinnedOperator : store.get(options.target, "sender")?.nodeId ?? nameFor(options.target, prefix, suffix);
+    const nodeIdentity = process.env.APP_NODE_ID?.trim() ?? "";
+    const faucet = new NodeClient({ baseUrl: options.target.faucetUrl, fetch: deadlineFetch(CHAIN_TIMEOUT_MS) });
+    /** Load, or claim and persist, the sender identity. Only the "sender" role is ever used by the
+     *  registry. Reconciles against the chain (the faucet's committed view) rather than trusting
+     *  state — see the extensive note that lived in the old app.ts service branch. */
+    const identity = async () => {
+        if (readOnly)
+            throw new Error("read-only registry must never claim or sign with any identity");
+        const existing = store.get(options.target, "sender");
+        if (existing) {
+            const onChain = await faucet.getIdentity(existing.nodeId);
+            if (onChain !== null)
+                return { sender: existing, signer: store.signerFor(existing) };
+            options.say(`   sender: ${existing.nodeId} is in state but not on chain — claiming it now`);
+            const retry = await faucet.claimIdentity(existing);
+            if (retry.kind === "committed")
+                return { sender: existing, signer: store.signerFor(existing) };
+            if (retry.kind === "exists") {
+                throw new Error(`'${existing.nodeId}' is on chain with keys this app does not hold.\n` +
+                    `  state/${options.target.name} is stale for 'sender'. npm run state:reset` +
+                    (options.target.chainIsEphemeral ? ` (or npm run reset for chain + state)` : ``));
+            }
+            throw new Error(`re-claim of '${existing.nodeId}' failed: ${retry.error}` +
+                `${retry.message ? ` — ${retry.message}` : ""}`);
+        }
+        const name = nameFor(options.target, prefix, suffix);
+        if (!isValidNodeId(name)) {
+            throw new Error(`'${name}' is not a usable identity name — the node requires 1–50 ASCII ` +
+                `alphanumeric characters (letters and digits only).`);
+        }
+        const id = store.create(options.target, "sender", name);
+        const r = await faucet.claimIdentity(id);
+        switch (r.kind) {
+            case "committed": return { sender: id, signer: store.signerFor(id) };
+            case "exists":
+                throw new Error(`'${name}' already exists on chain and these keys are not its keys.\n` +
+                    (!options.target.chainIsEphemeral
+                        ? `  this target's state was reset but the name was reused — npm run state:reset, then retry`
+                        : process.env.EVOLVER_IN_CONTAINER === "1"
+                            ? `  the chain outlived the app's state. Discard both together:\n` +
+                                `    docker compose down -v      (or: docker compose -f oci://<ref> down -v)`
+                            : `  the local chain outlived its state: npm run reset  (chain + state together)`));
+            case "failed":
+                if (r.error === "digest_mismatch") {
+                    throw new Error(`CLAIM RECIPE DRIFT — ${r.message}\n` +
+                        `  Nothing was signed. The node and @mcsherrylabs/evolver-client disagree on the\n` +
+                        `  proof-of-possession digest, which means their versions do not match.`);
+                }
+                throw new Error(`claim of '${name}' failed: ${r.error}${r.message ? ` — ${r.message}` : ""}`);
+        }
+    };
+    /** Wait until this own node can actually write (stopped bulk-syncing) before provisioning. */
+    const beforeProvision = async () => {
+        const deadline = Date.now() + 180_000;
+        let last = await node.currentRound();
+        let announced = false;
+        while (Date.now() < deadline) {
+            await new Promise((r) => setTimeout(r, 500));
+            const now = await node.currentRound();
+            const advanced = now - last;
+            last = now;
+            if (advanced < 5)
+                return;
+            if (!announced) {
+                options.say(`   this node is still catching up (round ${now}, +${advanced}/500ms) — waiting`);
+                announced = true;
+            }
+        }
+        throw new Error(`this node is still bulk-syncing after 3 minutes (round ${last}).\n` +
+            `  A submit would be accepted and then sit unrouted, so nothing is sent.`);
+    };
+    const module = registryModule({
+        chain: options.target.name, node, chainUrl: nodeUrl,
+        chainAgreedUrl: options.target.faucetUrl, operator, nodeIdentity, readOnly, identity,
+        beforeProvision, say: options.say,
+    });
+    ensureStateDir(options.target);
+    return startManagedProcessor({ ...options.shell,
+        recovery: { service: "registry", command: `node ${fileURLToPath(new URL("../scripts/recover-owner.js", import.meta.url))} --force` },
+        paths: { ...options.shell?.paths, state: registryStatePath(options.target) },
+        storeModules: [module.worker], lifecycle: [module.lifecycle],
+        routes: runtime => registryReadRoutes(runtime, async () => String(await node.currentRound())),
+        say: options.say });
+}

package/dist/installer.d.ts

@@ -1,11 +1,13 @@
+export type Mode = 'devnet' | 'local';
 export interface Installation {
     version: 1;
     uid: number;
     id: string;
     dir: string;
     project: string;
+    mode: Mode;
     nodeId: string;
-    committeeId: string;
+    committeeId?: string;
     identity: string;
     registryOperator: string;
     channel: string;
@@ -21,17 +23,20 @@ export interface Installation {
 }
 export interface InstallerDeps {
     command(command: string, args: string[], env?: NodeJS.ProcessEnv, cwd?: string): Promise<string>;
-    committeeReady(state: Installation, env: NodeJS.ProcessEnv): Promise<void>;
+    committeeReady?(state: Installation, env: NodeJS.ProcessEnv): Promise<void>;
     nodeBinding(state: Installation, env: NodeJS.ProcessEnv): Promise<{
         chainId: string;
         nodeId: string;
     }>;
     registryReady(state: Installation, env: NodeJS.ProcessEnv): Promise<void>;
     bootstrap(state: Installation, env: NodeJS.ProcessEnv): Promise<void>;
+    claimChannel?(state: Installation, env: NodeJS.ProcessEnv): Promise<void>;
 }
 export declare function managedDirectory(env?: NodeJS.ProcessEnv): string;
-export declare const managedConfigPath: (env?: NodeJS.ProcessEnv) => string;
-export declare function pinnedRegistration(version: string): {
+/** Per-mode state directory. The 0.8.0 path `<state>/meerkat/` (installation.json) is never used. */
+export declare function modeDirectory(mode: Mode, env?: NodeJS.ProcessEnv): string;
+export declare const managedConfigPath: (mode?: Mode, env?: NodeJS.ProcessEnv) => string;
+export declare function pinnedRegistration(version: string, mode?: Mode): {
     mcpServers: {
         meerkat: {
             command: string;
@@ -40,6 +45,152 @@ export declare function pinnedRegistration(version: string): {
     };
 };
 export declare function renderDeployment(state: Installation): {
+    name: string;
+    services: {
+        node: {
+            image: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+            container_name: string;
+            entrypoint: string[];
+            build: {
+                context: string;
+                dockerfile: string;
+                labels: {
+                    "io.meerkat.installation": string;
+                };
+                args: {
+                    EVOLVER_NODE_IMAGE: string;
+                };
+            };
+            environment: {
+                APP_NODE_ID: string;
+                DEVNET_API: string;
+                EVOLVER_UPSTREAM_NODE_ID: string;
+                EVOLVER_DA_PEERS: string;
+                EVOLVER_ALLOWED_OUTBOUND: string;
+                EVOLVER_EXECUTION_ENABLED: string;
+                EVOLVER_NODE_PORT: string;
+                EVOLVER_NODE_CONFIG?: undefined;
+                CLAIM_TIMEOUT?: undefined;
+                CLAIM_WATCH_SECS?: undefined;
+            };
+            group_add: string[];
+            volumes: string[];
+            restart: string;
+        };
+        registry: {
+            image: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+            container_name: string;
+            build: {
+                context: string;
+                dockerfile: string;
+                labels: {
+                    "io.meerkat.installation": string;
+                };
+                args: {
+                    EVOLVER_PROCESSOR_IMAGE: string;
+                };
+            };
+            user: string;
+            group_add: string[];
+            environment: {
+                EVOLVER_FAUCET_URL: string;
+                EVOLVER_CHAIN_ID: string;
+                APP_NODE_ID: string;
+                REGISTRY_CHANNEL: string;
+                REGISTRY_CHANNEL_OPERATOR: string;
+                REGISTRY_READ_ONLY: string;
+                REGISTRY_CONTENT_URL: string;
+                EVOLVER_DEVNET_URL?: string | undefined;
+                EVOLVER_TARGET: string;
+                EVOLVER_NODE: string;
+            };
+            volumes: string[];
+            restart: string;
+        };
+        'subscriptions-init': {
+            image: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+            profiles: string[];
+            user: string;
+            environment: {
+                EVOLVER_INITIAL_CHANNELS: string;
+                EVOLVER_OPERATOR_UID: string;
+                EVOLVER_OPERATOR_GID: string;
+                EVOLVER_FAUCET_URL: string;
+                EVOLVER_CHAIN_ID: string;
+                APP_NODE_ID: string;
+                REGISTRY_CHANNEL: string;
+                REGISTRY_CHANNEL_OPERATOR: string;
+                REGISTRY_READ_ONLY: string;
+                REGISTRY_CONTENT_URL: string;
+                EVOLVER_DEVNET_URL?: string | undefined;
+                EVOLVER_TARGET: string;
+                EVOLVER_NODE: string;
+            };
+            entrypoint: string[];
+            command: string[];
+            volumes: string[];
+        };
+        committee?: undefined;
+    };
+    volumes: {
+        'node-data': {
+            name: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+        };
+        'app-state': {
+            name: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+        };
+        subscriptions: {
+            name: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+        };
+        'agent-state': {
+            name: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+        };
+        'node-control': {
+            name: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+        };
+        control: {
+            name: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+        };
+        'committee-data'?: undefined;
+        genesis?: undefined;
+    };
+    networks: {
+        default: {
+            name: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+            internal?: undefined;
+        };
+    };
+} | {
     name: string;
     services: {
         committee: {
@@ -60,7 +211,7 @@ export declare function renderDeployment(state: Installation): {
             };
             entrypoint: string[];
             environment: {
-                NODE_ID: string;
+                NODE_ID: string | undefined;
                 PUBLIC_HOST: string;
             };
             group_add: string[];
@@ -87,12 +238,14 @@ export declare function renderDeployment(state: Installation): {
             environment: {
                 APP_NODE_ID: string;
                 DEVNET_API: string;
-                EVOLVER_UPSTREAM_NODE_ID: string;
+                EVOLVER_UPSTREAM_NODE_ID: string | undefined;
                 EVOLVER_ALLOWED_OUTBOUND: string;
                 EVOLVER_EXECUTION_ENABLED: string;
                 EVOLVER_NODE_PORT: string;
+                EVOLVER_NODE_CONFIG: string;
                 CLAIM_TIMEOUT: string;
                 CLAIM_WATCH_SECS: string;
+                EVOLVER_DA_PEERS?: undefined;
             };
             group_add: string[];
             volumes: string[];
@@ -110,20 +263,23 @@ export declare function renderDeployment(state: Installation): {
                 labels: {
                     "io.meerkat.installation": string;
                 };
+                args: {
+                    EVOLVER_PROCESSOR_IMAGE: string;
+                };
             };
             user: string;
+            group_add: string[];
             environment: {
-                EVOLVER_TARGET: string;
-                EVOLVER_NODE: string;
                 EVOLVER_FAUCET_URL: string;
                 EVOLVER_CHAIN_ID: string;
                 APP_NODE_ID: string;
-                EVOLVER_SUBSCRIPTIONS_FILE: string;
                 REGISTRY_CHANNEL: string;
                 REGISTRY_CHANNEL_OPERATOR: string;
+                REGISTRY_READ_ONLY: string;
                 REGISTRY_CONTENT_URL: string;
-                PROCESSOR_HTTP_PORT: string;
-                PROCESSOR_READ_HOST: string;
+                EVOLVER_DEVNET_URL?: string | undefined;
+                EVOLVER_TARGET: string;
+                EVOLVER_NODE: string;
             };
             volumes: string[];
             restart: string;
@@ -139,17 +295,16 @@ export declare function renderDeployment(state: Installation): {
                 EVOLVER_INITIAL_CHANNELS: string;
                 EVOLVER_OPERATOR_UID: string;
                 EVOLVER_OPERATOR_GID: string;
-                EVOLVER_TARGET: string;
-                EVOLVER_NODE: string;
                 EVOLVER_FAUCET_URL: string;
                 EVOLVER_CHAIN_ID: string;
                 APP_NODE_ID: string;
-                EVOLVER_SUBSCRIPTIONS_FILE: string;
                 REGISTRY_CHANNEL: string;
                 REGISTRY_CHANNEL_OPERATOR: string;
+                REGISTRY_READ_ONLY: string;
                 REGISTRY_CONTENT_URL: string;
-                PROCESSOR_HTTP_PORT: string;
-                PROCESSOR_READ_HOST: string;
+                EVOLVER_DEVNET_URL?: string | undefined;
+                EVOLVER_TARGET: string;
+                EVOLVER_NODE: string;
             };
             entrypoint: string[];
             command: string[];
@@ -193,6 +348,18 @@ export declare function renderDeployment(state: Installation): {
                 "io.meerkat.installation": string;
             };
         };
+        'node-control': {
+            name: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+        };
+        control: {
+            name: string;
+            labels: {
+                "io.meerkat.installation": string;
+            };
+        };
     };
     networks: {
         default: {
@@ -205,11 +372,11 @@ export declare function renderDeployment(state: Installation): {
     };
 };
 export declare function operatorEnvironment(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
-export declare function managedInstallation(env?: NodeJS.ProcessEnv): Promise<Installation | undefined>;
+export declare function managedInstallation(mode?: Mode, env?: NodeJS.ProcessEnv): Promise<Installation | undefined>;
 /** Protocol-only stdio bridge, one new facade/private child/session per harness connection.
  * Docker exec works even when daemon and harness share neither filesystem nor loopback. */
 export declare function serveManaged(state: Installation, env?: NodeJS.ProcessEnv): Promise<void>;
-export declare function installMeerkat(env?: NodeJS.ProcessEnv, deps?: InstallerDeps): Promise<{
+export declare function installMeerkat(mode?: Mode, env?: NodeJS.ProcessEnv, deps?: InstallerDeps): Promise<{
     dir: string;
     configPath: string;
     registration: {

package/dist/installer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../src/installer.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,CAAC,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IACvG,QAAQ,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IACvI,cAAc,EAAE,SAAS,GAAG,WAAW,GAAG,UAAU,CAAC;IAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACnH;AACD,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjG,cAAc,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,WAAW,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvG,aAAa,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvE;AACD,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAI7E;AACD,eAAO,MAAM,iBAAiB,GAAI,MAAK,MAAM,CAAC,UAAwB,KAAG,MAA0D,CAAC;AACpI,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM;;;;;;;EAGjD;AACD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsCnD;AA2BD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAK7E;AAwDD,wBAAsB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAOjH;AACD;2FAC2F;AAC3F,wBAAsB,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgC3G;AACD,wBAAsB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,EAAE,IAAI,GAAE,aAAwB;;;;;;;;;;;GAiFxG"}
+{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../src/installer.ts"],"names":[],"mappings":"AA4CA,MAAM,MAAM,IAAI,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEtC,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,CAAC,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAC9E,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAClG,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAC1E,cAAc,EAAE,SAAS,GAAG,WAAW,GAAG,UAAU,CAAC;IAAC,KAAK,CAAC,EAAE,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACnH;AACD,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjG,cAAc,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,WAAW,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvG,aAAa,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,YAAY,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AACD,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAI7E;AACD,qGAAqG;AACrG,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAEtF;AACD,eAAO,MAAM,iBAAiB,GAAI,OAAM,IAAe,EAAE,MAAK,MAAM,CAAC,UAAwB,KAAG,MAC3C,CAAC;AAEtD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,IAAe;;;;;;;EAGxE;AAkBD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqEnD;AA+BD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAK7E;AAwED,wBAAsB,mBAAmB,CAAC,IAAI,GAAE,IAAe,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAOxI;AACD;2FAC2F;AAC3F,wBAAsB,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgC3G;AACD,wBAAsB,cAAc,CAAC,IAAI,GAAE,IAAe,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,EAAE,IAAI,GAAE,aAAwB;;;;;;;;;;;GAgG/H"}