@meru454545/nexus-modscript-composer 2.0.12 → 2.0.13

package/README.md

@@ -152,9 +152,9 @@ const result = await generateFinalScript([nexusDeletionL0], {
 });
 ```
 
-This produces the isolated task `\NexusDeletionVerifier\NexusDeletionVerifier-<jobId>` and only uses `C:\ProgramData\NexusDeletionVerifier\<jobId>`. It does not share the normal `NexusModScripts` root. L1 writes `completion.ack` only when all three conditions hold: the L0 result has `data.complete: true`, its `data.job_id` matches the configured job, and Iceberg returned a 2xx response for that exact envelope. L2 then unregisters the verifier task and deletes only its isolated root.
+This produces the isolated task `\NexusDeletionVerifier\NexusDeletionVerifier-<jobId>` and only uses `C:\ProgramData\NexusDeletionVerifier\<jobId>`. It does not share the normal `NexusModScripts` root. The post-RMM finisher is embedded in this verifier; no second finisher script or scheduled task is created. It remains dormant until Iceberg creates `delete.intent` in the job root. L1 writes `completion.ack` only when all three conditions hold: the L0 result has `data.complete: true`, its `data.job_id` matches the configured job, and Iceberg returned a 2xx response for that exact envelope. L2 then unregisters the verifier task and deletes only its isolated root.
 
-The normal bulk cleanup helper is [`scripts/purge-nexus-modscripts.ps1`](scripts/purge-nexus-modscripts.ps1). It removes regular `\NexusModScripts\` deployments and deliberately never removes a deletion verifier.
+For a deletion job, run [`scripts/prepare-nexus-rmm-deletion.ps1`](scripts/prepare-nexus-rmm-deletion.ps1). It combines ordinary ModScript purging with the silent Nexus Endpoint desktop-app uninstall while deliberately preserving `nexusrmm`, Nexus Mesh, and the isolated verifier. [`scripts/purge-nexus-modscripts.ps1`](scripts/purge-nexus-modscripts.ps1) remains available as the backwards-compatible purge-only helper.
 
 ### Iceberg controller contract
 
@@ -176,4 +176,20 @@ The controller must create a unique job ID and callback token, deploy the verifi
 }
 ```
 
-Require the scoped token plus `X-Nexus-Deletion-Job` to match the job. Deduplicate `X-Nexus-Event-Id`; persist every non-complete scan as progress; and mark the job complete only after receiving this complete event. Record `AUOptions` before installation and pass that original value (or `null` when absent) as `expectedWindowsUpdateAuOptions`; restore it before accepting completion. For existing machines that lack this installation-time journal, require an explicit administrator-selected baseline and keep the job pending until one is supplied. Do not rely on the TacticalRMM DELETE HTTP response as proof of endpoint cleanup: it removes the management record before the agent-side uninstall has necessarily finished. Start the verifier after all ordinary modular scripts have been purged and before the first endpoint/RMM removal action, so it remains available to observe the final state.
+Require the scoped token plus `X-Nexus-Deletion-Job` to match the job. Deduplicate `X-Nexus-Event-Id`; persist every non-complete scan as progress; and mark the job complete only after receiving this complete event. Record `AUOptions` before installation and pass that original value (or `null` when absent) as `expectedWindowsUpdateAuOptions`; restore it before accepting completion. For existing machines that lack this installation-time journal, require an explicit administrator-selected baseline and keep the job pending until one is supplied. Do not rely on the TacticalRMM DELETE HTTP response as proof of endpoint cleanup: it removes the management record before the agent-side uninstall has necessarily finished.
+
+Use this controller order:
+
+1. Create and durably persist the deletion job, scoped callback token, RMM agent ID, and recorded `AUOptions` baseline.
+2. Generate and run the deletion-verifier L2. L2 registers and immediately starts `\NexusDeletionVerifier\NexusDeletionVerifier-<jobId>`. Wait for at least one authenticated progress callback so the verifier is known to be alive.
+3. While `nexusrmm` is still connected, run `prepare-nexus-rmm-deletion.ps1` as Administrator. Require its JSON result to be `prepared` or explicitly accept `prepared_with_warnings` after recording the warnings. Do not advance on `preparation_incomplete`; record its `remaining` list and retry or investigate.
+4. Commit the irreversible deletion intent/outbox entry in Iceberg, then create the verifier gate on the machine:
+
+   ```powershell
+   New-Item -ItemType File -Path "C:\ProgramData\NexusDeletionVerifier\<jobId>\delete.intent" -Force | Out-Null
+   ```
+
+5. Immediately call TacticalRMM `DELETE /agents/<rmm-agent-id>/`. The next verifier run sees the intent, waits up to five minutes for the normal agent uninstall, invokes the local RMM uninstaller only as a fallback, performs allowlisted residual cleanup, restores `AUOptions`, and then runs the read-only L0 scan.
+6. Keep the job pending until the authenticated `complete: true` event is accepted. That 2xx acknowledgement creates `completion.ack`; the existing verifier wrapper then deletes its own scheduled task and isolated job directory.
+
+Steps 4 and 5 must be retryable from the durable outbox state. Creating `delete.intent`, calling TacticalRMM DELETE, running the embedded finisher, processing callback event IDs, and acknowledging an already-complete job are all designed to be idempotent. Never purge `C:\ProgramData\NexusDeletionVerifier` from the controller; the acknowledged verifier removes itself.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meru454545/nexus-modscript-composer",
-  "version": "2.0.12",
+  "version": "2.0.13",
   "description": "Compose multi-layer deployment scripts for NexusEPM agents (L0 → L1 → L2 pipeline)",
   "type": "module",
   "main": "./dist/index.js",