@osva-ai/cli 1.1.0 → 1.1.2

package/dist/platform/upgrade/state.d.ts

@@ -0,0 +1,31 @@
+export declare const UPGRADE_STATE_RELATIVE: string;
+export declare const UPGRADE_LOCK_RELATIVE: string;
+export type UpgradePhase = "locked" | "pulling_image" | "prepared_configuration" | "stopped_applications" | "migrating" | "migration_failed" | "starting_applications" | "validating_readiness" | "completed" | "failed";
+export interface UpgradeState {
+    readonly schemaVersion: 1;
+    readonly phase: UpgradePhase;
+    readonly fromPlatformVersion: string;
+    readonly toPlatformVersion: string;
+    readonly fromImageRef: string;
+    readonly targetImageRef: string;
+    readonly startedAt: string;
+    readonly updatedAt: string;
+    readonly lastError?: string;
+    readonly migrationRequired: boolean;
+}
+export interface UpgradeLock {
+    readonly schemaVersion: 1;
+    readonly pid: number;
+    readonly startedAt: string;
+    readonly hostname: string;
+}
+export declare function readUpgradeState(installDir: string): Promise<UpgradeState | undefined>;
+export declare function writeUpgradeState(installDir: string, state: UpgradeState): Promise<void>;
+export declare function clearUpgradeState(installDir: string): Promise<void>;
+export declare function isUpgradeInProgress(state: UpgradeState | undefined): boolean;
+export declare function isIncompleteUpgrade(state: UpgradeState | undefined): boolean;
+export declare function recoveryGuidance(state: UpgradeState): string;
+export declare function acquireUpgradeLock(installDir: string): Promise<void>;
+export declare function releaseUpgradeLock(installDir: string): Promise<void>;
+export declare function upgradeStateExists(installDir: string): Promise<boolean>;
+//# sourceMappingURL=state.d.ts.map

package/dist/platform/upgrade/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../src/platform/upgrade/state.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,sBAAsB,QAA2C,CAAC;AAC/E,eAAO,MAAM,qBAAqB,QAAqC,CAAC;AAExE,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,eAAe,GACf,wBAAwB,GACxB,sBAAsB,GACtB,WAAW,GACX,kBAAkB,GAClB,uBAAuB,GACvB,sBAAsB,GACtB,WAAW,GACX,QAAQ,CAAC;AAEb,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACrC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAYnC;AAED,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOzE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,CAS5E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,CAS5E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAoB5D;AAED,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB1E;AAED,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO1E;AA2BD,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO7E"}

package/dist/platform/upgrade/state.js

@@ -0,0 +1,129 @@
+import os from "node:os";
+import { readFile, stat, unlink } from "node:fs/promises";
+import path from "node:path";
+import { writeFileAtomic } from "../../setup/atomic-write.js";
+export const UPGRADE_STATE_RELATIVE = path.join(".osva", "upgrade-state.json");
+export const UPGRADE_LOCK_RELATIVE = path.join(".osva", "upgrade.lock");
+export async function readUpgradeState(installDir) {
+    const statePath = path.join(installDir, UPGRADE_STATE_RELATIVE);
+    try {
+        const raw = await readFile(statePath, "utf8");
+        const parsed = JSON.parse(raw);
+        if (parsed.schemaVersion !== 1) {
+            return undefined;
+        }
+        return parsed;
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function writeUpgradeState(installDir, state) {
+    const statePath = path.join(installDir, UPGRADE_STATE_RELATIVE);
+    await writeFileAtomic(statePath, `${JSON.stringify(state, null, 2)}\n`, {
+        restrictPermissions: true,
+    });
+}
+export async function clearUpgradeState(installDir) {
+    const statePath = path.join(installDir, UPGRADE_STATE_RELATIVE);
+    try {
+        await unlink(statePath);
+    }
+    catch {
+        // ignore missing
+    }
+}
+export function isUpgradeInProgress(state) {
+    if (state === undefined) {
+        return false;
+    }
+    return (state.phase !== "completed" &&
+        state.phase !== "failed" &&
+        state.phase !== "migration_failed");
+}
+export function isIncompleteUpgrade(state) {
+    if (state === undefined) {
+        return false;
+    }
+    return (state.phase === "failed" ||
+        state.phase === "migration_failed" ||
+        isUpgradeInProgress(state));
+}
+export function recoveryGuidance(state) {
+    switch (state.phase) {
+        case "migration_failed":
+        case "failed":
+            return [
+                "An upgrade did not finish successfully.",
+                "Database schema may be ahead of the running image — do not downgrade the application image without operator review.",
+                "Inspect `osva platform status`, PostgreSQL logs, and docs/operations/UPGRADE.md.",
+                state.lastError === undefined ? "" : `Last error: ${state.lastError}`,
+            ]
+                .filter((line) => line.length > 0)
+                .join("\n");
+        case "stopped_applications":
+        case "migrating":
+        case "starting_applications":
+        case "validating_readiness":
+            return "Upgrade was interrupted mid-flight. Re-run `osva platform upgrade` with the same --to version after resolving Docker health, or follow docs/operations/UPGRADE.md for manual recovery.";
+        default:
+            return "See docs/operations/UPGRADE.md for incomplete upgrade recovery.";
+    }
+}
+export async function acquireUpgradeLock(installDir) {
+    const lockPath = path.join(installDir, UPGRADE_LOCK_RELATIVE);
+    const existing = await readUpgradeLock(installDir);
+    if (existing !== undefined && isProcessAlive(existing.pid)) {
+        throw new Error(`Another upgrade appears in progress (pid ${String(existing.pid)} since ${existing.startedAt}).`);
+    }
+    const lock = {
+        schemaVersion: 1,
+        pid: process.pid,
+        startedAt: new Date().toISOString(),
+        hostname: osHostname(),
+    };
+    await writeFileAtomic(lockPath, `${JSON.stringify(lock, null, 2)}\n`, {
+        restrictPermissions: true,
+    });
+}
+export async function releaseUpgradeLock(installDir) {
+    const lockPath = path.join(installDir, UPGRADE_LOCK_RELATIVE);
+    try {
+        await unlink(lockPath);
+    }
+    catch {
+        // ignore
+    }
+}
+async function readUpgradeLock(installDir) {
+    const lockPath = path.join(installDir, UPGRADE_LOCK_RELATIVE);
+    try {
+        const raw = await readFile(lockPath, "utf8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+}
+function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function osHostname() {
+    return os.hostname();
+}
+export async function upgradeStateExists(installDir) {
+    try {
+        await stat(path.join(installDir, UPGRADE_STATE_RELATIVE));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=state.js.map

package/dist/platform/upgrade/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../../src/platform/upgrade/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;AAC/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;AAkCxE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAkB;IAElB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;QAC/C,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAkB,EAClB,KAAmB;IAEnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;IAChE,MAAM,eAAe,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QACtE,mBAAmB,EAAE,IAAI;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACxD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAA+B;IACjE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,KAAK,CAAC,KAAK,KAAK,WAAW;QAC3B,KAAK,CAAC,KAAK,KAAK,QAAQ;QACxB,KAAK,CAAC,KAAK,KAAK,kBAAkB,CACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAA+B;IACjE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,KAAK,CAAC,KAAK,KAAK,QAAQ;QACxB,KAAK,CAAC,KAAK,KAAK,kBAAkB;QAClC,mBAAmB,CAAC,KAAK,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAmB;IAClD,QAAQ,KAAK,CAAC,KAAK,EAAE,CAAC;QACpB,KAAK,kBAAkB,CAAC;QACxB,KAAK,QAAQ;YACX,OAAO;gBACL,yCAAyC;gBACzC,qHAAqH;gBACrH,kFAAkF;gBAClF,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,SAAS,EAAE;aACtE;iBACE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;iBACjC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,KAAK,sBAAsB,CAAC;QAC5B,KAAK,WAAW,CAAC;QACjB,KAAK,uBAAuB,CAAC;QAC7B,KAAK,sBAAsB;YACzB,OAAO,wLAAwL,CAAC;QAClM;YACE,OAAO,iEAAiE,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAkB;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,SAAS,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,4CAA4C,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,QAAQ,CAAC,SAAS,IAAI,CACjG,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAgB;QACxB,aAAa,EAAE,CAAC;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,QAAQ,EAAE,UAAU,EAAE;KACvB,CAAC;IACF,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QACpE,mBAAmB,EAAE,IAAI;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAkB;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,UAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAkB;IACzD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/platform/upgrade/version.d.ts

@@ -0,0 +1,11 @@
+export interface ParsedPlatformVersion {
+    readonly major: number;
+    readonly minor: number;
+    readonly patch: number;
+    readonly prerelease: readonly string[];
+    readonly raw: string;
+}
+export declare function parsePlatformVersion(raw: string): ParsedPlatformVersion;
+/** Semantic ordering for OSVA platform versions (not lexical string compare). */
+export declare function comparePlatformVersions(left: string, right: string): -1 | 0 | 1;
+//# sourceMappingURL=version.d.ts.map

package/dist/platform/upgrade/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../../../src/platform/upgrade/version.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,qBAAqB,CAevE;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAoDZ"}

package/dist/platform/upgrade/version.js

@@ -0,0 +1,70 @@
+export function parsePlatformVersion(raw) {
+    const trimmed = raw.trim();
+    const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(trimmed);
+    if (match === null) {
+        throw new Error(`Invalid platform version '${raw}'.`);
+    }
+    const major = Number(match[1]);
+    const minor = Number(match[2]);
+    const patch = Number(match[3]);
+    const prereleaseRaw = match[4];
+    const prerelease = prereleaseRaw === undefined || prereleaseRaw.length === 0
+        ? []
+        : prereleaseRaw.split(".");
+    return { major, minor, patch, prerelease, raw: trimmed };
+}
+/** Semantic ordering for OSVA platform versions (not lexical string compare). */
+export function comparePlatformVersions(left, right) {
+    const a = parsePlatformVersion(left);
+    const b = parsePlatformVersion(right);
+    if (a.major !== b.major) {
+        return a.major < b.major ? -1 : 1;
+    }
+    if (a.minor !== b.minor) {
+        return a.minor < b.minor ? -1 : 1;
+    }
+    if (a.patch !== b.patch) {
+        return a.patch < b.patch ? -1 : 1;
+    }
+    const aPre = a.prerelease.length > 0;
+    const bPre = b.prerelease.length > 0;
+    if (!aPre && !bPre) {
+        return 0;
+    }
+    if (!aPre && bPre) {
+        return 1;
+    }
+    if (aPre && !bPre) {
+        return -1;
+    }
+    const len = Math.max(a.prerelease.length, b.prerelease.length);
+    for (let index = 0; index < len; index += 1) {
+        const aPart = a.prerelease[index];
+        const bPart = b.prerelease[index];
+        if (aPart === undefined) {
+            return -1;
+        }
+        if (bPart === undefined) {
+            return 1;
+        }
+        const aNum = /^\d+$/.test(aPart) ? Number(aPart) : undefined;
+        const bNum = /^\d+$/.test(bPart) ? Number(bPart) : undefined;
+        if (aNum !== undefined && bNum !== undefined) {
+            if (aNum !== bNum) {
+                return aNum < bNum ? -1 : 1;
+            }
+            continue;
+        }
+        if (aNum !== undefined) {
+            return -1;
+        }
+        if (bNum !== undefined) {
+            return 1;
+        }
+        if (aPart !== bPart) {
+            return aPart < bPart ? -1 : 1;
+        }
+    }
+    return 0;
+}
+//# sourceMappingURL=version.js.map

package/dist/platform/upgrade/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../../src/platform/upgrade/version.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,6CAA6C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,IAAI,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,UAAU,GACd,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QACvD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC3D,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,uBAAuB,CACrC,IAAY,EACZ,KAAa;IAEb,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,CAAC,CAAC;QACZ,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,OAAO,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,CAAC,CAAC;QACZ,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACpB,OAAO,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/platform/upgrade-guard.d.ts

@@ -0,0 +1,2 @@
+export declare function assertPlatformLifecycleAllowed(installDir: string, action: string): Promise<void>;
+//# sourceMappingURL=upgrade-guard.d.ts.map

package/dist/platform/upgrade-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade-guard.d.ts","sourceRoot":"","sources":["../../src/platform/upgrade-guard.ts"],"names":[],"mappings":"AAQA,wBAAsB,8BAA8B,CAClD,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/platform/upgrade-guard.js

@@ -0,0 +1,12 @@
+import { isIncompleteUpgrade, isUpgradeInProgress, readUpgradeState, recoveryGuidance, } from "./upgrade/state.js";
+import { PlatformCommandError } from "./types.js";
+export async function assertPlatformLifecycleAllowed(installDir, action) {
+    const state = await readUpgradeState(installDir);
+    if (isUpgradeInProgress(state)) {
+        throw new PlatformCommandError("installation_invalid", `Cannot ${action} while platform upgrade is in progress (phase ${state.phase}).`);
+    }
+    if (isIncompleteUpgrade(state) && state.phase !== "migration_failed") {
+        throw new PlatformCommandError("installation_invalid", `Cannot ${action} until the incomplete upgrade is resolved.\n${recoveryGuidance(state)}`);
+    }
+}
+//# sourceMappingURL=upgrade-guard.js.map

package/dist/platform/upgrade-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade-guard.js","sourceRoot":"","sources":["../../src/platform/upgrade-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,UAAkB,EAClB,MAAc;IAEd,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,oBAAoB,CAC5B,sBAAsB,EACtB,UAAU,MAAM,iDAAiD,KAAM,CAAC,KAAK,IAAI,CAClF,CAAC;IACJ,CAAC;IACD,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,KAAM,CAAC,KAAK,KAAK,kBAAkB,EAAE,CAAC;QACtE,MAAM,IAAI,oBAAoB,CAC5B,sBAAsB,EACtB,UAAU,MAAM,+CAA+C,gBAAgB,CAAC,KAAM,CAAC,EAAE,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/setup/acceptance-install.d.ts

@@ -0,0 +1,15 @@
+export declare function acceptanceInstallEnabled(env?: NodeJS.ProcessEnv): boolean;
+export declare function resolveSetupImageRef(input: {
+    readonly distributionImageRef: string;
+    readonly processEnv: NodeJS.ProcessEnv;
+}): string;
+export declare function writeAcceptanceSetupTokenFile(input: {
+    readonly processEnv: NodeJS.ProcessEnv;
+    readonly token: string;
+}): Promise<void>;
+export declare function writeAcceptanceBootstrapKeyFile(input: {
+    readonly processEnv: NodeJS.ProcessEnv;
+    readonly apiKey: string;
+}): Promise<void>;
+export declare function wipeAcceptanceBootstrapKeyFile(env?: NodeJS.ProcessEnv): Promise<void>;
+//# sourceMappingURL=acceptance-install.d.ts.map

package/dist/setup/acceptance-install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acceptance-install.d.ts","sourceRoot":"","sources":["../../src/setup/acceptance-install.ts"],"names":[],"mappings":"AAIA,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAET;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;CACxC,GAAG,MAAM,CAMT;AAED,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhB;AAED,wBAAsB,+BAA+B,CAAC,KAAK,EAAE;IAC3D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhB;AAED,wBAAsB,8BAA8B,CAClD,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,IAAI,CAAC,CAMf"}

package/dist/setup/acceptance-install.js

@@ -0,0 +1,44 @@
+import { writeFile } from "node:fs/promises";
+import { writeFileAtomic } from "./atomic-write.js";
+export function acceptanceInstallEnabled(env = process.env) {
+    return env.OSVA_ACCEPTANCE_INSTALL?.trim() === "1";
+}
+export function resolveSetupImageRef(input) {
+    const override = input.processEnv.OSVA_SETUP_LOCAL_IMAGE?.trim();
+    if (override !== undefined && override.length > 0) {
+        return override;
+    }
+    return input.distributionImageRef;
+}
+export async function writeAcceptanceSetupTokenFile(input) {
+    if (!acceptanceInstallEnabled(input.processEnv)) {
+        return;
+    }
+    const targetPath = input.processEnv.OSVA_SETUP_SETUP_TOKEN_FILE?.trim();
+    if (targetPath === undefined || targetPath.length === 0) {
+        return;
+    }
+    await writeFileAtomic(targetPath, `${input.token}\n`, {
+        restrictPermissions: true,
+    });
+}
+export async function writeAcceptanceBootstrapKeyFile(input) {
+    if (!acceptanceInstallEnabled(input.processEnv)) {
+        return;
+    }
+    const targetPath = input.processEnv.OSVA_SETUP_BOOTSTRAP_KEY_FILE?.trim();
+    if (targetPath === undefined || targetPath.length === 0) {
+        return;
+    }
+    await writeFileAtomic(targetPath, `${input.apiKey}\n`, {
+        restrictPermissions: true,
+    });
+}
+export async function wipeAcceptanceBootstrapKeyFile(env = process.env) {
+    const targetPath = env.OSVA_SETUP_BOOTSTRAP_KEY_FILE?.trim();
+    if (targetPath === undefined || targetPath.length === 0) {
+        return;
+    }
+    await writeFile(targetPath, "", { encoding: "utf8", mode: 0o600 });
+}
+//# sourceMappingURL=acceptance-install.js.map

package/dist/setup/acceptance-install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acceptance-install.js","sourceRoot":"","sources":["../../src/setup/acceptance-install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,UAAU,wBAAwB,CACtC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAGpC;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC;IACjE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,oBAAoB,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAGnD;IACC,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAC;IACxE,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO;IACT,CAAC;IACD,MAAM,eAAe,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE;QACpD,mBAAmB,EAAE,IAAI;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAGrD;IACC,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,6BAA6B,EAAE,IAAI,EAAE,CAAC;IAC1E,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO;IACT,CAAC;IACD,MAAM,eAAe,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE;QACrD,mBAAmB,EAAE,IAAI;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,CAAC;IAC7D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO;IACT,CAAC;IACD,MAAM,SAAS,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACrE,CAAC"}

package/dist/setup/atomic-write.d.ts

@@ -0,0 +1,4 @@
+export declare function writeFileAtomic(targetPath: string, contents: string, options?: {
+    readonly restrictPermissions?: boolean;
+}): Promise<void>;
+//# sourceMappingURL=atomic-write.d.ts.map

package/dist/setup/atomic-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-write.d.ts","sourceRoot":"","sources":["../../src/setup/atomic-write.ts"],"names":[],"mappings":"AAGA,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAAE,GACnD,OAAO,CAAC,IAAI,CAAC,CAoBf"}

package/dist/setup/atomic-write.js

@@ -0,0 +1,19 @@
+import { chmod, rename, writeFile } from "node:fs/promises";
+import path from "node:path";
+export async function writeFileAtomic(targetPath, contents, options) {
+    const directory = path.dirname(targetPath);
+    const baseName = path.basename(targetPath);
+    const tempPath = path.join(directory, `.${baseName}.${String(process.pid)}.tmp`);
+    await writeFile(tempPath, contents, { encoding: "utf8", flag: "wx" }).catch(async (error) => {
+        if (error.code === "EEXIST") {
+            await writeFile(tempPath, contents, { encoding: "utf8" });
+            return;
+        }
+        throw error;
+    });
+    await rename(tempPath, targetPath);
+    if (options?.restrictPermissions === true && process.platform !== "win32") {
+        await chmod(targetPath, 0o600);
+    }
+}
+//# sourceMappingURL=atomic-write.js.map

package/dist/setup/atomic-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-write.js","sourceRoot":"","sources":["../../src/setup/atomic-write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAkB,EAClB,QAAgB,EAChB,OAAoD;IAEpD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CACxB,SAAS,EACT,IAAI,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAC1C,CAAC;IACF,MAAM,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CACzE,KAAK,EAAE,KAA4B,EAAE,EAAE;QACrC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC,CACF,CAAC;IACF,MAAM,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACnC,IAAI,OAAO,EAAE,mBAAmB,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1E,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC"}

package/dist/setup/bootstrap-capture.d.ts

@@ -0,0 +1,9 @@
+export declare function parseBootstrapApiKey(stdout: string): string | undefined;
+export declare function parseWorkspaceBootstrapOutput(stdout: string): {
+    readonly workspaceId?: string;
+    readonly alreadyCompleted: boolean;
+    readonly apiKey?: string;
+};
+export declare function parseIdentityBootstrapSetupToken(stdout: string): string | undefined;
+export declare function redactBootstrapSubprocessOutput(text: string): string;
+//# sourceMappingURL=bootstrap-capture.d.ts.map

package/dist/setup/bootstrap-capture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-capture.d.ts","sourceRoot":"","sources":["../../src/setup/bootstrap-capture.ts"],"names":[],"mappings":"AAUA,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGvE;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG;IAC7D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAWA;AAED,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,SAAS,CAkBpB;AAED,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAapE"}

package/dist/setup/bootstrap-capture.js

@@ -0,0 +1,64 @@
+import { redactSecrets } from "../doctor/redact.js";
+const WORKSPACE_ID_PATTERN = /Workspace ID:\s*([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/i;
+const BOOTSTRAP_API_KEY_PATTERN = /(osva_ak_[0-9A-Za-z_-]+\.[0-9A-Za-z_-]+)/;
+const SETUP_TOKEN_MARKER = "One-time password setup token (single use; do not log or share):";
+export function parseBootstrapApiKey(stdout) {
+    const match = stdout.match(BOOTSTRAP_API_KEY_PATTERN);
+    return match?.[1];
+}
+export function parseWorkspaceBootstrapOutput(stdout) {
+    const alreadyCompleted = stdout.includes("Installation bootstrap has already completed");
+    const match = stdout.match(WORKSPACE_ID_PATTERN);
+    const apiKey = parseBootstrapApiKey(stdout);
+    return {
+        ...(match?.[1] === undefined ? {} : { workspaceId: match[1] }),
+        ...(apiKey === undefined ? {} : { apiKey }),
+        alreadyCompleted,
+    };
+}
+export function parseIdentityBootstrapSetupToken(stdout) {
+    const lines = stdout.split(/\r?\n/);
+    for (let index = 0; index < lines.length; index += 1) {
+        if (lines[index]?.trim() !== SETUP_TOKEN_MARKER) {
+            continue;
+        }
+        for (let next = index + 1; next < lines.length; next += 1) {
+            const candidate = lines[next]?.trim() ?? "";
+            if (candidate.length === 0) {
+                continue;
+            }
+            if (candidate.startsWith("Complete setup:")) {
+                return undefined;
+            }
+            return candidate;
+        }
+    }
+    return undefined;
+}
+export function redactBootstrapSubprocessOutput(text) {
+    let redacted = redactSecrets(text);
+    redacted = redactLineAfterMarker(redacted, SETUP_TOKEN_MARKER, "[setup-token-redacted]");
+    redacted = redactLineAfterMarker(redacted, "Copy the API key below now. It cannot be retrieved again:", "osva_ak_***");
+    return redacted;
+}
+function redactLineAfterMarker(text, marker, replacement) {
+    const lines = text.split(/\r?\n/);
+    const output = [];
+    for (let index = 0; index < lines.length; index += 1) {
+        output.push(lines[index] ?? "");
+        if (lines[index]?.trim() === marker) {
+            for (let next = index + 1; next < lines.length; next += 1) {
+                const candidate = lines[next]?.trim() ?? "";
+                if (candidate.length === 0) {
+                    output.push(lines[next] ?? "");
+                    continue;
+                }
+                output.push(replacement);
+                index = next;
+                break;
+            }
+        }
+    }
+    return output.join("\n");
+}
+//# sourceMappingURL=bootstrap-capture.js.map

package/dist/setup/bootstrap-capture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-capture.js","sourceRoot":"","sources":["../../src/setup/bootstrap-capture.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,MAAM,oBAAoB,GACxB,iFAAiF,CAAC;AAEpF,MAAM,yBAAyB,GAAG,0CAA0C,CAAC;AAE7E,MAAM,kBAAkB,GACtB,kEAAkE,CAAC;AAErE,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACtD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAK1D,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CACtC,8CAA8C,CAC/C,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO;QACL,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,MAAc;IAEd,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,kBAAkB,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QACD,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;YAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC5C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,SAAS;YACX,CAAC;YACD,IAAI,SAAS,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAC5C,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,IAAY;IAC1D,IAAI,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACnC,QAAQ,GAAG,qBAAqB,CAC9B,QAAQ,EACR,kBAAkB,EAClB,wBAAwB,CACzB,CAAC;IACF,QAAQ,GAAG,qBAAqB,CAC9B,QAAQ,EACR,2DAA2D,EAC3D,aAAa,CACd,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAY,EACZ,MAAc,EACd,WAAmB;IAEnB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YACpC,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;gBAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;gBAC5C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC3B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;oBAC/B,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACzB,KAAK,GAAG,IAAI,CAAC;gBACb,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC"}

package/dist/setup/compose-exec.d.ts

@@ -0,0 +1,21 @@
+import { type ProbeSpawnFn, type ProbeSpawnResult } from "./probe-spawn.js";
+export interface ComposeExecContext {
+    readonly installDir: string;
+    readonly envFilePath: string;
+    readonly projectName: string;
+}
+export interface ComposeExecOptions {
+    readonly spawn?: ProbeSpawnFn;
+    readonly timeoutMs: number;
+    readonly processEnv?: NodeJS.ProcessEnv;
+}
+export declare function buildComposeSpawnEnv(ctx: ComposeExecContext, processEnv?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function composeBaseArgs(ctx: ComposeExecContext): string[];
+export declare function runComposeCommand(ctx: ComposeExecContext, args: readonly string[], options: ComposeExecOptions): ProbeSpawnResult;
+export declare function assertComposeSuccess(result: ProbeSpawnResult, action: string): void;
+export declare function composeCommandIncludesDestructiveVolumeRemoval(args: readonly string[]): boolean;
+export declare class ComposeExecError extends Error {
+    readonly code: "timeout" | "command_failed";
+    constructor(code: "timeout" | "command_failed", message: string);
+}
+//# sourceMappingURL=compose-exec.d.ts.map

package/dist/setup/compose-exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose-exec.d.ts","sourceRoot":"","sources":["../../src/setup/compose-exec.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzC;AAED,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,kBAAkB,EACvB,UAAU,GAAE,MAAM,CAAC,UAAwB,GAC1C,MAAM,CAAC,UAAU,CAKnB;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAYjE;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,kBAAkB,EACvB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,kBAAkB,GAC1B,gBAAgB,CAMlB;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,MAAM,GACb,IAAI,CAgBN;AAED,wBAAgB,8CAA8C,CAC5D,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,OAAO,CAGT;AAWD,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,gBAAgB,CAAC;gBAEhC,IAAI,EAAE,SAAS,GAAG,gBAAgB,EAAE,OAAO,EAAE,MAAM;CAIhE"}

package/dist/setup/compose-exec.js

@@ -0,0 +1,55 @@
+import path from "node:path";
+import { redactSecrets } from "../doctor/redact.js";
+import { defaultProbeSpawn, } from "./probe-spawn.js";
+export function buildComposeSpawnEnv(ctx, processEnv = process.env) {
+    return {
+        ...processEnv,
+        COMPOSE_PROJECT_NAME: ctx.projectName,
+    };
+}
+export function composeBaseArgs(ctx) {
+    return [
+        "compose",
+        "--project-name",
+        ctx.projectName,
+        "--project-directory",
+        ctx.installDir,
+        "--env-file",
+        ctx.envFilePath,
+        "-f",
+        path.join(ctx.installDir, "compose.yml"),
+    ];
+}
+export function runComposeCommand(ctx, args, options) {
+    const spawn = options.spawn ?? defaultProbeSpawn;
+    const dockerArgs = [...composeBaseArgs(ctx), ...args];
+    const processEnv = options.processEnv ?? buildComposeSpawnEnv(ctx, process.env);
+    return spawn("docker", dockerArgs, options.timeoutMs, processEnv);
+}
+export function assertComposeSuccess(result, action) {
+    if (result.error?.code === "ETIMEDOUT") {
+        throw new ComposeExecError("timeout", `${action} timed out. Retry when Docker responds promptly.`);
+    }
+    if (result.status !== 0) {
+        const detail = redactSecrets(firstLine(result.stderr) || firstLine(result.stdout));
+        throw new ComposeExecError("command_failed", detail.length > 0 ? `${action} failed: ${detail}` : `${action} failed.`);
+    }
+}
+export function composeCommandIncludesDestructiveVolumeRemoval(args) {
+    const joined = args.join(" ");
+    return /\bdown\b/.test(joined) && /(?:^|\s)-v(?:\s|$)/.test(joined);
+}
+function firstLine(text) {
+    return (text
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .find((line) => line.length > 0) ?? "");
+}
+export class ComposeExecError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+//# sourceMappingURL=compose-exec.js.map

package/dist/setup/compose-exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose-exec.js","sourceRoot":"","sources":["../../src/setup/compose-exec.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,iBAAiB,GAGlB,MAAM,kBAAkB,CAAC;AAc1B,MAAM,UAAU,oBAAoB,CAClC,GAAuB,EACvB,aAAgC,OAAO,CAAC,GAAG;IAE3C,OAAO;QACL,GAAG,UAAU;QACb,oBAAoB,EAAE,GAAG,CAAC,WAAW;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,OAAO;QACL,SAAS;QACT,gBAAgB;QAChB,GAAG,CAAC,WAAW;QACf,qBAAqB;QACrB,GAAG,CAAC,UAAU;QACd,YAAY;QACZ,GAAG,CAAC,WAAW;QACf,IAAI;QACJ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,GAAuB,EACvB,IAAuB,EACvB,OAA2B;IAE3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,iBAAiB,CAAC;IACjD,MAAM,UAAU,GAAG,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACtD,MAAM,UAAU,GACd,OAAO,CAAC,UAAU,IAAI,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAwB,EACxB,MAAc;IAEd,IAAI,MAAM,CAAC,KAAK,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;QACvC,MAAM,IAAI,gBAAgB,CACxB,SAAS,EACT,GAAG,MAAM,kDAAkD,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,aAAa,CAC1B,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CACrD,CAAC;QACF,MAAM,IAAI,gBAAgB,CACxB,gBAAgB,EAChB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,YAAY,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,UAAU,CACxE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,8CAA8C,CAC5D,IAAuB;IAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,CACL,IAAI;SACD,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CACzC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAA+B;IAE5C,YAAY,IAAkC,EAAE,OAAe;QAC7D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/setup/compose-project.d.ts

@@ -0,0 +1,3 @@
+/** Stable Compose project identity scoped to the installation directory path. */
+export declare function deriveComposeProjectName(installDir: string): string;
+//# sourceMappingURL=compose-project.d.ts.map

package/dist/setup/compose-project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose-project.d.ts","sourceRoot":"","sources":["../../src/setup/compose-project.ts"],"names":[],"mappings":"AAGA,iFAAiF;AACjF,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAOnE"}

package/dist/setup/compose-project.js

@@ -0,0 +1,12 @@
+import { createHash } from "node:crypto";
+import path from "node:path";
+/** Stable Compose project identity scoped to the installation directory path. */
+export function deriveComposeProjectName(installDir) {
+    const normalized = path.resolve(installDir).replace(/\\/g, "/").toLowerCase();
+    const digest = createHash("sha256")
+        .update(normalized)
+        .digest("hex")
+        .slice(0, 12);
+    return `osva-${digest}`;
+}
+//# sourceMappingURL=compose-project.js.map

package/dist/setup/compose-project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose-project.js","sourceRoot":"","sources":["../../src/setup/compose-project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,iFAAiF;AACjF,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IACzD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,QAAQ,MAAM,EAAE,CAAC;AAC1B,CAAC"}

package/dist/setup/compose-template-root.d.ts

@@ -0,0 +1,3 @@
+/** Bundled registry-only Compose distribution shipped with the CLI package. */
+export declare function resolveComposeInstallTemplateRoot(): string;
+//# sourceMappingURL=compose-template-root.d.ts.map

package/dist/setup/compose-template-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose-template-root.d.ts","sourceRoot":"","sources":["../../src/setup/compose-template-root.ts"],"names":[],"mappings":"AAKA,+EAA+E;AAC/E,wBAAgB,iCAAiC,IAAI,MAAM,CAE1D"}

package/dist/setup/compose-template-root.js

@@ -0,0 +1,8 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+const setupModuleDir = path.dirname(fileURLToPath(import.meta.url));
+/** Bundled registry-only Compose distribution shipped with the CLI package. */
+export function resolveComposeInstallTemplateRoot() {
+    return path.resolve(setupModuleDir, "../../templates/compose-install");
+}
+//# sourceMappingURL=compose-template-root.js.map

package/dist/setup/compose-template-root.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose-template-root.js","sourceRoot":"","sources":["../../src/setup/compose-template-root.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAEpE,+EAA+E;AAC/E,MAAM,UAAU,iCAAiC;IAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;AACzE,CAAC"}