@ouro.bot/cli 0.1.0-alpha.74 → 0.1.0-alpha.740

package/dist/repertoire/travel-api-client.js

@@ -0,0 +1,360 @@
+"use strict";
+/**
+ * Travel API client module.
+ *
+ * Provides HTTP clients for:
+ * - Open-Meteo weather forecast (no auth, WMO weather codes)
+ * - US State Dept Travel Advisories (no auth)
+ * - Nominatim Geocoding (no auth, requires User-Agent)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TRAVEL_ADVISORY_RSS_URL = exports.WMO_WEATHER_CODES = void 0;
+exports.wmoWeatherDescription = wmoWeatherDescription;
+exports.getWeather = getWeather;
+exports.getWeatherByCity = getWeatherByCity;
+exports.isoToCountryName = isoToCountryName;
+exports.parseAdvisoryLevel = parseAdvisoryLevel;
+exports.parseCountryName = parseCountryName;
+exports.parseAdvisoryText = parseAdvisoryText;
+exports.getTravelAdvisory = getTravelAdvisory;
+exports.geocode = geocode;
+exports.reverseGeocode = reverseGeocode;
+exports.searchPOI = searchPOI;
+const runtime_1 = require("../nerves/runtime");
+// --- Open-Meteo Weather (zero auth) ---
+const OPEN_METEO_FORECAST = "https://api.open-meteo.com/v1/forecast";
+const OPEN_METEO_GEOCODING = "https://geocoding-api.open-meteo.com/v1/search";
+const OPEN_METEO_HEADERS = {
+    "User-Agent": "Ouroboros/1.0 (https://github.com/ourostack/ouroboros)",
+    Accept: "application/json",
+};
+/**
+ * WMO weather interpretation codes (WW) to human-readable descriptions.
+ * Spec: https://www.nodc.noaa.gov/archive/arc0021/0002199/1.1/data/0-data/HTML/WMO-CODE/WMO4677.HTM
+ */
+exports.WMO_WEATHER_CODES = {
+    0: "clear sky",
+    1: "mainly clear",
+    2: "partly cloudy",
+    3: "overcast",
+    45: "fog",
+    48: "depositing rime fog",
+    51: "light drizzle",
+    53: "moderate drizzle",
+    55: "dense drizzle",
+    56: "light freezing drizzle",
+    57: "dense freezing drizzle",
+    61: "slight rain",
+    63: "moderate rain",
+    65: "heavy rain",
+    66: "light freezing rain",
+    67: "heavy freezing rain",
+    71: "slight snowfall",
+    73: "moderate snowfall",
+    75: "heavy snowfall",
+    77: "snow grains",
+    80: "slight rain showers",
+    81: "moderate rain showers",
+    82: "violent rain showers",
+    85: "slight snow showers",
+    86: "heavy snow showers",
+    95: "thunderstorm",
+    96: "thunderstorm with slight hail",
+    99: "thunderstorm with heavy hail",
+};
+/** Convert a WMO weather code to a human-readable description. */
+function wmoWeatherDescription(code) {
+    return exports.WMO_WEATHER_CODES[code] ?? "unknown";
+}
+async function getWeather(lat, lon) {
+    return withNervesEvents("getWeather", { lat, lon }, async () => {
+        const url = `${OPEN_METEO_FORECAST}?latitude=${lat}&longitude=${lon}` +
+            `&current=temperature_2m,apparent_temperature,relative_humidity_2m,wind_speed_10m,weather_code` +
+            `&daily=temperature_2m_max,temperature_2m_min,weather_code` +
+            `&timezone=auto`;
+        const res = await fetch(url, { headers: OPEN_METEO_HEADERS });
+        if (!res.ok) {
+            throw new Error(`Open-Meteo API error: ${res.status} ${res.statusText}`);
+        }
+        const data = await res.json();
+        return parseOpenMeteoResponse(data, lat, lon);
+    });
+}
+async function getWeatherByCity(city) {
+    return withNervesEvents("getWeatherByCity", { city }, async () => {
+        // Step 1: geocode the city name via Open-Meteo geocoding
+        const geoUrl = `${OPEN_METEO_GEOCODING}?name=${encodeURIComponent(city)}&count=1&language=en`;
+        const geoRes = await fetch(geoUrl, { headers: OPEN_METEO_HEADERS });
+        if (!geoRes.ok) {
+            throw new Error(`Open-Meteo geocoding error: ${geoRes.status} ${geoRes.statusText}`);
+        }
+        const geoData = await geoRes.json();
+        const results = geoData.results;
+        if (!results || results.length === 0) {
+            throw new Error(`No location found for city "${city}"`);
+        }
+        const loc = results[0];
+        // Step 2: fetch forecast for the resolved coordinates
+        const url = `${OPEN_METEO_FORECAST}?latitude=${loc.latitude}&longitude=${loc.longitude}` +
+            `&current=temperature_2m,apparent_temperature,relative_humidity_2m,wind_speed_10m,weather_code` +
+            `&daily=temperature_2m_max,temperature_2m_min,weather_code` +
+            `&timezone=auto`;
+        const res = await fetch(url, { headers: OPEN_METEO_HEADERS });
+        if (!res.ok) {
+            throw new Error(`Open-Meteo API error: ${res.status} ${res.statusText}`);
+        }
+        const data = await res.json();
+        return parseOpenMeteoResponse(data, loc.latitude, loc.longitude, loc.name, loc.country_code);
+    });
+}
+function parseOpenMeteoResponse(data, lat, lon, cityName, countryCode) {
+    const current = data.current ?? {};
+    const daily = data.daily ?? {};
+    return {
+        temperature: current.temperature_2m ?? 0,
+        feelsLike: current.apparent_temperature ?? 0,
+        description: wmoWeatherDescription(current.weather_code ?? -1),
+        humidity: current.relative_humidity_2m ?? 0,
+        windSpeed: current.wind_speed_10m ?? 0,
+        city: cityName ?? `${lat},${lon}`,
+        country: countryCode ?? "",
+        dailyHigh: daily.temperature_2m_max?.[0],
+        dailyLow: daily.temperature_2m_min?.[0],
+    };
+}
+// --- US State Dept Travel Advisories ---
+/**
+ * Official US State Department travel advisories RSS feed.
+ * This is the canonical public feed maintained by travel.state.gov.
+ * Returns XML/RSS with per-country advisory items.
+ */
+exports.TRAVEL_ADVISORY_RSS_URL = "https://travel.state.gov/_res/rss/TAsTWs.xml";
+/**
+ * Mapping of ISO 3166-1 alpha-2 codes to country names, ONLY for codes
+ * where ISO differs from FIPS 10-4 (which the State Dept RSS feed uses).
+ *
+ * The RSS feed Country-Tag uses FIPS codes. Callers typically pass ISO codes.
+ * When the codes match (e.g. AF for Afghanistan), no lookup is needed.
+ * This table handles the ~30 codes where they diverge.
+ */
+const ISO_FIPS_DIVERGENCE = {
+    AG: "Antigua and Barbuda", // FIPS: AC
+    AT: "Austria", // FIPS: AU
+    AU: "Australia", // FIPS: AS
+    BD: "Bangladesh", // FIPS: BG
+    BH: "Bahrain", // FIPS: BA
+    BN: "Brunei", // FIPS: BX
+    BO: "Bolivia", // FIPS: BL
+    BS: "Bahamas", // FIPS: BF
+    BW: "Botswana", // FIPS: BC
+    CD: "Congo (Kinshasa)", // FIPS: CG
+    CH: "Switzerland", // FIPS: SZ
+    CI: "Cote d'Ivoire", // FIPS: IV
+    CL: "Chile", // FIPS: CI
+    CN: "China", // FIPS: CH
+    CZ: "Czechia", // FIPS: EZ
+    DE: "Germany", // FIPS: GM
+    DK: "Denmark", // FIPS: DA
+    DO: "Dominican Republic", // FIPS: DR
+    DZ: "Algeria", // FIPS: AG
+    ES: "Spain", // FIPS: SP
+    FI: "Finland", // FIPS: FI → same, but title might say "Finland"
+    GQ: "Equatorial Guinea", // FIPS: EK
+    HR: "Croatia", // FIPS: HR → same
+    IE: "Ireland", // FIPS: EI
+    IL: "Israel", // FIPS: IS
+    JP: "Japan", // FIPS: JA
+    KP: "North Korea", // FIPS: KN
+    KR: "South Korea", // FIPS: KS
+    LT: "Lithuania", // FIPS: LH
+    MA: "Morocco", // FIPS: MO
+    MM: "Burma", // FIPS: BM (State Dept uses "Burma (Myanmar)")
+    NG: "Nigeria", // FIPS: NI
+    NO: "Norway", // FIPS: NO → same
+    PH: "Philippines", // FIPS: RP
+    PT: "Portugal", // FIPS: PO
+    RO: "Romania", // FIPS: RO → same
+    SE: "Sweden", // FIPS: SW
+    SG: "Singapore", // FIPS: SN
+    TL: "Timor-Leste", // FIPS: TT
+    TR: "Turkey", // FIPS: TU
+    TW: "Taiwan", // FIPS: TW → same
+    UA: "Ukraine", // FIPS: UP
+    VA: "Holy See", // FIPS: VT
+    VN: "Vietnam", // FIPS: VM
+    YE: "Yemen", // FIPS: YM
+    ZA: "South Africa", // FIPS: SF
+};
+/**
+ * Look up the expected country name for an ISO alpha-2 code,
+ * but ONLY when that code diverges from the FIPS code used in the RSS feed.
+ * Returns undefined for codes where ISO == FIPS (no title fallback needed).
+ */
+function isoToCountryName(isoCode) {
+    return ISO_FIPS_DIVERGENCE[isoCode.toUpperCase()];
+}
+/**
+ * Parse advisory level (1-4) from an RSS item title like
+ * "Afghanistan - Level 4: Do Not Travel"
+ */
+function parseAdvisoryLevel(title) {
+    const match = title.match(/Level\s+(\d)/);
+    return match ? parseInt(match[1], 10) : 0;
+}
+/**
+ * Parse country name from an RSS item title like
+ * "Afghanistan - Level 4: Do Not Travel"
+ */
+function parseCountryName(title) {
+    const dashIdx = title.indexOf(" - ");
+    return dashIdx > 0 ? title.slice(0, dashIdx).trim() : title.trim();
+}
+/**
+ * Extract advisory text from title (the part after "Level N: ").
+ */
+function parseAdvisoryText(title) {
+    const match = title.match(/Level\s+\d:\s*(.+)/);
+    return match ? match[1].trim() : title.trim();
+}
+async function getTravelAdvisory(countryCode) {
+    return withNervesEvents("getTravelAdvisory", { countryCode }, async () => {
+        const res = await fetch(exports.TRAVEL_ADVISORY_RSS_URL, {
+            headers: {
+                Accept: "application/xml, text/xml",
+            },
+        });
+        if (!res.ok) {
+            throw new Error(`Travel advisory API error: ${res.status} ${res.statusText}`);
+        }
+        const xml = await res.text();
+        const upperCode = countryCode.toUpperCase();
+        // When the caller's ISO code diverges from FIPS, we need a title-based fallback.
+        const expectedCountryName = isoToCountryName(upperCode);
+        // Parse RSS items via regex (no XML parser dependency needed).
+        // Each <item> contains <title>, <pubDate>, and <category domain="Country-Tag">.
+        const itemPattern = /<item>([\s\S]*?)<\/item>/g;
+        let titleFallbackMatch = null;
+        let match;
+        while ((match = itemPattern.exec(xml)) !== null) {
+            const block = match[1];
+            const titleMatch = block.match(/<title>(.*?)<\/title>/);
+            const title = titleMatch?.[1] ?? "";
+            const pubDateMatch = block.match(/<pubDate>(.*?)<\/pubDate>/);
+            const pubDate = pubDateMatch?.[1]?.trim() ?? "";
+            // Extract country tag from <category domain="Country-Tag">XX</category>
+            const tagMatch = block.match(/<category\s+domain="Country-Tag">(.*?)<\/category>/);
+            const tag = tagMatch?.[1]?.trim().toUpperCase();
+            // Primary match: FIPS tag matches the requested code directly.
+            // Skip this path when the caller's ISO code is known to diverge from FIPS —
+            // e.g. ISO "ES" = Spain, but FIPS "ES" = El Salvador. In that case, only
+            // the title-based fallback should match.
+            if (tag === upperCode && !expectedCountryName) {
+                return {
+                    countryCode,
+                    countryName: parseCountryName(title),
+                    advisoryLevel: parseAdvisoryLevel(title),
+                    advisoryText: parseAdvisoryText(title),
+                    lastUpdated: pubDate,
+                };
+            }
+            // Title-based match: when ISO differs from FIPS, match by country name.
+            // Uses startsWith to handle names like "Burma (Myanmar)" matching "Burma".
+            if (expectedCountryName && !titleFallbackMatch) {
+                const titleCountry = parseCountryName(title);
+                if (titleCountry.toLowerCase().startsWith(expectedCountryName.toLowerCase())) {
+                    titleFallbackMatch = {
+                        countryCode,
+                        countryName: titleCountry,
+                        advisoryLevel: parseAdvisoryLevel(title),
+                        advisoryText: parseAdvisoryText(title),
+                        lastUpdated: pubDate,
+                    };
+                }
+            }
+        }
+        if (titleFallbackMatch)
+            return titleFallbackMatch;
+        throw new Error(`No travel advisory found for country code "${countryCode}"`);
+    });
+}
+// --- Nominatim Geocoding ---
+const NOMINATIM_BASE = "https://nominatim.openstreetmap.org";
+const NOMINATIM_HEADERS = {
+    "User-Agent": "Ouroboros/1.0 (https://github.com/ourostack/ouroboros)",
+    Accept: "application/json",
+};
+async function geocode(query) {
+    return withNervesEvents("geocode", { query }, async () => {
+        const url = `${NOMINATIM_BASE}/search?q=${encodeURIComponent(query)}&format=json`;
+        const res = await fetch(url, { headers: NOMINATIM_HEADERS });
+        if (!res.ok) {
+            throw new Error(`Nominatim geocode error: ${res.status} ${res.statusText}`);
+        }
+        const data = await res.json();
+        return data.map(parseGeoLocation);
+    });
+}
+async function reverseGeocode(lat, lon) {
+    return withNervesEvents("reverseGeocode", { lat, lon }, async () => {
+        const url = `${NOMINATIM_BASE}/reverse?lat=${lat}&lon=${lon}&format=json`;
+        const res = await fetch(url, { headers: NOMINATIM_HEADERS });
+        if (!res.ok) {
+            throw new Error(`Nominatim reverse geocode error: ${res.status} ${res.statusText}`);
+        }
+        const data = await res.json();
+        return parseGeoLocation(data);
+    });
+}
+async function searchPOI(query, lat, lon, radiusKm) {
+    return withNervesEvents("searchPOI", { query, lat, lon, radiusKm }, async () => {
+        const radius = radiusKm ?? 10;
+        // Nominatim uses viewbox for bounded search (approximate degrees from km)
+        const degOffset = radius / 111; // ~111 km per degree
+        const viewbox = `${lon - degOffset},${lat + degOffset},${lon + degOffset},${lat - degOffset}`;
+        const url = `${NOMINATIM_BASE}/search?q=${encodeURIComponent(query)}&format=json&viewbox=${viewbox}&bounded=1`;
+        const res = await fetch(url, { headers: NOMINATIM_HEADERS });
+        if (!res.ok) {
+            throw new Error(`Nominatim POI search error: ${res.status} ${res.statusText}`);
+        }
+        const data = await res.json();
+        return data.map(parseGeoLocation);
+    });
+}
+function parseGeoLocation(item) {
+    return {
+        lat: parseFloat(item.lat),
+        lon: parseFloat(item.lon),
+        displayName: item.display_name,
+        type: item.type ?? "unknown",
+    };
+}
+// --- Shared nerves event wrapper ---
+async function withNervesEvents(operation, meta, fn) {
+    (0, runtime_1.emitNervesEvent)({
+        event: "client.request_start",
+        component: "clients",
+        message: `travel API ${operation} starting`,
+        meta: { operation, ...meta },
+    });
+    try {
+        const result = await fn();
+        (0, runtime_1.emitNervesEvent)({
+            event: "client.request_end",
+            component: "clients",
+            message: `travel API ${operation} complete`,
+            meta: { operation, ...meta },
+        });
+        return result;
+    }
+    catch (err) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            event: "client.error",
+            component: "clients",
+            message: `travel API ${operation} failed`,
+            /* v8 ignore next -- defensive: callers throw Error instances @preserve */
+            meta: { operation, reason: err instanceof Error ? err.message : String(err), ...meta },
+        });
+        throw err;
+    }
+}

package/dist/repertoire/unraid-client.js

@@ -0,0 +1,155 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnraidClient = exports.UnraidClientError = void 0;
+const runtime_1 = require("../nerves/runtime");
+class UnraidClientError extends Error {
+    code;
+    ambiguous;
+    constructor(code, message, ambiguous = false, options = {}) {
+        super(limitUtf8(message, 240), options.cause === undefined ? undefined : { cause: options.cause });
+        this.code = code;
+        this.ambiguous = ambiguous;
+        this.name = "UnraidClientError";
+    }
+}
+exports.UnraidClientError = UnraidClientError;
+function limitUtf8(value, maxBytes) {
+    const bytes = Buffer.from(value, "utf8");
+    if (bytes.length <= maxBytes)
+        return value;
+    return bytes.subarray(0, Math.max(0, maxBytes - 3)).toString("utf8").replace(/\uFFFD+$/u, "") + "...";
+}
+function canonicalEndpoint(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error("Unraid GraphQL endpoint is invalid");
+    }
+    if ((url.protocol !== "http:" && url.protocol !== "https:") || url.username || url.password || url.search || url.hash) {
+        throw new Error("Unraid GraphQL endpoint is invalid");
+    }
+    return url.toString();
+}
+function statusError(status) {
+    if (status === 401)
+        return new UnraidClientError("unauthorized", "Unraid GraphQL request was unauthorized");
+    if (status === 403)
+        return new UnraidClientError("forbidden", "Unraid GraphQL request was forbidden");
+    return new UnraidClientError("transport", `Unraid GraphQL request failed with HTTP ${status}`);
+}
+class UnraidClient {
+    endpoint;
+    apiKey;
+    fetchImpl;
+    sleep;
+    readTimeoutMs;
+    mutationTimeoutMs;
+    constructor(options) {
+        this.endpoint = canonicalEndpoint(options.endpoint);
+        this.apiKey = options.apiKey.trim();
+        if (!this.apiKey)
+            throw new Error("Unraid API key is missing");
+        this.fetchImpl = options.fetch ?? fetch;
+        this.sleep = options.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+        this.readTimeoutMs = options.readTimeoutMs ?? 10_000;
+        this.mutationTimeoutMs = options.mutationTimeoutMs ?? 15_000;
+    }
+    static assertPrefixedId(value) {
+        if (Buffer.byteLength(value, "utf8") > 256 || !/^[^:]+:[^:]+$/u.test(value)) {
+            throw new Error("Unraid identifier must be one bounded prefixed ID");
+        }
+        return value;
+    }
+    read(document, variables, signal) {
+        return this.execute("read", document, variables, signal);
+    }
+    mutate(document, variables, signal) {
+        return this.execute("mutation", document, variables, signal);
+    }
+    async execute(kind, document, variables, signal) {
+        (0, runtime_1.emitNervesEvent)({
+            component: "repertoire",
+            event: "repertoire.unraid_request_start",
+            message: "Unraid GraphQL request started",
+            meta: { kind },
+        });
+        const delays = [250, 1000];
+        const maxAttempts = kind === "read" ? 3 : 1;
+        for (let attempt = 0;; attempt += 1) {
+            const timeout = AbortSignal.timeout(kind === "read" ? this.readTimeoutMs : this.mutationTimeoutMs);
+            const requestSignal = signal ? AbortSignal.any([signal, timeout]) : timeout;
+            let response;
+            try {
+                response = await this.fetchImpl(this.endpoint, {
+                    method: "POST",
+                    headers: { "x-api-key": this.apiKey, "Content-Type": "application/json" },
+                    body: JSON.stringify({ query: document, variables }),
+                    signal: requestSignal,
+                });
+            }
+            catch (error) {
+                const timedOut = timeout.aborted && !signal?.aborted;
+                if (kind === "read" && !timedOut && !signal?.aborted && attempt < maxAttempts - 1) {
+                    await this.sleep(delays[attempt]);
+                    continue;
+                }
+                const normalized = new UnraidClientError(timedOut ? "timeout" : "transport", timedOut ? "Unraid GraphQL request timed out" : "Unraid GraphQL transport failed", kind === "mutation" && !timedOut, { cause: error });
+                this.emitError(kind, normalized);
+                throw normalized;
+            }
+            if (!response.ok) {
+                if (kind === "read" && [429, 502, 503, 504].includes(response.status) && attempt < maxAttempts - 1) {
+                    await this.sleep(delays[attempt]);
+                    continue;
+                }
+                const error = statusError(response.status);
+                this.emitError(kind, error);
+                throw error;
+            }
+            let envelope;
+            try {
+                envelope = await response.json();
+            }
+            catch (cause) {
+                const error = new UnraidClientError("invalid_response", "Unraid GraphQL returned invalid JSON", false, { cause });
+                this.emitError(kind, error);
+                throw error;
+            }
+            if (!envelope || typeof envelope !== "object" || Array.isArray(envelope)) {
+                const error = new UnraidClientError("invalid_response", "Unraid GraphQL response envelope is invalid");
+                this.emitError(kind, error);
+                throw error;
+            }
+            const record = envelope;
+            if (Array.isArray(record.errors) && record.errors.length > 0) {
+                const error = new UnraidClientError("graphql", "Unraid GraphQL operation failed");
+                this.emitError(kind, error);
+                throw error;
+            }
+            if (!record.data || typeof record.data !== "object" || Array.isArray(record.data)) {
+                const error = new UnraidClientError("invalid_response", "Unraid GraphQL response omitted data");
+                this.emitError(kind, error);
+                throw error;
+            }
+            (0, runtime_1.emitNervesEvent)({
+                component: "repertoire",
+                event: "repertoire.unraid_request_end",
+                message: "Unraid GraphQL request completed",
+                meta: { kind, attempt: attempt + 1 },
+            });
+            return record.data;
+        }
+    }
+    emitError(kind, error) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "repertoire",
+            event: "repertoire.unraid_request_error",
+            message: "Unraid GraphQL request failed",
+            meta: { kind, code: error.code, ambiguous: error.ambiguous },
+        });
+    }
+}
+exports.UnraidClient = UnraidClient;

package/dist/repertoire/unraid-restart.js

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SANCTUARY_RESTART_MUTATION = void 0;
+exports.createApprovedUnraidRestartExecutor = createApprovedUnraidRestartExecutor;
+const node_crypto_1 = require("node:crypto");
+const runtime_1 = require("../nerves/runtime");
+const unraid_client_1 = require("./unraid-client");
+exports.SANCTUARY_RESTART_MUTATION = `mutation SanctuaryRestart($id: PrefixedID!) {
+  docker { restart(id: $id) { id names state status autoStart } }
+}`;
+function failure(code, message) {
+    return { ok: false, error: { code, message, degraded: true } };
+}
+function exactTarget(result, name) {
+    if (!result.ok)
+        return failure("invalid_response", result.error.message);
+    const matches = result.data.containers.filter((container) => container.name === name);
+    if (matches.length === 0)
+        return failure("not_found", `container '${name}' was not found`);
+    if (matches.length !== 1)
+        return failure("ambiguous", `container '${name}' is ambiguous`);
+    return matches[0];
+}
+function validArgument(value) {
+    return typeof value === "string" && value.length > 0 && Buffer.byteLength(value, "utf8") <= 128 && !value.includes("\uFFFD");
+}
+function acknowledgedIdentity(data, target) {
+    const docker = data.docker;
+    if (!docker || typeof docker !== "object" || Array.isArray(docker))
+        return false;
+    const restart = docker.restart;
+    if (!restart || typeof restart !== "object" || Array.isArray(restart))
+        return false;
+    const record = restart;
+    return record.id === target.id && Array.isArray(record.names)
+        && record.names.length === 1 && String(record.names[0]).replace(/^\//u, "") === target.name;
+}
+function createApprovedUnraidRestartExecutor(options) {
+    const createClient = options.createClient ?? ((input) => new unraid_client_1.UnraidClient(input));
+    const sleep = options.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+    const now = options.now ?? (() => new Date());
+    const observationTimeoutMs = options.observationTimeoutMs ?? 30_000;
+    return async (args) => {
+        if (!validArgument(args.container))
+            return failure("invalid_response", "container must be one bounded exact name");
+        const resolved = exactTarget(await options.listContainers(), args.container);
+        if ("ok" in resolved)
+            return resolved;
+        const fresh = exactTarget(await options.listContainers(), args.container);
+        if ("ok" in fresh)
+            return fresh;
+        if (fresh.id !== resolved.id)
+            return failure("stale_target", "container identity changed before restart");
+        const scenarioHandleDigest = options.acceptanceScenarioHandleDigest?.();
+        const approval = options.acceptanceApproval?.();
+        const attempt = {
+            container: { id: fresh.id, name: fresh.name },
+            beforeState: fresh.state,
+            observedAt: now().toISOString(),
+            actionDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify({ operation: "restart", container: { id: fresh.id, name: fresh.name } })).digest("hex"),
+            argumentDigest: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify({ container: args.container })).digest("hex"),
+            ...(scenarioHandleDigest ? { scenarioHandleDigest } : {}),
+            ...(approval ? { approvalId: approval.approvalId } : {}),
+            attemptId: (0, node_crypto_1.randomUUID)(),
+            mutationAcknowledged: false,
+            afterState: null,
+        };
+        if (approval && approval.argumentDigest !== attempt.argumentDigest)
+            return failure("stale_target", "approval arguments changed before restart");
+        await options.persistAttempt?.({ ...attempt, observedAt: now().toISOString(), state: "attempt_not_started" });
+        const apiKey = await options.loadWriteApiKey();
+        if (!apiKey.trim())
+            return failure("invalid_response", "Unraid write credential is unavailable");
+        const client = createClient({ endpoint: options.endpoint, apiKey });
+        await options.persistAttempt?.({ ...attempt, observedAt: now().toISOString(), state: "attempting" });
+        (0, runtime_1.emitNervesEvent)({ component: "repertoire", event: "repertoire.unraid_restart_start", message: "approved Unraid restart started", meta: { containerId: fresh.id, containerName: fresh.name } });
+        const persistTerminal = async (terminal) => {
+            try {
+                await options.persistAttempt?.(terminal);
+                return true;
+            }
+            catch (error) {
+                (0, runtime_1.emitNervesEvent)({ level: "error", component: "repertoire", event: "repertoire.unraid_restart_error", message: "approved Unraid restart terminal receipt persistence failed", meta: { containerId: fresh.id, category: error instanceof Error ? error.name : "unknown" } });
+                return false;
+            }
+        };
+        let acknowledged = false;
+        try {
+            const mutation = await client.mutate(exports.SANCTUARY_RESTART_MUTATION, { id: fresh.id });
+            acknowledged = acknowledgedIdentity(mutation, fresh);
+            if (!acknowledged)
+                throw new Error("restart response identity was invalid");
+        }
+        catch {
+            acknowledged = false;
+        }
+        const startedAt = now().getTime();
+        let sawRestarting = false;
+        try {
+            do {
+                const observed = exactTarget(await options.listContainers(), args.container);
+                if (!("ok" in observed)) {
+                    if (observed.id !== fresh.id) {
+                        await persistTerminal({ ...attempt, observedAt: now().toISOString(), state: "attempted_or_indeterminate", mutationAcknowledged: acknowledged });
+                        return failure("ambiguous", "container identity changed after restart attempt");
+                    }
+                    sawRestarting ||= observed.state === "restarting";
+                    if (observed.state === "running" && !observed.degraded && (acknowledged || sawRestarting)) {
+                        if (!await persistTerminal({ ...attempt, observedAt: now().toISOString(), state: "succeeded", mutationAcknowledged: acknowledged, afterState: observed.state })) {
+                            return failure("ambiguous", "restart succeeded but its terminal receipt could not be persisted; it was not retried");
+                        }
+                        (0, runtime_1.emitNervesEvent)({ component: "repertoire", event: "repertoire.unraid_restart_end", message: "approved Unraid restart completed", meta: { containerId: fresh.id, observedRestart: true } });
+                        return { ok: true, data: { container: { id: fresh.id, name: fresh.name }, beforeState: fresh.state, afterState: observed.state, observedRestart: true, degraded: false } };
+                    }
+                }
+                if (now().getTime() - startedAt >= observationTimeoutMs)
+                    break;
+                await sleep(1_000);
+            } while (true);
+        }
+        catch {
+            await persistTerminal({ ...attempt, observedAt: now().toISOString(), state: "attempted_or_indeterminate", mutationAcknowledged: acknowledged });
+            (0, runtime_1.emitNervesEvent)({ level: "error", component: "repertoire", event: "repertoire.unraid_restart_error", message: "approved Unraid restart observation failed", meta: { containerId: fresh.id, acknowledged } });
+            return failure("ambiguous", "restart was attempted but observation failed; it was not retried");
+        }
+        await persistTerminal({ ...attempt, observedAt: now().toISOString(), state: "attempted_or_indeterminate", mutationAcknowledged: acknowledged });
+        (0, runtime_1.emitNervesEvent)({ level: "error", component: "repertoire", event: "repertoire.unraid_restart_error", message: "approved Unraid restart outcome was ambiguous", meta: { containerId: fresh.id, acknowledged } });
+        return failure("ambiguous", "restart was attempted but could not be proven; it was not retried");
+    };
+}