@sealant/mend 0.36.0-next.628 → 0.36.0-next.643

package/dist/{chunk-OTYH35OK.js → chunk-2TDRYRGO.js}

@@ -26965,13 +26965,17 @@ var sameGrant = (left, right) => {
 var LAUNCH_WAITING_PREFIX = "waiting \xB7 the previous session in this worktree";
 var LAUNCH_WAITING_SAVING = `${LAUNCH_WAITING_PREFIX} is saving`;
 var LAUNCH_BOOTING = "booting";
+var LAUNCH_QUEUED = "queued \xB7 waiting for a worker";
+var LAUNCH_BUILDING_PREFIX = "building the workspace image";
 var LAUNCH_PREPARING = "preparing the workspace \xB7 no runtime yet \xB7 after an update, building the image takes about 8 minutes";
 var LAUNCH_BUILDING_IMAGE_LEGACY = "building the workspace image (first launch after an update, ~8 min)";
 var LAUNCH_PHASE_PREFIXES = [
   LAUNCH_WAITING_PREFIX,
   LAUNCH_BOOTING,
+  LAUNCH_QUEUED,
   LAUNCH_PREPARING,
-  LAUNCH_BUILDING_IMAGE_LEGACY
+  LAUNCH_BUILDING_IMAGE_LEGACY,
+  LAUNCH_BUILDING_PREFIX
 ];
 var phaseWordsOf = (summary) => {
   for (const prefix of LAUNCH_PHASE_PREFIXES) {
@@ -26995,6 +26999,12 @@ var launchPhaseOf = (summary) => {
     return { kind: "waiting-previous", words: phase.words };
   }
   if (phase.words.startsWith(LAUNCH_BOOTING)) return { kind: "booting", words: phase.words };
+  if (phase.words.startsWith(LAUNCH_QUEUED)) return { kind: "queued", words: phase.words };
+  if (phase.words === LAUNCH_BUILDING_IMAGE_LEGACY)
+    return { kind: "preparing", words: phase.words };
+  if (phase.words.startsWith(LAUNCH_BUILDING_PREFIX)) {
+    return { kind: "building", words: phase.words };
+  }
   return { kind: "preparing", words: phase.words };
 };
 
@@ -27127,6 +27137,9 @@ var AuditAction = Schema_exports.Literals([
   "session.shared_control_off",
   // The owner ended a session's workspace with captures still pending: work was discarded.
   "session.unsaved_discarded",
+  // Mend stopped a session whose owner no longer has access to where it ran (mend#558): a removed
+  // member, or a joiner who can no longer see the project. The session's owner is the actor.
+  "session.stopped_no_access",
   "member.password_reset_issued",
   "organization.created",
   "organization.renamed",
@@ -28105,6 +28118,14 @@ var Session = class extends Schema_exports.Class("Session")({
   sharedControlEnabledAt: Schema_exports.NullOr(Timestamp).pipe(
     Schema_exports.withConstructorDefault(Effect_exports.succeed(null))
   ),
+  /**
+   * When shared control was first turned on, kept after it is turned off (docs/adr/0016,
+   * decision 9): a session once shared runs on no one's memory and credits nobody until it ends.
+   */
+  sharedControlEverAt: Schema_exports.NullOr(Timestamp).pipe(
+    Schema_exports.withDecodingDefaultKey(Effect_exports.succeed(null)),
+    Schema_exports.withConstructorDefault(Effect_exports.succeed(null))
+  ),
   /**
    * Whether the harness left a conversation behind — a transcript Mend captured at settle or
    * found in the live harness home. False is a dead end: nothing to resume, nothing to hand
@@ -28436,7 +28457,7 @@ var ProjectClusterBindingsSnapshot = class extends Schema_exports.Class(
 }) {
 };
 
-// ../../node_modules/.pnpm/@sealant+api-contracts-next@0.39.0-next.694_effect@4.0.0-beta.93/node_modules/@sealant/api-contracts-next/dist/workspace-environment.js
+// ../../node_modules/.pnpm/@sealant+api-contracts-next@0.39.0-next.706_effect@4.0.0-beta.93/node_modules/@sealant/api-contracts-next/dist/workspace-environment.js
 var RESERVED_NAMES = new Map([
   // Identity/process roots the daemon and shells own.
   ...[
@@ -28607,7 +28628,17 @@ var SessionProcess = class extends Schema_exports.Class("SessionProcess")({
     Schema_exports.withConstructorDefault(Effect_exports.succeed(null))
   ),
   exitedAt: Schema_exports.NullOr(Timestamp),
-  updatedAt: Timestamp
+  updatedAt: Timestamp,
+  /**
+   * The Mend account whose Linux user the process runs as in a person-layout executor
+   * (docs/adr/0016, decision 1: "the person a process runs as is recorded on the process when it
+   * starts"). Null for a process that runs as root (a `shared` executor), on rows from before it
+   * was recorded, and where older servers omit it.
+   */
+  runsAs: Schema_exports.NullOr(Schema_exports.String).pipe(
+    Schema_exports.withDecodingDefaultKey(Effect_exports.succeed(null)),
+    Schema_exports.withConstructorDefault(Effect_exports.succeed(null))
+  )
 }) {
 };
 
@@ -29064,6 +29095,50 @@ var SlackLinkedMentionJob = Schema_exports.Struct({
   linkedAt: Schema_exports.String
 });
 
+// ../../packages/domain/src/workbench/steering.ts
+var ConversationWaitWork = Schema_exports.Struct({
+  kind: Schema_exports.Literals([
+    "task",
+    "paused-task",
+    "sub-agent",
+    "terminal",
+    "goal",
+    "wakeup",
+    "monitor",
+    "cron",
+    "unknown"
+  ]),
+  /** The harness's own id: what ending it names. */
+  id: Schema_exports.String,
+  description: Schema_exports.NullOr(Schema_exports.String),
+  /**
+   * The person the process runs as, or the session's owner, can end it from the waiting line
+   * (Claude's task stop, a monitor's included, Codex's terminal terminate and goal clear). A
+   * wakeup ends on its own within an hour; a scheduled prompt and what the harness would not say
+   * are waited for at most `CONVERSATION_WAIT_BOUNDS_MS`.
+   */
+  endable: Schema_exports.Boolean
+});
+var ConversationWait = class extends Schema_exports.Class("ConversationWait")({
+  sessionId: SessionId,
+  /** The turn that waits; the turns behind it wait with it. */
+  turnId: AgentTurnId,
+  /** Whose process finishes its work: the person it runs as. */
+  runsAs: Schema_exports.NullOr(Schema_exports.String),
+  /** Whose turn waits. */
+  sender: Schema_exports.String,
+  /** A turn still runs in the process. */
+  openTurn: Schema_exports.Boolean,
+  work: Schema_exports.Array(ConversationWaitWork),
+  /** The waiting line, in words: "Waits for Alice's 2 background tasks … before Bob's turn starts." */
+  line: Schema_exports.String,
+  since: Timestamp
+}) {
+};
+var CONVERSATION_WAIT_BOUNDS_MS = {
+  cron: 10 * 6e4
+};
+
 // ../../packages/domain/src/workbench/tour.ts
 var TourStop = class extends Schema_exports.Class("TourStop")({
   title: Schema_exports.String,

package/dist/{dashboard-P73HKQOT.js → dashboard-2HF3KTTU.js}

@@ -17,7 +17,7 @@ import {
   repositoryCloneUrlIssue,
   servicesHoldLine,
   withoutLaunchPhase
-} from "./chunk-OTYH35OK.js";
+} from "./chunk-2TDRYRGO.js";
 
 // src/dashboard.tsx
 import { CliRenderEvents, createCliRenderer } from "@opentui/core";
@@ -271,6 +271,10 @@ var startingWordsOf = (session) => {
       return phase.words.endsWith("is saving") ? "waiting for the previous save" : "waiting for the previous session";
     case "booting":
       return "booting";
+    case "queued":
+      return "queued";
+    case "building":
+      return "building the image";
     case "preparing":
       return "preparing the workspace";
   }
@@ -283,6 +287,10 @@ var startingExplanationOf = (session) => {
       return phase.words.endsWith("is saving") ? "the previous session in this worktree is still saving \xB7 this one starts from its save" : phase.words;
     case "booting":
       return "the workspace is booting \xB7 the agent starts when it is up";
+    case "queued":
+      return "the launch waits for a worker \xB7 it starts when one takes it";
+    case "building":
+      return `${phase.words} \xB7 the agent starts once it is built and booted`;
     case "preparing":
       return "the workspace has no runtime yet \xB7 after an update, building its image takes about 8 minutes";
   }

package/dist/main.js

@@ -52,7 +52,7 @@ import {
   trackBracketedPaste,
   validatePiProfile,
   validateSecretFilePath
-} from "./chunk-OTYH35OK.js";
+} from "./chunk-2TDRYRGO.js";
 
 // src/main.ts
 import { spawn as spawn3, spawnSync as spawnSync6 } from "node:child_process";
@@ -2814,12 +2814,16 @@ var COMMANDS = [
     name: "server upgrade",
     section: "this machine",
     summary: "upgrade to an explicit version with a database backup",
-    synopsis: ["--version <target|latest> [--assets-dir <dir>] [--offline] [--from-preview]"],
+    synopsis: [
+      "--version <target|latest> [--assets-dir <dir>] [--offline] [--from-preview] [--keep-backups <n>]"
+    ],
     description: [
       "Preflights release assets and the canonical image's version label before interrupting Mend. Downgrades are refused. latest is resolved only when explicitly requested; a same-version request does nothing.",
       "The installed configuration stays: the bind, the origin, the ports, the edge host and the declared exposure and tenancy are carried into the new generation, which renders the same overlays beside the new compose.yaml. An upgrade never drops the edge or the posture; mend server setup is where they change.",
       "Stops app writers, starts official Postgres if needed, and streams pg_dumpall into a private database backup before selecting and starting the target. Connections are interrupted. Workspace containers and data are retained, but active work can lose connectivity and need reconnection. Stop any external database writers before upgrading.",
-      "Preflight or backup failure retains the old pin and attempts to recover the old app if it was running. Once target startup may have begun, Mend never automatically downgrades or restores the database. The target pin, old generation and backup remain. Inspect logs, fix the target, then use mend server start. Recovery records are under the installation's backups/upgrade-UUID directory."
+      "Preflight or backup failure retains the old pin and attempts to recover the old app if it was running. Once target startup may have begun, Mend never automatically downgrades or restores the database. The target pin, old generation and backup remain. Inspect logs, fix the target, then use mend server start. Recovery records are under the installation's backups/upgrade-UUID directory.",
+      "After the target answers health, its recovery record is marked completed and older completed backups are removed, keeping the newest two (this one included) in the order Mend wrote them; each removal is printed with the space it freed. A failed upgrade removes nothing. A backup this release recorded as pending, or whose dump is incomplete, is always kept. Each dump holds the whole database, so it can run to gigabytes.",
+      'Backups written by releases before 0.36 carry no outcome: the first upgrade on 0.36 or later treats each one whose dump is whole as completed and keeps only the newest N, so copy any you want to keep out of backups/ first. Their removals are marked "from before 0.36, no recorded outcome".'
     ],
     options: [
       {
@@ -2837,6 +2841,10 @@ var COMMANDS = [
       {
         flag: "--from-preview",
         text: "once, from a preview numbered X.Y.Z-preview.K to a next build X.Y.Z-next.N; refused unless the target carries every migration the server applied"
+      },
+      {
+        flag: "--keep-backups <n>",
+        text: "completed upgrade backups to keep after a healthy upgrade, this one included; 0 keeps all. Default: 2"
       }
     ],
     examples: [
@@ -5993,6 +6001,286 @@ var commitGeneration = (paths, files) => {
   activateGeneration(paths, generation);
   return generation;
 };
+var renderRecovery = (record2) => `${JSON.stringify(record2, null, 2)}
+`;
+var BACKUP_NAME = /^upgrade-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var REMOVING_NAME = /^upgrade-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.removing$/;
+var RECOVERY_TEMPORARY = /^\.recovery-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var lstatOptional = (file) => {
+  try {
+    return fs14.lstatSync(file);
+  } catch (cause) {
+    if (hasCode(cause, "ENOENT")) return null;
+    throw cause;
+  }
+};
+var freedBy = (stat) => stat.nlink === 1 ? stat.size : 0;
+var GENERATION_NAME = /^gen-[0-9a-f-]{36}$/;
+var VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+var generationVersion = (configDir, generation) => {
+  if (!GENERATION_NAME.test(generation)) return void 0;
+  try {
+    const parsed = JSON.parse(
+      fs14.readFileSync(path15.join(configDir, "generations", generation, "server.json"), "utf8")
+    );
+    return typeof parsed === "object" && parsed !== null && "serverVersion" in parsed && typeof parsed.serverVersion === "string" && VERSION.test(parsed.serverVersion) ? parsed.serverVersion : void 0;
+  } catch {
+    return void 0;
+  }
+};
+var readRecord = (configDir, file, stat) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(fs14.readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null || !("previousGeneration" in parsed) || !("targetGeneration" in parsed) || typeof parsed.previousGeneration !== "string" || typeof parsed.targetGeneration !== "string")
+    return null;
+  const sequence = "sequence" in parsed && typeof parsed.sequence === "number" && Number.isSafeInteger(parsed.sequence) && parsed.sequence > 0 ? parsed.sequence : void 0;
+  const stamped = "createdAt" in parsed && typeof parsed.createdAt === "string" ? Date.parse(parsed.createdAt) : Number.NaN;
+  const targetGeneration = path15.basename(parsed.targetGeneration);
+  return {
+    previousGeneration: path15.basename(parsed.previousGeneration),
+    targetGeneration,
+    state: "state" in parsed ? parsed.state : void 0,
+    sequence,
+    recordsOutcome: "state" in parsed || "sequence" in parsed,
+    targetVersion: generationVersion(configDir, targetGeneration),
+    clock: Number.isFinite(stamped) ? stamped : stat.mtimeMs
+  };
+};
+var DUMP_TRAILER = /-- PostgreSQL database cluster dump complete\r?\n(?:--\r?\n)?\s*$/;
+var dumpIsWhole = (file, size) => {
+  const length = Math.min(size, 256);
+  if (length === 0) return false;
+  const buffer = Buffer.alloc(length);
+  const fd = fs14.openSync(file, "r");
+  try {
+    fs14.readSync(fd, buffer, 0, length, size - length);
+  } finally {
+    fs14.closeSync(fd);
+  }
+  const tail = buffer.toString("utf8");
+  const match = DUMP_TRAILER.exec(tail);
+  if (match === null) return false;
+  return match.index === 0 ? length === size : tail[match.index - 1] === "\n";
+};
+var readBackup = (configDir, directory) => {
+  const stat = lstatOptional(directory);
+  if (stat === null || !stat.isDirectory()) return { kind: "foreign" };
+  if (REMOVING_NAME.test(path15.basename(directory))) return readRemoving(directory);
+  if (!BACKUP_NAME.test(path15.basename(directory))) return { kind: "foreign" };
+  const entries = fs14.readdirSync(directory);
+  if (entries.length === 0) return { kind: "interrupted", bytes: 0 };
+  const recoveryFile = path15.join(directory, "recovery.json");
+  const recovery = lstatOptional(recoveryFile);
+  if (recovery === null || !recovery.isFile()) return { kind: "foreign" };
+  const record2 = readRecord(configDir, recoveryFile, recovery);
+  if (record2 === null) return { kind: "foreign" };
+  if (entries.includes("database.sql.partial"))
+    return { kind: "held", reason: "unfinished", record: record2 };
+  if (entries.some(
+    (name) => name !== "database.sql" && name !== "recovery.json" && !RECOVERY_TEMPORARY.test(name)
+  ))
+    return { kind: "foreign" };
+  if (record2.recordsOutcome && (record2.sequence === void 0 || record2.state === void 0))
+    return {
+      kind: "held",
+      reason: "unreadable",
+      detail: "recovery.json has a state without a valid sequence"
+    };
+  const dump = lstatOptional(path15.join(directory, "database.sql"));
+  if (dump !== null && !dump.isFile()) return { kind: "foreign" };
+  if (dump === null)
+    return record2.state === "completed" ? { kind: "interrupted", bytes: freedBy(recovery) } : { kind: "held", reason: "unfinished", record: record2 };
+  if (!dumpIsWhole(path15.join(directory, "database.sql"), dump.size))
+    return { kind: "held", reason: "unfinished", record: record2 };
+  if (record2.recordsOutcome && record2.state !== "completed")
+    return { kind: "held", reason: "pending", record: record2 };
+  return {
+    kind: "completed",
+    record: record2,
+    bytes: freedBy(dump) + freedBy(recovery),
+    legacy: !record2.recordsOutcome
+  };
+};
+var readRemoving = (directory) => {
+  let bytes = 0;
+  for (const name of fs14.readdirSync(directory)) {
+    const file = lstatOptional(path15.join(directory, name));
+    if (file === null || !file.isFile() || !(name === "database.sql" || name === "database.sql.partial" || name === "recovery.json" || RECOVERY_TEMPORARY.test(name)))
+      return { kind: "foreign" };
+    bytes += freedBy(file);
+  }
+  return { kind: "interrupted", bytes };
+};
+var nextSequence = (configDir, backups) => {
+  let highest = 0;
+  for (const name of fs14.readdirSync(backups)) {
+    if (!BACKUP_NAME.test(name)) continue;
+    try {
+      const directory = path15.join(backups, name);
+      const stat = lstatOptional(directory);
+      if (stat === null || !stat.isDirectory()) continue;
+      const file = path15.join(directory, "recovery.json");
+      const recovery = lstatOptional(file);
+      if (recovery === null || !recovery.isFile()) continue;
+      highest = Math.max(highest, readRecord(configDir, file, recovery)?.sequence ?? 0);
+    } catch {
+      continue;
+    }
+  }
+  return highest + 1;
+};
+var versionOrder = (compareVersions, a, b) => {
+  if (a === void 0 || b === void 0) return 0;
+  try {
+    return compareVersions(a, b);
+  } catch {
+    return 0;
+  }
+};
+var chainDepths = (records) => {
+  const depths = /* @__PURE__ */ new Map();
+  const depth = (record2, visiting) => {
+    const known = depths.get(record2);
+    if (known !== void 0) return known;
+    const next = new Set(visiting).add(record2);
+    const before = records.filter(
+      (other) => !next.has(other) && other.targetGeneration === record2.previousGeneration && other.targetGeneration !== other.previousGeneration
+    );
+    const value = Math.max(-1, ...before.map((other) => depth(other, next))) + 1;
+    depths.set(record2, value);
+    return value;
+  };
+  return (record2) => depth(record2, /* @__PURE__ */ new Set());
+};
+var newestFirst = (records, compareVersions) => {
+  const depth = chainDepths(records.filter((record2) => record2.sequence === void 0));
+  return (a, b) => {
+    if (a.sequence !== void 0 || b.sequence !== void 0) {
+      if (a.sequence === void 0) return 1;
+      if (b.sequence === void 0) return -1;
+      if (a.sequence !== b.sequence) return b.sequence - a.sequence;
+    } else {
+      const byVersion = versionOrder(compareVersions, b.targetVersion, a.targetVersion);
+      if (byVersion !== 0) return byVersion;
+      const byChain = depth(b) - depth(a);
+      if (byChain !== 0) return byChain;
+    }
+    return b.clock - a.clock;
+  };
+};
+var writtenAfterOutcomes = (record2, records, current, compareVersions) => {
+  const sequenced = records.filter((other) => other.sequence !== void 0);
+  const unsequenced = records.filter((other) => other.sequence === void 0);
+  const seen = /* @__PURE__ */ new Set();
+  const chainsFromSequenced = (candidate) => {
+    if (seen.has(candidate)) return false;
+    seen.add(candidate);
+    if (sequenced.some((other) => other.targetGeneration === candidate.previousGeneration))
+      return true;
+    return unsequenced.some(
+      (other) => other.targetGeneration === candidate.previousGeneration && chainsFromSequenced(other)
+    );
+  };
+  return chainsFromSequenced(record2) || sequenced.some(
+    (other) => other !== current && versionOrder(compareVersions, record2.targetVersion, other.targetVersion) > 0
+  );
+};
+var removeBackup = (directory) => {
+  const removing = REMOVING_NAME.test(path15.basename(directory)) ? directory : `${directory}.removing`;
+  if (removing !== directory) fs14.renameSync(directory, removing);
+  for (const name of fs14.readdirSync(removing))
+    if (name === "database.sql" || name === "database.sql.partial" || name === "recovery.json" || RECOVERY_TEMPORARY.test(name))
+      fs14.unlinkSync(path15.join(removing, name));
+  fs14.rmdirSync(removing);
+};
+var entryOf = ({ directory, bytes, legacy }) => ({
+  directory,
+  bytes,
+  legacy,
+  interrupted: false
+});
+var failureOf = (cause) => cause instanceof Error ? cause.message : "unknown filesystem error";
+var pruneBackups = (configDir, keep, current, compareVersions) => {
+  if (!Number.isSafeInteger(keep) || keep < 1)
+    throw new ServerStoreError("Pruning keeps at least one upgrade backup.");
+  const backups = path15.join(configDir, "backups");
+  if (path15.dirname(current.directory) !== backups)
+    throw new ServerStoreError("The current upgrade backup is outside this installation.");
+  const currentRead = readBackup(configDir, current.directory);
+  if (currentRead.kind !== "completed" || currentRead.record.sequence === void 0)
+    throw new ServerStoreError("The current upgrade backup is not completed; nothing was pruned.");
+  const completed = [];
+  const interrupted = [];
+  const held = [];
+  const records = [currentRead.record];
+  for (const name of fs14.readdirSync(backups).toSorted()) {
+    const directory = path15.join(backups, name);
+    if (directory === current.directory) continue;
+    let read;
+    try {
+      read = readBackup(configDir, directory);
+    } catch (cause) {
+      if (BACKUP_NAME.test(name) || REMOVING_NAME.test(name))
+        held.push({ directory, reason: "unreadable", detail: failureOf(cause) });
+      continue;
+    }
+    if (read.kind === "held") {
+      held.push({
+        directory,
+        reason: read.reason,
+        ...read.detail === void 0 ? {} : { detail: read.detail }
+      });
+      if (read.record !== void 0) records.push(read.record);
+    }
+    if (read.kind === "interrupted")
+      interrupted.push({ directory, bytes: read.bytes, legacy: false, interrupted: true });
+    if (read.kind === "completed") {
+      completed.push({
+        directory,
+        bytes: read.bytes,
+        legacy: read.legacy,
+        interrupted: false,
+        record: read.record
+      });
+      records.push(read.record);
+    }
+  }
+  const candidates = completed.filter((entry) => {
+    if (!entry.legacy || !writtenAfterOutcomes(entry.record, records, currentRead.record, compareVersions))
+      return true;
+    held.push({ directory: entry.directory, reason: "no-outcome" });
+    return false;
+  });
+  const compare = newestFirst(records, compareVersions);
+  candidates.sort((a, b) => compare(a.record, b.record));
+  const kept = [
+    { directory: current.directory, bytes: currentRead.bytes, legacy: false, interrupted: false },
+    ...candidates.slice(0, keep - 1).map(entryOf)
+  ];
+  const removed = [];
+  const failed = [];
+  for (const candidate of [...interrupted, ...candidates.slice(keep - 1).map(entryOf)]) {
+    try {
+      removeBackup(candidate.directory);
+      removed.push(candidate);
+    } catch (cause) {
+      failed.push({ directory: candidate.directory, message: failureOf(cause) });
+    }
+  }
+  let unsynced;
+  if (removed.length > 0 || failed.length > 0) {
+    try {
+      syncDirectory(backups);
+    } catch (cause) {
+      unsynced = failureOf(cause);
+    }
+  }
+  return { removed, kept, held, failed, ...unsynced === void 0 ? {} : { unsynced } };
+};
 var createStore = (configDir, lock) => {
   const paths = {
     configDir,
@@ -6014,22 +6302,19 @@ var createStore = (configDir, lock) => {
       const backups = path15.join(configDir, "backups");
       fs14.mkdirSync(backups, { recursive: true, mode: 448 });
       fs14.chmodSync(backups, 448);
+      const sequence = nextSequence(configDir, backups);
       const directory = path15.join(backups, `upgrade-${randomUUID2()}`);
       fs14.mkdirSync(directory, { mode: 448 });
-      writeDurable(
-        path15.join(directory, "recovery.json"),
-        `${JSON.stringify(
-          {
-            previousGeneration: previous.directory,
-            targetGeneration: target.directory,
-            database: "database.sql",
-            policy: "If target is active, migrations may have begun. Never downgrade or restore automatically."
-          },
-          null,
-          2
-        )}
-`
-      );
+      const record2 = {
+        previousGeneration: previous.directory,
+        targetGeneration: target.directory,
+        database: "database.sql",
+        sequence,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        policy: "If target is active, migrations may have begun. Never downgrade or restore automatically."
+      };
+      const recoveryFile = path15.join(directory, "recovery.json");
+      writeDurable(recoveryFile, renderRecovery({ ...record2, state: "pending" }));
       syncDirectory(directory);
       syncDirectory(backups);
       syncDirectory(configDir);
@@ -6049,9 +6334,16 @@ var createStore = (configDir, lock) => {
           }
           fs14.renameSync(partialFile, path15.join(directory, "database.sql"));
           syncDirectory(directory);
+        }),
+        markCompleted: () => whileOwned(() => {
+          const temporary = path15.join(directory, `.recovery-${randomUUID2()}`);
+          writeDurable(temporary, renderRecovery({ ...record2, state: "completed" }));
+          fs14.renameSync(temporary, recoveryFile);
+          syncDirectory(directory);
         })
       };
-    })
+    }),
+    pruneBackups: (keep, current, compareVersions) => whileOwned(() => pruneBackups(configDir, keep, current, compareVersions))
   };
 };
 var refuseFlatLayout = (configDir) => {
@@ -7406,9 +7698,26 @@ var startInstallation = async (runtime, installation, secrets) => {
   await probeHealth(runtime, healthOrigin(installation.config), installation.config.serverVersion);
   runtime.writeLine(reachableLine(installation.config));
 };
+var DEFAULT_KEEP_BACKUPS = 2;
 var parseUpgradeOptions = (args) => {
   const fromPreview = args.includes("--from-preview");
-  const rest = args.filter((arg) => arg !== "--from-preview");
+  const rest = [];
+  let keepBackups = DEFAULT_KEEP_BACKUPS;
+  for (let index = 0; index < args.length; index += 1) {
+    const flag = args[index];
+    if (flag === void 0 || flag === "--from-preview") continue;
+    if (flag === "--keep-backups") {
+      const value = args[index + 1];
+      if (value === void 0 || !/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)))
+        throw setupError(
+          "--keep-backups takes a whole number: how many upgrade backups to keep, 0 for all."
+        );
+      keepBackups = Number(value);
+      index += 1;
+      continue;
+    }
+    rest.push(flag);
+  }
   for (let index = 0; index < rest.length; index += 1) {
     const flag = rest[index];
     if (flag === "--offline") continue;
@@ -7421,7 +7730,63 @@ var parseUpgradeOptions = (args) => {
     throw setupError(
       "Upgrade requires --version TARGET. Use --version latest only to request the latest release explicitly."
     );
-  return { ...options, fromPreview };
+  return { ...options, fromPreview, keepBackups };
+};
+var formatBytes3 = (bytes) => {
+  if (bytes < 1024) return `${bytes} B`;
+  const units = ["KiB", "MiB", "GiB", "TiB"];
+  let value = bytes / 1024;
+  let unit = 0;
+  while (value >= 1024 && unit < units.length - 1) {
+    value /= 1024;
+    unit += 1;
+  }
+  return `${value.toFixed(value < 10 ? 1 : 0)} ${units[unit]}`;
+};
+var heldReason = (entry) => {
+  switch (entry.reason) {
+    case "pending":
+      return "pending: its upgrade never recorded a healthy target";
+    case "unfinished":
+      return "unfinished: no complete database dump";
+    case "no-outcome":
+      return "no recorded outcome: written after a 0.36 backup by a CLI that records none";
+    case "unreadable":
+      return `unreadable: ${entry.detail ?? "not read"}`;
+  }
+};
+var pruneUpgradeBackups = (runtime, store, backup, keep) => {
+  const marked = backup.markCompleted();
+  if (marked._tag === "error") {
+    runtime.writeLine(
+      `Could not record the upgrade as completed in ${backup.directory}/recovery.json; no backups were removed. ${marked.error.message}`
+    );
+    return;
+  }
+  if (keep === 0) {
+    runtime.writeLine("Upgrade backups \xB7 all kept (--keep-backups 0)");
+    return;
+  }
+  const pruned = store.pruneBackups(keep, backup, upgradeOrder);
+  if (pruned._tag === "error") {
+    runtime.writeLine(`Upgrade backups \xB7 not pruned: ${pruned.error.message}`);
+    return;
+  }
+  const { removed, kept, held, failed, unsynced } = pruned.value;
+  for (const entry of removed)
+    runtime.writeLine(
+      `Removed upgrade backup ${entry.directory} \xB7 ${formatBytes3(entry.bytes)}${entry.interrupted ? " \xB7 finishing a removal a crash cut short" : entry.legacy ? " \xB7 from before 0.36, no recorded outcome" : ""}`
+    );
+  const freed = removed.reduce((total, entry) => total + entry.bytes, 0);
+  runtime.writeLine(
+    `Upgrade backups \xB7 removed ${removed.length}${removed.length > 0 ? ` \xB7 ${formatBytes3(freed)} freed` : ""} \xB7 kept ${kept.length} (--keep-backups ${keep})`
+  );
+  for (const entry of failed)
+    runtime.writeLine(`Could not remove upgrade backup ${entry.directory}: ${entry.message}`);
+  if (unsynced !== void 0)
+    runtime.writeLine(`Upgrade backups \xB7 removals made but not fsynced: ${unsynced}`);
+  for (const entry of held)
+    runtime.writeLine(`Kept upgrade backup ${entry.directory} \xB7 ${heldReason(entry)}`);
 };
 var LEGACY_PREVIEW = /^(\d+\.\d+\.\d+)-preview\.(0|[1-9]\d*)$/;
 var NEXT_BUILD = /^(\d+\.\d+\.\d+)-next\.(0|[1-9]\d*)(\.preview\.[1-9]\d*)?$/;
@@ -7430,6 +7795,11 @@ var isPreviewToNext = (from, to) => {
   const next = NEXT_BUILD.exec(to);
   return preview !== null && next !== null && preview[1] === next[1];
 };
+var upgradeOrder = (a, b) => {
+  if (isPreviewToNext(a, b)) return -1;
+  if (isPreviewToNext(b, a)) return 1;
+  return compareServerVersions(a, b);
+};
 var drizzleMillis = (folder) => {
   const at = (start, end) => Number(folder.slice(start, end));
   return String(Date.UTC(at(0, 4), at(4, 6) - 1, at(6, 8), at(8, 10), at(10, 12), at(12, 14)));
@@ -7669,6 +8039,7 @@ var upgradeServer = async (args, runtime, store, existing) => {
     );
   }
   runtime.writeLine(`Upgraded to ${version}. Retained database backup: ${backup.directory}`);
+  pruneUpgradeBackups(runtime, store, backup, options.keepBackups);
 };
 var observeEdgeCertificate = async (runtime, installation, host) => {
   const listed = await runtime.run(
@@ -12537,7 +12908,7 @@ var dashboard = async (config, options = {}) => {
     );
     process.exit(rerun.status ?? 0);
   }
-  const { runDashboard } = await import("./dashboard-P73HKQOT.js");
+  const { runDashboard } = await import("./dashboard-2HF3KTTU.js");
   const agentShare = await startShareIfBridge(config);
   const tunnels = options.noTunnel === true || serverIsLocal(config) ? null : createServiceTunnels({
     listServices: () => fetchServices(config),

package/man/mend-accounts.1

@@ -1,4 +1,4 @@
-.TH MEND-ACCOUNTS 1 "" "mend 0.36.0\-next.628" "mend manual"
+.TH MEND-ACCOUNTS 1 "" "mend 0.36.0\-next.643" "mend manual"
 .SH NAME
 mend\-accounts \- your connected accounts on the platform
 .SH SYNOPSIS

package/man/mend-adopt.1

@@ -1,4 +1,4 @@
-.TH MEND-ADOPT 1 "" "mend 0.36.0\-next.628" "mend manual"
+.TH MEND-ADOPT 1 "" "mend 0.36.0\-next.643" "mend manual"
 .SH NAME
 mend\-adopt \- adopt a repository into the store
 .SH SYNOPSIS