@the-librarian/cli 1.0.0-rc.21

package/dist/semver.js

@@ -0,0 +1,98 @@
+// A tiny, dependency-light semver-ish comparison.
+//
+// We only need "is the installed version behind the latest release?" — not a
+// full spec-compliant semver implementation. This tolerates the prerelease
+// shapes the monorepo actually ships (`1.0.0`, `1.0.0-rc.2`, `v1.2.3`) and
+// degrades gracefully on anything it can't parse (returns 0 → "equal", so an
+// unparseable version is never reported as an update).
+//
+// Precedence rules (subset of semver §11):
+//   - numeric release fields compare numerically (1.2.0 < 1.10.0);
+//   - a version WITH a prerelease has LOWER precedence than the same version
+//     WITHOUT one (1.0.0-rc.1 < 1.0.0);
+//   - prerelease identifiers compare left-to-right; numeric identifiers
+//     compare numerically, others lexically, numeric < non-numeric.
+/** Strip a leading `v` and any build-metadata (`+…`) we don't compare on. */
+function parse(version) {
+    const trimmed = version.trim().replace(/^v/i, "");
+    if (!trimmed)
+        return null;
+    const [core, ...preParts] = trimmed.split("-");
+    // Drop build metadata (`+sha`) from the prerelease tail and the core.
+    const prerelease = preParts.join("-").split("+")[0] ?? "";
+    const coreNoBuild = (core ?? "").split("+")[0] ?? "";
+    const release = coreNoBuild.split(".").map((n) => Number.parseInt(n, 10));
+    if (release.length === 0 || release.some((n) => Number.isNaN(n)))
+        return null;
+    return {
+        release,
+        prerelease: prerelease.length > 0 ? prerelease.split(".") : [],
+    };
+}
+/**
+ * Compare two version strings. Returns <0 if `a` precedes `b`, >0 if `a`
+ * follows `b`, 0 if equal or either is unparseable (so an unknown version
+ * never reads as "behind").
+ */
+export function compareVersions(a, b) {
+    const pa = parse(a);
+    const pb = parse(b);
+    if (!pa || !pb)
+        return 0;
+    const len = Math.max(pa.release.length, pb.release.length);
+    for (let i = 0; i < len; i += 1) {
+        const da = pa.release[i] ?? 0;
+        const db = pb.release[i] ?? 0;
+        if (da !== db)
+            return da < db ? -1 : 1;
+    }
+    // Equal release fields → a version with a prerelease is LOWER than one
+    // without (1.0.0-rc.1 < 1.0.0).
+    const aPre = pa.prerelease.length > 0;
+    const bPre = pb.prerelease.length > 0;
+    if (aPre && !bPre)
+        return -1;
+    if (!aPre && bPre)
+        return 1;
+    if (!aPre && !bPre)
+        return 0;
+    return comparePrerelease(pa.prerelease, pb.prerelease);
+}
+function comparePrerelease(a, b) {
+    const len = Math.max(a.length, b.length);
+    for (let i = 0; i < len; i += 1) {
+        // A longer prerelease list (with all-else-equal prefixes) has higher
+        // precedence (rc.1 < rc.1.1).
+        if (i >= a.length)
+            return -1;
+        if (i >= b.length)
+            return 1;
+        const ai = a[i] ?? "";
+        const bi = b[i] ?? "";
+        const an = /^\d+$/.test(ai);
+        const bn = /^\d+$/.test(bi);
+        if (an && bn) {
+            const na = Number.parseInt(ai, 10);
+            const nb = Number.parseInt(bi, 10);
+            if (na !== nb)
+                return na < nb ? -1 : 1;
+            continue;
+        }
+        if (an !== bn)
+            return an ? -1 : 1; // numeric identifiers rank below alphanumeric
+        if (ai !== bi)
+            return ai < bi ? -1 : 1;
+    }
+    return 0;
+}
+/**
+ * True iff `installed` is strictly behind `latest`. Either side being unknown
+ * (empty / unparseable) yields `false` — the caller renders `?`, never a
+ * false "update available".
+ */
+export function isBehind(installed, latest) {
+    if (!installed || !latest)
+        return false;
+    return compareVersions(installed, latest) < 0;
+}
+//# sourceMappingURL=semver.js.map

package/dist/semver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver.js","sourceRoot":"","sources":["../src/semver.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,uDAAuD;AACvD,EAAE;AACF,2CAA2C;AAC3C,mEAAmE;AACnE,6EAA6E;AAC7E,wCAAwC;AACxC,wEAAwE;AACxE,oEAAoE;AAOpE,6EAA6E;AAC7E,SAAS,KAAK,CAAC,OAAe;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/C,sEAAsE;IACtE,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO;QACL,OAAO;QACP,UAAU,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;KAC/D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,uEAAuE;IACvE,gCAAgC;IAChC,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IACtC,IAAI,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,IAAI,IAAI;QAAE,OAAO,CAAC,CAAC;IAC5B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC;IAE7B,OAAO,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAW,EAAE,CAAW;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,qEAAqE;QACrE,8BAA8B;QAC9B,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC;QAC5B,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;YACb,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACnC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,KAAK,EAAE;gBAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,8CAA8C;QACjF,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,SAAiB,EAAE,MAAc;IACxD,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC"}

package/dist/server/admin.d.ts

@@ -0,0 +1,31 @@
+/** The curated admin verbs exposed under `server admin` (spec §7). */
+export declare const ADMIN_VERBS: readonly ["backup", "restore", "auth", "rebuild"];
+export type AdminVerb = (typeof ADMIN_VERBS)[number];
+/** A teaching error from `admin`; the runtime renders `.message` as one stderr line. */
+export declare class AdminError extends Error {
+    constructor(message: string);
+}
+export interface AdminOptions {
+    /** Platform for preflight's daemon hint. Default `process.platform`. */
+    platform?: NodeJS.Platform | undefined;
+    /**
+     * Whether the run is interactive (a TTY is attached). When true we add
+     * `docker exec -it` so the in-container CLI can prompt (e.g. `restore`'s
+     * `--secret-key` prompt, `auth reset-password`). A non-interactive run omits
+     * `-it` so it works in scripts/CI without a TTY.
+     */
+    interactive?: boolean | undefined;
+}
+export interface AdminResult {
+    /** Human-readable report for stdout (the in-container CLI's own output). */
+    output: string;
+}
+/**
+ * Run `server admin <verb> [args…]`. Validates the verb is curated, preflights
+ * docker, confirms the container is running, then runs
+ * `docker exec [-it] the-librarian the-librarian <verb> [args…]` — passing the
+ * args through VERBATIM. A rejected verb / down container is a teaching
+ * `AdminError`; no `docker exec` runs in either case.
+ */
+export declare function runAdmin(argv: readonly string[], options?: AdminOptions): Promise<AdminResult>;
+//# sourceMappingURL=admin.d.ts.map

package/dist/server/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/server/admin.ts"],"names":[],"mappings":"AA+BA,sEAAsE;AACtE,eAAO,MAAM,WAAW,mDAAoD,CAAC;AAE7E,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD,wFAAwF;AACxF,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;IACvC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;CAChB;AAyCD;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,WAAW,CAAC,CAqCtB"}

package/dist/server/admin.js

@@ -0,0 +1,110 @@
+// `librarian server admin <verb> [args…]` — run a curated subset of the
+// folded-in admin CLI (`@librarian/cli`, the `the-librarian` binary) INSIDE the
+// running all-in-one container. Spec §7 ("Folded-in admin").
+//
+// One uniform mechanism: `docker exec the-librarian the-librarian <verb> [args…]`.
+// Running it in the container (not on the host) gives the admin CLI direct
+// access to the data dir + the store/settings the server already uses — which is
+// exactly what lets `auth` recovery bypass a locked dashboard and lets
+// `backup`/`restore` reuse the store rather than re-implement it. (The CLI is
+// bundled into the runtime image in the same slice — see all-in-one.Dockerfile.)
+//
+// CURATED set (spec §7): only `backup | restore | auth | rebuild` are exposed.
+// `seed` / `migrate-data-dir` / `export` / `handoffs` exist in @librarian/cli but
+// are deliberately NOT folded in here (seed is dev-only; migrate-data-dir runs
+// automatically on `update`; export + handoffs are power-user/dashboard surfaces).
+// They stay reachable via a raw `docker exec` if ever truly needed.
+//
+// Args after the verb are passed through VERBATIM, in order — this module never
+// parses, reorders, or rewrites them (so e.g. `auth reset-password --user x` and
+// `restore --secret-key …` reach the CLI exactly as typed). A bearer/secret may
+// ride through as an arg the CLI itself reads; this module never logs or persists
+// it (AGENTS.md: privacy beats convenience).
+//
+// Everything goes through the injectable `docker.ts` seam, so tests assert the
+// exact argv without a real daemon or container.
+import { run } from "./docker.js";
+import { preflight } from "./preflight.js";
+import { redactSecrets } from "./redact.js";
+import { CONTAINER_NAME } from "./up.js";
+/** The curated admin verbs exposed under `server admin` (spec §7). */
+export const ADMIN_VERBS = ["backup", "restore", "auth", "rebuild"];
+/** A teaching error from `admin`; the runtime renders `.message` as one stderr line. */
+export class AdminError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AdminError";
+    }
+}
+/** True iff `verb` is one of the curated admin verbs. */
+function isAdminVerb(verb) {
+    return ADMIN_VERBS.includes(verb);
+}
+/** The teaching message for an unknown/dropped verb — names what IS available. */
+function unknownVerbMessage(verb) {
+    const allowed = ADMIN_VERBS.join(" | ");
+    const lead = verb === undefined
+        ? "`librarian server admin` needs a subcommand."
+        : `\`${verb}\` is not an \`admin\` subcommand.`;
+    return [
+        lead,
+        "",
+        `Allowed: ${allowed}.`,
+        "",
+        "Not exposed here (by design): `seed` (dev-only), `migrate-data-dir` (runs",
+        "automatically on `librarian server update`), `export`, and `handoffs`",
+        "(power-user / dashboard surfaces).",
+    ].join("\n");
+}
+/**
+ * Confirm the container is up before exec'ing into it. `docker inspect` reports
+ * `running` when it is; any other status (or a failed inspect → absent) is a
+ * teaching error pointing at `server up`, with NO `docker exec`.
+ */
+async function assertContainerRunning() {
+    const result = await run("docker", ["inspect", "--format", "{{.State.Status}}", CONTAINER_NAME]);
+    const status = result.code === 0 ? result.stdout.trim() : null;
+    if (status !== "running") {
+        throw new AdminError("The server isn't running — run `librarian server up` first, then re-run " +
+            "this admin command.");
+    }
+}
+/**
+ * Run `server admin <verb> [args…]`. Validates the verb is curated, preflights
+ * docker, confirms the container is running, then runs
+ * `docker exec [-it] the-librarian the-librarian <verb> [args…]` — passing the
+ * args through VERBATIM. A rejected verb / down container is a teaching
+ * `AdminError`; no `docker exec` runs in either case.
+ */
+export async function runAdmin(argv, options = {}) {
+    const [verb, ...rest] = argv;
+    // Validate FIRST — a rejected verb must never reach a `docker exec` (and we
+    // don't even need a daemon to tell the user the verb is wrong).
+    if (verb === undefined || !isAdminVerb(verb)) {
+        throw new AdminError(unknownVerbMessage(verb));
+    }
+    await preflight(options.platform ? { platform: options.platform } : {});
+    await assertContainerRunning();
+    // `docker exec [-it] the-librarian the-librarian <verb> [args…]` — args verbatim.
+    const execArgs = [
+        "exec",
+        ...(options.interactive ? ["-it"] : []),
+        CONTAINER_NAME,
+        "the-librarian",
+        verb,
+        ...rest,
+    ];
+    const result = await run("docker", execArgs);
+    if (result.code !== 0) {
+        // `admin` forwards secret-bearing args (`restore --secret-key …`, `auth …`),
+        // so a failed in-container step can echo them back. Redact before surfacing,
+        // identically to `update`/`up` (I-3) — the shared helper is the choke point.
+        const detail = redactSecrets(result.stderr.trim() || result.stdout.trim());
+        throw new AdminError(`\`the-librarian ${verb}\` failed in the container (exit ${result.code ?? "signal"})` +
+            (detail ? `:\n${detail}` : ".") +
+            `\n\nResolve the error above, then re-run \`librarian server admin ${verb}\`.`);
+    }
+    // The in-container CLI's own output is the report (stdout, then any stderr).
+    return { output: result.stdout + result.stderr };
+}
+//# sourceMappingURL=admin.js.map

package/dist/server/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/server/admin.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,gFAAgF;AAChF,6DAA6D;AAC7D,EAAE;AACF,mFAAmF;AACnF,2EAA2E;AAC3E,iFAAiF;AACjF,uEAAuE;AACvE,8EAA8E;AAC9E,iFAAiF;AACjF,EAAE;AACF,+EAA+E;AAC/E,kFAAkF;AAClF,+EAA+E;AAC/E,mFAAmF;AACnF,oEAAoE;AACpE,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAChF,kFAAkF;AAClF,6CAA6C;AAC7C,EAAE;AACF,+EAA+E;AAC/E,iDAAiD;AAEjD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,sEAAsE;AACtE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAI7E,wFAAwF;AACxF,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAmBD,yDAAyD;AACzD,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAQ,WAAiC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CAAC,IAAwB;IAClD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,IAAI,GACR,IAAI,KAAK,SAAS;QAChB,CAAC,CAAC,8CAA8C;QAChD,CAAC,CAAC,KAAK,IAAI,oCAAoC,CAAC;IACpD,OAAO;QACL,IAAI;QACJ,EAAE;QACF,YAAY,OAAO,GAAG;QACtB,EAAE;QACF,2EAA2E;QAC3E,uEAAuE;QACvE,oCAAoC;KACrC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,sBAAsB;IACnC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,mBAAmB,EAAE,cAAc,CAAC,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAClB,0EAA0E;YACxE,qBAAqB,CACxB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAuB,EACvB,UAAwB,EAAE;IAE1B,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAE7B,4EAA4E;IAC5E,gEAAgE;IAChE,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxE,MAAM,sBAAsB,EAAE,CAAC;IAE/B,kFAAkF;IAClF,MAAM,QAAQ,GAAG;QACf,MAAM;QACN,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,cAAc;QACd,eAAe;QACf,IAAI;QACJ,GAAG,IAAI;KACR,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE7C,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3E,MAAM,IAAI,UAAU,CAClB,mBAAmB,IAAI,oCAAoC,MAAM,CAAC,IAAI,IAAI,QAAQ,GAAG;YACnF,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC/B,qEAAqE,IAAI,KAAK,CACjF,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;AACnD,CAAC"}

package/dist/server/boot.d.ts

@@ -0,0 +1,51 @@
+/** The systemd unit file name (single instance per host). */
+export declare const UNIT_NAME = "the-librarian.service";
+/** The absolute path the unit is installed at (the system unit, via sudo). */
+export declare function unitPath(): string;
+export interface BootOptions {
+    /** Platform — gates the macOS deferral. Default `process.platform`. */
+    platform?: NodeJS.Platform | undefined;
+}
+/** A teaching error from boot ops; the runtime renders `.message` as one stderr line. */
+export declare class BootError extends Error {
+    constructor(message: string);
+}
+export interface BootResult {
+    /** Human-readable report for stdout. */
+    output: string;
+}
+/** Inputs to the pure unit generator (only a docker path — NEVER a secret). */
+export interface UnitInput {
+    /** The absolute path to the `docker` binary used in ExecStart/ExecStop. */
+    dockerPath: string;
+}
+/**
+ * Generate the systemd unit text. PURE + unit-tested. The headline invariant:
+ * it contains NO secret — no agent token, no `LIBRARIAN_AGENT_TOKEN`, no
+ * `docker run` / `-e` env injection — only a `docker start --attach` /
+ * `docker stop` of the EXISTING named container. The container already carries
+ * its env (incl. the token) in Docker's own state, so referencing it by name
+ * needs no secret in this file.
+ */
+export declare function generateUnit(input: UnitInput): string;
+/** The one-line macOS-deferred notice (shared by enable/disable + `up`). */
+export declare const MACOS_NOTICE: string;
+/**
+ * Enable boot persistence. On Linux: write the unit to `/etc/systemd/system`
+ * (root, so temp-file + `sudo cp` + `sudo chmod 644`), `sudo systemctl
+ * daemon-reload`, then `sudo systemctl enable --now the-librarian.service`.
+ * Idempotent — re-running rewrites the SAME unit path and re-enables, never
+ * duplicating. On macOS: print the deferred notice and skip cleanly (NOT an
+ * error).
+ */
+export declare function enableBoot(options?: BootOptions): Promise<BootResult>;
+/**
+ * Disable boot persistence. On Linux: `sudo systemctl disable --now
+ * the-librarian.service`, remove the unit file (`sudo rm -f`), then `sudo
+ * systemctl daemon-reload`. Safe if already disabled/absent — a non-zero
+ * `disable` (unit not loaded) becomes a friendly teaching message, never a
+ * crash; the `rm -f` + reload still run so a stale unit file is cleaned up. On
+ * macOS: print the deferred notice and skip cleanly.
+ */
+export declare function disableBoot(options?: BootOptions): Promise<BootResult>;
+//# sourceMappingURL=boot.d.ts.map

package/dist/server/boot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot.d.ts","sourceRoot":"","sources":["../../src/server/boot.ts"],"names":[],"mappings":"AAoCA,6DAA6D;AAC7D,eAAO,MAAM,SAAS,0BAA0B,CAAC;AAKjD,8EAA8E;AAC9E,wBAAgB,QAAQ,IAAI,MAAM,CAEjC;AAKD,MAAM,WAAW,WAAW;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;CACxC;AAED,yFAAyF;AACzF,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,UAAU;IACzB,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+EAA+E;AAC/E,MAAM,WAAW,SAAS;IACxB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CA+BrD;AAED,4EAA4E;AAC5E,eAAO,MAAM,YAAY,QAGsC,CAAC;AAkChE;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CA2B/E;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CA+BhF"}

package/dist/server/boot.js

@@ -0,0 +1,233 @@
+// `librarian server enable-boot` / `disable-boot` — Linux systemd boot
+// persistence for the all-in-one container. (macOS launchd is deferred — §9.)
+//
+// SECURITY — the whole point of this slice. The systemd unit MUST NOT contain
+// any secret. We do NOT bake a `docker run -e LIBRARIAN_AGENT_TOKEN=…` into
+// `ExecStart`: that would write the agent token into a world-readable
+// `/etc/systemd/system/*.service` file — a leak. Instead the unit references the
+// EXISTING named container (created by `up`/`update`, whose env — including the
+// token — lives in Docker's own container state, not a file we manage):
+//
+//   ExecStart=/usr/bin/docker start --attach the-librarian
+//   ExecStop=/usr/bin/docker stop the-librarian
+//
+// `docker start --attach` re-uses the container exactly as `up` created it
+// (same name, same env, same volume) and stays in the foreground so systemd's
+// `Type=simple` supervision + `Restart=always` work. This survives a `server
+// update` (which recreates the SAME container name) and reboots, with NO secret
+// anywhere on disk that we write.
+//
+// We default to a SYSTEM unit (`/etc/systemd/system/…`, via `sudo`) because it
+// boots reliably without a login session. (A `--user` unit under
+// `~/.config/systemd/user/` would need `loginctl enable-linger` to survive
+// logout — out of scope for v1; deliberately not built.)
+//
+// Writing to `/etc/systemd/system` needs root, so the unit is written to a
+// temp file first (NON-SECRET content) and then `sudo cp`'d into place — every
+// privileged step (`sudo cp`/`chmod`/`rm`, `sudo systemctl …`) routes through
+// the injectable `docker.ts` runner so tests assert the exact argv and never
+// touch real systemd, sudo, or docker.
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { run, which } from "./docker.js";
+import { CONTAINER_NAME } from "./up.js";
+/** The systemd unit file name (single instance per host). */
+export const UNIT_NAME = "the-librarian.service";
+/** The system-unit directory (a system unit boots without a login session). */
+const SYSTEMD_SYSTEM_DIR = "/etc/systemd/system";
+/** The absolute path the unit is installed at (the system unit, via sudo). */
+export function unitPath() {
+    return path.join(SYSTEMD_SYSTEM_DIR, UNIT_NAME);
+}
+/** Fallback docker path if `which docker` can't be resolved (well-known location). */
+const DEFAULT_DOCKER_PATH = "/usr/bin/docker";
+/** A teaching error from boot ops; the runtime renders `.message` as one stderr line. */
+export class BootError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "BootError";
+    }
+}
+/**
+ * Generate the systemd unit text. PURE + unit-tested. The headline invariant:
+ * it contains NO secret — no agent token, no `LIBRARIAN_AGENT_TOKEN`, no
+ * `docker run` / `-e` env injection — only a `docker start --attach` /
+ * `docker stop` of the EXISTING named container. The container already carries
+ * its env (incl. the token) in Docker's own state, so referencing it by name
+ * needs no secret in this file.
+ */
+export function generateUnit(input) {
+    const { dockerPath } = input;
+    return [
+        "[Unit]",
+        "Description=The Librarian (all-in-one)",
+        "After=docker.service",
+        "Requires=docker.service",
+        "",
+        "[Service]",
+        "Type=simple",
+        // SC5 (ADR 0008) — env-file POINTER, deliberately a comment, not a directive.
+        // `docker start --attach` re-uses the container's env exactly as `up`/`update`
+        // baked it from <deployDir>/deploy.env (0600); it does NOT read systemd's
+        // `Environment*`. A live `EnvironmentFile=` here would be silently ignored —
+        // misleading config — so this stays a comment that just tells a reader where
+        // the credentials live, with no value of any kind written into this file.
+        `# Container env (incl. credentials) is baked into the '${CONTAINER_NAME}' container`,
+        "# at `librarian server up`/`update`, sourced from the 0600 deploy.env in the",
+        "# deploy dir (default ~/.librarian/server). `docker start` re-uses that frozen",
+        "# env, so nothing sensitive is (or should be) written into this unit file.",
+        // Reference the EXISTING named container — NO `docker run`, NO `-e <secret>`.
+        // `--attach` keeps it in the foreground so Type=simple supervision works.
+        `ExecStart=${dockerPath} start --attach ${CONTAINER_NAME}`,
+        `ExecStop=${dockerPath} stop ${CONTAINER_NAME}`,
+        "Restart=always",
+        "RestartSec=5",
+        "",
+        "[Install]",
+        "WantedBy=multi-user.target",
+        "",
+    ].join("\n");
+}
+/** The one-line macOS-deferred notice (shared by enable/disable + `up`). */
+export const MACOS_NOTICE = "Boot persistence is Linux-only for now (launchd support is deferred). " +
+    "Skipping — on macOS, start the server manually with `librarian server up`, " +
+    "or use Docker Desktop's 'start on login' for the container.";
+/** True iff boot persistence is unsupported on this platform (macOS for now). */
+function isUnsupportedPlatform(platform) {
+    return platform === "darwin";
+}
+/**
+ * Boot-specific preflight: `docker` must be on PATH (the unit runs `docker
+ * start` at boot). Unlike the container-op preflight this does NOT require git
+ * or a reachable daemon — enabling/disabling a unit file needs neither. A
+ * missing docker is a teaching `BootError`.
+ */
+async function requireDocker() {
+    if ((await which("docker")) === null) {
+        throw new BootError("Docker is required but was not found on your PATH. " +
+            "The boot unit runs `docker start` — install Docker Engine (Linux) " +
+            "— see https://docs.docker.com/get-docker/ — then re-run this command.");
+    }
+}
+/**
+ * Resolve the absolute `docker` path for the unit's ExecStart. Goes through the
+ * injectable runner (`which docker`); falls back to the well-known
+ * `/usr/bin/docker` so a non-standard `which` output never breaks unit
+ * generation. The path is non-secret, so a fallback is safe.
+ */
+async function resolveDockerPath() {
+    const resolved = await which("docker");
+    return resolved && resolved.trim().length > 0 ? resolved.trim() : DEFAULT_DOCKER_PATH;
+}
+/**
+ * Enable boot persistence. On Linux: write the unit to `/etc/systemd/system`
+ * (root, so temp-file + `sudo cp` + `sudo chmod 644`), `sudo systemctl
+ * daemon-reload`, then `sudo systemctl enable --now the-librarian.service`.
+ * Idempotent — re-running rewrites the SAME unit path and re-enables, never
+ * duplicating. On macOS: print the deferred notice and skip cleanly (NOT an
+ * error).
+ */
+export async function enableBoot(options = {}) {
+    const platform = options.platform ?? process.platform;
+    if (isUnsupportedPlatform(platform)) {
+        return { output: MACOS_NOTICE };
+    }
+    // Boot persistence runs `docker start` at boot, so it needs `docker` on PATH
+    // — but NOT git (no clone here) and NOT a reachable daemon right now (the unit
+    // fires at boot, not at enable time). A lighter, boot-specific preflight.
+    await requireDocker();
+    const dockerPath = await resolveDockerPath();
+    const unit = generateUnit({ dockerPath });
+    await installUnit(unit);
+    // daemon-reload BEFORE enable --now so systemd sees the (possibly rewritten)
+    // unit. enable --now both enables-on-boot and starts the container now.
+    await sudoSystemctl(["daemon-reload"]);
+    await sudoSystemctl(["enable", "--now", UNIT_NAME]);
+    return {
+        output: [
+            `Boot persistence enabled — ${UNIT_NAME} will start the container on boot.`,
+            `  Unit: ${unitPath()} (references the existing '${CONTAINER_NAME}' container; no secret in the file)`,
+            "Disable it again with `librarian server disable-boot`.",
+        ].join("\n"),
+    };
+}
+/**
+ * Disable boot persistence. On Linux: `sudo systemctl disable --now
+ * the-librarian.service`, remove the unit file (`sudo rm -f`), then `sudo
+ * systemctl daemon-reload`. Safe if already disabled/absent — a non-zero
+ * `disable` (unit not loaded) becomes a friendly teaching message, never a
+ * crash; the `rm -f` + reload still run so a stale unit file is cleaned up. On
+ * macOS: print the deferred notice and skip cleanly.
+ */
+export async function disableBoot(options = {}) {
+    const platform = options.platform ?? process.platform;
+    if (isUnsupportedPlatform(platform)) {
+        return { output: MACOS_NOTICE };
+    }
+    await requireDocker();
+    // disable --now: tolerate "unit does not exist / not loaded" — already off.
+    const disable = await run("sudo", ["systemctl", "disable", "--now", UNIT_NAME]);
+    const alreadyAbsent = disable.code !== 0 && isUnitAbsent(disable.stderr);
+    if (disable.code !== 0 && !alreadyAbsent) {
+        failIfNonZero("sudo", ["systemctl", "disable", "--now", UNIT_NAME], disable);
+    }
+    // Remove the unit file (idempotent with `-f`), then daemon-reload so systemd
+    // forgets it. `rm -f` never errors on an absent file.
+    await sudoRun(["rm", "-f", unitPath()]);
+    await sudoSystemctl(["daemon-reload"]);
+    return {
+        output: alreadyAbsent
+            ? [
+                `Boot persistence was not enabled (${UNIT_NAME} was not loaded) — nothing to disable.`,
+                `Removed any stale unit file at ${unitPath()} and reloaded systemd.`,
+            ].join("\n")
+            : [
+                `Boot persistence disabled — ${UNIT_NAME} removed and systemd reloaded.`,
+                "The container itself is untouched; stop it with `librarian server down`.",
+            ].join("\n"),
+    };
+}
+// --- privileged steps (every one through the injectable runner) ----------
+/**
+ * Write the unit to the system path. `/etc/systemd/system` needs root, so the
+ * NON-SECRET unit text is written to a temp file first, then `sudo cp`'d into
+ * place and `sudo chmod 644`'d (world-readable is fine — there is no secret in
+ * it, by construction). The temp file is removed afterward. The `cp`/`chmod`
+ * argv is asserted by tests; the temp source carries the unit content for the
+ * test's no-secret check (the fake runner doesn't really move it).
+ */
+async function installUnit(unit) {
+    const dir = mkdtempSync(path.join(tmpdir(), "librarian-unit-"));
+    const tmp = path.join(dir, UNIT_NAME);
+    writeFileSync(tmp, unit, "utf8");
+    try {
+        await sudoRun(["cp", tmp, unitPath()]);
+        await sudoRun(["chmod", "644", unitPath()]);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+/** Run `sudo systemctl <args…>`; a non-zero exit is a teaching error. */
+async function sudoSystemctl(args) {
+    await sudoRun(["systemctl", ...args]);
+}
+/** Run `sudo <args…>`; a non-zero exit is a teaching error. */
+async function sudoRun(args) {
+    const result = await run("sudo", args);
+    failIfNonZero("sudo", args, result);
+}
+/** True when a `systemctl disable` failure means the unit simply isn't loaded. */
+function isUnitAbsent(stderr) {
+    return /does not exist|not loaded|no such file|not found/i.test(stderr);
+}
+function failIfNonZero(cmd, args, result) {
+    if (result.code === 0)
+        return;
+    const detail = result.stderr.trim() || result.stdout.trim();
+    throw new BootError(`\`${cmd} ${args[0]}\` failed (exit ${result.code ?? "signal"})` +
+        (detail ? `:\n${detail}` : ".") +
+        "\n\nResolve the error above (you may need sudo privileges), then re-run the command.");
+}
+//# sourceMappingURL=boot.js.map

package/dist/server/boot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot.js","sourceRoot":"","sources":["../../src/server/boot.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,8EAA8E;AAC9E,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,sEAAsE;AACtE,iFAAiF;AACjF,gFAAgF;AAChF,wEAAwE;AACxE,EAAE;AACF,2DAA2D;AAC3D,gDAAgD;AAChD,EAAE;AACF,2EAA2E;AAC3E,8EAA8E;AAC9E,6EAA6E;AAC7E,gFAAgF;AAChF,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,iEAAiE;AACjE,2EAA2E;AAC3E,yDAAyD;AACzD,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,uCAAuC;AAEvC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,6DAA6D;AAC7D,MAAM,CAAC,MAAM,SAAS,GAAG,uBAAuB,CAAC;AAEjD,+EAA+E;AAC/E,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAEjD,8EAA8E;AAC9E,MAAM,UAAU,QAAQ;IACtB,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;AAClD,CAAC;AAED,sFAAsF;AACtF,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAO9C,yFAAyF;AACzF,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAaD;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,KAAgB;IAC3C,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC7B,OAAO;QACL,QAAQ;QACR,wCAAwC;QACxC,sBAAsB;QACtB,yBAAyB;QACzB,EAAE;QACF,WAAW;QACX,aAAa;QACb,8EAA8E;QAC9E,+EAA+E;QAC/E,0EAA0E;QAC1E,6EAA6E;QAC7E,6EAA6E;QAC7E,0EAA0E;QAC1E,0DAA0D,cAAc,aAAa;QACrF,8EAA8E;QAC9E,gFAAgF;QAChF,4EAA4E;QAC5E,8EAA8E;QAC9E,0EAA0E;QAC1E,aAAa,UAAU,mBAAmB,cAAc,EAAE;QAC1D,YAAY,UAAU,SAAS,cAAc,EAAE;QAC/C,gBAAgB;QAChB,cAAc;QACd,EAAE;QACF,WAAW;QACX,4BAA4B;QAC5B,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,YAAY,GACvB,wEAAwE;IACxE,6EAA6E;IAC7E,6DAA6D,CAAC;AAEhE,iFAAiF;AACjF,SAAS,qBAAqB,CAAC,QAAyB;IACtD,OAAO,QAAQ,KAAK,QAAQ,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa;IAC1B,IAAI,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,SAAS,CACjB,qDAAqD;YACnD,oEAAoE;YACpE,uEAAuE,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB;IAC9B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAuB,EAAE;IACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAClC,CAAC;IAED,6EAA6E;IAC7E,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,aAAa,EAAE,CAAC;IAEtB,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1C,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IAExB,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,aAAa,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;IACvC,MAAM,aAAa,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAEpD,OAAO;QACL,MAAM,EAAE;YACN,8BAA8B,SAAS,oCAAoC;YAC3E,WAAW,QAAQ,EAAE,8BAA8B,cAAc,qCAAqC;YACtG,wDAAwD;SACzD,CAAC,IAAI,CAAC,IAAI,CAAC;KACb,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAAuB,EAAE;IACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,aAAa,EAAE,CAAC;IAEtB,4EAA4E;IAC5E,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAChF,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACzC,aAAa,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/E,CAAC;IAED,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACxC,MAAM,aAAa,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;IAEvC,OAAO;QACL,MAAM,EAAE,aAAa;YACnB,CAAC,CAAC;gBACE,qCAAqC,SAAS,wCAAwC;gBACtF,kCAAkC,QAAQ,EAAE,wBAAwB;aACrE,CAAC,IAAI,CAAC,IAAI,CAAC;YACd,CAAC,CAAC;gBACE,+BAA+B,SAAS,gCAAgC;gBACxE,0EAA0E;aAC3E,CAAC,IAAI,CAAC,IAAI,CAAC;KACjB,CAAC;AACJ,CAAC;AAED,4EAA4E;AAE5E;;;;;;;GAOG;AACH,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACtC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QACvC,MAAM,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,aAAa,CAAC,IAAc;IACzC,MAAM,OAAO,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,+DAA+D;AAC/D,KAAK,UAAU,OAAO,CAAC,IAAc;IACnC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,mDAAmD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,aAAa,CACpB,GAAW,EACX,IAAc,EACd,MAA+D;IAE/D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,IAAI,SAAS,CACjB,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,mBAAmB,MAAM,CAAC,IAAI,IAAI,QAAQ,GAAG;QAC9D,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/B,sFAAsF,CACzF,CAAC;AACJ,CAAC"}

package/dist/server/deploy-state.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The deploy-state recorded after a successful `up` (and rewritten by `update`).
+ * Every field is NON-SECRET — see the module header. Do NOT add a token/key.
+ */
+export interface DeployState {
+    /** The container name every `server` command operates on. */
+    containerName: string;
+    /** The resolved bind host the container publishes on (`127.0.0.1`, a tailnet IP, `0.0.0.0`). */
+    host: string;
+    /** The named data volume mounted at `/data` (sacred across `down`/`update`). */
+    dataVolume: string;
+    /** The deployed ref — a `vX.Y.Z` tag or `main` (what was checked out + built). */
+    ref: string;
+    /** The built image tag (`the-librarian:<ref>`). */
+    imageTag: string;
+}
+/** `<dir>/deploy-state.json` — the deploy-state file path within a deploy dir. */
+export declare function deployStatePath(dir: string): string;
+/**
+ * Write the deploy-state to `<dir>/deploy-state.json`, creating `dir` if absent.
+ *
+ * Only the five declared fields are persisted — a `pick`, not a spread — so no
+ * extra key (e.g. a smuggled token) can ride along into the file. The file is
+ * non-secret, so it gets ordinary (not 0600) permissions.
+ */
+export declare function writeDeployState(dir: string, state: DeployState): void;
+/**
+ * Read the deploy-state back, or `null` if the file is absent, unparseable, or
+ * missing any required field. Never throws — a missing/corrupt state file means
+ * the caller falls back (e.g. `status` uses `git describe`), never crashes.
+ */
+export declare function readDeployState(dir: string): DeployState | null;
+//# sourceMappingURL=deploy-state.d.ts.map

package/dist/server/deploy-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-state.d.ts","sourceRoot":"","sources":["../../src/server/deploy-state.ts"],"names":[],"mappings":"AAmBA;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,6DAA6D;IAC7D,aAAa,EAAE,MAAM,CAAC;IACtB,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,GAAG,EAAE,MAAM,CAAC;IACZ,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAKD,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAYtE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAyB/D"}