@the-librarian/cli 1.20.0 → 1.21.0

package/dist/server/down.js

@@ -15,7 +15,7 @@
 // Everything goes through the injectable `docker.ts` runner, so tests assert the
 // exact argv without a real daemon.
 import { run } from "./docker.js";
-import { preflight } from "./preflight.js";
+import { dockerPreflight } from "./preflight.js";
 import { CONTAINER_NAME } from "./up.js";
 /** A teaching error from `down`; the runtime renders `.message` as one stderr line. */
 export class DownError extends Error {
@@ -34,7 +34,7 @@ function isNotRunning(stderr) {
  * no-op; any other non-zero exit is a teaching `DownError`.
  */
 export async function runDown(options = {}) {
-    await preflight(options.platform ? { platform: options.platform } : {});
+    await dockerPreflight(options.platform ? { platform: options.platform } : {});
     // The single, data-safe command. No `rm`, no `-v`, no `volume`, no `-f`.
     const result = await run("docker", ["stop", CONTAINER_NAME]);
     if (result.code === 0) {

package/dist/server/down.js.map

@@ -1 +1 @@
-{"version":3,"file":"down.js","sourceRoot":"","sources":["../../src/server/down.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,iFAAiF;AACjF,8EAA8E;AAC9E,+CAA+C;AAC/C,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,2EAA2E;AAC3E,+EAA+E;AAC/E,gCAAgC;AAChC,EAAE;AACF,iFAAiF;AACjF,oCAAoC;AAEpC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAOzC,uFAAuF;AACvF,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAOD,gFAAgF;AAChF,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,mCAAmC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,UAAuB,EAAE;IACrD,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAExE,yEAAyE;IACzE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IAE7D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE;gBACN,WAAW,cAAc,GAAG;gBAC5B,qFAAqF;aACtF,CAAC,IAAI,CAAC,IAAI,CAAC;SACb,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,MAAM,EAAE;gBACN,GAAG,cAAc,oCAAoC;gBACrD,wCAAwC;aACzC,CAAC,IAAI,CAAC,IAAI,CAAC;SACb,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,MAAM,IAAI,SAAS,CACjB,iBAAiB,cAAc,mBAAmB,MAAM,CAAC,IAAI,IAAI,QAAQ,GAAG;QAC1E,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/B,mEAAmE,CACtE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"down.js","sourceRoot":"","sources":["../../src/server/down.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,iFAAiF;AACjF,8EAA8E;AAC9E,+CAA+C;AAC/C,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,2EAA2E;AAC3E,+EAA+E;AAC/E,gCAAgC;AAChC,EAAE;AACF,iFAAiF;AACjF,oCAAoC;AAEpC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAOzC,uFAAuF;AACvF,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAOD,gFAAgF;AAChF,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,mCAAmC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,UAAuB,EAAE;IACrD,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAE9E,yEAAyE;IACzE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IAE7D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE;gBACN,WAAW,cAAc,GAAG;gBAC5B,qFAAqF;aACtF,CAAC,IAAI,CAAC,IAAI,CAAC;SACb,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,MAAM,EAAE;gBACN,GAAG,cAAc,oCAAoC;gBACrD,wCAAwC;aACzC,CAAC,IAAI,CAAC,IAAI,CAAC;SACb,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,MAAM,IAAI,SAAS,CACjB,iBAAiB,cAAc,mBAAmB,MAAM,CAAC,IAAI,IAAI,QAAQ,GAAG;QAC1E,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/B,mEAAmE,CACtE,CAAC;AACJ,CAAC"}

package/dist/server/index.d.ts

@@ -3,6 +3,8 @@ export declare const SERVER_SUBCOMMANDS: readonly ["up", "update", "down", "stat
 export type ServerSubcommand = (typeof SERVER_SUBCOMMANDS)[number];
 /** The `librarian server` command surface (spec §4). */
 export declare function serverUsage(): string;
+/** Help for one server subcommand; evaluated before any lifecycle dispatch. */
+export declare function serverSubcommandUsage(subcommand: ServerSubcommand): string;
 /** True iff `name` is one of the known `server` subcommands. */
 export declare function isServerSubcommand(name: string): name is ServerSubcommand;
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAYA,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,2GAUrB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE,wDAAwD;AACxD,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,gBAAgB,CAEzE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAKA,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,2GAUrB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE,wDAAwD;AACxD,wBAAgB,WAAW,IAAI,MAAM,CAqBpC;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,gBAAgB,GAAG,MAAM,CAoB1E;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,gBAAgB,CAEzE"}

package/dist/server/index.js

@@ -1,14 +1,7 @@
 // The `librarian server` command group — self-host the Librarian from the CLI.
 //
-// S1 lays the foundation the later slices build on: the command SURFACE (the
-// help table from spec §4), the `docker.ts` seam, and `preflight()`. The
-// individual subcommands (up / update / down / status / logs / enable-boot /
-// disable-boot / admin) are implemented in their own slices; here they resolve
-// to a clear "arrives in a later slice" notice so the surface is honest about
-// what exists today.
-//
-// `server` with NO subcommand prints the surface; `librarian --help` reveals
-// this group alongside the harness commands (wired in `runtime.ts`).
+// `server` with no subcommand prints the lifecycle surface; `librarian --help`
+// reveals this group alongside the harness commands (wired in `runtime.ts`).
 /** The `server` subcommands, in the order they appear in the surface (§4). */
 export const SERVER_SUBCOMMANDS = [
     "up",
@@ -26,12 +19,13 @@ export function serverUsage() {
     return [
         "Usage: librarian server <subcommand> [flags]",
         "",
-        "Self-host the Librarian server (build + run the all-in-one container),",
+        "Self-host the Librarian server from an exact published release,",
+        "or use --ref <development-ref>; source refs build locally,",
         "then hand its MCP URL + agent token to `librarian install` on clients.",
         "",
         "Subcommands:",
-        "  up            Build + run the server; print the MCP URL + agent token",
-        "  update        Re-pin to a release, rebuild, recreate (data volume kept)",
+        "  up            Pull an exact release (or build a source ref) and start it",
+        "  update        Prepare, verify and replace; recover the old image on failure",
         "  down          Stop the container (the data volume is preserved)",
         "  status        Running? healthy? deployed version vs latest release",
         "  logs          Tail the container logs ([-f] [--service mcp|dashboard|all])",
@@ -43,6 +37,28 @@ export function serverUsage() {
         "Run `librarian server <subcommand> --help` for flags (per subcommand).",
     ].join("\n");
 }
+/** Help for one server subcommand; evaluated before any lifecycle dispatch. */
+export function serverSubcommandUsage(subcommand) {
+    const usage = {
+        up: [
+            "Usage: librarian server up [--ref <release|source-ref>] [--dir <path>]",
+            "       [--host <address>] [--dashboard-port <port>]",
+            "       [--data-volume <name> | --data-dir <path>] [--enable-boot] [--yes]",
+        ],
+        update: ["Usage: librarian server update [--ref <release|source-ref>] [--dir <path>] [--yes]"],
+        down: ["Usage: librarian server down"],
+        status: ["Usage: librarian server status [--dir <path>]"],
+        logs: ["Usage: librarian server logs [-f|--follow] [--service mcp|dashboard|all]"],
+        "enable-boot": ["Usage: librarian server enable-boot"],
+        "disable-boot": ["Usage: librarian server disable-boot"],
+        autoupdate: [
+            "Usage: librarian server autoupdate <enable|disable|uninstall|status> [--dir <path>]",
+            "       [--cadence daily|weekly]",
+        ],
+        admin: ["Usage: librarian server admin <backup|restore|auth|rebuild> [args…]"],
+    };
+    return usage[subcommand].join("\n");
+}
 /** True iff `name` is one of the known `server` subcommands. */
 export function isServerSubcommand(name) {
     return SERVER_SUBCOMMANDS.includes(name);

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,6EAA6E;AAC7E,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,qBAAqB;AACrB,EAAE;AACF,6EAA6E;AAC7E,qEAAqE;AAErE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,IAAI;IACJ,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,MAAM;IACN,aAAa;IACb,cAAc;IACd,YAAY;IACZ,OAAO;CACC,CAAC;AAIX,wDAAwD;AACxD,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,8CAA8C;QAC9C,EAAE;QACF,wEAAwE;QACxE,wEAAwE;QACxE,EAAE;QACF,cAAc;QACd,yEAAyE;QACzE,2EAA2E;QAC3E,mEAAmE;QACnE,sEAAsE;QACtE,8EAA8E;QAC9E,0EAA0E;QAC1E,qCAAqC;QACrC,qFAAqF;QACrF,qFAAqF;QACrF,EAAE;QACF,wEAAwE;KACzE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAQ,kBAAwC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAClE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAE7E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,IAAI;IACJ,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,MAAM;IACN,aAAa;IACb,cAAc;IACd,YAAY;IACZ,OAAO;CACC,CAAC;AAIX,wDAAwD;AACxD,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,8CAA8C;QAC9C,EAAE;QACF,iEAAiE;QACjE,4DAA4D;QAC5D,wEAAwE;QACxE,EAAE;QACF,cAAc;QACd,4EAA4E;QAC5E,+EAA+E;QAC/E,mEAAmE;QACnE,sEAAsE;QACtE,8EAA8E;QAC9E,0EAA0E;QAC1E,qCAAqC;QACrC,qFAAqF;QACrF,qFAAqF;QACrF,EAAE;QACF,wEAAwE;KACzE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,qBAAqB,CAAC,UAA4B;IAChE,MAAM,KAAK,GAAgD;QACzD,EAAE,EAAE;YACF,wEAAwE;YACxE,qDAAqD;YACrD,2EAA2E;SAC5E;QACD,MAAM,EAAE,CAAC,oFAAoF,CAAC;QAC9F,IAAI,EAAE,CAAC,8BAA8B,CAAC;QACtC,MAAM,EAAE,CAAC,+CAA+C,CAAC;QACzD,IAAI,EAAE,CAAC,0EAA0E,CAAC;QAClF,aAAa,EAAE,CAAC,qCAAqC,CAAC;QACtD,cAAc,EAAE,CAAC,sCAAsC,CAAC;QACxD,UAAU,EAAE;YACV,qFAAqF;YACrF,iCAAiC;SAClC;QACD,KAAK,EAAE,CAAC,qEAAqE,CAAC;KAC/E,CAAC;IACF,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAQ,kBAAwC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAClE,CAAC"}

package/dist/server/logs.js

@@ -29,7 +29,7 @@
 //     `--service` filter; only the delivery (buffered-then-returned vs.
 //     live-per-line) differs.
 import { run, stream } from "./docker.js";
-import { preflight } from "./preflight.js";
+import { dockerPreflight } from "./preflight.js";
 import { CONTAINER_NAME } from "./up.js";
 const SERVICES = ["mcp", "dashboard", "all"];
 /** A teaching error from `logs`; the runtime renders `.message` as one stderr line. */
@@ -135,7 +135,7 @@ function makeLineFilter(service, write) {
  */
 export async function runLogs(options = {}) {
     const service = resolveService(options.service);
-    await preflight(options.platform ? { platform: options.platform } : {});
+    await dockerPreflight(options.platform ? { platform: options.platform } : {});
     if (options.follow) {
         // Live tail: stream line-by-line, never buffer to close.
         const write = options.write ?? ((chunk) => process.stdout.write(chunk));

package/dist/server/logs.js.map

@@ -1 +1 @@
-{"version":3,"file":"logs.js","sourceRoot":"","sources":["../../src/server/logs.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,2EAA2E;AAC3E,oFAAoF;AACpF,iFAAiF;AACjF,0EAA0E;AAC1E,EAAE;AACF,0DAA0D;AAC1D,+EAA+E;AAC/E,qFAAqF;AACrF,sEAAsE;AACtE,+EAA+E;AAC/E,kFAAkF;AAClF,2EAA2E;AAC3E,gFAAgF;AAChF,yCAAyC;AACzC,EAAE;AACF,+EAA+E;AAC/E,oCAAoC;AACpC,+EAA+E;AAC/E,+EAA+E;AAC/E,kEAAkE;AAClE,6EAA6E;AAC7E,8EAA8E;AAC9E,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,2EAA2E;AAC3E,wEAAwE;AACxE,8BAA8B;AAE9B,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAKzC,MAAM,QAAQ,GAA2B,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;AAkBrE,uFAAuF;AACvF,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAgBD,2EAA2E;AAC3E,SAAS,cAAc,CAAC,GAAuB;IAC7C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,IAAK,QAA8B,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAkB,CAAC;IAC7E,MAAM,IAAI,SAAS,CACjB,sBAAsB,GAAG,kDAAkD;QACzE,8EAA8E;QAC9E,gCAAgC,CACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAoB;IAClD,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9C,8EAA8E;IAC9E,uBAAuB;IACvB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,wFAAwF;AACxF,SAAS,eAAe,CAAC,IAAY,EAAE,OAAoB;IACzD,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;SACnC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CACrB,OAAoB,EACpB,KAA8B;IAE9B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAQ,EAAE;QAClC,IAAI,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC;IACF,OAAO;QACL,IAAI,CAAC,KAAa;YAChB,MAAM,IAAI,KAAK,CAAC;YAChB,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC1B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC9B,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,KAAK;YACH,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,CAAC;gBACb,MAAM,GAAG,EAAE,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,UAAuB,EAAE;IACrD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAExE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,yDAAyD;QACzD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE;YACtE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YACvC,uEAAuE;YACvE,iEAAiE;YACjE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IAClC,CAAC;IAED,4EAA4E;IAC5E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CACjB,iBAAiB,cAAc,mBAAmB,MAAM,CAAC,IAAI,IAAI,QAAQ,GAAG;YAC1E,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC/B,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACpF,CAAC"}
+{"version":3,"file":"logs.js","sourceRoot":"","sources":["../../src/server/logs.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,2EAA2E;AAC3E,oFAAoF;AACpF,iFAAiF;AACjF,0EAA0E;AAC1E,EAAE;AACF,0DAA0D;AAC1D,+EAA+E;AAC/E,qFAAqF;AACrF,sEAAsE;AACtE,+EAA+E;AAC/E,kFAAkF;AAClF,2EAA2E;AAC3E,gFAAgF;AAChF,yCAAyC;AACzC,EAAE;AACF,+EAA+E;AAC/E,oCAAoC;AACpC,+EAA+E;AAC/E,+EAA+E;AAC/E,kEAAkE;AAClE,6EAA6E;AAC7E,8EAA8E;AAC9E,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,2EAA2E;AAC3E,wEAAwE;AACxE,8BAA8B;AAE9B,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAKzC,MAAM,QAAQ,GAA2B,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;AAkBrE,uFAAuF;AACvF,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAgBD,2EAA2E;AAC3E,SAAS,cAAc,CAAC,GAAuB;IAC7C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,IAAK,QAA8B,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAkB,CAAC;IAC7E,MAAM,IAAI,SAAS,CACjB,sBAAsB,GAAG,kDAAkD;QACzE,8EAA8E;QAC9E,gCAAgC,CACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAoB;IAClD,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9C,8EAA8E;IAC9E,uBAAuB;IACvB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,wFAAwF;AACxF,SAAS,eAAe,CAAC,IAAY,EAAE,OAAoB;IACzD,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;SACnC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CACrB,OAAoB,EACpB,KAA8B;IAE9B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAQ,EAAE;QAClC,IAAI,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC;IACF,OAAO;QACL,IAAI,CAAC,KAAa;YAChB,MAAM,IAAI,KAAK,CAAC;YAChB,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC1B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC9B,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,KAAK;YACH,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,CAAC;gBACb,MAAM,GAAG,EAAE,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,UAAuB,EAAE;IACrD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAE9E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,yDAAyD;QACzD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE;YACtE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YACvC,uEAAuE;YACvE,iEAAiE;YACjE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IAClC,CAAC;IAED,4EAA4E;IAC5E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CACjB,iBAAiB,cAAc,mBAAmB,MAAM,CAAC,IAAI,IAAI,QAAQ,GAAG;YAC1E,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC/B,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACpF,CAAC"}

package/dist/server/preflight.d.ts

@@ -14,11 +14,13 @@ export interface PreflightOptions {
     platform?: NodeJS.Platform;
 }
 /**
- * Confirm `docker` (daemon reachable) and `git` are available, or throw a
- * `PreflightError` with a teaching message. Resolves to nothing on success.
+ * Confirm `docker` is installed with a reachable daemon, or throw a teaching
+ * `PreflightError`. Resolves to nothing on success.
  *
  * Order matters: report a missing binary before probing the daemon, so a host
  * without Docker is told to install it (not told the daemon is down).
  */
-export declare function preflight(options?: PreflightOptions): Promise<void>;
+export declare function dockerPreflight(options?: PreflightOptions): Promise<void>;
+/** Confirm Docker plus Git for a lifecycle path that operates on source. */
+export declare function sourcePreflight(options?: PreflightOptions): Promise<void>;
 //# sourceMappingURL=preflight.d.ts.map

package/dist/server/preflight.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../src/server/preflight.ts"],"names":[],"mappings":"AAcA;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B;AAoBD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB7E"}
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../src/server/preflight.ts"],"names":[],"mappings":"AAeA;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B;AAoBD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAanF;AAED,4EAA4E;AAC5E,wBAAsB,eAAe,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAKnF"}

package/dist/server/preflight.js

@@ -1,8 +1,9 @@
 // Preflight for the `server` command group.
 //
-// Every `server` subcommand that drives a container (up / update / down /
-// status / logs / boot / admin) first confirms the host actually has the tools
-// it needs: `docker` installed AND its daemon reachable, and `git` installed.
+// Every `server` subcommand that directly drives a container (up / update /
+// down / status / logs / admin) first confirms the host actually has the tools
+// it needs: `docker` installed AND its daemon reachable. Source deployments
+// additionally require `git`; registry-backed and Docker-only commands do not.
 // A missing or unreachable tool is a TEACHING error (what to install, or "is
 // the daemon running?") — never a stack trace, never a bare "error".
 //
@@ -34,13 +35,13 @@ function dockerDaemonHint(platform) {
     return `Docker is installed but its daemon is unreachable. ${start}`;
 }
 /**
- * Confirm `docker` (daemon reachable) and `git` are available, or throw a
- * `PreflightError` with a teaching message. Resolves to nothing on success.
+ * Confirm `docker` is installed with a reachable daemon, or throw a teaching
+ * `PreflightError`. Resolves to nothing on success.
  *
  * Order matters: report a missing binary before probing the daemon, so a host
  * without Docker is told to install it (not told the daemon is down).
  */
-export async function preflight(options = {}) {
+export async function dockerPreflight(options = {}) {
     const platform = options.platform ?? process.platform;
     if ((await which("docker")) === null) {
         throw new PreflightError(DOCKER_INSTALL);
@@ -51,6 +52,10 @@ export async function preflight(options = {}) {
     if (info.code !== 0) {
         throw new PreflightError(dockerDaemonHint(platform));
     }
+}
+/** Confirm Docker plus Git for a lifecycle path that operates on source. */
+export async function sourcePreflight(options = {}) {
+    await dockerPreflight(options);
     if ((await which("git")) === null) {
         throw new PreflightError(GIT_INSTALL);
     }

package/dist/server/preflight.js.map

@@ -1 +1 @@
-{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../src/server/preflight.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,qEAAqE;AACrE,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,iDAAiD;AAEjD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;GAIG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAUD,MAAM,cAAc,GAClB,qDAAqD;IACrD,4DAA4D;IAC5D,qEAAqE,CAAC;AAExE,MAAM,WAAW,GACf,kDAAkD;IAClD,8DAA8D;IAC9D,2DAA2D,CAAC;AAE9D,SAAS,gBAAgB,CAAC,QAAyB;IACjD,MAAM,KAAK,GACT,QAAQ,KAAK,QAAQ;QACnB,CAAC,CAAC,4GAA4G;QAC9G,CAAC,CAAC,2IAA2I,CAAC;IAClJ,OAAO,sDAAsD,KAAK,EAAE,CAAC;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAA4B,EAAE;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IAEtD,IAAI,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,cAAc,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC;IAED,6EAA6E;IAC7E,iEAAiE;IACjE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,cAAc,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../src/server/preflight.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,6EAA6E;AAC7E,qEAAqE;AACrE,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,iDAAiD;AAEjD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;GAIG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAUD,MAAM,cAAc,GAClB,qDAAqD;IACrD,4DAA4D;IAC5D,qEAAqE,CAAC;AAExE,MAAM,WAAW,GACf,kDAAkD;IAClD,8DAA8D;IAC9D,2DAA2D,CAAC;AAE9D,SAAS,gBAAgB,CAAC,QAAyB;IACjD,MAAM,KAAK,GACT,QAAQ,KAAK,QAAQ;QACnB,CAAC,CAAC,4GAA4G;QAC9G,CAAC,CAAC,2IAA2I,CAAC;IAClJ,OAAO,sDAAsD,KAAK,EAAE,CAAC;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAA4B,EAAE;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IAEtD,IAAI,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,cAAc,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC;IAED,6EAA6E;IAC7E,iEAAiE;IACjE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,cAAc,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAA4B,EAAE;IAClE,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}

package/dist/server/source-repository.d.ts

@@ -0,0 +1,6 @@
+export declare const CANONICAL_SOURCE_REPOSITORY = "https://github.com/code-ministry-ltd/the-librarian";
+/** Accept the canonical repository only over authenticated, encrypted transports. */
+export declare function isCanonicalSourceRemote(remote: string): boolean;
+/** Git may echo credential-bearing remote URLs; no Git diagnostic is trusted. */
+export declare function redactGitDiagnostics(text: string): string;
+//# sourceMappingURL=source-repository.d.ts.map

package/dist/server/source-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-repository.d.ts","sourceRoot":"","sources":["../../src/server/source-repository.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,2BAA2B,uDAAuD,CAAC;AAIhG,qFAAqF;AACrF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAoB/D;AAED,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIzD"}

package/dist/server/source-repository.js

@@ -0,0 +1,40 @@
+import { redactSecrets } from "./redact.js";
+export const CANONICAL_SOURCE_REPOSITORY = "https://github.com/code-ministry-ltd/the-librarian";
+const CANONICAL_PATH = "/code-ministry-ltd/the-librarian";
+/** Accept the canonical repository only over authenticated, encrypted transports. */
+export function isCanonicalSourceRemote(remote) {
+    const value = remote.trim();
+    const scp = value.match(/^git@github\.com:(\/?[^?#]+)$/iu);
+    if (scp)
+        return normalizePath(scp[1] ?? "") === CANONICAL_PATH;
+    try {
+        const parsed = new URL(value);
+        if (parsed.hostname.toLowerCase() !== "github.com" || parsed.search || parsed.hash)
+            return false;
+        if (normalizePath(parsed.pathname) !== CANONICAL_PATH)
+            return false;
+        if (parsed.protocol === "https:")
+            return parsed.port === "" || parsed.port === "443";
+        return (parsed.protocol === "ssh:" &&
+            parsed.username === "git" &&
+            parsed.password === "" &&
+            (parsed.port === "" || parsed.port === "22"));
+    }
+    catch {
+        return false;
+    }
+}
+/** Git may echo credential-bearing remote URLs; no Git diagnostic is trusted. */
+export function redactGitDiagnostics(text) {
+    return redactSecrets(text)
+        .replace(/\b[a-z][a-z0-9+.-]*:\/\/[^\s'"`]+/giu, "[redacted-remote]")
+        .replace(/\b[^\s/@:]+@[^\s/'":]+(?::|\/)[^\s'"`]+/gu, "[redacted-remote]");
+}
+function normalizePath(value) {
+    const withLeadingSlash = value.startsWith("/") ? value : `/${value}`;
+    return withLeadingSlash
+        .replace(/\/$/u, "")
+        .replace(/\.git$/iu, "")
+        .toLowerCase();
+}
+//# sourceMappingURL=source-repository.js.map

package/dist/server/source-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-repository.js","sourceRoot":"","sources":["../../src/server/source-repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,CAAC,MAAM,2BAA2B,GAAG,oDAAoD,CAAC;AAEhG,MAAM,cAAc,GAAG,kCAAkC,CAAC;AAE1D,qFAAqF;AACrF,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC3D,IAAI,GAAG;QAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,cAAc,CAAC;IAE/D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,YAAY,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI;YAChF,OAAO,KAAK,CAAC;QACf,IAAI,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,cAAc;YAAE,OAAO,KAAK,CAAC;QACpE,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,IAAI,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC;QACrF,OAAO,CACL,MAAM,CAAC,QAAQ,KAAK,MAAM;YAC1B,MAAM,CAAC,QAAQ,KAAK,KAAK;YACzB,MAAM,CAAC,QAAQ,KAAK,EAAE;YACtB,CAAC,MAAM,CAAC,IAAI,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAC7C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,aAAa,CAAC,IAAI,CAAC;SACvB,OAAO,CAAC,sCAAsC,EAAE,mBAAmB,CAAC;SACpE,OAAO,CAAC,2CAA2C,EAAE,mBAAmB,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,gBAAgB,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;IACrE,OAAO,gBAAgB;SACpB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;SACnB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,WAAW,EAAE,CAAC;AACnB,CAAC"}

package/dist/server/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/server/status.ts"],"names":[],"mappings":"AA2BA,MAAM,WAAW,mBAAmB;IAClC,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,kBAAkB;IACjC,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;CAChB;AAkCD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAcjG"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/server/status.ts"],"names":[],"mappings":"AA2BA,MAAM,WAAW,mBAAmB;IAClC,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,kBAAkB;IACjC,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;CAChB;AAwDD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAcjG"}

package/dist/server/status.js

@@ -4,9 +4,8 @@
 // latest-release fetcher (so tests never touch a real daemon/network):
 //   - container running? (`docker inspect --format {{.State.Status}}`)
 //   - health (`docker inspect --format {{.State.Health.Status}}`)
-//   - the DEPLOYED version — the ref recorded in deploy-state.json, falling back
-//     to `git -C <dir> describe --tags` when no state file exists (e.g. a clone
-//     made before deploy-state existed)
+//   - the DEPLOYED provenance — published tag + short digest, source ref, or a
+//     legacy ref from old state / `git describe`
 //   - the LATEST release (`fetchLatestVersion` — the same fetch `librarian
 //     status` uses for the harnesses)
 //   - an `up-to-date | update-available` badge via `isBehind(deployed, latest)`
@@ -20,10 +19,11 @@ import { librarianDir } from "../paths.js";
 import { isBehind } from "../semver.js";
 import { fetchLatestVersion } from "../status.js";
 import { readDeployState } from "./deploy-state.js";
-import { run } from "./docker.js";
-import { preflight } from "./preflight.js";
+import { shortImageDigest } from "./deployment-image.js";
+import { run, which } from "./docker.js";
+import { dockerPreflight } from "./preflight.js";
 import { CONTAINER_NAME } from "./up.js";
-/** The deploy dir `status` reads its recorded ref / git-describe fallback from. */
+/** The deploy dir `status` reads its recorded provenance / git fallback from. */
 function resolveDeployDir(options) {
     return options.dir ?? path.join(librarianDir(options.home), "server");
 }
@@ -37,20 +37,28 @@ async function inspectField(format) {
         return null;
     return result.stdout.trim();
 }
-/**
- * Resolve the deployed version: the deploy-state ref first (authoritative — it's
- * exactly what `up` checked out + built), else `git -C <dir> describe --tags`.
- * Returns `null` (→ "unknown") when neither is available.
- */
 async function resolveDeployed(deployDir) {
     const state = readDeployState(deployDir);
-    if (state?.ref)
-        return state.ref;
+    if (state?.imageSource === "registry") {
+        return {
+            ref: state.ref,
+            label: `published ${state.ref} (${shortImageDigest(state.imageDigest)})`,
+            releaseComparable: true,
+        };
+    }
+    if (state?.imageSource === "source") {
+        return { ref: state.ref, label: `source ${state.ref}`, releaseComparable: false };
+    }
+    if (state?.ref) {
+        return { ref: state.ref, label: `legacy ${state.ref}`, releaseComparable: false };
+    }
+    if ((await which("git")) === null)
+        return null;
     const described = await run("git", ["-C", deployDir, "describe", "--tags"]);
     if (described.code === 0) {
         const tag = described.stdout.trim();
         if (tag)
-            return tag;
+            return { ref: tag, label: `legacy ${tag}`, releaseComparable: false };
     }
     return null;
 }
@@ -61,7 +69,7 @@ async function resolveDeployed(deployDir) {
  * `unknown`/`?`.
  */
 export async function serverStatus(options = {}) {
-    await preflight(options.platform ? { platform: options.platform } : {});
+    await dockerPreflight(options.platform ? { platform: options.platform } : {});
     const deployDir = resolveDeployDir(options);
     // Probe the container. A null status means `docker inspect` failed → absent.
     const statusField = await inspectField("{{.State.Status}}");
@@ -78,9 +86,9 @@ export async function serverStatus(options = {}) {
  * harness `status` table's `update?` column).
  */
 function badge(deployed, latest) {
-    if (!deployed || !latest)
+    if (!deployed?.releaseComparable || !latest)
         return "?";
-    return isBehind(deployed, latest) ? "update-available" : "up-to-date";
+    return isBehind(deployed.ref, latest) ? "update-available" : "up-to-date";
 }
 function render(input) {
     const { statusField, running, health, deployed, latest } = input;
@@ -91,7 +99,7 @@ function render(input) {
         "",
         `  Running:    ${runningLabel}`,
         `  Health:     ${runningLabel === "not running" ? "—" : healthLabel}`,
-        `  Deployed:   ${deployed ?? "unknown"}`,
+        `  Deployed:   ${deployed?.label ?? "unknown"}`,
         `  Latest:     ${latest ?? "unknown"}`,
         `  Update:     ${badge(deployed, latest)}`,
     ];

package/dist/server/status.js.map

@@ -1 +1 @@
-{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/server/status.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,uEAAuE;AACvE,kEAAkE;AAClE,iFAAiF;AACjF,gFAAgF;AAChF,wCAAwC;AACxC,2EAA2E;AAC3E,sCAAsC;AACtC,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,iFAAiF;AACjF,iFAAiF;AACjF,4DAA4D;AAE5D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAgBzC,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,OAA4B;IACpD,OAAO,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,YAAY,CAAC,MAAc;IACxC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IACpF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,SAAiB;IAC9C,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,KAAK,EAAE,GAAG;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC;IAEjC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5E,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAA+B,EAAE;IAClE,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE5C,6EAA6E;IAC7E,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,WAAW,KAAK,SAAS,CAAC;IAC1C,8EAA8E;IAC9E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,0BAA0B,CAAC,CAAC;IAE5F,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAEjG,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAChF,CAAC;AAUD;;;;GAIG;AACH,SAAS,KAAK,CAAC,QAAuB,EAAE,MAAqB;IAC3D,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACrC,OAAO,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC;AACxE,CAAC;AAED,SAAS,MAAM,CAAC,KAAkB;IAChC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACjE,MAAM,YAAY,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IAC9F,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAErE,MAAM,KAAK,GAAG;QACZ,yBAAyB,cAAc,IAAI;QAC3C,EAAE;QACF,iBAAiB,YAAY,EAAE;QAC/B,iBAAiB,YAAY,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;QACrE,iBAAiB,QAAQ,IAAI,SAAS,EAAE;QACxC,iBAAiB,MAAM,IAAI,SAAS,EAAE;QACtC,iBAAiB,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;KAC3C,CAAC;IAEF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,kEAAkE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/server/status.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,uEAAuE;AACvE,kEAAkE;AAClE,+EAA+E;AAC/E,iDAAiD;AACjD,2EAA2E;AAC3E,sCAAsC;AACtC,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,iFAAiF;AACjF,iFAAiF;AACjF,4DAA4D;AAE5D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAgBzC,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,OAA4B;IACpD,OAAO,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,YAAY,CAAC,MAAc;IACxC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IACpF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAgBD,KAAK,UAAU,eAAe,CAAC,SAAiB;IAC9C,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,KAAK,EAAE,WAAW,KAAK,UAAU,EAAE,CAAC;QACtC,OAAO;YACL,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK,EAAE,aAAa,KAAK,CAAC,GAAG,KAAK,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG;YACxE,iBAAiB,EAAE,IAAI;SACxB,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,EAAE,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,KAAK,EAAE,GAAG,EAAE,CAAC;QACf,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;IACpF,CAAC;IAED,IAAI,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5E,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,GAAG;YAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,GAAG,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAA+B,EAAE;IAClE,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE5C,6EAA6E;IAC7E,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,WAAW,KAAK,SAAS,CAAC;IAC1C,8EAA8E;IAC9E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,0BAA0B,CAAC,CAAC;IAE5F,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAEjG,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAChF,CAAC;AAUD;;;;GAIG;AACH,SAAS,KAAK,CAAC,QAAiC,EAAE,MAAqB;IACrE,IAAI,CAAC,QAAQ,EAAE,iBAAiB,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxD,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC;AAC5E,CAAC;AAED,SAAS,MAAM,CAAC,KAAkB;IAChC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACjE,MAAM,YAAY,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IAC9F,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAErE,MAAM,KAAK,GAAG;QACZ,yBAAyB,cAAc,IAAI;QAC3C,EAAE;QACF,iBAAiB,YAAY,EAAE;QAC/B,iBAAiB,YAAY,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;QACrE,iBAAiB,QAAQ,EAAE,KAAK,IAAI,SAAS,EAAE;QAC/C,iBAAiB,MAAM,IAAI,SAAS,EAAE;QACtC,iBAAiB,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;KAC3C,CAAC;IAEF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,kEAAkE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/server/up.d.ts

@@ -1,4 +1,5 @@
 import type { Prompter } from "../prompt.js";
+import { writeDeployState } from "./deploy-state.js";
 export { redactSecrets } from "./redact.js";
 /** The repository the deploy dir clones (same repo the latest-tag fetch targets). */
 export declare const REPO_URL = "https://github.com/code-ministry-ltd/the-librarian";
@@ -42,8 +43,24 @@ export declare const SAVE_KEY_WARNING = "SAVE THIS KEY \u2014 excluded from back
  * the client `~/.librarian/env` (env.ts). 0600, by construction.
  */
 export declare const DEPLOY_ENV_FILE = "deploy.env";
+/** Prefix for invocation-private credentials used while a candidate starts. */
+export declare const STAGED_DEPLOY_ENV_FILE = "deploy.env.next";
 /** `<deployDir>/deploy.env` — the 0600 deploy env-file path within a deploy dir. */
 export declare function deployEnvFilePath(deployDir: string): string;
+/** An invocation-private staged env path, promoted only after health succeeds. */
+export declare function stagedDeployEnvFilePath(deployDir: string, invocationId: string): string;
+export type StagedEnvIdMinter = () => string;
+/** Inject the non-secret staged-file suffix (tests only). */
+export declare function setStagedEnvIdMinter(next: StagedEnvIdMinter): void;
+export declare function resetStagedEnvIdMinter(): void;
+export type FinalizationRenamer = (source: string, destination: string) => void;
+/** Inject the two final promotion operations (tests force the second to fail). */
+export declare function setFinalizationRenamer(next: FinalizationRenamer): void;
+export declare function resetFinalizationRenamer(): void;
+export type FinalizationRestorer = (file: string, snapshot: FileSnapshot) => void;
+/** Inject prior-file restoration failures (tests only). */
+export declare function setFinalizationRestorer(next: FinalizationRestorer): void;
+export declare function resetFinalizationRestorer(): void;
 /** A sleep used between health polls. Injectable so tests don't actually wait. */
 export type Sleep = (ms: number) => Promise<void>;
 /** Override the health-poll sleep (tests inject a no-op so polling is instant). */
@@ -153,6 +170,11 @@ export interface UpDeps {
 export declare class UpError extends Error {
     constructor(message: string);
 }
+/** Deployment-file promotion failed; tells update whether exact prior bytes were restored. */
+export declare class DeploymentFinalizationError extends UpError {
+    readonly priorFilesRestored: boolean;
+    constructor(message: string, priorFilesRestored: boolean);
+}
 export interface RunArgsInput {
     host: string;
     dataVolume: string;
@@ -162,7 +184,10 @@ export interface RunArgsInput {
     dataDir?: string | undefined;
     /** `uid:gid` to run the container as — set for a bind-mount so files stay host-owned. */
     runAsUser?: string | undefined;
-    tag: string;
+    /** Restart policy to preserve during update recovery. Fresh deployments default to unless-stopped. */
+    restartPolicy?: string | undefined;
+    /** Exact local tag or digest-pinned registry reference passed to `docker run`. */
+    imageRef: string;
     /**
      * Absolute path to the 0600 deploy env-file ({@link writeDeployEnvFile}). The
      * secrets (`LIBRARIAN_AGENT_TOKEN`, `LIBRARIAN_SECRET_KEY`, and optional
@@ -190,6 +215,8 @@ export interface RunArgsInput {
  * {@link writeDeployEnvFile}), not on this argv.
  */
 export declare function buildRunArgs(input: RunArgsInput): string[];
+/** Build the detached candidate configuration without starting it. */
+export declare function buildCreateArgs(input: RunArgsInput): string[];
 /**
  * The `uid:gid` that owns a path — the user the container runs as for a
  * bind-mounted data dir, so the vault stays host-owned and operator-writable.
@@ -220,20 +247,8 @@ export interface DeployEnvInput {
      */
     host: string;
 }
-/**
- * Write the 0600 deploy env-file `docker run --env-file` reads, returning its
- * path. It carries `LIBRARIAN_AGENT_TOKEN`, `LIBRARIAN_SECRET_KEY` (when
- * supplied), optional `LIBRARIAN_BOOTSTRAP_CLAIM_SECRET`, and (loopback only)
- * `LIBRARIAN_ALLOW_NO_AUTH=true`. Mode 0600 on create AND an unconditional
- * `chmodSync(0o600)` so a pre-existing looser file is tightened (same discipline
- * as env.ts `writeEnvFile`). The directory is created if missing.
- *
- * Format is `KEY=VALUE` lines (docker's `--env-file` syntax — NOT shell, so no
- * quoting/`export`). The minted secrets are 64-hex with no special chars, so a
- * raw value is safe; we reject a value with a newline (it would corrupt the file
- * / smuggle a second var) rather than emit a malformed file.
- */
 export declare function writeDeployEnvFile(deployDir: string, input: DeployEnvInput): string;
+export declare function writeStagedDeployEnvFile(deployDir: string, input: DeployEnvInput): string;
 /**
  * Parse an existing deploy env-file into a `KEY=VALUE` record, or `{}` when absent.
  * `up` uses this to REUSE the master key and optional bootstrap-claim secret
@@ -253,6 +268,13 @@ export interface UpResult {
  * interfaces); the bind choice drives the auth model (§6).
  */
 export declare function runUp(options: UpOptions, deps: UpDeps): Promise<UpResult>;
+export declare function removeStagedEnv(stagedEnvFile: string): void;
+interface FileSnapshot {
+    contents: Buffer | null;
+    mode?: number | undefined;
+}
+/** Promote env + state as one guarded unit, restoring exact prior bytes on failure. */
+export declare function finalizeDeploymentFiles(deployDir: string, stagedEnvFile: string, state: Parameters<typeof writeDeployState>[1]): void;
 /**
  * Health-wait tuning shared by `up` and `update` (the bounded poll + log-tail).
  * A subset of `UpOptions` so `update` can reuse {@link waitForHealthy} without
@@ -265,6 +287,8 @@ export interface HealthWaitOptions {
     healthIntervalMs?: number | undefined;
     /** Lines of `docker logs` to surface on a failed health-wait. */
     logTailLines?: number | undefined;
+    /** Immutable container ID for owned-candidate cleanup; update omits this for legacy name use. */
+    containerIdentity?: string | undefined;
 }
 /**
  * Poll `docker inspect … Health.Status` until `healthy`, bounded. On timeout or

package/dist/server/up.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"up.d.ts","sourceRoot":"","sources":["../../src/server/up.ts"],"names":[],"mappings":"AAoDA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAU7C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,qFAAqF;AACrF,eAAO,MAAM,QAAQ,uDAAuD,CAAC;AAE7E,wFAAwF;AACxF,eAAO,MAAM,cAAc,kBAAkB,CAAC;AAE9C,uFAAuF;AACvF,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,6EAA6E;AAC7E,eAAO,MAAM,SAAS,cAAc,CAAC;AAErC,2EAA2E;AAC3E,eAAO,MAAM,cAAc,YAAY,CAAC;AAExC;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,mGAAmG;AACnG,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAuBpE;AAED,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,+CAA0C,CAAC;AAExE;;;;;GAKG;AACH,eAAO,MAAM,eAAe,eAAe,CAAC;AAE5C,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE3D;AAID,kFAAkF;AAClF,MAAM,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAMlD,mFAAmF;AACnF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAE1C;AAED,sCAAsC;AACtC,wBAAgB,UAAU,IAAI,IAAI,CAEjC;AAID,qFAAqF;AACrF,MAAM,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC;AAMvC,+CAA+C;AAC/C,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAEtD;AAED,8CAA8C;AAC9C,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAID;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC;AAM3C,8CAA8C;AAC9C,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CAE9D;AAED,yDAAyD;AACzD,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAED;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,MAAM,WAAW,SAAS;IACxB,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,kEAAkE;IAClE,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,MAAM;IACrB,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IACpC,uEAAuE;IACvE,QAAQ,EAAE,QAAQ,CAAC;IACnB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;IACvC;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAClC;;;;;OAKG;IACH,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC5C;AAED,qFAAqF;AACrF,qBAAa,OAAQ,SAAQ,KAAK;gBACpB,OAAO,EAAE,MAAM;CAI5B;AAID,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,aAAa,EAAE,MAAM,CAAC;IACtB,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,EAAE,CA0B1D;AAYD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG5C;AAED,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,MAAM,CAgCnF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgB3E;AAUD,MAAM,WAAW,QAAQ;IACvB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CA+I/E;AA6ND;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4D9E;AAmID;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWzE"}
+{"version":3,"file":"up.d.ts","sourceRoot":"","sources":["../../src/server/up.ts"],"names":[],"mappings":"AAsDA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAGL,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAqB3B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,qFAAqF;AACrF,eAAO,MAAM,QAAQ,uDAA8B,CAAC;AAEpD,wFAAwF;AACxF,eAAO,MAAM,cAAc,kBAAkB,CAAC;AAE9C,uFAAuF;AACvF,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,6EAA6E;AAC7E,eAAO,MAAM,SAAS,cAAc,CAAC;AAErC,2EAA2E;AAC3E,eAAO,MAAM,cAAc,YAAY,CAAC;AAExC;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,mGAAmG;AACnG,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAuBpE;AAED,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,+CAA0C,CAAC;AAExE;;;;;GAKG;AACH,eAAO,MAAM,eAAe,eAAe,CAAC;AAE5C,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,oBAAoB,CAAC;AAExD,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,kFAAkF;AAClF,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAKvF;AAED,MAAM,MAAM,iBAAiB,GAAG,MAAM,MAAM,CAAC;AAK7C,6DAA6D;AAC7D,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAElE;AAED,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;AAMhF,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAEtE;AAED,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAED,MAAM,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,KAAK,IAAI,CAAC;AAGlF,2DAA2D;AAC3D,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,oBAAoB,GAAG,IAAI,CAExE;AAED,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAID,kFAAkF;AAClF,MAAM,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAMlD,mFAAmF;AACnF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAE1C;AAED,sCAAsC;AACtC,wBAAgB,UAAU,IAAI,IAAI,CAEjC;AAID,qFAAqF;AACrF,MAAM,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC;AAMvC,+CAA+C;AAC/C,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAEtD;AAED,8CAA8C;AAC9C,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAID;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC;AAM3C,8CAA8C;AAC9C,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CAE9D;AAED,yDAAyD;AACzD,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAED;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,MAAM,WAAW,SAAS;IACxB,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,kEAAkE;IAClE,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,MAAM;IACrB,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IACpC,uEAAuE;IACvE,QAAQ,EAAE,QAAQ,CAAC;IACnB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;IACvC;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAClC;;;;;OAKG;IACH,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC5C;AAED,qFAAqF;AACrF,qBAAa,OAAQ,SAAQ,KAAK;gBACpB,OAAO,EAAE,MAAM;CAI5B;AAED,8FAA8F;AAC9F,qBAAa,2BAA4B,SAAQ,OAAO;IAGpD,QAAQ,CAAC,kBAAkB,EAAE,OAAO;gBADpC,OAAO,EAAE,MAAM,EACN,kBAAkB,EAAE,OAAO;CAKvC;AAID,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,aAAa,EAAE,MAAM,CAAC;IACtB,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,sGAAsG;IACtG,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,EAAE,CAmC1D;AAED,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,EAAE,CAG7D;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG5C;AAED,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAgDD,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,MAAM,CAEnF;AAED,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,MAAM,CAEzF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgB3E;AAUD,MAAM,WAAW,QAAQ;IACvB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAiU/E;AAgXD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAM3D;AAED,UAAU,YAAY;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAqBD,uFAAuF;AACvF,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAC5C,IAAI,CAsCN;AAiGD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,iGAAiG;IACjG,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6D9E;AA8ID;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWzE"}