@tiangong-ai/cli 0.0.61 → 0.0.63

package/dist/research/workspace/setup-release.js

@@ -0,0 +1,426 @@
+import { spawn } from "node:child_process";
+import { tmpdir } from "node:os";
+import { CliError } from "../../errors.js";
+const REGISTRY_URL = "https://registry.npmjs.org";
+// npm-registry-fetch prefers the scoped registry over opts.registry, so a
+// HOME/.npmrc could silently retarget @tiangong-ai; both pins ride along as
+// constant argv on every query.
+const SCOPED_REGISTRY_PIN = "--@tiangong-ai:registry=https://registry.npmjs.org";
+const STRICT_SSL_PIN = "--strict-ssl=true";
+const RESEARCH_CLI_PACKAGE_NAME = "@tiangong-ai/cli";
+const RELEASE_QUERY_TIMEOUT_MS = 30_000;
+const RELEASE_KILL_GRACE_MS = 5_000;
+const EXIT_STREAM_GRACE_MS = 1_000;
+const MAX_RELEASE_QUERY_OUTPUT_BYTES = 1024 * 1024;
+const EXACT_STABLE_SEMVER_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+const GIT_HEAD_PATTERN = /^[0-9a-f]{40}$/;
+const SHA512_INTEGRITY_PATTERN = /^sha512-[A-Za-z0-9+/]+={0,2}$/;
+const CANDIDATE_INVALID_CODE = "RESEARCH_SETUP_CANDIDATE_INVALID";
+const QUERY_FAILED_REASON = "RESEARCH_SETUP_RELEASE_QUERY_FAILED";
+const METADATA_INVALID_REASON = "RESEARCH_SETUP_RELEASE_METADATA_INVALID";
+const INSTALLED_INCOMPARABLE_REASON = "RESEARCH_SETUP_RELEASE_INSTALLED_INCOMPARABLE";
+// Only variables the pinned npm view query actually needs are forwarded;
+// ambient npm_config_* and unrelated ambient variables never reach the child.
+const CHILD_ENVIRONMENT_ALLOWLIST = [
+    "PATH",
+    "HOME",
+    "TMPDIR",
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "NO_PROXY",
+    "http_proxy",
+    "https_proxy",
+    "no_proxy",
+    "SSL_CERT_FILE",
+    "SSL_CERT_DIR",
+    "NODE_EXTRA_CA_CERTS",
+    "npm_config_cafile",
+];
+function buildChildEnvironment(environment) {
+    const source = environment ?? process.env;
+    const child = {};
+    for (const key of CHILD_ENVIRONMENT_ALLOWLIST) {
+        const value = source[key];
+        if (typeof value === "string" && value.length > 0) {
+            child[key] = value;
+        }
+    }
+    return child;
+}
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseStableSemver(value) {
+    const match = EXACT_STABLE_SEMVER_PATTERN.exec(value);
+    if (!match)
+        return null;
+    const parsed = [0, 0, 0];
+    for (let index = 1; index <= 3; index += 1) {
+        const part = match[index];
+        // Longer parts would round during Number conversion and silently corrupt
+        // the newer/same/older comparison.
+        if (part.length > 10)
+            return null;
+        const numeric = Number(part);
+        if (!Number.isSafeInteger(numeric))
+            return null;
+        parsed[index - 1] = numeric;
+    }
+    return parsed;
+}
+function compareStableSemver(candidate, installed) {
+    for (let index = 0; index < candidate.length; index += 1) {
+        if (candidate[index] > installed[index])
+            return "newer";
+        if (candidate[index] < installed[index])
+            return "older";
+    }
+    return "same";
+}
+function isVerifiedSha512Integrity(integrity) {
+    if (!SHA512_INTEGRITY_PATTERN.test(integrity))
+        return false;
+    return Buffer.from(integrity.slice("sha512-".length), "base64").length === 64;
+}
+function isPinnedRegistryTarball(tarball, version) {
+    if (typeof tarball !== "string")
+        return false;
+    let url;
+    try {
+        url = new URL(tarball);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== "https:")
+        return false;
+    if (url.username !== "" || url.password !== "")
+        return false;
+    if (url.host !== "registry.npmjs.org")
+        return false;
+    // Query/fragment components could smuggle signed URLs or tokens past the
+    // identity check, so only the bare pinned path is accepted.
+    if (url.search !== "" || url.hash !== "")
+        return false;
+    let pathname;
+    try {
+        pathname = decodeURIComponent(url.pathname);
+    }
+    catch {
+        return false;
+    }
+    return pathname === `/${RESEARCH_CLI_PACKAGE_NAME}/-/cli-${version}.tgz`;
+}
+function verifiedReleaseMetadata(stdout, requestedVersion) {
+    let value;
+    try {
+        value = JSON.parse(stdout);
+    }
+    catch {
+        return null;
+    }
+    if (!isObject(value))
+        return null;
+    // `npm view ... --json` emits the dist fields as flat dot-path keys; the
+    // nested-dist spelling never appears on the real interface.
+    const gitHead = value.gitHead;
+    const integrity = value["dist.integrity"];
+    const name = value.name;
+    const tarball = value["dist.tarball"];
+    const version = value.version;
+    if (name !== RESEARCH_CLI_PACKAGE_NAME)
+        return null;
+    if (typeof version !== "string" || version !== requestedVersion)
+        return null;
+    if (typeof gitHead !== "string" || !GIT_HEAD_PATTERN.test(gitHead))
+        return null;
+    if (typeof integrity !== "string" || !isVerifiedSha512Integrity(integrity))
+        return null;
+    if (!isPinnedRegistryTarball(tarball, requestedVersion))
+        return null;
+    return { version, integrity, tarball, gitHead };
+}
+const defaultSetupReleaseRunner = (input) => new Promise((resolvePromise) => {
+    // Windows npm is npm.cmd, which shell:false spawn cannot execute; the
+    // fixed cmd.exe branch forwards only constant argv plus the
+    // regex-validated exact version and accepts no additional parameters.
+    const windowsShell = process.platform === "win32";
+    const file = windowsShell ? "cmd.exe" : input.command;
+    const args = windowsShell ? ["/d", "/s", "/c", input.command, ...input.args] : input.args;
+    const stdoutChunks = [];
+    const stderrChunks = [];
+    let capturedBytes = 0;
+    let truncated = false;
+    let settled = false;
+    let terminating = false;
+    let timedOut = false;
+    let streamAbandoned = false;
+    const activeTimers = new Set();
+    // On POSIX the child leads its own process group, so a descendant that
+    // inherited the stdio pipes can be reached without ever signalling a pid
+    // we do not own.
+    const child = spawn(file, args, {
+        cwd: input.cwd,
+        env: input.environment,
+        detached: !windowsShell,
+        shell: false,
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    const later = (callback, delayMs) => {
+        const timer = setTimeout(() => {
+            activeTimers.delete(timer);
+            callback();
+        }, delayMs);
+        activeTimers.add(timer);
+        timer.unref();
+    };
+    // Both streams share one byte budget; chunks are concatenated once at
+    // settle instead of per-chunk, avoiding quadratic copies.
+    const capture = (chunks, chunk) => {
+        if (truncated)
+            return;
+        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        const remaining = MAX_RELEASE_QUERY_OUTPUT_BYTES - capturedBytes;
+        if (remaining <= 0) {
+            truncated = true;
+            return;
+        }
+        const take = bytes.length > remaining ? bytes.subarray(0, remaining) : bytes;
+        if (take.length > 0) {
+            chunks.push(take);
+            capturedBytes += take.length;
+        }
+        if (take.length < bytes.length)
+            truncated = true;
+    };
+    const killOwnedGroup = (signal) => {
+        if (windowsShell || typeof child.pid !== "number")
+            return;
+        try {
+            process.kill(-child.pid, signal);
+        }
+        catch {
+            // The process group is already gone.
+        }
+    };
+    // Windows has no process groups; the fixed taskkill targets only our own
+    // child pid's tree. One taskkill per query at most; the reference is kept
+    // so finish can guarantee the helper never outlives the bounded query.
+    let treeKill;
+    const killOwnedTreeOnWindows = () => {
+        if (!windowsShell || typeof child.pid !== "number" || treeKill)
+            return;
+        treeKill = spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
+            cwd: input.cwd,
+            env: input.environment,
+            shell: false,
+            stdio: "ignore",
+            windowsHide: true,
+        });
+        const fallbackKillChild = () => {
+            if (settled)
+                return;
+            try {
+                child.kill("SIGKILL");
+            }
+            catch {
+                // The child already exited.
+            }
+        };
+        treeKill.on("error", fallbackKillChild);
+        treeKill.on("close", fallbackKillChild);
+    };
+    // One finite force/settle watchdog: whatever happens to the child events,
+    // the query settles at most one grace period after termination began.
+    const forceSettle = () => {
+        if (settled)
+            return;
+        killOwnedGroup("SIGKILL");
+        try {
+            child.kill("SIGKILL");
+        }
+        catch {
+            // The child already exited.
+        }
+        streamAbandoned = true;
+        finish(124);
+    };
+    const terminateChild = () => {
+        if (terminating || settled)
+            return;
+        terminating = true;
+        if (windowsShell) {
+            // Start the tree kill while the root pid still exists: on real
+            // Windows a preceding root kill terminates cmd.exe immediately and
+            // taskkill /T would lose the still-running npm descendants. The root
+            // kill only happens as the bounded fallback in the watchdog and the
+            // taskkill completion/error handlers.
+            killOwnedTreeOnWindows();
+        }
+        else {
+            try {
+                child.kill("SIGTERM");
+            }
+            catch {
+                // The child already exited.
+            }
+            killOwnedGroup("SIGTERM");
+            later(() => {
+                killOwnedGroup("SIGKILL");
+                if (!settled) {
+                    try {
+                        child.kill("SIGKILL");
+                    }
+                    catch {
+                        // The child already exited.
+                    }
+                }
+            }, RELEASE_KILL_GRACE_MS);
+        }
+        later(forceSettle, RELEASE_KILL_GRACE_MS + EXIT_STREAM_GRACE_MS);
+    };
+    child.stdout?.on("data", (chunk) => {
+        capture(stdoutChunks, chunk);
+        if (truncated)
+            terminateChild();
+    });
+    child.stderr?.on("data", (chunk) => {
+        capture(stderrChunks, chunk);
+        if (truncated)
+            terminateChild();
+    });
+    later(() => {
+        timedOut = true;
+        terminateChild();
+    }, input.timeoutMs);
+    const finish = (exitCode) => {
+        if (settled)
+            return;
+        settled = true;
+        for (const timer of activeTimers)
+            clearTimeout(timer);
+        activeTimers.clear();
+        if (windowsShell) {
+            // Only a terminating/abandoned query can still own live tree members;
+            // a clean close means every pipe-holding process is already gone.
+            if (terminating || streamAbandoned) {
+                try {
+                    child.kill("SIGKILL");
+                }
+                catch {
+                    // The child already exited.
+                }
+            }
+            // The helper was spawned by this query and must never outlive it.
+            if (treeKill &&
+                typeof treeKill.pid === "number" &&
+                treeKill.pid > 0 &&
+                treeKill.exitCode === null &&
+                !treeKill.killed) {
+                try {
+                    treeKill.kill("SIGKILL");
+                }
+                catch {
+                    // The helper already exited.
+                }
+            }
+        }
+        else {
+            // Harmless ESRCH on a clean close; on an abandoned stream this is
+            // what reaps a descendant that inherited the pipes.
+            killOwnedGroup("SIGKILL");
+        }
+        child.stdout?.destroy();
+        child.stderr?.destroy();
+        resolvePromise({
+            exitCode: timedOut || truncated || streamAbandoned ? 124 : exitCode,
+            stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+            stderr: Buffer.concat(stderrChunks).toString("utf8"),
+        });
+    };
+    child.on("error", (error) => {
+        capture(stderrChunks, error.message);
+        finish(127);
+    });
+    child.on("close", (code) => finish(code ?? 1));
+    // Node emits "close" only once every stdio stream has ended. A descendant
+    // that inherited the pipes can hold them open long after the root exited,
+    // so the root's exit starts one bounded grace; if close has not arrived by
+    // then the buffered output is abandoned as untrusted and the query settles.
+    child.on("exit", () => {
+        later(() => {
+            if (settled)
+                return;
+            streamAbandoned = true;
+            finish(124);
+        }, EXIT_STREAM_GRACE_MS);
+    });
+});
+export async function inspectExactResearchCliRelease(candidateVersion, options) {
+    const candidate = parseStableSemver(candidateVersion);
+    if (!candidate) {
+        throw new CliError("The requested exact CLI candidate version is not a supported bounded stable semver release identifier.", { code: CANDIDATE_INVALID_CODE, exitCode: 2 });
+    }
+    const base = {
+        packageName: RESEARCH_CLI_PACKAGE_NAME,
+        requestedVersion: candidateVersion,
+        installedVersion: options.installedVersion,
+        registry: REGISTRY_URL,
+    };
+    const installed = parseStableSemver(options.installedVersion);
+    if (!installed) {
+        return {
+            ...base,
+            status: "unavailable",
+            metadata: null,
+            reason: INSTALLED_INCOMPARABLE_REASON,
+        };
+    }
+    const runner = options.runner ?? defaultSetupReleaseRunner;
+    let queryResult;
+    try {
+        queryResult = await runner({
+            command: "npm",
+            args: [
+                "view",
+                `${RESEARCH_CLI_PACKAGE_NAME}@${candidateVersion}`,
+                "name",
+                "version",
+                "dist.integrity",
+                "dist.tarball",
+                "gitHead",
+                "--json",
+                "--registry",
+                REGISTRY_URL,
+                SCOPED_REGISTRY_PIN,
+                STRICT_SSL_PIN,
+            ],
+            cwd: tmpdir(),
+            environment: buildChildEnvironment(options.environment),
+            timeoutMs: RELEASE_QUERY_TIMEOUT_MS,
+        });
+    }
+    catch {
+        return { ...base, status: "unavailable", metadata: null, reason: QUERY_FAILED_REASON };
+    }
+    if (queryResult.exitCode !== 0) {
+        return { ...base, status: "unavailable", metadata: null, reason: QUERY_FAILED_REASON };
+    }
+    // Runner-provided output is subject to the same combined budget as process
+    // output; oversized results are untrusted and never parsed or echoed.
+    if (Buffer.byteLength(queryResult.stdout, "utf8") + Buffer.byteLength(queryResult.stderr, "utf8") >
+        MAX_RELEASE_QUERY_OUTPUT_BYTES) {
+        return { ...base, status: "unavailable", metadata: null, reason: QUERY_FAILED_REASON };
+    }
+    const metadata = verifiedReleaseMetadata(queryResult.stdout, candidateVersion);
+    if (!metadata) {
+        return { ...base, status: "unavailable", metadata: null, reason: METADATA_INVALID_REASON };
+    }
+    return {
+        ...base,
+        status: compareStableSemver(candidate, installed),
+        metadata,
+        reason: null,
+    };
+}
+//# sourceMappingURL=setup-release.js.map

package/dist/research/workspace/setup-release.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-release.js","sourceRoot":"","sources":["../../../src/research/workspace/setup-release.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAsB3C,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAClD,0EAA0E;AAC1E,4EAA4E;AAC5E,gCAAgC;AAChC,MAAM,mBAAmB,GAAG,oDAAoD,CAAC;AACjF,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAC3C,MAAM,yBAAyB,GAAG,kBAAkB,CAAC;AACrD,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AACpC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,8BAA8B,GAAG,IAAI,GAAG,IAAI,CAAC;AACnD,MAAM,2BAA2B,GAAG,4CAA4C,CAAC;AACjF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAC1C,MAAM,wBAAwB,GAAG,+BAA+B,CAAC;AAEjE,MAAM,sBAAsB,GAAG,kCAAkC,CAAC;AAClE,MAAM,mBAAmB,GAAG,qCAAqC,CAAC;AAClE,MAAM,uBAAuB,GAAG,yCAAyC,CAAC;AAC1E,MAAM,6BAA6B,GAAG,+CAA+C,CAAC;AAEtF,yEAAyE;AACzE,8EAA8E;AAC9E,MAAM,2BAA2B,GAAG;IAClC,MAAM;IACN,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,aAAa;IACb,UAAU;IACV,YAAY;IACZ,aAAa;IACb,UAAU;IACV,eAAe;IACf,cAAc;IACd,qBAAqB;IACrB,mBAAmB;CACX,CAAC;AAEX,SAAS,qBAAqB,CAAC,WAA0C;IACvE,MAAM,MAAM,GAAG,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAC1C,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,2BAA2B,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,KAAK,GAAG,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAA6B,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;QAC3B,yEAAyE;QACzE,mCAAmC;QACnC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC;IAC9B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAC1B,SAAmC,EACnC,SAAmC;IAEnC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACzD,IAAI,SAAS,CAAC,KAAK,CAAE,GAAG,SAAS,CAAC,KAAK,CAAE;YAAE,OAAO,OAAO,CAAC;QAC1D,IAAI,SAAS,CAAC,KAAK,CAAE,GAAG,SAAS,CAAC,KAAK,CAAE;YAAE,OAAO,OAAO,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,yBAAyB,CAAC,SAAiB;IAClD,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAgB,EAAE,OAAe;IAChE,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,GAAG,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO,KAAK,CAAC;IACpD,yEAAyE;IACzE,4DAA4D;IAC5D,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,KAAK,IAAI,yBAAyB,UAAU,OAAO,MAAM,CAAC;AAC3E,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAc,EACd,gBAAwB;IAExB,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,yEAAyE;IACzE,4DAA4D;IAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,IAAI,KAAK,yBAAyB;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,yBAAyB,GAAuB,CAAC,KAAK,EAAE,EAAE,CAC9D,IAAI,OAAO,CAAqB,CAAC,cAAc,EAAE,EAAE;IACjD,sEAAsE;IACtE,4DAA4D;IAC5D,sEAAsE;IACtE,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IAClD,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IACtD,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IAC1F,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,uEAAuE;IACvE,yEAAyE;IACzE,iBAAiB;IACjB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE;QAC9B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,WAAW;QACtB,QAAQ,EAAE,CAAC,YAAY;QACvB,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,CAAC,QAAoB,EAAE,OAAe,EAAQ,EAAE;QAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,QAAQ,EAAE,CAAC;QACb,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,sEAAsE;IACtE,0DAA0D;IAC1D,MAAM,OAAO,GAAG,CAAC,MAAgB,EAAE,KAAsB,EAAQ,EAAE;QACjE,IAAI,SAAS;YAAE,OAAO;QACtB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,8BAA8B,GAAG,aAAa,CAAC;QACjE,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,SAAS,GAAG,IAAI,CAAC;YACjB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC7E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC;QAC/B,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;YAAE,SAAS,GAAG,IAAI,CAAC;IACnD,CAAC,CAAC;IACF,MAAM,cAAc,GAAG,CAAC,MAAsB,EAAQ,EAAE;QACtD,IAAI,YAAY,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO;QAC1D,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC,CAAC;IACF,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,QAAkC,CAAC;IACvC,MAAM,sBAAsB,GAAG,GAAS,EAAE;QACxC,IAAI,CAAC,YAAY,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,QAAQ;YAAE,OAAO;QACvE,QAAQ,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;YACpE,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,WAAW;YACtB,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,MAAM,iBAAiB,GAAG,GAAS,EAAE;YACnC,IAAI,OAAO;gBAAE,OAAO;YACpB,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC,CAAC;QACF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACxC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,WAAW,GAAG,GAAS,EAAE;QAC7B,IAAI,OAAO;YAAE,OAAO;QACpB,cAAc,CAAC,SAAS,CAAC,CAAC;QAC1B,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;QACD,eAAe,GAAG,IAAI,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,CAAC,CAAC;IACF,MAAM,cAAc,GAAG,GAAS,EAAE;QAChC,IAAI,WAAW,IAAI,OAAO;YAAE,OAAO;QACnC,WAAW,GAAG,IAAI,CAAC;QACnB,IAAI,YAAY,EAAE,CAAC;YACjB,+DAA+D;YAC/D,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,sCAAsC;YACtC,sBAAsB,EAAE,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;YACD,cAAc,CAAC,SAAS,CAAC,CAAC;YAC1B,KAAK,CAAC,GAAG,EAAE;gBACT,cAAc,CAAC,SAAS,CAAC,CAAC;gBAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,IAAI,CAAC;wBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACxB,CAAC;oBAAC,MAAM,CAAC;wBACP,4BAA4B;oBAC9B,CAAC;gBACH,CAAC;YACH,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,WAAW,EAAE,qBAAqB,GAAG,oBAAoB,CAAC,CAAC;IACnE,CAAC,CAAC;IACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACzC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,SAAS;YAAE,cAAc,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACzC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,SAAS;YAAE,cAAc,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,GAAG,EAAE;QACT,QAAQ,GAAG,IAAI,CAAC;QAChB,cAAc,EAAE,CAAC;IACnB,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACpB,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAQ,EAAE;QACxC,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,MAAM,KAAK,IAAI,YAAY;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACtD,YAAY,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,YAAY,EAAE,CAAC;YACjB,sEAAsE;YACtE,kEAAkE;YAClE,IAAI,WAAW,IAAI,eAAe,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,4BAA4B;gBAC9B,CAAC;YACH,CAAC;YACD,kEAAkE;YAClE,IACE,QAAQ;gBACR,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ;gBAChC,QAAQ,CAAC,GAAG,GAAG,CAAC;gBAChB,QAAQ,CAAC,QAAQ,KAAK,IAAI;gBAC1B,CAAC,QAAQ,CAAC,MAAM,EAChB,CAAC;gBACD,IAAI,CAAC;oBACH,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,6BAA6B;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,kEAAkE;YAClE,oDAAoD;YACpD,cAAc,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACxB,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACxB,cAAc,CAAC;YACb,QAAQ,EAAE,QAAQ,IAAI,SAAS,IAAI,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ;YACnE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACpD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;SACrD,CAAC,CAAC;IACL,CAAC,CAAC;IACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QAC1B,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/C,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACpB,KAAK,CAAC,GAAG,EAAE;YACT,IAAI,OAAO;gBAAE,OAAO;YACpB,eAAe,GAAG,IAAI,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,gBAAwB,EACxB,OAIC;IAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IACtD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAChB,wGAAwG,EACxG,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,CAAC,EAAE,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG;QACX,WAAW,EAAE,yBAAyB;QACtC,gBAAgB,EAAE,gBAAgB;QAClC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,QAAQ,EAAE,YAAY;KACvB,CAAC;IACF,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,6BAA6B;SACtC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,yBAAyB,CAAC;IAC3D,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,MAAM,CAAC;YACzB,OAAO,EAAE,KAAK;YACd,IAAI,EAAE;gBACJ,MAAM;gBACN,GAAG,yBAAyB,IAAI,gBAAgB,EAAE;gBAClD,MAAM;gBACN,SAAS;gBACT,gBAAgB;gBAChB,cAAc;gBACd,SAAS;gBACT,QAAQ;gBACR,YAAY;gBACZ,YAAY;gBACZ,mBAAmB;gBACnB,cAAc;aACf;YACD,GAAG,EAAE,MAAM,EAAE;YACb,WAAW,EAAE,qBAAqB,CAAC,OAAO,CAAC,WAAW,CAAC;YACvD,SAAS,EAAE,wBAAwB;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzF,CAAC;IACD,2EAA2E;IAC3E,sEAAsE;IACtE,IACE,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC;QAC7F,8BAA8B,EAC9B,CAAC;QACD,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC/E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAC7F,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,MAAM,EAAE,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC;QACjD,QAAQ;QACR,MAAM,EAAE,IAAI;KACb,CAAC;AACJ,CAAC"}

package/dist/research/workspace/setup-runtime-integrity.d.ts

@@ -0,0 +1,2 @@
+export declare function researchSetupRuntimeSha256(): Promise<string>;
+export declare function assertResearchSetupRuntimeIntegrity(expected: string): Promise<void>;

package/dist/research/workspace/setup-runtime-integrity.js

@@ -0,0 +1,31 @@
+import { join } from "node:path";
+import { CliError } from "../../errors.js";
+import { packageRoot } from "./constants.js";
+import { canonicalJson, hashRegularTree, sha256File, sha256Text } from "./storage.js";
+// Upgrade-only binding of the CLI's declared package identity and executable
+// distribution. Excludes node_modules, source checkout, caches, and owner data.
+// This is content integrity, not a publisher signature or dependency attestation.
+export async function researchSetupRuntimeSha256() {
+    const root = packageRoot();
+    const [manifest, bin, dist] = await Promise.all([
+        sha256File(join(root, "package.json")),
+        hashRegularTree(join(root, "bin")),
+        hashRegularTree(join(root, "dist")),
+    ]);
+    return sha256Text(canonicalJson({ algorithm: "cli-package-bin-dist-sha256-v1", manifest, bin, dist }));
+}
+export async function assertResearchSetupRuntimeIntegrity(expected) {
+    const observed = await researchSetupRuntimeSha256();
+    if (observed !== expected) {
+        throw new CliError("The running CLI bytes differ from the reviewed upgrade candidate.", {
+            code: "RESEARCH_SETUP_CLI_INTEGRITY_MISMATCH",
+            exitCode: 3,
+            details: {
+                expectedSha256: expected,
+                observedSha256: observed,
+                minimumAction: "Use the exact reviewed CLI distribution, or generate and review a fresh candidate with the selected distribution. Do not rewrite the existing candidate.",
+            },
+        });
+    }
+}
+//# sourceMappingURL=setup-runtime-integrity.js.map

package/dist/research/workspace/setup-runtime-integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-runtime-integrity.js","sourceRoot":"","sources":["../../../src/research/workspace/setup-runtime-integrity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEtF,6EAA6E;AAC7E,gFAAgF;AAChF,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,0BAA0B;IAC9C,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9C,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACtC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;KACpC,CAAC,CAAC;IACH,OAAO,UAAU,CACf,aAAa,CAAC,EAAE,SAAS,EAAE,gCAAgC,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CACpF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,QAAgB;IACxE,MAAM,QAAQ,GAAG,MAAM,0BAA0B,EAAE,CAAC;IACpD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,mEAAmE,EAAE;YACtF,IAAI,EAAE,uCAAuC;YAC7C,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,QAAQ;gBACxB,cAAc,EAAE,QAAQ;gBACxB,aAAa,EACX,0JAA0J;aAC7J;SACF,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/research/workspace/setup-upgrade.d.ts

@@ -0,0 +1,17 @@
+import { type ApplyResearchSetupOptions, type ApplyResearchSetupResult, type ResearchSetupPlan } from "./setup.js";
+export declare function applyManagedSetupUpgrade(plan: ResearchSetupPlan, options: ApplyResearchSetupOptions): Promise<ApplyResearchSetupResult>;
+export declare function rollbackResearchSetupUpgrade(candidatePath: string, workspace: string, options?: {
+    checkpoint?: (point: string) => Promise<void>;
+}): Promise<{
+    schemaVersion: number;
+    status: string;
+    replayed: boolean;
+    planSha256: string;
+    parentPlanSha256: string;
+} | {
+    replayed?: never;
+    schemaVersion: number;
+    status: string;
+    planSha256: string;
+    parentPlanSha256: string;
+}>;