@timurproko/a1 0.2.7-dev.1252 → 0.2.7-dev.1264

package/dist/foundation/release/update.js

@@ -5,17 +5,16 @@ import crossSpawn from "cross-spawn";
 import { valid as validSemver } from "semver";
 import { PRODUCT_IDENTITY, PRODUCT_TEXT } from "../../product-identity.js";
 import { earlyAccentPalette, earlyTerminalAppearance, earlyTerminalColorMode, resolveEarlyAccentColor } from "./early-accent.js";
-import { SHARED_PROGRESS_ACCENT_ANSI } from "./progress-palette.generated.js";
+import { SHARED_PROGRESS_ACCENT_ANSI } from "../../contracts/presentation/index.js";
 import { createRegistryFetcher, invalidateReleaseCheckCache, isNewerRelease, queryPublishedVersions, releaseChannelOf, } from "./latest-release.js";
-import { certifyMaterializedRelease } from "./bootstrap.js";
 import { resolveProductPaths } from "../lifecycle/index.js";
-import { CohortStateStore } from "./cohort-state.js";
-import { materializeRelease, readMaterializedRelease } from "./release-store.js";
-import { scheduleReleaseCleanup } from "./release-gc.js";
+import { ReleaseStateStore } from "./release-state.js";
 import { UPDATE_ACTIVATION_CONTRACT, activateInstalledRelease, delegateActivation, readActivationContracts, } from "./update-activation.js";
 import { UpdateTransactionStore } from "./update-transaction.js";
 import { acquireUpdateExecutionLease, reclaimDeadLease } from "./update-execution-lease.js";
-import { npmPrefixForGlobalRoot, removeUpdateRecoveryCapsule, resolveNpmCli, runProtectedPackageReplacement, updateLauncherPaths, updateNpmInstallArguments, } from "./update-recovery.js";
+import { npmPrefixForGlobalRoot, removeUpdateRecoveryCapsule, updateLauncherPaths, } from "./update-recovery.js";
+import { errorMessage, samePath } from "./managed-path.js";
+import { createProtectedUpdateInstaller, } from "./update-installer.js";
 export const PRODUCT_PACKAGE = PRODUCT_TEXT.packageName;
 const UPDATE_DIST_TAGS = { stable: "latest", next: "next" };
 const defaultFileSystem = {
@@ -57,7 +56,7 @@ const defaultOutput = {
     stderr(message) { process.stderr.write(message); },
 };
 /** Bound on the child diagnostics an update keeps: enough for npm's failure reason, never a log. */
-export const CHILD_DIAGNOSTIC_LIMIT = 8_000;
+const CHILD_DIAGNOSTIC_LIMIT = 8_000;
 export function createNpmProcessRunner(platform = process.platform) {
     return async (command, arguments_, request) => await new Promise((resolvePromise, rejectPromise) => {
         // Invariant: no child of the updater shares the terminal. The progress bar is the only
@@ -84,7 +83,7 @@ export function createNpmProcessRunner(platform = process.platform) {
 }
 export function createUpdateLifecycleCoordinator(environment = process.env, fileSystem = defaultFileSystem, _output = defaultOutput, patience = {}) {
     const paths = resolveProductPaths(environment);
-    const stateStore = new CohortStateStore(paths.dataDir);
+    const stateStore = new ReleaseStateStore(paths.dataDir);
     return {
         async targetIsActive(targetVersion) {
             const state = await stateStore.read(), activeId = state.references.active;
@@ -410,14 +409,14 @@ function resolveExactAutomaticTarget(target, channel, output) {
 function reportUnmanagedInstallation(output, packageRoot, activeGlobalRoot) {
     output.stderr(`${PRODUCT_TEXT.diagnostic(`refused to update automatically because ${packageRoot} could not be verified as an npm-managed ${PRODUCT_PACKAGE} installation; npm's active global package root is ${activeGlobalRoot}. Run npm install --global ${PRODUCT_PACKAGE} to install it manually.`)}\n`);
 }
-async function withUpdateExecutionLease(input, options, output, operation) {
+async function withUpdateExecutionLease(input, options, output, installer, operation) {
     let lease = await acquireUpdateExecutionLease(input);
     if (lease.status === "interrupted") {
         // Rationale: the owner that targeted another version is gone. Its durable transaction is rolled
         // back to the release that ran before it, so this request proceeds as an ordinary update of its
         // own target instead of reporting a dead attempt as in progress.
         const interrupted = lease.owner.targetVersion;
-        const rollback = await rollbackPriorRelease(input.dataDir, lease.transaction.priorActiveReleaseId)
+        const rollback = await installer.rollback(lease.transaction.priorActiveReleaseId)
             .catch(error => `rollback failed: ${errorMessage(error)}`);
         const store = new UpdateTransactionStore(input.dataDir);
         await store.finish("rolled-back", `interrupted ${interrupted} update settled by ${input.targetVersion}; ${rollback}`);
@@ -457,6 +456,19 @@ async function readRunningPackageVersion(packageRoot, fileSystem, output) {
     }
 }
 export async function runSelfUpdate(options) {
+    const plan = await planSelfUpdate(options);
+    if (typeof plan === "number")
+        return plan;
+    return await withUpdateExecutionLease({
+        dataDir: plan.paths.dataDir,
+        packageRoot: plan.installation.packageRoot,
+        channel: plan.channel,
+        targetVersion: plan.targetVersion,
+        mode: plan.mode,
+    }, options, plan.output, plan.installer, async () => await runUpdateTransaction(plan));
+}
+/** Resolve the running version, the target and the managed installation, or the exit code that ends the update. */
+async function planSelfUpdate(options) {
     const fileSystem = options.fileSystem ?? defaultFileSystem;
     const output = options.output ?? defaultOutput;
     const runner = options.runner ?? createNpmProcessRunner();
@@ -499,164 +511,155 @@ export async function runSelfUpdate(options) {
     const managed = await measure("global-root", async () => await resolveManagedNpmInstallation(options.packageRoot, fileSystem, runner, output));
     if (managed.installation === null)
         return managed.exitCode;
-    const { packageRoot, globalRoot, npmCliRoot } = managed.installation;
     const paths = resolveProductPaths(environment);
-    const lifecycle = options.lifecycle ?? createUpdateLifecycleCoordinator(environment, fileSystem, output);
-    const transactionStore = options.transactionStore ?? new UpdateTransactionStore(paths.dataDir);
-    const mode = options.mode ?? "manual";
-    const maintenance = options.maintenance ?? (options.lifecycle
-        ? async () => { }
-        : async () => await scheduleReleaseCleanup(paths.dataDir, paths));
-    return await withUpdateExecutionLease({ dataDir: paths.dataDir, packageRoot, channel, targetVersion, mode }, options, output, async () => {
-        let transaction = await transactionStore.read();
+    return {
+        output,
+        channel,
+        targetVersion,
+        progress,
+        installation: managed.installation,
+        paths,
+        lifecycle: options.lifecycle ?? createUpdateLifecycleCoordinator(environment, fileSystem, output),
+        transactionStore: options.transactionStore ?? new UpdateTransactionStore(paths.dataDir),
+        installer: options.installer ?? createProtectedUpdateInstaller(paths, environment),
+        mode: options.mode ?? "manual",
+        measure,
+        now,
+        onPhaseTiming: options.onPhaseTiming,
+    };
+}
+async function runUpdateTransaction(plan) {
+    const { output, progress, installer, lifecycle, transactionStore, targetVersion } = plan;
+    const { packageRoot, npmCliRoot } = plan.installation;
+    const run = { transaction: await transactionStore.read() };
+    try {
+        if ((!run.transaction || run.transaction.status === "completed") && await lifecycle.targetIsActive(targetVersion)) {
+            await installer.maintenance();
+            await transactionStore.clearCompleted();
+            output.stdout(`${PRODUCT_TEXT.commandName} is up to date — no update needed.\n`);
+            return 0;
+        }
         let npmCli;
         try {
-            if ((!transaction || transaction.status === "completed") && await lifecycle.targetIsActive(targetVersion)) {
-                await maintenance();
-                await transactionStore.clearCompleted();
-                output.stdout(`${PRODUCT_TEXT.commandName} is up to date — no update needed.\n`);
-                return 0;
-            }
-            const preflightRequired = options.npmCliResolver !== undefined
-                || options.packageReplacement === undefined && options.runner === undefined;
-            if (preflightRequired) {
-                try {
-                    npmCli = await (options.npmCliResolver ?? resolveNpmCli)(npmCliRoot, environment);
-                }
-                catch (error) {
-                    throw new UpdatePreflightFailure(errorMessage(error));
-                }
-            }
-            // Rationale: the bar first appears only after every non-mutating replacement prerequisite passes.
-            progress.set(3, 15);
-            const cohortStore = new CohortStateStore(paths.dataDir);
-            let cohortState = await cohortStore.read();
-            let priorActiveReleaseId = cohortState.references.active;
-            if (options.runner === undefined && (priorActiveReleaseId === null || cohortState.releases[priorActiveReleaseId]?.approval !== "approved")) {
-                // Invariant: protected replacement needs an immutable launch authority that npm cannot rename.
-                const recoveryRelease = await materializeRelease(packageRoot, paths.dataDir);
-                await cohortStore.recordCandidate(recoveryRelease);
-                const diagnostics = await certifyMaterializedRelease(recoveryRelease, paths.dataDir);
-                await cohortStore.approve(recoveryRelease.releaseId, diagnostics);
-                await cohortStore.activate(recoveryRelease.releaseId);
-                cohortState = await cohortStore.read();
-                priorActiveReleaseId = recoveryRelease.releaseId;
-            }
-            transaction = await transactionStore.begin({
-                channel,
-                targetVersion,
-                packageRoot,
-                priorActiveReleaseId,
-            });
-            if (phaseBefore(transaction.phase, "ownership-released")) {
-                await measure("ownership-release", async () => { await lifecycle.verifyPackageUnlocked(packageRoot); });
-                transaction = await transactionStore.advance("ownership-released");
-            }
-            progress.set(15, 70);
-            if (phaseBefore(transaction.phase, "package-installed")) {
-                if (options.packageReplacement || options.runner === undefined) {
-                    const priorReleaseId = transaction.priorActiveReleaseId ?? priorActiveReleaseId;
-                    const recordedPrior = priorReleaseId === null ? undefined : cohortState.releases[priorReleaseId];
-                    if ((!recordedPrior || recordedPrior.approval !== "approved") && !options.packageReplacement) {
-                        throw new Error(PRODUCT_TEXT.diagnostic("cannot protect package replacement because no approved prior release is available"));
-                    }
-                    const priorRelease = recordedPrior ?? {
-                        releaseId: priorReleaseId ?? "injected-prior-release",
-                        releaseRoot: packageRoot,
-                        contentDigest: "0".repeat(64),
-                    };
-                    const replacementTransaction = transaction;
-                    const replacement = await measure("npm-install", async () => await (options.packageReplacement ?? runProtectedPackageReplacement)({
-                        dataDir: paths.dataDir,
-                        globalRoot,
-                        npmCliRoot,
-                        ...(npmCli === undefined ? {} : { npmCli }),
-                        packageRoot,
-                        transaction: replacementTransaction,
-                        priorRelease,
-                        output,
-                        environment,
-                        onRecoveryState: async (recovery) => {
-                            if (transactionStore.setRecovery)
-                                transaction = await transactionStore.setRecovery(recovery) ?? transaction;
-                        },
-                    }));
-                    // Rationale: npm's own text explains a failed replacement and says nothing about a
-                    // successful one, so it reaches the terminal only when the installation did not happen.
-                    if (replacement.outcome !== "installed")
-                        reportChildDiagnostics(output, replacement);
-                    if (replacement.outcome === "installed")
-                        transaction = await transactionStore.advance("package-installed");
-                    if (replacement.cancelled) {
-                        progress.clear();
-                        output.stderr(`${PRODUCT_TEXT.diagnostic("update cancelled safely; the launcher is available and the transaction can be resumed.")}\n`);
-                        return 130;
-                    }
-                    if (replacement.outcome !== "installed") {
-                        throw new UpdateFailure(unsuccessfulCode(replacement.npmExitCode), `npm exited with status ${formatExitCode(replacement.npmExitCode)}`);
-                    }
-                }
-                else {
-                    const installation = await measure("npm-install", async () => await runNpm(runner, updateNpmInstallArguments(globalRoot, targetVersion), true, output, "start the global npm installation", false));
-                    if (installation.result === null)
-                        throw new UpdateFailure(installation.exitCode, "npm process failed");
-                    if (installation.result.code !== 0) {
-                        reportChildDiagnostics(output, installation.result);
-                        throw new UpdateFailure(unsuccessfulCode(installation.result.code), `npm exited with status ${formatExitCode(installation.result.code)}`);
-                    }
-                    transaction = await transactionStore.advance("package-installed");
-                }
-            }
-            progress.set(70, MATERIALIZE_PROGRESS.from);
-            let activationPhaseStartedAt = now();
-            const recordActivationPhase = async (phase) => {
-                options.onPhaseTiming?.({ phase, durationMs: Math.max(0, now() - activationPhaseStartedAt) });
-                transaction = await transactionStore.advance(phase);
-                progress.set(ACTIVATION_PROGRESS[phase].at, ACTIVATION_PROGRESS[phase].creepTo);
-                activationPhaseStartedAt = now();
-            };
-            await lifecycle.activateInstalled(packageRoot, targetVersion, recordActivationPhase, ({ completed, total }) => progress.set(MATERIALIZE_PROGRESS.from
-                + (MATERIALIZE_PROGRESS.to - MATERIALIZE_PROGRESS.from) * (total > 0 ? Math.min(1, completed / total) : 0)), state => {
-                if (state === "started") {
-                    activationPhaseStartedAt = now();
-                    progress.set(98, 99);
-                }
-                else {
-                    options.onPhaseTiming?.({ phase: "warmup", durationMs: Math.max(0, now() - activationPhaseStartedAt) });
-                    activationPhaseStartedAt = now();
-                    progress.set(99);
-                }
-            });
-            const transactionStartedAt = now();
-            if (transaction.recovery?.capsulePath)
-                await removeUpdateRecoveryCapsule(paths.dataDir, transaction.transactionId);
-            // Invariant: successful output follows the durable cleanup disposition. Slow recursive
-            // removal belongs to the detached worker started by this maintenance coordinator.
-            await maintenance();
-            // Concurrency: this is the launch cutover. No failure-prone update work follows success.
-            await transactionStore.finish("completed");
-            await Promise.all([transactionStore.clearCompleted(), invalidateReleaseCheckCache(paths.configDir)]).catch(() => undefined);
-            options.onPhaseTiming?.({ phase: "transaction-complete", durationMs: Math.max(0, now() - transactionStartedAt) });
-            progress.finish();
-            output.stdout(`${PRODUCT_TEXT.commandName} updated successfully to ${targetVersion}\n`);
-            return 0;
+            npmCli = await installer.preflight(npmCliRoot);
         }
         catch (error) {
-            progress.clear();
-            const message = errorMessage(error);
-            if (error instanceof UpdatePreflightFailure) {
-                output.stderr(`${PRODUCT_TEXT.diagnostic(`update could not start safely: ${message}. Nothing was changed. Retry with npm x -y -- ${PRODUCT_PACKAGE}-install`)}\n`);
-                return 1;
-            }
-            const rollback = options.lifecycle
-                ? "previous test lifecycle retained"
-                : await rollbackPriorRelease(paths.dataDir, transaction?.priorActiveReleaseId ?? null).catch(rollbackError => `rollback failed: ${errorMessage(rollbackError)}`);
-            if (transaction)
-                await transactionStore.finish(rollback === "rolled back" ? "rolled-back" : "failed", `${message}; ${rollback}`);
-            output.stderr(updateFailureLine(message, rollback, transactionStore.path));
-            return error instanceof UpdateFailure ? error.exitCode : 1;
+            throw new UpdatePreflightFailure(errorMessage(error));
+        }
+        // Rationale: the bar first appears only after every non-mutating replacement prerequisite passes.
+        progress.set(3, 15);
+        const protection = await installer.protectPriorRelease(packageRoot);
+        run.transaction = await transactionStore.begin({
+            channel: plan.channel,
+            targetVersion,
+            packageRoot,
+            priorActiveReleaseId: protection.priorActiveReleaseId,
+        });
+        if (phaseBefore(run.transaction.phase, "ownership-released")) {
+            await plan.measure("ownership-release", async () => { await lifecycle.verifyPackageUnlocked(packageRoot); });
+            run.transaction = await transactionStore.advance("ownership-released");
+        }
+        progress.set(15, 70);
+        if (phaseBefore(run.transaction.phase, "package-installed")) {
+            const cancelled = await replaceUpdatePackage(plan, run, protection, npmCli);
+            if (cancelled !== null)
+                return cancelled;
+        }
+        return await activateUpdate(plan, run);
+    }
+    catch (error) {
+        return await settleUpdateFailure(plan, run.transaction, error);
+    }
+}
+/** Replace the package under protection; returns an exit code when the user cancelled, null once installed. */
+async function replaceUpdatePackage(plan, run, protection, npmCli) {
+    const { output, progress, transactionStore } = plan;
+    const transaction = run.transaction;
+    const priorRelease = protection.approvedRelease(transaction.priorActiveReleaseId ?? protection.priorActiveReleaseId);
+    if (priorRelease === undefined) {
+        throw new Error(PRODUCT_TEXT.diagnostic("cannot protect package replacement because no approved prior release is available"));
+    }
+    const replacement = await plan.measure("npm-install", async () => await plan.installer.replacePackage({
+        globalRoot: plan.installation.globalRoot,
+        npmCliRoot: plan.installation.npmCliRoot,
+        ...(npmCli === undefined ? {} : { npmCli }),
+        packageRoot: plan.installation.packageRoot,
+        transaction,
+        priorRelease,
+        output,
+        onRecoveryState: async (recovery) => {
+            if (transactionStore.setRecovery)
+                run.transaction = await transactionStore.setRecovery(recovery) ?? run.transaction;
+        },
+    }));
+    // Rationale: npm's own text explains a failed replacement and says nothing about a
+    // successful one, so it reaches the terminal only when the installation did not happen.
+    if (replacement.outcome !== "installed")
+        reportChildDiagnostics(output, replacement);
+    if (replacement.outcome === "installed")
+        run.transaction = await transactionStore.advance("package-installed");
+    if (replacement.cancelled) {
+        progress.clear();
+        output.stderr(`${PRODUCT_TEXT.diagnostic("update cancelled safely; the launcher is available and the transaction can be resumed.")}\n`);
+        return 130;
+    }
+    if (replacement.outcome !== "installed") {
+        throw new UpdateFailure(unsuccessfulCode(replacement.npmExitCode), `npm exited with status ${formatExitCode(replacement.npmExitCode)}`);
+    }
+    return null;
+}
+/** Activate the installed package, commit maintenance, and only then report success. */
+async function activateUpdate(plan, run) {
+    const { output, progress, transactionStore, now, onPhaseTiming, paths } = plan;
+    progress.set(70, MATERIALIZE_PROGRESS.from);
+    let activationPhaseStartedAt = now();
+    const recordActivationPhase = async (phase) => {
+        onPhaseTiming?.({ phase, durationMs: Math.max(0, now() - activationPhaseStartedAt) });
+        run.transaction = await transactionStore.advance(phase);
+        progress.set(ACTIVATION_PROGRESS[phase].at, ACTIVATION_PROGRESS[phase].creepTo);
+        activationPhaseStartedAt = now();
+    };
+    await plan.lifecycle.activateInstalled(plan.installation.packageRoot, plan.targetVersion, recordActivationPhase, ({ completed, total }) => progress.set(MATERIALIZE_PROGRESS.from
+        + (MATERIALIZE_PROGRESS.to - MATERIALIZE_PROGRESS.from) * (total > 0 ? Math.min(1, completed / total) : 0)), state => {
+        if (state === "started") {
+            activationPhaseStartedAt = now();
+            progress.set(98, 99);
+        }
+        else {
+            onPhaseTiming?.({ phase: "warmup", durationMs: Math.max(0, now() - activationPhaseStartedAt) });
+            activationPhaseStartedAt = now();
+            progress.set(99);
         }
     });
+    const transactionStartedAt = now();
+    const transaction = run.transaction;
+    if (transaction?.recovery?.capsulePath)
+        await removeUpdateRecoveryCapsule(paths.dataDir, transaction.transactionId);
+    // Invariant: successful output follows the durable cleanup disposition. Slow recursive
+    // removal belongs to the detached worker started by this maintenance coordinator.
+    await plan.installer.maintenance();
+    // Concurrency: this is the launch cutover. No failure-prone update work follows success.
+    await transactionStore.finish("completed");
+    await Promise.all([transactionStore.clearCompleted(), invalidateReleaseCheckCache(paths.configDir)]).catch(() => undefined);
+    onPhaseTiming?.({ phase: "transaction-complete", durationMs: Math.max(0, now() - transactionStartedAt) });
+    progress.finish();
+    output.stdout(`${PRODUCT_TEXT.commandName} updated successfully to ${plan.targetVersion}\n`);
+    return 0;
+}
+async function settleUpdateFailure(plan, transaction, error) {
+    const { output, transactionStore } = plan;
+    plan.progress.clear();
+    const message = errorMessage(error);
+    if (error instanceof UpdatePreflightFailure) {
+        output.stderr(`${PRODUCT_TEXT.diagnostic(`update could not start safely: ${message}. Nothing was changed. Retry with npm x -y -- ${PRODUCT_PACKAGE}-install`)}\n`);
+        return 1;
+    }
+    const rollback = await plan.installer.rollback(transaction?.priorActiveReleaseId ?? null)
+        .catch(rollbackError => `rollback failed: ${errorMessage(rollbackError)}`);
+    if (transaction)
+        await transactionStore.finish(rollback === "rolled back" ? "rolled-back" : "failed", `${message}; ${rollback}`);
+    output.stderr(updateFailureLine(message, rollback, transactionStore.path));
+    return error instanceof UpdateFailure ? error.exitCode : 1;
 }
 export function assertUpdatePerformanceBudget(evidence, maximumPostNpmDurationMs = 30_000) {
     const failures = [];
@@ -698,24 +701,6 @@ function reportChildDiagnostics(output, result) {
     output.stderr(`${text}\n`);
     return true;
 }
-async function rollbackPriorRelease(dataDir, priorReleaseId) {
-    if (!priorReleaseId)
-        return "no prior release was available for rollback";
-    const stateStore = new CohortStateStore(dataDir);
-    const state = await stateStore.read();
-    const prior = state.releases[priorReleaseId];
-    if (!prior || prior.approval !== "approved")
-        return "prior release is not a verified rollback candidate";
-    if (state.references.active !== priorReleaseId) {
-        if (state.references.rollback === priorReleaseId)
-            await stateStore.rollback();
-        else
-            throw new Error(`prior release ${priorReleaseId} is not the recorded rollback release`);
-    }
-    // Invariant: rollback selects only a prior release whose retained content still verifies.
-    await readMaterializedRelease(prior.releaseRoot);
-    return "rolled back";
-}
 /** One reason and one next step; routine rollback detail stays in the journal. */
 function updateFailureLine(message, rollback, journalPath) {
     const note = rollback.startsWith("rollback failed") ? ` (${rollback})` : "";
@@ -731,9 +716,5 @@ class UpdateFailure extends Error {
 }
 class UpdatePreflightFailure extends Error {
 }
-function samePath(left, right) {
-    return process.platform === "win32" ? resolve(left).toLowerCase() === resolve(right).toLowerCase() : resolve(left) === resolve(right);
-}
 function unsuccessfulCode(code) { return code === null || code === 0 ? 1 : code; }
 function formatExitCode(code) { return code === null ? "unknown" : String(code); }
-function errorMessage(error) { return error instanceof Error ? error.message : String(error); }

package/dist/foundation/startup/startup-budget.d.ts

@@ -1,7 +1,7 @@
 import type { StartupTraceEvent } from "./startup-runtime.js";
 export interface StartupPerformanceEvidence {
     readonly profileId: "a1" | "pi";
-    readonly launchKind: "post-update" | "no-live-supervisor" | "warm";
+    readonly launchKind: "post-update" | "restart" | "warm";
     readonly events: readonly StartupTraceEvent[];
     readonly moduleGraph?: {
         readonly loadedFiles: number;
@@ -15,7 +15,7 @@ export interface StartupPerformanceEvidence {
 }
 export interface StartupBudgetViolation {
     readonly profileId: "a1" | "pi";
-    readonly launchKind: "post-update" | "no-live-supervisor" | "warm";
+    readonly launchKind: "post-update" | "restart" | "warm";
     readonly elapsedMs: number;
     readonly budgetMs: number;
     readonly dominantPhases: readonly {
@@ -27,13 +27,13 @@ export interface StartupBudgetViolation {
 /** Resolve the declared budget for one launch kind so measurement and reporting never restate the numbers. */
 export declare function resolveStartupBudgetMs(launchKind: StartupPerformanceEvidence["launchKind"], budgets?: {
     readonly postUpdateMs: number;
-    readonly noSupervisorMs: number;
+    readonly restartMs: number;
     readonly warmMs: number;
 }): number;
 /** Compare measured startup evidence with its budget without deciding whether the channel enforces it. */
 export declare function evaluateStartupPerformanceBudget(evidence: StartupPerformanceEvidence, budgets?: {
     readonly postUpdateMs: number;
-    readonly noSupervisorMs: number;
+    readonly restartMs: number;
     readonly warmMs: number;
 }): StartupBudgetViolation | null;
 /** Render one budget violation as the single message used by failures, evidence, and run summaries. */
@@ -41,6 +41,6 @@ export declare function formatStartupBudgetViolation(violation: StartupBudgetVio
 /** Enforce the startup budget in a channel that fails on an overrun. */
 export declare function assertStartupPerformanceBudget(evidence: StartupPerformanceEvidence, budgets?: {
     readonly postUpdateMs: number;
-    readonly noSupervisorMs: number;
+    readonly restartMs: number;
     readonly warmMs: number;
 }): void;

package/dist/foundation/startup/startup-budget.js

@@ -1,7 +1,7 @@
-const STARTUP_PERFORMANCE_BUDGETS = { postUpdateMs: 2_000, noSupervisorMs: 2_500, warmMs: 2_000 };
+const STARTUP_PERFORMANCE_BUDGETS = { postUpdateMs: 2_000, restartMs: 2_500, warmMs: 2_000 };
 /** Resolve the declared budget for one launch kind so measurement and reporting never restate the numbers. */
 export function resolveStartupBudgetMs(launchKind, budgets = STARTUP_PERFORMANCE_BUDGETS) {
-    return launchKind === "warm" ? budgets.warmMs : launchKind === "no-live-supervisor" ? budgets.noSupervisorMs : budgets.postUpdateMs;
+    return launchKind === "warm" ? budgets.warmMs : launchKind === "restart" ? budgets.restartMs : budgets.postUpdateMs;
 }
 /** Compare measured startup evidence with its budget without deciding whether the channel enforces it. */
 export function evaluateStartupPerformanceBudget(evidence, budgets = STARTUP_PERFORMANCE_BUDGETS) {

package/dist/integrations/pi/components/bracketed-paste.d.ts

@@ -0,0 +1,33 @@
+export declare const PASTE_START = "\u001B[200~";
+/** A bracketed paste whose end marker arrived, with the input that followed it in the same chunk. */
+export interface CompletedPaste {
+    readonly text: string;
+    /** UTF-8 bytes counted against the cap; zero when the framer has no cap. */
+    readonly bytes: number;
+    /** The paste exceeded the cap, so its text was dropped. */
+    readonly oversized: boolean;
+    readonly remaining: string;
+}
+/**
+ * Bracketed-paste framing across terminal input chunks. `feed` collects a paste for insertion;
+ * `discard` drops pastes while forwarding the input around them, and also holds back a split
+ * start marker so a paste can never leak in as typed text when paste is disabled.
+ */
+export declare class BracketedPasteFramer {
+    #private;
+    /** With `maxBytes`, a paste beyond it is reported as oversized and its text is dropped. */
+    constructor(maxBytes?: number);
+    /** A paste has started and its end marker has not arrived. */
+    get open(): boolean;
+    clear(): void;
+    /**
+     * Feed input that continues the open paste, or that begins with the start marker. Returns the
+     * completed paste, or undefined while the end marker is still to come.
+     */
+    feed(data: string): CompletedPaste | undefined;
+    /**
+     * Drop any bracketed paste in `data`, forwarding the input before and after it. False means
+     * `data` holds no paste and nothing was forwarded, so the caller handles it as ordinary input.
+     */
+    discard(data: string, forward: (data: string) => void): boolean;
+}

package/dist/integrations/pi/components/bracketed-paste.js

@@ -0,0 +1,123 @@
+export const PASTE_START = "\x1b[200~";
+const PASTE_END = "\x1b[201~";
+/**
+ * Bracketed-paste framing across terminal input chunks. `feed` collects a paste for insertion;
+ * `discard` drops pastes while forwarding the input around them, and also holds back a split
+ * start marker so a paste can never leak in as typed text when paste is disabled.
+ */
+export class BracketedPasteFramer {
+    #maxBytes;
+    #open;
+    #startTail = "";
+    /** With `maxBytes`, a paste beyond it is reported as oversized and its text is dropped. */
+    constructor(maxBytes) {
+        this.#maxBytes = maxBytes;
+    }
+    /** A paste has started and its end marker has not arrived. */
+    get open() {
+        return this.#open !== undefined;
+    }
+    clear() {
+        this.#open = undefined;
+        this.#startTail = "";
+    }
+    /**
+     * Feed input that continues the open paste, or that begins with the start marker. Returns the
+     * completed paste, or undefined while the end marker is still to come.
+     */
+    feed(data) {
+        return this.#feed(data, true);
+    }
+    /**
+     * Drop any bracketed paste in `data`, forwarding the input before and after it. False means
+     * `data` holds no paste and nothing was forwarded, so the caller handles it as ordinary input.
+     */
+    discard(data, forward) {
+        if (this.#open !== undefined) {
+            const done = this.#feed(data, false);
+            if (done !== undefined && done.remaining.length > 0)
+                forward(done.remaining);
+            return true;
+        }
+        const hadStartTail = this.#startTail.length > 0;
+        const candidate = this.#startTail + data;
+        this.#startTail = "";
+        const start = candidate.indexOf(PASTE_START);
+        if (start >= 0) {
+            if (start > 0)
+                forward(candidate.slice(0, start));
+            const done = this.#feed(candidate.slice(start), false);
+            if (done !== undefined && done.remaining.length > 0)
+                forward(done.remaining);
+            return true;
+        }
+        const partial = delimiterTail(candidate, PASTE_START);
+        // Compatibility: standalone Escape still cancels; marker fragments stay pending.
+        if (partial.length > 1) {
+            const before = candidate.slice(0, candidate.length - partial.length);
+            if (before.length > 0)
+                forward(before);
+            this.#startTail = partial;
+            return true;
+        }
+        if (hadStartTail) {
+            forward(candidate);
+            return true;
+        }
+        return false;
+    }
+    #feed(data, collect) {
+        if (this.#open === undefined) {
+            this.#open = { parts: [], piece: "", tail: "", bytes: 0, oversized: false };
+            data = data.slice(data.indexOf(PASTE_START) + PASTE_START.length);
+        }
+        // Protocol: inspect only the new fragment plus a delimiter-sized suffix, not the whole growing body.
+        const pending = this.#open;
+        const fragment = pending.tail + data;
+        const end = fragment.indexOf(PASTE_END);
+        const append = (part) => {
+            if (!collect || pending.oversized || part.length === 0)
+                return;
+            if (this.#maxBytes !== undefined) {
+                pending.bytes += Buffer.byteLength(part);
+                if (pending.bytes > this.#maxBytes) {
+                    pending.oversized = true;
+                    pending.parts = [];
+                    pending.piece = "";
+                    return;
+                }
+            }
+            // Performance: bound fragment metadata even if a terminal supplies one character per input chunk.
+            pending.piece += part;
+            if (pending.piece.length >= 16_384) {
+                pending.parts.push(pending.piece);
+                pending.piece = "";
+            }
+        };
+        if (end < 0) {
+            let cut = Math.max(0, fragment.length - (PASTE_END.length - 1));
+            if (cut > 0 && /[\uD800-\uDBFF]/u.test(fragment[cut - 1]) && /[\uDC00-\uDFFF]/u.test(fragment[cut]))
+                cut--;
+            append(fragment.slice(0, cut));
+            pending.tail = fragment.slice(cut);
+            return undefined;
+        }
+        append(fragment.slice(0, end));
+        this.#open = undefined;
+        return {
+            text: pending.oversized ? "" : pending.parts.join("") + pending.piece,
+            bytes: pending.bytes,
+            oversized: pending.oversized,
+            remaining: fragment.slice(end + PASTE_END.length),
+        };
+    }
+}
+function delimiterTail(text, delimiter) {
+    const limit = Math.min(text.length, delimiter.length - 1);
+    for (let length = limit; length > 0; length -= 1) {
+        const suffix = text.slice(text.length - length);
+        if (delimiter.startsWith(suffix))
+            return suffix;
+    }
+    return "";
+}

package/dist/integrations/pi/components/editor-interaction.d.ts

@@ -1,5 +1,6 @@
+import type { OwnedUiShellEditorRecall } from "../../../contracts/owned-ui/index.js";
 import type { Editor } from "@earendil-works/pi-tui";
-export interface EditorInteractionState {
+interface EditorInteractionState {
     lines: string[];
     cursorLine: number;
     cursorCol: number;
@@ -17,17 +18,7 @@ export interface EditorInteractionPort {
     }>;
     setSegmentTransform(transform: (text: string, mode: "word" | "grapheme", segments: Iterable<Intl.SegmentData>) => Iterable<Intl.SegmentData>): void;
 }
-export interface EditorRecallPort {
-    replace(entries: readonly string[]): void;
-    position(): {
-        readonly index: number;
-        readonly total: number;
-    };
-    observe(listener: () => void): () => void;
-    reset(): void;
-    /** Exit a recall browse cycle by restoring the unsent draft rather than keeping the recalled entry. */
-    restoreDraft?(): void;
-}
+export type EditorRecallPort = OwnedUiShellEditorRecall;
 export interface EditorSurface extends Pick<Editor, Exclude<keyof Editor, "setText" | "render" | "handleInput">> {
     setText(text: string): void;
     render(width: number): string[];
@@ -38,3 +29,4 @@ export interface EditorSurface extends Pick<Editor, Exclude<keyof Editor, "setTe
 export type SelectionEditor = Pick<Editor, "getText" | "getCursor" | "setText" | "insertTextAtCursor" | "invalidate" | "onChange" | "getPaddingX" | "isShowingAutocomplete"> & {
     readonly interaction?: EditorInteractionPort;
 };
+export {};