@withbuddi/buddi 0.1.0-pre.37 → 0.1.0-pre.39

package/packages/install/dist/app-layout.d.ts

@@ -0,0 +1,127 @@
+import type { HttpTransport } from '@buddi/gateway';
+import type { NpmRunner } from './upgrade.js';
+/** What the app sets in its supervisor's environment: where releases go. */
+export declare const APP_LAYOUT_VAR = "BUDDI_APP_LAYOUT";
+/**
+ * The exit status that tells buddi.app "start me again from `current`, now".
+ * EX_TEMPFAIL: not a crash, so the app counts no failure and waits no backoff.
+ */
+export declare const APP_RESTART_EXIT = 75;
+/** The repository a release's provenance must name. */
+export declare const SOURCE_REPOSITORY = "https://github.com/withbuddi/buddi";
+/** What a running supervisor inside a bundle says when the app did not start it. */
+export declare const APP_BUNDLE = "This buddi runs from inside buddi.app, and the app updates it. Open buddi from the menu bar to update.";
+/** `<releases>` when this installation is buddi.app's, else undefined. */
+export declare function appLayout(env: NodeJS.ProcessEnv): string | undefined;
+/** Does this root sit inside a macOS app bundle? */
+export declare function insideAppBundle(root: string): boolean;
+export declare function releaseDir(releases: string, version: string): string;
+/** The package root inside a release directory, where npm puts it. */
+export declare function releaseRoot(dir: string): string;
+export interface ReleaseMeta {
+    version: string;
+    integrity: string;
+    tarball: string;
+    /** Where npm serves the provenance bundle, when the version has one. */
+    attestations?: string;
+}
+/** One GET of `<registry>/@withbuddi%2Fbuddi/<version>`: the integrity and the provenance URL. */
+export declare function fetchReleaseMeta(registry: string, version: string, http: HttpTransport, auth?: Record<string, string>): Promise<ReleaseMeta>;
+export declare function stageArgs(prefix: string, version: string, registry: string): string[];
+export declare function auditArgs(prefix: string, registry: string): string[];
+/**
+ * What `npm audit signatures --json --include-attestations` answers. npm 10
+ * (Node 22's) prints only `invalid` and `missing`; npm 11 adds `verified`,
+ * which nothing here needs.
+ */
+export interface AuditReport {
+    invalid?: Array<{
+        name?: string;
+        version?: string;
+        code?: string;
+        message?: string;
+    }>;
+    missing?: Array<{
+        name?: string;
+        version?: string;
+    }>;
+}
+/**
+ * npm's verdict: nothing in the release failed its registry signature or its
+ * sigstore bundle, and this package is not unsigned. Throws with the reason.
+ */
+export declare function auditVerdict(report: AuditReport, version: string): void;
+/** What `<release>/release.json` records about how a release was checked. */
+export interface ReleaseRecord {
+    version: string;
+    integrity: string;
+    provenance: {
+        verified: true;
+        url: string;
+        repository: string;
+        workflow: string;
+    } | {
+        verified: false;
+        reason: string;
+    };
+    stagedAt: string;
+}
+export interface StageOptions {
+    releases: string;
+    version: string;
+    registry: string;
+    http: HttpTransport;
+    exec: NpmRunner;
+    binary?: string;
+    /** Provenance is required unless this says otherwise; default: only from the public registry. */
+    requireProvenance?: boolean;
+    /** The registry's credentials (`registryAuth`), sent to its origin only. */
+    auth?: Record<string, string>;
+    /** The CA chain provenance must chain to; Fulcio's by default. */
+    chain?: readonly string[];
+    log?: (line: string) => void;
+}
+/** A release that passed every check, still in its staging folder. */
+export interface StagedRelease {
+    /** `<releases>/.staging-<v>-<random>`: npm's prefix. */
+    staging: string;
+    /** The package root inside it, where the Postgres check runs. */
+    root: string;
+    record: ReleaseRecord;
+}
+/** The plain line a release that fails its provenance check is refused with. */
+export declare function provenanceRefusal(version: string, reason: string): string;
+/**
+ * Download, verify and unpack one release into a staging folder of its own.
+ * Nothing the app runs changes here, and no `buddi-<v>` is touched: the
+ * release is put in place by `placeRelease` once the rest of the upgrade has
+ * checked it, and `current` is switched later still, by `switchCurrent`.
+ */
+export declare function stageRelease(opts: StageOptions): Promise<StagedRelease>;
+/**
+ * Rename a checked staging folder into `<releases>/buddi-<version>`.
+ *
+ * A `buddi-<version>` already there that `current` or `previous` points at is
+ * kept as it is (it passed the same checks when it was staged), and the new
+ * copy is dropped: the release the app falls back on is never removed to make
+ * room. One nothing points at is replaced.
+ */
+export declare function placeRelease(target: string, version: string, staging: string, log?: (line: string) => void): Promise<{
+    dir: string;
+    root: string;
+    kept: boolean;
+}>;
+/** Where `current` and `previous` point now. */
+export declare function releaseLinks(releases: string): Promise<{
+    current?: string;
+    previous?: string;
+}>;
+/**
+ * Point `current` at the new root and `previous` at the one running now, then
+ * drop every release directory neither of them is in. The bundle's own copy is
+ * outside `<releases>` and is never removed.
+ */
+export declare function switchCurrent(target: string, next: string, running: string): Promise<void>;
+/** Remove release directories `current` and `previous` do not use, and stale staging. */
+export declare function pruneReleases(releases: string): Promise<string[]>;
+//# sourceMappingURL=app-layout.d.ts.map

package/packages/install/dist/app-layout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-layout.d.ts","sourceRoot":"","sources":["../src/app-layout.ts"],"names":[],"mappings":"AAmDA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,4EAA4E;AAC5E,eAAO,MAAM,cAAc,qBAAqB,CAAC;AAEjD;;;GAGG;AACH,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC,uDAAuD;AACvD,eAAO,MAAM,iBAAiB,uCAAuC,CAAC;AAEtE,oFAAoF;AACpF,eAAO,MAAM,UAAU,2GACmF,CAAC;AAE3G,0EAA0E;AAC1E,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAGpE;AAED,oDAAoD;AACpD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED,sEAAsE;AACtE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/C;AAMD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,kGAAkG;AAClG,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAelJ;AAMD,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAMrF;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpE;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtF,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAOvE;AAED,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE;QAAE,QAAQ,EAAE,IAAI,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACxH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,kEAAkE;IAClE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CA4E7E;AAQD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAoBxK;AAoBD,gDAAgD;AAChD,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAIrG;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhG;AAED,yFAAyF;AACzF,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBvE"}

package/packages/install/dist/app-layout.js

@@ -0,0 +1,323 @@
+/**
+ * buddi.app's own layout: upgrades that never write into the signed bundle.
+ *
+ * The Mac app carries a release inside `buddi.app/Contents/Resources/buddi/`,
+ * which is signed and sealed: `npm install --prefix` there would break the
+ * signature, and the app would go on running the bundle's copy anyway. So the
+ * app starts its supervisor with `BUDDI_APP_LAYOUT=<writable dir>` (it uses
+ * `<data>/releases`), and an upgrade in that layout goes there instead:
+ *
+ *     <releases>/buddi-<version>/                      npm's prefix for that release
+ *     <releases>/buddi-<version>/node_modules/@withbuddi/buddi   the release root
+ *     <releases>/current  -> the release root the app runs
+ *     <releases>/previous -> the root that ran before it (a release, or the bundle's copy)
+ *
+ * The app (`BundleLayout.swift`) starts whatever `current` points at, and the
+ * bundle's copy when there is no `current`; the bundle's copy is never touched,
+ * so it is always there to fall back on.
+ *
+ * Verification, before anything is switched:
+ *
+ *  - **Integrity.** The packument's `dist.integrity` (sha512) is read first,
+ *    npm verifies the tarball against it while installing, and the
+ *    `package-lock.json` npm wrote is read back to check that the integrity it
+ *    recorded is that same value: what is on disk is the tarball npm serves.
+ *  - **Signatures.** `npm audit signatures --include-attestations` verifies the
+ *    registry signature and the sigstore bundles with npm's own sigstore client
+ *    (Fulcio chain, Rekor inclusion). The npm that ships with Node 22 answers
+ *    `--json` with only `{ invalid, missing }`, so that is all this reads from
+ *    it: nothing invalid, and this package not missing.
+ *  - **Provenance.** Who signed is checked here (`provenance.ts`): the SLSA
+ *    bundle the registry serves for this version chains to Fulcio, its
+ *    signature verifies, its subject is the tarball's sha512, and its
+ *    certificate names `withbuddi/buddi`'s release workflow at this version's
+ *    tag. Required from the public registry; a registry of one's own (the
+ *    smoke, a mirror) has none to offer, and the record says so.
+ *
+ * All of it happens in `<releases>/.staging-<v>-<random>`; only a release that
+ * passed (and whose Postgres starts, see `upgrade.ts`) is renamed into
+ * `buddi-<v>` by `placeRelease`, and a `buddi-<v>` that `current` or
+ * `previous` points at is never removed to make room.
+ *
+ * Scripts stay off (`--ignore-scripts`, as everywhere in `upgrade.ts`); the one
+ * install script the release needs, embedded Postgres's dylib links, is what
+ * `createPostgresCheck` hydrates itself before it runs the new binary.
+ *
+ * Like `upgrade.ts`, nothing here reaches the network by itself: the registry
+ * is the `http` seam and npm is the `exec` seam.
+ */
+import { randomBytes } from 'node:crypto';
+import { lstat, mkdir, readFile, readdir, readlink, realpath, rename, rm, symlink, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { DEFAULT_REGISTRY, PACKAGE_NAME, PACKAGE_PATH, CHECK_TIMEOUT_MS, authFor, npmBinary, sanitizeNpmOutput } from './upgrade.js';
+import { attestationsUrl, verifyProvenance } from './provenance.js';
+/** What the app sets in its supervisor's environment: where releases go. */
+export const APP_LAYOUT_VAR = 'BUDDI_APP_LAYOUT';
+/**
+ * The exit status that tells buddi.app "start me again from `current`, now".
+ * EX_TEMPFAIL: not a crash, so the app counts no failure and waits no backoff.
+ */
+export const APP_RESTART_EXIT = 75;
+/** The repository a release's provenance must name. */
+export const SOURCE_REPOSITORY = 'https://github.com/withbuddi/buddi';
+/** What a running supervisor inside a bundle says when the app did not start it. */
+export const APP_BUNDLE = 'This buddi runs from inside buddi.app, and the app updates it. Open buddi from the menu bar to update.';
+/** `<releases>` when this installation is buddi.app's, else undefined. */
+export function appLayout(env) {
+    const dir = env[APP_LAYOUT_VAR]?.trim();
+    return dir !== undefined && dir !== '' && path.isAbsolute(dir) ? path.resolve(dir) : undefined;
+}
+/** Does this root sit inside a macOS app bundle? */
+export function insideAppBundle(root) {
+    return /\.app\/Contents\//.test(root.split(path.sep).join('/') + '/');
+}
+export function releaseDir(releases, version) {
+    return path.join(releases, `buddi-${version}`);
+}
+/** The package root inside a release directory, where npm puts it. */
+export function releaseRoot(dir) {
+    return path.join(dir, 'node_modules', ...PACKAGE_NAME.split('/'));
+}
+/** One GET of `<registry>/@withbuddi%2Fbuddi/<version>`: the integrity and the provenance URL. */
+export async function fetchReleaseMeta(registry, version, http, auth) {
+    const base = registry.replace(/\/+$/, '');
+    const response = await http(`${base}/${PACKAGE_PATH}/${version}`, {
+        method: 'GET',
+        headers: { accept: 'application/json', ...authFor(base, base, auth) },
+        signal: AbortSignal.timeout(CHECK_TIMEOUT_MS),
+    });
+    if (response.status !== 200)
+        throw new Error(`the registry answered ${response.status} for ${PACKAGE_NAME}@${version}`);
+    const body = await response.json();
+    if (body.version !== version)
+        throw new Error(`the registry described ${String(body.version)} when asked for ${version}`);
+    const integrity = body.dist?.integrity;
+    if (typeof integrity !== 'string' || !integrity.startsWith('sha512-'))
+        throw new Error(`${PACKAGE_NAME}@${version} has no sha512 integrity in the registry`);
+    const tarball = typeof body.dist?.tarball === 'string' ? body.dist.tarball : '';
+    const url = body.dist?.attestations?.url;
+    return { version, integrity, tarball, ...(typeof url === 'string' && url !== '' ? { attestations: url } : {}) };
+}
+/* ------------------------------------------------------------------ *
+ * npm, as this layout calls it
+ * ------------------------------------------------------------------ */
+export function stageArgs(prefix, version, registry) {
+    return [
+        'install', '--prefix', prefix, `${PACKAGE_NAME}@${version}`,
+        '--registry', registry,
+        '--ignore-scripts', '--no-audit', '--no-fund', '--omit=dev',
+    ];
+}
+export function auditArgs(prefix, registry) {
+    return ['audit', 'signatures', '--prefix', prefix, '--registry', registry, '--json', '--include-attestations'];
+}
+/**
+ * npm's verdict: nothing in the release failed its registry signature or its
+ * sigstore bundle, and this package is not unsigned. Throws with the reason.
+ */
+export function auditVerdict(report, version) {
+    if (typeof report !== 'object' || report === null || (!Array.isArray(report.invalid) && !Array.isArray(report.missing))) {
+        throw new Error('npm audit signatures answered with something other than its report');
+    }
+    const bad = (report.invalid ?? []).find(entry => entry.name === PACKAGE_NAME) ?? report.invalid?.[0];
+    if (bad !== undefined)
+        throw new Error(`npm could not verify ${bad.name ?? 'a package'}@${bad.version ?? '?'}: ${bad.message ?? bad.code ?? 'invalid signature'}`);
+    if ((report.missing ?? []).some(entry => entry.name === PACKAGE_NAME))
+        throw new Error(`${PACKAGE_NAME}@${version} has no registry signature`);
+}
+/** The plain line a release that fails its provenance check is refused with. */
+export function provenanceRefusal(version, reason) {
+    return `buddi did not update to ${version}: its provenance did not check out (${reason}).`;
+}
+/**
+ * Download, verify and unpack one release into a staging folder of its own.
+ * Nothing the app runs changes here, and no `buddi-<v>` is touched: the
+ * release is put in place by `placeRelease` once the rest of the upgrade has
+ * checked it, and `current` is switched later still, by `switchCurrent`.
+ */
+export async function stageRelease(opts) {
+    const { version, registry } = opts;
+    const binary = opts.binary ?? npmBinary();
+    const requireProvenance = opts.requireProvenance ?? registry.replace(/\/+$/, '') === DEFAULT_REGISTRY;
+    const timeout = 15 * 60_000;
+    const maxBuffer = 64 * 1024 * 1024;
+    const fail = (what, err) => {
+        const stderr = err?.stderr;
+        const text = (stderr ?? (err instanceof Error ? err.message : String(err))).toString().trim();
+        return new Error(`${what}: ${sanitizeNpmOutput(text)}`);
+    };
+    const meta = await fetchReleaseMeta(registry, version, opts.http, opts.auth);
+    if (requireProvenance && meta.attestations === undefined) {
+        throw new Error(`${PACKAGE_NAME}@${version} has no provenance attestation, and buddi.app installs only releases built by withbuddi/buddi's CI.`);
+    }
+    await mkdir(opts.releases, { recursive: true, mode: 0o700 });
+    // Resolved: npm given a prefix under a symlink (`/var` → `/private/var`, a
+    // linked home) writes its lock with `../../private/...` keys, and the
+    // integrity check below would find nothing.
+    const releases = await realpath(opts.releases);
+    const staging = path.join(releases, `.staging-${version}-${randomBytes(4).toString('hex')}`);
+    await mkdir(staging, { recursive: true, mode: 0o700 });
+    // npm's own kind of prefix manifest: no name, so it is nobody's project.
+    await writeFile(path.join(staging, 'package.json'), JSON.stringify({ private: true, description: 'A buddi release installed by buddi.app.' }, null, 2) + '\n');
+    try {
+        try {
+            await opts.exec(binary, stageArgs(staging, version, registry), { timeout, maxBuffer });
+        }
+        catch (err) {
+            throw fail(`npm install ${PACKAGE_NAME}@${version} failed`, err);
+        }
+        // What npm recorded for what it unpacked: the integrity the registry named.
+        const lock = JSON.parse(await readFile(path.join(staging, 'package-lock.json'), 'utf8').catch(() => '{}'));
+        const entry = lock.packages?.[`node_modules/${PACKAGE_NAME}`];
+        if (entry?.version !== version)
+            throw new Error(`npm installed ${entry?.version ?? 'nothing'} when ${version} was asked for`);
+        if (entry.integrity !== meta.integrity)
+            throw new Error(`the installed tarball's integrity (${entry.integrity ?? 'none'}) is not the registry's (${meta.integrity})`);
+        const pkg = JSON.parse(await readFile(path.join(releaseRoot(staging), 'package.json'), 'utf8').catch(() => '{}'));
+        if (pkg.name !== PACKAGE_NAME || pkg.version !== version)
+            throw new Error(`what was unpacked is ${pkg.name ?? 'not a package'} ${pkg.version ?? ''}, not ${PACKAGE_NAME}@${version}`.replace('  ', ' '));
+        let provenance;
+        if (meta.attestations !== undefined) {
+            let out;
+            try {
+                out = await opts.exec(binary, auditArgs(staging, registry), { timeout, maxBuffer });
+            }
+            catch (err) {
+                // `audit signatures` exits non-zero on an invalid signature and still prints its JSON.
+                const stdout = err?.stdout;
+                if (typeof stdout !== 'string' || stdout.trim() === '')
+                    throw fail('npm audit signatures failed', err);
+                out = { stdout };
+            }
+            const text = typeof out === 'string' ? out : String(out?.stdout ?? '');
+            let report;
+            try {
+                report = JSON.parse(text);
+            }
+            catch {
+                throw new Error('npm audit signatures did not answer with JSON');
+            }
+            auditVerdict(report, version);
+            // Who signed: the bundle npm verified, read and checked here.
+            const base = registry.replace(/\/+$/, '');
+            const url = meta.attestations.startsWith(`${base}/`) ? meta.attestations : attestationsUrl(base, PACKAGE_NAME, version);
+            const response = await opts.http(url, { method: 'GET', headers: { accept: 'application/json', ...authFor(url, base, opts.auth) }, signal: AbortSignal.timeout(CHECK_TIMEOUT_MS) });
+            if (response.status !== 200)
+                throw new Error(provenanceRefusal(version, `the registry answered ${response.status} for its attestations`));
+            const doc = await response.json().catch(() => undefined);
+            let facts;
+            try {
+                facts = verifyProvenance(doc, { name: PACKAGE_NAME, version, integrity: meta.integrity, ...(opts.chain === undefined ? {} : { chain: opts.chain }) });
+            }
+            catch (err) {
+                throw new Error(provenanceRefusal(version, err instanceof Error ? err.message : String(err)));
+            }
+            provenance = { verified: true, url, repository: facts.repository, workflow: facts.workflow };
+        }
+        else {
+            provenance = { verified: false, reason: `${registry} serves no provenance for ${version}` };
+        }
+        const record = { version, integrity: meta.integrity, provenance, stagedAt: new Date().toISOString() };
+        await writeFile(path.join(staging, 'release.json'), JSON.stringify(record, null, 2) + '\n');
+        opts.log?.(`upgrade: ${version} is downloaded to ${staging} (integrity ${provenance.verified ? 'and provenance ' : ''}verified).`);
+        return { staging, root: releaseRoot(staging), record };
+    }
+    catch (err) {
+        await rm(staging, { recursive: true, force: true }).catch(() => { });
+        throw err;
+    }
+}
+/** Is `dir` (a `buddi-<v>` in `releases`) the one `current` or `previous` points into? */
+async function referenced(releases, dir) {
+    const targets = await Promise.all(['current', 'previous'].map(name => realpath(path.join(releases, name)).catch(() => undefined)));
+    return targets.some(target => target !== undefined && path.relative(releases, target).split(path.sep)[0] === path.basename(dir));
+}
+/**
+ * Rename a checked staging folder into `<releases>/buddi-<version>`.
+ *
+ * A `buddi-<version>` already there that `current` or `previous` points at is
+ * kept as it is (it passed the same checks when it was staged), and the new
+ * copy is dropped: the release the app falls back on is never removed to make
+ * room. One nothing points at is replaced.
+ */
+export async function placeRelease(target, version, staging, log) {
+    const releases = await realpath(target);
+    const dir = releaseDir(releases, version);
+    const there = await lstat(dir).then(s => s.isDirectory(), () => false);
+    if (there && await referenced(releases, dir)) {
+        await rm(staging, { recursive: true, force: true });
+        log?.(`upgrade: ${version} is already in ${dir} and the app may go back to it; keeping that copy.`);
+        return { dir, root: releaseRoot(dir), kept: true };
+    }
+    if (there) {
+        // rename(2) replaces only an empty directory: move the old one aside first.
+        const aside = path.join(releases, `.staging-${version}-old-${randomBytes(4).toString('hex')}`);
+        await rename(dir, aside);
+        await rename(staging, dir);
+        await rm(aside, { recursive: true, force: true }).catch(() => { });
+    }
+    else {
+        await rename(staging, dir);
+    }
+    log?.(`upgrade: ${version} is in place in ${dir}.`);
+    return { dir, root: releaseRoot(dir), kept: false };
+}
+/* ------------------------------------------------------------------ *
+ * current, previous, and what is kept
+ * ------------------------------------------------------------------ */
+async function linkTarget(link) {
+    try {
+        return path.resolve(path.dirname(link), await readlink(link));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Replace a symlink in one rename, so the app never sees it missing. */
+async function pointAt(link, target) {
+    const tmp = `${link}.tmp-${process.pid}`;
+    await rm(tmp, { force: true });
+    await symlink(target, tmp);
+    await rename(tmp, link);
+}
+/** Where `current` and `previous` point now. */
+export async function releaseLinks(releases) {
+    const current = await linkTarget(path.join(releases, 'current'));
+    const previous = await linkTarget(path.join(releases, 'previous'));
+    return { ...(current === undefined ? {} : { current }), ...(previous === undefined ? {} : { previous }) };
+}
+/**
+ * Point `current` at the new root and `previous` at the one running now, then
+ * drop every release directory neither of them is in. The bundle's own copy is
+ * outside `<releases>` and is never removed.
+ */
+export async function switchCurrent(target, next, running) {
+    await mkdir(target, { recursive: true, mode: 0o700 });
+    const releases = await realpath(target);
+    await pointAt(path.join(releases, 'previous'), running);
+    await pointAt(path.join(releases, 'current'), next);
+    await pruneReleases(releases);
+}
+/** Remove release directories `current` and `previous` do not use, and stale staging. */
+export async function pruneReleases(releases) {
+    // Both sides resolved: a data folder under a symlink (`/var` → `/private/var`)
+    // must never make the release `current` points at look like someone else's.
+    const base = await realpath(releases).catch(() => releases);
+    const targets = await Promise.all(['current', 'previous'].map(name => realpath(path.join(base, name)).catch(() => undefined)));
+    const kept = new Set(targets.filter((p) => p !== undefined).map(p => path.relative(base, p).split(path.sep)[0]));
+    releases = base;
+    const removed = [];
+    for (const name of await readdir(releases).catch(() => [])) {
+        if (!name.startsWith('buddi-') && !name.startsWith('.staging-'))
+            continue;
+        if (kept.has(name))
+            continue;
+        const full = path.join(releases, name);
+        if (!(await lstat(full)).isDirectory())
+            continue;
+        await rm(full, { recursive: true, force: true });
+        removed.push(name);
+    }
+    return removed;
+}
+//# sourceMappingURL=app-layout.js.map

package/packages/install/dist/app-layout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-layout.js","sourceRoot":"","sources":["../src/app-layout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACrI,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGpE,4EAA4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAEjD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC,uDAAuD;AACvD,MAAM,CAAC,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAEtE,oFAAoF;AACpF,MAAM,CAAC,MAAM,UAAU,GACrB,wGAAwG,CAAC;AAE3G,0EAA0E;AAC1E,MAAM,UAAU,SAAS,CAAC,GAAsB;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;IACxC,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjG,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,OAAe;IAC1D,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAcD,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,OAAe,EAAE,IAAmB,EAAE,IAA6B;IAC1H,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,IAAI,YAAY,IAAI,OAAO,EAAE,EAAE;QAChE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;QACrE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;KAC9C,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,MAAM,QAAQ,YAAY,IAAI,OAAO,EAAE,CAAC,CAAC;IACxH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAgH,CAAC;IACjJ,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,OAAO,EAAE,CAAC,CAAC;IAC1H,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;IACvC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,YAAY,IAAI,OAAO,0CAA0C,CAAC,CAAC;IAC7J,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC;IACzC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAClH,CAAC;AAED;;wEAEwE;AAExE,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,OAAe,EAAE,QAAgB;IACzE,OAAO;QACL,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,YAAY,IAAI,OAAO,EAAE;QAC3D,YAAY,EAAE,QAAQ;QACtB,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,QAAgB;IACxD,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,wBAAwB,CAAC,CAAC;AACjH,CAAC;AAYD;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAmB,EAAE,OAAe;IAC/D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACxH,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACrG,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,IAAI,IAAI,WAAW,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,KAAK,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC,CAAC;IACnK,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,YAAY,IAAI,OAAO,4BAA4B,CAAC,CAAC;AACjJ,CAAC;AAmCD,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,MAAc;IAC/D,OAAO,2BAA2B,OAAO,uCAAuC,MAAM,IAAI,CAAC;AAC7F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAkB;IACnD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;IAC1C,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,gBAAgB,CAAC;IACtG,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,CAAC;IAC5B,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,GAAY,EAAS,EAAE;QACjD,MAAM,MAAM,GAAI,GAAkC,EAAE,MAAM,CAAC;QAC3D,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QAC9F,OAAO,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,iBAAiB,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,GAAG,YAAY,IAAI,OAAO,qGAAqG,CAAC,CAAC;IACnJ,CAAC;IAED,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,2EAA2E;IAC3E,sEAAsE;IACtE,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,OAAO,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7F,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,yEAAyE;IACzE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,yCAAyC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/J,IAAI,CAAC;QACH,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAAC,CAAC;QAC/F,OAAO,GAAG,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,eAAe,YAAY,IAAI,OAAO,SAAS,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;QAEjF,4EAA4E;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA4E,CAAC;QACtL,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,gBAAgB,YAAY,EAAE,CAAC,CAAC;QAC9D,IAAI,KAAK,EAAE,OAAO,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,EAAE,OAAO,IAAI,SAAS,SAAS,OAAO,gBAAgB,CAAC,CAAC;QAC9H,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,KAAK,CAAC,SAAS,IAAI,MAAM,4BAA4B,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACtK,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAwC,CAAC;QACzJ,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,IAAI,IAAI,eAAe,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,SAAS,YAAY,IAAI,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAEzM,IAAI,UAAuC,CAAC;QAC5C,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBAAC,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAAC,CAAC;YAC5F,OAAO,GAAG,EAAE,CAAC;gBACX,uFAAuF;gBACvF,MAAM,MAAM,GAAI,GAAkC,EAAE,MAAM,CAAC;gBAC3D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;oBAAE,MAAM,IAAI,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;gBACvG,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC;YACnB,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAE,GAAmC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;YACxG,IAAI,MAAmB,CAAC;YACxB,IAAI,CAAC;gBAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;YAAC,CAAC;YACjD,MAAM,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAAC,CAAC;YAC3E,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAE9B,8DAA8D;YAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YACxH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACnL,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,OAAO,EAAE,yBAAyB,QAAQ,CAAC,MAAM,uBAAuB,CAAC,CAAC,CAAC;YAC1I,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACzD,IAAI,KAA+C,CAAC;YACpD,IAAI,CAAC;gBAAC,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAC9J,OAAO,GAAG,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YAC9G,UAAU,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/F,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,6BAA6B,OAAO,EAAE,EAAE,CAAC;QAC9F,CAAC;QAED,MAAM,MAAM,GAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACrH,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5F,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,OAAO,qBAAqB,OAAO,eAAe,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QACnI,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,UAAU,CAAC,QAAgB,EAAE,GAAW;IACrD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACnI,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACnI,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,OAAe,EAAE,OAAe,EAAE,GAA4B;IAC/G,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,KAAK,IAAI,MAAM,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,GAAG,EAAE,CAAC,YAAY,OAAO,kBAAkB,GAAG,oDAAoD,CAAC,CAAC;QACpG,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,4EAA4E;QAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,OAAO,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/F,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC3B,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,GAAG,EAAE,CAAC,YAAY,OAAO,mBAAmB,GAAG,GAAG,CAAC,CAAC;IACpD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACtD,CAAC;AAGD;;wEAEwE;AAExE,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;IACtE,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AAC7B,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,MAAc;IACjD,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/B,MAAM,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3B,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IACnE,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAC5G,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,IAAY,EAAE,OAAe;IAC/E,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB;IAClD,+EAA+E;IAC/E,4EAA4E;IAC5E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC/H,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9H,QAAQ,GAAG,IAAI,CAAC;IAChB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,SAAS;QAC1E,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,SAAS;QACjD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/packages/install/dist/index.d.ts

@@ -2,4 +2,5 @@ export * from './environment.js';
 export * from './postgres.js';
 export * from './supervisor.js';
 export * from './upgrade.js';
+export * from './app-layout.js';
 //# sourceMappingURL=index.d.ts.map

package/packages/install/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC"}

package/packages/install/dist/index.js

@@ -5,4 +5,5 @@ export * from './environment.js';
 export * from './postgres.js';
 export * from './supervisor.js';
 export * from './upgrade.js';
+export * from './app-layout.js';
 //# sourceMappingURL=index.js.map

package/packages/install/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,4EAA4E;AAC5E,2DAA2D;AAC3D,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,4EAA4E;AAC5E,2DAA2D;AAC3D,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC"}

package/packages/install/dist/launcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"launcher.d.ts","sourceRoot":"","sources":["../src/launcher.ts"],"names":[],"mappings":";AAwBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AA6DxD,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAM5D"}
+{"version":3,"file":"launcher.d.ts","sourceRoot":"","sources":["../src/launcher.ts"],"names":[],"mappings":";AAyBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AA0ExD,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAM5D"}

package/packages/install/dist/launcher.js

@@ -20,6 +20,7 @@ import { supervise, supervisorSocket } from './supervisor.js';
 import { keptPluginDataLine, readKeptPluginData } from './kept-data.js';
 import { readProfileZone, timezoneLine } from './doctor-timezone.js';
 import { installedVersion, readUpgradeState, upgradeDoctorLines, versionView } from './upgrade.js';
+import { appLayout, insideAppBundle } from './app-layout.js';
 const entry = fileURLToPath(import.meta.url);
 // <root>/packages/install/dist/launcher.js — the installation root is three up.
 const root = path.resolve(path.dirname(entry), '../../..');
@@ -85,6 +86,17 @@ async function ask(ctx, method, route, body) {
         req.end(payload);
     });
 }
+/**
+ * Is this buddi.app's installation? The app says so in the supervisor's
+ * environment; a terminal running the same launcher is told by where it runs
+ * from: inside the bundle, or from a release under `<data>/releases`.
+ */
+function isAppInstall(ctx) {
+    return appLayout(process.env) !== undefined || insideAppBundle(root) || root.startsWith(path.join(ctx.data, 'releases') + path.sep);
+}
+function withApp(view, ctx) {
+    return isAppInstall(ctx) ? { ...view, app: true } : view;
+}
 async function control(ctx, action = 'status') {
     return await ask(ctx, action === 'status' ? 'GET' : 'POST', `/${action}`);
 }
@@ -586,7 +598,7 @@ async function run() {
          * looking at a supervisor that is barely up. The file is the record.
          */
         const state = await readUpgradeState(ctx.data, await installedVersion(root));
-        for (const line of upgradeDoctorLines(versionView(state), ctx.state?.phase))
+        for (const line of upgradeDoctorLines(withApp(versionView(state), ctx), ctx.state?.phase))
             console.log(line);
         console.log(`Logs: ${path.join(ctx.data, 'logs')}`);
         return;
@@ -597,11 +609,13 @@ async function run() {
             view = await ask(ctx, 'GET', '/version');
         }
         catch {
-            view = versionView(await readUpgradeState(ctx.data, await installedVersion(root)));
+            view = withApp(versionView(await readUpgradeState(ctx.data, await installedVersion(root))), ctx);
         }
-        console.log(`buddi ${view.current}`);
+        console.log(`buddi ${view.current}${view.app ? ' (buddi.app)' : ''}`);
         if (view.updateAvailable)
-            console.log(`A newer buddi is available: ${view.latest}`);
+            console.log(view.app ? `A newer buddi is available: ${view.latest}. Choose Update to ${view.latest} in the buddi menu.` : `A newer buddi is available: ${view.latest}`);
+        else if (view.processing)
+            console.log(view.processing.message);
         else if (view.latest !== undefined)
             console.log('This is the latest version.');
         return;