@zaip-ai/cli 6.3.0 → 7.5.0

package/dist/services/install-storage-boundary.js

@@ -0,0 +1,173 @@
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { access, lstat, opendir, readFile } from "node:fs/promises";
+import { join } from "node:path";
+const cacheDirectories = new Set(["temp", "cache", "sqlite"]);
+const legacyRoots = [".agents/local", ".agents/state/claims", ".zaip-aios/local-data"];
+const cutoverRoot = ".agents/private/state/storage-cutover";
+const journalName = /^([a-f0-9]{64})\.jsonl$/;
+function pending(reason) {
+    throw new Error(`storage_migration_pending: ${reason}. Finish the authenticated storage handoff/recovery ` +
+        "with the currently installed runtime before upgrading; --force/--yes cannot bypass it.");
+}
+function notFound(error) {
+    return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+/** Readonly physical inspection. Never follows aliases or creates recovery metadata. */
+async function info(root, name) {
+    let current = root;
+    for (const part of name.split("/")) {
+        current = join(current, part);
+        const entry = await lstat(current).catch((error) => {
+            if (notFound(error))
+                return null;
+            throw error;
+        });
+        if (entry === null)
+            return null;
+        if (entry.isSymbolicLink() || (entry.isFile() && entry.nlink !== 1))
+            pending("operational state contains an unresolved filesystem alias");
+        if (current !== join(root, name) && !entry.isDirectory())
+            pending("operational state has a non-directory ancestor");
+        if (current === join(root, name))
+            return entry;
+    }
+    return null;
+}
+async function hasState(root, name, depth = 0) {
+    if (depth > 64)
+        pending("legacy state exceeds the inspection depth bound");
+    const entry = await info(root, name);
+    if (entry === null)
+        return false;
+    if (!entry.isDirectory())
+        return true;
+    const directory = await opendir(join(root, name));
+    for await (const child of directory) {
+        if (child.name === ".gitignore") {
+            const ignore = await info(root, `${name}/${child.name}`);
+            if (ignore?.isFile())
+                continue;
+        }
+        if (await hasState(root, `${name}/${child.name}`, depth + 1))
+            return true;
+    }
+    return false;
+}
+async function boundedJson(root, name) {
+    const entry = await info(root, name);
+    if (!entry?.isFile() || entry.size > 1024 * 1024)
+        pending("cutover proof is missing or exceeds its inspection bound");
+    try {
+        const value = JSON.parse(await readFile(join(root, name), "utf8"));
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            pending("cutover proof is malformed");
+        return value;
+    }
+    catch {
+        return pending("cutover proof is malformed");
+    }
+}
+async function assertNoIncompleteCutover(root) {
+    for (const lock of ["storage-migration.lock", "storage-copy-session.lock"])
+        if (await info(root, `.agents/private/state/${lock}`))
+            pending("storage migration is active");
+    const entry = await info(root, cutoverRoot);
+    if (entry === null)
+        return;
+    if (!entry.isDirectory())
+        pending("cutover root is not a directory");
+    if (await info(root, `${cutoverRoot}/active.lock`))
+        pending("storage cutover is active");
+    const directory = await opendir(join(root, cutoverRoot));
+    for await (const child of directory) {
+        const match = journalName.exec(child.name);
+        if (!match) {
+            if (child.name.endsWith(".jsonl"))
+                pending("unrecognized cutover journal");
+            continue;
+        }
+        const path = `${cutoverRoot}/${child.name}`;
+        const journal = await info(root, path);
+        if (!journal?.isFile() || journal.size > 1024 * 1024)
+            pending("cutover journal is not a bounded physical file");
+        let lastType;
+        let journalText = "";
+        try {
+            journalText = await readFile(join(root, path), "utf8");
+            const lines = journalText.trim().split("\n");
+            for (const line of lines)
+                lastType = JSON.parse(line).type;
+        }
+        catch {
+            pending("cutover journal is incomplete or malformed");
+        }
+        if (lastType === "preparation_cancelled") {
+            const lines = journalText.trimEnd().split("\n");
+            const terminalLine = lines.pop();
+            const firstLine = lines[0];
+            if (!terminalLine || !firstLine)
+                pending("cancelled preparation is missing its owner");
+            const terminal = JSON.parse(terminalLine);
+            const original = `${lines.join("\n")}\n`;
+            const first = JSON.parse(firstLine);
+            const proof = await boundedJson(root, `.agents/state/storage-migrations/preparation-${match[1]}.json`);
+            if (first.type !== "started" ||
+                first.generation !== match[1] ||
+                first.task !== proof.task ||
+                first.run !== proof.run ||
+                !["preparation_cancelled_before_copy", "preparation_superseded_before_activation"].includes(String(proof.status)) ||
+                proof.generation !== match[1] ||
+                proof.replacement !== terminal.replacement ||
+                proof.journal_sha256 !== terminal.journal_sha256 ||
+                proof.journal_sha256 !== createHash("sha256").update(original).digest("hex") ||
+                lines.slice(1).some((line) => {
+                    const event = JSON.parse(line);
+                    if (event.type === "copied" &&
+                        proof.status === "preparation_superseded_before_activation")
+                        return typeof event.family !== "string" || !/^[a-f0-9]{64}$/.test(event.id);
+                    return (event.type !== "interrupted" ||
+                        event.activated !== false ||
+                        event.deletion_started !== false);
+                }))
+                pending("cancelled preparation proof differs");
+            continue;
+        }
+        if (lastType !== "completed")
+            pending("storage cutover has not completed");
+        const receipt = await boundedJson(root, `.agents/state/storage-migrations/cutover-${match[1]}.json`);
+        const archive = await boundedJson(root, ".agents/state/storage-migrations/local-archive.json");
+        if (receipt.status !== "operational_cutover_verified" ||
+            receipt.generation !== match[1] ||
+            archive.generation !== match[1])
+            pending("cutover completion references conflict");
+    }
+}
+/** Run BEFORE template loading, legacy migration planning, backups or installer writes.
+ * Cache-only is deliberately narrow: unknown legacy files require classification.
+ * Completion metadata never overrides remaining legacy facts and grants no authority.
+ */
+export async function assertInstallerStorageReady(root) {
+    await access(root, constants.W_OK);
+    await assertNoIncompleteCutover(root);
+    for (const legacy of legacyRoots)
+        if (await hasState(root, legacy))
+            pending(`legacy operational state remains in ${legacy}`);
+    const local = await info(root, ".local");
+    if (local === null)
+        return;
+    if (!local.isDirectory())
+        pending("legacy .local is not a physical directory");
+    const directory = await opendir(join(root, ".local"));
+    for await (const child of directory) {
+        const path = `.local/${child.name}`;
+        const entry = await info(root, path);
+        if (cacheDirectories.has(child.name) && entry?.isDirectory())
+            continue;
+        if ([".gitignore", "README.md"].includes(child.name) && entry?.isFile())
+            continue;
+        if (await hasState(root, path))
+            pending(`unmigrated or unclassified state remains in ${path}`);
+    }
+}
+//# sourceMappingURL=install-storage-boundary.js.map

package/dist/services/install-storage-boundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-storage-boundary.js","sourceRoot":"","sources":["../../src/services/install-storage-boundary.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC9D,MAAM,WAAW,GAAG,CAAC,eAAe,EAAE,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;AACvF,MAAM,WAAW,GAAG,uCAAuC,CAAC;AAC5D,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAE9C,SAAS,OAAO,CAAC,MAAc;IAC7B,MAAM,IAAI,KAAK,CACb,8BAA8B,MAAM,sDAAsD;QACxF,wFAAwF,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC9E,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,IAAY;IAC5C,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC1D,IAAI,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC;YACjE,OAAO,CAAC,2DAA2D,CAAC,CAAC;QACvE,IAAI,OAAO,KAAK,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;YACtD,OAAO,CAAC,gDAAgD,CAAC,CAAC;QAC5D,IAAI,OAAO,KAAK,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,IAAY,EAAE,KAAK,GAAG,CAAC;IAC3D,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,CAAC,iDAAiD,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAClD,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACzD,IAAI,MAAM,EAAE,MAAM,EAAE;gBAAE,SAAS;QACjC,CAAC;QACD,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAY;IACnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI;QAC9C,OAAO,CAAC,0DAA0D,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAC7D,OAAO,CAAC,4BAA4B,CAAC,CAAC;QACxC,OAAO,KAAgC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,IAAY;IACnD,KAAK,MAAM,IAAI,IAAI,CAAC,wBAAwB,EAAE,2BAA2B,CAAC;QACxE,IAAI,MAAM,IAAI,CAAC,IAAI,EAAE,yBAAyB,IAAI,EAAE,CAAC;YAAE,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO;IAC3B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;QAAE,OAAO,CAAC,iCAAiC,CAAC,CAAC;IACrE,IAAI,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,WAAW,cAAc,CAAC;QAAE,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IACzD,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,OAAO,CAAC,8BAA8B,CAAC,CAAC;YAC3E,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,WAAW,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI;YAClD,OAAO,CAAC,gDAAgD,CAAC,CAAC;QAC5D,IAAI,QAAiB,CAAC;QACtB,IAAI,WAAW,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7C,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,4CAA4C,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,QAAQ,KAAK,uBAAuB,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS;gBAAE,OAAO,CAAC,4CAA4C,CAAC,CAAC;YACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,WAAW,CAC7B,IAAI,EACJ,gDAAgD,KAAK,CAAC,CAAC,CAAC,OAAO,CAChE,CAAC;YACF,IACE,KAAK,CAAC,IAAI,KAAK,SAAS;gBACxB,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC;gBAC7B,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;gBACzB,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;gBACvB,CAAC,CAAC,mCAAmC,EAAE,0CAA0C,CAAC,CAAC,QAAQ,CACzF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CACrB;gBACD,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC;gBAC7B,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;gBAC1C,KAAK,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;gBAChD,KAAK,CAAC,cAAc,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC5E,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;oBAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC/B,IACE,KAAK,CAAC,IAAI,KAAK,QAAQ;wBACvB,KAAK,CAAC,MAAM,KAAK,0CAA0C;wBAE3D,OAAO,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAC9E,OAAO,CACL,KAAK,CAAC,IAAI,KAAK,aAAa;wBAC5B,KAAK,CAAC,SAAS,KAAK,KAAK;wBACzB,KAAK,CAAC,gBAAgB,KAAK,KAAK,CACjC,CAAC;gBACJ,CAAC,CAAC;gBAEF,OAAO,CAAC,qCAAqC,CAAC,CAAC;YACjD,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,KAAK,WAAW;YAAE,OAAO,CAAC,mCAAmC,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,WAAW,CAC/B,IAAI,EACJ,4CAA4C,KAAK,CAAC,CAAC,CAAC,OAAO,CAC5D,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,qDAAqD,CAAC,CAAC;QAC/F,IACE,OAAO,CAAC,MAAM,KAAK,8BAA8B;YACjD,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC;YAC/B,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC;YAE/B,OAAO,CAAC,wCAAwC,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,IAAY;IAC5D,MAAM,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACtC,KAAK,MAAM,MAAM,IAAI,WAAW;QAC9B,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,OAAO,CAAC,uCAAuC,MAAM,EAAE,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO;IAC3B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;QAAE,OAAO,CAAC,2CAA2C,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtD,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,UAAU,KAAK,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,WAAW,EAAE;YAAE,SAAS;QACvE,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,MAAM,EAAE;YAAE,SAAS;QAClF,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;YAAE,OAAO,CAAC,+CAA+C,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;AACH,CAAC"}

package/dist/services/install-storage-boundary.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=install-storage-boundary.test.d.ts.map

package/dist/services/install-storage-boundary.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-storage-boundary.test.d.ts","sourceRoot":"","sources":["../../src/services/install-storage-boundary.test.ts"],"names":[],"mappings":""}

package/dist/services/install-storage-boundary.test.js

@@ -0,0 +1,110 @@
+import { createHash } from "node:crypto";
+import { mkdir, mkdtemp, readdir, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { afterEach, expect, it } from "vitest";
+import { installAgentsTemplate } from "./install-agents-template.js";
+import { assertInstallerStorageReady } from "./install-storage-boundary.js";
+const roots = [];
+it("accepts only a bound cancellation before copy and rejects a forged cancellation", async () => {
+    const f = await fixture(), generation = "a".repeat(64), replacement = "b".repeat(64);
+    const before = `${JSON.stringify({ type: "started", generation, task: "TASK-FIXTURE", run: "RUN-FIXTURE" })}\n${JSON.stringify({ type: "interrupted", activated: false, deletion_started: false })}\n`;
+    const hash = createHash("sha256").update(before).digest("hex");
+    const path = `.agents/private/state/storage-cutover/${generation}.jsonl`;
+    await f.put(path, before +
+        `${JSON.stringify({ type: "preparation_cancelled", replacement, journal_sha256: hash })}\n`);
+    await expect(assertInstallerStorageReady(f.root)).rejects.toThrow(/storage_migration_pending/);
+    const proof = {
+        status: "preparation_cancelled_before_copy",
+        generation,
+        replacement,
+        task: "TASK-FIXTURE",
+        run: "RUN-FIXTURE",
+        journal_sha256: hash,
+    };
+    await f.put(`.agents/state/storage-migrations/preparation-${generation}.json`, JSON.stringify(proof));
+    await expect(assertInstallerStorageReady(f.root)).resolves.toBeUndefined();
+    await f.put(path, before.replace('"activated":false', '"activated":true') +
+        `${JSON.stringify({ type: "preparation_cancelled", replacement, journal_sha256: hash })}\n`);
+    await expect(assertInstallerStorageReady(f.root)).rejects.toThrow(/proof differs/);
+});
+afterEach(async () => {
+    await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })));
+});
+async function fixture() {
+    const parent = await mkdtemp(join(tmpdir(), "zaip-install-storage-"));
+    roots.push(parent);
+    const root = join(parent, "project"), template = join(parent, "template");
+    await mkdir(root);
+    await mkdir(template);
+    const emptyDigest = createHash("sha256").digest("hex");
+    await writeFile(join(template, "template-manifest.json"), JSON.stringify({
+        schemaVersion: 1,
+        templateVersion: "7.5.0",
+        minimumCliVersion: "7.5.0",
+        source: "isolated-test",
+        sourceFilesSha256: emptyDigest,
+        runtimeFilesSha256: emptyDigest,
+        files: [],
+    }));
+    const put = async (name, value) => {
+        await mkdir(dirname(join(root, name)), { recursive: true });
+        await writeFile(join(root, name), value);
+    };
+    return { root, template, put };
+}
+async function snapshot(root, prefix = "") {
+    const result = {};
+    for (const entry of await readdir(join(root, prefix), { withFileTypes: true })) {
+        const path = prefix ? `${prefix}/${entry.name}` : entry.name;
+        if (entry.isDirectory()) {
+            result[`${path}/`] = "";
+            Object.assign(result, await snapshot(root, path));
+        }
+        else
+            result[path] = (await readFile(join(root, path))).toString("base64");
+    }
+    return result;
+}
+it.each([
+    ".local/dashboard-sqlite/read-model.sqlite",
+    ".local/zaip-node/node.exe",
+    ".local/developer-identity.json",
+    ".local/autonomous/astra-diagnostic-quota/TASK-ONE/reservation.json",
+    ".local/hooks/receipt.json",
+    ".local/rapid-validation-cache-proposal.json",
+    ".agents/local/claims/old.json",
+    ".agents/state/claims/old.json",
+    ".zaip-aios/local-data/recovery/old.json",
+    ".agents/private/state/storage-cutover/active.lock",
+    ".agents/private/state/storage-migration.lock",
+    `.agents/private/state/storage-cutover/${"a".repeat(64)}.jsonl`,
+])("refuses forced upgrade before effects when %s requires recovery", async (pending) => {
+    const f = await fixture();
+    for (const path of [
+        ".agents/runtime/bin/zaip.mjs",
+        ".codex/hooks/zaip-pre-tool-use.mjs",
+        ".codex/config.toml",
+        ".agents/config/framework.lock.yaml",
+    ])
+        await f.put(path, "sentinel-before-upgrade\n");
+    await f.put(pending, pending.endsWith(".jsonl") ? '{"type":"started"}\n' : "private-fact");
+    const before = await snapshot(f.root);
+    for (const force of [false, true]) {
+        await expect(installAgentsTemplate({ cwd: f.root, templateDirectory: f.template, force, yes: true })).rejects.toThrow(/storage_migration_pending/);
+        expect(await snapshot(f.root)).toEqual(before);
+    }
+});
+it.each([false, true])("permits fresh/cache-only installation (cache=%s)", async (cache) => {
+    const f = await fixture();
+    if (cache) {
+        await f.put(".local/temp/test.log", "reproducible");
+        await f.put(".local/cache/rebuilt.bin", "reproducible");
+        await f.put(".local/sqlite/dashboard.sqlite", "reproducible");
+        await f.put(".local/.gitignore", "*\n!.gitignore\n");
+    }
+    await expect(installAgentsTemplate({ cwd: f.root, templateDirectory: f.template, force: true, yes: true })).resolves.toMatchObject({ applied: true });
+    if (cache)
+        expect(await readFile(join(f.root, ".local/temp/test.log"), "utf8")).toBe("reproducible");
+});
+//# sourceMappingURL=install-storage-boundary.test.js.map

package/dist/services/install-storage-boundary.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-storage-boundary.test.js","sourceRoot":"","sources":["../../src/services/install-storage-boundary.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAE5E,MAAM,KAAK,GAAa,EAAE,CAAC;AAC3B,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;IAC/F,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,EACvB,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAC3B,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC;IACvM,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,yCAAyC,UAAU,QAAQ,CAAC;IACzE,MAAM,CAAC,CAAC,GAAG,CACT,IAAI,EACJ,MAAM;QACJ,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,WAAW,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,IAAI,CAC9F,CAAC;IACF,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG;QACZ,MAAM,EAAE,mCAAmC;QAC3C,UAAU;QACV,WAAW;QACX,IAAI,EAAE,cAAc;QACpB,GAAG,EAAE,aAAa;QAClB,cAAc,EAAE,IAAI;KACrB,CAAC;IACF,MAAM,CAAC,CAAC,GAAG,CACT,gDAAgD,UAAU,OAAO,EACjE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CACtB,CAAC;IACF,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IAC3E,MAAM,CAAC,CAAC,GAAG,CACT,IAAI,EACJ,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACrD,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,WAAW,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,IAAI,CAC9F,CAAC;IACF,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;AACrF,CAAC,CAAC,CAAC;AACH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,OAAO;IACpB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACtE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAClC,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtB,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,SAAS,CACb,IAAI,CAAC,QAAQ,EAAE,wBAAwB,CAAC,EACxC,IAAI,CAAC,SAAS,CAAC;QACb,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,OAAO;QACxB,iBAAiB,EAAE,OAAO;QAC1B,MAAM,EAAE,eAAe;QACvB,iBAAiB,EAAE,WAAW;QAC9B,kBAAkB,EAAE,WAAW;QAC/B,KAAK,EAAE,EAAE;KACV,CAAC,CACH,CAAC;IACF,MAAM,GAAG,GAAG,KAAK,EAAE,IAAY,EAAE,KAAa,EAAE,EAAE;QAChD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,MAAM,GAAG,EAAE;IAC/C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC7D,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;YACxB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACpD,CAAC;;YAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,EAAE,CAAC,IAAI,CAAC;IACN,2CAA2C;IAC3C,2BAA2B;IAC3B,gCAAgC;IAChC,oEAAoE;IACpE,2BAA2B;IAC3B,6CAA6C;IAC7C,+BAA+B;IAC/B,+BAA+B;IAC/B,yCAAyC;IACzC,mDAAmD;IACnD,8CAA8C;IAC9C,yCAAyC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ;CAChE,CAAC,CAAC,iEAAiE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;IACtF,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI;QACjB,8BAA8B;QAC9B,oCAAoC;QACpC,oBAAoB;QACpB,oCAAoC;KACrC;QACC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;IACjD,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,MAAM,CACV,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CACxF,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,kDAAkD,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;IACzF,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,cAAc,CAAC,CAAC;QACpD,MAAM,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,cAAc,CAAC,CAAC;QACxD,MAAM,CAAC,CAAC,GAAG,CAAC,gCAAgC,EAAE,cAAc,CAAC,CAAC;QAC9D,MAAM,CAAC,CAAC,GAAG,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,MAAM,CACV,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAC9F,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,IAAI,KAAK;QACP,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAC9F,CAAC,CAAC,CAAC"}

package/dist/services/install-template-backup.d.ts

@@ -0,0 +1,3 @@
+export declare function createBackup(root: string, backupPath: string, currentFiles: ReadonlyMap<string, Buffer>): Promise<void>;
+export declare function availableBackupPath(root: string, now?: Date): Promise<string>;
+//# sourceMappingURL=install-template-backup.d.ts.map

package/dist/services/install-template-backup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-template-backup.d.ts","sourceRoot":"","sources":["../../src/services/install-template-backup.ts"],"names":[],"mappings":"AAEA,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACxC,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CASzF"}

package/dist/services/install-template-backup.js

@@ -0,0 +1,46 @@
+import { cp, lstat, mkdir, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+export async function createBackup(root, backupPath, currentFiles) {
+    const agentsPath = resolve(root, ".agents");
+    const agentsInfo = await lstat(agentsPath).catch((error) => {
+        if (isNotFound(error))
+            return null;
+        throw error;
+    });
+    if (agentsInfo?.isDirectory()) {
+        await cp(agentsPath, backupPath, { recursive: true, errorOnExist: true, force: false });
+    }
+    else {
+        await mkdir(backupPath, { recursive: false });
+    }
+    for (const [path, content] of currentFiles) {
+        if (path.startsWith(".agents/"))
+            continue;
+        const destination = resolve(backupPath, "_adapters", path);
+        await mkdir(dirname(destination), { recursive: true });
+        await writeFile(destination, content, { flag: "wx" });
+    }
+}
+export async function availableBackupPath(root, now = new Date()) {
+    const stamp = now.toISOString().slice(0, 19).replaceAll(":", "");
+    const base = resolve(root, `.agents.backup-${stamp}`);
+    if (!(await pathExists(base)))
+        return base;
+    for (let suffix = 2; suffix < 10_000; suffix += 1) {
+        const candidate = `${base}-${suffix}`;
+        if (!(await pathExists(candidate)))
+            return candidate;
+    }
+    throw new Error("Could not allocate a unique .agents backup path");
+}
+async function pathExists(path) {
+    return lstat(path).then(() => true, (error) => {
+        if (isNotFound(error))
+            return false;
+        throw error;
+    });
+}
+function isNotFound(error) {
+    return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+//# sourceMappingURL=install-template-backup.js.map

package/dist/services/install-template-backup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-template-backup.js","sourceRoot":"","sources":["../../src/services/install-template-backup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,UAAkB,EAClB,YAAyC;IAEzC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAClE,IAAI,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,IAAI,UAAU,EAAE,WAAW,EAAE,EAAE,CAAC;QAC9B,MAAM,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1F,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,YAAY,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,SAAS;QAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IACtE,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,kBAAkB,KAAK,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;IACvD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CACrB,GAAG,EAAE,CAAC,IAAI,EACV,CAAC,KAAc,EAAE,EAAE;QACjB,IAAI,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,MAAM,KAAK,CAAC;IACd,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC9E,CAAC"}

package/dist/services/install-template-lock.d.ts

@@ -0,0 +1,2 @@
+export declare function lockEntries(lock: string): ReadonlyMap<string, string>;
+//# sourceMappingURL=install-template-lock.d.ts.map

package/dist/services/install-template-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-template-lock.d.ts","sourceRoot":"","sources":["../../src/services/install-template-lock.ts"],"names":[],"mappings":"AAAA,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CA6BrE"}

package/dist/services/install-template-lock.js

@@ -0,0 +1,32 @@
+export function lockEntries(lock) {
+    const result = new Map();
+    const lines = lock.split(/\r?\n/);
+    let inManaged = false;
+    let current = null;
+    for (const line of lines) {
+        if (line === "managed_files:") {
+            inManaged = true;
+            continue;
+        }
+        if (!inManaged)
+            continue;
+        const compactMatch = /^ {2}(?:"([^"]+)"|([^:]+)): ([a-f0-9]{64})$/.exec(line);
+        if (compactMatch !== null) {
+            result.set(compactMatch[1] ?? compactMatch[2], compactMatch[3]);
+            current = null;
+            continue;
+        }
+        const pathMatch = /^ {2}(?:"([^"]+)"|([^:]+)):$/.exec(line);
+        if (pathMatch !== null) {
+            current = pathMatch[1] ?? pathMatch[2] ?? null;
+            continue;
+        }
+        const hashMatch = /^ {4}sha256: ([a-f0-9]{64})$/.exec(line);
+        if (current !== null && hashMatch !== null) {
+            result.set(current, hashMatch[1]);
+            current = null;
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=install-template-lock.js.map

package/dist/services/install-template-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-template-lock.js","sourceRoot":"","sources":["../../src/services/install-template-lock.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC9B,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,MAAM,YAAY,GAAG,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9E,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAK,YAAY,CAAC,CAAC,CAAY,EAAE,YAAY,CAAC,CAAC,CAAW,CAAC,CAAC;YACtF,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,OAAO,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAW,CAAC,CAAC;YAC5C,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/services/install-template-policy.d.ts

@@ -1,3 +1,19 @@
 export declare const PROJECT_OVERVIEW_ARTIFACTS: Set<string>;
+export declare function isProjectOwnedMakerPath(path: string): boolean;
+export declare function isProjectOwnedArchitecturePath(path: string): boolean;
+/** Only this portable Terraform root is seeded once; other infra paths keep their policy. */
+export declare function isProjectOwnedTerraformPath(path: string): boolean;
+type InspectedSeed = {
+    file: {
+        path: string;
+        content: string | Buffer;
+    };
+    current: Buffer | null;
+};
+/** No HCL inference: add missing seeds only to an empty root or an exact known foundation. */
+export declare function omittedTerraformSeeds(root: string, inspected: readonly InspectedSeed[], currentManaged: ReadonlyMap<string, string>): Promise<ReadonlySet<string>>;
+export declare function hasAlternateArchitecturePrincipal(root: string): Promise<boolean>;
 export declare function retiredTemplatePaths(currentManaged: ReadonlyMap<string, string>, renderedPaths: ReadonlySet<string>): readonly string[];
+export declare const FLAT_FRAMEWORK_RULES: Set<string>;
+export {};
 //# sourceMappingURL=install-template-policy.d.ts.map

package/dist/services/install-template-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-template-policy.d.ts","sourceRoot":"","sources":["../../src/services/install-template-policy.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,0BAA0B,aAWrC,CAAC;AAEH,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3C,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,GACjC,SAAS,MAAM,EAAE,CAUnB"}
+{"version":3,"file":"install-template-policy.d.ts","sourceRoot":"","sources":["../../src/services/install-template-policy.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,0BAA0B,aAYrC,CAAC;AAEH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAI7D;AACD,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpE;AAED,6FAA6F;AAC7F,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED,KAAK,aAAa,GAAG;IACnB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IACjD,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CAAC;AAYF,8FAA8F;AAC9F,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,aAAa,EAAE,EACnC,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAC1C,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAuB9B;AACD,wBAAsB,iCAAiC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUtF;AAED,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3C,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,GACjC,SAAS,MAAM,EAAE,CAWnB;AACD,eAAO,MAAM,oBAAoB,aAe/B,CAAC"}

package/dist/services/install-template-policy.js

@@ -1,3 +1,6 @@
+import { createHash } from "node:crypto";
+import { readdir } from "node:fs/promises";
+import { resolve } from "node:path";
 const RETIRED_MANAGED_TEMPLATE_PATHS = [
     ".agents/skills/zaip-skill-github-npm-deploy/SKILL.md",
     ".agents/skills/zaip-skill-github-npm-deploy/agents/openai.yaml",
@@ -7,6 +10,7 @@ export const PROJECT_OVERVIEW_ARTIFACTS = new Set([
     "tsconfig.base.json",
     // Seed once, then preserve preferences even during a forced framework upgrade.
     ".agents/config/deploy-policy.json",
+    ".agents/config/autonomous-cloud-inputs.json",
     ".agents/architecture/software-architecture.md",
     ".agents/design/DESIGN.md",
     ".agents/branding/brandbook.md",
@@ -14,12 +18,80 @@ export const PROJECT_OVERVIEW_ARTIFACTS = new Set([
     ".agents/sales/playbook.md",
     ".agents/growth/strategy.md",
 ]);
+export function isProjectOwnedMakerPath(path) {
+    return /^\.agents\/design\/design-system-maker\/(?:data|uploads?|exports?|history|\.local|_outputs)(?:\/|$)/i.test(path);
+}
+export function isProjectOwnedArchitecturePath(path) {
+    return path.startsWith(".agents/architecture/");
+}
+/** Only this portable Terraform root is seeded once; other infra paths keep their policy. */
+export function isProjectOwnedTerraformPath(path) {
+    return path.startsWith("infra/terraform/");
+}
+const terraformFoundationFiles = ["main.tf", "variables.tf", "versions.tf"];
+// Exact LF-normalized variables.tf from fad9e426c81c3a5b1458ae8b5dade465553ad117.
+// Only its explanatory manage_vps description differs; schema is unchanged.
+const legacyTerraformFoundationHashes = {
+    "infra/terraform/variables.tf": [
+        "4777b3633760d90204eede59ea85bcbfdf65e9a481edfe54b30767decff17db5",
+    ],
+};
+const normalizedSeedHash = (content) => createHash("sha256").update(content.toString().replaceAll("\r\n", "\n")).digest("hex");
+/** No HCL inference: add missing seeds only to an empty root or an exact known foundation. */
+export async function omittedTerraformSeeds(root, inspected, currentManaged) {
+    const missing = inspected.filter(({ file, current }) => isProjectOwnedTerraformPath(file.path) && current === null);
+    if (missing.length === 0)
+        return new Set();
+    const existing = await readdir(resolve(root, "infra/terraform")).catch((error) => {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    });
+    if (existing.length === 0)
+        return new Set();
+    const knownFoundation = terraformFoundationFiles.every((name) => {
+        const entry = inspected.find(({ file }) => file.path === `infra/terraform/${name}`);
+        if (entry?.current === null || entry?.current === undefined)
+            return false;
+        if (normalizedSeedHash(entry.current) === normalizedSeedHash(entry.file.content))
+            return true;
+        return (legacyTerraformFoundationHashes[entry.file.path]?.includes(normalizedSeedHash(entry.current)) === true &&
+            currentManaged.get(entry.file.path) ===
+                createHash("sha256").update(entry.current).digest("hex"));
+    });
+    return new Set(knownFoundation ? [] : missing.map(({ file }) => file.path));
+}
+export async function hasAlternateArchitecturePrincipal(root) {
+    const entries = await readdir(resolve(root, ".agents/architecture")).catch((error) => {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    });
+    return (!entries.includes("software-architecture.md") && entries.some((name) => name.endsWith(".md")));
+}
 export function retiredTemplatePaths(currentManaged, renderedPaths) {
     return [
         ...RETIRED_MANAGED_TEMPLATE_PATHS,
-        ...[...currentManaged.keys()].filter((path) => !renderedPaths.has(path) &&
+        ...[...currentManaged.keys()].filter((path) => !isProjectOwnedMakerPath(path) &&
+            !renderedPaths.has(path) &&
             (path.startsWith(".agents/dashboard/apps/frontend/dist/") ||
                 path.startsWith(".agents/design/apps/catalog/dist/"))),
     ];
 }
+export const FLAT_FRAMEWORK_RULES = new Set([
+    ".agents/rules/core.md",
+    ".agents/rules/workflow.md",
+    ".agents/rules/architecture.md",
+    ".agents/rules/autonomy-decision.md",
+    ".agents/rules/security.md",
+    ".agents/rules/context.md",
+    ".agents/rules/dashboard-ui-consistency.md",
+    ".agents/rules/evolution.md",
+    ".agents/rules/frontend-lite.md",
+    ".agents/rules/model-orchestration.md",
+    ".agents/rules/run-lifecycle-closure.md",
+    ".agents/rules/specialist-routing.md",
+    ".agents/rules/text-writing-utf8.md",
+    ".agents/rules/.gitkeep",
+]);
 //# sourceMappingURL=install-template-policy.js.map

package/dist/services/install-template-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"install-template-policy.js","sourceRoot":"","sources":["../../src/services/install-template-policy.ts"],"names":[],"mappings":"AAAA,MAAM,8BAA8B,GAAG;IACrC,sDAAsD;IACtD,gEAAgE;CACxD,CAAC;AACX,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IAChD,gFAAgF;IAChF,oBAAoB;IACpB,+EAA+E;IAC/E,mCAAmC;IACnC,+CAA+C;IAC/C,0BAA0B;IAC1B,+BAA+B;IAC/B,+BAA+B;IAC/B,2BAA2B;IAC3B,4BAA4B;CAC7B,CAAC,CAAC;AAEH,MAAM,UAAU,oBAAoB,CAClC,cAA2C,EAC3C,aAAkC;IAElC,OAAO;QACL,GAAG,8BAA8B;QACjC,GAAG,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAClC,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;YACxB,CAAC,IAAI,CAAC,UAAU,CAAC,uCAAuC,CAAC;gBACvD,IAAI,CAAC,UAAU,CAAC,mCAAmC,CAAC,CAAC,CAC1D;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"install-template-policy.js","sourceRoot":"","sources":["../../src/services/install-template-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,8BAA8B,GAAG;IACrC,sDAAsD;IACtD,gEAAgE;CACxD,CAAC;AACX,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IAChD,gFAAgF;IAChF,oBAAoB;IACpB,+EAA+E;IAC/E,mCAAmC;IACnC,6CAA6C;IAC7C,+CAA+C;IAC/C,0BAA0B;IAC1B,+BAA+B;IAC/B,+BAA+B;IAC/B,2BAA2B;IAC3B,4BAA4B;CAC7B,CAAC,CAAC;AAEH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,sGAAsG,CAAC,IAAI,CAChH,IAAI,CACL,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,8BAA8B,CAAC,IAAY;IACzD,OAAO,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;AAClD,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,OAAO,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAC7C,CAAC;AAMD,MAAM,wBAAwB,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;AAC5E,kFAAkF;AAClF,4EAA4E;AAC5E,MAAM,+BAA+B,GAAgD;IACnF,8BAA8B,EAAE;QAC9B,kEAAkE;KACnE;CACF,CAAC;AACF,MAAM,kBAAkB,GAAG,CAAC,OAAwB,EAAU,EAAE,CAC9D,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEzF,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAY,EACZ,SAAmC,EACnC,cAA2C;IAE3C,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAC9B,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,IAAI,CAClF,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACxF,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAClE,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC5C,MAAM,eAAe,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;QAC9D,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,mBAAmB,IAAI,EAAE,CAAC,CAAC;QACpF,IAAI,KAAK,EAAE,OAAO,KAAK,IAAI,IAAI,KAAK,EAAE,OAAO,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC1E,IAAI,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9F,OAAO,CACL,+BAA+B,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CACxD,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAClC,KAAK,IAAI;YACV,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;gBACjC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAC3D,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9E,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,IAAY;IAClE,MAAM,OAAO,GAAa,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAClF,CAAC,KAAc,EAAE,EAAE;QACjB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAClE,MAAM,KAAK,CAAC;IACd,CAAC,CACF,CAAC;IACF,OAAO,CACL,CAAC,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAC9F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,cAA2C,EAC3C,aAAkC;IAElC,OAAO;QACL,GAAG,8BAA8B;QACjC,GAAG,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAClC,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,uBAAuB,CAAC,IAAI,CAAC;YAC9B,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;YACxB,CAAC,IAAI,CAAC,UAAU,CAAC,uCAAuC,CAAC;gBACvD,IAAI,CAAC,UAAU,CAAC,mCAAmC,CAAC,CAAC,CAC1D;KACF,CAAC;AACJ,CAAC;AACD,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IAC1C,uBAAuB;IACvB,2BAA2B;IAC3B,+BAA+B;IAC/B,oCAAoC;IACpC,2BAA2B;IAC3B,0BAA0B;IAC1B,2CAA2C;IAC3C,4BAA4B;IAC5B,gCAAgC;IAChC,sCAAsC;IACtC,wCAAwC;IACxC,qCAAqC;IACrC,oCAAoC;IACpC,wBAAwB;CACzB,CAAC,CAAC"}

package/dist/services/install-template-render.d.ts

@@ -0,0 +1,11 @@
+import { type AdapterClients } from "./client-selection.js";
+import type { LoadedTemplateFile } from "./template-manifest.js";
+export interface RenderedFile {
+    path: string;
+    content: string | Buffer;
+    kind: "template" | "adapter";
+    expectedAbsent?: boolean;
+}
+/** Render only selected projections before deriving managed-file ownership. */
+export declare function renderTemplate(files: readonly LoadedTemplateFile[], projectName: string, frameworkVersion: string, clients: AdapterClients): RenderedFile[];
+//# sourceMappingURL=install-template-render.d.ts.map

package/dist/services/install-template-render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-template-render.d.ts","sourceRoot":"","sources":["../../src/services/install-template-render.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,cAAc,EAA0B,MAAM,uBAAuB,CAAC;AASpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS,kBAAkB,EAAE,EACpC,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE,cAAc,GACtB,YAAY,EAAE,CAgDhB"}

package/dist/services/install-template-render.js

@@ -0,0 +1,53 @@
+import { AGENT_CATALOG_PATH } from "./agent-catalog-upgrade.js";
+import { isClientAdapterEnabled } from "./client-selection.js";
+import { renderProjectClients } from "./install-client-selection.js";
+import { isProjectOwnedArchitecturePath, isProjectOwnedMakerPath, isProjectOwnedTerraformPath, PROJECT_OVERVIEW_ARTIFACTS, } from "./install-template-policy.js";
+import { frameworkLock } from "./render-framework-lock.js";
+/** Render only selected projections before deriving managed-file ownership. */
+export function renderTemplate(files, projectName, frameworkVersion, clients) {
+    const projectId = normalizeProjectId(projectName);
+    const rendered = files
+        .filter((file) => file.path !== ".agents/config/framework.lock.yaml" &&
+        !isProjectOwnedMakerPath(file.path) &&
+        isClientAdapterEnabled(file.path, clients))
+        .map((file) => ({
+        path: file.path,
+        content: typeof file.content === "string"
+            ? file.content
+                .replaceAll("{{PROJECT_NAME}}", JSON.stringify(projectName))
+                .replaceAll("{{PROJECT_ID}}", JSON.stringify(projectId))
+            : file.content,
+        kind: "template",
+    }));
+    const config = rendered.find((file) => file.path === ".agents/config/project.yaml");
+    if (config && typeof config.content === "string")
+        config.content = renderProjectClients(config.content, clients);
+    // Match seed-once consumer ownership so legitimate DESIGN edits remain valid.
+    const designManifest = rendered.find((file) => file.path === ".agents/design/.zaip-managed.json");
+    if (designManifest && typeof designManifest.content === "string") {
+        const manifest = JSON.parse(designManifest.content);
+        manifest.files = manifest.files.filter((file) => !PROJECT_OVERVIEW_ARTIFACTS.has(`.agents/design/${file.path}`) &&
+            !isProjectOwnedMakerPath(`.agents/design/${file.path}`));
+        designManifest.content = `${JSON.stringify(manifest, null, 2)}\n`;
+    }
+    const managed = rendered.filter((file) => (file.path === AGENT_CATALOG_PATH || !file.path.startsWith(".agents/config/")) &&
+        !PROJECT_OVERVIEW_ARTIFACTS.has(file.path) &&
+        !isProjectOwnedTerraformPath(file.path) &&
+        !isProjectOwnedArchitecturePath(file.path));
+    rendered.push({
+        path: ".agents/config/framework.lock.yaml",
+        content: frameworkLock(managed, frameworkVersion),
+        kind: "template",
+    });
+    return rendered;
+}
+function normalizeProjectId(name) {
+    const normalized = name
+        .normalize("NFKD")
+        .replace(/[\u0300-\u036f]/g, "")
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+    return normalized || "zaip-project";
+}
+//# sourceMappingURL=install-template-render.js.map