botmux 3.10.0 → 3.11.0

package/dist/cli/pm2-exact-start.js

@@ -0,0 +1,63 @@
+function errorText(error) {
+    if (error instanceof Error)
+        return error.message;
+    if (typeof error === 'string')
+        return error;
+    try {
+        return JSON.stringify(error);
+    }
+    catch {
+        return String(error);
+    }
+}
+/** `God.startProcessId` rejects these states before executeApp and therefore
+ * cannot have killed or restarted a live generation. The final jlist remains
+ * authoritative about whether the fleet is available. */
+export function isNonMutatingPm2StartRefusal(error) {
+    return /(?:\bid unknown\b|process already online|process already started|process with pid \d+ already exists)/i
+        .test(errorText(error));
+}
+function launchRpc(client) {
+    return new Promise((resolve, reject) => {
+        client.launchRPC(error => error ? reject(error) : resolve());
+    });
+}
+function closeRpc(client) {
+    return new Promise(resolve => client.close(() => resolve()));
+}
+function startExactProcessId(client, processId) {
+    return new Promise(resolve => {
+        client.executeRemote('startProcessId', processId, error => {
+            if (!error || isNonMutatingPm2StartRefusal(error)) {
+                resolve(null);
+                return;
+            }
+            resolve(`pm_id ${processId}: ${errorText(error)}`);
+        });
+    });
+}
+/** Connect once and concurrently issue PM2's conditional startProcessId RPC
+ * for distinct exact registry identities. The caller must hold Botmux's shared
+ * fleet-operation lock: PM2 checks a row before an async fork and is not itself
+ * a CAS across two clients. Unlike `pm2 start <name|id>`, this never routes
+ * through restartProcessId or intentionally interrupts a live successor. */
+export async function startExactPm2ProcessIds(processIds, client) {
+    const uniqueIds = [...new Set(processIds)];
+    if (uniqueIds.length !== processIds.length
+        || uniqueIds.some(id => !Number.isInteger(id) || id < 0)) {
+        throw new Error('exact PM2 compensation requires unique non-negative pm_id values');
+    }
+    if (uniqueIds.length === 0)
+        return;
+    await launchRpc(client);
+    try {
+        const failures = (await Promise.all(uniqueIds.map(id => startExactProcessId(client, id)))).filter((failure) => !!failure);
+        if (failures.length > 0) {
+            throw new Error(`conditional PM2 start failed (${failures.join('; ')})`);
+        }
+    }
+    finally {
+        await closeRpc(client);
+    }
+}
+//# sourceMappingURL=pm2-exact-start.js.map

package/dist/cli/pm2-exact-start.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pm2-exact-start.js","sourceRoot":"","sources":["../../src/cli/pm2-exact-start.ts"],"names":[],"mappings":"AAUA,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;AACvE,CAAC;AAED;;yDAEyD;AACzD,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,OAAO,wGAAwG;SAC5G,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,SAAS,CAAC,MAA2B;IAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,MAA2B;IAC3C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAA2B,EAC3B,SAAiB;IAEjB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,MAAM,CAAC,aAAa,CAAC,gBAAgB,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE;YACxD,IAAI,CAAC,KAAK,IAAI,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClD,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,OAAO,CAAC,SAAS,SAAS,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;4EAI4E;AAC5E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAAoB,EACpB,MAA2B;IAE3B,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3C,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;WACrC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEnC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CACjC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CACrD,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAqB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/cli/pm2-god-admission.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Node's process.kill is PID-addressed and PM2's `kill` RPC is PM2_HOME/socket
+ * addressed; neither binds a signal to a PID+birth generation. Therefore a
+ * live God cannot be safely replaced automatically. This admission check must
+ * run before any fleet or breadcrumb mutation.
+ */
+export declare function assertIncludePm2RestartAdmission(pids: readonly number[]): void;
+//# sourceMappingURL=pm2-god-admission.d.ts.map

package/dist/cli/pm2-god-admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pm2-god-admission.d.ts","sourceRoot":"","sources":["../../src/cli/pm2-god-admission.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAoB9E"}

package/dist/cli/pm2-god-admission.js

@@ -0,0 +1,25 @@
+/**
+ * Node's process.kill is PID-addressed and PM2's `kill` RPC is PM2_HOME/socket
+ * addressed; neither binds a signal to a PID+birth generation. Therefore a
+ * live God cannot be safely replaced automatically. This admission check must
+ * run before any fleet or breadcrumb mutation.
+ */
+export function assertIncludePm2RestartAdmission(pids) {
+    const canonical = [...new Set(pids)]
+        .filter(pid => Number.isSafeInteger(pid) && pid > 1)
+        .sort((a, b) => a - b);
+    if (canonical.length !== pids.length) {
+        throw new Error('[restart --include-pm2] PM2 God scan returned invalid/duplicate PIDs');
+    }
+    if (canonical.length === 0)
+        return;
+    if (canonical.length > 1) {
+        throw new Error(`[restart --include-pm2] multiple PM2 God daemons are visible `
+            + `(pids: ${canonical.join(', ')}); no process or breadcrumb was changed`);
+    }
+    throw new Error(`[restart --include-pm2] refusing before fleet mutation: live PM2 God pid ${canonical[0]} `
+        + 'cannot be signalled with generation-bound authority on this platform; '
+        + 'this option does not signal or restart an existing God; '
+        + 'no process or breadcrumb was changed');
+}
+//# sourceMappingURL=pm2-god-admission.js.map

package/dist/cli/pm2-god-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pm2-god-admission.js","sourceRoot":"","sources":["../../src/cli/pm2-god-admission.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAAC,IAAuB;IACtE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;SACjC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;SACnD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,IAAI,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACnC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,+DAA+D;cAC7D,UAAU,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,yCAAyC,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CACb,4EAA4E,SAAS,CAAC,CAAC,CAAC,GAAG;UACzF,wEAAwE;UACxE,0DAA0D;UAC1D,sCAAsC,CACzC,CAAC;AACJ,CAAC"}

package/dist/cli/pm2-jlist.d.ts

@@ -0,0 +1,13 @@
+export declare function parsePm2Integer(value: unknown, options?: {
+    nonNegative?: boolean;
+}): number | undefined;
+/** PM2 RPC addresses the canonical top-level pm_id. A nested pm2_env.pm_id can
+ * be a stale serialized copy and must never resurrect an absent/null identity. */
+export declare function parseCanonicalPm2Id(app: unknown): number | undefined;
+/** Forgiving parser for read-only/status surfaces. */
+export declare function parsePm2JlistOutput(output: string): any[];
+/** Shutdown authority must never interpret `{}`, `null`, or malformed output
+ * as an empty fleet: doing so would allow a later name-based PM2 mutation to
+ * bypass graceful shutdown of live daemons. */
+export declare function parsePm2JlistOutputStrict(output: string): any[];
+//# sourceMappingURL=pm2-jlist.d.ts.map

package/dist/cli/pm2-jlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pm2-jlist.d.ts","sourceRoot":"","sources":["../../src/cli/pm2-jlist.ts"],"names":[],"mappings":"AAKA,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,EACd,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GACtC,MAAM,GAAG,SAAS,CAQpB;AAED;kFACkF;AAClF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGpE;AA+ED,sDAAsD;AACtD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,EAAE,CAGzD;AAED;;+CAE+C;AAC/C,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,EAAE,CAW/D"}

package/dist/cli/pm2-jlist.js

@@ -0,0 +1,108 @@
+export function parsePm2Integer(value, options = {}) {
+    if (value === null || value === undefined)
+        return undefined;
+    if (typeof value === 'string' && !/^-?\d+$/.test(value.trim()))
+        return undefined;
+    if (typeof value !== 'number' && typeof value !== 'string')
+        return undefined;
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed))
+        return undefined;
+    if (options.nonNegative && parsed < 0)
+        return undefined;
+    return parsed;
+}
+/** PM2 RPC addresses the canonical top-level pm_id. A nested pm2_env.pm_id can
+ * be a stale serialized copy and must never resurrect an absent/null identity. */
+export function parseCanonicalPm2Id(app) {
+    if (!app || typeof app !== 'object' || Array.isArray(app))
+        return undefined;
+    return parsePm2Integer(app.pm_id, { nonNegative: true });
+}
+function parseProjection(output) {
+    try {
+        const parsed = JSON.parse(output);
+        return Array.isArray(parsed)
+            ? { kind: 'array', value: parsed }
+            : { kind: 'non-array' };
+    }
+    catch {
+        // PM2 can prefix stdout with informational `[PM2]` lines. Search backward
+        // for the final valid JSON array without accepting arbitrary JSON values.
+        for (let start = output.lastIndexOf('['); start >= 0; start = start === 0 ? -1 : output.lastIndexOf('[', start - 1)) {
+            try {
+                const parsed = JSON.parse(output.slice(start).trim());
+                if (Array.isArray(parsed))
+                    return { kind: 'array', value: parsed };
+            }
+            catch { /* try an earlier '[' */ }
+        }
+        return { kind: 'malformed' };
+    }
+}
+function isPlainRecord(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+/** Validate the parts of a PM2 registry row that every mutating caller relies
+ * on.  A syntactically valid JSON array is not authority when one of its rows
+ * would later be silently coerced to name="undefined", pid=0, or an absent
+ * canonical pm_id. */
+function assertSemanticPm2Rows(rows) {
+    const ids = new Map();
+    const positivePids = new Map();
+    for (let index = 0; index < rows.length; index++) {
+        const row = rows[index];
+        if (!isPlainRecord(row)) {
+            throw new Error(`pm2 jlist row ${index} is not an object`);
+        }
+        const name = row.name;
+        if (typeof name !== 'string' || !name.trim()) {
+            throw new Error(`pm2 jlist row ${index} has no non-empty name`);
+        }
+        const pmId = parseCanonicalPm2Id(row);
+        if (pmId === undefined) {
+            throw new Error(`pm2 jlist row ${index} (${name}) has no canonical non-negative pm_id`);
+        }
+        const priorName = ids.get(pmId);
+        if (priorName !== undefined) {
+            throw new Error(`pm2 jlist has duplicate canonical pm_id ${pmId} across ${priorName} and ${name}`);
+        }
+        ids.set(pmId, name);
+        const pid = parsePm2Integer(row.pid, { nonNegative: true });
+        if (pid === undefined) {
+            throw new Error(`pm2 jlist row ${index} (${name}) has no non-negative pid`);
+        }
+        if (pid > 1) {
+            const priorPidName = positivePids.get(pid);
+            if (priorPidName !== undefined) {
+                throw new Error(`pm2 jlist has duplicate positive pid ${pid} across ${priorPidName} and ${name}`);
+            }
+            positivePids.set(pid, name);
+        }
+        const env = row.pm2_env;
+        if (!isPlainRecord(env)
+            || typeof env.status !== 'string'
+            || !env.status.trim()) {
+            throw new Error(`pm2 jlist row ${index} (${name}) has no semantic pm2_env.status`);
+        }
+    }
+}
+/** Forgiving parser for read-only/status surfaces. */
+export function parsePm2JlistOutput(output) {
+    const parsed = parseProjection(output);
+    return parsed.kind === 'array' ? parsed.value : [];
+}
+/** Shutdown authority must never interpret `{}`, `null`, or malformed output
+ * as an empty fleet: doing so would allow a later name-based PM2 mutation to
+ * bypass graceful shutdown of live daemons. */
+export function parsePm2JlistOutputStrict(output) {
+    const parsed = parseProjection(output);
+    if (parsed.kind === 'array') {
+        assertSemanticPm2Rows(parsed.value);
+        return parsed.value;
+    }
+    throw new Error(parsed.kind === 'non-array'
+        ? 'pm2 jlist returned non-array JSON'
+        : 'pm2 jlist returned malformed output');
+}
+//# sourceMappingURL=pm2-jlist.js.map

package/dist/cli/pm2-jlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pm2-jlist.js","sourceRoot":"","sources":["../../src/cli/pm2-jlist.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,eAAe,CAC7B,KAAc,EACd,UAAqC,EAAE;IAEvC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IACjF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,OAAO,CAAC,WAAW,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;kFACkF;AAClF,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,OAAO,eAAe,CAAE,GAA+B,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE;YAClC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,0EAA0E;QAC1E,KACE,IAAI,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EACnC,KAAK,IAAI,CAAC,EACV,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,EAC7D,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACrE,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED;;;sBAGsB;AACtB,SAAS,qBAAqB,CAAC,IAAW;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAY,CAAC;QACnC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,mBAAmB,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,wBAAwB,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK,IAAI,uCAAuC,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,2CAA2C,IAAI,WAAW,SAAS,QAAQ,IAAI,EAAE,CAClF,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAEpB,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK,IAAI,2BAA2B,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CACb,wCAAwC,GAAG,WAAW,YAAY,QAAQ,IAAI,EAAE,CACjF,CAAC;YACJ,CAAC;YACD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC;QACxB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;eAChB,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;eAC9B,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK,IAAI,kCAAkC,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED;;+CAE+C;AAC/C,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACtD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IACD,MAAM,IAAI,KAAK,CACb,MAAM,CAAC,IAAI,KAAK,WAAW;QACzB,CAAC,CAAC,mCAAmC;QACrC,CAAC,CAAC,qCAAqC,CAC1C,CAAC;AACJ,CAAC"}

package/dist/cli/pm2-preflight.d.ts

@@ -0,0 +1,10 @@
+export interface Pm2ExecutableProbeRuntime {
+    readlink(path: string): string;
+    exists(path: string): boolean;
+}
+/** Fail closed when a live Linux PM2 God is executing a deleted Node binary.
+ * Failure to inspect /proc remains non-authoritative and is skipped, but a
+ * successful read is evaluated outside that catch so the safety refusal can
+ * never be swallowed as an inspection error. */
+export declare function assertLinuxPm2GodExecutableUsable(pm2Pid: number, runtime?: Pm2ExecutableProbeRuntime): void;
+//# sourceMappingURL=pm2-preflight.d.ts.map

package/dist/cli/pm2-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pm2-preflight.d.ts","sourceRoot":"","sources":["../../src/cli/pm2-preflight.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CAC/B;AAED;;;gDAGgD;AAChD,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,yBAGR,GACA,IAAI,CAWN"}

package/dist/cli/pm2-preflight.js

@@ -0,0 +1,23 @@
+import { existsSync, readlinkSync } from 'node:fs';
+/** Fail closed when a live Linux PM2 God is executing a deleted Node binary.
+ * Failure to inspect /proc remains non-authoritative and is skipped, but a
+ * successful read is evaluated outside that catch so the safety refusal can
+ * never be swallowed as an inspection error. */
+export function assertLinuxPm2GodExecutableUsable(pm2Pid, runtime = {
+    readlink: path => readlinkSync(path),
+    exists: path => existsSync(path),
+}) {
+    let executable;
+    try {
+        executable = runtime.readlink(`/proc/${pm2Pid}/exe`);
+    }
+    catch {
+        return;
+    }
+    const cleanPath = executable.replace(/ \(deleted\)$/, '');
+    if (!executable.endsWith(' (deleted)') && runtime.exists(cleanPath))
+        return;
+    throw new Error(`pm2 god daemon (pid ${pm2Pid}) 使用的 Node 二进制已失效: ${cleanPath}; `
+        + '为避免强杀未完成 Riff 交接的 daemon，拒绝自动清理，请先人工核对进程归属');
+}
+//# sourceMappingURL=pm2-preflight.js.map

package/dist/cli/pm2-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pm2-preflight.js","sourceRoot":"","sources":["../../src/cli/pm2-preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAOnD;;;gDAGgD;AAChD,MAAM,UAAU,iCAAiC,CAC/C,MAAc,EACd,UAAqC;IACnC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;IACpC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;CACjC;IAED,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QAAC,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,MAAM,MAAM,CAAC,CAAC;IAAC,CAAC;IAC7D,MAAM,CAAC;QAAC,OAAO;IAAC,CAAC;IAEjB,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,OAAO;IAC5E,MAAM,IAAI,KAAK,CACb,uBAAuB,MAAM,sBAAsB,SAAS,IAAI;UAC9D,4CAA4C,CAC/C,CAAC;AACJ,CAAC"}

package/dist/cli/pm2-shutdown-capability.d.ts

@@ -0,0 +1,27 @@
+export interface Pm2ShutdownCapabilityTarget {
+    name: string;
+    pid: number;
+}
+export interface AttestedPm2DaemonShutdownTarget extends Pm2ShutdownCapabilityTarget {
+    larkAppId: string;
+    ipcPort: number;
+    bootInstanceId: string;
+    processStartIdentity: string;
+}
+export interface Pm2ShutdownCapabilityRuntime {
+    now(): number;
+    exists(path: string): boolean;
+    readdir(path: string): string[];
+    read(path: string): string;
+    mtime(path: string): number;
+    isAlive(pid: number): boolean;
+    readStartIdentity(pid: number): string | undefined;
+}
+/**
+ * Require every still-live target daemon PID to own one fresh, daemon-written
+ * descriptor advertising the exact safe shutdown protocol. This is a rollout
+ * boundary, not a package-version guess: installing a new CLI does not upgrade
+ * an already-running old daemon in memory.
+ */
+export declare function assertPm2DaemonShutdownCapabilitiesIn(operation: string, targets: readonly Pm2ShutdownCapabilityTarget[], registryDir: string, runtime?: Pm2ShutdownCapabilityRuntime): AttestedPm2DaemonShutdownTarget[];
+//# sourceMappingURL=pm2-shutdown-capability.d.ts.map

package/dist/cli/pm2-shutdown-capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pm2-shutdown-capability.d.ts","sourceRoot":"","sources":["../../src/cli/pm2-shutdown-capability.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,+BAAgC,SAAQ,2BAA2B;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,4BAA4B;IAC3C,GAAG,IAAI,MAAM,CAAC;IACd,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACpD;AA6BD;;;;;GAKG;AACH,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,SAAS,2BAA2B,EAAE,EAC/C,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,4BAA6C,GACrD,+BAA+B,EAAE,CA4InC"}

package/dist/cli/pm2-shutdown-capability.js

@@ -0,0 +1,161 @@
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { SUPERVISOR_SHUTDOWN_PROTOCOL } from '../core/supervisor-shutdown-protocol.js';
+import { readSupervisorProcessStartIdentity } from '../core/process-start-identity.js';
+const FRESH_MS = 90_000;
+const defaultRuntime = {
+    now: () => Date.now(),
+    exists: path => existsSync(path),
+    readdir: path => readdirSync(path),
+    read: path => readFileSync(path, 'utf8'),
+    mtime: path => statSync(path).mtimeMs,
+    isAlive: pid => { try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    } },
+    readStartIdentity: pid => {
+        // Lazy import is unnecessary here: this pure helper has no daemon state.
+        // The concrete function is injected below to keep tests deterministic.
+        return readSupervisorProcessStartIdentity(pid);
+    },
+};
+function failure(operation, detail) {
+    return new Error(`[${operation}] refusing to signal daemon generation(s): ${detail}. `
+        + `The live daemon may predate shutdown protocol ${SUPERVISOR_SHUTDOWN_PROTOCOL}; `
+        + 'normal stop/restart intentionally fails closed on this first-upgrade boundary. '
+        + 'After confirming every Session/Riff workload is idle, run '
+        + '`botmux restart --bootstrap-shutdown-protocol --yes` for the operator-approved one-time bootstrap; '
+        + 'automatic update must not be reported as applied until the new handler-ready fleet is verified');
+}
+/**
+ * Require every still-live target daemon PID to own one fresh, daemon-written
+ * descriptor advertising the exact safe shutdown protocol. This is a rollout
+ * boundary, not a package-version guess: installing a new CLI does not upgrade
+ * an already-running old daemon in memory.
+ */
+export function assertPm2DaemonShutdownCapabilitiesIn(operation, targets, registryDir, runtime = defaultRuntime) {
+    const invalid = targets.filter(target => !target.name.trim() || !Number.isSafeInteger(target.pid) || target.pid <= 1);
+    if (invalid.length > 0) {
+        throw failure(operation, 'shutdown target has no canonical name/live PID');
+    }
+    const duplicatePids = [...new Set(targets.map(target => target.pid))]
+        .filter(pid => targets.filter(target => target.pid === pid).length > 1);
+    if (duplicatePids.length > 0) {
+        throw failure(operation, `multiple shutdown targets share PID(s) ${duplicatePids.join(', ')}`);
+    }
+    // A generation that exited before attestation needs no signal. Any successor
+    // is discovered from a fresh PM2 projection and must attest independently.
+    const liveTargets = targets.filter(target => runtime.isAlive(target.pid));
+    if (liveTargets.length === 0)
+        return [];
+    if (!runtime.exists(registryDir)) {
+        throw failure(operation, 'daemon descriptor registry is missing');
+    }
+    let names;
+    try {
+        names = runtime.readdir(registryDir);
+    }
+    catch (error) {
+        throw failure(operation, `daemon descriptor registry is unreadable (${error instanceof Error ? error.message : String(error)})`);
+    }
+    const now = runtime.now();
+    const targetPids = new Set(liveTargets.map(target => target.pid));
+    const descriptors = new Map();
+    for (const name of names) {
+        if (!name.endsWith('.json'))
+            continue;
+        const path = join(registryDir, name);
+        let mtimeMs;
+        try {
+            mtimeMs = runtime.mtime(path);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                continue;
+            throw failure(operation, `cannot inspect daemon descriptor ${name} (${error instanceof Error ? error.message : String(error)})`);
+        }
+        const mtimeFresh = now - mtimeMs <= FRESH_MS;
+        let value;
+        try {
+            value = JSON.parse(runtime.read(path));
+        }
+        catch (error) {
+            if (!mtimeFresh)
+                continue;
+            throw failure(operation, `fresh daemon descriptor ${name} is unreadable or malformed `
+                + `(${error instanceof Error ? error.message : String(error)})`);
+        }
+        const record = value && typeof value === 'object' && !Array.isArray(value)
+            ? value
+            : undefined;
+        const heartbeat = record?.lastHeartbeat;
+        const heartbeatFresh = typeof heartbeat === 'number'
+            && Number.isFinite(heartbeat)
+            && now - heartbeat <= FRESH_MS;
+        if (!mtimeFresh && !heartbeatFresh)
+            continue;
+        const pid = record?.pid;
+        if (!Number.isSafeInteger(pid) || pid <= 1) {
+            throw failure(operation, `fresh daemon descriptor ${name} has no canonical PID`);
+        }
+        if (!targetPids.has(pid))
+            continue;
+        if (!heartbeatFresh) {
+            throw failure(operation, `daemon descriptor ${name} has no fresh semantic heartbeat`);
+        }
+        if (!runtime.isAlive(pid))
+            continue;
+        if (descriptors.has(pid)) {
+            throw failure(operation, `multiple fresh descriptors claim live PID ${pid}`);
+        }
+        descriptors.set(pid, record);
+    }
+    const authorized = [];
+    for (const target of liveTargets) {
+        const descriptor = descriptors.get(target.pid);
+        if (!descriptor) {
+            // Re-check process birth: a generation that exited during the registry
+            // scan needs no signal, but a same-PID successor must not inherit a stale
+            // capability.
+            if (!runtime.readStartIdentity(target.pid) && !runtime.isAlive(target.pid))
+                continue;
+            throw failure(operation, `${target.name}/${target.pid} has no matching fresh daemon descriptor`);
+        }
+        if (descriptor.supervisorShutdownProtocol !== SUPERVISOR_SHUTDOWN_PROTOCOL) {
+            throw failure(operation, `${target.name}/${target.pid} does not attest ${SUPERVISOR_SHUTDOWN_PROTOCOL}`);
+        }
+        const larkAppId = descriptor.larkAppId;
+        const ipcPort = descriptor.ipcPort;
+        const bootInstanceId = descriptor.bootInstanceId;
+        if (typeof larkAppId !== 'string' || !larkAppId.trim()
+            || !Number.isSafeInteger(ipcPort) || ipcPort < 1 || ipcPort > 65_535
+            || typeof bootInstanceId !== 'string' || !bootInstanceId) {
+            throw failure(operation, `${target.name}/${target.pid} descriptor has no canonical app/port/boot identity`);
+        }
+        const describedStart = descriptor.processStartIdentity;
+        if (typeof describedStart !== 'string' || !describedStart) {
+            throw failure(operation, `${target.name}/${target.pid} descriptor has no process-start identity`);
+        }
+        const currentStart = runtime.readStartIdentity(target.pid);
+        if (!currentStart) {
+            if (!runtime.isAlive(target.pid))
+                continue;
+            throw failure(operation, `cannot revalidate process-start identity for ${target.name}/${target.pid}`);
+        }
+        if (currentStart !== describedStart) {
+            throw failure(operation, `${target.name}/${target.pid} process-start identity does not match its descriptor`);
+        }
+        authorized.push({
+            ...target,
+            larkAppId: larkAppId.trim(),
+            ipcPort: ipcPort,
+            bootInstanceId,
+            processStartIdentity: describedStart,
+        });
+    }
+    return authorized;
+}
+//# sourceMappingURL=pm2-shutdown-capability.js.map

package/dist/cli/pm2-shutdown-capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pm2-shutdown-capability.js","sourceRoot":"","sources":["../../src/cli/pm2-shutdown-capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,4BAA4B,EAAE,MAAM,yCAAyC,CAAC;AACvF,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AAwBvF,MAAM,QAAQ,GAAG,MAAM,CAAC;AAExB,MAAM,cAAc,GAAiC;IACnD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;IACrB,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;IAChC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC;IAClC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;IACxC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO;IACrC,OAAO,EAAE,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC,CAAC,CAAC;IACtF,iBAAiB,EAAE,GAAG,CAAC,EAAE;QACvB,yEAAyE;QACzE,uEAAuE;QACvE,OAAO,kCAAkC,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;CACF,CAAC;AAEF,SAAS,OAAO,CAAC,SAAiB,EAAE,MAAc;IAChD,OAAO,IAAI,KAAK,CACd,IAAI,SAAS,8CAA8C,MAAM,IAAI;UACnE,iDAAiD,4BAA4B,IAAI;UACjF,iFAAiF;UACjF,4DAA4D;UAC5D,qGAAqG;UACrG,gGAAgG,CACnG,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CACnD,SAAiB,EACjB,OAA+C,EAC/C,WAAmB,EACnB,UAAwC,cAAc;IAEtD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CACtC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC/E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,SAAS,EAAE,gDAAgD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;SAClE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1E,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,OAAO,CAAC,SAAS,EAAE,0CAA0C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,6EAA6E;IAC7E,2EAA2E;IAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,MAAM,OAAO,CAAC,SAAS,EAAE,uCAAuC,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QAAC,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAAC,CAAC;IAC7C,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,OAAO,CACX,SAAS,EACT,6CAA6C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CACvG,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC/D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YAAC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QACtC,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,SAAS;YACjE,MAAM,OAAO,CACX,SAAS,EACT,oCAAoC,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CACvG,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,GAAG,OAAO,IAAI,QAAQ,CAAC;QAE7C,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAC,CAAC;QAC/C,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC1B,MAAM,OAAO,CACX,SAAS,EACT,2BAA2B,IAAI,8BAA8B;kBAC3D,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAChE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACxE,CAAC,CAAC,KAAgC;YAClC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,SAAS,GAAG,MAAM,EAAE,aAAa,CAAC;QACxC,MAAM,cAAc,GAAG,OAAO,SAAS,KAAK,QAAQ;eAC/C,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;eAC1B,GAAG,GAAG,SAAS,IAAI,QAAQ,CAAC;QACjC,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc;YAAE,SAAS;QAE7C,MAAM,GAAG,GAAG,MAAM,EAAE,GAAG,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAK,GAAc,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,OAAO,CAAC,SAAS,EAAE,2BAA2B,IAAI,uBAAuB,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAa,CAAC;YAAE,SAAS;QAC7C,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,OAAO,CAAC,SAAS,EAAE,qBAAqB,IAAI,kCAAkC,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAa,CAAC;YAAE,SAAS;QAC9C,IAAI,WAAW,CAAC,GAAG,CAAC,GAAa,CAAC,EAAE,CAAC;YACnC,MAAM,OAAO,CAAC,SAAS,EAAE,6CAA6C,GAAG,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,GAAa,EAAE,MAAO,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,UAAU,GAAsC,EAAE,CAAC;IACzD,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,uEAAuE;YACvE,0EAA0E;YAC1E,cAAc;YACd,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,SAAS;YACrF,MAAM,OAAO,CACX,SAAS,EACT,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,0CAA0C,CACvE,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,0BAA0B,KAAK,4BAA4B,EAAE,CAAC;YAC3E,MAAM,OAAO,CACX,SAAS,EACT,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,oBAAoB,4BAA4B,EAAE,CAC/E,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACvC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QACnC,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QACjD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;eAC/C,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAK,OAAkB,GAAG,CAAC,IAAK,OAAkB,GAAG,MAAM;eACzF,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7D,MAAM,OAAO,CACX,SAAS,EACT,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,qDAAqD,CAClF,CAAC;QACJ,CAAC;QACD,MAAM,cAAc,GAAG,UAAU,CAAC,oBAAoB,CAAC;QACvD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1D,MAAM,OAAO,CACX,SAAS,EACT,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,2CAA2C,CACxE,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC3C,MAAM,OAAO,CACX,SAAS,EACT,gDAAgD,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,EAAE,CAC5E,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,KAAK,cAAc,EAAE,CAAC;YACpC,MAAM,OAAO,CACX,SAAS,EACT,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,uDAAuD,CACpF,CAAC;QACJ,CAAC;QACD,UAAU,CAAC,IAAI,CAAC;YACd,GAAG,MAAM;YACT,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE;YAC3B,OAAO,EAAE,OAAiB;YAC1B,cAAc;YACd,oBAAoB,EAAE,cAAc;SACrC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/cli/pm2-start-transaction.d.ts

@@ -0,0 +1,55 @@
+import type { FleetProcessEntry } from './fleet-shutdown.js';
+/** Preserve PM2's raw stop_exit_codes elements for exact policy validation.
+ * PM2 applies parseInt to string elements at exit time, so lossy numeric
+ * projection would hide restart-suppressing extras such as "0foo". */
+export declare function normalizeRawPm2StopExitCodes(value: unknown): unknown[];
+/** The in-memory shutdown capability is insufficient when PM2 still owns an
+ * old registry policy. In particular `stop_exit_codes:[0]` suppresses restart
+ * after PM2 normalizes SIGKILL/OOM to exit_code 0. Require the exact daemon
+ * policy that makes only shutdown()'s reserved sentinel terminal. */
+export declare function assertDaemonPm2GracefulExitPolicy(operation: string, entries: FleetProcessEntry[]): void;
+/** Require one exact, online, OS-live registry row for every configured core
+ * process and no stale/foreign core rows. This is the postcondition for every
+ * public fleet start surface. */
+export declare function assertConfiguredPm2FleetOnline(operation: string, entries: FleetProcessEntry[], configuredNames: string[], isAlive: (pid: number) => boolean): void;
+/** PM2 `online` is published before a daemon's shutdown endpoint/handler-ready
+ * capability. A public start is complete only after both authorities agree. */
+export declare function assertConfiguredPm2FleetReady<TEntry extends FleetProcessEntry>(operation: string, entries: TEntry[], configuredNames: string[], isAlive: (pid: number) => boolean, assertDaemonCapabilities: (entries: TEntry[]) => void): void;
+/** Capability scanners used by shutdown may legitimately omit a target that
+ * exited during their read. Start verification may not: require an exact
+ * attested PID set and recheck OS liveness after the capability scan. */
+export declare function assertExactAttestedDaemonSet(operation: string, daemonEntries: FleetProcessEntry[], attestedPids: readonly number[], isAlive: (pid: number) => boolean): void;
+export type StartBotFleetAdmission = {
+    state: 'already-online';
+} | {
+    state: 'start-eligible';
+} | {
+    state: 'fleet-down';
+};
+/** `start-bot` is safe only for the append-one-bot case: either the entire
+ * configured fleet is already online, or exactly the requested bot row is
+ * absent while every other configured bot and the dashboard are online. */
+export declare function classifyStartBotFleetAdmission(operation: string, entries: FleetProcessEntry[], configuredNames: string[], targetName: string, isAlive: (pid: number) => boolean): StartBotFleetAdmission;
+export interface Pm2StartTransactionRuntime<TProjection> {
+    start(timeoutMs: number): void;
+    /** Must obtain a new projection and validate the complete expected state. */
+    verifyFresh(timeoutMs: number): TProjection;
+    /** Must independently re-read authority before compensating partial launch. */
+    rollback(): void;
+}
+/** Run one bounded PM2 launch and make the fresh fleet projection—not the CLI
+ * exit code—the success authority. Any incomplete/unverified launch is
+ * compensated before the error escapes. */
+export declare function runBoundedPm2StartTransaction<TProjection>(operation: string, startTimeoutMs: number, verifyTimeoutMs: number, runtime: Pm2StartTransactionRuntime<TProjection>): TProjection;
+export interface LatePm2StartRollbackRuntime {
+    now(): number;
+    sleep(ms: number): void;
+    /** Re-read authority and compensate anything currently published. Return
+     * true only when this observation exactly matches the pre-start state. */
+    reconcileOnce(): boolean;
+}
+/** A killed/timed-out PM2 client does not cancel work already queued in God.
+ * Therefore an empty first rollback projection is not success: require one
+ * continuous restored window, resetting it whenever a late row appears. */
+export declare function reconcileLatePm2StartPublication(operation: string, settleMs: number, timeoutMs: number, runtime: LatePm2StartRollbackRuntime): void;
+//# sourceMappingURL=pm2-start-transaction.d.ts.map

package/dist/cli/pm2-start-transaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pm2-start-transaction.d.ts","sourceRoot":"","sources":["../../src/cli/pm2-start-transaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAG7D;;sEAEsE;AACtE,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,EAAE,CAEtE;AAuED;;;qEAGqE;AACrE,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,iBAAiB,EAAE,GAC3B,IAAI,CAmBN;AAED;;iCAEiC;AACjC,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,iBAAiB,EAAE,EAC5B,eAAe,EAAE,MAAM,EAAE,EACzB,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAChC,IAAI,CAeN;AAED;+EAC+E;AAC/E,wBAAgB,6BAA6B,CAAC,MAAM,SAAS,iBAAiB,EAC5E,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EAAE,EACjB,eAAe,EAAE,MAAM,EAAE,EACzB,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,EACjC,wBAAwB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,GACpD,IAAI,CAGN;AAED;;yEAEyE;AACzE,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,iBAAiB,EAAE,EAClC,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAChC,IAAI,CAiBN;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,KAAK,EAAE,gBAAgB,CAAA;CAAE,GAC3B;IAAE,KAAK,EAAE,gBAAgB,CAAA;CAAE,GAC3B;IAAE,KAAK,EAAE,YAAY,CAAA;CAAE,CAAC;AAE5B;;2EAE2E;AAC3E,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,iBAAiB,EAAE,EAC5B,eAAe,EAAE,MAAM,EAAE,EACzB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAChC,sBAAsB,CAsCxB;AAED,MAAM,WAAW,0BAA0B,CAAC,WAAW;IACrD,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,6EAA6E;IAC7E,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,CAAC;IAC5C,+EAA+E;IAC/E,QAAQ,IAAI,IAAI,CAAC;CAClB;AAED;;2CAE2C;AAC3C,wBAAgB,6BAA6B,CAAC,WAAW,EACvD,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,0BAA0B,CAAC,WAAW,CAAC,GAC/C,WAAW,CA4Bb;AAED,MAAM,WAAW,2BAA2B;IAC1C,GAAG,IAAI,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;8EAC0E;IAC1E,aAAa,IAAI,OAAO,CAAC;CAC1B;AAED;;2EAE2E;AAC3E,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,2BAA2B,GACnC,IAAI,CAwBN"}