create-principles-disciple 1.121.7 → 1.121.9

package/dist/update/bootstrap-protocol.js

@@ -0,0 +1,132 @@
+/**
+ * Bootstrap process protocol (SPEC §6.1) — strict single-JSON-object in,
+ * strict single-JSON-object out.
+ *
+ * Companion, Console, and the installer speak to the bootstrap through this
+ * one protocol. The transport layer (stdin/stdout around this pure handler)
+ * stays thin so the contract itself is testable: exactly one parseable JSON
+ * object per direction, stable reason codes, and a next action on every
+ * failure (rc-9, cli-1 semantics applied to the protocol boundary).
+ */
+import { isReleaseChannelName } from './product-identity.js';
+import { ReleaseManagerError } from './release-manager.js';
+export class BootstrapProtocolError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.name = 'BootstrapProtocolError';
+        this.reason = reason;
+    }
+}
+/**
+ * Parses exactly ONE JSON object from the raw request text. Trailing data,
+ * non-objects, arrays, and unknown/missing fields are hard errors — a
+ * protocol peer that emits garbage gets a structured refusal, never a
+ * best-effort guess.
+ */
+export function parseBootstrapRequest(raw) {
+    const text = raw.trim();
+    if (text.length === 0) {
+        throw new BootstrapProtocolError('protocol_empty_request', 'The bootstrap request body is empty.');
+    }
+    if (!text.startsWith('{') || !text.endsWith('}')) {
+        throw new BootstrapProtocolError('protocol_not_single_object', 'The bootstrap request must be exactly one JSON object.');
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (error) {
+        throw new BootstrapProtocolError('protocol_invalid_json', `The bootstrap request is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new BootstrapProtocolError('protocol_not_single_object', 'The bootstrap request must be exactly one JSON object.');
+    }
+    const record = parsed;
+    if (!Object.hasOwn(record, 'op')) {
+        throw new BootstrapProtocolError('protocol_missing_op', 'The bootstrap request is missing the required "op" field.');
+    }
+    const { op } = record;
+    const knownOps = ['inspect', 'check', 'apply', 'rollback'];
+    if (typeof op !== 'string' || !knownOps.includes(op)) {
+        throw new BootstrapProtocolError('protocol_unknown_op', `Unknown bootstrap op: ${JSON.stringify(op)}. Supported: ${knownOps.join(', ')}.`);
+    }
+    const allowedFields = op === 'check'
+        ? new Set(['op', 'channel'])
+        : op === 'apply'
+            ? new Set(['op', 'releaseId'])
+            : new Set(['op']);
+    const extraFields = Object.keys(record).filter((key) => !allowedFields.has(key));
+    if (extraFields.length > 0) {
+        throw new BootstrapProtocolError('protocol_unknown_field', `Unknown bootstrap request fields: ${extraFields.join(', ')}`);
+    }
+    if (op === 'check') {
+        if (!Object.hasOwn(record, 'channel')) {
+            throw new BootstrapProtocolError('protocol_missing_channel', 'A check request requires the "channel" field.');
+        }
+        if (!isReleaseChannelName(record.channel)) {
+            throw new BootstrapProtocolError('protocol_invalid_channel', `channel must be "stable" or "candidate", got: ${JSON.stringify(record.channel)}`);
+        }
+        return { op, channel: record.channel };
+    }
+    if (op === 'apply') {
+        if (!Object.hasOwn(record, 'releaseId')) {
+            throw new BootstrapProtocolError('protocol_missing_release_id', 'An apply request requires the "releaseId" field.');
+        }
+        if (typeof record.releaseId !== 'string' || record.releaseId.length === 0) {
+            throw new BootstrapProtocolError('protocol_invalid_release_id', `releaseId must be a non-empty string, got: ${JSON.stringify(record.releaseId)}`);
+        }
+        return { op, releaseId: record.releaseId };
+    }
+    return op === 'rollback' ? { op: 'rollback' } : { op: 'inspect' };
+}
+/** Serializes exactly one JSON object for stdout (no banners, no extra text). */
+export function serializeBootstrapResponse(response) {
+    return `${JSON.stringify(response)}\n`;
+}
+/**
+ * Dispatches a parsed request against a ReleaseManager and produces the
+ * protocol response. Manager failures become structured refusals — the
+ * protocol never leaks stack traces into the response object.
+ */
+export async function handleBootstrapRequest(request, manager) {
+    try {
+        switch (request.op) {
+            case 'inspect':
+                return { ok: true, result: await Promise.resolve(manager.inspect()) };
+            case 'check':
+                return { ok: true, result: await manager.check(request.channel) };
+            case 'apply':
+                await manager.apply();
+                return { ok: true, result: { applied: true } };
+            case 'rollback':
+                await manager.rollback();
+                return { ok: true, result: { rolledBack: true } };
+        }
+    }
+    catch (error) {
+        if (error instanceof ReleaseManagerError) {
+            return {
+                ok: false,
+                reason: error.reason,
+                message: error.message,
+                nextAction: error.nextAction,
+            };
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            ok: false,
+            reason: 'internal_error',
+            message,
+            nextAction: 'Retry the operation; if it fails again, collect the bootstrap log from ~/.pd/logs and report it.',
+        };
+    }
+    // Exhaustive switch guard — reaching here is a programming error.
+    return {
+        ok: false,
+        reason: 'internal_error',
+        message: 'unhandled bootstrap request',
+        nextAction: 'Report this protocol violation.',
+    };
+}
+//# sourceMappingURL=bootstrap-protocol.js.map

package/dist/update/bootstrap-protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-protocol.js","sourceRoot":"","sources":["../../src/update/bootstrap-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAwB3D,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,MAAM,CAAS;IAExB,YAAY,MAAc,EAAE,OAAe;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,sBAAsB,CAAC,wBAAwB,EAAE,sCAAsC,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,sBAAsB,CAAC,4BAA4B,EAAE,wDAAwD,CAAC,CAAC;IAC3H,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,sBAAsB,CAAC,uBAAuB,EAAE,4CAA4C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClK,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,sBAAsB,CAAC,4BAA4B,EAAE,wDAAwD,CAAC,CAAC;IAC3H,CAAC;IACD,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,sBAAsB,CAAC,qBAAqB,EAAE,2DAA2D,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,EAAC,EAAE,EAAC,GAAG,MAAM,CAAC;IACpB,MAAM,QAAQ,GAAkC,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1F,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAwB,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,sBAAsB,CAAC,qBAAqB,EAAE,yBAAyB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,gBAAgB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7I,CAAC;IACD,MAAM,aAAa,GAAG,EAAE,KAAK,OAAO;QAClC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5B,CAAC,CAAC,EAAE,KAAK,OAAO;YACd,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC9B,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,sBAAsB,CAAC,wBAAwB,EAAE,qCAAqC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,sBAAsB,CAAC,0BAA0B,EAAE,+CAA+C,CAAC,CAAC;QAChH,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,sBAAsB,CAAC,0BAA0B,EAAE,iDAAiD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,sBAAsB,CAAC,6BAA6B,EAAE,kDAAkD,CAAC,CAAC;QACtH,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,sBAAsB,CAAC,6BAA6B,EAAE,8CAA8C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACpJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;AACpE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,0BAA0B,CAAC,QAA2B;IACpE,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAyB,EACzB,OAAuB;IAEvB,IAAI,CAAC;QACH,QAAQ,OAAO,CAAC,EAAE,EAAE,CAAC;YACnB,KAAK,SAAS;gBACZ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACxE,KAAK,OAAO;gBACV,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACpE,KAAK,OAAO;gBACV,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;gBACtB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;YACjD,KAAK,UAAU;gBACb,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;YACzC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gBAAgB;YACxB,OAAO;YACP,UAAU,EAAE,kGAAkG;SAC/G,CAAC;IACJ,CAAC;IACD,kEAAkE;IAClE,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,6BAA6B;QACtC,UAAU,EAAE,iCAAiC;KAC9C,CAAC;AACJ,CAAC"}

package/dist/update/channel-metadata.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Strict Channel Metadata contract (SPEC §4.2).
+ *
+ * Channel Metadata maps `stable` / `candidate` to a release metadata digest.
+ * Promotion changes ONLY this signed pointer; it never rebuilds or mutates a
+ * release. The pointer must reference the exact release metadata digest —
+ * never an asset digest, never a package version.
+ */
+import { type ReleaseChannelName } from './product-identity.js';
+export declare const CHANNEL_METADATA_SCHEMA_VERSION = 1;
+export interface ChannelMetadata {
+    readonly schemaVersion: number;
+    readonly channel: ReleaseChannelName;
+    /** Monotonic metadata version — must strictly increase per channel. */
+    readonly version: number;
+    readonly expiresAt: string;
+    readonly releaseMetadataDigest: string;
+    readonly releaseId: string;
+    readonly productVersion: string;
+    readonly publicationSequence: number;
+}
+export declare class ChannelMetadataError extends Error {
+    readonly field: string;
+    constructor(field: string, message: string);
+}
+export declare function parseChannelMetadata(value: unknown): ChannelMetadata;
+export declare function isChannelMetadataExpired(metadata: ChannelMetadata, now?: Date): boolean;
+//# sourceMappingURL=channel-metadata.d.ts.map

package/dist/update/channel-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-metadata.d.ts","sourceRoot":"","sources":["../../src/update/channel-metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAKL,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAE/B,eAAO,MAAM,+BAA+B,IAAI,CAAC;AAEjD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,YAAY,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAIzC;CACF;AAaD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAyDpE;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAEnG"}

package/dist/update/channel-metadata.js

@@ -0,0 +1,90 @@
+/**
+ * Strict Channel Metadata contract (SPEC §4.2).
+ *
+ * Channel Metadata maps `stable` / `candidate` to a release metadata digest.
+ * Promotion changes ONLY this signed pointer; it never rebuilds or mutates a
+ * release. The pointer must reference the exact release metadata digest —
+ * never an asset digest, never a package version.
+ */
+import { assertSha256Hex, isReleaseChannelName, parseProductVersion, ProductIdentityError, } from './product-identity.js';
+export const CHANNEL_METADATA_SCHEMA_VERSION = 1;
+export class ChannelMetadataError extends Error {
+    field;
+    constructor(field, message) {
+        super(message);
+        this.name = 'ChannelMetadataError';
+        this.field = field;
+    }
+}
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function requireOwn(record, field) {
+    if (!Object.hasOwn(record, field)) {
+        throw new ChannelMetadataError(field, `Channel metadata is missing required field "${field}"`);
+    }
+    return record[field];
+}
+export function parseChannelMetadata(value) {
+    if (!isPlainObject(value)) {
+        throw new ChannelMetadataError('root', 'Channel metadata must be a JSON object');
+    }
+    const { schemaVersion } = { schemaVersion: requireOwn(value, 'schemaVersion') };
+    if (schemaVersion !== CHANNEL_METADATA_SCHEMA_VERSION) {
+        throw new ChannelMetadataError('schemaVersion', `Unsupported channel metadata schemaVersion: ${JSON.stringify(schemaVersion)}`);
+    }
+    const channelValue = requireOwn(value, 'channel');
+    if (!isReleaseChannelName(channelValue)) {
+        throw new ChannelMetadataError('channel', `channel must be "stable" or "candidate", got: ${JSON.stringify(channelValue)}`);
+    }
+    const version = requireOwn(value, 'version');
+    if (typeof version !== 'number' || !Number.isSafeInteger(version) || version <= 0) {
+        throw new ChannelMetadataError('version', `version must be a positive safe integer, got: ${JSON.stringify(version)}`);
+    }
+    const expiresAt = requireOwn(value, 'expiresAt');
+    if (typeof expiresAt !== 'string' || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/.test(expiresAt) || Number.isNaN(Date.parse(expiresAt))) {
+        throw new ChannelMetadataError('expiresAt', `expiresAt must be an RFC3339 UTC timestamp ending in Z, got: ${JSON.stringify(expiresAt)}`);
+    }
+    // Identity helpers throw ProductIdentityError; rethrow as channel errors.
+    const guarded = (read) => {
+        try {
+            return read();
+        }
+        catch (error) {
+            if (error instanceof ProductIdentityError) {
+                throw new ChannelMetadataError(error.field, error.message);
+            }
+            throw error;
+        }
+    };
+    const releaseMetadataDigest = guarded(() => assertSha256Hex(requireOwn(value, 'releaseMetadataDigest'), 'releaseMetadataDigest'));
+    const releaseId = guarded(() => assertSha256Hex(requireOwn(value, 'releaseId'), 'releaseId'));
+    const { productVersion } = guarded(() => parseProductVersion(requireOwn(value, 'productVersion')));
+    const publicationSequence = requireOwn(value, 'publicationSequence');
+    if (typeof publicationSequence !== 'number' || !Number.isSafeInteger(publicationSequence) || publicationSequence <= 0) {
+        throw new ChannelMetadataError('publicationSequence', `publicationSequence must be a positive safe integer, got: ${JSON.stringify(publicationSequence)}`);
+    }
+    const knownKeys = new Set([
+        'schemaVersion', 'channel', 'version', 'expiresAt', 'releaseMetadataDigest',
+        'releaseId', 'productVersion', 'publicationSequence',
+    ]);
+    for (const key of Object.keys(value)) {
+        if (!knownKeys.has(key)) {
+            throw new ChannelMetadataError(key, `Channel metadata contains unknown field "${key}"`);
+        }
+    }
+    return {
+        schemaVersion,
+        channel: channelValue,
+        version,
+        expiresAt,
+        releaseMetadataDigest,
+        releaseId,
+        productVersion,
+        publicationSequence,
+    };
+}
+export function isChannelMetadataExpired(metadata, now = new Date()) {
+    return Date.parse(metadata.expiresAt) <= now.getTime();
+}
+//# sourceMappingURL=channel-metadata.js.map

package/dist/update/channel-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-metadata.js","sourceRoot":"","sources":["../../src/update/channel-metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAcjD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,KAAK,CAAS;IAEvB,YAAY,KAAa,EAAE,OAAe;QACxC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,MAA+B,EAAE,KAAa;IAChE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,oBAAoB,CAAC,KAAK,EAAE,+CAA+C,KAAK,GAAG,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,oBAAoB,CAAC,MAAM,EAAE,wCAAwC,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,UAAU,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,CAAC;IAChF,IAAI,aAAa,KAAK,+BAA+B,EAAE,CAAC;QACtD,MAAM,IAAI,oBAAoB,CAAC,eAAe,EAAE,+CAA+C,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAClI,CAAC;IACD,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAClD,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,oBAAoB,CAAC,SAAS,EAAE,iDAAiD,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC7H,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,oBAAoB,CAAC,SAAS,EAAE,iDAAiD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxH,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACjD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,gDAAgD,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC9I,MAAM,IAAI,oBAAoB,CAAC,WAAW,EAAE,gEAAgE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3I,CAAC;IACD,0EAA0E;IAC1E,MAAM,OAAO,GAAG,CAAI,IAAa,EAAK,EAAE;QACtC,IAAI,CAAC;YACH,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;gBAC1C,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IACF,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,KAAK,EAAE,uBAAuB,CAAC,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAClI,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IAC9F,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,UAAU,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACnG,MAAM,mBAAmB,GAAG,UAAU,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACrE,IAAI,OAAO,mBAAmB,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAAC,IAAI,mBAAmB,IAAI,CAAC,EAAE,CAAC;QACtH,MAAM,IAAI,oBAAoB,CAAC,qBAAqB,EAAE,6DAA6D,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAC5J,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;QACxB,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,uBAAuB;QAC3E,WAAW,EAAE,gBAAgB,EAAE,qBAAqB;KACrD,CAAC,CAAC;IACH,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,4CAA4C,GAAG,GAAG,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,OAAO;QACL,aAAa;QACb,OAAO,EAAE,YAAY;QACrB,OAAO;QACP,SAAS;QACT,qBAAqB;QACrB,SAAS;QACT,cAAc;QACd,mBAAmB;KACpB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAyB,EAAE,GAAG,GAAS,IAAI,IAAI,EAAE;IACxF,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AACzD,CAAC"}

package/dist/update/channel-promotion.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Channel promotion (SPEC §4.2, §13, §18-8).
+ *
+ * Promotion changes ONLY the signed channel pointer: the next channel
+ * document references an already-published release's exact metadata digest.
+ * It never rebuilds, rewrites, or even reads release ASSETS — that is the
+ * structural separation-of-duties guarantee this module embodies. Release
+ * publication and channel promotion are separate permissions; a promotion
+ * credential must not be able to alter a published asset.
+ */
+import type { ChannelMetadata } from './channel-metadata.js';
+import type { ReleaseMetadata } from './release-metadata.js';
+import type { ReleaseChannelName } from './product-identity.js';
+export type PromotionRefusalReason = 'channel_mismatch' | 'sequence_not_advancing' | 'channel_version_regression';
+export interface PromotionRefusal {
+    readonly promoted: false;
+    readonly reason: PromotionRefusalReason;
+    readonly message: string;
+}
+export interface PromotionResult {
+    readonly promoted: true;
+    readonly channel: ReleaseChannelName;
+    readonly previousVersion: number | null;
+    readonly next: ChannelMetadata;
+}
+export interface PromotionPlanInput {
+    readonly channel: ReleaseChannelName;
+    readonly release: ReleaseMetadata;
+    readonly current: ChannelMetadata | null;
+    /** Bumped by exactly one per promotion (monotonic metadata version). */
+    readonly expiresAt: string;
+}
+/**
+ * Plans the next signed channel document. Pure: no I/O, no asset access.
+ * The output is what a promotion signer signs — the signature step lives in
+ * the release pipeline, never here.
+ */
+export declare function planChannelPromotion(input: PromotionPlanInput): PromotionResult | PromotionRefusal;
+//# sourceMappingURL=channel-promotion.d.ts.map

package/dist/update/channel-promotion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-promotion.d.ts","sourceRoot":"","sources":["../../src/update/channel-promotion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,MAAM,MAAM,sBAAsB,GAC9B,kBAAkB,GAClB,wBAAwB,GACxB,4BAA4B,CAAC;AAEjC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,GAAG,eAAe,GAAG,gBAAgB,CA2ClG"}

package/dist/update/channel-promotion.js

@@ -0,0 +1,55 @@
+/**
+ * Channel promotion (SPEC §4.2, §13, §18-8).
+ *
+ * Promotion changes ONLY the signed channel pointer: the next channel
+ * document references an already-published release's exact metadata digest.
+ * It never rebuilds, rewrites, or even reads release ASSETS — that is the
+ * structural separation-of-duties guarantee this module embodies. Release
+ * publication and channel promotion are separate permissions; a promotion
+ * credential must not be able to alter a published asset.
+ */
+/**
+ * Plans the next signed channel document. Pure: no I/O, no asset access.
+ * The output is what a promotion signer signs — the signature step lives in
+ * the release pipeline, never here.
+ */
+export function planChannelPromotion(input) {
+    const { channel, release, current } = input;
+    if (current !== null && current.channel !== channel) {
+        return {
+            promoted: false,
+            reason: 'channel_mismatch',
+            message: `The current channel document is for "${current.channel}", not "${channel}".`,
+        };
+    }
+    if (current !== null && release.publicationSequence < current.publicationSequence) {
+        return {
+            promoted: false,
+            reason: 'sequence_not_advancing',
+            message: `Promoting release ${release.productVersion} (sequence ${release.publicationSequence}) would move the ${channel} channel backwards from sequence ${current.publicationSequence}.`,
+        };
+    }
+    const previousVersion = current !== null ? current.version : null;
+    const nextVersion = (previousVersion ?? 0) + 1;
+    const next = {
+        schemaVersion: 1,
+        channel,
+        version: nextVersion,
+        expiresAt: input.expiresAt,
+        // The pointer triple — the ONLY release facts a promotion may state, and
+        // all three come verbatim from the published release metadata.
+        releaseMetadataDigest: release.metadataDigest,
+        releaseId: release.releaseId,
+        productVersion: release.productVersion,
+        publicationSequence: release.publicationSequence,
+    };
+    if (nextVersion <= (previousVersion ?? 0)) {
+        return {
+            promoted: false,
+            reason: 'channel_version_regression',
+            message: `Channel version must strictly increase (${previousVersion ?? 0} -> ${nextVersion}).`,
+        };
+    }
+    return { promoted: true, channel, previousVersion, next };
+}
+//# sourceMappingURL=channel-promotion.js.map

package/dist/update/channel-promotion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-promotion.js","sourceRoot":"","sources":["../../src/update/channel-promotion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAgCH;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAyB;IAC5D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAE5C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACpD,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,wCAAwC,OAAO,CAAC,OAAO,WAAW,OAAO,IAAI;SACvF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;QAClF,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,wBAAwB;YAChC,OAAO,EAAE,qBAAqB,OAAO,CAAC,cAAc,cAAc,OAAO,CAAC,mBAAmB,oBAAoB,OAAO,oCAAoC,OAAO,CAAC,mBAAmB,GAAG;SAC3L,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,MAAM,WAAW,GAAG,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAE/C,MAAM,IAAI,GAAoB;QAC5B,aAAa,EAAE,CAAC;QAChB,OAAO;QACP,OAAO,EAAE,WAAW;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,yEAAyE;QACzE,+DAA+D;QAC/D,qBAAqB,EAAE,OAAO,CAAC,cAAc;QAC7C,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;KACjD,CAAC;IAEF,IAAI,WAAW,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,EAAE,CAAC;QAC1C,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,4BAA4B;YACpC,OAAO,EAAE,2CAA2C,eAAe,IAAI,CAAC,OAAO,WAAW,IAAI;SAC/F,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;AAC5D,CAAC"}

package/dist/update/data-compatibility.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Data and configuration compatibility policy (SPEC §10).
+ *
+ * Code rollback and data compatibility are separate release properties. An
+ * ordinary update is automatically eligible only when its schema changes
+ * stay backward-readable by the retained previous release
+ * (expand-migrate-contract). Destructive or contract migrations require a
+ * separate explicit maintenance workflow and are REFUSED by the ordinary
+ * update path — they cannot pass through automatic update.
+ */
+import { ProductIdentityError } from './product-identity.js';
+import type { ReleaseMetadata } from './release-metadata.js';
+export type DataCompatibilityDecision = {
+    readonly eligible: true;
+    readonly mode: 'expand_migrate_contract';
+    readonly oldestReadableRelease: string;
+} | {
+    readonly eligible: false;
+    readonly reason: 'destructive_migration_requires_maintenance';
+    readonly message: string;
+    readonly nextAction: string;
+};
+/**
+ * Decides whether updating from `previous` to `candidate` keeps ordinary
+ * update semantics. The candidate declares the oldest release whose data it
+ * remains forward-compatible with (`dataSchemaForwardReadableFrom`); the
+ * RETAINED previous release must be within that window for automatic
+ * eligibility.
+ */
+export declare function evaluateDataCompatibility(input: {
+    candidate: ReleaseMetadata;
+    previous: ReleaseMetadata | null;
+}): DataCompatibilityDecision;
+export { ProductIdentityError };
+//# sourceMappingURL=data-compatibility.d.ts.map

package/dist/update/data-compatibility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-compatibility.d.ts","sourceRoot":"","sources":["../../src/update/data-compatibility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAA+C,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,MAAM,yBAAyB,GACjC;IACE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC;IACzC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;CACxC,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,4CAA4C,CAAC;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEN;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,SAAS,EAAE,eAAe,CAAC;IAC3B,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;CAClC,GAAG,yBAAyB,CA8B5B;AAED,OAAO,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/update/data-compatibility.js

@@ -0,0 +1,45 @@
+/**
+ * Data and configuration compatibility policy (SPEC §10).
+ *
+ * Code rollback and data compatibility are separate release properties. An
+ * ordinary update is automatically eligible only when its schema changes
+ * stay backward-readable by the retained previous release
+ * (expand-migrate-contract). Destructive or contract migrations require a
+ * separate explicit maintenance workflow and are REFUSED by the ordinary
+ * update path — they cannot pass through automatic update.
+ */
+import { compareProductVersions, parseProductVersion, ProductIdentityError } from './product-identity.js';
+/**
+ * Decides whether updating from `previous` to `candidate` keeps ordinary
+ * update semantics. The candidate declares the oldest release whose data it
+ * remains forward-compatible with (`dataSchemaForwardReadableFrom`); the
+ * RETAINED previous release must be within that window for automatic
+ * eligibility.
+ */
+export function evaluateDataCompatibility(input) {
+    const { candidate, previous } = input;
+    const oldestReadable = parseProductVersion(candidate.compatibility.dataSchemaForwardReadableFrom, 'compatibility.dataSchemaForwardReadableFrom');
+    if (previous === null) {
+        return {
+            eligible: true,
+            mode: 'expand_migrate_contract',
+            oldestReadableRelease: oldestReadable.productVersion,
+        };
+    }
+    const previousVersion = parseProductVersion(previous.productVersion, 'previous.productVersion');
+    if (compareProductVersions(previousVersion, oldestReadable) >= 0) {
+        return {
+            eligible: true,
+            mode: 'expand_migrate_contract',
+            oldestReadableRelease: oldestReadable.productVersion,
+        };
+    }
+    return {
+        eligible: false,
+        reason: 'destructive_migration_requires_maintenance',
+        message: `Release ${candidate.productVersion} only guarantees data readable back to ${oldestReadable.productVersion}, but the retained previous release is ${previous.productVersion}. An ordinary update could strand code rollback.`,
+        nextAction: 'Run the separate maintenance migration workflow (export, confirmation, recovery instructions) instead of the ordinary update path; code rollback is unavailable after its declared point.',
+    };
+}
+export { ProductIdentityError };
+//# sourceMappingURL=data-compatibility.js.map

package/dist/update/data-compatibility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-compatibility.js","sourceRoot":"","sources":["../../src/update/data-compatibility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAgB1G;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAGzC;IACC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACtC,MAAM,cAAc,GAAG,mBAAmB,CACxC,SAAS,CAAC,aAAa,CAAC,6BAA6B,EACrD,6CAA6C,CAC9C,CAAC;IAEF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,yBAAyB;YAC/B,qBAAqB,EAAE,cAAc,CAAC,cAAc;SACrD,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,mBAAmB,CAAC,QAAQ,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC;IAChG,IAAI,sBAAsB,CAAC,eAAe,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,yBAAyB;YAC/B,qBAAqB,EAAE,cAAc,CAAC,cAAc;SACrD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,4CAA4C;QACpD,OAAO,EAAE,WAAW,SAAS,CAAC,cAAc,0CAA0C,cAAc,CAAC,cAAc,0CAA0C,QAAQ,CAAC,cAAc,kDAAkD;QACtO,UAAU,EAAE,2LAA2L;KACxM,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/update/install-layout.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Installation layout contract (SPEC §5).
+ *
+ * Production installation state lives under `~/.pd`:
+ *
+ *   bootstrap/  installer-owned; a product release can never overwrite it
+ *   install.json  channel selection + automatic check settings
+ *   trust/      TUF trusted root metadata cache
+ *   channels/   cached signed channel metadata
+ *   releases/<release-id>/
+ *   staging/<transaction-id>/
+ *   transactions/<transaction-id>.json
+ *   active.json / previous.json
+ *   logs/
+ *
+ * This module owns ONLY path derivation and strict readers. Every read of
+ * untrusted on-disk JSON returns `unknown` until validated (rc-1) and fails
+ * loud on malformed required fields (rc-3).
+ */
+import { type ReleaseChannelName } from './product-identity.js';
+export interface PdHomePaths {
+    readonly home: string;
+    readonly bootstrapDir: string;
+    readonly bootstrapManifestPath: string;
+    readonly installConfigPath: string;
+    readonly trustDir: string;
+    readonly channelsDir: string;
+    readonly releasesDir: string;
+    readonly stagingDir: string;
+    readonly transactionsDir: string;
+    readonly activeRecordPath: string;
+    readonly previousRecordPath: string;
+    readonly logsDir: string;
+}
+export declare function resolvePdHomePaths(pdHome: string): PdHomePaths;
+/** Creates the installation skeleton once; never touches an existing file. */
+export declare function ensurePdHomeLayout(paths: PdHomePaths): void;
+export declare class InstallLayoutError extends Error {
+    readonly field: string;
+    constructor(field: string, message: string);
+}
+export interface BootstrapManifest {
+    readonly bootstrapVersion: string;
+    readonly installedAt: string;
+}
+/** Strict reader for the installer-owned bootstrap manifest. */
+export declare function readBootstrapManifest(paths: PdHomePaths): BootstrapManifest | null;
+export interface InstallConfig {
+    readonly channel: ReleaseChannelName;
+    readonly autoCheck: boolean;
+}
+/**
+ * Installation-level settings (SPEC §2.3). Missing file yields the safe
+ * default (stable channel, automatic checks off); a malformed file fails
+ * loud instead of degrading to guesses.
+ */
+export declare function readInstallConfig(paths: PdHomePaths): InstallConfig;
+export declare function writeInstallConfig(paths: PdHomePaths, config: InstallConfig): void;
+//# sourceMappingURL=install-layout.d.ts.map

package/dist/update/install-layout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-layout.d.ts","sourceRoot":"","sources":["../../src/update/install-layout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EAAmE,KAAK,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEjI,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAgB9D;AAED,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAO3D;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,YAAY,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAIzC;CACF;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAgBD,gEAAgE;AAChE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,iBAAiB,GAAG,IAAI,CAuBlF;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,aAAa,CAgBnE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,CAOlF"}