create-principles-disciple 1.132.6 → 1.133.0

package/dist/update/apply-payload.js

@@ -0,0 +1,166 @@
+/**
+ * PRI-698 Phase 1 — apply payload acquisition for the ReleaseManager.
+ *
+ * Bridges the signed metadata world (TUF-verified release metadata + artifact
+ * target) and the installer's deployment contract (a local, extracted,
+ * self-contained release-asset directory). Owns ONLY acquisition-side writes,
+ * strictly bounded to the ReleaseManager staging area:
+ *
+ *   ~/.pd/staging/<transactionId>/release-asset.tar.gz   (verified download)
+ *   ~/.pd/staging/<transactionId>/payload/               (extracted payload)
+ *
+ * Deployment writes (~/.pd/runtime, host extension dirs) belong exclusively
+ * to the installer; this module never touches them (ADR-0023 Decision 1,
+ * ADR-0024 §2.1). release-manager.ts itself stays free of filesystem
+ * mutation: it orchestrates, this helper acquires.
+ *
+ * Import-graph constraint: this module is reachable from the console's
+ * dynamically-imported authority module, so `installer.js` (the heavy CLI
+ * graph) is loaded via dynamic import at acquisition time only — the
+ * governed check path never pays for it.
+ *
+ * Artifact target convention (Phase 1, see
+ * docs/architecture/PRI-698-phase4-preflight-analysis.md §4): the release
+ * pipeline publishes each release asset as TUF target
+ *
+ *   releases/<releaseId>/release-asset-<platform>-<arch>.tar.gz
+ *
+ * with TUF `custom` identity {releaseId, channel, platform} and tarball
+ * contents = the release-asset directory at its root (no wrapping component
+ * directory). The pipeline does not publish these targets yet; the flag
+ * stays off in production until it does.
+ */
+import { execFileSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { resolveTrustedReleaseTarget, downloadTrustedReleasePayload, } from './trust-metadata.js';
+/** Acquisition failure with a stable reason; release-manager.ts maps it onto the ReleaseManagerError contract. */
+export class ApplyPayloadError extends Error {
+    reason;
+    nextAction;
+    constructor(reason, message, nextAction) {
+        super(message);
+        this.name = 'ApplyPayloadError';
+        this.reason = reason;
+        this.nextAction = nextAction;
+    }
+}
+/**
+ * Select the release asset matching THIS runtime (platform + arch + node ABI)
+ * from the signed release metadata. A payload built for a different node ABI
+ * can break native modules after the swap, so a mismatch is a refusal, never
+ * a warning (rc-3: fail loud before any mutation).
+ */
+export function selectReleaseAsset(releaseMetadata) {
+    const { platform } = process;
+    const { arch } = process;
+    const nodeAbi = process.versions.modules;
+    const asset = releaseMetadata.assets.find((a) => a.platform === platform && a.arch === arch);
+    if (asset === undefined) {
+        throw new ApplyPayloadError('release_metadata_invalid', `Release ${releaseMetadata.productVersion} declares no asset for this platform (${platform}/${arch}); declared: ${releaseMetadata.assets.map((a) => `${a.platform}/${a.arch}`).join(', ') || 'none'}.`, 'Wait for a release asset covering this platform, or update from a supported host.');
+    }
+    if (asset.nodeAbi !== nodeAbi) {
+        throw new ApplyPayloadError('release_metadata_invalid', `Release ${releaseMetadata.productVersion} asset for ${platform}/${arch} targets node ABI ${asset.nodeAbi}, but this runtime is ABI ${nodeAbi}.`, 'Upgrade the bootstrap runtime first, or publish a release asset built for this node ABI.');
+    }
+    return asset;
+}
+/** TUF target path of the release asset for THIS platform (Phase 1 convention). */
+export function releaseAssetTargetPath(releaseId) {
+    return `releases/${releaseId}/release-asset-${process.platform}-${process.arch}.tar.gz`;
+}
+/**
+ * Resolve the signed artifact target, cross-check the TUF identity and digest
+ * against the signed release metadata (rc-6), and download it with in-flight
+ * sha256 verification into `~/.pd/staging/<transactionId>/`.
+ * Zero writes happen before every identity check has passed.
+ */
+export async function downloadReleaseAsset(options) {
+    const { paths, metadataBaseUrl, fetcher, releaseMetadata, channel, transactionId } = options;
+    const asset = selectReleaseAsset(releaseMetadata);
+    const targetPath = releaseAssetTargetPath(releaseMetadata.releaseId);
+    let trustedTarget;
+    try {
+        trustedTarget = await resolveTrustedReleaseTarget({
+            metadataDir: paths.trustDir,
+            metadataBaseUrl,
+            targetPath,
+            expectedChannel: channel,
+            expectedPlatform: process.platform,
+            fetcher,
+        });
+    }
+    catch (error) {
+        throw new ApplyPayloadError('metadata_refresh_failed', `The signed artifact target for release ${releaseMetadata.releaseId} could not be resolved: ${error instanceof Error ? error.message : String(error)}`, 'Verify that the release pipeline published this release asset to the signed repository, then retry.');
+    }
+    // rc-6: the TUF-signed identity and the release metadata must name the same
+    // release and the same bytes — a mismatch means the channel points at
+    // metadata the artifact repo does not answer for. Refuse before any write.
+    if (trustedTarget.releaseId !== releaseMetadata.releaseId) {
+        throw new ApplyPayloadError('release_metadata_invalid', `Signed artifact target names release ${trustedTarget.releaseId}, but the channel metadata names ${releaseMetadata.releaseId}.`, 'The release repository is inconsistent; wait for refreshed signed metadata. Nothing was modified.');
+    }
+    if (trustedTarget.artifactSha256 !== asset.archiveSha256) {
+        throw new ApplyPayloadError('release_metadata_invalid', 'The signed artifact digest disagrees with the digest in the signed release metadata.', 'The release repository is inconsistent; wait for refreshed signed metadata. Nothing was modified.');
+    }
+    const transactionDir = path.join(paths.stagingDir, transactionId);
+    const archivePath = path.join(transactionDir, 'release-asset.tar.gz');
+    fs.mkdirSync(transactionDir, { recursive: true });
+    try {
+        await downloadTrustedReleasePayload({
+            metadataDir: paths.trustDir,
+            metadataBaseUrl,
+            targetPath,
+            destinationPath: archivePath,
+            fetcher,
+        });
+    }
+    catch (error) {
+        throw new ApplyPayloadError('metadata_refresh_failed', `The signed release asset could not be downloaded: ${error instanceof Error ? error.message : String(error)}`, 'Check network access to the release repository and retry; nothing was deployed.');
+    }
+    return { transactionDir, archivePath, trustedTarget };
+}
+/**
+ * Extract the release-asset tarball with the same discipline as the legacy
+ * console updater (EP-08): spawn tar via an argv array so paths stay data,
+ * and use cwd + RELATIVE archive/dir paths — Git Bash GNU tar on Windows
+ * misparses `D:\...` as a remote host (ERR: "Cannot connect to C:"), while
+ * Windows System32 bsdtar does not support GNU's --force-local. Relative is
+ * the universal form.
+ */
+function extractReleaseAssetArchive(transactionDir, payloadDir) {
+    execFileSync('tar', ['xzf', 'release-asset.tar.gz', '-C', 'payload'], {
+        cwd: transactionDir,
+        stdio: 'pipe',
+    });
+    if (!fs.existsSync(path.join(payloadDir, '_release', 'manifest.json'))) {
+        throw new Error('the artifact tarball does not contain a self-contained release asset at its root (missing _release/manifest.json)');
+    }
+}
+/**
+ * Extract the verified archive inside the staging transaction dir and run the
+ * installer's own self-contained asset preflight (the same verification gate
+ * a manual `npx create-principles-disciple` run of this payload would face).
+ * Every write stays inside the staging transaction dir.
+ */
+export async function extractAndVerifyReleaseAsset(options) {
+    const { transactionDir, archivePath } = options;
+    if (!fs.existsSync(archivePath)) {
+        throw new ApplyPayloadError('release_metadata_invalid', `The verified release archive is missing from staging: ${archivePath}`, 'Nothing was deployed; the runtime is unchanged. Retry the update.');
+    }
+    const payloadDir = path.join(transactionDir, 'payload');
+    try {
+        fs.mkdirSync(payloadDir, { recursive: true });
+        extractReleaseAssetArchive(transactionDir, payloadDir);
+        // Dynamic import: keeps installer.js (and its CLI dependency graph) out
+        // of the module graph until a real acquisition needs it — the governed
+        // check path never pays for it.
+        const { preflightSelfContainedReleaseAsset } = await import('../installer.js');
+        await preflightSelfContainedReleaseAsset(payloadDir);
+    }
+    catch (error) {
+        if (error instanceof ApplyPayloadError)
+            throw error;
+        throw new ApplyPayloadError('release_metadata_invalid', `The downloaded release payload failed verification: ${error instanceof Error ? error.message : String(error)}`, 'Nothing was deployed; the runtime is unchanged. Retry the update after the release repository issue is resolved.');
+    }
+    return { payloadDir };
+}
+//# sourceMappingURL=apply-payload.js.map

package/dist/update/apply-payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-payload.js","sourceRoot":"","sources":["../../src/update/apply-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,GAE9B,MAAM,qBAAqB,CAAC;AAO7B,kHAAkH;AAClH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,MAAM,CAAyD;IAC/D,UAAU,CAAS;IAE5B,YAAY,MAA8D,EAAE,OAAe,EAAE,UAAkB;QAC7G,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,eAAgC;IACjE,MAAM,EAAC,QAAQ,EAAC,GAAG,OAAO,CAAC;IAC3B,MAAM,EAAC,IAAI,EAAC,GAAG,OAAO,CAAC;IACvB,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC7F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,iBAAiB,CACzB,0BAA0B,EAC1B,WAAW,eAAe,CAAC,cAAc,yCAAyC,QAAQ,IAAI,IAAI,gBAAgB,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,EACtM,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,iBAAiB,CACzB,0BAA0B,EAC1B,WAAW,eAAe,CAAC,cAAc,cAAc,QAAQ,IAAI,IAAI,qBAAqB,KAAK,CAAC,OAAO,6BAA6B,OAAO,GAAG,EAChJ,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,OAAO,YAAY,SAAS,kBAAkB,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,SAAS,CAAC;AAC1F,CAAC;AAkBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAoC;IAC7E,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAC7F,MAAM,KAAK,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,sBAAsB,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IAErE,IAAI,aAAmC,CAAC;IACxC,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,2BAA2B,CAAC;YAChD,WAAW,EAAE,KAAK,CAAC,QAAQ;YAC3B,eAAe;YACf,UAAU;YACV,eAAe,EAAE,OAAO;YACxB,gBAAgB,EAAE,OAAO,CAAC,QAAQ;YAClC,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CACzB,yBAAyB,EACzB,0CAA0C,eAAe,CAAC,SAAS,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACtJ,qGAAqG,CACtG,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,sEAAsE;IACtE,2EAA2E;IAC3E,IAAI,aAAa,CAAC,SAAS,KAAK,eAAe,CAAC,SAAS,EAAE,CAAC;QAC1D,MAAM,IAAI,iBAAiB,CACzB,0BAA0B,EAC1B,wCAAwC,aAAa,CAAC,SAAS,oCAAoC,eAAe,CAAC,SAAS,GAAG,EAC/H,mGAAmG,CACpG,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,cAAc,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;QACzD,MAAM,IAAI,iBAAiB,CACzB,0BAA0B,EAC1B,sFAAsF,EACtF,mGAAmG,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC;IACtE,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,6BAA6B,CAAC;YAClC,WAAW,EAAE,KAAK,CAAC,QAAQ;YAC3B,eAAe;YACf,UAAU;YACV,eAAe,EAAE,WAAW;YAC5B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CACzB,yBAAyB,EACzB,qDAAqD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC7G,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;AACxD,CAAC;AAOD;;;;;;;GAOG;AACH,SAAS,0BAA0B,CAAC,cAAsB,EAAE,UAAkB;IAC5E,YAAY,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE;QACpE,GAAG,EAAE,cAAc;QACnB,KAAK,EAAE,MAAM;KACd,CAAC,CAAC;IACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,OAAgC;IACjF,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAChD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,iBAAiB,CACzB,0BAA0B,EAC1B,yDAAyD,WAAW,EAAE,EACtE,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,0BAA0B,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QACvD,wEAAwE;QACxE,uEAAuE;QACvE,gCAAgC;QAChC,MAAM,EAAE,kCAAkC,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC/E,MAAM,kCAAkC,CAAC,UAAU,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iBAAiB;YAAE,MAAM,KAAK,CAAC;QACpD,MAAM,IAAI,iBAAiB,CACzB,0BAA0B,EAC1B,uDAAuD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC/G,kHAAkH,CACnH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC"}

package/dist/update/bootstrap-protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap-protocol.d.ts","sourceRoot":"","sources":["../../src/update/bootstrap-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,OAAO,KAAK,EAAE,cAAc,EAAC,MAAM,sBAAsB,CAAC;AAG1D,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC;AAE5E,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAA;CAAE,CAAC;AAEhC,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,GAAG,wBAAwB,CAAC;AAE/E,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,YAAY,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAI1C;CACF;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAsDnE;AAED,iFAAiF;AACjF,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAE9E;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,gBAAgB,EACzB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,iBAAiB,CAAC,CAsC5B"}
+{"version":3,"file":"bootstrap-protocol.d.ts","sourceRoot":"","sources":["../../src/update/bootstrap-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,OAAO,KAAK,EAAE,cAAc,EAAC,MAAM,sBAAsB,CAAC;AAG1D,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC;AAE5E,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAA;CAAE,CAAC;AAEhC,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,GAAG,wBAAwB,CAAC;AAE/E,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,YAAY,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAI1C;CACF;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAsDnE;AAED,iFAAiF;AACjF,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAE9E;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,gBAAgB,EACzB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,iBAAiB,CAAC,CAkD5B"}

package/dist/update/bootstrap-protocol.js

@@ -97,8 +97,20 @@ export async function handleBootstrapRequest(request, manager) {
             case 'check':
                 return { ok: true, result: await manager.check(request.channel) };
             case 'apply':
-                await manager.apply();
-                return { ok: true, result: { applied: true } };
+                // PRI-698 Phase 1: apply() is the real write orchestrator now and
+                // requires a caller deployment context (workspaceDir) the bootstrap
+                // wire contract does not carry. This protocol surface has no
+                // production transport and never served apply (it previously refused
+                // with `shadow_mode_read_only`); returning a structured refusal keeps
+                // that parity without inventing protocol fields for a consumer that
+                // does not exist yet (P7). Extend the wire contract with the real
+                // first consumer.
+                return {
+                    ok: false,
+                    reason: 'apply_not_supported_over_bootstrap_protocol',
+                    message: 'The bootstrap protocol does not carry the deployment context ReleaseManager.apply() requires.',
+                    nextAction: 'Trigger updates through the Console update surface, which supplies the deployment context.',
+                };
             case 'rollback':
                 await manager.rollback();
                 return { ok: true, result: { rolledBack: true } };

package/dist/update/bootstrap-protocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap-protocol.js","sourceRoot":"","sources":["../../src/update/bootstrap-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAwB3D,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,MAAM,CAAS;IAExB,YAAY,MAAc,EAAE,OAAe;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,sBAAsB,CAAC,wBAAwB,EAAE,sCAAsC,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,sBAAsB,CAAC,4BAA4B,EAAE,wDAAwD,CAAC,CAAC;IAC3H,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,sBAAsB,CAAC,uBAAuB,EAAE,4CAA4C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClK,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,sBAAsB,CAAC,4BAA4B,EAAE,wDAAwD,CAAC,CAAC;IAC3H,CAAC;IACD,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,sBAAsB,CAAC,qBAAqB,EAAE,2DAA2D,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,EAAC,EAAE,EAAC,GAAG,MAAM,CAAC;IACpB,MAAM,QAAQ,GAAkC,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1F,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAwB,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,sBAAsB,CAAC,qBAAqB,EAAE,yBAAyB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,gBAAgB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7I,CAAC;IACD,MAAM,aAAa,GAAG,EAAE,KAAK,OAAO;QAClC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5B,CAAC,CAAC,EAAE,KAAK,OAAO;YACd,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC9B,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,sBAAsB,CAAC,wBAAwB,EAAE,qCAAqC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,sBAAsB,CAAC,0BAA0B,EAAE,+CAA+C,CAAC,CAAC;QAChH,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,sBAAsB,CAAC,0BAA0B,EAAE,iDAAiD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,sBAAsB,CAAC,6BAA6B,EAAE,kDAAkD,CAAC,CAAC;QACtH,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,sBAAsB,CAAC,6BAA6B,EAAE,8CAA8C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACpJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;AACpE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,0BAA0B,CAAC,QAA2B;IACpE,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAyB,EACzB,OAAuB;IAEvB,IAAI,CAAC;QACH,QAAQ,OAAO,CAAC,EAAE,EAAE,CAAC;YACnB,KAAK,SAAS;gBACZ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACxE,KAAK,OAAO;gBACV,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACpE,KAAK,OAAO;gBACV,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;gBACtB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;YACjD,KAAK,UAAU;gBACb,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;YACzC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gBAAgB;YACxB,OAAO;YACP,UAAU,EAAE,kGAAkG;SAC/G,CAAC;IACJ,CAAC;IACD,kEAAkE;IAClE,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,6BAA6B;QACtC,UAAU,EAAE,iCAAiC;KAC9C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"bootstrap-protocol.js","sourceRoot":"","sources":["../../src/update/bootstrap-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAwB3D,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,MAAM,CAAS;IAExB,YAAY,MAAc,EAAE,OAAe;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,sBAAsB,CAAC,wBAAwB,EAAE,sCAAsC,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,sBAAsB,CAAC,4BAA4B,EAAE,wDAAwD,CAAC,CAAC;IAC3H,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,sBAAsB,CAAC,uBAAuB,EAAE,4CAA4C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClK,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,sBAAsB,CAAC,4BAA4B,EAAE,wDAAwD,CAAC,CAAC;IAC3H,CAAC;IACD,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,sBAAsB,CAAC,qBAAqB,EAAE,2DAA2D,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,EAAC,EAAE,EAAC,GAAG,MAAM,CAAC;IACpB,MAAM,QAAQ,GAAkC,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1F,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAwB,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,sBAAsB,CAAC,qBAAqB,EAAE,yBAAyB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,gBAAgB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7I,CAAC;IACD,MAAM,aAAa,GAAG,EAAE,KAAK,OAAO;QAClC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5B,CAAC,CAAC,EAAE,KAAK,OAAO;YACd,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC9B,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,sBAAsB,CAAC,wBAAwB,EAAE,qCAAqC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,sBAAsB,CAAC,0BAA0B,EAAE,+CAA+C,CAAC,CAAC;QAChH,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,sBAAsB,CAAC,0BAA0B,EAAE,iDAAiD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,sBAAsB,CAAC,6BAA6B,EAAE,kDAAkD,CAAC,CAAC;QACtH,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,sBAAsB,CAAC,6BAA6B,EAAE,8CAA8C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACpJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;AACpE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,0BAA0B,CAAC,QAA2B;IACpE,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAyB,EACzB,OAAuB;IAEvB,IAAI,CAAC;QACH,QAAQ,OAAO,CAAC,EAAE,EAAE,CAAC;YACnB,KAAK,SAAS;gBACZ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACxE,KAAK,OAAO;gBACV,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACpE,KAAK,OAAO;gBACV,kEAAkE;gBAClE,oEAAoE;gBACpE,6DAA6D;gBAC7D,qEAAqE;gBACrE,sEAAsE;gBACtE,oEAAoE;gBACpE,kEAAkE;gBAClE,kBAAkB;gBAClB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,6CAA6C;oBACrD,OAAO,EAAE,+FAA+F;oBACxG,UAAU,EAAE,4FAA4F;iBACzG,CAAC;YACJ,KAAK,UAAU;gBACb,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;YACzC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gBAAgB;YACxB,OAAO;YACP,UAAU,EAAE,kGAAkG;SAC/G,CAAC;IACJ,CAAC;IACD,kEAAkE;IAClE,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,6BAA6B;QACtC,UAAU,EAAE,iCAAiC;KAC9C,CAAC;AACJ,CAAC"}

package/dist/update/release-manager-authority.d.ts

@@ -31,6 +31,15 @@
  * activation rollout opens the `shadow_mode_read_only` gate (its own go/no-go);
  * until then these kinds explicitly fall back to the legacy console updater —
  * TEMPORARY migration debt per ADR-0024 D-1, not a supported long-term state.
+ *
+ * PRI-698 Phase 1: `apply-full` (full-runtime update) is served by the real
+ * ReleaseManager.apply() orchestration (installer + journal) and reports the
+ * same base readiness as `check`. The CONSOLE additionally gates the routing
+ * behind the `release_manager_write_authority` flag (default off) — flag-off
+ * dispatches fall back explicitly with `release_manager_write_disabled`.
+ * `apply` (the plugin-diff mechanism, which the ReleaseManager does not
+ * implement) and `rollback` (Phase 2 — must prove same-version restore first)
+ * stay structurally not-ready with explicit reasons.
  */
 import { ReleaseManager, type InstallStatus, type LegacyUpdaterDecision } from './release-manager.js';
 /** Mutation kinds the console MutationController routes (PRI-659 contract). */
@@ -60,10 +69,16 @@ export declare function createReleaseManagerAuthority(options: ReleaseManagerAut
 /**
  * Map a ReleaseManager refusal onto the console's explicit-fallback reason
  * vocabulary (rc-9: degradation must be observable with a stable reason).
+ * `transactionOpened` passes through the PRI-698 default-on safety net
+ * semantics: false ⇒ the refusal happened before any side effect, so the
+ * console may fall back to the legacy updater with an explicit reason; true
+ * ⇒ runtime-side effects may exist and the refusal must surface as a
+ * failure, never as a fallback.
  */
 export declare function mapReleaseManagerErrorToFallback(error: unknown): {
     reason: string;
     message: string;
     nextAction: string | null;
+    transactionOpened: boolean;
 };
 //# sourceMappingURL=release-manager-authority.d.ts.map

package/dist/update/release-manager-authority.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-manager-authority.d.ts","sourceRoot":"","sources":["../../src/update/release-manager-authority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAGH,OAAO,EACL,cAAc,EAEd,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAG9B,+EAA+E;AAC/E,eAAO,MAAM,+BAA+B,YAAI,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,CAAU,CAAC;AACrG,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3F,MAAM,MAAM,6BAA6B,GACrC,8BAA8B,GAC9B,yBAAyB,GACzB,uBAAuB,GACvB,uBAAuB,GACvB,wBAAwB,CAAC;AAE7B,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,6BAA6B,EAAE,CAAC;CAC5D;AAKD,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;CAC1F;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,mFAAmF;IACnF,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,2BAA2B,EAAE,gCAAgC,CAAC,CAAC,CAAC;CACjG;AAkBD,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,8BAA8B,GACtC,uBAAuB,CAuDzB;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAG;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CASA"}
+{"version":3,"file":"release-manager-authority.d.ts","sourceRoot":"","sources":["../../src/update/release-manager-authority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAGH,OAAO,EACL,cAAc,EAEd,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAG9B,+EAA+E;AAC/E,eAAO,MAAM,+BAA+B,YAAI,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,CAAU,CAAC;AACrG,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3F,MAAM,MAAM,6BAA6B,GACrC,8BAA8B,GAC9B,yBAAyB,GACzB,uBAAuB,GACvB,uBAAuB,GACvB,wBAAwB,CAAC;AAE7B,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,6BAA6B,EAAE,CAAC;CAC5D;AAUD,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;CAC1F;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,mFAAmF;IACnF,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,2BAA2B,EAAE,gCAAgC,CAAC,CAAC,CAAC;CACjG;AAkBD,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,8BAA8B,GACtC,uBAAuB,CA0DzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAG;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iBAAiB,EAAE,OAAO,CAAC;CAC5B,CAeA"}

package/dist/update/release-manager-authority.js

@@ -31,14 +31,28 @@
  * activation rollout opens the `shadow_mode_read_only` gate (its own go/no-go);
  * until then these kinds explicitly fall back to the legacy console updater —
  * TEMPORARY migration debt per ADR-0024 D-1, not a supported long-term state.
+ *
+ * PRI-698 Phase 1: `apply-full` (full-runtime update) is served by the real
+ * ReleaseManager.apply() orchestration (installer + journal) and reports the
+ * same base readiness as `check`. The CONSOLE additionally gates the routing
+ * behind the `release_manager_write_authority` flag (default off) — flag-off
+ * dispatches fall back explicitly with `release_manager_write_disabled`.
+ * `apply` (the plugin-diff mechanism, which the ReleaseManager does not
+ * implement) and `rollback` (Phase 2 — must prove same-version restore first)
+ * stay structurally not-ready with explicit reasons.
  */
 import * as fs from 'node:fs';
 import { ReleaseManager, ReleaseManagerError, } from './release-manager.js';
 import { InstallLayoutError, resolvePdHomePaths } from './install-layout.js';
 /** Mutation kinds the console MutationController routes (PRI-659 contract). */
 export const RELEASE_MANAGER_AUTHORITY_KINDS = ['check', 'apply', 'apply-full', 'rollback'];
-/** Structural gate: activation/rollback arrive with the Phase 4 transaction rollout. */
-const ACTIVATION_AVAILABLE = false;
+/**
+ * Structural gate for the kinds whose write path does not exist yet:
+ * `rollback` arrives with the Phase 2 restore migration; `apply` (plugin
+ * diff) is not a ReleaseManager mechanism at all. `apply-full` left this
+ * gate in PRI-698 Phase 1.
+ */
+const ROLLBACK_AVAILABLE = false;
 /**
  * Probe the transactions directory WITHOUT writing: an existing directory must
  * be writable (the journal is a mandatory mutation contract, ADR-0024 D-2), a
@@ -95,15 +109,18 @@ export function createReleaseManagerAuthority(options) {
         },
         apply: {
             ready: false,
-            reasons: ACTIVATION_AVAILABLE ? baseReasons : [...baseReasons, 'rollback_not_available'],
+            reasons: ROLLBACK_AVAILABLE ? baseReasons : [...baseReasons, 'rollback_not_available'],
         },
+        // PRI-698 Phase 1: the full-runtime write path exists (ReleaseManager.apply
+        // → installer → journal). Console routing is additionally flag-gated
+        // (`release_manager_write_authority`, default off).
         'apply-full': {
-            ready: false,
-            reasons: ACTIVATION_AVAILABLE ? baseReasons : [...baseReasons, 'rollback_not_available'],
+            ready: baseReady,
+            reasons: baseReasons,
         },
         rollback: {
             ready: false,
-            reasons: ACTIVATION_AVAILABLE ? baseReasons : [...baseReasons, 'rollback_not_available'],
+            reasons: ROLLBACK_AVAILABLE ? baseReasons : [...baseReasons, 'rollback_not_available'],
         },
     };
     return { manager, installStatus, kinds };
@@ -111,15 +128,26 @@ export function createReleaseManagerAuthority(options) {
 /**
  * Map a ReleaseManager refusal onto the console's explicit-fallback reason
  * vocabulary (rc-9: degradation must be observable with a stable reason).
+ * `transactionOpened` passes through the PRI-698 default-on safety net
+ * semantics: false ⇒ the refusal happened before any side effect, so the
+ * console may fall back to the legacy updater with an explicit reason; true
+ * ⇒ runtime-side effects may exist and the refusal must surface as a
+ * failure, never as a fallback.
  */
 export function mapReleaseManagerErrorToFallback(error) {
     if (error instanceof ReleaseManagerError) {
-        return { reason: error.reason, message: error.message, nextAction: error.nextAction };
+        return {
+            reason: error.reason,
+            message: error.message,
+            nextAction: error.nextAction,
+            transactionOpened: error.transactionOpened,
+        };
     }
     return {
         reason: 'release_manager_check_failed',
         message: error instanceof Error ? error.message : String(error),
         nextAction: null,
+        transactionOpened: false,
     };
 }
 //# sourceMappingURL=release-manager-authority.js.map

package/dist/update/release-manager-authority.js.map

@@ -1 +1 @@
-{"version":3,"file":"release-manager-authority.js","sourceRoot":"","sources":["../../src/update/release-manager-authority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EACL,cAAc,EACd,mBAAmB,GAGpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,CAAU,CAAC;AAerG,wFAAwF;AACxF,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAmBnC;;;;;GAKG;AACH,SAAS,0BAA0B,CAAC,MAAc;IAChD,MAAM,EAAE,eAAe,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,eAAe,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAAuC;IAEvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEzD,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClF,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC;QACjC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,EAAE;QAC9C,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnF,CAAC,CAAC;IAEH,IAAI,aAAa,GAAyB,IAAI,CAAC;IAC/C,IAAI,CAAC;QACH,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,IAAI,KAAK,YAAY,kBAAkB,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;YAChF,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,aAAa,KAAK,IAAI,IAAI,aAAa,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,CAAC,GAAG,OAAO,CAAU,CAAC;IAC1C,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE;YACL,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,WAAW;SACrB;QACD,KAAK,EAAE;YACL,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,GAAG,WAAW,EAAE,wBAAwB,CAAW;SACpG;QACD,YAAY,EAAE;YACZ,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,GAAG,WAAW,EAAE,wBAAwB,CAAW;SACpG;QACD,QAAQ,EAAE;YACR,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,oBAAoB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,GAAG,WAAW,EAAE,wBAAwB,CAAW;SACpG;KACwF,CAAC;IAE5F,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAAC,KAAc;IAK7D,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;QACzC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;IACxF,CAAC;IACD,OAAO;QACL,MAAM,EAAE,8BAA8B;QACtC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/D,UAAU,EAAE,IAAI;KACjB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"release-manager-authority.js","sourceRoot":"","sources":["../../src/update/release-manager-authority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EACL,cAAc,EACd,mBAAmB,GAGpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,CAAU,CAAC;AAerG;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAmBjC;;;;;GAKG;AACH,SAAS,0BAA0B,CAAC,MAAc;IAChD,MAAM,EAAE,eAAe,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,eAAe,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAAuC;IAEvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEzD,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClF,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC;QACjC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,EAAE;QAC9C,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnF,CAAC,CAAC;IAEH,IAAI,aAAa,GAAyB,IAAI,CAAC;IAC/C,IAAI,CAAC;QACH,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,IAAI,KAAK,YAAY,kBAAkB,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;YAChF,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,aAAa,KAAK,IAAI,IAAI,aAAa,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,CAAC,GAAG,OAAO,CAAU,CAAC;IAC1C,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE;YACL,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,WAAW;SACrB;QACD,KAAK,EAAE;YACL,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,GAAG,WAAW,EAAE,wBAAwB,CAAW;SAClG;QACD,4EAA4E;QAC5E,qEAAqE;QACrE,oDAAoD;QACpD,YAAY,EAAE;YACZ,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,WAAW;SACrB;QACD,QAAQ,EAAE;YACR,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,GAAG,WAAW,EAAE,wBAAwB,CAAW;SAClG;KACwF,CAAC;IAE5F,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gCAAgC,CAAC,KAAc;IAM7D,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;QACzC,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC3C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,8BAA8B;QACtC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/D,UAAU,EAAE,IAAI;QAChB,iBAAiB,EAAE,KAAK;KACzB,CAAC;AACJ,CAAC"}

package/dist/update/release-manager.d.ts

@@ -3,9 +3,18 @@
  *
  * External surface is intentionally small: inspect / check / apply /
  * rollback. The module hides metadata validation, download, extraction,
- * staging, probes, journaling, host control, rollback, and cleanup. In this
- * phase (shadow mode) apply/rollback refuse read-only: activation lands with
- * the transaction state machine, never by loosening this gate.
+ * staging, probes, journaling, host control, rollback, and cleanup.
+ *
+ * PRI-698 Phase 1: `apply()` is the update ORCHESTRATOR. It acquires the
+ * signed release payload into the staging area (apply-payload.ts) and hands
+ * deployment to the installer — the only direct artifact deployment authority
+ * (ADR-0024 §2.1) — as ONE journaled transaction (planned → downloaded →
+ * verified by this module; staged → probed → activated → confirmed by the
+ * installer's existing cycle, same journal file). This module performs ZERO
+ * deployment-side filesystem mutation: no writes under `~/.pd/runtime` or the
+ * host extension directories ever originate here. `rollback()` still refuses:
+ * rollback migration is Phase 2 and must prove same-version restore before it
+ * replaces the legacy rollback.
  *
  * Every refusal carries a stable reason and an Owner-visible next action
  * (rc-9) and is computed BEFORE any installation state is mutated.
@@ -13,12 +22,23 @@
 import { resolveTrustedReleaseTarget, type TrustedReleaseTarget } from './trust-metadata.js';
 import { buildReleaseMetadata } from './release-metadata.js';
 import { type ReleasePolicyDecision } from './release-policy.js';
+import type { Language } from '../i18n.js';
+import type { HostTarget } from '../installers/index.js';
 import type { ReleaseChannelName } from './product-identity.js';
-export type ReleaseManagerReason = 'shadow_mode_read_only' | 'bootstrap_not_installed' | 'metadata_refresh_failed' | 'release_metadata_unavailable' | 'release_metadata_invalid' | 'active_record_corrupt';
+export type ReleaseManagerReason = 'shadow_mode_read_only' | 'bootstrap_not_installed' | 'metadata_refresh_failed' | 'release_metadata_unavailable' | 'release_metadata_invalid' | 'active_record_corrupt' | 'legacy_layout_not_supported' | 'journal_unavailable' | 'apply_failed';
 export declare class ReleaseManagerError extends Error {
     readonly reason: ReleaseManagerReason;
     readonly nextAction: string;
-    constructor(reason: ReleaseManagerReason, message: string, nextAction: string);
+    /**
+     * PRI-698 Phase 1 default-on safety net: true when the refusal happened
+     * AFTER the apply transaction was opened (planned journaled) — runtime
+     * state may include staging writes and a terminal journal tail. False for
+     * pre-transaction refusals (layout, metadata, journal-unavailable): the
+     * caller can safely fall back to the legacy updater with an explicit
+     * reason, because zero side effects exist.
+     */
+    readonly transactionOpened: boolean;
+    constructor(reason: ReleaseManagerReason, message: string, nextAction: string, transactionOpened?: boolean);
 }
 export type InstallationLayout = 'dual-slot' | 'legacy-overlay' | 'none';
 export interface InstallStatus {
@@ -55,6 +75,25 @@ export interface UpdateCheck {
         readonly note: string | null;
     };
 }
+/** Caller-supplied deployment context for apply() (PRI-698 Phase 1). */
+export interface ApplyOptions {
+    /** Workspace the installer re-run operates on (console passes its own). */
+    readonly workspaceDir: string;
+    /** Installer language; defaults to 'zh' (the installer's default locale). */
+    readonly language?: Language;
+    /** Host installers to run; defaults to 'openclaw' (matches the legacy full-update sync). */
+    readonly host?: HostTarget;
+}
+export type ApplyOutcome = {
+    readonly kind: 'applied';
+    readonly productVersion: string;
+    readonly transactionId: string;
+    readonly journalPath: string;
+} | {
+    readonly kind: 'no_update';
+    /** Why nothing was applied (policy refusal reason or already-current note). */
+    readonly note: string;
+};
 export interface ReleaseManagerOptions {
     readonly pdHome: string;
     readonly metadataBaseUrl: string;
@@ -83,8 +122,37 @@ export declare class ReleaseManager {
     constructor(options: ReleaseManagerOptions);
     inspect(): InstallStatus;
     check(channel: ReleaseChannelName): Promise<UpdateCheck>;
-    apply(): Promise<never>;
+    /**
+     * PRI-698 Phase 1: the update orchestrator. Readiness → signed candidate
+     * resolution → payload acquisition into staging (journaled) → deployment
+     * through the installer (the only direct artifact deployment authority,
+     * ADR-0024 §2.1) as ONE transaction. Every failure leaves the runtime on
+     * the previous release and the journal at a terminal state.
+     */
+    apply(options: ApplyOptions): Promise<ApplyOutcome>;
     rollback(): Promise<never>;
+    /**
+     * Resolve + digest-verify + cache the signed channel document (shared by
+     * check() and apply(); writes stay inside the RM-owned channels cache).
+     */
+    private refreshSignedChannel;
+    /**
+     * evaluateReleaseAdvancement with the ACTIVE release's own metadata as the
+     * current state when a dual-slot installation records one (shared by
+     * check() and apply()).
+     */
+    private evaluateCandidateDecision;
+    /**
+     * The release metadata document names the bytes to deploy. check() only
+     * evaluates already-cached documents; apply() is the "transactional updater"
+     * that finally downloads it: TUF target `releases/<releaseId>/metadata.json`
+     * (Phase 1 convention, custom identity {releaseId, channel, platform:
+     * 'metadata'}) fetched digest-verified into the releases cache, then read
+     * back through the SAME strict validation path (identity + expiry + channel
+     * digest binding). A pre-seeded local document is still accepted unchanged,
+     * so check()-time behavior is untouched.
+     */
+    private ensureReleaseMetadataDocument;
     private legacyOverlayMarker;
     private readChannelMetadataPayload;
     private readActiveReleaseMetadata;

package/dist/update/release-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-manager.d.ts","sourceRoot":"","sources":["../../src/update/release-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EAAE,2BAA2B,EAAoD,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE/I,OAAO,EACL,oBAAoB,EAKrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAU7B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,MAAM,MAAM,oBAAoB,GAC5B,uBAAuB,GACvB,yBAAyB,GACzB,yBAAyB,GACzB,8BAA8B,GAC9B,0BAA0B,GAC1B,uBAAuB,CAAC;AAE5B,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,YAAY,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAK5E;CACF;AAED,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,gBAAgB,GAAG,MAAM,CAAC;AAEzE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;CACtC;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,OAAO,GAAG,IAAI,CAAC;CAC1C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,MAAM,EAAE,SAAS;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KACjF,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpD,QAAQ,CAAC,gBAAgB,EAAE;QACzB,QAAQ,CAAC,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAAC;QAC9C,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;QAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;KAC9B,CAAC;CACH;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChF,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACzF;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAwCD;;;;;GAKG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAc;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;IAEhD,YAAY,OAAO,EAAE,qBAAqB,EAGzC;IAED,OAAO,IAAI,aAAa,CAqBvB;IAEK,KAAK,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAwF7D;IAEK,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,CAO5B;IAEK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,CAO/B;IAED,OAAO,CAAC,mBAAmB;IAM3B,OAAO,CAAC,0BAA0B;IAelC,OAAO,CAAC,yBAAyB;IASjC,OAAO,CAAC,2BAA2B;YAiCrB,wBAAwB;CA8BvC;AAED,gEAAgE;AAChE,OAAO,EAAE,oBAAoB,EAAE,CAAC"}
+{"version":3,"file":"release-manager.d.ts","sourceRoot":"","sources":["../../src/update/release-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAMH,OAAO,EAAE,2BAA2B,EAAoD,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE/I,OAAO,EACL,oBAAoB,EAKrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAiB7B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,MAAM,MAAM,oBAAoB,GAC5B,uBAAuB,GACvB,yBAAyB,GACzB,yBAAyB,GACzB,8BAA8B,GAC9B,0BAA0B,GAC1B,uBAAuB,GACvB,6BAA6B,GAC7B,qBAAqB,GACrB,cAAc,CAAC;AAEnB,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IAGpC,YAAY,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,UAAQ,EAMvG;CACF;AAED,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,gBAAgB,GAAG,MAAM,CAAC;AAEzE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;CACtC;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,OAAO,GAAG,IAAI,CAAC;CAC1C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,MAAM,EAAE,SAAS;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KACjF,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpD,QAAQ,CAAC,gBAAgB,EAAE;QACzB,QAAQ,CAAC,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAAC;QAC9C,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;QAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;KAC9B,CAAC;CACH;AAED,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAC7B,4FAA4F;IAC5F,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,MAAM,YAAY,GACpB;IACA,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GACC;IACA,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAoEJ,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChF,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACzF;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAwCD;;;;;GAKG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAc;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;IAEhD,YAAY,OAAO,EAAE,qBAAqB,EAGzC;IAED,OAAO,IAAI,aAAa,CAqBvB;IAEK,KAAK,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CA4B7D;IAED;;;;;;OAMG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA2IxD;IAEK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,CAO/B;IAED;;;OAGG;YACW,oBAAoB;IAqClC;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;IAmCjC;;;;;;;;;OASG;YACW,6BAA6B;IAmB3C,OAAO,CAAC,mBAAmB;IAM3B,OAAO,CAAC,0BAA0B;IAelC,OAAO,CAAC,yBAAyB;IASjC,OAAO,CAAC,2BAA2B;YAiCrB,wBAAwB;CA8BvC;AAED,gEAAgE;AAChE,OAAO,EAAE,oBAAoB,EAAE,CAAC"}