direxio-deployer 0.1.0

package/scripts/phases/s7_verify_e2e.sh

@@ -0,0 +1,136 @@
+#!/usr/bin/env bash
+# S7 VERIFY_E2E - end-to-end acceptance. DONE only when every check passes.
+#
+# Checks: healthz, Matrix versions, Matrix federation well-known, owner.json+CORS,
+# token-authenticated /_p2p command, and non-empty TURN turnServer.
+# Local bridge message send/read is validated separately; this script checks HTTP actions.
+
+run_phase() {
+  phase_set S7_VERIFY_E2E in_progress "running end-to-end acceptance"
+  local domain token password
+  domain=$(state_get domain)
+  password=$(state_get password)
+  local fails=0
+
+  _check "healthz"               "https://$domain/healthz"                       "" 200 || fails=$((fails+1))
+  _check "matrix versions"       "https://$domain/_matrix/client/versions"       "" 200 || fails=$((fails+1))
+  _check_matrix_server_wellknown "$domain" || fails=$((fails+1))
+  _check_owner_cors "$domain" || fails=$((fails+1))
+  token=$(_p2p_access_token "$domain" "$password")
+  if [ -n "$token" ]; then
+    _check_p2p_agent_auth "$domain" "$token" || fails=$((fails+1))
+  else
+    warn "  ✗ _p2p/query mcp.messages.list (failed to exchange fresh access_token)"
+    fails=$((fails+1))
+  fi
+  _check_turn "$domain" "$password" || fails=$((fails+1))
+
+  if [ "$fails" -eq 0 ]; then
+    phase_set S7_VERIFY_E2E done "all green"
+    return 0
+  fi
+  phase_set S7_VERIFY_E2E failed "$fails checks failed"
+  warn "$fails acceptance checks failed. See references/troubleshooting.md for targeted fixes."
+  return 1
+}
+
+_check_p2p_agent_auth() {
+  local domain=$1 token=$2 code body
+  local room_id
+  room_id=$(state_get agent_room_id)
+  local args=()
+  while IFS= read -r arg; do args+=("$arg"); done < <(curl_resolve_args "$domain")
+  body=$(mktemp)
+  code=$(curl -sk "${args[@]}" -o "$body" -w '%{http_code}' \
+    -X POST "https://$domain/_p2p/query" \
+    -H 'Content-Type: application/json' \
+    -H "Authorization: Bearer $token" \
+    -d "{\"action\":\"mcp.messages.list\",\"params\":{\"room_id\":\"$room_id\",\"limit\":1}}" 2>/dev/null)
+  if [ "$code" = "200" ] && jq -e '(.messages | type == "array") and (.room_id | type == "string")' "$body" >/dev/null 2>&1; then
+    rm -f "$body"
+    ok "  ✓ _p2p/query mcp.messages.list (agent token)"
+    return 0
+  fi
+  warn "  ✗ _p2p/query mcp.messages.list (got $code, body=$(head -c 120 "$body" 2>/dev/null))"
+  rm -f "$body"
+  return 1
+}
+
+_p2p_access_token() {
+  local domain=$1 password=$2 at
+  local args=()
+  while IFS= read -r arg; do args+=("$arg"); done < <(curl_resolve_args "$domain")
+  at=$(curl -sk "${args[@]}" -X POST "https://$domain/_p2p/command" -H 'Content-Type: application/json' \
+        -d "{\"action\":\"portal.auth\",\"params\":{\"password\":\"$password\"}}" 2>/dev/null | jq -r '.access_token // empty')
+  printf '%s' "$at"
+}
+
+curl_resolve_args() {
+  local domain=$1 pubip
+  pubip=$(res_get public_ip)
+  [ -n "$pubip" ] && printf '%s\n' --resolve "$domain:443:$pubip"
+}
+
+# Web client reads owner.json from the local dev origin. HTTP 200 without CORS
+# still fails in the browser, so S7 validates the response header.
+_check_owner_cors() {
+  local domain=$1 tmp code cors
+  tmp=$(mktemp)
+  local args=()
+  while IFS= read -r arg; do args+=("$arg"); done < <(curl_resolve_args "$domain")
+  code=$(curl -sk "${args[@]}" -o /dev/null -D "$tmp" -w '%{http_code}' \
+    -H 'Origin: http://127.0.0.1:51820' \
+    "https://$domain/.well-known/portal/owner.json" 2>/dev/null)
+  cors=$(grep -i '^Access-Control-Allow-Origin:' "$tmp" | tr -d '\r' | head -n 1 || true)
+  rm -f "$tmp"
+
+  if [ "$code" = "200" ] && printf '%s' "$cors" | grep -Eiq 'Access-Control-Allow-Origin:[[:space:]]*(\*|http://127\.0\.0\.1:51820)$'; then
+    ok "  ✓ portal owner.json (200 + CORS)"; return 0
+  fi
+  warn "  x portal owner.json CORS invalid (code=$code, header=${cors:-<missing>})"; return 1
+}
+
+# Federation acceptance: when server_name is a bare domain, remote homeservers
+# default to 8448. This deployment exposes 443, so well-known must point there.
+_check_matrix_server_wellknown() {
+  local domain=$1 body
+  local args=()
+  while IFS= read -r arg; do args+=("$arg"); done < <(curl_resolve_args "$domain")
+  body=$(curl -sk "${args[@]}" "https://$domain/.well-known/matrix/server" 2>/dev/null)
+  if printf '%s' "$body" | jq -e --arg want "$domain:443" '.["m.server"] == $want' >/dev/null 2>&1; then
+    ok "  ✓ matrix federation well-known ($domain:443)"; return 0
+  fi
+  warn "  x matrix federation well-known invalid:$(printf '%s' "$body" | head -c 120)"; return 1
+}
+
+# _check <name> <url> <bearer-token-or-empty> <expected-code>
+_check() {
+  local name=$1 url=$2 tok=$3 want=$4 code
+  local domain args=()
+  domain=$(state_get domain)
+  while IFS= read -r arg; do args+=("$arg"); done < <(curl_resolve_args "$domain")
+  if [ -n "$tok" ]; then
+    code=$(curl -sk "${args[@]}" -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $tok" "$url" 2>/dev/null)
+  else
+    code=$(curl -sk "${args[@]}" -o /dev/null -w '%{http_code}' "$url" 2>/dev/null)
+  fi
+  if [ "$code" = "$want" ]; then ok "  ✓ $name ($code)"; return 0
+  else warn "  ✗ $name (got $code, want $want)"; return 1; fi
+}
+
+# TURN acceptance: exchange the backend password/init-code field for Matrix access_token, then verify
+# /voip/turnServer returns non-empty valid TURN credentials.
+_check_turn() {
+  local domain=$1 password=$2 at turn
+  local args=()
+  while IFS= read -r arg; do args+=("$arg"); done < <(curl_resolve_args "$domain")
+  at=$(_p2p_access_token "$domain" "$password")
+  if [ -z "$at" ]; then warn "  x TURN (failed to exchange access_token; cannot verify turnServer)"; return 1; fi
+  turn=$(curl -sk "${args[@]}" "https://$domain/_matrix/client/v3/voip/turnServer" \
+          -H "Authorization: Bearer $at" 2>/dev/null)
+  if printf '%s' "$turn" | jq -e '(.uris|type=="array" and length>0) and (any(.uris[]; test("^turns?:"))) and (.username|tostring|length>0) and (.password|tostring|length>0) and (.ttl>0)' >/dev/null 2>&1; then
+    ok "  ✓ TURN turnServer non-empty and valid"; return 0
+  else
+    warn "  x TURN turnServer invalid/empty:$(printf '%s' "$turn" | head -c 120)"; return 1
+  fi
+}

package/scripts/pricing-estimate.sh

@@ -0,0 +1,256 @@
+#!/usr/bin/env bash
+# pricing-estimate.sh - estimate monthly AWS costs for a Direxio EC2 node.
+set -euo pipefail
+
+usage() {
+  cat >&2 <<'EOF'
+Usage:
+  scripts/pricing-estimate.sh --state <state.json> [--write-state]
+  scripts/pricing-estimate.sh --region <region> --instance-type <type> --disk-gb <gb> --domain-mode <user|route53>
+
+Queries AWS Price List where possible. Falls back conservatively when pricing is unavailable.
+EOF
+}
+
+region_location() {
+  case "$1" in
+    us-east-1) echo "US East (N. Virginia)" ;;
+    us-east-2) echo "US East (Ohio)" ;;
+    us-west-1) echo "US West (N. California)" ;;
+    us-west-2) echo "US West (Oregon)" ;;
+    ap-southeast-1) echo "Asia Pacific (Singapore)" ;;
+    ap-southeast-2) echo "Asia Pacific (Sydney)" ;;
+    ap-northeast-1) echo "Asia Pacific (Tokyo)" ;;
+    ap-northeast-2) echo "Asia Pacific (Seoul)" ;;
+    ap-east-1) echo "Asia Pacific (Hong Kong)" ;;
+    eu-west-1) echo "EU (Ireland)" ;;
+    eu-central-1) echo "EU (Frankfurt)" ;;
+    *) echo "" ;;
+  esac
+}
+
+price_from_get_products() {
+  local service=$1 location=$2 shift_count=2 json
+  shift "$shift_count"
+  json=$(aws pricing get-products \
+    --region us-east-1 \
+    --service-code "$service" \
+    --filters "Type=TERM_MATCH,Field=location,Value=$location" "$@" \
+    --max-results 1 \
+    --output json 2>/dev/null) || return 1
+  printf '%s\n' "$json" | jq -r '
+    .PriceList[0]
+    | fromjson
+    | .terms.OnDemand
+    | to_entries[0].value.priceDimensions
+    | to_entries[0].value.pricePerUnit.USD
+  ' 2>/dev/null
+}
+
+numeric_or_empty() {
+  case "${1:-}" in
+    ''|null|None) return 1 ;;
+    *[!0-9.]* ) return 1 ;;
+    *) printf '%s\n' "$1" ;;
+  esac
+}
+
+lookup_ec2_hourly() {
+  local location=$1 instance_type=$2 raw
+  raw=$(price_from_get_products AmazonEC2 "$location" \
+    "Type=TERM_MATCH,Field=instanceType,Value=$instance_type" \
+    "Type=TERM_MATCH,Field=operatingSystem,Value=Linux" \
+    "Type=TERM_MATCH,Field=tenancy,Value=Shared" \
+    "Type=TERM_MATCH,Field=preInstalledSw,Value=NA" \
+    "Type=TERM_MATCH,Field=capacitystatus,Value=Used" \
+  ) || return 1
+  numeric_or_empty "$raw"
+}
+
+lookup_gp3_gb_month() {
+  local location=$1 raw
+  raw=$(price_from_get_products AmazonEC2 "$location" \
+    "Type=TERM_MATCH,Field=productFamily,Value=Storage" \
+    "Type=TERM_MATCH,Field=volumeApiName,Value=gp3" \
+  ) || return 1
+  numeric_or_empty "$raw"
+}
+
+lookup_public_ipv4_hourly() {
+  local location=$1 raw
+  raw=$(price_from_get_products AmazonVPC "$location" \
+    "Type=TERM_MATCH,Field=productFamily,Value=Public IPv4 Address" \
+  ) || return 1
+  numeric_or_empty "$raw"
+}
+
+round2() {
+  awk -v n="${1:-0}" 'BEGIN { printf "%.2f", n + 0 }'
+}
+
+build_estimate() {
+  local region=$1 instance_type=$2 disk_gb=$3 domain_mode=$4
+  local hours=730 location ec2_hourly gp3_rate public_ipv4_hourly route53_monthly status warnings_json
+  local ec2_source gp3_source ipv4_source
+  location=$(region_location "$region")
+  status=queried
+  warnings_json='[]'
+
+  if [ -z "$location" ]; then
+    status=fallback
+    warnings_json=$(jq -cn --arg w "Region is not mapped to an AWS Pricing location; using conservative fallback estimates" '$ARGS.named | [.w]')
+  fi
+
+  if [ "$status" = "queried" ] && ec2_hourly=$(lookup_ec2_hourly "$location" "$instance_type"); then
+    ec2_source=aws_pricing
+  else
+    status=fallback
+    ec2_hourly=${DIREXIO_FALLBACK_EC2_HOURLY_USD:-0.030}
+    ec2_source=fallback
+  fi
+
+  if [ "$status" = "queried" ] && gp3_rate=$(lookup_gp3_gb_month "$location"); then
+    gp3_source=aws_pricing
+  else
+    status=fallback
+    gp3_rate=${DIREXIO_FALLBACK_GP3_GB_MONTH_USD:-0.10}
+    gp3_source=fallback
+  fi
+
+  if [ "$status" = "queried" ] && public_ipv4_hourly=$(lookup_public_ipv4_hourly "$location"); then
+    ipv4_source=aws_pricing
+  else
+    [ "$status" = "fallback" ] || status=fallback
+    public_ipv4_hourly=${DIREXIO_FALLBACK_PUBLIC_IPV4_HOURLY_USD:-0.005}
+    ipv4_source=fallback
+  fi
+
+  if [ "$status" = "fallback" ]; then
+    warnings_json=$(printf '%s\n' "$warnings_json" | jq '. + ["AWS Pricing API unavailable; using conservative fallback estimates"] | unique')
+  fi
+
+  if [ "$domain_mode" = "route53" ]; then
+    route53_monthly=${DIREXIO_ROUTE53_HOSTED_ZONE_MONTHLY_USD:-0.50}
+  else
+    route53_monthly=0
+  fi
+
+  jq -n \
+    --arg pricing_status "$status" \
+    --arg region "$region" \
+    --arg location "$location" \
+    --arg instance_type "$instance_type" \
+    --arg domain_mode "$domain_mode" \
+    --arg ec2_source "$ec2_source" \
+    --arg gp3_source "$gp3_source" \
+    --arg ipv4_source "$ipv4_source" \
+    --argjson warnings "$warnings_json" \
+    --argjson hours "$hours" \
+    --argjson disk_gb "$disk_gb" \
+    --argjson ec2_hourly "$ec2_hourly" \
+    --argjson ec2_monthly "$(round2 "$(awk -v h="$ec2_hourly" -v m="$hours" 'BEGIN { print h*m }')")" \
+    --argjson gp3_rate "$gp3_rate" \
+    --argjson gp3_monthly "$(round2 "$(awk -v r="$gp3_rate" -v gb="$disk_gb" 'BEGIN { print r*gb }')")" \
+    --argjson ipv4_hourly "$public_ipv4_hourly" \
+    --argjson ipv4_monthly "$(round2 "$(awk -v h="$public_ipv4_hourly" -v m="$hours" 'BEGIN { print h*m }')")" \
+    --argjson route53_monthly "$route53_monthly" '
+      def total:
+        (.components.ec2_instance.monthly_usd
+        + .components.ebs_gp3.monthly_usd
+        + .components.public_ipv4.monthly_usd
+        + .components.route53_hosted_zone.monthly_usd);
+      {
+        pricing_status: $pricing_status,
+        region: $region,
+        location: $location,
+        hours_per_month: $hours,
+        warnings: $warnings,
+        components: {
+          ec2_instance: {
+            instance_type: $instance_type,
+            hourly_usd: $ec2_hourly,
+            monthly_usd: $ec2_monthly,
+            source: $ec2_source
+          },
+          ebs_gp3: {
+            storage_gb: $disk_gb,
+            gb_month_usd: $gp3_rate,
+            monthly_usd: $gp3_monthly,
+            source: $gp3_source
+          },
+          public_ipv4: {
+            hourly_usd: $ipv4_hourly,
+            monthly_usd: $ipv4_monthly,
+            billed_even_when_attached: true,
+            source: $ipv4_source
+          },
+          route53_hosted_zone: {
+            monthly_usd: $route53_monthly,
+            included: ($domain_mode == "route53")
+          }
+        },
+        notes: [
+          "Estimate excludes data transfer, TURN relay traffic, domain registration, taxes, and AWS credit eligibility.",
+          "Public IPv4 is billed hourly by AWS even when attached to a running instance.",
+          "AWS credits may reduce charges only when the account, plan, region, and service usage are eligible; verify in AWS Billing Console."
+        ],
+        recommendations: [
+          "Set an AWS Budget or billing alert before leaving the node running.",
+          "Review AWS Billing Console after deployment and after destroy to confirm actual charges and remaining credits."
+        ]
+      } | .total_monthly_usd = ((total * 100 | round) / 100)
+    '
+}
+
+state=""
+write_state=0
+region=""
+instance_type=""
+disk_gb=""
+domain_mode=""
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --state) state=${2:-}; shift 2 ;;
+    --write-state) write_state=1; shift ;;
+    --region) region=${2:-}; shift 2 ;;
+    --instance-type) instance_type=${2:-}; shift 2 ;;
+    --disk-gb) disk_gb=${2:-}; shift 2 ;;
+    --domain-mode) domain_mode=${2:-}; shift 2 ;;
+    -h|--help) usage; exit 0 ;;
+    *) usage; exit 1 ;;
+  esac
+done
+
+if [ -n "$state" ]; then
+  [ -f "$state" ] || {
+    echo "state.json not found: $state" >&2
+    exit 1
+  }
+  region=${region:-$(jq -r '.region // empty' "$state")}
+  instance_type=${instance_type:-$(jq -r '.instance_type // empty' "$state")}
+  domain_mode=${domain_mode:-$(jq -r '.domain_mode // "user"' "$state")}
+  disk_gb=${disk_gb:-$(jq -r '.resources.root_volume_gb // .root_volume_gb // "8"' "$state")}
+fi
+
+region=${region:-${AWS_DEFAULT_REGION:-${AWS_REGION:-}}}
+instance_type=${instance_type:-t3.small}
+disk_gb=${disk_gb:-8}
+domain_mode=${domain_mode:-user}
+
+[ -n "$region" ] || {
+  echo "region is required for pricing estimate" >&2
+  exit 1
+}
+
+estimate=$(build_estimate "$region" "$instance_type" "$disk_gb" "$domain_mode")
+if [ "$write_state" = "1" ]; then
+  [ -n "$state" ] || {
+    echo "--write-state requires --state" >&2
+    exit 1
+  }
+  tmp="$state.tmp.$$"
+  jq --argjson estimate "$estimate" '.cost_estimate = $estimate' "$state" > "$tmp" && mv "$tmp" "$state"
+fi
+
+printf '%s\n' "$estimate"

package/scripts/render/render-userdata.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# render-userdata.sh - render final cloud-init user-data.
+#
+# Bundle cloud-init deployment files (docker-compose.yml / Caddyfile /
+# init-tokens.sh) into a tar.gz, inline it as one write_files entry, and unpack
+# it to /opt/p2p in runcmd. Comment-only lines are stripped at the end to keep
+# AWS user-data below the 16384-byte limit. Replaces __DOMAIN__ /
+# __ACME_EMAIL__ / __MESSAGE_SERVER_IMAGE__; the EC2 instance does not need to
+# clone repos.
+#
+# Usage:
+#   render-userdata.sh --domain <domain> --acme <email> --message-server-image <img> > user-data.yaml
+set -euo pipefail
+
+HERE=$(cd "$(dirname "$0")/.." && pwd)
+CI="$HERE/cloud-init"
+source "$HERE/lib/domain.sh"
+
+DOMAIN=""; ACME=""; MESSAGE_SERVER_IMAGE=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --domain) DOMAIN=$2; shift 2;;
+    --acme) ACME=$2; shift 2;;
+    --message-server-image) MESSAGE_SERVER_IMAGE=$2; shift 2;;
+    --as-image) MESSAGE_SERVER_IMAGE=$2; shift 2;;
+    *) echo "unknown arg: $1" >&2; exit 1;;
+  esac
+done
+[ -n "$MESSAGE_SERVER_IMAGE" ] || { echo "--message-server-image required" >&2; exit 1; }
+[ -n "$DOMAIN" ] || { echo "--domain required; production deployments require a real domain" >&2; exit 1; }
+DOMAIN=$(domain_normalize "$DOMAIN")
+[ "$DOMAIN" != "PLACEHOLDER" ] || { echo "PLACEHOLDER/sslip.io domains are not accepted in the production renderer" >&2; exit 1; }
+domain_is_formal_name "$DOMAIN" || { echo "invalid production domain: $DOMAIN" >&2; exit 1; }
+
+# Single-line base64 compatible with GNU/Linux and macOS/BSD base64.
+b64() { base64 | tr -d '\n'; }
+sed_replacement_escape() { printf '%s' "$1" | sed 's/[\\&#]/\\&/g'; }
+
+# Build a deterministic tar.gz bundle with fixed permissions and no extra attrs.
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+cp "$CI/docker-compose.yml" "$WORK/docker-compose.yml"
+cp "$CI/Caddyfile"          "$WORK/Caddyfile"
+tr -d '\r' < "$CI/init-tokens.sh" > "$WORK/init-tokens.sh"
+chmod 0644 "$WORK/docker-compose.yml" "$WORK/Caddyfile"
+chmod 0755 "$WORK/init-tokens.sh"
+find "$WORK" -name '._*' -delete
+# -C creates a flat archive. Explicit gzip avoids macOS tar stdout quirks.
+# COPYFILE_DISABLE=1 avoids AppleDouble ._* extended-attribute files.
+BUNDLE_B64=$(COPYFILE_DISABLE=1 tar -C "$WORK" -cf - docker-compose.yml Caddyfile init-tokens.sh | gzip -n | b64)
+
+# Generate user-data: append the bundle entry to write_files and unpack first in runcmd.
+# Avoid passing multiline strings via awk -v; macOS awk rejects newline in string.
+EXTRA_WF=$(mktemp); trap 'rm -rf "$WORK" "$EXTRA_WF"' EXIT
+cat > "$EXTRA_WF" <<EOF
+  - path: /opt/p2p/bundle.tar.gz
+    permissions: '0644'
+    encoding: b64
+    content: $BUNDLE_B64
+EOF
+
+# Insert unpack as the first runcmd step before Docker install / compose up.
+UNPACK='  - mkdir -p /opt/p2p && tar -xzf /opt/p2p/bundle.tar.gz -C /opt/p2p && chmod 0755 /opt/p2p/init-tokens.sh'
+
+strip_userdata_comments() {
+  awk '
+    NR == 1 && $0 == "#cloud-config" { print; next }
+    /^[[:space:]]*#/ { next }
+    { print }
+  '
+}
+
+awk -v wf="$EXTRA_WF" -v unpack="$UNPACK" '
+  # Insert bundle entry before runcmd.
+  /^runcmd:/ && !wfdone {
+    while ((getline line < wf) > 0) print line
+    close(wf)
+    print
+    print unpack
+    wfdone=1
+    next
+  }
+  { print }
+' "$CI/user-data.yaml" \
+| sed "s#__DOMAIN__#$(sed_replacement_escape "$DOMAIN")#g; s#__ACME_EMAIL__#$(sed_replacement_escape "$ACME")#g; s#__MESSAGE_SERVER_IMAGE__#$(sed_replacement_escape "$MESSAGE_SERVER_IMAGE")#g" \
+| strip_userdata_comments

package/scripts/reset-app-data.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# reset-app-data.sh - clear app data on an existing node while preserving infra/TLS.
+set -euo pipefail
+
+HERE=$(cd "$(dirname "$0")" && pwd)
+# shellcheck disable=SC1090
+source "$HERE/lib/paths.sh"
+# shellcheck disable=SC1090
+source "$HERE/lib/operation_report.sh"
+# shellcheck disable=SC1090
+source "$HERE/lib/ops.sh"
+
+STATE_JSON=$(ops_state_path "${1:-}")
+ops_require_state "$STATE_JSON"
+
+if [ "${DIREXIO_RESET_APP_DATA_CONFIRM:-0}" != "1" ]; then
+  cat >&2 <<'EOF'
+reset-app-data is destructive for application data.
+It preserves EC2, Elastic IP/public IPv4, DNS, and Caddy TLS volumes, but clears Matrix/message-server data.
+Set DIREXIO_RESET_APP_DATA_CONFIRM=1 to continue.
+EOF
+  exit 2
+fi
+
+remote_command=$(ops_reset_remote_command)
+ops_ssh "$STATE_JSON" "$remote_command"
+ops_mark_refresh_pending "$STATE_JSON" S4_BOOTSTRAP_STACK
+if ops_stop_scoped_daemon "$STATE_JSON"; then
+  bridge_stop_message="Scoped local bridge daemon was stopped; rerun S6 to install fresh config."
+else
+  bridge_stop_message="Scoped local bridge daemon stop was skipped or not needed."
+fi
+report=$(ops_write_report reset_app_data reset_remote_data_cleared_refresh_pending "$STATE_JSON")
+
+echo "Application data reset complete on the existing node."
+echo "Caddy TLS storage was preserved."
+echo "Old user confirmations and runtime checks were cleared."
+echo "$bridge_stop_message"
+echo "Local S4-S7 gates were reset; rerun orchestrate with P2P_EXISTING_STATE_ACTION=continue."
+echo "operation report: $report"

package/scripts/update.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# update.sh - update an existing EC2 node without recreating infra or deleting data.
+set -euo pipefail
+
+HERE=$(cd "$(dirname "$0")" && pwd)
+# shellcheck disable=SC1090
+source "$HERE/lib/paths.sh"
+# shellcheck disable=SC1090
+source "$HERE/lib/operation_report.sh"
+# shellcheck disable=SC1090
+source "$HERE/lib/ops.sh"
+
+STATE_JSON=$(ops_state_path "${1:-}")
+ops_require_state "$STATE_JSON"
+
+remote_command=$(ops_update_remote_command "${MESSAGE_SERVER_IMAGE:-}")
+ops_ssh "$STATE_JSON" "$remote_command"
+ops_mark_refresh_pending "$STATE_JSON" S4_BOOTSTRAP_STACK
+if ops_stop_scoped_daemon "$STATE_JSON"; then
+  bridge_stop_message="Scoped local bridge daemon was stopped; rerun S6 to install fresh config."
+else
+  bridge_stop_message="Scoped local bridge daemon stop was skipped or not needed."
+fi
+report=$(ops_write_report update update_remote_restart_complete_refresh_pending "$STATE_JSON")
+
+echo "Update remote restart complete."
+echo "Old user confirmations and runtime checks were cleared."
+echo "$bridge_stop_message"
+echo "Local S4-S7 gates were reset; rerun orchestrate with P2P_EXISTING_STATE_ACTION=continue to refresh credentials, MCP, and verification."
+echo "operation report: $report"