dshmarket 1.32.0 → 1.33.0

package/README.md

@@ -37,6 +37,7 @@ its own dsh: it may be older than the one `npm` would give you (#139).
 - **One-click install** — confirm the source, watch live progress; most plugins go live after a page refresh, no restart
 - **Backup & restore** — export your profile's plugin list and configuration as readable JSON, import it on another machine, store it on WebDAV with daily auto-backup, or sync through a private GitHub Gist; restores **merge** (plugins installed after the backup are kept), validate before writing, and roll back on failure
 - **Updates** — per-plugin update checks (npm version or pinned commit vs HEAD), one-click update, or update everything at once; the market updates itself the same way
+- **Public update API** — plugin-owned settings pages can use the versioned, capability-gated [update API v1](UPDATE-API-V1.md) (beta) instead of copying package-manager logic or depending on private Market UI responses
 - **Uninstall** — two-step confirm; plugins installed this session are removed live
 - **Hot disable / enable** — toggles write `- id: …` + `disabled: true|false` into the profile's `cordis.patch.yml` (the official patch layer, mechanism ported from [dsh-plugin-hub](https://github.com/Noob-stupid/dsh-plugin-hub)): DSH's HMR re-composes within ~1s, no restart, and the loader re-applies the choice on every boot; hand-edited patch rows show as badges, host-infrastructure plugins are protected from toggling, and a malformed patch file is never made worse
 - **Restart when needed** — changes that cannot hot-load show a one-click restart beside the pending-change banner; the action is restricted to same-origin loopback requests

package/README.zh.md

@@ -35,6 +35,7 @@ dsh plugin --profile web add dshmarket
 - **一键安装**——确认来源，实时进度；多数插件刷新页面即可用，无需重启
 - **备份与恢复**——把 profile 的插件清单与配置导出为可读 JSON，换机导入，存到 WebDAV 并每日自动备份，或通过私有 GitHub Gist 跨机器同步；恢复采用**合并**方式（备份之后新装的插件会保留），写入前校验、失败自动回滚
 - **更新**——逐插件检测（npm 版本或锁定 commit 对比 HEAD），一键更新或全部更新；市场自己也走同一通道升级
+- **公共更新接口**——插件自己的设置页可调用带版本号、能力探测和回滚状态的[更新 API v1](UPDATE-API-V1.md)（beta），无需复制包管理逻辑，也不依赖市场 UI 的私有响应字段
 - **卸载**——两步确认防误触；本次会话装的插件即点即卸
 - **热禁用 / 启用**——开关会往 profile 的 `cordis.patch.yml`（官方补丁层，机制移植自 [dsh-plugin-hub](https://github.com/Noob-stupid/dsh-plugin-hub)）写入 `- id: …` + `disabled: true|false`：DSH 的 HMR 约 1 秒内重新组合，无需重启，loader 每次启动都会重新应用这个选择；手工改过的补丁行会显示成徽标，宿主基础设施插件禁止开关，补丁文件格式不对时绝不会被写得更糟
 - **按需重启**——无法热加载的变更会在待重启提示旁显示一键重启；操作仅接受本机同源请求

package/UPDATE-API-V1.md

@@ -0,0 +1,115 @@
+# Public plugin update API v1
+
+> **Status: beta.** The shape described here may still change between
+> releases. `GET /dsh-market/api/v1/capabilities` reports
+> `"stability": "beta"` while that is true, and `"stable"` once it stops
+> moving — read that field rather than assuming from the `v1` in the path.
+>
+> Nothing here is going away; what is not yet promised is that field names
+> and response shapes will survive untouched. If you ship against it now,
+> say so in an issue: a shape somebody depends on is a much stronger reason
+> not to move it, and it is how this reaches `stable`.
+
+
+`dshmarket` exposes a small, versioned, same-origin JSON API for plugin-owned
+update surfaces. It lets a plugin show its own update button without spawning a
+package manager, copying the Market installation algorithm, or binding to the
+Market UI's private response fields.
+
+All responses carry:
+
+```json
+{ "schema": "dsh-market/update-api/v1" }
+```
+
+Clients must discover the API before enabling mutation controls:
+
+```http
+GET /dsh-market/api/v1/capabilities
+```
+
+The response names the Market version, profile, runtime (`web` or `desktop`),
+supported features, restart owner and endpoint paths. A client must hide its
+restart button when `restart.supported` is false. Desktop and supervised hosts
+normally delegate restart to their owning shell or operator.
+
+## Check one installed package
+
+```http
+GET /dsh-market/api/v1/updates?name=dsh-mcp-connector&force=1
+```
+
+The response includes the installed version, target version, source kind and
+whether the target is a forward update. Omitting `force=1` allows the Market's
+short update-check cache.
+
+## Start and observe an update
+
+Mutation requests require the same-origin protection used by the Market UI.
+
+```http
+POST /dsh-market/api/v1/updates
+Content-Type: application/json
+
+{ "packageName": "dsh-mcp-connector" }
+```
+
+An accepted request returns HTTP `202` immediately with an `operationId`.
+Passing `"force": true` opts this one operation out of the registry release-age
+wait; clients should offer it only after the normal operation reports
+`RELEASE_TOO_FRESH` or `VERSION_UNCHANGED`.
+
+Poll the operation by id:
+
+```http
+GET /dsh-market/api/v1/operations?operationId=<id>
+```
+
+States are `queued`, `running`, `succeeded`, `failed`, `cancelled` and
+`rolled-back`. Running operations include structured package progress when
+pnpm provides it. Terminal operations include:
+
+- the before and actually installed versions;
+- `refreshRequired` and `restartRequired` outcomes;
+- a stable failure code, bounded user-facing message and retryability;
+- whether a compatibility rollback is currently available.
+
+Up to 50 operation records live in the current Host process. A boot id is
+embedded in every operation id, so a client never mistakes a stale browser
+record for a task belonging to the replacement process.
+
+## Roll back
+
+```http
+POST /dsh-market/api/v1/rollback
+Content-Type: application/json
+
+{ "operationId": "<id>" }
+```
+
+Rollback is intentionally capability- and operation-scoped. It is available
+only when the Market's compatibility verification retained a recovery point;
+a later mutation may supersede it. The normalized result is written back to
+the same operation record.
+
+## Restart
+
+```http
+POST /dsh-market/api/v1/restart
+Content-Type: application/json
+
+{}
+```
+
+This preserves the Market's stricter restart guard: direct loopback,
+same-origin, no forwarding headers, no package mutation in progress, and a Host
+whose lifecycle is not owned by Desktop or a supervisor. Clients must feature
+detect it; they must not invent an alternative process-control path.
+
+## Compatibility policy
+
+- New optional response fields may be added within v1.
+- Existing v1 fields and meanings are not repurposed.
+- A breaking change uses a new path and schema version.
+- When discovery is unavailable, plugin UIs should fall back to opening the
+  Market rather than calling legacy `/dsh-market/*` mutation routes directly.

package/lib/check.js

@@ -221,7 +221,7 @@ function readNodeModulesVersion(base, name) {
  * hoisting (`<profiles>/node_modules/…` when the profile lives under
  * `<profiles>/<name>`) and mirrors the Loader's package search roots.
  */
-function resolvePackageDir(anchorPackageJson, name) {
+function resolvePackageDir(anchorPackageJson, name, ignoredPackageDirectory) {
     let paths = [];
     try {
         paths = createRequire(anchorPackageJson).resolve.paths(name) ?? [];
@@ -229,8 +229,19 @@ function resolvePackageDir(anchorPackageJson, name) {
     catch {
         return null;
     }
+    const ignored = ignoredPackageDirectory === undefined
+        ? null
+        : resolve(ignoredPackageDirectory);
     for (const searchPath of paths) {
         const candidate = join(searchPath, name);
+        if (ignored !== null) {
+            const resolvedCandidate = resolve(candidate);
+            const matchesIgnored = process.platform === 'win32'
+                ? resolvedCandidate.toLowerCase() === ignored.toLowerCase()
+                : resolvedCandidate === ignored;
+            if (matchesIgnored)
+                continue;
+        }
         if (existsSync(join(candidate, 'package.json')))
             return candidate;
     }
@@ -709,15 +720,27 @@ function lockfileCoreVersions(profileDir) {
  */
 export function buildBundleLayers(profileDirectory, bundleNames, specs, dshInstallDir) {
     const bundles = bundleNames.map((name) => {
+        // The real loader gives the DSH installation first refusal for in-box
+        // bundles. Desktop keeps that installation private from plugins, so a
+        // DIRECT profile-local copy with the same official name is only a stale
+        // shadow, never evidence for the layer the running host loaded (#371).
+        // Keep walking the profile anchor's parent search paths: Desktop heals an
+        // authoritative host fallback at <profiles>/node_modules.
+        const ignoredProfilePackage = dshInstallDir === null && INBOX_BUNDLES.has(name)
+            ? join(profileDirectory, 'node_modules', name)
+            : undefined;
         const anchors = [
-            dshInstallDir !== null ? join(dshInstallDir, 'package.json') : null,
-            join(profileDirectory, 'package.json'),
+            { anchor: dshInstallDir !== null ? join(dshInstallDir, 'package.json') : null },
+            {
+                anchor: join(profileDirectory, 'package.json'),
+                ignoredPackageDirectory: ignoredProfilePackage,
+            },
         ];
         let directory = null;
-        for (const anchor of anchors) {
+        for (const { anchor, ignoredPackageDirectory } of anchors) {
             if (anchor === null)
                 continue;
-            directory = resolvePackageDir(anchor, name);
+            directory = resolvePackageDir(anchor, name, ignoredPackageDirectory);
             if (directory !== null)
                 break;
         }

package/lib/routes.js

@@ -9,6 +9,7 @@
  */
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { Readable } from 'node:stream';
 import { forgetCatalog, loadRegistry, pluginCategories } from './registry.js';
 import { cleanHotDir, hotMount, hotUnmount, listHotMounts, MAX_NOTE, mountClientOnlyDeps, purgeMarketState, readMarketState, writeMarketState, } from './hot.js';
 import { createGroup, deleteGroup, removeFromGroups, renameGroup, setGroupMembers } from './groups.js';
@@ -38,6 +39,7 @@ import { activationAfterReplace, brokenClientBundles, checkClientBundle, hasHost
 import { carrierDisableIds, disableRow, enableRow, findUserPatchPath, isProtectedModule, packagePatchFlags, readUserPatchState, removeRowBlocks, rowIdsForPackage, userPatchPackageReferences, } from './patch.js';
 import { createProfileBackup, downloadWebdav, MAX_BACKUP_BYTES, mergeRestoreManifest, restoreProfileBackup, unportableDeps, uploadWebdav, } from './backup.js';
 import { createGist, fitsGistLimit, GistError, gistErrorCode, parseGistId, readGist, resolveGistTokenSource, updateGist, verifyGistToken, } from './gist.js';
+import { MAX_UPDATE_OPERATIONS_V1, UpdateOperationStoreV1, UPDATE_API_V1_SCHEMA } from './update-api-v1.js';
 /**
  * The market's own version, read once from its installed package.json.
  *
@@ -658,7 +660,281 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
             throw error;
         }
     }
+    const legacyHandlers = new Map();
+    const captureLegacy = (path, route) => {
+        legacyHandlers.set(path, route.handler);
+        return route;
+    };
+    const operationsV1 = new UpdateOperationStoreV1(BOOT_ID);
+    /** Invoke one existing route in memory so v1 reuses the battle-tested executor. */
+    async function invokeLegacy(path, source, method, body, url = path) {
+        const handler = legacyHandlers.get(path);
+        if (handler === undefined)
+            throw new Error(`legacy route is unavailable: ${path}`);
+        const chunks = body === undefined ? [] : [Buffer.from(JSON.stringify(body))];
+        const replay = Readable.from(chunks);
+        Object.assign(replay, {
+            method,
+            url,
+            headers: { ...source.headers },
+            socket: source.socket,
+        });
+        let status = 200;
+        let text = '';
+        const captured = {
+            writeHead(code) { status = code; return this; },
+            end(chunk) {
+                if (chunk !== undefined)
+                    text += Buffer.isBuffer(chunk) ? chunk.toString('utf8') : chunk;
+                return this;
+            },
+        };
+        await handler(replay, captured);
+        let payload = null;
+        try {
+            payload = text === '' ? null : JSON.parse(text);
+        }
+        catch {
+            payload = { error: text };
+        }
+        return { status, payload };
+    }
+    const packageNameFrom = (request) => {
+        try {
+            return new URL(request.url ?? '', 'http://localhost').searchParams.get('name') ?? '';
+        }
+        catch {
+            return '';
+        }
+    };
+    const operationIdFrom = (request) => {
+        try {
+            return new URL(request.url ?? '', 'http://localhost').searchParams.get('operationId') ?? '';
+        }
+        catch {
+            return '';
+        }
+    };
+    const forceCheckFrom = (request) => {
+        try {
+            return new URL(request.url ?? '', 'http://localhost').searchParams.get('force') === '1';
+        }
+        catch {
+            return false;
+        }
+    };
     const disposers = [
+        host.webServer.register({
+            kind: 'exact',
+            path: '/dsh-market/api/v1/capabilities',
+            handler: (request, response) => {
+                if (request.method !== 'GET') {
+                    response.writeHead(405, { allow: 'GET' });
+                    response.end();
+                    return;
+                }
+                const canRestart = restartAllowed(config);
+                sendJson(response, 200, {
+                    schema: UPDATE_API_V1_SCHEMA,
+                    apiVersion: 1,
+                    // Machine-readable, because a policy that lives only in a markdown
+                    // file is one a client never reads. `beta` says the shape may still
+                    // change; it becomes `stable` once a release stops moving it, and
+                    // that is the point at which the compatibility promise starts.
+                    stability: 'beta',
+                    marketVersion: marketVersion(),
+                    profile: config.profile,
+                    bootId: BOOT_ID,
+                    runtime: config.profileDirectory === undefined ? 'web' : 'desktop',
+                    features: {
+                        check: true,
+                        update: true,
+                        progress: true,
+                        rollback: true,
+                        restart: canRestart,
+                    },
+                    restart: {
+                        supported: canRestart,
+                        managedBy: canRestart ? 'market' : config.profileDirectory === undefined ? 'operator' : 'desktop-host',
+                        supervisor: detectedSupervisor(),
+                    },
+                    operationRetention: 'current-process',
+                    operationLimit: MAX_UPDATE_OPERATIONS_V1,
+                    endpoints: {
+                        updates: '/dsh-market/api/v1/updates',
+                        operations: '/dsh-market/api/v1/operations',
+                        rollback: '/dsh-market/api/v1/rollback',
+                        restart: '/dsh-market/api/v1/restart',
+                    },
+                });
+            },
+        }),
+        host.webServer.register({
+            kind: 'exact',
+            path: '/dsh-market/api/v1/updates',
+            handler: async (request, response) => {
+                if (request.method === 'GET') {
+                    const name = packageNameFrom(request);
+                    if (!NPM_NAME_RE.test(name)) {
+                        sendJson(response, 400, { schema: UPDATE_API_V1_SCHEMA, error: 'a valid package name is required' });
+                        return;
+                    }
+                    try {
+                        const force = forceCheckFrom(request);
+                        const channel = activeChannel();
+                        const channelFor = SELF_NAMES.has(name) ? new Map([[name, channel]]) : undefined;
+                        const update = (await checkUpdates(config.profile, force, activeProfileDir, channelFor))[name];
+                        if (update === undefined) {
+                            sendJson(response, 404, { schema: UPDATE_API_V1_SCHEMA, error: 'plugin is not installed' });
+                            return;
+                        }
+                        sendJson(response, 200, {
+                            schema: UPDATE_API_V1_SCHEMA,
+                            package: {
+                                name,
+                                source: update.kind,
+                                installedVersion: update.current ?? update.version,
+                                latestVersion: update.latest,
+                                updateAvailable: update.updateAvailable,
+                                channelSwitch: update.channelSwitch ?? null,
+                            },
+                        });
+                    }
+                    catch (error) {
+                        sendJson(response, 500, {
+                            schema: UPDATE_API_V1_SCHEMA,
+                            error: error instanceof Error ? error.message : String(error),
+                        });
+                    }
+                    return;
+                }
+                if (request.method !== 'POST') {
+                    response.writeHead(405, { allow: 'GET, POST' });
+                    response.end();
+                    return;
+                }
+                if (!sameOrigin(request)) {
+                    sendJson(response, 403, { schema: UPDATE_API_V1_SCHEMA, error: 'untrusted origin' });
+                    return;
+                }
+                try {
+                    const body = (await readJsonBody(request));
+                    const packageName = typeof body.packageName === 'string' ? body.packageName : '';
+                    if (!NPM_NAME_RE.test(packageName)) {
+                        sendJson(response, 400, { schema: UPDATE_API_V1_SCHEMA, error: 'a valid package name is required' });
+                        return;
+                    }
+                    if (operationsV1.hasActive()) {
+                        sendJson(response, 409, {
+                            schema: UPDATE_API_V1_SCHEMA,
+                            error: 'another public update operation is already running',
+                            failure: {
+                                code: 'OPERATION_BUSY',
+                                message: 'another public update operation is already running',
+                                retryable: true,
+                            },
+                        });
+                        return;
+                    }
+                    const installedVersion = readInstalledVersion(config.profile, packageName, activeProfileDir);
+                    if (installedVersion === null) {
+                        sendJson(response, 404, {
+                            schema: UPDATE_API_V1_SCHEMA,
+                            error: 'plugin is not installed',
+                            failure: {
+                                code: 'PLUGIN_NOT_INSTALLED',
+                                message: 'plugin is not installed in this profile',
+                                retryable: false,
+                            },
+                        });
+                        return;
+                    }
+                    const operation = operationsV1.create(packageName, installedVersion);
+                    operationsV1.start(operation.operationId);
+                    void invokeLegacy('/dsh-market/update', request, 'POST', {
+                        name: packageName,
+                        ...(body.force === true ? { force: true } : {}),
+                    }).then(({ status, payload }) => {
+                        operationsV1.finish(operation.operationId, status, payload, readInstalledVersion(config.profile, packageName, activeProfileDir));
+                    }).catch((error) => {
+                        operationsV1.finish(operation.operationId, 500, { error: error instanceof Error ? error.message : String(error) }, readInstalledVersion(config.profile, packageName, activeProfileDir));
+                    });
+                    sendJson(response, 202, {
+                        schema: UPDATE_API_V1_SCHEMA,
+                        operation: operationsV1.get(operation.operationId),
+                    });
+                }
+                catch (error) {
+                    sendJson(response, 400, {
+                        schema: UPDATE_API_V1_SCHEMA,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            },
+        }),
+        host.webServer.register({
+            kind: 'exact',
+            path: '/dsh-market/api/v1/operations',
+            handler: (request, response) => {
+                if (request.method !== 'GET') {
+                    response.writeHead(405, { allow: 'GET' });
+                    response.end();
+                    return;
+                }
+                const operation = operationsV1.get(operationIdFrom(request), progress);
+                if (operation === null) {
+                    sendJson(response, 404, { schema: UPDATE_API_V1_SCHEMA, error: 'operation not found in this host process' });
+                    return;
+                }
+                sendJson(response, 200, { schema: UPDATE_API_V1_SCHEMA, operation });
+            },
+        }),
+        host.webServer.register({
+            kind: 'exact',
+            path: '/dsh-market/api/v1/rollback',
+            handler: async (request, response) => {
+                if (request.method !== 'POST') {
+                    response.writeHead(405, { allow: 'POST' });
+                    response.end();
+                    return;
+                }
+                if (!sameOrigin(request)) {
+                    sendJson(response, 403, { schema: UPDATE_API_V1_SCHEMA, error: 'untrusted origin' });
+                    return;
+                }
+                try {
+                    const body = (await readJsonBody(request));
+                    const operationId = typeof body.operationId === 'string' ? body.operationId : '';
+                    const legacyRollbackId = operationsV1.beginRollback(operationId);
+                    if (legacyRollbackId === null) {
+                        sendJson(response, 409, { schema: UPDATE_API_V1_SCHEMA, error: 'rollback is not available for this operation' });
+                        return;
+                    }
+                    const result = await invokeLegacy('/dsh-market/rollback', request, 'POST', { rollbackId: legacyRollbackId });
+                    const operation = operationsV1.finishRollback(operationId, result.status, result.payload);
+                    sendJson(response, 200, { schema: UPDATE_API_V1_SCHEMA, operation });
+                }
+                catch (error) {
+                    sendJson(response, 400, {
+                        schema: UPDATE_API_V1_SCHEMA,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            },
+        }),
+        host.webServer.register({
+            kind: 'exact',
+            path: '/dsh-market/api/v1/restart',
+            handler: async (request, response) => {
+                if (request.method !== 'POST') {
+                    response.writeHead(405, { allow: 'POST' });
+                    response.end();
+                    return;
+                }
+                const result = await invokeLegacy('/dsh-market/restart', request, 'POST', {});
+                sendJson(response, result.status, { schema: UPDATE_API_V1_SCHEMA, result: result.payload });
+            },
+        }),
         host.webServer.register({
             kind: 'exact',
             path: '/dsh-market/backup',
@@ -1633,7 +1909,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                 }
             },
         }),
-        host.webServer.register({
+        host.webServer.register(captureLegacy('/dsh-market/update', {
             kind: 'exact',
             path: '/dsh-market/update',
             handler: async (request, response) => {
@@ -1997,7 +2273,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                     sendJson(response, 500, { error: message });
                 }
             },
-        }),
+        })),
         host.webServer.register({
             kind: 'exact',
             path: '/dsh-market/setup-pnpm',
@@ -2227,7 +2503,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                 }
             },
         }),
-        host.webServer.register({
+        host.webServer.register(captureLegacy('/dsh-market/restart', {
             kind: 'exact',
             path: '/dsh-market/restart',
             handler: (request, response) => {
@@ -2266,7 +2542,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                     sendJson(response, 500, { error: message });
                 }
             },
-        }),
+        })),
         host.webServer.register({
             kind: 'exact',
             path: '/dsh-market/approve-builds',
@@ -2562,7 +2838,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                 }
             },
         }),
-        host.webServer.register({
+        host.webServer.register(captureLegacy('/dsh-market/rollback', {
             kind: 'exact',
             path: '/dsh-market/rollback',
             handler: async (request, response) => {
@@ -2630,7 +2906,7 @@ export function mountMarketRoutes(host, config, commandRuntime, agentsLookup) {
                     sendJson(response, 500, { error: message });
                 }
             },
-        }),
+        })),
         host.webServer.register({
             kind: 'exact',
             path: '/dsh-market/install',

package/lib/types/update-api-v1.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Stable, versioned contract for plugin-owned update surfaces.
+ *
+ * The market UI has richer internal response shapes that evolve with its UI.
+ * Third-party plugins must not depend on those shapes, so this module owns the
+ * small JSON envelope exposed under `/dsh-market/api/v1`.
+ */
+import type { InstallProgress } from './dsh-cli.ts';
+export declare const UPDATE_API_V1_SCHEMA: 'dsh-market/update-api/v1';
+export declare const MAX_UPDATE_OPERATIONS_V1 = 50;
+export type UpdateOperationState = 'queued' | 'running' | 'succeeded' | 'failed' | 'cancelled' | 'rolled-back';
+export interface UpdateFailureV1 {
+    code: string;
+    message: string;
+    retryable: boolean;
+}
+export interface UpdateOperationV1 {
+    schema: typeof UPDATE_API_V1_SCHEMA;
+    operationId: string;
+    kind: 'update';
+    packageName: string;
+    state: UpdateOperationState;
+    createdAt: number;
+    startedAt: number | null;
+    finishedAt: number | null;
+    beforeVersion: string | null;
+    installedVersion: string | null;
+    progress: {
+        phase: string | null;
+        done: number;
+        total: number | null;
+        percent: number | null;
+        currentPackage: string | null;
+        detail: string | null;
+        downloaded: number | null;
+        size: number | null;
+    };
+    outcome: {
+        refreshRequired: boolean;
+        restartRequired: boolean;
+        rollback: {
+            available: boolean;
+            state: 'unavailable' | 'available' | 'running' | 'succeeded' | 'failed';
+            detail: string | null;
+        };
+    };
+    failure: UpdateFailureV1 | null;
+}
+/** Process-local operation registry. A boot id scopes ids across restarts. */
+export declare class UpdateOperationStoreV1 {
+    private readonly bootId;
+    private readonly now;
+    private readonly maxOperations;
+    private sequence;
+    private readonly operations;
+    private activeId;
+    constructor(bootId: string, now?: () => number, maxOperations?: number);
+    hasActive(): boolean;
+    create(packageName: string, beforeVersion: string | null): UpdateOperationV1;
+    start(operationId: string): void;
+    finish(operationId: string, status: number, payload: unknown, installedVersion: string | null): UpdateOperationV1 | null;
+    beginRollback(operationId: string): string | null;
+    finishRollback(operationId: string, status: number, payload: unknown): UpdateOperationV1 | null;
+    get(operationId: string, progress?: InstallProgress): UpdateOperationV1 | null;
+    private snapshot;
+}