memkin 0.4.0

package/dist/lifecycle/run-up.js

@@ -0,0 +1,307 @@
+import { createHash, randomUUID } from "node:crypto";
+import { chmodSync, existsSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { loadConfig } from "../core/config.js";
+import { detectDaemonRuntime, resolveDaemonArgv } from "../daemon/autostart/argv.js";
+import { rawYamlHash, readDaemonState, servingSubsetHash, writeDaemonState, } from "../daemon/autostart/daemon-state.js";
+import { disableAutostart, enableAutostart } from "../daemon/autostart/index.js";
+import { nodeRunner } from "../daemon/autostart/runner.js";
+import { ADAPTERS, detectInstalledAgents, planInstall, runInstall } from "../install/index.js";
+import { resolveMcpHttpRuntime } from "../server/mcp-http-runtime.js";
+import { provisionManagedForeground as realProvisionManagedForeground } from "../store/managed/managed-engine.js";
+import { managedPaths } from "../store/managed/pg-paths.js";
+import { createPgRuntimeProvider } from "../store/managed/pg-runtime-provider.js";
+import { createPgSupervisor } from "../store/managed/pg-supervisor.js";
+import { pollHealth } from "./health-poll.js";
+import { recordOriginal } from "./install-state.js";
+import { acquireLifecycleLock } from "./lifecycle-lock.js";
+import { bringUpDaemon, planUp, wireAgents } from "./up.js";
+export async function runUp(opts = {}, injected = {}) {
+    const home = injected.home ?? homedir();
+    const platform = injected.platform ?? process.platform;
+    const runner = injected.runner ?? nodeRunner;
+    const fetchHealthImpl = injected.fetchHealthImpl ?? defaultFetchHealth;
+    // Step 1: acquire lifecycle lock
+    const lock = acquireLifecycleLock(home, "up");
+    try {
+        // Step 2: load config
+        const config = loadConfig(opts.config);
+        const configPath = config.__context.configPath;
+        const missingEnvVars = config.__context.missingEnvVars;
+        const engine = config.store.engine ?? "pglite";
+        // Step 2a: foreground managed-Postgres provision (P0-3/P0-4)
+        // Must run BEFORE bringUpDaemon/enableAutostart so the daemon's ensureUp is a fast warm-path.
+        if (engine === "managed") {
+            const provisionFn = injected.provisionManagedForeground ??
+                ((cfg) => realProvisionManagedForeground(cfg, {
+                    home,
+                    provider: createPgRuntimeProvider({
+                        home,
+                        pgMajor: "17",
+                        runtimeDir: cfg.store?.managed?.runtime_dir,
+                    }),
+                    makeSupervisor: (rt, h) => createPgSupervisor({
+                        runtime: rt,
+                        paths: managedPaths(h, rt.pgMajor),
+                        runner,
+                    }),
+                }));
+            await provisionFn(config);
+        }
+        // Step 3: detected agents mapped to {id, supportsHttp}
+        const detectedIds = detectInstalledAgents(home, platform);
+        const detectedAgents = detectedIds.map((id) => {
+            const adapter = ADAPTERS.find((a) => a.id === id);
+            return { id, supportsHttp: adapter?.supportsHttp ?? false };
+        });
+        // Step 4: plan
+        const plan = planUp({ detectedAgents, missingEnvVars, engine });
+        // Step 5: resolve MCP HTTP runtime
+        const runtime = resolveMcpHttpRuntime(config.mcp.http, { mcpPort: opts.port });
+        const port = runtime.port;
+        const url = `http://127.0.0.1:${port}/mcp`;
+        // Step 6: instance ID
+        const instanceId = randomUUID();
+        // Step 7: frozen argv
+        const rt = injected.daemonRuntime ?? detectDaemonRuntime();
+        const serveTail = [
+            "serve",
+            "--mcp-http",
+            "--no-open",
+            "--config",
+            configPath,
+            "--mcp-bind",
+            "127.0.0.1",
+            "--mcp-port",
+            String(port),
+            "--mcp-read-write",
+            "--daemon-instance-id",
+            instanceId,
+            ...runtime.allowedHosts.flatMap((h) => ["--mcp-allowed-host", h]),
+        ];
+        const argv = resolveDaemonArgv(rt, serveTail);
+        // Step 8: extract secret env vars from raw yaml
+        const env = extractSecretEnv(configPath);
+        // Step 9: build DaemonState
+        const state = {
+            instance_id: instanceId,
+            config_path: configPath,
+            raw_yaml_hash: rawYamlHash(configPath),
+            serving_subset_hash: servingSubsetHash({
+                bind: "127.0.0.1",
+                port,
+                readOnly: false,
+                hosts: runtime.allowedHosts,
+            }),
+            url,
+            argv,
+        };
+        // Step 10: read prior state
+        const stateDir = join(home, ".memkin");
+        const priorState = readDaemonState(stateDir);
+        const reconcile = priorState !== null;
+        let savedSnapshot = null;
+        const serviceFilePath = platform === "darwin"
+            ? join(home, "Library", "LaunchAgents", "com.memkin.daemon.plist")
+            : join(home, ".config", "systemd", "user", "memkin.service");
+        // Step 11: bringUpDaemon
+        await bringUpDaemon({
+            priorState,
+            saveOld: async () => {
+                const serviceFileText = existsSync(serviceFilePath)
+                    ? readFileSync(serviceFilePath, "utf8")
+                    : null;
+                savedSnapshot = { serviceFileText, daemonJson: priorState };
+                return savedSnapshot;
+            },
+            enable: () => enableAutostart({ platform, home, runner, state, env, linger: opts.linger }),
+            pollReady: () => pollHealth(() => fetchHealthImpl(url), { instanceId, port, bind: "127.0.0.1", engine }, { timeoutMs: 10_000 }),
+            disable: () => disableAutostart({ platform, home, runner }).then(() => undefined),
+            restoreOld: async (saved) => {
+                // BEST-EFFORT restore: evict failed new service, re-write saved service file + daemon.json then reactivate
+                // FIX 2: bootout the failed new service before restoring old
+                await disableAutostart({ platform, home, runner }).catch(() => { });
+                const snap = saved;
+                if (snap.serviceFileText !== null) {
+                    writeFileSync(serviceFilePath, snap.serviceFileText, "utf8");
+                    // FIX 1: ensure restored service file is also 0600
+                    chmodSync(serviceFilePath, 0o600);
+                }
+                if (snap.daemonJson !== null) {
+                    writeDaemonState(stateDir, snap.daemonJson);
+                    // Best-effort re-activate (fire & forget — we're already in an error path)
+                    await enableAutostart({
+                        platform,
+                        home,
+                        runner,
+                        state: snap.daemonJson,
+                        env: {},
+                    }).catch(() => { });
+                }
+            },
+        });
+        // Step 12: wire agents
+        // In-memory before-image map: agentId -> {path, beforeText}
+        const beforeImages = new Map();
+        await wireAgents({
+            plan: plan.wire,
+            reconcile,
+            writeAgent: async (agent) => {
+                // Capture before-image of agent's mcp config files via a dry-run plan
+                const agentImages = captureBeforeImage(agent.id, home, platform, url);
+                beforeImages.set(agent.id, agentImages);
+                // FIX 3: record Layer-1 backup (first-backup-wins) before mutating
+                recordBeforeInstall(agent.id, home, platform, url, agentImages);
+                // Run install for this agent via HTTP transport
+                runInstall({ agent: [agent.id], http: true, url, home, platform });
+            },
+            rollbackToBeforeImage: async () => {
+                for (const images of beforeImages.values()) {
+                    for (const img of images) {
+                        if (img.beforeText === null) {
+                            // file didn't exist before — remove it if it now exists
+                            try {
+                                if (existsSync(img.path)) {
+                                    const { unlinkSync } = await import("node:fs");
+                                    unlinkSync(img.path);
+                                }
+                            }
+                            catch {
+                                /* best-effort */
+                            }
+                        }
+                        else {
+                            try {
+                                writeFileSync(img.path, img.beforeText, "utf8");
+                            }
+                            catch {
+                                /* best-effort */
+                            }
+                        }
+                    }
+                }
+            },
+            restoreOldDaemon: async () => {
+                if (savedSnapshot) {
+                    // FIX 2: bootout the currently-loaded (failed new) service before restoring old
+                    await disableAutostart({ platform, home, runner }).catch(() => { });
+                    if (savedSnapshot.serviceFileText !== null) {
+                        writeFileSync(serviceFilePath, savedSnapshot.serviceFileText, "utf8");
+                        // FIX 1: ensure restored service file is also 0600
+                        chmodSync(serviceFilePath, 0o600);
+                    }
+                    if (savedSnapshot.daemonJson !== null) {
+                        writeDaemonState(stateDir, savedSnapshot.daemonJson);
+                        await enableAutostart({
+                            platform,
+                            home,
+                            runner,
+                            state: savedSnapshot.daemonJson,
+                            env: {},
+                        }).catch(() => { });
+                    }
+                }
+            },
+        });
+        return {
+            url,
+            port,
+            engine,
+            wiredAgents: plan.wire.map((a) => a.id),
+            skippedAgents: plan.skip.map((a) => ({
+                id: a.id,
+                reason: "stdio-only agent (pglite engine)",
+            })),
+            warnings: plan.warnings,
+        };
+    }
+    finally {
+        lock.release();
+    }
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/** Fetch /health from the daemon. Not injected in production — only overridden in tests. */
+async function defaultFetchHealth(url) {
+    const healthUrl = url.replace(/\/mcp$/, "/health");
+    const r = await fetch(healthUrl);
+    const body = (await r.json().catch(() => ({})));
+    return { status: r.status, body };
+}
+/** Extract secret env var names from raw YAML text (${VAR_NAME} references) that are present in process.env. */
+function extractSecretEnv(configPath) {
+    try {
+        const raw = readFileSync(configPath, "utf8");
+        const matches = [...raw.matchAll(/\$\{([A-Z_][A-Z0-9_]*)\}/g)];
+        const env = {};
+        for (const m of matches) {
+            const name = m[1];
+            const val = process.env[name];
+            if (val !== undefined)
+                env[name] = val;
+        }
+        return env;
+    }
+    catch {
+        return {};
+    }
+}
+/** Capture before-image of the agent's mcp config files by doing a dry-run plan. */
+function captureBeforeImage(agentId, home, platform, url) {
+    try {
+        const planned = planInstall({ agent: [agentId], http: true, url, home, platform }, "upsert");
+        const images = [];
+        for (const client of planned) {
+            for (const op of client.ops) {
+                if ("path" in op && op.path) {
+                    const beforeText = existsSync(op.path) ? readFileSync(op.path, "utf8") : null;
+                    images.push({ path: op.path, beforeText });
+                }
+            }
+        }
+        return images;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * FIX 3: Record Layer-1 backup (install-state.json) for all ops of an agent BEFORE mutating.
+ * managedHash is a hash of the memkin MCP entry content that will be written (used by
+ * restorableOriginal to detect post-install hand-edits).
+ */
+function recordBeforeInstall(agentId, home, platform, url, beforeImages) {
+    try {
+        const planned = planInstall({ agent: [agentId], http: true, url, home, platform }, "upsert");
+        // Build a lookup of path → beforeText for quick access
+        const imageMap = new Map(beforeImages.map((img) => [img.path, img.beforeText]));
+        for (const client of planned) {
+            for (const op of client.ops) {
+                if (!("path" in op) || !op.path)
+                    continue; // skip cli ops
+                const opRef = {
+                    client: agentId,
+                    scope: "global",
+                    path: op.path,
+                    op_kind: op.kind,
+                };
+                const beforeText = imageMap.get(op.path) ?? null;
+                const present = beforeText !== null;
+                // managedHash: hash of the entry that is about to be written
+                const entryContent = "entry" in op && op.entry
+                    ? JSON.stringify(op.entry)
+                    : "content" in op && op.content
+                        ? op.content
+                        : op.path;
+                const managedHash = createHash("sha256").update(entryContent).digest("hex");
+                recordOriginal(home, opRef, { present, raw: beforeText }, managedHash);
+            }
+        }
+    }
+    catch {
+        // best-effort — Layer-1 backup is non-fatal
+    }
+}
+//# sourceMappingURL=run-up.js.map

package/dist/lifecycle/run-up.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-up.js","sourceRoot":"","sources":["../../src/lifecycle/run-up.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAErF,OAAO,EACL,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEjF,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,0BAA0B,IAAI,8BAA8B,EAAE,MAAM,oCAAoC,CAAC;AAClH,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAgC5D,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,OAAqB,EAAE,EACvB,WAA0B,EAAE;IAE5B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,UAAU,CAAC;IAC7C,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,IAAI,kBAAkB,CAAC;IAEvE,iCAAiC;IACjC,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,sBAAsB;QACtB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;QAC/C,MAAM,cAAc,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC;QAE/C,6DAA6D;QAC7D,8FAA8F;QAC9F,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,WAAW,GACf,QAAQ,CAAC,0BAA0B;gBACnC,CAAC,CAAC,GAAiB,EAAE,EAAE,CACrB,8BAA8B,CAAC,GAAG,EAAE;oBAClC,IAAI;oBACJ,QAAQ,EAAE,uBAAuB,CAAC;wBAChC,IAAI;wBACJ,OAAO,EAAE,IAAI;wBACb,UAAU,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW;qBAC5C,CAAC;oBACF,cAAc,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CACxB,kBAAkB,CAAC;wBACjB,OAAO,EAAE,EAAE;wBACX,KAAK,EAAE,YAAY,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC;wBAClC,MAAM;qBACP,CAAC;iBACL,CAAC,CAAC,CAAC;YACR,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAED,uDAAuD;QACvD,MAAM,WAAW,GAAG,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1D,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;YAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,IAAI,KAAK,EAAE,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,eAAe;QACf,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;QAEhE,mCAAmC;QACnC,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,MAAM,GAAG,GAAG,oBAAoB,IAAI,MAAM,CAAC;QAE3C,sBAAsB;QACtB,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;QAEhC,sBAAsB;QACtB,MAAM,EAAE,GAAG,QAAQ,CAAC,aAAa,IAAI,mBAAmB,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAG;YAChB,OAAO;YACP,YAAY;YACZ,WAAW;YACX,UAAU;YACV,UAAU;YACV,YAAY;YACZ,WAAW;YACX,YAAY;YACZ,MAAM,CAAC,IAAI,CAAC;YACZ,kBAAkB;YAClB,sBAAsB;YACtB,UAAU;YACV,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;SAClE,CAAC;QACF,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAE9C,gDAAgD;QAChD,MAAM,GAAG,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAEzC,4BAA4B;QAC5B,MAAM,KAAK,GAAgB;YACzB,WAAW,EAAE,UAAU;YACvB,WAAW,EAAE,UAAU;YACvB,aAAa,EAAE,WAAW,CAAC,UAAU,CAAC;YACtC,mBAAmB,EAAE,iBAAiB,CAAC;gBACrC,IAAI,EAAE,WAAW;gBACjB,IAAI;gBACJ,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,OAAO,CAAC,YAAY;aAC5B,CAAC;YACF,GAAG;YACH,IAAI;SACL,CAAC;QAEF,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,UAAU,KAAK,IAAI,CAAC;QAItC,IAAI,aAAa,GAAoB,IAAI,CAAC;QAE1C,MAAM,eAAe,GACnB,QAAQ,KAAK,QAAQ;YACnB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,yBAAyB,CAAC;YAClE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAEjE,yBAAyB;QACzB,MAAM,aAAa,CAAC;YAClB,UAAU;YACV,OAAO,EAAE,KAAK,IAAuB,EAAE;gBACrC,MAAM,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;oBACjD,CAAC,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC;oBACvC,CAAC,CAAC,IAAI,CAAC;gBACT,aAAa,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;gBAC5D,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,MAAM,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1F,SAAS,EAAE,GAAG,EAAE,CACd,UAAU,CACR,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,EAC1B,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAC/C,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB;YACH,OAAO,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YACjF,UAAU,EAAE,KAAK,EAAE,KAAc,EAAE,EAAE;gBACnC,2GAA2G;gBAC3G,6DAA6D;gBAC7D,MAAM,gBAAgB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACnE,MAAM,IAAI,GAAG,KAAiB,CAAC;gBAC/B,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;oBAClC,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;oBAC7D,mDAAmD;oBACnD,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;gBACpC,CAAC;gBACD,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;oBAC7B,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;oBAC5C,2EAA2E;oBAC3E,MAAM,eAAe,CAAC;wBACpB,QAAQ;wBACR,IAAI;wBACJ,MAAM;wBACN,KAAK,EAAE,IAAI,CAAC,UAAU;wBACtB,GAAG,EAAE,EAAE;qBACR,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QAEH,uBAAuB;QACvB,4DAA4D;QAC5D,MAAM,YAAY,GAAG,IAAI,GAAG,EAA8D,CAAC;QAE3F,MAAM,UAAU,CAAC;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS;YACT,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBAC1B,sEAAsE;gBACtE,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;gBACtE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;gBACxC,mEAAmE;gBACnE,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;gBAChE,gDAAgD;gBAChD,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,qBAAqB,EAAE,KAAK,IAAI,EAAE;gBAChC,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;oBAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;wBACzB,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;4BAC5B,wDAAwD;4BACxD,IAAI,CAAC;gCACH,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oCACzB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;oCAC/C,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gCACvB,CAAC;4BACH,CAAC;4BAAC,MAAM,CAAC;gCACP,iBAAiB;4BACnB,CAAC;wBACH,CAAC;6BAAM,CAAC;4BACN,IAAI,CAAC;gCACH,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;4BAClD,CAAC;4BAAC,MAAM,CAAC;gCACP,iBAAiB;4BACnB,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBAC3B,IAAI,aAAa,EAAE,CAAC;oBAClB,gFAAgF;oBAChF,MAAM,gBAAgB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBACnE,IAAI,aAAa,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;wBAC3C,aAAa,CAAC,eAAe,EAAE,aAAa,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;wBACtE,mDAAmD;wBACnD,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;oBACpC,CAAC;oBACD,IAAI,aAAa,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;wBACtC,gBAAgB,CAAC,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;wBACrD,MAAM,eAAe,CAAC;4BACpB,QAAQ;4BACR,IAAI;4BACJ,MAAM;4BACN,KAAK,EAAE,aAAa,CAAC,UAAU;4BAC/B,GAAG,EAAE,EAAE;yBACR,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBACrB,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QAEH,OAAO;YACL,GAAG;YACH,IAAI;YACJ,MAAM;YACN,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACnC,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,MAAM,EAAE,kCAAkC;aAC3C,CAAC,CAAC;YACH,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,4FAA4F;AAC5F,KAAK,UAAU,kBAAkB,CAC/B,GAAW;IAEX,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACnD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAC3E,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,gHAAgH;AAChH,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC,CAAC;QAC/D,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAClB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,GAAG,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QACzC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,SAAS,kBAAkB,CACzB,OAAe,EACf,IAAY,EACZ,QAAyB,EACzB,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAuD,EAAE,CAAC;QACtE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;gBAC5B,IAAI,MAAM,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;oBAC5B,MAAM,UAAU,GAAG,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBAC9E,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,OAAe,EACf,IAAY,EACZ,QAAyB,EACzB,GAAW,EACX,YAAgE;IAEhE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC7F,uDAAuD;QACvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;gBAC5B,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI;oBAAE,SAAS,CAAC,eAAe;gBAC1D,MAAM,KAAK,GAAG;oBACZ,MAAM,EAAE,OAAO;oBACf,KAAK,EAAE,QAAiB;oBACxB,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,OAAO,EAAE,EAAE,CAAC,IAAI;iBACjB,CAAC;gBACF,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;gBACjD,MAAM,OAAO,GAAG,UAAU,KAAK,IAAI,CAAC;gBACpC,6DAA6D;gBAC7D,MAAM,YAAY,GAChB,OAAO,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK;oBACvB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC;oBAC1B,CAAC,CAAC,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO;wBAC7B,CAAC,CAAC,EAAE,CAAC,OAAO;wBACZ,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC;gBAChB,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5E,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,WAAW,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;AACH,CAAC"}

package/dist/lifecycle/status.d.ts

@@ -0,0 +1,38 @@
+import type { DaemonState } from "../daemon/autostart/daemon-state.js";
+import type { ManagedState } from "../store/managed/pg-paths.js";
+export interface HealthLite {
+    status: number;
+    body: Record<string, unknown>;
+}
+export interface ComputeStatusDeps {
+    stored: Pick<DaemonState, "raw_yaml_hash" | "serving_subset_hash" | "config_path" | "url"> | null;
+    /** rawYamlHash(stored.config_path) — caller computes; no secret resolution */
+    currentRawHash: string | null;
+    currentServingHash: string | null;
+    /** live /health response, or null if unreachable */
+    health: HealthLite | null;
+}
+export interface StatusReport {
+    running: boolean;
+    url?: string;
+    pid?: number;
+    engine?: string;
+    configPath?: string;
+    drift: {
+        configChanged: boolean;
+        needsReup: boolean;
+        restartedOntoEditedConfig: boolean;
+    };
+}
+export declare function computeStatus(deps: ComputeStatusDeps): StatusReport;
+export interface ManagedStatusLine {
+    label: string;
+    value: string;
+}
+/**
+ * Formats managed Postgres state into secret-free display lines.
+ * `clusterRunning` is true when `pg_ctl status -D <pgdata>` indicates the
+ * postmaster is running (callers probe this; pass null when skipping the check).
+ */
+export declare function formatManagedStatus(state: ManagedState, clusterRunning: boolean | null): ManagedStatusLine[];
+//# sourceMappingURL=status.d.ts.map

package/dist/lifecycle/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/lifecycle/status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAEjE,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,eAAe,GAAG,qBAAqB,GAAG,aAAa,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC;IAClG,8EAA8E;IAC9E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,oDAAoD;IACpD,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE;QACL,aAAa,EAAE,OAAO,CAAC;QACvB,SAAS,EAAE,OAAO,CAAC;QACnB,yBAAyB,EAAE,OAAO,CAAC;KACpC,CAAC;CACH;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,YAAY,CAyBnE;AAMD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,YAAY,EACnB,cAAc,EAAE,OAAO,GAAG,IAAI,GAC7B,iBAAiB,EAAE,CAgBrB"}

package/dist/lifecycle/status.js

@@ -0,0 +1,41 @@
+export function computeStatus(deps) {
+    const { stored, currentRawHash, currentServingHash, health } = deps;
+    const running = !!health && health.status === 200;
+    const body = health?.body ?? {};
+    const configChanged = !!stored && currentRawHash !== null && currentRawHash !== stored.raw_yaml_hash;
+    const needsReup = !!stored && currentServingHash !== null && currentServingHash !== stored.serving_subset_hash;
+    // The daemon echoes the config hash it actually loaded; if it differs from stored desired hash,
+    // it restarted onto edited YAML.
+    const loaded = typeof body.loaded_config_hash === "string" ? body.loaded_config_hash : null;
+    const restartedOntoEditedConfig = !!stored && loaded !== null && loaded !== stored.raw_yaml_hash;
+    return {
+        running,
+        url: stored?.url,
+        pid: typeof body.pid === "number" ? body.pid : undefined,
+        engine: typeof body.engine === "string" ? body.engine : undefined,
+        configPath: stored?.config_path,
+        drift: { configChanged, needsReup, restartedOntoEditedConfig },
+    };
+}
+/**
+ * Formats managed Postgres state into secret-free display lines.
+ * `clusterRunning` is true when `pg_ctl status -D <pgdata>` indicates the
+ * postmaster is running (callers probe this; pass null when skipping the check).
+ */
+export function formatManagedStatus(state, clusterRunning) {
+    const lines = [
+        { label: "Managed Postgres pgdata", value: state.pgdata },
+        { label: "Managed Postgres port", value: String(state.fixedPort) },
+        { label: "Managed Postgres socketDir", value: state.socketDir },
+        { label: "Managed Postgres version", value: state.pgVersion },
+    ];
+    if (clusterRunning === true) {
+        lines.push({ label: "Managed Postgres process", value: "running ✓" });
+    }
+    else if (clusterRunning === false) {
+        lines.push({ label: "Managed Postgres process", value: "stopped ✗" });
+    }
+    // null → skip (caller chose not to probe)
+    return lines;
+}
+//# sourceMappingURL=status.js.map

package/dist/lifecycle/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/lifecycle/status.ts"],"names":[],"mappings":"AA8BA,MAAM,UAAU,aAAa,CAAC,IAAuB;IACnD,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEpE,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;IAEhC,MAAM,aAAa,GACjB,CAAC,CAAC,MAAM,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,MAAM,CAAC,aAAa,CAAC;IAEjF,MAAM,SAAS,GACb,CAAC,CAAC,MAAM,IAAI,kBAAkB,KAAK,IAAI,IAAI,kBAAkB,KAAK,MAAM,CAAC,mBAAmB,CAAC;IAE/F,gGAAgG;IAChG,iCAAiC;IACjC,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,MAAM,CAAC,aAAa,CAAC;IAEjG,OAAO;QACL,OAAO;QACP,GAAG,EAAE,MAAM,EAAE,GAAG;QAChB,GAAG,EAAE,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QACxD,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACjE,UAAU,EAAE,MAAM,EAAE,WAAW;QAC/B,KAAK,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,yBAAyB,EAAE;KAC/D,CAAC;AACJ,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAmB,EACnB,cAA8B;IAE9B,MAAM,KAAK,GAAwB;QACjC,EAAE,KAAK,EAAE,yBAAyB,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE;QACzD,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE;QAClE,EAAE,KAAK,EAAE,4BAA4B,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE;QAC/D,EAAE,KAAK,EAAE,0BAA0B,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE;KAC9D,CAAC;IAEF,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACxE,CAAC;SAAM,IAAI,cAAc,KAAK,KAAK,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,0CAA0C;IAE1C,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lifecycle/up.d.ts

@@ -0,0 +1,35 @@
+export interface AgentRef {
+    id: string;
+    supportsHttp: boolean;
+}
+export interface PlanUpDeps {
+    detectedAgents: AgentRef[];
+    missingEnvVars: string[];
+    engine: "pglite" | "postgres" | "managed";
+}
+export interface UpPlan {
+    wire: AgentRef[];
+    skip: AgentRef[];
+    warnings: string[];
+}
+export declare function planUp(deps: PlanUpDeps): UpPlan;
+export interface BringUpDeps {
+    priorState: unknown | null;
+    saveOld: () => Promise<unknown>;
+    enable: () => Promise<void>;
+    pollReady: () => Promise<boolean>;
+    disable: () => Promise<void>;
+    restoreOld: (saved: unknown) => Promise<void>;
+}
+export declare function bringUpDaemon(deps: BringUpDeps): Promise<void>;
+export interface WireAgentsDeps<A = {
+    id: string;
+}> {
+    plan: A[];
+    reconcile: boolean;
+    writeAgent: (agent: A) => Promise<void>;
+    rollbackToBeforeImage: () => Promise<void>;
+    restoreOldDaemon: () => Promise<void>;
+}
+export declare function wireAgents<A>(deps: WireAgentsDeps<A>): Promise<void>;
+//# sourceMappingURL=up.d.ts.map

package/dist/lifecycle/up.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"up.d.ts","sourceRoot":"","sources":["../../src/lifecycle/up.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,QAAQ,EAAE,CAAC;IAC3B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjB,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAgB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAiB/C;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,SAAS,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAapE;AAED,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE;IAChD,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,qBAAqB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,gBAAgB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,wBAAsB,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAY1E"}

package/dist/lifecycle/up.js

@@ -0,0 +1,45 @@
+export function planUp(deps) {
+    if (deps.missingEnvVars.length > 0) {
+        throw new Error(`Cannot start daemon: missing env vars referenced in config: ${deps.missingEnvVars.join(", ")}`);
+    }
+    const warnings = [];
+    // On pglite, a 2nd stdio process would collide on the single-writer lock → skip stdio-only agents.
+    if (deps.engine === "pglite") {
+        warnings.push("pglite: concurrent CLI commands and stdio-only agents are unsafe; postgres recommended");
+        const wire = deps.detectedAgents.filter((a) => a.supportsHttp);
+        const skip = deps.detectedAgents.filter((a) => !a.supportsHttp);
+        return { wire, skip, warnings };
+    }
+    return { wire: deps.detectedAgents, skip: [], warnings };
+}
+export async function bringUpDaemon(deps) {
+    const reconcile = deps.priorState !== null;
+    const saved = reconcile ? await deps.saveOld() : null;
+    await deps.enable();
+    const ready = await deps.pollReady();
+    if (ready)
+        return;
+    // Not ready → undo
+    if (reconcile) {
+        await deps.restoreOld(saved);
+    }
+    else {
+        await deps.disable();
+    }
+    throw new Error("Daemon failed readiness check; rolled back.");
+}
+export async function wireAgents(deps) {
+    try {
+        for (const agent of deps.plan) {
+            await deps.writeAgent(agent);
+        }
+    }
+    catch (err) {
+        await deps.rollbackToBeforeImage();
+        if (deps.reconcile) {
+            await deps.restoreOldDaemon();
+        }
+        throw err instanceof Error ? err : new Error(String(err));
+    }
+}
+//# sourceMappingURL=up.js.map

package/dist/lifecycle/up.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"up.js","sourceRoot":"","sources":["../../src/lifecycle/up.ts"],"names":[],"mappings":"AAiBA,MAAM,UAAU,MAAM,CAAC,IAAgB;IACrC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,+DAA+D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,mGAAmG;IACnG,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CACX,wFAAwF,CACzF,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAChE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;AAC3D,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAiB;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;IACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;IACrC,IAAI,KAAK;QAAE,OAAO;IAClB,mBAAmB;IACnB,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;AACjE,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAI,IAAuB;IACzD,IAAI,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC"}

package/dist/processors/privacy.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Privacy Processor for DigitalBrainExtractor
+ * Redacts sensitive data in ExtractionResult with configurable L1/L2/L3 patterns
+ */
+import type { PrivacyConfig } from "../core/config.js";
+import type { ExtractionResult } from "../core/types.js";
+/**
+ * Privacy Processor - redacts sensitive data in ExtractionResult
+ *
+ * Supports three levels of patterns:
+ * - L1: Phone numbers, ID cards, bank cards (configurable)
+ * - L2: IP addresses (always active)
+ * - L3: Blocked words from config
+ *
+ * Modes:
+ * - reversible: generates .memkin/redaction_map.jsonl for recovery
+ * - irreversible: redacts without keeping recovery map
+ *
+ * Protected fields (never redacted):
+ * - Entity.name
+ * - SourceRef.raw_hash
+ */
+export declare class PrivacyProcessor {
+    private config;
+    private redactionMap;
+    private stateBase?;
+    private phoneRegex;
+    private idCardRegex;
+    private bankCardRegex;
+    private ipRegex;
+    constructor(config: PrivacyConfig, options?: {
+        stateBase?: string;
+    });
+    /**
+     * Main entry point - process ExtractionResult and apply redactions
+     */
+    process(result: ExtractionResult): ExtractionResult;
+    /**
+     * Process SourceRef - redacts quote and url, but NOT raw_hash
+     */
+    private processSourceRef;
+    /**
+     * Process Entity - redacts context, but NOT name or slug
+     */
+    private processEntity;
+    /**
+     * Process Decision - redacts summary and reasoning
+     */
+    private processDecision;
+    /**
+     * Process TaskSignal - redacts title
+     */
+    private processTask;
+    /**
+     * Process Link - redacts context
+     */
+    private processLink;
+    /**
+     * Process Discovery - redacts summary and detail
+     */
+    private processDiscovery;
+    /**
+     * Process Knowledge - redacts content and applies blocked words to topic
+     * Topic only gets L3 (blocked words) redaction, NOT L1/L2
+     * related_entities are NEVER redacted
+     */
+    private processKnowledge;
+    /**
+     * Process Preference - redacts summary and detail
+     */
+    private processPreference;
+    /**
+     * Process Reference - redacts summary and trigger
+     * title and url are NOT redacted (url is the core field; title is a document name)
+     */
+    private processReference;
+    /**
+     * Redact blocked words only (L3 only, no L1/L2 regex)
+     * Used for topic field which should not match phone/ID/IP patterns
+     */
+    private redactBlockedWordsOnly;
+    /**
+     * Redact text by applying all enabled patterns
+     * Tracks replacements for reversible mode
+     */
+    private redactText;
+    /**
+     * Apply redaction with pattern and track in map if reversible mode
+     * Important: pattern matching happens on the original text before any replacements
+     */
+    private applyRedaction;
+    /**
+     * Escape special regex characters
+     */
+    private escapeRegex;
+    /**
+     * Write redaction map to .memkin/redaction_map.jsonl
+     */
+    private writeRedactionMap;
+}
+//# sourceMappingURL=privacy.d.ts.map

package/dist/processors/privacy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy.d.ts","sourceRoot":"","sources":["../../src/processors/privacy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,KAAK,EAIV,gBAAgB,EAOjB,MAAM,kBAAkB,CAAC;AAY1B;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,YAAY,CAAwB;IAC5C,OAAO,CAAC,SAAS,CAAC,CAAS;IAG3B,OAAO,CAAC,UAAU,CAAkB;IACpC,OAAO,CAAC,WAAW,CAAmB;IACtC,OAAO,CAAC,aAAa,CAAgB;IAGrC,OAAO,CAAC,OAAO,CAAyC;gBAE5C,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO;IAKvE;;OAEG;IACH,OAAO,CAAC,MAAM,EAAE,gBAAgB,GAAG,gBAAgB;IAkCnD;;OAEG;IACH,OAAO,CAAC,gBAAgB;IASxB;;OAEG;IACH,OAAO,CAAC,aAAa;IAQrB;;OAEG;IACH,OAAO,CAAC,eAAe;IAWvB;;OAEG;IACH,OAAO,CAAC,WAAW;IAQnB;;OAEG;IACH,OAAO,CAAC,WAAW;IAQnB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAWxB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IASxB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAWxB;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAS9B;;;OAGG;IACH,OAAO,CAAC,UAAU;IA8BlB;;;OAGG;IACH,OAAO,CAAC,cAAc;IA2CtB;;OAEG;IACH,OAAO,CAAC,WAAW;IAInB;;OAEG;IACH,OAAO,CAAC,iBAAiB;CAY1B"}