openmates 0.27.0-alpha.21 → 0.27.0-alpha.23

package/dist/{chunk-UIW7XY2C.js → chunk-NQP5QUVR.js}

@@ -1733,6 +1733,227 @@ function coalesceMemoryRequestMessages(messages) {
   return result;
 }
 
+// ../ui/src/utils/projectFilePatch.ts
+var ProjectFilePatchError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ProjectFilePatchError";
+  }
+};
+var HEADER = /^(---|\+\+\+) ([^\t]+)(?:\t.*)?$/;
+var HUNK = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@(?: .*)?$/;
+function applyProjectFilePatch(original, unifiedDiff, expectedPath) {
+  if (!unifiedDiff || unifiedDiff.includes("\0") || unifiedDiff.includes("\r")) {
+    throw new ProjectFilePatchError("Patch must be a non-empty LF unified diff");
+  }
+  const rows2 = unifiedDiff.split("\n");
+  if (rows2.at(-1) === "") rows2.pop();
+  if (rows2.length < 3) throw new ProjectFilePatchError("Patch is missing file headers or hunks");
+  const oldHeader = HEADER.exec(rows2[0] ?? "");
+  const newHeader = HEADER.exec(rows2[1] ?? "");
+  if (!oldHeader || oldHeader[1] !== "---" || !newHeader || newHeader[1] !== "+++") {
+    throw new ProjectFilePatchError("Patch must start with one old and one new file header");
+  }
+  const oldPath = normalizeHeaderPath(oldHeader[2] ?? "");
+  const newPath = normalizeHeaderPath(newHeader[2] ?? "");
+  if (oldPath === "/dev/null" || newPath === "/dev/null") {
+    throw new ProjectFilePatchError("Update patches cannot create or delete files");
+  }
+  if (expectedPath && (oldPath !== expectedPath || newPath !== expectedPath)) {
+    throw new ProjectFilePatchError("Patch file headers do not match the requested path");
+  }
+  const hunks = [];
+  let row = 2;
+  while (row < rows2.length) {
+    const match = HUNK.exec(rows2[row] ?? "");
+    if (!match) throw new ProjectFilePatchError("Patch contains data outside a valid hunk");
+    const hunk = {
+      oldStart: parseCoordinate(match[1]),
+      oldCount: match[2] === void 0 ? 1 : parseCoordinate(match[2]),
+      newStart: parseCoordinate(match[3]),
+      newCount: match[4] === void 0 ? 1 : parseCoordinate(match[4]),
+      lines: []
+    };
+    row += 1;
+    let oldSeen = 0;
+    let newSeen = 0;
+    while (row < rows2.length && !rows2[row]?.startsWith("@@ ")) {
+      const value = rows2[row] ?? "";
+      if (value === "\") {
+        const previous = hunk.lines.at(-1);
+        if (!previous || !previous.line.hasNewline) {
+          throw new ProjectFilePatchError("Misplaced no-newline marker");
+        }
+        previous.line.hasNewline = false;
+        row += 1;
+        continue;
+      }
+      const prefix = value[0];
+      if (prefix !== " " && prefix !== "-" && prefix !== "+") {
+        throw new ProjectFilePatchError("Every hunk line must have a unified-diff prefix");
+      }
+      const kind = prefix === " " ? "context" : prefix === "-" ? "remove" : "add";
+      hunk.lines.push({ kind, line: { value: value.slice(1), hasNewline: true } });
+      if (kind !== "add") oldSeen += 1;
+      if (kind !== "remove") newSeen += 1;
+      row += 1;
+    }
+    if (oldSeen !== hunk.oldCount || newSeen !== hunk.newCount) {
+      throw new ProjectFilePatchError("Hunk line counts do not match its header");
+    }
+    hunks.push(hunk);
+  }
+  if (hunks.length === 0) throw new ProjectFilePatchError("Patch has no hunks");
+  const source = splitContentLines(original);
+  const output = [];
+  let sourceIndex = 0;
+  let outputLine = 1;
+  for (const hunk of hunks) {
+    const expectedSourceIndex = hunk.oldCount === 0 ? hunk.oldStart : hunk.oldStart - 1;
+    const expectedOutputLine = hunk.newCount === 0 ? hunk.newStart + 1 : hunk.newStart;
+    if (expectedSourceIndex < sourceIndex || expectedSourceIndex > source.length) {
+      throw new ProjectFilePatchError("Patch hunks overlap or are outside the source");
+    }
+    while (sourceIndex < expectedSourceIndex) {
+      output.push(source[sourceIndex]);
+      sourceIndex += 1;
+      outputLine += 1;
+    }
+    if (outputLine !== expectedOutputLine) {
+      throw new ProjectFilePatchError("Patch new-file coordinates are inconsistent");
+    }
+    for (const item of hunk.lines) {
+      if (item.kind !== "add") {
+        const actual = source[sourceIndex];
+        if (!actual || actual.value !== item.line.value || actual.hasNewline !== item.line.hasNewline) {
+          throw new ProjectFilePatchError("Patch context does not match the source exactly");
+        }
+        sourceIndex += 1;
+      }
+      if (item.kind !== "remove") {
+        output.push({ ...item.line });
+        outputLine += 1;
+      }
+    }
+  }
+  output.push(...source.slice(sourceIndex));
+  validateNewlinePlacement(output);
+  return {
+    content: output.map((line) => line.value + (line.hasNewline ? "\n" : "")).join(""),
+    appliedDiff: unifiedDiff,
+    oldPath,
+    newPath
+  };
+}
+function parseCoordinate(value) {
+  const number = Number(value);
+  if (!Number.isSafeInteger(number) || number < 0) throw new ProjectFilePatchError("Invalid hunk coordinate");
+  return number;
+}
+function normalizeHeaderPath(value) {
+  if (value === "/dev/null") return value;
+  if (value.startsWith("a/") || value.startsWith("b/")) return value.slice(2);
+  return value;
+}
+function splitContentLines(content) {
+  if (content === "") return [];
+  const lines = [];
+  let start = 0;
+  for (let index = 0; index < content.length; index += 1) {
+    if (content[index] !== "\n") continue;
+    lines.push({ value: content.slice(start, index), hasNewline: true });
+    start = index + 1;
+  }
+  if (start < content.length) lines.push({ value: content.slice(start), hasNewline: false });
+  return lines;
+}
+function validateNewlinePlacement(lines) {
+  for (let index = 0; index < lines.length - 1; index += 1) {
+    if (!lines[index]?.hasNewline) throw new ProjectFilePatchError("No-newline marker is only valid at end of file");
+  }
+}
+
+// ../ui/src/utils/embedVersionReconstruction.ts
+async function reconstructVersionRows(rows2, decrypt) {
+  const sorted2 = [...rows2].sort((a, b) => a.version_number - b.version_number);
+  let content = null;
+  let expected = sorted2[0]?.version_number ?? 1;
+  for (const row of sorted2) {
+    if (!Number.isSafeInteger(row.version_number) || row.version_number < 1 || row.version_number !== expected) {
+      throw new Error("Version chain is incomplete");
+    }
+    expected += 1;
+    if (row.encrypted_snapshot) {
+      content = await decrypt(row.encrypted_snapshot);
+      if (content === null) throw new Error("Version snapshot could not be decrypted");
+    } else {
+      if (content === null) throw new Error("Version history is missing the initial snapshot");
+      if (!row.encrypted_patch) throw new Error("Version patch is missing");
+      const patch = await decrypt(row.encrypted_patch);
+      if (patch === null) throw new Error("Version patch could not be decrypted");
+      content = applyVersionPatch(content, patch);
+    }
+  }
+  if (content === null) throw new Error("Version history is missing the initial snapshot");
+  return content;
+}
+function applyVersionPatch(content, patch) {
+  if (patch.includes("\")) {
+    const withHeaders = patch.startsWith("@@ ") ? `--- version
++++ version
+${patch}` : patch;
+    return applyProjectFilePatch(content, withHeaders).content;
+  }
+  const source = content === "" ? [] : content.split("\n");
+  const lines = patch.split("\n");
+  if (lines.at(-1) === "") lines.pop();
+  let index = 0;
+  if (lines[0]?.startsWith("--- ") && lines[1]?.startsWith("+++ ")) index = 2;
+  const output = [];
+  let sourceIndex = 0;
+  let hunkCount = 0;
+  while (index < lines.length) {
+    const header2 = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@(?: .*)?$/.exec(lines[index] ?? "");
+    if (!header2) throw new Error("Version patch contains an invalid hunk");
+    const oldStart = Number(header2[1]);
+    const oldCount = header2[2] === void 0 ? 1 : Number(header2[2]);
+    const newStart = Number(header2[3]);
+    const newCount = header2[4] === void 0 ? 1 : Number(header2[4]);
+    const start = oldCount === 0 ? oldStart : oldStart - 1;
+    const outputStart = newCount === 0 ? newStart : newStart - 1;
+    if (![oldStart, oldCount, newStart, newCount].every(Number.isSafeInteger) || start < sourceIndex || start > source.length) throw new Error("Version patch hunks overlap or exceed content");
+    output.push(...source.slice(sourceIndex, start));
+    if (output.length !== outputStart) throw new Error("Version patch coordinates do not match content");
+    sourceIndex = start;
+    let removed = 0;
+    let added = 0;
+    index += 1;
+    while (index < lines.length && !lines[index]?.startsWith("@@ ")) {
+      const line = lines[index] ?? "";
+      if (line === "\") {
+        index += 1;
+        continue;
+      }
+      if (![" ", "-", "+"].includes(line[0] ?? "")) throw new Error("Version patch has an invalid line");
+      if (line[0] !== "+") {
+        if (source[sourceIndex] !== line.slice(1)) throw new Error("Version patch context does not match local content");
+        sourceIndex += 1;
+        removed += 1;
+      }
+      if (line[0] !== "-") {
+        output.push(line.slice(1));
+        added += 1;
+      }
+      index += 1;
+    }
+    if (removed !== oldCount || added !== newCount) throw new Error("Version patch line counts do not match its header");
+    hunkCount += 1;
+  }
+  if (hunkCount === 0) throw new Error("Version patch has no hunks");
+  output.push(...source.slice(sourceIndex));
+  return output.join("\n");
+}
+
 // src/accountImport.ts
 import { createDecipheriv, createHash as createHash4, scryptSync } from "crypto";
 import JSZip from "jszip";
@@ -2863,146 +3084,6 @@ function createProjectFileJobExecutor(options) {
   } };
 }
 
-// ../ui/src/utils/projectFilePatch.ts
-var ProjectFilePatchError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ProjectFilePatchError";
-  }
-};
-var HEADER = /^(---|\+\+\+) ([^\t]+)(?:\t.*)?$/;
-var HUNK = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@(?: .*)?$/;
-function applyProjectFilePatch(original, unifiedDiff, expectedPath) {
-  if (!unifiedDiff || unifiedDiff.includes("\0") || unifiedDiff.includes("\r")) {
-    throw new ProjectFilePatchError("Patch must be a non-empty LF unified diff");
-  }
-  const rows2 = unifiedDiff.split("\n");
-  if (rows2.at(-1) === "") rows2.pop();
-  if (rows2.length < 3) throw new ProjectFilePatchError("Patch is missing file headers or hunks");
-  const oldHeader = HEADER.exec(rows2[0] ?? "");
-  const newHeader = HEADER.exec(rows2[1] ?? "");
-  if (!oldHeader || oldHeader[1] !== "---" || !newHeader || newHeader[1] !== "+++") {
-    throw new ProjectFilePatchError("Patch must start with one old and one new file header");
-  }
-  const oldPath = normalizeHeaderPath(oldHeader[2] ?? "");
-  const newPath = normalizeHeaderPath(newHeader[2] ?? "");
-  if (oldPath === "/dev/null" || newPath === "/dev/null") {
-    throw new ProjectFilePatchError("Update patches cannot create or delete files");
-  }
-  if (expectedPath && (oldPath !== expectedPath || newPath !== expectedPath)) {
-    throw new ProjectFilePatchError("Patch file headers do not match the requested path");
-  }
-  const hunks = [];
-  let row = 2;
-  while (row < rows2.length) {
-    const match = HUNK.exec(rows2[row] ?? "");
-    if (!match) throw new ProjectFilePatchError("Patch contains data outside a valid hunk");
-    const hunk = {
-      oldStart: parseCoordinate(match[1]),
-      oldCount: match[2] === void 0 ? 1 : parseCoordinate(match[2]),
-      newStart: parseCoordinate(match[3]),
-      newCount: match[4] === void 0 ? 1 : parseCoordinate(match[4]),
-      lines: []
-    };
-    row += 1;
-    let oldSeen = 0;
-    let newSeen = 0;
-    while (row < rows2.length && !rows2[row]?.startsWith("@@ ")) {
-      const value = rows2[row] ?? "";
-      if (value === "\") {
-        const previous = hunk.lines.at(-1);
-        if (!previous || !previous.line.hasNewline) {
-          throw new ProjectFilePatchError("Misplaced no-newline marker");
-        }
-        previous.line.hasNewline = false;
-        row += 1;
-        continue;
-      }
-      const prefix = value[0];
-      if (prefix !== " " && prefix !== "-" && prefix !== "+") {
-        throw new ProjectFilePatchError("Every hunk line must have a unified-diff prefix");
-      }
-      const kind = prefix === " " ? "context" : prefix === "-" ? "remove" : "add";
-      hunk.lines.push({ kind, line: { value: value.slice(1), hasNewline: true } });
-      if (kind !== "add") oldSeen += 1;
-      if (kind !== "remove") newSeen += 1;
-      row += 1;
-    }
-    if (oldSeen !== hunk.oldCount || newSeen !== hunk.newCount) {
-      throw new ProjectFilePatchError("Hunk line counts do not match its header");
-    }
-    hunks.push(hunk);
-  }
-  if (hunks.length === 0) throw new ProjectFilePatchError("Patch has no hunks");
-  const source = splitContentLines(original);
-  const output = [];
-  let sourceIndex = 0;
-  let outputLine = 1;
-  for (const hunk of hunks) {
-    const expectedSourceIndex = hunk.oldCount === 0 ? hunk.oldStart : hunk.oldStart - 1;
-    const expectedOutputLine = hunk.newCount === 0 ? hunk.newStart + 1 : hunk.newStart;
-    if (expectedSourceIndex < sourceIndex || expectedSourceIndex > source.length) {
-      throw new ProjectFilePatchError("Patch hunks overlap or are outside the source");
-    }
-    while (sourceIndex < expectedSourceIndex) {
-      output.push(source[sourceIndex]);
-      sourceIndex += 1;
-      outputLine += 1;
-    }
-    if (outputLine !== expectedOutputLine) {
-      throw new ProjectFilePatchError("Patch new-file coordinates are inconsistent");
-    }
-    for (const item of hunk.lines) {
-      if (item.kind !== "add") {
-        const actual = source[sourceIndex];
-        if (!actual || actual.value !== item.line.value || actual.hasNewline !== item.line.hasNewline) {
-          throw new ProjectFilePatchError("Patch context does not match the source exactly");
-        }
-        sourceIndex += 1;
-      }
-      if (item.kind !== "remove") {
-        output.push({ ...item.line });
-        outputLine += 1;
-      }
-    }
-  }
-  output.push(...source.slice(sourceIndex));
-  validateNewlinePlacement(output);
-  return {
-    content: output.map((line) => line.value + (line.hasNewline ? "\n" : "")).join(""),
-    appliedDiff: unifiedDiff,
-    oldPath,
-    newPath
-  };
-}
-function parseCoordinate(value) {
-  const number = Number(value);
-  if (!Number.isSafeInteger(number) || number < 0) throw new ProjectFilePatchError("Invalid hunk coordinate");
-  return number;
-}
-function normalizeHeaderPath(value) {
-  if (value === "/dev/null") return value;
-  if (value.startsWith("a/") || value.startsWith("b/")) return value.slice(2);
-  return value;
-}
-function splitContentLines(content) {
-  if (content === "") return [];
-  const lines = [];
-  let start = 0;
-  for (let index = 0; index < content.length; index += 1) {
-    if (content[index] !== "\n") continue;
-    lines.push({ value: content.slice(start, index), hasNewline: true });
-    start = index + 1;
-  }
-  if (start < content.length) lines.push({ value: content.slice(start), hasNewline: false });
-  return lines;
-}
-function validateNewlinePlacement(lines) {
-  for (let index = 0; index < lines.length - 1; index += 1) {
-    if (!lines[index]?.hasNewline) throw new ProjectFilePatchError("No-newline marker is only valid at end of file");
-  }
-}
-
 // ../ui/src/utils/projectSearchProtocol.ts
 var ProjectSearchProtocolError = class extends Error {
   code;
@@ -4884,6 +4965,7 @@ var OpenMatesWsClient = class {
     const clientCapabilities = [
       "canonical_embed_receipts_v1",
       "typed_recovery_outputs_v2",
+      "agentic-storage-v2",
       ...options.taskUpdateJobs !== false ? ["task_update_jobs"] : [],
       ...options.projectFileJobs === true ? ["project_file_jobs"] : [],
       ...options.remoteCommandJobs === true ? ["remote_command_jobs"] : []
@@ -10749,45 +10831,13 @@ var BLOCKED_SETTINGS_MUTATE_PATHS = /* @__PURE__ */ new Set([
   "/v1/settings/verify-action-code",
   "/v1/settings/user/disable-2fa"
 ]);
-function applyUnifiedDiffForEmbedVersion(content, patch) {
-  const contentLines = content.split("\n");
-  const lines = patch.split("\n");
-  const hunks = [];
-  let current = null;
-  for (const line of lines) {
-    const match = /^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
-    if (match) {
-      if (current) hunks.push(current);
-      current = { start: Number(match[1]) - 1, oldLines: [], newLines: [] };
-      continue;
-    }
-    if (!current) continue;
-    if (line.startsWith(" ")) {
-      current.oldLines.push(line.slice(1));
-      current.newLines.push(line.slice(1));
-    } else if (line.startsWith("-")) {
-      current.oldLines.push(line.slice(1));
-    } else if (line.startsWith("+")) {
-      current.newLines.push(line.slice(1));
-    }
-  }
-  if (current) hunks.push(current);
-  for (const hunk of hunks.sort((a, b) => b.start - a.start)) {
-    const actual = contentLines.slice(hunk.start, hunk.start + hunk.oldLines.length);
-    if (actual.join("\n") !== hunk.oldLines.join("\n")) {
-      throw new Error("Version patch context does not match local content");
-    }
-    contentLines.splice(hunk.start, hunk.oldLines.length, ...hunk.newLines);
-  }
-  return contentLines.join("\n");
-}
 function buildUnifiedDiffForEmbedRestore(currentContent, restoredContent, currentVersion, newVersion) {
-  const currentLines = currentContent.split("\n");
-  const restoredLines = restoredContent.split("\n");
+  const currentLines = currentContent ? currentContent.split("\n") : [];
+  const restoredLines = restoredContent ? restoredContent.split("\n") : [];
   return [
     `--- v${currentVersion}`,
     `+++ v${newVersion}`,
-    `@@ -1,${Math.max(1, currentLines.length)} +1,${Math.max(1, restoredLines.length)} @@`,
+    `@@ -${currentLines.length ? 1 : 0},${currentLines.length} +${restoredLines.length ? 1 : 0},${restoredLines.length} @@`,
     ...currentLines.map((line) => `-${line}`),
     ...restoredLines.map((line) => `+${line}`)
   ].join("\n");
@@ -11388,7 +11438,11 @@ var OpenMatesClient = class _OpenMatesClient {
       artifact,
       imported_at: Math.floor(Date.now() / 1e3)
     }, this.getCliRequestHeaders());
-    if (!response.ok) throw new Error(`Team import failed with HTTP ${response.status}`);
+    if (!response.ok) {
+      const detail = response.data?.detail;
+      const explanation = typeof detail === "string" && detail.length <= 500 ? `: ${detail}` : "";
+      throw new Error(`Team import failed with HTTP ${response.status}${explanation}`);
+    }
     return response.data;
   }
   async updateTeamMemberRole(teamId, memberUserId, role) {
@@ -14261,7 +14315,7 @@ var OpenMatesClient = class _OpenMatesClient {
                   historicalContent = await decryptWithAesGcmCombined(versionRow.encrypted_snapshot, embedKey);
                 } else if (typeof versionRow.encrypted_patch === "string" && historicalContent !== null) {
                   const patch = await decryptWithAesGcmCombined(versionRow.encrypted_patch, embedKey);
-                  historicalContent = applyUnifiedDiffForEmbedVersion(historicalContent, patch ?? "");
+                  historicalContent = applyVersionPatch(historicalContent, patch ?? "");
                 } else {
                   throw new Error("Canonical recovery embed history lacks a starting snapshot.");
                 }
@@ -19616,8 +19670,12 @@ Required: ${schema.required.join(", ")}`
     if (!response.ok || !response.data) {
       throw new Error(this.formatEmbedVersionError(response.data, `Failed to load embed version ${version} (HTTP ${response.status})`));
     }
-    if (typeof response.data.content === "string" || !Array.isArray(response.data.rows)) {
-      return response.data;
+    if (response.data.embed_id !== embedId || response.data.version_number !== version) {
+      throw new Error("Version response does not match the selected version");
+    }
+    if (typeof response.data.content === "string") return response.data;
+    if (!Array.isArray(response.data.rows) || response.data.rows.at(-1)?.version_number !== version) {
+      throw new Error("Version response does not match the selected version");
     }
     const content = await this.reconstructEncryptedEmbedVersion(embedId, response.data.rows, context);
     if (response.data.rows.length > 32 && response.data.readonly === false) {
@@ -19770,22 +19828,7 @@ Required: ${schema.required.join(", ")}`
     if (!embedKey) {
       throw new Error("Could not resolve embed encryption key for version history.");
     }
-    const sortedRows = [...rows2].sort((a, b) => a.version_number - b.version_number);
-    let content = null;
-    for (const row of sortedRows) {
-      if (row.encrypted_snapshot) {
-        content = await decryptWithAesGcmCombined(row.encrypted_snapshot, embedKey);
-        continue;
-      }
-      if (row.encrypted_patch && content !== null) {
-        const patch = await decryptWithAesGcmCombined(row.encrypted_patch, embedKey);
-        content = applyUnifiedDiffForEmbedVersion(content, patch ?? "");
-      }
-    }
-    if (content === null) {
-      throw new Error("Version history is missing the initial snapshot");
-    }
-    return content;
+    return reconstructVersionRows(rows2, (ciphertext) => decryptWithAesGcmCombined(ciphertext, embedKey));
   }
   async resolveVersionEmbedKey(embedId, context) {
     if (context?.projectId) {
@@ -20700,6 +20743,7 @@ Required: ${schema.required.join(", ")}`
     return {
       "User-Agent": this.getCliUserAgent(),
       "X-OpenMates-SDK": "cli",
+      "X-OpenMates-Client-Capabilities": "agentic-storage-v2",
       "X-OpenMates-Device-Identity": this.getCliApiKeyDeviceIdentity(),
       Origin: deriveAppUrl(this.apiUrl)
     };
@@ -27804,6 +27848,7 @@ var OpenMates = class {
       Authorization: `Bearer ${splitApiKeyCredential(this.apiKey ?? "").bearer}`,
       Origin: sdkOrigin(this.apiUrl),
       "X-OpenMates-SDK": this.sdkName,
+      "X-OpenMates-Client-Capabilities": "agentic-storage-v2",
       "X-OpenMates-Device-Identity": this.deviceId
     };
     if (hasBody) {
@@ -27815,6 +27860,7 @@ var OpenMates = class {
     return {
       Accept: "application/json",
       "X-OpenMates-SDK": this.sdkName,
+      "X-OpenMates-Client-Capabilities": "agentic-storage-v2",
       "X-OpenMates-Device-Identity": this.deviceId
     };
   }
@@ -34880,7 +34926,7 @@ function planRuntimeMonitoringServices(input) {
       "",
       "[Timer]",
       "OnBootSec=2min",
-      "OnUnitActiveSec=5min",
+      "OnUnitActiveSec=1min",
       "Persistent=true",
       `Unit=${serviceName}`,
       "",
@@ -34940,6 +34986,60 @@ function validateServerEnvironmentTarget(command, environment) {
   throw new Error("Unknown server environment target; use shared-dev for explicit server administration.");
 }
 
+// src/serverStorageMigration.ts
+function parseStorageMigrationOutcome(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return { status: "paused", reason: "migration_coordinator_response_invalid" };
+  }
+  const row = value;
+  if (!["pending", "paused", "reader_enabled", "prune_enabled", "not_applicable"].includes(String(row.status))) {
+    return { status: "paused", reason: "migration_coordinator_response_invalid" };
+  }
+  const result = { status: row.status };
+  if (typeof row.reason === "string" && /^[a-z_]{1,80}$/.test(row.reason)) result.reason = row.reason;
+  if (typeof row.source_commit === "string" && /^[a-f0-9]{40}$/.test(row.source_commit)) result.source_commit = row.source_commit;
+  if (Number.isInteger(row.retry_seconds) && Number(row.retry_seconds) > 0 && Number(row.retry_seconds) <= 86400) {
+    result.retry_seconds = Number(row.retry_seconds);
+  }
+  return result;
+}
+function parseStorageMigrationProgress(value) {
+  const row = value && typeof value === "object" && !Array.isArray(value) ? value : {};
+  const result = { automatic: parseStorageMigrationOutcome(row.automatic) };
+  if (row.legacy_full_graph !== void 0) result.legacy_full_graph = parseStorageMigrationOutcome(row.legacy_full_graph);
+  const fields = {
+    message_segments: ["copying", "verified", "reader_active"],
+    message_pages: ["read_enabled", "pruned"],
+    version_rows: ["copied", "reader_active", "pruned", "stale"]
+  };
+  for (const [name, names] of Object.entries(fields)) {
+    const counts = row[name];
+    if (!counts || typeof counts !== "object" || Array.isArray(counts)) continue;
+    const selected = {};
+    for (const key of names) {
+      const count = counts[key];
+      if (typeof count === "number" && Number.isSafeInteger(count) && count >= 0) selected[key] = count;
+    }
+    result[name] = selected;
+  }
+  return result;
+}
+function storageMigrationCommand(composePrefix, operation, sourceRevision) {
+  if (sourceRevision !== void 0 && !/^[a-f0-9]{40}$/i.test(sourceRevision)) {
+    throw new Error("source_revision_unavailable");
+  }
+  return [
+    ...composePrefix,
+    "exec",
+    "-T",
+    ...sourceRevision ? ["-e", `BUILD_COMMIT_SHA=${sourceRevision.toLowerCase()}`] : [],
+    "api",
+    "python",
+    "/app/scripts/storage_rollout.py",
+    operation
+  ];
+}
+
 // src/serverBackupArchive.ts
 import { execFileSync as execFileSync2 } from "child_process";
 import { chmodSync as chmodSync4, lstatSync as lstatSync2, readdirSync as readdirSync4, renameSync as renameSync3, rmSync as rmSync4 } from "fs";
@@ -37378,6 +37478,100 @@ function sourceUpdateMetadata(installPath) {
     }
   };
 }
+function runAutomaticStorageMigration(installPath, role, installMode, withOverrides) {
+  if (role !== "core") return { status: "not_applicable" };
+  if (!shouldAutoInstallRuntimeMonitoringServices(process.env)) {
+    return { status: "paused", reason: "inventory_refresh_service_disabled", retry_seconds: 60 };
+  }
+  if (!refreshStorageRuntimeInventory(installPath, role, installMode, withOverrides)) {
+    return { status: "paused", reason: "runtime_inventory_refresh_unavailable", retry_seconds: 60 };
+  }
+  let sourceRevision;
+  if (installMode === "source") {
+    if (exec("git status --porcelain", installPath).trim()) {
+      return { status: "pending", reason: "source_worktree_unverified" };
+    }
+    const revision = exec("git rev-parse HEAD", installPath).trim();
+    if (!/^[a-f0-9]{40}$/i.test(revision)) {
+      return { status: "pending", reason: "source_revision_unavailable" };
+    }
+    sourceRevision = revision;
+  }
+  const args = storageMigrationCommand(composeArgs(installPath, withOverrides, installMode, role), "auto", sourceRevision);
+  const result = spawnSync("docker", args, {
+    cwd: installPath,
+    encoding: "utf8",
+    timeout: 45e3,
+    stdio: ["ignore", "pipe", "pipe"],
+    maxBuffer: 64 * 1024
+  });
+  if (result.error || result.status !== 0) {
+    return { status: "paused", reason: "migration_coordinator_unavailable" };
+  }
+  try {
+    return parseStorageMigrationOutcome(JSON.parse(result.stdout.trim()));
+  } catch {
+  }
+  return { status: "paused", reason: "migration_coordinator_response_invalid" };
+}
+function refreshStorageRuntimeInventory(installPath, role, installMode, withOverrides) {
+  if (role !== "core") return true;
+  if (installMode === "source" && exec("git status --porcelain", installPath).trim()) return false;
+  try {
+    const containers = execFileSync4(
+      "docker",
+      [...composeArgs(installPath, withOverrides, installMode, role), "ps", "--all", "-q", "api"],
+      { cwd: installPath, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 15e3 }
+    ).trim().split(/\s+/).filter(Boolean);
+    if (containers.length < 1 || containers.length > 128 || new Set(containers).size !== containers.length || containers.some((id) => !/^[a-f0-9]{12,64}$/.test(id))) return false;
+    const cohort = [];
+    for (const container of containers) {
+      const output = execFileSync4(
+        "docker",
+        ["exec", container, "python", "/app/scripts/storage_runtime_inventory.py", "inspect"],
+        { cwd: installPath, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 15e3, maxBuffer: 64 * 1024 }
+      );
+      cohort.push(JSON.parse(output.trim()));
+    }
+    const result = spawnSync(
+      "docker",
+      ["exec", "-i", containers[0], "python", "/app/scripts/storage_runtime_inventory.py", "publish"],
+      {
+        cwd: installPath,
+        encoding: "utf8",
+        input: JSON.stringify(cohort),
+        timeout: 45e3,
+        stdio: ["pipe", "pipe", "pipe"],
+        maxBuffer: 64 * 1024
+      }
+    );
+    if (result.error || result.status !== 0) return false;
+    const published = JSON.parse(result.stdout.trim());
+    return published.status === "published";
+  } catch {
+    return false;
+  }
+}
+function readStorageMigrationProgress(installPath, role, installMode, withOverrides) {
+  if (role !== "core") return { automatic: { status: "not_applicable" } };
+  const result = spawnSync("docker", storageMigrationCommand(
+    composeArgs(installPath, withOverrides, installMode, role),
+    "status"
+  ), {
+    cwd: installPath,
+    encoding: "utf8",
+    timeout: 45e3,
+    stdio: ["ignore", "pipe", "pipe"],
+    maxBuffer: 64 * 1024
+  });
+  if (!result.error && result.status === 0) {
+    try {
+      return parseStorageMigrationProgress(JSON.parse(result.stdout.trim()));
+    } catch {
+    }
+  }
+  return { automatic: { status: "paused", reason: "migration_coordinator_unavailable", retry_seconds: 60 } };
+}
 function copyIfExists(source, destination) {
   if (!existsSync11(source)) return;
   mkdirSync12(dirname9(destination), { recursive: true });
@@ -37887,8 +38081,40 @@ async function serverStatus(flags) {
     args.push("--format", "json");
   }
   if (selection.requested) args.push(...selection.services);
+  if (flags.json === true) {
+    const output = execFileSync4("docker", args, { cwd: installPath, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    const containers = [];
+    if (output) {
+      if (output.startsWith("[")) containers.push(...JSON.parse(output));
+      else for (const line of output.split("\n")) containers.push(JSON.parse(line));
+    }
+    printJson({
+      command: "status",
+      path: installPath,
+      role,
+      containers,
+      storageMigration: readStorageMigrationProgress(installPath, role, getInstallMode(installPath, config), withOverrides)
+    });
+    return;
+  }
   const code = await runInteractive("docker", args, installPath);
   if (code !== 0) process.exit(code);
+  const migration = readStorageMigrationProgress(installPath, role, getInstallMode(installPath, config), withOverrides);
+  const outcome = migration.automatic;
+  console.log(`Storage migration: ${outcome.status}${outcome.reason ? ` (${outcome.reason})` : ""}${outcome.retry_seconds ? `; retry in ${outcome.retry_seconds}s` : ""}`);
+  if (migration.legacy_full_graph) console.log(`Legacy full graph migration: ${migration.legacy_full_graph.status} (${migration.legacy_full_graph.reason ?? "policy_pending"})`);
+  if (migration.message_segments) console.log(`Message segments: ${JSON.stringify(migration.message_segments)}`);
+  if (migration.message_pages) console.log(`Message pages: ${JSON.stringify(migration.message_pages)}`);
+  if (migration.version_rows) console.log(`Version rows: ${JSON.stringify(migration.version_rows)}`);
+}
+function sourceBuildCommitSha(installPath) {
+  try {
+    if (exec("git status --porcelain", installPath).trim()) return "";
+    const revision = exec("git rev-parse HEAD", installPath).trim();
+    return /^[a-f0-9]{40}$/i.test(revision) ? revision.toLowerCase() : "";
+  } catch {
+    return "";
+  }
 }
 async function serverStart(flags) {
   requireDocker();
@@ -37921,6 +38147,18 @@ async function serverStart(flags) {
     code = await runInteractive("docker", pullArgs, installPath);
     if (code !== 0) process.exit(code);
   }
+  if (installMode === "source") {
+    const buildArgs = [
+      ...composeArgs(installPath, withOverrides, installMode, role),
+      "build",
+      "--build-arg",
+      `BUILD_COMMIT_SHA=${sourceBuildCommitSha(installPath)}`
+    ];
+    if (selection.requested) buildArgs.push(...selection.services);
+    console.error("Building source containers...");
+    code = await runInteractive("docker", buildArgs, installPath);
+    if (code !== 0) process.exit(code);
+  }
   code = await runInteractive("docker", args, installPath);
   if (code !== 0) process.exit(code);
   if (flags.json === true) {
@@ -38562,6 +38800,8 @@ async function installRuntimeMonitoringServices(installPath, role) {
   execSync("systemctl daemon-reload", { stdio: "pipe" });
   const timers = files.filter(([name]) => name.endsWith(".timer")).map(([name]) => name);
   execSync(`systemctl enable --now ${timers.map(shellQuote).join(" ")}`, { stdio: "pipe" });
+  execFileSync4("systemctl", ["restart", plan.timerName], { stdio: "pipe" });
+  execFileSync4("systemctl", ["--no-block", "try-restart", plan.serviceName], { stdio: "pipe" });
   for (const timer of timers) execFileSync4("systemctl", ["is-active", "--quiet", timer], { stdio: "pipe" });
 }
 async function autoInstallRuntimeMonitoringServices(installPath, role) {
@@ -38933,6 +39173,8 @@ async function serverUpdate(client2, rest, flags) {
         await runInteractive("docker", [...composeArgs(installPath, withOverrides, installMode, role), "ps"], installPath);
         throw error;
       }
+      const automaticStorageMigration2 = runAutomaticStorageMigration(installPath, role, installMode, withOverrides);
+      console.error(`Storage migration: ${automaticStorageMigration2.status}${automaticStorageMigration2.reason ? ` (${automaticStorageMigration2.reason})` : ""}`);
       if (config) {
         saveServerConfig({ ...config, imageTag: target.tag, imageChannel: target.channel });
       }
@@ -38970,6 +39212,7 @@ async function serverUpdate(client2, rest, flags) {
           checks: successfulRuntimeOutput2?.checks ?? [],
           runtimeCompletedAt: successfulRuntimeOutput2?.completed_at,
           quickTest: quickTest2,
+          automaticStorageMigration: automaticStorageMigration2,
           completionEmailDelivery: completion3.delivery
         });
         if (flags.json === true) {
@@ -38999,6 +39242,7 @@ async function serverUpdate(client2, rest, flags) {
         checks: successfulRuntimeOutput2?.checks ?? [],
         runtimeCompletedAt: successfulRuntimeOutput2?.completed_at,
         quickTest: quickTest2,
+        automaticStorageMigration: automaticStorageMigration2,
         completionEmailDelivery: completion2.delivery,
         completionEmailDeliveryId: completion2.deliveryId,
         completionEmailPendingAt: completion2.deliveryPendingAt,
@@ -39014,6 +39258,7 @@ async function serverUpdate(client2, rest, flags) {
           runtimeVerification: successfulRuntimeOutput2,
           caddy: caddy2,
           quickTest: quickTest2,
+          automaticStorageMigration: automaticStorageMigration2,
           completionEmailDelivery: completion2.delivery,
           completedAt: completion2.completedAt
         });
@@ -39078,8 +39323,16 @@ async function serverUpdate(client2, rest, flags) {
         );
       }
     }
+    let sourceBuildRevision = "";
+    try {
+      if (!exec("git status --porcelain", installPath).trim()) {
+        const revision = exec("git rev-parse HEAD", installPath).trim();
+        if (/^[a-f0-9]{40}$/i.test(revision)) sourceBuildRevision = revision.toLowerCase();
+      }
+    } catch {
+    }
     const buildArgs = appendSelectedServices(
-      [...composeArgs(installPath, withOverrides, installMode, role), "build"],
+      [...composeArgs(installPath, withOverrides, installMode, role), "build", "--build-arg", `BUILD_COMMIT_SHA=${sourceBuildRevision}`],
       coreSetupPlan.pullOrBuildServices,
       filterRequested
     );
@@ -39146,6 +39399,8 @@ async function serverUpdate(client2, rest, flags) {
       await runInteractive("docker", [...composeArgs(installPath, withOverrides, installMode, role), "ps"], installPath);
       throw error;
     }
+    const automaticStorageMigration = runAutomaticStorageMigration(installPath, role, installMode, withOverrides);
+    console.error(`Storage migration: ${automaticStorageMigration.status}${automaticStorageMigration.reason ? ` (${automaticStorageMigration.reason})` : ""}`);
     try {
       await autoInstallRuntimeMonitoringServices(installPath, role);
     } catch (error) {
@@ -39172,6 +39427,7 @@ async function serverUpdate(client2, rest, flags) {
         checks: successfulRuntimeOutput?.checks ?? [],
         runtimeCompletedAt: successfulRuntimeOutput?.completed_at,
         quickTest,
+        automaticStorageMigration,
         completionEmailDelivery: completion2.delivery
       });
       if (flags.json === true) {
@@ -39199,6 +39455,7 @@ async function serverUpdate(client2, rest, flags) {
       checks: successfulRuntimeOutput?.checks ?? [],
       runtimeCompletedAt: successfulRuntimeOutput?.completed_at,
       quickTest,
+      automaticStorageMigration,
       completionEmailDelivery: completion.delivery,
       completionEmailDeliveryId: completion.deliveryId,
       completionEmailPendingAt: completion.deliveryPendingAt,
@@ -39215,6 +39472,7 @@ async function serverUpdate(client2, rest, flags) {
         runtimeVerification: successfulRuntimeOutput,
         caddy,
         quickTest,
+        automaticStorageMigration,
         completionEmailDelivery: completion.delivery,
         completedAt: completion.completedAt
       });
@@ -39371,7 +39629,23 @@ async function serverMonitoring(rest, flags) {
   let output;
   try {
     requireDocker();
+    const inventoryRefreshed = refreshStorageRuntimeInventory(
+      installPath,
+      role,
+      getInstallMode(installPath, config),
+      config?.composeProfile === "full"
+    );
     output = runRuntimeVerification(installPath, role, config);
+    if (!inventoryRefreshed) {
+      output.checks.push({
+        id: "core.storage_migration_inventory",
+        status: "failed",
+        required: false,
+        duration_ms: 0,
+        failureClass: "configuration",
+        sanitized_reason: "runtime_inventory_refresh_unavailable"
+      });
+    }
   } catch (error) {
     console.error(`Runtime verifier unavailable: ${error instanceof Error ? error.name : "UnknownError"}`);
     output = {

package/dist/cli.js

@@ -21,7 +21,7 @@ import {
   shouldRequireTrustedAccountGuard,
   waitForSafeE2ETotpWindow,
   waitForWorkflowRun
-} from "./chunk-UIW7XY2C.js";
+} from "./chunk-NQP5QUVR.js";
 import "./chunk-FRNW5Q2V.js";
 import "./chunk-IWKP55ZB.js";
 import "./chunk-4IRYB3YN.js";

package/dist/index.js

@@ -43,7 +43,7 @@ import {
   selectAssistantMessagesForSpeech,
   serializeToYaml,
   summarizeAssistantSpeech
-} from "./chunk-UIW7XY2C.js";
+} from "./chunk-NQP5QUVR.js";
 import "./chunk-FRNW5Q2V.js";
 import "./chunk-IWKP55ZB.js";
 import "./chunk-4IRYB3YN.js";

package/fixtures/privacy-runtime/linux-arm64/manifest.json

@@ -17,47 +17,47 @@
     {
       "name": "libggml-base.so",
       "bytes": 1110088,
-      "sha256": "c89a99e75ebcffa92defcd49867b0385f5b079691855f84aff3ed3e1f77c1742"
+      "sha256": "92d2614c50936307afdc6524b801d1c2d0f25af5969c04aea4e37b3f47797c42"
     },
     {
       "name": "libggml-base.so.0",
       "bytes": 1110088,
-      "sha256": "c89a99e75ebcffa92defcd49867b0385f5b079691855f84aff3ed3e1f77c1742"
+      "sha256": "92d2614c50936307afdc6524b801d1c2d0f25af5969c04aea4e37b3f47797c42"
     },
     {
       "name": "libggml-base.so.0.15.1",
       "bytes": 1110088,
-      "sha256": "c89a99e75ebcffa92defcd49867b0385f5b079691855f84aff3ed3e1f77c1742"
+      "sha256": "92d2614c50936307afdc6524b801d1c2d0f25af5969c04aea4e37b3f47797c42"
     },
     {
       "name": "libggml-cpu.so",
       "bytes": 869800,
-      "sha256": "4e8577ad56d1903858037136763bf980298a39d98207fd9958a47796ec76835a"
+      "sha256": "efdc4d1aa71b49b084eb26c2e751e356ca43a44d3f5dc553e91dd6610cc291d5"
     },
     {
       "name": "libggml-cpu.so.0",
       "bytes": 869800,
-      "sha256": "4e8577ad56d1903858037136763bf980298a39d98207fd9958a47796ec76835a"
+      "sha256": "efdc4d1aa71b49b084eb26c2e751e356ca43a44d3f5dc553e91dd6610cc291d5"
     },
     {
       "name": "libggml-cpu.so.0.15.1",
       "bytes": 869800,
-      "sha256": "4e8577ad56d1903858037136763bf980298a39d98207fd9958a47796ec76835a"
+      "sha256": "efdc4d1aa71b49b084eb26c2e751e356ca43a44d3f5dc553e91dd6610cc291d5"
     },
     {
       "name": "libggml.so",
       "bytes": 1899104,
-      "sha256": "115c6454413cf8eba3a1884d1b087f100c8a310bce4e7da82d562bcf993bb9a3"
+      "sha256": "684599527a3492b456a658e0676f54df02cd27290d2d2b87ee3bb36286414c64"
     },
     {
       "name": "libggml.so.0",
       "bytes": 1899104,
-      "sha256": "115c6454413cf8eba3a1884d1b087f100c8a310bce4e7da82d562bcf993bb9a3"
+      "sha256": "684599527a3492b456a658e0676f54df02cd27290d2d2b87ee3bb36286414c64"
     },
     {
       "name": "libggml.so.0.15.1",
       "bytes": 1899104,
-      "sha256": "115c6454413cf8eba3a1884d1b087f100c8a310bce4e7da82d562bcf993bb9a3"
+      "sha256": "684599527a3492b456a658e0676f54df02cd27290d2d2b87ee3bb36286414c64"
     },
     {
       "name": "openmates-pii-worker",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmates",
-  "version": "0.27.0-alpha.21",
+  "version": "0.27.0-alpha.23",
   "description": "OpenMates CLI and SDK",
   "type": "module",
   "main": "dist/index.js",