paratix 0.12.8 → 0.13.0

package/README.md

@@ -127,17 +127,21 @@ Options:
   --dry-run
   --env <key=value>
   --env-file <path>
+  --filter <names>
   --first-run
   --reconnect-timeout <seconds>
   --verbose
-  --version
   --help
 ```
 
+`--filter <names>` restricts the run to the named recipes and modules. Names are matched anywhere in the tree, and every node that is not selected is shown as `skipped` instead of being executed. The option is comma-separated and repeatable, so `--filter rybbit,palamedes-examples` and `--filter rybbit --filter palamedes-examples` are equivalent. Selecting a recipe runs its whole subtree; a recipe that is not selected but contains a selected descendant is still descended into, so only the matching children run while its siblings are skipped. If several nodes share the same name, every one of them is selected. An unknown filter name aborts the run before it connects (exit code 2). The final run summary counts only top-level nodes, so nested skipped nodes are still shown but are not added to the `skipped` tally. `--filter` composes with `--dry-run` and the other flags.
+
 `--first-run` is meant for explicit bootstrap flows where a fresh server must be hardened first and the rest of the system should only be applied later.
 
 `--diff` only works together with `--dry-run`. When enabled, modules that opt in print a unified diff below their status line, showing exactly which lines or values would change. Without `--diff`, the dry-run output is unchanged. Diff-producing modules: `file.copy`, `file.template`, `sysctl.set`, `hostname.set`, `swap.file`, `swap.swappiness`, `swap.vfsCachePressure`, `cron.job`, `cron.absent`, `timer.scheduled`, `timer.absent`, `net.hosts`, `quadlet.container`.
 
+`--reconnect-timeout <seconds>` sets how long Paratix keeps retrying the SSH connection after a module forces the connection to drop — after a `system.reboot` or after an SSH port change. When a module reboots the host, Paratix waits a short grace period and then reconnects within a **300 second window by default**, so hosts that need a few minutes to come back (fsck, cloud-init, slow POST) still succeed. The number of attempts follows the time window rather than a fixed cap, so the window is never cut short. Port-change reconnects use a shorter 120 second default because the port comes back almost immediately. Set `--reconnect-timeout` (up to 86400 seconds) to override both paths for exceptionally slow reboots.
+
 ## Documentation
 
 - For project scaffolding, see [`create-paratix`](https://www.npmjs.com/package/create-paratix).

package/dist/{chunk-M3ZQJNKM.js → chunk-XIRORNO3.js}

@@ -1568,13 +1568,6 @@ function buildRepositoryUpdateFlag(name, expectedContent) {
     flagPrefix
   };
 }
-function firstNonEmptyApt(text) {
-  for (const line of text.split("\n")) {
-    const trimmed = line.trim();
-    if (trimmed.length > 0) return trimmed;
-  }
-  return null;
-}
 async function probeAptRepositoryInodeIdentity(ssh2, filePath) {
   const result = await ssh2.exec(`stat -c '%d:%i' ${shellQuote(filePath)}`, {
     ignoreExitCode: true,
@@ -1615,7 +1608,7 @@ async function rollbackRepositoryAfterUpdateFailure(parameters) {
   const failureMessage = `[apt.repository] apt-get update failed for ${name}`;
   if (rollbackUpdate.code !== 0) {
     return failedCommand(
-      `${failureMessage}; rollback succeeded but apt-get update on the restored sources also failed (exit code ${String(rollbackUpdate.code)}): ${firstNonEmptyApt(rollbackUpdate.stderr) ?? firstNonEmptyApt(rollbackUpdate.stdout) ?? "no output"}`,
+      `${failureMessage}; rollback succeeded but apt-get update on the restored sources also failed (exit code ${String(rollbackUpdate.code)}): ${firstNonEmptyLine(rollbackUpdate.stderr) ?? firstNonEmptyLine(rollbackUpdate.stdout) ?? "no output"}`,
       updateResult
     );
   }
@@ -3323,10 +3316,12 @@ var EXEC_OPTS4 = { ignoreExitCode: true, silent: true };
 var UNIT_NAME_PATTERN = new RegExp("^[\\w@.\\-]+$", "v");
 var COMPOSE_CONFIG_MODE = "0600";
 var COMPOSE_CONFIG_STAGING_PREFIX = ".compose.yml.paratix-staging";
+var COMPOSE_IMAGE_INSPECT_FORMAT = "{{.Id}}\\n{{range .RepoDigests}}{{.}}\\n{{end}}";
 var SYSTEMD_UNIT_MODE = "0644";
 var SYSTEMD_UNIT_STAGING_PREFIX = ".compose-systemd-unit.paratix-staging";
 var C0_CONTROL_MAX_CODE_POINT = 31;
 var DELETE_CONTROL_CODE_POINT2 = 127;
+var COMPOSE_CONFIG_JSON_MAX_BYTES = 1048576;
 function requireComposeSsh(ssh2, action, projectDirectory) {
   return ssh2 ?? failed(`[compose.${action}] SSH connection is required for ${projectDirectory}`);
 }
@@ -3351,10 +3346,6 @@ var COMPOSE_UP_ACTION_KEYWORDS_REGEX = new RegExp("^(?:Creating|Recreating|Start
 function composeUpReportedChange(composeOutput) {
   return COMPOSE_UP_ACTION_KEYWORDS_REGEX.test(composeOutput);
 }
-var COMPOSE_PULL_ACTION_REGEX = new RegExp("^(?:Pulling|Downloaded)\\s", "mv");
-function composePullReportedChange(composeOutput) {
-  return COMPOSE_PULL_ACTION_REGEX.test(composeOutput);
-}
 function validateComposeUpServices(services) {
   for (const service2 of services ?? []) {
     if (service2 === "") {
@@ -3392,6 +3383,148 @@ function parseComposeProjectName(stdout, projectDirectory) {
     return null;
   }
 }
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readComposeServiceImage(service2) {
+  if (!isRecord(service2)) return null;
+  const { image } = service2;
+  return typeof image === "string" && image.trim() !== "" ? image : null;
+}
+function collectComposeConfigImages(services) {
+  const images = /* @__PURE__ */ new Set();
+  for (const service2 of Object.values(services)) {
+    const image = readComposeServiceImage(service2);
+    if (image !== null) images.add(image);
+  }
+  return [...images].sort();
+}
+function parseComposeConfigImages(stdout) {
+  if (Buffer.byteLength(stdout, "utf8") > COMPOSE_CONFIG_JSON_MAX_BYTES) return null;
+  try {
+    const parsed = JSON.parse(stdout);
+    if (!isRecord(parsed)) return null;
+    const { services } = parsed;
+    if (!isRecord(services)) return null;
+    return collectComposeConfigImages(services);
+  } catch {
+    return null;
+  }
+}
+function buildComposeImageInspectCommand(runtime, image) {
+  return `${runtime} image inspect --format '${COMPOSE_IMAGE_INSPECT_FORMAT}' -- ${shellQuote(image)}`;
+}
+function getComposeImageRepository(image) {
+  const digestSeparatorIndex = image.indexOf("@");
+  if (digestSeparatorIndex !== -1) return image.slice(0, digestSeparatorIndex);
+  const lastSlashIndex = image.lastIndexOf("/");
+  const lastColonIndex = image.lastIndexOf(":");
+  return lastColonIndex > lastSlashIndex ? image.slice(0, lastColonIndex) : image;
+}
+function readComposeImageIdentifierFromInspectOutput(image, output) {
+  const lines = output.split("\n").filter((line) => line.length > 0);
+  if (lines.length === 0) return null;
+  const [id, ...repoDigests] = lines;
+  const repository = getComposeImageRepository(image);
+  for (const repoDigest of repoDigests) {
+    const separatorIndex = repoDigest.indexOf("@");
+    if (separatorIndex === -1) continue;
+    const repo = repoDigest.slice(0, separatorIndex);
+    const digest = repoDigest.slice(separatorIndex + 1);
+    if (repo === repository && digest.length > 0) return digest;
+  }
+  return id.length > 0 ? id : null;
+}
+async function resolveComposeConfigImages(parameters) {
+  const result = await parameters.ssh.exec(
+    `${composeCommand(parameters.runtime, parameters.projectDirectory)} config --format json`,
+    EXEC_OPTS4
+  );
+  if (result.code !== 0) {
+    return failedCommand(
+      `[compose.pull] failed to resolve images for ${parameters.projectDirectory}`,
+      result
+    );
+  }
+  const images = parseComposeConfigImages(result.stdout);
+  if (images === null) {
+    return failed(
+      `[compose.pull] failed to parse compose config images for ${parameters.projectDirectory}`
+    );
+  }
+  return images;
+}
+async function inspectComposeImageBeforePull(parameters) {
+  const result = await parameters.ssh.exec(
+    buildComposeImageInspectCommand(parameters.runtime, parameters.image),
+    EXEC_OPTS4
+  );
+  if (result.code !== 0) return null;
+  return readComposeImageIdentifierFromInspectOutput(parameters.image, result.stdout);
+}
+async function inspectComposeImageAfterPull(parameters) {
+  const result = await parameters.ssh.exec(
+    buildComposeImageInspectCommand(parameters.runtime, parameters.image),
+    EXEC_OPTS4
+  );
+  if (result.code !== 0) {
+    return failedCommand(
+      `[compose.pull] image inspect failed for ${parameters.image} in ${parameters.projectDirectory}`,
+      result
+    );
+  }
+  const imageIdentifier = readComposeImageIdentifierFromInspectOutput(
+    parameters.image,
+    result.stdout
+  );
+  if (imageIdentifier === null) {
+    return failed(
+      `[compose.pull] image inspect returned no digest or image ID for ${parameters.image} in ${parameters.projectDirectory}`
+    );
+  }
+  return imageIdentifier;
+}
+async function snapshotComposeImagesBeforePull(parameters) {
+  return new Map(
+    await Promise.all(
+      parameters.images.map(
+        async (image) => [
+          image,
+          await inspectComposeImageBeforePull({
+            image,
+            runtime: parameters.runtime,
+            ssh: parameters.ssh
+          })
+        ]
+      )
+    )
+  );
+}
+async function snapshotComposeImagesAfterPull(parameters) {
+  const entries = await Promise.all(
+    parameters.images.map(async (image) => ({
+      image,
+      imageIdentifier: await inspectComposeImageAfterPull({
+        image,
+        projectDirectory: parameters.projectDirectory,
+        runtime: parameters.runtime,
+        ssh: parameters.ssh
+      })
+    }))
+  );
+  const snapshot = /* @__PURE__ */ new Map();
+  for (const { image, imageIdentifier } of entries) {
+    if (typeof imageIdentifier !== "string") return imageIdentifier;
+    snapshot.set(image, imageIdentifier);
+  }
+  return snapshot;
+}
+function composeImageSnapshotChanged(parameters) {
+  for (const [image, afterIdentifier] of parameters.after) {
+    if (parameters.before.get(image) !== afterIdentifier) return true;
+  }
+  return false;
+}
 async function resolveComposeProjectName(parameters) {
   const result = await parameters.ssh.exec(
     `${composeCommand(parameters.runtime, parameters.projectDirectory)} config --format json`,
@@ -4050,13 +4183,33 @@ var compose = {
           ssh: connection
         });
         if (typeof runtime !== "string") return runtime;
+        const images = await resolveComposeConfigImages({
+          projectDirectory,
+          runtime,
+          ssh: connection
+        });
+        if (!Array.isArray(images)) return images;
+        const beforePull = await snapshotComposeImagesBeforePull({
+          images,
+          runtime,
+          ssh: connection
+        });
         const result = await connection.exec(
           `${composeCommand(runtime, projectDirectory)} pull 2>&1`,
           EXEC_OPTS4
         );
         if (result.code !== 0)
           return failedCommand(`[compose.pull] failed for ${projectDirectory}`, result);
-        return { status: composePullReportedChange(result.stdout) ? "changed" : "ok" };
+        const afterPull = await snapshotComposeImagesAfterPull({
+          images,
+          projectDirectory,
+          runtime,
+          ssh: connection
+        });
+        if (!(afterPull instanceof Map)) return afterPull;
+        return {
+          status: composeImageSnapshotChanged({ after: afterPull, before: beforePull }) ? "changed" : "ok"
+        };
       },
       // eslint-disable-next-line @typescript-eslint/require-await -- Interface requires async
       async check() {
@@ -6185,7 +6338,7 @@ function describeType(value) {
 function isHostKeyMode(value) {
   return value === "accept-new" || value === "no" || value === "yes";
 }
-function isRecord(value) {
+function isRecord2(value) {
   return Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null;
 }
 function collectOptionalBooleanErrors(object, key, errors) {
@@ -6304,7 +6457,7 @@ function collectSshConfigErrors(value) {
     errors.push(`Invalid property 'ssh' (expected object, got ${describeType(value)})`);
     return errors;
   }
-  if (!isRecord(value)) {
+  if (!isRecord2(value)) {
     errors.push("Invalid property 'ssh' (expected object, got object)");
     return errors;
   }
@@ -6329,7 +6482,8 @@ function normalizeServerDefinitionSshError(error) {
 function validateSshConfig(ssh2) {
   const errors = collectSshConfigErrors(ssh2);
   if (errors.length === 0) return;
-  throw new Error(`ServerDefinition: ${normalizeServerDefinitionSshError(errors[0])}`);
+  const message = errors.map((error) => normalizeServerDefinitionSshError(error)).join("; ");
+  throw new Error(`ServerDefinition: ${message}`);
 }
 
 // src/meta.ts
@@ -6372,7 +6526,7 @@ function normalizeMetaValueResolver(value) {
     return value;
   };
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null;
 }
 function assertValidEnvironmentMetaEntry(candidate) {
@@ -6460,7 +6614,7 @@ function isSystemRebootMetaEntry(entry) {
   return entry.kind === SYSTEM_REBOOT_KIND;
 }
 function assertValidModuleMetaEntry(entry) {
-  if (!isRecord2(entry)) {
+  if (!isRecord3(entry)) {
     throw new TypeError(`Invalid meta entry: expected object, got ${typeof entry}`);
   }
   switch (entry.kind) {
@@ -13000,7 +13154,20 @@ async function ensureSshDirectoryAndAuthorizedKeysAreNotSymlinks(conn, parameter
   const keysPath = shellQuote(authorizedKeysPath);
   const quotedUser = shellQuote(user2);
   const quotedPrimaryGroup = shellQuote(primaryGroup);
-  const command2 = `set -e; [ ! -L ${directory} ] || { echo '.ssh must not be a symlink' >&2; exit 1; }; if [ -e ${directory} ]; then [ -d ${directory} ] || { echo '.ssh must be a directory' >&2; exit 1; }; else mkdir -p ${directory}; fi; [ -d ${directory} ] && [ ! -L ${directory} ] || { echo '.ssh must be a real directory' >&2; exit 1; }; ssh_directory_identity=$(stat -c '%d:%i' ${directory}) || exit $?; chmod 700 ${directory} && chown ${quotedUser}:${quotedPrimaryGroup} ${directory}; [ ! -L ${directory} ] && [ -d ${directory} ] || { echo '.ssh must be a real directory' >&2; exit 1; }; post_ssh_directory_identity=$(stat -c '%d:%i' ${directory}) || exit $?; [ "$post_ssh_directory_identity" = "$ssh_directory_identity" ] || { echo '.ssh directory changed during metadata update' >&2; exit 1; }; [ ! -L ${keysPath} ] || { echo 'authorized_keys must not be a symlink' >&2; exit 1; }`;
+  const command2 = `set -e
+[ ! -L ${directory} ] || { echo '.ssh must not be a symlink' >&2; exit 1; }
+if [ -e ${directory} ]; then
+  [ -d ${directory} ] || { echo '.ssh must be a directory' >&2; exit 1; }
+else
+  mkdir -p ${directory}
+fi
+[ -d ${directory} ] && [ ! -L ${directory} ] || { echo '.ssh must be a real directory' >&2; exit 1; }
+ssh_directory_identity=$(stat -c '%d:%i' ${directory}) || exit $?
+chmod 700 ${directory} && chown ${quotedUser}:${quotedPrimaryGroup} ${directory}
+[ ! -L ${directory} ] && [ -d ${directory} ] || { echo '.ssh must be a real directory' >&2; exit 1; }
+post_ssh_directory_identity=$(stat -c '%d:%i' ${directory}) || exit $?
+[ "$post_ssh_directory_identity" = "$ssh_directory_identity" ] || { echo '.ssh directory changed during metadata update' >&2; exit 1; }
+[ ! -L ${keysPath} ] || { echo 'authorized_keys must not be a symlink' >&2; exit 1; }`;
   const result = await conn.exec(command2, MUTATION_EXEC_OPTS);
   if (result.code !== 0) {
     const label = result.stderr.includes("authorized_keys must not be a symlink") ? "authorized_keys symlink check failed" : "failed to prepare .ssh directory";
@@ -13030,10 +13197,25 @@ async function stageAuthorizedKeysContent(conn, parameters) {
   const filterScratchPath = `${temporaryPath}.filter`;
   const quotedFilterScratchPath = shellQuote(filterScratchPath);
   const quotedKey = shellQuote(key);
-  const existingAuthorizedKeysGuard = `[ ! -L ${quotedAuthorizedKeysPath} ] || { echo 'authorized_keys must not be a symlink' >&2; exit 1; }; [ -f ${quotedAuthorizedKeysPath} ] || { echo 'authorized_keys must be a regular file' >&2; exit 1; }`;
+  const existingAuthorizedKeysGuard = `[ ! -L ${quotedAuthorizedKeysPath} ] || { echo 'authorized_keys must not be a symlink' >&2; exit 1; }
+  [ -f ${quotedAuthorizedKeysPath} ] || { echo 'authorized_keys must be a regular file' >&2; exit 1; }`;
   const readExistingAuthorizedKeys = `dd if=${quotedAuthorizedKeysPath} iflag=nofollow status=none of=${quotedTemporaryPath}`;
   const stage = state === "present" ? await conn.exec(
-    `{ if [ -e ${quotedAuthorizedKeysPath} ]; then ${existingAuthorizedKeysGuard}; ${readExistingAuthorizedKeys} || exit $?; grep -qxF -- ${quotedKey} ${quotedTemporaryPath}; grep_status=$?; if [ "$grep_status" -eq 0 ]; then :; elif [ "$grep_status" -eq 1 ]; then printf '%s\\n' ${quotedKey} >> ${quotedTemporaryPath}; else exit "$grep_status"; fi; else printf '%s\\n' ${quotedKey} > ${quotedTemporaryPath}; fi; }`,
+    `{ if [ -e ${quotedAuthorizedKeysPath} ]; then
+  ${existingAuthorizedKeysGuard}
+  ${readExistingAuthorizedKeys} || exit $?
+  grep -qxF -- ${quotedKey} ${quotedTemporaryPath}
+  grep_status=$?
+  if [ "$grep_status" -eq 0 ]; then
+    :
+  elif [ "$grep_status" -eq 1 ]; then
+    printf '%s\\n' ${quotedKey} >> ${quotedTemporaryPath}
+  else
+    exit "$grep_status"
+  fi
+else
+  printf '%s\\n' ${quotedKey} > ${quotedTemporaryPath}
+fi; }`,
     MUTATION_EXEC_OPTS
   ) : (
     // R-0000044: use `grep -vxF` (whole-line match) to mirror the present
@@ -13045,7 +13227,20 @@ async function stageAuthorizedKeysContent(conn, parameters) {
     // TOCTOU where the path could become a symlink between the
     // `[ ! -L ]` guard and grep's open() call.
     await conn.exec(
-      `{ if [ -e ${quotedAuthorizedKeysPath} ]; then ${existingAuthorizedKeysGuard}; ${readExistingAuthorizedKeys} || exit $?; grep -vxF -- ${quotedKey} ${quotedTemporaryPath} > ${quotedFilterScratchPath}; grep_status=$?; if [ "$grep_status" -eq 0 ] || [ "$grep_status" -eq 1 ]; then mv -T -- ${quotedFilterScratchPath} ${quotedTemporaryPath} || exit $?; else rm -f -- ${quotedFilterScratchPath}; exit "$grep_status"; fi; else : > ${quotedTemporaryPath}; fi; }`,
+      `{ if [ -e ${quotedAuthorizedKeysPath} ]; then
+  ${existingAuthorizedKeysGuard}
+  ${readExistingAuthorizedKeys} || exit $?
+  grep -vxF -- ${quotedKey} ${quotedTemporaryPath} > ${quotedFilterScratchPath}
+  grep_status=$?
+  if [ "$grep_status" -eq 0 ] || [ "$grep_status" -eq 1 ]; then
+    mv -T -- ${quotedFilterScratchPath} ${quotedTemporaryPath} || exit $?
+  else
+    rm -f -- ${quotedFilterScratchPath}
+    exit "$grep_status"
+  fi
+else
+  : > ${quotedTemporaryPath}
+fi; }`,
       MUTATION_EXEC_OPTS
     )
   );
@@ -13066,7 +13261,38 @@ async function replaceAuthorizedKeysAtomically(conn, parameters) {
   const expectedAuthorizedKeysState = shellQuote(`600 ${user2} ${primaryGroup} regular file`);
   const quotedBackupPath = shellQuote(`${authorizedKeysPath}.paratix-backup`);
   const replace2 = await conn.exec(
-    `chmod 600 ${quotedTemporaryPath} && chown ${shellQuote(user2)}:${shellQuote(primaryGroup)} ${quotedTemporaryPath} && { expected_authorized_keys_hash=$(sha256sum ${quotedTemporaryPath} | cut -d' ' -f1) || exit $?; [ ! -L ${quotedSshDirectoryPath} ] || { echo '.ssh must not be a symlink' >&2; exit 1; }; [ -d ${quotedSshDirectoryPath} ] || { echo '.ssh must be a directory' >&2; exit 1; }; ssh_directory_state=$(stat -c '%a %U %G %F' ${quotedSshDirectoryPath}) || exit $?; [ "$ssh_directory_state" = ${expectedSshDirectoryState} ] || { echo '.ssh ownership changed before authorized_keys replace' >&2; exit 1; }; [ ! -L ${quotedAuthorizedKeysPath} ] || { echo 'authorized_keys must not be a symlink' >&2; exit 1; }; rm -f -- ${quotedBackupPath}; backup_created=0; if [ -e ${quotedAuthorizedKeysPath} ]; then [ -f ${quotedAuthorizedKeysPath} ] || { echo 'authorized_keys must be a regular file' >&2; exit 1; }; [ ! -L ${quotedAuthorizedKeysPath} ] || { echo 'authorized_keys must not be a symlink' >&2; exit 1; }; ln -P -- ${quotedAuthorizedKeysPath} ${quotedBackupPath} || { echo 'failed to create authorized_keys backup hardlink' >&2; exit 1; }; backup_created=1; fi; [ ! -L ${quotedAuthorizedKeysPath} ] || { rm -f -- ${quotedBackupPath}; echo 'authorized_keys must not be a symlink' >&2; exit 1; }; if ! mv -T -- ${quotedTemporaryPath} ${quotedAuthorizedKeysPath}; then if [ "$backup_created" = 1 ]; then mv -T -- ${quotedBackupPath} ${quotedAuthorizedKeysPath} || echo 'authorized_keys backup restore failed; backup is at '${quotedBackupPath} >&2; fi; echo 'authorized_keys replace failed' >&2; exit 1; fi; [ ! -e ${quotedTemporaryPath} ] || { rm -f -- ${quotedBackupPath}; echo 'authorized_keys replace did not consume temporary file' >&2; exit 1; }; [ ! -L ${quotedAuthorizedKeysPath} ] || { rm -f -- ${quotedBackupPath}; echo 'authorized_keys must not be a symlink' >&2; exit 1; }; [ -f ${quotedAuthorizedKeysPath} ] || { rm -f -- ${quotedBackupPath}; echo 'authorized_keys must be a regular file' >&2; exit 1; }; authorized_keys_state=$(stat -c '%a %U %G %F' ${quotedAuthorizedKeysPath}) || { rm -f -- ${quotedBackupPath}; exit 1; }; [ "$authorized_keys_state" = ${expectedAuthorizedKeysState} ] || { rm -f -- ${quotedBackupPath}; echo 'authorized_keys metadata changed during replace' >&2; exit 1; }; authorized_keys_hash=$(sha256sum ${quotedAuthorizedKeysPath} | cut -d' ' -f1) || { rm -f -- ${quotedBackupPath}; exit 1; }; [ "$authorized_keys_hash" = "$expected_authorized_keys_hash" ] || { rm -f -- ${quotedBackupPath}; echo 'authorized_keys content changed during replace' >&2; exit 1; }; rm -f -- ${quotedBackupPath}; }`,
+    `chmod 600 ${quotedTemporaryPath} && chown ${shellQuote(user2)}:${shellQuote(primaryGroup)} ${quotedTemporaryPath} && {
+  expected_authorized_keys_hash=$(sha256sum ${quotedTemporaryPath} | cut -d' ' -f1) || exit $?
+  [ ! -L ${quotedSshDirectoryPath} ] || { echo '.ssh must not be a symlink' >&2; exit 1; }
+  [ -d ${quotedSshDirectoryPath} ] || { echo '.ssh must be a directory' >&2; exit 1; }
+  ssh_directory_state=$(stat -c '%a %U %G %F' ${quotedSshDirectoryPath}) || exit $?
+  [ "$ssh_directory_state" = ${expectedSshDirectoryState} ] || { echo '.ssh ownership changed before authorized_keys replace' >&2; exit 1; }
+  [ ! -L ${quotedAuthorizedKeysPath} ] || { echo 'authorized_keys must not be a symlink' >&2; exit 1; }
+  rm -f -- ${quotedBackupPath}
+  backup_created=0
+  if [ -e ${quotedAuthorizedKeysPath} ]; then
+    [ -f ${quotedAuthorizedKeysPath} ] || { echo 'authorized_keys must be a regular file' >&2; exit 1; }
+    [ ! -L ${quotedAuthorizedKeysPath} ] || { echo 'authorized_keys must not be a symlink' >&2; exit 1; }
+    ln -P -- ${quotedAuthorizedKeysPath} ${quotedBackupPath} || { echo 'failed to create authorized_keys backup hardlink' >&2; exit 1; }
+    backup_created=1
+  fi
+  [ ! -L ${quotedAuthorizedKeysPath} ] || { rm -f -- ${quotedBackupPath}; echo 'authorized_keys must not be a symlink' >&2; exit 1; }
+  if ! mv -T -- ${quotedTemporaryPath} ${quotedAuthorizedKeysPath}; then
+    if [ "$backup_created" = 1 ]; then
+      mv -T -- ${quotedBackupPath} ${quotedAuthorizedKeysPath} || echo 'authorized_keys backup restore failed; backup is at '${quotedBackupPath} >&2
+    fi
+    echo 'authorized_keys replace failed' >&2
+    exit 1
+  fi
+  [ ! -e ${quotedTemporaryPath} ] || { rm -f -- ${quotedBackupPath}; echo 'authorized_keys replace did not consume temporary file' >&2; exit 1; }
+  [ ! -L ${quotedAuthorizedKeysPath} ] || { rm -f -- ${quotedBackupPath}; echo 'authorized_keys must not be a symlink' >&2; exit 1; }
+  [ -f ${quotedAuthorizedKeysPath} ] || { rm -f -- ${quotedBackupPath}; echo 'authorized_keys must be a regular file' >&2; exit 1; }
+  authorized_keys_state=$(stat -c '%a %U %G %F' ${quotedAuthorizedKeysPath}) || { rm -f -- ${quotedBackupPath}; exit 1; }
+  [ "$authorized_keys_state" = ${expectedAuthorizedKeysState} ] || { rm -f -- ${quotedBackupPath}; echo 'authorized_keys metadata changed during replace' >&2; exit 1; }
+  authorized_keys_hash=$(sha256sum ${quotedAuthorizedKeysPath} | cut -d' ' -f1) || { rm -f -- ${quotedBackupPath}; exit 1; }
+  [ "$authorized_keys_hash" = "$expected_authorized_keys_hash" ] || { rm -f -- ${quotedBackupPath}; echo 'authorized_keys content changed during replace' >&2; exit 1; }
+  rm -f -- ${quotedBackupPath}
+}`,
     MUTATION_EXEC_OPTS
   );
   if (replace2.code !== 0) {
@@ -19070,4 +19296,3 @@ export {
   ufw,
   user
 };
-//# sourceMappingURL=chunk-M3ZQJNKM.js.map