paratix 0.16.0 → 0.16.1

package/dist/{chunk-56SN6NQH.js → chunk-KC7XBI77.js}

@@ -2519,6 +2519,13 @@ async function validateExistingExtractDestination(conn, parameters) {
 // src/modules/fileMetadataHelpers.ts
 var EXEC_OPTS2 = { ignoreExitCode: true, silent: true };
 var DEFAULT_FILE_WRITE_MODE = "0644";
+var EMPTY_OWNERSHIP = {
+  group: "",
+  groupId: "",
+  mode: "",
+  owner: "",
+  ownerId: ""
+};
 function assertValidChownOwnershipSpec(ownerSpec) {
   if (ownerSpec === "") {
     throw new Error("chown ownership spec must not be empty");
@@ -2581,20 +2588,23 @@ function renderGuardedMetadataCommand(kind, remotePath, value) {
   ].join("\n");
 }
 async function readOwnership(ssh2, remotePath) {
-  const result = await ssh2.exec(`stat -c '%a %U %G' ${shellQuote(remotePath)}`, EXEC_OPTS2);
-  if (result.code !== 0) return { group: "", mode: "", owner: "" };
-  const [mode = "", owner = "", group2 = ""] = result.stdout.trim().split(new RegExp("\\s+", "v"));
-  return { group: group2, mode, owner };
+  const result = await ssh2.exec(`stat -c '%a %U %G %u %g' ${shellQuote(remotePath)}`, EXEC_OPTS2);
+  if (result.code !== 0) return { ...EMPTY_OWNERSHIP };
+  const [mode = "", owner = "", group2 = "", ownerId = "", groupId = ""] = result.stdout.trim().split(new RegExp("\\s+", "v"));
+  return { group: group2, groupId, mode, owner, ownerId };
 }
 function normalizeMode(mode) {
   return mode.startsWith("0") ? mode : `0${mode}`;
 }
-function ownershipComponentMatches(expected, actual) {
-  return expected === "" || actual === expected;
+var NUMERIC_ID_PATTERN = new RegExp("^\\d+$", "v");
+function isNumericId(value) {
+  return NUMERIC_ID_PATTERN.test(value);
 }
-function groupOwnershipMatches(expectsGroup, expectedGroup, actualGroup) {
-  if (!expectsGroup) return true;
-  return ownershipComponentMatches(expectedGroup, actualGroup);
+function ownershipComponentMatches(expected, actual, actualId) {
+  if (expected === "") return true;
+  if (actual === expected || actualId === expected) return true;
+  if (!isNumericId(expected) || !isNumericId(actualId)) return false;
+  return Number(expected) === Number(actualId);
 }
 async function resolveWriteMode(ssh2, remotePath, explicitMode) {
   if (explicitMode != null) return explicitMode;
@@ -2635,10 +2645,10 @@ function ownershipMatches(current, options) {
   if (options?.mode != null && current.mode !== options.mode.replace(new RegExp("^0+", "v"), "")) return false;
   if (options?.owner == null) return true;
   const expectsGroup = options.owner.includes(":");
-  const [expectedOwner, expectedGroup = ""] = options.owner.split(":", 2);
-  if (!ownershipComponentMatches(expectedOwner, current.owner)) return false;
-  if (!groupOwnershipMatches(expectsGroup, expectedGroup, current.group)) return false;
-  return true;
+  const [expectedOwner = "", expectedGroup = ""] = options.owner.split(":", 2);
+  if (!ownershipComponentMatches(expectedOwner, current.owner, current.ownerId)) return false;
+  if (!expectsGroup) return true;
+  return ownershipComponentMatches(expectedGroup, current.group, current.groupId);
 }
 function createMetadataModule(kind, remotePath, value) {
   const name = `file.${kind}: ${remotePath}`;
@@ -2676,6 +2686,7 @@ var SILENT = { silent: true };
 var FLAGS_DIR = "/var/lib/paratix/flags";
 var ARCHIVE_MARKER_MODE = "0644";
 var ARCHIVE_OWNER_MEMBER_CONCURRENCY = 8;
+var ARCHIVE_STAT_OWNERSHIP_FIELDS = 4;
 async function mapWithConcurrencyLimit2(items, limit, mapper) {
   if (items.length === 0) return [];
   const results = [];
@@ -3055,11 +3066,9 @@ async function applyExtract(conn, parameters) {
   }
 }
 function ownerMatchesStat(stdout, owner) {
-  const [actualUser = "", actualGroup = ""] = stdout.trim().split(new RegExp("\\s+", "v"), 2);
+  const [actualUser = "", actualGroup = "", actualUserId = "", actualGroupId = ""] = stdout.trim().split(new RegExp("\\s+", "v"), ARCHIVE_STAT_OWNERSHIP_FIELDS);
   const [expectedUser = "", expectedGroup = ""] = owner.split(":", 2);
-  if (expectedUser !== "" && actualUser !== expectedUser) return false;
-  if (expectedGroup !== "" && actualGroup !== expectedGroup) return false;
-  return true;
+  return ownershipComponentMatches(expectedUser, actualUser, actualUserId) && ownershipComponentMatches(expectedGroup, actualGroup, actualGroupId);
 }
 function isStringArray(value) {
   return Array.isArray(value) && value.every((item) => typeof item === "string");
@@ -3071,7 +3080,7 @@ async function extractedMemberOwnerMatches(conn, parameters) {
     EXEC_OPTS3
   );
   if (exists.code !== 0) return false;
-  const stat5 = await conn.exec(`stat -c '%U %G' -- ${shellQuote(path3)}`, EXEC_OPTS3);
+  const stat5 = await conn.exec(`stat -c '%U %G %u %g' -- ${shellQuote(path3)}`, EXEC_OPTS3);
   if (stat5.code !== 0) return false;
   return ownerMatchesStat(stat5.stdout, owner);
 }
@@ -5354,18 +5363,22 @@ function rejectSensitiveHeadersOverHttp(parameters) {
   );
 }
 async function readDownloadOwnership(conn, destination) {
-  const result = await conn.exec(`stat -c '%a %U %G' ${shellQuote(destination)}`, {
+  const result = await conn.exec(`stat -c '%a %U %G %u %g' ${shellQuote(destination)}`, {
     ignoreExitCode: true,
     silent: true
   });
-  if (result.code !== 0) return { group: "", mode: "", owner: "" };
-  const [mode = "", owner = "", group2 = ""] = result.stdout.trim().split(new RegExp("\\s+", "v"));
-  return { group: group2, mode, owner };
+  if (result.code !== 0) return { group: "", groupId: "", mode: "", owner: "", ownerId: "" };
+  const [mode = "", owner = "", group2 = "", ownerId = "", groupId = ""] = result.stdout.trim().split(new RegExp("\\s+", "v"));
+  return { group: group2, groupId, mode, owner, ownerId };
+}
+function downloadComponentMatches(expected, actual, actualId) {
+  if (expected == null) return true;
+  return ownershipComponentMatches(expected, actual, actualId);
 }
 function downloadOwnershipMatches(current, options) {
   if (options.mode != null && current.mode !== options.mode.replace(new RegExp("^0+", "v"), "")) return false;
-  if (options.owner != null && current.owner !== options.owner) return false;
-  if (options.group != null && current.group !== options.group) return false;
+  if (!downloadComponentMatches(options.owner, current.owner, current.ownerId)) return false;
+  if (!downloadComponentMatches(options.group, current.group, current.groupId)) return false;
   return true;
 }
 async function metadataMatches(conn, destination, options) {
@@ -5564,7 +5577,7 @@ function downloadModeDrifted(current, options) {
   return options.mode != null && current.mode !== options.mode.replace(new RegExp("^0+", "v"), "");
 }
 function downloadOwnerDrifted(current, options) {
-  return options.owner != null && current.owner !== options.owner || options.group != null && current.group !== options.group;
+  return !downloadComponentMatches(options.owner, current.owner, current.ownerId) || !downloadComponentMatches(options.group, current.group, current.groupId);
 }
 async function healModeDrift(conn, parameters, current) {
   if (parameters.mode == null || !downloadModeDrifted(current, parameters)) {
@@ -6922,18 +6935,27 @@ ${endMarker}`
   };
 }
 async function readPropertiesState(ssh2, remotePath) {
-  const result = await ssh2.exec(`stat -c '%a %U %G' ${shellQuote(remotePath)}`, EXEC_OPTS6);
-  if (result.code !== 0) return { group: "", mode: "", owner: "" };
-  const [mode = "", owner = "", group2 = ""] = result.stdout.trim().split(new RegExp("\\s+", "v"));
-  return { group: group2, mode, owner };
+  const result = await ssh2.exec(`stat -c '%a %U %G %u %g' ${shellQuote(remotePath)}`, EXEC_OPTS6);
+  if (result.code !== 0) return { group: "", groupId: "", mode: "", owner: "", ownerId: "" };
+  const [mode = "", owner = "", group2 = "", ownerId = "", groupId = ""] = result.stdout.trim().split(new RegExp("\\s+", "v"));
+  return { group: group2, groupId, mode, owner, ownerId };
 }
 function modeMatches(current, desired) {
   return current === desired.replace(new RegExp("^0+", "v"), "");
 }
+function assertValidOwnershipComponent(value, kind) {
+  if (isNumericId(value)) return;
+  if (kind === "user") assertValidUserName(value);
+  else assertValidGroupName(value);
+}
+function propertiesComponentMatches(expected, actual, actualId) {
+  if (expected == null) return true;
+  return ownershipComponentMatches(expected, actual, actualId);
+}
 function assertValidPropertiesOptions(options) {
   if (options.mode != null) validateMode(options.mode);
-  if (options.owner != null) assertValidUserName(options.owner);
-  if (options.group != null) assertValidGroupName(options.group);
+  if (options.owner != null) assertValidOwnershipComponent(options.owner, "user");
+  if (options.group != null) assertValidOwnershipComponent(options.group, "group");
 }
 function isDriftFailure(result) {
   return typeof result !== "boolean";
@@ -6949,8 +6971,8 @@ async function applyModeDrift(context) {
 }
 async function maybeApplyCombinedChown(context) {
   const { current, options, remotePath, ssh: ssh2 } = context;
-  const ownerNeedsUpdate = options.owner != null && current.owner !== options.owner;
-  const groupNeedsUpdate = options.group != null && current.group !== options.group;
+  const ownerNeedsUpdate = options.owner != null && !propertiesComponentMatches(options.owner, current.owner, current.ownerId);
+  const groupNeedsUpdate = options.group != null && !propertiesComponentMatches(options.group, current.group, current.groupId);
   if (!ownerNeedsUpdate || !groupNeedsUpdate || options.owner == null || options.group == null) {
     return false;
   }
@@ -6963,7 +6985,9 @@ async function maybeApplyCombinedChown(context) {
 }
 async function maybeApplySingleChown(context) {
   const { current, options, remotePath, ssh: ssh2 } = context;
-  if (options.owner == null || current.owner === options.owner) return false;
+  if (options.owner == null || propertiesComponentMatches(options.owner, current.owner, current.ownerId)) {
+    return false;
+  }
   const result = await ssh2.exec(renderGuardedChownCommand(options.owner, remotePath), EXEC_OPTS6);
   if (result.code !== 0) {
     return failedCommand(`[file.properties: ${remotePath}] chown failed`, result);
@@ -6972,7 +6996,9 @@ async function maybeApplySingleChown(context) {
 }
 async function maybeApplySingleChgrp(context) {
   const { current, options, remotePath, ssh: ssh2 } = context;
-  if (options.group == null || current.group === options.group) return false;
+  if (options.group == null || propertiesComponentMatches(options.group, current.group, current.groupId)) {
+    return false;
+  }
   const result = await ssh2.exec(renderGuardedChgrpCommand(options.group, remotePath), EXEC_OPTS6);
   if (result.code !== 0) {
     return failedCommand(`[file.properties: ${remotePath}] chgrp failed`, result);
@@ -7011,10 +7037,10 @@ function properties(remotePath, options) {
     async check(ssh2) {
       if (!ssh2) return NEEDS_APPLY;
       if (await isSymlink(ssh2, remotePath)) return NEEDS_APPLY;
-      const { group: group2, mode, owner } = await readPropertiesState(ssh2, remotePath);
+      const { group: group2, groupId, mode, owner, ownerId } = await readPropertiesState(ssh2, remotePath);
       if (options.mode != null && !modeMatches(mode, options.mode)) return NEEDS_APPLY;
-      if (options.owner != null && owner !== options.owner) return NEEDS_APPLY;
-      if (options.group != null && group2 !== options.group) return NEEDS_APPLY;
+      if (!propertiesComponentMatches(options.owner, owner, ownerId)) return NEEDS_APPLY;
+      if (!propertiesComponentMatches(options.group, group2, groupId)) return NEEDS_APPLY;
       return "ok";
     },
     name: `file.properties: ${remotePath}`

package/dist/cli.js

@@ -6262,7 +6262,7 @@ async function runApplyCommand(file, options, run = runPlaybook) {
   if (options.diff && !options.dryRun) {
     throw new CliUsageError("--diff requires --dry-run");
   }
-  printCliHeader("0.16.0-81f051d");
+  printCliHeader("0.16.1-728d4e1");
   const environmentOverrides = applyCliEnvironmentOverrides(options.env, {
     firstRun: options.firstRun
   });
@@ -6300,7 +6300,7 @@ function renderSubcommandOptionsHelp(command) {
   return ["", `Options for "paratix ${command.name()} <file>":`, ...rows].join("\n");
 }
 var program = new Command();
-program.name("paratix").description("Idempotent VPS setup tool in TypeScript").version("0.16.0-81f051d");
+program.name("paratix").description("Idempotent VPS setup tool in TypeScript").version("0.16.1-728d4e1");
 var applyCommand = program.command("apply <file>").description("Apply a server definition").option(
   "--diff",
   "When combined with --dry-run, show a unified diff per module that would change.",

package/dist/{index-N3n0FmKh.d.ts → index-jbXRUlJ6.d.ts}

@@ -1017,7 +1017,7 @@ type PropertiesOptions = {
 /**
  * Set file or directory ownership and permissions on the remote host.
  * Only the attributes specified in `options` are checked and applied. Drift
- * is detected via `stat -c '%a %U %G'` so `apply` only invokes the relevant
+ * is detected via `stat -c '%a %U %G %u %g'` so `apply` only invokes the relevant
  * `chmod`/`chown`/`chgrp` for fields that actually differ from the desired
  * state. When all desired fields already match, `apply` returns `status: "ok"`
  * instead of falsely reporting a change.

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { E as Environment, M as Module, a as ModuleMetaEntry, b as MetaEnvironmentValue, c as EnvironmentMetaEntry, S as SshdPortMetaEntry, d as SystemHostMetaEntry, e as SystemRebootMetaEntry, f as ModuleResult, g as ExecResult, h as ModuleStatus, i as SshConnection, O as OrchestrationStep, j as ShutdownSignal, k as ServerDefinition } from './index-N3n0FmKh.js';
-export { l as EnvironmentValue, m as ExecOptions, N as NEEDS_APPLY, n as SshConfig, o as apt, p as archive, q as command, r as compose, s as cron, t as download, u as file, v as git, w as group, x as hostname, y as mount, z as net, A as op, B as package, C as quadlet, D as releaseUpgrade, F as rsync, G as script, H as service, I as ssh, J as sshd, K as swap, L as sysctl, P as system, Q as systemd, R as timer, T as ufw, U as user } from './index-N3n0FmKh.js';
+import { E as Environment, M as Module, a as ModuleMetaEntry, b as MetaEnvironmentValue, c as EnvironmentMetaEntry, S as SshdPortMetaEntry, d as SystemHostMetaEntry, e as SystemRebootMetaEntry, f as ModuleResult, g as ExecResult, h as ModuleStatus, i as SshConnection, O as OrchestrationStep, j as ShutdownSignal, k as ServerDefinition } from './index-jbXRUlJ6.js';
+export { l as EnvironmentValue, m as ExecOptions, N as NEEDS_APPLY, n as SshConfig, o as apt, p as archive, q as command, r as compose, s as cron, t as download, u as file, v as git, w as group, x as hostname, y as mount, z as net, A as op, B as package, C as quadlet, D as releaseUpgrade, F as rsync, G as script, H as service, I as ssh, J as sshd, K as swap, L as sysctl, P as system, Q as systemd, R as timer, T as ufw, U as user } from './index-jbXRUlJ6.js';
 
 /**
  * Fail the run if a condition on the current env is not satisfied.

package/dist/index.js

@@ -61,7 +61,7 @@ import {
   user,
   validateHostLabel,
   validateSshConfig
-} from "./chunk-56SN6NQH.js";
+} from "./chunk-KC7XBI77.js";
 
 // src/conditionalModules.ts
 function createConditionalApplyState(environment) {

package/dist/modules/index.d.ts

@@ -1 +1 @@
-export { V as PackageSpec, W as UpgradeOptions, o as apt, p as archive, q as command, r as compose, s as cron, t as download, u as file, v as git, w as group, x as hostname, y as mount, z as net, A as op, B as package, C as quadlet, D as releaseUpgrade, F as rsync, G as script, H as service, I as ssh, J as sshd, K as swap, L as sysctl, P as system, Q as systemd, R as timer, T as ufw, U as user } from '../index-N3n0FmKh.js';
+export { V as PackageSpec, W as UpgradeOptions, o as apt, p as archive, q as command, r as compose, s as cron, t as download, u as file, v as git, w as group, x as hostname, y as mount, z as net, A as op, B as package, C as quadlet, D as releaseUpgrade, F as rsync, G as script, H as service, I as ssh, J as sshd, K as swap, L as sysctl, P as system, Q as systemd, R as timer, T as ufw, U as user } from '../index-jbXRUlJ6.js';

package/dist/modules/index.js

@@ -27,7 +27,7 @@ import {
   timer,
   ufw,
   user
-} from "../chunk-56SN6NQH.js";
+} from "../chunk-KC7XBI77.js";
 export {
   apt,
   archive,

package/llm-guide.md

@@ -224,6 +224,15 @@ very slow artifact hosts or large downloads.
 | `file.stat`       | `(remotePath: string): Module`                                                                                      | No (always-applies) |
 | `file.template`   | `(remotePath: string, templatePath: string, options?: { mode?: string; owner?: string; strict?: boolean }): Module` | Yes                 |
 
+**Note on `owner` and `group` values:** Every ownership option accepts either a POSIX name or a
+numeric id — `owner: "www-data:www-data"` and `owner: "65532:65532"` are both valid, and the two
+components may be mixed (`owner: "root:65532"`). Numeric ids are the only option for accounts that
+have no passwd or group entry on the target host, such as `65532` in distroless images or `70` in
+the postgres image. Drift detection compares the declared value against both the name and the id
+reported by the host, so a numerically declared owner converges to `status: "ok"` like a named one.
+`file.properties` keeps `owner` and `group` as separate options and therefore rejects a combined
+`"user:group"` spec.
+
 **Note on `file.copy` and the default mode:** When `options.mode` is omitted, `file.copy` sets the mode to the documented default of `0644`. The mode is applied during upload (`uploadFile` with `{ mode }`) and compared with the desired value in `check`, so subsequent runs detect mode drift (for example, a manual `chmod 0600`) as `needs-apply`. Pass `{ mode: "0600" }` explicitly when more restrictive permissions are required, such as for secrets.
 
 **Note on `file.line`:** The `line` value must be a single line without CR/LF characters. Use `file.block` for multiline content.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paratix",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "description": "Idempotent VPS setup tool in TypeScript",
   "type": "module",
   "files": [