spawnfile 0.1.14 → 0.1.18

package/dist/deployment/record.js

@@ -1,8 +1,11 @@
 import path from "node:path";
-import { readdir, rename, writeFile } from "node:fs/promises";
+import { readdir } from "node:fs/promises";
 import { z } from "zod";
 import { ensureDirectory, readUtf8File } from "../filesystem/index.js";
+import { deployResourcesSchema } from "./resourceLog.js";
+import { publishDeploymentRecord } from "./recordPublication.js";
 import { SpawnfileError } from "../shared/index.js";
+import { recordingReportSchema } from "../report/index.js";
 import { parseOrganizationHandoff } from "./organizationHandoffTypes.js";
 import { parseOpaqueTargetHandle } from "../target/index.js";
 import { normalizeDeploymentName, resolveDeploymentRecordPath, resolveDeploymentRecordsDirectory } from "./names.js";
@@ -79,6 +82,11 @@ const deploymentRecordV1Schema = z.object({
     version: z.literal("spawnfile.deployment.v1")
 }).strict();
 export const deploymentRecordSchema = z.object({
+    activated_at: z.iso.datetime({ offset: true }).optional(),
+    activation_exact: z.boolean().optional(),
+    activation_note: z.string().min(1).optional(),
+    recording: recordingReportSchema.optional(),
+    resource_snapshot: deployResourcesSchema.optional(),
     auth_profile: z.string().min(1).nullable(),
     compile_fingerprint: z.string().min(1),
     created_at: z.string().min(1),
@@ -208,12 +216,10 @@ export const listDeploymentRecords = async (outputDirectory) => {
     }));
     return records.sort((left, right) => left.record.name.localeCompare(right.record.name));
 };
-export const writeDeploymentRecord = async (outputDirectory, record) => {
+export const writeDeploymentRecord = async (outputDirectory, record, previous) => {
     const parsed = parseDeploymentRecord(record);
     const recordPath = resolveDeploymentRecordPath(outputDirectory, parsed.name);
     await ensureDirectory(path.dirname(recordPath));
-    const temporaryPath = path.join(path.dirname(recordPath), `.${path.basename(recordPath)}.${process.pid}.${Date.now()}.tmp`);
-    await writeFile(temporaryPath, `${JSON.stringify(parsed, null, 2)}\n`, "utf8");
-    await rename(temporaryPath, recordPath);
+    await publishDeploymentRecord(recordPath, parsed, undefined, previous);
     return recordPath;
 };

package/dist/deployment/recordPublication.d.ts

@@ -0,0 +1,15 @@
+import { SpawnfileError } from "../shared/index.js";
+import { type DeploymentRecord } from "./record.js";
+import { type DeployResourceReport } from "./resourceLog.js";
+/** Publication succeeded: callers must not roll back its named container. */
+export declare class HomeDeploymentRecordingError extends SpawnfileError {
+    constructor(deployment: string, cause: unknown);
+}
+export declare const bindDeploymentRecording: (recordPath: string, record: DeploymentRecord, report: DeployResourceReport, reportBytes: string) => DeploymentRecord;
+/** Caller holds the publication lock; recover a published snapshot before using its history. */
+export declare const reconcileDeploymentResources: (recordPath: string) => Promise<void>;
+/** The original non-recording publication sequence, including its temporary name and permissions. */
+export declare const writeAtomicDeploymentFile: (file: string, bytes: string) => Promise<void>;
+/** Callers create the directory and pass the predecessor from their existing lifecycle read.
+ * Recording replacements re-read under the lock; off never probes for recording state. */
+export declare const publishDeploymentRecord: (recordPath: string, record: DeploymentRecord, publishReport?: (durable: boolean) => Promise<void>, previous?: DeploymentRecord | null) => Promise<void>;

package/dist/deployment/recordPublication.js

@@ -0,0 +1,76 @@
+import path from "node:path";
+import { readFile, rename, writeFile } from "node:fs/promises";
+import { PublishedFileSyncError, syncFile, writeDurableFile } from "../filesystem/index.js";
+import { SpawnfileError } from "../shared/index.js";
+import { acquirePidLock } from "./pidLock.js";
+import { parseDeploymentRecord } from "./record.js";
+import { createDeployResources, ensureDeployResources } from "./resourceLog.js";
+/** Publication succeeded: callers must not roll back its named container. */
+export class HomeDeploymentRecordingError extends SpawnfileError {
+    constructor(deployment, cause) {
+        super("io_error", `Deployment ${deployment} is published, but recording failed: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+    }
+}
+export const bindDeploymentRecording = (recordPath, record, report, reportBytes) => {
+    const { recording: _recording, resource_snapshot: _snapshot, ...base } = record;
+    return report.recording ? { ...base, recording: report.recording,
+        resource_snapshot: createDeployResources(recordPath, record, report, reportBytes) } : base;
+};
+const priorRecord = async (recordPath) => {
+    let bytes;
+    try {
+        bytes = await readFile(recordPath, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+    return parseDeploymentRecord(JSON.parse(bytes), recordPath);
+};
+/** Caller holds the publication lock; recover a published snapshot before using its history. */
+export const reconcileDeploymentResources = async (recordPath) => {
+    const previous = await priorRecord(recordPath);
+    if (previous?.resource_snapshot && previous.recording) {
+        await syncFile(recordPath);
+        ensureDeployResources(recordPath, previous.resource_snapshot, previous.recording.keep_ms);
+    }
+};
+/** The original non-recording publication sequence, including its temporary name and permissions. */
+export const writeAtomicDeploymentFile = async (file, bytes) => {
+    const temporary = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${Date.now()}.tmp`);
+    await writeFile(temporary, bytes, "utf8");
+    await rename(temporary, file);
+};
+/** Callers create the directory and pass the predecessor from their existing lifecycle read.
+ * Recording replacements re-read under the lock; off never probes for recording state. */
+export const publishDeploymentRecord = async (recordPath, record, publishReport, previous) => {
+    if (!record.recording && !previous?.recording) {
+        await publishReport?.(false);
+        await writeAtomicDeploymentFile(recordPath, `${JSON.stringify(record, null, 2)}\n`);
+        return;
+    }
+    const release = await acquirePidLock(`${recordPath}.resource-log.lock`);
+    try {
+        await reconcileDeploymentResources(recordPath);
+        await publishReport?.(true);
+        try {
+            await writeDurableFile(recordPath, `${JSON.stringify(record, null, 2)}\n`);
+        }
+        catch (cause) {
+            if (cause instanceof PublishedFileSyncError)
+                throw new HomeDeploymentRecordingError(record.name, cause);
+            throw cause;
+        }
+        try {
+            if (record.resource_snapshot && record.recording)
+                ensureDeployResources(recordPath, record.resource_snapshot, record.recording.keep_ms);
+        }
+        catch (cause) {
+            throw new HomeDeploymentRecordingError(record.name, cause);
+        }
+    }
+    finally {
+        await release();
+    }
+};

package/dist/deployment/recordedMemoryRetention.d.ts

@@ -0,0 +1,18 @@
+import type { RecordingReport } from "../report/index.js";
+import type { DeploymentRecord } from "./record.js";
+export interface RecordedMemoryDeletionOptions {
+    discardRecordedMemory?: boolean;
+    removeVolumes?: boolean;
+}
+/** A recompile cannot revoke deployed protection or change the mount-name mapping. */
+export declare const recordedMemoryForDeletion: (record: Pick<DeploymentRecord, "recording" | "compile_fingerprint">, report: {
+    compile_fingerprint?: string;
+    recording?: RecordingReport;
+} | null, mounts: readonly {
+    id: string;
+}[], options: RecordedMemoryDeletionOptions) => RecordingReport | undefined;
+/** The recording report lists mount ids; deletion operates on resolved names.
+ * Compare names after mapping so aliases cannot bypass the retention guard. */
+export declare const assertRecordedMemoryRetention: <T extends {
+    id: string;
+}>(recording: RecordingReport | undefined, mounts: readonly T[], deleting: readonly string[], nameOf: (mount: T) => string, options: RecordedMemoryDeletionOptions, remedy?: string) => void;

package/dist/deployment/recordedMemoryRetention.js

@@ -0,0 +1,27 @@
+import { SpawnfileError } from "../shared/index.js";
+const protectedMountIds = (recording) => [...recording.memory_mount_ids, ...(recording.recording_mount_ids ?? [])];
+/** A recompile cannot revoke deployed protection or change the mount-name mapping. */
+export const recordedMemoryForDeletion = (record, report, mounts, options) => {
+    if (options.removeVolumes && !options.discardRecordedMemory) {
+        const deployed = record.recording;
+        const mismatch = report?.compile_fingerprint !== record.compile_fingerprint;
+        const weakened = deployed && (!report?.recording || report.recording.keep_ms < deployed.keep_ms
+            || protectedMountIds(deployed).some((id) => !protectedMountIds(report.recording).includes(id) || !mounts.some((mount) => mount.id === id)));
+        if ((deployed && mismatch) || weakened || (report?.recording && mismatch)) {
+            throw new SpawnfileError("runtime_error", "Deployment record and report disagree; recording protection cannot be weakened. Restore the deployed report or pass --discard-recorded-memory with --volumes");
+        }
+    }
+    return record.recording ?? report?.recording;
+};
+/** The recording report lists mount ids; deletion operates on resolved names.
+ * Compare names after mapping so aliases cannot bypass the retention guard. */
+export const assertRecordedMemoryRetention = (recording, mounts, deleting, nameOf, options, remedy = "pass --discard-recorded-memory with --volumes to deliberately discard them") => {
+    if (!recording || !options.removeVolumes || options.discardRecordedMemory)
+        return;
+    const protectedIds = new Set(protectedMountIds(recording));
+    const protectedNames = new Set(mounts.filter((mount) => protectedIds.has(mount.id)).map(nameOf));
+    const protectedDeletions = [...new Set(deleting.filter((name) => protectedNames.has(name)))].sort();
+    if (protectedDeletions.length > 0) {
+        throw new SpawnfileError("runtime_error", `Recording retains memory ledgers and recording stores in ${protectedDeletions.join(", ")}; ${remedy}`);
+    }
+};

package/dist/deployment/resourceLog.d.ts

@@ -0,0 +1,140 @@
+import { z } from "zod";
+import { type RecordingReport } from "../report/index.js";
+export declare const DEPLOY_RESOURCES_VERSION = "spawnfile.deploy-resources.v1";
+export declare const DEPLOY_RESOURCE_LOG_FILE = "resource-log.jsonl";
+export declare const deployResourcesSchema: z.ZodObject<{
+    version: z.ZodLiteral<"spawnfile.deploy-resources.v1">;
+    deployment: z.ZodString;
+    deployment_id: z.ZodString;
+    activated_at: z.ZodISODateTime;
+    activation_exact: z.ZodBoolean;
+    activation_note: z.ZodOptional<z.ZodString>;
+    rolled_back_at: z.ZodOptional<z.ZodISODateTime>;
+    exact: z.ZodOptional<z.ZodLiteral<false>>;
+    deployed_at: z.ZodISODateTime;
+    report_sha256: z.ZodString;
+    resources: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodLiteral<"git">;
+        commit: z.ZodString;
+        sha256: z.ZodString;
+        url: z.ZodOptional<z.ZodString>;
+        agent_node_ids: z.ZodArray<z.ZodString>;
+        declared_by: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodLiteral<"bundle">;
+        sha256: z.ZodString;
+        origin: z.ZodOptional<z.ZodString>;
+        agent_node_ids: z.ZodArray<z.ZodString>;
+        declared_by: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>], "kind">>;
+    recording_agents: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        node_id: z.ZodString;
+        slug: z.ZodString;
+        directory: z.ZodString;
+        keep_ms: z.ZodNumber;
+        networks: z.ZodArray<z.ZodString>;
+        memory: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            declared_by: z.ZodString;
+            ledger_path: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>>;
+        feeds: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            volume_name: z.ZodString;
+        }, z.core.$strict>>;
+        resources: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            kind: z.ZodEnum<{
+                git: "git";
+                bundle: "bundle";
+            }>;
+        }, z.core.$strict>>;
+        snapshots: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type DeployResources = z.infer<typeof deployResourcesSchema>;
+export interface ResourceOwnership {
+    agent_node_ids: string[];
+    declared_by?: string;
+}
+/** Both reports carry the already-resolved pins; distribution omits private URLs. */
+export interface DeployResourceReport {
+    recording?: RecordingReport;
+    workspace_git_resources?: Array<Partial<ResourceOwnership> & {
+        id: string;
+        commit: string;
+        sha256: string;
+        url?: string;
+    }>;
+    workspace_bundles?: Array<Partial<ResourceOwnership> & {
+        id: string;
+        sha256: string;
+        origin?: string;
+    }>;
+}
+export interface DeploymentActivation {
+    activated_at?: string;
+    activation_exact?: boolean;
+    activation_note?: string;
+}
+/** Record path is the deployment identity: project output scoped, or home scoped. */
+export declare const deployResourceLogPath: (recordPath: string) => string;
+export declare const createDeployResources: (recordPath: string, record: DeploymentActivation & {
+    name: string;
+    created_at: string;
+}, report: DeployResourceReport, reportBytes: string) => DeployResources;
+/** Invalid/legacy unowned lines are reported; never guess an agent's pin. */
+export declare const readDeployResources: (recordPath: string) => import("../filesystem/retainedJsonl.js").JsonlReadResult<{
+    version: "spawnfile.deploy-resources.v1";
+    deployment: string;
+    deployment_id: string;
+    activated_at: string;
+    activation_exact: boolean;
+    deployed_at: string;
+    report_sha256: string;
+    resources: ({
+        id: string;
+        kind: "git";
+        commit: string;
+        sha256: string;
+        agent_node_ids: string[];
+        url?: string | undefined;
+        declared_by?: string | undefined;
+    } | {
+        id: string;
+        kind: "bundle";
+        sha256: string;
+        agent_node_ids: string[];
+        origin?: string | undefined;
+        declared_by?: string | undefined;
+    })[];
+    activation_note?: string | undefined;
+    rolled_back_at?: string | undefined;
+    exact?: false | undefined;
+    recording_agents?: {
+        node_id: string;
+        slug: string;
+        directory: string;
+        keep_ms: number;
+        networks: string[];
+        memory: {
+            id: string;
+            declared_by: string;
+            ledger_path: string | null;
+        }[];
+        feeds: {
+            id: string;
+            volume_name: string;
+        }[];
+        resources: {
+            id: string;
+            kind: "git" | "bundle";
+        }[];
+        snapshots: string[];
+    }[] | undefined;
+}>;
+export declare const deployResourcesAt: (entries: readonly DeployResources[], recordPath: string, instant: string | Date, agentNodeId?: string) => DeployResources | null;
+/** Caller holds the publication lock. Reconcile only against the LAST entry. */
+export declare const ensureDeployResources: (recordPath: string, entry: DeployResources, keepMs: number) => void;

package/dist/deployment/resourceLog.js

@@ -0,0 +1,78 @@
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { z } from "zod";
+import { appendRetainedJsonl, entryAt, readRetainedJsonl, syncFileSync } from "../filesystem/index.js";
+import { recordingAgentSchema } from "../report/index.js";
+export const DEPLOY_RESOURCES_VERSION = "spawnfile.deploy-resources.v1";
+export const DEPLOY_RESOURCE_LOG_FILE = "resource-log.jsonl";
+const text = z.string().min(1);
+const digest = text.regex(/^sha256:[a-f0-9]{64}$/u);
+const ownership = { agent_node_ids: z.array(text).min(1), declared_by: text.optional() };
+const resourceSchema = z.discriminatedUnion("kind", [
+    z.object({ ...ownership, id: text, kind: z.literal("git"), commit: text.regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/u), sha256: digest, url: text.optional() }).strict(),
+    z.object({ ...ownership, id: text, kind: z.literal("bundle"), sha256: digest, origin: text.optional() }).strict()
+]);
+export const deployResourcesSchema = z.object({
+    version: z.literal(DEPLOY_RESOURCES_VERSION), deployment: text,
+    deployment_id: text,
+    activated_at: z.iso.datetime({ offset: true }), activation_exact: z.boolean(), activation_note: text.optional(),
+    rolled_back_at: z.iso.datetime({ offset: true }).optional(), exact: z.literal(false).optional(),
+    deployed_at: z.iso.datetime({ offset: true }), report_sha256: digest,
+    resources: z.array(resourceSchema),
+    recording_agents: z.array(recordingAgentSchema).optional()
+}).strict().refine((value) => !value.rolled_back_at || (value.exact === false && !value.activation_exact
+    && Date.parse(value.rolled_back_at) >= Date.parse(value.activated_at)), "Invalid candidate interval");
+const isDeployResources = (value) => deployResourcesSchema.safeParse(value).success;
+/** Record path is the deployment identity: project output scoped, or home scoped. */
+export const deployResourceLogPath = (recordPath) => path.join(path.dirname(recordPath), path.basename(recordPath) === "record.json" ? DEPLOY_RESOURCE_LOG_FILE : `${path.basename(recordPath, ".json")}.${DEPLOY_RESOURCE_LOG_FILE}`);
+export const createDeployResources = (recordPath, record, report, reportBytes) => deployResourcesSchema.parse({
+    version: DEPLOY_RESOURCES_VERSION, deployment: record.name, deployment_id: path.resolve(recordPath),
+    deployed_at: record.created_at, activated_at: record.activated_at ?? record.created_at,
+    activation_exact: record.activation_exact ?? false,
+    ...((record.activation_note || !record.activated_at) ? { activation_note: record.activation_note ?? "Activation boundary was not recorded" } : {}),
+    report_sha256: `sha256:${createHash("sha256").update(reportBytes).digest("hex")}`,
+    ...(report.recording?.agents ? { recording_agents: report.recording.agents } : {}),
+    resources: [
+        ...(report.workspace_git_resources ?? []).map(({ id, commit, sha256, url, agent_node_ids, declared_by }) => ({ id, kind: "git", commit, sha256, agent_node_ids, ...(declared_by ? { declared_by } : {}), ...(url === undefined ? {} : { url }) })),
+        ...(report.workspace_bundles ?? []).map(({ id, sha256, origin, agent_node_ids, declared_by }) => ({ id, kind: "bundle", sha256, agent_node_ids, ...(declared_by ? { declared_by } : {}), ...(origin === undefined ? {} : { origin }) }))
+    ]
+});
+/** Invalid/legacy unowned lines are reported; never guess an agent's pin. */
+export const readDeployResources = (recordPath) => readRetainedJsonl(deployResourceLogPath(recordPath), isDeployResources);
+export const deployResourcesAt = (entries, recordPath, instant, agentNodeId) => {
+    const scoped = entries.filter((value) => value.deployment_id === path.resolve(recordPath));
+    const at = instant instanceof Date ? instant.getTime() : Date.parse(instant);
+    const candidate = entryAt(scoped.filter((value) => value.rolled_back_at && at <= Date.parse(value.rolled_back_at)), instant, (value) => value.activated_at);
+    const entry = candidate ?? entryAt(activeDeployments(scoped), instant, (value) => value.activated_at);
+    return entry && agentNodeId !== undefined
+        ? { ...entry, resources: entry.resources.filter((resource) => resource.agent_node_ids.includes(agentNodeId)) }
+        : entry;
+};
+/** A published project candidate can subsequently fail readiness. Its successful-looking
+ * snapshot must not outlive its rollback interval, nor replace the restored predecessor. */
+const activeDeployments = (entries) => {
+    const rolledBack = new Set(entries.filter((entry) => entry.rolled_back_at)
+        .map((entry) => `${entry.activated_at}:${entry.report_sha256}`));
+    return entries.filter((entry) => !entry.rolled_back_at && !rolledBack.has(`${entry.activated_at}:${entry.report_sha256}`));
+};
+const retainDeployResources = (entries, cutoff) => {
+    const predecessor = entryAt(activeDeployments(entries), new Date(cutoff), (entry) => entry.activated_at);
+    return entries.filter((entry) => entry === predecessor || Date.parse(entry.activated_at) > cutoff
+        || (entry.rolled_back_at !== undefined && Date.parse(entry.rolled_back_at) >= cutoff));
+};
+/** Caller holds the publication lock. Reconcile only against the LAST entry. */
+export const ensureDeployResources = (recordPath, entry, keepMs) => {
+    if (entry.deployment_id !== path.resolve(recordPath))
+        throw new Error("Deployment history identity does not match its record path");
+    const history = readDeployResources(recordPath);
+    if (history.errors.length)
+        throw new Error(`Cannot reconcile deployment history: ${history.errors.join("; ")}`);
+    if (JSON.stringify(history.entries.at(-1)) === JSON.stringify(entry)) {
+        syncFileSync(deployResourceLogPath(recordPath));
+        return;
+    }
+    appendRetainedJsonl(deployResourceLogPath(recordPath), entry, {
+        keepMs, now: new Date(), timeOf: (value) => value.activated_at, isEntry: isDeployResources,
+        retain: retainDeployResources
+    });
+};

package/dist/deployment/upLifecycleRecoveryState.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Ephemeral grants issued only by the durable up reconciler. They are kept
+ * process-local: a restart reconstructs them by re-reading and re-verifying
+ * the lifecycle records, never by trusting caller-supplied recovery data.
+ */
+export interface NoDockerMutationRecovery {
+    readonly kind: "no_docker_mutation";
+}
+export interface DeploymentRecordRecovery {
+    readonly kind: "deployment_record";
+}
+export interface DetachedContainerRecovery {
+    readonly containerId: string;
+    readonly containerName: string;
+    readonly deploymentLabels: Readonly<Record<string, string>>;
+    readonly imageId: string;
+    readonly kind: "detached_container";
+}
+export type UpLifecycleRecovery = NoDockerMutationRecovery | DeploymentRecordRecovery | DetachedContainerRecovery;
+export declare const noDockerMutationRecovery: () => NoDockerMutationRecovery;
+export declare const deploymentRecordRecovery: () => DeploymentRecordRecovery;
+export declare const detachedContainerRecovery: (value: Omit<DetachedContainerRecovery, "kind">) => DetachedContainerRecovery;
+export declare const isTrustedUpLifecycleRecovery: (value: unknown) => value is UpLifecycleRecovery;

package/dist/deployment/upLifecycleRecoveryState.js

@@ -0,0 +1,12 @@
+const grants = new WeakSet();
+const grant = (value) => {
+    const result = Object.freeze(value);
+    grants.add(result);
+    return result;
+};
+export const noDockerMutationRecovery = () => grant({ kind: "no_docker_mutation" });
+export const deploymentRecordRecovery = () => grant({ kind: "deployment_record" });
+export const detachedContainerRecovery = (value) => grant({ ...value, kind: "detached_container" });
+export const isTrustedUpLifecycleRecovery = (value) => value !== null
+    && typeof value === "object"
+    && grants.has(value);

package/dist/deployment/upReceiptTypes.d.ts

@@ -38,15 +38,28 @@ declare const compiledEngineEntrySchema: z.ZodObject<{
     engine: z.ZodString;
 }, z.core.$strict>;
 export type CompiledEngineEntry = z.infer<typeof compiledEngineEntrySchema>;
-declare const moltnetReleaseIdentitySchema: z.ZodObject<{
+declare const moltnetReleaseIdentitySchema: z.ZodUnion<readonly [z.ZodObject<{
     architecture: z.ZodUnion<readonly [z.ZodLiteral<"amd64">, z.ZodLiteral<"arm64">]>;
     asset: z.ZodString;
     asset_sha256: z.ZodString;
-    capabilities: z.ZodTuple<[z.ZodLiteral<"pi-bridge">], null>;
+    capabilities: z.ZodUnion<readonly [z.ZodTuple<[z.ZodLiteral<"pi-bridge">], null>, z.ZodTuple<[z.ZodLiteral<"daimon-bridge">, z.ZodLiteral<"pi-bridge">], null>]>;
     release_version: z.ZodString;
     source_revision: z.ZodString;
     version: z.ZodLiteral<"spawnfile.moltnet-release-identity.v1">;
-}, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    architecture: z.ZodUnion<readonly [z.ZodLiteral<"amd64">, z.ZodLiteral<"arm64">]>;
+    asset: z.ZodString;
+    asset_sha256: z.ZodString;
+    capabilities: z.ZodTuple<[z.ZodLiteral<"daimon-bridge">, z.ZodLiteral<"pi-bridge">], null>;
+    development: z.ZodObject<{
+        mode: z.ZodLiteral<"local-development">;
+        non_production: z.ZodLiteral<true>;
+        unsigned: z.ZodLiteral<true>;
+        unpublished: z.ZodLiteral<true>;
+    }, z.core.$strict>;
+    source_sha256: z.ZodString;
+    version: z.ZodLiteral<"spawnfile.moltnet-release-identity.v1">;
+}, z.core.$strict>]>;
 export type MoltnetReleaseReceiptIdentity = z.infer<typeof moltnetReleaseIdentitySchema>;
 export declare const upReceiptSchema: z.ZodPreprocess<z.ZodObject<{
     version: z.ZodLiteral<"spawnfile.up-receipt.v1">;
@@ -68,15 +81,28 @@ export declare const upReceiptSchema: z.ZodPreprocess<z.ZodObject<{
         agent: z.ZodString;
         engine: z.ZodString;
     }, z.core.$strict>>>;
-    moltnet_release: z.ZodOptional<z.ZodObject<{
+    moltnet_release: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
         architecture: z.ZodUnion<readonly [z.ZodLiteral<"amd64">, z.ZodLiteral<"arm64">]>;
         asset: z.ZodString;
         asset_sha256: z.ZodString;
-        capabilities: z.ZodTuple<[z.ZodLiteral<"pi-bridge">], null>;
+        capabilities: z.ZodUnion<readonly [z.ZodTuple<[z.ZodLiteral<"pi-bridge">], null>, z.ZodTuple<[z.ZodLiteral<"daimon-bridge">, z.ZodLiteral<"pi-bridge">], null>]>;
         release_version: z.ZodString;
         source_revision: z.ZodString;
         version: z.ZodLiteral<"spawnfile.moltnet-release-identity.v1">;
-    }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        architecture: z.ZodUnion<readonly [z.ZodLiteral<"amd64">, z.ZodLiteral<"arm64">]>;
+        asset: z.ZodString;
+        asset_sha256: z.ZodString;
+        capabilities: z.ZodTuple<[z.ZodLiteral<"daimon-bridge">, z.ZodLiteral<"pi-bridge">], null>;
+        development: z.ZodObject<{
+            mode: z.ZodLiteral<"local-development">;
+            non_production: z.ZodLiteral<true>;
+            unsigned: z.ZodLiteral<true>;
+            unpublished: z.ZodLiteral<true>;
+        }, z.core.$strict>;
+        source_sha256: z.ZodString;
+        version: z.ZodLiteral<"spawnfile.moltnet-release-identity.v1">;
+    }, z.core.$strict>]>>;
     organization_handoff: z.ZodOptional<z.ZodObject<{
         binding_digest: z.ZodString;
         deployment_handle: z.ZodString;

package/dist/deployment/upReceiptTypes.js

@@ -43,11 +43,16 @@ const compiledEngineEntrySchema = z
     engine: z.string().min(1)
 })
     .strict();
-const moltnetReleaseIdentitySchema = z.object({
+const publishedMoltnetReleaseIdentitySchema = z.object({
     architecture: z.union([z.literal("amd64"), z.literal("arm64")]),
     asset: z.string().regex(/^moltnet_linux_(amd64|arm64)\.tar\.gz$/u),
     asset_sha256: z.string().regex(/^sha256:[a-f0-9]{64}$/u),
-    capabilities: z.tuple([z.literal("pi-bridge")]),
+    // Union, not replacement: moltnet v0.1.18 publishes both bridges, and every
+    // older pi-only release must still validate.
+    capabilities: z.union([
+        z.tuple([z.literal("pi-bridge")]),
+        z.tuple([z.literal("daimon-bridge"), z.literal("pi-bridge")])
+    ]),
     release_version: z.string().regex(/^v?\d+\.\d+\.\d+(?:-\d+-g[a-f0-9]{7,40})?$/u),
     source_revision: z.string().regex(/^[a-f0-9]{40}$/u),
     version: z.literal("spawnfile.moltnet-release-identity.v1")
@@ -68,6 +73,28 @@ const moltnetReleaseIdentitySchema = z.object({
         });
     }
 });
+const localMoltnetReleaseIdentitySchema = z.object({
+    architecture: z.union([z.literal("amd64"), z.literal("arm64")]),
+    asset: z.string().regex(/^moltnet_linux_(amd64|arm64)\.tar\.gz$/u),
+    asset_sha256: z.string().regex(/^sha256:[a-f0-9]{64}$/u),
+    capabilities: z.tuple([z.literal("daimon-bridge"), z.literal("pi-bridge")]),
+    development: z.object({
+        mode: z.literal("local-development"),
+        non_production: z.literal(true),
+        unsigned: z.literal(true),
+        unpublished: z.literal(true)
+    }).strict(),
+    source_sha256: z.string().regex(/^sha256:[a-f0-9]{64}$/u),
+    version: z.literal("spawnfile.moltnet-release-identity.v1")
+}).strict().superRefine((value, context) => {
+    if (!value.asset.includes(`_${value.architecture}.`)) {
+        context.addIssue({ code: z.ZodIssueCode.custom, path: ["asset"], message: "Moltnet asset architecture must match identity architecture" });
+    }
+});
+const moltnetReleaseIdentitySchema = z.union([
+    publishedMoltnetReleaseIdentitySchema,
+    localMoltnetReleaseIdentitySchema
+]);
 const organizationHandoffReceiptSchema = z.object({
     binding_digest: z.string().regex(/^sha256:[a-f0-9]{64}$/u),
     deployment_handle: z.string().regex(/^sf-oh1-[a-f0-9]{64}$/u),

package/dist/deployment/workspaceResourceMigration.d.ts

@@ -0,0 +1,55 @@
+export declare const WORKSPACE_RESOURCE_MANIFEST_VERSION: "spawnfile.workspace-resource-manifest.v1";
+export declare const WORKSPACE_RESOURCE_MIGRATION_VERSION: "spawnfile.workspace-resource-migration.v1";
+export interface WorkspaceResourceManifestFile {
+    gid: number;
+    mode: number;
+    path: string;
+    sha256: `sha256:${string}`;
+    size: number;
+    uid: number;
+}
+export interface WorkspaceResourceManifestDirectory {
+    gid: number;
+    mode: number;
+    path: string;
+    uid: number;
+}
+export interface WorkspaceResourceManifest {
+    version: typeof WORKSPACE_RESOURCE_MANIFEST_VERSION;
+    root: {
+        gid: number;
+        mode: number;
+        uid: number;
+    };
+    directories: WorkspaceResourceManifestDirectory[];
+    files: WorkspaceResourceManifestFile[];
+}
+export interface WorkspaceResourceMigrationReceipt {
+    version: typeof WORKSPACE_RESOURCE_MIGRATION_VERSION;
+    active_path: string;
+    destination_path: string;
+    manifest_sha256: `sha256:${string}`;
+    rollback: boolean;
+    source_path: string;
+    source_retained: true;
+    status: "activated" | "rolled_back";
+}
+export interface WorkspaceResourceMigrationHooks {
+    beforeActivation?: (destinationPath: string) => Promise<void>;
+    afterActivation?: (destinationPath: string) => Promise<void>;
+    afterCopy?: (temporaryPath: string) => Promise<void>;
+    activate?: (temporaryPath: string, destinationPath: string) => Promise<void>;
+    copy?: (sourcePath: string, temporaryPath: string) => Promise<void>;
+    freeBytes?: (parentPath: string) => Promise<bigint>;
+    withSourceWriteFence?: <T>(operation: () => Promise<T>) => Promise<T>;
+}
+export interface WorkspaceResourceMigrationOptions {
+    destinationPath: string;
+    hooks?: WorkspaceResourceMigrationHooks;
+    manifestPath: string;
+    resolvedIdentity: string;
+    sourceQuiesced?: boolean;
+    sourcePath: string;
+}
+export declare const migrateWorkspaceResource: (options: WorkspaceResourceMigrationOptions) => Promise<WorkspaceResourceMigrationReceipt>;
+export declare const buildWorkspaceResourceManifest: (sourcePath: string) => Promise<WorkspaceResourceManifest>;