stitchkit 0.104.2 → 0.105.1

package/dist/{index-ssmd41kh.js → index-d2h99n7d.js}

@@ -27,7 +27,7 @@ import {
   encodeAgentConversationArchive2,
   decodeAgentConversationArchive2,
   assistantStatus
-} from "./index-r5hsgkz5.js";
+} from "./index-0gs4ymfj.js";
 
 // src/agent-runtime/purge.ts
 import { z } from "zod";

package/dist/{index-z94wht4y.js → index-dky0dcmf.js}

@@ -43,20 +43,47 @@ function createDiagnosticJournalReadResultSchema2(eventSchema) {
     z2.object({ type: z2.literal("anomaly"), anomaly: DiagnosticJournalAnomalySchema2 }).strict().readonly()
   ]);
 }
+var DiagnosticJournalStartupRefusalReasonSchema2 = z2.enum([
+  "torn-without-retention-slot",
+  "not-a-regular-file",
+  "unreadable"
+]);
+var DIAGNOSTIC_JOURNAL_LISTED_QUARANTINE_LIMIT = 32;
+var QuarantinedFileSchema = z2.object({
+  file: z2.string(),
+  quarantinedAs: z2.string(),
+  reason: DiagnosticJournalStartupRefusalReasonSchema2.optional(),
+  code: z2.string().optional()
+}).strict().readonly();
 var DiagnosticJournalRecoveryStatusSchema2 = z2.object({
   filesChecked: ByteCountSchema,
   anomalies: ByteCountSchema,
   skippedBytes: ByteCountSchema,
   firstAnomaly: DiagnosticJournalAnomalySchema2.optional(),
-  lastAnomaly: DiagnosticJournalAnomalySchema2.optional()
+  lastAnomaly: DiagnosticJournalAnomalySchema2.optional(),
+  quarantined: z2.array(QuarantinedFileSchema).max(DIAGNOSTIC_JOURNAL_LISTED_QUARANTINE_LIMIT).readonly().optional(),
+  quarantinedUnlisted: z2.number().int().positive().optional()
 }).strict().readonly();
+var REFUSAL_MESSAGES = {
+  "torn-without-retention-slot": "Diagnostic journal tail recovery requires maxFiles >= 2; no data was removed",
+  "not-a-regular-file": "Diagnostic journal generations must be regular files",
+  unreadable: "Diagnostic journal could not read a retained file"
+};
 
 class DiagnosticJournalRecoveryError2 extends Error {
+  reason;
+  file;
   recovery;
-  constructor(recovery) {
-    super("Diagnostic journal tail recovery requires maxFiles >= 2; no data was removed");
-    this.recovery = recovery;
+  quarantineFailed;
+  constructor(options) {
+    const quarantineFailed = options.quarantineFailed ?? false;
+    super(`${REFUSAL_MESSAGES[options.reason]}: ${options.file}${quarantineFailed ? " (moving it aside failed)" : ""}`, options.cause === undefined ? undefined : { cause: options.cause });
     this.name = "DiagnosticJournalRecoveryError";
+    this.reason = options.reason;
+    this.file = options.file;
+    if (options.recovery)
+      this.recovery = options.recovery;
+    this.quarantineFailed = quarantineFailed;
   }
 }
 
@@ -72,6 +99,8 @@ var DiagnosticJournalLimitsSchema2 = z3.object({
   maxFiles: PositiveSafeIntegerSchema
 }).strict().readonly();
 var DiagnosticJournalLockPolicySchema2 = z3.enum(["refuse", "reclaim-stale"]);
+var DiagnosticJournalStartupScanSchema2 = z3.enum(["tails", "full"]);
+var DiagnosticJournalStartupRefusalPolicySchema2 = z3.enum(["quarantine", "fail"]);
 var DiagnosticJournalStateSchema2 = z3.enum(["open", "draining", "closed", "failed"]);
 var DiagnosticJournalRefusalReasonSchema2 = z3.enum([
   "closed",
@@ -153,4 +182,4 @@ function readDiagnosticJournalLockDiagnosis2(error) {
   return isRecord(diagnosis) ? diagnosis : undefined;
 }
 
-export { DiagnosticJournalFrameSchema2, DiagnosticJournalAnomalySchema2, createDiagnosticJournalReadResultSchema2, DiagnosticJournalRecoveryStatusSchema2, DiagnosticJournalRecoveryError2, DiagnosticJournalLimitsSchema2, DiagnosticJournalLockPolicySchema2, DiagnosticJournalStateSchema2, DiagnosticJournalRefusalReasonSchema2, DiagnosticJournalFailurePhaseSchema2, DiagnosticJournalStatusSchema2, DiagnosticJournalSubmitResultSchema2, DiagnosticJournalWaitResultSchema2, DiagnosticJournalCloseResultSchema2, parseDiagnosticJournalMode, readDiagnosticJournalLockDiagnosis2 };
+export { DiagnosticJournalFrameSchema2, DiagnosticJournalAnomalySchema2, createDiagnosticJournalReadResultSchema2, DiagnosticJournalStartupRefusalReasonSchema2, DIAGNOSTIC_JOURNAL_LISTED_QUARANTINE_LIMIT, DiagnosticJournalRecoveryStatusSchema2, DiagnosticJournalRecoveryError2, DiagnosticJournalLimitsSchema2, DiagnosticJournalLockPolicySchema2, DiagnosticJournalStartupScanSchema2, DiagnosticJournalStartupRefusalPolicySchema2, DiagnosticJournalStateSchema2, DiagnosticJournalRefusalReasonSchema2, DiagnosticJournalFailurePhaseSchema2, DiagnosticJournalStatusSchema2, DiagnosticJournalSubmitResultSchema2, DiagnosticJournalWaitResultSchema2, DiagnosticJournalCloseResultSchema2, parseDiagnosticJournalMode, readDiagnosticJournalLockDiagnosis2 };

package/dist/index-drs41arz.js

@@ -0,0 +1,455 @@
+import {
+  withSignalDeadline
+} from "./index-9tqbxv5p.js";
+import {
+  fetchGuarded,
+  PrivateAddressRefusal,
+  readCapped
+} from "./index-3h0ztg0z.js";
+import {
+  raceAbort
+} from "./index-b0kddvzw.js";
+import {
+  writeFileAtomicSync2
+} from "./index-cazts87s.js";
+import {
+  assertPositiveSafeInteger
+} from "./index-0s4xebbg.js";
+import {
+  serializeCanonicalJson
+} from "./index-zsvzhjtk.js";
+
+// src/tools/cli/signature.ts
+import {
+  createPrivateKey,
+  createPublicKey,
+  sign as cryptoSign,
+  verify as cryptoVerify
+} from "node:crypto";
+import { z } from "zod";
+var CliBuildSignatureSchema2 = z.object({
+  algorithm: z.literal("ed25519"),
+  keyId: z.string().min(1),
+  signature: z.string().min(1)
+});
+function cliManifestSigningPayload2(manifest) {
+  return serializeCanonicalJson({
+    name: manifest.name,
+    version: manifest.version,
+    commit: manifest.commit,
+    builtAt: manifest.builtAt,
+    assets: manifest.assets.map((asset) => ({
+      platform: asset.platform,
+      arch: asset.arch,
+      compression: asset.compression,
+      size: asset.size,
+      sha256: asset.sha256
+    }))
+  });
+}
+function publicKeyOf(material) {
+  const trimmed = material.trim();
+  if (trimmed.includes("BEGIN PUBLIC KEY"))
+    return createPublicKey(trimmed);
+  const raw = Buffer.from(trimmed, "base64");
+  if (raw.length !== 32) {
+    throw new Error("[stitchkit] an Ed25519 public key is 32 bytes or SPKI PEM");
+  }
+  const spki = Buffer.concat([Buffer.from("302a300506032b6570032100", "hex"), raw]);
+  return createPublicKey({ key: spki, format: "der", type: "spki" });
+}
+function signCliManifest2(manifest, options) {
+  const signature = cryptoSign(null, Buffer.from(cliManifestSigningPayload2(manifest), "utf8"), createPrivateKey(typeof options.privateKey === "string" ? options.privateKey : { key: Buffer.from(options.privateKey), format: "der", type: "pkcs8" }));
+  return {
+    algorithm: "ed25519",
+    keyId: options.keyId,
+    signature: signature.toString("base64")
+  };
+}
+function verifyCliManifest2(manifest, signature, trust) {
+  const keys = trust?.keys;
+  if (!keys || Object.keys(keys).length === 0)
+    return "unenforced";
+  if (!signature)
+    return "missing";
+  const material = Object.hasOwn(keys, signature.keyId) ? keys[signature.keyId] : undefined;
+  if (material === undefined)
+    return "unknown-key";
+  try {
+    const ok = cryptoVerify(null, Buffer.from(cliManifestSigningPayload2(manifest), "utf8"), publicKeyOf(material), Buffer.from(signature.signature, "base64"));
+    return ok ? "valid" : "invalid";
+  } catch {
+    return "invalid";
+  }
+}
+function cliSignatureAccepted2(verdict) {
+  return verdict === "valid" || verdict === "unenforced";
+}
+
+// src/tools/cli/manifest.ts
+import { z as z2 } from "zod";
+var CliBuildTargetSchema2 = z2.object({
+  platform: z2.string().min(1),
+  arch: z2.string().min(1)
+});
+var CliBuildAssetSchema2 = CliBuildTargetSchema2.extend({
+  url: z2.url(),
+  compression: z2.enum(["gzip", "none"]).default("none"),
+  size: z2.int().positive(),
+  sha256: z2.string().regex(/^[0-9a-f]{64}$/, "sha256 must be 64 lowercase hex characters")
+});
+var CliBuildManifestSchema2 = z2.object({
+  name: z2.string().min(1),
+  version: z2.string().min(1),
+  commit: z2.string().min(1),
+  builtAt: z2.iso.datetime(),
+  assets: z2.array(CliBuildAssetSchema2),
+  signature: CliBuildSignatureSchema2.optional()
+});
+var CliBuildStampSchema2 = z2.object({
+  version: z2.string().min(1),
+  commit: z2.string().min(1),
+  builtAt: z2.iso.datetime()
+});
+function formatCliBuildStamp2(stamp, name) {
+  const prefix = name ? `${name} ` : "";
+  return `${prefix}${stamp.version} (${stamp.commit.slice(0, 12)}, built ${stamp.builtAt})`;
+}
+function currentCliBuildTarget2() {
+  return { platform: process.platform, arch: process.arch };
+}
+function selectCliBuildAsset2(manifest, target = currentCliBuildTarget2()) {
+  return manifest.assets.find((asset) => asset.platform === target.platform && asset.arch === target.arch);
+}
+function isManifestList(value) {
+  return Array.isArray(value);
+}
+function assertCliPublishable2(previous, next) {
+  const published = previous === undefined ? [] : isManifestList(previous) ? previous : [previous];
+  for (const candidate of published) {
+    if (candidate.version !== next.version)
+      continue;
+    if (candidate.commit === next.commit)
+      continue;
+    throw new Error(`[stitchkit] ${next.name} ${next.version} was already published from commit ${candidate.commit}; ` + `refusing to republish it from ${next.commit} — bump the version instead`);
+  }
+}
+
+// src/tools/cli/update.ts
+import { createHash as createHash2, randomBytes } from "node:crypto";
+import { existsSync, readFileSync, statSync, unlinkSync } from "node:fs";
+import { basename, dirname, extname, join } from "node:path";
+
+// src/tools/cli/publication-assets.ts
+import { createHash } from "node:crypto";
+import { Readable } from "node:stream";
+import { setImmediate as nextTurn } from "node:timers/promises";
+import { createGunzip, createGzip } from "node:zlib";
+
+// src/tools/cli/publication-control.ts
+function waitForPublication(operation, signal) {
+  return raceAbort(operation, signal, (value) => {
+    if (value instanceof ReadableStream && !value.locked)
+      value.cancel(signal.reason).catch(() => {
+        return;
+      });
+  });
+}
+function withPublicationDeadline(timeoutMs, caller, body) {
+  return withSignalDeadline(timeoutMs, caller, () => new Error(`CLI publication exceeded ${timeoutMs} ms`), body);
+}
+
+// src/tools/cli/publication-assets.ts
+async function collectCliBytes(source, maxBytes, signal) {
+  assertPositiveSafeInteger("CLI asset byte cap", maxBytes, RangeError);
+  const blocks = [];
+  let total = 0;
+  let filled = 0;
+  let block;
+  const consume = (chunk) => {
+    signal?.throwIfAborted();
+    if (!(chunk instanceof Uint8Array))
+      throw new TypeError("CLI asset stream must contain Uint8Array chunks");
+    if (total + chunk.byteLength > maxBytes)
+      throw new RangeError(`CLI asset exceeds ${maxBytes} bytes`);
+    for (let offset = 0;offset < chunk.byteLength; ) {
+      if (!block || filled === block.length) {
+        block = new Uint8Array(Math.min(64 * 1024, maxBytes - total));
+        blocks.push(block);
+        filled = 0;
+      }
+      const count = Math.min(chunk.byteLength - offset, block.length - filled);
+      block.set(chunk.subarray(offset, offset + count), filled);
+      filled += count;
+      total += count;
+      offset += count;
+    }
+  };
+  if (source instanceof Uint8Array)
+    consume(source);
+  else {
+    const reader = source.getReader();
+    let chunks = 0;
+    try {
+      for (;; ) {
+        const next = signal ? await waitForPublication(reader.read(), signal) : await reader.read();
+        if (next.done)
+          break;
+        consume(next.value);
+        if (++chunks % 128 === 0) {
+          if (signal)
+            await waitForPublication(nextTurn(), signal);
+          else
+            await nextTurn();
+        }
+      }
+    } catch (error) {
+      reader.cancel(error).catch(() => {
+        return;
+      });
+      throw error;
+    } finally {
+      reader.releaseLock();
+    }
+  }
+  signal?.throwIfAborted();
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of blocks) {
+    const count = Math.min(chunk.length, total - offset);
+    bytes.set(chunk.subarray(0, count), offset);
+    offset += count;
+  }
+  return bytes;
+}
+async function transformAsset(bytes, kind, maxBytes, signal) {
+  const codec = kind === "gzip" ? createGzip() : createGunzip();
+  const output = Readable.toWeb(codec);
+  codec.end(bytes);
+  try {
+    return await collectCliBytes(output, maxBytes, signal);
+  } finally {
+    codec.destroy();
+  }
+}
+function gzipCliAsset(bytes, maxBytes, signal) {
+  return transformAsset(bytes, "gzip", maxBytes, signal);
+}
+async function decodeCliAsset(transferred, asset, maxBytes, signal) {
+  assertPositiveSafeInteger("CLI asset byte cap", maxBytes, RangeError);
+  assertPositiveSafeInteger("CLI asset size", asset.size, RangeError);
+  if (asset.size > maxBytes)
+    throw new RangeError(`CLI asset declared size exceeds ${maxBytes} bytes`);
+  const bytes = asset.compression === "gzip" ? await transformAsset(transferred, "gunzip", asset.size, signal) : transferred;
+  if (bytes.length !== asset.size)
+    throw new Error(`CLI asset is ${bytes.length} bytes, manifest says ${asset.size}`);
+  const sha256 = createHash("sha256").update(bytes).digest("hex");
+  if (sha256 !== asset.sha256)
+    throw new Error("CLI asset digest does not match the manifest (checksum mismatch) — refusing to install it");
+  return { bytes, sha256 };
+}
+
+// src/tools/cli/update.ts
+var DEFAULT_CHECK_TIMEOUT_MS = 2000;
+var DEFAULT_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
+var DEFAULT_DOWNLOAD_TIMEOUT_MS = 120000;
+var DEFAULT_VERIFY_TIMEOUT_MS = 30000;
+var MANIFEST_MAX_BYTES = 256 * 1024;
+var DEFAULT_MAX_ASSET_BYTES = 256 * 1024 * 1024;
+function parseVersion(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?/.exec(value.trim());
+  if (!match)
+    return;
+  const numbers = [match[1], match[2], match[3]].map((part) => Number(part));
+  if (numbers.some((part) => !Number.isFinite(part)))
+    return;
+  return { numbers, prerelease: match[4] };
+}
+function compareCliVersions2(left, right) {
+  const a = parseVersion(left);
+  const b = parseVersion(right);
+  if (!a || !b)
+    return;
+  for (let index = 0;index < 3; index++) {
+    const difference = (a.numbers[index] ?? 0) - (b.numbers[index] ?? 0);
+    if (difference !== 0)
+      return difference < 0 ? -1 : 1;
+  }
+  if (a.prerelease === b.prerelease)
+    return 0;
+  if (a.prerelease === undefined)
+    return 1;
+  if (b.prerelease === undefined)
+    return -1;
+  const leftParts = a.prerelease.split(".");
+  const rightParts = b.prerelease.split(".");
+  for (let index = 0;index < Math.max(leftParts.length, rightParts.length); index++) {
+    const leftPart = leftParts[index];
+    const rightPart = rightParts[index];
+    if (leftPart === rightPart)
+      continue;
+    if (leftPart === undefined)
+      return -1;
+    if (rightPart === undefined)
+      return 1;
+    const leftNumeric = /^\d+$/.test(leftPart);
+    const rightNumeric = /^\d+$/.test(rightPart);
+    if (leftNumeric !== rightNumeric)
+      return leftNumeric ? -1 : 1;
+    if (leftNumeric) {
+      const leftDigits = leftPart.replace(/^0+(?=\d)/, "");
+      const rightDigits = rightPart.replace(/^0+(?=\d)/, "");
+      if (leftDigits.length !== rightDigits.length)
+        return leftDigits.length < rightDigits.length ? -1 : 1;
+      if (leftDigits === rightDigits)
+        continue;
+      return leftDigits < rightDigits ? -1 : 1;
+    }
+    return leftPart < rightPart ? -1 : 1;
+  }
+  return 0;
+}
+async function checkCliUpdate2(config) {
+  const now = config.now ?? Date.now();
+  const interval = config.intervalMs ?? DEFAULT_CHECK_INTERVAL_MS;
+  if (config.lastCheckedAt !== undefined && now - config.lastCheckedAt < interval) {
+    return { status: "skipped", nextCheckAt: config.lastCheckedAt + interval };
+  }
+  try {
+    const response = await fetchGuarded(new URL(config.manifestUrl), config.allowPrivateHosts ?? false, {
+      timeoutMs: config.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS,
+      bodyTimeoutMs: config.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS
+    });
+    if (!response.ok)
+      return { status: "unknown", reason: `manifest responded ${response.status}` };
+    const body = await readCapped(response, MANIFEST_MAX_BYTES);
+    if (!body)
+      return { status: "unknown", reason: "manifest is larger than expected" };
+    const parsed = CliBuildManifestSchema2.safeParse(JSON.parse(body.toString("utf8")));
+    if (!parsed.success)
+      return { status: "unknown", reason: "manifest did not validate" };
+    const manifest = parsed.data;
+    const order = compareCliVersions2(config.currentVersion, manifest.version);
+    if (order === undefined) {
+      return {
+        status: "unknown",
+        reason: `cannot compare ${config.currentVersion} with ${manifest.version}`
+      };
+    }
+    const verdict = verifyCliManifest2(manifest, manifest.signature, config.trust);
+    if (order >= 0)
+      return { status: "current", version: manifest.version, signature: verdict };
+    if (!cliSignatureAccepted2(verdict)) {
+      return { status: "unknown", reason: `manifest signature: ${verdict}` };
+    }
+    const asset = selectCliBuildAsset2(manifest, config.target ?? currentCliBuildTarget2());
+    return {
+      status: "outdated",
+      version: manifest.version,
+      manifest,
+      ...asset && { asset },
+      signature: verdict
+    };
+  } catch (error) {
+    if (error instanceof PrivateAddressRefusal) {
+      return {
+        status: "unknown",
+        reason: `${error.message} — the manifest endpoint is not public. Set ` + "`allowPrivateHosts` if it is your own deployment; the download keeps " + "its own setting, because an asset URL comes from the document."
+      };
+    }
+    return {
+      status: "unknown",
+      reason: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function applyCliUpdate2(config) {
+  const target = config.targetPath ?? process.execPath;
+  if (config.trust) {
+    if (!config.manifest) {
+      throw new Error("[stitchkit] update: a trust root needs the manifest the asset came from");
+    }
+    const verdict = verifyCliManifest2(config.manifest, config.manifest.signature, config.trust);
+    if (!cliSignatureAccepted2(verdict)) {
+      throw new Error(`[stitchkit] update: refusing to install — manifest signature ${verdict}`);
+    }
+    if (!config.manifest.assets.some((asset) => asset.sha256 === config.asset.sha256)) {
+      throw new Error("[stitchkit] update: the asset is not one the signed manifest names");
+    }
+  }
+  const response = await fetchGuarded(new URL(config.asset.url), config.allowPrivateHosts ?? false, {
+    timeoutMs: config.timeoutMs ?? DEFAULT_DOWNLOAD_TIMEOUT_MS,
+    bodyTimeoutMs: config.timeoutMs ?? DEFAULT_DOWNLOAD_TIMEOUT_MS
+  });
+  if (!response.ok) {
+    throw new Error(`[stitchkit] update download responded ${response.status}`);
+  }
+  const transferred = await readCapped(response, config.maxBytes ?? DEFAULT_MAX_ASSET_BYTES);
+  if (!transferred)
+    throw new Error("[stitchkit] update download exceeded the size ceiling");
+  const { bytes, sha256 } = await decodeCliAsset(transferred, config.asset, config.maxBytes ?? DEFAULT_MAX_ASSET_BYTES);
+  if (config.verify)
+    await verifyCandidate(target, bytes, config.verify, config.verifyTimeoutMs);
+  const backup = config.backupPath ? keepReplacedBinary(target, config.backupPath) : undefined;
+  writeFileAtomicSync2(target, bytes, { mode: 493 });
+  return {
+    path: target,
+    bytes: bytes.length,
+    sha256,
+    ...backup && { backupPath: backup.path, backupSha256: backup.sha256 }
+  };
+}
+async function verifyCandidate(target, bytes, verify, timeoutMs = DEFAULT_VERIFY_TIMEOUT_MS) {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new RangeError("[stitchkit] update: verifyTimeoutMs must be a positive number");
+  }
+  const candidate = join(dirname(target), `.${basename(target)}.candidate-${randomBytes(8).toString("hex")}${extname(target)}`);
+  writeFileAtomicSync2(candidate, bytes, { mode: 493 });
+  const controller = new AbortController;
+  let timer;
+  const deadline = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      const error = new Error(`verification did not finish within ${timeoutMs} ms`);
+      controller.abort(error);
+      reject(error);
+    }, timeoutMs);
+  });
+  try {
+    await Promise.race([
+      Promise.resolve().then(() => verify(candidate, controller.signal)),
+      deadline
+    ]);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    throw new Error(`[stitchkit] update: the new build failed verification — ${reason}`, {
+      cause: error
+    });
+  } finally {
+    clearTimeout(timer);
+    try {
+      unlinkSync(candidate);
+    } catch {}
+  }
+}
+function keepReplacedBinary(target, backupPath) {
+  if (!existsSync(target))
+    return;
+  const previous = readFileSync(target);
+  writeFileAtomicSync2(backupPath, previous, { mode: statSync(target).mode & 511 });
+  return { path: backupPath, sha256: createHash2("sha256").update(previous).digest("hex") };
+}
+function rollbackCliUpdate2(config) {
+  const target = config.targetPath ?? process.execPath;
+  if (!existsSync(config.backupPath)) {
+    throw new Error(`[stitchkit] rollback: no backup at ${config.backupPath}`);
+  }
+  const bytes = readFileSync(config.backupPath);
+  const sha256 = createHash2("sha256").update(bytes).digest("hex");
+  if (sha256 !== config.expectedSha256) {
+    throw new Error(`[stitchkit] rollback: backup digest ${sha256} does not match the expected ${config.expectedSha256} — refusing to restore it`);
+  }
+  writeFileAtomicSync2(target, bytes, { mode: statSync(config.backupPath).mode & 511 });
+  return { path: target, bytes: bytes.length, sha256 };
+}
+
+export { CliBuildSignatureSchema2, cliManifestSigningPayload2, signCliManifest2, verifyCliManifest2, cliSignatureAccepted2, CliBuildTargetSchema2, CliBuildAssetSchema2, CliBuildManifestSchema2, CliBuildStampSchema2, formatCliBuildStamp2, currentCliBuildTarget2, selectCliBuildAsset2, assertCliPublishable2, waitForPublication, withPublicationDeadline, collectCliBytes, gzipCliAsset, decodeCliAsset, compareCliVersions2, checkCliUpdate2, applyCliUpdate2, rollbackCliUpdate2 };