toolroll 0.8.0 → 0.8.2

package/dist/toolroll-update-cli.js

@@ -11,7 +11,7 @@ import { installMethod } from "./install-method.js";
 import { isNewer, latestVersionNow } from "./releases.js";
 import { databasePath } from "./store.js";
 import { PACKAGE_VERSION } from "./version.js";
-import { currentRuntime, machineSystem, readRuntimeUpdate, requestRuntimeUpdateCancel, resumeRuntimeUpdate, retireUpdateJob, runtimeUpdateTerminal, startRuntimeRollback, startRuntimeUpdate, } from "./toolroll-update.js";
+import { currentRuntime, lastCompletedUpdate, machineSystem, readRuntimeUpdate, requestRuntimeUpdateCancel, resumeRuntimeUpdate, retireUpdateJob, startRuntimeRollback, startRuntimeUpdate, } from "./toolroll-update.js";
 /** Loaded on first use (as backup.ts and store.ts do), so modules that only import this one (the console,
  * and tests that load it in a browser-like environment) never need `node:sqlite` itself. */
 function sqlite() {
@@ -90,9 +90,13 @@ export async function runUpdateCommand(args, write, deps = {}) {
         write("This Toolroll runs from a source checkout. Update it with git; toolroll update replaces installed releases only.");
         return 1;
     }
+    if (method.kind === "desktop") {
+        write("This Toolroll is the Toolroll app, which updates as a whole app. Update it from the Toolroll app.");
+        return 1;
+    }
     if (has("rollback")) {
-        const last = readRuntimeUpdate(stateDir);
-        if (!last || last.kind !== "update" || last.phase !== "complete" || !runtimeUpdateTerminal(last.phase)) {
+        const last = lastCompletedUpdate(stateDir);
+        if (!last) {
             write("There is no completed update to roll back.");
             return 1;
         }

package/dist/toolroll-update-ui.d.ts

@@ -24,6 +24,8 @@ export type UpdatesView = {
         version: string;
         notes: string[];
     } | null;
+    /** The version `toolroll update --rollback` returns to: the last completed update's, while it is what runs. */
+    rollbackTo: string | null;
     csrf: string;
 };
 /** The steps, each done, current, failed or waiting. Also the live region's fragment. */

package/dist/toolroll-update-ui.js

@@ -59,17 +59,18 @@ export function updatesHtml(view, notice) {
     const newer = latest !== null && newerThan(latest, view.current);
     const state = view.method.kind === "npx" ? `<h2>Toolroll ${e(view.current)}</h2><p class="meta">npx runs the latest release each time, so this is current.</p>`
         : view.method.kind === "source" ? `<h2>Toolroll ${e(view.current)}</h2><p class="meta">This runs from a source checkout. Update it with git.</p>`
-            : newer ? `<h2>Toolroll ${e(latest)} is available</h2><p class="meta">You have ${e(view.current)}. Running work finishes first, and your current version is kept so you can go back.</p>`
-                : "off" in view.latest ? `<h2>Toolroll ${e(view.current)}</h2><p class="meta">Update checks are off.</p><form method="get" action="/settings/updates" class="update-actions"><input type="hidden" name="check" value="now"><button type="submit">Check now</button></form>`
-                    : latest === null ? `<h2>Toolroll ${e(view.current)}</h2><p class="meta">Couldn’t check for a newer release: ${e("problem" in view.latest ? view.latest.problem : "")}</p>`
-                        : `<h2>Toolroll ${e(view.current)} is up to date</h2>`;
-    const form = newer && !["npx", "source"].includes(view.method.kind)
+            : newer && view.method.kind === "desktop" ? `<h2>Toolroll ${e(latest)} is available</h2><p class="meta">You have ${e(view.current)}. Update it from the Toolroll app.</p>`
+                : newer ? `<h2>Toolroll ${e(latest)} is available</h2><p class="meta">You have ${e(view.current)}. Running work finishes first, and your current version is kept so you can go back.</p>`
+                    : "off" in view.latest ? `<h2>Toolroll ${e(view.current)}</h2><p class="meta">Update checks are off.</p><form method="get" action="/settings/updates" class="update-actions"><input type="hidden" name="check" value="now"><button type="submit">Check now</button></form>`
+                        : latest === null ? `<h2>Toolroll ${e(view.current)}</h2><p class="meta">Couldn’t check for a newer release: ${e("problem" in view.latest ? view.latest.problem : "")}</p>`
+                            : `<h2>Toolroll ${e(view.current)} is up to date</h2>`;
+    const form = newer && !["npx", "source", "desktop"].includes(view.method.kind)
         ? `<form method="post" action="/settings/updates">${csrf}<input type="hidden" name="version" value="${e(latest)}">` +
             `<label class="step-up">Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>` +
             `<div class="update-actions"><button type="submit" name="when" value="now" class="primary">Update now</button>` +
             `<button type="submit" name="when" value="when-idle">When idle</button><button type="submit" name="when" value="tonight">Tonight (03:00)</button></div></form>`
         : "";
-    const rollback = j?.kind === "update" && j.phase === "complete" ? `<p class="meta">To go back to ${e(j.from.version)}: <code>toolroll update --rollback</code></p>` : "";
+    const rollback = view.rollbackTo !== null ? `<p class="meta">To go back to ${e(view.rollbackTo)}: <code>toolroll update --rollback</code></p>` : "";
     return `<section class="updates">${note}${whatsNew}${j ? outcomeHtml(j) : ""}<div class="card" data-update-state="${newer ? "available" : "current"}">${state}${form}${rollback}</div></section>`;
 }
 export function newerThan(a, b) {

package/dist/toolroll-update.d.ts

@@ -2,6 +2,7 @@ import type { DatabaseSync } from "node:sqlite";
 import { type SupervisorRunner } from "./daemon.js";
 export declare const PROVENANCE_REPOSITORY = "https://github.com/ap9000/toolroll";
 export declare const PROVENANCE_WORKFLOW = ".github/workflows/publish.yml";
+export declare const PROVENANCE_ISSUER = "https://token.actions.githubusercontent.com";
 /** The steps a person sees, in order. */
 export declare const UPDATE_STEPS: readonly ["verifying", "draining", "backing-up", "rehearsing", "switching", "restarting", "health"];
 export type UpdateStep = typeof UPDATE_STEPS[number];
@@ -66,6 +67,13 @@ export type RuntimeUpdateJournal = {
         unit: string;
         pids: number[];
     };
+    /** Each repo's watch daemon that runs this version, recorded the same way: switched with the service, and stopped and
+     * restarted with it only when launchd had it loaded before the update (`loaded` absent: 0.8.1 stopped every one). */
+    watches?: {
+        unit: string;
+        pids: number[];
+        loaded?: boolean;
+    }[];
     /** Recorded before each change so a resumed or failed run knows what to put back. */
     switched?: {
         links: {
@@ -76,10 +84,21 @@ export type RuntimeUpdateJournal = {
             path: string;
             saved: string;
         } | null;
+        watches?: {
+            path: string;
+            saved: string;
+        }[];
         databaseRestored?: boolean;
     };
-    /** What the live database held when a failed run restored its backup: nothing written is lost. */
+    /** What the live database held when a failed run restored its backup: nothing written is lost. The newest of `kept`. */
     keptAside?: string;
+    /** The live database could not be read, so it was moved aside whole rather than copied. */
+    keptAsideUnreadable?: boolean;
+    /** Every copy kept aside, oldest first: a retried restore adds one and never drops the pointer to an earlier one. */
+    kept?: {
+        path: string;
+        unreadable: boolean;
+    }[];
     /** The restore put the backup back: a retried restore never puts it back again (what was written since belongs to
      * the restored version and would be lost), and it keeps a fresh copy aside before every attempt until then. */
     restoredDatabase?: boolean;
@@ -107,8 +126,18 @@ export type UpdateSystem = {
     commands: (from: RuntimeRef) => string[];
     /** The background service's definition, when one runs `from`. */
     serviceUnit: (from: RuntimeRef) => string | null;
+    /** Every repo's watch daemon definition that runs `from`. */
+    watchUnits: (from: RuntimeRef) => string[];
+    /** npm's own Sigstore verifier: the bundle's certificate chains to Sigstore, its signature is in the transparency
+     * log, and the certificate names exactly this identity. */
+    sigstore: (bundle: unknown, identity: {
+        issuer: string;
+        identity: string;
+    }) => Promise<void>;
     /** The processes the service runs now. */
     servicePids: (unit: string) => Promise<number[]>;
+    /** Whether launchd has the service loaded now. */
+    serviceLoaded: (unit: string) => Promise<boolean>;
     /** Unload the service; resolves once launchd no longer has it. */
     stopService: (unit: string) => Promise<void>;
     /** Load and start the service from its definition on disk. */
@@ -118,8 +147,11 @@ export type UpdateSystem = {
     healthTimeoutMs?: number;
     /** How long stopped service processes may take to exit. */
     exitTimeoutMs?: number;
-    /** Fault injection for state-machine tests, never selectable by a flag. */
-    checkpoint?: (phase: RuntimePhase) => void;
+    /** Bytes free for this user in the folder `dir` is on. */
+    freeBytes?: (dir: string) => number;
+    /** Fault injection for state-machine tests, never selectable by a flag. `kept-aside`: the live database was just
+     * kept aside, before the backup is put back. */
+    checkpoint?: (phase: RuntimePhase | "kept-aside") => void;
 };
 export type UpdateOutcome = {
     ok: boolean;
@@ -128,16 +160,23 @@ export type UpdateOutcome = {
     journal: RuntimeUpdateJournal | null;
 };
 export declare const runtimeUpdateTerminal: (phase: RuntimePhase) => boolean;
-export declare function readRuntimeUpdate(stateDir: string): RuntimeUpdateJournal | null;
+export declare function readRuntimeUpdate(stateDir: string, file?: string): RuntimeUpdateJournal | null;
+/** The update `--rollback` returns from: the last one that completed, whatever was attempted since. */
+export declare function lastCompletedUpdate(stateDir: string): RuntimeUpdateJournal | null;
 /** Running work by name, for a refusal a person can act on. */
 export declare function runningWorkWords(db: DatabaseSync): string | null;
-/** The npm provenance statement for exactly these bytes must name the
- * Toolroll repository and its publish workflow. Anything else is refused.
- * npm's own check (UpdateSystem.install) verifies the statement's signature. */
-export declare function checkProvenance(attestations: unknown, version: string, sha512Hex: string): {
+export type Provenance = {
     repository: string;
     workflow: string;
+    issuer: string;
+    identity: string;
+    bundle: unknown;
 };
+/** The npm provenance for exactly these bytes of Toolroll itself must be signed by a certificate that names the
+ * Toolroll repository, its publish workflow and GitHub Actions as the issuer. The statement's own claims name
+ * nobody: only the certificate, whose key must have signed the statement. Sigstore's chain and transparency log are
+ * then checked by npm's own verifier (UpdateSystem.sigstore) for the identity returned here. */
+export declare function checkProvenance(attestations: unknown, version: string, sha512Hex: string): Provenance;
 /** Headlines of this version's changelog section: its bold lead phrases. */
 export declare function releaseNotes(changelog: string, version: string): string[];
 /** Every rename here: what is renamed is flushed first (a file itself, a link
@@ -184,7 +223,10 @@ export declare function startRuntimeRollback(o: {
 export declare function resumeRuntimeUpdate(stateDir: string, system: UpdateSystem, id?: string): Promise<UpdateOutcome>;
 /** A prepared update whose job could not start. */
 export declare function abandonRuntimeUpdate(stateDir: string, id: string, why: string, now: Date): void;
-export declare function requestRuntimeUpdateCancel(stateDir: string): string;
+/** `locked`: a test's seam, called once the updater's lock is held and before the journal is read again. */
+export declare function requestRuntimeUpdateCancel(stateDir: string, now?: Date, seams?: {
+    locked?: () => void;
+}): string;
 /** Keep the newest release-* runtimes (and any in `keep`), at most KEEP_RUNTIMES; deploy-browser's browser-* and
  * the rollback-* records are not this updater's to remove. */
 export declare function pruneRuntimes(stateDir: string, keep: readonly string[]): string[];
@@ -196,30 +238,41 @@ export type RuntimeUpdateStatus = {
         version: string;
         notes: string[];
     } | null;
+    /** The last completed update `--rollback` returns from, whatever was attempted since. */
+    lastUpdate: {
+        from: string;
+        to: string;
+    } | null;
 };
 export declare function runtimeUpdateStatus(stateDir: string): RuntimeUpdateStatus;
 export declare function markWhatsNewSeen(stateDir: string): void;
 type Exec = (command: string, args: string[], options?: {
     cwd?: string;
     timeout?: number;
+    input?: string;
 }) => {
     status: number | null;
     stdout: string;
     stderr: string;
 };
 export declare function currentRuntime(version: string): RuntimeRef;
-/** Seams for tests: npm and ps (`exec`), launchctl (`run`), and process liveness. */
+/** Seams for tests: npm, node and ps (`exec`), launchctl (`run`), process liveness, and launchd's waits (`sleep`). */
 export type MachineSeams = {
     exec?: Exec;
     run?: SupervisorRunner;
     alive?: (pid: number) => boolean;
+    sleep?: (ms: number) => Promise<void>;
+    execPath?: string;
 };
 export declare function machineSystem(home?: string, env?: Record<string, string | undefined>, seams?: MachineSeams): UpdateSystem;
-/** The console starts the updater for one prepared journal as its own one-off
- * launchd job, so the service it restarts is not its parent. The job resumes
- * that id only; it does not run at login (no RunAtLoad: launchd starts it
- * with a kickstart) and removes its definition when it finishes. Elsewhere it
- * is a detached process. */
+/** npm's own Sigstore verifier. Found from npm itself (the `npm` on PATH, then the one beside node), never only from
+ * `npm root --global`: with a custom global prefix (npm's advice for permission errors) that folder holds the global
+ * packages, not npm. */
+export declare function findSigstoreVerifier(o: {
+    path: string;
+    execPath: string;
+    npmRoot: () => string | null;
+}): string | null;
 export declare function launchRuntimeUpdate(args: {
     databaseFile: string;
     id: string;
@@ -228,6 +281,7 @@ export declare function launchRuntimeUpdate(args: {
     home?: string;
     run?: SupervisorRunner;
     platform?: NodeJS.Platform;
+    npmBin?: () => Promise<string | null>;
 }): Promise<void>;
 /** The job's last act: its definition goes, so nothing can start it again. Only the definition for this id. */
 export declare function retireUpdateJob(id: string, home?: string): void;