ysk-server-core 1.0.0

package/dist/update/advisor.js

@@ -0,0 +1,117 @@
+/**
+ * Intelligent software update & vulnerability advice (structured, pure logic).
+ */
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+/**
+ * Derive structured update advice from inventory + advisory signals.
+ * Policy:
+ * - high/critical risk always requires human approval
+ * - low-risk security patches (no HIGH/CRITICAL CVE, no breaking) may auto-update
+ * - routine medium updates require approval
+ */
+export function adviseUpdate(item) {
+    if (!item.packageName || !item.currentVersion) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1417'), {
+            httpStatus: 400,
+        });
+    }
+    const candidate = item.candidateVersion ?? item.currentVersion;
+    const same = candidate === item.currentVersion;
+    const cves = item.knownCves ?? [];
+    let advice = 'skip';
+    let risk = 'low';
+    let requiresApproval = false;
+    let summary = same
+        ? tl('notes.auto.n0799')
+        : tl('notes.auto.n0943');
+    if (!same) {
+        const hasCritical = cves.some((c) => /CRITICAL/i.test(c));
+        const hasHigh = cves.some((c) => /HIGH/i.test(c));
+        if (hasCritical) {
+            advice = 'urgent';
+            risk = 'critical';
+            requiresApproval = true;
+            summary = tl('notes.auto.t0488', { v0: (item.currentVersion), v1: (candidate) });
+        }
+        else if (hasHigh) {
+            advice = 'update';
+            risk = 'high';
+            requiresApproval = true;
+            summary = tl('notes.auto.t0489', { v0: (item.currentVersion), v1: (candidate) });
+        }
+        else if (item.hasBreakingChange) {
+            advice = 'watch';
+            risk = 'high';
+            requiresApproval = true;
+            summary = tl('notes.auto.t0490', { v0: (item.currentVersion), v1: (candidate) });
+        }
+        else if (item.hasSecurityFix) {
+            advice = 'update';
+            risk = 'low';
+            requiresApproval = false;
+            summary = tl('notes.auto.t0491', { v0: (item.currentVersion), v1: (candidate) });
+        }
+        else {
+            advice = 'update';
+            risk = 'medium';
+            requiresApproval = true;
+            summary = tl('notes.auto.t0492', { v0: (item.currentVersion), v1: (candidate) });
+        }
+    }
+    else if (cves.length > 0) {
+        summary = tl('notes.auto.t0493', { v0: (cves.length) });
+        risk = cves.some((c) => /CRITICAL|HIGH/i.test(c)) ? 'high' : 'medium';
+        requiresApproval = true;
+        advice = 'watch';
+    }
+    // Invariant: high and critical always require approval
+    if (risk === 'high' || risk === 'critical') {
+        requiresApproval = true;
+    }
+    return {
+        packageName: item.packageName,
+        currentVersion: item.currentVersion,
+        candidateVersion: candidate,
+        advice,
+        risk,
+        cves,
+        requiresApproval,
+        summary,
+    };
+}
+/**
+ * Build public advisory lookup query descriptors (NVD / GHSA style).
+ */
+export function buildAdvisoryQueries(packageName, version) {
+    if (!packageName) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.n1416'), { httpStatus: 400 });
+    }
+    return [
+        { source: 'nvd', query: `cpe:2.3:a:*:${packageName}:${version}:*:*:*:*:*:*:*` },
+        { source: 'github-advisory', query: packageName },
+        { source: 'ubuntu-security', query: packageName },
+    ];
+}
+/**
+ * Plan package update execution with rollback hints.
+ */
+export function planUpdateExecution(item) {
+    const mode = item.requiresApproval ? 'approval' : 'auto';
+    return {
+        mode,
+        commands: [
+            `apt-get install -y --only-upgrade ${item.packageName}=${item.candidateVersion} || npm update -g ${item.packageName}@${item.candidateVersion}`,
+        ],
+        rollbackCommands: [
+            `apt-get install -y --allow-downgrades ${item.packageName}=${item.currentVersion} || npm install -g ${item.packageName}@${item.currentVersion}`,
+        ],
+        audit: {
+            package: item.packageName,
+            from: item.currentVersion,
+            to: item.candidateVersion,
+            advice: item.advice,
+            risk: item.risk,
+        },
+    };
+}
+//# sourceMappingURL=advisor.js.map

package/dist/update/advisor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisor.js","sourceRoot":"","sources":["../../src/update/advisor.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAC,MAAM,mBAAmB,CAAC;AAY5D;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAA0B;IACrD,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QAC9C,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAChE,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,cAAc,CAAC;IAC/D,MAAM,IAAI,GAAG,SAAS,KAAK,IAAI,CAAC,cAAc,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IAElC,IAAI,MAAM,GAAiB,MAAM,CAAC;IAClC,IAAI,IAAI,GAAa,KAAK,CAAC;IAC3B,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,OAAO,GAAG,IAAI;QAChB,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC;QACxB,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;IAE3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAElD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,GAAG,QAAQ,CAAC;YAClB,IAAI,GAAG,UAAU,CAAC;YAClB,gBAAgB,GAAG,IAAI,CAAC;YACxB,OAAO,GAAG,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,MAAM,GAAG,QAAQ,CAAC;YAClB,IAAI,GAAG,MAAM,CAAC;YACd,gBAAgB,GAAG,IAAI,CAAC;YACxB,OAAO,GAAG,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;aAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAClC,MAAM,GAAG,OAAO,CAAC;YACjB,IAAI,GAAG,MAAM,CAAC;YACd,gBAAgB,GAAG,IAAI,CAAC;YACxB,OAAO,GAAG,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;aAAM,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/B,MAAM,GAAG,QAAQ,CAAC;YAClB,IAAI,GAAG,KAAK,CAAC;YACb,gBAAgB,GAAG,KAAK,CAAC;YACzB,OAAO,GAAG,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,QAAQ,CAAC;YAClB,IAAI,GAAG,QAAQ,CAAC;YAChB,gBAAgB,GAAG,IAAI,CAAC;YACxB,OAAO,GAAG,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,GAAG,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QACtE,gBAAgB,GAAG,IAAI,CAAC;QACxB,MAAM,GAAG,OAAO,CAAC;IACnB,CAAC;IAED,uDAAuD;IACvD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QAC3C,gBAAgB,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,gBAAgB,EAAE,SAAS;QAC3B,MAAM;QACN,IAAI;QACJ,IAAI;QACJ,gBAAgB;QAChB,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,OAAe;IAEf,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO;QACL,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,WAAW,IAAI,OAAO,gBAAgB,EAAE;QAC/E,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE;QACjD,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE;KAClD,CAAC;AACJ,CAAC;AASD;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAmB;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE;YACR,qCAAqC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,gBAAgB,qBAAqB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,gBAAgB,EAAE;SAC/I;QACD,gBAAgB,EAAE;YAChB,yCAAyC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,cAAc,sBAAsB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,cAAc,EAAE;SAChJ;QACD,KAAK,EAAE;YACL,OAAO,EAAE,IAAI,CAAC,WAAW;YACzB,IAAI,EAAE,IAAI,CAAC,cAAc;YACzB,EAAE,EAAE,IAAI,CAAC,gBAAgB;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB;KACF,CAAC;AACJ,CAAC"}

package/dist/update/index.d.ts

@@ -0,0 +1,7 @@
+export * from './advisor.js';
+export * from './self-update.js';
+export * from './inventory.js';
+export * from './self-update-apply.js';
+export * from './package-apply.js';
+export * from './summary.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/update/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/update/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC"}

package/dist/update/index.js

@@ -0,0 +1,7 @@
+export * from './advisor.js';
+export * from './self-update.js';
+export * from './inventory.js';
+export * from './self-update-apply.js';
+export * from './package-apply.js';
+export * from './summary.js';
+//# sourceMappingURL=index.js.map

package/dist/update/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/update/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC"}

package/dist/update/inventory.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Package inventory — real host apt/dpkg data.
+ * candidateVersion comes from apt-cache policy / apt list --upgradable, never faked to current.
+ */
+import type { HostExecutor } from '../host/executor.js';
+import type { PackageInventoryItem } from './advisor.js';
+import type { UpdateItemDto } from 'ysk-server-shared';
+import type { SoftwareUpgradeInfo } from '../hosting/software-probe/index.js';
+export type InventoryCollectMeta = {
+    /** How candidates were resolved */
+    source: 'apt' | 'dpkg-only' | 'mixed';
+    upgradableCount: number;
+    notes: string[];
+};
+/**
+ * Collect installed packages + real upgrade candidates.
+ *
+ * 1) `apt list --upgradable` → known upgrades (best signal)
+ * 2) `dpkg-query` sample + `apt-cache policy` Candidate: for each
+ * 3) Never set candidate === current unless apt says so
+ */
+export declare function collectInventory(host: HostExecutor): Promise<{
+    items: PackageInventoryItem[];
+    meta: InventoryCollectMeta;
+}>;
+/**
+ * Produce structured update advice for inventory.
+ */
+export declare function adviseInventory(items: PackageInventoryItem[]): UpdateItemDto[];
+/**
+ * Catalog software upgrades via HostSoftwareProbe.upgrade (unified standard).
+ * Complements full-host collectInventory with product-scoped package status.
+ */
+export declare function collectCatalogSoftwareUpgrades(host: HostExecutor): Promise<SoftwareUpgradeInfo[]>;
+/**
+ * Query OSV.dev for a package (network). Returns CVE-like ids when available.
+ * Does not invent candidate versions — only annotates installed version vulns.
+ */
+export declare function lookupOsvVulns(packageName: string, version: string): Promise<string[]>;
+//# sourceMappingURL=inventory.d.ts.map

package/dist/update/inventory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory.d.ts","sourceRoot":"","sources":["../../src/update/inventory.ts"],"names":[],"mappings":"AACA;;;GAGG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAE9E,MAAM,MAAM,oBAAoB,GAAG;IACjC,mCAAmC;IACnC,MAAM,EAAE,KAAK,GAAG,WAAW,GAAG,OAAO,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC;IAClE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC9B,IAAI,EAAE,oBAAoB,CAAC;CAC5B,CAAC,CA2ID;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,aAAa,EAAE,CAE9E;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAKhC;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,EAAE,CAAC,CA0BnB"}

package/dist/update/inventory.js

@@ -0,0 +1,182 @@
+import { tl } from 'ysk-server-shared';
+import { adviseUpdate } from './advisor.js';
+import { HostSoftwareProbe } from '../hosting/software-probe/index.js';
+/**
+ * Collect installed packages + real upgrade candidates.
+ *
+ * 1) `apt list --upgradable` → known upgrades (best signal)
+ * 2) `dpkg-query` sample + `apt-cache policy` Candidate: for each
+ * 3) Never set candidate === current unless apt says so
+ */
+export async function collectInventory(host) {
+    const notes = [];
+    const byName = new Map();
+    // —— 1) Upgradable list (authoritative upgrade set) ——
+    // apt-get update mutates indexes and needs YSK_EXECUTE; apt list is read-only and works without it.
+    const refreshIndexes = host.executeEnabled();
+    const upScript = refreshIndexes
+        ? `apt-get update -qq 2>/dev/null || true; apt list --upgradable -qq 2>/dev/null | head -n 200`
+        : `apt list --upgradable -qq 2>/dev/null | head -n 200`;
+    if (!refreshIndexes) {
+        notes.push(tl('notes.auto.n1610'));
+    }
+    const up = await host.runCommand(['bash', '-c', upScript], {
+        dryRun: false,
+        // Keep read-only apt list bounded so CI/unit paths cannot hang 60s+ per call.
+        timeoutMs: refreshIndexes ? 120_000 : 20_000,
+    });
+    let upgradableCount = 0;
+    if (up.stdout.trim()) {
+        for (const line of up.stdout.trim().split('\n')) {
+            // e.g. openssl/jammy-updates 3.0.2-0ubuntu1.18 amd64 [upgradable from: 3.0.2-0ubuntu1.12]
+            const m = line.match(/^([a-zA-Z0-9.+_-]+)\/\S+\s+(\S+)\s+\S+\s+\[upgradable from:\s*([^\]]+)\]/);
+            if (!m)
+                continue;
+            const packageName = m[1];
+            const candidateVersion = m[2];
+            const currentVersion = m[3].trim();
+            if (!packageName || !candidateVersion || !currentVersion)
+                continue;
+            upgradableCount += 1;
+            byName.set(packageName, {
+                packageName,
+                currentVersion,
+                candidateVersion,
+                hasSecurityFix: /security/i.test(line),
+            });
+        }
+        if (upgradableCount > 0) {
+            notes.push(tl('notes.auto.t0463', { v0: (upgradableCount) }));
+        }
+    }
+    else {
+        notes.push(up.exitCode !== 0
+            ? tl('notes.auto.t0464', { v0: (up.exitCode) })
+            : tl('notes.auto.n0226'));
+    }
+    // —— 2) dpkg installed sample + apt-cache policy Candidate ——
+    // Single bash loop to avoid N round-trips
+    const policyScript = `
+set -e
+export LANG=C
+n=0
+while IFS=$'\\t' read -r name ver; do
+  [ -z "$name" ] && continue
+  [ "$name" = "nodejs" ] && continue
+  cand=$(apt-cache policy "$name" 2>/dev/null | awk '/^  Candidate:/{print $2; exit}')
+  if [ -z "$cand" ] || [ "$cand" = "(none)" ]; then
+    cand="$ver"
+  fi
+  printf '%s\\t%s\\t%s\\n' "$name" "$ver" "$cand"
+  n=$((n+1))
+  [ "$n" -ge 80 ] && break
+done < <(dpkg-query -W -f='\${Package}\\t\${Version}\\n' 2>/dev/null | head -n 80)
+`.trim();
+    const pol = await host.runCommand(['bash', '-c', policyScript], {
+        dryRun: false,
+        timeoutMs: 25_000,
+    });
+    let policyRows = 0;
+    if (pol.exitCode === 0 && pol.stdout.trim()) {
+        for (const line of pol.stdout.trim().split('\n')) {
+            const [name, ver, cand] = line.split('\t');
+            if (!name || !ver)
+                continue;
+            policyRows += 1;
+            const candidateVersion = cand && cand !== '(none)' && cand.trim() ? cand.trim() : ver;
+            const existing = byName.get(name);
+            if (existing) {
+                // Prefer upgradable parse for candidate; refresh current from dpkg if present
+                existing.currentVersion = ver;
+                if (!existing.candidateVersion ||
+                    existing.candidateVersion === existing.currentVersion) {
+                    existing.candidateVersion = candidateVersion;
+                }
+            }
+            else {
+                byName.set(name, {
+                    packageName: name,
+                    currentVersion: ver,
+                    candidateVersion,
+                });
+            }
+        }
+        notes.push(tl('notes.auto.t0465', { v0: (policyRows) }));
+    }
+    else {
+        notes.push(tl('notes.auto.t0466', { v0: (pol.exitCode) }));
+    }
+    // —— 3) nodejs: only if deb package exists; else note runtime only (no fake apt candidate) ——
+    const nodeDeb = byName.get('nodejs');
+    if (!nodeDeb) {
+        // Optional: show runtime as info-only when not an apt package — omit fake upgrade path
+        notes.push(tl('notes.auto.t0467', { v0: (process.version) }));
+    }
+    const items = [...byName.values()].sort((a, b) => {
+        const au = a.candidateVersion !== a.currentVersion ? 0 : 1;
+        const bu = b.candidateVersion !== b.currentVersion ? 0 : 1;
+        if (au !== bu)
+            return au - bu;
+        return a.packageName.localeCompare(b.packageName);
+    });
+    const realUpgrades = items.filter((i) => i.candidateVersion && i.candidateVersion !== i.currentVersion).length;
+    let source = 'mixed';
+    if (upgradableCount > 0 && policyRows > 0)
+        source = 'mixed';
+    else if (upgradableCount > 0)
+        source = 'apt';
+    else if (policyRows > 0)
+        source = 'dpkg-only';
+    else
+        source = 'dpkg-only';
+    notes.push(tl('notes.auto.t0468', { v0: (realUpgrades) }));
+    return {
+        items,
+        meta: { source, upgradableCount: realUpgrades, notes },
+    };
+}
+/**
+ * Produce structured update advice for inventory.
+ */
+export function adviseInventory(items) {
+    return items.map((i) => adviseUpdate(i));
+}
+/**
+ * Catalog software upgrades via HostSoftwareProbe.upgrade (unified standard).
+ * Complements full-host collectInventory with product-scoped package status.
+ */
+export async function collectCatalogSoftwareUpgrades(host) {
+    const probe = new HostSoftwareProbe(host);
+    // Only packages that are installed and may have apt candidates
+    const all = await probe.upgrades();
+    return all.filter((u) => u.installed);
+}
+/**
+ * Query OSV.dev for a package (network). Returns CVE-like ids when available.
+ * Does not invent candidate versions — only annotates installed version vulns.
+ */
+export async function lookupOsvVulns(packageName, version) {
+    try {
+        const res = await fetch('https://api.osv.dev/v1/query', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                package: { name: packageName, ecosystem: 'Debian' },
+                version,
+            }),
+            // Network-bound helper used by HTTP tests — never hang the suite.
+            signal: AbortSignal.timeout(5_000),
+        });
+        if (!res.ok)
+            return [];
+        const body = (await res.json());
+        return (body.vulns ?? []).slice(0, 10).map((v) => {
+            const sev = v.severity?.[0]?.score ?? '';
+            return `${v.id ?? 'UNKNOWN'} ${sev}`.trim();
+        });
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=inventory.js.map

package/dist/update/inventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory.js","sourceRoot":"","sources":["../../src/update/inventory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAQvC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAUvE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAkB;IAIvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEvD,uDAAuD;IACvD,oGAAoG;IACpG,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,cAAc;QAC7B,CAAC,CAAC,6FAA6F;QAC/F,CAAC,CAAC,qDAAqD,CAAC;IAC1D,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE;QACzD,MAAM,EAAE,KAAK;QACb,8EAA8E;QAC9E,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;KAC7C,CAAC,CAAC;IAEH,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,0FAA0F;YAC1F,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAClB,0EAA0E,CAC3E,CAAC;YACF,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;YAC1B,MAAM,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;YAC/B,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;YACpC,IAAI,CAAC,WAAW,IAAI,CAAC,gBAAgB,IAAI,CAAC,cAAc;gBAAE,SAAS;YACnE,eAAe,IAAI,CAAC,CAAC;YACrB,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE;gBACtB,WAAW;gBACX,cAAc;gBACd,gBAAgB;gBAChB,cAAc,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;aACvC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,QAAQ,KAAK,CAAC;YACf,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAC3B,CAAC;IACJ,CAAC;IAED,8DAA8D;IAC9D,0CAA0C;IAC1C,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;CAetB,CAAC,IAAI,EAAE,CAAC;IAEP,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE;QAC9D,MAAM,EAAE,KAAK;QACb,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;IAEH,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG;gBAAE,SAAS;YAC5B,UAAU,IAAI,CAAC,CAAC;YAChB,MAAM,gBAAgB,GACpB,IAAI,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,QAAQ,EAAE,CAAC;gBACb,8EAA8E;gBAC9E,QAAQ,CAAC,cAAc,GAAG,GAAG,CAAC;gBAC9B,IACE,CAAC,QAAQ,CAAC,gBAAgB;oBAC1B,QAAQ,CAAC,gBAAgB,KAAK,QAAQ,CAAC,cAAc,EACrD,CAAC;oBACD,QAAQ,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;gBAC/C,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE;oBACf,WAAW,EAAE,IAAI;oBACjB,cAAc,EAAE,GAAG;oBACnB,gBAAgB;iBACjB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAC/C,CAAC;IACJ,CAAC;IAED,8FAA8F;IAC9F,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,uFAAuF;QACvF,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAClD,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC/C,MAAM,EAAE,GAAG,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,EAAE,GAAG,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC9B,OAAO,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB,KAAK,CAAC,CAAC,cAAc,CACrE,CAAC,MAAM,CAAC;IAET,IAAI,MAAM,GAAmC,OAAO,CAAC;IACrD,IAAI,eAAe,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC;QAAE,MAAM,GAAG,OAAO,CAAC;SACvD,IAAI,eAAe,GAAG,CAAC;QAAE,MAAM,GAAG,KAAK,CAAC;SACxC,IAAI,UAAU,GAAG,CAAC;QAAE,MAAM,GAAG,WAAW,CAAC;;QACzC,MAAM,GAAG,WAAW,CAAC;IAE1B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAE3D,OAAO;QACL,KAAK;QACL,IAAI,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,KAAK,EAAE;KACvD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,KAA6B;IAC3D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,IAAkB;IAElB,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1C,+DAA+D;IAC/D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;IACnC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,WAAmB,EACnB,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,8BAA8B,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE;gBACnD,OAAO;aACR,CAAC;YACF,kEAAkE;YAClE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAK7B,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC/C,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;YACzC,OAAO,GAAG,CAAC,CAAC,EAAE,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/update/package-apply.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Apply apt package upgrade from panel — fail-closed, honest notes.
+ */
+import type { HostExecutor } from '../host/executor.js';
+import type { UpdateItemDto } from 'ysk-server-shared';
+export declare function applyPackageUpdate(input: {
+    host: HostExecutor;
+    item: UpdateItemDto;
+    /** Operator confirmed high-risk apply */
+    confirmHighRisk?: boolean;
+    onLog?: (ev: {
+        stream: 'stdout' | 'stderr';
+        line: string;
+    }) => void;
+    abortSignal?: AbortSignal;
+}): Promise<{
+    ok: boolean;
+    applied: boolean;
+    blocked?: boolean;
+    blockMessage?: string;
+    notes: string[];
+    commands: string[];
+    exitCode?: number;
+}>;
+export type PackageApplyResult = Awaited<ReturnType<typeof applyPackageUpdate>>;
+export type BatchPackageApplyItem = {
+    packageName: string;
+    currentVersion: string;
+    candidateVersion?: string;
+    risk?: string;
+    requiresApproval?: boolean;
+    cves?: string[];
+    summary?: string;
+};
+/**
+ * Sequential multi-package apply — never silent full-system apt upgrade.
+ * Caps batch size; each package uses the same fail-closed path as single apply.
+ */
+export declare function applyPackageUpdateBatch(input: {
+    host: HostExecutor;
+    items: BatchPackageApplyItem[];
+    confirmHighRisk?: boolean;
+    /** Max packages per request (default 40) */
+    limit?: number;
+    /** Build UpdateItemDto from inventory fields (inject adviseUpdate from caller) */
+    toItem: (row: BatchPackageApplyItem) => UpdateItemDto;
+    onLog?: (ev: {
+        stream: 'stdout' | 'stderr';
+        line: string;
+    }) => void;
+    abortSignal?: AbortSignal;
+    /** Fired after each package (for SSE progress) */
+    onItemDone?: (row: {
+        packageName: string;
+        ok: boolean;
+        applied: boolean;
+        index: number;
+        total: number;
+    }) => void;
+}): Promise<{
+    ok: boolean;
+    appliedCount: number;
+    failedCount: number;
+    results: Array<{
+        packageName: string;
+        ok: boolean;
+        applied: boolean;
+        blocked?: boolean;
+        blockMessage?: string;
+        notes: string[];
+    }>;
+    notes: string[];
+}>;
+//# sourceMappingURL=package-apply.d.ts.map

package/dist/update/package-apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-apply.d.ts","sourceRoot":"","sources":["../../src/update/package-apply.ts"],"names":[],"mappings":"AACA;;GAEG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,aAAa,CAAC;IACpB,yCAAyC;IACzC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE;QAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACpE,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC,CAoID;AAED,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC;AAEhF,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,MAAM,EAAE,CAAC,GAAG,EAAE,qBAAqB,KAAK,aAAa,CAAC;IACtD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE;QAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACpE,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,kDAAkD;IAClD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,EAAE,EAAE,OAAO,CAAC;QACZ,OAAO,EAAE,OAAO,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;KACf,KAAK,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,KAAK,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,EAAE,EAAE,OAAO,CAAC;QACZ,OAAO,EAAE,OAAO,CAAC;QACjB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,CAAC;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC,CA0ED"}

package/dist/update/package-apply.js

@@ -0,0 +1,188 @@
+import { tl } from 'ysk-server-shared';
+import { withHostMutatingJob } from '../host/host-job.js';
+import { planUpdateExecution } from './advisor.js';
+export async function applyPackageUpdate(input) {
+    const plan = planUpdateExecution(input.item);
+    const notes = [...Object.entries(plan.audit).map(([k, v]) => `${k}=${v}`)];
+    notes.push(`mode=${plan.mode}`);
+    if (plan.mode === 'approval' && !input.confirmHighRisk) {
+        return {
+            ok: false,
+            applied: false,
+            blocked: true,
+            blockMessage: tl('notes.auto.n1038'),
+            notes: [...notes, tl('notes.auto.n0771')],
+            commands: plan.commands,
+        };
+    }
+    if (!input.host.executeEnabled()) {
+        return {
+            ok: false,
+            applied: false,
+            blocked: true,
+            blockMessage: tl('ops.blocked.needExecuteShort'),
+            notes: [...notes, tl('ops.blocked.needExecuteBlocked')],
+            commands: plan.commands,
+        };
+    }
+    if (!input.host.isRoot()) {
+        return {
+            ok: false,
+            applied: false,
+            blocked: true,
+            blockMessage: tl('notes.auto.n0642'),
+            notes: [...notes, tl('notes.auto.n0772')],
+            commands: plan.commands,
+        };
+    }
+    const pkg = input.item.packageName.replace(/[^a-zA-Z0-9.+_-]/g, '');
+    if (!pkg || pkg !== input.item.packageName) {
+        return {
+            ok: false,
+            applied: false,
+            notes: [tl('notes.auto.n0640')],
+            commands: plan.commands,
+        };
+    }
+    const rawCand = (input.item.candidateVersion ?? '').trim();
+    const cand = rawCand.replace(/[^a-zA-Z0-9.+~:_-]/g, '');
+    const hasCand = Boolean(cand) &&
+        cand === rawCand &&
+        cand !== input.item.currentVersion;
+    if (!hasCand) {
+        return {
+            ok: false,
+            applied: false,
+            blocked: true,
+            blockMessage: !rawCand || rawCand === input.item.currentVersion
+                ? tl('notes.auto.n1048')
+                : tl('notes.auto.n0234'),
+            notes: [...notes, tl('notes.auto.n0770')],
+            commands: [],
+        };
+    }
+    // Exact candidate only — never fall back to unversioned upgrade (wrong version risk)
+    const cmd = `export DEBIAN_FRONTEND=noninteractive; apt-get install -y --only-upgrade ${JSON.stringify(pkg)}=${JSON.stringify(cand)} 2>&1`;
+    // Serialize with runtime PHP/apt installs to avoid dpkg lock races
+    return withHostMutatingJob(async () => {
+        input.onLog?.({
+            stream: 'stdout',
+            line: `YSK_APT_UPGRADE ${pkg}=${cand}`,
+        });
+        const r = await input.host.runCommand(['bash', '-c', cmd], {
+            timeoutMs: 300_000,
+            onChunk: input.onLog
+                ? (c) => input.onLog({ stream: c.stream, line: c.text })
+                : undefined,
+            signal: input.abortSignal,
+        });
+        const out = ((r.stdout || '') + (r.stderr || '')).slice(0, 800);
+        // Honest applied: exit 0 alone is not enough — verify dpkg version matches candidate
+        const verR = await input.host.runCommand([
+            'bash',
+            '-c',
+            `dpkg-query -W -f='\${Version}' ${JSON.stringify(pkg)} 2>/dev/null || true`,
+        ], { timeoutMs: 15_000 });
+        const installedNow = (verR.stdout || '').trim();
+        const versionMatches = (have, want) => {
+            if (!have || !want)
+                return false;
+            if (have === want)
+                return true;
+            // Epoch-tolerant: "2:1.0-1" vs "1.0-1"
+            const stripEpoch = (v) => v.replace(/^\d+:/, '');
+            return stripEpoch(have) === stripEpoch(want);
+        };
+        const versionOk = versionMatches(installedNow, cand) || versionMatches(installedNow, rawCand);
+        const cmdOk = r.exitCode === 0;
+        const applied = cmdOk && versionOk;
+        const ok = applied;
+        if (cmdOk && !versionOk) {
+            notes.push(tl('notes.auto.t0462', { v0: r.exitCode }), `verify_failed: dpkg=${installedNow || '(none)'} wanted=${cand}`);
+        }
+        return {
+            ok,
+            applied,
+            notes: [
+                ...notes,
+                tl('notes.auto.t0460', { v0: input.item.currentVersion, v1: cand }),
+                applied
+                    ? tl('notes.auto.t0461', { v0: pkg })
+                    : tl('notes.auto.t0462', { v0: r.exitCode }),
+                installedNow ? `dpkg_now=${installedNow}` : 'dpkg_now=(none)',
+                out.slice(0, 400),
+            ],
+            commands: [cmd],
+            exitCode: r.exitCode,
+        };
+    });
+}
+/**
+ * Sequential multi-package apply — never silent full-system apt upgrade.
+ * Caps batch size; each package uses the same fail-closed path as single apply.
+ */
+export async function applyPackageUpdateBatch(input) {
+    const limit = Math.min(Math.max(input.limit ?? 40, 1), 40);
+    const slice = (input.items ?? []).slice(0, limit);
+    const results = [];
+    const notes = [];
+    if (!slice.length) {
+        return {
+            ok: false,
+            appliedCount: 0,
+            failedCount: 0,
+            results: [],
+            notes: [tl('notes.auto.n0640')],
+        };
+    }
+    let appliedCount = 0;
+    let failedCount = 0;
+    let index = 0;
+    for (const row of slice) {
+        if (input.abortSignal?.aborted) {
+            notes.push('batch aborted');
+            break;
+        }
+        index += 1;
+        const item = input.toItem(row);
+        input.onLog?.({
+            stream: 'stdout',
+            line: `YSK_BATCH ${index}/${slice.length} ${item.packageName}`,
+        });
+        const r = await applyPackageUpdate({
+            host: input.host,
+            item,
+            confirmHighRisk: input.confirmHighRisk,
+            onLog: input.onLog,
+            abortSignal: input.abortSignal,
+        });
+        if (r.ok && r.applied)
+            appliedCount += 1;
+        else
+            failedCount += 1;
+        input.onItemDone?.({
+            packageName: item.packageName,
+            ok: r.ok,
+            applied: r.applied,
+            index,
+            total: slice.length,
+        });
+        results.push({
+            packageName: item.packageName,
+            ok: r.ok,
+            applied: r.applied,
+            blocked: r.blocked,
+            blockMessage: r.blockMessage,
+            notes: r.notes,
+        });
+    }
+    notes.push(`batch=${slice.length} applied=${appliedCount} failed=${failedCount}`);
+    return {
+        ok: failedCount === 0 && appliedCount > 0,
+        appliedCount,
+        failedCount,
+        results,
+        notes,
+    };
+}
+//# sourceMappingURL=package-apply.js.map