feat: continue unresolved runtime update maintenance

app/Commands/UpdatesMaintain.tsadded+23-0

Changes to app/Commands/UpdatesMaintain.ts

		@@ -0,0 +1,23 @@
	1	+import { defineCommand } from '@stacksjs/cli'
	2	+import { printAsync } from '../../resources/functions/cli/output'
	3	+import { storeCommandFailure, storeCommandReference, storeReferenceFlags } from '../../resources/functions/drone/updates/command'
	4	+import { continueRuntimeTrustMaintenance } from '../../resources/functions/drone/updates/store'
	5	+
	6	+export default defineCommand({
	7	+ name: 'updates:maintain <directory>',
	8	+ description: 'Explicitly retain an unresolved attempt and require fresh signed metadata verification without resetting trust',
	9	+ options: {
	10	+ ...storeReferenceFlags,
	11	+ '--attempt <id>': 'Exact unresolved attempt identity from independently pinned store readback',
	12	+ '--acknowledge-unresolved-inputs': 'Acknowledge that prior inputs remain unresolved and retained for investigation',
	13	+ '--repository <path>': 'Bounded offline metadata repository for full fresh verification',
	14	+ '--trusted-system-clock-source <name>': 'Audit label for the independently managed trusted system clock, not an attestation',
	15	+ },
	16	+ async handle(options, directory) {
	17	+ try {
	18	+ if (options.acknowledgeUnresolvedInputs !== true || typeof options.attempt !== 'string' || typeof options.repository !== 'string' || typeof options.trustedSystemClockSource !== 'string') throw new Error('Explicit attempt, acknowledgement, repository and trusted clock source required')
	19	+ await printAsync(JSON.stringify(await continueRuntimeTrustMaintenance({ ...storeCommandReference(options, directory), repository: options.repository, previousAttemptId: options.attempt, acknowledgeUnresolvedInputs: true, clock: { source: options.trustedSystemClockSource, read: () => new Date() } })))
	20	+ }
	21	+ catch { await storeCommandFailure() }
	22	+ },
	23	+})