feat: package atomic reversible nginx releases

scripts/deploy/lib/release-transaction.d.mts

@@ -0,0 +1,34 @@
+export interface TransactionInput {
+  root: string;
+  archivePath: string;
+  transactionId: string;
+  verifierModulePath: string;
+  trustPolicyPath: string;
+  uid: number;
+  gid: number;
+  now?: string;
+  clock?: () => string;
+  verifySignedReleaseEnvelope?: (input: any) => any;
+  smokeCheck?: (input: { releaseDir: string; manifestDigest: string }) => Promise<Uint8Array>;
+  smokeCommand?: string;
+  expectedCurrentManifestDigest?: string | null;
+  expectedFence?: number;
+  crashPoint?: 'before-swap' | 'after-swap';
+  targetReleaseId?: string;
+}
+
+export interface ControlState {
+  schema: 'portfolio-release-control-state/v1';
+  currentManifestDigest: string | null;
+  currentReleaseId: string | null;
+  publisherFence: number;
+  latestLedgerHeadHash: string;
+  latestLedgerRevision: number;
+  activeTransaction: null | Record<string, unknown>;
+}
+
+export function readControlState(root: string): Promise<ControlState>;
+export function prepareRelease(input: TransactionInput): Promise<Record<string, unknown>>;
+export function activateRelease(input: TransactionInput): Promise<Record<string, any>>;
+export function rollbackRelease(input: TransactionInput): Promise<Record<string, any>>;
+export function cleanupOrphanStages(root: string): Promise<string[]>;