@eudiplo/cli 8.0.1 → 8.0.2-main.4c3e735

package/dist/index.js

@@ -2980,7 +2980,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve7.call(this, root, ref);
+      let _sch = resolve9.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a2 = root.localRefs) === null || _a2 === void 0 ? void 0 : _a2[ref];
         const { schemaId } = this.opts;
@@ -3007,7 +3007,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve7(root, ref) {
+    function resolve9(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -3832,7 +3832,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve7(baseURI, relativeURI, options) {
+    function resolve9(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const {
         parsed: baseParsed,
@@ -4194,7 +4194,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve7,
+      resolve: resolve9,
       resolveComponent,
       equal,
       serialize,
@@ -13617,6 +13617,10 @@ function requiredSchemaFiles() {
 // src/sea-assets.ts
 import { readFile as readFile2 } from "node:fs/promises";
 import { getAsset, isSea } from "node:sea";
+var templatesBaseUrl = new URL("../templates/", import.meta.url);
+function templateAssetUrl(relativePath) {
+  return new URL(relativePath, templatesBaseUrl);
+}
 async function readCliTextAsset(assetKey, fileUrl) {
   if (isSea()) {
     return getAsset(assetKey, "utf8");
@@ -13665,10 +13669,7 @@ async function loadBundledConfigSchemaTexts() {
   for (const schemaFile of manifest) {
     const text = await readCliTextAsset(
       `templates/schemas/${schemaFile}`,
-      () => new URL(
-        `../../../../templates/schemas/${schemaFile}`,
-        import.meta.url
-      )
+      () => templateAssetUrl(`schemas/${schemaFile}`)
     );
     schemas.set(schemaFile, text);
   }
@@ -13677,10 +13678,7 @@ async function loadBundledConfigSchemaTexts() {
 async function readSchemaManifest() {
   const text = await readCliTextAsset(
     manifestAssetKey,
-    () => new URL(
-      "../../../../templates/schemas.manifest.json",
-      import.meta.url
-    )
+    () => templateAssetUrl("schemas.manifest.json")
   );
   const parsed = JSON.parse(text);
   if (!Array.isArray(parsed) || !parsed.every((item) => typeof item === "string")) {
@@ -20635,7 +20633,7 @@ function resolveImageTag(imageTagOverride) {
 async function createComposeFile() {
   return readCliTextAsset(
     "templates/docker-compose.yml",
-    new URL("../../templates/docker-compose.yml", import.meta.url)
+    templateAssetUrl("docker-compose.yml")
   );
 }
 function createNoClientComposeOverride() {
@@ -20662,10 +20660,7 @@ async function copyBundledDemoConfig(targetDirectory, force) {
       });
       const contents = await readCliBinaryAsset(
         `templates/demo-config/${normalized}`,
-        new URL(
-          `../../templates/demo-config/${normalized}`,
-          import.meta.url
-        )
+        templateAssetUrl(`demo-config/${normalized}`)
       );
       await writeFile3(destinationPath, contents, { mode: 384 });
     }
@@ -20693,10 +20688,7 @@ async function readDemoConfigManifest() {
   try {
     const manifestText = await readCliTextAsset(
       demoConfigManifestAssetKey,
-      new URL(
-        "../../templates/demo-config.manifest.json",
-        import.meta.url
-      )
+      templateAssetUrl("demo-config.manifest.json")
     );
     const parsed = JSON.parse(manifestText);
     if (Array.isArray(parsed) && parsed.every((item) => typeof item === "string")) {
@@ -20705,10 +20697,7 @@ async function readDemoConfigManifest() {
   } catch {
     try {
       const localManifest = await readFile6(
-        new URL(
-          "../../templates/demo-config.manifest.json",
-          import.meta.url
-        ),
+        templateAssetUrl("demo-config.manifest.json"),
         "utf8"
       );
       const parsed = JSON.parse(localManifest);
@@ -21561,8 +21550,107 @@ function createConfigCommand(context, setExitCode) {
 
 // src/services/deployment-drivers.ts
 import { access as access2, mkdir as mkdir6, rm as rm4, stat as stat2, unlink as unlink2, writeFile as writeFile5 } from "node:fs/promises";
-import { delimiter, join as join10, resolve as resolve5 } from "node:path";
+import { delimiter, join as join10, resolve as resolve6 } from "node:path";
 import { spawn } from "node:child_process";
+
+// src/services/compose-args.ts
+import { resolve as resolve5 } from "node:path";
+var SERVICE_NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/;
+var DURATION = /^(\d+(\.\d+)?(ns|us|µs|ms|s|m|h))+$/;
+var TIMESTAMP = /^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})?)?$/;
+function assertServiceName(service) {
+  if (!SERVICE_NAME.test(service)) {
+    throw new Error(
+      `Invalid service name ${JSON.stringify(service)}. Service names start with a letter or digit and contain only letters, digits, ".", "_" and "-".`
+    );
+  }
+}
+function assertSince(since) {
+  const isDuration = DURATION.test(since);
+  const isTimestamp = TIMESTAMP.test(since) && !Number.isNaN(Date.parse(since));
+  if (!isDuration && !isTimestamp) {
+    throw new Error(
+      `Invalid --since value ${JSON.stringify(since)}. Use a duration such as 10m or 2h30m, or a timestamp such as 2026-09-01T12:00:00Z.`
+    );
+  }
+}
+function assertTail(tail) {
+  if (!Number.isInteger(tail) || tail < 0) {
+    throw new Error("--tail must be a whole number of lines, 0 or more.");
+  }
+}
+function buildComposeBaseArgs(instance, projectDirectory, composeFiles) {
+  const args = ["compose"];
+  if (instance.envFile) {
+    args.push("--env-file", resolve5(projectDirectory, instance.envFile));
+  }
+  for (const composeFile of composeFiles) {
+    args.push("-f", resolve5(projectDirectory, composeFile));
+  }
+  for (const profile of instance.composeProfiles ?? []) {
+    args.push("--profile", profile);
+  }
+  if (instance.projectName) {
+    args.push("--project-name", instance.projectName);
+  }
+  return args;
+}
+function buildComposePsArgs() {
+  return ["ps"];
+}
+function buildComposeListServicesArgs() {
+  return ["config", "--services"];
+}
+function buildComposeLogsArgs(service, options = {}) {
+  const args = ["logs"];
+  if (options.follow === true) {
+    args.push("--follow");
+  }
+  if (options.tail !== void 0) {
+    assertTail(options.tail);
+    args.push("--tail", String(options.tail));
+  }
+  if (options.since !== void 0) {
+    assertSince(options.since);
+    args.push("--since", options.since);
+  }
+  if (service !== void 0) {
+    assertServiceName(service);
+    args.push(service);
+  }
+  return args;
+}
+function buildComposePullArgs(service) {
+  const args = ["pull"];
+  if (service !== void 0) {
+    assertServiceName(service);
+    args.push(service);
+  }
+  return args;
+}
+function buildComposeUpArgs() {
+  return ["up", "-d"];
+}
+function buildComposeRestartArgs(service) {
+  const args = ["restart"];
+  if (service !== void 0) {
+    assertServiceName(service);
+    args.push(service);
+  }
+  return args;
+}
+function parseServiceList(stdout) {
+  return stdout.split(/\r?\n/).map((line) => line.trim()).filter((line) => SERVICE_NAME.test(line)).sort();
+}
+function assertKnownService(service, known) {
+  if (!known.includes(service)) {
+    throw new Error(
+      `Unknown service ${service}. Services in this project: ${known.join(", ") || "none"}.`
+    );
+  }
+}
+
+// src/services/deployment-drivers.ts
 var drivers = {
   compose: {
     target: "compose",
@@ -21578,7 +21666,7 @@ var drivers = {
       for (const composeFile of getComposeFiles(instance)) {
         let found = true;
         try {
-          await access2(resolve5(projectDirectory, composeFile));
+          await access2(resolve6(projectDirectory, composeFile));
         } catch {
           found = false;
         }
@@ -21596,8 +21684,41 @@ var drivers = {
     down(options) {
       return runCompose(["down", ...options.args], options);
     },
-    logs(options) {
-      return runCompose(["logs", "-f", ...options.args], options);
+    async logs(options) {
+      const service = await resolveComposeService(options);
+      const { follow, tail } = readLogOptions(options.flags);
+      const since = typeof options.flags.since === "string" ? options.flags.since : void 0;
+      return runCompose(
+        [
+          ...buildComposeLogsArgs(service, { follow, tail, since }),
+          ...options.args
+        ],
+        options
+      );
+    },
+    async ps(options) {
+      return runCompose(
+        [...buildComposePsArgs(), ...options.args],
+        options
+      );
+    },
+    async pull(options) {
+      const service = await resolveComposeService(options);
+      return runCompose(
+        [...buildComposePullArgs(service), ...options.args],
+        options
+      );
+    },
+    async restart(options) {
+      assertWritable(options);
+      const service = await resolveComposeService(options);
+      const restartArgs = buildComposeRestartArgs(service);
+      const runtime = await resolveComposeRuntime(options.context.env);
+      options.context.stdout.write(
+        `Restarting ${service ?? "all services"} of ${options.instanceName}${runtime ? ` with ${runtime.name} compose` : ""}
+`
+      );
+      return runCompose([...restartArgs, ...options.args], options);
     }
   },
   external: {
@@ -21617,7 +21738,11 @@ var drivers = {
       );
       return runKubectl(
         [
-          ...buildLogsArgs(scope, workload, readLogOptions(options.flags)),
+          ...buildLogsArgs(
+            scope,
+            workload,
+            readLogOptions(options.flags)
+          ),
           ...options.args
         ],
         options
@@ -21645,14 +21770,17 @@ var drivers = {
         [...buildRestartArgs(scope, workload), ...options.args],
         options
       );
-      if (restarted !== 0 || options.flags.wait === false) {
+      if (restarted !== 0 || options.flags["no-wait"] === true) {
         return restarted;
       }
       return runKubectl(buildRolloutStatusArgs(scope, workload), options);
     }
   }
 };
-function assertWritable({ instance, instanceName }) {
+function assertWritable({
+  instance,
+  instanceName
+}) {
   if (instance.readOnly === true) {
     throw new Error(
       `Instance ${instanceName} is registered read-only. Re-register it without --read-only to allow changes.`
@@ -21858,7 +21986,10 @@ function unreadyEndpoints(stdout) {
       (endpoint) => isRecord3(endpoint) && // An omitted ready condition means ready, per the API contract.
       (!isRecord3(endpoint.conditions) || endpoint.conditions.ready !== false)
     );
-    readyByService.set(service, (readyByService.get(service) ?? false) || ready);
+    readyByService.set(
+      service,
+      (readyByService.get(service) ?? false) || ready
+    );
   }
   return [...readyByService.entries()].filter(([, ready]) => !ready).map(([service]) => service).sort();
 }
@@ -21986,7 +22117,7 @@ async function ensureComposeProject(cwd, options) {
     composeProfiles: composeProfiles(options),
     envFile: envFileName,
     projectName: mode === "demo" ? "eudiplo-demo" : "eudiplo",
-    projectDirectory: resolve5(cwd)
+    projectDirectory: resolve6(cwd)
   };
 }
 async function ensureProjectDirectory(directory) {
@@ -22040,23 +22171,14 @@ function unsupportedCommand(command, target) {
 }
 async function runCompose(args, { instance, context }) {
   const projectDirectory = instance.projectDirectory ?? context.cwd;
-  const composeArgs = ["compose"];
-  if (instance.envFile) {
-    composeArgs.push(
-      "--env-file",
-      resolve5(projectDirectory, instance.envFile)
-    );
-  }
-  for (const composeFile of getComposeFiles(instance)) {
-    composeArgs.push("-f", resolve5(projectDirectory, composeFile));
-  }
-  for (const profile of instance.composeProfiles ?? []) {
-    composeArgs.push("--profile", profile);
-  }
-  if (instance.projectName) {
-    composeArgs.push("--project-name", instance.projectName);
-  }
-  composeArgs.push(...args);
+  const composeArgs = [
+    ...buildComposeBaseArgs(
+      instance,
+      projectDirectory,
+      getComposeFiles(instance)
+    ),
+    ...args
+  ];
   const composeRuntime = await resolveComposeRuntime(context.env);
   if (!composeRuntime) {
     context.stderr.write(
@@ -22078,6 +22200,64 @@ async function runCompose(args, { instance, context }) {
     child.on("close", (code) => resolveProcess(code ?? 1));
   });
 }
+async function captureCompose(args, { instance, context }) {
+  const projectDirectory = instance.projectDirectory ?? context.cwd;
+  const composeRuntime = await resolveComposeRuntime(context.env);
+  if (!composeRuntime) {
+    throw new Error(
+      "Docker or Podman was not found in a supported install location."
+    );
+  }
+  const composeArgs = [
+    ...buildComposeBaseArgs(
+      instance,
+      projectDirectory,
+      getComposeFiles(instance)
+    ),
+    ...args
+  ];
+  return new Promise((resolveProcess) => {
+    const child = spawn(composeRuntime.command, composeArgs, {
+      cwd: projectDirectory,
+      env: context.env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (chunk) => {
+      stdout += String(chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += String(chunk);
+    });
+    child.on(
+      "error",
+      (error) => resolveProcess({ code: 1, stdout, stderr: error.message })
+    );
+    child.on(
+      "close",
+      (code) => resolveProcess({ code: code ?? 1, stdout, stderr })
+    );
+  });
+}
+async function resolveComposeService(options) {
+  const service = readServiceFlag(options.flags);
+  if (service === void 0) {
+    return void 0;
+  }
+  assertServiceName(service);
+  const listed = await captureCompose(
+    buildComposeListServicesArgs(),
+    options
+  );
+  if (listed.code !== 0) {
+    throw new Error(
+      `Could not list Compose services: ${listed.stderr.trim() || `exit code ${listed.code}`}`
+    );
+  }
+  assertKnownService(service, parseServiceList(listed.stdout));
+  return service;
+}
 async function resolveComposeRuntime(env) {
   const preferredRuntime = parsePreferredRuntime(
     env.EUDIPLO_CONTAINER_RUNTIME
@@ -22175,7 +22355,7 @@ async function removeIfExists(path2) {
 }
 
 // src/services/project-directory.ts
-import { resolve as resolve6 } from "node:path";
+import { resolve as resolve7 } from "node:path";
 function resolveProjectDirectory(parsed, context, promptedDirectory) {
   const positionalDirectory = parsed.subject;
   const flagDirectory = readStringFlag(parsed.flags, "directory");
@@ -22187,7 +22367,7 @@ function resolveProjectDirectory(parsed, context, promptedDirectory) {
       "Specify the project directory either positionally or with --directory."
     );
   }
-  return resolve6(
+  return resolve7(
     context.cwd,
     positionalDirectory ?? flagDirectory ?? promptedDirectory ?? "."
   );
@@ -22313,45 +22493,52 @@ var descriptions = {
   down: "Stop the selected Compose deployment",
   logs: "Stream logs for the selected deployment",
   ps: "List the running containers or pods for the selected deployment",
-  restart: "Restart the workloads of the selected deployment"
+  restart: "Restart the workloads of the selected deployment",
+  pull: "Download the configured images without changing configuration"
 };
 var serviceScoped = /* @__PURE__ */ new Set([
   "logs",
-  "restart"
+  "restart",
+  "pull"
 ]);
 function createDeploymentCommands(context, setExitCode) {
-  return ["up", "down", "logs", "ps", "restart"].map((name) => {
-    const command = new Command(name).description(descriptions[name]).argument(
-      "[args...]",
-      "additional arguments passed to the deployment runtime"
-    ).option("--instance <name>", "select a configured instance");
-    if (serviceScoped.has(name)) {
-      command.option(
-        "--service <name>",
-        "select a configured workload (Kubernetes instances)"
-      );
-    }
-    if (name === "logs") {
-      command.option("--follow", "stream new output as it arrives").option("--tail <lines>", "number of recent lines to show");
-    }
-    if (name === "restart") {
-      command.option(
-        "--no-wait",
-        "return without waiting for the rollout to finish"
-      );
+  return ["up", "down", "logs", "ps", "restart", "pull"].map(
+    (name) => {
+      const command = new Command(name).description(descriptions[name]).argument(
+        "[args...]",
+        "additional arguments passed to the deployment runtime"
+      ).option("--instance <name>", "select a configured instance");
+      if (serviceScoped.has(name)) {
+        command.option(
+          "--service <name>",
+          "select a single service (Compose) or configured workload (Kubernetes)"
+        );
+      }
+      if (name === "logs") {
+        command.option("--follow", "stream new output as it arrives").option("--tail <lines>", "number of recent lines to show").option(
+          "--since <time>",
+          "show logs since a duration (10m, 2h) or timestamp (Compose instances)"
+        );
+      }
+      if (name === "restart") {
+        command.option(
+          "--no-wait",
+          "return without waiting for the rollout to finish (Kubernetes instances)"
+        );
+      }
+      return command.action(async (args, options) => {
+        const { config } = await loadCliState(context);
+        setExitCode(
+          await runDriverCommand(
+            config,
+            name,
+            parsedArgs(name, void 0, args, options),
+            context
+          )
+        );
+      });
     }
-    return command.action(async (args, options) => {
-      const { config } = await loadCliState(context);
-      setExitCode(
-        await runDriverCommand(
-          config,
-          name,
-          parsedArgs(name, void 0, args, options),
-          context
-        )
-      );
-    });
-  });
+  );
 }
 
 // src/services/diagnostics.ts
@@ -23031,6 +23218,146 @@ function createInstanceCommand(context, setExitCode) {
   return instance;
 }
 
+// src/services/browser.ts
+import { spawn as spawn2 } from "node:child_process";
+import { access as access3 } from "node:fs/promises";
+import { delimiter as delimiter2, join as join11 } from "node:path";
+function assertWebUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`${value} is not a valid absolute URL.`);
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error(
+      `Refusing to open ${value}: only http and https URLs are supported.`
+    );
+  }
+  return url;
+}
+async function chooseLauncher(url, { platform, env, which }) {
+  const browser = env.BROWSER?.trim();
+  if (browser && !/\s|%s/.test(browser)) {
+    const command = await which(browser);
+    if (command) {
+      return { command, args: [url] };
+    }
+  }
+  if (platform === "darwin") {
+    return { command: "open", args: [url] };
+  }
+  if (platform === "win32") {
+    return {
+      command: "rundll32.exe",
+      args: ["url.dll,FileProtocolHandler", url]
+    };
+  }
+  if (env.WSL_DISTRO_NAME) {
+    const wslview = await which("wslview");
+    if (wslview) {
+      return { command: wslview, args: [url] };
+    }
+  }
+  if (env.DISPLAY || env.WAYLAND_DISPLAY) {
+    const xdgOpen = await which("xdg-open");
+    if (xdgOpen) {
+      return { command: xdgOpen, args: [url] };
+    }
+  }
+  return void 0;
+}
+function launchBrowser(launcher) {
+  return new Promise((resolveLaunch) => {
+    const child = spawn2(launcher.command, launcher.args, {
+      detached: true,
+      stdio: "ignore"
+    });
+    child.once("error", () => resolveLaunch(false));
+    child.once("spawn", () => {
+      child.unref();
+      resolveLaunch(true);
+    });
+  });
+}
+function pathLookup(env, platform = process.platform) {
+  const extensions = platform === "win32" ? ["", ...(env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";")] : [""];
+  return async (name) => {
+    const entries = (env.PATH ?? "").split(delimiter2).filter(Boolean);
+    for (const entry of entries) {
+      for (const extension of extensions) {
+        const candidate = join11(entry, `${name}${extension}`);
+        try {
+          await access3(candidate);
+          return candidate;
+        } catch {
+        }
+      }
+    }
+    return void 0;
+  };
+}
+
+// src/commands/open/action.ts
+var defaultDependencies = {
+  platform: process.platform,
+  launch: launchBrowser
+};
+function resolveOpenTarget(instanceName, instance, docs) {
+  if (docs) {
+    const base = instance.url.endsWith("/") ? instance.url : `${instance.url}/`;
+    return assertWebUrl(new URL("api/docs", base).href).href;
+  }
+  if (!instance.clientUrl) {
+    throw new Error(
+      `Instance ${instanceName} has no web client URL. Use --docs to open the API documentation instead.`
+    );
+  }
+  return assertWebUrl(instance.clientUrl).href;
+}
+async function runOpenCommand(config, parsed, context, dependencies = defaultDependencies) {
+  const [instanceName, instance] = resolveInstance(config, parsed);
+  const url = resolveOpenTarget(
+    instanceName,
+    instance,
+    parsed.flags.docs === true
+  );
+  if (parsed.flags.print === true || context.interactive !== true) {
+    context.stdout.write(`${url}
+`);
+    return 0;
+  }
+  const launcher = await chooseLauncher(url, {
+    platform: dependencies.platform,
+    env: context.env,
+    which: pathLookup(context.env, dependencies.platform)
+  });
+  if (!launcher || !await dependencies.launch(launcher)) {
+    context.stdout.write(`No browser is available here. Open: ${url}
+`);
+    return 0;
+  }
+  context.stdout.write(`Opening ${url}
+`);
+  return 0;
+}
+
+// src/commands/open/index.ts
+function createOpenCommand(context, setExitCode) {
+  return new Command("open").description(
+    "Open the web client of the selected instance in a browser"
+  ).option("--instance <name>", "select a configured instance").option("--docs", "open the management API documentation instead").option("--print", "print the URL instead of opening a browser").action(async (options) => {
+    const { config } = await loadCliState(context);
+    setExitCode(
+      await runOpenCommand(
+        config,
+        parsedArgs("open", void 0, [], options),
+        context
+      )
+    );
+  });
+}
+
 // src/commands/status/action.ts
 async function runStatusCommand(config, parsed, context) {
   const [instanceName, instance] = resolveInstance(config, parsed);
@@ -23063,13 +23390,229 @@ function createStatusCommand(context, setExitCode) {
   });
 }
 
+// src/commands/upgrade/action.ts
+import { readFile as readFile9, writeFile as writeFile6 } from "node:fs/promises";
+import { resolve as resolve8 } from "node:path";
+
+// src/services/compose-upgrade.ts
+var managedImages = {
+  EUDIPLO_IMAGE: "ghcr.io/openwallet-foundation/eudiplo",
+  EUDIPLO_CLIENT_IMAGE: "ghcr.io/openwallet-foundation/eudiplo-client"
+};
+var TAG = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/;
+function assertImageTag(tag) {
+  if (!TAG.test(tag)) {
+    throw new Error(
+      `Invalid image tag ${JSON.stringify(tag)}. Tags contain letters, digits, "_", "." and "-", and cannot start with "." or "-".`
+    );
+  }
+}
+function planImageUpgrade(content, tag) {
+  assertImageTag(tag);
+  const found = /* @__PURE__ */ new Set();
+  const changes = [];
+  const lines = content.split("\n").map((line) => {
+    const match = /^(EUDIPLO_IMAGE|EUDIPLO_CLIENT_IMAGE)=(.*?)(\r?)$/.exec(
+      line
+    );
+    if (!match) {
+      return line;
+    }
+    const key = match[1];
+    const value = match[2];
+    const lineEnding = match[3];
+    const repository = managedImages[key];
+    if (found.has(key)) {
+      throw new Error(
+        `${key} is defined more than once in the env file.`
+      );
+    }
+    found.add(key);
+    const prefix = `${repository}:`;
+    const current = value.startsWith(prefix) ? value.slice(prefix.length) : void 0;
+    if (current === void 0 || !TAG.test(current)) {
+      throw new Error(
+        `${key} is set to ${value}, which is not a CLI-managed image. Update it yourself, or restore ${prefix}<tag> to let the CLI manage it.`
+      );
+    }
+    if (current !== tag) {
+      changes.push({ key, repository, from: current, to: tag });
+    }
+    return `${key}=${prefix}${tag}${lineEnding}`;
+  });
+  if (!found.has("EUDIPLO_IMAGE")) {
+    throw new Error(
+      "The env file does not define EUDIPLO_IMAGE, so there is no CLI-managed image to upgrade."
+    );
+  }
+  return { changes, content: lines.join("\n") };
+}
+function parseVersion(tag) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(tag);
+  if (!match) {
+    return void 0;
+  }
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3])
+  };
+}
+function compareVersions(a, b) {
+  return a.major - b.major || a.minor - b.minor || a.patch - b.patch;
+}
+var migrationBaseUrl = "https://docs.eudiplo.dev/migration";
+function migrationNotes(from, to) {
+  const fromVersion = parseVersion(from);
+  const toVersion = parseVersion(to);
+  if (!fromVersion || !toVersion) {
+    return [
+      `Cannot compare ${from} and ${to} as versions. Check the release notes and ${migrationBaseUrl} before continuing.`
+    ];
+  }
+  const order = compareVersions(fromVersion, toVersion);
+  if (order > 0) {
+    return [
+      `${to} is older than ${from}. Downgrades are not supported once database migrations have run; restore a backup instead if you need to go back.`
+    ];
+  }
+  const notes = [];
+  for (let major = fromVersion.major + 1; major <= toVersion.major; major++) {
+    notes.push(
+      `Major version ${major}: read ${migrationBaseUrl}/${major - 1}.x-to-${major}.0 first.`
+    );
+  }
+  return notes;
+}
+
+// src/commands/upgrade/action.ts
+async function runUpgradeCommand(config, parsed, context) {
+  const [instanceName, instance] = resolveInstance(config, parsed);
+  if (instance.target !== "compose") {
+    throw new Error(unsupportedCommand("upgrade", instance.target));
+  }
+  const options = {
+    instanceName,
+    instance,
+    args: [],
+    flags: parsed.flags,
+    context
+  };
+  assertWritable(options);
+  const tag = readStringFlag(parsed.flags, "image-tag");
+  if (!tag) {
+    throw new Error("upgrade requires --image-tag <tag>.");
+  }
+  if (!instance.envFile) {
+    throw new Error(
+      `Instance ${instanceName} has no env file, so its images are not managed by the CLI.`
+    );
+  }
+  const envPath = resolve8(
+    instance.projectDirectory ?? context.cwd,
+    instance.envFile
+  );
+  const original = await readEnvFile(envPath);
+  const plan = planImageUpgrade(original, tag);
+  if (plan.changes.length === 0) {
+    context.stdout.write(
+      `${instanceName} already uses image tag ${tag}.
+`
+    );
+    return 0;
+  }
+  context.stdout.write(`Upgrade ${instanceName}:
+`);
+  for (const change of plan.changes) {
+    context.stdout.write(
+      `  ${change.repository}: ${change.from} -> ${change.to}
+`
+    );
+  }
+  const notes = new Set(
+    plan.changes.flatMap(
+      (change) => migrationNotes(change.from, change.to)
+    )
+  );
+  for (const note of notes) {
+    context.stdout.write(`Note: ${note}
+`);
+  }
+  if (!await confirmUpgrade(parsed, context)) {
+    context.stdout.write("Upgrade cancelled. Nothing was changed.\n");
+    return 0;
+  }
+  await writeFile6(envPath, plan.content, "utf8");
+  const pulled = await runCompose(buildComposePullArgs(void 0), options);
+  if (pulled !== 0) {
+    await writeFile6(envPath, original, "utf8");
+    context.stderr.write(
+      `Pulling the new images failed. Restored the previous image tags in ${envPath}.
+`
+    );
+    return pulled;
+  }
+  const recreated = await runCompose(buildComposeUpArgs(), options);
+  if (recreated !== 0) {
+    context.stderr.write(
+      `The new images were pulled and ${envPath} now uses ${tag}, but recreating the services failed. Fix the error above and run eudiplo up.
+`
+    );
+    return recreated;
+  }
+  context.stdout.write(`Upgraded ${instanceName} to ${tag}.
+`);
+  return 0;
+}
+async function readEnvFile(path2) {
+  try {
+    return await readFile9(path2, "utf8");
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      throw new Error(`Env file not found: ${path2}`);
+    }
+    throw error;
+  }
+}
+async function confirmUpgrade(parsed, context) {
+  if (parsed.flags.yes === true) {
+    return true;
+  }
+  if (context.interactive !== true) {
+    throw new Error("upgrade requires --yes in non-interactive mode.");
+  }
+  const prompter = createPrompter(context);
+  try {
+    const answer = (await prompter.ask("Continue? [y/N]: ")).trim().toLowerCase();
+    return answer === "y" || answer === "yes";
+  } finally {
+    prompter.close();
+  }
+}
+
+// src/commands/upgrade/index.ts
+function createUpgradeCommand(context, setExitCode) {
+  return new Command("upgrade").description(
+    "Upgrade the EUDIPLO application images of a Compose deployment"
+  ).requiredOption("--image-tag <tag>", "image tag to upgrade to").option("--instance <name>", "select a configured instance").option("--yes", "upgrade without asking for confirmation").action(async (options) => {
+    const { config } = await loadCliState(context);
+    setExitCode(
+      await runUpgradeCommand(
+        config,
+        parsedArgs("upgrade", void 0, [], options),
+        context
+      )
+    );
+  });
+}
+
 // src/commands/version/action.ts
 import { isSea as isSea2 } from "node:sea";
 
 // package.json
 var package_default = {
   name: "@eudiplo/cli",
-  version: "8.0.1",
+  version: "8.0.2-main.4c3e735",
   description: "Deployment-aware command line tools for EUDIPLO",
   private: false,
   type: "module",
@@ -23243,6 +23786,8 @@ function createProgram(context, setExitCode) {
   for (const command of createDeploymentCommands(context, setExitCode)) {
     program2.addCommand(command);
   }
+  program2.addCommand(createUpgradeCommand(context, setExitCode));
+  program2.addCommand(createOpenCommand(context, setExitCode));
   program2.addCommand(createInstanceCommand(context, setExitCode));
   program2.addCommand(createConfigCommand(context, setExitCode));
   program2.addCommand(createDoctorCommand(context, setExitCode));