@osva-ai/cli 1.1.0 → 1.1.2

package/dist/platform/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/platform/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,MAAM,MAAM,mBAAmB,GAC7B,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAE3E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACrD,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,SAAS,CAAC;CACjD;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EACT,OAAO,GACP,sBAAsB,GACtB,sBAAsB,GACtB,cAAc,GACd,oBAAoB,GACpB,gBAAgB,GAChB,oBAAoB,CAAC;gBAEb,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM;CAIhE"}

package/dist/platform/types.js

@@ -0,0 +1,8 @@
+export class PlatformCommandError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/platform/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/platform/types.ts"],"names":[],"mappings":"AAsCA,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,IAAI,CAOY;IAEzB,YAAY,IAAkC,EAAE,OAAe;QAC7D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/platform/upgrade/backup-policy.d.ts

@@ -0,0 +1,4 @@
+export declare const BACKUP_ATTESTATION_FLAG = "backup-confirmed";
+export declare function backupRequirementsText(): string;
+export declare function requiresBackupAttestation(migrationRequired: boolean): boolean;
+//# sourceMappingURL=backup-policy.d.ts.map

package/dist/platform/upgrade/backup-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-policy.d.ts","sourceRoot":"","sources":["../../../src/platform/upgrade/backup-policy.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,uBAAuB,qBAAqB,CAAC;AAE1D,wBAAgB,sBAAsB,IAAI,MAAM,CAc/C;AAED,wBAAgB,yBAAyB,CAAC,iBAAiB,EAAE,OAAO,GAAG,OAAO,CAE7E"}

package/dist/platform/upgrade/backup-policy.js

@@ -0,0 +1,20 @@
+export const BACKUP_ATTESTATION_FLAG = "backup-confirmed";
+export function backupRequirementsText() {
+    return [
+        "Before upgrading OSVA you must back up durable state manually:",
+        "",
+        "1. PostgreSQL — logical dump (pg_dump) or your managed snapshot process.",
+        "   OSVA stores Runs, workflows, agents, API keys, and migration history in PostgreSQL.",
+        "2. Artifact storage — back up the Compose artifact volume (filesystem mode) or your S3 bucket.",
+        "3. Document secrets separately — OSVA does not back up OSVA_AUTH_SECRET or provider keys.",
+        "",
+        "OSVA migrations are forward-only. A backup confirmation flag is operator attestation only;",
+        "it does not prove a backup exists or that restore was tested.",
+        "",
+        "See docs/operations/BACKUP_AND_RECOVERY.md and docs/operations/UPGRADE.md.",
+    ].join("\n");
+}
+export function requiresBackupAttestation(migrationRequired) {
+    return migrationRequired;
+}
+//# sourceMappingURL=backup-policy.js.map

package/dist/platform/upgrade/backup-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-policy.js","sourceRoot":"","sources":["../../../src/platform/upgrade/backup-policy.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AAE1D,MAAM,UAAU,sBAAsB;IACpC,OAAO;QACL,gEAAgE;QAChE,EAAE;QACF,0EAA0E;QAC1E,wFAAwF;QACxF,gGAAgG;QAChG,2FAA2F;QAC3F,EAAE;QACF,4FAA4F;QAC5F,+DAA+D;QAC/D,EAAE;QACF,4EAA4E;KAC7E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,iBAA0B;IAClE,OAAO,iBAAiB,CAAC;AAC3B,CAAC"}

package/dist/platform/upgrade/catalog.d.ts

@@ -0,0 +1,26 @@
+export interface UpgradeTarget {
+    readonly platformVersion: string;
+    readonly imageRef: string;
+}
+export interface UpgradePath {
+    readonly fromPlatformVersion: string;
+    readonly toPlatformVersion: string;
+    readonly migrationRequired: boolean;
+    readonly composeTemplateUpdate: boolean;
+}
+export interface ResolvedUpgradeTarget {
+    readonly platformVersion: string;
+    readonly imageRef: string;
+    readonly composeYaml: string;
+    readonly path: UpgradePath;
+}
+export declare function loadUpgradeCatalog(): Promise<{
+    readonly targets: readonly UpgradeTarget[];
+    readonly paths: readonly UpgradePath[];
+}>;
+export declare function resolveUpgradeTarget(input: {
+    readonly toPlatformVersion: string;
+    readonly fromPlatformVersion: string;
+    readonly processEnv: NodeJS.ProcessEnv;
+}): Promise<ResolvedUpgradeTarget>;
+//# sourceMappingURL=catalog.d.ts.map

package/dist/platform/upgrade/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../../src/platform/upgrade/catalog.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;CACzC;AAQD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;CAC5B;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;CACxC,CAAC,CAWD;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;CACxC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAqDjC"}

package/dist/platform/upgrade/catalog.js

@@ -0,0 +1,56 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { assertPinnedImageRef, loadComposeDistribution, } from "../../setup/distribution.js";
+import { resolveComposeInstallTemplateRoot } from "../../setup/compose-template-root.js";
+import { comparePlatformVersions } from "./version.js";
+export async function loadUpgradeCatalog() {
+    const templateRoot = resolveComposeInstallTemplateRoot();
+    const catalogPath = path.join(templateRoot, "upgrade-catalog.json");
+    const raw = await readFile(catalogPath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed.schemaVersion !== 1) {
+        throw new Error(`Unsupported upgrade catalog schema version ${String(parsed.schemaVersion)}.`);
+    }
+    return { targets: parsed.targets, paths: parsed.paths };
+}
+export async function resolveUpgradeTarget(input) {
+    const catalog = await loadUpgradeCatalog();
+    const distribution = await loadComposeDistribution();
+    const targetEntry = catalog.targets.find((target) => target.platformVersion === input.toPlatformVersion) ??
+        (distribution.manifest.platformVersion === input.toPlatformVersion
+            ? {
+                platformVersion: distribution.manifest.platformVersion,
+                imageRef: distribution.manifest.imageRef,
+            }
+            : undefined);
+    if (targetEntry === undefined) {
+        throw new Error(`Unsupported upgrade target '${input.toPlatformVersion}'. This CLI supports explicit upgrades to: ${catalog.targets.map((target) => target.platformVersion).join(", ")}.`);
+    }
+    const pathRule = catalog.paths.find((candidate) => candidate.fromPlatformVersion === input.fromPlatformVersion &&
+        candidate.toPlatformVersion === input.toPlatformVersion);
+    if (pathRule === undefined) {
+        throw new Error(`No supported upgrade path from ${input.fromPlatformVersion} to ${input.toPlatformVersion}. See docs/operations/UPGRADE.md and docs/release/COMPATIBILITY.md.`);
+    }
+    if (comparePlatformVersions(input.fromPlatformVersion, input.toPlatformVersion) >= 0) {
+        throw new Error(`Refusing downgrade or no-op upgrade (${input.fromPlatformVersion} → ${input.toPlatformVersion}).`);
+    }
+    const imageRef = resolveUpgradeImageRef({
+        target: targetEntry,
+        processEnv: input.processEnv,
+    });
+    assertPinnedImageRef(imageRef);
+    return {
+        platformVersion: targetEntry.platformVersion,
+        imageRef,
+        composeYaml: distribution.composeYaml,
+        path: pathRule,
+    };
+}
+function resolveUpgradeImageRef(input) {
+    const override = input.processEnv.OSVA_UPGRADE_LOCAL_IMAGE?.trim();
+    if (override !== undefined && override.length > 0) {
+        return override;
+    }
+    return input.target.imageRef;
+}
+//# sourceMappingURL=catalog.js.map

package/dist/platform/upgrade/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../../src/platform/upgrade/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AACzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AA2BvD,MAAM,CAAC,KAAK,UAAU,kBAAkB;IAItC,MAAM,YAAY,GAAG,iCAAiC,EAAE,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;IACrD,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,8CAA8C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAI1C;IACC,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAG,MAAM,uBAAuB,EAAE,CAAC;IACrD,MAAM,WAAW,GACf,OAAO,CAAC,OAAO,CAAC,IAAI,CAClB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,KAAK,KAAK,CAAC,iBAAiB,CAC/D;QACD,CAAC,YAAY,CAAC,QAAQ,CAAC,eAAe,KAAK,KAAK,CAAC,iBAAiB;YAChE,CAAC,CAAC;gBACE,eAAe,EAAE,YAAY,CAAC,QAAQ,CAAC,eAAe;gBACtD,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ;aACzC;YACH,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,CAAC,iBAAiB,8CAA8C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1K,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CACjC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,mBAAmB,KAAK,KAAK,CAAC,mBAAmB;QAC3D,SAAS,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,CAC1D,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,kCAAkC,KAAK,CAAC,mBAAmB,OAAO,KAAK,CAAC,iBAAiB,qEAAqE,CAC/J,CAAC;IACJ,CAAC;IAED,IACE,uBAAuB,CACrB,KAAK,CAAC,mBAAmB,EACzB,KAAK,CAAC,iBAAiB,CACxB,IAAI,CAAC,EACN,CAAC;QACD,MAAM,IAAI,KAAK,CACb,wCAAwC,KAAK,CAAC,mBAAmB,MAAM,KAAK,CAAC,iBAAiB,IAAI,CACnG,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,sBAAsB,CAAC;QACtC,MAAM,EAAE,WAAW;QACnB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAE/B,OAAO;QACL,eAAe,EAAE,WAAW,CAAC,eAAe;QAC5C,QAAQ;QACR,WAAW,EAAE,YAAY,CAAC,WAAW;QACrC,IAAI,EAAE,QAAQ;KACf,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,KAG/B;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;IACnE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;AAC/B,CAAC"}

package/dist/platform/upgrade/options.d.ts

@@ -0,0 +1,8 @@
+export interface PlatformUpgradeOptions {
+    readonly toPlatformVersion: string;
+    readonly dryRun: boolean;
+    readonly backupConfirmed: boolean;
+    readonly authorizeExecute: boolean;
+}
+export declare function parsePlatformUpgradeOptions(flags: Readonly<Record<string, string | boolean>>): PlatformUpgradeOptions;
+//# sourceMappingURL=options.d.ts.map

package/dist/platform/upgrade/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../../src/platform/upgrade/options.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAChD,sBAAsB,CAoBxB"}

package/dist/platform/upgrade/options.js

@@ -0,0 +1,17 @@
+import { PlatformCommandError } from "../types.js";
+export function parsePlatformUpgradeOptions(flags) {
+    const toFlag = flags.to;
+    if (toFlag === true || toFlag === undefined) {
+        throw new PlatformCommandError("usage", "Usage: osva platform upgrade --to VERSION [--dry-run] [--backup-confirmed] [--yes]");
+    }
+    if (typeof toFlag !== "string" || toFlag.trim().length === 0) {
+        throw new PlatformCommandError("usage", "--to requires an explicit platform version (for example 1.1.0).");
+    }
+    return {
+        toPlatformVersion: toFlag.trim(),
+        dryRun: flags["dry-run"] === true,
+        backupConfirmed: flags["backup-confirmed"] === true,
+        authorizeExecute: flags.yes === true,
+    };
+}
+//# sourceMappingURL=options.js.map

package/dist/platform/upgrade/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../../src/platform/upgrade/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AASnD,MAAM,UAAU,2BAA2B,CACzC,KAAiD;IAEjD,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC;IACxB,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,IAAI,oBAAoB,CAC5B,OAAO,EACP,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,oBAAoB,CAC5B,OAAO,EACP,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,iBAAiB,EAAE,MAAM,CAAC,IAAI,EAAE;QAChC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI;QACjC,eAAe,EAAE,KAAK,CAAC,kBAAkB,CAAC,KAAK,IAAI;QACnD,gBAAgB,EAAE,KAAK,CAAC,GAAG,KAAK,IAAI;KACrC,CAAC;AACJ,CAAC"}

package/dist/platform/upgrade/preflight.d.ts

@@ -0,0 +1,25 @@
+import type { ResolvedInstallation } from "../types.js";
+import type { ProbeSpawnFn } from "../../setup/probe-spawn.js";
+import { type ResolvedUpgradeTarget } from "./catalog.js";
+export interface UpgradePreflightReport {
+    readonly currentPlatformVersion: string;
+    readonly currentImageRef: string;
+    readonly targetPlatformVersion: string;
+    readonly targetImageRef: string;
+    readonly migrationRequired: boolean;
+    readonly composeTemplateUpdate: boolean;
+    readonly backupRequired: boolean;
+    readonly serviceInterruption: string;
+    readonly blockingIssues: readonly string[];
+    readonly warnings: readonly string[];
+    readonly target: ResolvedUpgradeTarget | undefined;
+}
+export declare function runUpgradePreflight(input: {
+    readonly installation: ResolvedInstallation;
+    readonly toPlatformVersion: string;
+    readonly processEnv: NodeJS.ProcessEnv;
+    readonly spawn?: ProbeSpawnFn;
+    readonly fetch?: typeof fetch;
+}): Promise<UpgradePreflightReport>;
+export declare function formatUpgradeDryRunHuman(report: UpgradePreflightReport): string;
+//# sourceMappingURL=preflight.d.ts.map

package/dist/platform/upgrade/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../../src/platform/upgrade/preflight.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE/D,OAAO,EAAwB,KAAK,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAQhF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,GAAG,SAAS,CAAC;CACpD;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CAC/B,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAoElC;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,sBAAsB,GAC7B,MAAM,CAiCR"}

package/dist/platform/upgrade/preflight.js

@@ -0,0 +1,91 @@
+import { loadComposeDistribution } from "../../setup/distribution.js";
+import { collectPlatformStatus } from "../status.js";
+import { backupRequirementsText } from "./backup-policy.js";
+import { resolveUpgradeTarget } from "./catalog.js";
+import { isIncompleteUpgrade, isUpgradeInProgress, readUpgradeState, recoveryGuidance, } from "./state.js";
+export async function runUpgradePreflight(input) {
+    const blockingIssues = [];
+    const warnings = [];
+    const existingState = await readUpgradeState(input.installation.installDir);
+    if (isUpgradeInProgress(existingState)) {
+        blockingIssues.push(`Upgrade already in progress (phase ${existingState.phase}).`);
+    }
+    else if (isIncompleteUpgrade(existingState)) {
+        warnings.push(recoveryGuidance(existingState));
+    }
+    const currentPlatformVersion = input.installation.marker.platformVersion;
+    const currentImageRef = input.installation.marker.imageRef;
+    let target;
+    try {
+        target = await resolveUpgradeTarget({
+            toPlatformVersion: input.toPlatformVersion,
+            fromPlatformVersion: currentPlatformVersion,
+            processEnv: input.processEnv,
+        });
+    }
+    catch (error) {
+        blockingIssues.push(error instanceof Error ? error.message : "Unsupported upgrade target.");
+    }
+    if (target !== undefined) {
+        const distribution = await loadComposeDistribution();
+        if (distribution.manifest.platformVersion !== target.platformVersion) {
+            warnings.push("Target version differs from the bundled CLI distribution metadata; verify image compatibility before proceeding.");
+        }
+    }
+    const status = await collectPlatformStatus(input.installation, {
+        spawn: input.spawn,
+        fetch: input.fetch,
+    });
+    if (!status.apiReadyOk) {
+        warnings.push("Control plane is not fully ready before upgrade; expect additional startup time after migration.");
+    }
+    if (currentImageRef !== input.installation.envValues.OSVA_IMAGE) {
+        blockingIssues.push("Installation marker and .env image references disagree; repair metadata before upgrading.");
+    }
+    return {
+        currentPlatformVersion,
+        currentImageRef,
+        targetPlatformVersion: target?.platformVersion ?? input.toPlatformVersion,
+        targetImageRef: target?.imageRef ?? "unknown",
+        migrationRequired: target?.path.migrationRequired ?? true,
+        composeTemplateUpdate: target?.path.composeTemplateUpdate ?? false,
+        backupRequired: target?.path.migrationRequired ?? true,
+        serviceInterruption: "Expect control plane and Console downtime while application services stop, migrations run, and services restart. PostgreSQL and Valkey remain running.",
+        blockingIssues,
+        warnings,
+        target,
+    };
+}
+export function formatUpgradeDryRunHuman(report) {
+    const lines = [
+        "OSVA platform upgrade dry-run",
+        "",
+        `Current: ${report.currentPlatformVersion} (${report.currentImageRef})`,
+        `Target:  ${report.target?.platformVersion ?? report.targetPlatformVersion} (${report.target?.imageRef ?? report.targetImageRef})`,
+        "",
+        `Migration required: ${report.migrationRequired ? "yes" : "no"}`,
+        `Compose template update: ${report.composeTemplateUpdate ? "yes" : "no"}`,
+        `Service interruption: ${report.serviceInterruption}`,
+        "",
+        "Backup requirements:",
+        backupRequirementsText(),
+        "",
+    ];
+    if (report.blockingIssues.length > 0) {
+        lines.push("Blocking issues:");
+        for (const issue of report.blockingIssues) {
+            lines.push(`  - ${issue}`);
+        }
+        lines.push("");
+    }
+    if (report.warnings.length > 0) {
+        lines.push("Warnings:");
+        for (const warning of report.warnings) {
+            lines.push(`  - ${warning}`);
+        }
+        lines.push("");
+    }
+    lines.push("Dry-run is read-only and cannot predict all migration failures. Run with --backup-confirmed and --yes to execute.");
+    return `${lines.join("\n")}\n`;
+}
+//# sourceMappingURL=preflight.js.map

package/dist/platform/upgrade/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../../src/platform/upgrade/preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAA8B,MAAM,cAAc,CAAC;AAChF,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAgBpB,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAMzC;IACC,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAC5E,IAAI,mBAAmB,CAAC,aAAa,CAAC,EAAE,CAAC;QACvC,cAAc,CAAC,IAAI,CACjB,sCAAsC,aAAc,CAAC,KAAK,IAAI,CAC/D,CAAC;IACJ,CAAC;SAAM,IAAI,mBAAmB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAc,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,sBAAsB,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC;IACzE,MAAM,eAAe,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC;IAE3D,IAAI,MAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,oBAAoB,CAAC;YAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,mBAAmB,EAAE,sBAAsB;YAC3C,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,IAAI,CACjB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CACvE,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,YAAY,GAAG,MAAM,uBAAuB,EAAE,CAAC;QACrD,IAAI,YAAY,CAAC,QAAQ,CAAC,eAAe,KAAK,MAAM,CAAC,eAAe,EAAE,CAAC;YACrE,QAAQ,CAAC,IAAI,CACX,kHAAkH,CACnH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,YAAY,EAAE;QAC7D,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,kGAAkG,CACnG,CAAC;IACJ,CAAC;IAED,IAAI,eAAe,KAAK,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;QAChE,cAAc,CAAC,IAAI,CACjB,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,sBAAsB;QACtB,eAAe;QACf,qBAAqB,EAAE,MAAM,EAAE,eAAe,IAAI,KAAK,CAAC,iBAAiB;QACzE,cAAc,EAAE,MAAM,EAAE,QAAQ,IAAI,SAAS;QAC7C,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,iBAAiB,IAAI,IAAI;QACzD,qBAAqB,EAAE,MAAM,EAAE,IAAI,CAAC,qBAAqB,IAAI,KAAK;QAClE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,iBAAiB,IAAI,IAAI;QACtD,mBAAmB,EACjB,wJAAwJ;QAC1J,cAAc;QACd,QAAQ;QACR,MAAM;KACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAA8B;IAE9B,MAAM,KAAK,GAAG;QACZ,+BAA+B;QAC/B,EAAE;QACF,YAAY,MAAM,CAAC,sBAAsB,KAAK,MAAM,CAAC,eAAe,GAAG;QACvE,YAAY,MAAM,CAAC,MAAM,EAAE,eAAe,IAAI,MAAM,CAAC,qBAAqB,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,IAAI,MAAM,CAAC,cAAc,GAAG;QAClI,EAAE;QACF,uBAAuB,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QAChE,4BAA4B,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QACzE,yBAAyB,MAAM,CAAC,mBAAmB,EAAE;QACrD,EAAE;QACF,sBAAsB;QACtB,sBAAsB,EAAE;QACxB,EAAE;KACH,CAAC;IACF,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,KAAK,CAAC,IAAI,CACR,mHAAmH,CACpH,CAAC;IACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/platform/upgrade/run-upgrade.d.ts

@@ -0,0 +1,22 @@
+import { type ProbeSpawnFn } from "../../setup/probe-spawn.js";
+import { type ResolvedInstallation } from "../types.js";
+import { type UpgradePreflightReport } from "./preflight.js";
+import type { PlatformUpgradeOptions } from "./options.js";
+export declare const COMPOSE_UPGRADE_PULL_TIMEOUT_MS = 900000;
+export interface UpgradeResult {
+    readonly fromPlatformVersion: string;
+    readonly toPlatformVersion: string;
+    readonly imageRef: string;
+    readonly message: string;
+}
+export declare function runPlatformUpgrade(installation: ResolvedInstallation, options: PlatformUpgradeOptions, deps?: {
+    readonly spawn?: ProbeSpawnFn;
+    readonly fetch?: typeof fetch;
+    readonly processEnv?: NodeJS.ProcessEnv;
+}): Promise<UpgradeResult>;
+export declare class PlatformUpgradeDryRunReport extends Error {
+    readonly formatted: string;
+    readonly report: UpgradePreflightReport;
+    constructor(formatted: string, report: UpgradePreflightReport);
+}
+//# sourceMappingURL=run-upgrade.d.ts.map

package/dist/platform/upgrade/run-upgrade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-upgrade.d.ts","sourceRoot":"","sources":["../../../src/platform/upgrade/run-upgrade.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEL,KAAK,YAAY,EAClB,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAM9E,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,gBAAgB,CAAC;AAUxB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAE3D,eAAO,MAAM,+BAA+B,SAAU,CAAC;AAIvD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,oBAAoB,EAClC,OAAO,EAAE,sBAAsB,EAC/B,IAAI,GAAE;IACJ,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACpC,GACL,OAAO,CAAC,aAAa,CAAC,CAoJxB;AAED,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;gBAE5B,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB;CAK9D"}

package/dist/platform/upgrade/run-upgrade.js

@@ -0,0 +1,253 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { redactSecrets } from "../../doctor/redact.js";
+import { assertComposeSuccess, buildComposeSpawnEnv, composeCommandIncludesDestructiveVolumeRemoval, runComposeCommand, } from "../../setup/compose-exec.js";
+import { writeFileAtomic } from "../../setup/atomic-write.js";
+import { renderInstallEnvFile } from "../../setup/env-file.js";
+import { INSTALLATION_MARKER_RELATIVE, renderInstallationMarker, } from "../../setup/installation-state.js";
+import { defaultProbeSpawn, } from "../../setup/probe-spawn.js";
+import { CLI_VERSION } from "../../version.js";
+import { installEnvValuesFromMap } from "../resolve-installation.js";
+import { probeInstallationReadiness } from "../readiness.js";
+import { PLATFORM_APPLICATION_SERVICES } from "../services.js";
+import { PlatformCommandError } from "../types.js";
+import { COMPOSE_LIFECYCLE_TIMEOUT_MS } from "../lifecycle.js";
+import { backupRequirementsText, requiresBackupAttestation, } from "./backup-policy.js";
+import { formatUpgradeDryRunHuman, runUpgradePreflight, } from "./preflight.js";
+import { acquireUpgradeLock, clearUpgradeState, releaseUpgradeLock, writeUpgradeState, } from "./state.js";
+export const COMPOSE_UPGRADE_PULL_TIMEOUT_MS = 900_000;
+const INTEGRITY_CLI_IMAGE_PATH = "/app/packages/db/dist/migrations-integrity-cli.js";
+export async function runPlatformUpgrade(installation, options, deps = {}) {
+    const processEnv = deps.processEnv ?? process.env;
+    const report = await runUpgradePreflight({
+        installation,
+        toPlatformVersion: options.toPlatformVersion,
+        processEnv,
+        spawn: deps.spawn,
+        fetch: deps.fetch,
+    });
+    if (report.blockingIssues.length > 0) {
+        throw new PlatformCommandError("installation_invalid", report.blockingIssues.join(" "));
+    }
+    if (options.dryRun) {
+        throw new PlatformUpgradeDryRunReport(formatUpgradeDryRunHuman(report), report);
+    }
+    if (report.target === undefined) {
+        throw new PlatformCommandError("installation_invalid", report.blockingIssues.join(" "));
+    }
+    const target = report.target;
+    if (!options.authorizeExecute) {
+        throw new PlatformCommandError("usage", "Refusing to upgrade without --yes. Run with --dry-run first to review the plan.");
+    }
+    if (requiresBackupAttestation(report.migrationRequired) &&
+        !options.backupConfirmed) {
+        throw new PlatformCommandError("usage", `Refusing upgrade without --backup-confirmed.\n\n${backupRequirementsText()}`);
+    }
+    await acquireUpgradeLock(installation.installDir);
+    const startedAt = new Date().toISOString();
+    let state = {
+        schemaVersion: 1,
+        phase: "locked",
+        fromPlatformVersion: report.currentPlatformVersion,
+        toPlatformVersion: report.targetPlatformVersion,
+        fromImageRef: report.currentImageRef,
+        targetImageRef: report.targetImageRef,
+        startedAt,
+        updatedAt: startedAt,
+        migrationRequired: report.migrationRequired,
+    };
+    try {
+        await persistState(installation.installDir, state);
+        state = await advance(state, "pulling_image", installation.installDir);
+        pullTargetImage(target.imageRef, deps.spawn);
+        state = await advance(state, "prepared_configuration", installation.installDir);
+        await prepareInstallationConfiguration(installation, target);
+        state = await advance(state, "stopped_applications", installation.installDir);
+        stopApplicationServices(installation, deps.spawn);
+        if (report.migrationRequired) {
+            state = await advance(state, "migrating", installation.installDir);
+            try {
+                runMigrationJob(installation, deps.spawn);
+                verifyMigrationIntegrity(installation, deps.spawn);
+            }
+            catch (error) {
+                state = await advance(state, "migration_failed", installation.installDir, error);
+                throw migrationFailure(error);
+            }
+        }
+        state = await advance(state, "starting_applications", installation.installDir);
+        startApplicationServices(installation, deps.spawn);
+        state = await advance(state, "validating_readiness", installation.installDir);
+        const readiness = await probeInstallationReadiness({
+            ...installation,
+            envValues: {
+                ...installation.envValues,
+                OSVA_IMAGE: target.imageRef,
+            },
+        }, deps.fetch ?? fetch);
+        if (!readiness.apiReadyOk || !readiness.consoleReady) {
+            throw new PlatformCommandError("platform_not_ready", "Upgrade rolled out the target image but readiness checks failed. The database schema may have migrated; do not downgrade the application without operator review. Inspect logs and docs/operations/UPGRADE.md.");
+        }
+        await updateInstallationMarker(installation, target);
+        state = await advance(state, "completed", installation.installDir);
+        await clearUpgradeState(installation.installDir);
+        return {
+            fromPlatformVersion: report.currentPlatformVersion,
+            toPlatformVersion: report.targetPlatformVersion,
+            imageRef: target.imageRef,
+            message: `Upgraded OSVA platform from ${report.currentPlatformVersion} to ${report.targetPlatformVersion}.`,
+        };
+    }
+    catch (error) {
+        if (state.phase !== "completed" &&
+            state.phase !== "migration_failed" &&
+            state.phase !== "failed") {
+            state = await advance(state, "failed", installation.installDir, error);
+        }
+        throw error;
+    }
+    finally {
+        await releaseUpgradeLock(installation.installDir);
+    }
+}
+export class PlatformUpgradeDryRunReport extends Error {
+    formatted;
+    report;
+    constructor(formatted, report) {
+        super("dry-run");
+        this.formatted = formatted;
+        this.report = report;
+    }
+}
+async function persistState(installDir, state) {
+    await writeUpgradeState(installDir, state);
+}
+async function advance(state, phase, installDir, error) {
+    const next = {
+        ...state,
+        phase,
+        updatedAt: new Date().toISOString(),
+        ...(error === undefined
+            ? {}
+            : {
+                lastError: redactSecrets(error instanceof Error ? error.message : String(error)),
+            }),
+    };
+    await writeUpgradeState(installDir, next);
+    return next;
+}
+function pullTargetImage(imageRef, spawn) {
+    const run = spawn ?? defaultProbeSpawn;
+    const pull = run("docker", ["pull", imageRef], COMPOSE_UPGRADE_PULL_TIMEOUT_MS);
+    if (pull.status !== 0) {
+        throw new PlatformCommandError("compose_failed", redactSecrets(pull.stderr.trim() ||
+            pull.stdout.trim() ||
+            `Failed to pull ${imageRef}.`));
+    }
+}
+async function prepareInstallationConfiguration(installation, target) {
+    const envMap = new Map(Object.entries(installation.envValues));
+    envMap.set("OSVA_IMAGE", target.imageRef);
+    const values = installEnvValuesFromMap(envMap);
+    await writeFileAtomic(installation.envPath, renderInstallEnvFile(values), {
+        restrictPermissions: true,
+    });
+    if (target.path.composeTemplateUpdate) {
+        await writeFileAtomic(installation.composePath, target.composeYaml);
+    }
+}
+function stopApplicationServices(installation, spawn) {
+    const services = [...PLATFORM_APPLICATION_SERVICES].reverse();
+    const args = ["stop", ...services];
+    assertSafeArgs(args);
+    const result = runComposeCommand(installation.execCtx, args, {
+        spawn,
+        timeoutMs: COMPOSE_LIFECYCLE_TIMEOUT_MS,
+        processEnv: buildComposeSpawnEnv(installation.execCtx),
+    });
+    assertComposeSuccess(result, "Stopping application services for upgrade");
+}
+function runMigrationJob(installation, spawn) {
+    const args = ["up", "--no-build", "--wait", "migrate"];
+    assertSafeArgs(args);
+    const result = runComposeCommand(installation.execCtx, args, {
+        spawn,
+        timeoutMs: COMPOSE_LIFECYCLE_TIMEOUT_MS,
+        processEnv: buildComposeSpawnEnv(installation.execCtx),
+    });
+    assertComposeSuccess(result, "Database migration job");
+}
+function verifyMigrationIntegrity(installation, spawn) {
+    const args = [
+        "run",
+        "--rm",
+        "-T",
+        "--no-deps",
+        "--entrypoint",
+        "node",
+        "web",
+        INTEGRITY_CLI_IMAGE_PATH,
+    ];
+    assertSafeArgs(args);
+    const result = runComposeCommand(installation.execCtx, args, {
+        spawn,
+        timeoutMs: COMPOSE_LIFECYCLE_TIMEOUT_MS,
+        processEnv: buildComposeSpawnEnv(installation.execCtx),
+    });
+    if (result.status !== 0) {
+        throw new PlatformCommandError("platform_not_ready", redactSecrets(result.stderr.trim() ||
+            result.stdout.trim() ||
+            "Migration integrity probe failed."));
+    }
+    const output = result.stdout.trim();
+    if (output.includes("schema_mismatch") ||
+        output.includes("schema_ahead") ||
+        output.includes("database_inaccessible")) {
+        throw new PlatformCommandError("platform_not_ready", "Migration integrity probe reported schema mismatch. Follow docs/operations/UPGRADE.md before restarting applications.");
+    }
+}
+function startApplicationServices(installation, spawn) {
+    const args = [
+        "up",
+        "-d",
+        "--no-build",
+        "--pull",
+        "never",
+        "--wait",
+        ...PLATFORM_APPLICATION_SERVICES,
+    ];
+    assertSafeArgs(args);
+    const result = runComposeCommand(installation.execCtx, args, {
+        spawn,
+        timeoutMs: COMPOSE_LIFECYCLE_TIMEOUT_MS,
+        processEnv: buildComposeSpawnEnv(installation.execCtx),
+    });
+    assertComposeSuccess(result, "Starting upgraded application services");
+}
+async function updateInstallationMarker(installation, target) {
+    const markerPath = path.join(installation.installDir, INSTALLATION_MARKER_RELATIVE);
+    const raw = await readFile(markerPath, "utf8");
+    const existing = JSON.parse(raw);
+    const marker = renderInstallationMarker({
+        platformVersion: target.platformVersion,
+        imageRef: target.imageRef,
+        cliVersion: CLI_VERSION,
+        installDir: installation.installDir,
+        composeProjectName: installation.envValues.COMPOSE_PROJECT_NAME,
+        existing,
+    });
+    await writeFileAtomic(markerPath, `${JSON.stringify(marker, null, 2)}\n`, {
+        restrictPermissions: true,
+    });
+}
+function assertSafeArgs(args) {
+    if (composeCommandIncludesDestructiveVolumeRemoval(args)) {
+        throw new Error("Refusing destructive compose operation during upgrade.");
+    }
+}
+function migrationFailure(error) {
+    return new PlatformCommandError("platform_not_ready", error instanceof PlatformCommandError
+        ? error.message
+        : "Database migration failed during upgrade. Application services remain stopped. Schema may be partially migrated — see docs/operations/UPGRADE.md.");
+}
+//# sourceMappingURL=run-upgrade.js.map

package/dist/platform/upgrade/run-upgrade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-upgrade.js","sourceRoot":"","sources":["../../../src/platform/upgrade/run-upgrade.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,8CAA8C,EAC9C,iBAAiB,GAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAA6B,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EACL,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wBAAwB,EACxB,mBAAmB,GAEpB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,GAGlB,MAAM,YAAY,CAAC;AAGpB,MAAM,CAAC,MAAM,+BAA+B,GAAG,OAAO,CAAC;AACvD,MAAM,wBAAwB,GAC5B,mDAAmD,CAAC;AAStD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,YAAkC,EAClC,OAA+B,EAC/B,OAII,EAAE;IAEN,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACvC,YAAY;QACZ,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,UAAU;QACV,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,oBAAoB,CAC5B,sBAAsB,EACtB,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAChC,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,2BAA2B,CACnC,wBAAwB,CAAC,MAAM,CAAC,EAChC,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,oBAAoB,CAC5B,sBAAsB,EACtB,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAChC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAE7B,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,IAAI,oBAAoB,CAC5B,OAAO,EACP,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,IACE,yBAAyB,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACnD,CAAC,OAAO,CAAC,eAAe,EACxB,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,OAAO,EACP,mDAAmD,sBAAsB,EAAE,EAAE,CAC9E,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,KAAK,GAAiB;QACxB,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,QAAQ;QACf,mBAAmB,EAAE,MAAM,CAAC,sBAAsB;QAClD,iBAAiB,EAAE,MAAM,CAAC,qBAAqB;QAC/C,YAAY,EAAE,MAAM,CAAC,eAAe;QACpC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS;QACT,SAAS,EAAE,SAAS;QACpB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;KAC5C,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAEnD,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,eAAe,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;QACvE,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAE7C,KAAK,GAAG,MAAM,OAAO,CACnB,KAAK,EACL,wBAAwB,EACxB,YAAY,CAAC,UAAU,CACxB,CAAC;QACF,MAAM,gCAAgC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAE7D,KAAK,GAAG,MAAM,OAAO,CACnB,KAAK,EACL,sBAAsB,EACtB,YAAY,CAAC,UAAU,CACxB,CAAC;QACF,uBAAuB,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAElD,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7B,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;YACnE,IAAI,CAAC;gBACH,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1C,wBAAwB,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,GAAG,MAAM,OAAO,CACnB,KAAK,EACL,kBAAkB,EAClB,YAAY,CAAC,UAAU,EACvB,KAAK,CACN,CAAC;gBACF,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,KAAK,GAAG,MAAM,OAAO,CACnB,KAAK,EACL,uBAAuB,EACvB,YAAY,CAAC,UAAU,CACxB,CAAC;QACF,wBAAwB,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAEnD,KAAK,GAAG,MAAM,OAAO,CACnB,KAAK,EACL,sBAAsB,EACtB,YAAY,CAAC,UAAU,CACxB,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAChD;YACE,GAAG,YAAY;YACf,SAAS,EAAE;gBACT,GAAG,YAAY,CAAC,SAAS;gBACzB,UAAU,EAAE,MAAM,CAAC,QAAQ;aAC5B;SACF,EACD,IAAI,CAAC,KAAK,IAAI,KAAK,CACpB,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;YACrD,MAAM,IAAI,oBAAoB,CAC5B,oBAAoB,EACpB,gNAAgN,CACjN,CAAC;QACJ,CAAC;QAED,MAAM,wBAAwB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACrD,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;QACnE,MAAM,iBAAiB,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAEjD,OAAO;YACL,mBAAmB,EAAE,MAAM,CAAC,sBAAsB;YAClD,iBAAiB,EAAE,MAAM,CAAC,qBAAqB;YAC/C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,+BAA+B,MAAM,CAAC,sBAAsB,OAAO,MAAM,CAAC,qBAAqB,GAAG;SAC5G,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,CAAC,KAAK,KAAK,WAAW;YAC3B,KAAK,CAAC,KAAK,KAAK,kBAAkB;YAClC,KAAK,CAAC,KAAK,KAAK,QAAQ,EACxB,CAAC;YACD,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,kBAAkB,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,SAAS,CAAS;IAClB,MAAM,CAAyB;IAExC,YAAY,SAAiB,EAAE,MAA8B;QAC3D,KAAK,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,KAAK,UAAU,YAAY,CACzB,UAAkB,EAClB,KAAmB;IAEnB,MAAM,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,KAAmB,EACnB,KAAmB,EACnB,UAAkB,EAClB,KAAe;IAEf,MAAM,IAAI,GAAiB;QACzB,GAAG,KAAK;QACR,KAAK;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,GAAG,CAAC,KAAK,KAAK,SAAS;YACrB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,SAAS,EAAE,aAAa,CACtB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD;aACF,CAAC;KACP,CAAC;IACF,MAAM,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CACtB,QAAgB,EAChB,KAA+B;IAE/B,MAAM,GAAG,GAAG,KAAK,IAAI,iBAAiB,CAAC;IACvC,MAAM,IAAI,GAAG,GAAG,CACd,QAAQ,EACR,CAAC,MAAM,EAAE,QAAQ,CAAC,EAClB,+BAA+B,CAChC,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,oBAAoB,CAC5B,gBAAgB,EAChB,aAAa,CACX,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YAClB,kBAAkB,QAAQ,GAAG,CAChC,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,YAAkC,EAClC,MAA6B;IAE7B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/D,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,eAAe,CAAC,YAAY,CAAC,OAAO,EAAE,oBAAoB,CAAC,MAAM,CAAC,EAAE;QACxE,mBAAmB,EAAE,IAAI;KAC1B,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACtC,MAAM,eAAe,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,YAAkC,EAClC,KAA+B;IAE/B,MAAM,QAAQ,GAAG,CAAC,GAAG,6BAA6B,CAAC,CAAC,OAAO,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC;IACnC,cAAc,CAAC,IAAI,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE;QAC3D,KAAK;QACL,SAAS,EAAE,4BAA4B;QACvC,UAAU,EAAE,oBAAoB,CAAC,YAAY,CAAC,OAAO,CAAC;KACvD,CAAC,CAAC;IACH,oBAAoB,CAAC,MAAM,EAAE,2CAA2C,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,eAAe,CACtB,YAAkC,EAClC,KAA+B;IAE/B,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvD,cAAc,CAAC,IAAI,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE;QAC3D,KAAK;QACL,SAAS,EAAE,4BAA4B;QACvC,UAAU,EAAE,oBAAoB,CAAC,YAAY,CAAC,OAAO,CAAC;KACvD,CAAC,CAAC;IACH,oBAAoB,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,wBAAwB,CAC/B,YAAkC,EAClC,KAA+B;IAE/B,MAAM,IAAI,GAAG;QACX,KAAK;QACL,MAAM;QACN,IAAI;QACJ,WAAW;QACX,cAAc;QACd,MAAM;QACN,KAAK;QACL,wBAAwB;KACzB,CAAC;IACF,cAAc,CAAC,IAAI,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE;QAC3D,KAAK;QACL,SAAS,EAAE,4BAA4B;QACvC,UAAU,EAAE,oBAAoB,CAAC,YAAY,CAAC,OAAO,CAAC;KACvD,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,oBAAoB,CAC5B,oBAAoB,EACpB,aAAa,CACX,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YAClB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YACpB,mCAAmC,CACtC,CACF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACpC,IACE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAClC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC/B,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EACxC,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,oBAAoB,EACpB,uHAAuH,CACxH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,YAAkC,EAClC,KAA+B;IAE/B,MAAM,IAAI,GAAG;QACX,IAAI;QACJ,IAAI;QACJ,YAAY;QACZ,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,GAAG,6BAA6B;KACjC,CAAC;IACF,cAAc,CAAC,IAAI,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE;QAC3D,KAAK;QACL,SAAS,EAAE,4BAA4B;QACvC,UAAU,EAAE,oBAAoB,CAAC,YAAY,CAAC,OAAO,CAAC;KACvD,CAAC,CAAC;IACH,oBAAoB,CAAC,MAAM,EAAE,wCAAwC,CAAC,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,YAAkC,EAClC,MAA6B;IAE7B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1B,YAAY,CAAC,UAAU,EACvB,4BAA4B,CAC7B,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAE9B,CAAC;IACF,MAAM,MAAM,GAAG,wBAAwB,CAAC;QACtC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,WAAW;QACvB,UAAU,EAAE,YAAY,CAAC,UAAU;QACnC,kBAAkB,EAAE,YAAY,CAAC,SAAS,CAAC,oBAAoB;QAC/D,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,eAAe,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QACxE,mBAAmB,EAAE,IAAI;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,IAAuB;IAC7C,IAAI,8CAA8C,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,IAAI,oBAAoB,CAC7B,oBAAoB,EACpB,KAAK,YAAY,oBAAoB;QACnC,CAAC,CAAC,KAAK,CAAC,OAAO;QACf,CAAC,CAAC,mJAAmJ,CACxJ,CAAC;AACJ,CAAC"}