@pleri/olam-cli 0.1.14 → 0.1.21

package/dist/commands/__tests__/bootstrap.test.js

@@ -0,0 +1,288 @@
+// C1 + C3 (Phase C — fresh-install self-bootstrap): `olam bootstrap`
+// orchestrator. Closes the user goal end-to-end:
+// `npm install -g @pleri/olam-cli && olam init && olam bootstrap`.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { runBootstrap, pullImageWithRetry, loadImageDigests, } from '../bootstrap.js';
+import { EXIT_BOOTSTRAP_PULL_FAILED, EXIT_GENERIC_ERROR, EXIT_PROTOCOL_MISMATCH, } from '../../exit-codes.js';
+// ── Test helpers ──────────────────────────────────────────────────
+function mkDigest(seed) {
+    // Build a 64-hex digest deterministically from a seed for readable test
+    // output. Real digests are sha256 hex of the manifest content; tests
+    // just need stable strings of the right shape.
+    const hex = (seed + 'a'.repeat(64)).replace(/[^a-f0-9]/g, '0').slice(0, 64);
+    return `sha256:${hex}`;
+}
+const FIXTURE_DIGESTS = {
+    'host-cp': mkDigest('host-cp-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'),
+    auth: mkDigest('auth-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'),
+    devbox: mkDigest('devbox-ccccccccccccccccccccccccccccccccccccccccccccccccccccccc'),
+    $registry: 'ghcr.io/pleri',
+    $published_version: '0.1.15',
+};
+function ok(stdout = '') {
+    return { exitCode: 0, stdout, stderr: '' };
+}
+function err(stderr, exitCode = 1) {
+    return { exitCode, stdout: '', stderr };
+}
+function makeMockDocker(opts = {}) {
+    const calls = opts.calls ?? { pull: [], inspect: [] };
+    return {
+        info: vi.fn(async () => (opts.infoOk === false ? err('cannot connect to docker') : ok())),
+        pull: vi.fn(async (ref) => {
+            calls.pull.push(ref);
+            return opts.pullResults?.get(ref) ?? ok();
+        }),
+        inspectLabel: vi.fn(async (ref, label) => {
+            calls.inspect.push(`${ref}#${label}`);
+            const value = opts.inspectLabels?.get(ref) ?? '1';
+            return ok(`${value}\n`);
+        }),
+    };
+}
+function silentSubprocess() {
+    const calls = [];
+    return {
+        calls,
+        runOlamSubcommand: (args) => {
+            calls.push([...args]);
+            return ok();
+        },
+    };
+}
+// Suppress real console output during tests — orchestrator uses ora +
+// stdout/stderr writes that vitest reports as warnings otherwise.
+beforeEach(() => {
+    vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    vi.spyOn(process.stderr, 'write').mockImplementation(() => true);
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+// ── pullImageWithRetry — unit ────────────────────────────────────
+describe('pullImageWithRetry — coalesce + retry', () => {
+    it('returns first attempt success without retrying', async () => {
+        let calls = 0;
+        const docker = {
+            info: async () => ok(),
+            pull: async () => {
+                calls++;
+                return ok();
+            },
+            inspectLabel: async () => ok('1'),
+        };
+        const result = await pullImageWithRetry('ghcr.io/test/img@sha256:xxx', docker);
+        expect(result.exitCode).toBe(0);
+        expect(calls).toBe(1);
+    });
+    it('retries once on transient (network) failure, then succeeds', async () => {
+        let calls = 0;
+        const docker = {
+            info: async () => ok(),
+            pull: async () => {
+                calls++;
+                if (calls === 1)
+                    return err('connection refused', 1);
+                return ok();
+            },
+            inspectLabel: async () => ok('1'),
+        };
+        const result = await pullImageWithRetry('ghcr.io/test/img@sha256:xxx', docker);
+        expect(result.exitCode).toBe(0);
+        expect(calls).toBe(2);
+    });
+    it('does NOT retry on a non-transient failure (e.g. manifest unknown)', async () => {
+        let calls = 0;
+        const docker = {
+            info: async () => ok(),
+            pull: async () => {
+                calls++;
+                return err('manifest unknown', 1);
+            },
+            inspectLabel: async () => ok('1'),
+        };
+        const result = await pullImageWithRetry('ghcr.io/test/img@sha256:xxx', docker);
+        expect(result.exitCode).toBe(1);
+        expect(calls).toBe(1);
+    });
+    it('coalesces concurrent identical pulls into one in-flight promise', async () => {
+        let pullsStarted = 0;
+        const gate = new Promise((resolveGate) => setTimeout(resolveGate, 30));
+        const docker = {
+            info: async () => ok(),
+            pull: async () => {
+                pullsStarted++;
+                await gate;
+                return ok();
+            },
+            inspectLabel: async () => ok('1'),
+        };
+        const ref = 'ghcr.io/test/img@sha256:dedupeme';
+        const [a, b, c] = await Promise.all([
+            pullImageWithRetry(ref, docker),
+            pullImageWithRetry(ref, docker),
+            pullImageWithRetry(ref, docker),
+        ]);
+        expect(a.exitCode).toBe(0);
+        expect(b.exitCode).toBe(0);
+        expect(c.exitCode).toBe(0);
+        expect(pullsStarted).toBe(1); // coalesced
+    });
+    it('does not coalesce different image refs', async () => {
+        let pullsStarted = 0;
+        const docker = {
+            info: async () => ok(),
+            pull: async () => {
+                pullsStarted++;
+                return ok();
+            },
+            inspectLabel: async () => ok('1'),
+        };
+        await Promise.all([
+            pullImageWithRetry('ghcr.io/a@sha256:111', docker),
+            pullImageWithRetry('ghcr.io/b@sha256:222', docker),
+            pullImageWithRetry('ghcr.io/c@sha256:333', docker),
+        ]);
+        expect(pullsStarted).toBe(3);
+    });
+});
+// ── runBootstrap — orchestrator ───────────────────────────────────
+describe('runBootstrap — happy path', () => {
+    it('exits 0 when daemon up + 3 pulls succeed + handshake passes + services start', async () => {
+        const docker = makeMockDocker();
+        const sub = silentSubprocess();
+        const result = await runBootstrap({ withSmoke: false, skipAuthLogin: true }, { docker, digests: FIXTURE_DIGESTS, runOlamSubcommand: sub.runOlamSubcommand });
+        expect(result.exitCode).toBe(0);
+        expect(sub.calls).toEqual([
+            ['host-cp', 'start'],
+            ['auth', 'up'],
+        ]);
+    });
+    it('with --with-smoke, dispatches a smoke-test world create', async () => {
+        const docker = makeMockDocker();
+        const sub = silentSubprocess();
+        const result = await runBootstrap({ withSmoke: true, skipAuthLogin: true }, { docker, digests: FIXTURE_DIGESTS, runOlamSubcommand: sub.runOlamSubcommand });
+        expect(result.exitCode).toBe(0);
+        const lastCall = sub.calls[sub.calls.length - 1] ?? [];
+        expect(lastCall[0]).toBe('create');
+        expect(lastCall).toContain('--workspace');
+        expect(lastCall).toContain('smoke');
+    });
+    it('without --skip-auth-login (and OLAM_BOOTSTRAP_SKIP_AUTH_LOGIN unset), runs auth login', async () => {
+        const docker = makeMockDocker();
+        const sub = silentSubprocess();
+        delete process.env.OLAM_BOOTSTRAP_SKIP_AUTH_LOGIN;
+        const result = await runBootstrap({ withSmoke: false, skipAuthLogin: false }, { docker, digests: FIXTURE_DIGESTS, runOlamSubcommand: sub.runOlamSubcommand });
+        expect(result.exitCode).toBe(0);
+        expect(sub.calls).toContainEqual(['auth', 'login']);
+    });
+});
+describe('runBootstrap — failure paths', () => {
+    it('exits EXIT_GENERIC_ERROR (1) when docker daemon not reachable', async () => {
+        const docker = makeMockDocker({ infoOk: false });
+        const sub = silentSubprocess();
+        const result = await runBootstrap({ withSmoke: false, skipAuthLogin: true }, { docker, digests: FIXTURE_DIGESTS, runOlamSubcommand: sub.runOlamSubcommand });
+        expect(result.exitCode).toBe(EXIT_GENERIC_ERROR);
+        expect(result.summary).toContain('docker daemon not reachable');
+        // No subcommands run — bailed at step 1.
+        expect(sub.calls).toEqual([]);
+    });
+    it('exits EXIT_BOOTSTRAP_PULL_FAILED (3) when an image pull fails terminally', async () => {
+        const calls = { pull: [], inspect: [] };
+        const docker = makeMockDocker({
+            pullResults: new Map([
+                [`ghcr.io/pleri/olam-host-cp@${FIXTURE_DIGESTS['host-cp']}`, err('manifest unknown', 1)],
+            ]),
+            calls,
+        });
+        const sub = silentSubprocess();
+        const result = await runBootstrap({ withSmoke: false, skipAuthLogin: true }, { docker, digests: FIXTURE_DIGESTS, runOlamSubcommand: sub.runOlamSubcommand });
+        expect(result.exitCode).toBe(EXIT_BOOTSTRAP_PULL_FAILED);
+        expect(result.summary).toContain('pull failed');
+        expect(sub.calls).toEqual([]);
+    });
+    it('exits EXIT_PROTOCOL_MISMATCH (4) when an image LABEL is missing', async () => {
+        const docker = makeMockDocker({
+            // Missing LABEL → docker inspect returns "<no value>".
+            inspectLabels: new Map([
+                [`ghcr.io/pleri/olam-devbox@${FIXTURE_DIGESTS.devbox}`, '<no value>'],
+            ]),
+        });
+        const sub = silentSubprocess();
+        const result = await runBootstrap({ withSmoke: false, skipAuthLogin: true }, { docker, digests: FIXTURE_DIGESTS, runOlamSubcommand: sub.runOlamSubcommand });
+        expect(result.exitCode).toBe(EXIT_PROTOCOL_MISMATCH);
+        expect(result.summary).toContain('devbox');
+    });
+    it('exits EXIT_PROTOCOL_MISMATCH when an image LABEL declares non-overlapping versions', async () => {
+        const docker = makeMockDocker({
+            inspectLabels: new Map([
+                [`ghcr.io/pleri/olam-auth@${FIXTURE_DIGESTS.auth}`, '99'],
+            ]),
+        });
+        const sub = silentSubprocess();
+        const result = await runBootstrap({ withSmoke: false, skipAuthLogin: true }, { docker, digests: FIXTURE_DIGESTS, runOlamSubcommand: sub.runOlamSubcommand });
+        expect(result.exitCode).toBe(EXIT_PROTOCOL_MISMATCH);
+        expect(result.summary).toContain('auth');
+    });
+    it('exits EXIT_GENERIC_ERROR when host-cp start fails', async () => {
+        const docker = makeMockDocker();
+        const calls = [];
+        const runOlamSubcommand = (args) => {
+            calls.push([...args]);
+            if (args[0] === 'host-cp')
+                return err('host-cp could not start', 1);
+            return ok();
+        };
+        const result = await runBootstrap({ withSmoke: false, skipAuthLogin: true }, { docker, digests: FIXTURE_DIGESTS, runOlamSubcommand });
+        expect(result.exitCode).toBe(EXIT_GENERIC_ERROR);
+        expect(result.summary).toContain('host-cp');
+    });
+    it('exits EXIT_GENERIC_ERROR when auth up fails', async () => {
+        const docker = makeMockDocker();
+        const runOlamSubcommand = (args) => {
+            if (args[0] === 'auth' && args[1] === 'up')
+                return err('auth-service docker port busy', 1);
+            return ok();
+        };
+        const result = await runBootstrap({ withSmoke: false, skipAuthLogin: true }, { docker, digests: FIXTURE_DIGESTS, runOlamSubcommand });
+        expect(result.exitCode).toBe(EXIT_GENERIC_ERROR);
+        expect(result.summary).toContain('auth up');
+    });
+});
+describe('runBootstrap — registry override + digest resolution', () => {
+    it('uses --registry flag when provided', async () => {
+        const calls = { pull: [], inspect: [] };
+        const docker = makeMockDocker({ calls });
+        const sub = silentSubprocess();
+        await runBootstrap({ withSmoke: false, skipAuthLogin: true, registry: 'localhost:5000/test' }, { docker, digests: FIXTURE_DIGESTS, runOlamSubcommand: sub.runOlamSubcommand });
+        expect(calls.pull[0]).toContain('localhost:5000/test/olam-host-cp');
+    });
+    it('falls back to digests.$registry when --registry not provided', async () => {
+        const calls = { pull: [], inspect: [] };
+        const docker = makeMockDocker({ calls });
+        const sub = silentSubprocess();
+        await runBootstrap({ withSmoke: false, skipAuthLogin: true }, {
+            docker,
+            digests: { ...FIXTURE_DIGESTS, $registry: 'ghcr.io/atlas-namespace' },
+            runOlamSubcommand: sub.runOlamSubcommand,
+        });
+        expect(calls.pull[0]).toContain('ghcr.io/atlas-namespace/olam-host-cp');
+    });
+    it('pulls all 3 images with the correct digest references', async () => {
+        const calls = { pull: [], inspect: [] };
+        const docker = makeMockDocker({ calls });
+        const sub = silentSubprocess();
+        await runBootstrap({ withSmoke: false, skipAuthLogin: true }, { docker, digests: FIXTURE_DIGESTS, runOlamSubcommand: sub.runOlamSubcommand });
+        expect(calls.pull).toHaveLength(3);
+        expect(calls.pull).toContain(`ghcr.io/pleri/olam-host-cp@${FIXTURE_DIGESTS['host-cp']}`);
+        expect(calls.pull).toContain(`ghcr.io/pleri/olam-auth@${FIXTURE_DIGESTS.auth}`);
+        expect(calls.pull).toContain(`ghcr.io/pleri/olam-devbox@${FIXTURE_DIGESTS.devbox}`);
+    });
+});
+// ── loadImageDigests — unit ───────────────────────────────────────
+describe('loadImageDigests', () => {
+    it('throws when image-digests.json is absent', () => {
+        expect(() => loadImageDigests('/tmp/no-such-install-' + Date.now())).toThrow(/image-digests\.json missing/);
+    });
+});
+//# sourceMappingURL=bootstrap.test.js.map

package/dist/commands/__tests__/bootstrap.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.test.js","sourceRoot":"","sources":["../../../src/commands/__tests__/bootstrap.test.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,iDAAiD;AACjD,mEAAmE;AAEnE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,GAIjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,qEAAqE;AAErE,SAAS,QAAQ,CAAC,IAAY;IAC5B,wEAAwE;IACxE,qEAAqE;IACrE,+CAA+C;IAC/C,MAAM,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5E,OAAO,UAAU,GAAG,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,eAAe,GAAiB;IACpC,SAAS,EAAE,QAAQ,CAAC,gEAAgE,CAAC;IACrF,IAAI,EAAE,QAAQ,CAAC,+DAA+D,CAAC;IAC/E,MAAM,EAAE,QAAQ,CAAC,gEAAgE,CAAC;IAClF,SAAS,EAAE,eAAe;IAC1B,kBAAkB,EAAE,QAAQ;CAC7B,CAAC;AAEF,SAAS,EAAE,CAAC,SAAiB,EAAE;IAC7B,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAC7C,CAAC;AACD,SAAS,GAAG,CAAC,MAAc,EAAE,WAAmB,CAAC;IAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;AAC1C,CAAC;AAUD,SAAS,cAAc,CAAC,OAAoB,EAAE;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACtD,OAAO;QACL,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzF,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACxB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,OAAO,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,CAAC,CAAC;QACF,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACvC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;YAClD,OAAO,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QAC1B,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB;IAIvB,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,OAAO;QACL,KAAK;QACL,iBAAiB,EAAE,CAAC,IAAI,EAAE,EAAE;YAC1B,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YACtB,OAAO,EAAE,EAAE,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,kEAAkE;AAClE,UAAU,CAAC,GAAG,EAAE;IACd,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACjE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC,CAAC,CAAC;AACH,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,eAAe,EAAE,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,oEAAoE;AAEpE,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,MAAM,GAAe;YACzB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE;YACtB,IAAI,EAAE,KAAK,IAAI,EAAE;gBACf,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,EAAE,CAAC;YACd,CAAC;YACD,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC;SAClC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;QAC/E,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,MAAM,GAAe;YACzB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE;YACtB,IAAI,EAAE,KAAK,IAAI,EAAE;gBACf,KAAK,EAAE,CAAC;gBACR,IAAI,KAAK,KAAK,CAAC;oBAAE,OAAO,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;gBACrD,OAAO,EAAE,EAAE,CAAC;YACd,CAAC;YACD,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC;SAClC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;QAC/E,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,MAAM,GAAe;YACzB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE;YACtB,IAAI,EAAE,KAAK,IAAI,EAAE;gBACf,KAAK,EAAE,CAAC;gBACR,OAAO,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;YACpC,CAAC;YACD,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC;SAClC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;QAC/E,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,WAAW,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAe;YACzB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE;YACtB,IAAI,EAAE,KAAK,IAAI,EAAE;gBACf,YAAY,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC;gBACX,OAAO,EAAE,EAAE,CAAC;YACd,CAAC;YACD,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC;SAClC,CAAC;QACF,MAAM,GAAG,GAAG,kCAAkC,CAAC;QAC/C,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAClC,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC;YAC/B,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC;YAC/B,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,MAAM,MAAM,GAAe;YACzB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE;YACtB,IAAI,EAAE,KAAK,IAAI,EAAE;gBACf,YAAY,EAAE,CAAC;gBACf,OAAO,EAAE,EAAE,CAAC;YACd,CAAC;YACD,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC;SAClC,CAAC;QACF,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,kBAAkB,CAAC,sBAAsB,EAAE,MAAM,CAAC;YAClD,kBAAkB,CAAC,sBAAsB,EAAE,MAAM,CAAC;YAClD,kBAAkB,CAAC,sBAAsB,EAAE,MAAM,CAAC;SACnD,CAAC,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,qEAAqE;AAErE,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,EACzC,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAC/E,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YACxB,CAAC,SAAS,EAAE,OAAO,CAAC;YACpB,CAAC,MAAM,EAAE,IAAI,CAAC;SACf,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,EACxC,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAC/E,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC1C,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,EAC1C,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAC/E,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,EACzC,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAC/E,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QAChE,yCAAyC;QACzC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAA2C,CAAC;QACjF,MAAM,MAAM,GAAG,cAAc,CAAC;YAC5B,WAAW,EAAE,IAAI,GAAG,CAAC;gBACnB,CAAC,8BAA8B,eAAe,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;aACzF,CAAC;YACF,KAAK;SACN,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,EACzC,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAC/E,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,MAAM,GAAG,cAAc,CAAC;YAC5B,uDAAuD;YACvD,aAAa,EAAE,IAAI,GAAG,CAAC;gBACrB,CAAC,6BAA6B,eAAe,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC;aACtE,CAAC;SACH,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,EACzC,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAC/E,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,MAAM,MAAM,GAAG,cAAc,CAAC;YAC5B,aAAa,EAAE,IAAI,GAAG,CAAC;gBACrB,CAAC,2BAA2B,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC;aAC1D,CAAC;SACH,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,EACzC,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAC/E,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,KAAK,GAAe,EAAE,CAAC;QAC7B,MAAM,iBAAiB,GAAG,CAAC,IAAuB,EAAuB,EAAE;YACzE,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YACtB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;YACpE,OAAO,EAAE,EAAE,CAAC;QACd,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,EACzC,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,CACxD,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,iBAAiB,GAAG,CAAC,IAAuB,EAAuB,EAAE;YACzE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,OAAO,GAAG,CAAC,+BAA+B,EAAE,CAAC,CAAC,CAAC;YAC3F,OAAO,EAAE,EAAE,CAAC;QACd,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,EACzC,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,CACxD,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sDAAsD,EAAE,GAAG,EAAE;IACpE,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,EAAc,EAAE,OAAO,EAAE,EAAc,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;QAC/B,MAAM,YAAY,CAChB,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,qBAAqB,EAAE,EAC1E,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAC/E,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,EAAc,EAAE,OAAO,EAAE,EAAc,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;QAC/B,MAAM,YAAY,CAChB,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,EACzC;YACE,MAAM;YACN,OAAO,EAAE,EAAE,GAAG,eAAe,EAAE,SAAS,EAAE,yBAAyB,EAAE;YACrE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;SACzC,CACF,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,EAAc,EAAE,OAAO,EAAE,EAAc,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;QAC/B,MAAM,YAAY,CAChB,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,EACzC,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAC/E,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,8BAA8B,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACzF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2BAA2B,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;QAChF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,6BAA6B,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,qEAAqE;AAErE,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,uBAAuB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAC1E,6BAA6B,CAC9B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/__tests__/upgrade.rollback.test.js

@@ -67,7 +67,7 @@ function buildFixtureImage(tag, labelValue) {
     return result.status === 0;
 }
 function bakedSha(tag) {
-    const result = spawnSync('docker', ['inspect', '--format', '{{index .Config.Labels "olam_build_sha"}}', tag], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+    const result = spawnSync('docker', ['inspect', '--format', '{{index .Config.Labels "olam.build.sha"}}', tag], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
     if (result.status !== 0)
         return null;
     return (result.stdout ?? '').trim();

package/dist/commands/__tests__/upgrade.swap.test.js

@@ -87,7 +87,7 @@ function imageExists(tag) {
     return imageId(tag) !== null;
 }
 function bakedSha(tag) {
-    const result = spawnSync('docker', ['inspect', '--format', '{{index .Config.Labels "olam_build_sha"}}', tag], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+    const result = spawnSync('docker', ['inspect', '--format', '{{index .Config.Labels "olam.build.sha"}}', tag], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
     if (result.status !== 0)
         return null;
     return (result.stdout ?? '').trim();

package/dist/commands/auth-upgrade.d.ts

@@ -9,14 +9,22 @@
  *   smoke test: POST /credentials/add provider=codex must NOT return a Claude URL
  */
 import type { Command } from 'commander';
+import { type DockerImpl, type ImageDigests } from './bootstrap.js';
 export interface AuthUpgradeOpts {
     readonly yes: boolean;
     readonly skipRecreate: boolean;
+    /**
+     * Phase C — C6: opt into the legacy source-build path for auth-service.
+     * Only works when isDevMode() is true. Default false → pull
+     * `olam-auth@sha256:<digest>` from ghcr.io and recreate.
+     */
+    readonly fromSource: boolean;
 }
 /** Normalise raw Commander option object into typed opts. */
 export declare function parseAuthUpgradeOpts(raw: {
     yes?: boolean;
     skipRecreate?: boolean;
+    fromSource?: boolean;
 }): AuthUpgradeOpts;
 /**
  * Check cwd looks like the olam repo root for auth-service.
@@ -43,5 +51,38 @@ export declare function smokeTestCodexProvider(authSecret: string | null): Promi
     ok: false;
     error: string;
 }>;
+/**
+ * Phase C — C6: default `olam auth upgrade` flow for installed CLIs.
+ *
+ * Pulls `olam-auth@sha256:<digest>` from ghcr.io (via bootstrap.ts's
+ * retry-throttle-coalesce helper), runs the protocol-version handshake,
+ * re-tags to `olam-auth:local` (the canonical tag the
+ * AuthContainerController expects), then docker stop + docker rm +
+ * controller.start() — same recreate path as the legacy --from-source
+ * flow uses post-build.
+ */
+export interface AuthUpgradePullDeps {
+    readonly docker?: DockerImpl;
+    readonly digests?: ImageDigests;
+    readonly registry?: string;
+    /**
+     * Recreate driver. Default: stop + rm + AuthContainerController.start
+     * + waitForAuthHealth. Tests stub to avoid real docker calls.
+     */
+    readonly recreateAuth?: () => Promise<{
+        ok: boolean;
+        error?: string;
+    }>;
+    /** Test-only: skip the docker-tag step (e.g. when injecting). */
+    readonly tagImpl?: (from: string, to: string) => {
+        ok: boolean;
+        error?: string;
+    };
+}
+export interface AuthUpgradePullResult {
+    readonly exitCode: number;
+    readonly summary: string;
+}
+export declare function runAuthUpgradePullByDigest(deps?: AuthUpgradePullDeps): Promise<AuthUpgradePullResult>;
 export declare function registerAuthUpgrade(auth: Command): void;
 //# sourceMappingURL=auth-upgrade.d.ts.map

package/dist/commands/auth-upgrade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-upgrade.d.ts","sourceRoot":"","sources":["../../src/commands/auth-upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAezC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,6DAA6D;AAC7D,wBAAgB,oBAAoB,CAAC,GAAG,EAAE;IACxC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GAAG,eAAe,CAKlB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAW7F;AAED,uEAAuE;AACvE,wBAAsB,iBAAiB,CAAC,SAAS,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAc5E;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAuCtD;AAiMD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CASvD"}
+{"version":3,"file":"auth-upgrade.d.ts","sourceRoot":"","sources":["../../src/commands/auth-upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASzC,OAAO,EAIL,KAAK,UAAU,EACf,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAexB,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,6DAA6D;AAC7D,wBAAgB,oBAAoB,CAAC,GAAG,EAAE;IACxC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,GAAG,eAAe,CAMlB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAW7F;AAED,uEAAuE;AACvE,wBAAsB,iBAAiB,CAAC,SAAS,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAc5E;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAuCtD;AA4DD;;;;;;;;;GASG;AAEH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,iEAAiE;IACjE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAClF;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,qBAAqB,CAAC,CAqFhC;AAgMD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAqCvD"}

package/dist/commands/auth-upgrade.js

@@ -11,10 +11,15 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { spawnSync } from 'node:child_process';
+import ora from 'ora';
 import pc from 'picocolors';
-import { printError, printSuccess, printInfo, printWarning } from '../output.js';
+import { printError, printSuccess, printInfo, printWarning, printHeader } from '../output.js';
 import { readAuthSecret } from './host-cp.js';
 import { AuthContainerController } from '@olam/core/src/auth/index.js';
+import { loadImageDigests, pullImageWithRetry, realDocker, } from './bootstrap.js';
+import { EXIT_BOOTSTRAP_PULL_FAILED, EXIT_GENERIC_ERROR, EXIT_PROTOCOL_MISMATCH, } from '../exit-codes.js';
+import { checkProtocolOverlap, parseProtocolVersionsLabel } from '../protocol-version.js';
+import { isDevMode, MissingBuildScriptError } from '../install-root.js';
 const AUTH_PORT = 9999;
 const AUTH_HEALTH_URL = `http://127.0.0.1:${AUTH_PORT}/health`;
 const AUTH_ADD_URL = `http://127.0.0.1:${AUTH_PORT}/credentials/add`;
@@ -23,6 +28,7 @@ export function parseAuthUpgradeOpts(raw) {
     return {
         yes: raw.yes === true,
         skipRecreate: raw.skipRecreate === true,
+        fromSource: raw.fromSource === true,
     };
 }
 /**
@@ -143,6 +149,117 @@ function printTimings(timings) {
     }
     printInfo('total', `${(total / 1000).toFixed(1)}s`);
 }
+export async function runAuthUpgradePullByDigest(deps = {}) {
+    const docker = deps.docker ?? realDocker;
+    const digests = deps.digests ?? loadImageDigests();
+    const registry = deps.registry ?? digests.$registry ?? 'ghcr.io/pleri';
+    printHeader('olam auth upgrade (pull-by-digest)');
+    // Step 1 — daemon smoke.
+    const infoSpinner = ora('Checking docker daemon').start();
+    const info = await docker.info();
+    if (info.exitCode !== 0) {
+        infoSpinner.fail('docker daemon not reachable');
+        process.stderr.write(`${pc.red('error')} docker info exited with ${info.exitCode}.\n` +
+            '  Ensure Docker is running, then retry.\n');
+        return { exitCode: EXIT_GENERIC_ERROR, summary: 'docker daemon not reachable' };
+    }
+    infoSpinner.succeed('docker daemon reachable');
+    // Step 2 — pull olam-auth by digest.
+    const ref = `${registry}/olam-auth@${digests.auth}`;
+    const pullSpinner = ora(`Pulling ${ref.slice(0, 60)}…`).start();
+    const pullResult = await pullImageWithRetry(ref, docker);
+    if (pullResult.exitCode !== 0) {
+        pullSpinner.fail('Pull failed');
+        process.stderr.write(`${pc.red('error')} pull failed (exit ${pullResult.exitCode}):\n` +
+            `  ${pullResult.stderr.split('\n')[0] ?? '(empty)'}\n` +
+            '\n  Remedy: re-run after resolving network / GHCR availability.\n' +
+            '  For monorepo dev, `OLAM_DEV=1 olam auth upgrade --from-source` builds locally.\n');
+        return { exitCode: EXIT_BOOTSTRAP_PULL_FAILED, summary: 'pull failed: auth' };
+    }
+    pullSpinner.succeed('Image pulled');
+    // Step 3 — protocol-version handshake.
+    const handshakeSpinner = ora('Verifying olam.protocol.versions handshake').start();
+    const inspect = await docker.inspectLabel(ref, 'olam.protocol.versions');
+    if (inspect.exitCode !== 0) {
+        handshakeSpinner.fail('Could not inspect auth image');
+        process.stderr.write(`${pc.red('error')} docker inspect ${ref} failed: ${inspect.stderr}\n`);
+        return { exitCode: EXIT_GENERIC_ERROR, summary: 'inspect failed: auth' };
+    }
+    const labelValue = (inspect.stdout || '').trim();
+    const versions = parseProtocolVersionsLabel(labelValue === '<no value>' ? '' : labelValue);
+    const decision = checkProtocolOverlap(versions);
+    if (!decision.compatible) {
+        handshakeSpinner.fail('Protocol mismatch on auth image');
+        process.stderr.write(`${pc.red('error')} ${decision.remedy}\n`);
+        return { exitCode: EXIT_PROTOCOL_MISMATCH, summary: 'protocol mismatch: auth' };
+    }
+    handshakeSpinner.succeed('Protocol handshake passed');
+    // Step 4 — re-tag pulled-by-digest to olam-auth:local.
+    const tagSpinner = ora('Tagging digest → olam-auth:local').start();
+    const tagger = deps.tagImpl ?? defaultTagAuth;
+    const tagResult = tagger(ref, 'olam-auth:local');
+    if (!tagResult.ok) {
+        tagSpinner.fail('docker tag failed');
+        process.stderr.write(`${pc.red('error')} ${tagResult.error ?? 'docker tag failed'}\n`);
+        return { exitCode: EXIT_GENERIC_ERROR, summary: 'tag failed: auth' };
+    }
+    tagSpinner.succeed('Re-tagged → olam-auth:local');
+    // Step 5 — recreate auth-service container.
+    const authSpinner = ora('Recreating auth-service container').start();
+    const recreate = deps.recreateAuth ?? defaultRecreateAuth;
+    const recreateResult = await recreate();
+    if (!recreateResult.ok) {
+        authSpinner.fail('auth-service recreate failed');
+        process.stderr.write(`${pc.red('error')} ${recreateResult.error ?? 'unknown failure'}\n`);
+        return { exitCode: EXIT_GENERIC_ERROR, summary: 'auth recreate failed' };
+    }
+    authSpinner.succeed('auth-service running on new image');
+    printSuccess('Auth upgrade complete (pull-by-digest)');
+    printInfo('digest', digests.auth.slice(0, 32) + '…');
+    return { exitCode: 0, summary: 'auth upgraded' };
+}
+function defaultTagAuth(from, to) {
+    try {
+        const r = spawnSync('docker', ['tag', from, to], {
+            encoding: 'utf-8',
+            stdio: ['ignore', 'ignore', 'pipe'],
+        });
+        if (r.status === 0 && r.error === undefined)
+            return { ok: true };
+        return {
+            ok: false,
+            error: (r.stderr ?? '').trim() || r.error?.message || 'docker tag failed',
+        };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            error: err instanceof Error ? `spawnSync threw: ${err.message}` : 'spawnSync threw',
+        };
+    }
+}
+async function defaultRecreateAuth() {
+    try {
+        spawnSync('docker', ['stop', 'olam-auth'], {
+            encoding: 'utf-8',
+            stdio: ['ignore', 'ignore', 'ignore'],
+        });
+        spawnSync('docker', ['rm', 'olam-auth'], {
+            encoding: 'utf-8',
+            stdio: ['ignore', 'ignore', 'ignore'],
+        });
+        const controller = new AuthContainerController();
+        controller.start();
+        const healthy = await waitForAuthHealth(15_000);
+        if (!healthy) {
+            return { ok: false, error: 'auth-service /health did not respond within 15s' };
+        }
+        return { ok: true };
+    }
+    catch (err) {
+        return { ok: false, error: err instanceof Error ? err.message : String(err) };
+    }
+}
 // ── Main handler ──────────────────────────────────────────────────
 async function handleAuthUpgrade(opts) {
     const cwd = process.cwd();
@@ -175,8 +292,23 @@ async function handleAuthUpgrade(opts) {
         }
     }
     const timings = [];
-    // Step a: build the auth image.
-    const buildScript = path.join(cwd, 'packages/adapters/src/docker/build-auth.sh');
+    // Step a: build the auth image. Phase B6: resolve the build script via
+    // installRoot + 2-condition dev-mode check (OLAM_DEV=1 + monorepo
+    // siblings). Outside dev mode, surface the named remedy from
+    // MissingBuildScriptError and exit cleanly — published-image upgrades
+    // (Phase C's C6) take the no-flag default path.
+    let buildScript;
+    try {
+        const { resolveBuildScript } = await import('../install-root.js');
+        buildScript = resolveBuildScript({
+            scriptRelPath: 'packages/adapters/src/docker/build-auth.sh',
+        });
+    }
+    catch (err) {
+        printError(err instanceof Error ? err.message : String(err));
+        process.exitCode = 1;
+        return;
+    }
     const imageResult = runStep('bash build-auth.sh', 'bash', [buildScript], { cwd });
     timings.push({ label: 'docker image build', durationMs: imageResult.durationMs });
     if (!imageResult.ok) {
@@ -267,11 +399,31 @@ async function handleAuthUpgrade(opts) {
 export function registerAuthUpgrade(auth) {
     auth
         .command('upgrade')
-        .description('Rebuild the olam-auth image and force-recreate the container')
+        .description('Upgrade the olam-auth container. Default: pull olam-auth@<digest> from ghcr.io and recreate. ' +
+        'Use --from-source to rebuild from monorepo source (requires OLAM_DEV=1).')
         .option('-y, --yes', 'Skip the confirmation prompt')
-        .option('--skip-recreate', 'Build the image only; skip container stop/rm/start')
+        .option('--skip-recreate', 'Build the image only; skip container stop/rm/start (only with --from-source)')
+        .option('--from-source', 'Build olam-auth from monorepo source (legacy path).\n' +
+        '                              Requires OLAM_DEV=1 + a `packages/` sibling at the install root.')
         .action(async (opts) => {
-        await handleAuthUpgrade(parseAuthUpgradeOpts(opts));
+        const parsed = parseAuthUpgradeOpts(opts);
+        if (parsed.fromSource) {
+            if (!isDevMode()) {
+                printError(new MissingBuildScriptError('packages/adapters/src/docker/build-auth.sh').message);
+                process.exitCode = 1;
+                return;
+            }
+            await handleAuthUpgrade(parsed);
+            return;
+        }
+        try {
+            const result = await runAuthUpgradePullByDigest();
+            process.exitCode = result.exitCode;
+        }
+        catch (err) {
+            printError(err instanceof Error ? err.message : String(err));
+            process.exitCode = EXIT_GENERIC_ERROR;
+        }
     });
 }
 //# sourceMappingURL=auth-upgrade.js.map