@pleri/olam-cli 0.1.145 → 0.1.147

package/dist/lib/port-forward.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"port-forward.js","sourceRoot":"","sources":["../../src/lib/port-forward.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AACvC,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;AACrF,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;AAEnF,wFAAwF;AACxF,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAanC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAA8C,EAAE;IAEhD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC;IAChD,OAAO,KAAK,CAAC,WAAW,EAAE,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY,EAAE,SAAiB;IACjE,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,IAAI,GAAG,KAAK,CAAC;QAEjB,SAAS,MAAM,CAAC,MAAe;YAC7B,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,iFAAiF;IACjF,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACrG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,GAAG,EAAE;QACV,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;IAC/E,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAqB;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,YAAY,CAAC,IAAqB;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,OAAe,EAAE,GAAW;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,OAAO,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IAC5C,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAMD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,SAAiB,EACjB,MAAc,EACd,YAAoB,iBAAiB,EACrC,aAAqB,iBAAiB,EACtC,OAAwB,EAAE;IAE1B,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAE1C,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC;IACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,WAAW,GAAwB,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5C,CAAC;QAED,yEAAyE;QACzE,MAAM,KAAK,GAAG,SAAS,CACrB,SAAS,EACT;YACE,WAAW,EAAE,OAAO;YACpB,cAAc;YACd,IAAI,EAAE,SAAS;YACf,MAAM;YACN,GAAG,SAAS,IAAI,UAAU,EAAE;SAC7B,EACD;YACE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;YACrC,QAAQ,EAAE,IAAI;SACf,CACF,CAAC;QAEF,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,qCAAqC;QACvF,CAAC;QAED,mDAAmD;QACnD,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAEjC,2EAA2E;QAC3E,KAAK,CAAC,KAAK,EAAE,CAAC;QAEd,4DAA4D;QAC5D,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YACtB,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAC3C,CAAC;YAAS,CAAC;QACT,WAAW,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAwB,EAAE;IACxD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B;IAC/B,CAAC;IACD,IAAI,CAAC;QAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC"}

package/dist/lib/upgrade-kubernetes.d.ts

@@ -0,0 +1,77 @@
+/**
+ * upgrade-kubernetes.ts — 8-step kubernetes upgrade path for olam upgrade.
+ *
+ * Phase 1b C2 of olam-host-suite-phase-1b-k3s-beta-flavour (plan
+ * ~/.claude/plans/olam-host-suite-phase-1b-k3s-beta-flavour.md).
+ *
+ * Decisions consumed:
+ *   D10 — context-allowlist + OLAM_K8S_CONTEXT_ACK strict-equality check
+ *   D12 — Secret pre-check (base64-decode + key-name + placeholder exact match)
+ *   D14 — --force-refresh-manifests flag + --accept-security-regression guard
+ *   D15 — kubectl rollout status --timeout=90s; state snapshot on failure
+ *   D17 — port-forward spawn via flock (spawnPortForward from port-forward.ts)
+ *   D22 — probeKubernetesApiReachable pre-flight via kubectl-wrap (5s timeout)
+ *
+ * Step order:
+ *   0  probeKubernetesApiReachable — 5s timeout kubectl cluster-info
+ *   1  D10 context-allowlist + OLAM_K8S_CONTEXT_ACK strict-equality byte-for-byte
+ *   2  D12 Secret pre-check (olam-host-cp-secret; base64-decode; key-name check)
+ *   3  kubectl apply --context <pinned> -f ~/.olam/k8s/manifests/
+ *   4  D15 kubectl rollout status --context <pinned> --timeout=90s (95s wrap)
+ *   5  D17 port-forward spawn via flock
+ *   6  verify /health returns X-Olam-Engine: kubernetes
+ *   7  emit upgrade.complete instrumentation event
+ *   8  success message
+ *
+ * Manifests NOT auto-rolled-back on failure (D15 spec). Operator must
+ * manually intervene; state snapshot is printed on failure.
+ */
+import { kubectlWrap } from './kubectl-wrap.js';
+import { spawnPortForward, probePortForwardLiveness, type PortForwardDeps } from './port-forward.js';
+import { emitUpgradeComplete, type EmitOpts } from './instrumentation.js';
+import { runManifestRefresh } from './manifest-refresh.js';
+export declare const OLAM_K8S_MANIFESTS_DIR: string;
+export declare const K8S_NAMESPACE = "olam";
+export declare const HOST_CP_SECRET_NAME = "olam-host-cp-secret";
+export declare const HOST_CP_DEPLOYMENT_NAME = "olam-host-cp";
+export declare const PORT_FORWARD_TARGET = "service/olam-host-cp";
+export declare const HOST_CP_HEALTH_URL = "http://127.0.0.1:19000/health";
+export interface UpgradeKubernetesDeps {
+    /** Override kubectl-wrap for tests. */
+    readonly kubectlWrapImpl?: typeof kubectlWrap;
+    /** Override spawnPortForward for tests. */
+    readonly spawnPortForwardImpl?: typeof spawnPortForward;
+    /** Override probePortForwardLiveness for tests. */
+    readonly probePortForwardLivenessImpl?: typeof probePortForwardLiveness;
+    /** Override fetch for /health verification in tests. */
+    readonly fetchImpl?: (url: string, init?: RequestInit) => Promise<Response>;
+    /** Override emitUpgradeComplete for tests. */
+    readonly emitImpl?: typeof emitUpgradeComplete;
+    /** Override manifest refresh for tests. */
+    readonly manifestRefreshImpl?: typeof runManifestRefresh;
+    /** Override manifests dir path for tests. */
+    readonly manifestsDir?: string;
+    /** Override PortForwardDeps for tests (passed into spawnPortForward). */
+    readonly portForwardDeps?: PortForwardDeps;
+    /** Override emit opts for tests. */
+    readonly emitOpts?: EmitOpts;
+    /** Override stdout for tests. */
+    readonly stdout?: NodeJS.WritableStream;
+    /** Override stderr for tests. */
+    readonly stderr?: NodeJS.WritableStream;
+}
+export interface UpgradeKubernetesOpts {
+    readonly forceRefreshManifests?: boolean;
+    readonly acceptSecurityRegression?: boolean;
+}
+export interface UpgradeKubernetesResult {
+    readonly exitCode: number;
+    readonly summary: string;
+}
+/**
+ * Main entrypoint for the kubernetes upgrade path.
+ *
+ * Called from upgrade.ts when host.substrate === 'kubernetes'.
+ */
+export declare function runUpgradeKubernetes(opts?: UpgradeKubernetesOpts, deps?: UpgradeKubernetesDeps): Promise<UpgradeKubernetesResult>;
+//# sourceMappingURL=upgrade-kubernetes.d.ts.map

package/dist/lib/upgrade-kubernetes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade-kubernetes.d.ts","sourceRoot":"","sources":["../../src/lib/upgrade-kubernetes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAOH,OAAO,EAAE,WAAW,EAAwB,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,KAAK,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAA4B,MAAM,uBAAuB,CAAC;AAGrF,eAAO,MAAM,sBAAsB,QAA2C,CAAC;AAC/E,eAAO,MAAM,aAAa,SAAS,CAAC;AACpC,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AACtD,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAC1D,eAAO,MAAM,kBAAkB,kCAAkC,CAAC;AAclE,MAAM,WAAW,qBAAqB;IACpC,uCAAuC;IACvC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,WAAW,CAAC;IAC9C,2CAA2C;IAC3C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,gBAAgB,CAAC;IACxD,mDAAmD;IACnD,QAAQ,CAAC,4BAA4B,CAAC,EAAE,OAAO,wBAAwB,CAAC;IACxE,wDAAwD;IACxD,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5E,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAC/C,2CAA2C;IAC3C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,kBAAkB,CAAC;IACzD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAC7B,iCAAiC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IACxC,iCAAiC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CACzC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;CAC7C;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAqJD;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,GAAE,qBAA0B,EAChC,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,uBAAuB,CAAC,CAgKlC"}

package/dist/lib/upgrade-kubernetes.js

@@ -0,0 +1,277 @@
+/**
+ * upgrade-kubernetes.ts — 8-step kubernetes upgrade path for olam upgrade.
+ *
+ * Phase 1b C2 of olam-host-suite-phase-1b-k3s-beta-flavour (plan
+ * ~/.claude/plans/olam-host-suite-phase-1b-k3s-beta-flavour.md).
+ *
+ * Decisions consumed:
+ *   D10 — context-allowlist + OLAM_K8S_CONTEXT_ACK strict-equality check
+ *   D12 — Secret pre-check (base64-decode + key-name + placeholder exact match)
+ *   D14 — --force-refresh-manifests flag + --accept-security-regression guard
+ *   D15 — kubectl rollout status --timeout=90s; state snapshot on failure
+ *   D17 — port-forward spawn via flock (spawnPortForward from port-forward.ts)
+ *   D22 — probeKubernetesApiReachable pre-flight via kubectl-wrap (5s timeout)
+ *
+ * Step order:
+ *   0  probeKubernetesApiReachable — 5s timeout kubectl cluster-info
+ *   1  D10 context-allowlist + OLAM_K8S_CONTEXT_ACK strict-equality byte-for-byte
+ *   2  D12 Secret pre-check (olam-host-cp-secret; base64-decode; key-name check)
+ *   3  kubectl apply --context <pinned> -f ~/.olam/k8s/manifests/
+ *   4  D15 kubectl rollout status --context <pinned> --timeout=90s (95s wrap)
+ *   5  D17 port-forward spawn via flock
+ *   6  verify /health returns X-Olam-Engine: kubernetes
+ *   7  emit upgrade.complete instrumentation event
+ *   8  success message
+ *
+ * Manifests NOT auto-rolled-back on failure (D15 spec). Operator must
+ * manually intervene; state snapshot is printed on failure.
+ */
+import * as os from 'node:os';
+import * as path from 'node:path';
+import ora from 'ora';
+import pc from 'picocolors';
+import { printError, printSuccess, printInfo, printWarning } from '../output.js';
+import { kubectlWrap } from './kubectl-wrap.js';
+import { spawnPortForward, probePortForwardLiveness } from './port-forward.js';
+import { emitUpgradeComplete } from './instrumentation.js';
+import { runManifestRefresh } from './manifest-refresh.js';
+import { OLAM_HOME } from './config.js';
+export const OLAM_K8S_MANIFESTS_DIR = path.join(OLAM_HOME, 'k8s', 'manifests');
+export const K8S_NAMESPACE = 'olam';
+export const HOST_CP_SECRET_NAME = 'olam-host-cp-secret';
+export const HOST_CP_DEPLOYMENT_NAME = 'olam-host-cp';
+export const PORT_FORWARD_TARGET = 'service/olam-host-cp';
+export const HOST_CP_HEALTH_URL = 'http://127.0.0.1:19000/health';
+/** Placeholder values that indicate the Secret has not been configured (D12). */
+const PLACEHOLDER_VALUES = new Set(['OLAM_AUTH_SECRET', 'GH_TOKEN']);
+/** Required keys in the olam-host-cp-secret (D12). */
+const REQUIRED_SECRET_KEYS = ['OLAM_AUTH_SECRET', 'GH_TOKEN'];
+/** D10 — allowed kubectl context patterns. Currently: anything non-empty.
+ * The allowlist is enforced by OLAM_K8S_CONTEXT_ACK strict-equality. */
+function isContextAllowed(context) {
+    return typeof context === 'string' && context.length > 0;
+}
+/**
+ * Step 0 — D22: probe Kubernetes API reachability (5s timeout).
+ * Uses kubectl cluster-info with a tight timeout to detect unreachable API server.
+ */
+async function probeKubernetesApiReachable(context, deps) {
+    const wrap = deps.kubectlWrapImpl ?? kubectlWrap;
+    const result = await wrap(['--context', context, 'cluster-info'], { timeout: 5_000 });
+    return result.ok;
+}
+/**
+ * Step 2 — D12: Secret pre-check.
+ *
+ * Fetches the olam-host-cp-secret, base64-decodes each data value, and:
+ *   a) Asserts OLAM_AUTH_SECRET and GH_TOKEN keys are present.
+ *   b) EXACT-EQUALS check against placeholder strings — if any decoded value
+ *      equals the literal placeholder name ('OLAM_AUTH_SECRET' or 'GH_TOKEN'),
+ *      the secret has not been configured and the upgrade is refused.
+ *
+ * Returns null on success; error message string on failure.
+ */
+async function checkSecretPreCondition(context, deps) {
+    const wrap = deps.kubectlWrapImpl ?? kubectlWrap;
+    const result = await wrap([
+        '--context', context,
+        'get', 'secret', HOST_CP_SECRET_NAME,
+        '-n', K8S_NAMESPACE,
+        '-o', 'json',
+    ], { timeout: 15_000 });
+    if (!result.ok) {
+        return (`Secret "${HOST_CP_SECRET_NAME}" not found in namespace "${K8S_NAMESPACE}".\n` +
+            `  Create it first: kubectl --context ${context} apply -f <your-secret.yaml>\n` +
+            `  ${result.stderr.split('\n')[0] ?? ''}`);
+    }
+    let secretJson;
+    try {
+        secretJson = JSON.parse(result.stdout);
+    }
+    catch {
+        return `Failed to parse Secret JSON: ${result.stdout.slice(0, 200)}`;
+    }
+    const data = secretJson.data ?? {};
+    for (const key of REQUIRED_SECRET_KEYS) {
+        if (!(key in data)) {
+            return (`Secret "${HOST_CP_SECRET_NAME}" is missing required key "${key}".\n` +
+                `  Keys found: ${Object.keys(data).join(', ') || '(none)'}\n` +
+                `  Add the key and re-run.`);
+        }
+        const b64 = data[key] ?? '';
+        const decoded = Buffer.from(b64, 'base64').toString('utf8');
+        // EXACT-EQUALS: decoded value === placeholder name means unconfigured (D12).
+        if (PLACEHOLDER_VALUES.has(decoded)) {
+            return (`Secret "${HOST_CP_SECRET_NAME}" key "${key}" still holds its placeholder value.\n` +
+                `  Replace the placeholder with a real value, then re-run.`);
+        }
+    }
+    return null; // all checks passed
+}
+/**
+ * Step 4 — D15: kubectl rollout status with state snapshot on failure.
+ * Wrapper timeout: 95s (5s padding over the kubectl --timeout=90s).
+ */
+async function waitForRollout(context, deps, stderr) {
+    const wrap = deps.kubectlWrapImpl ?? kubectlWrap;
+    const result = await wrap([
+        '--context', context,
+        'rollout', 'status',
+        `deployment/${HOST_CP_DEPLOYMENT_NAME}`,
+        '-n', K8S_NAMESPACE,
+        '--timeout=90s',
+    ], { timeout: 95_000 });
+    if (result.ok)
+        return true;
+    // State snapshot on failure (D15).
+    stderr.write(`${pc.red('error:')} kubectl rollout status timed out or failed.\n` +
+        `  reason: ${result.reason ?? 'nonzero'} exitCode=${result.exitCode}\n\n`);
+    stderr.write(`${pc.dim('--- kubectl get pods -n olam -o wide ---')}\n`);
+    const podsResult = await wrap(['--context', context, 'get', 'pods', '-n', K8S_NAMESPACE, '-o', 'wide'], { timeout: 10_000 });
+    stderr.write((podsResult.stdout || podsResult.stderr || '(no output)') + '\n');
+    stderr.write(`\n${pc.dim('--- kubectl describe deployment/olam-host-cp -n olam ---')}\n`);
+    const descResult = await wrap(['--context', context, 'describe', `deployment/${HOST_CP_DEPLOYMENT_NAME}`, '-n', K8S_NAMESPACE], { timeout: 10_000 });
+    stderr.write((descResult.stdout || descResult.stderr || '(no output)') + '\n');
+    stderr.write(`\n${pc.yellow('note:')} Manifests are NOT auto-rolled-back. Inspect the state above and remediate manually.\n`);
+    return false;
+}
+/**
+ * Step 6 — verify /health returns X-Olam-Engine: kubernetes.
+ */
+async function verifyHealthHeader(deps) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    try {
+        const res = await fetchImpl(HOST_CP_HEALTH_URL, {
+            signal: AbortSignal.timeout(5_000),
+        });
+        const engine = res.headers.get('x-olam-engine') ?? res.headers.get('X-Olam-Engine');
+        return { ok: engine === 'kubernetes', engineHeader: engine };
+    }
+    catch {
+        return { ok: false, engineHeader: null };
+    }
+}
+/**
+ * Main entrypoint for the kubernetes upgrade path.
+ *
+ * Called from upgrade.ts when host.substrate === 'kubernetes'.
+ */
+export async function runUpgradeKubernetes(opts = {}, deps = {}) {
+    const stdout = deps.stdout ?? process.stdout;
+    const stderr = deps.stderr ?? process.stderr;
+    const manifestsDir = deps.manifestsDir ?? OLAM_K8S_MANIFESTS_DIR;
+    const startMs = Date.now();
+    // ── Step 0: D22 — probe Kubernetes API reachability (5s) ─────────
+    const step0Spinner = ora('Probing Kubernetes API reachability').start();
+    const context = process.env.OLAM_K8S_CONTEXT_ACK ?? '';
+    // We need a context for the probe — use the env var if set, else try default.
+    // The full context validation happens at step 1.
+    const probeContext = context.length > 0 ? context : 'default';
+    const reachable = await probeKubernetesApiReachable(probeContext, deps);
+    if (!reachable) {
+        step0Spinner.fail('Kubernetes API not reachable');
+        stderr.write(`${pc.red('error:')} kubectl cluster-info failed (5s timeout).\n` +
+            `  Ensure your kubectl context is correct and the cluster is reachable.\n` +
+            `  Set OLAM_K8S_CONTEXT_ACK=<context-name> to your active kubectl context.\n`);
+        return { exitCode: 1, summary: 'kubernetes api not reachable' };
+    }
+    step0Spinner.succeed('Kubernetes API reachable');
+    // ── Step 1: D10 — context-allowlist + OLAM_K8S_CONTEXT_ACK ───────
+    const step1Spinner = ora('Verifying kubectl context (D10)').start();
+    // OLAM_K8S_CONTEXT_ACK is byte-for-byte, no trim, no case-fold (D10).
+    const ackValue = process.env.OLAM_K8S_CONTEXT_ACK ?? '';
+    if (ackValue.length === 0 || !isContextAllowed(ackValue)) {
+        step1Spinner.fail('Context ACK missing or disallowed');
+        stderr.write(`${pc.red('error:')} OLAM_K8S_CONTEXT_ACK is not set or empty.\n` +
+            `  Set it to your kubectl context name (byte-for-byte match):\n` +
+            `    export OLAM_K8S_CONTEXT_ACK=<your-context-name>\n` +
+            `  See GATES.md G-001 for the context-allowlist requirement.\n`);
+        return { exitCode: 1, summary: 'context ack not set' };
+    }
+    // Capture the pinned context name (byte-for-byte, as provided).
+    const pinnedContext = ackValue;
+    // Audit WARN on bypass (D10: operator explicitly acknowledged a potentially unsafe context).
+    process.stderr.write(`${pc.yellow('[WARN]')} OLAM_K8S_UNSAFE_CONTEXT_ACK ctx=${pinnedContext}\n`);
+    step1Spinner.succeed(`Context pinned: ${pc.bold(pinnedContext)}`);
+    // ── D14: --force-refresh-manifests flag ──────────────────────────
+    if (opts.forceRefreshManifests) {
+        const step14Spinner = ora('Refreshing manifests (D14)').start();
+        const refreshImpl = deps.manifestRefreshImpl ?? runManifestRefresh;
+        const refreshResult = await refreshImpl(manifestsDir, opts.acceptSecurityRegression === true, {});
+        if (!refreshResult.ok) {
+            step14Spinner.fail('Manifest refresh refused');
+            stderr.write(`${pc.red('error:')} ${refreshResult.message}\n`);
+            return { exitCode: 1, summary: 'manifest refresh refused' };
+        }
+        step14Spinner.succeed(refreshResult.message);
+    }
+    // ── Step 2: D12 — Secret pre-check ───────────────────────────────
+    const step2Spinner = ora(`Checking Secret ${HOST_CP_SECRET_NAME} (D12)`).start();
+    const secretError = await checkSecretPreCondition(pinnedContext, deps);
+    if (secretError !== null) {
+        step2Spinner.fail('Secret pre-check failed');
+        stderr.write(`${pc.red('error:')} ${secretError}\n`);
+        return { exitCode: 1, summary: 'secret pre-check failed' };
+    }
+    step2Spinner.succeed(`Secret ${HOST_CP_SECRET_NAME} verified`);
+    // ── Step 3: kubectl apply ─────────────────────────────────────────
+    const step3Spinner = ora('Applying manifests').start();
+    const wrap = deps.kubectlWrapImpl ?? kubectlWrap;
+    const applyResult = await wrap(['--context', pinnedContext, 'apply', '-f', manifestsDir], { timeout: 120_000 });
+    if (!applyResult.ok) {
+        step3Spinner.fail('kubectl apply failed');
+        stderr.write(`${pc.red('error:')} kubectl apply failed (exit ${applyResult.exitCode}):\n` +
+            `  ${applyResult.stderr.split('\n').slice(0, 5).join('\n  ')}\n`);
+        return { exitCode: 1, summary: 'kubectl apply failed' };
+    }
+    step3Spinner.succeed('Manifests applied');
+    // ── Step 4: D15 — kubectl rollout status (90s timeout, 95s wrap) ──
+    const step4Spinner = ora('Waiting for rollout (90s)').start();
+    const rolloutOk = await waitForRollout(pinnedContext, deps, stderr);
+    if (!rolloutOk) {
+        step4Spinner.fail('Rollout status failed or timed out');
+        return { exitCode: 1, summary: 'rollout status timed out' };
+    }
+    step4Spinner.succeed('Rollout complete');
+    // ── Step 5: D17 — port-forward spawn via flock ───────────────────
+    const step5Spinner = ora('Establishing port-forward').start();
+    const pfSpawn = deps.spawnPortForwardImpl ?? spawnPortForward;
+    const pfResult = await pfSpawn(pinnedContext, K8S_NAMESPACE, PORT_FORWARD_TARGET, 19000, 19000, deps.portForwardDeps ?? {});
+    if (pfResult.spawned) {
+        step5Spinner.succeed(`Port-forward spawned (pid ${pfResult.pid})`);
+    }
+    else if (pfResult.reason === 'live') {
+        step5Spinner.succeed('Port-forward already live');
+    }
+    else {
+        step5Spinner.warn('Port-forward lock held by concurrent caller; skipping spawn');
+    }
+    // Brief wait for port-forward tunnel to be ready before health check.
+    await new Promise((r) => setTimeout(r, 1_500));
+    // ── Step 6: verify /health returns X-Olam-Engine: kubernetes ─────
+    const step6Spinner = ora('Verifying host-cp health (X-Olam-Engine: kubernetes)').start();
+    const healthCheck = await verifyHealthHeader(deps);
+    if (!healthCheck.ok) {
+        step6Spinner.fail(healthCheck.engineHeader !== null
+            ? `X-Olam-Engine header is "${healthCheck.engineHeader}" (expected "kubernetes")`
+            : 'host-cp /health not reachable via port-forward');
+        stderr.write(`${pc.red('error:')} host-cp did not report engine=kubernetes.\n` +
+            `  Check that the deployment rolled out with the correct image.\n`);
+        return { exitCode: 1, summary: 'health check failed — engine mismatch' };
+    }
+    step6Spinner.succeed('host-cp reports X-Olam-Engine: kubernetes');
+    // ── Step 7: emit upgrade.complete instrumentation event ───────────
+    const emitImpl = deps.emitImpl ?? emitUpgradeComplete;
+    emitImpl({
+        substrate: 'kubernetes',
+        duration_ms: Date.now() - startMs,
+        flavor: 'k3s',
+    }, deps.emitOpts ?? {});
+    // ── Step 8: success message ────────────────────────────────────────
+    printSuccess('olam upgrade (kubernetes) complete');
+    stdout.write(`  context: ${pc.bold(pinnedContext)}\n`);
+    stdout.write(`  substrate: ${pc.bold('kubernetes')} (flavor=k3s)\n`);
+    stdout.write(`  port-forward: 127.0.0.1:19000 → ${PORT_FORWARD_TARGET}\n`);
+    return { exitCode: 0, summary: 'kubernetes upgrade complete' };
+}
+//# sourceMappingURL=upgrade-kubernetes.js.map

package/dist/lib/upgrade-kubernetes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade-kubernetes.js","sourceRoot":"","sources":["../../src/lib/upgrade-kubernetes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,WAAW,EAAwB,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAwB,MAAM,mBAAmB,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAiB,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAA4B,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;AAC/E,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AACpC,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AACzD,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAC;AACtD,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAC1D,MAAM,CAAC,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAElE,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC,CAAC;AAErE,sDAAsD;AACtD,MAAM,oBAAoB,GAAG,CAAC,kBAAkB,EAAE,UAAU,CAAU,CAAC;AAEvE;wEACwE;AACxE,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3D,CAAC;AAqCD;;;GAGG;AACH,KAAK,UAAU,2BAA2B,CACxC,OAAe,EACf,IAA2B;IAE3B,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,IAAI,WAAW,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,CAAC,WAAW,EAAE,OAAO,EAAE,cAAc,CAAC,EACtC,EAAE,OAAO,EAAE,KAAK,EAAE,CACnB,CAAC;IACF,OAAO,MAAM,CAAC,EAAE,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,uBAAuB,CACpC,OAAe,EACf,IAA2B;IAE3B,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,IAAI,WAAW,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB;QACE,WAAW,EAAE,OAAO;QACpB,KAAK,EAAE,QAAQ,EAAE,mBAAmB;QACpC,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,MAAM;KACb,EACD,EAAE,OAAO,EAAE,MAAM,EAAE,CACpB,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CACL,WAAW,mBAAmB,6BAA6B,aAAa,MAAM;YAC9E,wCAAwC,OAAO,gCAAgC;YAC/E,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAC1C,CAAC;IACJ,CAAC;IAED,IAAI,UAA6C,CAAC;IAClD,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAsB,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,gCAAgC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;IAEnC,KAAK,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QACvC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;YACnB,OAAO,CACL,WAAW,mBAAmB,8BAA8B,GAAG,MAAM;gBACrE,iBAAiB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,IAAI;gBAC7D,2BAA2B,CAC5B,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5D,6EAA6E;QAC7E,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,OAAO,CACL,WAAW,mBAAmB,UAAU,GAAG,wCAAwC;gBACnF,2DAA2D,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,oBAAoB;AACnC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAC3B,OAAe,EACf,IAA2B,EAC3B,MAA6B;IAE7B,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,IAAI,WAAW,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB;QACE,WAAW,EAAE,OAAO;QACpB,SAAS,EAAE,QAAQ;QACnB,cAAc,uBAAuB,EAAE;QACvC,IAAI,EAAE,aAAa;QACnB,eAAe;KAChB,EACD,EAAE,OAAO,EAAE,MAAM,EAAE,CACpB,CAAC;IAEF,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE3B,mCAAmC;IACnC,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,gDAAgD;QACjE,aAAa,MAAM,CAAC,MAAM,IAAI,SAAS,aAAa,MAAM,CAAC,QAAQ,MAAM,CAC5E,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,0CAA0C,CAAC,IAAI,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,MAAM,IAAI,CAC3B,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,EACxE,EAAE,OAAO,EAAE,MAAM,EAAE,CACpB,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,IAAI,aAAa,CAAC,GAAG,IAAI,CAAC,CAAC;IAE/E,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,0DAA0D,CAAC,IAAI,CAAC,CAAC;IAC1F,MAAM,UAAU,GAAG,MAAM,IAAI,CAC3B,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,uBAAuB,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,EAChG,EAAE,OAAO,EAAE,MAAM,EAAE,CACpB,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,IAAI,aAAa,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/E,MAAM,CAAC,KAAK,CACV,KAAK,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,wFAAwF,CAChH,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,kBAAkB,CAC/B,IAA2B;IAE3B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,kBAAkB,EAAE;YAC9C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACpF,OAAO,EAAE,EAAE,EAAE,MAAM,KAAK,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAA8B,EAAE,EAChC,OAA8B,EAAE;IAEhC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,sBAAsB,CAAC;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE3B,oEAAoE;IACpE,MAAM,YAAY,GAAG,GAAG,CAAC,qCAAqC,CAAC,CAAC,KAAK,EAAE,CAAC;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC;IAEvD,8EAA8E;IAC9E,iDAAiD;IACjD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,YAAY,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,8CAA8C;YAC/D,0EAA0E;YAC1E,6EAA6E,CAChF,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IAClE,CAAC;IACD,YAAY,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAEjD,oEAAoE;IACpE,MAAM,YAAY,GAAG,GAAG,CAAC,iCAAiC,CAAC,CAAC,KAAK,EAAE,CAAC;IAEpE,sEAAsE;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzD,YAAY,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,8CAA8C;YAC/D,gEAAgE;YAChE,uDAAuD;YACvD,+DAA+D,CAClE,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACzD,CAAC;IAED,gEAAgE;IAChE,MAAM,aAAa,GAAG,QAAQ,CAAC;IAE/B,6FAA6F;IAC7F,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,oCAAoC,aAAa,IAAI,CAC5E,CAAC;IACF,YAAY,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAElE,oEAAoE;IACpE,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC/B,MAAM,aAAa,GAAG,GAAG,CAAC,4BAA4B,CAAC,CAAC,KAAK,EAAE,CAAC;QAChE,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,IAAI,kBAAkB,CAAC;QACnE,MAAM,aAAa,GAAG,MAAM,WAAW,CACrC,YAAY,EACZ,IAAI,CAAC,wBAAwB,KAAK,IAAI,EACtC,EAAyB,CAC1B,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YAC/C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,OAAO,IAAI,CAAC,CAAC;YAC/D,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;QAC9D,CAAC;QACD,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,oEAAoE;IACpE,MAAM,YAAY,GAAG,GAAG,CAAC,mBAAmB,mBAAmB,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;IACjF,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACvE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,YAAY,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,WAAW,IAAI,CAAC,CAAC;QACrD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;IAC7D,CAAC;IACD,YAAY,CAAC,OAAO,CAAC,UAAU,mBAAmB,WAAW,CAAC,CAAC;IAE/D,qEAAqE;IACrE,MAAM,YAAY,GAAG,GAAG,CAAC,oBAAoB,CAAC,CAAC,KAAK,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,IAAI,WAAW,CAAC;IACjD,MAAM,WAAW,GAAG,MAAM,IAAI,CAC5B,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,EACzD,EAAE,OAAO,EAAE,OAAO,EAAE,CACrB,CAAC;IACF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,YAAY,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,+BAA+B,WAAW,CAAC,QAAQ,MAAM;YAC1E,KAAK,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnE,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAC1D,CAAC;IACD,YAAY,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAE1C,qEAAqE;IACrE,MAAM,YAAY,GAAG,GAAG,CAAC,2BAA2B,CAAC,CAAC,KAAK,EAAE,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACpE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,YAAY,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACxD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IAC9D,CAAC;IACD,YAAY,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAEzC,oEAAoE;IACpE,MAAM,YAAY,GAAG,GAAG,CAAC,2BAA2B,CAAC,CAAC,KAAK,EAAE,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,IAAI,gBAAgB,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,KAAK,EACL,KAAK,EACL,IAAI,CAAC,eAAe,IAAI,EAAE,CAC3B,CAAC;IACF,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,YAAY,CAAC,OAAO,CAAC,6BAA6B,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC;IACrE,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACtC,YAAY,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;IACnF,CAAC;IAED,sEAAsE;IACtE,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAErD,oEAAoE;IACpE,MAAM,YAAY,GAAG,GAAG,CAAC,sDAAsD,CAAC,CAAC,KAAK,EAAE,CAAC;IACzF,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,YAAY,CAAC,IAAI,CACf,WAAW,CAAC,YAAY,KAAK,IAAI;YAC/B,CAAC,CAAC,4BAA4B,WAAW,CAAC,YAAY,2BAA2B;YACjF,CAAC,CAAC,gDAAgD,CACrD,CAAC;QACF,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,8CAA8C;YAC/D,kEAAkE,CACrE,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;IAC3E,CAAC;IACD,YAAY,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC;IAElE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC;IACtD,QAAQ,CACN;QACE,SAAS,EAAE,YAAY;QACvB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;QACjC,MAAM,EAAE,KAAK;KACd,EACD,IAAI,CAAC,QAAQ,IAAI,EAAE,CACpB,CAAC;IAEF,sEAAsE;IACtE,YAAY,CAAC,oCAAoC,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC;IACrE,MAAM,CAAC,KAAK,CAAC,qCAAqC,mBAAmB,IAAI,CAAC,CAAC;IAE3E,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;AACjE,CAAC"}