@pleri/olam-cli 0.1.145 → 0.1.147

package/dist/commands/substrate-audit-log.js

@@ -0,0 +1,148 @@
+/**
+ * substrate-audit-log.ts — `olam substrate audit-log` subcommand.
+ *
+ * Phase 1b C3 of olam-host-suite-phase-1b-k3s-beta-flavour (plan
+ * ~/.claude/plans/olam-host-suite-phase-1b-k3s-beta-flavour.md).
+ *
+ * Decisions consumed:
+ *   D19 — audit-log inspection subcommand ships in PR3 (not deferred).
+ *
+ * Reads `~/.olam/state/manifest-refresh-audit.jsonl` and renders entries.
+ *
+ * Subcommand: `olam substrate audit-log`
+ *   (registered under the existing `substrate` parent command via registerSubstrate)
+ *
+ * Flags:
+ *   --json               Emit raw JSONL on stdout (one entry per line).
+ *   --since <ISO-date>   Filter entries with ts >= <ISO-date>.
+ *   --limit <N>          Max entries (default 50; applied AFTER --since filter).
+ *
+ * No force-overwrite power — read-only. Absent log file prints "no entries"
+ * without error (exit 0).
+ */
+import * as fs from 'node:fs';
+import pc from 'picocolors';
+import { MANIFEST_REFRESH_AUDIT_LOG } from '../lib/manifest-refresh.js';
+const DEFAULT_LIMIT = 50;
+/**
+ * Parse the JSONL audit log file into entries. Skips malformed lines.
+ */
+function parseAuditLog(raw) {
+    const lines = raw.split('\n').filter((l) => l.trim().length > 0);
+    const entries = [];
+    for (const line of lines) {
+        try {
+            const entry = JSON.parse(line);
+            entries.push(entry);
+        }
+        catch {
+            // Skip malformed lines silently.
+        }
+    }
+    return entries;
+}
+/**
+ * Format a single entry as a pretty-printed table row.
+ *
+ * Table columns: ts | security_regression | accepted | changed_fields
+ */
+function formatEntryRow(entry, index) {
+    const ts = entry.ts ?? '(no timestamp)';
+    const regression = entry.security_regression ? pc.red('yes') : pc.green('no');
+    const accepted = entry.accepted ? pc.yellow('yes') : '—';
+    const fields = (entry.changed_fields ?? []).join(', ') || '—';
+    return `  ${String(index + 1).padStart(3)}  ${ts}  regression=${regression}  accepted=${accepted}  fields=[${fields}]`;
+}
+function formatHeader() {
+    return (`  ${'#'.padStart(3)}  ${'timestamp'.padEnd(27)}  regression  accepted  fields\n` +
+        `  ${'─'.repeat(3)}  ${'─'.repeat(27)}  ${'─'.repeat(10)}  ${'─'.repeat(8)}  ${'─'.repeat(20)}`);
+}
+/**
+ * Implementation of `olam substrate audit-log`. Exported for testability.
+ *
+ * @returns process exit code (0 = success, 1 = error)
+ */
+export function handleAuditLog(opts, deps = {}) {
+    const auditLogPath = deps.auditLogPath ?? MANIFEST_REFRESH_AUDIT_LOG;
+    const stdout = deps.stdout ?? process.stdout;
+    const stderr = deps.stderr ?? process.stderr;
+    const readFileSyncImpl = deps.readFileSync ?? fs.readFileSync;
+    const existsSyncImpl = deps.existsSync ?? fs.existsSync;
+    const rawLimit = opts.limit;
+    const limit = typeof rawLimit === 'number'
+        ? rawLimit
+        : typeof rawLimit === 'string'
+            ? Number.parseInt(rawLimit, 10)
+            : DEFAULT_LIMIT;
+    const effectiveLimit = Number.isFinite(limit) && limit > 0 ? limit : DEFAULT_LIMIT;
+    if (!existsSyncImpl(auditLogPath)) {
+        stdout.write('no entries\n');
+        return 0;
+    }
+    let raw;
+    try {
+        raw = readFileSyncImpl(auditLogPath, 'utf8');
+    }
+    catch (err) {
+        stderr.write(`${pc.red('error:')} could not read audit log at ${auditLogPath}: ${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+    let entries = parseAuditLog(raw);
+    // --since filter
+    if (opts.since) {
+        const sinceMs = Date.parse(opts.since);
+        if (Number.isNaN(sinceMs)) {
+            stderr.write(`${pc.red('error:')} invalid --since date "${opts.since}". Expected ISO-8601 (e.g. 2026-05-20T00:00:00Z).\n`);
+            return 1;
+        }
+        entries = entries.filter((e) => {
+            const ts = Date.parse(e.ts ?? '');
+            return !Number.isNaN(ts) && ts >= sinceMs;
+        });
+    }
+    // --limit (applied after filter, from the END of the list — most recent N)
+    if (entries.length > effectiveLimit) {
+        entries = entries.slice(-effectiveLimit);
+    }
+    if (entries.length === 0) {
+        stdout.write('no entries\n');
+        return 0;
+    }
+    if (opts.json) {
+        for (const entry of entries) {
+            stdout.write(JSON.stringify(entry) + '\n');
+        }
+        return 0;
+    }
+    // Pretty-printed table.
+    stdout.write(formatHeader() + '\n');
+    entries.forEach((entry, i) => {
+        stdout.write(formatEntryRow(entry, i) + '\n');
+    });
+    stdout.write(`\n${entries.length} entr${entries.length === 1 ? 'y' : 'ies'} shown\n`);
+    return 0;
+}
+/**
+ * Register `olam substrate audit-log` under the `substrate` parent command.
+ *
+ * Called from registerSubstrate() in substrate.ts.
+ */
+export function registerSubstrateAuditLog(substrateCmdRef) {
+    substrateCmdRef
+        .command('audit-log')
+        .description('Inspect the manifest-refresh audit log (~/.olam/state/manifest-refresh-audit.jsonl). ' +
+        'Read-only. No force-overwrite power.')
+        .option('--json', 'Emit raw JSONL on stdout instead of a pretty table')
+        .option('--since <ISO-date>', 'Filter entries with timestamp >= <ISO-date>')
+        .option('--limit <N>', `Max entries to show (default ${DEFAULT_LIMIT})`)
+        .action((opts) => {
+        const code = handleAuditLog({
+            json: opts.json,
+            since: opts.since,
+            limit: opts.limit,
+        });
+        if (code !== 0)
+            process.exitCode = code;
+    });
+}
+//# sourceMappingURL=substrate-audit-log.js.map

package/dist/commands/substrate-audit-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"substrate-audit-log.js","sourceRoot":"","sources":["../../src/commands/substrate-audit-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,0BAA0B,EAAkC,MAAM,4BAA4B,CAAC;AAgBxG,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB;;GAEG;AACH,SAAS,aAAa,CACpB,GAAW;IAEX,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjE,MAAM,OAAO,GAAgC,EAAE,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA8B,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAgC,EAAE,KAAa;IACrE,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,gBAAgB,CAAC;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACzD,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;IAC9D,OAAO,KAAK,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,gBAAgB,UAAU,cAAc,QAAQ,aAAa,MAAM,GAAG,CAAC;AACzH,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,CACL,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,kCAAkC;QACjF,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAChG,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAkB,EAAE,OAAqB,EAAE;IACxE,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,0BAA0B,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,CAAC;IAC9D,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,UAAU,CAAC;IAExD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC;IAC5B,MAAM,KAAK,GACT,OAAO,QAAQ,KAAK,QAAQ;QAC1B,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ;YAC5B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC/B,CAAC,CAAC,aAAa,CAAC;IACtB,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;IAEnF,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC7B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAW,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,gCAAgC,YAAY,KAC7D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,IAAI,CACL,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEjC,iBAAiB;IACjB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,0BAA0B,IAAI,CAAC,KAAK,qDAAqD,CAC7G,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,OAAO,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,IAAI,OAAO,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QACpC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC7B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,wBAAwB;IACxB,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC;IACpC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,MAAM,QAAQ,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC;IAEtF,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,eAAwB;IAChE,eAAe;SACZ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CACV,uFAAuF;QACrF,sCAAsC,CACzC;SACA,MAAM,CAAC,QAAQ,EAAE,oDAAoD,CAAC;SACtE,MAAM,CAAC,oBAAoB,EAAE,6CAA6C,CAAC;SAC3E,MAAM,CAAC,aAAa,EAAE,gCAAgC,aAAa,GAAG,CAAC;SACvE,MAAM,CAAC,CAAC,IAAwD,EAAE,EAAE;QACnE,MAAM,IAAI,GAAG,cAAc,CAAC;YAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC1C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/substrate.d.ts

@@ -0,0 +1,60 @@
+/**
+ * olam substrate — Manage the operator-facing deployment substrate.
+ *
+ * Phase 1b A2 of olam-host-suite-phase-1b-k3s-beta-flavour (plan
+ * ~/.claude/plans/olam-host-suite-phase-1b-k3s-beta-flavour.md).
+ *
+ * Subcommands:
+ *   olam substrate get               — print active substrate (+ flavor + beta-expiry)
+ *   olam substrate set <substrate>   — switch to compose | kubernetes
+ *
+ * Decisions consumed:
+ *   D1 — `~/.olam/config.json` schema-versioned seam (host.substrate)
+ *   D2 — user-facing vocab is `compose | kubernetes` (NOT docker | k3s)
+ *   D7 — telemetry is opt-in stdout-emission (stderr `OLAM_INSTR`)
+ *   D21 — canonical instrumentation event schema (olam.instr.v1)
+ *
+ * Risk mitigations:
+ *   T2 — pre-flight via `runDoctor` programmatically with `engine: <target>` override.
+ *        Refuses with actionable remediation if prereqs fail.
+ *   T3 — refuses if worlds exist on current substrate (operator must `olam destroy --all`).
+ *
+ * Beta-expiry date: 2026-11-16 (Phase 1b ship-date + 6 months per Falsifiable
+ * signal section; surfaced in `get` output so operators see the commitment).
+ */
+import type { Command } from 'commander';
+import { readConfig, writeConfig } from '../lib/config.js';
+import { emitSubstrateSet } from '../lib/instrumentation.js';
+import { type RunDoctorDeps } from './doctor.js';
+export declare const BETA_EXPIRY_DATE: "2026-11-16";
+type DoctorRunner = (opts: {
+    json?: boolean;
+}, deps?: RunDoctorDeps) => Promise<{
+    exitCode: number;
+}>;
+type WorldsCounter = () => Promise<number>;
+export type SubstrateDeps = {
+    readonly readConfig?: typeof readConfig;
+    readonly writeConfig?: typeof writeConfig;
+    readonly emit?: typeof emitSubstrateSet;
+    readonly runDoctor?: DoctorRunner;
+    readonly countWorlds?: WorldsCounter;
+    readonly stdout?: NodeJS.WritableStream;
+    readonly stderr?: NodeJS.WritableStream;
+};
+/**
+ * Implementation of `olam substrate get`. Reads the config + prints a single
+ * human-readable line. Exported for testability.
+ */
+export declare function handleGet(deps?: SubstrateDeps): Promise<number>;
+/**
+ * Implementation of `olam substrate set <substrate>`. Validates target, runs
+ * pre-flight via doctor with the target engine, refuses on worlds-exist OR
+ * doctor-fail, persists config, emits instrumentation. Exported for testability.
+ *
+ * Returns the desired process exit code (0 = success, 1 = refused/fail).
+ */
+export declare function handleSet(target: string, deps?: SubstrateDeps): Promise<number>;
+export declare function registerSubstrate(program: Command): void;
+export {};
+//# sourceMappingURL=substrate.d.ts.map

package/dist/commands/substrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"substrate.d.ts","sourceRoot":"","sources":["../../src/commands/substrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAkB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAa,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAK5D,eAAO,MAAM,gBAAgB,EAAG,YAAqB,CAAC;AAEtD,KAAK,YAAY,GAAG,CAClB,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,EACxB,IAAI,CAAC,EAAE,aAAa,KACjB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEnC,KAAK,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAE3C,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,UAAU,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,WAAW,CAAC;IAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,gBAAgB,CAAC;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CACzC,CAAC;AAiBF;;;GAGG;AACH,wBAAsB,SAAS,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAMzE;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmGzF;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAiCxD"}

package/dist/commands/substrate.js

@@ -0,0 +1,175 @@
+/**
+ * olam substrate — Manage the operator-facing deployment substrate.
+ *
+ * Phase 1b A2 of olam-host-suite-phase-1b-k3s-beta-flavour (plan
+ * ~/.claude/plans/olam-host-suite-phase-1b-k3s-beta-flavour.md).
+ *
+ * Subcommands:
+ *   olam substrate get               — print active substrate (+ flavor + beta-expiry)
+ *   olam substrate set <substrate>   — switch to compose | kubernetes
+ *
+ * Decisions consumed:
+ *   D1 — `~/.olam/config.json` schema-versioned seam (host.substrate)
+ *   D2 — user-facing vocab is `compose | kubernetes` (NOT docker | k3s)
+ *   D7 — telemetry is opt-in stdout-emission (stderr `OLAM_INSTR`)
+ *   D21 — canonical instrumentation event schema (olam.instr.v1)
+ *
+ * Risk mitigations:
+ *   T2 — pre-flight via `runDoctor` programmatically with `engine: <target>` override.
+ *        Refuses with actionable remediation if prereqs fail.
+ *   T3 — refuses if worlds exist on current substrate (operator must `olam destroy --all`).
+ *
+ * Beta-expiry date: 2026-11-16 (Phase 1b ship-date + 6 months per Falsifiable
+ * signal section; surfaced in `get` output so operators see the commitment).
+ */
+import pc from 'picocolors';
+import { readConfig, writeConfig } from '../lib/config.js';
+import { emitSubstrateSet } from '../lib/instrumentation.js';
+import { runDoctor } from './doctor.js';
+import { loadContext } from '../context.js';
+import { printError, printInfo, printSuccess, printWarning } from '../output.js';
+import { registerSubstrateAuditLog } from './substrate-audit-log.js';
+export const BETA_EXPIRY_DATE = '2026-11-16';
+async function defaultCountWorlds() {
+    const { ctx } = await loadContext();
+    if (!ctx)
+        return 0;
+    return ctx.worldManager.listWorlds().length;
+}
+function formatBetaLine(cfg) {
+    if (cfg.host.substrate === 'compose') {
+        return `Substrate: ${pc.bold('compose')}`;
+    }
+    // flavor is informational only; left to D11 doctor probe to detect at runtime.
+    // Static get-time output names `k3s` as the first-supported flavor per the plan.
+    return `Substrate: ${pc.bold('kubernetes')} (beta until ${BETA_EXPIRY_DATE}, flavor=k3s)`;
+}
+/**
+ * Implementation of `olam substrate get`. Reads the config + prints a single
+ * human-readable line. Exported for testability.
+ */
+export async function handleGet(deps = {}) {
+    const read = deps.readConfig ?? readConfig;
+    const stdout = deps.stdout ?? process.stdout;
+    const cfg = read();
+    stdout.write(formatBetaLine(cfg) + '\n');
+    return 0;
+}
+/**
+ * Implementation of `olam substrate set <substrate>`. Validates target, runs
+ * pre-flight via doctor with the target engine, refuses on worlds-exist OR
+ * doctor-fail, persists config, emits instrumentation. Exported for testability.
+ *
+ * Returns the desired process exit code (0 = success, 1 = refused/fail).
+ */
+export async function handleSet(target, deps = {}) {
+    const stderr = deps.stderr ?? process.stderr;
+    const stdout = deps.stdout ?? process.stdout;
+    const read = deps.readConfig ?? readConfig;
+    const write = deps.writeConfig ?? writeConfig;
+    const emit = deps.emit ?? emitSubstrateSet;
+    const runDoctorFn = deps.runDoctor ?? runDoctor;
+    const countWorlds = deps.countWorlds ?? defaultCountWorlds;
+    if (target !== 'compose' && target !== 'kubernetes') {
+        stderr.write(`${pc.red('error:')} unsupported substrate "${target}". Expected: compose | kubernetes.\n`);
+        return 1;
+    }
+    const targetSubstrate = target;
+    const current = read();
+    if (current.host.substrate === targetSubstrate) {
+        stdout.write(`Substrate already set to ${pc.bold(targetSubstrate)}. No change.\n`);
+        return 0;
+    }
+    // T3: refuse if worlds exist on the current substrate. Operator must
+    // explicitly `olam destroy --all` to avoid bisected worlds.db state.
+    let worldsCount;
+    try {
+        worldsCount = await countWorlds();
+    }
+    catch (err) {
+        stderr.write(`${pc.yellow('warn:')} could not list worlds (${err instanceof Error ? err.message : String(err)}); assuming none exist and proceeding.\n`);
+        worldsCount = 0;
+    }
+    if (worldsCount > 0) {
+        stderr.write(`${pc.red('error:')} ${worldsCount} world(s) exist on the current substrate (${pc.bold(current.host.substrate)}). Switching substrates abandons their state.\n`);
+        stderr.write(`       Run ${pc.bold('olam destroy --all')} first, then re-run this command.\n`);
+        return 1;
+    }
+    // T2: pre-flight via doctor with the target engine. The kubernetes engine
+    // arg matches the substrate value 1:1 in PR1 — Phase 1b's substrate→engine
+    // mapping is identity (compose→docker; kubernetes→kubernetes).
+    // PR4 ships an `--substrate=<target>` CLI flag for doctor; PR1 routes
+    // through the existing `engine` programmatic dep.
+    const engine = targetSubstrate === 'compose' ? 'docker' : 'kubernetes';
+    stdout.write(`Running pre-flight for ${pc.bold(targetSubstrate)} substrate…\n`);
+    let doctorResult;
+    try {
+        doctorResult = await runDoctorFn({ json: true }, { engine });
+    }
+    catch (err) {
+        stderr.write(`${pc.red('error:')} pre-flight crashed: ${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+    if (doctorResult.exitCode !== 0) {
+        stderr.write(`${pc.red('error:')} pre-flight failed for ${pc.bold(targetSubstrate)} substrate.\n`);
+        stderr.write(`       Run ${pc.bold(`olam doctor${targetSubstrate === 'kubernetes' ? ' --substrate=kubernetes' : ''}`)} to see what's missing, fix the named prereqs, then re-run.\n`);
+        return 1;
+    }
+    // Persist + emit only after the gates pass.
+    const next = write({ host: { substrate: targetSubstrate } });
+    emit({
+        substrate: targetSubstrate,
+        flavor: targetSubstrate === 'kubernetes' ? 'k3s' : undefined,
+    });
+    stdout.write(formatBetaLine(next) + '\n');
+    if (targetSubstrate === 'kubernetes') {
+        stdout.write(`\nKubernetes substrate is in beta until ${BETA_EXPIRY_DATE}.\n` +
+            `Rollback: ${pc.bold('olam substrate set compose')} (preserves compose worlds you create after this).\n` +
+            `Next: ${pc.bold('olam upgrade')} to deploy host-cp to your kubectl context.\n`);
+    }
+    else {
+        stdout.write(`\nNext: ${pc.bold('olam upgrade')} to redeploy host-cp on the compose substrate.\n`);
+    }
+    return 0;
+}
+export function registerSubstrate(program) {
+    const sub = program.command('substrate').description('Manage deployment substrate (beta)');
+    sub
+        .command('get')
+        .description('Print the active substrate')
+        .action(async () => {
+        try {
+            const code = await handleGet();
+            if (code !== 0)
+                process.exitCode = code;
+        }
+        catch (err) {
+            printError(`olam substrate get failed: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
+        }
+    });
+    sub
+        .command('set <substrate>')
+        .description('Switch substrate (compose | kubernetes)')
+        .action(async (target) => {
+        try {
+            const code = await handleSet(target);
+            if (code !== 0)
+                process.exitCode = code;
+        }
+        catch (err) {
+            printError(`olam substrate set failed: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
+        }
+    });
+    // Phase 1b C3 — D19: manifest-refresh audit log inspection.
+    registerSubstrateAuditLog(sub);
+}
+// Silence unused-import lints when these helpers are referenced only via
+// indirect calls (printInfo/printWarning/printSuccess are imported for parity
+// with sibling commands' patterns even though substrate uses stdout/stderr
+// directly for clean test injection).
+void printInfo;
+void printWarning;
+void printSuccess;
+//# sourceMappingURL=substrate.js.map

package/dist/commands/substrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"substrate.js","sourceRoot":"","sources":["../../src/commands/substrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAkB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAsB,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAErE,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAqB,CAAC;AAmBtD,KAAK,UAAU,kBAAkB;IAC/B,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC;IACnB,OAAO,GAAG,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc,CAAC,GAAuC;IAC7D,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,cAAc,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;IAC5C,CAAC;IACD,+EAA+E;IAC/E,iFAAiF;IACjF,OAAO,cAAc,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB,gBAAgB,eAAe,CAAC;AAC5F,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAsB,EAAE;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC;IACnB,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,OAAsB,EAAE;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,gBAAgB,CAAC;IAC3C,MAAM,WAAW,GAAiB,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;IAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAE3D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QACpD,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,2BAA2B,MAAM,sCAAsC,CAC3F,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,eAAe,GAAc,MAAM,CAAC;IAE1C,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC;IACvB,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;QAC/C,MAAM,CAAC,KAAK,CACV,4BAA4B,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,gBAAgB,CACrE,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,qEAAqE;IACrE,qEAAqE;IACrE,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,2BACnB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,0CAA0C,CAC3C,CAAC;QACF,WAAW,GAAG,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,WAAW,6CAA6C,EAAE,CAAC,IAAI,CACpF,OAAO,CAAC,IAAI,CAAC,SAAS,CACvB,iDAAiD,CACnD,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,qCAAqC,CAAC,CAAC;QAC/F,OAAO,CAAC,CAAC;IACX,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,+DAA+D;IAC/D,sEAAsE;IACtE,kDAAkD;IAClD,MAAM,MAAM,GAA4B,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC;IAChG,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;IAChF,IAAI,YAAkC,CAAC;IACvC,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,wBACjB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,IAAI,CACL,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,eAAe,CACrF,CAAC;QACF,MAAM,CAAC,KAAK,CACV,cAAc,EAAE,CAAC,IAAI,CACnB,cAAc,eAAe,KAAK,YAAY,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,EAAE,CAClF,+DAA+D,CACjE,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,4CAA4C;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,SAAS,EAAE,eAAe;QAC1B,MAAM,EAAE,eAAe,KAAK,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,eAAe,KAAK,YAAY,EAAE,CAAC;QACrC,MAAM,CAAC,KAAK,CACV,2CAA2C,gBAAgB,KAAK;YAC9D,aAAa,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,sDAAsD;YACxG,SAAS,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,+CAA+C,CAClF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,KAAK,CACV,WAAW,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,kDAAkD,CACrF,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;IAE3F,GAAG;SACA,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,4BAA4B,CAAC;SACzC,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;YAC/B,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CAAC,yCAAyC,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,EAAE;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CACR,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACjF,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,4DAA4D;IAC5D,yBAAyB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,yEAAyE;AACzE,8EAA8E;AAC9E,2EAA2E;AAC3E,sCAAsC;AACtC,KAAK,SAAS,CAAC;AACf,KAAK,YAAY,CAAC;AAClB,KAAK,YAAY,CAAC"}

package/dist/commands/upgrade.d.ts

@@ -35,6 +35,14 @@ export interface UpgradeOpts {
      * pull-by-digest path that operators on installed CLIs need.
      */
     readonly fromSource: boolean;
+    /**
+     * Phase 1b — C2/D14: refresh manifests in ~/.olam/k8s/manifests/ during
+     * a kubernetes-substrate upgrade. Requires --accept-security-regression
+     * when security-sensitive fields (securityContext, capabilities, etc.) differ.
+     */
+    readonly forceRefreshManifests: boolean;
+    /** Phase 1b — C2/D14: accept security-sensitive field regressions in manifests. */
+    readonly acceptSecurityRegression: boolean;
 }
 /**
  * Check whether node_modules is in sync with package-lock.json.
@@ -83,6 +91,8 @@ export declare function parseUpgradeOpts(raw: {
     n?: string | number;
     json?: boolean;
     fromSource?: boolean;
+    forceRefreshManifests?: boolean;
+    acceptSecurityRegression?: boolean;
 }): UpgradeOpts;
 /**
  * Extract the JS bundle hash from index.html.

package/dist/commands/upgrade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upgrade.d.ts","sourceRoot":"","sources":["../../src/commands/upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYzC,OAAO,EAIL,KAAK,UAAU,EACf,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAaxB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAaxD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE;IAAE,WAAW,EAAE,OAAO,CAAA;CAAE,EAC9B,GAAG,EAAE,MAAM,GACV;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,CAQlD;AAED,+CAA+C;AAC/C,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAWzF;AAED,6DAA6D;AAC7D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,GAAG,WAAW,CAqBd;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGlE;AAuDD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWzD;AAED,qEAAqE;AACrE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAUhD;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,MAAM,GAAG,IAAI,CAInF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAuBD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW,CAmExE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,oBAAoB,EAAE,aAAa,CAAC,QAAQ,CAMxD,CAAC;AAEF,0CAA0C;AAC1C,UAAU,eAAe;IACvB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,eAAe,CAiBvE;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,8EAA8E;IAC9E,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAC9C,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,UAAU,CA2E3E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG;IAClE,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,aAAa,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,OAAO,EAAE,MAAM,CAAC;CACjB,CAeA;AA8BD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3G,QAAQ,CAAC,WAAW,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAA;KAAE,CAAC;IAChH,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3G,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,SAAS,SAAS,EAClB,cAAc,SAAQ,GACrB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,CAAC,CAyBjE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,eAAe,GAAG,IAAI,GAC/B,MAAM,CAYR;AAoGD;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CACxB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC7B;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1E;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjF;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAC9B,aAAa,EAAE,MAAM,KAClB;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACxF;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAC7B,aAAa,EAAE,MAAM,KAClB;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACtC;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,iBAAiB,CAAC,CAsU5B;AA4wBD,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAuFtD"}
+{"version":3,"file":"upgrade.d.ts","sourceRoot":"","sources":["../../src/commands/upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYzC,OAAO,EAIL,KAAK,UAAU,EACf,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AAexB,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,mFAAmF;IACnF,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;CAC5C;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAaxD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE;IAAE,WAAW,EAAE,OAAO,CAAA;CAAE,EAC9B,GAAG,EAAE,MAAM,GACV;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,CAQlD;AAED,+CAA+C;AAC/C,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAWzF;AAED,6DAA6D;AAC7D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE;IACpC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC,GAAG,WAAW,CAuBd;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGlE;AAuDD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWzD;AAED,qEAAqE;AACrE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAUhD;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,MAAM,GAAG,IAAI,CAInF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAuBD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW,CAmExE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,oBAAoB,EAAE,aAAa,CAAC,QAAQ,CAMxD,CAAC;AAEF,0CAA0C;AAC1C,UAAU,eAAe;IACvB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,eAAe,CAiBvE;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,8EAA8E;IAC9E,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAC9C,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,UAAU,CA2E3E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG;IAClE,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,aAAa,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,OAAO,EAAE,MAAM,CAAC;CACjB,CAeA;AA8BD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3G,QAAQ,CAAC,WAAW,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAA;KAAE,CAAC;IAChH,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3G,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,SAAS,SAAS,EAClB,cAAc,SAAQ,GACrB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,CAAC,CAyBjE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,eAAe,GAAG,IAAI,GAC/B,MAAM,CAYR;AAoGD;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CACxB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC7B;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1E;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjF;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAC9B,aAAa,EAAE,MAAM,KAClB;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACxF;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAC7B,aAAa,EAAE,MAAM,KAClB;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACtC;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,iBAAiB,CAAC,CAsU5B;AA4wBD,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0HtD"}

package/dist/commands/upgrade.js

@@ -25,6 +25,8 @@ import { loadImageDigests, pullImageWithRetry, realDocker, } from './bootstrap.j
 import { EXIT_BOOTSTRAP_PULL_FAILED, EXIT_GENERIC_ERROR, EXIT_PROTOCOL_MISMATCH, } from '../exit-codes.js';
 import { checkProtocolOverlap, parseProtocolVersionsLabel } from '../protocol-version.js';
 import { isDevMode, MissingBuildScriptError } from '../install-root.js';
+import { readConfig } from '../lib/config.js';
+import { runUpgradeKubernetes } from '../lib/upgrade-kubernetes.js';
 const AUTH_HEALTH_URL = 'http://127.0.0.1:9999/health';
 /**
  * Check whether node_modules is in sync with package-lock.json.
@@ -99,6 +101,8 @@ export function parseUpgradeOpts(raw) {
         historyN: Number.isFinite(historyN) && historyN > 0 ? historyN : 10,
         historyJson: raw.json === true,
         fromSource: raw.fromSource === true,
+        forceRefreshManifests: raw.forceRefreshManifests === true,
+        acceptSecurityRegression: raw.acceptSecurityRegression === true,
     };
 }
 /**
@@ -1623,8 +1627,34 @@ export function registerUpgrade(program) {
         .option('--from-source', 'Build host-cp + auth + devbox from monorepo source (legacy path).\n' +
         '                              Requires OLAM_DEV=1 + a `packages/` sibling at the install root.\n' +
         '                              Default (no flag): pull pre-built images from ghcr.io by digest.')
+        .option('--force-refresh-manifests', '[kubernetes substrate only] Re-apply manifests from ~/.olam/k8s/manifests/ before\n' +
+        '                              the rollout. Security-sensitive field diffs require\n' +
+        '                              --accept-security-regression to proceed.')
+        .option('--accept-security-regression', '[kubernetes substrate only] Accept security-sensitive field changes in manifests\n' +
+        '                              when using --force-refresh-manifests. Writes an audit\n' +
+        '                              entry to ~/.olam/state/manifest-refresh-audit.jsonl.')
         .action(async (opts) => {
         const parsed = parseUpgradeOpts(opts);
+        // Phase 1b — C2: substrate-aware routing.
+        // Read host.substrate from ~/.olam/config.json BEFORE any other branching.
+        // Compose path: unchanged (byte-identical to prior behaviour).
+        // Kubernetes path: 8-step flow in upgrade-kubernetes.ts.
+        const cfg = readConfig();
+        if (cfg.host.substrate === 'kubernetes') {
+            try {
+                const result = await runUpgradeKubernetes({
+                    forceRefreshManifests: parsed.forceRefreshManifests,
+                    acceptSecurityRegression: parsed.acceptSecurityRegression,
+                });
+                process.exitCode = result.exitCode;
+            }
+            catch (err) {
+                printError(err instanceof Error ? err.message : String(err));
+                process.exitCode = EXIT_GENERIC_ERROR;
+            }
+            return;
+        }
+        // compose path — unchanged below this line ────────────────────
         // Phase C — C6: --from-source gates the legacy build path. Default
         // pull-by-digest path lands installed-CLI operators on a fresh
         // image set without a monorepo clone.