orionfold-relay 0.20.0 → 0.21.0

package/README.md

@@ -143,7 +143,10 @@ relay license remove <license-id>                            # forget a license
   pack. Paid packs are new content, not repossessed features.
 
 The full terms in plain language — seats, transfer, what expiry does and doesn't do —
-are in [docs/trust/license-terms.md](docs/trust/license-terms.md).
+are in [docs/trust/license-terms.md](docs/trust/license-terms.md). The gating
+philosophy behind the boundary — and the never-regress promise that binds us to it —
+is published at [orionfold.com/promise](https://orionfold.com/promise/). Browse and
+buy premium packs at [orionfold.com/relay](https://orionfold.com/relay/).
 
 ---
 

package/dist/cli.js

@@ -1186,7 +1186,7 @@ var CURRENT_PLUGIN_API_VERSION, CAPABILITY_VALUES, ORIGIN_VALUES, PrimitivesBund
 var init_types = __esm({
   "src/lib/plugins/sdk/types.ts"() {
     "use strict";
-    CURRENT_PLUGIN_API_VERSION = "0.20";
+    CURRENT_PLUGIN_API_VERSION = "0.21";
     CAPABILITY_VALUES = ["fs", "net", "child_process", "env"];
     ORIGIN_VALUES = ["ainative-internal", "third-party"];
     PrimitivesBundleManifestSchema = z.object({
@@ -1232,16 +1232,16 @@ function computeHash(content) {
 function safePreview(content) {
   return content.slice(0, MAX_PREVIEW_CHARS).trim();
 }
-function safeStat(path21) {
+function safeStat(path23) {
   try {
-    return statSync2(path21);
+    return statSync2(path23);
   } catch {
     return null;
   }
 }
-function safeReadFile(path21) {
+function safeReadFile(path23) {
   try {
-    return readFileSync4(path21, "utf-8");
+    return readFileSync4(path23, "utf-8");
   } catch {
     return null;
   }
@@ -11951,9 +11951,9 @@ function buildPermissionSummary(toolName, input) {
     }
   }
   if (toolName === "Read" || toolName === "Write" || toolName === "Edit" || toolName === "read" || toolName === "write" || toolName === "edit") {
-    const path21 = input.file_path ?? input.path;
-    if (typeof path21 === "string" && path21.trim().length > 0) {
-      return truncate(path21.trim());
+    const path23 = input.file_path ?? input.path;
+    if (typeof path23 === "string" && path23.trim().length > 0) {
+      return truncate(path23.trim());
     }
   }
   if (toolName?.startsWith("mcp__")) {
@@ -11987,9 +11987,9 @@ function getPermissionDetailEntries(toolName, input) {
     }
   }
   if (toolName === "Read" || toolName === "Write" || toolName === "Edit" || toolName === "read" || toolName === "write" || toolName === "edit") {
-    const path21 = input.file_path ?? input.path;
-    if (typeof path21 === "string") {
-      return [{ label: "Path", value: path21 }];
+    const path23 = input.file_path ?? input.path;
+    if (typeof path23 === "string") {
+      return [{ label: "Path", value: path23 }];
     }
   }
   return Object.entries(input).slice(0, 6).map(([key, value]) => ({
@@ -12891,7 +12891,7 @@ var init_registry6 = __esm({
     init_registry5();
     init_installer();
     init_schedule_spec();
-    SUPPORTED_API_VERSIONS = /* @__PURE__ */ new Set([CURRENT_PLUGIN_API_VERSION, "0.19"]);
+    SUPPORTED_API_VERSIONS = /* @__PURE__ */ new Set([CURRENT_PLUGIN_API_VERSION, "0.20"]);
     pluginCache = null;
     lastLoadedPluginIds = /* @__PURE__ */ new Set();
     PluginTableSchema = z16.object({
@@ -12934,8 +12934,8 @@ function pluginTools(_ctx) {
             Promise.resolve().then(() => (init_ainative_paths(), ainative_paths_exports)),
             Promise.resolve().then(() => (init_types(), types_exports))
           ]);
-          const fs20 = await import("fs");
-          const path21 = await import("path");
+          const fs22 = await import("fs");
+          const path23 = await import("path");
           const yaml13 = await import("js-yaml");
           const kind5 = listPlugins2();
           const registrations = await listPluginMcpRegistrations2();
@@ -12952,13 +12952,13 @@ function pluginTools(_ctx) {
               let manifestHash;
               let capabilityAcceptStatus = "pending";
               try {
-                const pluginYamlPath = path21.join(
+                const pluginYamlPath = path23.join(
                   pluginsDir,
                   pluginId,
                   "plugin.yaml"
                 );
-                if (fs20.existsSync(pluginYamlPath)) {
-                  const content = fs20.readFileSync(pluginYamlPath, "utf-8");
+                if (fs22.existsSync(pluginYamlPath)) {
+                  const content = fs22.readFileSync(pluginYamlPath, "utf-8");
                   const rawManifest = yaml13.load(content);
                   if (rawManifest !== null && typeof rawManifest === "object" && !Array.isArray(rawManifest)) {
                     const record = rawManifest;
@@ -12971,7 +12971,7 @@ function pluginTools(_ctx) {
                   try {
                     manifestHash = deriveManifestHash2(content);
                     const parsed = PluginManifestSchema2.safeParse(rawManifest);
-                    const pluginRootDir = path21.join(pluginsDir, pluginId);
+                    const pluginRootDir = path23.join(pluginsDir, pluginId);
                     const check = isCapabilityAccepted2(
                       pluginId,
                       manifestHash,
@@ -19387,13 +19387,13 @@ var init_codex_app_server_client = __esm({
           await syncPluginMcpToCodex2();
         } catch (err2) {
           try {
-            const fs20 = await import("fs");
-            const path21 = await import("path");
+            const fs22 = await import("fs");
+            const path23 = await import("path");
             const { getAinativeLogsDir: getAinativeLogsDir2 } = await Promise.resolve().then(() => (init_ainative_paths(), ainative_paths_exports));
             const dir = getAinativeLogsDir2();
-            fs20.mkdirSync(dir, { recursive: true });
-            fs20.appendFileSync(
-              path21.join(dir, "plugins.log"),
+            fs22.mkdirSync(dir, { recursive: true });
+            fs22.appendFileSync(
+              path23.join(dir, "plugins.log"),
               `${(/* @__PURE__ */ new Date()).toISOString()} codex-sync-failed: ${err2 instanceof Error ? err2.message : String(err2)}
 `
             );
@@ -22985,14 +22985,14 @@ function resolvePostAction(action, row, itemVariable) {
 function substituteRowPath(template, row, itemVariable) {
   const escaped = itemVariable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const pattern = new RegExp(`\\{\\{\\s*${escaped}\\.([\\w.]+)\\s*\\}\\}`, "g");
-  return template.replace(pattern, (_match, path21) => {
-    const value = readPath(row, path21);
+  return template.replace(pattern, (_match, path23) => {
+    const value = readPath(row, path23);
     if (value === void 0 || value === null) return "";
     return String(value);
   });
 }
-function readPath(obj, path21) {
-  const parts = path21.split(".");
+function readPath(obj, path23) {
+  const parts = path23.split(".");
   let current = obj;
   for (const part of parts) {
     if (current === null || current === void 0) return void 0;
@@ -23179,14 +23179,14 @@ ${resolvedTemplate}`);
   return parts.join("");
 }
 function resolveRowTemplate(template, context) {
-  return template.replace(/\{\{\s*([^}]+)\s*\}\}/g, (_match, path21) => {
-    const value = readContextPath(context, path21.trim());
+  return template.replace(/\{\{\s*([^}]+)\s*\}\}/g, (_match, path23) => {
+    const value = readContextPath(context, path23.trim());
     if (value === void 0 || value === null) return "";
     return typeof value === "string" ? value : JSON.stringify(value);
   });
 }
-function readContextPath(value, path21) {
-  const parts = path21.split(".");
+function readContextPath(value, path23) {
+  const parts = path23.split(".");
   let current = value;
   for (const part of parts) {
     if (current === null || current === void 0) return void 0;
@@ -25611,25 +25611,76 @@ var init_app_schedule_id = __esm({
   }
 });
 
+// src/lib/packs/install-state.ts
+var install_state_exports = {};
+__export(install_state_exports, {
+  InstallStateSchema: () => InstallStateSchema,
+  hashFileSha256: () => hashFileSha256,
+  installStatePath: () => installStatePath,
+  readInstallState: () => readInstallState,
+  writeInstallState: () => writeInstallState
+});
+import fs19 from "fs";
+import path20 from "path";
+import { createHash as createHash5 } from "crypto";
+import { z as z30 } from "zod";
+function installStatePath(appsDir, appId) {
+  return path20.join(appsDir, appId, "install-state.json");
+}
+function readInstallState(appsDir, appId) {
+  try {
+    const raw = fs19.readFileSync(installStatePath(appsDir, appId), "utf-8");
+    const parsed = InstallStateSchema.safeParse(JSON.parse(raw));
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}
+function writeInstallState(appsDir, appId, state) {
+  const dir = path20.join(appsDir, appId);
+  fs19.mkdirSync(dir, { recursive: true });
+  const tmp = path20.join(dir, `.install-state.${process.pid}.tmp`);
+  fs19.writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n");
+  fs19.renameSync(tmp, installStatePath(appsDir, appId));
+}
+function hashFileSha256(absPath) {
+  return createHash5("sha256").update(fs19.readFileSync(absPath)).digest("hex");
+}
+var InstallStateSchema;
+var init_install_state = __esm({
+  "src/lib/packs/install-state.ts"() {
+    "use strict";
+    InstallStateSchema = z30.object({
+      packVersion: z30.string().min(1),
+      installedAt: z30.string().min(1),
+      /** Dropped-artifact relPath (pack space, e.g. "profiles/x--y/SKILL.md") → sha256 hex of the DEST bytes. */
+      files: z30.record(z30.string(), z30.string())
+    }).strict();
+  }
+});
+
 // src/lib/packs/install.ts
 var install_exports = {};
 __export(install_exports, {
-  installPack: () => installPack
+  acquirePack: () => acquirePack,
+  artifactDestPath: () => artifactDestPath,
+  installPack: () => installPack,
+  relayCoreVersion: () => relayCoreVersion
 });
-import fs19 from "fs";
-import path20 from "path";
+import fs20 from "fs";
+import path21 from "path";
 import os4 from "os";
 import { execFileSync as execFileSync3 } from "child_process";
 import yaml12 from "js-yaml";
 import semver from "semver";
 function relayCoreVersion() {
-  if (semver.valid("0.20.0")) {
-    return "0.20.0";
+  if (semver.valid("0.21.0")) {
+    return "0.21.0";
   }
   try {
     const root = getAppRoot(import.meta.dirname, 3);
     const pkg2 = JSON.parse(
-      fs19.readFileSync(path20.join(root, "package.json"), "utf-8")
+      fs20.readFileSync(path21.join(root, "package.json"), "utf-8")
     );
     if (pkg2.version && semver.valid(pkg2.version)) return pkg2.version;
   } catch {
@@ -25783,11 +25834,21 @@ async function installPack(source, options = {}) {
       droppedManifest.entitlement = pack.meta.entitlement;
     }
     writeManifest(appsDir, pack.meta.id, droppedManifest);
-    const { profilesDropped, blueprintsDropped } = dropArtifacts(
+    const { profilesDropped, blueprintsDropped, dropped } = dropArtifacts(
       resolved.files,
       profilesDir,
       blueprintsDir
     );
+    const { writeInstallState: writeInstallState2, hashFileSha256: hashFileSha2562 } = await Promise.resolve().then(() => (init_install_state(), install_state_exports));
+    const stateFiles = {};
+    for (const artifact of dropped) {
+      stateFiles[artifact.relPath] = hashFileSha2562(artifact.destPath);
+    }
+    writeInstallState2(appsDir, pack.meta.id, {
+      packVersion: pack.meta.version,
+      installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      files: stateFiles
+    });
     if (blueprintsDropped > 0) {
       const { reloadBlueprints: reloadBlueprints2 } = await Promise.resolve().then(() => (init_registry3(), registry_exports3));
       reloadBlueprints2();
@@ -25812,25 +25873,25 @@ function isGitUrl(source) {
 }
 function acquirePack(source) {
   if (!isGitUrl(source)) {
-    const resolved = path20.resolve(source);
-    if (!fs19.existsSync(resolved)) {
+    const resolved = path21.resolve(source);
+    if (!fs20.existsSync(resolved)) {
       throw new PackValidationError(`Pack path does not exist: ${resolved}`);
     }
     return { dir: resolved, cleanup: () => {
     } };
   }
-  const tmp = fs19.mkdtempSync(path20.join(os4.tmpdir(), "ainative-pack-clone-"));
+  const tmp = fs20.mkdtempSync(path21.join(os4.tmpdir(), "ainative-pack-clone-"));
   try {
     execFileSync3("git", ["clone", "--depth", "1", source, tmp], {
       stdio: "pipe"
     });
   } catch (err2) {
-    fs19.rmSync(tmp, { recursive: true, force: true });
+    fs20.rmSync(tmp, { recursive: true, force: true });
     throw new PackValidationError(`git clone failed for ${source}`, err2);
   }
   return {
     dir: tmp,
-    cleanup: () => fs19.rmSync(tmp, { recursive: true, force: true })
+    cleanup: () => fs20.rmSync(tmp, { recursive: true, force: true })
   };
 }
 function findResolved(files, relPath) {
@@ -25839,7 +25900,7 @@ function findResolved(files, relPath) {
 function readCustomerSeed(resolved) {
   const file = findResolved(resolved.files, "seed/customers.yaml");
   if (!file) return [];
-  const parsed = yaml12.load(fs19.readFileSync(file.absPath, "utf-8"));
+  const parsed = yaml12.load(fs20.readFileSync(file.absPath, "utf-8"));
   if (!Array.isArray(parsed)) {
     throw new PackValidationError(
       "seed/customers.yaml must be a YAML list of { slug, name, ... }"
@@ -25851,7 +25912,7 @@ function readTableSeed(resolved, logicalId) {
   for (const ext of ["json", "yaml", "yml"]) {
     const file = findResolved(resolved.files, `seed/tables/${logicalId}.${ext}`);
     if (!file) continue;
-    const text2 = fs19.readFileSync(file.absPath, "utf-8");
+    const text2 = fs20.readFileSync(file.absPath, "utf-8");
     const parsed = ext === "json" ? JSON.parse(text2) : yaml12.load(text2);
     if (!Array.isArray(parsed)) {
       throw new PackValidationError(
@@ -25909,30 +25970,36 @@ function rewriteViewRefs(view, maps) {
   return view;
 }
 function writeManifest(appsDir, appId, manifest) {
-  fs19.mkdirSync(path20.join(appsDir, appId), { recursive: true });
+  fs20.mkdirSync(path21.join(appsDir, appId), { recursive: true });
   writeAppManifest(appId, manifest, appsDir);
 }
+function artifactDestPath(relPath, profilesDir, blueprintsDir) {
+  if (relPath.startsWith("profiles/")) {
+    return path21.join(profilesDir, relPath.slice("profiles/".length));
+  }
+  if (relPath.startsWith("blueprints/") && relPath.endsWith(".yaml")) {
+    return path21.join(blueprintsDir, relPath.slice("blueprints/".length));
+  }
+  return null;
+}
 function dropArtifacts(files, profilesDir, blueprintsDir) {
   const profileDirs = /* @__PURE__ */ new Set();
   let blueprintsDropped = 0;
+  const dropped = [];
   for (const file of files) {
+    const dest = artifactDestPath(file.relPath, profilesDir, blueprintsDir);
+    if (!dest) continue;
+    fs20.mkdirSync(path21.dirname(dest), { recursive: true });
+    fs20.copyFileSync(file.absPath, dest);
+    dropped.push({ relPath: file.relPath, destPath: dest });
     if (file.relPath.startsWith("profiles/")) {
-      const dest = path20.join(profilesDir, file.relPath.slice("profiles/".length));
-      fs19.mkdirSync(path20.dirname(dest), { recursive: true });
-      fs19.copyFileSync(file.absPath, dest);
       const top = file.relPath.split("/")[1];
       if (top) profileDirs.add(top);
-    } else if (file.relPath.startsWith("blueprints/") && file.relPath.endsWith(".yaml")) {
-      const dest = path20.join(
-        blueprintsDir,
-        file.relPath.slice("blueprints/".length)
-      );
-      fs19.mkdirSync(path20.dirname(dest), { recursive: true });
-      fs19.copyFileSync(file.absPath, dest);
+    } else {
       blueprintsDropped += 1;
     }
   }
-  return { profilesDropped: profileDirs.size, blueprintsDropped };
+  return { profilesDropped: profileDirs.size, blueprintsDropped, dropped };
 }
 function titleCase3(slug) {
   return slug.split(/[-_]/).filter(Boolean).map((p) => p.charAt(0).toUpperCase() + p.slice(1)).join(" ");
@@ -25947,6 +26014,145 @@ var init_install = __esm({
   }
 });
 
+// src/lib/packs/update.ts
+var update_exports = {};
+__export(update_exports, {
+  PackNotInstalledError: () => PackNotInstalledError,
+  packUpdateAvailability: () => packUpdateAvailability,
+  updatePack: () => updatePack
+});
+import fs21 from "fs";
+import path22 from "path";
+import semver2 from "semver";
+function packUpdateAvailability(appId, opts2 = {}) {
+  const appsDir = opts2.appsDir ?? getAinativeAppsDir();
+  const installedVersion = readInstallState(appsDir, appId)?.packVersion ?? null;
+  const template = findPackTemplate(appId, { templatesDir: opts2.templatesDir });
+  const availableVersion = template?.meta?.version ?? null;
+  const updateAvailable = availableVersion !== null && semver2.valid(availableVersion) !== null && (installedVersion === null || semver2.valid(installedVersion) === null || semver2.compare(availableVersion, installedVersion) > 0);
+  return { installedVersion, availableVersion, updateAvailable };
+}
+async function updatePack(id, options = {}) {
+  const appsDir = options.appsDir ?? getAinativeAppsDir();
+  const profilesDir = options.profilesDir ?? getAinativeProfilesDir();
+  const blueprintsDir = options.blueprintsDir ?? getAinativeBlueprintsDir();
+  const installed = getApp(id, appsDir);
+  if (!installed) {
+    throw new PackNotInstalledError(
+      `Pack "${id}" is not installed. Install it first with: relay pack add ${id}`
+    );
+  }
+  const state = readInstallState(appsDir, id);
+  const previousVersion = state?.packVersion ?? null;
+  const { resolvePackSource: resolvePackSource2 } = await Promise.resolve().then(() => (init_catalog(), catalog_exports));
+  const resolvedSource = resolvePackSource2(options.source ?? id, {
+    templatesDir: options.templatesDir
+  });
+  const { dir: packDir, cleanup } = acquirePack(resolvedSource);
+  try {
+    const pack = parsePack(packDir);
+    if (pack.meta.id !== id) {
+      throw new PackValidationError(
+        `Update source is pack "${pack.meta.id}", not "${id}" \u2014 refusing to cross-update.`
+      );
+    }
+    const coreVersion = options.coreVersion ?? relayCoreVersion();
+    if (pack.meta.relayCore && !semver2.satisfies(coreVersion, pack.meta.relayCore)) {
+      throw new PackValidationError(
+        `Pack ${pack.meta.id}@${pack.meta.version} requires relay-core ${pack.meta.relayCore}, but this install is ${coreVersion}.`
+      );
+    }
+    const newVersion = pack.meta.version;
+    if (previousVersion !== null && semver2.valid(previousVersion) && semver2.valid(newVersion) && semver2.compare(newVersion, previousVersion) <= 0) {
+      return {
+        packId: id,
+        previousVersion,
+        newVersion,
+        upToDate: true,
+        backedUp: []
+      };
+    }
+    if (pack.meta.entitlement) {
+      const { assertEntitled: assertEntitled2, PackLicenseError: PackLicenseError2 } = await Promise.resolve().then(() => (init_gate(), gate_exports));
+      try {
+        if (options.licenseUrl) {
+          const { loadLicense: loadLicense2 } = await Promise.resolve().then(() => (init_load(), load_exports));
+          const license = await loadLicense2(options.licenseUrl);
+          assertEntitled2(pack.meta.entitlement, license);
+        } else {
+          const { findEntitledLicense: findEntitledLicense2 } = await Promise.resolve().then(() => (init_store(), store_exports));
+          if (!findEntitledLicense2(pack.meta.entitlement)) {
+            assertEntitled2(pack.meta.entitlement, void 0);
+          }
+        }
+      } catch (err2) {
+        if (err2 instanceof PackLicenseError2) {
+          const renew = pack.meta.purchaseUrl ? `renew at ${pack.meta.purchaseUrl}` : `redeem one with: relay license add <path-or-url to your .license.json>`;
+          throw new PackLicenseError2(
+            `Your installed ${id} keeps working \u2014 nothing is locked. Updating to v${newVersion} needs an active license: ${renew}. (${err2.message})`,
+            err2.reason
+          );
+        }
+        throw err2;
+      }
+    }
+    const resolved = resolvePackLayer(pack);
+    const backupRoot = path22.join(
+      appsDir,
+      id,
+      "backup",
+      previousVersion ?? "unknown"
+    );
+    const backedUp = [];
+    for (const file of resolved.files) {
+      const dest = artifactDestPath(file.relPath, profilesDir, blueprintsDir);
+      if (!dest || !fs21.existsSync(dest)) continue;
+      const recorded = state?.files[file.relPath];
+      if (recorded !== void 0 && hashFileSha256(dest) === recorded) continue;
+      const backupPath = path22.join(backupRoot, file.relPath);
+      fs21.mkdirSync(path22.dirname(backupPath), { recursive: true });
+      fs21.copyFileSync(dest, backupPath);
+      backedUp.push(file.relPath);
+    }
+    const install = await installPack(packDir, {
+      appsDir,
+      profilesDir,
+      blueprintsDir,
+      coreVersion: options.coreVersion,
+      licenseUrl: options.licenseUrl,
+      templatesDir: options.templatesDir
+    });
+    return {
+      packId: id,
+      previousVersion,
+      newVersion,
+      upToDate: false,
+      backedUp,
+      install
+    };
+  } finally {
+    cleanup();
+  }
+}
+var PackNotInstalledError;
+var init_update = __esm({
+  "src/lib/packs/update.ts"() {
+    "use strict";
+    init_ainative_paths();
+    init_registry();
+    init_install();
+    init_format();
+    init_catalog();
+    init_install_state();
+    PackNotInstalledError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "PackNotInstalledError";
+      }
+    };
+  }
+});
+
 // src/lib/packs/cli.ts
 var cli_exports = {};
 __export(cli_exports, {
@@ -25980,7 +26186,7 @@ async function runPackCommand(argv, io) {
     case "remove":
       return runRemove(arg, io);
     case "update":
-      return runUpdate(arg, io);
+      return runUpdate(arg, rest[1], licenseUrl, io);
     default:
       io.error(`Unknown pack action: ${action ?? "(none)"}`);
       io.error(USAGE);
@@ -26020,9 +26226,15 @@ async function runList(io) {
       io.log("No packs installed.");
       return 0;
     }
+    const { packUpdateAvailability: packUpdateAvailability2 } = await Promise.resolve().then(() => (init_update(), update_exports));
     for (const app of apps) {
       const premium = app.entitlement ? "  [premium]" : "";
-      io.log(`${app.id}  ${app.name}  ${app.primitivesSummary}${premium}`);
+      const avail = packUpdateAvailability2(app.id, { appsDir });
+      const version = avail.installedVersion ? `  installed v${avail.installedVersion}` : "";
+      const update = avail.updateAvailable && avail.availableVersion ? `  [update available \u2192 v${avail.availableVersion}]` : "";
+      io.log(
+        `${app.id}  ${app.name}  ${app.primitivesSummary}${version}${update}${premium}`
+      );
     }
     return 0;
   } catch (err2) {
@@ -26062,11 +26274,47 @@ async function runRemove(id, io) {
     return 1;
   }
 }
-async function runUpdate(id, io) {
-  io.log(
-    `pack update${id ? ` ${id}` : ""}: managed-base updates land in a future release. v1 is editable-seed \u2014 edit the installed pack in place.`
-  );
-  return 0;
+async function runUpdate(id, source, licenseUrl, io) {
+  if (!id) {
+    io.error(
+      "Missing pack id. Usage: relay pack update <id> [source] [--license-url=<path|url>]"
+    );
+    return 1;
+  }
+  try {
+    const { updatePack: updatePack2 } = await Promise.resolve().then(() => (init_update(), update_exports));
+    const report = await updatePack2(id, {
+      appsDir: io.appsDir,
+      profilesDir: io.profilesDir,
+      blueprintsDir: io.blueprintsDir,
+      source,
+      licenseUrl
+    });
+    if (report.upToDate) {
+      io.log(
+        `${report.packId} is already up to date (v${report.newVersion}).`
+      );
+      return 0;
+    }
+    const install = report.install;
+    io.log(
+      `Updated ${report.packId} v${report.previousVersion ?? "unknown"} \u2192 v${report.newVersion}: ${install.tablesCreated} table(s) added (${install.rowsSeeded} row(s)), ${install.profilesDropped} profile(s), ${install.blueprintsDropped} blueprint(s), ${install.schedulesRegistered} schedule(s).`
+    );
+    if (report.backedUp.length > 0) {
+      io.log(
+        `Backed up ${report.backedUp.length} user-modified file(s) to apps/${report.packId}/backup/${report.previousVersion ?? "unknown"}/ before overwriting:`
+      );
+      for (const relPath of report.backedUp) {
+        io.log(`  ${relPath}`);
+      }
+    }
+    return 0;
+  } catch (err2) {
+    io.error(
+      `Failed to update pack: ${err2 instanceof Error ? err2.message : String(err2)}`
+    );
+    return 1;
+  }
 }
 var USAGE;
 var init_cli = __esm({
@@ -26078,7 +26326,7 @@ var init_cli = __esm({
       "  add <name|path|git-url> [--license-url=<path|url>]   install a pack",
       "  list                 list installed packs",
       "  remove <id>          uninstall a pack",
-      "  update <id>          (v1 stub \u2014 editable-seed; edit in place)"
+      "  update <id> [source] [--license-url=<path|url>]      update to a newer version"
     ].join("\n");
   }
 });
@@ -26548,10 +26796,10 @@ import { existsSync as existsSync4, renameSync, cpSync, rmSync as rmSync2, readF
 import { join as join6 } from "path";
 import { homedir as homedir2 } from "os";
 import Database from "better-sqlite3";
-function hasSqliteHeader(path21) {
+function hasSqliteHeader(path23) {
   const SQLITE_MAGIC = "SQLite format 3\0";
   try {
-    const header = readFileSync3(path21, { encoding: null });
+    const header = readFileSync3(path23, { encoding: null });
     return header.length >= 16 && header.subarray(0, 16).toString("binary") === SQLITE_MAGIC;
   } catch {
     return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orionfold-relay",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Orionfold Relay — a local-first, multi-agent orchestration runtime and builder scaffold for AI-native work.",
   "keywords": [
     "ai",