@leverege/build-tools 2.101.2 → 2.103.0

package/.vscode/launch.json

@@ -58,6 +58,16 @@
       "runtimeExecutable": "node",
       "console": "integratedTerminal"
     },
+    {
+      "name": "chart-to-registry rsrc-srvr",
+      "type": "node",
+      "request": "launch",
+      "program": "${workspaceFolder}/src/chart-to-registry.mjs",
+      "args": [],
+      "cwd": "/Users/john/Work/leverege/cicd/@plt/resource-server",
+      "runtimeExecutable": "node",
+      "console": "integratedTerminal"
+    },
     {
       "name": "ingestor in monorepo",
       "type": "node",

package/README.md

@@ -16,7 +16,7 @@ Most tools assume the following are installed and configured:
 - `kubectl` (with a valid cluster context)
 - `helm` (v3+)
 - `fzf` (for interactive pod selection in `k8x` and `klog`)
-- Node.js 22+
+- Node.js 22+ - prefer 24
 
 ---
 
@@ -85,13 +85,15 @@ init-my-chart [--dry-run] [--debug]
 ```
 
 **`chart-to-registry`** — Pushes Helm charts to GCP Artifact Registry with version
-checking and dependency resolution.
+checking and dependency resolution. Warns if `appVersion` in Chart.yaml does not start
+with `v` (bypass with `--ignore-appv`).
 ```bash
-chart-to-registry --chart <dir> [--project <id>] [--repository <name>] [--force] [--dry-run]
+chart-to-registry --chart <dir> [--project <id>] [--repository <name>] [--force] [--dry-run] [--ignore-appv]
 ```
 
 **`push-my-chart`** — Publishes Helm charts to both GCS Chartmuseum (legacy) and
-GCP Artifact Registry.
+GCP Artifact Registry. Displays chart name, version, and appVersion before pushing;
+warns if `appVersion` does not start with `v`.
 ```bash
 push-my-chart [--chart <dir>] [--no-registry]
 ```
@@ -226,11 +228,20 @@ Manager, updating `.npmrc` / `.yarnrc.yml`. Skips refresh if the token is less t
 refresh-npm-token [--project <id>] [--force] [--dry-run]
 ```
 
-**`pkgck`** — Checks for common package configuration issues (babel, eslint, circleci,
-dockerfile, etc.) with visual pass/fail indicators.
+**`repo-panopticon`** — Multi-repo health dashboard. Checks each repository against a suite
+of indicators in a compact 80-column table. Monorepo-aware: workspace packages are
+auto-discovered, grouped under their parent repo label, and checked individually.
 ```bash
-pkgck
+repo-panopticon <dirs...>                 # check one or more repos / globs
+repo-panopticon @plt/* @kud/* @srv/*      # typical full-org sweep
+repo-panopticon --no-pull @plt/*          # skip git pull/fetch
+repo-panopticon --limit 40 @srv/*         # cap displayed rows (default 80)
+repo-panopticon --concurrency 10 @srv/*   # increase parallelism (default 5)
 ```
+Columns: `mgr` (npm/yrn) · `pkg` (package.json version) · `git` (latest semver tag) ·
+`scop` (package scope) · `cir` (CircleCI — ✘ missing · L legacy · 1 orb v1 · 2 orb v2) ·
+`ESM` (`"type":"module"`) · `har` (.har hooks directory) · `lnt` (ESLint major version) ·
+`bbl` (Babel presence). Repo name shown in orange when dirty or sync failed.
 
 **`pkglint`** — Verifies required documentation files (README.md, LICENSE.md) are
 present before publishing.
@@ -252,8 +263,9 @@ count-lines-of-code [--src-only]
 
 ### CI/CD Integration
 
-**`circle-orb-it`** — Installs or updates CircleCI configuration (Leverege orb) and
-GitHub Dependabot settings for a repository. Preserves existing customizations.
+**`circle-orb-it`** — Installs or updates CircleCI configuration (Leverege orb v2.0.0) and
+GitHub Dependabot settings for a repository. Auto-detects npm vs yarn-berry and writes
+the appropriate template. Preserves existing customizations.
 ```bash
 circle-orb-it [--dry-run] [--debug]
 ```
@@ -340,6 +352,7 @@ BUILD_TOOLS_DEBUG=1 docker-to-registry
 
 | Tool | Replacement |
 |------|-------------|
+| `pkgck` | `repo-panopticon` |
 | `docker-to-registry-py` | `docker-to-registry` |
 | `chart-to-museum` | `push-my-chart` |
 | `refresh-py-idx` | No longer needed |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.101.2",
+  "version": "2.103.0",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -16,7 +16,6 @@
     "prepack": "npm exec prepack"
   },
   "bin": {
-    "build-and-push": "src/build-and-push.sh",
     "build-cnpg-image": "src/build-cnpg-image.mjs",
     "build-tools": "src/build-tools.mjs",
     "change-up": "src/change-up.sh",
@@ -29,8 +28,6 @@
     "decrypt-secrets": "src/decrypt-secrets.sh",
     "dirty-git": "src/dirty-git.sh",
     "docker-to-registry": "src/docker-to-registry.mjs",
-    "docker-to-registry-py": "src/docker-to-registry-py.mjs",
-    "docker-to-registry.sh": "src/docker-to-registry.sh",
     "dockreate": "src/dockreate.sh",
     "encrypt-secrets": "src/encrypt-secrets.sh",
     "firebaseDeploy": "src/firebaseDeploy.mjs",
@@ -55,7 +52,7 @@
     "npm-link": "src/npm-link.sh",
     "npm-unlink": "src/npm-unlink.sh",
     "overwhelm": "src/overwhelm.mjs",
-    "pkgck": "src/pkgck.sh",
+    "pkgck": "echo '*** Use repo-panopticon instead! ***",
     "pkglint": "src/pkglint.sh",
     "prepack": "src/prepack.mjs",
     "prune-git": "src/prune-git.sh",
@@ -65,18 +62,18 @@
     "push-my-chart": "src/push-my-chart.mjs",
     "refresh-npm-token": "src/refresh-npm-token.mjs",
     "refresh-py-idx": "src/refresh-py-idx.sh",
+    "repo-panopticon": "src/repo-panopticon.mjs",
     "send-to-slack": "src/send-to-slack.mjs",
     "service-man": "src/service-man/service-man.mjs",
     "snapshot-cnpg": "src/snapshot-cnpg.mjs",
-    "tag-release": "src/tag-release.mjs",
     "unleash": "src/unleash.mjs",
     "upload-model": "src/upload-model.sh",
     "yarn-build": "src/yarn-build.mjs"
   },
   "author": "Leverege Devs",
   "engines": {
-    "node": "^22.11 || ^24.11",
-    "npm": ">=11.6"
+    "node": "^22.11 || >=24",
+    "npm": ">=10.2 || >=11.6"
   },
   "license": "SEE LICENSE IN LICENSE.md",
   "dependencies": {
@@ -94,7 +91,7 @@
     "googleapis": "^171.4.0",
     "handlebars": "^4.7.9",
     "ignore": "^7.0.5",
-    "inquirer": "^13.4.2",
+    "inquirer": "^13.4.3",
     "js-yaml": "^4.1.1",
     "jsdoc": "^4.0.5",
     "ms": "^2.1.3",
@@ -103,20 +100,20 @@
     "p-limit": "^7.3.0",
     "package-up": "^5.0.0",
     "readline-sync": "^1.4.10",
-    "semver": "^7.7.4",
+    "semver": "^7.8.0",
     "shell-quote": "^1.8.3",
     "simple-git": "^3.36.0",
     "sloc": "^0.3.2",
     "superstruct": "^2.0.2",
     "tmp": "^0.2.5",
-    "toml": "^3.0.0",
-    "yaml": "^2.8.3",
+    "toml": "^4.1.1",
+    "yaml": "^2.9.0",
     "zx": "^8.8.5"
   },
   "devDependencies": {
     "@leverege/eslint-config-leverege": "^5.1.2",
     "chai": "^6.2.2",
     "mocha": "^11.7.5",
-    "npm": "^11.13.0"
+    "npm": "^11.14.1"
   }
 }

package/src/Utils.mjs

@@ -534,6 +534,7 @@ export const parseHelmChart = async ( helmroot = './helm' ) => {
   const chartName = chartYaml.name
   const chartLibrary = chartYaml?.type === 'library'
   const chartVersion = chartYaml.version
+  const chartAppVersion = chartYaml.appVersion
   const chartPackage = `${chartName}-${chartVersion}.tgz`
   const valuesText = fs.readFileSync( `${helmroot}/values.yaml`, 'utf8' )
   const valuesYaml = YAML.load( valuesText )
@@ -573,6 +574,7 @@ export const parseHelmChart = async ( helmroot = './helm' ) => {
     chartLibrary,
     chartPackage,
     chartVersion,
+    chartAppVersion,
     hasDependencies,
     depsOutOfSync,
     imageRegistry,

package/src/chart-to-registry.mjs

@@ -14,9 +14,10 @@ import {
   errorExit,
   establishOauthAccess,
   log,
-  warning,
   parseHelmChart,
+  proceed,
   shellCmd,
+  warning,
 } from './Utils.mjs'
 
 const commandLineOptions = [ // Use commandLineOptions to tie into the Usage statements
@@ -46,6 +47,11 @@ const commandLineOptions = [ // Use commandLineOptions to tie into the Usage sta
     type : Boolean,
     description : '{green update artifact registry auth token and exit}',
   },
+  {
+    name : 'ignore-appv',
+    type : Boolean,
+    description : '{green ignore the Char.yaml appVersion format}',
+  },
   {
     name : 'dry-run',
     type : Boolean,
@@ -98,6 +104,11 @@ if ( semverLt( process.version, minNodejsVersion ) ) {
 // load up all we need to know about the chart
 const helmChart = await parseHelmChart( args.chart )
 
+if ( !helmChart.chartAppVersion.startsWith( 'v' ) && !args.ignoreAppv ) {
+  warning( 'Chart.yaml appVersion does not begin with the letter "v"\n' )
+  await proceed( 'You sure about this?' )
+}
+
 // helm push helm-package.tgz oci://REGISTRY_LOCATION/REGISTRY_PROJECT/REGISTRY_REPOSITORY/charts
 //
 const registryLocation = args.location || helmChart.registryLocation

package/src/circle-orb-it/{circle-orb.yml → circle-npm.yml}

@@ -1,25 +1,28 @@
 version: 2.1
 
 orbs:
-  leverege: leverege/circle-nodejs-ci@1.2.6
+  leverege: leverege/circle-nodejs-ci@2.0.0
 
 workflows:
   build-and-verify:
     jobs:
       - leverege/install-dependencies:
           context: npm
-          # pkg-manager: yarn-berry   # uncomment for Yarn Berry repos
       - leverege/code-analysis:
+          context: npm
           requires:
             - leverege/install-dependencies
       - leverege/code-coverage:
+          context:
+            - npm
+            - leverege-gcp                # provides GCP_SA_KEY_JSON for tests that need GCP access
           coverage-threshold: 70          # percentage threshold for functions, lines, and statements
-          context: leverege-gcp           # provides GCP_SA_KEY_JSON for tests that need GCP access
           enable-redis: false             # set to true if tests require a live Redis connection
           cache-config: '{"type":"inMemory"}' # sets CACHE_CONFIG env var - options: inMemory, redis
           requires:
             - leverege/install-dependencies
       - leverege/generate-docs:
+          context: npm
           requires:
             - leverege/install-dependencies
       - leverege/mirror-to-github:

package/src/circle-orb-it/circle-orb-it.mjs

@@ -11,14 +11,19 @@ import {
   enableDebug,
   errorExit,
   getGitRootDirectory,
+  getIsYarnProject,
   log,
+  mkdirSafe,
   proceed,
+  warning,
 } from '../Utils.mjs'
 
-const ORB_VERSION = '1.2.6' // Keep this in sync with the version in circle-orb.yml
+const ORB_VERSION = '2.0.0' // Keep this in sync with the versions in circle-npm.yml and circle-yarn.yml
 const CIRCLE_DIR = '.circleci'
 const CIRCLE_YML = `${CIRCLE_DIR}/config.yml`
-const CIRCLE_YML_TEMPLATE = path.join( BUILD_TOOLS_ROOT, 'circle-orb-it', 'circle-orb.yml' )
+const CIRCLE_NPM_TEMPLATE = path.join( BUILD_TOOLS_ROOT, 'circle-orb-it', 'circle-npm.yml' )
+const CIRCLE_YARN_TEMPLATE = path.join( BUILD_TOOLS_ROOT, 'circle-orb-it', 'circle-yarn.yml' )
+const CIRCLE_YML_TEMPLATE = isYarn => ( isYarn ? CIRCLE_YARN_TEMPLATE : CIRCLE_NPM_TEMPLATE )
 const GITHUB_DIR = '.github'
 const DEPENDABOT_FILE = `${GITHUB_DIR}/dependabot.yml`
 const DEPENDABOT_TEMPLATE = path.join( BUILD_TOOLS_ROOT, 'circle-orb-it', 'dependabot.yml' )
@@ -52,9 +57,13 @@ if ( !gitRoot ) {
   errorExit( 'This command must be run inside a git repository' )
 }
 
+const isYarn = getIsYarnProject( gitRoot )
+const circleTemplate = CIRCLE_YML_TEMPLATE( isYarn )
+log( chalk.blue( `\nPackage manager: ${isYarn ? 'yarn-berry' : 'npm'}` ) )
+
 // Warn if this looks like a Python project since the orb is Node.js only
 if ( fs.existsSync( path.join( gitRoot, 'pyproject.toml' ) ) ) {
-  log( chalk.yellow( '\n***WARNING: pyproject.toml detected - the leverege orb is Node.js only' ) )
+  warning( 'pyproject.toml detected - the leverege orb is Node.js only' )
   await proceed( 'Continue anyway?' )
 }
 
@@ -119,7 +128,7 @@ if ( !writeCircleYml && !writeDependabot ) {
 
 if ( options.dryRun ) {
   if ( writeCircleYml ) {
-    let dryRunContent = fs.readFileSync( CIRCLE_YML_TEMPLATE, 'utf-8' )
+    let dryRunContent = fs.readFileSync( circleTemplate, 'utf-8' )
     if ( redisEnabled ) {
       dryRunContent = dryRunContent
         .replace( 'enable-redis: false', 'enable-redis: true' )
@@ -142,10 +151,8 @@ if ( options.dryRun ) {
 // ---------- Write ----------
 
 if ( writeCircleYml ) {
-  if ( !fs.existsSync( circleDir ) ) {
-    fs.mkdirSync( circleDir, { recursive : true } )
-  }
-  let circleYmlContent = fs.readFileSync( CIRCLE_YML_TEMPLATE, 'utf-8' )
+  mkdirSafe( circleDir )
+  let circleYmlContent = fs.readFileSync( circleTemplate, 'utf-8' )
   if ( redisEnabled ) {
     circleYmlContent = circleYmlContent
       .replace( 'enable-redis: false', 'enable-redis: true' )
@@ -162,9 +169,7 @@ if ( writeCircleYml ) {
 }
 
 if ( writeDependabot ) {
-  if ( !fs.existsSync( githubDir ) ) {
-    fs.mkdirSync( githubDir, { recursive : true } )
-  }
+  mkdirSafe( githubDir )
   fs.writeFileSync( dependabotPath, fs.readFileSync( DEPENDABOT_TEMPLATE, 'utf-8' ) )
   log( chalk.green( `Dependabot config written => ${dependabotPath}` ) )
 }

package/src/circle-orb-it/circle-yarn.yml

@@ -0,0 +1,25 @@
+version: 2.1
+
+orbs:
+  leverege: leverege/circle-nodejs-ci@2.0.0
+
+workflows:
+  build-and-verify:
+    jobs:
+      - leverege/code-analysis:
+          context: npm
+          pkg-manager: yarn-berry
+      - leverege/code-coverage:
+          context:
+            - npm
+            - leverege-gcp                # provides GCP_SA_KEY_JSON for tests that need GCP access
+          pkg-manager: yarn-berry
+          coverage-threshold: 70          # percentage threshold for functions, lines, and statements
+          enable-redis: false             # set to true if tests require a live Redis connection
+          cache-config: '{"type":"inMemory"}' # sets CACHE_CONFIG env var - options: inMemory, redis
+      - leverege/generate-docs:
+          context: npm
+          pkg-manager: yarn-berry
+      - leverege/mirror-to-github:
+          context: github-mirror
+          # github-team: platform   # available teams: platform, utilities, pitcrew, recovr

package/src/dashboard/DashboardManager.mjs

@@ -9,16 +9,25 @@ import { debug, errorExit, log } from '../Utils.mjs'
 // const FIELD_MANAGER = 'dashboard'
 const GRAFANA_LABEL = 'grafana_dashboard'
 const GRAFANA_FOLDER = 'grafana_folder'
+const GRAFANA_LOCAL = 'grafana_dashboard_local'
 
 /* eslint-disable security/detect-non-literal-fs-filename */
 export default class DashboardManager {
   #api
   #namespace
   #dryRun
+  #prune
+  #folders
+  #localDir
+  #pruneLocal
 
-  constructor( { namespace = 'prometheus', dryRun = false } = {} ) {
+  constructor( { namespace = 'prometheus', dryRun = false, prune = false, folders = [], localDir = null, pruneLocal = false } = {} ) {
     this.#namespace = namespace
     this.#dryRun = dryRun
+    this.#prune = prune
+    this.#folders = folders
+    this.#localDir = localDir
+    this.#pruneLocal = pruneLocal
   }
 
   #getApi() {
@@ -31,21 +40,61 @@ export default class DashboardManager {
   }
 
   async apply( dir ) {
-    const folders = fs.readdirSync( dir, { withFileTypes : true } )
-      .filter( e => e.isDirectory() )
+    if ( !fs.existsSync( dir ) ) {
+      errorExit( `Dashboard directory not found: ${dir}` )
+    }
 
-    if ( folders.length === 0 ) {
-      log( chalk.yellow( `No dashboard subfolders found in ${dir}` ) )
+    const entries = fs.readdirSync( dir, { withFileTypes : true } )
+    const folders = entries.filter( e => e.isDirectory() )
+    const jsonFiles = entries.filter( e => e.isFile() && e.name.endsWith( '.json' ) )
+
+    if ( folders.length === 0 && jsonFiles.length === 0 ) {
+      log( chalk.yellow( `No dashboards or subfolders found in ${dir}` ) )
       return
     }
 
-    for ( const folder of folders ) {
-      const files = fs.readdirSync( path.join( dir, folder.name ) )
-        .filter( f => f.endsWith( '.json' ) )
+    const applied = new Set()
+
+    if ( folders.length === 0 ) {
+      // leaf directory — apply JSON files using basename as the Grafana folder name
+      const folderName = path.basename( dir )
+      for ( const file of jsonFiles ) {
+        const name = await this.#applyDashboard( folderName, path.join( dir, file.name ) )
+        if ( name ) applied.add( name )
+      }
+      if ( this.#prune ) await this.#pruneOrphans( applied, folderName )
+    } else {
+      // filter to configured folders if DASHBOARDS was set in overwhelm.yaml
+      const activeFolders = this.#folders.length > 0 ?
+        folders.filter( f => this.#folders.includes( f.name ) ) :
+        folders
+
+      if ( this.#folders.length > 0 && activeFolders.length < this.#folders.length ) {
+        const missing = this.#folders.filter( f => !folders.find( d => d.name === f ) )
+        missing.forEach( f => log( chalk.yellow( `  [warn] requested folder not found: ${f}` ) ) )
+      }
+
+      for ( const folder of activeFolders ) {
+        const files = fs.readdirSync( path.join( dir, folder.name ) )
+          .filter( f => f.endsWith( '.json' ) )
+
+        for ( const file of files ) {
+          const name = await this.#applyDashboard( folder.name, path.join( dir, folder.name, file ) )
+          if ( name ) applied.add( name )
+        }
+      }
+
+      if ( this.#prune ) await this.#pruneOrphans( applied )
+    }
 
-      for ( const file of files ) {
-        await this.#applyDashboard( folder.name, path.join( dir, folder.name, file ) )
+    // Apply local dashboards if --local-dir was specified
+    if ( this.#localDir ) {
+      if ( !fs.existsSync( this.#localDir ) ) {
+        errorExit( `Local dashboard directory not found: ${this.#localDir}` )
       }
+      log( chalk.bold( `Applying local dashboards from: ${this.#localDir}` ) )
+      const localApplied = await this.#applyDir( this.#localDir, true )
+      if ( this.#pruneLocal ) await this.#pruneLocalOrphans( localApplied )
     }
   }
 
@@ -64,7 +113,11 @@ export default class DashboardManager {
       return
     }
 
-    for ( const folder of folders ) {
+    const activeFolders = this.#folders.length > 0 ?
+      folders.filter( f => this.#folders.includes( f.name ) ) :
+      folders
+
+    for ( const folder of activeFolders ) {
       const files = fs.readdirSync( path.join( dir, folder.name ) )
         .filter( f => f.endsWith( '.json' ) )
 
@@ -75,20 +128,74 @@ export default class DashboardManager {
         files.forEach( f => log( `  ${chalk.cyan( path.basename( f, '.json' ) )}` ) )
       }
     }
+
+    if ( this.#localDir && fs.existsSync( this.#localDir ) ) {
+      log( chalk.bold( `\nLocal dashboards in: ${this.#localDir}` ) )
+      const localFolders = fs.readdirSync( this.#localDir, { withFileTypes : true } )
+        .filter( e => e.isDirectory() )
+
+      for ( const folder of localFolders ) {
+        const files = fs.readdirSync( path.join( this.#localDir, folder.name ) )
+          .filter( f => f.endsWith( '.json' ) )
+
+        log( chalk.bold( `\n[${folder.name}] (local)` ) )
+        if ( files.length === 0 ) {
+          log( chalk.dim( '  (empty)' ) )
+        } else {
+          files.forEach( f => log( `  ${chalk.cyan( path.basename( f, '.json' ) )}` ) )
+        }
+      }
+    }
   }
 
-  async #applyDashboard( folder, filePath ) {
+  // Scans a directory for JSON files (leaf mode) or subfolders and applies all dashboards.
+  // Returns the Set of ConfigMap names applied.
+  async #applyDir( dir, local = false ) {
+    const entries = fs.readdirSync( dir, { withFileTypes : true } )
+    const subDirs = entries.filter( e => e.isDirectory() )
+    const jsonFiles = entries.filter( e => e.isFile() && e.name.endsWith( '.json' ) )
+    const applied = new Set()
+
+    if ( subDirs.length === 0 ) {
+      const folderName = path.basename( dir )
+      for ( const file of jsonFiles ) {
+        const name = await this.#applyDashboard( folderName, path.join( dir, file.name ), local )
+        if ( name ) applied.add( name )
+      }
+    } else {
+      for ( const folder of subDirs ) {
+        const files = fs.readdirSync( path.join( dir, folder.name ) )
+          .filter( f => f.endsWith( '.json' ) )
+
+        for ( const file of files ) {
+          const name = await this.#applyDashboard( folder.name, path.join( dir, folder.name, file ), local )
+          if ( name ) applied.add( name )
+        }
+      }
+    }
+
+    return applied
+  }
+
+  async #applyDashboard( folder, filePath, local = false ) {
     const filename = path.basename( filePath )
-    const name = `dashboard-${path.basename( filePath, '.json' )}`
+    const slug = path.basename( filePath, '.json' )
+      .toLowerCase()
+      .replace( /[^a-z0-9.-]+/g, '-' )
+      .replace( /^-+|-+$/g, '' )
+    const name = `dashboard-${local ? 'local-' : ''}${slug}`
     const json = fs.readFileSync( filePath, 'utf8' )
 
+    const labels = { [GRAFANA_LABEL] : '1' }
+    if ( local ) labels[GRAFANA_LOCAL] = '1'
+
     const configMap = {
       apiVersion : 'v1',
       kind : 'ConfigMap',
       metadata : {
         name,
         namespace : this.#namespace,
-        labels : { [GRAFANA_LABEL] : '1' },
+        labels,
         annotations : { [GRAFANA_FOLDER] : folder },
       },
       data : { [filename] : json },
@@ -97,8 +204,8 @@ export default class DashboardManager {
     debug( configMap, `dashboard: ${name}` )
 
     if ( this.#dryRun ) {
-      log( chalk.yellow( `  [dry-run] ${filename} → [${folder}]` ) )
-      return
+      log( chalk.yellow( `  [dry-run] ${filename} → [${folder}]${local ? ' (local)' : ''}` ) )
+      return name
     }
 
     const api = this.#getApi()
@@ -117,10 +224,78 @@ export default class DashboardManager {
       } else {
         await api.createNamespacedConfigMap( { namespace : this.#namespace, body : configMap } )
       }
-      log( chalk.green( `  ✓ ${filename} → [${folder}]` ) )
+      log( chalk.green( `  ✓ ${filename} → [${folder}]${local ? ' (local)' : ''}` ) )
     } catch ( e ) {
       errorExit( `Failed to apply ${name}: ${e.message}` )
     }
+    return name
+  }
+
+  async #pruneOrphans( applied, folderFilter = null ) {
+    const api = this.#getApi()
+    let configMaps
+    try {
+      const res = await api.listNamespacedConfigMap( {
+        namespace : this.#namespace,
+        labelSelector : `${GRAFANA_LABEL}=1`,
+      } )
+      configMaps = res.items
+    } catch ( e ) {
+      log( chalk.yellow( `  [prune] could not list ConfigMaps: ${e.message}` ) )
+      return
+    }
+
+    const orphans = configMaps.filter( ( cm ) => {
+      if ( applied.has( cm.metadata.name ) ) return false
+      if ( cm.metadata.labels?.[GRAFANA_LOCAL] === '1' ) return false // leave local CMs to pruneLocal
+      if ( folderFilter && cm.metadata.annotations?.[GRAFANA_FOLDER] !== folderFilter ) return false
+      return true
+    } )
+
+    for ( const cm of orphans ) {
+      const name = cm.metadata.name
+      if ( this.#dryRun ) {
+        log( chalk.yellow( `  [dry-run] prune ${name}` ) )
+        continue
+      }
+      try {
+        await api.deleteNamespacedConfigMap( { name, namespace : this.#namespace } )
+        log( chalk.red( `  ✗ pruned ${name}` ) )
+      } catch ( e ) {
+        log( chalk.yellow( `  [prune] failed to delete ${name}: ${e.message}` ) )
+      }
+    }
+  }
+
+  async #pruneLocalOrphans( applied ) {
+    const api = this.#getApi()
+    let configMaps
+    try {
+      const res = await api.listNamespacedConfigMap( {
+        namespace : this.#namespace,
+        labelSelector : `${GRAFANA_LOCAL}=1`,
+      } )
+      configMaps = res.items
+    } catch ( e ) {
+      log( chalk.yellow( `  [prune-local] could not list ConfigMaps: ${e.message}` ) )
+      return
+    }
+
+    const orphans = configMaps.filter( cm => !applied.has( cm.metadata.name ) )
+
+    for ( const cm of orphans ) {
+      const name = cm.metadata.name
+      if ( this.#dryRun ) {
+        log( chalk.yellow( `  [dry-run] prune-local ${name}` ) )
+        continue
+      }
+      try {
+        await api.deleteNamespacedConfigMap( { name, namespace : this.#namespace } )
+        log( chalk.red( `  ✗ pruned (local) ${name}` ) )
+      } catch ( e ) {
+        log( chalk.yellow( `  [prune-local] failed to delete ${name}: ${e.message}` ) )
+      }
+    }
   }
 
 }