@leverege/build-tools 2.101.2 → 2.103.0

package/src/helm-charts/prom-operator/helmup.plugin

@@ -8,7 +8,7 @@ showInstalling "The Prometheus Operator (kube-prometheus-stack)"
 
 # https://artifacthub.io/packages/helm/prometheus-community/kube-prometheus-stack
 OCI_CHART="oci://ghcr.io/prometheus-community/charts/kube-prometheus-stack"
-[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="83.7.0"
+[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="85.0.2"
 helm upgrade $NS --install prometheus-stack $OCI_CHART \
                  --values  prom-operator/prometheus-stack.yaml \
                  --version $PROMETHEUS_STACK_CHART_VERSION $HELM_WHAT

package/src/helm-charts/prom-operator/prometheus-stack.yaml.ovh

@@ -143,9 +143,15 @@ grafana:
   sidecar:
       dashboards:
         enabled: true
+        folderAnnotation: grafana_folder
+        provider:
+          foldersFromFilesStructure: true
   # Credentials are injected from the grafana-google-oauth k8s secret, which is
   # managed by the ExternalSecret in helmup.plugin once ESO is deployed.
   # On first install, the secret is a placeholder created by helmup.bootstrap.
+  grafana.ini:
+    feature_toggles:
+      ssoSettingsApi: false
   envFromSecret: grafana-google-oauth
   env:
     GF_SERVER_ROOT_URL: https://${PROJECT_NAME}-monitoring.${HOST}.com
@@ -310,6 +316,15 @@ alertmanager:
           - namespace
           - alertname
 
+      # GKE node upgrade/maintenance suppresses expected churn alerts.
+      # PVC, disk pressure, and other infrastructure alerts are intentionally
+      # excluded so genuine storage/capacity problems are never silenced.
+      - source_matchers:
+          - alertname="GKEMaintenanceInProgress"
+          - maintenance="true"
+        target_matchers:
+          - alertname=~"KubernetesNodeNotReady|KubernetesPodNotHealthy|KubernetesPodCrashLooping|frequent_app_restarts"
+
     route:
       receiver: slack # default for everything
       group_by: ["alertname", "namespace"]

package/src/helm-charts/prom-operator/rules/gke-maintenance-rules.yaml

@@ -0,0 +1,19 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: gke-maintenance-rules
+  namespace: prometheus
+
+spec:
+  groups:
+  - name: GKE Maintenance
+    rules:
+    - alert: GKEMaintenanceInProgress
+      expr: sum(kube_node_spec_unschedulable) > 0
+      for: 3m
+      labels:
+        severity: info
+        maintenance: "true"
+      annotations:
+        summary: "GKE node maintenance in progress"
+        description: "{{ $value }} node(s) are currently unschedulable — GKE upgrade or cordon in progress"

package/src/helm-charts/prom-operator/stackdriver-exporter.yaml.ovh

@@ -19,7 +19,8 @@ stackdriver:
       kubernetes.io/container/accelerator/duty_cycle,
       kubernetes.io/container/accelerator/memory_total,
       kubernetes.io/container/accelerator/memory_used,
-      monitoring.googleapis.com/uptime_check/check_passed,
+      pubsub.googleapis.com/subscription/backlog_bytes,
+      pubsub.googleapis.com/subscription/dead_letter_message_count,
       pubsub.googleapis.com/subscription/num_undelivered_messages,
       pubsub.googleapis.com/subscription/oldest_unacked_message_age,
       pubsub.googleapis.com/subscription/pull_ack_request_count,

package/src/helm-charts/valkey/valkey-local.yaml

@@ -85,6 +85,7 @@ sentinel:
 
 metrics:
   enabled: true
+  resourcesPreset: "small"
   image:
     registry: us-docker.pkg.dev
     repository: leverege-registry/bitnami-mirror/images/redis-exporter

package/src/helmup.sh

@@ -20,6 +20,7 @@ function giveHelp() {
       `color g "--k8s-match"` Only proceed if k8s context is correctly set
       `color g "--dry-run"`   Show what helm would do without applying changes
       `color g "--debug"`     Enable verbose debug output
+      `color g "--mutate"`    Forces a deployment mutation
       `color g "--help"`      Show this help message
 
     Invocation Modes:
@@ -48,6 +49,9 @@ for arg in "$@"; do
     --k8s-match)
       export OVERWHELM_ARGS="--matchk8s"
       ;;
+    --mutate)
+      MUTATE_DEPLOYMENT=1
+      ;;
     --help|-h)
       giveHelp && exit 0
       ;;
@@ -622,6 +626,25 @@ function doHelmup() {
   local from=
   [ ! -z "$FROM_VERSIONS" ] && from="`color y \"<= from Versions.json\"`"
   printf "$doing $from\n"
+  if [[ $MUTATE_DEPLOYMENT -eq 1 ]];
+  then
+    cat<<MUTATION_MSG
+
+  `color y "WARNING: About to delete the $SERVICE k8s deployment object!
+           This will cause brief downtime while helm recreates it. The service
+           and any LoadBalancer/static IP will be unaffected."`
+
+MUTATION_MSG
+    yesToContinue "to delete the $SERVICE deployment and proceed with upgrade"
+    kubectl delete deployments.apps $SERVICE
+    cat<<DELETE_WAIT
+    
+    `color y "  Waiting for $SERVICE deployment to be fully removed..."`
+
+DELETE_WAIT
+    kubectl wait --for=delete deployment/$SERVICE --timeout=120s
+  fi
+
   # plugins pass HELMUP as a single quoted string - split it into args without using eval
   [[ $# -eq 1 ]] && set -- $1
   "$@" --set "helmup.culprit=$culprit" --set "helmup.deployT=$deployT"
@@ -811,7 +834,7 @@ REBOOTSTRAP
 }
 
 # ---------- helmup MAIN ----------
-helm repo update &>/dev/null & # see comments in the doInstall function for rationale
+helm repo update leverege &>/dev/null & # see comments in the doInstall function for rationale
 
 overwhelm $OVERWHELM_ARGS
 [ $? -ne 0 ] && printf "\n\n***Aborting helmup...\n\n" && exit 1

package/src/init-my-chart/Chartwright.mjs

@@ -13,7 +13,7 @@ const hbsContext = {
   hbsChartName : '',
   hbsChartVersion : '1.0.0',
   hbsChartAppVersion : 'v1.0.0',
-  hbsArtifactRegistry : 'us-docker.pkg.dev/leverege-registry/FOOLDER/images',
+  hbsArtifactRegistry : 'us-docker.pkg.dev/leverege-registry/FOLDER/images',
   hbsPartOf : '',
   hbsServicePreemptible : true,
   hbsRedisEnabled : true,

package/src/init-my-chart/leaf-chart-templates/templates/extraobjects.yaml

@@ -0,0 +1 @@
+{{ include "leverege.extraObjects" . }}

package/src/overwhelm.mjs

@@ -250,14 +250,14 @@ const buildYaml = ( yamls, replacements ) => {
 const values = buildYaml( yams, over )
 
 // Check to see if someone is requesting a value from the yaml.
+// Uses the fully merged+resolved `over` object so context-specific keys are found.
 if ( args.key ) {
-  const section = args.section || 'default'
-  const keys = yaml[section]
-  debug( { keys }, '<==Replacements' )
+  const val = over[args.key] ?? ''
+  debug( { over }, '<==Replacements' )
   if ( args.export ) {
-    log( `export ${args.key}=${keys[args.key]}` )
+    log( `export ${args.key}=${val}` )
   } else {
-    log( keys[args.key] )
+    log( val )
   }
   if ( !args.continue ) process.exit()
 }

package/src/push-my-chart.mjs

@@ -9,7 +9,9 @@ import {
   errorExit,
   log,
   parseHelmChart,
-  shellCmd
+  proceed,
+  shellCmd,
+  warning,
 } from './Utils.mjs'
 
 const commandLineOptions = [
@@ -56,11 +58,18 @@ if ( args.help ) {
 const {
   chartName,
   chartVersion,
+  chartAppVersion,
   depsOutOfSync,
 } = await parseHelmChart( args.chart )
 
-log( chalk.green( `Chart   => ${chalk.bold.yellow( chartName )}` ) )
-log( chalk.green( `Version => ${chalk.bold.yellow( chartVersion )}` ) )
+log( chalk.green( `Chart      => ${chalk.bold.yellow( chartName )}` ) )
+log( chalk.green( `Version    => ${chalk.bold.yellow( chartVersion )}` ) )
+log( chalk.green( `AppVersion => ${chalk.bold.yellow( chartAppVersion )}` ) )
+
+if ( !chartAppVersion.startsWith( 'v' ) ) {
+  warning( 'Chart.yaml appVersion does not begin with the letter "v"\n' )
+  await proceed( 'You sure about this?' )
+}
 
 if ( depsOutOfSync ) {
   try {
@@ -89,7 +98,7 @@ if ( args.noRegistry ) {
 
 try {
   log( chalk.green( '  ... pushing to the Artifact Registry' ) )
-  const registry = await shellCmd( `chart-to-registry --chart ${args.chart}` )
+  const registry = await shellCmd( `chart-to-registry --chart ${args.chart} --ignore-appv` )
   debug( { registry }, '<==chart-to-registry' )
   process.exit( museumStatus )
 } catch ( ex ) {

package/src/repo-panopticon.mjs

@@ -0,0 +1,415 @@
+#!/usr/bin/env node
+/* eslint-disable security/detect-non-literal-fs-filename, no-multi-spaces, key-spacing */
+import fs from 'node:fs'
+import path from 'node:path'
+
+import { program } from 'commander'
+import chalk from 'chalk'
+import { glob } from 'glob'
+import ora from 'ora'
+import pLimit from 'p-limit'
+import simpleGit from 'simple-git'
+
+import { clear, enableDebug, log, parseJsonFile } from './Utils.mjs'
+
+// ---------- Symbols ----------
+
+const SYM_GOOD = chalk.green( '✔' )
+const SYM_BAD  = chalk.red( '✘' )
+
+// ---------- Checks ----------
+// Each check: { label: string, fn: ({ dir, pkg, isWorkspace }) => { value: string } }
+// Add new checks here — the table expands automatically.
+
+const CHECKS = [
+  {
+    label : 'cir',
+    fn    : ( { dir } ) => {
+      const cfgPath = path.join( dir, '.circleci', 'config.yml' )
+      if ( !fs.existsSync( cfgPath ) ) return { value : SYM_BAD }
+      try {
+        const content = fs.readFileSync( cfgPath, 'utf8' )
+        const match = content.match( /leverege\/circle-nodejs-ci@(\d+)\.\d+\.\d+/ )
+        if ( !match || parseInt( match[1], 10 ) === 0 ) return { value : chalk.hex( '#FFA500' )( 'L' ) }
+        const major = parseInt( match[1], 10 )
+        return { value : major === 1 ? chalk.yellow( '1' ) : chalk.green( `${major}` ) }
+      } catch {
+        return { value : chalk.hex( '#FFA500' )( 'L' ) }
+      }
+    },
+  },
+  {
+    label : 'ESM',
+    fn    : ( { pkg } ) => {
+      const ok = pkg?.type === 'module'
+      return { value : ok ? SYM_GOOD : SYM_BAD }
+    },
+  },
+  {
+    label : 'har',
+    fn    : ( { gitRoot } ) => {
+      const ok = fs.existsSync( path.join( gitRoot, '.har' ) )
+      return { value : ok ? SYM_GOOD : SYM_BAD }
+    },
+  },
+  {
+    label : 'lnt',
+    fn    : ( { dir, pkg, gitRoot } ) => {
+      if ( !pkg?.scripts?.lint ) return { value : SYM_BAD }
+      try {
+        // Prefer package-local node_modules; fall back to monorepo root (hoisted)
+        const local  = path.join( dir, 'node_modules', 'eslint', 'package.json' )
+        const hoisted = path.join( gitRoot, 'node_modules', 'eslint', 'package.json' )
+        const eslintPkg = JSON.parse( fs.readFileSync(
+          fs.existsSync( local ) ? local : hoisted, 'utf8'
+        ) )
+        const major = parseInt( eslintPkg.version.split( '.' )[0], 10 )
+        return { value : major <= 8 ? chalk.yellow( `${major}` ) : chalk.green( `${major}` ) }
+      } catch {
+        return { value : chalk.dim( '?' ) }
+      }
+    },
+  },
+  {
+    label : 'bbl',
+    fn    : ( { dir, pkg } ) => {
+      const configFiles = [ '.babelrc', '.babelrc.js', '.babelrc.json', 'babel.config.js', 'babel.config.json', 'babel.config.cjs' ]
+      const hasConfig   = configFiles.some( f => fs.existsSync( path.join( dir, f ) ) )
+      const allDeps     = { ...( pkg?.dependencies ?? {} ), ...( pkg?.devDependencies ?? {} ) }
+      const hasDep      = Object.keys( allDeps ).some( k => k.includes( 'babel' ) )
+      return { value : ( hasConfig || hasDep ) ? SYM_BAD : chalk.dim( '–' ) }
+    },
+  },
+]
+
+// ---------- Helpers ----------
+
+const ANSI_RE = /\x1B\[[0-9;]*m/g // eslint-disable-line no-control-regex
+
+function visLen( str ) {
+  return str.replace( ANSI_RE, '' ).length
+}
+
+function pad( str, width ) {
+  return str + ' '.repeat( Math.max( 0, width - visLen( str ) ) )
+}
+
+function center( str, width ) {
+  const gap = Math.max( 0, width - visLen( str ) )
+  const left = Math.floor( gap / 2 )
+  return ' '.repeat( left ) + str + ' '.repeat( gap - left )
+}
+
+const NONSEMVER = '!SEMVER'
+
+// Strict x.y.z only — pre-release and build metadata are flagged !SEMVER
+function parseVersion( raw ) {
+  if ( !raw ) return null
+  const v = raw.startsWith( 'v' ) ? raw : `v${raw}`
+  return /^v\d+\.\d+\.\d+$/.test( v ) ? v : NONSEMVER
+}
+
+function fmtPkgVer( ver ) {
+  if ( !ver ) return chalk.dim( '?' )
+  if ( ver === NONSEMVER ) return chalk.yellow( NONSEMVER )
+  return chalk.green( ver )
+}
+
+function fmtGitVer( gitVer, pkgVer ) {
+  if ( !gitVer ) return chalk.bgRed.white( 'UNTAGGD' )
+  if ( gitVer === NONSEMVER ) return chalk.yellow( NONSEMVER )
+  if ( gitVer === pkgVer ) return chalk.green( gitVer )
+  return chalk.yellow( gitVer )
+}
+
+function fmtScope( pkg ) {
+  const name = pkg?.name ?? ''
+  const match = name.match( /^(@[^/]+)/ )
+  if ( match ) return chalk.green( match[1].slice( 0, 4 ) )  // '@' + 3 chars: @leverege → @lev
+  if ( pkg?.private === true ) return chalk.yellow( 'PRVT' )
+  return chalk.bgRed.white( 'PUBL' )
+}
+
+// Extracts { repoName, group } from a directory path.
+// For workspace packages (gitRoot !== dir), group is the monorepo's org/name path
+// and repoName is the package's own directory name.
+// For root repos, group is the @xxx path component and repoName is relative to it.
+function repoLabel( dir, gitRoot ) {
+  const parts = dir.split( path.sep )
+  const atIdx = parts.findIndex( p => /^@\w+$/.test( p ) )
+
+  if ( gitRoot && gitRoot !== dir ) {
+    // Workspace package — group under the monorepo's label
+    const rootParts = gitRoot.split( path.sep )
+    const rootAtIdx = rootParts.findIndex( p => /^@\w+$/.test( p ) )
+    const group = rootAtIdx === -1 ?
+      path.basename( gitRoot ) :
+      rootParts.slice( rootAtIdx ).join( '/' )
+    return { repoName : path.basename( dir ), group }
+  }
+
+  if ( atIdx === -1 ) return { repoName : path.basename( dir ), group : null }
+  const group = parts[atIdx]
+  const repoName = parts.slice( atIdx + 1 ).join( '/' )
+  return { repoName, group }
+}
+
+// ---------- Per-repo ----------
+
+async function checkRepo( dir, { pull } ) {
+  if ( !fs.existsSync( path.join( dir, 'package.json' ) ) ) return null
+
+  let gitRoot
+  try {
+    gitRoot = ( await simpleGit( dir ).revparse( [ '--show-toplevel' ] ) ).trim()
+  } catch {
+    return null
+  }
+
+  const isWorkspace = gitRoot !== dir
+  const git = simpleGit( gitRoot )
+  const pkg = await parseJsonFile( path.join( dir, 'package.json' ) )
+
+  // Monorepo roots are represented by their workspace packages — skip the root itself
+  if ( !isWorkspace && pkg?.workspaces ) return null
+
+  const pkgVer = parseVersion( pkg?.version )
+
+  let syncOk = true
+  if ( isWorkspace ) {
+    try {
+      const relDir = path.relative( gitRoot, dir )
+      const status = await git.status( [ '--', relDir ] )
+      syncOk = status.files.length === 0
+    } catch {
+      syncOk = false
+    }
+  } else if ( pull ) {
+    try {
+      await git.pull()
+      await git.fetch( [ '--tags' ] )
+    } catch {
+      syncOk = false
+    }
+  }
+
+  let gitVer = null
+  if ( isWorkspace ) {
+    // Look for workspace-style tags: pkg-name/vX.Y.Z
+    const pkgBaseName = ( pkg?.name ?? path.basename( dir ) ).replace( /^@[^/]+\//, '' )
+    try {
+      const tagOutput = ( await git.raw( [ 'tag', '--list', `${pkgBaseName}/v*` ] ) ).trim()
+      if ( tagOutput ) {
+        const semverTags = tagOutput.split( '\n' )
+          .map( ( t ) => { const m = t.trim().match( /(?:^|\/)v(\d+\.\d+\.\d+)$/ ); return m ? m[1] : null } )
+          .filter( Boolean )
+        if ( semverTags.length ) {
+          semverTags.sort( ( a, b ) => {
+            const av = a.split( '.' ).map( Number )
+            const bv = b.split( '.' ).map( Number )
+            return ( bv[0] - av[0] ) || ( bv[1] - av[1] ) || ( bv[2] - av[2] )
+          } )
+          gitVer = `v${semverTags[0]}`
+        } else {
+          gitVer = NONSEMVER
+        }
+      }
+    } catch { /* no tags → null = UNTAGGD */ }
+  } else {
+    // git describe gives the nearest tag reachable from HEAD, matching original pkgck behavior
+    try {
+      const tag = ( await git.raw( [ 'describe', '--abbrev=0', '--tags' ] ) ).trim()
+      // Handles 'v1.2.3' and workspace-style 'pkg-name/v1.2.3'
+      const match = tag.match( /(?:^|\/)v(\d+\.\d+\.\d+)$/ )
+      gitVer = match ? `v${match[1]}` : NONSEMVER
+    } catch { /* no tags → null = UNTAGGD */ }
+  }
+
+  let needsPush = ''
+  if ( pkgVer && pkgVer !== NONSEMVER && gitVer === pkgVer ) {
+    try {
+      const pkgBaseName = ( pkg?.name ?? path.basename( dir ) ).replace( /^@[^/]+\//, '' )
+      const tagToCheck = isWorkspace ? `${pkgBaseName}/${pkgVer}` : pkgVer
+      const remote = await git.listRemote( [ '--tags', 'origin' ] )
+      if ( !remote.includes( tagToCheck ) ) needsPush = chalk.yellow( '!tags' )
+    } catch { /* ignore */ }
+  }
+
+  const isYarn   = fs.existsSync( path.join( gitRoot, 'yarn.lock' ) ) || fs.existsSync( path.join( gitRoot, '.yarn' ) )
+  const pkgMgr   = isYarn ? chalk.cyan( 'yrn' ) : chalk.red( 'npm' )
+
+  const { repoName, group } = repoLabel( dir, gitRoot )
+  return {
+    repoName,
+    group,
+    pkgMgr,
+    pkgVer      : fmtPkgVer( pkgVer ),
+    gitVer      : fmtGitVer( gitVer, pkgVer ),
+    dirty       : !syncOk,
+    scope       : fmtScope( pkg ),
+    isWorkspace,
+    checks      : CHECKS.map( ( { label, fn } ) => ( { label, ...fn( { dir, pkg, isWorkspace, gitRoot } ) } ) ),
+    needsPush,
+  }
+}
+
+// ---------- Table ----------
+
+function renderTable( rows ) {
+  const pkgW   = Math.max( 3, ...rows.map( r => visLen( r.pkgVer ) ) )
+  const gitW   = Math.max( 7, ...rows.map( r => visLen( r.gitVer ) ) )
+  const scopeW = Math.max( 4, ...rows.map( r => visLen( r.scope ) ) )
+
+  // Fixed width of all columns except name. Elements: mgr pkg git scope checks (no needsPush).
+  // join('  ') puts 2-space sep between N+5 elements = N+4 separators.
+  const checkLabelW = CHECKS.reduce( ( sum, c ) => sum + c.label.length, 0 )
+  const fixedW = 3 + pkgW + gitW + scopeW + checkLabelW + ( CHECKS.length + 4 ) * 2
+
+  // Name area: 2-space indent + repo name. Group label prints on its own line above each section.
+  const hasGroups = rows.some( r => r.group )
+  const indent    = hasGroups ? 2 : 0
+  const maxRepoW  = Math.min( 22, Math.max( 4, ...rows.map( r => r.repoName.length ) ) )
+  const nameW     = Math.min( indent + maxRepoW, 80 - fixedW )
+  const repoW     = nameW - indent
+
+  const nameHdr = pad( `${' '.repeat( indent )}name`, nameW )
+  const hdr = [
+    nameHdr,
+    center( 'mgr', 3 ),
+    center( 'pkg', pkgW ),
+    center( 'git', gitW ),
+    center( 'scop', scopeW ),
+    ...CHECKS.map( c => center( c.label, c.label.length ) ),
+  ].join( '  ' )
+
+  const separator = chalk.dim( '─'.repeat( visLen( hdr ) ) )
+
+  log( '' )
+  log( chalk.dim( hdr ) )
+  log( separator )
+
+  let currentGroup
+  for ( const row of rows ) {
+    if ( row.group !== currentGroup ) {
+      currentGroup = row.group
+      if ( hasGroups ) log( chalk.cyan( row.group ?? '' ) )
+    }
+    const nameStr  = ' '.repeat( indent ) + row.repoName.slice( 0, repoW )
+    const nameCell = row.dirty ? chalk.hex( '#FFA500' )( nameStr ) : nameStr
+    const line = [
+      pad( nameCell, nameW ),
+      pad( row.pkgMgr, 3 ),
+      pad( row.pkgVer, pkgW ),
+      pad( row.gitVer, gitW ),
+      pad( row.scope, scopeW ),
+      ...row.checks.map( c => center( c.value, c.label.length ) ),
+    ].join( '  ' ) + ( row.needsPush ? `  ${row.needsPush}` : '' )
+    log( line )
+  }
+
+  log( '' )
+}
+
+// ---------- CLI ----------
+
+program
+  .name( 'package-checker' )
+  .description( chalk.green( 'A panopticon for your git repos!' ) )
+  .argument( '<dirs...>', 'directories to check' )
+  .option( '--no-pull', 'skip git pull and tag fetch' )
+  .option( '--no-clear', 'do not clear the screen before output' )
+  .option( '--concurrency <n>', 'max parallel repos', '5' )
+  .option( '--limit <n>', 'max rows to display', '80' )
+  .option( '--debug', 'enable debug logging' )
+  .addHelpText( 'after', `
+${chalk.yellow( 'Columns:' )}
+  ${chalk.green( 'pkg' )}    version from package.json
+  ${chalk.green( 'git' )}    latest semver git tag (green=match, yellow=mismatch, red=untagged)
+  ${chalk.green( 'name' )}  orange if dirty: pull/fetch failed (regular repos) or local modifications present (workspace packages)
+  ${chalk.green( 'scope' )}  package scope: @org, PRVT, or PUBL
+  ${chalk.green( 'cir' )}    CircleCI config: ✘=missing, L=legacy, 1=orb v1, 2=orb v2
+  ${chalk.green( 'ESM' )}    "type": "module" in package.json
+  ${chalk.green( 'har' )}    .har directory present at repo root
+  ${chalk.green( 'lnt' )}    ESLint version from node_modules (✘=no lint script, ?=not installed, yellow=v8, green=v9+)
+
+${chalk.yellow( 'Monorepos:' )}
+  Workspace packages are discovered automatically — passing a monorepo root
+  expands its workspaces field so you never need to add packages/* globs.
+  Git tags are looked up as pkg-name/vX.Y.Z. Pull/fetch runs at the root.
+
+${chalk.yellow( 'Examples:' )}
+  ${chalk.green( 'package-checker ~/repos/my-service' )}
+  ${chalk.green( 'package-checker --no-pull ~/repos/*' )}
+  ${chalk.green( 'package-checker --concurrency 10 @plt/* @kud/* @srv/* @tpi/*' )}
+` )
+  .parse()
+
+const dirs = program.args
+const options = program.opts()
+if ( options.debug ) { enableDebug() }
+
+if ( options.clear ) { clear() }
+
+// Auto-expand workspace packages from any monorepo roots in the input.
+// Supports both array and yarn-style { packages: [...] } workspaces fields.
+async function expandWorkspaces( dir ) {
+  try {
+    const pkg = await parseJsonFile( path.join( dir, 'package.json' ) )
+    const patterns = Array.isArray( pkg?.workspaces ) ?
+      pkg.workspaces :
+      ( pkg?.workspaces?.packages ?? [] )
+    if ( !patterns.length ) return []
+    const matches = await Promise.all(
+      patterns.map( p => glob( p, { cwd : dir, absolute : true } ) )
+    )
+    return matches.flat().filter( d => !/test|demo/i.test( path.basename( d ) ) )
+  } catch {
+    return []
+  }
+}
+
+const resolvedDirs  = dirs.map( dir => path.resolve( dir ) )
+const wsExpansions  = ( await Promise.all( resolvedDirs.map( expandWorkspaces ) ) ).flat()
+const allDirs       = [ ...new Set( [ ...resolvedDirs, ...wsExpansions ] ) ]
+
+const total   = allDirs.length
+let completed = 0
+const spinner = ora( `Checking repos (0/${total})...` ).start()
+
+process.on( 'SIGINT', () => { spinner.stop(); process.exit( 1 ) } )
+
+const limit = pLimit( parseInt( options.concurrency, 10 ) )
+const results = await Promise.all(
+  allDirs.map( dir => limit( async () => {
+    const result = await checkRepo( dir, { pull : options.pull } )
+    spinner.text = `Checking repos (${++completed}/${total})...`
+    return result
+  } ) )
+)
+
+spinner.stop()
+
+const rows = results
+  .filter( Boolean )
+  .sort( ( a, b ) => {
+    const ga = a.group ?? ''
+    const gb = b.group ?? ''
+    if ( ga !== gb ) return ga.localeCompare( gb )
+    return a.repoName.localeCompare( b.repoName )
+  } )
+
+if ( rows.length === 0 ) {
+  log( chalk.yellow( '\nNo valid repositories found.\n' ) )
+  process.exit( 0 )
+}
+
+const maxRows   = parseInt( options.limit, 10 )
+const checked   = rows.length
+const displayed = rows.slice( 0, maxRows )
+
+renderTable( displayed )
+
+const summary = checked > displayed.length ?
+  `total repositories checked: ${checked} (${displayed.length} displayed)\n` :
+  `total repositories checked: ${checked}\n`
+log( summary )

package/src/service-man/config/secrets/npmrc.json

@@ -2,6 +2,7 @@
   "type": "managed",
   "name": "NPMRC",
   "source": "leverege-registry:DEPRECATED_NPMRC",
+  "k8s": { "secret": "npmrc", "key": "key" },
   "labels": {
     "env-type": "string"
   },

package/src/service-man/config/secrets/tsdb-dense-password.json

@@ -0,0 +1,13 @@
+{
+  "type": "random",
+  "width": 48,
+  "immutable": true,
+  "labels": {
+    "env-type": "string"
+  },
+  "annotations": {
+    "description": "dense timescale db postgres password",
+    "owner": "platform-team",
+    "source": "service-man"
+  }
+}