@pleri/olam-cli 0.1.106 → 0.1.107

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,MAAM,CAAC;KACZ,WAAW,CAAC,+DAA+D,CAAC;KAC5E,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;AAE7B,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,sEAAsE;AACtE,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,mBAAmB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;AAC/D,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAE1B,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,wBAAwB;AAExB,OAAO,CAAC,KAAK,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,MAAM,CAAC;KACZ,WAAW,CAAC,+DAA+D,CAAC;KAC5E,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;AAE7B,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,sEAAsE;AACtE,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,mBAAmB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;AAC/D,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAE1B,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,wBAAwB;AAExB,OAAO,CAAC,KAAK,EAAE,CAAC"}

package/dist/lib/health-probes.d.ts

@@ -0,0 +1,116 @@
+/**
+ * health-probes.ts — Shared host-health probe module.
+ *
+ * Phase A1 of olam-operator-onboarding-parity (plan
+ * ~/.claude/plans/olam-operator-onboarding-parity.md).
+ *
+ * The Seam (Decision 3): `olam doctor` + `olam diagnose` both consume
+ * these probes. No probe writes to disk; no probe spawns long-running
+ * processes; each is independently safe to run in parallel.
+ *
+ * Probe contract:
+ *   - Each returns ProbeResult: { ok: true, message } | { ok: false, message, remedy }
+ *   - Each is async; can run in parallel via Promise.all
+ *   - Each accepts injectable deps (docker exec / fetch / OLAM_HOME) for testability
+ *
+ * Cap thresholds (probeKgStorage) mirror packages/cli/src/commands/kg-status.ts:
+ *   - 1.5 GB soft-cap → ok:true with "soft-warn" message
+ *   - 5.0 GB hard-cap → ok:false with prune remedy
+ *
+ * Daemon-reachability rule (Risk T5): callers that probe per-image
+ * presence MUST call probeDockerDaemon first and fast-fail on its
+ * failure. Image probes throw confusing "404 no such image" errors
+ * when the daemon is paused mid-check.
+ */
+export type ProbeResult = {
+    readonly ok: true;
+    readonly message: string;
+} | {
+    readonly ok: false;
+    readonly message: string;
+    readonly remedy: string;
+};
+export interface DockerExecResult {
+    readonly status: number | null;
+    readonly stdout: string;
+    readonly stderr: string;
+}
+export type DockerExec = (cmd: string, args: ReadonlyArray<string>) => DockerExecResult;
+export type FetchLike = (input: string, init?: {
+    signal?: AbortSignal;
+}) => Promise<Response>;
+/**
+ * Verify docker daemon is reachable via `docker info --format`.
+ *
+ * MUST be called first by callers that probe per-image presence; image
+ * probes throw confusing "404 no such image" errors when the daemon is
+ * paused mid-check (Risk T5 mitigation).
+ */
+export declare function probeDockerDaemon(dockerExec?: DockerExec): Promise<ProbeResult>;
+/**
+ * Verify each ref is present locally via `docker image inspect`.
+ *
+ * Fast-fail: returns the first missing image; subsequent refs NOT
+ * probed. Caller decides ordering of refs.
+ */
+export declare function probeImagePresence(refs: ReadonlyArray<string>, dockerExec?: DockerExec): Promise<ProbeResult>;
+/**
+ * GET http://127.0.0.1:19000/health with 5s timeout; expect HTTP 200
+ * AND a JSON envelope matching the host-cp shape (defends against
+ * false-positives from a port-collision with some other 19000-bound
+ * process — audit finding HIGH body-shape).
+ *
+ * Real envelope (per `packages/host-cp/src/server.mjs:665-688`):
+ *   { status: 'ok', phase, uptime_seconds: number, cache: {...},
+ *     mode: { deployment, world_host }, registry: {...}, auth: {...} }
+ *
+ * Probe asserts three orthogonal fields (`phase` + `cache` object +
+ * `mode.deployment`) that no random web server would carry together.
+ * Substring-on-the-token-path was an earlier fragile heuristic; this
+ * version pins to actual server contract.
+ *
+ * Aborts via AbortController on timeout; failure mode is captured in
+ * the error path with reason ("timeout" / "ECONNREFUSED" / etc.).
+ *
+ * Always consumes the response body before returning (avoids undici
+ * socket leak when the probe is invoked in a loop).
+ */
+export declare function probeHostCpHealth(fetchImpl?: FetchLike): Promise<ProbeResult>;
+/**
+ * Read the canonical credentials vault at `<OLAM_HOME>/auth-data/accounts.json`
+ * (matching `packages/auth-service/src/store.ts:LOCAL_DATA_DIR` and
+ * `scripts/audit-credentials.mjs:resolveAccountsPath`); count active
+ * `claude` credentials.
+ *
+ * Vault shape (per packages/auth-service/src/types.ts): a flat JSON array
+ * of account objects. Each account has:
+ *   - provider: 'claude' | 'codex' | ...
+ *   - state?: 'active' | 'cooldown' | 'disabled'
+ *   - rateLimited?: boolean  (legacy fallback for state)
+ *   - expiresAt?: number (epoch ms)
+ *   - rateLimitResetsAt?: string (ISO 8601)
+ *
+ * Predicate mirrors `effectiveState()` from scripts/audit-credentials.mjs
+ * inline (the canonical helper is a .mjs script that we can't import from
+ * this TS module). If the canonical predicate evolves (new fields, new
+ * state literals), this mirror MUST be updated.
+ *
+ * Override: `OLAM_AUTH_DATA_PATH` env var lets CI/test fixtures point
+ * at an alternate accounts.json. Matches the canonical helper.
+ */
+export declare function probeAuthVault(olamHomeOverride?: string): Promise<ProbeResult>;
+/**
+ * Cumulative KG storage under OLAM_HOME (pristines + overlays).
+ * Soft warn at 1.5 GB; hard fail at 5 GB.
+ *
+ * Layout (mirrors packages/cli/src/commands/kg-status.ts):
+ *   - Pristines: ~/.olam/kg/<workspace>/graphify-out/
+ *   - Overlays:  ~/.olam/worlds/<world>/<clone>/graphify-out/
+ *
+ * Cap constants duplicated rather than imported from kg-status.ts to
+ * keep this module self-contained (the Seam decision — see plan
+ * decision 3). A future PR may extract them to a single source if
+ * a third consumer lands.
+ */
+export declare function probeKgStorage(olamHomeOverride?: string): Promise<ProbeResult>;
+//# sourceMappingURL=health-probes.d.ts.map

package/dist/lib/health-probes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health-probes.d.ts","sourceRoot":"","sources":["../../src/lib/health-probes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAQH,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAM9E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,gBAAgB,CAAC;AAExF,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AA+B9F;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,GAAE,UAA8B,GACzC,OAAO,CAAC,WAAW,CAAC,CAUtB;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAC3B,UAAU,GAAE,UAA8B,GACzC,OAAO,CAAC,WAAW,CAAC,CAYtB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,iBAAiB,CACrC,SAAS,GAAE,SAAwB,GAClC,OAAO,CAAC,WAAW,CAAC,CAgCtB;AAwBD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,cAAc,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAqCpF;AAoCD;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAuBpF"}

package/dist/lib/health-probes.js

@@ -0,0 +1,390 @@
+/**
+ * health-probes.ts — Shared host-health probe module.
+ *
+ * Phase A1 of olam-operator-onboarding-parity (plan
+ * ~/.claude/plans/olam-operator-onboarding-parity.md).
+ *
+ * The Seam (Decision 3): `olam doctor` + `olam diagnose` both consume
+ * these probes. No probe writes to disk; no probe spawns long-running
+ * processes; each is independently safe to run in parallel.
+ *
+ * Probe contract:
+ *   - Each returns ProbeResult: { ok: true, message } | { ok: false, message, remedy }
+ *   - Each is async; can run in parallel via Promise.all
+ *   - Each accepts injectable deps (docker exec / fetch / OLAM_HOME) for testability
+ *
+ * Cap thresholds (probeKgStorage) mirror packages/cli/src/commands/kg-status.ts:
+ *   - 1.5 GB soft-cap → ok:true with "soft-warn" message
+ *   - 5.0 GB hard-cap → ok:false with prune remedy
+ *
+ * Daemon-reachability rule (Risk T5): callers that probe per-image
+ * presence MUST call probeDockerDaemon first and fast-fail on its
+ * failure. Image probes throw confusing "404 no such image" errors
+ * when the daemon is paused mid-check.
+ */
+import { spawnSync } from 'node:child_process';
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import path from 'node:path';
+import { SOFT_CAP_BYTES, HARD_CAP_BYTES } from './kg-caps.js';
+const HEALTH_TIMEOUT_MS = 5_000;
+/**
+ * Default Docker exec implementation. Consumers MUST inject their own
+ * `exec` parameter in tests — this default reaches real
+ * `node:child_process.spawnSync` and will shell out to a real `docker`
+ * binary on the test runner (green on dev laptops with Docker running;
+ * red on CI runners without daemon). Audit finding HIGH-2.
+ */
+const defaultDockerExec = (cmd, args) => {
+    const r = spawnSync(cmd, [...args], {
+        encoding: 'utf-8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    return {
+        status: r.status,
+        stdout: r.stdout ?? '',
+        stderr: r.stderr ?? '',
+    };
+};
+/**
+ * Default fetch implementation. Consumers MUST inject their own
+ * `fetchImpl` parameter in tests — this default reaches the global
+ * `fetch` and will make real network calls on the test runner.
+ * Audit finding HIGH-2.
+ */
+const defaultFetch = (input, init) => fetch(input, init);
+// ── Probes ─────────────────────────────────────────────────────────────
+/**
+ * Verify docker daemon is reachable via `docker info --format`.
+ *
+ * MUST be called first by callers that probe per-image presence; image
+ * probes throw confusing "404 no such image" errors when the daemon is
+ * paused mid-check (Risk T5 mitigation).
+ */
+export async function probeDockerDaemon(dockerExec = defaultDockerExec) {
+    const r = dockerExec('docker', ['info', '--format', '{{.ServerVersion}}']);
+    if (r.status === 0 && r.stdout.trim().length > 0) {
+        return { ok: true, message: `docker ${r.stdout.trim()} reachable` };
+    }
+    return {
+        ok: false,
+        message: 'docker daemon not reachable',
+        remedy: 'Start Docker Desktop (or your docker daemon) and re-run.',
+    };
+}
+/**
+ * Verify each ref is present locally via `docker image inspect`.
+ *
+ * Fast-fail: returns the first missing image; subsequent refs NOT
+ * probed. Caller decides ordering of refs.
+ */
+export async function probeImagePresence(refs, dockerExec = defaultDockerExec) {
+    for (const ref of refs) {
+        const r = dockerExec('docker', ['image', 'inspect', '--format', '{{.Id}}', ref]);
+        if (r.status !== 0) {
+            return {
+                ok: false,
+                message: `image ${ref} not present locally`,
+                remedy: 'Run `olam bootstrap` to pull the published image, or build locally.',
+            };
+        }
+    }
+    return { ok: true, message: `${refs.length} image(s) present` };
+}
+/**
+ * GET http://127.0.0.1:19000/health with 5s timeout; expect HTTP 200
+ * AND a JSON envelope matching the host-cp shape (defends against
+ * false-positives from a port-collision with some other 19000-bound
+ * process — audit finding HIGH body-shape).
+ *
+ * Real envelope (per `packages/host-cp/src/server.mjs:665-688`):
+ *   { status: 'ok', phase, uptime_seconds: number, cache: {...},
+ *     mode: { deployment, world_host }, registry: {...}, auth: {...} }
+ *
+ * Probe asserts three orthogonal fields (`phase` + `cache` object +
+ * `mode.deployment`) that no random web server would carry together.
+ * Substring-on-the-token-path was an earlier fragile heuristic; this
+ * version pins to actual server contract.
+ *
+ * Aborts via AbortController on timeout; failure mode is captured in
+ * the error path with reason ("timeout" / "ECONNREFUSED" / etc.).
+ *
+ * Always consumes the response body before returning (avoids undici
+ * socket leak when the probe is invoked in a loop).
+ */
+export async function probeHostCpHealth(fetchImpl = defaultFetch) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), HEALTH_TIMEOUT_MS);
+    try {
+        const res = await fetchImpl('http://127.0.0.1:19000/health', { signal: controller.signal });
+        const body = await res.text().catch(() => '');
+        if (res.status !== 200) {
+            return {
+                ok: false,
+                message: `host-cp /health returned ${res.status}`,
+                remedy: 'Restart host-cp via `olam host-cp start`; verify port 19000 is bound to 127.0.0.1.',
+            };
+        }
+        if (isHostCpHealthEnvelope(body)) {
+            return { ok: true, message: 'host-cp /health returned 200' };
+        }
+        return {
+            ok: false,
+            message: 'host-cp /health returned 200 but body did not match the host-cp envelope (possible port collision on :19000)',
+            remedy: 'Check `lsof -iTCP:19000`; another process may have bound the port. Restart host-cp via `olam host-cp start`.',
+        };
+    }
+    catch (err) {
+        const e = err;
+        const reason = e.name === 'AbortError' ? `timeout (${HEALTH_TIMEOUT_MS}ms)` : e.message;
+        return {
+            ok: false,
+            message: `host-cp /health unreachable: ${reason}`,
+            remedy: 'Restart host-cp via `olam host-cp start`; verify port 19000 is bound to 127.0.0.1.',
+        };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+/**
+ * Match three orthogonal fields from host-cp's real /health envelope.
+ * Returns true only when ALL match (a random 19000-bound web server is
+ * very unlikely to ship all three in one response by accident).
+ */
+function isHostCpHealthEnvelope(body) {
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return false;
+    }
+    if (!parsed || typeof parsed !== 'object')
+        return false;
+    const obj = parsed;
+    if (typeof obj.phase !== 'string')
+        return false;
+    if (!obj.cache || typeof obj.cache !== 'object')
+        return false;
+    const mode = obj.mode;
+    if (!mode || typeof mode !== 'object')
+        return false;
+    if (typeof mode.deployment !== 'string')
+        return false;
+    return true;
+}
+/**
+ * Read the canonical credentials vault at `<OLAM_HOME>/auth-data/accounts.json`
+ * (matching `packages/auth-service/src/store.ts:LOCAL_DATA_DIR` and
+ * `scripts/audit-credentials.mjs:resolveAccountsPath`); count active
+ * `claude` credentials.
+ *
+ * Vault shape (per packages/auth-service/src/types.ts): a flat JSON array
+ * of account objects. Each account has:
+ *   - provider: 'claude' | 'codex' | ...
+ *   - state?: 'active' | 'cooldown' | 'disabled'
+ *   - rateLimited?: boolean  (legacy fallback for state)
+ *   - expiresAt?: number (epoch ms)
+ *   - rateLimitResetsAt?: string (ISO 8601)
+ *
+ * Predicate mirrors `effectiveState()` from scripts/audit-credentials.mjs
+ * inline (the canonical helper is a .mjs script that we can't import from
+ * this TS module). If the canonical predicate evolves (new fields, new
+ * state literals), this mirror MUST be updated.
+ *
+ * Override: `OLAM_AUTH_DATA_PATH` env var lets CI/test fixtures point
+ * at an alternate accounts.json. Matches the canonical helper.
+ */
+export async function probeAuthVault(olamHomeOverride) {
+    const vaultPath = resolveAccountsPath(olamHomeOverride);
+    if (!existsSync(vaultPath)) {
+        return {
+            ok: false,
+            message: `auth vault missing at ${vaultPath}`,
+            remedy: 'Run `olam auth up && olam auth login` to provision the vault.',
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(vaultPath, 'utf-8'));
+    }
+    catch (err) {
+        return {
+            ok: false,
+            message: `auth vault malformed: ${err.message}`,
+            remedy: 'Inspect the accounts.json file; restore from backup or re-run `olam auth up`.',
+        };
+    }
+    if (!Array.isArray(parsed)) {
+        return {
+            ok: false,
+            message: 'auth vault malformed: expected JSON array at top level',
+            remedy: 'Restore the vault from backup or re-run `olam auth up && olam auth login`.',
+        };
+    }
+    const accounts = parsed.filter((a) => a !== null && typeof a === 'object');
+    const now = Date.now();
+    const activeClaude = accounts.filter((a) => a.provider === 'claude' && effectiveState(a, now) === 'active');
+    if (activeClaude.length === 0) {
+        return {
+            ok: false,
+            message: `no active claude credentials (vault has ${accounts.length} account(s))`,
+            remedy: 'Run `olam auth login` to add a credential, or wait for the next reset.',
+        };
+    }
+    return { ok: true, message: `${activeClaude.length} active claude credential(s)` };
+}
+function resolveAccountsPath(olamHomeOverride) {
+    // OLAM_AUTH_DATA_PATH is the explicit override (matches the canonical
+    // helper at scripts/audit-credentials.mjs). Honoured first for CI fixtures.
+    const explicit = process.env.OLAM_AUTH_DATA_PATH;
+    if (explicit)
+        return explicit;
+    const olamHome = olamHomeOverride ?? process.env.OLAM_HOME ?? path.join(homedir(), '.olam');
+    return path.join(olamHome, 'auth-data', 'accounts.json');
+}
+/**
+ * Inline mirror of `effectiveState()` from scripts/audit-credentials.mjs.
+ *
+ * IMPORTANT: keep this in sync with the canonical helper. If the helper
+ * changes, this copy MUST change too (no compile-time link between them).
+ */
+function effectiveState(account, now) {
+    const persisted = account.state ?? (account.rateLimited ? 'cooldown' : 'active');
+    if (persisted === 'disabled')
+        return 'disabled';
+    if (typeof account.expiresAt === 'number' && account.expiresAt <= now)
+        return 'expired';
+    if (persisted === 'cooldown') {
+        const reset = account.rateLimitResetsAt ? new Date(account.rateLimitResetsAt).getTime() : 0;
+        if (reset > 0 && reset <= now)
+            return 'active';
+    }
+    return persisted;
+}
+/**
+ * Cumulative KG storage under OLAM_HOME (pristines + overlays).
+ * Soft warn at 1.5 GB; hard fail at 5 GB.
+ *
+ * Layout (mirrors packages/cli/src/commands/kg-status.ts):
+ *   - Pristines: ~/.olam/kg/<workspace>/graphify-out/
+ *   - Overlays:  ~/.olam/worlds/<world>/<clone>/graphify-out/
+ *
+ * Cap constants duplicated rather than imported from kg-status.ts to
+ * keep this module self-contained (the Seam decision — see plan
+ * decision 3). A future PR may extract them to a single source if
+ * a third consumer lands.
+ */
+export async function probeKgStorage(olamHomeOverride) {
+    const olamHome = olamHomeOverride ?? process.env.OLAM_HOME ?? path.join(homedir(), '.olam');
+    const kgRoot = path.join(olamHome, 'kg');
+    const worldsRoot = path.join(olamHome, 'worlds');
+    const kgBytes = enumerateGraphifyOut(kgRoot, 'pristine');
+    const overlayBytes = enumerateGraphifyOut(worldsRoot, 'overlay');
+    const totalBytes = kgBytes + overlayBytes;
+    if (totalBytes >= HARD_CAP_BYTES) {
+        return {
+            ok: false,
+            message: `KG storage ${formatBytes(totalBytes)} exceeds 5 GB hard cap`,
+            remedy: 'Prune stale pristines: `rm -rf ~/.olam/kg/<workspace>` after operator review.',
+        };
+    }
+    if (totalBytes >= SOFT_CAP_BYTES) {
+        return {
+            ok: true,
+            message: `KG storage ${formatBytes(totalBytes)} (soft-warn — exceeds 1.5 GB; consider pruning)`,
+        };
+    }
+    return { ok: true, message: `KG storage ${formatBytes(totalBytes)} (under cap)` };
+}
+function enumerateGraphifyOut(root, layout) {
+    if (!existsSync(root))
+        return 0;
+    let total = 0;
+    let entries;
+    try {
+        entries = readdirSync(root, { withFileTypes: true });
+    }
+    catch {
+        return 0;
+    }
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        if (layout === 'pristine') {
+            total += dirSizeBytes(path.join(root, entry.name, 'graphify-out'));
+        }
+        else {
+            const worldDir = path.join(root, entry.name);
+            let clones;
+            try {
+                clones = readdirSync(worldDir, { withFileTypes: true });
+            }
+            catch {
+                continue;
+            }
+            for (const clone of clones) {
+                if (!clone.isDirectory())
+                    continue;
+                total += dirSizeBytes(path.join(worldDir, clone.name, 'graphify-out'));
+            }
+        }
+    }
+    return total;
+}
+/**
+ * Recursive byte sum over a directory.
+ *
+ * Symlink policy: short-circuited via `entry.isSymbolicLink()` in the
+ * common case. KNOWN FALSE-POSITIVE CLASS (audit finding HIGH-3): on
+ * filesystems that don't populate `d_type` (some network mounts, FUSE,
+ * exotic overlay FS), `Dirent` flags report `UV_DIRENT_UNKNOWN` and
+ * both `isSymbolicLink()` and `isDirectory()` return `false`. Such an
+ * entry is then `statSync`'d as a file; if it's actually a symlink to
+ * a giant file, the target's bytes are counted. Probability is low on
+ * APFS/ext4; impact is "doctor false-fail on a healthy host with
+ * exotic FS." Mirrors the same shape in kg-status.ts:240.
+ */
+function dirSizeBytes(dir) {
+    if (!existsSync(dir))
+        return 0;
+    let total = 0;
+    const stack = [dir];
+    while (stack.length > 0) {
+        const cur = stack.pop();
+        let entries;
+        try {
+            entries = readdirSync(cur, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            const full = path.join(cur, entry.name);
+            if (entry.isSymbolicLink())
+                continue;
+            if (entry.isDirectory()) {
+                stack.push(full);
+                continue;
+            }
+            try {
+                total += statSync(full).size;
+            }
+            catch {
+                // race: file disappeared between readdir + stat
+            }
+        }
+    }
+    return total;
+}
+function formatBytes(n) {
+    if (n < 1024)
+        return `${n} B`;
+    if (n < 1024 * 1024)
+        return `${(n / 1024).toFixed(1)} KB`;
+    if (n < 1024 * 1024 * 1024)
+        return `${(n / 1024 / 1024).toFixed(1)} MB`;
+    return `${(n / 1024 / 1024 / 1024).toFixed(2)} GB`;
+}
+//# sourceMappingURL=health-probes.js.map

package/dist/lib/health-probes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health-probes.js","sourceRoot":"","sources":["../../src/lib/health-probes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAe,MAAM,SAAS,CAAC;AACvF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAM9D,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAchC;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAe,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;IAClD,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;QAClC,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IACH,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;KACvB,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,YAAY,GAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAEpE,0EAA0E;AAE1E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,aAAyB,iBAAiB;IAE1C,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;IACtE,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,6BAA6B;QACtC,MAAM,EAAE,0DAA0D;KACnE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAA2B,EAC3B,aAAyB,iBAAiB;IAE1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,SAAS,GAAG,sBAAsB;gBAC3C,MAAM,EAAE,qEAAqE;aAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,mBAAmB,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,YAAuB,YAAY;IAEnC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,4BAA4B,GAAG,CAAC,MAAM,EAAE;gBACjD,MAAM,EAAE,oFAAoF;aAC7F,CAAC;QACJ,CAAC;QACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;QAC/D,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,8GAA8G;YACvH,MAAM,EAAE,8GAA8G;SACvH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAY,CAAC;QACvB,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACxF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,gCAAgC,MAAM,EAAE;YACjD,MAAM,EAAE,oFAAoF;SAC7F,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,OAAQ,IAAgC,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACnF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,gBAAyB;IAC5D,MAAM,SAAS,GAAG,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,yBAAyB,SAAS,EAAE;YAC7C,MAAM,EAAE,+DAA+D;SACxE,CAAC;IACJ,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,yBAA0B,GAAa,CAAC,OAAO,EAAE;YAC1D,MAAM,EAAE,+EAA+E;SACxF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,wDAAwD;YACjE,MAAM,EAAE,4EAA4E;SACrF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC5G,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,2CAA2C,QAAQ,CAAC,MAAM,cAAc;YACjF,MAAM,EAAE,wEAAwE;SACjF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,MAAM,8BAA8B,EAAE,CAAC;AACrF,CAAC;AAED,SAAS,mBAAmB,CAAC,gBAAyB;IACpD,sEAAsE;IACtE,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACjD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,QAAQ,GAAG,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IAC5F,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;AAC3D,CAAC;AAUD;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAqB,EAAE,GAAW;IACxD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACjF,IAAI,SAAS,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IAChD,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG;QAAE,OAAO,SAAS,CAAC;IACxF,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,GAAG;YAAE,OAAO,QAAQ,CAAC;IACjD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,gBAAyB;IAC5D,MAAM,QAAQ,GAAG,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEjD,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,oBAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,OAAO,GAAG,YAAY,CAAC;IAE1C,IAAI,UAAU,IAAI,cAAc,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,cAAc,WAAW,CAAC,UAAU,CAAC,wBAAwB;YACtE,MAAM,EAAE,+EAA+E;SACxF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,IAAI,cAAc,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,cAAc,WAAW,CAAC,UAAU,CAAC,iDAAiD;SAChG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;AACpF,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,MAA8B;IACxE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;YAAE,SAAS;QACnC,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,MAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;oBAAE,SAAS;gBACnC,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAa,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QACzB,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,SAAS;YACrC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IAC9B,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1D,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IACxE,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AACrD,CAAC"}

package/dist/lib/kg-caps.d.ts

@@ -0,0 +1,19 @@
+/**
+ * kg-caps.ts — KG storage cap thresholds (single source of truth).
+ *
+ * Phase A1 follow-up (audit finding HIGH-1: drift): A1's `health-probes.ts`
+ * and the pre-existing `commands/kg-status.ts` were both hard-coding the
+ * 1.5 GB soft / 5 GB hard cap thresholds. With doctor + diagnose + kg-status
+ * as three consumers (A1 added consumer #2; A3 makes it #3 transitively),
+ * the plan's "third-consumer threshold" has arrived. Pin the constants here
+ * so any future cap-policy change touches one file.
+ *
+ * Drift contract: every consumer of these constants MUST import from this
+ * module, NOT redefine inline. A grep for `1_500_000_000` or `5_000_000_000`
+ * across `packages/cli/src/` should match only this file.
+ */
+/** Soft warn threshold — 1.5 GB. Below this: silent. Above: doctor prints a "consider pruning" note but still exits 0. */
+export declare const SOFT_CAP_BYTES = 1500000000;
+/** Hard fail threshold — 5 GB. At or above: doctor exits 1; `olam kg status` exits 1. */
+export declare const HARD_CAP_BYTES = 5000000000;
+//# sourceMappingURL=kg-caps.d.ts.map

package/dist/lib/kg-caps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kg-caps.d.ts","sourceRoot":"","sources":["../../src/lib/kg-caps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,0HAA0H;AAC1H,eAAO,MAAM,cAAc,aAAgB,CAAC;AAE5C,yFAAyF;AACzF,eAAO,MAAM,cAAc,aAAgB,CAAC"}

package/dist/lib/kg-caps.js

@@ -0,0 +1,19 @@
+/**
+ * kg-caps.ts — KG storage cap thresholds (single source of truth).
+ *
+ * Phase A1 follow-up (audit finding HIGH-1: drift): A1's `health-probes.ts`
+ * and the pre-existing `commands/kg-status.ts` were both hard-coding the
+ * 1.5 GB soft / 5 GB hard cap thresholds. With doctor + diagnose + kg-status
+ * as three consumers (A1 added consumer #2; A3 makes it #3 transitively),
+ * the plan's "third-consumer threshold" has arrived. Pin the constants here
+ * so any future cap-policy change touches one file.
+ *
+ * Drift contract: every consumer of these constants MUST import from this
+ * module, NOT redefine inline. A grep for `1_500_000_000` or `5_000_000_000`
+ * across `packages/cli/src/` should match only this file.
+ */
+/** Soft warn threshold — 1.5 GB. Below this: silent. Above: doctor prints a "consider pruning" note but still exits 0. */
+export const SOFT_CAP_BYTES = 1_500_000_000;
+/** Hard fail threshold — 5 GB. At or above: doctor exits 1; `olam kg status` exits 1. */
+export const HARD_CAP_BYTES = 5_000_000_000;
+//# sourceMappingURL=kg-caps.js.map

package/dist/lib/kg-caps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kg-caps.js","sourceRoot":"","sources":["../../src/lib/kg-caps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,0HAA0H;AAC1H,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAC;AAE5C,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pleri/olam-cli",
-  "version": "0.1.106",
+  "version": "0.1.107",
   "type": "module",
   "bin": {
     "olam": "./bin/olam.cjs"