@pleri/olam-cli 0.1.158 → 0.1.159

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AACzF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,MAAM,CAAC;KACZ,WAAW,CAAC,+DAA+D,CAAC;IAC7E,4EAA4E;IAC5E,0EAA0E;KACzE,MAAM,CAAC,OAAO,EAAE,6DAA6D,CAAC;KAC9E,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;AAE7B,gEAAgE;AAChE,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACnD,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;IACxB,qEAAqE;IACrE,+EAA+E;IAC/E,iDAAiD;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACzF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0DAA0D,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK;YACtF,qEAAqE,CACxE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,sEAAsE;AACtE,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,mBAAmB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;AAC/D,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAC5B,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAC5B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACnC,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,8BAA8B,CAAC,OAAO,CAAC,CAAC;AACxC,2BAA2B,CAAC,OAAO,CAAC,CAAC;AACrC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,cAAc,CAAC,OAAO,CAAC,CAAC;AAExB,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,wBAAwB;AAExB,OAAO,CAAC,KAAK,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AACzF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,MAAM,CAAC;KACZ,WAAW,CAAC,+DAA+D,CAAC;IAC7E,4EAA4E;IAC5E,0EAA0E;KACzE,MAAM,CAAC,OAAO,EAAE,6DAA6D,CAAC;KAC9E,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;AAE7B,gEAAgE;AAChE,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACnD,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;IACxB,qEAAqE;IACrE,+EAA+E;IAC/E,iDAAiD;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACzF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0DAA0D,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK;YACtF,qEAAqE,CACxE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,sEAAsE;AACtE,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,mBAAmB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;AAC/D,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAC5B,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAC5B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACnC,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,8BAA8B,CAAC,OAAO,CAAC,CAAC;AACxC,2BAA2B,CAAC,OAAO,CAAC,CAAC;AACrC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,cAAc,CAAC,OAAO,CAAC,CAAC;AAExB,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,wBAAwB;AAExB,OAAO,CAAC,KAAK,EAAE,CAAC"}

package/dist/lib/host-side-proxy.d.ts

@@ -0,0 +1,67 @@
+/**
+ * host-side-proxy.ts — Phase A A3 of olam-k3d-on-mac-substrate-decision.
+ *
+ * Manages the host-side `tecnativa/docker-socket-proxy` container that
+ * fronts the operator's docker daemon on macOS+colima+virtiofs. Wraps
+ * `docker compose -f <yaml> {up,down,ps}` calls with idempotent semantics.
+ *
+ * Background — round-4 wave-2 R4-W2-F: an in-cluster docker-socket-proxy
+ * Pod would itself need a hostPath bind mount of /var/run/docker.sock and
+ * hit virtiofs ENOTSUP. The proxy MUST live on the operator's docker
+ * daemon (sibling to k3d), not inside the k3d cluster. This helper is
+ * what `olam upgrade` Step 0.7 calls to ensure that sibling container
+ * is running before host-cp pods reference the in-cluster ExternalName
+ * Service (packages/host-cp/k8s/manifests/docker-socket-proxy/60-service.yaml).
+ *
+ * The compose yaml managed here:
+ *   packages/host-cp/k8s/host-side/docker-socket-proxy.compose.yaml
+ *
+ * Resolution: shipped in the npm tarball via packages/cli/package.json's
+ * `files` glob; resolved at runtime relative to the CLI's install location
+ * via resolveHostSideProxyComposePath (read by callers; this module
+ * accepts the path as a dep for testability).
+ *
+ * Idempotency: `docker compose up -d` is idempotent at the docker level
+ * (running container → no-op success). `docker compose down` removes
+ * the container even if absent. `ps` returns running/stopped/absent.
+ *
+ * D20 stdin-safe: this module never accepts secret values as argv; the
+ * proxy container has no secrets. Plain `docker compose` invocation.
+ */
+import { spawnSync } from 'node:child_process';
+export type ProxyStatus = 'running' | 'stopped' | 'unknown';
+export interface HostSideProxyDeps {
+    /** Spawn wrapper for testability. Defaults to node:child_process spawnSync. */
+    readonly spawnSyncImpl?: typeof spawnSync;
+    /** DOCKER_CONTEXT env override (e.g. "colima"). When unset, inherits process env. */
+    readonly dockerContext?: string;
+}
+export interface HostSideProxyResult {
+    readonly ok: boolean;
+    /** Structured remediation string surfaced when ok=false. */
+    readonly reason?: string;
+}
+export interface HostSideProxyStatusResult {
+    readonly ok: boolean;
+    readonly status: ProxyStatus;
+    readonly reason?: string;
+}
+/**
+ * Start the host-side proxy container. Idempotent: running container
+ * → no-op success.
+ *
+ * @param composePath Absolute path to docker-socket-proxy.compose.yaml.
+ */
+export declare function startHostSideProxy(composePath: string, deps?: HostSideProxyDeps): HostSideProxyResult;
+/**
+ * Stop the host-side proxy container. Idempotent: absent container
+ * → no-op success.
+ */
+export declare function stopHostSideProxy(composePath: string, deps?: HostSideProxyDeps): HostSideProxyResult;
+/**
+ * Status of the host-side proxy container. Returns 'running' / 'stopped' /
+ * 'unknown' based on `docker compose ps --format json`. 'unknown' indicates
+ * a probe failure (plugin absent, daemon unreachable, malformed output).
+ */
+export declare function statusHostSideProxy(composePath: string, deps?: HostSideProxyDeps): HostSideProxyStatusResult;
+//# sourceMappingURL=host-side-proxy.d.ts.map

package/dist/lib/host-side-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-side-proxy.d.ts","sourceRoot":"","sources":["../../src/lib/host-side-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE5D,MAAM,WAAW,iBAAiB;IAChC,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,SAAS,CAAC;IAC1C,qFAAqF;IACrF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AA6BD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,iBAAsB,GAC3B,mBAAmB,CA4BrB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,iBAAsB,GAC3B,mBAAmB,CAyBrB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,iBAAsB,GAC3B,yBAAyB,CAiD3B"}

package/dist/lib/host-side-proxy.js

@@ -0,0 +1,177 @@
+/**
+ * host-side-proxy.ts — Phase A A3 of olam-k3d-on-mac-substrate-decision.
+ *
+ * Manages the host-side `tecnativa/docker-socket-proxy` container that
+ * fronts the operator's docker daemon on macOS+colima+virtiofs. Wraps
+ * `docker compose -f <yaml> {up,down,ps}` calls with idempotent semantics.
+ *
+ * Background — round-4 wave-2 R4-W2-F: an in-cluster docker-socket-proxy
+ * Pod would itself need a hostPath bind mount of /var/run/docker.sock and
+ * hit virtiofs ENOTSUP. The proxy MUST live on the operator's docker
+ * daemon (sibling to k3d), not inside the k3d cluster. This helper is
+ * what `olam upgrade` Step 0.7 calls to ensure that sibling container
+ * is running before host-cp pods reference the in-cluster ExternalName
+ * Service (packages/host-cp/k8s/manifests/docker-socket-proxy/60-service.yaml).
+ *
+ * The compose yaml managed here:
+ *   packages/host-cp/k8s/host-side/docker-socket-proxy.compose.yaml
+ *
+ * Resolution: shipped in the npm tarball via packages/cli/package.json's
+ * `files` glob; resolved at runtime relative to the CLI's install location
+ * via resolveHostSideProxyComposePath (read by callers; this module
+ * accepts the path as a dep for testability).
+ *
+ * Idempotency: `docker compose up -d` is idempotent at the docker level
+ * (running container → no-op success). `docker compose down` removes
+ * the container even if absent. `ps` returns running/stopped/absent.
+ *
+ * D20 stdin-safe: this module never accepts secret values as argv; the
+ * proxy container has no secrets. Plain `docker compose` invocation.
+ */
+import { spawnSync } from 'node:child_process';
+/**
+ * Probe `docker compose version`. Returns ok=false with remediation when
+ * the compose plugin is absent. Required preflight before up/down/ps.
+ */
+function probeDockerCompose(deps) {
+    const spawn = deps.spawnSyncImpl ?? spawnSync;
+    const env = deps.dockerContext !== undefined
+        ? { ...process.env, DOCKER_CONTEXT: deps.dockerContext }
+        : process.env;
+    const r = spawn('docker', ['compose', 'version'], {
+        env,
+        encoding: 'utf8',
+        timeout: 5000,
+    });
+    if (r.error !== undefined || r.status !== 0) {
+        return {
+            ok: false,
+            reason: 'docker compose plugin not found. Install via `brew install docker-compose` ' +
+                'or the Docker Desktop installer. The legacy `docker-compose` binary is NOT ' +
+                'a substitute — olam requires `docker compose` (v2 plugin) for the host-side ' +
+                'docker-socket-proxy lifecycle on macOS.',
+        };
+    }
+    return { ok: true };
+}
+/**
+ * Start the host-side proxy container. Idempotent: running container
+ * → no-op success.
+ *
+ * @param composePath Absolute path to docker-socket-proxy.compose.yaml.
+ */
+export function startHostSideProxy(composePath, deps = {}) {
+    const probe = probeDockerCompose(deps);
+    if (!probe.ok) {
+        return probe;
+    }
+    const spawn = deps.spawnSyncImpl ?? spawnSync;
+    const env = deps.dockerContext !== undefined
+        ? { ...process.env, DOCKER_CONTEXT: deps.dockerContext }
+        : process.env;
+    const r = spawn('docker', ['compose', '-f', composePath, 'up', '-d'], {
+        env,
+        encoding: 'utf8',
+        timeout: 60_000,
+    });
+    if (r.error !== undefined) {
+        return { ok: false, reason: `docker compose up failed: ${r.error.message}` };
+    }
+    if (r.status !== 0) {
+        const stderr = (r.stderr ?? '').toString().trim();
+        return {
+            ok: false,
+            reason: `docker compose -f ${composePath} up -d exited ${r.status ?? 'null'}: ${stderr || '(no stderr)'}. ` +
+                `Check: \`docker context ls\` shows colima active; \`docker info\` succeeds; the compose ` +
+                `file exists at the printed path.`,
+        };
+    }
+    return { ok: true };
+}
+/**
+ * Stop the host-side proxy container. Idempotent: absent container
+ * → no-op success.
+ */
+export function stopHostSideProxy(composePath, deps = {}) {
+    const probe = probeDockerCompose(deps);
+    if (!probe.ok) {
+        return probe;
+    }
+    const spawn = deps.spawnSyncImpl ?? spawnSync;
+    const env = deps.dockerContext !== undefined
+        ? { ...process.env, DOCKER_CONTEXT: deps.dockerContext }
+        : process.env;
+    const r = spawn('docker', ['compose', '-f', composePath, 'down'], {
+        env,
+        encoding: 'utf8',
+        timeout: 30_000,
+    });
+    if (r.error !== undefined) {
+        return { ok: false, reason: `docker compose down failed: ${r.error.message}` };
+    }
+    if (r.status !== 0) {
+        const stderr = (r.stderr ?? '').toString().trim();
+        return {
+            ok: false,
+            reason: `docker compose down exited ${r.status ?? 'null'}: ${stderr || '(no stderr)'}.`,
+        };
+    }
+    return { ok: true };
+}
+/**
+ * Status of the host-side proxy container. Returns 'running' / 'stopped' /
+ * 'unknown' based on `docker compose ps --format json`. 'unknown' indicates
+ * a probe failure (plugin absent, daemon unreachable, malformed output).
+ */
+export function statusHostSideProxy(composePath, deps = {}) {
+    const probe = probeDockerCompose(deps);
+    if (!probe.ok) {
+        return { ok: false, status: 'unknown', reason: probe.reason };
+    }
+    const spawn = deps.spawnSyncImpl ?? spawnSync;
+    const env = deps.dockerContext !== undefined
+        ? { ...process.env, DOCKER_CONTEXT: deps.dockerContext }
+        : process.env;
+    const r = spawn('docker', ['compose', '-f', composePath, 'ps', '--format', 'json'], {
+        env,
+        encoding: 'utf8',
+        timeout: 10_000,
+    });
+    if (r.error !== undefined || r.status !== 0) {
+        return {
+            ok: false,
+            status: 'unknown',
+            reason: `docker compose ps failed: ${(r.stderr ?? r.error?.message ?? '(no detail)').toString().trim()}`,
+        };
+    }
+    const stdout = (r.stdout ?? '').toString().trim();
+    if (stdout === '' || stdout === '[]') {
+        return { ok: true, status: 'stopped' };
+    }
+    // Compose v2 `--format json` emits either a JSON array OR newline-delimited
+    // JSON objects depending on plugin version. Handle both.
+    try {
+        const parsed = stdout.startsWith('[')
+            ? JSON.parse(stdout)
+            : stdout.split('\n').filter((line) => line.trim() !== '').map((line) => JSON.parse(line));
+        if (!Array.isArray(parsed) || parsed.length === 0) {
+            return { ok: true, status: 'stopped' };
+        }
+        const allRunning = parsed.every((entry) => {
+            if (typeof entry !== 'object' || entry === null) {
+                return false;
+            }
+            const state = entry.State;
+            return typeof state === 'string' && state.toLowerCase() === 'running';
+        });
+        return { ok: true, status: allRunning ? 'running' : 'stopped' };
+    }
+    catch {
+        return {
+            ok: false,
+            status: 'unknown',
+            reason: 'docker compose ps emitted unparseable JSON; check `docker compose version`.',
+        };
+    }
+}
+//# sourceMappingURL=host-side-proxy.js.map

package/dist/lib/host-side-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-side-proxy.js","sourceRoot":"","sources":["../../src/lib/host-side-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAuB/C;;;GAGG;AACH,SAAS,kBAAkB,CAAC,IAAuB;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,SAAS,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,KAAK,SAAS;QAC1C,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,aAAa,EAAE;QACxD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAChB,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE;QAChD,GAAG;QACH,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,6EAA6E;gBAC7E,6EAA6E;gBAC7E,8EAA8E;gBAC9E,yCAAyC;SAC5C,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAmB,EACnB,OAA0B,EAAE;IAE5B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,SAAS,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,KAAK,SAAS;QAC1C,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,aAAa,EAAE;QACxD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAChB,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;QACpE,GAAG;QACH,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,qBAAqB,WAAW,iBAAiB,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,aAAa,IAAI;gBACnG,0FAA0F;gBAC1F,kCAAkC;SACrC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAAmB,EACnB,OAA0B,EAAE;IAE5B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,SAAS,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,KAAK,SAAS;QAC1C,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,aAAa,EAAE;QACxD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAChB,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE;QAChE,GAAG;QACH,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,8BAA8B,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,aAAa,GAAG;SACxF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAmB,EACnB,OAA0B,EAAE;IAE5B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,SAAS,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,KAAK,SAAS;QAC1C,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,aAAa,EAAE;QACxD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAChB,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE;QAClF,GAAG;QACH,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,6BAA6B,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,IAAI,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;SACzG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACzC,CAAC;IACD,4EAA4E;IAC5E,yDAAyD;IACzD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YAC5C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACpB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACzC,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,KAAK,GAAI,KAA6B,CAAC,KAAK,CAAC;YACnD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,6EAA6E;SACtF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/lib/upgrade-kubernetes.d.ts

@@ -23,12 +23,19 @@
  *   D27 — audit log entry (phase2.flag_removed) emitted per upgrade run
  *
  * Step order (Phase D — kubernetes substrate, Phase 2 GA):
- *   0.5  D4 k3d node docker socket bind-mount preflight (Decision #11 backward-compat surface)
  *   0    probeKubernetesApiReachable — 5s timeout kubectl cluster-info
+ *         (Step 0.5 D4 k3d node bind-mount preflight REMOVED in
+ *         olam-k3d-on-mac-substrate-decision Phase B B3 — R3-A retracted.)
  *   0.5b B4 ensureK8sBootstrap (namespace + RBAC + ConfigMap + PVC + secrets)
  *   0.6  R3-C create/update ghcr-pull imagePullSecret in olam namespace (when GH_TOKEN available)
  *         NOTE: relocated from pre-step 0.4 to post-bootstrap (R4-W2-A) — the
  *         `olam` namespace must exist before kubectl can create the secret.
+ *   0.7  olam-k3d-on-mac-substrate-decision Phase A — host-side docker-
+ *         socket-proxy auto-start on macOS (Decision #1 + #3). Linux substrate
+ *         is a no-op. Resolves R4-W2-F (virtiofs ENOTSUP on stat of docker.sock
+ *         hostPath bind mounts) by routing host-cp's docker access through a
+ *         host-side proxy container reachable via in-cluster ExternalName
+ *         Service (host.k3d.internal:2375).
  *   1    D10 context-allowlist + OLAM_K8S_CONTEXT_ACK strict-equality byte-for-byte
  *   2    D12 Secret pre-check (olam-host-cp-secret; base64-decode; key-name check)
  *   2.6  C2 per-peripheral Secret pre-check (iterates PERIPHERALS; unconditional — D5)
@@ -100,9 +107,11 @@ export interface UpgradeKubernetesDeps {
      */
     readonly getClusterServerUrlImpl?: () => Promise<string | null>;
     /**
-     * D7: override docker socket accessibility check for inline preflight.
-     * Returns true when /var/run/docker.sock is accessible inside the host-cp pod.
-     * Tests inject a mock to avoid real kubectl invocations.
+     * D7 (RETIRED in olam-k3d-on-mac-substrate-decision Phase B B3): the
+     * docker socket accessibility preflight is gone (host-cp no longer mounts
+     * docker.sock — it talks TCP to docker-socket-proxy). Field kept in the
+     * interface so existing test injections compile; the value is never read.
+     * New tests should not inject this field.
      */
     readonly checkDockerSocketImpl?: (context: string) => Promise<boolean>;
     /**
@@ -126,14 +135,6 @@ export interface UpgradeKubernetesDeps {
      */
     readonly ghTokenOverride?: string;
     readonly ghTokenOverrideActive?: boolean;
-    /**
-     * Phase D D4: override for k3d node mount detection (step 0.5 preflight).
-     * Returns 'new-form' when /host-colima/ bind is present (correct),
-     * 'old-form' when /var/run/docker.sock direct file-bind is present (broken on colima),
-     * or 'none' when neither is detectable (non-k3d or bare k3s cluster — warn only).
-     * Tests inject a mock to avoid real `docker inspect` invocations.
-     */
-    readonly checkK3dNodeMountsImpl?: () => Promise<'new-form' | 'old-form' | 'none'>;
 }
 export interface UpgradeKubernetesOpts {
     readonly forceRefreshManifests?: boolean;

package/dist/lib/upgrade-kubernetes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upgrade-kubernetes.d.ts","sourceRoot":"","sources":["../../src/lib/upgrade-kubernetes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAQ9B,OAAO,EAAE,WAAW,EAAwB,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,KAAK,eAAe,EAAE,KAAK,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AACrK,OAAO,EAAE,mBAAmB,EAAE,KAAK,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAA4B,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAItI,OAAO,EAAE,kBAAkB,EAAE,KAAK,aAAa,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEhG,eAAO,MAAM,sBAAsB,QAA2C,CAAC;AAC/E,eAAO,MAAM,aAAa,SAAS,CAAC;AACpC,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AACtD,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAC1D,eAAO,MAAM,kBAAkB,kCAAkC,CAAC;AAElE,oDAAoD;AACpD,eAAO,MAAM,mBAAmB,QAAqD,CAAC;AAkJtF,MAAM,WAAW,qBAAqB;IACpC,uCAAuC;IACvC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,WAAW,CAAC;IAC9C,2CAA2C;IAC3C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,gBAAgB,CAAC;IACxD,yDAAyD;IACzD,QAAQ,CAAC,kCAAkC,CAAC,EAAE,OAAO,8BAA8B,CAAC;IACpF,mDAAmD;IACnD,QAAQ,CAAC,4BAA4B,CAAC,EAAE,OAAO,wBAAwB,CAAC;IACxE,wDAAwD;IACxD,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5E,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAC/C,2CAA2C;IAC3C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,kBAAkB,CAAC;IACzD,2CAA2C;IAC3C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,uBAAuB,CAAC;IAC5D,sFAAsF;IACtF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,iGAAiG;IACjG,QAAQ,CAAC,yBAAyB,CAAC,EAAE,yBAAyB,CAAC;IAC/D,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAC7B,iCAAiC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IACxC,iCAAiC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IACxC,oEAAoE;IACpE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC,YAAY,CAAC;IACnD,yDAAyD;IACzD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAChE;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,kBAAkB,CAAC;IACtD,sDAAsD;IACtD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC,CAAC;CACnF;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,wFAAwF;IACxF,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAkdD;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,GAAE,qBAA0B,EAChC,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,uBAAuB,CAAC,CAqalC"}
+{"version":3,"file":"upgrade-kubernetes.d.ts","sourceRoot":"","sources":["../../src/lib/upgrade-kubernetes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAS9B,OAAO,EAAE,WAAW,EAAwB,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,KAAK,eAAe,EAAE,KAAK,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AACrK,OAAO,EAAE,mBAAmB,EAAE,KAAK,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAA4B,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAItI,OAAO,EAAE,kBAAkB,EAAwB,KAAK,aAAa,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAgBtH,eAAO,MAAM,sBAAsB,QAA2C,CAAC;AAC/E,eAAO,MAAM,aAAa,SAAS,CAAC;AACpC,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AACtD,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAC1D,eAAO,MAAM,kBAAkB,kCAAkC,CAAC;AAElE,oDAAoD;AACpD,eAAO,MAAM,mBAAmB,QAAqD,CAAC;AA2HtF,MAAM,WAAW,qBAAqB;IACpC,uCAAuC;IACvC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,WAAW,CAAC;IAC9C,2CAA2C;IAC3C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,gBAAgB,CAAC;IACxD,yDAAyD;IACzD,QAAQ,CAAC,kCAAkC,CAAC,EAAE,OAAO,8BAA8B,CAAC;IACpF,mDAAmD;IACnD,QAAQ,CAAC,4BAA4B,CAAC,EAAE,OAAO,wBAAwB,CAAC;IACxE,wDAAwD;IACxD,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5E,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAC/C,2CAA2C;IAC3C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,kBAAkB,CAAC;IACzD,2CAA2C;IAC3C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,uBAAuB,CAAC;IAC5D,sFAAsF;IACtF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,iGAAiG;IACjG,QAAQ,CAAC,yBAAyB,CAAC,EAAE,yBAAyB,CAAC;IAC/D,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAC7B,iCAAiC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IACxC,iCAAiC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IACxC,oEAAoE;IACpE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC,YAAY,CAAC;IACnD,yDAAyD;IACzD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAChE;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,kBAAkB,CAAC;IACtD,sDAAsD;IACtD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAK1C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,wFAAwF;IACxF,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAgYD;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,GAAE,qBAA0B,EAChC,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,uBAAuB,CAAC,CAwblC"}

package/dist/lib/upgrade-kubernetes.js

@@ -23,12 +23,19 @@
  *   D27 — audit log entry (phase2.flag_removed) emitted per upgrade run
  *
  * Step order (Phase D — kubernetes substrate, Phase 2 GA):
- *   0.5  D4 k3d node docker socket bind-mount preflight (Decision #11 backward-compat surface)
  *   0    probeKubernetesApiReachable — 5s timeout kubectl cluster-info
+ *         (Step 0.5 D4 k3d node bind-mount preflight REMOVED in
+ *         olam-k3d-on-mac-substrate-decision Phase B B3 — R3-A retracted.)
  *   0.5b B4 ensureK8sBootstrap (namespace + RBAC + ConfigMap + PVC + secrets)
  *   0.6  R3-C create/update ghcr-pull imagePullSecret in olam namespace (when GH_TOKEN available)
  *         NOTE: relocated from pre-step 0.4 to post-bootstrap (R4-W2-A) — the
  *         `olam` namespace must exist before kubectl can create the secret.
+ *   0.7  olam-k3d-on-mac-substrate-decision Phase A — host-side docker-
+ *         socket-proxy auto-start on macOS (Decision #1 + #3). Linux substrate
+ *         is a no-op. Resolves R4-W2-F (virtiofs ENOTSUP on stat of docker.sock
+ *         hostPath bind mounts) by routing host-cp's docker access through a
+ *         host-side proxy container reachable via in-cluster ExternalName
+ *         Service (host.k3d.internal:2375).
  *   1    D10 context-allowlist + OLAM_K8S_CONTEXT_ACK strict-equality byte-for-byte
  *   2    D12 Secret pre-check (olam-host-cp-secret; base64-decode; key-name check)
  *   2.6  C2 per-peripheral Secret pre-check (iterates PERIPHERALS; unconditional — D5)
@@ -51,7 +58,8 @@ import { parse as yamlParse, stringify as yamlStringify } from 'yaml';
 import ora from 'ora';
 import pc from 'picocolors';
 import { printError, printSuccess, printInfo, printWarning } from '../output.js';
-import { buildDockerSocketRemedy, defaultDetectK8sClusterType } from './health-probes.js';
+// buildDockerSocketRemedy + defaultDetectK8sClusterType removed in
+// olam-k3d-on-mac-substrate-decision Phase B B3 — Pre-step 0b retracted.
 import { kubectlWrap } from './kubectl-wrap.js';
 import { spawnPortForward, spawnAllPeripheralPortForwards, probePortForwardLiveness } from './port-forward.js';
 import { emitUpgradeComplete } from './instrumentation.js';
@@ -59,7 +67,21 @@ import { runManifestRefresh, seedManifestsFromBundle } from './manifest-refresh.
 import { OLAM_HOME, OLAM_STATE_DIR } from './config.js';
 import { PERIPHERALS } from './peripheral-registry.js';
 import { resolveKubectlContext } from './kubectl-context.js';
-import { ensureK8sBootstrap } from './k8s-bootstrap.js';
+import { ensureK8sBootstrap, resolveK8sAssetsRoot } from './k8s-bootstrap.js';
+import { startHostSideProxy } from './host-side-proxy.js';
+/**
+ * Resolve the bundled docker-socket-proxy.compose.yaml path. Looks under
+ * the same k8s-assets root that ships the in-cluster manifests. Returns
+ * null when the bundle layout is unexpected (dev contexts without a built
+ * tarball). Step 0.7's caller treats null as a continue-with-warning.
+ */
+function resolveHostSideProxyComposePath() {
+    const root = resolveK8sAssetsRoot();
+    if (root === null)
+        return null;
+    const candidate = path.join(root, 'host-side', 'docker-socket-proxy.compose.yaml');
+    return fs.existsSync(candidate) ? candidate : null;
+}
 export const OLAM_K8S_MANIFESTS_DIR = path.join(OLAM_HOME, 'k8s', 'manifests');
 export const K8S_NAMESPACE = 'olam';
 export const HOST_CP_SECRET_NAME = 'olam-host-cp-secret';
@@ -174,25 +196,6 @@ async function detectManagedK8sProvider(deps) {
     }
     return null;
 }
-/**
- * D7 — Check docker socket accessibility inside the host-cp pod.
- * Uses `kubectl exec deploy/olam-host-cp -n olam -- test -S /var/run/docker.sock`.
- * Returns true when socket is accessible; false when absent or unreachable.
- */
-async function checkDockerSocketAccessible(context, deps) {
-    if (deps.checkDockerSocketImpl) {
-        return deps.checkDockerSocketImpl(context);
-    }
-    const wrap = deps.kubectlWrapImpl ?? kubectlWrap;
-    const result = await wrap([
-        '--context', context,
-        'exec', 'deploy/olam-host-cp',
-        '-n', 'olam',
-        '--',
-        'test', '-S', '/var/run/docker.sock',
-    ], { timeout: 10_000 });
-    return result.ok;
-}
 /**
  * Step 0 — D22: probe Kubernetes API reachability (5s timeout).
  * Uses kubectl cluster-info with a tight timeout to detect unreachable API server.
@@ -467,82 +470,12 @@ async function createGhcrPullSecret(context, deps, stderr) {
     }
     return { skipped: false };
 }
-/** k3d node container name olam uses by convention. */
-const K3D_NODE_CONTAINER = 'k3d-olam-host-server-0';
-/**
- * Default implementation: run `docker inspect k3d-olam-host-server-0` and
- * scan the Mounts array to determine which bind form is in use.
- *
- * Returns:
- *   'new-form' — /host-colima/ bind present (correct form per Phase B B1)
- *   'old-form' — /var/run/docker.sock direct file-bind present (broken on colima, R3-A)
- *   'none'     — container not found or neither bind detectable (non-k3d / bare k3s)
- */
-async function defaultCheckK3dNodeMounts() {
-    const { execFile } = await import('node:child_process');
-    const { promisify } = await import('node:util');
-    const execFileAsync = promisify(execFile);
-    try {
-        const { stdout } = await execFileAsync('docker', ['inspect', K3D_NODE_CONTAINER, '--format', '{{json .HostConfig.Binds}}'], { timeout: 8_000 });
-        const binds = JSON.parse(stdout.trim());
-        if (!Array.isArray(binds))
-            return 'none';
-        // New form: bind contains /host-colima/ (directory bind from Phase B B1).
-        if (binds.some((b) => b.includes('/host-colima/')))
-            return 'new-form';
-        // Old form: bind contains /var/run/docker.sock as a file source (R3-A broken form).
-        if (binds.some((b) => b.startsWith('/var/run/docker.sock:')))
-            return 'old-form';
-        return 'none';
-    }
-    catch {
-        // Container not found, docker unavailable, or JSON parse error — treat as non-k3d.
-        return 'none';
-    }
-}
-/**
- * Step 0.5 — Phase D D4: k3d node docker socket bind-mount preflight (Decision #11).
- *
- * Detects whether the k3d-olam-host cluster was created with the correct
- * `--volume "$HOME/.colima/default/:/host-colima/@server:*"` bind (new form,
- * Phase B B1) or the old `--volume /var/run/docker.sock:/var/run/docker.sock`
- * direct file-bind (broken on colima, R3-A).
- *
- * - 'new-form' → proceed (correct)
- * - 'old-form' → hard error with actionable Decision #11 recreate command
- * - 'none'     → WARN only (non-k3d or bare k3s without socket bind; may work)
- *
- * Runs ONLY on kubernetes substrate. The check is host-side (`docker inspect`)
- * so it can fire BEFORE any kubectl apply (pre-step 0b runs AFTER cluster is
- * deployed; this runs BEFORE step 0 so fresh-install operators catch the
- * broken bind before wasting a full upgrade attempt).
- *
- * Returns null on pass/warn (upgrade should continue);
- * returns error message string on hard failure (upgrade should abort).
- */
-async function preflightK3dNodeMounts(deps, stderr) {
-    const check = deps.checkK3dNodeMountsImpl ?? defaultCheckK3dNodeMounts;
-    const form = await check();
-    if (form === 'new-form') {
-        // Correct bind — proceed silently.
-        return null;
-    }
-    if (form === 'old-form') {
-        // Decision #11 backward-compat error: operator must recreate the cluster.
-        return (`Your k3d cluster was created with the old --volume form which fails on colima.\n` +
-            `  Recreate the cluster with:\n` +
-            `    k3d cluster delete olam-host\n` +
-            `    k3d cluster create olam-host --volume "$HOME/.colima/default/:/host-colima/@server:*"\n` +
-            `  Then re-run olam upgrade.`);
-    }
-    // 'none': k3d node container not found or non-k3d cluster (bare k3s, minikube, etc.).
-    // Emit WARN only — we cannot detect the bind on non-k3d setups, so do not block.
-    stderr.write(`${pc.yellow('[warn]')} step 0.5: k3d node container "${K3D_NODE_CONTAINER}" not found or bind form undetectable.\n` +
-        `  This is expected on non-k3d clusters (bare k3s, minikube). Continuing.\n` +
-        `  On colima+k3d: ensure the cluster was created with:\n` +
-        `    k3d cluster create olam-host --volume "$HOME/.colima/default/:/host-colima/@server:*"\n`);
-    return null;
-}
+// K3D_NODE_CONTAINER, defaultCheckK3dNodeMounts, preflightK3dNodeMounts
+// REMOVED in olam-k3d-on-mac-substrate-decision Phase B B3 (2026-05-21).
+// They were the Decision #11 backward-compat preflight for the R3-A
+// two-volume hostPath approach, which is fully retracted (Phase B B2).
+// host-cp now reaches docker via TCP through the docker-socket-proxy
+// ExternalName Service — no docker socket bind into k3d nodes at all.
 /**
  * Main entrypoint for the kubernetes upgrade path.
  *
@@ -576,18 +509,13 @@ export async function runUpgradeKubernetes(opts = {}, deps = {}) {
     // silently dropped the secret. Subsequent host-cp rollouts then 401'd on
     // image pull. Step 0.4 now runs AFTER Step 0.5 (B4 bootstrap creates the
     // namespace + RBAC) — see below.
-    // ── Step 0.5: D4 — k3d node docker socket bind-mount preflight (Decision #11) ──
-    // Runs BEFORE API reachability (step 0) so operators on a mis-configured k3d
-    // cluster get an actionable error before wasting a full upgrade attempt.
-    // Only meaningful on k3d clusters where the node container is named
-    // k3d-olam-host-server-0. Non-k3d clusters emit WARN and proceed.
-    {
-        const step05Error = await preflightK3dNodeMounts(deps, stderr);
-        if (step05Error !== null) {
-            stderr.write(`${pc.red('error:')} ${step05Error}\n`);
-            return { exitCode: 1, summary: 'k3d node bind-mount preflight failed (Decision #11)' };
-        }
-    }
+    // Step 0.5 REMOVED in olam-k3d-on-mac-substrate-decision Phase B B3
+    // (2026-05-21). The k3d node docker socket bind-mount preflight checked
+    // whether the cluster was created with the R3-A two-volume hostPath form,
+    // which is fully retracted in Phase B B2. There is no longer any docker
+    // socket binding into k3d node containers — host-cp reaches docker via
+    // TCP through the docker-socket-proxy ExternalName Service, served by a
+    // host-side proxy container started by Step 0.7. No preflight needed.
     // ── Pre-step 0a-prelude: B3 — resolve kubectl context ONCE (config + env) ──
     // The context is needed by ALL kubectl-invoking pre-steps and steps below.
     // Resolution policy lives in `kubectl-context.ts` (single source of truth):
@@ -622,30 +550,14 @@ export async function runUpgradeKubernetes(opts = {}, deps = {}) {
             return { exitCode: 1, summary: 'managed-k8s context detected (Decision #18 retraction)' };
         }
     }
-    // ── Pre-step 0b: D7 — docker socket bind-mount preflight ──────────────
-    // Checks that /var/run/docker.sock is accessible inside the host-cp pod
-    // BEFORE step 0. Prevents crash-loop UX when the operator forgot the
-    // --volume socket bind on k3d cluster create (OQ13 resolution).
-    // Note: only meaningful when host-cp is already deployed. On a fresh install
-    // the pod doesn't exist yet — kubectl exec will fail gracefully (WARN only).
-    {
-        const socketAccessible = await checkDockerSocketAccessible(pinnedContext, deps);
-        if (!socketAccessible) {
-            // Issue #713: emit a cluster-type-aware remedy (colima vs k3d).
-            const clusterType = defaultDetectK8sClusterType(pinnedContext);
-            const remedyText = buildDockerSocketRemedy(clusterType)
-                .split('\n')
-                .map((line) => `  ${line}`)
-                .join('\n');
-            stderr.write(`${pc.yellow('[WARN]')} docker socket not accessible at /var/run/docker.sock inside the host-cp pod.\n` +
-                `  This means the cluster was not created with the docker socket bind-mount,\n` +
-                `  or host-cp is not yet deployed (first install — this warning is expected).\n` +
-                `  For subsequent upgrades:\n` +
-                `${remedyText}\n` +
-                `  Run olam doctor to check probe 28 (probeDockerSocketBindMount).\n`);
-            // WARN only — do not abort. Fresh installs have no pod yet.
-        }
-    }
+    // Pre-step 0b D7 (docker socket bind-mount preflight) REMOVED in
+    // olam-k3d-on-mac-substrate-decision Phase B B3 (2026-05-21). The
+    // preflight checked /var/run/docker.sock inside host-cp via `kubectl exec`,
+    // which is obsolete: host-cp no longer has a docker socket volumeMount
+    // (see packages/host-cp/k8s/manifests/50-deployment.yaml). Docker access
+    // is via TCP to docker-socket-proxy. Step 0.7 (above) handles the new
+    // substrate's UX; the doctor probe for proxy reachability lives in
+    // Phase C C1.
     // ── Step 0: D22 — probe Kubernetes API reachability (5s) ─────────
     const step0Spinner = ora('Probing Kubernetes API reachability').start();
     const reachable = await probeKubernetesApiReachable(pinnedContext, deps);
@@ -714,6 +626,47 @@ export async function runUpgradeKubernetes(opts = {}, deps = {}) {
             step06Spinner.succeed('ghcr-pull imagePullSecret created/updated');
         }
     }
+    // ── Step 0.7: olam-k3d-on-mac-substrate-decision Phase A — host-side ────
+    //    docker-socket-proxy auto-start on macOS (Decisions #1 + #3 + #7).
+    //
+    // Resolves R4-W2-F: on macOS + colima + virtiofs, containerd's OCI runtime
+    // spec generator calls stat() on docker.sock hostPath bind mounts; virtiofs
+    // returns ENOTSUP on stat/statx for socket files. The R3-A two-volume
+    // hostPath approach is unrecoverable. This step routes around it by
+    // ensuring a host-side `tecnativa/docker-socket-proxy` container is
+    // running on the operator's docker daemon (sibling to k3d). The
+    // in-cluster Service (packages/host-cp/k8s/manifests/docker-socket-proxy/
+    // 60-service.yaml) is `type: ExternalName` aliased to host.k3d.internal,
+    // which routes traffic to this host-side container.
+    //
+    // Decision #7 (Universal): runs on all host OSes regardless of substrate.
+    // This means Linux operators also get the proxy. The per-Pod cost is
+    // invisible against the maintenance tax of OS-conditional Service generation.
+    //
+    // Idempotent: `docker compose up -d` on a running container is a no-op
+    // success. Failure surfaces an actionable remediation string but does
+    // NOT abort the upgrade — host-cp will then fail at Step 4 rollout with
+    // a clearer "proxy unreachable" symptom that the new doctor probe
+    // (olam-k3d-on-mac-substrate-decision Phase C C1) diagnoses.
+    if (process.platform === 'darwin') {
+        const step07Spinner = ora('Starting host-side docker-socket-proxy (R4-W2-F)').start();
+        const composePath = resolveHostSideProxyComposePath();
+        if (composePath === null) {
+            step07Spinner.warn('host-side docker-socket-proxy compose yaml not found (bundle layout?)');
+            stderr.write(`${pc.yellow('[warn]')} could not locate docker-socket-proxy.compose.yaml in the bundled k8s assets.\n` +
+                `  This is a packaging bug — please report. Continuing without auto-start.\n`);
+        }
+        else {
+            const startResult = startHostSideProxy(composePath);
+            if (!startResult.ok) {
+                step07Spinner.warn(`host-side docker-socket-proxy start failed (continuing): ${startResult.reason ?? 'unknown'}`);
+                stderr.write(`${pc.yellow('[warn]')} ${startResult.reason ?? 'unknown error'}\n`);
+            }
+            else {
+                step07Spinner.succeed('docker-socket-proxy ready on host');
+            }
+        }
+    }
     // ── Step 1: D10 — context-allowlist validation ───────────────────
     // The context was already resolved (config-first, env-fallback) before
     // pre-step 0a. Step 1 keeps the D10 allowlist gate + the audit WARN so