@pleri/olam-cli 0.1.160 → 0.1.161

package/dist/lib/bootstrap-kubernetes.d.ts

@@ -0,0 +1,42 @@
+/**
+ * bootstrap-kubernetes.ts — k3s mode of `olam bootstrap`.
+ *
+ * Wraps the legacy `scripts/dogfood/up.sh` reference flow into a CLI
+ * routine so external operators with only the published `@pleri/olam-cli`
+ * tarball (no access to the private `pleri/olam` repo) can bring up an
+ * end-to-end olam-on-k3s stack with one command.
+ *
+ * Steps (idempotent):
+ *   0. Preflight — detect required tools (k3d, kubectl, helm, jq, curl,
+ *      openssl, gh, docker). With --auto-install on macOS, run `brew
+ *      install` for missing brew-formulae.
+ *   1. Secrets — generate `~/.olam/{auth-secret,kg-bearer-token,
+ *      auth-db-secret,mcp-auth-jwt-secret,memory-bearer-secret}` if absent.
+ *   2. Colima (macOS only) — ensure running; chmod /var/run/docker.sock
+ *      inside the VM (virtiofs mitigation).
+ *   3. k3d cluster — create `<cluster>` with the gh-config bind. Skipped
+ *      if cluster already exists.
+ *   4. Observability — chain bundled scripts in `<install>/host-cp/
+ *      observability/` to install Loki + Promtail + Grafana +
+ *      kube-prometheus-stack + Kyverno admission policy.
+ *   5. Delegate to `olam upgrade -y` — that flow handles namespace + RBAC
+ *      + secrets + ghcr-pull + host-side docker-socket-proxy +
+ *      manifest apply + rollout + verify.
+ *
+ * Note: `olam upgrade` already ships the 8-step k8s flow in
+ * `upgrade-kubernetes.ts` (Phase 1b C2 + Phase 2 C/D). This module is
+ * the prereq + cluster-create + observability wrapper around it.
+ */
+export declare const DEFAULT_K3S_CLUSTER = "olam-host";
+export interface BootstrapKubernetesOptions {
+    readonly cluster: string;
+    readonly autoInstall: boolean;
+    readonly skipObservability: boolean;
+    readonly skipClusterCreate: boolean;
+}
+export interface BootstrapKubernetesResult {
+    readonly exitCode: number;
+    readonly summary: string;
+}
+export declare function runBootstrapKubernetes(rawOpts: Partial<BootstrapKubernetesOptions>): Promise<BootstrapKubernetesResult>;
+//# sourceMappingURL=bootstrap-kubernetes.d.ts.map

package/dist/lib/bootstrap-kubernetes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-kubernetes.d.ts","sourceRoot":"","sources":["../../src/lib/bootstrap-kubernetes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAcH,eAAO,MAAM,mBAAmB,cAAc,CAAC;AA4B/C,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAuOD,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAC3C,OAAO,CAAC,yBAAyB,CAAC,CAqBpC"}

package/dist/lib/bootstrap-kubernetes.js

@@ -0,0 +1,287 @@
+/**
+ * bootstrap-kubernetes.ts — k3s mode of `olam bootstrap`.
+ *
+ * Wraps the legacy `scripts/dogfood/up.sh` reference flow into a CLI
+ * routine so external operators with only the published `@pleri/olam-cli`
+ * tarball (no access to the private `pleri/olam` repo) can bring up an
+ * end-to-end olam-on-k3s stack with one command.
+ *
+ * Steps (idempotent):
+ *   0. Preflight — detect required tools (k3d, kubectl, helm, jq, curl,
+ *      openssl, gh, docker). With --auto-install on macOS, run `brew
+ *      install` for missing brew-formulae.
+ *   1. Secrets — generate `~/.olam/{auth-secret,kg-bearer-token,
+ *      auth-db-secret,mcp-auth-jwt-secret,memory-bearer-secret}` if absent.
+ *   2. Colima (macOS only) — ensure running; chmod /var/run/docker.sock
+ *      inside the VM (virtiofs mitigation).
+ *   3. k3d cluster — create `<cluster>` with the gh-config bind. Skipped
+ *      if cluster already exists.
+ *   4. Observability — chain bundled scripts in `<install>/host-cp/
+ *      observability/` to install Loki + Promtail + Grafana +
+ *      kube-prometheus-stack + Kyverno admission policy.
+ *   5. Delegate to `olam upgrade -y` — that flow handles namespace + RBAC
+ *      + secrets + ghcr-pull + host-side docker-socket-proxy +
+ *      manifest apply + rollout + verify.
+ *
+ * Note: `olam upgrade` already ships the 8-step k8s flow in
+ * `upgrade-kubernetes.ts` (Phase 1b C2 + Phase 2 C/D). This module is
+ * the prereq + cluster-create + observability wrapper around it.
+ */
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, writeFileSync, chmodSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir, platform } from 'node:os';
+import { randomBytes } from 'node:crypto';
+import pc from 'picocolors';
+import { printError, printSuccess, printInfo, printWarning, printHeader } from '../output.js';
+import { installRoot } from '../install-root.js';
+import { resolveK8sAssetsRoot } from './k8s-bootstrap.js';
+const OLAM_HOME = join(homedir(), '.olam');
+export const DEFAULT_K3S_CLUSTER = 'olam-host';
+const REQUIRED_TOOLS = [
+    { name: 'k3d', brew: 'k3d' },
+    { name: 'kubectl', brew: 'kubectl' },
+    { name: 'helm', brew: 'helm' },
+    { name: 'jq', brew: 'jq' },
+    { name: 'curl', hint: 'expected on macOS by default; `apt install curl` on linux' },
+    { name: 'openssl', hint: 'expected on macOS by default; `apt install openssl` on linux' },
+    { name: 'gh', brew: 'gh', hint: 'after install: `gh auth login`' },
+    { name: 'docker', hint: 'Docker Desktop, or colima on macOS' },
+];
+const SECRET_FILES = [
+    'auth-secret',
+    'kg-bearer-token',
+    'auth-db-secret',
+    'mcp-auth-jwt-secret',
+    'memory-bearer-secret',
+];
+const OBSERVABILITY_SCRIPTS = [
+    'loki-ingest.sh',
+    'grafana-port-forward.sh',
+    'prom-no-double-grafana.sh',
+    'kyverno-cardinality-mutate.sh',
+];
+/** Wraps `command -v <tool>` returning true when the binary is on PATH. */
+function hasTool(tool) {
+    const result = spawnSync('command', ['-v', tool], { shell: true, stdio: 'pipe' });
+    return result.status === 0;
+}
+function detectMissingTools() {
+    return REQUIRED_TOOLS.filter((tool) => !hasTool(tool.name));
+}
+function runOrFail(cmd, args, description) {
+    const result = spawnSync(cmd, args, { stdio: 'inherit' });
+    if (result.status !== 0) {
+        printError(`${description} failed (exit ${result.status ?? 'signal'})`);
+        process.exit(result.status ?? 1);
+    }
+}
+function runCapture(cmd, args) {
+    const result = spawnSync(cmd, args, { encoding: 'utf8' });
+    return {
+        ok: result.status === 0,
+        stdout: result.stdout ?? '',
+        stderr: result.stderr ?? '',
+    };
+}
+function step(label) {
+    process.stdout.write('\n' + pc.bold(pc.cyan(`==> ${label}`)) + '\n');
+}
+function preflight(opts) {
+    step('0/5 — preflight (tool detection)');
+    const missing = detectMissingTools();
+    if (missing.length === 0) {
+        printSuccess('all required tools present');
+    }
+    else if (opts.autoInstall && platform() === 'darwin') {
+        const brewable = missing.filter((t) => t.brew);
+        if (brewable.length > 0) {
+            printInfo('auto-install', `${brewable.length} brew formula(s): ${brewable.map((t) => t.brew).join(', ')}`);
+            runOrFail('brew', ['install', ...brewable.map((t) => t.brew)], 'brew install');
+        }
+        const stillMissing = detectMissingTools();
+        if (stillMissing.length > 0) {
+            printError('tools still missing after auto-install:');
+            for (const t of stillMissing) {
+                process.stderr.write(`  - ${t.name}${t.hint ? ` — ${t.hint}` : ''}\n`);
+            }
+            process.exit(1);
+        }
+        printSuccess('all required tools present after auto-install');
+    }
+    else {
+        printError(`${missing.length} required tool(s) missing:`);
+        for (const t of missing) {
+            const hint = t.brew ? `brew install ${t.brew}` : t.hint ?? '(install manually)';
+            process.stderr.write(`  - ${pc.bold(t.name)}: ${hint}\n`);
+        }
+        process.stderr.write('\nRe-run with --auto-install on macOS to install brew-formulae automatically.\n');
+        process.exit(1);
+    }
+    // gh auth
+    if (!runCapture('gh', ['auth', 'status']).ok) {
+        printError('gh is not authenticated — run: gh auth login');
+        process.exit(1);
+    }
+    printSuccess('gh authenticated');
+    // docker reachability
+    if (!runCapture('docker', ['info']).ok) {
+        printError('docker daemon unreachable — start Docker Desktop or colima');
+        process.exit(1);
+    }
+    printSuccess('docker daemon reachable');
+}
+function ensureSecrets() {
+    step('1/5 — operator secrets');
+    mkdirSync(OLAM_HOME, { recursive: true });
+    for (const name of SECRET_FILES) {
+        const path = join(OLAM_HOME, name);
+        if (existsSync(path)) {
+            printInfo('skip', `~/.olam/${name} already exists`);
+            continue;
+        }
+        const hex = randomBytes(32).toString('hex');
+        writeFileSync(path, hex + '\n', { encoding: 'utf8', mode: 0o600 });
+        chmodSync(path, 0o600);
+        printSuccess(`generated ~/.olam/${name}`);
+    }
+}
+function ensureColima() {
+    if (platform() !== 'darwin')
+        return;
+    step('2/5 — colima (macOS)');
+    if (!runCapture('colima', ['status']).ok) {
+        printWarning('colima not running — starting');
+        runOrFail('colima', ['start', '--cpu', '4', '--memory', '8', '--vm-type=vz', '--mount-type=virtiofs'], 'colima start');
+    }
+    printSuccess('colima running');
+    // virtiofs blocks chmod of docker.sock from the macOS side. Idempotent + non-fatal.
+    const chmod = runCapture('colima', ['ssh', '--', 'sudo', 'chmod', '666', '/var/run/docker.sock']);
+    if (chmod.ok) {
+        printSuccess('docker.sock chmod applied inside colima VM');
+    }
+    else {
+        printWarning('colima ssh chmod failed — k3d cluster create may still succeed');
+    }
+}
+function ensureCluster(opts) {
+    if (opts.skipClusterCreate) {
+        step('3/5 — cluster (skipped via --skip-cluster-create)');
+        return;
+    }
+    step(`3/5 — k3d cluster create (${opts.cluster})`);
+    if (runCapture('k3d', ['cluster', 'list', opts.cluster]).ok) {
+        printInfo('cluster', `'${opts.cluster}' already exists`);
+        return;
+    }
+    const ghConfigBind = `${homedir()}/.config/gh:/host/.config/gh`;
+    runOrFail('k3d', ['cluster', 'create', opts.cluster, '--volume', ghConfigBind, '--wait', '--timeout', '90s'], `k3d cluster create ${opts.cluster}`);
+    if (!runCapture('kubectl', ['cluster-info']).ok) {
+        printError('kubectl cannot reach the cluster — check kubeconfig context');
+        process.exit(1);
+    }
+    printSuccess(`cluster ready (${runCapture('kubectl', ['config', 'current-context']).stdout.trim()})`);
+}
+/** Resolve the bundled observability scripts dir. */
+function resolveObservabilityScriptsDir() {
+    // Install-mode: bundle-host-cp.mjs copies scripts/e2e/*.sh to
+    // <install-root>/host-cp/observability/.
+    const installed = join(installRoot(), 'host-cp', 'observability');
+    if (existsSync(installed))
+        return installed;
+    // Dev-mode fallback: resolve via the k8s assets root + walk up to repo
+    // root then into scripts/e2e/. Works when running against the monorepo.
+    const k8sRoot = resolveK8sAssetsRoot();
+    if (k8sRoot) {
+        const dev = join(k8sRoot, '..', '..', '..', 'scripts', 'e2e');
+        if (existsSync(dev))
+            return dev;
+    }
+    return null;
+}
+function installObservability(opts) {
+    if (opts.skipObservability) {
+        step('4/5 — observability (skipped via --skip-observability)');
+        return;
+    }
+    step('4/5 — observability stack (Loki + Promtail + Grafana + Prometheus + Kyverno)');
+    const observabilityDir = resolveObservabilityScriptsDir();
+    if (!observabilityDir) {
+        printWarning('bundled observability scripts not found — skipping');
+        printWarning('  (expected in published CLI installs; missing only in dev tarballs without bundling)');
+        return;
+    }
+    for (const script of OBSERVABILITY_SCRIPTS) {
+        const path = join(observabilityDir, script);
+        if (!existsSync(path)) {
+            printWarning(`observability script missing: ${script} — skipping`);
+            continue;
+        }
+        printInfo('run', script);
+        const result = spawnSync('bash', [path], { stdio: 'inherit' });
+        if (result.status !== 0) {
+            // loki-ingest's 10s scrub-wait is known to flake on cold-start; the
+            // underlying Loki/Promtail install almost always succeeded.
+            if (script === 'loki-ingest.sh') {
+                printWarning('loki-ingest non-zero — likely Promtail scrub-wait flake; continuing');
+            }
+            else {
+                printError(`${script} failed — observability stack not ready`);
+                process.exit(1);
+            }
+        }
+        else {
+            printSuccess(`${script} passed`);
+        }
+    }
+}
+function delegateToUpgrade() {
+    step('5/5 — apply manifests + rollout (olam upgrade)');
+    // Re-invoke `olam upgrade -y` via the same process binary. The upgrade
+    // flow's 8-step k8s path (upgrade-kubernetes.ts) handles namespace +
+    // RBAC + Secrets + ghcr-pull + host-side docker-socket-proxy + manifest
+    // apply + rollout status + port-forward + /health verify + audit log.
+    const olamBin = process.argv[1] ?? 'olam';
+    const result = spawnSync(process.execPath, [olamBin, 'upgrade', '-y'], { stdio: 'inherit' });
+    if (result.status !== 0) {
+        printError('olam upgrade failed — see output above');
+        process.exit(result.status ?? 1);
+    }
+}
+function summary(opts) {
+    step('done');
+    process.stdout.write(`
+  Cluster:    ${opts.cluster}
+  Next steps:
+    olam doctor                       # verify the stack
+    olam services status              # peripherals 1/1
+    kubectl get pods -n olam
+
+  Grafana:
+    kubectl port-forward -n monitoring svc/olam-grafana 3000:80
+    open http://localhost:3000
+    # admin password:
+    kubectl get secret olam-grafana-admin -n monitoring \\
+      -o jsonpath='{.data.admin-password}' | base64 -d
+`);
+}
+export async function runBootstrapKubernetes(rawOpts) {
+    const opts = {
+        cluster: rawOpts.cluster ?? DEFAULT_K3S_CLUSTER,
+        autoInstall: rawOpts.autoInstall ?? false,
+        skipObservability: rawOpts.skipObservability ?? false,
+        skipClusterCreate: rawOpts.skipClusterCreate ?? false,
+    };
+    printHeader('olam bootstrap — k3s mode');
+    printInfo('mode', 'one-command bring-up of olam peripherals + observability on a local k3d cluster');
+    preflight(opts);
+    ensureSecrets();
+    ensureColima();
+    ensureCluster(opts);
+    installObservability(opts);
+    delegateToUpgrade();
+    summary(opts);
+    printSuccess('bootstrap complete');
+    return { exitCode: 0, summary: `bootstrap complete on cluster ${opts.cluster}` };
+}
+//# sourceMappingURL=bootstrap-kubernetes.js.map

package/dist/lib/bootstrap-kubernetes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-kubernetes.js","sourceRoot":"","sources":["../../src/lib/bootstrap-kubernetes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AAE3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAE/C,MAAM,cAAc,GAA6F;IAC/G,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;IAC5B,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;IACpC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;IAC9B,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;IAC1B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,2DAA2D,EAAE;IACnF,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,8DAA8D,EAAE;IACzF,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,gCAAgC,EAAE;IAClE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,oCAAoC,EAAE;CAC/D,CAAC;AAEF,MAAM,YAAY,GAA0B;IAC1C,aAAa;IACb,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,sBAAsB;CACvB,CAAC;AAEF,MAAM,qBAAqB,GAA0B;IACnD,gBAAgB;IAChB,yBAAyB;IACzB,2BAA2B;IAC3B,+BAA+B;CAChC,CAAC;AAcF,2EAA2E;AAC3E,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAClF,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,IAAuB,EAAE,WAAmB;IAC1E,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,GAAG,WAAW,iBAAiB,MAAM,CAAC,MAAM,IAAI,QAAQ,GAAG,CAAC,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,IAAuB;IACtD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1D,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,IAAgC;IACjD,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAEzC,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,YAAY,CAAC,4BAA4B,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,IAAI,CAAC,WAAW,IAAI,QAAQ,EAAE,KAAK,QAAQ,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,SAAS,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,MAAM,qBAAqB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3G,SAAS,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;QAC1C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,UAAU,CAAC,yCAAyC,CAAC,CAAC;YACtD,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;gBAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,YAAY,CAAC,+CAA+C,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,UAAU,CAAC,GAAG,OAAO,CAAC,MAAM,4BAA4B,CAAC,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,oBAAoB,CAAC;YAChF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iFAAiF,CAAC,CAAC;QACxG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,UAAU;IACV,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC7C,UAAU,CAAC,8CAA8C,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,YAAY,CAAC,kBAAkB,CAAC,CAAC;IAEjC,sBAAsB;IACtB,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACvC,UAAU,CAAC,4DAA4D,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,YAAY,CAAC,yBAAyB,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAE/B,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,SAAS,CAAC,MAAM,EAAE,WAAW,IAAI,iBAAiB,CAAC,CAAC;YACpD,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5C,aAAa,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,YAAY,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,QAAQ,EAAE,KAAK,QAAQ;QAAE,OAAO;IACpC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAE7B,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACzC,YAAY,CAAC,+BAA+B,CAAC,CAAC;QAC9C,SAAS,CACP,QAAQ,EACR,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,cAAc,EAAE,uBAAuB,CAAC,EACjF,cAAc,CACf,CAAC;IACJ,CAAC;IACD,YAAY,CAAC,gBAAgB,CAAC,CAAC;IAE/B,oFAAoF;IACpF,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAClG,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QACb,YAAY,CAAC,4CAA4C,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,gEAAgE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAgC;IACrD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,IAAI,CAAC,mDAAmD,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IACD,IAAI,CAAC,6BAA6B,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;IAEnD,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC5D,SAAS,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,kBAAkB,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,OAAO,EAAE,8BAA8B,CAAC;IAChE,SAAS,CACP,KAAK,EACL,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,EAC3F,sBAAsB,IAAI,CAAC,OAAO,EAAE,CACrC,CAAC;IAEF,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAChD,UAAU,CAAC,6DAA6D,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,YAAY,CAAC,kBAAkB,UAAU,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACxG,CAAC;AAED,qDAAqD;AACrD,SAAS,8BAA8B;IACrC,8DAA8D;IAC9D,yCAAyC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAClE,IAAI,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAE5C,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;IACvC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAgC;IAC5D,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,IAAI,CAAC,8EAA8E,CAAC,CAAC;IAErF,MAAM,gBAAgB,GAAG,8BAA8B,EAAE,CAAC;IAC1D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,YAAY,CAAC,oDAAoD,CAAC,CAAC;QACnE,YAAY,CAAC,uFAAuF,CAAC,CAAC;QACtG,OAAO;IACT,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,qBAAqB,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,YAAY,CAAC,iCAAiC,MAAM,aAAa,CAAC,CAAC;YACnE,SAAS;QACX,CAAC;QACD,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,oEAAoE;YACpE,4DAA4D;YAC5D,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;gBAChC,YAAY,CAAC,qEAAqE,CAAC,CAAC;YACtF,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,GAAG,MAAM,yCAAyC,CAAC,CAAC;gBAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,GAAG,MAAM,SAAS,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB;IACxB,IAAI,CAAC,gDAAgD,CAAC,CAAC;IAEvD,uEAAuE;IACvE,qEAAqE;IACrE,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7F,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,wCAAwC,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,IAAgC;IAC/C,IAAI,CAAC,MAAM,CAAC,CAAC;IACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBACP,IAAI,CAAC,OAAO;;;;;;;;;;;;CAY3B,CAAC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAA4C;IAE5C,MAAM,IAAI,GAA+B;QACvC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,mBAAmB;QAC/C,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,KAAK;QACzC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,KAAK;QACrD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,KAAK;KACtD,CAAC;IAEF,WAAW,CAAC,2BAA2B,CAAC,CAAC;IACzC,SAAS,CAAC,MAAM,EAAE,iFAAiF,CAAC,CAAC;IAErG,SAAS,CAAC,IAAI,CAAC,CAAC;IAChB,aAAa,EAAE,CAAC;IAChB,YAAY,EAAE,CAAC;IACf,aAAa,CAAC,IAAI,CAAC,CAAC;IACpB,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC3B,iBAAiB,EAAE,CAAC;IACpB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEd,YAAY,CAAC,oBAAoB,CAAC,CAAC;IACnC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,iCAAiC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;AACnF,CAAC"}

package/dist/lib/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAcH,eAAO,MAAM,SAAS,QAA2B,CAAC;AAClD,eAAO,MAAM,cAAc,QAA2B,CAAC;AACvD,eAAO,MAAM,gBAAgB,QAAiC,CAAC;AAE/D,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;AAEjD,MAAM,MAAM,UAAU,GAAG;IACvB,eAAe,EAAE,CAAC,CAAC;IACnB,IAAI,EAAE;QAAE,SAAS,EAAE,SAAS,CAAA;KAAE,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AA0DF;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CACxB,IAAI,GAAE;IACJ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CAC3B,GACL,UAAU,CAsCZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;CAAE,EAC/C,IAAI,GAAE;IACJ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CAC3B,GACL,UAAU,CAaZ"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAcH,eAAO,MAAM,SAAS,QAA2B,CAAC;AAClD,eAAO,MAAM,cAAc,QAA2B,CAAC;AACvD,eAAO,MAAM,gBAAgB,QAAiC,CAAC;AAE/D,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;AAEjD,MAAM,MAAM,UAAU,GAAG;IACvB,eAAe,EAAE,CAAC,CAAC;IACnB,IAAI,EAAE;QAAE,SAAS,EAAE,SAAS,CAAA;KAAE,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AA+DF;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CACxB,IAAI,GAAE;IACJ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CAC3B,GACL,UAAU,CAsCZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;CAAE,EAC/C,IAAI,GAAE;IACJ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CAC3B,GACL,UAAU,CAaZ"}

package/dist/lib/config.js

@@ -27,7 +27,12 @@ import { randomUUID } from 'node:crypto';
 export const OLAM_HOME = join(homedir(), '.olam');
 export const OLAM_STATE_DIR = join(OLAM_HOME, 'state');
 export const OLAM_CONFIG_PATH = join(OLAM_HOME, 'config.json');
-const DEFAULT_SUBSTRATE = 'compose';
+// k3s mode is the canonical olam substrate as of feat/cli-bootstrap-k3s-default
+// (2026-05-22). Fresh installs default to `kubernetes`; existing installs whose
+// ~/.olam/config.json explicitly carries `host.substrate: 'compose'` keep their
+// current behaviour (compose mode remains supported but is no longer the
+// default). To pin compose on a fresh install: `olam config set host.substrate compose`.
+const DEFAULT_SUBSTRATE = 'kubernetes';
 function makeDefaultConfig() {
     return {
         'config.schema': 1,

package/dist/lib/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AAClD,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AACvD,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;AAU/D,MAAM,iBAAiB,GAAc,SAAS,CAAC;AAE/C,SAAS,iBAAiB;IACxB,OAAO;QACL,eAAe,EAAE,CAAC;QAClB,IAAI,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE;QACtC,UAAU,EAAE,UAAU,EAAE;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,WAAmB,cAAc;IACvD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,IAAI,GAAG,CAAC,CAAC,IAA+B,CAAC;IAC/C,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAClF,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,KAAiB,EACjB,SAAgC,OAAO,CAAC,MAAM;IAE9C,cAAc,EAAE,CAAC;IACjB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAChF,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,UAAU,CAAC,GAAG,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;YAC1D,CAAC;QACH,CAAC;QACD,MAAM,CAAC,KAAK,CACV,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACzF,CAAC;QACF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,UAAU,CACxB,OAII,EAAE;IAEN,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAE7C,cAAc,CAAC,QAAQ,CAAC,CAAC;IAEzB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;QAClC,eAAe,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,mCAAmC,UAAU,KAC3C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,8BAA8B,CAC/B,CAAC;QACF,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;QAClC,eAAe,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,CACV,wCAAwC,UAAU,8BAA8B,CACjF,CAAC;QACF,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;QAClC,eAAe,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CACzB,OAA+C,EAC/C,OAII,EAAE;IAEN,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAEjC,MAAM,IAAI,GAAe;QACvB,eAAe,EAAE,CAAC;QAClB,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE;QAClD,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;IAEF,eAAe,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AAClD,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AACvD,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;AAU/D,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAChF,yEAAyE;AACzE,yFAAyF;AACzF,MAAM,iBAAiB,GAAc,YAAY,CAAC;AAElD,SAAS,iBAAiB;IACxB,OAAO;QACL,eAAe,EAAE,CAAC;QAClB,IAAI,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE;QACtC,UAAU,EAAE,UAAU,EAAE;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,WAAmB,cAAc;IACvD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,IAAI,GAAG,CAAC,CAAC,IAA+B,CAAC;IAC/C,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAClF,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,KAAiB,EACjB,SAAgC,OAAO,CAAC,MAAM;IAE9C,cAAc,EAAE,CAAC;IACjB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAChF,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,UAAU,CAAC,GAAG,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;YAC1D,CAAC;QACH,CAAC;QACD,MAAM,CAAC,KAAK,CACV,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACzF,CAAC;QACF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,UAAU,CACxB,OAII,EAAE;IAEN,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAE7C,cAAc,CAAC,QAAQ,CAAC,CAAC;IAEzB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;QAClC,eAAe,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,mCAAmC,UAAU,KAC3C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,8BAA8B,CAC/B,CAAC;QACF,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;QAClC,eAAe,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,CACV,wCAAwC,UAAU,8BAA8B,CACjF,CAAC;QACF,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;QAClC,eAAe,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CACzB,OAA+C,EAC/C,OAII,EAAE;IAEN,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAEjC,MAAM,IAAI,GAAe;QACvB,eAAe,EAAE,CAAC;QAClB,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE;QAClD,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;IAEF,eAAe,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC"}

package/hermes-bundle/version.json

@@ -1,4 +1,4 @@
 {
-  "bundledAt": "2026-05-22T05:49:33.599Z",
+  "bundledAt": "2026-05-22T07:50:42.070Z",
   "kgFirstSha": "29a9ccce1b115d049e375c4a90eb5cf7c123e610e2d0590270a4db2cdbc64a28"
 }

package/host-cp/k8s/manifests/50-deployment.yaml

@@ -111,7 +111,7 @@ spec:
         # k3d), started by `olam upgrade` Step 0.7 — not inside this Pod.
       containers:
         - name: olam-host-cp
-          image: ghcr.io/pleri/olam-host-cp@sha256:3bf4a89af3544e382bf2d708ff73baa6704cf91a0b509f8b1a153fbe603a4223
+          image: ghcr.io/pleri/olam-host-cp@sha256:a71a02ad25f03c1481d8b5a4f3cf50614eb1f9b02376935e4df5c65b9bd4fa8f
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/k8s/manifests/auth-service/50-deployment.yaml

@@ -70,7 +70,7 @@ spec:
               mountPath: /data
       containers:
         - name: olam-auth-service
-          image: ghcr.io/pleri/olam-auth@sha256:a7b1e4c0ddee4fc6bfb2689c4d23d8bc0fcc95bc7b42a28d977b990f1408505b
+          image: ghcr.io/pleri/olam-auth@sha256:7ad7f92e5feafff3921f3219886a2aec312d83e00c66eaa568e53aac03b19b16
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/k8s/manifests/kg-service/50-deployment.yaml

@@ -61,7 +61,7 @@ spec:
               mountPath: /data
       containers:
         - name: olam-kg-service
-          image: ghcr.io/pleri/olam-kg-service@sha256:72fdfb96981903cd83d0b6ad997985bad86a7892c0d1ec7c5dcc9b4d9f8f44db
+          image: ghcr.io/pleri/olam-kg-service@sha256:9c01fd288e136116abfd0e34c7230417a30c5036e411838b88a553c44a802f13
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/k8s/manifests/mcp-auth-service/50-deployment.yaml

@@ -68,7 +68,7 @@ spec:
               mountPath: /data
       containers:
         - name: olam-mcp-auth-service
-          image: ghcr.io/pleri/olam-mcp-auth@sha256:d8fb62e437142bf352e0d6f637c2b912baa592f25f4abbac1acc2c8cced976c2
+          image: ghcr.io/pleri/olam-mcp-auth@sha256:ddd15d5ee0b18ed36a8916c4d8d985182f6e32b57fc2625295f5db19a14b37a0
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

package/host-cp/k8s/manifests/memory-service/50-deployment.yaml

@@ -70,7 +70,7 @@ spec:
           # bootstrap-placeholder comment + run `npm run refresh:manifest-digests`
           # once ghcr.io/pleri/olam-memory-service has a real published digest.
           # bootstrap-placeholder: pre-publish; refresh after first release
-          image: ghcr.io/pleri/olam-memory-service@sha256:bc377f94911baff74f7b91c44ea471580fdfdc1947e757dd6f550675084312d6
+          image: ghcr.io/pleri/olam-memory-service@sha256:8dd1593af37b345a9b9b741803355254f1f719d9bf23e56339d9baed8dea9ac1
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true