@pleri/olam-cli 0.1.200 → 0.1.204

package/dist/commands/rekey.d.ts

@@ -1,84 +0,0 @@
-/**
- * `olam rekey <world-id>` — rotate the per-world postgres password.
- *
- * Phase A9 of `olam-hybrid-shared-postgres`. Phase A4 (commit 7b4334ff)
- * landed `applyPostgresWorldRole` which already supports rotation via
- * `ALTER ROLE` when the role exists. A9 exposes that rotation as a
- * standalone operator-facing command, useful when:
- *
- *   - The operator wants to force-rotate credentials (suspected leak).
- *   - A world container lost its env-injected password (e.g. crashed
- *     before the app read it).
- *   - A future tmpfs cred-mount flow needs a re-inject path.
- *
- * Flow:
- *   1. Load context + WorldManager.getWorld(worldId).
- *   2. Hybrid + DB gates (exit 3 if non-hybrid or no per-world DBs).
- *   3. `applyPostgresWorldRole(id, worldDbNames)` → ALTER ROLE rotates
- *      the password atomically. The old password is gone.
- *   4. Write new password to `~/.olam/worlds/<id>/credentials.json`
- *      (chmod 600).
- *   5. `docker restart olam-<id>-devbox` so the container picks up the
- *      new password from env on next process start.
- *   6. Audit-log line to `~/.olam/usage.log` (SEC-002): timestamp +
- *      world-id + "rekey" — NEVER the password.
- *
- * Exit codes:
- *   0  success
- *   1  unexpected error
- *   2  world not found
- *   3  precondition failed (non-hybrid, no DBs, etc.)
- */
-import type { Command } from 'commander';
-import { type PostgresWorldRoleResult } from '@olam/core/src/world/manager.js';
-import type { WorldMetadata } from '@olam/core/src/world/types.js';
-export interface RekeyOptions {
-    readonly print?: boolean;
-    readonly json?: boolean;
-}
-export interface RekeyResult {
-    readonly worldId: string;
-    readonly worldRoleName: string;
-    readonly password: string;
-    readonly credentialsPath: string;
-    readonly rotatedAt: string;
-    readonly containerRestarted: boolean;
-}
-/**
- * Minimal dependency surface used by {@link doRekey}. Pure-function
- * injection lets tests run without docker, without disk writes outside
- * the test's tmp dir, and without mocking modules.
- */
-export interface RekeyDeps {
-    readonly getWorld: (id: string) => WorldMetadata | undefined;
-    readonly applyPostgresWorldRole: (worldId: string, worldDbNames: ReadonlyArray<string>) => PostgresWorldRoleResult;
-    readonly restartContainer: (containerName: string) => {
-        ok: boolean;
-        stderr: string;
-    };
-    /** Override for tests. Default: real fs + ~/.olam. */
-    readonly olamHomeDir: () => string;
-    readonly now: () => Date;
-    /** Stream for human-readable lines (overridable for tests). */
-    readonly stdout: {
-        write(s: string): void;
-    };
-    /** Audit-log appender; default writes to `${olamHomeDir()}/usage.log`. */
-    readonly appendAuditLog: (line: string) => void;
-}
-/** Domain-specific error carrying the documented exit code. */
-export declare class RekeyError extends Error {
-    readonly exitCode: number;
-    constructor(message: string, exitCode: number);
-}
-/**
- * Core rekey logic. Returns the rotation result on success, throws
- * {@link RekeyError} with the documented exit code on failure.
- *
- * The password is held in this function's local binding and the
- * returned object only; it is written to disk with mode 0o600 and
- * NEVER logged or written to the audit trail (SEC-002).
- */
-export declare function doRekey(worldId: string, deps: RekeyDeps): Promise<RekeyResult>;
-export declare function registerRekey(program: Command): void;
-//# sourceMappingURL=rekey.d.ts.map

package/dist/commands/rekey.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rekey.d.ts","sourceRoot":"","sources":["../../src/commands/rekey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAcnE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,aAAa,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,sBAAsB,EAAE,CAC/B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,KAChC,uBAAuB,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACtF,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,MAAM,CAAC;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC5C,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACjD;AAsCD,+DAA+D;AAC/D,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACd,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAK9C;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,WAAW,CAAC,CA0EtB;AAuBD,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqCpD"}

package/dist/commands/rekey.js

@@ -1,209 +0,0 @@
-/**
- * `olam rekey <world-id>` — rotate the per-world postgres password.
- *
- * Phase A9 of `olam-hybrid-shared-postgres`. Phase A4 (commit 7b4334ff)
- * landed `applyPostgresWorldRole` which already supports rotation via
- * `ALTER ROLE` when the role exists. A9 exposes that rotation as a
- * standalone operator-facing command, useful when:
- *
- *   - The operator wants to force-rotate credentials (suspected leak).
- *   - A world container lost its env-injected password (e.g. crashed
- *     before the app read it).
- *   - A future tmpfs cred-mount flow needs a re-inject path.
- *
- * Flow:
- *   1. Load context + WorldManager.getWorld(worldId).
- *   2. Hybrid + DB gates (exit 3 if non-hybrid or no per-world DBs).
- *   3. `applyPostgresWorldRole(id, worldDbNames)` → ALTER ROLE rotates
- *      the password atomically. The old password is gone.
- *   4. Write new password to `~/.olam/worlds/<id>/credentials.json`
- *      (chmod 600).
- *   5. `docker restart olam-<id>-devbox` so the container picks up the
- *      new password from env on next process start.
- *   6. Audit-log line to `~/.olam/usage.log` (SEC-002): timestamp +
- *      world-id + "rekey" — NEVER the password.
- *
- * Exit codes:
- *   0  success
- *   1  unexpected error
- *   2  world not found
- *   3  precondition failed (non-hybrid, no DBs, etc.)
- */
-import { spawnSync as defaultSpawnSync } from 'node:child_process';
-import * as fs from 'node:fs';
-import * as os from 'node:os';
-import * as path from 'node:path';
-import { applyPostgresWorldRole as defaultApplyPostgresWorldRole, } from '@olam/core/src/world/manager.js';
-import { loadContext } from '../context.js';
-import { printError, printSuccess, printInfo, printHeader } from '../output.js';
-/** Container name convention — mirrors enter.ts:286, refresh.ts:90, ps.ts:157. */
-function devboxContainerName(worldId) {
-    return `olam-${worldId}-devbox`;
-}
-/** Resolve `~/.olam` honoring OLAM_HOME (mirrors host-cp.ts:55). */
-function olamHomeDir() {
-    return process.env['OLAM_HOME'] ?? path.join(os.homedir(), '.olam');
-}
-function defaultRestartContainer(name, spawn = defaultSpawnSync) {
-    // 30s graceful-stop window matches refresh.ts:41 (RESTART_TIMEOUT_S).
-    const r = spawn('docker', ['restart', '--time', '30', name], {
-        encoding: 'utf-8',
-        stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    return {
-        ok: r.status === 0 && r.error === undefined,
-        stderr: (r.stderr || '').trim() || (r.stdout || '').trim(),
-    };
-}
-function defaultAppendAuditLog(homeDir, line) {
-    fs.mkdirSync(homeDir, { recursive: true });
-    fs.appendFileSync(path.join(homeDir, 'usage.log'), line.endsWith('\n') ? line : line + '\n', {
-        encoding: 'utf-8',
-    });
-}
-function buildDefaultDeps() {
-    return {
-        // Replaced inside `registerRekey` once the context is loaded; the
-        // default here keeps the type contract self-consistent.
-        getWorld: () => undefined,
-        applyPostgresWorldRole: (id, dbs) => defaultApplyPostgresWorldRole(id, dbs),
-        restartContainer: (name) => defaultRestartContainer(name),
-        olamHomeDir,
-        now: () => new Date(),
-        stdout: { write: (s) => process.stdout.write(s) },
-        appendAuditLog: (line) => defaultAppendAuditLog(olamHomeDir(), line),
-    };
-}
-/** Domain-specific error carrying the documented exit code. */
-export class RekeyError extends Error {
-    exitCode;
-    constructor(message, exitCode) {
-        super(message);
-        this.name = 'RekeyError';
-        this.exitCode = exitCode;
-    }
-}
-/**
- * Core rekey logic. Returns the rotation result on success, throws
- * {@link RekeyError} with the documented exit code on failure.
- *
- * The password is held in this function's local binding and the
- * returned object only; it is written to disk with mode 0o600 and
- * NEVER logged or written to the audit trail (SEC-002).
- */
-export async function doRekey(worldId, deps) {
-    const world = deps.getWorld(worldId);
-    if (!world) {
-        throw new RekeyError(`world not found: ${worldId}`, 2);
-    }
-    if (world.worldRoleName === undefined) {
-        throw new RekeyError(`world ${worldId} is not hybrid-mode (no per-world role). ` +
-            '`olam rekey` only applies to hybrid-mode worlds; use the bridge ' +
-            "postgres's `development` user.", 3);
-    }
-    if (world.worldDbNames === undefined || world.worldDbNames.length === 0) {
-        throw new RekeyError('world has no per-world DBs to rotate role on', 3);
-    }
-    // 1. Rotate. ALTER ROLE inside applyPostgresWorldRole is idempotent —
-    //    the same function handles both initial create and rotation.
-    const { worldRoleName, password } = deps.applyPostgresWorldRole(worldId, world.worldDbNames);
-    // 2. Persist credentials BEFORE restart so the container always has a
-    //    valid file to consult if env-injection ever moves to file-mount.
-    const rotatedAt = deps.now().toISOString();
-    const homeDir = deps.olamHomeDir();
-    const worldDir = path.join(homeDir, 'worlds', worldId);
-    fs.mkdirSync(worldDir, { recursive: true });
-    const credentialsPath = path.join(worldDir, 'credentials.json');
-    const payload = {
-        worldRoleName,
-        password,
-        rotatedAt,
-    };
-    // chmod 600 — owner read/write only. Order matters: create empty file
-    // first, fchmod, THEN write. `writeFileSync({ mode })` only applies on
-    // initial create, so re-rotations on an existing file keep the old
-    // mode if we skip the explicit chmod.
-    fs.writeFileSync(credentialsPath, JSON.stringify(payload, null, 2) + '\n', {
-        encoding: 'utf-8',
-        mode: 0o600,
-    });
-    fs.chmodSync(credentialsPath, 0o600);
-    // 3. Restart the world devbox container so the (env-injected)
-    //    password reload happens. Failure here is reported but the
-    //    rotation itself is already durable in postgres.
-    const restart = deps.restartContainer(devboxContainerName(worldId));
-    // Container restart is best-effort; rotation already landed in pg.
-    // 4. Audit-log line — NO password. SEC-002 closure.
-    deps.appendAuditLog(`${rotatedAt} ${worldId} rekey`);
-    if (!restart.ok) {
-        // Surface the restart failure in stderr; caller can re-run
-        // `docker restart olam-<id>-devbox` manually. Exit code stays 0
-        // because the credential rotation succeeded.
-        process.stderr.write(`warn: docker restart ${devboxContainerName(worldId)} failed (` +
-            `${restart.stderr || 'unknown'}). Run it manually to pick up the new ` +
-            'password.\n');
-    }
-    return {
-        worldId,
-        worldRoleName,
-        password,
-        credentialsPath,
-        rotatedAt,
-        containerRestarted: restart.ok,
-    };
-}
-function emitJson(stdout, result) {
-    stdout.write(JSON.stringify(result, null, 2) + '\n');
-}
-function emitHuman(result, opts) {
-    printHeader(`Rotated credentials for ${result.worldId}`);
-    printInfo('role', result.worldRoleName);
-    printInfo('credentials', result.credentialsPath);
-    printInfo('rotated', result.rotatedAt);
-    printInfo('container', result.containerRestarted ? 'restarted' : 'restart failed (see stderr)');
-    if (opts.print) {
-        // Plain stdout (no `printInfo` decorator) so the password can be
-        // piped: `olam rekey <id> --print | tail -n1`.
-        process.stdout.write(result.password + '\n');
-    }
-    printSuccess(`Run \`olam enter ${result.worldId}\` to verify the new password works`);
-}
-export function registerRekey(program) {
-    program
-        .command('rekey')
-        .description('Rotate the per-world postgres password for a hybrid-mode world')
-        .argument('<world-id>', 'World ID (e.g. iron-bay-3122)')
-        .option('--print', 'Also print the new password to stdout (default: write to file only)')
-        .option('--json', 'Emit the rotation result as JSON')
-        .action(async (worldId, opts) => {
-        const { ctx, error } = await loadContext();
-        if (!ctx) {
-            printError(error?.message ?? 'Olam is not configured. Run `olam init` first.');
-            process.exitCode = 1;
-            return;
-        }
-        const deps = {
-            ...buildDefaultDeps(),
-            getWorld: (id) => ctx.worldManager.getWorld(id),
-        };
-        try {
-            const result = await doRekey(worldId, deps);
-            if (opts.json) {
-                emitJson(deps.stdout, result);
-            }
-            else {
-                emitHuman(result, opts);
-            }
-        }
-        catch (err) {
-            if (err instanceof RekeyError) {
-                printError(err.message);
-                process.exitCode = err.exitCode;
-                return;
-            }
-            printError(err instanceof Error ? err.message : String(err));
-            process.exitCode = 1;
-        }
-    });
-}
-//# sourceMappingURL=rekey.js.map

package/dist/commands/rekey.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rekey.js","sourceRoot":"","sources":["../../src/commands/rekey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAAyB,MAAM,oBAAoB,CAAC;AAC1F,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EACL,sBAAsB,IAAI,6BAA6B,GAExD,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhF,kFAAkF;AAClF,SAAS,mBAAmB,CAAC,OAAe;IAC1C,OAAO,QAAQ,OAAO,SAAS,CAAC;AAClC,CAAC;AAED,oEAAoE;AACpE,SAAS,WAAW;IAClB,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AACtE,CAAC;AAqCD,SAAS,uBAAuB,CAC9B,IAAY,EACZ,QAAiC,gBAAgB;IAEjD,sEAAsE;IACtE,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;QAC3D,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAA6B,CAAC;IAC/B,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAC3C,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;KAC3D,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe,EAAE,IAAY;IAC1D,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,EAAE;QAC3F,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO;QACL,kEAAkE;QAClE,wDAAwD;QACxD,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS;QACzB,sBAAsB,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,6BAA6B,CAAC,EAAE,EAAE,GAAG,CAAC;QAC3E,gBAAgB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC;QACzD,WAAW;QACX,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QACrB,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QACjD,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,OAAO,UAAW,SAAQ,KAAK;IAC1B,QAAQ,CAAS;IAC1B,YAAY,OAAe,EAAE,QAAgB;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAAe,EACf,IAAe;IAEf,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,UAAU,CAAC,oBAAoB,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,UAAU,CAClB,SAAS,OAAO,2CAA2C;YACzD,kEAAkE;YAClE,gCAAgC,EAClC,CAAC,CACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,UAAU,CAAC,8CAA8C,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,sEAAsE;IACtE,iEAAiE;IACjE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,sBAAsB,CAC7D,OAAO,EACP,KAAK,CAAC,YAAY,CACnB,CAAC;IAEF,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG;QACd,aAAa;QACb,QAAQ;QACR,SAAS;KACV,CAAC;IACF,sEAAsE;IACtE,uEAAuE;IACvE,mEAAmE;IACnE,sCAAsC;IACtC,EAAE,CAAC,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;QACzE,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAErC,8DAA8D;IAC9D,+DAA+D;IAC/D,qDAAqD;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,mEAAmE;IAEnE,oDAAoD;IACpD,IAAI,CAAC,cAAc,CAAC,GAAG,SAAS,IAAI,OAAO,QAAQ,CAAC,CAAC;IAErD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,2DAA2D;QAC3D,gEAAgE;QAChE,6CAA6C;QAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wBAAwB,mBAAmB,CAAC,OAAO,CAAC,WAAW;YAC7D,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,wCAAwC;YACtE,aAAa,CAChB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO;QACP,aAAa;QACb,QAAQ;QACR,eAAe;QACf,SAAS;QACT,kBAAkB,EAAE,OAAO,CAAC,EAAE;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,MAAkC,EAAE,MAAmB;IACvE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,SAAS,CAChB,MAAmB,EACnB,IAAkB;IAElB,WAAW,CAAC,2BAA2B,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IACxC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IACjD,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACvC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC;IAChG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,iEAAiE;QACjE,+CAA+C;QAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC/C,CAAC;IACD,YAAY,CAAC,oBAAoB,MAAM,CAAC,OAAO,qCAAqC,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,gEAAgE,CAAC;SAC7E,QAAQ,CAAC,YAAY,EAAE,+BAA+B,CAAC;SACvD,MAAM,CAAC,SAAS,EAAE,qEAAqE,CAAC;SACxF,MAAM,CAAC,QAAQ,EAAE,kCAAkC,CAAC;SACpD,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,IAAkB,EAAE,EAAE;QACpD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,UAAU,CAAC,KAAK,EAAE,OAAO,IAAI,gDAAgD,CAAC,CAAC;YAC/E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAc;YACtB,GAAG,gBAAgB,EAAE;YACrB,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;SAChD,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;gBAC9B,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACxB,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,UAAU,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/repos-list-json.d.ts

@@ -1,58 +0,0 @@
-/**
- * Pure JSON serialiser for `olam repos list --json`.
- *
- * Kept separate from the command action so the wire contract is
- * unit-testable without a filesystem round-trip (mirrors the pattern
- * used by `auth-list-json.ts`, `renderPsJson` in ps.ts, and
- * `servicesStatusJson` in services.ts).
- *
- * WHY this exists: agent/script drivers (CI pipelines, Rico, flywheel
- * chain skills) need to discover registered repo paths before spawning
- * worlds or dispatching work with `--repo`. The human table is colorized
- * and reflows per terminal width, so scraping it is brittle and breaks
- * when column widths change. This serialiser gives drivers a stable,
- * color-free array: each entry carries the name, resolved path, and
- * optional metadata needed to pick a repo without re-querying the registry.
- *
- * Secret redaction: the optional `url` field can carry HTTPS credentials
- * in the URL userinfo component (e.g. `https://token:x-oauth-basic@github.com/...`).
- * The serialiser redacts userinfo credentials with `***` before emitting,
- * matching the same pattern used by `olam skills source list --json`.
- * The `path` field is a local filesystem path and carries no secrets.
- */
-import type { RepoEntry } from '@olam/core/src/global-config/schema.js';
-/**
- * Per-repo row in the `repos list --json` payload.
- * Field names are load-bearing — add new fields freely, never rename.
- */
-export interface RepoListJsonEntry {
-    /** Registered repo name (lowercase, digits, dash). */
-    readonly name: string;
-    /** Resolved absolute filesystem path (may still be tilde-prefixed when stored as such). */
-    readonly path: string;
-    /**
-     * Git remote URL, if registered, with credentials redacted.
-     * null when the entry has no url field.
-     */
-    readonly url: string | null;
-    /** Optional human-readable description. */
-    readonly description: string | null;
-    /** Default branch name (e.g. "main"). null when not set. */
-    readonly defaultBranch: string | null;
-    /** Unix epoch ms when the entry was first registered. */
-    readonly addedAt: number;
-    /** Unix epoch ms of the last update. */
-    readonly updatedAt: number;
-}
-/** Top-level shape emitted by `olam repos list --json`. */
-export interface ReposListJson {
-    /** Number of registered repos. */
-    readonly count: number;
-    readonly repos: readonly RepoListJsonEntry[];
-}
-/**
- * Serialise the global repo registry to the stable `--json` wire shape.
- * Returns a JSON string (no trailing newline — caller adds it).
- */
-export declare function renderReposListJson(entries: readonly RepoEntry[]): string;
-//# sourceMappingURL=repos-list-json.d.ts.map

package/dist/commands/repos-list-json.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"repos-list-json.d.ts","sourceRoot":"","sources":["../../src/commands/repos-list-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAGxE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,sDAAsD;IACtD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2FAA2F;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,2CAA2C;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wCAAwC;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,2DAA2D;AAC3D,MAAM,WAAW,aAAa;IAC5B,kCAAkC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC9C;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,CAkBzE"}

package/dist/commands/repos-list-json.js

@@ -1,45 +0,0 @@
-/**
- * Pure JSON serialiser for `olam repos list --json`.
- *
- * Kept separate from the command action so the wire contract is
- * unit-testable without a filesystem round-trip (mirrors the pattern
- * used by `auth-list-json.ts`, `renderPsJson` in ps.ts, and
- * `servicesStatusJson` in services.ts).
- *
- * WHY this exists: agent/script drivers (CI pipelines, Rico, flywheel
- * chain skills) need to discover registered repo paths before spawning
- * worlds or dispatching work with `--repo`. The human table is colorized
- * and reflows per terminal width, so scraping it is brittle and breaks
- * when column widths change. This serialiser gives drivers a stable,
- * color-free array: each entry carries the name, resolved path, and
- * optional metadata needed to pick a repo without re-querying the registry.
- *
- * Secret redaction: the optional `url` field can carry HTTPS credentials
- * in the URL userinfo component (e.g. `https://token:x-oauth-basic@github.com/...`).
- * The serialiser redacts userinfo credentials with `***` before emitting,
- * matching the same pattern used by `olam skills source list --json`.
- * The `path` field is a local filesystem path and carries no secrets.
- */
-import { redactUrl } from '@olam/core/src/skill-sources/index.js';
-/**
- * Serialise the global repo registry to the stable `--json` wire shape.
- * Returns a JSON string (no trailing newline — caller adds it).
- */
-export function renderReposListJson(entries) {
-    const rows = entries.map((e) => ({
-        name: e.name,
-        path: e.path,
-        // Redact credentials from URL userinfo (e.g. `https://token:x@host` → `https://token:***@host`).
-        url: e.url != null ? redactUrl(e.url) : null,
-        description: e.description ?? null,
-        defaultBranch: e.defaultBranch ?? null,
-        addedAt: e.addedAt,
-        updatedAt: e.updatedAt,
-    }));
-    const payload = {
-        count: rows.length,
-        repos: rows,
-    };
-    return JSON.stringify(payload);
-}
-//# sourceMappingURL=repos-list-json.js.map

package/dist/commands/repos-list-json.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"repos-list-json.js","sourceRoot":"","sources":["../../src/commands/repos-list-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAiClE;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,IAAI,GAAwB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,iGAAiG;QACjG,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;QAC5C,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;QAClC,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,IAAI;QACtC,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC,CAAC,CAAC;IAEJ,MAAM,OAAO,GAAkB;QAC7B,KAAK,EAAE,IAAI,CAAC,MAAM;QAClB,KAAK,EAAE,IAAI;KACZ,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC"}

package/dist/commands/repos.d.ts

@@ -1,11 +0,0 @@
-/**
- * olam repos — manage the global repo registry (~/.olam/config.json).
- *
- *   olam repos list [--json]
- *   olam repos add --name <n> --path <p> [--description <d>] [--default-branch <b>]
- *   olam repos remove <name>
- *   olam repos update <name> [--path <p>] [--description <d>] [--default-branch <b>]
- */
-import type { Command } from 'commander';
-export declare function registerRepos(program: Command): void;
-//# sourceMappingURL=repos.d.ts.map

package/dist/commands/repos.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"repos.d.ts","sourceRoot":"","sources":["../../src/commands/repos.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAezC,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAwFpD"}

package/dist/commands/repos.js

@@ -1,102 +0,0 @@
-/**
- * olam repos — manage the global repo registry (~/.olam/config.json).
- *
- *   olam repos list [--json]
- *   olam repos add --name <n> --path <p> [--description <d>] [--default-branch <b>]
- *   olam repos remove <name>
- *   olam repos update <name> [--path <p>] [--description <d>] [--default-branch <b>]
- */
-import pc from 'picocolors';
-import { listRepos, addRepo, removeRepo, updateRepo, } from '@olam/core/src/global-config/index.js';
-import { printError, printSuccess, printHeader } from '../output.js';
-import { renderReposListJson } from './repos-list-json.js';
-function asMessage(err) {
-    return err instanceof Error ? err.message : String(err);
-}
-export function registerRepos(program) {
-    const repos = program
-        .command('repos')
-        .description('Manage the global repo registry');
-    repos
-        .command('list')
-        .description('List all registered repos')
-        .option('--json', 'Emit a machine-readable JSON object instead of the human table', false)
-        .action((opts) => {
-        const all = listRepos();
-        // --json: stable, scriptable contract. Always an object with a `repos` array
-        // (empty when no repos registered). Consumers gate on `count`; drivers
-        // iterate `repos[].name` + `repos[].path` to pick a repo for `--repo` flags.
-        // url credentials are redacted before emission (`:***@` substitution).
-        if (opts.json) {
-            process.stdout.write(renderReposListJson(all) + '\n');
-            return;
-        }
-        if (all.length === 0) {
-            console.log(pc.dim('0 repo(s) registered. Add one with: olam repos add --name <n> --path <p>'));
-            return;
-        }
-        printHeader(`${all.length} repo(s)`);
-        for (const r of all) {
-            const when = new Date(r.addedAt).toISOString().slice(0, 10);
-            console.log(`  ${pc.bold(r.name.padEnd(24))} ${r.path.padEnd(48)} ${pc.dim(when)}`);
-        }
-    });
-    repos
-        .command('add')
-        .description('Register a local repo path')
-        .requiredOption('--name <name>', 'Repo name (lowercase, digits, dash)')
-        .requiredOption('--path <path>', 'Absolute or ~/... path to the local repo')
-        .option('--description <desc>', 'Optional human-readable description')
-        .option('--default-branch <branch>', 'Default branch name (e.g. main)')
-        .action((opts) => {
-        try {
-            const entry = addRepo({
-                name: opts.name,
-                path: opts.path,
-                description: opts.description,
-                defaultBranch: opts.defaultBranch,
-            });
-            printSuccess(`registered repo "${entry.name}" at ${entry.path}`);
-        }
-        catch (err) {
-            printError(asMessage(err));
-            process.exitCode = 1;
-        }
-    });
-    repos
-        .command('remove')
-        .description('Remove a repo from the registry')
-        .argument('<name>', 'Repo name to remove')
-        .action((name) => {
-        try {
-            removeRepo(name);
-            printSuccess(`removed repo "${name}"`);
-        }
-        catch (err) {
-            printError(asMessage(err));
-            process.exitCode = 1;
-        }
-    });
-    repos
-        .command('update')
-        .description('Update a registered repo')
-        .argument('<name>', 'Repo name to update')
-        .option('--path <path>', 'New path')
-        .option('--description <desc>', 'New description')
-        .option('--default-branch <branch>', 'New default branch')
-        .action((name, opts) => {
-        try {
-            const entry = updateRepo(name, {
-                path: opts.path,
-                description: opts.description,
-                defaultBranch: opts.defaultBranch,
-            });
-            printSuccess(`updated repo "${entry.name}"`);
-        }
-        catch (err) {
-            printError(asMessage(err));
-            process.exitCode = 1;
-        }
-    });
-}
-//# sourceMappingURL=repos.js.map

package/dist/commands/repos.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"repos.js","sourceRoot":"","sources":["../../src/commands/repos.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EACL,SAAS,EACT,OAAO,EACP,UAAU,EACV,UAAU,GACX,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,MAAM,KAAK,GAAG,OAAO;SAClB,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,iCAAiC,CAAC,CAAC;IAElD,KAAK;SACF,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,2BAA2B,CAAC;SACxC,MAAM,CAAC,QAAQ,EAAE,gEAAgE,EAAE,KAAK,CAAC;SACzF,MAAM,CAAC,CAAC,IAAuB,EAAE,EAAE;QAClC,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QACxB,6EAA6E;QAC7E,uEAAuE;QACvE,6EAA6E;QAC7E,uEAAuE;QACvE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC,CAAC;YAChG,OAAO;QACT,CAAC;QACD,WAAW,CAAC,GAAG,GAAG,CAAC,MAAM,UAAU,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5D,OAAO,CAAC,GAAG,CACT,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACvE,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,4BAA4B,CAAC;SACzC,cAAc,CAAC,eAAe,EAAE,qCAAqC,CAAC;SACtE,cAAc,CAAC,eAAe,EAAE,0CAA0C,CAAC;SAC3E,MAAM,CAAC,sBAAsB,EAAE,qCAAqC,CAAC;SACrE,MAAM,CAAC,2BAA2B,EAAE,iCAAiC,CAAC;SACtE,MAAM,CAAC,CAAC,IAAkF,EAAE,EAAE;QAC7F,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,OAAO,CAAC;gBACpB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC,CAAC,CAAC;YACH,YAAY,CAAC,oBAAoB,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,iCAAiC,CAAC;SAC9C,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;SACzC,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;QACvB,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,YAAY,CAAC,iBAAiB,IAAI,GAAG,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0BAA0B,CAAC;SACvC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;SACzC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;SACnC,MAAM,CAAC,sBAAsB,EAAE,iBAAiB,CAAC;SACjD,MAAM,CAAC,2BAA2B,EAAE,oBAAoB,CAAC;SACzD,MAAM,CAAC,CAAC,IAAY,EAAE,IAAqE,EAAE,EAAE;QAC9F,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC,CAAC,CAAC;YACH,YAAY,CAAC,iBAAiB,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/restart.d.ts

@@ -1,18 +0,0 @@
-/**
- * olam restart <world> — Restart a world container, auto-building the
- * agent-stream bundle first when the host dist is stale.
- *
- * Phase B2 (olam-world-bundle-freshness): closes the silent-staleness
- * loop where operators run `olam restart` expecting a fresh bundle but
- * instead get the image-baked dist from the last docker build.
- *
- * With Phase B1's bind-mount overlay, the freshly-built dist is
- * immediately visible inside the restarted container — no docker cp
- * required.
- *
- * Fast path (dist current): ≤ 15s.
- * Slow path (dist absent or stale): ≤ 90s (dominated by tsc compile).
- */
-import type { Command } from 'commander';
-export declare function registerRestart(program: Command): void;
-//# sourceMappingURL=restart.d.ts.map

package/dist/commands/restart.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"restart.d.ts","sourceRoot":"","sources":["../../src/commands/restart.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAmCzC,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAuEtD"}