@pleri/olam-cli 0.1.200 → 0.1.204

package/dist/lib/kubectl-context.js

@@ -1,105 +0,0 @@
-/**
- * kubectl-context.ts — shared kubectl-context resolver.
- *
- * Single source of truth for the D1 / SEC-NEW-003 context-resolution
- * policy. Extracted so `upgrade-kubernetes.ts`, `auth-refresh-kubernetes.ts`,
- * `services.ts`, and any future kubernetes-substrate consumer can call the
- * same helper instead of duplicating it.
- *
- * Policy (matches the pre-existing auth-refresh-kubernetes.ts and services.ts
- * behaviour — see also docs/architecture/peripheral-services-on-k3s.md):
- *
- *   1. `host.kubectl_context_pinned` in `~/.olam/config.json` (preferred,
- *      persistent — the doc-recommended way).
- *   2. `OLAM_K8S_CONTEXT_ACK` env var (deprecated fallback; emits a
- *      deprecation warning to nudge operators toward (1)).
- *   3. Both absent → error result with actionable remediation.
- *
- * No `fs` reads in this module beyond what `readConfig` does; no kubectl
- * invocations. Pure resolution. Safe to call from any layer.
- */
-import { readConfig, writeConfig } from './config.js';
-import { defaultGetContexts, isOlamManagedContext } from './k8s-context-discovery.js';
-const DEPRECATION_WARNING = 'OLAM_K8S_CONTEXT_ACK is deprecated; set host.kubectl_context_pinned in ~/.olam/config.json';
-const NO_CONTEXT_ERROR = 'kubectl_context_pinned is not set in ~/.olam/config.json and OLAM_K8S_CONTEXT_ACK is not set.\n' +
-    '  Set it with: olam config set host.kubectl_context_pinned <your-kubectl-context>\n' +
-    '  List candidates with: kubectl config get-contexts -o name';
-/**
- * Canonical kubectl context provisioned by `olam setup` / `olam up` — the
- * k3d cluster named by `DEFAULT_K3S_CLUSTER` (`olam-host`) surfaces as the
- * context `k3d-olam-host`. Defined locally (rather than imported from
- * bootstrap-kubernetes.ts) to avoid a module cycle; kept in sync via this
- * comment. When present among the operator's contexts, auto-pin prefers it.
- */
-export const CANONICAL_K3S_CONTEXT = 'k3d-olam-host';
-/**
- * Resolve the operator's kubectl context name. See module docstring for policy.
- *
- * `configPath` lets callers (and tests) point at a non-default config file.
- * Returns a `KubectlContextResolution` — callers branch on `error` vs `context`.
- */
-export function resolveKubectlContext(configPath) {
-    const cfg = readConfig({ configPath });
-    const raw = cfg.host['kubectl_context_pinned'];
-    if (typeof raw === 'string' && raw.length > 0) {
-        return { context: raw };
-    }
-    const ack = process.env['OLAM_K8S_CONTEXT_ACK'];
-    if (typeof ack === 'string' && ack.length > 0) {
-        return { context: ack, deprecationWarning: DEPRECATION_WARNING };
-    }
-    return { error: NO_CONTEXT_ERROR };
-}
-function buildNoAutoPinError(olamContexts) {
-    if (olamContexts.length === 0) {
-        return ('No kubectl context is pinned and none could be auto-detected.\n' +
-            '  No k3d-olam-* context exists yet — provision one with: olam setup\n' +
-            '  Or pin an existing context manually:\n' +
-            '    olam config set host.kubectl_context_pinned <your-kubectl-context>\n' +
-            '  (list candidates with: kubectl config get-contexts -o name)');
-    }
-    return ('No kubectl context is pinned and auto-pin is ambiguous.\n' +
-        `  Found ${olamContexts.length} olam-managed contexts: ${olamContexts.join(', ')}\n` +
-        '  Pick one explicitly:\n' +
-        `    olam config set host.kubectl_context_pinned ${olamContexts[0]}`);
-}
-/**
- * Resolve the kubectl context, auto-pinning when it can be done unambiguously.
- *
- * Unlike the pure `resolveKubectlContext`, this helper is allowed to (a) shell
- * out to `kubectl` to enumerate contexts and (b) persist a pin to
- * `~/.olam/config.json`. It exists so the onboarding flow (`olam upgrade`)
- * helps the operator resolve a missing pin instead of dead-ending.
- *
- * Policy:
- *   - Already pinned / `OLAM_K8S_CONTEXT_ACK` set → return it, write nothing.
- *   - Exactly the canonical `k3d-olam-host` present → pin it.
- *   - Exactly one `k3d-olam-*` context present → pin it.
- *   - Zero or multiple non-canonical `k3d-olam-*` → return an actionable error
- *     listing the candidates and the exact `olam config set` command.
- */
-export function autoPinKubectlContext(deps = {}) {
-    const existing = resolveKubectlContext(deps.configPath);
-    if (existing.context !== undefined) {
-        return { context: existing.context };
-    }
-    const getContexts = deps.getContexts ?? defaultGetContexts;
-    const writeConfigFn = deps.writeConfigFn ?? writeConfig;
-    const olamContexts = getContexts().filter(isOlamManagedContext);
-    let chosen;
-    if (olamContexts.includes(CANONICAL_K3S_CONTEXT)) {
-        chosen = CANONICAL_K3S_CONTEXT;
-    }
-    else if (olamContexts.length === 1) {
-        chosen = olamContexts[0];
-    }
-    if (chosen === undefined) {
-        return { error: buildNoAutoPinError(olamContexts) };
-    }
-    writeConfigFn({ host: { kubectl_context_pinned: chosen } }, { configPath: deps.configPath });
-    return {
-        context: chosen,
-        autoPinnedMessage: `auto-pinned kubectl context "${chosen}" → ~/.olam/config.json (host.kubectl_context_pinned)`,
-    };
-}
-//# sourceMappingURL=kubectl-context.js.map

package/dist/lib/kubectl-context.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"kubectl-context.js","sourceRoot":"","sources":["../../src/lib/kubectl-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAatF,MAAM,mBAAmB,GACvB,4FAA4F,CAAC;AAE/F,MAAM,gBAAgB,GACpB,iGAAiG;IACjG,qFAAqF;IACrF,6DAA6D,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAErD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAmB;IACvD,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IACvC,MAAM,GAAG,GAAI,GAAG,CAAC,IAAgC,CAAC,wBAAwB,CAAC,CAAC;IAE5E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAChD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;AACrC,CAAC;AA4BD,SAAS,mBAAmB,CAAC,YAA+B;IAC1D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,CACL,iEAAiE;YACjE,uEAAuE;YACvE,0CAA0C;YAC1C,0EAA0E;YAC1E,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,CACL,2DAA2D;QAC3D,WAAW,YAAY,CAAC,MAAM,2BAA2B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACpF,0BAA0B;QAC1B,mDAAmD,YAAY,CAAC,CAAC,CAAC,EAAE,CACrE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAoB,EAAE;IAC1D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,WAAW,CAAC;IAExD,MAAM,YAAY,GAAG,WAAW,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAEhE,IAAI,MAA0B,CAAC;IAC/B,IAAI,YAAY,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACjD,MAAM,GAAG,qBAAqB,CAAC;IACjC,CAAC;SAAM,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,YAAY,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,aAAa,CAAC,EAAE,IAAI,EAAE,EAAE,sBAAsB,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC7F,OAAO;QACL,OAAO,EAAE,MAAM;QACf,iBAAiB,EAAE,gCAAgC,MAAM,uDAAuD;KACjH,CAAC;AACJ,CAAC"}

package/dist/lib/kubectl-wrap.d.ts

@@ -1,65 +0,0 @@
-/**
- * kubectl-wrap.ts — subprocess timeout wrapper for kubectl invocations.
- *
- * Phase 1b C1 of olam-host-suite-phase-1b-k3s-beta-flavour (plan
- * ~/.claude/plans/olam-host-suite-phase-1b-k3s-beta-flavour.md).
- *
- * ALL kubectl invocations in olam-cli MUST go through `kubectlWrap`.
- * Direct `child_process.spawn('kubectl', ...)` calls outside this module
- * break the timeout guarantee and fail `audit:kubectl-callers` (Seam C1).
- *
- * Timeout lifecycle:
- *   1. Spawn kubectl with the provided args.
- *   2. Start wall-clock timer (default 120 000 ms; per-call configurable).
- *   3. On timer fire: SIGTERM the process; wait 5 000 ms; SIGKILL if still alive.
- *   4. Returns { ok: false, reason: 'timeout', … } immediately after the kill
- *      sequence completes (does not wait further for exit after SIGKILL).
- *
- * Returns:
- *   { ok: true,  stdout, stderr, exitCode }       — clean exit 0
- *   { ok: false, stdout, stderr, exitCode, reason } — non-zero exit or timeout
- *
- * reason values:
- *   'timeout'  — wall-clock limit exceeded; process SIGKILLed
- *   'spawn'    — spawn itself failed (e.g. kubectl not on PATH)
- *   'nonzero'  — kubectl exited with non-zero status
- */
-import { spawn } from 'node:child_process';
-export declare const DEFAULT_TIMEOUT_MS = 120000;
-export type KubectlResult = {
-    ok: true;
-    stdout: string;
-    stderr: string;
-    exitCode: number;
-} | {
-    ok: false;
-    stdout: string;
-    stderr: string;
-    exitCode: number;
-    reason: 'timeout' | 'spawn' | 'nonzero';
-};
-export interface KubectlWrapOpts {
-    /** Per-call timeout override (ms). Defaults to DEFAULT_TIMEOUT_MS (120 s). */
-    readonly timeout?: number;
-    /** Additional environment variables to merge into the subprocess env. */
-    readonly env?: Record<string, string>;
-    /**
-     * spawn factory — injectable for tests so unit tests never fork a real kubectl.
-     * Signature matches `child_process.spawn` return type.
-     */
-    readonly spawnImpl?: typeof spawn;
-    /**
-     * Optional stdin payload. When set, the subprocess stdin is set to 'pipe'
-     * and this string is written then closed. Used for `kubectl apply -f -`
-     * patterns (C1 ConfigMap substitution; D20 — value never in argv).
-     */
-    readonly stdin?: string;
-}
-/**
- * Invoke kubectl with a timeout.
- *
- * @param args - kubectl arguments (e.g. ['get', 'pods', '-n', 'olam'])
- * @param opts - timeout, env overrides, and spawn factory for injection
- */
-export declare function kubectlWrap(args: readonly string[], opts?: KubectlWrapOpts): Promise<KubectlResult>;
-//# sourceMappingURL=kubectl-wrap.d.ts.map

package/dist/lib/kubectl-wrap.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"kubectl-wrap.d.ts","sourceRoot":"","sources":["../../src/lib/kubectl-wrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,eAAO,MAAM,kBAAkB,SAAU,CAAC;AAG1C,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAA;CAAE,CAAC;AAE7G,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,aAAa,CAAC,CA6FxB"}

package/dist/lib/kubectl-wrap.js

@@ -1,135 +0,0 @@
-/**
- * kubectl-wrap.ts — subprocess timeout wrapper for kubectl invocations.
- *
- * Phase 1b C1 of olam-host-suite-phase-1b-k3s-beta-flavour (plan
- * ~/.claude/plans/olam-host-suite-phase-1b-k3s-beta-flavour.md).
- *
- * ALL kubectl invocations in olam-cli MUST go through `kubectlWrap`.
- * Direct `child_process.spawn('kubectl', ...)` calls outside this module
- * break the timeout guarantee and fail `audit:kubectl-callers` (Seam C1).
- *
- * Timeout lifecycle:
- *   1. Spawn kubectl with the provided args.
- *   2. Start wall-clock timer (default 120 000 ms; per-call configurable).
- *   3. On timer fire: SIGTERM the process; wait 5 000 ms; SIGKILL if still alive.
- *   4. Returns { ok: false, reason: 'timeout', … } immediately after the kill
- *      sequence completes (does not wait further for exit after SIGKILL).
- *
- * Returns:
- *   { ok: true,  stdout, stderr, exitCode }       — clean exit 0
- *   { ok: false, stdout, stderr, exitCode, reason } — non-zero exit or timeout
- *
- * reason values:
- *   'timeout'  — wall-clock limit exceeded; process SIGKILLed
- *   'spawn'    — spawn itself failed (e.g. kubectl not on PATH)
- *   'nonzero'  — kubectl exited with non-zero status
- */
-import { spawn } from 'node:child_process';
-export const DEFAULT_TIMEOUT_MS = 120_000;
-const SIGKILL_GRACE_MS = 5_000;
-/**
- * Invoke kubectl with a timeout.
- *
- * @param args - kubectl arguments (e.g. ['get', 'pods', '-n', 'olam'])
- * @param opts - timeout, env overrides, and spawn factory for injection
- */
-export async function kubectlWrap(args, opts = {}) {
-    const timeoutMs = opts.timeout ?? DEFAULT_TIMEOUT_MS;
-    const spawnImpl = opts.spawnImpl ?? spawn;
-    const stdout = [];
-    const stderr = [];
-    return new Promise((resolve) => {
-        let resolved = false;
-        let killTimer = null;
-        let sigkillTimer = null;
-        function safeResolve(r) {
-            if (resolved)
-                return;
-            resolved = true;
-            if (killTimer !== null) {
-                clearTimeout(killTimer);
-                killTimer = null;
-            }
-            if (sigkillTimer !== null) {
-                clearTimeout(sigkillTimer);
-                sigkillTimer = null;
-            }
-            resolve(r);
-        }
-        let child;
-        try {
-            child = spawnImpl('kubectl', [...args], {
-                stdio: [opts.stdin !== undefined ? 'pipe' : 'ignore', 'pipe', 'pipe'],
-                env: { ...process.env, ...(opts.env ?? {}) },
-            });
-        }
-        catch (err) {
-            resolve({
-                ok: false,
-                stdout: '',
-                stderr: err instanceof Error ? err.message : String(err),
-                exitCode: -1,
-                reason: 'spawn',
-            });
-            return;
-        }
-        // Write stdin payload and close the stream when provided.
-        if (opts.stdin !== undefined && child.stdin) {
-            child.stdin.write(opts.stdin, 'utf8');
-            child.stdin.end();
-        }
-        if (child.stdout) {
-            child.stdout.on('data', (chunk) => { stdout.push(chunk.toString('utf8')); });
-        }
-        if (child.stderr) {
-            child.stderr.on('data', (chunk) => { stderr.push(chunk.toString('utf8')); });
-        }
-        child.on('error', (err) => {
-            safeResolve({
-                ok: false,
-                stdout: stdout.join(''),
-                stderr: err.message,
-                exitCode: -1,
-                reason: 'spawn',
-            });
-        });
-        child.on('exit', (code) => {
-            const exitCode = code ?? -1;
-            const stdoutStr = stdout.join('');
-            const stderrStr = stderr.join('');
-            if (exitCode === 0) {
-                safeResolve({ ok: true, stdout: stdoutStr, stderr: stderrStr, exitCode });
-            }
-            else {
-                safeResolve({ ok: false, stdout: stdoutStr, stderr: stderrStr, exitCode, reason: 'nonzero' });
-            }
-        });
-        // Wall-clock timeout: SIGTERM then SIGKILL after grace period.
-        killTimer = setTimeout(() => {
-            killTimer = null;
-            // SIGTERM — polite shutdown request.
-            try {
-                child.kill('SIGTERM');
-            }
-            catch { /* already exited */ }
-            // SIGKILL after 5 s grace — hard kill if SIGTERM wasn't enough.
-            sigkillTimer = setTimeout(() => {
-                sigkillTimer = null;
-                try {
-                    child.kill('SIGKILL');
-                }
-                catch { /* already exited */ }
-                // Resolve immediately after SIGKILL without waiting for the 'exit' event.
-                // The 'exit' event may fire after this resolve; safeResolve is idempotent.
-                safeResolve({
-                    ok: false,
-                    stdout: stdout.join(''),
-                    stderr: stderr.join(''),
-                    exitCode: -1,
-                    reason: 'timeout',
-                });
-            }, SIGKILL_GRACE_MS);
-        }, timeoutMs);
-    });
-}
-//# sourceMappingURL=kubectl-wrap.js.map

package/dist/lib/kubectl-wrap.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"kubectl-wrap.js","sourceRoot":"","sources":["../../src/lib/kubectl-wrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAC1C,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAwB/B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAuB,EACvB,OAAwB,EAAE;IAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAE1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;QAC5C,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,SAAS,GAAyC,IAAI,CAAC;QAC3D,IAAI,YAAY,GAAyC,IAAI,CAAC;QAE9D,SAAS,WAAW,CAAC,CAAgB;YACnC,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBAAC,YAAY,CAAC,SAAS,CAAC,CAAC;gBAAC,SAAS,GAAG,IAAI,CAAC;YAAC,CAAC;YACtE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAAC,YAAY,CAAC,YAAY,CAAC,CAAC;gBAAC,YAAY,GAAG,IAAI,CAAC;YAAC,CAAC;YAC/E,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC;QAED,IAAI,KAA+B,CAAC;QACpC,IAAI,CAAC;YACH,KAAK,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;gBACtC,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACrE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE;aAC7C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC;gBACN,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACxD,QAAQ,EAAE,CAAC,CAAC;gBACZ,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,0DAA0D;QAC1D,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5C,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACtC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACpB,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;QAED,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,WAAW,CAAC;gBACV,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,MAAM,EAAE,GAAG,CAAC,OAAO;gBACnB,QAAQ,EAAE,CAAC,CAAC;gBACZ,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;YAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnB,WAAW,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAChG,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,+DAA+D;QAC/D,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,SAAS,GAAG,IAAI,CAAC;YACjB,qCAAqC;YACrC,IAAI,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;YAE7D,gEAAgE;YAChE,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC7B,YAAY,GAAG,IAAI,CAAC;gBACpB,IAAI,CAAC;oBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;gBAC7D,0EAA0E;gBAC1E,2EAA2E;gBAC3E,WAAW,CAAC;oBACV,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvB,QAAQ,EAAE,CAAC,CAAC;oBACZ,MAAM,EAAE,SAAS;iBAClB,CAAC,CAAC;YACL,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACvB,CAAC,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/manifest-refresh.d.ts

@@ -1,136 +0,0 @@
-/**
- * manifest-refresh.ts — D14 --force-refresh-manifests flag implementation.
- *
- * Phase 1b C2 of olam-host-suite-phase-1b-k3s-beta-flavour (plan
- * ~/.claude/plans/olam-host-suite-phase-1b-k3s-beta-flavour.md).
- *
- * Decisions consumed:
- *   D14 — --force-refresh-manifests flag (NOT a subcommand); requires
- *          --accept-security-regression when security-sensitive fields differ.
- *
- * Security-sensitive manifest fields (refuse without --accept-security-regression):
- *   - securityContext (pod or container level)
- *   - resources.limits
- *   - capabilities (add/drop lists)
- *   - readOnlyRootFilesystem
- *   - RBAC Role rules (rules[].verbs / resources / apiGroups)
- *
- * Audit log:
- *   ~/.olam/state/manifest-refresh-audit.jsonl (mode 0600; append-only)
- *   ENOSPC aborts the refresh with "audit log unavailable: <error>".
- *   The file is created on first write; mode set via writeFileSync options.
- *
- * Two functions are exported:
- *   diffManifestSecurityFields — pure diff, no I/O; testable.
- *   runManifestRefresh         — performs the full refresh with audit-log.
- */
-import * as fs from 'node:fs';
-export declare const MANIFEST_REFRESH_AUDIT_LOG: string;
-/** Security-sensitive field paths checked by the diff. */
-export declare const SECURITY_SENSITIVE_FIELDS: readonly ["securityContext", "resources.limits", "capabilities", "readOnlyRootFilesystem", "rules"];
-export type SecuritySensitiveField = (typeof SECURITY_SENSITIVE_FIELDS)[number];
-export interface ManifestDiffResult {
-    /** True when any security-sensitive field value differs between old and new. */
-    hasSecurityRegression: boolean;
-    /** List of field keys that changed. */
-    changedFields: SecuritySensitiveField[];
-}
-export interface ManifestRefreshAuditEntry {
-    ts: string;
-    manifests_path: string;
-    security_regression: boolean;
-    changed_fields: string[];
-    accepted: boolean;
-    operator_pid: number;
-    /** When set, the refresh was scoped to this peripheral's manifest subdir (C4/D19). */
-    peripheral?: string;
-}
-export interface ManifestRefreshDeps {
-    /** Override state dir for tests. */
-    readonly stateDir?: string;
-    /** Override manifests dir for tests. */
-    readonly manifestsDir?: string;
-    /** Override audit log path for tests. */
-    readonly auditLogPath?: string;
-    /** Override fs.readdirSync for tests. */
-    readonly readdirSync?: typeof fs.readdirSync;
-    /** Override fs.readFileSync for tests. */
-    readonly readFileSync?: typeof fs.readFileSync;
-    /** Override fs.writeFileSync for tests. */
-    readonly writeFileSync?: typeof fs.writeFileSync;
-    /** Override fs.existsSync for tests. */
-    readonly existsSync?: typeof fs.existsSync;
-    /** Override Date.now for tests. */
-    readonly now?: () => Date;
-}
-export interface SeedManifestsDeps {
-    /** Override installRoot path (for tests). */
-    readonly installRootDir?: string;
-    /** Override target manifests dir path (for tests). */
-    readonly targetManifestsDir?: string;
-    /** Override fs.existsSync (for tests). */
-    readonly existsSync?: typeof fs.existsSync;
-    /** Override fs.cpSync (for tests). */
-    readonly cpSync?: typeof fs.cpSync;
-    /** Override fs.mkdirSync (for tests). */
-    readonly mkdirSync?: typeof fs.mkdirSync;
-}
-export type SeedManifestsResult = {
-    seeded: true;
-    source: string;
-    target: string;
-    message: string;
-} | {
-    seeded: false;
-    skipped: true;
-    reason: string;
-} | {
-    seeded: false;
-    skipped: false;
-    error: string;
-};
-/**
- * Copy bundled manifests from the CLI package's host-cp/k8s/manifests/ to
- * ~/.olam/k8s/manifests/ if the target dir does not yet exist.
- *
- * @param forceRefresh — when true, always overwrite (--force-refresh-manifests path).
- * @param deps         — injectable for tests.
- */
-export declare function seedManifestsFromBundle(forceRefresh: boolean, deps?: SeedManifestsDeps): SeedManifestsResult;
-/**
- * Pure diff between two YAML manifest file contents (as strings).
- * Parses each as JSON (manifests may be JSON or YAML; we handle JSON
- * and treat parse failures as "content changed" = regression to be safe).
- *
- * Used by runManifestRefresh and directly by tests.
- */
-export declare function diffManifestSecurityFields(oldContent: string, newContent: string): ManifestDiffResult;
-export type ManifestRefreshResult = {
-    ok: true;
-    message: string;
-} | {
-    ok: false;
-    message: string;
-};
-/**
- * Run the manifest refresh check.
- *
- * @param manifestsDir    — path to ~/.olam/k8s/manifests/
- * @param acceptRegression — true when --accept-security-regression is set
- * @param deps            — injectable for tests
- * @param peripheral      — when set, scope diff to manifests/<peripheral>/ ONLY (C4/D19)
- *
- * Returns ok=false when:
- *   - Security-sensitive fields differ AND !acceptRegression.
- *   - Audit log write fails (ENOSPC).
- *   - peripheral is set but the peripheral subdir does not exist.
- *
- * On ok=true the audit log entry is written with accepted=true (or
- * accepted=false when no regression was detected — regression-free
- * refreshes are still audited).
- *
- * When peripheral is set, the audit-log entry includes { peripheral: <name> } (D19).
- * Other peripherals' security drift does NOT block a targeted peripheral refresh (D19).
- */
-export declare function runManifestRefresh(manifestsDir: string, acceptRegression: boolean, deps?: ManifestRefreshDeps, peripheral?: string): Promise<ManifestRefreshResult>;
-//# sourceMappingURL=manifest-refresh.d.ts.map

package/dist/lib/manifest-refresh.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest-refresh.d.ts","sourceRoot":"","sources":["../../src/lib/manifest-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAK9B,eAAO,MAAM,0BAA0B,QAA4D,CAAC;AAEpG,0DAA0D;AAC1D,eAAO,MAAM,yBAAyB,qGAM5B,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF,MAAM,WAAW,kBAAkB;IACjC,gFAAgF;IAChF,qBAAqB,EAAE,OAAO,CAAC;IAC/B,uCAAuC;IACvC,aAAa,EAAE,sBAAsB,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,wCAAwC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,yCAAyC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,yCAAyC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC;IAC7C,0CAA0C;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,YAAY,CAAC;IAC/C,2CAA2C;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,aAAa,CAAC;IACjD,wCAAwC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC;IAC3C,mCAAmC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAuBD,MAAM,WAAW,iBAAiB;IAChC,6CAA6C;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,sDAAsD;IACtD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,0CAA0C;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC;IAC3C,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC;IACnC,yCAAyC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC;CAC1C;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,OAAO,EACrB,IAAI,GAAE,iBAAsB,GAC3B,mBAAmB,CAkErB;AAkCD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,kBAAkB,CA4BpB;AAyBD,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,gBAAgB,EAAE,OAAO,EACzB,IAAI,GAAE,mBAAwB,EAC9B,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,qBAAqB,CAAC,CA2FhC"}