@pleri/olam-cli 0.1.201 → 0.1.204

package/dist/commands/ask.js

@@ -1,63 +0,0 @@
-/**
- * olam ask — interactive assistant for olam usage + setup questions.
- *
- *   olam ask "<question>"   answer once and exit (script-friendly)
- *   olam ask                open an interactive multi-turn REPL
- *
- * Powered by the Claude Agent SDK on the operator's LOCAL Claude Code
- * subscription, pinned to Sonnet (`claude-sonnet-4-6`). No extra API cost on
- * top of the operator's existing Claude Code login. Grounded in a knowledge
- * pack bundled at build time, plus live repo files when run inside a checkout.
- *
- * Read-only: the assistant never mutates files or creates worlds.
- */
-import { runOneShot } from '../ask/one-shot.js';
-import { runRepl } from '../ask/repl.js';
-/**
- * Route invocation to one-shot vs REPL based on argument presence. Pure
- * relative to the injected runners so the routing decision is unit-testable
- * without spinning up the SDK (Rule 9 — the WHY: a regression that routed a
- * bare `olam ask` to one-shot, or an arg to the REPL, breaks both the script
- * contract and the interactive contract silently).
- */
-export async function routeAsk(question, runners) {
-    if (typeof question === 'string' && question.trim().length > 0) {
-        return runners.oneShot(question);
-    }
-    return runners.repl();
-}
-export function registerAsk(program) {
-    program
-        .command('ask')
-        .description('Ask olam about its own usage, setup, and CLI (local Claude subscription)')
-        .argument('[question...]', 'Question to answer once; omit to open an interactive REPL')
-        .addHelpText('after', [
-        '',
-        'Modes:',
-        '  olam ask "how do I create a world?"   Answer once and exit (script-friendly)',
-        '  olam ask                               Open an interactive multi-turn REPL',
-        '',
-        'In the REPL, type /exit (or Ctrl-D) to quit. Conversation context is kept',
-        'across turns.',
-        '',
-        'Auth & cost:',
-        '  Uses your LOCAL Claude Code subscription via the Claude Agent SDK, pinned',
-        '  to Sonnet (claude-sonnet-4-6). No extra API cost beyond your Claude Code',
-        '  login. If Claude Code is not installed or not logged in, olam ask exits',
-        '  with instructions.',
-        '',
-        'Grounding:',
-        '  Answers come from a knowledge pack bundled into the CLI. Inside an olam',
-        '  checkout, the assistant can also read live repo files for fresher answers.',
-    ].join('\n'))
-        .action(async (questionParts) => {
-        // commander gives variadic args as an array; join into one question.
-        const question = questionParts.join(' ').trim();
-        const code = await routeAsk(question.length > 0 ? question : undefined, {
-            oneShot: (q) => runOneShot(q),
-            repl: () => runRepl(),
-        });
-        process.exitCode = code;
-    });
-}
-//# sourceMappingURL=ask.js.map

package/dist/commands/ask.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ask.js","sourceRoot":"","sources":["../../src/commands/ask.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,QAA4B,EAC5B,OAGC;IAED,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,0EAA0E,CAAC;SACvF,QAAQ,CAAC,eAAe,EAAE,2DAA2D,CAAC;SACtF,WAAW,CACV,OAAO,EACP;QACE,EAAE;QACF,QAAQ;QACR,gFAAgF;QAChF,8EAA8E;QAC9E,EAAE;QACF,2EAA2E;QAC3E,eAAe;QACf,EAAE;QACF,cAAc;QACd,6EAA6E;QAC7E,4EAA4E;QAC5E,2EAA2E;QAC3E,sBAAsB;QACtB,EAAE;QACF,YAAY;QACZ,2EAA2E;QAC3E,8EAA8E;KAC/E,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;SACA,MAAM,CAAC,KAAK,EAAE,aAAuB,EAAE,EAAE;QACxC,qEAAqE;QACrE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE;YACtE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAC7B,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE;SACtB,CAAC,CAAC;QACH,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC1B,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/auth-list-json.d.ts

@@ -1,87 +0,0 @@
-/**
- * Pure JSON serialiser for `olam auth list --json` (local vault path).
- *
- * Kept separate from the command action so the wire contract is
- * unit-testable without an AuthClient round-trip (mirrors `renderPsJson`
- * in ps.ts and `renderWorldList` in list.ts).
- *
- * WHY this exists: credential-vault health is exactly the precondition an
- * agent/script driver must check before dispatching Claude work — the
- * "all credentials cooled down" failure mode is a documented operational
- * concern (see `npm run audit:credentials`). The human table is colorized
- * and reflows per terminal width, so screen-scraping it is brittle. This
- * gives drivers a stable, color-free shape: a top-level `healthy` flag
- * (is any credential pickable right now?), the next cooldown reset, and a
- * per-account row carrying the fields needed to reason about rotation.
- *
- * Token security: this serialiser only ever touches the safe summary
- * fields. accessToken / refreshToken are never present on
- * AuthAccountSummary and are never emitted.
- */
-import type { AuthAccountSummary } from '@olam/core/src/auth/types.js';
-import type { AccountEntry } from '../lib/auth-remote.js';
-/** Per-account row in the `auth list --json` payload. */
-export interface AuthListAccountJson {
-    readonly id: string;
-    readonly label: string;
-    readonly state: string;
-    readonly tokenValid: boolean;
-    readonly expiresIn: string;
-    readonly rateLimited: boolean;
-    readonly rateLimitResetsAt: string | null;
-    readonly weeklyResetsAt: string | null;
-    readonly requestCount5h: number;
-    readonly last429At: string | null;
-}
-/** Top-level shape emitted by `olam auth list --json`. */
-export interface AuthListJson {
-    readonly count: number;
-    /** True when at least one credential is in the `active` state. */
-    readonly healthy: boolean;
-    /**
-     * ISO timestamp of the soonest cooldown/rate-limit reset across the
-     * vault, or null when nothing is scheduled. Lets a driver know when to
-     * retry without polling.
-     */
-    readonly nextResetAt: string | null;
-    readonly accounts: readonly AuthListAccountJson[];
-}
-/**
- * Serialise the local auth-service account summaries to the stable
- * `--json` wire shape. `now` is injectable for deterministic tests.
- */
-export declare function renderAuthListJson(accounts: readonly AuthAccountSummary[], now?: number): string;
-/**
- * B4 (narrowed) — JSON shape for `olam auth list --json` when the remote
- * backend is active. The remote payload carries less detail than the local
- * one (no `usage` window stats, no `tokenValid` — those are local-only
- * concepts today), so the wire shape is intentionally narrower. The `stale`
- * + `lastFetchedAt` fields surface the in-process cache's freshness so
- * driver scripts can decide whether to retry.
- */
-export interface AuthListRemoteAccountJson {
-    readonly id: string;
-    readonly label: string;
-    readonly state: string;
-    readonly expiresIn: string;
-    readonly provider: string | null;
-    readonly email: string | null;
-    readonly rateLimitResetsAt: string | null;
-    readonly weeklyResetsAt: string | null;
-}
-export interface AuthListRemoteJson {
-    readonly count: number;
-    /** True iff at least one account is in the `active` state. */
-    readonly healthy: boolean;
-    /** True iff this payload came from the stale-cache fallback. */
-    readonly stale: boolean;
-    /** Epoch ms of the underlying fetch; informs the operator how old the data is. */
-    readonly lastFetchedAt: number;
-    readonly accounts: readonly AuthListRemoteAccountJson[];
-}
-/**
- * Serialise the remote `AccountEntry[]` payload to the `--json` wire shape.
- * `stale` + `fetchedAt` propagate from the orchestrator's `RemoteListResult`.
- */
-export declare function renderRemoteAuthListJson(accounts: ReadonlyArray<AccountEntry>, stale: boolean, fetchedAt: number): string;
-//# sourceMappingURL=auth-list-json.d.ts.map

package/dist/commands/auth-list-json.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-list-json.d.ts","sourceRoot":"","sources":["../../src/commands/auth-list-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,0DAA0D;AAC1D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACnD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,EACvC,GAAG,GAAE,MAAmB,GACvB,MAAM,CAsBR;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACzD;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,aAAa,CAAC,YAAY,CAAC,EACrC,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,MAAM,GAChB,MAAM,CAqBR"}

package/dist/commands/auth-list-json.js

@@ -1,71 +0,0 @@
-/**
- * Pure JSON serialiser for `olam auth list --json` (local vault path).
- *
- * Kept separate from the command action so the wire contract is
- * unit-testable without an AuthClient round-trip (mirrors `renderPsJson`
- * in ps.ts and `renderWorldList` in list.ts).
- *
- * WHY this exists: credential-vault health is exactly the precondition an
- * agent/script driver must check before dispatching Claude work — the
- * "all credentials cooled down" failure mode is a documented operational
- * concern (see `npm run audit:credentials`). The human table is colorized
- * and reflows per terminal width, so screen-scraping it is brittle. This
- * gives drivers a stable, color-free shape: a top-level `healthy` flag
- * (is any credential pickable right now?), the next cooldown reset, and a
- * per-account row carrying the fields needed to reason about rotation.
- *
- * Token security: this serialiser only ever touches the safe summary
- * fields. accessToken / refreshToken are never present on
- * AuthAccountSummary and are never emitted.
- */
-import { nextCooldownReset } from '@olam/auth-logic';
-/**
- * Serialise the local auth-service account summaries to the stable
- * `--json` wire shape. `now` is injectable for deterministic tests.
- */
-export function renderAuthListJson(accounts, now = Date.now()) {
-    const rows = accounts.map((a) => ({
-        id: a.id,
-        label: a.accountLabel ?? a.id,
-        state: a.state ?? 'unknown',
-        tokenValid: a.tokenValid,
-        expiresIn: a.expiresIn,
-        rateLimited: a.rateLimited,
-        rateLimitResetsAt: a.rateLimitResetsAt ?? null,
-        weeklyResetsAt: a.weeklyResetsAt ?? null,
-        requestCount5h: a.usage?.requestCount5h ?? 0,
-        last429At: a.usage?.last429At ?? null,
-    }));
-    const payload = {
-        count: rows.length,
-        healthy: rows.some((r) => r.state === 'active'),
-        nextResetAt: nextCooldownReset(accounts, now),
-        accounts: rows,
-    };
-    return JSON.stringify(payload);
-}
-/**
- * Serialise the remote `AccountEntry[]` payload to the `--json` wire shape.
- * `stale` + `fetchedAt` propagate from the orchestrator's `RemoteListResult`.
- */
-export function renderRemoteAuthListJson(accounts, stale, fetchedAt) {
-    const rows = accounts.map((a) => ({
-        id: a.id,
-        label: a.label ?? a.id,
-        state: a.state ?? 'unknown',
-        expiresIn: a.expiresIn ?? '',
-        provider: a.provider ?? null,
-        email: a.email === undefined ? null : a.email,
-        rateLimitResetsAt: a.rateLimitResetsAt === undefined ? null : a.rateLimitResetsAt,
-        weeklyResetsAt: a.weeklyResetsAt === undefined ? null : a.weeklyResetsAt,
-    }));
-    const payload = {
-        count: rows.length,
-        healthy: rows.some((r) => r.state === 'active'),
-        stale,
-        lastFetchedAt: fetchedAt,
-        accounts: rows,
-    };
-    return JSON.stringify(payload);
-}
-//# sourceMappingURL=auth-list-json.js.map

package/dist/commands/auth-list-json.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-list-json.js","sourceRoot":"","sources":["../../src/commands/auth-list-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAgCrD;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAuC,EACvC,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,IAAI,GAA0B,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvD,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,EAAE;QAC7B,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,SAAS;QAC3B,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,IAAI,IAAI;QAC9C,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI;QACxC,cAAc,EAAE,CAAC,CAAC,KAAK,EAAE,cAAc,IAAI,CAAC;QAC5C,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,IAAI,IAAI;KACtC,CAAC,CAAC,CAAC;IAEJ,MAAM,OAAO,GAAiB;QAC5B,KAAK,EAAE,IAAI,CAAC,MAAM;QAClB,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC;QAC/C,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC;QAC7C,QAAQ,EAAE,IAAI;KACf,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAgCD;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAqC,EACrC,KAAc,EACd,SAAiB;IAEjB,MAAM,IAAI,GAAgC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7D,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,SAAS;QAC3B,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE;QAC5B,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;QAC5B,KAAK,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;QAC7C,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB;QACjF,cAAc,EAAE,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc;KACzE,CAAC,CAAC,CAAC;IAEJ,MAAM,OAAO,GAAuB;QAClC,KAAK,EAAE,IAAI,CAAC,MAAM;QAClB,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC;QAC/C,KAAK;QACL,aAAa,EAAE,SAAS;QACxB,QAAQ,EAAE,IAAI;KACf,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC"}

package/dist/commands/auth-migrate.d.ts

@@ -1,212 +0,0 @@
-/**
- * olam auth migrate — one-shot migration tool for operators with a legacy
- * `~/.olam/auth-data/accounts.json` (the file the pre-Phase-A auth-service
- * container wrote OAuth tokens to). Reads each local account and walks the
- * operator through re-authenticating it against the cloud auth-worker.
- *
- * ───────────────────────────────────────────────────────────────────────────
- * IMPORTANT — DESIGN-DOC NOTE FROM B2's AUDIT
- * ───────────────────────────────────────────────────────────────────────────
- *
- * **There is no `POST /v1/credentials` endpoint on the cloud auth-worker DO.**
- * Phase A's design doc (`docs/architecture/cloud-only-vault.md` §3 — "the
- * bearer IS the credential") makes the explicit choice that the cloud vault
- * does not accept already-minted OAuth tokens over HTTP. The only way a
- * credential lands in the DO is via the worker's own OAuth-callback handler
- * after the operator completes the Anthropic device-code dance.
- *
- * So "migrate" here does NOT mean "POST tokens into the cloud DO" (phase-b-
- * tasks.md B3's wording is shorthand). It means: **for each local account,
- * re-run the OAuth-start flow against the cloud auth-worker so the operator
- * re-authenticates that Anthropic account, and the worker's callback stores
- * the resulting token server-side.**
- *
- * The local OAuth token bytes themselves are never sent anywhere — they
- * remain in `~/.olam/auth-data/accounts.json` until the operator approves
- * the final timestamped rename. Local file is NEVER deleted automatically.
- *
- * ───────────────────────────────────────────────────────────────────────────
- * IDEMPOTENCE MODEL
- * ───────────────────────────────────────────────────────────────────────────
- *
- * Per-account migration state lives in `~/.olam/auth-data/migration-state.json`:
- *
- *   {
- *     "version": 1,
- *     "migrated": {
- *       "<sha256(stable-content-shape)>": {
- *         "migratedAt": "2026-05-29T...Z",
- *         "email": "alice@example.com",
- *         "provider": "claude"
- *       },
- *       ...
- *     }
- *   }
- *
- * The hash is computed from a STABLE JSON shape (`{email, provider,
- * anthropicAccountId}`) — re-running migrate after the local vault changes
- * picks up new accounts but skips already-migrated ones. Atomic write
- * (write-to-tmp then rename) guarantees that a mid-flight kill resumes
- * cleanly: any account whose state record is durable on disk is skipped;
- * the rest are re-attempted.
- *
- * ───────────────────────────────────────────────────────────────────────────
- * CLI SURFACE
- * ───────────────────────────────────────────────────────────────────────────
- *
- *   olam auth migrate                 # default: interactive live-run
- *   olam auth migrate --dry-run       # print the per-account plan only
- *   olam auth migrate --remote <url>  # override auth-worker URL
- *   olam auth migrate --yes           # CI safety; only valid w/ --dry-run
- */
-import type { Command } from 'commander';
-import { DEFAULT_AUTH_WORKER_URL } from '../lib/auth-login.js';
-import { printError, printHeader, printSuccess } from '../output.js';
-/**
- * A row from the legacy local vault. The pre-Phase-A `auth-service` container
- * wrote a richer record than this; for migration purposes we only need the
- * three fields that uniquely identify an Anthropic account.
- */
-export interface LocalAccount {
-    readonly email: string;
-    readonly provider: string;
-    readonly anthropicAccountId?: string;
-    /** Optional label the operator gave the account at login time. */
-    readonly label?: string;
-}
-/** Shape of `~/.olam/auth-data/accounts.json` (the legacy vault file). */
-export interface LocalAccountsFile {
-    readonly accounts: readonly LocalAccount[];
-}
-/** Per-hash record in `migration-state.json`. */
-export interface MigrationRecord {
-    readonly migratedAt: string;
-    readonly email: string;
-    readonly provider: string;
-}
-/** Shape of `~/.olam/auth-data/migration-state.json`. */
-export interface MigrationState {
-    readonly version: 1;
-    readonly migrated: Readonly<Record<string, MigrationRecord>>;
-}
-/** Per-account decision in the migration plan. */
-export interface PlannedAccount {
-    readonly account: LocalAccount;
-    readonly hash: string;
-    readonly status: 'pending' | 'already-migrated';
-    readonly migratedRecord?: MigrationRecord;
-}
-/** Options parsed from Commander for `olam auth migrate`. */
-export interface AuthMigrateOptions {
-    readonly local?: boolean;
-    readonly remote?: boolean | string;
-    readonly dryRun?: boolean;
-    readonly yes?: boolean;
-}
-/** Result of a `runAuthMigrate` invocation (drives `process.exitCode`). */
-export interface AuthMigrateResult {
-    readonly exitCode: 0 | 1;
-    /** Total accounts in the local vault (zero when the file is absent). */
-    readonly accountsTotal?: number;
-    /** Accounts that were already-migrated at start. */
-    readonly accountsAlreadyMigrated?: number;
-    /** Accounts that completed migration during THIS invocation. */
-    readonly accountsMigratedNow?: number;
-    /** Accounts the operator skipped this run. */
-    readonly accountsSkipped?: number;
-    /** True when --dry-run was honoured (no live OAuth). */
-    readonly dryRun?: boolean;
-    /** Resolved auth-worker URL for the live-run case. */
-    readonly resolvedRemoteUrl?: string;
-}
-export interface AuthMigrateDeps {
-    /** Absolute path to ~/.olam/auth-data/accounts.json. */
-    readonly accountsPath?: string;
-    /** Absolute path to ~/.olam/auth-data/migration-state.json. */
-    readonly statePath?: string;
-    /** fs.readFileSync surrogate (defaults to real fs). */
-    readonly readFileSync?: (p: string) => string;
-    /** fs.writeFileSync surrogate (defaults to real fs). */
-    readonly writeFileSync?: (p: string, data: string) => void;
-    /** fs.renameSync surrogate (defaults to real fs). */
-    readonly renameSync?: (from: string, to: string) => void;
-    /** fs.existsSync surrogate (defaults to real fs). */
-    readonly existsSync?: (p: string) => boolean;
-    /** Returns the current ISO timestamp (defaults to new Date().toISOString()). */
-    readonly now?: () => string;
-    /** Reads OLAM_AUTH_WORKER_URL env var (resolveRemoteUrl). */
-    readonly readEnv?: (key: string) => string | undefined;
-    /** Reads ~/.olam/auth-worker-url file (resolveRemoteUrl). */
-    readonly readAuthWorkerUrlFile?: () => string | null;
-    /** True when stdin is a TTY (interactive prompts are meaningful). */
-    readonly isTty?: () => boolean;
-    /**
-     * Per-account interactive prompt:
-     *   q = abort migration; s = skip this account; anything else = proceed.
-     * Returns the operator's raw answer; runAuthMigrate interprets.
-     */
-    readonly promptPerAccount?: (question: string) => Promise<string>;
-    /** Final "rename local vault?" prompt (yes / no). */
-    readonly promptFinalRename?: (question: string) => Promise<string>;
-    /** Where banner + table output goes. Defaults to process.stdout. */
-    readonly stdout?: NodeJS.WritableStream;
-    /** Where errors + warnings go. Defaults to process.stderr. */
-    readonly stderr?: NodeJS.WritableStream;
-}
-/**
- * Stable content hash for an account. Two accounts with identical
- * (email, provider, anthropicAccountId) tuples produce the same hash —
- * the operator deleting + re-adding the same Anthropic account locally
- * still resolves to "already migrated" on the cloud side. Tests rely on
- * this invariant being stable (no random salt, no time component).
- */
-export declare function accountContentHash(account: LocalAccount): string;
-/** Empty initial migration state (version 1). */
-export declare function emptyMigrationState(): MigrationState;
-/**
- * Read + parse migration-state.json. Returns `emptyMigrationState()` when
- * the file is absent (first-ever migrate run). Throws on parse-failure or
- * version drift so the caller can exit 1 with a manual-inspection message.
- */
-export declare function readMigrationState(statePath: string, deps: Pick<AuthMigrateDeps, 'existsSync' | 'readFileSync'>): MigrationState;
-/**
- * Atomically write migration state. Strategy: serialise to `<path>.tmp`,
- * then `rename` over the live file. The rename is atomic on POSIX (and on
- * NTFS via ReplaceFileEx semantics); a process kill between the .tmp write
- * and the rename leaves the live file untouched.
- *
- * Throws on write or rename failure; caller is expected to surface the
- * error and exit 1 without touching anything else.
- */
-export declare function writeMigrationStateAtomic(statePath: string, state: MigrationState, deps: Pick<AuthMigrateDeps, 'writeFileSync' | 'renameSync'>): void;
-/**
- * Read + parse the legacy local vault file. Returns `null` when absent
- * (the "nothing to migrate" path). Throws on parse failure.
- */
-export declare function readLocalAccounts(accountsPath: string, deps: Pick<AuthMigrateDeps, 'existsSync' | 'readFileSync'>): LocalAccountsFile | null;
-/**
- * Pure planner — given the local accounts + the migration state, decide
- * what each account's status is. No IO; trivial to unit-test.
- */
-export declare function planMigration(accounts: readonly LocalAccount[], state: MigrationState): PlannedAccount[];
-/**
- * Run the `olam auth migrate` decision tree. Every IO touchpoint is funnelled
- * through `AuthMigrateDeps` so tests assert on orchestration without spawning
- * real OAuth round-trips, filesystem writes, or readline reads.
- */
-export declare function runAuthMigrate(opts: AuthMigrateOptions, deps?: AuthMigrateDeps): Promise<AuthMigrateResult>;
-/**
- * Register `olam auth migrate` on the supplied `auth` subcommand. Called
- * from `packages/cli/src/commands/auth.ts`.
- */
-export declare function registerAuthMigrate(auth: Command): void;
-export { DEFAULT_AUTH_WORKER_URL };
-export declare const _internal: {
-    printError: typeof printError;
-    printHeader: typeof printHeader;
-    printSuccess: typeof printSuccess;
-    pc: import("picocolors/types.js").Colors & {
-        createColors: (enabled?: boolean) => import("picocolors/types.js").Colors;
-    };
-};
-//# sourceMappingURL=auth-migrate.d.ts.map

package/dist/commands/auth-migrate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-migrate.d.ts","sourceRoot":"","sources":["../../src/commands/auth-migrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAOH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,OAAO,EAAoB,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAIrE;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,kEAAkE;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;CAC5C;AAED,iDAAiD;AACjD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;CAC9D;AAED,kDAAkD;AAClD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,kBAAkB,CAAC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC;CAC3C;AAED,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IACzB,wEAAwE;IACxE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,oDAAoD;IACpD,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,gEAAgE;IAChE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,wDAAwD;IACxD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAID,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9C,wDAAwD;IACxD,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3D,qDAAqD;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,qDAAqD;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,gFAAgF;IAChF,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACvD,6DAA6D;IAC7D,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACrD,qEAAqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClE,qDAAqD;IACrD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,oEAAoE;IACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IACxC,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CACzC;AAcD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAOhE;AAED,iDAAiD;AACjD,wBAAgB,mBAAmB,IAAI,cAAc,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,GAAG,cAAc,CAAC,GACzD,cAAc,CA6BhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,cAAc,EACrB,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,eAAe,GAAG,YAAY,CAAC,GAC1D,IAAI,CAON;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,GAAG,cAAc,CAAC,GACzD,iBAAiB,GAAG,IAAI,CAoC1B;AAID;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,SAAS,YAAY,EAAE,EACjC,KAAK,EAAE,cAAc,GACpB,cAAc,EAAE,CASlB;AAwDD;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,EACxB,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,iBAAiB,CAAC,CAoO5B;AAID;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAoBvD;AAGD,OAAO,EAAE,uBAAuB,EAAE,CAAC;AAInC,eAAO,MAAM,SAAS;;;;;8BArpBR,CAAC;;CA0pBd,CAAC"}