@pleri/olam-cli 0.1.201 → 0.1.204

package/dist/install-root.js

@@ -1,98 +0,0 @@
-/**
- * Phase B (olam-fresh-install-self-bootstrap) — B6.
- *
- * `installRoot()` + `isDevMode()` — the seam between an installed
- * @pleri/olam-cli and a monorepo clone. Three CLI commands need to
- * shell out to `packages/adapters/src/docker/build-*.sh` (legacy
- * source-build paths from before Phase B's image registry):
- *
- *   - olam auth upgrade --from-source
- *   - olam upgrade --from-source
- *   - olam create --rebuild-base
- *
- * From an installed CLI, those scripts don't exist (the published
- * tarball ships dist/ + plugin/ + host-cp/ — not the build scripts).
- * From a monorepo clone, they do.
- *
- * Decision #1 (Phase B) carries-forward Decision #1 (Phase C revision):
- * dev mode is a 2-condition opt-in:
- *   1. OLAM_DEV=1 in the environment
- *   2. A `packages/` sibling exists at the installRoot
- *
- * Both must be true. The OLAM_DEV flag prevents a stray `packages/`
- * directory adjacent to a global npm install from accidentally
- * activating source-build paths (still imperfect — see S10's deferred
- * 4-condition opt-in for full path-traversal hardening — but adequate
- * for the local-dev / dogfood audience the epic targets).
- *
- * S10 simplified the 4-condition opt-in (uid match + sentinel file)
- * to 2-condition per the user's "perf + leak/logic over security
- * hardening" reframe in pass 3.
- */
-import { existsSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-/**
- * Returns the absolute path to the package's install root.
- *
- *   - Locally (from src/): /<repo>/packages/cli
- *   - Globally installed: /<global-prefix>/lib/node_modules/@pleri/olam-cli
- *   - From dist/index.js: /<global-prefix>/lib/node_modules/@pleri/olam-cli
- *
- * Implementation: this file lives at <pkg>/src/install-root.ts (dev)
- * or <pkg>/dist/install-root.js (when bundled). Walking up one directory
- * from this file's location lands at <pkg> in both cases — the
- * `import.meta.url`-resolved dirname. The fileURLToPath conversion
- * handles `file:` URLs cleanly across platforms (Windows-forward-slash
- * tolerance comes for free from path.dirname).
- */
-export function installRoot(metaUrl = import.meta.url) {
-    const here = fileURLToPath(metaUrl);
-    // dist/install-root.js OR src/install-root.ts → <pkg>
-    return resolve(dirname(here), '..');
-}
-/**
- * 2-condition dev-mode detection.
- *
- * @param env - Process env. Defaults to `process.env`. Injectable for tests.
- * @param installRootDir - Where to look for the `packages/` sibling. Defaults
- *   to `installRoot()`. Injectable for tests.
- */
-export function isDevMode(env = process.env, installRootDir = installRoot()) {
-    if (env.OLAM_DEV !== '1')
-        return false;
-    // The package install root sits at <repo>/packages/cli when from a clone.
-    // Walking up two levels lands at <repo>; checking <repo>/packages/.
-    const repoRoot = resolve(installRootDir, '..', '..');
-    return existsSync(join(repoRoot, 'packages')) && existsSync(join(repoRoot, 'package.json'));
-}
-/**
- * Resolve the path to a build script under packages/adapters/src/docker/.
- * In dev mode → returns the absolute path to the source script.
- * In install mode → throws `MissingBuildScriptError` with a named remedy.
- *
- * The exception, not exit-code path, lets call sites decide whether to
- * recover gracefully (e.g. fall back to a pull-by-digest path) or just
- * surface to stderr + exit. Phase C's C6 will use the recover-gracefully
- * path; today's three call sites just exit.
- */
-export class MissingBuildScriptError extends Error {
-    constructor(scriptRelPath) {
-        super(`Build script ${scriptRelPath} is not available in this CLI install.\n` +
-            `  Source-build paths require a monorepo clone:\n` +
-            `    git clone https://github.com/pleri/olam && cd olam\n` +
-            `    OLAM_DEV=1 olam <command> --from-source\n` +
-            `  For published-image upgrades (Phase B+), drop the --from-source flag\n` +
-            `  and the CLI will pull pre-built images from ghcr.io/pleri/* by digest.`);
-        this.name = 'MissingBuildScriptError';
-    }
-}
-export function resolveBuildScript(input) {
-    const { scriptRelPath, env = process.env, installRootDir = installRoot() } = input;
-    if (!isDevMode(env, installRootDir)) {
-        throw new MissingBuildScriptError(scriptRelPath);
-    }
-    const repoRoot = resolve(installRootDir, '..', '..');
-    return join(repoRoot, scriptRelPath);
-}
-//# sourceMappingURL=install-root.js.map

package/dist/install-root.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"install-root.js","sourceRoot":"","sources":["../src/install-root.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,UAAkB,MAAM,CAAC,IAAI,CAAC,GAAG;IAC3D,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,sDAAsD;IACtD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CACvB,MAAyB,OAAO,CAAC,GAAG,EACpC,iBAAyB,WAAW,EAAE;IAEtC,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACvC,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrD,OAAO,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,aAAqB;QAC/B,KAAK,CACH,gBAAgB,aAAa,0CAA0C;YACrE,kDAAkD;YAClD,0DAA0D;YAC1D,+CAA+C;YAC/C,0EAA0E;YAC1E,0EAA0E,CAC7E,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAQD,MAAM,UAAU,kBAAkB,CAAC,KAA8B;IAC/D,MAAM,EAAE,aAAa,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,WAAW,EAAE,EAAE,GAAG,KAAK,CAAC;IACnF,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,uBAAuB,CAAC,aAAa,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACvC,CAAC"}

package/dist/lib/anthropic-base-url-file.d.ts

@@ -1,37 +0,0 @@
-/**
- * Helpers for `olam auth issue-anthropic-token` (g4.1) cloud-mode UX.
- *
- * Extracted from auth.ts so the file-write + label-default logic is unit
- * testable without driving the commander action (which blocks on a stdin
- * cookie prompt). auth.ts delegates here; tests target this module directly
- * — same pattern as `auth-refresh-kubernetes.ts`.
- */
-/**
- * Resolve the friendly token label. The label is just a handle for
- * `list-anthropic-tokens` + revocation, so it is optional: when omitted we
- * default to `<hostname>-<timestamp>`, unique per mint on a single laptop.
- */
-export declare function resolveTokenLabel(label?: string): string;
-export interface WriteBaseUrlResult {
-    /** True when the file was written; false when skipped via `write: false`. */
-    readonly wrote: boolean;
-    /** Absolute path the URL was (or would have been) written to. */
-    readonly path: string;
-}
-/**
- * Persist the cloud-mode bearer URL where auth-client's `resolveCloudUrl()`
- * expects it: `<home>/.olam/anthropic-base-url`, a single BARE trimmed URL
- * plus a trailing newline, chmod 600.
- *
- * Bare URL only — NO `export X='...'` shell wrapper and no quotes. The
- * resolver reads the file verbatim, `.trim()`s it, and parses one URL per
- * file; a shell-assignment line would break that contract.
- *
- * Returns `{ wrote: false }` (no filesystem touch) when `opts.write === false`
- * — the `--no-write-file` opt-out path.
- */
-export declare function writeAnthropicBaseUrlFile(url: string, opts?: {
-    write?: boolean;
-    homeDir?: string;
-}): WriteBaseUrlResult;
-//# sourceMappingURL=anthropic-base-url-file.d.ts.map

package/dist/lib/anthropic-base-url-file.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"anthropic-base-url-file.d.ts","sourceRoot":"","sources":["../../src/lib/anthropic-base-url-file.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAGxD;AAED,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/C,kBAAkB,CAcpB"}

package/dist/lib/anthropic-base-url-file.js

@@ -1,46 +0,0 @@
-/**
- * Helpers for `olam auth issue-anthropic-token` (g4.1) cloud-mode UX.
- *
- * Extracted from auth.ts so the file-write + label-default logic is unit
- * testable without driving the commander action (which blocks on a stdin
- * cookie prompt). auth.ts delegates here; tests target this module directly
- * — same pattern as `auth-refresh-kubernetes.ts`.
- */
-import * as fs from 'node:fs';
-import * as os from 'node:os';
-import * as path from 'node:path';
-/**
- * Resolve the friendly token label. The label is just a handle for
- * `list-anthropic-tokens` + revocation, so it is optional: when omitted we
- * default to `<hostname>-<timestamp>`, unique per mint on a single laptop.
- */
-export function resolveTokenLabel(label) {
-    if (label && label.trim().length > 0)
-        return label;
-    return `${os.hostname()}-${Date.now()}`;
-}
-/**
- * Persist the cloud-mode bearer URL where auth-client's `resolveCloudUrl()`
- * expects it: `<home>/.olam/anthropic-base-url`, a single BARE trimmed URL
- * plus a trailing newline, chmod 600.
- *
- * Bare URL only — NO `export X='...'` shell wrapper and no quotes. The
- * resolver reads the file verbatim, `.trim()`s it, and parses one URL per
- * file; a shell-assignment line would break that contract.
- *
- * Returns `{ wrote: false }` (no filesystem touch) when `opts.write === false`
- * — the `--no-write-file` opt-out path.
- */
-export function writeAnthropicBaseUrlFile(url, opts = {}) {
-    const homeDir = opts.homeDir ?? os.homedir();
-    const filePath = path.join(homeDir, '.olam', 'anthropic-base-url');
-    if (opts.write === false) {
-        return { wrote: false, path: filePath };
-    }
-    fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    // mode on writeFileSync is masked by umask; chmod after to guarantee 600.
-    fs.writeFileSync(filePath, `${url}\n`, { mode: 0o600 });
-    fs.chmodSync(filePath, 0o600);
-    return { wrote: true, path: filePath };
-}
-//# sourceMappingURL=anthropic-base-url-file.js.map

package/dist/lib/anthropic-base-url-file.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"anthropic-base-url-file.js","sourceRoot":"","sources":["../../src/lib/anthropic-base-url-file.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,OAAO,GAAG,EAAE,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAC1C,CAAC;AASD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAW,EACX,OAA8C,EAAE;IAEhD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC;IAEnE,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC1C,CAAC;IAED,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,0EAA0E;IAC1E,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE9B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACzC,CAAC"}

package/dist/lib/auth-backend.d.ts

@@ -1,168 +0,0 @@
-/**
- * auth-backend — shared backend resolver for `olam auth` subcommands.
- *
- * Phase B (cloud-only-vault) flips the default credential backend across the
- * full CLI auth surface from local (`auth-service` container at 127.0.0.1:9999)
- * to remote (cloud auth-worker, e.g. auth-worker.kaluga.co). This helper is the
- * single seam every auth subcommand calls to determine which backend its
- * action should target.
- *
- * Resolution order (mirrors docs/architecture/cloud-only-vault.md §2 for
- * `withCredential`, adapted to the CLI's --local / --remote flag surface):
- *
- *   1. `--local` AND `--remote` (any form) both passed → throw
- *      `ConflictingBackendFlags` (exit 1 in the action handler).
- *   2. `--local` alone → backend='local', emitDeprecationWarning=true
- *      (operator explicitly opted out of the new default; warn so they know
- *      the flag will eventually be removed).
- *   3. `--remote` (boolean) alone → backend='remote', no warning.
- *   4. `--remote <url>` (string form, back-compat) → backend='remote',
- *      explicitRemoteUrl=<url>. No warning. Pre-Phase-B operators were
- *      already opting in by typing the URL.
- *   5. `OLAM_CREDENTIAL_BACKEND=local` env → backend='local', NO warning
- *      (env-set is the operator's host-wide preference; pestering them on
- *      every command is noise).
- *   6. `OLAM_CREDENTIAL_BACKEND=remote` env → backend='remote', no warning.
- *   7. Default → backend='remote' (the Phase B flip).
- *
- * The Phase A `withCredential` selector at
- * `packages/auth-client/src/backends/selector.ts` honours the same env var
- * for the agent runtime; this helper keeps the CLI surface symmetric.
- *
- * ─── Subcommand audit (current backend coupling, pre-Phase-B) ───
- *
- * Every existing `olam auth` subcommand and the code path it currently uses
- * to reach a credential backend. Each is a future caller of `requireBackend`
- * once B2 / B4 land. References are `packages/cli/src/commands/auth.ts` line
- * numbers at HEAD = 3a74bb62 (Phase A complete).
- *
- *   login            (auth.ts:170-306) — `--remote <url>` already wired to
- *                    auth-remote.ts `remoteOAuthStart` (auth.ts:178-238).
- *                    Local path (auth.ts:240-305) uses `AuthClient` against
- *                    127.0.0.1:9999. B2 flips the default + adds the
- *                    interactive confirm prompt + deprecation warning.
- *
- *   list             (auth.ts:416-509) — `--remote <url>` wired to
- *                    `remoteListAccounts` + `remoteListServiceTokens`
- *                    (auth.ts:423-464). Local path (auth.ts:466-508) uses
- *                    `AuthClient.status()`. B4 flips default + adds 30s TTL
- *                    cache + `--no-cache`.
- *
- *   refresh          (auth.ts:323-361) — LOCAL ONLY today. Reads config to
- *                    detect k8s substrate, then calls `AuthClient.refreshAccount`.
- *                    No --remote path exists yet. B4 adds a default-remote
- *                    branch (token-refresh via cloud DO) + `--local` opt-out.
- *
- *   disable          (auth.ts:124-137) — LOCAL ONLY (AuthClient.disableAccount).
- *                    B4 adds default-remote branch.
- *
- *   enable           (auth.ts:139-152) — LOCAL ONLY (AuthClient.enableAccount).
- *                    B4 adds default-remote branch.
- *
- *   status           (auth.ts:116-122 — deprecated alias for `olam services
- *                    status`) AND auth-status.ts:runAuthStatus (the real
- *                    status implementation invoked by other code paths).
- *                    LOCAL ONLY (AuthClient.status). B7 doctor sweep covers
- *                    the cross-backend health view.
- *
- *   list-json        (auth-list-json.ts) — pure serialiser invoked from
- *                    `list --json` (auth.ts:481-484). Operates on already-
- *                    fetched local data. B4 keeps it local-only for now
- *                    (the JSON wire shape is a local-vault contract).
- *
- *   logout           (auth.ts:308-321) — LOCAL ONLY (AuthClient.deleteAccount).
- *                    Out of Phase B scope; tracked for a follow-up plan.
- *
- *   remove           (auth.ts:154-167) — LOCAL ONLY (AuthClient.deleteAccount).
- *                    Out of Phase B scope.
- *
- *   bind-service-token    (auth.ts:363-413) — remote-only by design (CF
- *                    Access service-token binding). No `requireBackend` needed.
- *
- *   migrate-to-remote      (auth.ts:511-543) — bridging command from e6; B3
- *                    replaces this with `olam auth migrate`.
- *
- *   rotate-service-token   (auth.ts:545-572) — remote-only. No change.
- *
- *   doctor                  (auth.ts:574-614) — remote-only probe today; B7
- *                    extends to dual-backend health.
- *
- *   issue-anthropic-token  (auth.ts:616-684) — remote-only. No change.
- *
- *   list-anthropic-tokens  (auth.ts:686-740) — remote-only. No change.
- *
- *   revoke-anthropic-token (auth.ts:742-773) — remote-only. No change.
- *
- *   upgrade                 (registered via registerAuthUpgrade(auth) at
- *                    auth.ts:775) — separate file; out of Phase B scope.
- *
- * Subcommands flagged "LOCAL ONLY" today are the ones B4 will refactor to
- * route through `requireBackend`. The "remote-only by design" subcommands
- * (bind-service-token, doctor, issue/list/revoke anthropic tokens) keep
- * their `--remote` required flag — they have no local equivalent.
- */
-/** Discriminant for the resolved credential backend. */
-export type Backend = 'local' | 'remote';
-/**
- * Parsed CLI flags relevant to backend selection. Commander.js gives us
- * `--remote` as boolean OR string depending on the option definition; we
- * support both forms so subcommands can choose:
- *
- *   .option('--remote',         '...')  // boolean
- *   .option('--remote <url>',   '...')  // string (back-compat)
- *
- * Mixed-cardinality subcommands (login, list) historically used the string
- * form; future cleanup may collapse to boolean once the artifact-based
- * default URL discovery (Phase A `~/.olam/cloud-bearer.json`) covers all
- * call sites.
- */
-export interface BackendResolutionArgs {
-    readonly local?: boolean;
-    readonly remote?: boolean | string;
-}
-export interface BackendResolution {
-    readonly backend: Backend;
-    /**
-     * When backend='remote' and the operator passed `--remote <url>` (string
-     * form), the explicit URL. Subcommands prefer this over auto-discovered
-     * defaults (env / artifact / hard-coded fallback).
-     */
-    readonly explicitRemoteUrl?: string;
-    /**
-     * True when the operator passed `--local` on the CLI. Used by callers to
-     * emit a single deprecation-warning line to stderr before proceeding.
-     * False for `OLAM_CREDENTIAL_BACKEND=local` — that's a host-wide opt-out
-     * the operator already understands, no need to nag every command.
-     */
-    readonly emitDeprecationWarning: boolean;
-}
-/**
- * Thrown when the operator passes `--local` AND `--remote` to the same
- * subcommand. Both flags express intent — there's no sane way to choose
- * one silently. Action handlers should `printError(err.message); exit 1`.
- */
-export declare class ConflictingBackendFlags extends Error {
-    constructor();
-}
-/**
- * Resolve which credential backend a subcommand should target.
- *
- * See the resolution-order comment at the top of this file for the seven
- * branches. Pure function — no I/O, no side effects, no caching. Cheap
- * enough to call once per subcommand action.
- *
- * Reads `process.env.OLAM_CREDENTIAL_BACKEND` directly so callers don't
- * have to thread it through.
- */
-export declare function requireBackend(args: BackendResolutionArgs): BackendResolution;
-/**
- * Emit a single deprecation-warning line to the supplied stream. Centralised
- * so the wording stays consistent across every `olam auth` subcommand that
- * accepts `--local`. Returns void; callers may ignore the return.
- *
- * Callers should only invoke this when
- * `resolution.emitDeprecationWarning === true` — gating belongs to the
- * caller so test scaffolding can introspect the resolution without IO.
- */
-export declare function emitDeprecationWarning(stderr: NodeJS.WritableStream): void;
-//# sourceMappingURL=auth-backend.d.ts.map

package/dist/lib/auth-backend.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-backend.d.ts","sourceRoot":"","sources":["../../src/lib/auth-backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsGG;AAEH,wDAAwD;AACxD,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEzC;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;;CAKjD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,qBAAqB,GAAG,iBAAiB,CAwC7E;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,CAK1E"}

package/dist/lib/auth-backend.js

@@ -1,172 +0,0 @@
-/**
- * auth-backend — shared backend resolver for `olam auth` subcommands.
- *
- * Phase B (cloud-only-vault) flips the default credential backend across the
- * full CLI auth surface from local (`auth-service` container at 127.0.0.1:9999)
- * to remote (cloud auth-worker, e.g. auth-worker.kaluga.co). This helper is the
- * single seam every auth subcommand calls to determine which backend its
- * action should target.
- *
- * Resolution order (mirrors docs/architecture/cloud-only-vault.md §2 for
- * `withCredential`, adapted to the CLI's --local / --remote flag surface):
- *
- *   1. `--local` AND `--remote` (any form) both passed → throw
- *      `ConflictingBackendFlags` (exit 1 in the action handler).
- *   2. `--local` alone → backend='local', emitDeprecationWarning=true
- *      (operator explicitly opted out of the new default; warn so they know
- *      the flag will eventually be removed).
- *   3. `--remote` (boolean) alone → backend='remote', no warning.
- *   4. `--remote <url>` (string form, back-compat) → backend='remote',
- *      explicitRemoteUrl=<url>. No warning. Pre-Phase-B operators were
- *      already opting in by typing the URL.
- *   5. `OLAM_CREDENTIAL_BACKEND=local` env → backend='local', NO warning
- *      (env-set is the operator's host-wide preference; pestering them on
- *      every command is noise).
- *   6. `OLAM_CREDENTIAL_BACKEND=remote` env → backend='remote', no warning.
- *   7. Default → backend='remote' (the Phase B flip).
- *
- * The Phase A `withCredential` selector at
- * `packages/auth-client/src/backends/selector.ts` honours the same env var
- * for the agent runtime; this helper keeps the CLI surface symmetric.
- *
- * ─── Subcommand audit (current backend coupling, pre-Phase-B) ───
- *
- * Every existing `olam auth` subcommand and the code path it currently uses
- * to reach a credential backend. Each is a future caller of `requireBackend`
- * once B2 / B4 land. References are `packages/cli/src/commands/auth.ts` line
- * numbers at HEAD = 3a74bb62 (Phase A complete).
- *
- *   login            (auth.ts:170-306) — `--remote <url>` already wired to
- *                    auth-remote.ts `remoteOAuthStart` (auth.ts:178-238).
- *                    Local path (auth.ts:240-305) uses `AuthClient` against
- *                    127.0.0.1:9999. B2 flips the default + adds the
- *                    interactive confirm prompt + deprecation warning.
- *
- *   list             (auth.ts:416-509) — `--remote <url>` wired to
- *                    `remoteListAccounts` + `remoteListServiceTokens`
- *                    (auth.ts:423-464). Local path (auth.ts:466-508) uses
- *                    `AuthClient.status()`. B4 flips default + adds 30s TTL
- *                    cache + `--no-cache`.
- *
- *   refresh          (auth.ts:323-361) — LOCAL ONLY today. Reads config to
- *                    detect k8s substrate, then calls `AuthClient.refreshAccount`.
- *                    No --remote path exists yet. B4 adds a default-remote
- *                    branch (token-refresh via cloud DO) + `--local` opt-out.
- *
- *   disable          (auth.ts:124-137) — LOCAL ONLY (AuthClient.disableAccount).
- *                    B4 adds default-remote branch.
- *
- *   enable           (auth.ts:139-152) — LOCAL ONLY (AuthClient.enableAccount).
- *                    B4 adds default-remote branch.
- *
- *   status           (auth.ts:116-122 — deprecated alias for `olam services
- *                    status`) AND auth-status.ts:runAuthStatus (the real
- *                    status implementation invoked by other code paths).
- *                    LOCAL ONLY (AuthClient.status). B7 doctor sweep covers
- *                    the cross-backend health view.
- *
- *   list-json        (auth-list-json.ts) — pure serialiser invoked from
- *                    `list --json` (auth.ts:481-484). Operates on already-
- *                    fetched local data. B4 keeps it local-only for now
- *                    (the JSON wire shape is a local-vault contract).
- *
- *   logout           (auth.ts:308-321) — LOCAL ONLY (AuthClient.deleteAccount).
- *                    Out of Phase B scope; tracked for a follow-up plan.
- *
- *   remove           (auth.ts:154-167) — LOCAL ONLY (AuthClient.deleteAccount).
- *                    Out of Phase B scope.
- *
- *   bind-service-token    (auth.ts:363-413) — remote-only by design (CF
- *                    Access service-token binding). No `requireBackend` needed.
- *
- *   migrate-to-remote      (auth.ts:511-543) — bridging command from e6; B3
- *                    replaces this with `olam auth migrate`.
- *
- *   rotate-service-token   (auth.ts:545-572) — remote-only. No change.
- *
- *   doctor                  (auth.ts:574-614) — remote-only probe today; B7
- *                    extends to dual-backend health.
- *
- *   issue-anthropic-token  (auth.ts:616-684) — remote-only. No change.
- *
- *   list-anthropic-tokens  (auth.ts:686-740) — remote-only. No change.
- *
- *   revoke-anthropic-token (auth.ts:742-773) — remote-only. No change.
- *
- *   upgrade                 (registered via registerAuthUpgrade(auth) at
- *                    auth.ts:775) — separate file; out of Phase B scope.
- *
- * Subcommands flagged "LOCAL ONLY" today are the ones B4 will refactor to
- * route through `requireBackend`. The "remote-only by design" subcommands
- * (bind-service-token, doctor, issue/list/revoke anthropic tokens) keep
- * their `--remote` required flag — they have no local equivalent.
- */
-/**
- * Thrown when the operator passes `--local` AND `--remote` to the same
- * subcommand. Both flags express intent — there's no sane way to choose
- * one silently. Action handlers should `printError(err.message); exit 1`.
- */
-export class ConflictingBackendFlags extends Error {
-    constructor() {
-        super('Cannot specify both --local and --remote. Pick one.');
-        this.name = 'ConflictingBackendFlags';
-    }
-}
-/**
- * Resolve which credential backend a subcommand should target.
- *
- * See the resolution-order comment at the top of this file for the seven
- * branches. Pure function — no I/O, no side effects, no caching. Cheap
- * enough to call once per subcommand action.
- *
- * Reads `process.env.OLAM_CREDENTIAL_BACKEND` directly so callers don't
- * have to thread it through.
- */
-export function requireBackend(args) {
-    const localFlag = args.local === true;
-    const remoteFlag = args.remote === true || (typeof args.remote === 'string' && args.remote.length > 0);
-    // (1) Conflict — both flags explicit.
-    if (localFlag && remoteFlag) {
-        throw new ConflictingBackendFlags();
-    }
-    // (2) Explicit --local opt-out.
-    if (localFlag) {
-        return { backend: 'local', emitDeprecationWarning: true };
-    }
-    // (3) Explicit --remote (boolean).
-    if (args.remote === true) {
-        return { backend: 'remote', emitDeprecationWarning: false };
-    }
-    // (4) Explicit --remote <url> (string).
-    if (typeof args.remote === 'string' && args.remote.length > 0) {
-        return {
-            backend: 'remote',
-            explicitRemoteUrl: args.remote,
-            emitDeprecationWarning: false,
-        };
-    }
-    // (5) + (6) Env-set override.
-    const env = process.env['OLAM_CREDENTIAL_BACKEND'];
-    if (env === 'local') {
-        return { backend: 'local', emitDeprecationWarning: false };
-    }
-    if (env === 'remote') {
-        return { backend: 'remote', emitDeprecationWarning: false };
-    }
-    // (7) Default — Phase B flip: remote.
-    return { backend: 'remote', emitDeprecationWarning: false };
-}
-/**
- * Emit a single deprecation-warning line to the supplied stream. Centralised
- * so the wording stays consistent across every `olam auth` subcommand that
- * accepts `--local`. Returns void; callers may ignore the return.
- *
- * Callers should only invoke this when
- * `resolution.emitDeprecationWarning === true` — gating belongs to the
- * caller so test scaffolding can introspect the resolution without IO.
- */
-export function emitDeprecationWarning(stderr) {
-    stderr.write('warning: --local flag is deprecated. Cloud auth-worker is now the default. ' +
-        'See docs/plans/cloud-only-vault/.\n');
-}
-//# sourceMappingURL=auth-backend.js.map

package/dist/lib/auth-backend.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-backend.js","sourceRoot":"","sources":["../../src/lib/auth-backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsGG;AAwCH;;;;GAIG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD;QACE,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,IAA2B;IACxD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;IACtC,MAAM,UAAU,GACd,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEtF,sCAAsC;IACtC,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,IAAI,uBAAuB,EAAE,CAAC;IACtC,CAAC;IAED,gCAAgC;IAChC,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC;IAC5D,CAAC;IAED,mCAAmC;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED,wCAAwC;IACxC,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9D,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,iBAAiB,EAAE,IAAI,CAAC,MAAM;YAC9B,sBAAsB,EAAE,KAAK;SAC9B,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACnD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED,sCAAsC;IACtC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA6B;IAClE,MAAM,CAAC,KAAK,CACV,6EAA6E;QAC3E,qCAAqC,CACxC,CAAC;AACJ,CAAC"}

package/dist/lib/auth-list-cache.d.ts

@@ -1,67 +0,0 @@
-/**
- * auth-list-cache — in-process TTL cache for `olam auth list --remote` results.
- *
- * Phase B (cloud-only-vault) Decision D5 caches remote `auth list` results for
- * 30 seconds in-memory (NOT persisted to disk). The cache keeps interactive
- * runs cheap and lets driver scripts (e.g. `olam doctor` probes that fan out
- * to `auth list` for credential health) avoid hammering the cloud DO.
- *
- * Two-tier read model: `getCachedAuthList` returns a FRESH entry (within TTL),
- * `getStaleAuthList` returns the most recent entry regardless of age — the
- * latter is the offline fallback used when a fresh fetch fails. The command
- * action surfaces staleness to the operator via a `(stale)` annotation +
- * footer warning.
- *
- * Key shape: callers compose a key from (baseUrl, identityHint). A single
- * Map keyed by that string keeps multiple auth-worker targets isolated (an
- * operator running `auth list --remote A` then `--remote B` shouldn't see
- * A's results for B).
- *
- * Not persisted: this cache lives only as long as the CLI process. Phase D
- * may extend to a file-based cache if operator runs frequent short-lived
- * `olam auth list` invocations and pays a real RTT cost — but the in-process
- * model is simpler + correct for the most common cases (interactive use,
- * tight-loop script invocations within a single CLI process).
- *
- * Concurrency: single-threaded JS; no locking needed. Read returns the
- * snapshot at-call-time.
- */
-/** TTL in milliseconds — 30 seconds per Decision D5. */
-export declare const AUTH_LIST_CACHE_TTL_MS = 30000;
-/**
- * Return the cached entry for `key` when it's within the TTL window.
- * Returns `null` when the entry is missing OR stale. `now` is injectable
- * for deterministic tests; production callers omit it.
- */
-export declare function getCachedAuthList<T>(key: string, now?: number): {
-    result: T;
-    fetchedAt: number;
-} | null;
-/**
- * Return the cached entry for `key` regardless of age. Used as the
- * offline fallback when a fresh fetch fails. Returns `null` when the
- * cache has never seen this key.
- */
-export declare function getStaleAuthList<T>(key: string): {
-    result: T;
-    fetchedAt: number;
-} | null;
-/**
- * Insert / replace the cached entry for `key`. `now` is injectable for tests.
- */
-export declare function setCachedAuthList<T>(key: string, result: T, now?: number): void;
-/**
- * Invalidate the entry for `key`. When `key` is omitted, clear the entire
- * cache. Callers use this after a mutation that the next `list` MUST reflect
- * (e.g. an explicit `auth login` succeeded against the same baseUrl) — though
- * for B4 (narrowed) such mutations live on the local backend so callers will
- * mostly leave the cache to expire naturally.
- */
-export declare function invalidateAuthListCache(key?: string): void;
-/**
- * Test-only: wipes the module-level cache. Production code MUST NOT call
- * this. Tests that share the module across describe blocks call it in a
- * `beforeEach` to keep the cache deterministic.
- */
-export declare function _resetAuthListCacheForTests(): void;
-//# sourceMappingURL=auth-list-cache.d.ts.map

package/dist/lib/auth-list-cache.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-list-cache.d.ts","sourceRoot":"","sources":["../../src/lib/auth-list-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,wDAAwD;AACxD,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAS7C;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,MAAmB,GACvB;IAAE,MAAM,EAAE,CAAC,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAKzC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAChC,GAAG,EAAE,MAAM,GACV;IAAE,MAAM,EAAE,CAAC,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAIzC;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,CAAC,EACT,GAAG,GAAE,MAAmB,GACvB,IAAI,CAEN;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAM1D;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,CAElD"}