@pleri/olam-cli 0.1.201 → 0.1.204

package/dist/lib/auth-mutator-backend.js

@@ -1,62 +0,0 @@
-/**
- * auth-mutator-backend — backend resolver for `olam auth refresh / disable /
- * enable` under B4 (narrowed scope).
- *
- * Phase A6 architecturally ruled out adding `/v1/credentials/*` mutators to
- * the cloud DO. As a result, refresh / disable / enable currently have ONE
- * valid backend (local). This helper exists so the three subcommand handlers
- * share identical flag-parsing + identical "remote-unsupported" exit
- * semantics:
- *
- *   - default (no flag) → proceed (local)
- *   - --local → proceed (local) — no deprecation warning emitted; warning the
- *     operator against the only working backend would be hostile until OQ7
- *     ships a cloud-side equivalent.
- *   - --remote (any form) → exit code 2 + structured message pointing to OQ7
- *   - --local --remote → exit code 1 (ConflictingBackendFlags semantic)
- *
- * Exit code 2 is the marker callers parse to distinguish "this subcommand
- * has no cloud equivalent yet" from a generic local failure (exit 1).
- * Wrapping scripts can branch on it to either fall back to --local or
- * surface a clear "this needs OQ7" message.
- *
- * The message body uses a `%s` placeholder for the subcommand name so the
- * three callers share one string.
- */
-/** Structured message body for the remote-unsupported path. */
-export const REMOTE_MUTATOR_UNSUPPORTED_MESSAGE_TEMPLATE = 'olam auth %s has no cloud equivalent yet.\n' +
-    "Phase A's architectural decision keeps the cloud DO's credential\n" +
-    'surface proxy-only. Tracked follow-up: docs/plans/cloud-only-vault/\n' +
-    'README.md § Open questions → admin mutator UX.\n\n' +
-    'Use --local to operate on the legacy vault.';
-/**
- * Render the remote-unsupported message for a specific subcommand.
- */
-export function renderRemoteUnsupportedMessage(subcommand) {
-    return REMOTE_MUTATOR_UNSUPPORTED_MESSAGE_TEMPLATE.replace('%s', subcommand);
-}
-/**
- * Resolve which path a mutator subcommand should take given the operator's
- * flags. Pure function — caller is responsible for printing the message +
- * setting the process.exitCode.
- */
-export function resolveMutatorBackend(subcommand, args) {
-    const localFlag = args.local === true;
-    const remoteFlag = args.remote === true ||
-        (typeof args.remote === 'string' && args.remote.length > 0);
-    if (localFlag && remoteFlag) {
-        return {
-            outcome: 'conflict',
-            message: 'Cannot specify both --local and --remote. Pick one.',
-        };
-    }
-    if (remoteFlag) {
-        return {
-            outcome: 'remote-unsupported',
-            message: renderRemoteUnsupportedMessage(subcommand),
-            exitCode: 2,
-        };
-    }
-    return { outcome: 'proceed-local' };
-}
-//# sourceMappingURL=auth-mutator-backend.js.map

package/dist/lib/auth-mutator-backend.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-mutator-backend.js","sourceRoot":"","sources":["../../src/lib/auth-mutator-backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAcH,+DAA+D;AAC/D,MAAM,CAAC,MAAM,2CAA2C,GACtD,6CAA6C;IAC7C,oEAAoE;IACpE,uEAAuE;IACvE,oDAAoD;IACpD,6CAA6C,CAAC;AAEhD;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAAC,UAAkB;IAC/D,OAAO,2CAA2C,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,IAAwB;IAExB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;IACtC,MAAM,UAAU,GACd,IAAI,CAAC,MAAM,KAAK,IAAI;QACpB,CAAC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE9D,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,UAAU;YACnB,OAAO,EAAE,qDAAqD;SAC/D,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,oBAAoB;YAC7B,OAAO,EAAE,8BAA8B,CAAC,UAAU,CAAC;YACnD,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;AACtC,CAAC"}

package/dist/lib/auth-refresh-kubernetes.d.ts

@@ -1,65 +0,0 @@
-/**
- * auth-refresh-kubernetes.ts — D4 kubernetes Secret rotation for `olam auth refresh`.
- *
- * Extracted from auth.ts to keep the testable logic free of @olam/core dependencies.
- * No @olam/core imports here — tested directly by auth.test.ts without needing
- * to mock the entire @olam/core workspace package.
- *
- * D20 security invariant: secret value NEVER in subprocess argv (–from-literal forbidden).
- * SEC-NEW-003: refuses when kubectl_context_pinned absent (no ambient KUBECONFIG fallthrough).
- * ADV-N-003: kubectl rollout restart after apply (K8s does NOT hot-update mounted Secrets).
- */
-import { kubectlWrap } from './kubectl-wrap.js';
-export interface AuthRefreshKubernetesDeps {
-    /** Injectable kubectlWrap for tests (Secret apply + rollout restart). */
-    readonly kubectlWrapImpl?: typeof kubectlWrap;
-    /** Injectable readFileSync for reading ~/.olam/auth-secret. */
-    readonly readFileSyncImpl?: (p: string, enc: 'utf8') => string;
-    /** Injectable writeFileSync for writing ~/.olam/auth-secret. */
-    readonly writeFileSyncImpl?: (p: string, data: string, opts: {
-        mode: number;
-    }) => void;
-    /** Injectable config path for readConfig. */
-    readonly configPath?: string;
-    /** Injectable olam home override (for auth-secret path). */
-    readonly olamHomeOverride?: string;
-    /** Injectable stdout. */
-    readonly stdout?: NodeJS.WritableStream;
-    /** Injectable stderr. */
-    readonly stderr?: NodeJS.WritableStream;
-}
-/**
- * Construct the olam-host-cp-secret YAML in-process (D20 stdin-safe design).
- * Values are base64-encoded via Buffer. NEVER uses --from-literal in subprocess argv.
- */
-export declare function buildSecretYaml(secretName: string, data: Record<string, string>): string;
-/**
- * Resolve the pinned kubectl context from config or OLAM_K8S_CONTEXT_ACK fallback.
- *
- * Returns { context } on success.
- * Returns { error } when neither source has a context (SEC-NEW-003 enforcement).
- * Returns { context, deprecationWarning } when OLAM_K8S_CONTEXT_ACK fallback is used.
- *
- * Re-exports the canonical implementation from `kubectl-context.ts` so all
- * call sites share one policy.
- */
-export declare function resolveKubectlContext(configPath?: string): {
-    context?: string;
-    deprecationWarning?: string;
-    error?: string;
-};
-/**
- * Run the kubernetes-substrate portion of auth refresh (D4).
- *
- * Called by auth.ts after a successful `client.refreshAccount()` when
- * the substrate is kubernetes. Performs:
- *   1. Reads ~/.olam/auth-secret for the bearer secret value.
- *   2. Writes ~/.olam/auth-secret back (idempotent, sets mode 0o600).
- *   3. Constructs olam-host-cp-secret YAML in-process (D20: value in stdin, not argv).
- *   4. kubectl apply -f - via stdin pipe.
- *   5. kubectl rollout restart deployment/olam-host-cp -n olam (ADV-N-003).
- *
- * Returns exit code: 0 = success, 1 = error.
- */
-export declare function applyK8sAuthRefresh(pinnedContext: string, deps?: AuthRefreshKubernetesDeps): Promise<number>;
-//# sourceMappingURL=auth-refresh-kubernetes.d.ts.map

package/dist/lib/auth-refresh-kubernetes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-refresh-kubernetes.d.ts","sourceRoot":"","sources":["../../src/lib/auth-refresh-kubernetes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAOhD,MAAM,WAAW,yBAAyB;IACxC,yEAAyE;IACzE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,WAAW,CAAC;IAC9C,+DAA+D;IAC/D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/D,gEAAgE;IAChE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACvF,6CAA6C;IAC7C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,4DAA4D;IAC5D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,yBAAyB;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IACxC,yBAAyB;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CACzC;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAYxF;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAEA;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,MAAM,EACrB,IAAI,GAAE,yBAA8B,GACnC,OAAO,CAAC,MAAM,CAAC,CA4EjB"}

package/dist/lib/auth-refresh-kubernetes.js

@@ -1,125 +0,0 @@
-/**
- * auth-refresh-kubernetes.ts — D4 kubernetes Secret rotation for `olam auth refresh`.
- *
- * Extracted from auth.ts to keep the testable logic free of @olam/core dependencies.
- * No @olam/core imports here — tested directly by auth.test.ts without needing
- * to mock the entire @olam/core workspace package.
- *
- * D20 security invariant: secret value NEVER in subprocess argv (–from-literal forbidden).
- * SEC-NEW-003: refuses when kubectl_context_pinned absent (no ambient KUBECONFIG fallthrough).
- * ADV-N-003: kubectl rollout restart after apply (K8s does NOT hot-update mounted Secrets).
- */
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import pc from 'picocolors';
-import { stringify as yamlStringify } from 'yaml';
-import { OLAM_HOME } from './config.js';
-import { kubectlWrap } from './kubectl-wrap.js';
-import { HOST_CP_SECRET_NAME, HOST_CP_DEPLOYMENT_NAME } from './upgrade-kubernetes.js';
-import { resolveKubectlContext as resolveKubectlContextShared } from './kubectl-context.js';
-import { resolveSecretPath, canonicalSecretPath, ensureSecretsDir } from '@olam/core/src/secrets/paths.js';
-const K8S_NAMESPACE = 'olam';
-/**
- * Construct the olam-host-cp-secret YAML in-process (D20 stdin-safe design).
- * Values are base64-encoded via Buffer. NEVER uses --from-literal in subprocess argv.
- */
-export function buildSecretYaml(secretName, data) {
-    const base64Data = {};
-    for (const [key, value] of Object.entries(data)) {
-        base64Data[key] = Buffer.from(value).toString('base64');
-    }
-    return yamlStringify({
-        apiVersion: 'v1',
-        kind: 'Secret',
-        metadata: { name: secretName, namespace: K8S_NAMESPACE },
-        type: 'Opaque',
-        data: base64Data,
-    });
-}
-/**
- * Resolve the pinned kubectl context from config or OLAM_K8S_CONTEXT_ACK fallback.
- *
- * Returns { context } on success.
- * Returns { error } when neither source has a context (SEC-NEW-003 enforcement).
- * Returns { context, deprecationWarning } when OLAM_K8S_CONTEXT_ACK fallback is used.
- *
- * Re-exports the canonical implementation from `kubectl-context.ts` so all
- * call sites share one policy.
- */
-export function resolveKubectlContext(configPath) {
-    return resolveKubectlContextShared(configPath);
-}
-/**
- * Run the kubernetes-substrate portion of auth refresh (D4).
- *
- * Called by auth.ts after a successful `client.refreshAccount()` when
- * the substrate is kubernetes. Performs:
- *   1. Reads ~/.olam/auth-secret for the bearer secret value.
- *   2. Writes ~/.olam/auth-secret back (idempotent, sets mode 0o600).
- *   3. Constructs olam-host-cp-secret YAML in-process (D20: value in stdin, not argv).
- *   4. kubectl apply -f - via stdin pipe.
- *   5. kubectl rollout restart deployment/olam-host-cp -n olam (ADV-N-003).
- *
- * Returns exit code: 0 = success, 1 = error.
- */
-export async function applyK8sAuthRefresh(pinnedContext, deps = {}) {
-    const stdout = deps.stdout ?? process.stdout;
-    const stderr = deps.stderr ?? process.stderr;
-    const olamHome = deps.olamHomeOverride ?? OLAM_HOME;
-    // READ from resolved path (new canonical or legacy fallback).
-    const authSecretReadFile = deps.olamHomeOverride
-        ? path.join(olamHome, 'auth-secret')
-        : resolveSecretPath('auth-secret');
-    // WRITE to canonical path.
-    const authSecretWriteFile = deps.olamHomeOverride
-        ? path.join(olamHome, 'auth-secret')
-        : canonicalSecretPath('auth-secret');
-    const readFn = deps.readFileSyncImpl ?? ((p, enc) => fs.readFileSync(p, enc));
-    const writeFn = deps.writeFileSyncImpl ?? ((p, data, opts) => {
-        ensureSecretsDir();
-        fs.mkdirSync(path.dirname(p), { recursive: true });
-        fs.writeFileSync(p, data, { encoding: 'utf8', mode: opts.mode });
-    });
-    const wrap = deps.kubectlWrapImpl ?? kubectlWrap;
-    // Read current auth-secret.
-    let authSecretValue = null;
-    try {
-        const raw = readFn(authSecretReadFile, 'utf8').trim();
-        if (raw.length > 0)
-            authSecretValue = raw;
-    }
-    catch {
-        // File absent — warn and skip Secret update.
-    }
-    // Write to canonical location (both substrates; idempotent).
-    if (authSecretValue !== null) {
-        writeFn(authSecretWriteFile, authSecretValue + '\n', { mode: 0o600 });
-    }
-    else {
-        stderr.write(`${pc.yellow('[warn]')} ~/.olam/auth-secret not found — skipping kubernetes Secret update. ` +
-            `Run \`olam upgrade\` to populate the Secret.\n`);
-        return 0;
-    }
-    // D20: construct Secret YAML in-process; secret value NEVER in subprocess argv.
-    const secretYaml = buildSecretYaml(HOST_CP_SECRET_NAME, {
-        OLAM_AUTH_SECRET: authSecretValue,
-    });
-    // Apply the Secret via stdin pipe.
-    const applyResult = await wrap(['--context', pinnedContext, 'apply', '-f', '-'], { timeout: 30_000, stdin: secretYaml });
-    if (!applyResult.ok) {
-        stderr.write(`${pc.red('error:')} kubectl apply (Secret update) failed: ${applyResult.stderr.split('\n')[0] ?? ''}\n`);
-        return 1;
-    }
-    // ADV-N-003: rollout restart to flush the mounted Secret into host-cp.
-    const rolloutResult = await wrap(['--context', pinnedContext, 'rollout', 'restart', `deployment/${HOST_CP_DEPLOYMENT_NAME}`, '-n', K8S_NAMESPACE], { timeout: 60_000 });
-    if (!rolloutResult.ok) {
-        stderr.write(`${pc.yellow('[warn]')} rollout restart failed: ${rolloutResult.stderr.split('\n')[0] ?? ''}. ` +
-            `host-cp may not pick up the new token until the next pod restart.\n`);
-        // Non-fatal: apply succeeded; warn but return 0.
-    }
-    else {
-        stdout.write(`${pc.green('✓')} Restarted deployment/${HOST_CP_DEPLOYMENT_NAME} (new token mounted)\n`);
-    }
-    return 0;
-}
-//# sourceMappingURL=auth-refresh-kubernetes.js.map

package/dist/lib/auth-refresh-kubernetes.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-refresh-kubernetes.js","sourceRoot":"","sources":["../../src/lib/auth-refresh-kubernetes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EAAE,qBAAqB,IAAI,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAE3G,MAAM,aAAa,GAAG,MAAM,CAAC;AAmB7B;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,IAA4B;IAC9E,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,aAAa,CAAC;QACnB,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE;QACxD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,UAAU;KACjB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAmB;IAKvD,OAAO,2BAA2B,CAAC,UAAU,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,aAAqB,EACrB,OAAkC,EAAE;IAEpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,IAAI,SAAS,CAAC;IACpD,8DAA8D;IAC9D,MAAM,kBAAkB,GAAG,IAAI,CAAC,gBAAgB;QAC9C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC;QACpC,CAAC,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;IACrC,2BAA2B;IAC3B,MAAM,mBAAmB,GAAG,IAAI,CAAC,gBAAgB;QAC/C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC;QACpC,CAAC,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAS,EAAE,GAAW,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,IAAI,CAAC,CAAC,CAAS,EAAE,IAAY,EAAE,IAAsB,EAAE,EAAE;QAC7F,gBAAgB,EAAE,CAAC;QACnB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,IAAI,WAAW,CAAC;IAEjD,4BAA4B;IAC5B,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,eAAe,GAAG,GAAG,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;IAED,6DAA6D;IAC7D,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,CAAC,mBAAmB,EAAE,eAAe,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,sEAAsE;YAC5F,gDAAgD,CACjD,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,gFAAgF;IAChF,MAAM,UAAU,GAAG,eAAe,CAAC,mBAAmB,EAAE;QACtD,gBAAgB,EAAE,eAAe;KAClC,CAAC,CAAC;IAEH,mCAAmC;IACnC,MAAM,WAAW,GAAG,MAAM,IAAI,CAC5B,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAChD,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,CACvC,CAAC;IAEF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,0CAA0C,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CACzG,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,uEAAuE;IACvE,MAAM,aAAa,GAAG,MAAM,IAAI,CAC9B,CAAC,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,uBAAuB,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,EAChH,EAAE,OAAO,EAAE,MAAM,EAAE,CACpB,CAAC;IAEF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACtB,MAAM,CAAC,KAAK,CACV,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI;YAC/F,qEAAqE,CACtE,CAAC;QACF,iDAAiD;IACnD,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,uBAAuB,wBAAwB,CAAC,CAAC;IACzG,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/lib/auth-remote.d.ts

@@ -1,172 +0,0 @@
-/**
- * auth-remote — HTTP helper for `olam auth --remote <url>` subcommands.
- *
- * Wraps fetch calls against the auth-worker's `/v1/*` endpoints.
- *
- * V1 dogfood note: CF Access cookie must be obtained manually via browser.
- * A proper CLI-orchestrated SSO flow (CLI-as-OAuth-client) is deferred to v2.
- * See e4/e5/e6 task notes in docs/plans/auth-worker-multitenant-vault/.
- */
-export type FetchFn = typeof fetch;
-export interface RemoteClientOptions {
-    /** Auth-worker base URL, e.g. https://auth.example.workers.dev */
-    baseUrl: string;
-    /** CF_Authorization cookie value, obtained manually from browser DevTools. */
-    cfAuthCookie?: string;
-    /**
-     * CF Access service-token client id (Phase H h2). When both this and
-     * cfAccessClientSecret are present, the request authenticates machine-to-
-     * machine via CF-Access-Client-Id / CF-Access-Client-Secret headers — no
-     * cookie-paste needed. The Cloudflare edge mints the SSO JWT.
-     */
-    cfAccessClientId?: string;
-    /** CF Access service-token client secret (paired with cfAccessClientId). */
-    cfAccessClientSecret?: string;
-    /** Injected fetch for testing. Defaults to global fetch. */
-    fetchFn?: FetchFn;
-}
-export interface ServiceToken {
-    client_id: string;
-    label: string;
-    created_at?: string;
-}
-/**
- * Per-account row returned by the cloud auth-worker's `GET /v1/accounts`
- * (B4 narrowed). The wire shape MUST stay aligned with the server's
- * handleListAccounts response in `packages/auth-worker/src/auth-worker-do.ts`.
- *
- * Backward-compat fields (`label`, `expiresIn`) are populated by
- * `remoteListAccounts` from the raw server payload so existing call sites
- * (pre-B4 `olam auth list --remote <url>` text rendering) keep rendering.
- */
-export interface AccountEntry {
-    id: string;
-    /** Friendly label — accountLabel from server, falling back to id. */
-    label?: string;
-    /** 'active' | 'cooldown' | 'disabled' (server-derived). */
-    state?: string;
-    /** Pre-B4 free-form expiry hint; populated post-B4 from `expiresAt` epoch ms. */
-    expiresIn?: string;
-    /** B4: provider — usually 'claude'. */
-    provider?: string;
-    /** B4: email, may be null. */
-    email?: string | null;
-    /** B4: ISO timestamp the cooldown / rate-limit window resets at. */
-    rateLimitResetsAt?: string | null;
-    /** B4: ISO timestamp the weekly rate-limit window resets at. */
-    weeklyResetsAt?: string | null;
-}
-/** B4: server response wire shape for GET /v1/accounts. */
-export interface ListAccountsResponse {
-    accounts: ReadonlyArray<{
-        id: string;
-        provider: string;
-        email: string | null;
-        accountLabel: string | null;
-        state: 'active' | 'cooldown' | 'disabled';
-        rateLimited: boolean;
-        rateLimitResetsAt: string | null;
-        weeklyResetsAt: string | null;
-        expiresAt: number;
-        addedAt: string;
-        lastRefreshed: string;
-        lastUsed: string | null;
-        plan: string | null;
-        organization: string | null;
-        scopes: ReadonlyArray<string>;
-    }>;
-    count: number;
-}
-export interface AnthropicTokenIssueResponse {
-    secret: string;
-    token_hash: string;
-    label: string;
-    anthropic_base_url_hint?: string;
-}
-export interface AnthropicTokenEntry {
-    token_hash: string;
-    label: string;
-    issued_at?: string;
-    created_at?: string;
-    last_used_at?: string;
-}
-export interface OAuthStartResponse {
-    authorize_url: string;
-    state_id: string;
-}
-export interface HealthResponse {
-    status: string;
-    version?: string;
-}
-export interface DoctorCheckResult {
-    probe: string;
-    status: 'pass' | 'fail' | 'warn';
-    message: string;
-    remedy?: string;
-}
-/**
- * GET /v1/health — worker liveness probe.
- */
-export declare function remoteHealth(opts: RemoteClientOptions): Promise<HealthResponse>;
-/**
- * POST /v1/oauth/start — begin an OAuth flow.
- * Returns { authorize_url, state_id }.
- */
-export declare function remoteOAuthStart(opts: RemoteClientOptions): Promise<OAuthStartResponse>;
-/**
- * GET /v1/service-tokens — list bound service tokens.
- */
-export declare function remoteListServiceTokens(opts: RemoteClientOptions): Promise<ServiceToken[]>;
-/**
- * GET /v1/accounts — list registered accounts (Anthropic OAuth sessions).
- *
- * B4 (narrowed): the server response is `{accounts, count}`. We map it back to
- * the AccountEntry[] shape pre-existing call sites expect, and we never trust
- * the server to omit secret fields — see the explicit field whitelist below.
- *
- * Defensive shape handling: the server contract is `{accounts: [...], count}`,
- * but the legacy pre-B4 mock and older server builds may have returned a bare
- * array. Both shapes are accepted (array OR envelope) so a partial roll-out
- * never blocks the CLI from rendering useful output.
- */
-export declare function remoteListAccounts(opts: RemoteClientOptions): Promise<AccountEntry[]>;
-/**
- * POST /v1/service-tokens/bind — bind a CF service token to a user sub.
- */
-export declare function remoteBindServiceToken(opts: RemoteClientOptions, payload: {
-    client_id: string;
-    label: string;
-}): Promise<{
-    ok: boolean;
-}>;
-/**
- * DELETE /v1/service-tokens/:client_id — revoke a service token.
- */
-export declare function remoteDeleteServiceToken(opts: RemoteClientOptions, clientId: string): Promise<{
-    ok: boolean;
-}>;
-/**
- * POST /v1/anthropic-tokens/issue — mint a new Anthropic proxy token.
- * Returns { secret, token_hash, label, anthropic_base_url_hint }.
- */
-export declare function remoteIssueAnthropicToken(opts: RemoteClientOptions, label: string): Promise<AnthropicTokenIssueResponse>;
-/**
- * GET /v1/anthropic-tokens — list issued Anthropic proxy tokens.
- */
-export declare function remoteListAnthropicTokens(opts: RemoteClientOptions): Promise<AnthropicTokenEntry[]>;
-/**
- * DELETE /v1/anthropic-tokens/:token_hash — revoke an Anthropic proxy token.
- * Returns true on 200/204, false on 404.
- */
-export declare function remoteRevokeAnthropicToken(opts: RemoteClientOptions, tokenHash: string): Promise<boolean>;
-/**
- * runDoctorChecks — runs 4 diagnostic probes against the auth-worker.
- * Returns an ordered array of DoctorCheckResult (pass/fail/warn + remedy).
- *
- * Probe 1: GET /v1/health → liveness
- * Probe 2: CF Access JWKS reachable (derives team domain from worker URL)
- * Probe 3: POST /v1/oauth/start → endpoint reachability
- * Probe 4: ANTHROPIC_OAUTH_CLIENT_ID env present (config check)
- */
-export declare function runDoctorChecks(opts: RemoteClientOptions): Promise<DoctorCheckResult[]>;
-//# sourceMappingURL=auth-remote.d.ts.map

package/dist/lib/auth-remote.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-remote.d.ts","sourceRoot":"","sources":["../../src/lib/auth-remote.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC;AAEnC,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,4DAA4D;IAC5D,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAOD,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,2DAA2D;AAC3D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,aAAa,CAAC;QACtB,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,KAAK,EAAE,QAAQ,GAAG,UAAU,GAAG,UAAU,CAAC;QAC1C,WAAW,EAAE,OAAO,CAAC;QACrB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;KAC/B,CAAC,CAAC;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAsCD;;GAEG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,cAAc,CAAC,CAWzB;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAa7B;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,YAAY,EAAE,CAAC,CAWzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,YAAY,EAAE,CAAC,CAmDzB;AAoCD;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAA;CAAE,CAAC,CAa1B;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,mBAAmB,EACzB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAA;CAAE,CAAC,CAW1B;AAUD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,2BAA2B,CAAC,CAatC;AAED;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAYhC;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,mBAAmB,EACzB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CA2G9B"}