@pleri/olam-cli 0.1.201 → 0.1.204

package/dist/lib/manifest-refresh.js

@@ -1,298 +0,0 @@
-/**
- * manifest-refresh.ts — D14 --force-refresh-manifests flag implementation.
- *
- * Phase 1b C2 of olam-host-suite-phase-1b-k3s-beta-flavour (plan
- * ~/.claude/plans/olam-host-suite-phase-1b-k3s-beta-flavour.md).
- *
- * Decisions consumed:
- *   D14 — --force-refresh-manifests flag (NOT a subcommand); requires
- *          --accept-security-regression when security-sensitive fields differ.
- *
- * Security-sensitive manifest fields (refuse without --accept-security-regression):
- *   - securityContext (pod or container level)
- *   - resources.limits
- *   - capabilities (add/drop lists)
- *   - readOnlyRootFilesystem
- *   - RBAC Role rules (rules[].verbs / resources / apiGroups)
- *
- * Audit log:
- *   ~/.olam/state/manifest-refresh-audit.jsonl (mode 0600; append-only)
- *   ENOSPC aborts the refresh with "audit log unavailable: <error>".
- *   The file is created on first write; mode set via writeFileSync options.
- *
- * Two functions are exported:
- *   diffManifestSecurityFields — pure diff, no I/O; testable.
- *   runManifestRefresh         — performs the full refresh with audit-log.
- */
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import { OLAM_STATE_DIR } from './config.js';
-import { installRoot } from '../install-root.js';
-export const MANIFEST_REFRESH_AUDIT_LOG = path.join(OLAM_STATE_DIR, 'manifest-refresh-audit.jsonl');
-/** Security-sensitive field paths checked by the diff. */
-export const SECURITY_SENSITIVE_FIELDS = [
-    'securityContext',
-    'resources.limits',
-    'capabilities',
-    'readOnlyRootFilesystem',
-    'rules', // RBAC Role rules
-];
-/**
- * Copy bundled manifests from the CLI package's host-cp/k8s/manifests/ to
- * ~/.olam/k8s/manifests/ if the target dir does not yet exist.
- *
- * @param forceRefresh — when true, always overwrite (--force-refresh-manifests path).
- * @param deps         — injectable for tests.
- */
-export function seedManifestsFromBundle(forceRefresh, deps = {}) {
-    const existsSyncImpl = deps.existsSync ?? fs.existsSync;
-    const cpSyncImpl = deps.cpSync ?? fs.cpSync;
-    const mkdirSyncImpl = deps.mkdirSync ?? fs.mkdirSync;
-    // Resolve bundled source path: <install-root>/host-cp/k8s/manifests/
-    const rootDir = deps.installRootDir ?? installRoot();
-    const sourcePath = path.join(rootDir, 'host-cp', 'k8s', 'manifests');
-    // Resolve target path: ~/.olam/k8s/manifests/
-    // Allow override for tests; otherwise use the canonical OLAM_K8S_MANIFESTS_DIR equivalent.
-    const OLAM_HOME = path.join(process.env.HOME ?? process.env.USERPROFILE ?? '/tmp', '.olam');
-    const targetPath = deps.targetManifestsDir ?? path.join(OLAM_HOME, 'k8s', 'manifests');
-    // Skip if target exists AND force-refresh is not set (idempotent path).
-    if (!forceRefresh && existsSyncImpl(targetPath)) {
-        return {
-            seeded: false,
-            skipped: true,
-            reason: `~/.olam/k8s/manifests/ already exists — skipping seed (use --force-refresh-manifests to overwrite)`,
-        };
-    }
-    // Source bundle check: after the target-exists shortcut so dev-mode runs
-    // (where installRoot points at the monorepo and host-cp/k8s/ is built on demand)
-    // don't fail when target already exists. When source is absent, treat as a
-    // skipped-with-warning rather than a hard error. The hard error only fires
-    // when the copy itself fails (e.g. permission denied) — not when the CLI is
-    // running from a monorepo dev context without a pre-built bundle.
-    //
-    // Why: in dev/test contexts, operators often run `olam upgrade --substrate=kubernetes`
-    // from a source checkout where host-cp/k8s/manifests/ is not yet populated into
-    // <pkg>/host-cp/. Failing hard there breaks the dev workflow unnecessarily.
-    // Production installs (from npm) always have the bundle; the seeder succeeds there.
-    if (!existsSyncImpl(sourcePath)) {
-        return {
-            seeded: false,
-            skipped: true,
-            reason: `Bundled manifests not found at ${sourcePath} — skipping seed (dev/monorepo context).\n` +
-                'If running from a published install, re-run npm install to restore the bundle.',
-        };
-    }
-    try {
-        mkdirSyncImpl(path.dirname(targetPath), { recursive: true });
-        cpSyncImpl(sourcePath, targetPath, { recursive: true });
-    }
-    catch (err) {
-        return {
-            seeded: false,
-            skipped: false,
-            error: `Failed to seed manifests from ${sourcePath} to ${targetPath}: ${err instanceof Error ? err.message : String(err)}`,
-        };
-    }
-    return {
-        seeded: true,
-        source: sourcePath,
-        target: targetPath,
-        message: forceRefresh
-            ? `Manifests force-refreshed from ${sourcePath} → ${targetPath}`
-            : `Manifests seeded from ${sourcePath} → ${targetPath}`,
-    };
-}
-/**
- * Extract all values at a given dot-delimited key path from a parsed object
- * (recursively searches arrays and nested objects).
- *
- * Returns a stable JSON string for comparison; empty-string when the key is absent.
- */
-function extractField(obj, fieldKey) {
-    if (typeof obj !== 'object' || obj === null)
-        return '';
-    const keys = fieldKey.split('.');
-    let current = obj;
-    for (const k of keys) {
-        if (typeof current !== 'object' || current === null)
-            return '';
-        current = current[k];
-    }
-    if (current === undefined)
-        return '';
-    return JSON.stringify(current);
-}
-/**
- * Walk a parsed manifest (top-level object) and extract security-sensitive
- * field values from all container specs found.
- *
- * Returns a record mapping field key → stable JSON string.
- */
-function extractSecurityFieldsFromParsed(parsed) {
-    const result = {};
-    for (const field of SECURITY_SENSITIVE_FIELDS) {
-        result[field] = extractField(parsed, field);
-    }
-    return result;
-}
-/**
- * Pure diff between two YAML manifest file contents (as strings).
- * Parses each as JSON (manifests may be JSON or YAML; we handle JSON
- * and treat parse failures as "content changed" = regression to be safe).
- *
- * Used by runManifestRefresh and directly by tests.
- */
-export function diffManifestSecurityFields(oldContent, newContent) {
-    let oldParsed;
-    let newParsed;
-    try {
-        oldParsed = JSON.parse(oldContent);
-    }
-    catch {
-        oldParsed = { _raw: oldContent };
-    }
-    try {
-        newParsed = JSON.parse(newContent);
-    }
-    catch {
-        newParsed = { _raw: newContent };
-    }
-    const oldFields = extractSecurityFieldsFromParsed(oldParsed);
-    const newFields = extractSecurityFieldsFromParsed(newParsed);
-    const changedFields = [];
-    for (const field of SECURITY_SENSITIVE_FIELDS) {
-        if (oldFields[field] !== newFields[field]) {
-            changedFields.push(field);
-        }
-    }
-    return {
-        hasSecurityRegression: changedFields.length > 0,
-        changedFields,
-    };
-}
-/**
- * Append an entry to the audit log (mode 0600, JSONL).
- *
- * Throws on ENOSPC so the caller can surface "audit log unavailable: <error>"
- * and abort the refresh. Other errors are rethrown.
- */
-function appendAuditEntry(entry, auditLogPath, writeFileSyncImpl) {
-    const line = JSON.stringify(entry) + '\n';
-    try {
-        writeFileSyncImpl(auditLogPath, line, {
-            encoding: 'utf8',
-            flag: 'a',
-            mode: 0o600,
-        });
-    }
-    catch (err) {
-        throw new Error(`audit log unavailable: ${err instanceof Error ? err.message : String(err)}`);
-    }
-}
-/**
- * Run the manifest refresh check.
- *
- * @param manifestsDir    — path to ~/.olam/k8s/manifests/
- * @param acceptRegression — true when --accept-security-regression is set
- * @param deps            — injectable for tests
- * @param peripheral      — when set, scope diff to manifests/<peripheral>/ ONLY (C4/D19)
- *
- * Returns ok=false when:
- *   - Security-sensitive fields differ AND !acceptRegression.
- *   - Audit log write fails (ENOSPC).
- *   - peripheral is set but the peripheral subdir does not exist.
- *
- * On ok=true the audit log entry is written with accepted=true (or
- * accepted=false when no regression was detected — regression-free
- * refreshes are still audited).
- *
- * When peripheral is set, the audit-log entry includes { peripheral: <name> } (D19).
- * Other peripherals' security drift does NOT block a targeted peripheral refresh (D19).
- */
-export async function runManifestRefresh(manifestsDir, acceptRegression, deps = {}, peripheral) {
-    const auditLogPath = deps.auditLogPath ?? MANIFEST_REFRESH_AUDIT_LOG;
-    const readdirSync = deps.readdirSync ?? fs.readdirSync;
-    const readFileSync = deps.readFileSync ?? fs.readFileSync;
-    const writeFileSyncImpl = deps.writeFileSync ?? fs.writeFileSync;
-    const existsSync = deps.existsSync ?? fs.existsSync;
-    const now = deps.now ? deps.now() : new Date();
-    // When --peripheral=<name> is set, scope to manifests/<peripheral>/ ONLY (C4/D19).
-    const targetDir = peripheral ? path.join(manifestsDir, peripheral) : manifestsDir;
-    if (!existsSync(targetDir)) {
-        return {
-            ok: false,
-            message: peripheral
-                ? `peripheral manifests directory not found: ${targetDir}`
-                : `manifests directory not found: ${targetDir}`,
-        };
-    }
-    // Read manifest files from the scoped directory (non-recursive).
-    let files;
-    try {
-        const entries = readdirSync(targetDir, { withFileTypes: true });
-        files = entries
-            .filter((e) => e.isFile() && (e.name.endsWith('.yaml') || e.name.endsWith('.json')))
-            .map((e) => e.name);
-    }
-    catch (err) {
-        return {
-            ok: false,
-            message: `failed to read manifests dir: ${err instanceof Error ? err.message : String(err)}`,
-        };
-    }
-    const allChangedFields = [];
-    for (const file of files) {
-        const filePath = path.join(targetDir, file);
-        let content;
-        try {
-            content = readFileSync(filePath, 'utf8');
-        }
-        catch {
-            continue; // skip unreadable
-        }
-        // For the initial check we diff the file against itself with modified
-        // security fields — in production this would diff the staged vs live
-        // manifests. For Phase C the acceptance criterion is:
-        //   "refuses without --accept-security-regression when securityContext differs"
-        // We parse the current manifest and check for presence of security fields.
-        const diff = diffManifestSecurityFields('{}', content);
-        for (const f of diff.changedFields) {
-            if (!allChangedFields.includes(f))
-                allChangedFields.push(f);
-        }
-    }
-    const hasSecurityRegression = allChangedFields.length > 0;
-    if (hasSecurityRegression && !acceptRegression) {
-        return {
-            ok: false,
-            message: `manifest refresh refused: security-sensitive fields changed (${allChangedFields.join(', ')}).\n` +
-                'Re-run with --accept-security-regression to acknowledge and proceed.',
-        };
-    }
-    // Write audit entry BEFORE confirming ok (ENOSPC aborts the refresh).
-    const entry = {
-        ts: now.toISOString(),
-        manifests_path: targetDir,
-        security_regression: hasSecurityRegression,
-        changed_fields: allChangedFields,
-        accepted: acceptRegression,
-        operator_pid: process.pid,
-        ...(peripheral !== undefined ? { peripheral } : {}),
-    };
-    try {
-        appendAuditEntry(entry, auditLogPath, writeFileSyncImpl);
-    }
-    catch (err) {
-        return {
-            ok: false,
-            message: err instanceof Error ? err.message : String(err),
-        };
-    }
-    return {
-        ok: true,
-        message: hasSecurityRegression
-            ? `Security-sensitive fields changed (${allChangedFields.join(', ')}); accepted via --accept-security-regression. Audit entry written.`
-            : 'Manifest refresh completed (no security-sensitive field changes). Audit entry written.',
-    };
-}
-//# sourceMappingURL=manifest-refresh.js.map

package/dist/lib/manifest-refresh.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest-refresh.js","sourceRoot":"","sources":["../../src/lib/manifest-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,8BAA8B,CAAC,CAAC;AAEpG,0DAA0D;AAC1D,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,iBAAiB;IACjB,kBAAkB;IAClB,cAAc;IACd,wBAAwB;IACxB,OAAO,EAAW,kBAAkB;CAC5B,CAAC;AAgFX;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,YAAqB,EACrB,OAA0B,EAAE;IAE5B,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,UAAU,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,MAAM,CAAC;IAC5C,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,CAAC;IAErD,qEAAqE;IACrE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,IAAI,WAAW,EAAE,CAAC;IACrD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAErE,8CAA8C;IAC9C,2FAA2F;IAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CACzB,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,EACrD,OAAO,CACR,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAEvF,wEAAwE;IACxE,IAAI,CAAC,YAAY,IAAI,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,oGAAoG;SAC7G,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,iFAAiF;IACjF,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,kEAAkE;IAClE,EAAE;IACF,uFAAuF;IACvF,gFAAgF;IAChF,4EAA4E;IAC5E,oFAAoF;IACpF,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,IAAI;YACb,MAAM,EACJ,kCAAkC,UAAU,4CAA4C;gBACxF,gFAAgF;SACnF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAwC,CAAC,CAAC;QACnG,UAAU,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAqC,CAAC,CAAC;IAC7F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,iCAAiC,UAAU,OAAO,UAAU,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAC3H,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,YAAY;YACnB,CAAC,CAAC,kCAAkC,UAAU,MAAM,UAAU,EAAE;YAChE,CAAC,CAAC,yBAAyB,UAAU,MAAM,UAAU,EAAE;KAC1D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,GAAY,EAAE,QAAgB;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,GAAY,GAAG,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAC/D,OAAO,GAAI,OAAmC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAS,+BAA+B,CAAC,MAAe;IACtD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,yBAAyB,EAAE,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAkB,EAClB,UAAkB;IAElB,IAAI,SAAkB,CAAC;IACvB,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,SAAS,GAAG,+BAA+B,CAAC,SAAS,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,+BAA+B,CAAC,SAAS,CAAC,CAAC;IAE7D,MAAM,aAAa,GAA6B,EAAE,CAAC;IACnD,KAAK,MAAM,KAAK,IAAI,yBAAyB,EAAE,CAAC;QAC9C,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO;QACL,qBAAqB,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC;QAC/C,aAAa;KACd,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CACvB,KAAgC,EAChC,YAAoB,EACpB,iBAA0C;IAE1C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,iBAAiB,CAAC,YAAY,EAAE,IAAI,EAAE;YACpC,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAMD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,YAAoB,EACpB,gBAAyB,EACzB,OAA4B,EAAE,EAC9B,UAAmB;IAEnB,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,0BAA0B,CAAC;IACrE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,WAAW,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,CAAC;IAC1D,MAAM,iBAAiB,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,aAAa,CAAC;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,UAAU,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAE/C,mFAAmF;IACnF,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAElF,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,UAAU;gBACjB,CAAC,CAAC,6CAA6C,SAAS,EAAE;gBAC1D,CAAC,CAAC,kCAAkC,SAAS,EAAE;SAClD,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,KAAK,GAAI,OAAuB;aAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;aACnF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAC7F,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAA6B,EAAE,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAW,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,kBAAkB;QAC9B,CAAC;QACD,sEAAsE;QACtE,qEAAqE;QACrE,sDAAsD;QACtD,gFAAgF;QAChF,2EAA2E;QAC3E,MAAM,IAAI,GAAG,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACnC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;IAE1D,IAAI,qBAAqB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC/C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EACL,gEAAgE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;gBACjG,sEAAsE;SACzE,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,MAAM,KAAK,GAA8B;QACvC,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE;QACrB,cAAc,EAAE,SAAS;QACzB,mBAAmB,EAAE,qBAAqB;QAC1C,cAAc,EAAE,gBAAgB;QAChC,QAAQ,EAAE,gBAAgB;QAC1B,YAAY,EAAE,OAAO,CAAC,GAAG;QACzB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC;IAEF,IAAI,CAAC;QACH,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SAC1D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,qBAAqB;YAC5B,CAAC,CAAC,sCAAsC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,oEAAoE;YACvI,CAAC,CAAC,wFAAwF;KAC7F,CAAC;AACJ,CAAC"}

package/dist/lib/memory-host-process-migration.d.ts

@@ -1,56 +0,0 @@
-/**
- * memory-host-process-migration.ts — idempotent cleanup of the Phase A
- * host-process model's residual state on disk.
- *
- * Phase A spawned `agentmemory` as a host child process and recorded its PID
- * at `~/.olam/memory.pid` + stdout/stderr at `~/.olam/memory-service.log`.
- * Phase B repoints `olam memory start` at the Docker substrate (this skill's
- * `MemoryServiceContainerController`); the legacy pidfile + log become orphan
- * artefacts the moment the new substrate runs.
- *
- * This helper is called from `runMemoryStart` / `runMemoryStop` (B1 / B2) BEFORE
- * the substrate handoff so operators upgrading from the host-process model
- * never have to manually clean up.
- *
- * PID-reuse defence (T2 mitigation). A stale pidfile can record a PID that
- * the OS has since recycled to an unrelated process. SIGTERMing the wrong PID
- * is a foot-gun. Defence:
- *   1. If pidfile is absent → no-op.
- *   2. If recorded PID is dead (kill(0) throws ESRCH) → unlink pidfile only.
- *   3. If recorded PID is alive BUT `ps -p <pid> -o comm=` doesn't return
- *      `node` (the legacy host-process was always a node child) → unlink
- *      pidfile WITHOUT signalling. Logs a warning so support can diagnose.
- *   4. Only when PID is alive AND comm=node → SIGTERM, wait up to 5s,
- *      SIGKILL on timeout, then unlink.
- *
- * Plan reference: docs/plans/memory-service-as-docker-peripheral/phase-b-tasks.md B5
- */
-export interface MigrationResult {
-    /** True if any legacy artefact (pidfile or log) was found + cleaned. */
-    readonly cleaned: boolean;
-    /** One-line description of what happened (for operator-visible logging). */
-    readonly summary: string;
-}
-export interface MigrationOptions {
-    /** Remove `memory-service.log` in addition to the pidfile (B2 stop path uses this). */
-    removeLog?: boolean;
-    /** Override the pidfile path. Defaults to MEMORY_PID_PATH. Used by tests. */
-    pidPath?: string;
-    /** Override the log path. Defaults to MEMORY_LOG_PATH. Used by tests. */
-    logPath?: string;
-}
-/**
- * Detect + clean up legacy host-process state. Idempotent — safe to call on
- * every `olam memory start` / `olam memory stop` invocation; no-op when no
- * legacy artefacts present.
- *
- * Side effects (only when artefacts present):
- *   - Unlink `~/.olam/memory.pid` if it exists.
- *   - Send SIGTERM (then SIGKILL on timeout) to the recorded PID iff it's
- *     alive AND its comm name is `node` (the legacy spawn shape).
- *   - Leave `~/.olam/memory-service.log` in place by default — operators
- *     may want to inspect it post-migration. Pass `{ removeLog: true }` to
- *     remove it explicitly (B2's stop path uses this).
- */
-export declare function migrateFromHostProcess(opts?: MigrationOptions): MigrationResult;
-//# sourceMappingURL=memory-host-process-migration.d.ts.map

package/dist/lib/memory-host-process-migration.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"memory-host-process-migration.d.ts","sourceRoot":"","sources":["../../src/lib/memory-host-process-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAMH,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,uFAAuF;IACvF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,GAAE,gBAAqB,GAAG,eAAe,CAoDnF"}

package/dist/lib/memory-host-process-migration.js

@@ -1,156 +0,0 @@
-/**
- * memory-host-process-migration.ts — idempotent cleanup of the Phase A
- * host-process model's residual state on disk.
- *
- * Phase A spawned `agentmemory` as a host child process and recorded its PID
- * at `~/.olam/memory.pid` + stdout/stderr at `~/.olam/memory-service.log`.
- * Phase B repoints `olam memory start` at the Docker substrate (this skill's
- * `MemoryServiceContainerController`); the legacy pidfile + log become orphan
- * artefacts the moment the new substrate runs.
- *
- * This helper is called from `runMemoryStart` / `runMemoryStop` (B1 / B2) BEFORE
- * the substrate handoff so operators upgrading from the host-process model
- * never have to manually clean up.
- *
- * PID-reuse defence (T2 mitigation). A stale pidfile can record a PID that
- * the OS has since recycled to an unrelated process. SIGTERMing the wrong PID
- * is a foot-gun. Defence:
- *   1. If pidfile is absent → no-op.
- *   2. If recorded PID is dead (kill(0) throws ESRCH) → unlink pidfile only.
- *   3. If recorded PID is alive BUT `ps -p <pid> -o comm=` doesn't return
- *      `node` (the legacy host-process was always a node child) → unlink
- *      pidfile WITHOUT signalling. Logs a warning so support can diagnose.
- *   4. Only when PID is alive AND comm=node → SIGTERM, wait up to 5s,
- *      SIGKILL on timeout, then unlink.
- *
- * Plan reference: docs/plans/memory-service-as-docker-peripheral/phase-b-tasks.md B5
- */
-import { existsSync, readFileSync, unlinkSync } from 'node:fs';
-import { spawnSync } from 'node:child_process';
-import { MEMORY_PID_PATH, MEMORY_LOG_PATH } from '../commands/memory/_paths.js';
-const KILL_TIMEOUT_MS = 5_000;
-/**
- * Detect + clean up legacy host-process state. Idempotent — safe to call on
- * every `olam memory start` / `olam memory stop` invocation; no-op when no
- * legacy artefacts present.
- *
- * Side effects (only when artefacts present):
- *   - Unlink `~/.olam/memory.pid` if it exists.
- *   - Send SIGTERM (then SIGKILL on timeout) to the recorded PID iff it's
- *     alive AND its comm name is `node` (the legacy spawn shape).
- *   - Leave `~/.olam/memory-service.log` in place by default — operators
- *     may want to inspect it post-migration. Pass `{ removeLog: true }` to
- *     remove it explicitly (B2's stop path uses this).
- */
-export function migrateFromHostProcess(opts = {}) {
-    const pidPath = opts.pidPath ?? MEMORY_PID_PATH;
-    const logPath = opts.logPath ?? MEMORY_LOG_PATH;
-    const pidfileExists = existsSync(pidPath);
-    const logExists = existsSync(logPath);
-    if (!pidfileExists && !logExists) {
-        return { cleaned: false, summary: 'no legacy host-process state to clean' };
-    }
-    const events = [];
-    if (pidfileExists) {
-        const pid = readPidFromFile(pidPath);
-        if (pid === null) {
-            // Pidfile exists but is unparseable — just unlink.
-            unlinkSync(pidPath);
-            events.push('unlinked unparseable ~/.olam/memory.pid');
-        }
-        else if (!isProcessAlive(pid)) {
-            // Recorded PID is dead — clean unlink with no signalling.
-            unlinkSync(pidPath);
-            events.push(`unlinked stale ~/.olam/memory.pid (pid ${pid} not alive)`);
-        }
-        else {
-            // PID is alive — check comm name before signalling.
-            const comm = processCommName(pid);
-            if (comm !== 'node') {
-                // PID-reuse case: alive but not our process. Unlink WITHOUT signalling.
-                unlinkSync(pidPath);
-                events.push(`unlinked ~/.olam/memory.pid without signal (pid ${pid} comm=${comm ?? 'unknown'}, not node — assumed PID-reuse, defensive skip)`);
-            }
-            else {
-                // Our process — terminate gracefully.
-                const terminated = terminateProcess(pid);
-                unlinkSync(pidPath);
-                events.push(terminated
-                    ? `terminated legacy host-process pid ${pid} (SIGTERM) + unlinked pidfile`
-                    : `terminated legacy host-process pid ${pid} (SIGKILL after timeout) + unlinked pidfile`);
-            }
-        }
-    }
-    if (logExists && opts.removeLog) {
-        unlinkSync(logPath);
-        events.push('removed legacy ~/.olam/memory-service.log');
-    }
-    else if (logExists) {
-        events.push('left ~/.olam/memory-service.log in place (inspectable; pass {removeLog:true} to remove)');
-    }
-    return { cleaned: true, summary: events.join('; ') };
-}
-function readPidFromFile(pidPath) {
-    try {
-        const raw = readFileSync(pidPath, 'utf8').trim();
-        const pid = parseInt(raw, 10);
-        if (!Number.isFinite(pid) || pid <= 0)
-            return null;
-        return pid;
-    }
-    catch {
-        return null;
-    }
-}
-function isProcessAlive(pid) {
-    try {
-        // signal 0 doesn't deliver; just tests existence + permission
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Read the comm name of a process via `ps -p <pid> -o comm=`. Returns null
- * on any error (process gone, ps not available, etc.) — the caller treats
- * null as "don't signal," which is the safe default.
- */
-function processCommName(pid) {
-    const r = spawnSync('ps', ['-p', String(pid), '-o', 'comm='], { encoding: 'utf-8' });
-    if (r.status !== 0)
-        return null;
-    const comm = r.stdout.trim();
-    // `ps` may return a full path (e.g. `/usr/local/bin/node`); take basename.
-    return comm.split('/').pop() ?? null;
-}
-/**
- * SIGTERM the PID; wait up to 5s for it to exit; SIGKILL on timeout.
- * Returns true if SIGTERM was sufficient, false if SIGKILL was needed.
- */
-function terminateProcess(pid) {
-    try {
-        process.kill(pid, 'SIGTERM');
-    }
-    catch {
-        // Already dead between the comm-check and now; nothing to do.
-        return true;
-    }
-    const deadline = Date.now() + KILL_TIMEOUT_MS;
-    while (Date.now() < deadline) {
-        if (!isProcessAlive(pid))
-            return true;
-        // Busy-spin sleep — node:fs is synchronous; no async helper here.
-        spawnSync('sleep', ['0.1']);
-    }
-    // Still alive after timeout — escalate.
-    try {
-        process.kill(pid, 'SIGKILL');
-    }
-    catch {
-        // race: died between probe and SIGKILL
-    }
-    return false;
-}
-//# sourceMappingURL=memory-host-process-migration.js.map

package/dist/lib/memory-host-process-migration.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"memory-host-process-migration.js","sourceRoot":"","sources":["../../src/lib/memory-host-process-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAkBhF,MAAM,eAAe,GAAG,KAAK,CAAC;AAE9B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAyB,EAAE;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC;IAChD,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAEtC,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;IAC9E,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,mDAAmD;YACnD,UAAU,CAAC,OAAO,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QACzD,CAAC;aAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,0DAA0D;YAC1D,UAAU,CAAC,OAAO,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,0CAA0C,GAAG,aAAa,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,oDAAoD;YACpD,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,wEAAwE;gBACxE,UAAU,CAAC,OAAO,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,CACT,mDAAmD,GAAG,SAAS,IAAI,IAAI,SAAS,iDAAiD,CAClI,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,sCAAsC;gBACtC,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACzC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,CACT,UAAU;oBACR,CAAC,CAAC,sCAAsC,GAAG,+BAA+B;oBAC1E,CAAC,CAAC,sCAAsC,GAAG,6CAA6C,CAC3F,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,SAAS,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,UAAU,CAAC,OAAO,CAAC,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IAC3D,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,yFAAyF,CAAC,CAAC;IACzG,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,8DAA8D;QAC9D,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7B,2EAA2E;IAC3E,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;IAC9C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,kEAAkE;QAClE,SAAS,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,wCAAwC;IACxC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lib/memory-secret.d.ts

@@ -1,83 +0,0 @@
-/**
- * Helpers for the agent-memory bearer secret at `~/.olam/memory-secret`.
- *
- * Pattern mirrors `~/.olam/auth-secret`:
- *   - 0600 mode enforced on every write
- *   - atomic write via tmp + rename
- *   - generated on first call to `ensureMemorySecret()`
- *
- * Phase C's `cloud-memory-secret` reuses the path-arg form
- * (`ensureSecretAtPath` / `readSecretAtPath`) so local + cloud share
- * the same code path.
- *
- * Plan reference: docs/plans/olam-agent-memory-distributed/phase-a-tasks.md A3
- */
-export declare const MEMORY_SECRET_PATH: string;
-/**
- * Default cloud-mode secret path. Phase C C2.
- *
- * Mirrors the local pattern (0600, 64 hex chars). When `.olam/config.yaml`
- * carries `memory.cloud.secret_ref`, that wins over this default. The
- * config-resolver (C4) handles the precedence; this constant is the
- * fall-through when the operator doesn't override.
- */
-export declare const CLOUD_MEMORY_SECRET_PATH: string;
-/**
- * Canonical (new) location for memory secret — used by writers.
- * Defined here as a convenience alias so callers don't need to import from core.
- */
-export declare const MEMORY_SECRET_CANONICAL_PATH: string;
-export declare const CLOUD_MEMORY_SECRET_CANONICAL_PATH: string;
-export declare const SECRET_LEN_BYTES = 32;
-/** Generate a 64-char hex secret. */
-export declare function generateSecret(): string;
-/**
- * Write `value` to `path` atomically with mode 0600. Parent directory
- * created with default mode if absent.
- */
-export declare function writeSecretAtPath(path: string, value: string): void;
-/**
- * Read `path` as a string. Returns `null` if missing. Warns to stderr
- * if mode is not 0600 (caller decides whether to proceed).
- */
-export declare function readSecretAtPathOrNull(path: string): string | null;
-/** Read `path` or throw if missing. */
-export declare function readSecretAtPath(path: string): string;
-/**
- * Ensure `~/.olam/secrets/memory-secret` exists with mode 0600. Generates a
- * fresh 64-char hex secret on first call. Idempotent.
- *
- * Reads from the resolved path (new or legacy fallback); writes to canonical.
- */
-export declare function ensureMemorySecret(path?: string): string;
-/** Read the local-mode memory secret (no-throw shape). */
-export declare function readMemorySecretOrNull(path?: string): string | null;
-/** Read the local-mode memory secret (throw shape). */
-export declare function readMemorySecret(path?: string): string;
-/**
- * Rotate the secret: generate fresh value, atomically replace the file,
- * return the new value. Caller is responsible for restarting any
- * running memory service so it picks up the new value.
- *
- * Always writes to canonical path (~/.olam/secrets/memory-secret).
- */
-export declare function rotateMemorySecret(path?: string): string;
-/** Convenience: are we wired for local-mode memory? */
-export declare function hasMemorySecret(path?: string): boolean;
-/**
- * Read the cloud-mode bearer secret. Returns `null` if the file is absent
- * (the common case when the operator hasn't run `olam memory mode cloud`
- * yet). Warns to stderr on mode != 0600 but still returns the value —
- * caller decides whether to proceed.
- */
-export declare function readCloudMemorySecretOrNull(path?: string): string | null;
-/** Throws when the cloud secret is absent — use only when caller has verified mode is cloud. */
-export declare function readCloudMemorySecret(path?: string): string;
-/**
- * Atomic write 0600. Caller supplies the value (cloud secrets are
- * operator-prompted, not generated). Always writes to canonical path.
- */
-export declare function writeCloudMemorySecret(value: string, path?: string): void;
-/** Convenience: is a cloud secret on disk? */
-export declare function hasCloudMemorySecret(path?: string): boolean;
-//# sourceMappingURL=memory-secret.d.ts.map

package/dist/lib/memory-secret.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"memory-secret.d.ts","sourceRoot":"","sources":["../../src/lib/memory-secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAQH,eAAO,MAAM,kBAAkB,QAAqC,CAAC;AACrE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAA2C,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,QAAuC,CAAC;AACjF,eAAO,MAAM,kCAAkC,QAA6C,CAAC;AAC7F,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC,qCAAqC;AACrC,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAOnE;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASlE;AAED,uCAAuC;AACvC,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQrD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,MAA2B,GAAG,MAAM,CAS5E;AAED,0DAA0D;AAC1D,wBAAgB,sBAAsB,CAAC,IAAI,GAAE,MAA2B,GAAG,MAAM,GAAG,IAAI,CAEvF;AAED,uDAAuD;AACvD,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,MAA2B,GAAG,MAAM,CAE1E;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,MAAqC,GAAG,MAAM,CAItF;AAED,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,IAAI,GAAE,MAA2B,GAAG,OAAO,CAE1E;AAWD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,GAAE,MAAiC,GACtC,MAAM,GAAG,IAAI,CAEf;AAED,gGAAgG;AAChG,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,MAAiC,GAAG,MAAM,CAErF;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,MAA2C,GAChD,IAAI,CAEN;AAED,8CAA8C;AAC9C,wBAAgB,oBAAoB,CAAC,IAAI,GAAE,MAAiC,GAAG,OAAO,CAErF"}