@pleri/olam-cli 0.1.201 → 0.1.205

package/dist/commands/seed.js

@@ -1,303 +0,0 @@
-/**
- * `olam seed <subcommand>` — operator-facing CRUD for postgres seed templates.
- *
- * Phase A task A1 of `olam-hybrid-shared-postgres`. The hybrid path's
- * `services.postgres.seed_template:` field in `.olam.yaml` references named
- * template DBs on the operator's `olam-postgres` singleton. This command is
- * the canonical way to populate, inspect, and remove those templates.
- *
- * Subcommands:
- *   bake    — pg_dump a source DB into the singleton as a new template
- *   list    — list seed-template DBs on the singleton
- *   remove  — DROP a seed template (refuses if any per-world clones exist)
- *   verify  — sanity-check a seed (existence, connectivity, size)
- *
- * Source modes for `bake`:
- *   --source-container <name>      docker exec pg_dump inside a running container
- *   --source-url <postgres-url>    pg_dump via libpq URL (host pg, neon, etc.)
- *   --source-local <db>            pg_dump a DB that already lives on the singleton
- *
- * Generic across projects — atlas-core's `atlas_common_seed` /
- * `atlas_merchant_seed`, atlas-pay's `atlas_pay_seed`, and any future repo's
- * named seeds all flow through this same surface. No atlas-specific knowledge
- * embedded.
- */
-import { spawnSync, spawn as spawnAsync } from 'node:child_process';
-import { printError, printSuccess, printInfo, printHeader, printWarning } from '../output.js';
-const DEFAULT_SINGLETON_CONTAINER = 'olam-postgres';
-const DEFAULT_SINGLETON_USER = 'development';
-// ── helpers ─────────────────────────────────────────────────────────
-/**
- * Validate a seed name. Names map 1:1 to postgres DB identifiers, so they
- * must be plain alphanumeric + underscore (matches `[a-z][a-z0-9_]*`).
- * Hyphens are rejected — `CREATE DATABASE "foo-bar"` requires double-quoting
- * everywhere downstream which is brittle.
- */
-function assertValidSeedName(name) {
-    if (!/^[a-z][a-z0-9_]*$/.test(name)) {
-        throw new Error(`invalid seed name "${name}" — must match [a-z][a-z0-9_]* (no hyphens, no uppercase)`);
-    }
-}
-function singletonDocker(container, user, args, stdin) {
-    return spawnSync('docker', ['exec', '-i', container, 'psql', '-U', user, ...args], { encoding: 'utf-8', input: stdin });
-}
-function singletonHasDb(container, user, db) {
-    const r = singletonDocker(container, user, [
-        '-d', 'postgres', '-tAc',
-        `SELECT 1 FROM pg_database WHERE datname='${db.replace(/'/g, "''")}'`,
-    ]);
-    return r.status === 0 && (r.stdout || '').trim() === '1';
-}
-function singletonListSeeds(container, user) {
-    const r = singletonDocker(container, user, [
-        '-d', 'postgres', '-tAc',
-        "SELECT datname || '|' || pg_size_pretty(pg_database_size(datname)) " +
-            "FROM pg_database WHERE datname LIKE '%\\_seed' ORDER BY datname",
-    ]);
-    if (r.status !== 0) {
-        throw new Error(`failed to list seeds: ${(r.stderr || '').trim()}`);
-    }
-    const lines = (r.stdout || '').trim().split('\n').filter((l) => l.length > 0);
-    return lines.map((line) => {
-        const [name = '', size = ''] = line.split('|');
-        return { name, size };
-    });
-}
-function singletonListClonesOf(container, user, seed) {
-    // World clones derive from `<seed-without-_seed>_world_<id>` per
-    // deriveWorldDbName in core/src/world/manager.ts.
-    const prefix = seed.endsWith('_seed') ? seed.slice(0, -'_seed'.length) : seed;
-    const r = singletonDocker(container, user, [
-        '-d', 'postgres', '-tAc',
-        `SELECT datname FROM pg_database WHERE datname LIKE '${prefix.replace(/'/g, "''")}_world_%' ORDER BY datname`,
-    ]);
-    if (r.status !== 0)
-        return [];
-    return (r.stdout || '').trim().split('\n').filter((l) => l.length > 0);
-}
-// ── bake ────────────────────────────────────────────────────────────
-async function handleBake(opts) {
-    assertValidSeedName(opts.as);
-    const singleton = opts.singletonContainer ?? DEFAULT_SINGLETON_CONTAINER;
-    const singletonUser = opts.singletonUser ?? DEFAULT_SINGLETON_USER;
-    // Mode resolution — exactly one source must be set.
-    const sources = [opts.sourceContainer, opts.sourceUrl, opts.sourceLocal].filter(Boolean);
-    if (sources.length === 0) {
-        throw new Error('no source specified — pass exactly one of --source-container, --source-url, --source-local');
-    }
-    if (sources.length > 1) {
-        throw new Error('multiple sources specified — pass exactly one of --source-container, --source-url, --source-local');
-    }
-    // Pre-flight: singleton container reachable?
-    const ping = spawnSync('docker', ['inspect', '--format', '{{.State.Status}}', singleton], { encoding: 'utf-8' });
-    if (ping.status !== 0 || (ping.stdout || '').trim() !== 'running') {
-        throw new Error(`singleton container "${singleton}" not running — run \`olam bootstrap\` first`);
-    }
-    // Already exists?
-    if (singletonHasDb(singleton, singletonUser, opts.as)) {
-        if (!opts.force) {
-            throw new Error(`seed "${opts.as}" already exists — pass --force to overwrite (DROP + recreate)`);
-        }
-        // Check for active clones first; refuse drop if any.
-        const clones = singletonListClonesOf(singleton, singletonUser, opts.as);
-        if (clones.length > 0) {
-            throw new Error(`cannot --force overwrite "${opts.as}" — ${clones.length} per-world clone(s) still depend on it: ${clones.join(', ')}\n` +
-                `Destroy those worlds first, then re-bake.`);
-        }
-        printWarning(`Dropping existing seed "${opts.as}" (--force)`);
-        const drop = singletonDocker(singleton, singletonUser, ['-d', 'postgres', '-c', `DROP DATABASE "${opts.as}"`]);
-        if (drop.status !== 0) {
-            throw new Error(`DROP DATABASE failed: ${(drop.stderr || '').trim()}`);
-        }
-    }
-    process.stdout.write(`  Creating empty target DB "${opts.as}" on singleton\n`);
-    const create = singletonDocker(singleton, singletonUser, ['-d', 'postgres', '-c', `CREATE DATABASE "${opts.as}"`]);
-    if (create.status !== 0) {
-        throw new Error(`CREATE DATABASE "${opts.as}" failed: ${(create.stderr || '').trim()}`);
-    }
-    // Pipe pg_dump → singleton psql. Use spawn (not spawnSync) so the stream
-    // can flow without buffering the whole dump in memory.
-    let dumpArgs;
-    // Initialised to the same minimal-PATH shape that every branch below sets;
-    // the spread of `process.env` (typed `string | undefined`) tripped tsc
-    // strict-mode and was always overwritten anyway.
-    let dumpEnv = { PATH: process.env['PATH'] || '' };
-    if (opts.sourceContainer) {
-        const srcDb = opts.sourceDb ?? 'postgres';
-        const srcUser = opts.sourceUser ?? DEFAULT_SINGLETON_USER;
-        process.stdout.write(`  Source: container ${opts.sourceContainer} DB=${srcDb} user=${srcUser}\n`);
-        dumpArgs = ['exec', opts.sourceContainer, 'pg_dump', '-U', srcUser, '-d', srcDb, '--no-owner', '--no-privileges'];
-        dumpEnv = { PATH: process.env['PATH'] || '' };
-    }
-    else if (opts.sourceLocal) {
-        if (!singletonHasDb(singleton, singletonUser, opts.sourceLocal)) {
-            throw new Error(`--source-local "${opts.sourceLocal}" does not exist on singleton`);
-        }
-        process.stdout.write(`  Source: singleton local DB ${opts.sourceLocal}\n`);
-        dumpArgs = ['exec', singleton, 'pg_dump', '-U', singletonUser, '-d', opts.sourceLocal, '--no-owner', '--no-privileges'];
-        dumpEnv = { PATH: process.env['PATH'] || '' };
-    }
-    else {
-        // sourceUrl
-        process.stdout.write(`  Source: ${opts.sourceUrl.replace(/\/\/[^:]+:[^@]+@/, '//<creds>@')}\n`);
-        dumpArgs = ['exec', '-e', `PGURL=${opts.sourceUrl}`, singleton, 'sh', '-c', 'pg_dump --no-owner --no-privileges "$PGURL"'];
-        dumpEnv = { PATH: process.env['PATH'] || '' };
-    }
-    const dumper = spawnAsync('docker', dumpArgs, { stdio: ['ignore', 'pipe', 'inherit'], env: dumpEnv });
-    const loader = spawnAsync('docker', ['exec', '-i', singleton, 'psql', '-U', singletonUser, '-d', opts.as, '-v', 'ON_ERROR_STOP=1', '-q'], { stdio: ['pipe', 'inherit', 'inherit'], env: { PATH: process.env['PATH'] || '' } });
-    dumper.stdout.pipe(loader.stdin);
-    const [dumpExit, loadExit] = await Promise.all([
-        new Promise((res) => dumper.on('close', (code) => res(code ?? 1))),
-        new Promise((res) => loader.on('close', (code) => res(code ?? 1))),
-    ]);
-    if (dumpExit !== 0) {
-        throw new Error(`pg_dump exited with code ${dumpExit}`);
-    }
-    if (loadExit !== 0) {
-        throw new Error(`psql load exited with code ${loadExit}`);
-    }
-    // Verify
-    const size = singletonDocker(singleton, singletonUser, [
-        '-d', 'postgres', '-tAc',
-        `SELECT pg_size_pretty(pg_database_size('${opts.as}'))`,
-    ]);
-    const sizeStr = (size.stdout || '').trim() || 'unknown';
-    printSuccess(`Seed "${opts.as}" baked (${sizeStr})`);
-}
-// ── list ────────────────────────────────────────────────────────────
-function handleList(opts) {
-    const singleton = opts.singletonContainer ?? DEFAULT_SINGLETON_CONTAINER;
-    const singletonUser = opts.singletonUser ?? DEFAULT_SINGLETON_USER;
-    const seeds = singletonListSeeds(singleton, singletonUser);
-    if (opts.json) {
-        process.stdout.write(JSON.stringify(seeds, null, 2) + '\n');
-        return;
-    }
-    if (seeds.length === 0) {
-        process.stdout.write('No seeds found on singleton.\n');
-        return;
-    }
-    printHeader(`${seeds.length} seed(s) on ${singleton}`);
-    const nameWidth = Math.max(...seeds.map((s) => s.name.length), 4);
-    for (const s of seeds) {
-        process.stdout.write(`  ${s.name.padEnd(nameWidth)}  ${s.size}\n`);
-    }
-}
-// ── remove ──────────────────────────────────────────────────────────
-function handleRemove(name, opts) {
-    assertValidSeedName(name);
-    const singleton = opts.singletonContainer ?? DEFAULT_SINGLETON_CONTAINER;
-    const singletonUser = opts.singletonUser ?? DEFAULT_SINGLETON_USER;
-    if (!singletonHasDb(singleton, singletonUser, name)) {
-        printWarning(`Seed "${name}" does not exist on singleton — nothing to do`);
-        return;
-    }
-    const clones = singletonListClonesOf(singleton, singletonUser, name);
-    if (clones.length > 0 && !opts.force) {
-        throw new Error(`seed "${name}" has ${clones.length} active world clone(s): ${clones.join(', ')}\n` +
-            `Destroy those worlds first, or re-run with --force to drop anyway (CAUTION: leaves world DBs orphaned).`);
-    }
-    const drop = singletonDocker(singleton, singletonUser, ['-d', 'postgres', '-c', `DROP DATABASE "${name}"`]);
-    if (drop.status !== 0) {
-        throw new Error(`DROP DATABASE "${name}" failed: ${(drop.stderr || '').trim()}`);
-    }
-    printSuccess(`Removed seed "${name}"`);
-}
-// ── verify ──────────────────────────────────────────────────────────
-function handleVerify(name, opts) {
-    assertValidSeedName(name);
-    const singleton = opts.singletonContainer ?? DEFAULT_SINGLETON_CONTAINER;
-    const singletonUser = opts.singletonUser ?? DEFAULT_SINGLETON_USER;
-    if (!singletonHasDb(singleton, singletonUser, name)) {
-        throw new Error(`seed "${name}" does not exist on singleton`);
-    }
-    // Heartbeat: run a trivial SELECT to prove connectivity + accessibility.
-    const heartbeat = singletonDocker(singleton, singletonUser, ['-d', name, '-tAc', 'SELECT 1']);
-    if (heartbeat.status !== 0 || (heartbeat.stdout || '').trim() !== '1') {
-        throw new Error(`heartbeat failed: ${(heartbeat.stderr || '').trim()}`);
-    }
-    // Size + table count for visibility.
-    const meta = singletonDocker(singleton, singletonUser, [
-        '-d', name, '-tAc',
-        "SELECT pg_size_pretty(pg_database_size(current_database())) || '|' || " +
-            "(SELECT COUNT(*) FROM information_schema.tables WHERE table_schema = 'public')",
-    ]);
-    const [size = '?', tableCount = '?'] = (meta.stdout || '').trim().split('|');
-    const clones = singletonListClonesOf(singleton, singletonUser, name);
-    printSuccess(`Seed "${name}" OK`);
-    printInfo('size', size);
-    printInfo('tables', `${tableCount} (public schema)`);
-    printInfo('clones', `${clones.length}${clones.length > 0 ? ' (' + clones.join(', ') + ')' : ''}`);
-}
-// ── register ────────────────────────────────────────────────────────
-export function registerSeed(program) {
-    const seed = program
-        .command('seed')
-        .description('Manage postgres seed templates on the olam-postgres singleton');
-    seed
-        .command('bake')
-        .description('Bake a source DB into the singleton as a named seed template')
-        .requiredOption('--as <name>', 'Target seed name (e.g. atlas_common_seed); [a-z][a-z0-9_]*')
-        .option('--source-container <name>', 'Source: pg_dump inside this docker container')
-        .option('--source-url <url>', 'Source: pg_dump via postgres:// URL (libpq)')
-        .option('--source-local <db>', 'Source: pg_dump a DB already on the singleton')
-        .option('--source-db <db>', 'DB name to dump (when --source-container; default: postgres)')
-        .option('--source-user <user>', 'Source-side user (when --source-container; default: development)')
-        .option('--singleton-container <name>', 'Override singleton container name (default: olam-postgres)')
-        .option('--singleton-user <user>', 'Override singleton user (default: development)')
-        .option('--force', 'Drop + recreate if the seed already exists')
-        .action(async (opts) => {
-        try {
-            await handleBake(opts);
-        }
-        catch (err) {
-            printError(err instanceof Error ? err.message : String(err));
-            process.exit(1);
-        }
-    });
-    seed
-        .command('list')
-        .description('List seed templates on the singleton')
-        .option('--json', 'Emit machine-parseable JSON')
-        .option('--singleton-container <name>', 'Override singleton container name (default: olam-postgres)')
-        .option('--singleton-user <user>', 'Override singleton user (default: development)')
-        .action((opts) => {
-        try {
-            handleList(opts);
-        }
-        catch (err) {
-            printError(err instanceof Error ? err.message : String(err));
-            process.exit(1);
-        }
-    });
-    seed
-        .command('remove <name>')
-        .description('Remove a seed template (refuses by default if any per-world clones exist)')
-        .option('--force', 'DROP even if active clones exist (clones will be orphaned)')
-        .option('--singleton-container <name>', 'Override singleton container name (default: olam-postgres)')
-        .option('--singleton-user <user>', 'Override singleton user (default: development)')
-        .action((name, opts) => {
-        try {
-            handleRemove(name, opts);
-        }
-        catch (err) {
-            printError(err instanceof Error ? err.message : String(err));
-            process.exit(1);
-        }
-    });
-    seed
-        .command('verify <name>')
-        .description('Sanity-check a seed (existence, connectivity, size, clone count)')
-        .option('--singleton-container <name>', 'Override singleton container name (default: olam-postgres)')
-        .option('--singleton-user <user>', 'Override singleton user (default: development)')
-        .action((name, opts) => {
-        try {
-            handleVerify(name, opts);
-        }
-        catch (err) {
-            printError(err instanceof Error ? err.message : String(err));
-            process.exit(1);
-        }
-    });
-}
-//# sourceMappingURL=seed.js.map

package/dist/commands/seed.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"seed.js","sourceRoot":"","sources":["../../src/commands/seed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE9F,MAAM,2BAA2B,GAAG,eAAe,CAAC;AACpD,MAAM,sBAAsB,GAAG,aAAa,CAAC;AA+B7C,uEAAuE;AAEvE;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,2DAA2D,CACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB,EAAE,IAAY,EAAE,IAAc,EAAE,KAAc;IACtF,OAAO,SAAS,CACd,QAAQ,EACR,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,EACtD,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CACpC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,IAAY,EAAE,EAAU;IACjE,MAAM,CAAC,GAAG,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE;QACzC,IAAI,EAAE,UAAU,EAAE,MAAM;QACxB,4CAA4C,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;KACtE,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC;AAC3D,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAiB,EAAE,IAAY;IACzD,MAAM,CAAC,GAAG,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE;QACzC,IAAI,EAAE,UAAU,EAAE,MAAM;QACxB,qEAAqE;YACrE,iEAAiE;KAClE,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9E,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,SAAiB,EAAE,IAAY,EAAE,IAAY;IAC1E,iEAAiE;IACjE,kDAAkD;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,MAAM,CAAC,GAAG,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE;QACzC,IAAI,EAAE,UAAU,EAAE,MAAM;QACxB,uDAAuD,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,4BAA4B;KAC9G,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,uEAAuE;AAEvE,KAAK,UAAU,UAAU,CAAC,IAAiB;IACzC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE7B,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,IAAI,2BAA2B,CAAC;IACzE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,sBAAsB,CAAC;IAEnE,oDAAoD;IACpD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAC;IACvH,CAAC;IAED,6CAA6C;IAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,mBAAmB,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACjH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,wBAAwB,SAAS,8CAA8C,CAAC,CAAC;IACnG,CAAC;IAED,kBAAkB;IAClB,IAAI,cAAc,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,EAAE,gEAAgE,CAAC,CAAC;QACpG,CAAC;QACD,qDAAqD;QACrD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,CAAC,EAAE,OAAO,MAAM,CAAC,MAAM,2CAA2C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBACtH,2CAA2C,CAC9C,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,2BAA2B,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/G,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,oBAAoB,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACnH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,yEAAyE;IACzE,uDAAuD;IACvD,IAAI,QAAkB,CAAC;IACvB,2EAA2E;IAC3E,uEAAuE;IACvE,iDAAiD;IACjD,IAAI,OAAO,GAA2B,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IAC1E,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,sBAAsB,CAAC;QAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,eAAe,OAAO,KAAK,SAAS,OAAO,IAAI,CAAC,CAAC;QAClG,QAAQ,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;QAClH,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IAChD,CAAC;SAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,WAAW,+BAA+B,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QAC3E,QAAQ,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;QACxH,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,YAAY;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,SAAU,CAAC,OAAO,CAAC,kBAAkB,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;QACjG,QAAQ,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,IAAI,CAAC,SAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,6CAA6C,CAAC,CAAC;QAC5H,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IACtG,MAAM,MAAM,GAAG,UAAU,CACvB,QAAQ,EACR,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC,EACpG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CACpF,CAAC;IAEF,MAAM,CAAC,MAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAM,CAAC,CAAC;IAEnC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7C,IAAI,OAAO,CAAS,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAS,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;KAC3E,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,SAAS;IACT,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,EAAE,aAAa,EAAE;QACrD,IAAI,EAAE,UAAU,EAAE,MAAM;QACxB,2CAA2C,IAAI,CAAC,EAAE,KAAK;KACxD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACxD,YAAY,CAAC,SAAS,IAAI,CAAC,EAAE,YAAY,OAAO,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,uEAAuE;AAEvE,SAAS,UAAU,CAAC,IAAiB;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,IAAI,2BAA2B,CAAC;IACzE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,sBAAsB,CAAC;IACnE,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IACD,WAAW,CAAC,GAAG,KAAK,CAAC,MAAM,eAAe,SAAS,EAAE,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,uEAAuE;AAEvE,SAAS,YAAY,CAAC,IAAY,EAAE,IAAmB;IACrD,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,IAAI,2BAA2B,CAAC;IACzE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,sBAAsB,CAAC;IAEnE,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC;QACpD,YAAY,CAAC,SAAS,IAAI,+CAA+C,CAAC,CAAC;QAC3E,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,SAAS,MAAM,CAAC,MAAM,2BAA2B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACjF,yGAAyG,CAC5G,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,IAAI,GAAG,CAAC,CAAC,CAAC;IAC5G,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,YAAY,CAAC,iBAAiB,IAAI,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,uEAAuE;AAEvE,SAAS,YAAY,CAAC,IAAY,EAAE,IAAmB;IACrD,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,IAAI,2BAA2B,CAAC;IACzE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,sBAAsB,CAAC;IAEnE,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,+BAA+B,CAAC,CAAC;IAChE,CAAC;IACD,yEAAyE;IACzE,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAC9F,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,qCAAqC;IACrC,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,EAAE,aAAa,EAAE;QACrD,IAAI,EAAE,IAAI,EAAE,MAAM;QAClB,wEAAwE;YACxE,gFAAgF;KACjF,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,GAAG,GAAG,EAAE,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;IACrE,YAAY,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;IAClC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxB,SAAS,CAAC,QAAQ,EAAE,GAAG,UAAU,kBAAkB,CAAC,CAAC;IACrD,SAAS,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACpG,CAAC;AAED,uEAAuE;AAEvE,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC3C,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+DAA+D,CAAC,CAAC;IAEhF,IAAI;SACD,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,8DAA8D,CAAC;SAC3E,cAAc,CAAC,aAAa,EAAE,4DAA4D,CAAC;SAC3F,MAAM,CAAC,2BAA2B,EAAE,8CAA8C,CAAC;SACnF,MAAM,CAAC,oBAAoB,EAAE,6CAA6C,CAAC;SAC3E,MAAM,CAAC,qBAAqB,EAAE,+CAA+C,CAAC;SAC9E,MAAM,CAAC,kBAAkB,EAAE,8DAA8D,CAAC;SAC1F,MAAM,CAAC,sBAAsB,EAAE,kEAAkE,CAAC;SAClG,MAAM,CAAC,8BAA8B,EAAE,4DAA4D,CAAC;SACpG,MAAM,CAAC,yBAAyB,EAAE,gDAAgD,CAAC;SACnF,MAAM,CAAC,SAAS,EAAE,4CAA4C,CAAC;SAC/D,MAAM,CAAC,KAAK,EAAE,IAAiB,EAAE,EAAE;QAClC,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sCAAsC,CAAC;SACnD,MAAM,CAAC,QAAQ,EAAE,6BAA6B,CAAC;SAC/C,MAAM,CAAC,8BAA8B,EAAE,4DAA4D,CAAC;SACpG,MAAM,CAAC,yBAAyB,EAAE,gDAAgD,CAAC;SACnF,MAAM,CAAC,CAAC,IAAiB,EAAE,EAAE;QAC5B,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,2EAA2E,CAAC;SACxF,MAAM,CAAC,SAAS,EAAE,4DAA4D,CAAC;SAC/E,MAAM,CAAC,8BAA8B,EAAE,4DAA4D,CAAC;SACpG,MAAM,CAAC,yBAAyB,EAAE,gDAAgD,CAAC;SACnF,MAAM,CAAC,CAAC,IAAY,EAAE,IAAmB,EAAE,EAAE;QAC5C,IAAI,CAAC;YACH,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,kEAAkE,CAAC;SAC/E,MAAM,CAAC,8BAA8B,EAAE,4DAA4D,CAAC;SACpG,MAAM,CAAC,yBAAyB,EAAE,gDAAgD,CAAC;SACnF,MAAM,CAAC,CAAC,IAAY,EAAE,IAAmB,EAAE,EAAE;QAC5C,IAAI,CAAC;YACH,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/services-tls.d.ts

@@ -1,120 +0,0 @@
-/**
- * `olam services tls-install` — generate a locally-trusted TLS certificate
- * for the K3d Traefik IngressRoute and apply it as a Kubernetes Secret.
- *
- * Why this exists: HTTP/1.1 inside `kubectl port-forward` hits the browser's
- * 6-connection-per-origin cap under Electric SQL long-poll load (one shape
- * subscription per concurrent route → SPA stalls at ~25s pending). Putting
- * Traefik in front with TLS + HTTP/2 fixes both problems with one cert
- * provisioning step. mkcert handles the root-CA dance so browsers trust
- * `https://olam.local` natively — no padlock warnings, no `--insecure`.
- *
- * Flow:
- *   1. Verify `mkcert` is on PATH (actionable error otherwise).
- *   2. Run `mkcert -install` (idempotent — no-op if root CA already trusted).
- *   3. Mint a cert in a tmp dir for `olam.local 127.0.0.1 ::1`.
- *   4. Read tls.crt + tls.key, base64-encode, substitute into the template.
- *   5. `kubectl apply -f -` against the rendered Secret manifest.
- *   6. Suggest the /etc/hosts line (do NOT auto-edit).
- *
- * Idempotency: if `olam-host-cp-tls` already exists AND its NotAfter is
- * more than 30 days away, skip the whole flow. Operators can force renewal
- * with `kubectl -n olam delete secret olam-host-cp-tls`.
- *
- * Design constraints honoured:
- *   - No new npm deps (uses node:child_process + node:fs + node:os).
- *   - SAN list includes `127.0.0.1` + `::1` because modern browsers ignore
- *     CN and only honour SANs (Chrome 58+, Brave, Safari, Firefox).
- *   - `/etc/hosts` is printed, not auto-mutated — touching it behind the
- *     operator's back is a foot-gun (and would require sudo).
- */
-import type { Command } from 'commander';
-/** Result of `tlsInstall` — exported for tests and the auto-invoke path in `services up`. */
-export interface TlsInstallResult {
-    readonly action: 'installed' | 'renewed' | 'skipped' | 'failed';
-    /** Reason string surfaced to the operator; non-null when action === 'failed' or 'skipped'. */
-    readonly reason?: string;
-    /** Traefik websecure NodePort, when discovered. */
-    readonly httpsPort?: number;
-}
-export interface TlsInstallDeps {
-    /** Override path to a `mkcert`-compatible binary (defaults to PATH lookup). */
-    readonly mkcertPath?: string;
-    /** Injectable subprocess runner — tests pass a stub; production uses spawnSync. */
-    readonly spawnImpl?: (cmd: string, args: readonly string[], opts?: {
-        encoding?: 'utf-8';
-        timeout?: number;
-        input?: string;
-    }) => {
-        status: number | null;
-        stdout: string;
-        stderr: string;
-    };
-    /**
-     * Inject the kubectl context (skip resolution). When undefined the helper
-     * resolves via `~/.olam/config.json` → `OLAM_K8S_CONTEXT_ACK` (matches the
-     * services.ts policy).
-     */
-    readonly kubectlContext?: string;
-    /** Skip mkcert -install (used in tests where the binary is a stub). */
-    readonly skipRootInstall?: boolean;
-    /**
-     * Returns true when the current process has an interactive terminal attached.
-     * Defaults to `() => process.stdin.isTTY === true`.
-     * Injectable for tests that need to exercise the non-TTY path.
-     */
-    readonly isTtyAttached?: () => boolean;
-    /**
-     * Override the path to the TLS Secret template. Defaults to the bundled
-     * `packages/host-cp/k8s/manifests/65-tls-secret-template.yaml`.
-     */
-    readonly templatePath?: string;
-    /** Override "now" for renewal-window tests. */
-    readonly now?: Date;
-}
-/**
- * Probe whether the mkcert root CA is already trusted on this machine.
- *
- * macOS: `mkcert -CAROOT` → directory; if `rootCA.pem` exists there AND
- *   `security find-certificate -c mkcert /Library/Keychains/System.keychain`
- *   exits 0, the CA is already in the system keychain.
- * Linux/other: CA file existence alone is used as a proxy for "trusted"
- *   (nss-based stores don't need sudo and mkcert handles them idempotently).
- *
- * Returns false on any probe failure so the caller falls back to attempting
- * `mkcert -install` (safe — mkcert itself is idempotent).
- */
-export declare function isMkcertRootTrusted(mkcertPath: string, spawn: NonNullable<TlsInstallDeps['spawnImpl']>): boolean;
-/** Resolve Traefik's `websecure` NodePort (HTTPS edge), or null on failure. */
-export declare function resolveTraefikHttpsPort(spawnArg?: TlsInstallDeps['spawnImpl'], context?: string): number | null;
-/**
- * Pure renderer: substitutes the placeholders in the TLS Secret template.
- * Exported for snapshot testing.
- */
-export declare function renderTlsSecret(template: string, crtBase64: string, keyBase64: string): string;
-/**
- * The full tls-install flow. Returns a structured result so the caller in
- * `services up` can decide whether to print the success URL or fall back.
- */
-export declare function tlsInstall(deps?: TlsInstallDeps): Promise<TlsInstallResult>;
-/** Auto-invoke seam used by `olam services up` — silent when skipped, loud when failed. */
-export declare function ensureTlsInstalled(): Promise<TlsInstallResult>;
-export declare function registerServicesTls(services: Command): void;
-/** Constants exported for tests + cross-module usage. */
-export declare const TLS_SECRET_NAME = "olam-host-cp-tls";
-export declare const TLS_NAMESPACE = "olam";
-export declare const TLS_RENEWAL_THRESHOLD_DAYS = 30;
-export declare const TLS_SAN_LIST: readonly ["olam.local", "127.0.0.1", "::1"];
-/** Used by services.ts to write a "did we already do this" probe. */
-export declare function tlsSecretExists(spawnArg?: TlsInstallDeps['spawnImpl'], context?: string): boolean;
-/**
- * Best-effort: `execFileSync('kubectl', ...)` to apply the bundled
- * IngressRoute + Service manifests when `services up` first runs. Idempotent
- * via `kubectl apply`. We DON'T do this from tls-install (single-responsibility:
- * tls-install only handles certs); services.ts orchestrates the manifest apply.
- */
-export declare function applyIngressManifests(context: string): {
-    ok: boolean;
-    reason?: string;
-};
-//# sourceMappingURL=services-tls.d.ts.map

package/dist/commands/services-tls.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"services-tls.d.ts","sourceRoot":"","sources":["../../src/commands/services-tls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAOH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAczC,6FAA6F;AAC7F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IAChE,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,mDAAmD;IACnD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,SAAS,CAAC,EAAE,CACnB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KAC5D;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,uEAAuE;IACvE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB;AAmBD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,WAAW,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,GAC9C,OAAO,CAoBT;AA8GD,+EAA+E;AAC/E,wBAAgB,uBAAuB,CACrC,QAAQ,CAAC,EAAE,cAAc,CAAC,WAAW,CAAC,EACtC,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,GAAG,IAAI,CAwBf;AAYD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAI9F;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA0KrF;AAwCD,2FAA2F;AAC3F,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAEpE;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,GAAG,IAAI,CAQ3D;AAED,yDAAyD;AACzD,eAAO,MAAM,eAAe,qBAAc,CAAC;AAC3C,eAAO,MAAM,aAAa,SAAY,CAAC;AACvC,eAAO,MAAM,0BAA0B,KAAyB,CAAC;AACjE,eAAO,MAAM,YAAY,6CAAW,CAAC;AAErC,qEAAqE;AACrE,wBAAgB,eAAe,CAC7B,QAAQ,CAAC,EAAE,cAAc,CAAC,WAAW,CAAC,EACtC,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAWT;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAcvF"}