@pleri/olam-cli 0.1.201 → 0.1.205

package/dist/lib/auth-remote.js

@@ -1,394 +0,0 @@
-/**
- * auth-remote — HTTP helper for `olam auth --remote <url>` subcommands.
- *
- * Wraps fetch calls against the auth-worker's `/v1/*` endpoints.
- *
- * V1 dogfood note: CF Access cookie must be obtained manually via browser.
- * A proper CLI-orchestrated SSO flow (CLI-as-OAuth-client) is deferred to v2.
- * See e4/e5/e6 task notes in docs/plans/auth-worker-multitenant-vault/.
- */
-function normalizeBase(url) {
-    return url.replace(/\/+$/, '');
-}
-/**
- * Build common headers for auth-worker requests.
- * When cfAuthCookie is provided, forwards it so the worker's CF Access
- * middleware can authenticate the request server-side.
- */
-function buildHeaders(cookie, cfAccess) {
-    const headers = {
-        'Content-Type': 'application/json',
-        Accept: 'application/json',
-    };
-    // Phase H h2: prefer machine-to-machine service-token headers when present.
-    // The CF Access edge validates these and injects the SSO JWT the worker's
-    // resolveIdentity expects. Cookie + service token are not mutually
-    // exclusive — both may be sent; the edge honours the service token.
-    if (cfAccess) {
-        headers['CF-Access-Client-Id'] = cfAccess.clientId;
-        headers['CF-Access-Client-Secret'] = cfAccess.clientSecret;
-    }
-    if (cookie) {
-        headers['Cookie'] = `CF_Authorization=${cookie}`;
-    }
-    return headers;
-}
-/** Extract the CF Access service-token pair from options, or undefined. */
-function cfAccessFromOpts(opts) {
-    if (opts.cfAccessClientId && opts.cfAccessClientSecret) {
-        return { clientId: opts.cfAccessClientId, clientSecret: opts.cfAccessClientSecret };
-    }
-    return undefined;
-}
-/**
- * GET /v1/health — worker liveness probe.
- */
-export async function remoteHealth(opts) {
-    const { baseUrl, cfAuthCookie, fetchFn = fetch } = opts;
-    const url = `${normalizeBase(baseUrl)}/v1/health`;
-    const res = await fetchFn(url, {
-        method: 'GET',
-        headers: buildHeaders(cfAuthCookie),
-    });
-    if (!res.ok) {
-        throw new Error(`Health check failed: HTTP ${res.status}`);
-    }
-    return res.json();
-}
-/**
- * POST /v1/oauth/start — begin an OAuth flow.
- * Returns { authorize_url, state_id }.
- */
-export async function remoteOAuthStart(opts) {
-    const { baseUrl, cfAuthCookie, fetchFn = fetch } = opts;
-    const url = `${normalizeBase(baseUrl)}/v1/oauth/start`;
-    const res = await fetchFn(url, {
-        method: 'POST',
-        headers: buildHeaders(cfAuthCookie),
-        body: JSON.stringify({}),
-    });
-    if (!res.ok) {
-        const body = await res.text().catch(() => '');
-        throw new Error(`OAuth start failed: HTTP ${res.status}${body ? ` — ${body}` : ''}`);
-    }
-    return res.json();
-}
-/**
- * GET /v1/service-tokens — list bound service tokens.
- */
-export async function remoteListServiceTokens(opts) {
-    const { baseUrl, cfAuthCookie, fetchFn = fetch } = opts;
-    const url = `${normalizeBase(baseUrl)}/v1/service-tokens`;
-    const res = await fetchFn(url, {
-        method: 'GET',
-        headers: buildHeaders(cfAuthCookie),
-    });
-    if (!res.ok) {
-        throw new Error(`List service-tokens failed: HTTP ${res.status}`);
-    }
-    return res.json();
-}
-/**
- * GET /v1/accounts — list registered accounts (Anthropic OAuth sessions).
- *
- * B4 (narrowed): the server response is `{accounts, count}`. We map it back to
- * the AccountEntry[] shape pre-existing call sites expect, and we never trust
- * the server to omit secret fields — see the explicit field whitelist below.
- *
- * Defensive shape handling: the server contract is `{accounts: [...], count}`,
- * but the legacy pre-B4 mock and older server builds may have returned a bare
- * array. Both shapes are accepted (array OR envelope) so a partial roll-out
- * never blocks the CLI from rendering useful output.
- */
-export async function remoteListAccounts(opts) {
-    const { baseUrl, cfAuthCookie, fetchFn = fetch } = opts;
-    const url = `${normalizeBase(baseUrl)}/v1/accounts`;
-    const res = await fetchFn(url, {
-        method: 'GET',
-        headers: buildHeaders(cfAuthCookie, cfAccessFromOpts(opts)),
-    });
-    if (!res.ok) {
-        throw new Error(`List accounts failed: HTTP ${res.status}`);
-    }
-    const raw = (await res.json());
-    const rows = extractAccountRows(raw);
-    // Whitelist + map: never propagate unknown keys (defence in depth — even
-    // if the server starts returning extra fields, we surface only the ones
-    // the CLI's rendering layer expects).
-    return rows.map((row) => {
-        const r = row;
-        const expiresAt = typeof r['expiresAt'] === 'number' ? r['expiresAt'] : undefined;
-        const accountLabel = typeof r['accountLabel'] === 'string' ? r['accountLabel'] : undefined;
-        const expiresIn = typeof r['expiresIn'] === 'string'
-            ? r['expiresIn']
-            : expiresAt !== undefined
-                ? formatExpiresInFromEpoch(expiresAt, Date.now())
-                : undefined;
-        return {
-            id: String(r['id'] ?? ''),
-            label: accountLabel,
-            state: typeof r['state'] === 'string' ? r['state'] : undefined,
-            expiresIn,
-            provider: typeof r['provider'] === 'string' ? r['provider'] : undefined,
-            email: r['email'] === null
-                ? null
-                : typeof r['email'] === 'string'
-                    ? r['email']
-                    : undefined,
-            rateLimitResetsAt: r['rateLimitResetsAt'] === null
-                ? null
-                : typeof r['rateLimitResetsAt'] === 'string'
-                    ? r['rateLimitResetsAt']
-                    : undefined,
-            weeklyResetsAt: r['weeklyResetsAt'] === null
-                ? null
-                : typeof r['weeklyResetsAt'] === 'string'
-                    ? r['weeklyResetsAt']
-                    : undefined,
-        };
-    });
-}
-/**
- * Extract the rows array from either the B4 envelope shape `{accounts, count}`
- * or the legacy bare-array shape. Unknown shapes return an empty array (the
- * caller surfaces this as "no accounts"; safer than throwing a parse error
- * when the server is on a partial-rollout build).
- */
-function extractAccountRows(raw) {
-    if (Array.isArray(raw))
-        return raw;
-    if (raw && typeof raw === 'object' && 'accounts' in raw) {
-        const accounts = raw.accounts;
-        if (Array.isArray(accounts))
-            return accounts;
-    }
-    return [];
-}
-/**
- * Convert an `expiresAt` epoch-ms to the free-form `expiresIn` hint string the
- * CLI's table renderer already understands.  Examples: `"32m"`, `"1h12m"`,
- * `"expired 4d"`. Future-tense for positive deltas; "expired N" for past.
- */
-function formatExpiresInFromEpoch(expiresAt, now) {
-    const deltaMs = expiresAt - now;
-    const absMs = Math.abs(deltaMs);
-    const m = Math.floor(absMs / 60_000) % 60;
-    const h = Math.floor(absMs / 3_600_000) % 24;
-    const d = Math.floor(absMs / 86_400_000);
-    const parts = [];
-    if (d > 0)
-        parts.push(`${d}d`);
-    if (h > 0)
-        parts.push(`${h}h`);
-    if (parts.length === 0 || m > 0)
-        parts.push(`${m}m`);
-    const body = parts.join('');
-    return deltaMs < 0 ? `expired ${body}` : body;
-}
-/**
- * POST /v1/service-tokens/bind — bind a CF service token to a user sub.
- */
-export async function remoteBindServiceToken(opts, payload) {
-    const { baseUrl, cfAuthCookie, fetchFn = fetch } = opts;
-    const url = `${normalizeBase(baseUrl)}/v1/service-tokens/bind`;
-    const res = await fetchFn(url, {
-        method: 'POST',
-        headers: buildHeaders(cfAuthCookie),
-        body: JSON.stringify(payload),
-    });
-    if (!res.ok) {
-        const body = await res.text().catch(() => '');
-        throw new Error(`Bind service-token failed: HTTP ${res.status}${body ? ` — ${body}` : ''}`);
-    }
-    return { ok: true };
-}
-/**
- * DELETE /v1/service-tokens/:client_id — revoke a service token.
- */
-export async function remoteDeleteServiceToken(opts, clientId) {
-    const { baseUrl, cfAuthCookie, fetchFn = fetch } = opts;
-    const url = `${normalizeBase(baseUrl)}/v1/service-tokens/${encodeURIComponent(clientId)}`;
-    const res = await fetchFn(url, {
-        method: 'DELETE',
-        headers: buildHeaders(cfAuthCookie),
-    });
-    if (!res.ok) {
-        throw new Error(`Delete service-token failed: HTTP ${res.status}`);
-    }
-    return { ok: true };
-}
-// ── g4: Anthropic proxy token helpers ────────────────────────────────────────
-// Types AnthropicTokenIssueResponse + AnthropicTokenEntry are declared at the
-// top of this file (lines 35-48) — added by PR #972 which independently fixed
-// the JSDoc-eating-types bug while this branch was in flight. The cherry-pick
-// of commit 19512c47 (which removed the stray /** that was hiding the
-// duplicate declarations below) exposed both copies; the duplicate block is
-// removed here to fix the resulting TS2300 "Duplicate identifier" error.
-/**
- * POST /v1/anthropic-tokens/issue — mint a new Anthropic proxy token.
- * Returns { secret, token_hash, label, anthropic_base_url_hint }.
- */
-export async function remoteIssueAnthropicToken(opts, label) {
-    const { baseUrl, cfAuthCookie, fetchFn = fetch } = opts;
-    const url = `${normalizeBase(baseUrl)}/v1/anthropic-tokens/issue`;
-    const res = await fetchFn(url, {
-        method: 'POST',
-        headers: buildHeaders(cfAuthCookie, cfAccessFromOpts(opts)),
-        body: JSON.stringify({ label }),
-    });
-    if (!res.ok) {
-        const body = await res.text().catch(() => '');
-        throw new Error(`Issue anthropic-token failed: HTTP ${res.status}${body ? ` — ${body}` : ''}`);
-    }
-    return res.json();
-}
-/**
- * GET /v1/anthropic-tokens — list issued Anthropic proxy tokens.
- */
-export async function remoteListAnthropicTokens(opts) {
-    const { baseUrl, cfAuthCookie, fetchFn = fetch } = opts;
-    const url = `${normalizeBase(baseUrl)}/v1/anthropic-tokens`;
-    const res = await fetchFn(url, {
-        method: 'GET',
-        headers: buildHeaders(cfAuthCookie, cfAccessFromOpts(opts)),
-    });
-    if (!res.ok) {
-        const body = await res.text().catch(() => '');
-        throw new Error(`List anthropic-tokens failed: HTTP ${res.status}${body ? ` — ${body}` : ''}`);
-    }
-    return res.json();
-}
-/**
- * DELETE /v1/anthropic-tokens/:token_hash — revoke an Anthropic proxy token.
- * Returns true on 200/204, false on 404.
- */
-export async function remoteRevokeAnthropicToken(opts, tokenHash) {
-    const { baseUrl, cfAuthCookie, fetchFn = fetch } = opts;
-    const url = `${normalizeBase(baseUrl)}/v1/anthropic-tokens/${encodeURIComponent(tokenHash)}`;
-    const res = await fetchFn(url, {
-        method: 'DELETE',
-        headers: buildHeaders(cfAuthCookie, cfAccessFromOpts(opts)),
-    });
-    if (res.status === 404)
-        return false;
-    if (!res.ok) {
-        throw new Error(`Revoke anthropic-token failed: HTTP ${res.status}`);
-    }
-    return true;
-}
-/**
- * runDoctorChecks — runs 4 diagnostic probes against the auth-worker.
- * Returns an ordered array of DoctorCheckResult (pass/fail/warn + remedy).
- *
- * Probe 1: GET /v1/health → liveness
- * Probe 2: CF Access JWKS reachable (derives team domain from worker URL)
- * Probe 3: POST /v1/oauth/start → endpoint reachability
- * Probe 4: ANTHROPIC_OAUTH_CLIENT_ID env present (config check)
- */
-export async function runDoctorChecks(opts) {
-    const results = [];
-    const { baseUrl, cfAuthCookie, fetchFn = fetch } = opts;
-    const base = normalizeBase(baseUrl);
-    // Probe 1: /v1/health
-    try {
-        const h = await remoteHealth({ baseUrl, cfAuthCookie, fetchFn });
-        results.push({
-            probe: 'worker-health',
-            status: 'pass',
-            message: `Worker alive${h.version ? ` (version=${h.version})` : ''}`,
-        });
-    }
-    catch (err) {
-        results.push({
-            probe: 'worker-health',
-            status: 'fail',
-            message: err instanceof Error ? err.message : 'Health check failed',
-            remedy: `Verify the worker is deployed and reachable at ${base}`,
-        });
-    }
-    // Probe 2: CF Access JWKS
-    // Extract team domain from the worker URL host segment.
-    // e.g. https://auth.example.workers.dev → team = "example"
-    // For custom domains like auth.myteam.example.com, we look for the last
-    // two segments of the authority. In practice workers.dev domains expose team name.
-    let jwksUrl;
-    try {
-        const parsed = new URL(baseUrl);
-        // heuristic: take the second-to-last part of the hostname before TLD pair
-        const parts = parsed.hostname.split('.');
-        // e.g. auth.myteam.cloudflareaccess.com or myteam.cloudflareaccess.com
-        // Best-effort: use the host as the team domain search key
-        const team = parts.length >= 3 ? parts[parts.length - 3] : parts[0];
-        jwksUrl = `https://${team}.cloudflareaccess.com/cdn-cgi/access/certs`;
-    }
-    catch {
-        jwksUrl = `${base}/.well-known/jwks.json`;
-    }
-    try {
-        const res = await fetchFn(jwksUrl, { method: 'GET' });
-        if (res.ok) {
-            results.push({
-                probe: 'cf-access-jwks',
-                status: 'pass',
-                message: `CF Access JWKS reachable at ${jwksUrl}`,
-            });
-        }
-        else {
-            results.push({
-                probe: 'cf-access-jwks',
-                status: 'warn',
-                message: `CF Access JWKS returned HTTP ${res.status}`,
-                remedy: `Verify Cloudflare Access is configured for your zone. JWKS checked: ${jwksUrl}`,
-            });
-        }
-    }
-    catch (err) {
-        results.push({
-            probe: 'cf-access-jwks',
-            status: 'warn',
-            message: `CF Access JWKS unreachable: ${err instanceof Error ? err.message : String(err)}`,
-            remedy: `Check network access to ${jwksUrl}. CF Access may not be configured for this zone.`,
-        });
-    }
-    // Probe 3: POST /v1/oauth/start
-    try {
-        await remoteOAuthStart({ baseUrl, cfAuthCookie, fetchFn });
-        results.push({
-            probe: 'oauth-start',
-            status: 'pass',
-            message: 'OAuth start endpoint is reachable',
-        });
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        // 403 means CF Access is enforcing SSO but the endpoint exists — that's a warn.
-        const status = msg.includes('HTTP 403') ? 'warn' : 'fail';
-        results.push({
-            probe: 'oauth-start',
-            status,
-            message: `OAuth start: ${msg}`,
-            remedy: status === 'warn'
-                ? 'Open the worker URL in a browser to complete CF Access SSO, then re-run with --cookie.'
-                : `Check that /v1/oauth/start is deployed at ${base}`,
-        });
-    }
-    // Probe 4: ANTHROPIC_OAUTH_CLIENT_ID env
-    const clientId = process.env['ANTHROPIC_OAUTH_CLIENT_ID'];
-    if (clientId) {
-        results.push({
-            probe: 'env-client-id',
-            status: 'pass',
-            message: `ANTHROPIC_OAUTH_CLIENT_ID is set (length=${clientId.length})`,
-        });
-    }
-    else {
-        results.push({
-            probe: 'env-client-id',
-            status: 'warn',
-            message: 'ANTHROPIC_OAUTH_CLIENT_ID is not set in the environment',
-            remedy: 'Set ANTHROPIC_OAUTH_CLIENT_ID in your shell profile (the Anthropic OAuth app client ID).',
-        });
-    }
-    return results;
-}
-//# sourceMappingURL=auth-remote.js.map

package/dist/lib/auth-remote.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-remote.js","sourceRoot":"","sources":["../../src/lib/auth-remote.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAkHH,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,MAAe,EAAE,QAAuB;IAC5D,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,kBAAkB;KAC3B,CAAC;IACF,4EAA4E;IAC5E,0EAA0E;IAC1E,mEAAmE;IACnE,oEAAoE;IACpE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,qBAAqB,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACnD,OAAO,CAAC,yBAAyB,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC;IAC7D,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,QAAQ,CAAC,GAAG,oBAAoB,MAAM,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,IAAyB;IACjD,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACvD,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,EAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC;IACtF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAyB;IAEzB,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;IACxD,MAAM,GAAG,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC;IAClD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;QAC7B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,YAAY,CAAC,YAAY,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAA6B,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAyB;IAEzB,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;IACxD,MAAM,GAAG,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACvD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;QAC7B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,YAAY,CAAC,YAAY,CAAC;QACnC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAiC,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAyB;IAEzB,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;IACxD,MAAM,GAAG,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;QAC7B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,YAAY,CAAC,YAAY,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAA6B,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAyB;IAEzB,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;IACxD,MAAM,GAAG,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,cAAc,CAAC;IACpD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;QAC7B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,YAAY,CAAC,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC;KAC5D,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;IAC1C,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,yEAAyE;IACzE,wEAAwE;IACxE,sCAAsC;IACtC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,MAAM,CAAC,GAAG,GAA8B,CAAC;QACzC,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9F,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,cAAc,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,MAAM,SAAS,GACb,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ;YAChC,CAAC,CAAE,CAAC,CAAC,WAAW,CAAY;YAC5B,CAAC,CAAC,SAAS,KAAK,SAAS;gBACvB,CAAC,CAAC,wBAAwB,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;gBACjD,CAAC,CAAC,SAAS,CAAC;QAClB,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,SAAS;YAC1E,SAAS;YACT,QAAQ,EAAE,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,UAAU,CAAY,CAAC,CAAC,CAAC,SAAS;YACnF,KAAK,EACH,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI;gBACjB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ;oBAC9B,CAAC,CAAE,CAAC,CAAC,OAAO,CAAY;oBACxB,CAAC,CAAC,SAAS;YACjB,iBAAiB,EACf,CAAC,CAAC,mBAAmB,CAAC,KAAK,IAAI;gBAC7B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,KAAK,QAAQ;oBAC1C,CAAC,CAAE,CAAC,CAAC,mBAAmB,CAAY;oBACpC,CAAC,CAAC,SAAS;YACjB,cAAc,EACZ,CAAC,CAAC,gBAAgB,CAAC,KAAK,IAAI;gBAC1B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,KAAK,QAAQ;oBACvC,CAAC,CAAE,CAAC,CAAC,gBAAgB,CAAY;oBACjC,CAAC,CAAC,SAAS;SAClB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,GAAY;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACnC,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAI,GAA6B,CAAC,QAAQ,CAAC;QACzD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,SAAiB,EAAE,GAAW;IAC9D,MAAM,OAAO,GAAG,SAAS,GAAG,GAAG,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC;IAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5B,OAAO,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAyB,EACzB,OAA6C;IAE7C,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;IACxD,MAAM,GAAG,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,yBAAyB,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;QAC7B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,YAAY,CAAC,YAAY,CAAC;QACnC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAyB,EACzB,QAAgB;IAEhB,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;IACxD,MAAM,GAAG,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,sBAAsB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1F,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;QAC7B,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,YAAY,CAAC,YAAY,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,sEAAsE;AACtE,4EAA4E;AAC5E,yEAAyE;AAEzE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAyB,EACzB,KAAa;IAEb,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;IACxD,MAAM,GAAG,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,4BAA4B,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;QAC7B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,YAAY,CAAC,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAA0C,CAAC;AAC5D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAyB;IAEzB,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;IACxD,MAAM,GAAG,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAC5D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;QAC7B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,YAAY,CAAC,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC;KAC5D,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAoC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAyB,EACzB,SAAiB;IAEjB,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;IACxD,MAAM,GAAG,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,wBAAwB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;IAC7F,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;QAC7B,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,YAAY,CAAC,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC;KAC5D,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAyB;IAEzB,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;IACxD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAEpC,sBAAsB;IACtB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;SACrE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB;YACnE,MAAM,EAAE,kDAAkD,IAAI,EAAE;SACjE,CAAC,CAAC;IACL,CAAC;IAED,0BAA0B;IAC1B,wDAAwD;IACxD,2DAA2D;IAC3D,wEAAwE;IACxE,mFAAmF;IACnF,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,0EAA0E;QAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,uEAAuE;QACvE,0DAA0D;QAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpE,OAAO,GAAG,WAAW,IAAI,4CAA4C,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,GAAG,IAAI,wBAAwB,CAAC;IAC5C,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,gBAAgB;gBACvB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,+BAA+B,OAAO,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,gBAAgB;gBACvB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,gCAAgC,GAAG,CAAC,MAAM,EAAE;gBACrD,MAAM,EAAE,uEAAuE,OAAO,EAAE;aACzF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YAC1F,MAAM,EAAE,2BAA2B,OAAO,kDAAkD;SAC7F,CAAC,CAAC;IACL,CAAC;IAED,gCAAgC;IAChC,IAAI,CAAC;QACH,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,mCAAmC;SAC7C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,gFAAgF;QAChF,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,aAAa;YACpB,MAAM;YACN,OAAO,EAAE,gBAAgB,GAAG,EAAE;YAC9B,MAAM,EACJ,MAAM,KAAK,MAAM;gBACf,CAAC,CAAC,wFAAwF;gBAC1F,CAAC,CAAC,6CAA6C,IAAI,EAAE;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,yCAAyC;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,4CAA4C,QAAQ,CAAC,MAAM,GAAG;SACxE,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,yDAAyD;YAClE,MAAM,EACJ,0FAA0F;SAC7F,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/lib/bootstrap-kubernetes.d.ts

@@ -1,164 +0,0 @@
-/**
- * bootstrap-kubernetes.ts — k3s mode of `olam bootstrap`.
- *
- * Wraps the legacy `scripts/dogfood/up.sh` reference flow into a CLI
- * routine so external operators with only the published `@pleri/olam-cli`
- * tarball (no access to the private `pleri/olam` repo) can bring up an
- * end-to-end olam-on-k3s stack with one command.
- *
- * Steps (idempotent):
- *   0. Preflight — detect required tools (k3d, kubectl, helm, jq, curl,
- *      openssl, gh, docker). With --auto-install on macOS, run `brew
- *      install` for missing brew-formulae.
- *   1. Secrets — generate `~/.olam/{auth-secret,kg-bearer-token,
- *      auth-db-secret,mcp-auth-jwt-secret,memory-bearer-secret}` if absent.
- *   2. Container runtime (macOS only) — honour host.preferred_runtime;
- *      auto-detect otherwise (prefer an installed Docker Desktop over
- *      imposing Colima). For Docker Desktop: select the `desktop-linux`
- *      context + ensure the daemon is up. For Colima: ensure running +
- *      chmod /var/run/docker.sock inside the VM (virtiofs mitigation).
- *   3. k3d cluster — create `<cluster>` with the gh-config bind. Skipped
- *      if cluster already exists.
- *   4. Observability — chain bundled scripts in `<install>/host-cp/
- *      observability/` to install Loki + Promtail + Grafana +
- *      kube-prometheus-stack + Kyverno admission policy.
- *   5. Delegate to `olam upgrade -y` — that flow handles namespace + RBAC
- *      + secrets + ghcr-pull + host-side docker-socket-proxy +
- *      manifest apply + rollout + verify.
- *
- * Note: `olam upgrade` already ships the 8-step k8s flow in
- * `upgrade-kubernetes.ts` (Phase 1b C2 + Phase 2 C/D). This module is
- * the prereq + cluster-create + observability wrapper around it.
- */
-import type { PreferredRuntime } from "./config.js";
-export declare const DEFAULT_K3S_CLUSTER = "olam-host";
-export interface BootstrapKubernetesOptions {
-    readonly cluster: string;
-    readonly autoInstall: boolean;
-    readonly skipObservability: boolean;
-    readonly skipClusterCreate: boolean;
-    readonly forceObservability: boolean;
-    /**
-     * Skip the pre-pull phase (docker pull + k3d image import of the
-     * manifest-pinned ghcr.io/pleri/olam-* images). Default: false — pre-pull
-     * runs to warm the k3d node cache so pod rollouts don't cold-pull (which
-     * widens the doctor rollout-race window). Kubelet on-demand pull remains
-     * the fallback, so skipping is always safe.
-     */
-    readonly skipPrepull: boolean;
-    /**
-     * Streamlined-vs-full output toggle. Default false: each long-running phase
-     * shows a single live spinner line (latest output + elapsed) that settles to
-     * ok/warn/fail — full output is captured to ~/.olam/logs/. When true (or when
-     * stdout is not a TTY), all child output streams sequentially, no cosmetic
-     * in-place rewrites. Surfaced as the `--verbose` CLI flag.
-     */
-    readonly verbose: boolean;
-    /**
-     * DEPRECATED alias for `verbose`, retained for back-compat. ORed into
-     * `verbose` at normalisation time. Prefer `verbose`.
-     */
-    readonly verboseObservability: boolean;
-    /**
-     * DEV-ONLY: mount a local olam source checkout into the k3d node at
-     * /host/olam. See `RunSetupOptions.hostCpDevPath` for full rationale —
-     * regular operators leave this unset; the published image is
-     * self-contained.
-     */
-    readonly hostCpDevPath?: string;
-    /**
-     * macOS container runtime preference, threaded from
-     * `~/.olam/config.json host.preferred_runtime` (Phase 0 substrate
-     * picker). When set, it decides whether the k3d node runs on Docker
-     * Desktop or Colima. When undefined we auto-detect: an installed Docker
-     * Desktop is preferred over imposing Colima. Ignored on non-darwin.
-     */
-    readonly preferredRuntime?: PreferredRuntime;
-}
-export interface BootstrapKubernetesResult {
-    readonly exitCode: number;
-    readonly summary: string;
-}
-export interface LiveTaskResult {
-    readonly ok: boolean;
-    readonly exitCode: number | null;
-    readonly durationMs: number;
-    readonly logPath: string;
-}
-export interface LiveTaskOptions {
-    /** When true (or stdout is not a TTY), stream all output sequentially with no
-     *  in-place spinner rewrites. */
-    readonly verbose: boolean;
-    /** Environment for the child process. Defaults to process.env. */
-    readonly env?: NodeJS.ProcessEnv;
-    /** Basename (no extension) for the captured log under ~/.olam/logs/. */
-    readonly logName: string;
-    /**
-     * 'auto' (default): the spinner settles itself via succeed()/fail() on exit.
-     * 'manual': the spinner is stopped+cleared on exit and the CALLER prints the
-     * final status line (used by installObservability, which maps exit codes to
-     * nuanced ok/warn/error states like the loki scrub-wait flake).
-     */
-    readonly settle?: "auto" | "manual";
-}
-/**
- * Run a child process with live, single-line progress (default) or full
- * sequential streaming (verbose / non-TTY). Combined stdout+stderr is always
- * captured to `~/.olam/logs/<logName>.log` for post-hoc debugging regardless
- * of mode. Async (uses `spawn`) so the spinner can actually animate — the
- * legacy `spawnSync` path blocked the event loop and showed nothing for the
- * full 90-155s of each observability script.
- */
-export declare function runLiveTask(label: string, cmd: string, args: readonly string[], opts: LiveTaskOptions): Promise<LiveTaskResult>;
-/**
- * Decide which macOS container runtime to drive for the k3d node.
- *
- * Explicit operator preference (from `~/.olam/config.json
- * host.preferred_runtime`) always wins. When unset, prefer an installed
- * Docker Desktop over Colima — i.e. never impose a second Colima VM onto
- * a machine that already runs Docker Desktop. Pure function: the
- * detection result is injected so it stays unit-testable.
- */
-export declare function resolveMacRuntime(preferred: PreferredRuntime | undefined, dockerDesktopInstalled: boolean): PreferredRuntime;
-/**
- * Probe whether the component installed by `script` is already healthy.
- * Uses `spawnSync` with `stdio: 'pipe'` so output never leaks to the operator.
- * Returns false on any error or unexpected output — conservatively runs the
- * script when in doubt.
- */
-export declare function isObservabilityComponentReady(component: string): boolean;
-/**
- * Read the Grafana admin credentials from the cluster secret.
- * Returns null when the secret is absent or kubectl fails (bootstrap
- * may not have run observability yet).
- */
-export declare function getGrafanaCredentials(): {
-    user: string;
-    password: string;
-} | null;
-/**
- * Run a single observability bash script with live progress.
- *
- * Default mode shows a one-line spinner (latest output + elapsed) that the
- * CALLER settles (manual settle) so it can map exit codes to nuanced states
- * (e.g. the loki scrub-wait flake → warn, not fail). Verbose / non-TTY mode
- * streams all output sequentially. Combined output is always captured to
- * `~/.olam/logs/observability-<name>.log`.
- */
-export declare function runObservabilityScript(scriptPath: string, scriptName: string, env: NodeJS.ProcessEnv, verbose?: boolean): Promise<{
-    ok: boolean;
-    durationMs: number;
-    logPath: string;
-}>;
-/**
- * Parse the bundled deployment manifests and return the UNIQUE set of
- * `ghcr.io/pleri/olam-*@sha256:<digest>` image refs they pin. These are the
- * authoritative refs that actually get deployed (host-cp + plan-chat share one
- * host-cp digest → deduped to a single pull). Non-olam images (busybox init,
- * postgres, electric) are ignored.
- *
- * Pure function — no I/O beyond reading the passed-in files; unit-tested.
- */
-export declare function collectOlamImageRefs(manifestsRoot: string): string[];
-export declare function runBootstrapKubernetes(rawOpts: Partial<BootstrapKubernetesOptions>): Promise<BootstrapKubernetesResult>;
-//# sourceMappingURL=bootstrap-kubernetes.d.ts.map

package/dist/lib/bootstrap-kubernetes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"bootstrap-kubernetes.d.ts","sourceRoot":"","sources":["../../src/lib/bootstrap-kubernetes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AA0BH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAKpD,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAsC/C,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CAC9C;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAqDD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B;qCACiC;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,cAAc,CAAC,CAuFzB;AAwGD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,gBAAgB,GAAG,SAAS,EACvC,sBAAsB,EAAE,OAAO,GAC9B,gBAAgB,CAGlB;AA6OD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAqFxE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,CA0BP;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,OAAO,GAAE,OAAe,GACvB,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAS/D;AAsQD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAgBpE;AA6HD,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAC3C,OAAO,CAAC,yBAAyB,CAAC,CA2CpC"}