@pleri/olam-cli 0.1.201 → 0.1.205

package/dist/lib/bootstrap-kubernetes.js

@@ -1,1002 +0,0 @@
-/**
- * bootstrap-kubernetes.ts — k3s mode of `olam bootstrap`.
- *
- * Wraps the legacy `scripts/dogfood/up.sh` reference flow into a CLI
- * routine so external operators with only the published `@pleri/olam-cli`
- * tarball (no access to the private `pleri/olam` repo) can bring up an
- * end-to-end olam-on-k3s stack with one command.
- *
- * Steps (idempotent):
- *   0. Preflight — detect required tools (k3d, kubectl, helm, jq, curl,
- *      openssl, gh, docker). With --auto-install on macOS, run `brew
- *      install` for missing brew-formulae.
- *   1. Secrets — generate `~/.olam/{auth-secret,kg-bearer-token,
- *      auth-db-secret,mcp-auth-jwt-secret,memory-bearer-secret}` if absent.
- *   2. Container runtime (macOS only) — honour host.preferred_runtime;
- *      auto-detect otherwise (prefer an installed Docker Desktop over
- *      imposing Colima). For Docker Desktop: select the `desktop-linux`
- *      context + ensure the daemon is up. For Colima: ensure running +
- *      chmod /var/run/docker.sock inside the VM (virtiofs mitigation).
- *   3. k3d cluster — create `<cluster>` with the gh-config bind. Skipped
- *      if cluster already exists.
- *   4. Observability — chain bundled scripts in `<install>/host-cp/
- *      observability/` to install Loki + Promtail + Grafana +
- *      kube-prometheus-stack + Kyverno admission policy.
- *   5. Delegate to `olam upgrade -y` — that flow handles namespace + RBAC
- *      + secrets + ghcr-pull + host-side docker-socket-proxy +
- *      manifest apply + rollout + verify.
- *
- * Note: `olam upgrade` already ships the 8-step k8s flow in
- * `upgrade-kubernetes.ts` (Phase 1b C2 + Phase 2 C/D). This module is
- * the prereq + cluster-create + observability wrapper around it.
- */
-import { spawn, spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync, chmodSync, statSync, } from "node:fs";
-import { join } from "node:path";
-import { homedir, platform } from "node:os";
-import { randomBytes } from "node:crypto";
-import pc from "picocolors";
-import ora from "ora";
-import { printError, printSuccess, printInfo, printWarning, printHeader, } from "../output.js";
-import { installRoot } from "../install-root.js";
-import { resolveK8sAssetsRoot } from "./k8s-bootstrap.js";
-import { canonicalSecretPath, ensureSecretsDir } from "@olam/core/src/secrets/paths.js";
-const OLAM_HOME = join(homedir(), ".olam");
-export const DEFAULT_K3S_CLUSTER = "olam-host";
-const REQUIRED_TOOLS = [
-    { name: "k3d", brew: "k3d" },
-    { name: "kubectl", brew: "kubectl" },
-    { name: "helm", brew: "helm" },
-    { name: "jq", brew: "jq" },
-    {
-        name: "curl",
-        hint: "expected on macOS by default; `apt install curl` on linux",
-    },
-    {
-        name: "openssl",
-        hint: "expected on macOS by default; `apt install openssl` on linux",
-    },
-    { name: "gh", brew: "gh", hint: "after install: `gh auth login`" },
-    { name: "docker", hint: "Docker Desktop, or colima on macOS" },
-];
-const SECRET_FILES = [
-    "auth-secret",
-    "kg-bearer-token",
-    "auth-db-secret",
-    "mcp-auth-jwt-secret",
-    "memory-bearer-secret",
-];
-const OBSERVABILITY_SCRIPTS = [
-    "loki-ingest.sh",
-    "grafana-port-forward.sh",
-    "prom-no-double-grafana.sh",
-    "kyverno-cardinality-mutate.sh",
-];
-/** Wraps `command -v <tool>` returning true when the binary is on PATH. */
-function hasTool(tool) {
-    const result = spawnSync("command", ["-v", tool], {
-        shell: true,
-        stdio: "pipe",
-    });
-    return result.status === 0;
-}
-function detectMissingTools() {
-    return REQUIRED_TOOLS.filter((tool) => !hasTool(tool.name));
-}
-function runOrFail(cmd, args, description) {
-    const result = spawnSync(cmd, args, { stdio: "inherit" });
-    if (result.status !== 0) {
-        printError(`${description} failed (exit ${result.status ?? "signal"})`);
-        process.exit(result.status ?? 1);
-    }
-}
-function runCapture(cmd, args) {
-    const result = spawnSync(cmd, args, { encoding: "utf8" });
-    return {
-        ok: result.status === 0,
-        stdout: result.stdout ?? "",
-        stderr: result.stderr ?? "",
-    };
-}
-function step(label) {
-    process.stdout.write("\n" + pc.bold(pc.cyan(`==> ${label}`)) + "\n");
-}
-/** Truncate a single status line so the spinner never wraps the terminal. */
-function truncate(text, max) {
-    const clean = text.replace(/\s+/g, " ").trim();
-    return clean.length > max ? clean.slice(0, max - 1) + "…" : clean;
-}
-/**
- * Run a child process with live, single-line progress (default) or full
- * sequential streaming (verbose / non-TTY). Combined stdout+stderr is always
- * captured to `~/.olam/logs/<logName>.log` for post-hoc debugging regardless
- * of mode. Async (uses `spawn`) so the spinner can actually animate — the
- * legacy `spawnSync` path blocked the event loop and showed nothing for the
- * full 90-155s of each observability script.
- */
-export function runLiveTask(label, cmd, args, opts) {
-    const logDir = join(homedir(), ".olam", "logs");
-    mkdirSync(logDir, { recursive: true });
-    const logPath = join(logDir, `${opts.logName}.log`);
-    const startMs = Date.now();
-    const settle = opts.settle ?? "auto";
-    const useSpinner = !opts.verbose && Boolean(process.stdout.isTTY);
-    return new Promise((resolve) => {
-        const child = spawn(cmd, [...args], {
-            env: opts.env ?? process.env,
-            stdio: ["ignore", "pipe", "pipe"],
-        });
-        const chunks = [];
-        let latestLine = "";
-        let outBuf = "";
-        let errBuf = "";
-        const spinner = useSpinner ? ora({ text: label }).start() : null;
-        const elapsed = () => ((Date.now() - startMs) / 1000).toFixed(0);
-        const render = () => {
-            if (!spinner)
-                return;
-            const suffix = latestLine ? ` ${pc.dim("·")} ${truncate(latestLine, 60)}` : "";
-            spinner.text = `${label}${suffix} ${pc.dim(`(${elapsed()}s)`)}`;
-        };
-        const ticker = spinner ? setInterval(render, 1000) : null;
-        if (ticker && typeof ticker.unref === "function")
-            ticker.unref();
-        const onData = (buf, which) => {
-            const text = buf.toString("utf-8");
-            chunks.push(text);
-            const acc = (which === "out" ? outBuf : errBuf) + text;
-            const lines = acc.split("\n");
-            const remainder = lines.pop() ?? "";
-            if (which === "out")
-                outBuf = remainder;
-            else
-                errBuf = remainder;
-            for (const raw of lines) {
-                const line = raw.replace(/\s+$/, "");
-                if (line.length === 0)
-                    continue;
-                if (spinner) {
-                    latestLine = line;
-                    render();
-                }
-                else if (opts.verbose) {
-                    process.stdout.write(`  ${pc.dim(`[${label}]`)} ${line}\n`);
-                }
-            }
-        };
-        child.stdout?.on("data", (b) => onData(b, "out"));
-        child.stderr?.on("data", (b) => onData(b, "err"));
-        const finalize = (code) => {
-            if (ticker)
-                clearInterval(ticker);
-            const durationMs = Date.now() - startMs;
-            writeFileSync(logPath, chunks.join(""), "utf-8");
-            const ok = code === 0;
-            const secs = `${(durationMs / 1000).toFixed(1)}s`;
-            if (spinner) {
-                if (settle === "auto") {
-                    if (ok)
-                        spinner.succeed(`${label} ${pc.dim(`(${secs})`)}`);
-                    else
-                        spinner.fail(`${label} — failed (${secs}) — log=${logPath}`);
-                }
-                else {
-                    // Caller owns the final line; clear the transient progress line.
-                    spinner.stop();
-                }
-            }
-            else if (settle === "auto") {
-                // No spinner (verbose or non-TTY): the live line never rendered, so emit
-                // a plain terminal status line. Manual-settle callers print their own.
-                if (ok) {
-                    process.stdout.write(`${pc.green("ok")} ${label} ${pc.dim(`(${secs})`)}\n`);
-                }
-                else {
-                    process.stderr.write(`${pc.red("error")} ${label} — failed (${secs}) — log=${logPath}\n`);
-                }
-            }
-            resolve({ ok, exitCode: code, durationMs, logPath });
-        };
-        child.on("error", (err) => {
-            chunks.push(`\n[spawn error] ${err.message}\n`);
-            finalize(-1);
-        });
-        child.on("close", (code) => finalize(code));
-    });
-}
-function preflight(opts) {
-    step("0/7 — preflight (tool detection)");
-    const missing = detectMissingTools();
-    if (missing.length === 0) {
-        printSuccess("all required tools present");
-    }
-    else if (opts.autoInstall && platform() === "darwin") {
-        const brewable = missing.filter((t) => t.brew);
-        if (brewable.length > 0) {
-            printInfo("auto-install", `${brewable.length} brew formula(s): ${brewable.map((t) => t.brew).join(", ")}`);
-            runOrFail("brew", ["install", ...brewable.map((t) => t.brew)], "brew install");
-        }
-        const stillMissing = detectMissingTools();
-        if (stillMissing.length > 0) {
-            printError("tools still missing after auto-install:");
-            for (const t of stillMissing) {
-                process.stderr.write(`  - ${t.name}${t.hint ? ` — ${t.hint}` : ""}\n`);
-            }
-            process.exit(1);
-        }
-        printSuccess("all required tools present after auto-install");
-    }
-    else {
-        printError(`${missing.length} required tool(s) missing:`);
-        for (const t of missing) {
-            const hint = t.brew
-                ? `brew install ${t.brew}`
-                : (t.hint ?? "(install manually)");
-            process.stderr.write(`  - ${pc.bold(t.name)}: ${hint}\n`);
-        }
-        process.stderr.write("\nRe-run with --auto-install on macOS to install brew-formulae automatically.\n");
-        process.exit(1);
-    }
-    // gh auth — honour env-var auth (GH_TOKEN / GITHUB_TOKEN). `gh auth status`
-    // exits non-zero when auth comes from env even though the user IS authenticated
-    // (gh prints "✓ Logged in (GH_TOKEN)" but returns exit code 1 because no
-    // gh-managed credential is stored). Don't fail bootstrap on that case —
-    // exercise the token directly via `gh api user` which actually validates it.
-    const authStatus = runCapture("gh", ["auth", "status"]);
-    const ghTokenSet = !!(process.env.GH_TOKEN || process.env.GITHUB_TOKEN);
-    if (!authStatus.ok && !ghTokenSet) {
-        printError("gh is not authenticated — run: gh auth login");
-        process.exit(1);
-    }
-    if (!authStatus.ok && ghTokenSet) {
-        // Env-var token present but gh auth status non-zero. Validate by hitting
-        // the API. If that fails too, the token is bad/expired.
-        if (!runCapture("gh", ["api", "user", "--jq", ".login"]).ok) {
-            printError("GH_TOKEN/GITHUB_TOKEN set but invalid — `gh api user` failed");
-            process.exit(1);
-        }
-    }
-    printSuccess("gh authenticated");
-    // docker reachability. On macOS the runtime (Docker Desktop / Colima)
-    // may not be started yet — ensureContainerRuntime (step 2/7) brings it
-    // up, so a cold daemon here is only a warning. On Linux the operator
-    // owns the daemon, so an unreachable daemon stays a hard failure.
-    if (!runCapture("docker", ["info"]).ok) {
-        if (platform() === "darwin") {
-            printWarning("docker daemon not reachable yet — starting the container runtime next");
-        }
-        else {
-            printError("docker daemon unreachable — start Docker Desktop or colima");
-            process.exit(1);
-        }
-    }
-    else {
-        printSuccess("docker daemon reachable");
-    }
-}
-function ensureSecrets() {
-    step("1/7 — operator secrets");
-    mkdirSync(OLAM_HOME, { recursive: true });
-    ensureSecretsDir();
-    for (const name of SECRET_FILES) {
-        // Write to canonical new location (~/.olam/secrets/<name>).
-        const newPath = canonicalSecretPath(name);
-        // Legacy path — if it already exists there, skip (migration handles move).
-        const legacyPath = join(OLAM_HOME, name);
-        if (existsSync(newPath) || existsSync(legacyPath)) {
-            printInfo("skip", `~/.olam/secrets/${name} already exists`);
-            continue;
-        }
-        const hex = randomBytes(32).toString("hex");
-        writeFileSync(newPath, hex + "\n", { encoding: "utf8", mode: 0o600 });
-        chmodSync(newPath, 0o600);
-        printSuccess(`generated ~/.olam/secrets/${name}`);
-    }
-}
-/**
- * Decide which macOS container runtime to drive for the k3d node.
- *
- * Explicit operator preference (from `~/.olam/config.json
- * host.preferred_runtime`) always wins. When unset, prefer an installed
- * Docker Desktop over Colima — i.e. never impose a second Colima VM onto
- * a machine that already runs Docker Desktop. Pure function: the
- * detection result is injected so it stays unit-testable.
- */
-export function resolveMacRuntime(preferred, dockerDesktopInstalled) {
-    if (preferred)
-        return preferred;
-    return dockerDesktopInstalled ? "docker-desktop" : "colima";
-}
-/** True when the Docker Desktop app bundle is present on this Mac. */
-function isDockerDesktopInstalled() {
-    return existsSync("/Applications/Docker.app");
-}
-/** True when the active docker context has a reachable daemon. */
-function dockerDaemonReachable() {
-    return runCapture("docker", ["info"]).ok;
-}
-/**
- * macOS container-runtime bring-up (step 2/7). Honours
- * `opts.preferredRuntime`; auto-detects Docker Desktop otherwise. k3d
- * runs its k3s node on whichever daemon the *active docker context*
- * points at, so this both selects the runtime and points the context at
- * it before `k3d cluster create`. No-op on non-darwin (Linux operators
- * manage their own daemon).
- */
-function ensureContainerRuntime(opts) {
-    if (platform() !== "darwin")
-        return;
-    const runtime = resolveMacRuntime(opts.preferredRuntime, isDockerDesktopInstalled());
-    if (runtime === "external-k8s") {
-        step("2/7 — container runtime (external-k8s)");
-        printInfo("runtime", "preferred_runtime=external-k8s — not managing Docker Desktop/Colima");
-        return;
-    }
-    if (runtime === "docker-desktop") {
-        ensureDockerDesktop();
-        return;
-    }
-    ensureColima();
-}
-/**
- * Ensure Docker Desktop is the active docker context and its daemon is
- * up. Starts the app (`open -a Docker`) and polls `docker info` for up to
- * ~90s when the daemon isn't ready yet. Used instead of Colima whenever
- * Docker Desktop is the resolved runtime.
- */
-function ensureDockerDesktop() {
-    step("2/7 — Docker Desktop (macOS)");
-    // Point the docker CLI at Docker Desktop's daemon. `desktop-linux` is
-    // Docker Desktop's macOS context name; k3d reads the active context to
-    // choose where the k3s node container runs. Non-fatal if the context is
-    // already current or named differently on exotic installs.
-    if (runCapture("docker", ["context", "use", "desktop-linux"]).ok) {
-        printSuccess("docker context → desktop-linux");
-    }
-    else {
-        printWarning("could not select the 'desktop-linux' docker context — using the current context");
-    }
-    if (dockerDaemonReachable()) {
-        printSuccess("Docker Desktop daemon reachable");
-        return;
-    }
-    printWarning("Docker Desktop not running — starting (open -a Docker)");
-    runCapture("open", ["-a", "Docker"]);
-    for (let waited = 0; waited < 90; waited += 3) {
-        spawnSync("sleep", ["3"]);
-        if (dockerDaemonReachable()) {
-            printSuccess(`Docker Desktop daemon reachable (after ~${waited + 3}s)`);
-            return;
-        }
-    }
-    printError("Docker Desktop did not become ready within 90s — start it manually and re-run `olam bootstrap`");
-    process.exit(1);
-}
-function ensureColima() {
-    if (platform() !== "darwin")
-        return;
-    step("2/7 — colima (macOS)");
-    if (!runCapture("colima", ["status"]).ok) {
-        printWarning("colima not running — starting");
-        runOrFail("colima", [
-            "start",
-            "--cpu",
-            "4",
-            "--memory",
-            "8",
-            "--vm-type=vz",
-            "--mount-type=virtiofs",
-        ], "colima start");
-    }
-    printSuccess("colima running");
-    // virtiofs blocks chmod of docker.sock from the macOS side. Idempotent + non-fatal.
-    const chmod = runCapture("colima", [
-        "ssh",
-        "--",
-        "sudo",
-        "chmod",
-        "666",
-        "/var/run/docker.sock",
-    ]);
-    if (chmod.ok) {
-        printSuccess("docker.sock chmod applied inside colima VM");
-    }
-    else {
-        printWarning("colima ssh chmod failed — k3d cluster create may still succeed");
-    }
-}
-function ensureCluster(opts) {
-    if (opts.skipClusterCreate) {
-        step("3/7 — cluster (skipped via --skip-cluster-create)");
-        return;
-    }
-    step(`3/7 — k3d cluster create (${opts.cluster})`);
-    if (runCapture("k3d", ["cluster", "list", opts.cluster]).ok) {
-        printInfo("cluster", `'${opts.cluster}' already exists`);
-        return;
-    }
-    // host-cp's deployment has two hostPath mounts:
-    //   /host/.config/gh   ← gh CLI config (optional; bound when present)
-    //   /host/olam         ← operator's olam source (DEV ONLY via --host-cp-dev-path)
-    // Published-CLI consumers have no olam checkout; the operator-repo mount
-    // is left absent + DirectoryOrCreate handles it gracefully in-cluster.
-    const volumes = [];
-    const ghConfigDir = `${homedir()}/.config/gh`;
-    if (existsSync(ghConfigDir)) {
-        volumes.push("--volume", `${ghConfigDir}:/host/.config/gh`);
-    }
-    else {
-        printInfo("cluster", `${ghConfigDir} not found; skipping gh-config bind (run \`gh auth login\` to enable)`);
-    }
-    if (opts.hostCpDevPath) {
-        if (!existsSync(opts.hostCpDevPath)) {
-            printError(`--host-cp-dev-path ${opts.hostCpDevPath} does not exist`);
-            process.exit(1);
-        }
-        volumes.push("--volume", `${opts.hostCpDevPath}:/host/olam`);
-        printInfo("cluster", `dev-mode: mounting ${opts.hostCpDevPath} → /host/olam`);
-    }
-    runOrFail("k3d", [
-        "cluster",
-        "create",
-        opts.cluster,
-        ...volumes,
-        "--wait",
-        "--timeout",
-        "90s",
-    ], `k3d cluster create ${opts.cluster}`);
-    if (!runCapture("kubectl", ["cluster-info"]).ok) {
-        printError("kubectl cannot reach the cluster — check kubeconfig context");
-        process.exit(1);
-    }
-    printSuccess(`cluster ready (${runCapture("kubectl", ["config", "current-context"]).stdout.trim()})`);
-}
-/** Resolve the bundled observability scripts dir. */
-function resolveObservabilityScriptsDir() {
-    // Install-mode: bundle-host-cp.mjs copies scripts/e2e/*.sh to
-    // <install-root>/host-cp/observability/.
-    const installed = join(installRoot(), "host-cp", "observability");
-    if (existsSync(installed))
-        return installed;
-    // Dev-mode fallback: resolve via the k8s assets root + walk up to repo
-    // root then into scripts/e2e/. Works when running against the monorepo.
-    const k8sRoot = resolveK8sAssetsRoot();
-    if (k8sRoot) {
-        const dev = join(k8sRoot, "..", "..", "..", "scripts", "e2e");
-        if (existsSync(dev))
-            return dev;
-    }
-    return null;
-}
-/**
- * Resolve the bundled peripheral-services dir (helm-values + manifests).
- * Returns null when neither install-mode nor dev-mode layout matches.
- */
-function resolvePeripheralServicesDir() {
-    // Install-mode: bundle-host-cp.mjs copies packages/peripheral-services/
-    // {helm-values,manifests} to <install-root>/host-cp/peripheral-services/.
-    const installed = join(installRoot(), "host-cp", "peripheral-services");
-    if (existsSync(installed))
-        return installed;
-    // Dev-mode fallback: walk up from k8s assets root to packages/peripheral-services.
-    const k8sRoot = resolveK8sAssetsRoot();
-    if (k8sRoot) {
-        const dev = join(k8sRoot, "..", "..", "peripheral-services");
-        if (existsSync(dev))
-            return dev;
-    }
-    return null;
-}
-/**
- * Resolve OLAM_BUNDLE_ROOT — the dir the observability scripts read to find
- * `peripheral-services/{helm-values,manifests}/...`. In install-mode this is
- * `<install>/host-cp`; in dev-mode it's the monorepo's `packages/` dir.
- */
-function resolveBundleRoot() {
-    const installed = join(installRoot(), "host-cp");
-    if (existsSync(join(installed, "peripheral-services")))
-        return installed;
-    const k8sRoot = resolveK8sAssetsRoot();
-    if (k8sRoot) {
-        const dev = join(k8sRoot, "..", "..");
-        if (existsSync(join(dev, "peripheral-services")))
-            return dev;
-    }
-    return null;
-}
-/**
- * Probe whether the component installed by `script` is already healthy.
- * Uses `spawnSync` with `stdio: 'pipe'` so output never leaks to the operator.
- * Returns false on any error or unexpected output — conservatively runs the
- * script when in doubt.
- */
-export function isObservabilityComponentReady(component) {
-    /** Silent kubectl probe — returns trimmed stdout or empty string on failure. */
-    function kget(args) {
-        const r = spawnSync("kubectl", [...args], {
-            encoding: "utf-8",
-            stdio: "pipe",
-        });
-        if (r.status !== 0)
-            return "";
-        return (r.stdout ?? "").trim();
-    }
-    switch (component) {
-        case "kyverno-cardinality-mutate": {
-            // ClusterPolicy doesn't expose `.status.ready` as a flat field — the real
-            // shape is `.status.conditions[?(@.type=="Ready")].status == "True"`.
-            // The previous flat probe always returned empty → script re-ran every
-            // boot. Caught during live verification on 2026-05-28.
-            const policyReady = kget([
-                "get", "clusterpolicy", "enforce-cardinality-labeldrop",
-                "-o", `jsonpath={.status.conditions[?(@.type=="Ready")].status}`,
-            ]);
-            const admissionReplicas = parseInt(kget([
-                "get", "deploy", "-n", "kyverno", "kyverno-admission-controller",
-                "-o", "jsonpath={.status.readyReplicas}",
-            ]) || "0", 10);
-            return policyReady === "True" && admissionReplicas >= 1;
-        }
-        case "prom-no-double-grafana": {
-            const grafanaReplicas = parseInt(kget([
-                "-n", "monitoring", "get", "deploy", "olam-grafana",
-                "-o", "jsonpath={.status.readyReplicas}",
-            ]) || "0", 10);
-            const promReplicas = parseInt(kget([
-                "-n", "monitoring", "get", "sts",
-                "prometheus-olam-prom-kube-prometheus-prometheus",
-                "-o", "jsonpath={.status.readyReplicas}",
-            ]) || "0", 10);
-            return grafanaReplicas >= 1 && promReplicas >= 1;
-        }
-        case "loki-ingest": {
-            const lokiReplicas = parseInt(kget([
-                "-n", "monitoring", "get", "sts", "olam-loki",
-                "-o", "jsonpath={.status.readyReplicas}",
-            ]) || "0", 10);
-            const promtailReady = parseInt(kget([
-                "-n", "monitoring", "get", "ds", "olam-promtail",
-                "-o", "jsonpath={.status.numberReady}",
-            ]) || "0", 10);
-            return lokiReplicas >= 1 && promtailReady >= 1;
-        }
-        case "grafana-port-forward": {
-            // Probe: Grafana deploy has >= 1 ready replica AND the olam-dashboards
-            // ConfigMap exists (created by this script). When both are true the
-            // chart + dashboards are already installed; skip the re-run.
-            const grafanaReplicas = parseInt(kget([
-                "-n", "monitoring", "get", "deploy", "olam-grafana",
-                "-o", "jsonpath={.status.readyReplicas}",
-            ]) || "0", 10);
-            const dashboardsCm = kget([
-                "-n", "monitoring", "get", "cm", "olam-dashboards",
-                "-o", "name",
-            ]);
-            return grafanaReplicas >= 1 && dashboardsCm.trim().length > 0;
-        }
-        default:
-            return false;
-    }
-}
-/**
- * Read the Grafana admin credentials from the cluster secret.
- * Returns null when the secret is absent or kubectl fails (bootstrap
- * may not have run observability yet).
- */
-export function getGrafanaCredentials() {
-    function getSecretKey(key) {
-        const r = spawnSync("kubectl", [
-            "-n", "monitoring", "get", "secret", "olam-grafana-admin",
-            "-o", `jsonpath={.data.${key}}`,
-        ], { encoding: "utf-8", stdio: "pipe" });
-        if (r.status !== 0)
-            return "";
-        return (r.stdout ?? "").trim();
-    }
-    const rawUser = getSecretKey("admin-user");
-    const rawPassword = getSecretKey("admin-password");
-    if (!rawUser || !rawPassword)
-        return null;
-    try {
-        const user = Buffer.from(rawUser, "base64").toString("utf-8");
-        const password = Buffer.from(rawPassword, "base64").toString("utf-8");
-        if (!user || !password)
-            return null;
-        return { user, password };
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Run a single observability bash script with live progress.
- *
- * Default mode shows a one-line spinner (latest output + elapsed) that the
- * CALLER settles (manual settle) so it can map exit codes to nuanced states
- * (e.g. the loki scrub-wait flake → warn, not fail). Verbose / non-TTY mode
- * streams all output sequentially. Combined output is always captured to
- * `~/.olam/logs/observability-<name>.log`.
- */
-export async function runObservabilityScript(scriptPath, scriptName, env, verbose = false) {
-    const baseName = scriptName.replace(/\.sh$/, "");
-    const res = await runLiveTask(baseName, "bash", [scriptPath], {
-        verbose,
-        env,
-        logName: `observability-${baseName}`,
-        settle: "manual",
-    });
-    return { ok: res.ok, durationMs: res.durationMs, logPath: res.logPath };
-}
-async function installObservability(opts) {
-    if (opts.skipObservability) {
-        step("4/7 — observability (skipped via --skip-observability)");
-        return;
-    }
-    step("4/7 — observability");
-    const observabilityDir = resolveObservabilityScriptsDir();
-    if (!observabilityDir) {
-        throw new Error(`Bundled observability assets missing. ` +
-            `This indicates a corrupt or incomplete @pleri/olam-cli installation. ` +
-            `Remediation: reinstall with 'npm install -g @pleri/olam-cli@latest', ` +
-            `or open an issue at https://github.com/pleri/olam/issues with this error.`);
-    }
-    // Export OLAM_BUNDLE_ROOT so the scripts resolve helm-values/manifests from
-    // the published tarball instead of `git rev-parse` (which fails outside the
-    // monorepo). resolveBundleRoot returns null only in degenerate dev contexts;
-    // the scripts handle absence by falling back to git.
-    const bundleRoot = resolveBundleRoot();
-    const scriptEnv = { ...process.env };
-    if (bundleRoot) {
-        scriptEnv.OLAM_BUNDLE_ROOT = bundleRoot;
-    }
-    const outcomes = [];
-    for (const script of OBSERVABILITY_SCRIPTS) {
-        const path = join(observabilityDir, script);
-        if (!existsSync(path)) {
-            outcomes.push({ script, state: "missing" });
-            continue;
-        }
-        if (!opts.forceObservability) {
-            const component = script.replace(/\.sh$/, "");
-            if (isObservabilityComponentReady(component)) {
-                outcomes.push({ script, state: "skipped" });
-                continue;
-            }
-        }
-        const runResult = await runObservabilityScript(path, script, scriptEnv, opts.verbose);
-        if (runResult.ok) {
-            outcomes.push({
-                script,
-                state: "ran",
-                durationMs: runResult.durationMs,
-                logPath: runResult.logPath,
-            });
-        }
-        else if (script === "loki-ingest.sh") {
-            outcomes.push({
-                script,
-                state: "loki-flake",
-                durationMs: runResult.durationMs,
-                logPath: runResult.logPath,
-            });
-        }
-        else {
-            outcomes.push({
-                script,
-                state: "ran-failed",
-                durationMs: runResult.durationMs,
-                logPath: runResult.logPath,
-            });
-        }
-    }
-    // Compact name: strip the .sh suffix and the cardinality-mutate suffix that
-    // serves no informational purpose at this level.
-    const niceName = (script) => script.replace(/\.sh$/, "").replace(/-cardinality-mutate$/, "");
-    // All-installed fast path: one line instead of four. Trims the most common
-    // case (operator re-runs setup on a healthy cluster) to a single line.
-    const allSkipped = outcomes.length > 0 && outcomes.every((o) => o.state === "skipped");
-    if (allSkipped) {
-        printSuccess(`all ${outcomes.length} already installed (--force-observability to reinstall)`);
-        return;
-    }
-    for (const o of outcomes) {
-        const name = niceName(o.script);
-        const seconds = o.durationMs !== undefined
-            ? `${(o.durationMs / 1000).toFixed(1)}s`
-            : "";
-        switch (o.state) {
-            case "missing":
-                printWarning(`${name}: script not found — skipping`);
-                break;
-            case "skipped":
-                printSuccess(`${name}: already installed`);
-                break;
-            case "ran":
-                printSuccess(`${name}: ${seconds}`);
-                break;
-            case "loki-flake":
-                printWarning(`${name}: ${seconds} (promtail scrub-wait flake; continuing)`);
-                break;
-            case "ran-failed": {
-                printError(`${name}: failed (${seconds}) — log=${o.logPath}`);
-                if (o.logPath !== undefined) {
-                    const tail = readFileSync(o.logPath, "utf-8")
-                        .split("\n")
-                        .slice(-20)
-                        .join("\n");
-                    process.stderr.write(`  --- last 20 lines from ${o.script} ---\n${tail}\n`);
-                }
-                process.exit(1);
-            }
-        }
-    }
-}
-/**
- * Step 5: Apply the peripheral-services manifest tree (IngressRoutes,
- * NetworkPolicies, ServiceMonitors, recording rules, Grafana dashboard
- * ConfigMaps, Kyverno ClusterPolicy). These are NOT covered by `olam
- * upgrade`'s host-cp manifest apply — without this step, the observability
- * stack runs but has no scrape targets and no dashboards.
- */
-function applyPeripheralServicesManifests() {
-    step("5/7 — peripheral-services manifests (IngressRoutes + ServiceMonitors + recording rules + dashboards + Kyverno)");
-    const dir = resolvePeripheralServicesDir();
-    if (!dir) {
-        printWarning("bundled peripheral-services manifests not found — skipping");
-        return;
-    }
-    const manifestsDir = join(dir, "manifests");
-    if (!existsSync(manifestsDir)) {
-        printWarning(`peripheral-services/manifests not found at ${manifestsDir} — skipping`);
-        return;
-    }
-    // Skip deployment manifests (files matching *deploy*.yaml): these overlap with the
-    // canonical deployment specs applied by `olam upgrade` step 3 (k8s/manifests/<svc>/50-deployment.yaml).
-    // Applying them here causes a rolling update when upgrade re-applies with a different image
-    // digest, making `kubectl rollout status` fail while the old pod is Terminating.
-    // Standalone operators can still apply deployment manifests manually if needed.
-    const manifestFiles = readdirSync(manifestsDir)
-        .filter((f) => (f.endsWith(".yaml") || f.endsWith(".yml")) && !/deploy/i.test(f))
-        .map((f) => join(manifestsDir, f));
-    if (manifestFiles.length === 0) {
-        printWarning("no non-deployment peripheral-services manifests found — skipping");
-        return;
-    }
-    // Capture kubectl apply output for each manifest; count unchanged vs changed.
-    // On a healthy re-run every resource reports "unchanged" — no per-manifest spam.
-    // Verbose output is written to ~/.olam/logs/peripheral-services-apply.log.
-    const logDir = join(homedir(), ".olam", "logs");
-    mkdirSync(logDir, { recursive: true });
-    const logPath = join(logDir, "peripheral-services-apply.log");
-    const logLines = [];
-    let unchangedCount = 0;
-    let changedCount = 0;
-    for (const manifest of manifestFiles) {
-        const r = spawnSync("kubectl", ["apply", "-f", manifest], {
-            stdio: "pipe",
-            encoding: "utf-8",
-        });
-        const combined = (r.stdout ?? "") + (r.stderr ?? "");
-        logLines.push(`==> ${manifest}\n${combined}`);
-        if (r.status !== 0) {
-            // Write the full log before aborting so the operator can diagnose.
-            writeFileSync(logPath, logLines.join("\n"), "utf-8");
-            printError(`kubectl apply failed for ${manifest.replace(manifestsDir + "/", "")} — see ${logPath}`);
-            process.stderr.write(`  --- last lines ---\n${combined.split("\n").slice(-10).join("\n")}\n`);
-            process.exit(r.status ?? 1);
-        }
-        // Count resources by whether kubectl reported "unchanged" or "configured"/"created".
-        const lines = combined.split("\n").filter((l) => l.trim().length > 0);
-        for (const line of lines) {
-            if (/unchanged$/.test(line.trim())) {
-                unchangedCount++;
-            }
-            else if (/configured$|created$/.test(line.trim())) {
-                changedCount++;
-            }
-        }
-    }
-    writeFileSync(logPath, logLines.join("\n"), "utf-8");
-    // Compact: "12 manifests — no-op" or "12 manifests — 3 changed"
-    const summary = changedCount > 0
-        ? `${manifestFiles.length} manifests — ${changedCount} changed`
-        : `${manifestFiles.length} manifests — no-op`;
-    printSuccess(`peripheral-services: ${summary}`);
-}
-/**
- * Recursively collect deployment manifest files (`50-deployment.yaml`) under
- * `manifestsRoot`, including the top-level host-cp one and every peripheral
- * subdir.
- */
-function findDeploymentManifests(manifestsRoot) {
-    const out = [];
-    const walk = (dir) => {
-        let names;
-        try {
-            names = readdirSync(dir);
-        }
-        catch {
-            return;
-        }
-        for (const name of names) {
-            const full = join(dir, name);
-            let isDir = false;
-            try {
-                isDir = statSync(full).isDirectory();
-            }
-            catch {
-                continue;
-            }
-            if (isDir) {
-                walk(full);
-            }
-            else if (/^50-deployment\.ya?ml$/.test(name)) {
-                out.push(full);
-            }
-        }
-    };
-    walk(manifestsRoot);
-    return out;
-}
-/**
- * Parse the bundled deployment manifests and return the UNIQUE set of
- * `ghcr.io/pleri/olam-*@sha256:<digest>` image refs they pin. These are the
- * authoritative refs that actually get deployed (host-cp + plan-chat share one
- * host-cp digest → deduped to a single pull). Non-olam images (busybox init,
- * postgres, electric) are ignored.
- *
- * Pure function — no I/O beyond reading the passed-in files; unit-tested.
- */
-export function collectOlamImageRefs(manifestsRoot) {
-    const refRe = /image:\s*(ghcr\.io\/pleri\/olam-[a-z0-9-]+@sha256:[a-f0-9]{64})/g;
-    const seen = new Set();
-    for (const file of findDeploymentManifests(manifestsRoot)) {
-        let raw;
-        try {
-            raw = readFileSync(file, "utf-8");
-        }
-        catch {
-            continue;
-        }
-        for (const m of raw.matchAll(refRe)) {
-            const ref = m[1];
-            if (ref)
-                seen.add(ref);
-        }
-    }
-    return [...seen].sort();
-}
-/**
- * Step 6/7: pre-pull the manifest-pinned olam-* images and import them into the
- * k3d node's containerd. Warms the cache so pod rollouts in step 7 don't
- * cold-pull — which is what widened the rollout-race window that surfaced as
- * "image not detected" / "pod not ready" in `olam doctor`. Best-effort:
- * per-image failures warn + continue (kubelet on-demand pull is the fallback).
- */
-async function prepullImages(opts) {
-    if (opts.skipPrepull) {
-        step("6/7 — pre-pull olam images (skipped via --skip-prepull)");
-        return;
-    }
-    step("6/7 — pre-pull olam images (docker pull + k3d image import)");
-    const k8sRoot = resolveK8sAssetsRoot();
-    const manifestsRoot = k8sRoot ? join(k8sRoot, "manifests") : null;
-    if (!manifestsRoot || !existsSync(manifestsRoot)) {
-        printWarning("bundled manifests not found — skipping pre-pull (pods will cold-pull on demand)");
-        return;
-    }
-    const refs = collectOlamImageRefs(manifestsRoot);
-    if (refs.length === 0) {
-        printWarning("no ghcr.io/pleri/olam-* image refs found in manifests — skipping");
-        return;
-    }
-    printInfo("pre-pull", `${refs.length} unique olam image(s) → node '${opts.cluster}'`);
-    for (const ref of refs) {
-        const short = ref.replace(/^ghcr\.io\/pleri\//, "").replace(/@sha256:.*/, "");
-        const pull = await runLiveTask(`pull ${short}`, "docker", ["pull", ref], {
-            verbose: opts.verbose,
-            logName: `prepull-${short}`,
-        });
-        if (!pull.ok) {
-            printWarning(`${short}: docker pull failed — pod will cold-pull on demand (log=${pull.logPath})`);
-            continue;
-        }
-        const imp = await runLiveTask(`import ${short}`, "k3d", ["image", "import", ref, "-c", opts.cluster], { verbose: opts.verbose, logName: `prepull-import-${short}` });
-        if (!imp.ok) {
-            printWarning(`${short}: k3d image import failed — pod will cold-pull on demand (log=${imp.logPath})`);
-        }
-    }
-}
-async function delegateToUpgrade(opts) {
-    step("7/7 — apply host-cp + peripherals + rollout (olam upgrade)");
-    // Re-invoke `olam upgrade -y` via the same process binary. The upgrade
-    // flow's 8-step k8s path (upgrade-kubernetes.ts) handles namespace +
-    // RBAC + Secrets + ghcr-pull + host-side docker-socket-proxy + manifest
-    // apply + rollout status + port-forward + /health verify + audit log.
-    const olamBin = process.argv[1] ?? "olam";
-    // Verbose: stream the full upgrade output inline (its own ora spinners + logs
-    // are most useful raw when debugging). Default: collapse to one live line and
-    // capture everything to ~/.olam/logs/bootstrap-upgrade.log.
-    if (opts.verbose) {
-        const result = spawnSync(process.execPath, [olamBin, "upgrade", "-y"], {
-            stdio: "inherit",
-        });
-        if (result.status !== 0) {
-            printError("olam upgrade failed — see output above");
-            process.exit(result.status ?? 1);
-        }
-        return;
-    }
-    const res = await runLiveTask("olam upgrade", process.execPath, [olamBin, "upgrade", "-y"], { verbose: false, logName: "bootstrap-upgrade", settle: "auto" });
-    if (!res.ok) {
-        printError(`olam upgrade failed (exit ${res.exitCode}) — see ${res.logPath}`);
-        const tail = readFileSync(res.logPath, "utf-8")
-            .split("\n")
-            .slice(-30)
-            .join("\n");
-        process.stderr.write(`  --- last 30 lines from olam upgrade ---\n${tail}\n`);
-        process.exit(res.exitCode ?? 1);
-    }
-}
-function summary(opts) {
-    step("done");
-    const grafanaCreds = getGrafanaCredentials();
-    const grafanaCredsBlock = grafanaCreds
-        ? `    User:     ${grafanaCreds.user}\n    Password: ${grafanaCreds.password}`
-        : `    # Get password: kubectl -n monitoring get secret olam-grafana-admin \\
-    #   -o jsonpath='{.data.admin-password}' | base64 -d`;
-    process.stdout.write(`
-  Cluster:    ${opts.cluster}
-  Next steps:
-    olam doctor                       # verify the stack
-    olam services status              # peripherals 1/1
-    kubectl get pods -n olam
-
-  Grafana:
-    URL:          http://localhost:3000  (after the port-forward below)
-${grafanaCredsBlock}
-    Port-forward: kubectl port-forward -n monitoring svc/olam-grafana 3000:80
-
-  Prometheus:
-    URL:          http://localhost:9090  (after the port-forward below)
-    Port-forward: kubectl port-forward -n monitoring svc/olam-prom-kube-prometheus-prometheus 9090:9090
-`);
-}
-export async function runBootstrapKubernetes(rawOpts) {
-    // Default auto-install ON for macOS. The wizard contract is "fresh
-    // machine → working cluster in one command", which requires installing
-    // missing brew formulae without operator intervention. Linux operators
-    // see a per-tool install hint (apt/dnf auto-install is queued as a
-    // follow-up). Pass --no-auto-install or set autoInstall=false to
-    // restore the earlier opt-in behaviour.
-    const defaultAutoInstall = platform() === "darwin";
-    // `verbose` is the canonical flag; `verboseObservability` is the deprecated
-    // alias and ORs in for back-compat.
-    const verbose = (rawOpts.verbose ?? false) || (rawOpts.verboseObservability ?? false);
-    const opts = {
-        cluster: rawOpts.cluster ?? DEFAULT_K3S_CLUSTER,
-        autoInstall: rawOpts.autoInstall ?? defaultAutoInstall,
-        skipObservability: rawOpts.skipObservability ?? false,
-        skipClusterCreate: rawOpts.skipClusterCreate ?? false,
-        forceObservability: rawOpts.forceObservability ?? false,
-        skipPrepull: rawOpts.skipPrepull ?? false,
-        verbose,
-        verboseObservability: rawOpts.verboseObservability ?? false,
-        hostCpDevPath: rawOpts.hostCpDevPath,
-        preferredRuntime: rawOpts.preferredRuntime,
-    };
-    printHeader("olam setup — k3s mode");
-    printInfo("mode", "one-command bring-up of olam peripherals + observability on a local k3d cluster");
-    preflight(opts);
-    ensureSecrets();
-    ensureContainerRuntime(opts);
-    ensureCluster(opts);
-    await installObservability(opts);
-    applyPeripheralServicesManifests();
-    await prepullImages(opts);
-    await delegateToUpgrade(opts);
-    summary(opts);
-    printSuccess("setup complete");
-    return { exitCode: 0, summary: `setup complete on cluster ${opts.cluster}` };
-}
-//# sourceMappingURL=bootstrap-kubernetes.js.map