@pleri/olam-cli 0.1.201 → 0.1.205

package/dist/lib/instrumentation.js

@@ -1,104 +0,0 @@
-/**
- * instrumentation.ts — stdout JSON event emitter for olam-cli.
- *
- * Phase 1b A3 of olam-host-suite-phase-1b-k3s-beta-flavour (plan
- * ~/.claude/plans/olam-host-suite-phase-1b-k3s-beta-flavour.md).
- *
- * Canonical event schema (Decision 21 — `olam.instr.v1`):
- *   {
- *     "schema": "olam.instr.v1",
- *     "event": "substrate.set" | "upgrade.complete",
- *     "install_id": "<uuid-v4-from-config>",
- *     "ts": "<ISO-8601-UTC>",
- *     <event-specific-fields>
- *   }
- *
- * Emission target: **stderr**, newline-delimited, each line prefixed with
- * `OLAM_INSTR ` so consumers can grep-distinguish from other stderr output.
- *
- * Why stderr (and not stdout)? olam-cli's existing stdout-JSON contracts
- * (e.g. `olam status --json`, `olam doctor --json`) reserve stdout for
- * command output that consumers parse positionally. Mixing instrumentation
- * into stdout breaks those contracts. stderr keeps the emitter
- * grep-distinguishable AND segregated from the data-plane output.
- *
- * Consumers: month-6 aggregator script (`scripts/aggregate-substrate-events.mjs`,
- * D20) groups events by `install_id` for Falsifiable signal thresholds 1+4.
- *
- * Defensive contract:
- *   - emit() MUST NOT throw if the config can't be read; falls back to a
- *     placeholder install_id ('unknown') + emits a one-line stderr WARN.
- *   - Schema is versioned (`olam.instr.v1`); v2 fields land additively.
- *     Consumers MUST tolerate unknown fields.
- */
-import { readConfig } from './config.js';
-export const INSTRUMENTATION_SCHEMA = 'olam.instr.v1';
-export const INSTRUMENTATION_PREFIX = 'OLAM_INSTR ';
-function nowIso(now) {
-    const d = now ? now() : new Date();
-    return d.toISOString();
-}
-function resolveInstallId(opts) {
-    try {
-        if (opts.installIdProvider)
-            return opts.installIdProvider();
-        const cfg = readConfig();
-        return cfg.install_id;
-    }
-    catch {
-        return 'unknown';
-    }
-}
-function writeLine(stderr, payload) {
-    try {
-        const line = `${INSTRUMENTATION_PREFIX}${JSON.stringify(payload)}\n`;
-        stderr.write(line);
-    }
-    catch (err) {
-        // emit must never throw; surface the failure tersely to stderr.
-        try {
-            stderr.write(`[WARN] olam instrumentation emit failed: ${err instanceof Error ? err.message : String(err)}\n`);
-        }
-        catch {
-            // give up; emitter contract is best-effort.
-        }
-    }
-}
-/**
- * Emit a `substrate.set` event. Called by `olam substrate set` ONLY on success
- * (failure paths emit nothing — by design; thresholds count successful switches).
- *
- * @param payload — substrate + optional flavor
- * @param opts — test-only injection points (stderr / now / installIdProvider)
- */
-export function emitSubstrateSet(payload, opts = {}) {
-    const event = {
-        schema: INSTRUMENTATION_SCHEMA,
-        event: 'substrate.set',
-        install_id: resolveInstallId(opts),
-        ts: nowIso(opts.now),
-        substrate: payload.substrate,
-        ...(payload.flavor !== undefined ? { flavor: payload.flavor } : {}),
-    };
-    writeLine(opts.stderr ?? process.stderr, event);
-}
-/**
- * Emit an `upgrade.complete` event. Called by Phase C C2's substrate-aware
- * `olam upgrade` ONLY on success.
- *
- * @param payload — substrate + duration_ms (and optional flavor)
- * @param opts — test-only injection points
- */
-export function emitUpgradeComplete(payload, opts = {}) {
-    const event = {
-        schema: INSTRUMENTATION_SCHEMA,
-        event: 'upgrade.complete',
-        install_id: resolveInstallId(opts),
-        ts: nowIso(opts.now),
-        substrate: payload.substrate,
-        duration_ms: payload.duration_ms,
-        ...(payload.flavor !== undefined ? { flavor: payload.flavor } : {}),
-    };
-    writeLine(opts.stderr ?? process.stderr, event);
-}
-//# sourceMappingURL=instrumentation.js.map

package/dist/lib/instrumentation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"instrumentation.js","sourceRoot":"","sources":["../../src/lib/instrumentation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAwB,CAAC;AAC/D,MAAM,CAAC,MAAM,sBAAsB,GAAG,aAAsB,CAAC;AAgC7D,SAAS,MAAM,CAAC,GAAgB;IAC9B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACnC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAc;IACtC,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC5D,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,UAAU,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,MAA6B,EAAE,OAA6B;IAC7E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,sBAAsB,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;QACrE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gEAAgE;QAChE,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,CACV,4CACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,IAAI,CACL,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAiE,EACjE,OAAiB,EAAE;IAEnB,MAAM,KAAK,GAAsB;QAC/B,MAAM,EAAE,sBAAsB;QAC9B,KAAK,EAAE,eAAe;QACtB,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC;QAClC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;IACF,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAIC,EACD,OAAiB,EAAE;IAEnB,MAAM,KAAK,GAAyB;QAClC,MAAM,EAAE,sBAAsB;QAC9B,KAAK,EAAE,kBAAkB;QACzB,UAAU,EAAE,gBAAgB,CAAC,IAAI,CAAC;QAClC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;IACF,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAClD,CAAC"}

package/dist/lib/k8s-bootstrap.d.ts

@@ -1,126 +0,0 @@
-/**
- * k8s-bootstrap.ts — apply the `olam` namespace + RBAC + secret set on a
- * fresh kubernetes cluster.
- *
- * B4 of olam-issue-npm-only-k3s. Without this an npm-only operator running
- * `olam upgrade --substrate=kubernetes` against a fresh cluster fails with:
- *
- *   Error from server (NotFound): namespaces "olam" not found
- *   Secret "olam-host-cp-secret" not found in namespace "olam"
- *
- * The 8-step upgrade flow (upgrade-kubernetes.ts) already runs
- * `seedManifestsFromBundle` to put manifest YAML at ~/.olam/k8s/manifests/,
- * but no one APPLIES them on first install — operators were expected to
- * `kubectl apply -f` by hand. That barrier is the npm-only blocker this
- * module closes.
- *
- * Idempotency: kubectl apply is idempotent by design for manifests
- * (server-side merge keys deduplicate). For secrets we render once and
- * persist the values to ~/.olam/k8s-secrets-state.json — subsequent runs
- * reuse the same values so worlds that have cached tokens don't break.
- *
- * Order (matches the seed manifest filename numeric prefix):
- *   1. 00-namespace.yaml        — host-cp namespace
- *   2. 10-serviceaccount.yaml   — host-cp ServiceAccount
- *   3. 20-rbac.yaml             — host-cp Role/RoleBinding
- *   4. 30-configmap.yaml        — host-cp env ConfigMap
- *   5. 45-pvc.yaml              — host-cp PersistentVolumeClaim
- *   6. host-cp Secret           — RENDERED from templates/40-secret-template.yaml
- *   7. per-peripheral manifests + secrets (auth-service, mcp-auth-service, kg-service, memory-service)
- *
- * Deployments + Services (50-deployment.yaml, 60-service.yaml) are NOT
- * applied here — that is upgrade-kubernetes.ts's job (it manages rollout
- * status + port-forward + audit log). ensureK8sBootstrap returns once the
- * "prerequisites" (namespace + RBAC + secrets) are in place.
- */
-import { kubectlWrap } from './kubectl-wrap.js';
-import { type RenderDeps, type RenderResult } from './k8s-secret-render.js';
-export declare const K8S_NAMESPACE = "olam";
-/**
- * kubectl apply wrapper — accepts a YAML string and applies via stdin (D20
- * stdin-safe; values never inlined into argv). When `manifestPath` is given
- * the file is applied via `-f <path>` instead (manifests stay on disk).
- */
-declare function kubectlApply(context: string, source: {
-    path: string;
-} | {
-    stdinYaml: string;
-}, deps: BootstrapDeps): Promise<{
-    ok: boolean;
-    stderr: string;
-}>;
-/**
- * Locate the bundled k8s assets directory. In install-mode this is
- * `<install-root>/host-cp/k8s/`. In dev-mode it falls back to the
- * monorepo's `packages/host-cp/k8s/`.
- */
-export declare function resolveK8sAssetsRoot(installRootDir?: string): string | null;
-export interface BootstrapDeps {
-    /** Injectable kubectlWrap for tests. */
-    readonly kubectlWrapImpl?: typeof kubectlWrap;
-    /** Override the k8s assets root path (auto-resolved via installRoot when absent). */
-    readonly k8sAssetsRoot?: string;
-    /** Pass-through deps for the secret renderer (file IO, gh-token, RNG, state file). */
-    readonly renderDeps?: RenderDeps;
-    /** stdout for human-readable progress. */
-    readonly stdout?: NodeJS.WritableStream;
-    /** stderr for warnings + errors. */
-    readonly stderr?: NodeJS.WritableStream;
-    /** Hook into kubectlApply for tests (overrides the kubectlWrap path entirely). */
-    readonly applyImpl?: typeof kubectlApply;
-    /**
-     * Optional progress callback invoked for each manifest/secret being applied.
-     * When provided, replaces the per-item stdout.write so callers (e.g. upgrade-kubernetes)
-     * can route progress through a spinner's `.text` instead of newlining to stdout.
-     */
-    readonly onProgress?: (label: string) => void;
-}
-export interface BootstrapOptions {
-    readonly context: string;
-    readonly namespace?: string;
-    /** When true, regenerate every secret value (overwrites ~/.olam/k8s-secrets-state.json). */
-    readonly rotateSecrets?: boolean;
-    /** When true, no kubectl invocations happen; the function returns the would-be plan. */
-    readonly dryRun?: boolean;
-}
-export type AppliedKind = {
-    kind: 'manifest';
-    path: string;
-} | {
-    kind: 'secret';
-    name: string;
-};
-export interface BootstrapResult {
-    readonly applied: ReadonlyArray<AppliedKind>;
-    readonly skipped: ReadonlyArray<{
-        kind: AppliedKind['kind'];
-        ref: string;
-        reason: string;
-    }>;
-    readonly secretResults: ReadonlyArray<RenderResult>;
-}
-/**
- * Run the bootstrap. Idempotent on re-run.
- *
- * Apply order (numeric filename prefix mirrors apply ORDER):
- *   1. <root>/manifests/00-namespace.yaml + 10/20/30/45 (host-cp prereqs)
- *   2. Per-peripheral 10/20/30/45 prereqs (auth-service / mcp-auth-service / kg-service / memory-service)
- *   3. host-cp Secret (rendered from templates/40-secret-template.yaml)
- *   4. Per-peripheral Secrets (rendered from each *-secret-template.yaml)
- *
- * On the first failed apply we surface the kubectl stderr and stop —
- * partial-apply state is left in the cluster (kubectl apply is idempotent;
- * re-running picks up where we stopped).
- */
-export declare function ensureK8sBootstrap(opts: BootstrapOptions, deps?: BootstrapDeps): Promise<{
-    exitCode: number;
-    result: BootstrapResult;
-    error?: string;
-}>;
-/**
- * Read the list of expected Secret names — used by probeK8sRequiredSecrets
- * so the doctor probe stays in lockstep with the bootstrap module.
- */
-export declare function expectedSecretNames(): ReadonlyArray<string>;
-export {};
-//# sourceMappingURL=k8s-bootstrap.d.ts.map

package/dist/lib/k8s-bootstrap.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"k8s-bootstrap.d.ts","sourceRoot":"","sources":["../../src/lib/k8s-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAKH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,OAAO,EAEL,KAAK,UAAU,EACf,KAAK,YAAY,EAElB,MAAM,wBAAwB,CAAC;AAEhC,eAAO,MAAM,aAAa,SAAS,CAAC;AAqCpC;;;;GAIG;AACH,iBAAe,YAAY,CACzB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAChD,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAQ1C;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,GAAE,MAAsB,GAAG,MAAM,GAAG,IAAI,CAQ1F;AAED,MAAM,WAAW,aAAa;IAC5B,wCAAwC;IACxC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,WAAW,CAAC;IAC9C,qFAAqF;IACrF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,sFAAsF;IACtF,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IACxC,oCAAoC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IACxC,kFAAkF;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,YAAY,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,4FAA4F;IAC5F,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,wFAAwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,gBAAgB,EACtB,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,eAAe,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAoGxE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,aAAa,CAAC,MAAM,CAAC,CAE3D"}

package/dist/lib/k8s-bootstrap.js

@@ -1,218 +0,0 @@
-/**
- * k8s-bootstrap.ts — apply the `olam` namespace + RBAC + secret set on a
- * fresh kubernetes cluster.
- *
- * B4 of olam-issue-npm-only-k3s. Without this an npm-only operator running
- * `olam upgrade --substrate=kubernetes` against a fresh cluster fails with:
- *
- *   Error from server (NotFound): namespaces "olam" not found
- *   Secret "olam-host-cp-secret" not found in namespace "olam"
- *
- * The 8-step upgrade flow (upgrade-kubernetes.ts) already runs
- * `seedManifestsFromBundle` to put manifest YAML at ~/.olam/k8s/manifests/,
- * but no one APPLIES them on first install — operators were expected to
- * `kubectl apply -f` by hand. That barrier is the npm-only blocker this
- * module closes.
- *
- * Idempotency: kubectl apply is idempotent by design for manifests
- * (server-side merge keys deduplicate). For secrets we render once and
- * persist the values to ~/.olam/k8s-secrets-state.json — subsequent runs
- * reuse the same values so worlds that have cached tokens don't break.
- *
- * Order (matches the seed manifest filename numeric prefix):
- *   1. 00-namespace.yaml        — host-cp namespace
- *   2. 10-serviceaccount.yaml   — host-cp ServiceAccount
- *   3. 20-rbac.yaml             — host-cp Role/RoleBinding
- *   4. 30-configmap.yaml        — host-cp env ConfigMap
- *   5. 45-pvc.yaml              — host-cp PersistentVolumeClaim
- *   6. host-cp Secret           — RENDERED from templates/40-secret-template.yaml
- *   7. per-peripheral manifests + secrets (auth-service, mcp-auth-service, kg-service, memory-service)
- *
- * Deployments + Services (50-deployment.yaml, 60-service.yaml) are NOT
- * applied here — that is upgrade-kubernetes.ts's job (it manages rollout
- * status + port-forward + audit log). ensureK8sBootstrap returns once the
- * "prerequisites" (namespace + RBAC + secrets) are in place.
- */
-import { spawnSync } from 'node:child_process';
-import { existsSync, readdirSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { kubectlWrap } from './kubectl-wrap.js';
-import { installRoot } from '../install-root.js';
-import { OLAM_HOME } from './config.js';
-import { renderAllSecrets, SECRET_TEMPLATE_BINDINGS, } from './k8s-secret-render.js';
-export const K8S_NAMESPACE = 'olam';
-/**
- * Manifest files inside `<install-root>/host-cp/k8s/manifests/` that
- * ensureK8sBootstrap applies. Ordered numerically by filename prefix.
- * Deployment + Service are intentionally absent — upgrade-kubernetes.ts
- * applies those alongside its rollout-status step.
- */
-const HOST_CP_PREREQ_MANIFESTS = [
-    '00-namespace.yaml',
-    '10-serviceaccount.yaml',
-    '20-rbac.yaml',
-    '30-configmap.yaml',
-    '45-pvc.yaml',
-];
-/**
- * Peripheral subdirs under `<install-root>/host-cp/k8s/manifests/`. Each
- * carries its own 10/20/30/45 prerequisite YAMLs. 50-deployment + 60-service
- * are skipped here (upgrade.ts owns rollout).
- */
-const PERIPHERAL_SUBDIRS = [
-    'auth-service',
-    'mcp-auth-service',
-    'kg-service',
-    'memory-service',
-    // Phase B Model B: in-cluster chunks substrate + plan-chat sidecar.
-    // chunks-postgres and chunks-electric come before plan-chat-service so
-    // their Services exist when plan-chat-service first resolves
-    // OLAM_PLAN_CHAT_DATABASE_URL / OLAM_PLAN_CHAT_ELECTRIC_URL.
-    'chunks-postgres',
-    'chunks-electric',
-    'plan-chat-service',
-];
-const PERIPHERAL_PREREQ_FILES = ['10-serviceaccount.yaml', '20-rbac.yaml', '30-configmap.yaml', '45-pvc.yaml'];
-/**
- * kubectl apply wrapper — accepts a YAML string and applies via stdin (D20
- * stdin-safe; values never inlined into argv). When `manifestPath` is given
- * the file is applied via `-f <path>` instead (manifests stay on disk).
- */
-async function kubectlApply(context, source, deps) {
-    const wrap = deps.kubectlWrapImpl ?? kubectlWrap;
-    if ('path' in source) {
-        const r = await wrap(['--context', context, 'apply', '-f', source.path], { timeout: 30_000 });
-        return { ok: r.ok, stderr: r.stderr };
-    }
-    const r = await wrap(['--context', context, 'apply', '-f', '-'], { timeout: 30_000, stdin: source.stdinYaml });
-    return { ok: r.ok, stderr: r.stderr };
-}
-/**
- * Locate the bundled k8s assets directory. In install-mode this is
- * `<install-root>/host-cp/k8s/`. In dev-mode it falls back to the
- * monorepo's `packages/host-cp/k8s/`.
- */
-export function resolveK8sAssetsRoot(installRootDir = installRoot()) {
-    const installed = join(installRootDir, 'host-cp', 'k8s');
-    if (existsSync(installed))
-        return installed;
-    // Dev-mode fallback. installRoot points at <repo>/packages/cli; walk up.
-    const repoRoot = join(installRootDir, '..', '..');
-    const monorepo = join(repoRoot, 'packages', 'host-cp', 'k8s');
-    if (existsSync(monorepo))
-        return monorepo;
-    return null;
-}
-/**
- * Run the bootstrap. Idempotent on re-run.
- *
- * Apply order (numeric filename prefix mirrors apply ORDER):
- *   1. <root>/manifests/00-namespace.yaml + 10/20/30/45 (host-cp prereqs)
- *   2. Per-peripheral 10/20/30/45 prereqs (auth-service / mcp-auth-service / kg-service / memory-service)
- *   3. host-cp Secret (rendered from templates/40-secret-template.yaml)
- *   4. Per-peripheral Secrets (rendered from each *-secret-template.yaml)
- *
- * On the first failed apply we surface the kubectl stderr and stop —
- * partial-apply state is left in the cluster (kubectl apply is idempotent;
- * re-running picks up where we stopped).
- */
-export async function ensureK8sBootstrap(opts, deps = {}) {
-    const stdout = deps.stdout ?? process.stdout;
-    const stderr = deps.stderr ?? process.stderr;
-    const namespace = opts.namespace ?? K8S_NAMESPACE;
-    const apply = deps.applyImpl ?? kubectlApply;
-    const onProgress = deps.onProgress;
-    const assetsRoot = deps.k8sAssetsRoot ?? resolveK8sAssetsRoot();
-    if (assetsRoot === null || !existsSync(assetsRoot)) {
-        return {
-            exitCode: 1,
-            result: { applied: [], skipped: [], secretResults: [] },
-            error: 'Could not find bundled k8s assets. Expected <install-root>/host-cp/k8s/ or <repo>/packages/host-cp/k8s/. ' +
-                'Reinstall the CLI: `npm install -g @pleri/olam-cli@latest`.',
-        };
-    }
-    const manifestsRoot = join(assetsRoot, 'manifests');
-    const applied = [];
-    const skipped = [];
-    // 1+2. host-cp prereq manifests + per-peripheral prereqs.
-    const manifestPaths = [];
-    for (const f of HOST_CP_PREREQ_MANIFESTS) {
-        manifestPaths.push(join(manifestsRoot, f));
-    }
-    for (const sub of PERIPHERAL_SUBDIRS) {
-        for (const f of PERIPHERAL_PREREQ_FILES) {
-            const p = join(manifestsRoot, sub, f);
-            if (existsSync(p))
-                manifestPaths.push(p);
-        }
-    }
-    for (const mp of manifestPaths) {
-        if (opts.dryRun) {
-            applied.push({ kind: 'manifest', path: mp });
-            continue;
-        }
-        if (!existsSync(mp)) {
-            skipped.push({ kind: 'manifest', ref: mp, reason: 'file not found in bundle (older package?)' });
-            continue;
-        }
-        const label = `  → applying ${mp.replace(assetsRoot, '<k8s-assets>')}`;
-        if (onProgress) {
-            onProgress(label);
-        }
-        else {
-            stdout.write(`${label}\n`);
-        }
-        const r = await apply(opts.context, { path: mp }, deps);
-        if (!r.ok) {
-            stderr.write(`error: kubectl apply -f ${mp} failed:\n${r.stderr}\n`);
-            return {
-                exitCode: 1,
-                result: { applied, skipped, secretResults: [] },
-                error: `kubectl apply of ${mp} failed`,
-            };
-        }
-        applied.push({ kind: 'manifest', path: mp });
-    }
-    // 3+4. Render + apply secrets.
-    const { results } = renderAllSecrets(assetsRoot, { rotate: opts.rotateSecrets === true, context: opts.context, namespace }, deps.renderDeps ?? {});
-    for (const r of results) {
-        if (r.status === 'skipped') {
-            const reason = `unresolved source(s): ${r.missingSources.join('; ')}`;
-            skipped.push({ kind: 'secret', ref: r.secretName, reason });
-            stderr.write(`warn: Secret ${r.secretName} skipped — ${reason}\n`);
-            stderr.write(`      Once you have the source value, apply manually:\n`);
-            stderr.write(`        kubectl --context ${opts.context} apply -n ${namespace} -f - <<EOF\n        (rendered secret YAML)\nEOF\n`);
-            continue;
-        }
-        if (opts.dryRun) {
-            applied.push({ kind: 'secret', name: r.secretName });
-            continue;
-        }
-        const secretLabel = `  → applying Secret ${r.secretName}`;
-        if (onProgress) {
-            onProgress(secretLabel);
-        }
-        else {
-            stdout.write(`${secretLabel}\n`);
-        }
-        const a = await apply(opts.context, { stdinYaml: r.renderedYaml }, deps);
-        if (!a.ok) {
-            stderr.write(`error: kubectl apply Secret ${r.secretName} failed:\n${a.stderr}\n`);
-            return {
-                exitCode: 1,
-                result: { applied, skipped, secretResults: results },
-                error: `kubectl apply Secret ${r.secretName} failed`,
-            };
-        }
-        applied.push({ kind: 'secret', name: r.secretName });
-    }
-    return { exitCode: 0, result: { applied, skipped, secretResults: results } };
-}
-/**
- * Read the list of expected Secret names — used by probeK8sRequiredSecrets
- * so the doctor probe stays in lockstep with the bootstrap module.
- */
-export function expectedSecretNames() {
-    return SECRET_TEMPLATE_BINDINGS.map((b) => b.secretName);
-}
-//# sourceMappingURL=k8s-bootstrap.js.map

package/dist/lib/k8s-bootstrap.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"k8s-bootstrap.js","sourceRoot":"","sources":["../../src/lib/k8s-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,gBAAgB,EAGhB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,wBAAwB,GAAG;IAC/B,mBAAmB;IACnB,wBAAwB;IACxB,cAAc;IACd,mBAAmB;IACnB,aAAa;CACL,CAAC;AAEX;;;;GAIG;AACH,MAAM,kBAAkB,GAAG;IACzB,cAAc;IACd,kBAAkB;IAClB,YAAY;IACZ,gBAAgB;IAChB,oEAAoE;IACpE,uEAAuE;IACvE,6DAA6D;IAC7D,6DAA6D;IAC7D,iBAAiB;IACjB,iBAAiB;IACjB,mBAAmB;CACX,CAAC;AAEX,MAAM,uBAAuB,GAAG,CAAC,wBAAwB,EAAE,cAAc,EAAE,mBAAmB,EAAE,aAAa,CAAU,CAAC;AAExH;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,OAAe,EACf,MAAgD,EAChD,IAAmB;IAEnB,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,IAAI,WAAW,CAAC;IACjD,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9F,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/G,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,iBAAyB,WAAW,EAAE;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,yEAAyE;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC;AA0CD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAsB,EACtB,OAAsB,EAAE;IAExB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,YAAY,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IAEnC,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,IAAI,oBAAoB,EAAE,CAAC;IAChE,IAAI,UAAU,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACnD,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;YACvD,KAAK,EACH,2GAA2G;gBAC3G,6DAA6D;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAsE,EAAE,CAAC;IAEtF,0DAA0D;IAC1D,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,wBAAwB,EAAE,CAAC;QACzC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,uBAAuB,EAAE,CAAC;YACxC,MAAM,CAAC,GAAG,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACtC,IAAI,UAAU,CAAC,CAAC,CAAC;gBAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC,CAAC;YACjG,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC;QACvE,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,aAAa,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;YACrE,OAAO;gBACL,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE;gBAC/C,KAAK,EAAE,oBAAoB,EAAE,SAAS;aACvC,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,+BAA+B;IAC/B,MAAM,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAClC,UAAU,EACV,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,EACzE,IAAI,CAAC,UAAU,IAAI,EAAE,CACtB,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,yBAAyB,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,UAAU,cAAc,MAAM,IAAI,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;YACxE,MAAM,CAAC,KAAK,CAAC,6BAA6B,IAAI,CAAC,OAAO,aAAa,SAAS,oDAAoD,CAAC,CAAC;YAClI,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;YACrD,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAG,uBAAuB,CAAC,CAAC,UAAU,EAAE,CAAC;QAC1D,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC,WAAW,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,YAAa,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1E,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,UAAU,aAAa,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;YACnF,OAAO;gBACL,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE;gBACpD,KAAK,EAAE,wBAAwB,CAAC,CAAC,UAAU,SAAS;aACrD,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,CAAC;AAC/E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AAC3D,CAAC"}

package/dist/lib/k8s-context-discovery.d.ts

@@ -1,80 +0,0 @@
-/**
- * k8s-context-discovery.ts — kubeconfig context enumeration + reachability + idleness probes.
- *
- * Used by `olam setup` Phase 0.5 (ADR 021) to detect existing reachable
- * Kubernetes contexts and offer to reuse them instead of provisioning a
- * new k3d cluster.
- *
- * All external I/O is injected via the `KubeContextDeps` interface for
- * testability. Production callers use the default implementations which
- * shell out to `kubectl`.
- */
-export interface KubeContextProbe {
-    readonly reachable: boolean;
-    readonly error?: string;
-    readonly serverUrl?: string;
-}
-export interface KubeContextDeps {
-    /**
-     * Return all context names from `~/.kube/config` (or `$KUBECONFIG`).
-     * Default: `kubectl config get-contexts -o name`
-     */
-    readonly getContexts?: () => string[];
-    /**
-     * Probe one context for reachability.
-     * Default: `kubectl --context=<name> cluster-info --request-timeout=3s`
-     */
-    readonly clusterInfo?: (context: string) => KubeContextProbe;
-    /**
-     * Check whether a context is idle (no `olam` namespace, or `olam` ns
-     * present but no running pods).
-     * Default: `kubectl --context=<name> get namespace olam --ignore-not-found`
-     *          + `kubectl --context=<name> get pods -n olam`
-     */
-    readonly isIdle?: (context: string) => boolean;
-}
-/**
- * Context names provisioned by `olam setup` — never offered for reuse.
- * These are ours to manage (create/destroy via k3d).
- */
-export declare const OLAM_MANAGED_CONTEXT_PREFIX = "k3d-olam-";
-export declare function isOlamManagedContext(name: string): boolean;
-/**
- * Default implementation: enumerate kubeconfig contexts via
- * `kubectl config get-contexts -o name`.
- * Returns an empty array when kubectl is absent or returns no contexts.
- */
-export declare function defaultGetContexts(): string[];
-/**
- * Default implementation: probe a context via
- * `kubectl --context=<name> cluster-info --request-timeout=3s`.
- *
- * Returns reachable:true when exit status is 0.
- * Returns reachable:false + the stderr text otherwise.
- */
-export declare function defaultClusterInfo(context: string): KubeContextProbe;
-/**
- * Default implementation: a context is idle when there is no `olam`
- * namespace OR the namespace exists but has no running pods.
- *
- * "Idle" means we haven't deployed Olam there yet — safe to offer for reuse.
- */
-export declare function defaultIsIdle(context: string): boolean;
-export interface DiscoveryResult {
-    /** All reachable idle contexts that are not k3d-olam-* managed contexts. */
-    readonly offerable: readonly string[];
-    /** All contexts that were probed (for diagnostics). */
-    readonly allContexts: readonly string[];
-}
-/**
- * Discover reachable idle kubeconfig contexts that could be offered for reuse.
- *
- * Steps:
- *   1. Enumerate all contexts from kubeconfig.
- *   2. Filter out k3d-olam-* (olam-managed).
- *   3. For each remaining context, probe reachability (3s timeout).
- *   4. For reachable contexts, check idleness.
- *   5. Return the offerable set.
- */
-export declare function discoverOfferableContexts(deps?: KubeContextDeps): DiscoveryResult;
-//# sourceMappingURL=k8s-context-discovery.d.ts.map

package/dist/lib/k8s-context-discovery.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"k8s-context-discovery.d.ts","sourceRoot":"","sources":["../../src/lib/k8s-context-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,gBAAgB,CAAC;IAC7D;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;CAChD;AAID;;;GAGG;AACH,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAEvD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAW7C;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAcpE;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAqBtD;AAID,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,uDAAuD;IACvD,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,GAAE,eAAoB,GAAG,eAAe,CAgBrF"}

package/dist/lib/k8s-context-discovery.js

@@ -1,102 +0,0 @@
-/**
- * k8s-context-discovery.ts — kubeconfig context enumeration + reachability + idleness probes.
- *
- * Used by `olam setup` Phase 0.5 (ADR 021) to detect existing reachable
- * Kubernetes contexts and offer to reuse them instead of provisioning a
- * new k3d cluster.
- *
- * All external I/O is injected via the `KubeContextDeps` interface for
- * testability. Production callers use the default implementations which
- * shell out to `kubectl`.
- */
-import { spawnSync } from 'node:child_process';
-// ── k3d-managed context names we own — excluded from the reuse offer ──────────
-/**
- * Context names provisioned by `olam setup` — never offered for reuse.
- * These are ours to manage (create/destroy via k3d).
- */
-export const OLAM_MANAGED_CONTEXT_PREFIX = 'k3d-olam-';
-export function isOlamManagedContext(name) {
-    return name.startsWith(OLAM_MANAGED_CONTEXT_PREFIX);
-}
-// ── Default implementations ───────────────────────────────────────────────────
-/**
- * Default implementation: enumerate kubeconfig contexts via
- * `kubectl config get-contexts -o name`.
- * Returns an empty array when kubectl is absent or returns no contexts.
- */
-export function defaultGetContexts() {
-    const r = spawnSync('kubectl', ['config', 'get-contexts', '-o', 'name'], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
-    if (r.status !== 0 || !r.stdout)
-        return [];
-    return r.stdout
-        .split('\n')
-        .map((l) => l.trim())
-        .filter(Boolean);
-}
-/**
- * Default implementation: probe a context via
- * `kubectl --context=<name> cluster-info --request-timeout=3s`.
- *
- * Returns reachable:true when exit status is 0.
- * Returns reachable:false + the stderr text otherwise.
- */
-export function defaultClusterInfo(context) {
-    const r = spawnSync('kubectl', ['--context', context, 'cluster-info', '--request-timeout=3s'], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
-    if (r.status === 0) {
-        // Extract server URL from stdout if present (first line looks like
-        // "Kubernetes control plane is running at https://127.0.0.1:6443")
-        const match = r.stdout.match(/running at (https?:\/\/\S+)/i);
-        return { reachable: true, serverUrl: match?.[1] };
-    }
-    const err = (r.stderr || '').trim().slice(0, 200);
-    return { reachable: false, error: err || 'cluster-info failed' };
-}
-/**
- * Default implementation: a context is idle when there is no `olam`
- * namespace OR the namespace exists but has no running pods.
- *
- * "Idle" means we haven't deployed Olam there yet — safe to offer for reuse.
- */
-export function defaultIsIdle(context) {
-    // Check whether the `olam` namespace exists
-    const nsResult = spawnSync('kubectl', ['--context', context, 'get', 'namespace', 'olam', '--ignore-not-found', '-o', 'name'], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
-    const nsLine = (nsResult.stdout || '').trim();
-    if (!nsLine) {
-        // No `olam` namespace → definitely idle
-        return true;
-    }
-    // Namespace exists — check if any pods are running
-    const podsResult = spawnSync('kubectl', ['--context', context, 'get', 'pods', '-n', 'olam', '--no-headers'], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
-    const podsOut = (podsResult.stdout || '').trim();
-    // If output is empty or just "No resources found..." the ns is empty → idle
-    return !podsOut || /no resources found/i.test(podsOut);
-}
-/**
- * Discover reachable idle kubeconfig contexts that could be offered for reuse.
- *
- * Steps:
- *   1. Enumerate all contexts from kubeconfig.
- *   2. Filter out k3d-olam-* (olam-managed).
- *   3. For each remaining context, probe reachability (3s timeout).
- *   4. For reachable contexts, check idleness.
- *   5. Return the offerable set.
- */
-export function discoverOfferableContexts(deps = {}) {
-    const getContextsFn = deps.getContexts ?? defaultGetContexts;
-    const clusterInfoFn = deps.clusterInfo ?? defaultClusterInfo;
-    const isIdleFn = deps.isIdle ?? defaultIsIdle;
-    const allContexts = getContextsFn();
-    const offerable = [];
-    for (const ctx of allContexts) {
-        if (isOlamManagedContext(ctx))
-            continue;
-        const probe = clusterInfoFn(ctx);
-        if (!probe.reachable)
-            continue;
-        if (isIdleFn(ctx))
-            offerable.push(ctx);
-    }
-    return { offerable, allContexts };
-}
-//# sourceMappingURL=k8s-context-discovery.js.map