@pleri/olam-cli 0.1.201 → 0.1.205

package/dist/lib/memory-secret.js

@@ -1,147 +0,0 @@
-/**
- * Helpers for the agent-memory bearer secret at `~/.olam/memory-secret`.
- *
- * Pattern mirrors `~/.olam/auth-secret`:
- *   - 0600 mode enforced on every write
- *   - atomic write via tmp + rename
- *   - generated on first call to `ensureMemorySecret()`
- *
- * Phase C's `cloud-memory-secret` reuses the path-arg form
- * (`ensureSecretAtPath` / `readSecretAtPath`) so local + cloud share
- * the same code path.
- *
- * Plan reference: docs/plans/olam-agent-memory-distributed/phase-a-tasks.md A3
- */
-import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, renameSync, unlinkSync, chmodSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join, dirname } from 'node:path';
-import { randomBytes } from 'node:crypto';
-import { resolveSecretPath, canonicalSecretPath } from '@olam/core/src/secrets/paths.js';
-export const MEMORY_SECRET_PATH = resolveSecretPath('memory-secret');
-/**
- * Default cloud-mode secret path. Phase C C2.
- *
- * Mirrors the local pattern (0600, 64 hex chars). When `.olam/config.yaml`
- * carries `memory.cloud.secret_ref`, that wins over this default. The
- * config-resolver (C4) handles the precedence; this constant is the
- * fall-through when the operator doesn't override.
- */
-export const CLOUD_MEMORY_SECRET_PATH = resolveSecretPath('cloud-memory-secret');
-/**
- * Canonical (new) location for memory secret — used by writers.
- * Defined here as a convenience alias so callers don't need to import from core.
- */
-export const MEMORY_SECRET_CANONICAL_PATH = canonicalSecretPath('memory-secret');
-export const CLOUD_MEMORY_SECRET_CANONICAL_PATH = canonicalSecretPath('cloud-memory-secret');
-export const SECRET_LEN_BYTES = 32; // 64 hex chars
-/** Generate a 64-char hex secret. */
-export function generateSecret() {
-    return randomBytes(SECRET_LEN_BYTES).toString('hex');
-}
-/**
- * Write `value` to `path` atomically with mode 0600. Parent directory
- * created with default mode if absent.
- */
-export function writeSecretAtPath(path, value) {
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    const tmp = `${path}.tmp.${process.pid}`;
-    writeFileSync(tmp, value, { mode: 0o600 });
-    // writeFileSync's mode is umask-respecting; chmod explicitly to be safe.
-    chmodSync(tmp, 0o600);
-    renameSync(tmp, path);
-}
-/**
- * Read `path` as a string. Returns `null` if missing. Warns to stderr
- * if mode is not 0600 (caller decides whether to proceed).
- */
-export function readSecretAtPathOrNull(path) {
-    if (!existsSync(path))
-        return null;
-    const mode = statSync(path).mode & 0o777;
-    if (mode !== 0o600) {
-        process.stderr.write(`warn: ${path} has mode 0${mode.toString(8)}; expected 0600. Run 'olam memory secret rotate' to regenerate.\n`);
-    }
-    return readFileSync(path, 'utf8').trim();
-}
-/** Read `path` or throw if missing. */
-export function readSecretAtPath(path) {
-    const v = readSecretAtPathOrNull(path);
-    if (v === null) {
-        throw new Error(`Secret not found at ${path}. Run 'olam memory start' to generate it.`);
-    }
-    return v;
-}
-/**
- * Ensure `~/.olam/secrets/memory-secret` exists with mode 0600. Generates a
- * fresh 64-char hex secret on first call. Idempotent.
- *
- * Reads from the resolved path (new or legacy fallback); writes to canonical.
- */
-export function ensureMemorySecret(path = MEMORY_SECRET_PATH) {
-    const existing = readSecretAtPathOrNull(path);
-    if (existing)
-        return existing;
-    const fresh = generateSecret();
-    // When using the default resolved path, write to canonical new location.
-    // When given an explicit path (test seam or direct caller), honour it for write too.
-    const writePath = path === MEMORY_SECRET_PATH ? MEMORY_SECRET_CANONICAL_PATH : path;
-    writeSecretAtPath(writePath, fresh);
-    return fresh;
-}
-/** Read the local-mode memory secret (no-throw shape). */
-export function readMemorySecretOrNull(path = MEMORY_SECRET_PATH) {
-    return readSecretAtPathOrNull(path);
-}
-/** Read the local-mode memory secret (throw shape). */
-export function readMemorySecret(path = MEMORY_SECRET_PATH) {
-    return readSecretAtPath(path);
-}
-/**
- * Rotate the secret: generate fresh value, atomically replace the file,
- * return the new value. Caller is responsible for restarting any
- * running memory service so it picks up the new value.
- *
- * Always writes to canonical path (~/.olam/secrets/memory-secret).
- */
-export function rotateMemorySecret(path = MEMORY_SECRET_CANONICAL_PATH) {
-    const fresh = generateSecret();
-    writeSecretAtPath(path, fresh);
-    return fresh;
-}
-/** Convenience: are we wired for local-mode memory? */
-export function hasMemorySecret(path = MEMORY_SECRET_PATH) {
-    return existsSync(path);
-}
-// ── Cloud-mode wrappers (Phase C C2) ────────────────────────────────────────
-//
-// Thin facades over the path-arg helpers so cloud + local share the same
-// atomic-write, 0600-enforced, mode-warning code path. The split exists
-// because the CLI surfaces them under different verbs (`olam memory secret`
-// for local; cloud secrets are operator-prompted at `olam memory mode cloud`
-// time per C3) and because Phase C's config resolver (C4) keeps the
-// resolution logic in one place.
-/**
- * Read the cloud-mode bearer secret. Returns `null` if the file is absent
- * (the common case when the operator hasn't run `olam memory mode cloud`
- * yet). Warns to stderr on mode != 0600 but still returns the value —
- * caller decides whether to proceed.
- */
-export function readCloudMemorySecretOrNull(path = CLOUD_MEMORY_SECRET_PATH) {
-    return readSecretAtPathOrNull(path);
-}
-/** Throws when the cloud secret is absent — use only when caller has verified mode is cloud. */
-export function readCloudMemorySecret(path = CLOUD_MEMORY_SECRET_PATH) {
-    return readSecretAtPath(path);
-}
-/**
- * Atomic write 0600. Caller supplies the value (cloud secrets are
- * operator-prompted, not generated). Always writes to canonical path.
- */
-export function writeCloudMemorySecret(value, path = CLOUD_MEMORY_SECRET_CANONICAL_PATH) {
-    writeSecretAtPath(path, value);
-}
-/** Convenience: is a cloud secret on disk? */
-export function hasCloudMemorySecret(path = CLOUD_MEMORY_SECRET_PATH) {
-    return existsSync(path);
-}
-//# sourceMappingURL=memory-secret.js.map

package/dist/lib/memory-secret.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"memory-secret.js","sourceRoot":"","sources":["../../src/lib/memory-secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC1H,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;AACrE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;AAEjF;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;AACjF,MAAM,CAAC,MAAM,kCAAkC,GAAG,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;AAC7F,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC,CAAC,eAAe;AAEnD,qCAAqC;AACrC,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAa;IAC3D,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3C,yEAAyE;IACzE,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;IACzC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,SAAS,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,mEAAmE,CAC/G,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,uBAAuB,IAAI,2CAA2C,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,kBAAkB;IAClE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,yEAAyE;IACzE,qFAAqF;IACrF,MAAM,SAAS,GAAG,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC;IACpF,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,sBAAsB,CAAC,OAAe,kBAAkB;IACtE,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,gBAAgB,CAAC,OAAe,kBAAkB;IAChE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,4BAA4B;IAC5E,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,eAAe,CAAC,OAAe,kBAAkB;IAC/D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,+EAA+E;AAC/E,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,4EAA4E;AAC5E,6EAA6E;AAC7E,oEAAoE;AACpE,iCAAiC;AAEjC;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAe,wBAAwB;IAEvC,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,qBAAqB,CAAC,OAAe,wBAAwB;IAC3E,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAa,EACb,OAAe,kCAAkC;IAEjD,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,oBAAoB,CAAC,OAAe,wBAAwB;IAC1E,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/lib/peripheral-registry.d.ts

@@ -1,53 +0,0 @@
-/**
- * peripheral-registry.ts — Typed const registry of olam's 4 k8s peripheral services.
- *
- * Phase 2 Phase B (olam-host-suite-phase-2-peripheral-services-on-k3s).
- *
- * Each entry describes everything port-forward.ts (B2), upgrade-kubernetes.ts (C),
- * and services.ts / doctor.ts (D) need to drive the lifecycle of one peripheral.
- *
- * ---
- * YAML-DRIVEN REFACTOR TRIGGER (Decision D26)
- *
- * This file uses a hardcoded TypeScript const — acceptable while the registry
- * has ≤4 entries (small, type-safe, IDE-checkable). ADD THE 5th PERIPHERAL HERE
- * as a plain object literal first; if the registry grows to 5+ entries and the
- * pattern becomes repetitive, THEN migrate to yaml-driven config. Do not
- * over-engineer for the case that hasn't arrived.
- * ---
- *
- * host-cp is NOT in PERIPHERALS. It is a named special-case in port-forward.ts.
- */
-export type Peripheral = {
-    /** Human-readable short name (without the olam- prefix). Used as the manifest subdirectory name. */
-    name: 'auth-service' | 'mcp-auth-service' | 'kg-service' | 'memory-service' | 'plan-chat-service';
-    /** Local port kubectl port-forward binds on the host. */
-    port: number;
-    /**
-     * Full k8s resource name (Service + Deployment + app label) in the olam namespace.
-     * All peripheral k8s resources carry the `olam-` prefix in metadata.name and the
-     * `app:` label selector (e.g. `olam-auth-service`). This is the value to pass
-     * directly to `kubectl port-forward service/<k8sResourceName>`,
-     * `kubectl rollout status deployment/<k8sResourceName>`, and `-l app=<k8sResourceName>`.
-     */
-    k8sResourceName: string;
-    /** docker-compose service name for the compose substrate equivalent (Phase D). */
-    composeContainerName: string;
-    /** ENV var name in host-cp's deployment ConfigMap that exposes this peripheral's URL. */
-    configMapKeyInHostCp: string;
-    /** Health check path — e.g. /health or /agentmemory/livez. */
-    healthPath: string;
-    /**
-     * D2 (cloud-only-vault Phase D): set true when this peripheral is superseded
-     * by a cloud-native alternative and operators should migrate away.
-     * The entry STAYS until Phase E removes it; D needs it for --with-local-auth.
-     */
-    deprecated?: boolean;
-    /**
-     * D2: when deprecated is true, names the canonical cloud replacement.
-     * For example 'cloud-auth-worker' for auth-service.
-     */
-    replacedBy?: string;
-};
-export declare const PERIPHERALS: ReadonlyArray<Peripheral>;
-//# sourceMappingURL=peripheral-registry.d.ts.map

package/dist/lib/peripheral-registry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"peripheral-registry.d.ts","sourceRoot":"","sources":["../../src/lib/peripheral-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,MAAM,UAAU,GAAG;IACvB,oGAAoG;IACpG,IAAI,EAAE,cAAc,GAAG,kBAAkB,GAAG,YAAY,GAAG,gBAAgB,GAAG,mBAAmB,CAAC;IAClG,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,yFAAyF;IACzF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,aAAa,CAAC,UAAU,CAmDxC,CAAC"}

package/dist/lib/peripheral-registry.js

@@ -1,73 +0,0 @@
-/**
- * peripheral-registry.ts — Typed const registry of olam's 4 k8s peripheral services.
- *
- * Phase 2 Phase B (olam-host-suite-phase-2-peripheral-services-on-k3s).
- *
- * Each entry describes everything port-forward.ts (B2), upgrade-kubernetes.ts (C),
- * and services.ts / doctor.ts (D) need to drive the lifecycle of one peripheral.
- *
- * ---
- * YAML-DRIVEN REFACTOR TRIGGER (Decision D26)
- *
- * This file uses a hardcoded TypeScript const — acceptable while the registry
- * has ≤4 entries (small, type-safe, IDE-checkable). ADD THE 5th PERIPHERAL HERE
- * as a plain object literal first; if the registry grows to 5+ entries and the
- * pattern becomes repetitive, THEN migrate to yaml-driven config. Do not
- * over-engineer for the case that hasn't arrived.
- * ---
- *
- * host-cp is NOT in PERIPHERALS. It is a named special-case in port-forward.ts.
- */
-export const PERIPHERALS = [
-    {
-        name: 'auth-service',
-        port: 9999,
-        k8sResourceName: 'olam-auth-service',
-        composeContainerName: 'olam-auth-service',
-        // D2 (cloud-only-vault Phase D): ConfigMap key preserved for --with-local-auth
-        // operators until Phase E removes the whole entry.
-        configMapKeyInHostCp: 'OLAM_AUTH_SERVICE_URL',
-        healthPath: '/health',
-        // D2: deprecated in favour of the cloud auth-worker. Phase E will remove this entry.
-        deprecated: true,
-        replacedBy: 'cloud-auth-worker',
-    },
-    {
-        name: 'mcp-auth-service',
-        port: 9998,
-        k8sResourceName: 'olam-mcp-auth-service',
-        composeContainerName: 'olam-mcp-auth-service',
-        configMapKeyInHostCp: 'OLAM_MCP_AUTH_SERVICE_URL',
-        healthPath: '/health',
-    },
-    {
-        name: 'kg-service',
-        port: 9997,
-        k8sResourceName: 'olam-kg-service',
-        composeContainerName: 'olam-kg-service',
-        configMapKeyInHostCp: 'OLAM_KG_SERVICE_URL',
-        healthPath: '/health',
-    },
-    {
-        name: 'memory-service',
-        port: 3111,
-        k8sResourceName: 'olam-memory-service',
-        composeContainerName: 'olam-memory-service',
-        configMapKeyInHostCp: 'OLAM_MEMORY_SERVICE_URL',
-        healthPath: '/agentmemory/livez',
-    },
-    {
-        // Phase B Model B: plan-chat-service joins the registry as the 5th
-        // peripheral. host-cp's PLAN_CHAT_SERVICE_URL ConfigMap key gets rewritten
-        // to cluster-DNS form by upgrade-kubernetes.ts step 2.5 (buildK8sDnsUrl).
-        // The host-cp source (server.mjs:/api/plan-chat/*) reads PLAN_CHAT_SERVICE_URL
-        // at request time so the new value applies on every render.
-        name: 'plan-chat-service',
-        port: 3200,
-        k8sResourceName: 'olam-plan-chat-service',
-        composeContainerName: 'olam-plan-chat-service',
-        configMapKeyInHostCp: 'PLAN_CHAT_SERVICE_URL',
-        healthPath: '/livez',
-    },
-];
-//# sourceMappingURL=peripheral-registry.js.map

package/dist/lib/peripheral-registry.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"peripheral-registry.js","sourceRoot":"","sources":["../../src/lib/peripheral-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAkCH,MAAM,CAAC,MAAM,WAAW,GAA8B;IACpD;QACE,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,IAAI;QACV,eAAe,EAAE,mBAAmB;QACpC,oBAAoB,EAAE,mBAAmB;QACzC,+EAA+E;QAC/E,mDAAmD;QACnD,oBAAoB,EAAE,uBAAuB;QAC7C,UAAU,EAAE,SAAS;QACrB,qFAAqF;QACrF,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,mBAAmB;KAChC;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,IAAI;QACV,eAAe,EAAE,uBAAuB;QACxC,oBAAoB,EAAE,uBAAuB;QAC7C,oBAAoB,EAAE,2BAA2B;QACjD,UAAU,EAAE,SAAS;KACtB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,IAAI;QACV,eAAe,EAAE,iBAAiB;QAClC,oBAAoB,EAAE,iBAAiB;QACvC,oBAAoB,EAAE,qBAAqB;QAC3C,UAAU,EAAE,SAAS;KACtB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,IAAI;QACV,eAAe,EAAE,qBAAqB;QACtC,oBAAoB,EAAE,qBAAqB;QAC3C,oBAAoB,EAAE,yBAAyB;QAC/C,UAAU,EAAE,oBAAoB;KACjC;IACD;QACE,mEAAmE;QACnE,2EAA2E;QAC3E,0EAA0E;QAC1E,+EAA+E;QAC/E,4DAA4D;QAC5D,IAAI,EAAE,mBAAmB;QACzB,IAAI,EAAE,IAAI;QACV,eAAe,EAAE,wBAAwB;QACzC,oBAAoB,EAAE,wBAAwB;QAC9C,oBAAoB,EAAE,uBAAuB;QAC7C,UAAU,EAAE,QAAQ;KACrB;CACO,CAAC"}

package/dist/lib/plans-client.d.ts

@@ -1,69 +0,0 @@
-export interface PlansClientConfig {
-    readonly cloudUrl: string;
-    readonly bearer: string;
-}
-export declare class PlansClientError extends Error {
-    readonly status: number;
-    readonly body?: string | undefined;
-    constructor(status: number, message: string, body?: string | undefined);
-}
-/**
- * Resolve cloud config from env + dotfiles. Returns null when no
- * cloud config is present (callers surface that as
- * "olam cloud not configured; run olam auth setup-cloud or set
- * OLAM_CLOUD_URL").
- */
-export declare function resolveCloudConfig(): PlansClientConfig | null;
-export interface PlanSummary {
-    readonly plan_id: string;
-    readonly operator_id: string;
-    readonly status: 'pending' | 'active' | 'halted' | 'destroyed' | 'requires_reregistration_expired';
-    readonly mode: 'cloud' | 'goal';
-    readonly created_at: number;
-    readonly last_active_at: number | null;
-    readonly pinned_until: number | null;
-    readonly host_cp_url?: string;
-    readonly auth_recovery_callback_url?: string;
-    readonly has_recovery_callback: boolean;
-}
-export declare class PlansClient {
-    private readonly cfg;
-    constructor(cfg: PlansClientConfig);
-    /** Build the showcase Basic-auth header. */
-    private authHeader;
-    private request;
-    list(operator_id: string): Promise<readonly PlanSummary[]>;
-    show(plan_id: string, operator_id: string): Promise<PlanSummary>;
-    remove(plan_id: string, operator_id: string): Promise<void>;
-    /**
-     * Pin a plan to skip the TTL pruner until `pinned_until_ms`. Calls
-     * /v1/plans/update-urls with a synthetic body — but plans-index
-     * doesn't expose a pin path yet. v1 wires this via update-urls
-     * with a deliberate empty URL update + a sibling POST that we'll
-     * stub here pending B5+ follow-up. For now: throws not_implemented
-     * so the operator sees a clear error.
-     */
-    pin(_plan_id: string, _operator_id: string, _pinned_until_ms: number): Promise<void>;
-    unpin(_plan_id: string, _operator_id: string): Promise<void>;
-    reregister(plan_id: string, confirmation_token: string): Promise<void>;
-    /**
-     * C6 — Admin aggregate by operator. Requires admin_secret in
-     * X-Admin-Secret header (in addition to the operator's showcase
-     * Basic auth at the relay layer).
-     */
-    adminAggregate(admin_secret: string): Promise<AdminAggregateResponse>;
-}
-export interface OperatorAggregateRow {
-    readonly operator_id: string;
-    readonly plan_count: number;
-    readonly active_count: number;
-    readonly earliest_created_at: number;
-    readonly latest_created_at: number;
-    readonly usd_lifetime: number;
-    readonly days_active: number;
-}
-export interface AdminAggregateResponse {
-    readonly count: number;
-    readonly operators: readonly OperatorAggregateRow[];
-}
-//# sourceMappingURL=plans-client.d.ts.map

package/dist/lib/plans-client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"plans-client.d.ts","sourceRoot":"","sources":["../../src/lib/plans-client.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,gBAAiB,SAAQ,KAAK;aACb,MAAM,EAAE,MAAM;aAAmC,IAAI,CAAC,EAAE,MAAM;gBAA9D,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAkB,IAAI,CAAC,EAAE,MAAM,YAAA;CAI3F;AAYD;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,iBAAiB,GAAG,IAAI,CAQ7D;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,iCAAiC,CAAC;IACnG,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;CACzC;AAED,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,iBAAiB;IAEnD,4CAA4C;IAC5C,OAAO,CAAC,UAAU;YAKJ,OAAO;IAgBf,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC;IAS1D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAShE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjE;;;;;;;OAOG;IACG,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASpF,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS5D,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU5E;;;;OAIG;IACG,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAU5E;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACrD"}

package/dist/lib/plans-client.js

@@ -1,140 +0,0 @@
-// B5 — plans-client: HTTP client to plan-agent-do's /v1/plans/* relays.
-//
-// Cloud URL discovery:
-//   1. env var $OLAM_CLOUD_URL (preferred for ops scripts)
-//   2. ~/.olam/cloud-url file (operator-set; chmod 644)
-//
-// Bearer auth:
-//   The relay paths on plan-agent-do gate via showcase Basic auth
-//   (operator:$SHOWCASE_PASSWORD). v1 of this CLI reads
-//   $OLAM_SHOWCASE_PASSWORD or ~/.olam/showcase-password. A future
-//   pass replaces this with the operator-id-keyed bearer once the
-//   cloud-side auth flow lands.
-import * as fs from 'node:fs';
-import * as os from 'node:os';
-import * as path from 'node:path';
-export class PlansClientError extends Error {
-    status;
-    body;
-    constructor(status, message, body) {
-        super(message);
-        this.status = status;
-        this.body = body;
-        this.name = 'PlansClientError';
-    }
-}
-const OLAM_HOME = path.join(os.homedir(), '.olam');
-function readFileOrNull(p) {
-    try {
-        return fs.readFileSync(p, 'utf8').trim();
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Resolve cloud config from env + dotfiles. Returns null when no
- * cloud config is present (callers surface that as
- * "olam cloud not configured; run olam auth setup-cloud or set
- * OLAM_CLOUD_URL").
- */
-export function resolveCloudConfig() {
-    const cloudUrl = process.env.OLAM_CLOUD_URL
-        ?? readFileOrNull(path.join(OLAM_HOME, 'cloud-url'));
-    if (!cloudUrl)
-        return null;
-    const bearer = process.env.OLAM_SHOWCASE_PASSWORD
-        ?? readFileOrNull(path.join(OLAM_HOME, 'showcase-password'));
-    if (!bearer)
-        return null;
-    return { cloudUrl: cloudUrl.replace(/\/+$/, ''), bearer };
-}
-export class PlansClient {
-    cfg;
-    constructor(cfg) {
-        this.cfg = cfg;
-    }
-    /** Build the showcase Basic-auth header. */
-    authHeader() {
-        const credentials = Buffer.from(`operator:${this.cfg.bearer}`).toString('base64');
-        return `Basic ${credentials}`;
-    }
-    async request(path, init) {
-        const headers = {
-            Authorization: this.authHeader(),
-        };
-        if (init.body)
-            headers['content-type'] = 'application/json';
-        if (init.adminSecret)
-            headers['X-Admin-Secret'] = init.adminSecret;
-        return fetch(`${this.cfg.cloudUrl}${path}`, {
-            method: init.method,
-            headers,
-            body: init.body ? JSON.stringify(init.body) : undefined,
-        });
-    }
-    async list(operator_id) {
-        const res = await this.request(`/v1/plans/list?operator_id=${encodeURIComponent(operator_id)}`, {
-            method: 'GET',
-        });
-        if (!res.ok)
-            throw new PlansClientError(res.status, `list failed: ${res.status}`, await res.text());
-        const json = (await res.json());
-        return json.plans;
-    }
-    async show(plan_id, operator_id) {
-        const res = await this.request(`/v1/plans/${encodeURIComponent(plan_id)}?operator_id=${encodeURIComponent(operator_id)}`, { method: 'GET' });
-        if (!res.ok)
-            throw new PlansClientError(res.status, `show failed: ${res.status}`, await res.text());
-        return (await res.json());
-    }
-    async remove(plan_id, operator_id) {
-        const res = await this.request(`/v1/plans/${encodeURIComponent(plan_id)}?operator_id=${encodeURIComponent(operator_id)}`, { method: 'DELETE' });
-        if (!res.ok && res.status !== 404) {
-            throw new PlansClientError(res.status, `delete failed: ${res.status}`, await res.text());
-        }
-    }
-    /**
-     * Pin a plan to skip the TTL pruner until `pinned_until_ms`. Calls
-     * /v1/plans/update-urls with a synthetic body — but plans-index
-     * doesn't expose a pin path yet. v1 wires this via update-urls
-     * with a deliberate empty URL update + a sibling POST that we'll
-     * stub here pending B5+ follow-up. For now: throws not_implemented
-     * so the operator sees a clear error.
-     */
-    async pin(_plan_id, _operator_id, _pinned_until_ms) {
-        throw new PlansClientError(501, 'olam plans pin: not yet implemented.\n' +
-            '  The pin/unpin endpoint is queued for plan-DO B5+. Tracking in CLI audit #1406 (Top-2 priority #1).\n' +
-            '  Workaround: edit the plan tracker frontmatter directly to add `pinned: true`.');
-    }
-    async unpin(_plan_id, _operator_id) {
-        throw new PlansClientError(501, 'olam plans unpin: not yet implemented.\n' +
-            '  The pin/unpin endpoint is queued for plan-DO B5+. Tracking in CLI audit #1406 (Top-2 priority #1).\n' +
-            '  Workaround: edit the plan tracker frontmatter directly to remove `pinned` or set `pinned: null`.');
-    }
-    async reregister(plan_id, confirmation_token) {
-        const res = await this.request('/v1/plans/re-register', {
-            method: 'POST',
-            body: { plan_id, confirmation_token },
-        });
-        if (!res.ok) {
-            throw new PlansClientError(res.status, `re-register failed: ${res.status}`, await res.text());
-        }
-    }
-    /**
-     * C6 — Admin aggregate by operator. Requires admin_secret in
-     * X-Admin-Secret header (in addition to the operator's showcase
-     * Basic auth at the relay layer).
-     */
-    async adminAggregate(admin_secret) {
-        const res = await this.request('/v1/admin/aggregate-by-operator', {
-            method: 'GET',
-            adminSecret: admin_secret,
-        });
-        if (!res.ok) {
-            throw new PlansClientError(res.status, `aggregate failed: ${res.status}`, await res.text());
-        }
-        return (await res.json());
-    }
-}
-//# sourceMappingURL=plans-client.js.map

package/dist/lib/plans-client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plans-client.js","sourceRoot":"","sources":["../../src/lib/plans-client.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,uBAAuB;AACvB,2DAA2D;AAC3D,wDAAwD;AACxD,EAAE;AACF,eAAe;AACf,kEAAkE;AAClE,wDAAwD;AACxD,mEAAmE;AACnE,kEAAkE;AAClE,gCAAgC;AAEhC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAOlC,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACb;IAAiD;IAA7E,YAA4B,MAAc,EAAE,OAAe,EAAkB,IAAa;QACxF,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,WAAM,GAAN,MAAM,CAAQ;QAAmC,SAAI,GAAJ,IAAI,CAAS;QAExF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AAEnD,SAAS,cAAc,CAAC,CAAS;IAC/B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc;WACtC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB;WAC5C,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC;AAeD,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,GAAsB;QAAtB,QAAG,GAAH,GAAG,CAAmB;IAAG,CAAC;IAEvD,4CAA4C;IACpC,UAAU;QAChB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClF,OAAO,SAAS,WAAW,EAAE,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,IAAY,EACZ,IAAiF;QAEjF,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,IAAI,CAAC,UAAU,EAAE;SACjC,CAAC;QACF,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC5D,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;QACnE,OAAO,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,IAAI,EAAE,EAAE;YAC1C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SACxD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,WAAmB;QAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,8BAA8B,kBAAkB,CAAC,WAAW,CAAC,EAAE,EAAE;YAC9F,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACpG,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4C,CAAC;QAC3E,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,WAAmB;QAC7C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAC5B,aAAa,kBAAkB,CAAC,OAAO,CAAC,gBAAgB,kBAAkB,CAAC,WAAW,CAAC,EAAE,EACzF,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACpG,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgB,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,WAAmB;QAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAC5B,aAAa,kBAAkB,CAAC,OAAO,CAAC,gBAAgB,kBAAkB,CAAC,WAAW,CAAC,EAAE,EACzF,EAAE,MAAM,EAAE,QAAQ,EAAE,CACrB,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,CAAC,QAAgB,EAAE,YAAoB,EAAE,gBAAwB;QACxE,MAAM,IAAI,gBAAgB,CACxB,GAAG,EACH,wCAAwC;YACtC,wGAAwG;YACxG,iFAAiF,CACpF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,YAAoB;QAChD,MAAM,IAAI,gBAAgB,CACxB,GAAG,EACH,0CAA0C;YACxC,wGAAwG;YACxG,oGAAoG,CACvG,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,kBAA0B;QAC1D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,uBAAuB,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,YAAoB;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,iCAAiC,EAAE;YAChE,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,YAAY;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,qBAAqB,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;IACtD,CAAC;CACF"}