@pleri/olam-cli 0.1.201 → 0.1.205

package/dist/lib/port-forward.d.ts

@@ -1,168 +0,0 @@
-/**
- * port-forward.ts — kubectl port-forward lifecycle manager for olam-cli.
- *
- * Phase 1b C1 of olam-host-suite-phase-1b-k3s-beta-flavour (plan
- * ~/.claude/plans/olam-host-suite-phase-1b-k3s-beta-flavour.md).
- *
- * Phase 2 Phase B B2 (olam-host-suite-phase-2-peripheral-services-on-k3s):
- *   Extended with registry-driven multi-peripheral support:
- *     spawnAllPeripheralPortForwards() — iterate PERIPHERALS; spawn each in parallel
- *     stopAllPeripheralPortForwards()  — SIGTERM each peripheral's port-forward
- *     getPeripheralLivenessSnapshot()  — TCP probe all 4 peripherals; return {name, alive}[]
- *   Each peripheral uses its own independent flock + PID file named by peripheral.name.
- *   host-cp port-forward retained as a named special-case; Phase 1b callers unchanged.
- *
- * Decisions consumed:
- *   D17 — port-forward spawn via flock advisory lock (race-safe)
- *   D23 — PID file at ~/.olam/state/port-forward.pid (mode 0600)
- *   D24 — probePortForwardLiveness uses TCP probe, NOT kill(pid, 0)
- *   D26 — per-peripheral PID/lock at ~/.olam/state/port-forward-<name>.{pid,lock}
- *
- * ## Flock strategy (why O_CREAT|O_EXCL, not POSIX flock(2))
- *
- * Node.js has no built-in `flock(2)` syscall binding. Instead we use
- * `fs.openSync(lockPath, 'wx')` which maps to `open(O_CREAT|O_EXCL|O_WRONLY)`.
- * On POSIX this is atomic: exactly ONE caller will succeed; concurrent callers
- * receive EEXIST. This is semantically equivalent to a non-blocking `flock`
- * for our scenario (guard the read-check-spawn sequence against concurrent
- * `olam upgrade` / `olam status` invocations). POSIX flock would additionally
- * survive fd inheritance across forks — we don't need that here because the
- * lock scope is only the spawn decision, not the port-forward subprocess lifetime.
- * Lock release: `unlinkSync(lockPath)` in a finally block.
- *
- * ## PID file lifecycle
- *   1. Acquire lock (O_CREAT|O_EXCL on lock file).
- *   2. Read PID file (if present) → TCP-probe liveness of existing forward.
- *   3. If live → release lock; return (nothing to do).
- *   4. Write PID file to a tmp path, set mode 0600, rename atomically.
- *   5. Spawn kubectl port-forward.
- *   6. Release lock.
- *   7. Port-forward runs detached (stderr suppressed); PID file removed on exit.
- *
- * ## TCP probe (D24)
- *
- * `probePortForwardLiveness` opens a TCP connection to 127.0.0.1:19000.
- * `kill(pid, 0)` would only check process existence — it cannot distinguish
- * "port-forward process alive but tunnel broken" from "tunnel working". TCP
- * is the ground truth.
- */
-import { spawn } from 'node:child_process';
-import * as path from 'node:path';
-import * as os from 'node:os';
-import { type Peripheral } from './peripheral-registry.js';
-export declare const PORT_FORWARD_PORT = 19000;
-export declare const PORT_FORWARD_LOCK_PATH: string;
-export declare const PORT_FORWARD_PID_PATH: string;
-export interface PortForwardDeps {
-    /** inject for tests — overrides the state dir used for lock + PID files */
-    readonly stateDir?: string;
-    /** inject for tests — overrides the spawn factory */
-    readonly spawnImpl?: typeof spawn;
-    /** inject for tests — overrides TCP probe */
-    readonly tcpProbeImpl?: (host: string, port: number, timeoutMs: number) => Promise<boolean>;
-    /** inject for tests — overrides Date.now() for timestamp assertions */
-    readonly now?: () => number;
-}
-/**
- * Probe liveness of the port-forward tunnel via a TCP connection attempt.
- *
- * Returns true only when a TCP connection to 127.0.0.1:PORT_FORWARD_PORT
- * succeeds. PID-alive check (kill(pid, 0)) is intentionally NOT used —
- * the process could be alive but the tunnel broken (per D24).
- *
- * Injectable: `deps.tcpProbeImpl` replaces the real TCP socket for tests.
- */
-export declare function probePortForwardLiveness(deps?: Pick<PortForwardDeps, 'tcpProbeImpl'>): Promise<boolean>;
-export type SpawnPortForwardResult = {
-    spawned: true;
-    pid: number;
-} | {
-    spawned: false;
-    reason: 'live' | 'lock-held';
-};
-/**
- * Spawn a `kubectl port-forward` subprocess, guarded by an advisory lock
- * so concurrent callers produce exactly ONE running port-forward process.
- *
- * Protocol:
- *   1. Acquire advisory lock (throws on concurrent access → returns 'lock-held').
- *   2. TCP-probe liveness of any existing port-forward.
- *   3. If live → release lock; return { spawned: false, reason: 'live' }.
- *   4. Spawn kubectl port-forward (detached, stdio ignored).
- *   5. Write PID file atomically (mode 0600).
- *   6. Release lock.
- *   7. Unref child so the CLI process can exit without waiting for it.
- *   8. Register 'exit' listener on child to remove the PID file on teardown.
- *
- * @param context - kubectl context name (--context flag)
- * @param namespace - target namespace
- * @param target - service or pod target (e.g. 'service/olam-host-cp')
- * @param localPort - local port to bind (default: PORT_FORWARD_PORT)
- * @param remotePort - remote port on the target (default: PORT_FORWARD_PORT)
- * @param deps - injectable dependencies for testing
- */
-export declare function spawnPortForward(context: string, namespace: string, target: string, localPort?: number, remotePort?: number, deps?: PortForwardDeps): Promise<SpawnPortForwardResult>;
-/**
- * Kill a running port-forward identified by the PID file and remove the file.
- * No-op when no PID file exists. Returns true when a process was signalled.
- */
-export declare function stopPortForward(deps?: PortForwardDeps): boolean;
-/**
- * Options for peripheral port-forward operations (injectable for tests).
- * Extends the same deps pattern as the host-cp single port-forward.
- */
-export interface PeripheralPortForwardDeps {
-    /** Override state directory (default: OLAM_STATE_DIR). Used in tests to isolate state. */
-    readonly stateDir?: string;
-    /** Override spawn factory (default: child_process.spawn). */
-    readonly spawnImpl?: typeof spawn;
-    /** Override TCP probe (default: real TCP socket). */
-    readonly tcpProbeImpl?: (host: string, port: number, timeoutMs: number) => Promise<boolean>;
-}
-/**
- * Spawn a kubectl port-forward for a single peripheral, guarded by an
- * independent advisory lock per peripheral. Mirrors the Phase 1b host-cp
- * pattern (D17/D23/D24) generalised to any Peripheral entry.
- *
- * Returns true when a new process was spawned; false when the tunnel was
- * already live or the lock was held by a concurrent caller.
- *
- * @internal — called by spawnAllPeripheralPortForwards; exported for test injection.
- */
-export declare function spawnPeripheralPortForward(peripheral: Peripheral, context: string, namespace: string, deps?: PeripheralPortForwardDeps): Promise<boolean>;
-/**
- * Spawn kubectl port-forward processes for all 4 peripherals in parallel.
- *
- * Each peripheral uses its own independent flock + PID file
- * (`~/.olam/state/port-forward-<name>.{lock,pid}`), so locking one
- * peripheral does NOT block another.
- *
- * @param context - kubectl context name (--context flag); defaults to 'olam'
- * @param namespace - target namespace; defaults to 'olam'
- * @param deps - injectable dependencies for testing
- */
-export declare function spawnAllPeripheralPortForwards(context?: string, namespace?: string, deps?: PeripheralPortForwardDeps): Promise<void>;
-/**
- * Send SIGTERM to all running peripheral port-forward processes and
- * remove their PID and lock files.
- *
- * No-op for any peripheral whose PID file is absent (process already stopped).
- *
- * @param deps - injectable dependencies for testing (stateDir override)
- */
-export declare function stopAllPeripheralPortForwards(deps?: Pick<PeripheralPortForwardDeps, 'stateDir'>): void;
-export interface PeripheralLivenessEntry {
-    name: string;
-    alive: boolean;
-}
-/**
- * TCP-probe each peripheral and return a snapshot of their liveness.
- *
- * Uses the same realTcpProbe utility as probePortForwardLiveness (D24).
- * Probes run in parallel for speed.
- *
- * @param deps - injectable dependencies for testing
- */
-export declare function getPeripheralLivenessSnapshot(deps?: Pick<PeripheralPortForwardDeps, 'tcpProbeImpl'>): Promise<PeripheralLivenessEntry[]>;
-export { os, path };
-//# sourceMappingURL=port-forward.d.ts.map

package/dist/lib/port-forward.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"port-forward.d.ts","sourceRoot":"","sources":["../../src/lib/port-forward.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAG3C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAExE,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AACvC,eAAO,MAAM,sBAAsB,QAAiD,CAAC;AACrF,eAAO,MAAM,qBAAqB,QAAgD,CAAC;AAKnF,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5F,uEAAuE;IACvE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,GAAE,IAAI,CAAC,eAAe,EAAE,cAAc,CAAM,GAC/C,OAAO,CAAC,OAAO,CAAC,CAGlB;AA8ED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAAA;CAAE,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,MAA0B,EACrC,UAAU,GAAE,MAA0B,EACtC,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,sBAAsB,CAAC,CAgEjC;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAWnE;AAID;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,0FAA0F;IAC1F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,qDAAqD;IACrD,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7F;AAoBD;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,yBAA8B,GACnC,OAAO,CAAC,OAAO,CAAC,CAkElB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,SAAS,EAChB,SAAS,SAAS,EAClB,IAAI,GAAE,yBAA8B,GACnC,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,GAAE,IAAI,CAAC,yBAAyB,EAAE,UAAU,CAAM,GACrD,IAAI,CAYN;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAsB,6BAA6B,CACjD,IAAI,GAAE,IAAI,CAAC,yBAAyB,EAAE,cAAc,CAAM,GACzD,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAQpC;AAGD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC"}

package/dist/lib/port-forward.js

@@ -1,393 +0,0 @@
-/**
- * port-forward.ts — kubectl port-forward lifecycle manager for olam-cli.
- *
- * Phase 1b C1 of olam-host-suite-phase-1b-k3s-beta-flavour (plan
- * ~/.claude/plans/olam-host-suite-phase-1b-k3s-beta-flavour.md).
- *
- * Phase 2 Phase B B2 (olam-host-suite-phase-2-peripheral-services-on-k3s):
- *   Extended with registry-driven multi-peripheral support:
- *     spawnAllPeripheralPortForwards() — iterate PERIPHERALS; spawn each in parallel
- *     stopAllPeripheralPortForwards()  — SIGTERM each peripheral's port-forward
- *     getPeripheralLivenessSnapshot()  — TCP probe all 4 peripherals; return {name, alive}[]
- *   Each peripheral uses its own independent flock + PID file named by peripheral.name.
- *   host-cp port-forward retained as a named special-case; Phase 1b callers unchanged.
- *
- * Decisions consumed:
- *   D17 — port-forward spawn via flock advisory lock (race-safe)
- *   D23 — PID file at ~/.olam/state/port-forward.pid (mode 0600)
- *   D24 — probePortForwardLiveness uses TCP probe, NOT kill(pid, 0)
- *   D26 — per-peripheral PID/lock at ~/.olam/state/port-forward-<name>.{pid,lock}
- *
- * ## Flock strategy (why O_CREAT|O_EXCL, not POSIX flock(2))
- *
- * Node.js has no built-in `flock(2)` syscall binding. Instead we use
- * `fs.openSync(lockPath, 'wx')` which maps to `open(O_CREAT|O_EXCL|O_WRONLY)`.
- * On POSIX this is atomic: exactly ONE caller will succeed; concurrent callers
- * receive EEXIST. This is semantically equivalent to a non-blocking `flock`
- * for our scenario (guard the read-check-spawn sequence against concurrent
- * `olam upgrade` / `olam status` invocations). POSIX flock would additionally
- * survive fd inheritance across forks — we don't need that here because the
- * lock scope is only the spawn decision, not the port-forward subprocess lifetime.
- * Lock release: `unlinkSync(lockPath)` in a finally block.
- *
- * ## PID file lifecycle
- *   1. Acquire lock (O_CREAT|O_EXCL on lock file).
- *   2. Read PID file (if present) → TCP-probe liveness of existing forward.
- *   3. If live → release lock; return (nothing to do).
- *   4. Write PID file to a tmp path, set mode 0600, rename atomically.
- *   5. Spawn kubectl port-forward.
- *   6. Release lock.
- *   7. Port-forward runs detached (stderr suppressed); PID file removed on exit.
- *
- * ## TCP probe (D24)
- *
- * `probePortForwardLiveness` opens a TCP connection to 127.0.0.1:19000.
- * `kill(pid, 0)` would only check process existence — it cannot distinguish
- * "port-forward process alive but tunnel broken" from "tunnel working". TCP
- * is the ground truth.
- */
-import { spawn } from 'node:child_process';
-import * as fs from 'node:fs';
-import * as net from 'node:net';
-import * as path from 'node:path';
-import * as os from 'node:os';
-import { OLAM_STATE_DIR } from './config.js';
-import { PERIPHERALS } from './peripheral-registry.js';
-export const PORT_FORWARD_PORT = 19000;
-export const PORT_FORWARD_LOCK_PATH = path.join(OLAM_STATE_DIR, 'port-forward.lock');
-export const PORT_FORWARD_PID_PATH = path.join(OLAM_STATE_DIR, 'port-forward.pid');
-/** TCP probe timeout (ms). Fast enough to feel snappy; generous enough for loopback. */
-const TCP_PROBE_TIMEOUT_MS = 2_000;
-/**
- * Probe liveness of the port-forward tunnel via a TCP connection attempt.
- *
- * Returns true only when a TCP connection to 127.0.0.1:PORT_FORWARD_PORT
- * succeeds. PID-alive check (kill(pid, 0)) is intentionally NOT used —
- * the process could be alive but the tunnel broken (per D24).
- *
- * Injectable: `deps.tcpProbeImpl` replaces the real TCP socket for tests.
- */
-export async function probePortForwardLiveness(deps = {}) {
-    const probe = deps.tcpProbeImpl ?? realTcpProbe;
-    return probe('127.0.0.1', PORT_FORWARD_PORT, TCP_PROBE_TIMEOUT_MS);
-}
-function realTcpProbe(host, port, timeoutMs) {
-    return new Promise((resolve) => {
-        const socket = new net.Socket();
-        let done = false;
-        function finish(result) {
-            if (done)
-                return;
-            done = true;
-            socket.destroy();
-            resolve(result);
-        }
-        const timer = setTimeout(() => finish(false), timeoutMs);
-        socket.once('connect', () => { clearTimeout(timer); finish(true); });
-        socket.once('error', () => { clearTimeout(timer); finish(false); });
-        socket.once('timeout', () => { clearTimeout(timer); finish(false); });
-        socket.connect(port, host);
-    });
-}
-/**
- * Acquire the flock advisory lock (O_CREAT|O_EXCL). Returns a release function.
- * Throws with code EEXIST when the lock is already held by a concurrent caller.
- *
- * The lock file is only held for the duration of the read-check-spawn sequence;
- * it is not held for the port-forward subprocess lifetime.
- */
-function acquireAdvisoryLock(lockPath) {
-    // O_CREAT|O_EXCL|O_WRONLY — POSIX atomic create; throws EEXIST if already exists
-    const fd = fs.openSync(lockPath, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY);
-    fs.closeSync(fd);
-    return () => {
-        try {
-            fs.unlinkSync(lockPath);
-        }
-        catch { /* already removed; best-effort */ }
-    };
-}
-function pidFilePath(deps) {
-    const stateDir = deps.stateDir ?? OLAM_STATE_DIR;
-    return path.join(stateDir, 'port-forward.pid');
-}
-function lockFilePath(deps) {
-    const stateDir = deps.stateDir ?? OLAM_STATE_DIR;
-    return path.join(stateDir, 'port-forward.lock');
-}
-/**
- * Ensure the state directory exists, then atomically write a PID file
- * to a tmp path and rename into place (mode 0600).
- */
-function writePidFile(pidPath, pid) {
-    const dir = path.dirname(pidPath);
-    if (!fs.existsSync(dir)) {
-        fs.mkdirSync(dir, { recursive: true });
-    }
-    const tmp = `${pidPath}.tmp.${process.pid}`;
-    fs.writeFileSync(tmp, String(pid) + '\n', { encoding: 'utf8', mode: 0o600 });
-    fs.renameSync(tmp, pidPath);
-}
-/**
- * Read the PID from the PID file. Returns null when the file is absent
- * or its content is not a valid positive integer.
- */
-function readPidFile(pidPath) {
-    if (!fs.existsSync(pidPath))
-        return null;
-    try {
-        const raw = fs.readFileSync(pidPath, 'utf8').trim();
-        const n = Number.parseInt(raw, 10);
-        if (!Number.isInteger(n) || n <= 0)
-            return null;
-        return n;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Spawn a `kubectl port-forward` subprocess, guarded by an advisory lock
- * so concurrent callers produce exactly ONE running port-forward process.
- *
- * Protocol:
- *   1. Acquire advisory lock (throws on concurrent access → returns 'lock-held').
- *   2. TCP-probe liveness of any existing port-forward.
- *   3. If live → release lock; return { spawned: false, reason: 'live' }.
- *   4. Spawn kubectl port-forward (detached, stdio ignored).
- *   5. Write PID file atomically (mode 0600).
- *   6. Release lock.
- *   7. Unref child so the CLI process can exit without waiting for it.
- *   8. Register 'exit' listener on child to remove the PID file on teardown.
- *
- * @param context - kubectl context name (--context flag)
- * @param namespace - target namespace
- * @param target - service or pod target (e.g. 'service/olam-host-cp')
- * @param localPort - local port to bind (default: PORT_FORWARD_PORT)
- * @param remotePort - remote port on the target (default: PORT_FORWARD_PORT)
- * @param deps - injectable dependencies for testing
- */
-export async function spawnPortForward(context, namespace, target, localPort = PORT_FORWARD_PORT, remotePort = PORT_FORWARD_PORT, deps = {}) {
-    const lockPath = lockFilePath(deps);
-    const pidPath = pidFilePath(deps);
-    const spawnImpl = deps.spawnImpl ?? spawn;
-    // Ensure state dir exists before trying to create lock file
-    const stateDir = deps.stateDir ?? OLAM_STATE_DIR;
-    if (!fs.existsSync(stateDir)) {
-        fs.mkdirSync(stateDir, { recursive: true });
-    }
-    let releaseLock = null;
-    try {
-        releaseLock = acquireAdvisoryLock(lockPath);
-    }
-    catch (err) {
-        const code = err.code;
-        if (code === 'EEXIST') {
-            return { spawned: false, reason: 'lock-held' };
-        }
-        throw err;
-    }
-    try {
-        // TCP-probe any existing port-forward before deciding to spawn.
-        const live = await probePortForwardLiveness(deps);
-        if (live) {
-            return { spawned: false, reason: 'live' };
-        }
-        // Spawn kubectl port-forward detached so the CLI can exit independently.
-        const child = spawnImpl('kubectl', [
-            '--context', context,
-            'port-forward',
-            '-n', namespace,
-            target,
-            `${localPort}:${remotePort}`,
-        ], {
-            stdio: ['ignore', 'ignore', 'ignore'],
-            detached: true,
-        });
-        if (typeof child.pid !== 'number' || child.pid <= 0) {
-            return { spawned: false, reason: 'lock-held' }; // spawn failed; surface as non-fatal
-        }
-        // Atomic PID file write (tmp → rename, mode 0600).
-        writePidFile(pidPath, child.pid);
-        // Unref so the parent CLI process can exit without waiting for the tunnel.
-        child.unref();
-        // Best-effort PID file cleanup when the port-forward exits.
-        child.once('exit', () => {
-            try {
-                fs.unlinkSync(pidPath);
-            }
-            catch { /* already gone */ }
-        });
-        return { spawned: true, pid: child.pid };
-    }
-    finally {
-        releaseLock();
-    }
-}
-/**
- * Kill a running port-forward identified by the PID file and remove the file.
- * No-op when no PID file exists. Returns true when a process was signalled.
- */
-export function stopPortForward(deps = {}) {
-    const pidPath = pidFilePath(deps);
-    const pid = readPidFile(pidPath);
-    if (pid === null)
-        return false;
-    try {
-        process.kill(pid, 'SIGTERM');
-    }
-    catch {
-        // ESRCH: already dead; fine.
-    }
-    try {
-        fs.unlinkSync(pidPath);
-    }
-    catch { /* already gone */ }
-    return true;
-}
-/**
- * Build the PID file path for a peripheral by name.
- * Path: <stateDir>/port-forward-<name>.pid
- */
-function peripheralPidPath(name, stateDir) {
-    return path.join(stateDir, `port-forward-${name}.pid`);
-}
-/**
- * Build the lock file path for a peripheral by name.
- * Path: <stateDir>/port-forward-<name>.lock
- * Each peripheral gets its own independent lock file (D26: locking auth-service
- * must NOT block mcp-auth-service).
- */
-function peripheralLockPath(name, stateDir) {
-    return path.join(stateDir, `port-forward-${name}.lock`);
-}
-/**
- * Spawn a kubectl port-forward for a single peripheral, guarded by an
- * independent advisory lock per peripheral. Mirrors the Phase 1b host-cp
- * pattern (D17/D23/D24) generalised to any Peripheral entry.
- *
- * Returns true when a new process was spawned; false when the tunnel was
- * already live or the lock was held by a concurrent caller.
- *
- * @internal — called by spawnAllPeripheralPortForwards; exported for test injection.
- */
-export async function spawnPeripheralPortForward(peripheral, context, namespace, deps = {}) {
-    const stateDir = deps.stateDir ?? OLAM_STATE_DIR;
-    const spawnImpl = deps.spawnImpl ?? spawn;
-    const tcpProbeImpl = deps.tcpProbeImpl ?? realTcpProbe;
-    // Ensure state dir exists.
-    if (!fs.existsSync(stateDir)) {
-        fs.mkdirSync(stateDir, { recursive: true });
-    }
-    const lockPath = peripheralLockPath(peripheral.name, stateDir);
-    const pidPath = peripheralPidPath(peripheral.name, stateDir);
-    let releaseLock = null;
-    try {
-        releaseLock = acquireAdvisoryLock(lockPath);
-    }
-    catch (err) {
-        const code = err.code;
-        if (code === 'EEXIST') {
-            return false; // lock held by concurrent caller
-        }
-        throw err;
-    }
-    try {
-        // TCP-probe any existing port-forward before deciding to spawn (D24).
-        const alive = await tcpProbeImpl('127.0.0.1', peripheral.port, TCP_PROBE_TIMEOUT_MS);
-        if (alive) {
-            return false; // tunnel already live
-        }
-        // Spawn kubectl port-forward detached (stdio ignored).
-        const child = spawnImpl('kubectl', [
-            '--context', context,
-            'port-forward',
-            '-n', namespace,
-            `service/${peripheral.k8sResourceName}`,
-            `${peripheral.port}:${peripheral.port}`,
-        ], {
-            stdio: ['ignore', 'ignore', 'ignore'],
-            detached: true,
-        });
-        if (typeof child.pid !== 'number' || child.pid <= 0) {
-            return false; // spawn failed; non-fatal
-        }
-        // Atomic PID file write (tmp → rename, mode 0600).
-        writePidFile(pidPath, child.pid);
-        // Unref so the parent CLI process can exit without waiting for the tunnel.
-        child.unref();
-        // Best-effort PID file cleanup when the port-forward exits.
-        child.once('exit', () => {
-            try {
-                fs.unlinkSync(pidPath);
-            }
-            catch { /* already gone */ }
-        });
-        return true;
-    }
-    finally {
-        releaseLock();
-    }
-}
-/**
- * Spawn kubectl port-forward processes for all 4 peripherals in parallel.
- *
- * Each peripheral uses its own independent flock + PID file
- * (`~/.olam/state/port-forward-<name>.{lock,pid}`), so locking one
- * peripheral does NOT block another.
- *
- * @param context - kubectl context name (--context flag); defaults to 'olam'
- * @param namespace - target namespace; defaults to 'olam'
- * @param deps - injectable dependencies for testing
- */
-export async function spawnAllPeripheralPortForwards(context = 'olam', namespace = 'olam', deps = {}) {
-    await Promise.all(PERIPHERALS.map((p) => spawnPeripheralPortForward(p, context, namespace, deps)));
-}
-/**
- * Send SIGTERM to all running peripheral port-forward processes and
- * remove their PID and lock files.
- *
- * No-op for any peripheral whose PID file is absent (process already stopped).
- *
- * @param deps - injectable dependencies for testing (stateDir override)
- */
-export function stopAllPeripheralPortForwards(deps = {}) {
-    const stateDir = deps.stateDir ?? OLAM_STATE_DIR;
-    for (const p of PERIPHERALS) {
-        const pidPath = peripheralPidPath(p.name, stateDir);
-        const lockPath = peripheralLockPath(p.name, stateDir);
-        const pid = readPidFile(pidPath);
-        if (pid !== null) {
-            try {
-                process.kill(pid, 'SIGTERM');
-            }
-            catch { /* ESRCH: already dead; fine */ }
-        }
-        try {
-            fs.unlinkSync(pidPath);
-        }
-        catch { /* already gone */ }
-        try {
-            fs.unlinkSync(lockPath);
-        }
-        catch { /* already gone */ }
-    }
-}
-/**
- * TCP-probe each peripheral and return a snapshot of their liveness.
- *
- * Uses the same realTcpProbe utility as probePortForwardLiveness (D24).
- * Probes run in parallel for speed.
- *
- * @param deps - injectable dependencies for testing
- */
-export async function getPeripheralLivenessSnapshot(deps = {}) {
-    const tcpProbeImpl = deps.tcpProbeImpl ?? realTcpProbe;
-    return Promise.all(PERIPHERALS.map(async (p) => {
-        const alive = await tcpProbeImpl('127.0.0.1', p.port, TCP_PROBE_TIMEOUT_MS);
-        return { name: p.name, alive };
-    }));
-}
-// Re-export so tests can import from this module without needing os/path.
-export { os, path };
-//# sourceMappingURL=port-forward.js.map

package/dist/lib/port-forward.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"port-forward.js","sourceRoot":"","sources":["../../src/lib/port-forward.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAmB,MAAM,0BAA0B,CAAC;AAExE,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AACvC,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;AACrF,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;AAEnF,wFAAwF;AACxF,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAanC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAA8C,EAAE;IAEhD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC;IAChD,OAAO,KAAK,CAAC,WAAW,EAAE,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY,EAAE,SAAiB;IACjE,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,IAAI,GAAG,KAAK,CAAC;QAEjB,SAAS,MAAM,CAAC,MAAe;YAC7B,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,iFAAiF;IACjF,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACrG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,GAAG,EAAE;QACV,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;IAC/E,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAqB;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,YAAY,CAAC,IAAqB;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,OAAe,EAAE,GAAW;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,OAAO,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IAC5C,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAMD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,SAAiB,EACjB,MAAc,EACd,YAAoB,iBAAiB,EACrC,aAAqB,iBAAiB,EACtC,OAAwB,EAAE;IAE1B,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAE1C,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC;IACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,WAAW,GAAwB,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5C,CAAC;QAED,yEAAyE;QACzE,MAAM,KAAK,GAAG,SAAS,CACrB,SAAS,EACT;YACE,WAAW,EAAE,OAAO;YACpB,cAAc;YACd,IAAI,EAAE,SAAS;YACf,MAAM;YACN,GAAG,SAAS,IAAI,UAAU,EAAE;SAC7B,EACD;YACE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;YACrC,QAAQ,EAAE,IAAI;SACf,CACF,CAAC;QAEF,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,qCAAqC;QACvF,CAAC;QAED,mDAAmD;QACnD,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAEjC,2EAA2E;QAC3E,KAAK,CAAC,KAAK,EAAE,CAAC;QAEd,4DAA4D;QAC5D,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YACtB,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAC3C,CAAC;YAAS,CAAC;QACT,WAAW,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAwB,EAAE;IACxD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B;IAC/B,CAAC;IACD,IAAI,CAAC;QAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAiBD;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,IAAI,MAAM,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY,EAAE,QAAgB;IACxD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,IAAI,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,UAAsB,EACtB,OAAe,EACf,SAAiB,EACjB,OAAkC,EAAE;IAEpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC;IAEvD,2BAA2B;IAC3B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE7D,IAAI,WAAW,GAAwB,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,CAAC,iCAAiC;QACjD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,sEAAsE;QACtE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;QACrF,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,CAAC,sBAAsB;QACtC,CAAC;QAED,uDAAuD;QACvD,MAAM,KAAK,GAAG,SAAS,CACrB,SAAS,EACT;YACE,WAAW,EAAE,OAAO;YACpB,cAAc;YACd,IAAI,EAAE,SAAS;YACf,WAAW,UAAU,CAAC,eAAe,EAAE;YACvC,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE;SACxC,EACD;YACE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;YACrC,QAAQ,EAAE,IAAI;SACf,CACF,CAAC;QAEF,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC,CAAC,0BAA0B;QAC1C,CAAC;QAED,mDAAmD;QACnD,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAEjC,2EAA2E;QAC3E,KAAK,CAAC,KAAK,EAAE,CAAC;QAEd,4DAA4D;QAC5D,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YACtB,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,WAAW,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAO,GAAG,MAAM,EAChB,SAAS,GAAG,MAAM,EAClB,OAAkC,EAAE;IAEpC,MAAM,OAAO,CAAC,GAAG,CACf,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAChF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAoD,EAAE;IAEtD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,+BAA+B,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC5D,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAwD,EAAE;IAE1D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC;IACvD,OAAO,OAAO,CAAC,GAAG,CAChB,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1B,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;QAC5E,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC"}

package/dist/lib/shell-rc.d.ts

@@ -1,90 +0,0 @@
-/**
- * shell-rc.ts — Idempotent shell-rc file append + timestamped backup.
- *
- * Phase C1 of olam-operator-onboarding-parity (plan
- * ~/.claude/plans/olam-operator-onboarding-parity.md).
- *
- * Phase C's `olam setup` wizard offers to add
- *   eval "$(olam completion zsh)"
- * to the operator's `~/.zshrc` / `~/.bashrc`. This module is the safety
- * layer that:
- *
- *   1. Grep-checks a marker substring before writing — re-running the
- *      wizard is a no-op (no duplicate eval lines, no n-times appended).
- *   2. Backs the file up to `<rcPath>.olam-bak.<ISO-timestamp>` before
- *      ANY mutation — recoverable if the operator decides they didn't
- *      want the line.
- *   3. Writes atomically via tmp-file + rename — `kill -9` mid-write
- *      can't leave a half-written rc file.
- *
- * Decision 6 (plan): mirrors adb's `phase_mise_activation` pattern; the
- * idempotency + backup pair is the operator-UX floor.
- *
- * Risk T4 mitigation (per plan + design doc): the grep-for-marker check
- * uses `String.includes` not a per-line scan — a marker can match across
- * whitespace if needed. The backup runs unconditionally before the
- * append; corrupted rc states are recoverable via `mv <backup> <rcPath>`.
- */
-export type AppendStatus = 'appended' | 'already-present' | 'no-rc-file';
-export interface AppendResult {
-    readonly status: AppendStatus;
-    /** Path to the timestamped backup file. `null` when `status !== 'appended'`. */
-    readonly backupPath: string | null;
-}
-export interface AppendOptions {
-    /** Absolute path to the operator's shell rc (e.g. `/Users/me/.zshrc`). */
-    readonly rcPath: string;
-    /**
-     * Substring searched for in the rc to detect "already present."
-     * Convention: a short stable token (e.g. `olam completion`) — distinct
-     * enough to avoid collisions with unrelated mentions, short enough that
-     * the operator can edit the exact line shape without breaking
-     * idempotency.
-     */
-    readonly marker: string;
-    /**
-     * The exact line to append. The function adds a trailing newline if
-     * not already present + ensures the previous line of the rc file ends
-     * with a newline (so the appended line isn't concatenated onto the
-     * previous line on rcs that don't end with `\n`).
-     */
-    readonly contentLine: string;
-    /**
-     * Optional clock override for deterministic test timestamps. Defaults
-     * to `() => new Date()`.
-     */
-    readonly clock?: () => Date;
-}
-/**
- * Append `contentLine` to `rcPath` exactly once.
- *
- *   - rcPath doesn't exist           → returns `{status: 'no-rc-file', backupPath: null}`
- *   - rcPath content already includes the marker substring
- *                                    → returns `{status: 'already-present', backupPath: null}`
- *   - otherwise: backup + append
- *                                    → returns `{status: 'appended', backupPath: <ts-path>}`
- *
- * The write is atomic: content is staged to `<rcPath>.olam-tmp.<pid>`
- * and then `renameSync`'d to `rcPath`. POSIX rename is atomic within a
- * filesystem; a `kill -9` mid-call leaves either the backup-only state
- * (no rc change) or the renamed-final state (atomic apply), never a
- * half-written rc.
- *
- * The backup path uses a filesystem-safe ISO timestamp with `:` + `.`
- * replaced by `-` (avoids colons in filenames on Windows for cross-
- * platform consumers; not strictly required on macOS / Linux but
- * cosmetically nicer).
- */
-export declare function appendIdempotent(opts: AppendOptions): AppendResult;
-/**
- * Resolve the operator's shell rc path based on `$SHELL`.
- *
- *   /bin/zsh, /usr/bin/zsh, /opt/homebrew/bin/zsh → ~/.zshrc
- *   /bin/bash, /usr/bin/bash                     → ~/.bashrc
- *   anything else                                → null (caller must surface)
- *
- * The caller decides what to do on null — typically Phase C surfaces a
- * remedy message naming the supported shells.
- */
-export declare function resolveShellRc(home: string, shellEnv: string | undefined): string | null;
-//# sourceMappingURL=shell-rc.d.ts.map