@pleri/olam-cli 0.1.43 → 0.1.45

package/bin/check-node.cjs

@@ -0,0 +1,38 @@
+'use strict';
+
+const REQUIRED_MAJOR = 22;
+
+function checkNodeVersion(versionString) {
+  if (typeof versionString !== 'string' || versionString.length === 0) {
+    return { ok: false, detected: String(versionString), required: REQUIRED_MAJOR };
+  }
+  const major = parseInt(versionString.split('.')[0], 10);
+  if (Number.isNaN(major) || major < REQUIRED_MAJOR) {
+    return { ok: false, detected: versionString, required: REQUIRED_MAJOR };
+  }
+  return { ok: true, detected: versionString, required: REQUIRED_MAJOR };
+}
+
+function formatBanner(detected) {
+  return [
+    '',
+    'olam: unsupported Node.js version',
+    '',
+    `  required: Node ${REQUIRED_MAJOR}+`,
+    `  detected: Node ${detected}`,
+    '',
+    '  Why: the CLI uses node:fs.globSync, which was added in Node 22.0.0.',
+    '  Older runtimes fail at module-load before any error handler runs.',
+    '',
+    '  Fix (pick one):',
+    '    mise:    mise use --global node@22',
+    '    nvm:     nvm install 22 && nvm use 22',
+    '    asdf:    asdf install nodejs 22.20.0 && asdf global nodejs 22.20.0',
+    '    brew:    brew install node@22 && brew link --overwrite --force node@22',
+    '',
+    '  Then re-run: olam bootstrap',
+    '',
+  ].join('\n');
+}
+
+module.exports = { checkNodeVersion, formatBanner, REQUIRED_MAJOR };

package/bin/olam.cjs

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+// CJS shim that runs before the ESM bundle to fail fast on unsupported Node.
+// Kept in CJS so the parse step uses only Node ≥0.x APIs — this file must
+// load cleanly even on the Node versions we are about to reject.
+'use strict';
+
+const { checkNodeVersion, formatBanner } = require('./check-node.cjs');
+
+const result = checkNodeVersion(process.versions.node);
+
+if (!result.ok) {
+  process.stderr.write(formatBanner(result.detected));
+  // 64 = EX_USAGE per BSD sysexits — "the command was used incorrectly".
+  // Distinct from 1 (generic), 2 (pleri-not-configured), 3 (pull failed),
+  // 4 (protocol mismatch), 5 (auth); see packages/cli/src/exit-codes.ts.
+  process.exit(64);
+}
+
+const { join } = require('node:path');
+const { pathToFileURL } = require('node:url');
+const bundlePath = join(__dirname, '..', 'dist', 'index.js');
+
+import(pathToFileURL(bundlePath).href).catch((err) => {
+  process.stderr.write(`olam: failed to load CLI bundle (${bundlePath})\n  ${err && err.message ? err.message : err}\n`);
+  process.exit(1);
+});

package/dist/image-digests.json

@@ -3,6 +3,6 @@
   "devbox": "sha256:9363a1979d7df0ed2b2c964c183ba3e739383c146416f27b1ceb976f64648fd9",
   "host-cp": "sha256:29d2e544db7fabae259a0311a76ff367ee5e2ca5f48e9640ebefaf3c5997bda3",
   "$schema_version": 1,
-  "$published_version": "0.1.43",
+  "$published_version": "0.1.45",
   "$registry": "ghcr.io/pleri"
 }

package/dist/index.js

@@ -4598,7 +4598,7 @@ function isSecureOrLocalhost(value) {
     return false;
   return parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]" || parsed.hostname === "::1";
 }
-var repoTypeSchema, envSetupSchema, RepoConfigSchema, ServiceConfigSchema, sshHostSchema, computeProviderType, stackImageSchema, computeProvidersSchema, ComputeConfigSchema, CostConfigSchema, DashboardConfigSchema, PleriConfigSchema, authModeSchema, AuthConfigSchema, DevboxRegistrySchema, DevboxImageSelectorSchema, DevboxConfigSchema, OlamConfigSchema;
+var repoTypeSchema, envSetupSchema, EntitledMcpsSchema, RepoConfigSchema, ServiceConfigSchema, sshHostSchema, computeProviderType, stackImageSchema, computeProvidersSchema, ComputeConfigSchema, CostConfigSchema, DashboardConfigSchema, PleriConfigSchema, authModeSchema, AuthConfigSchema, DevboxRegistrySchema, DevboxImageSelectorSchema, DevboxConfigSchema, WorldsDefaultSchema, OlamConfigSchema;
 var init_schema2 = __esm({
   "../core/dist/config/schema.js"() {
     "use strict";
@@ -4612,6 +4612,10 @@ var init_schema2 = __esm({
       env_overrides: external_exports.record(external_exports.string(), external_exports.string()).optional().default({}),
       auto_generate: external_exports.boolean().optional().default(true)
     });
+    EntitledMcpsSchema = external_exports.union([
+      external_exports.literal("*"),
+      external_exports.array(external_exports.string())
+    ]);
     RepoConfigSchema = external_exports.object({
       // Symmetric ingress validation with WorkspaceRepoSchema.name — same rule
       // applies whether names enter via `.olam/config.yaml` or `~/.olam/
@@ -4636,7 +4640,18 @@ var init_schema2 = __esm({
       // HTTP liveness services this repo exposes. Flowed through from
       // WorkspaceRepoSchema.readiness_services; used by WorldManager to build
       // the per-world readiness chain at world-create time.
-      readiness_services: external_exports.array(ReadinessServiceSchema).optional()
+      readiness_services: external_exports.array(ReadinessServiceSchema).optional(),
+      // Per-repo entitlement overrides. When unset, falls back to
+      // `worlds_default.<field>`. Empty array `[]` means "explicitly none."
+      // Only enforced server-side when root `multi_tenant: true`; advisory
+      // metadata otherwise. See `EntitledMcpsSchema` (forward-declared below)
+      // and the plan's Phase 0 / Phase E sections.
+      //
+      // Note: forward-reference via z.lazy() — `EntitledMcpsSchema` is declared
+      // after RepoConfigSchema in this file (it sits with WorldsDefaultSchema).
+      // z.lazy() defers resolution to first parse/validate, breaking the cycle.
+      entitled_mcps: EntitledMcpsSchema.optional(),
+      agent_teams_enabled: external_exports.boolean().optional()
     });
     ServiceConfigSchema = external_exports.object({
       image: external_exports.string().min(1),
@@ -4764,6 +4779,10 @@ var init_schema2 = __esm({
        */
       image_selectors: external_exports.array(DevboxImageSelectorSchema).optional().default([])
     });
+    WorldsDefaultSchema = external_exports.object({
+      entitled_mcps: EntitledMcpsSchema.optional().default("*"),
+      agent_teams_enabled: external_exports.boolean().optional().default(true)
+    });
     OlamConfigSchema = external_exports.object({
       version: external_exports.number().int().positive(),
       repos: external_exports.array(RepoConfigSchema).min(1, "At least one repo is required"),
@@ -4780,7 +4799,16 @@ var init_schema2 = __esm({
       pleri: PleriConfigSchema.optional(),
       auth: AuthConfigSchema.optional().default({ mode: "oauth" }),
       dashboard: DashboardConfigSchema.optional().default({ port: 9740, tunnel: false }),
-      devbox: DevboxConfigSchema.optional()
+      devbox: DevboxConfigSchema.optional(),
+      // Multi-tenant flag: governs whether entitlement values are enforced (true,
+      // CF deployment) or advisory (false, single-operator Docker; default).
+      // See `WorldsDefaultSchema` and `RepoConfigSchema.entitled_mcps` for the
+      // values themselves.
+      multi_tenant: external_exports.boolean().optional().default(false),
+      worlds_default: WorldsDefaultSchema.optional().default({
+        entitled_mcps: "*",
+        agent_teams_enabled: true
+      })
     });
   }
 });

package/dist/mcp-server.js

@@ -28081,6 +28081,10 @@ var envSetupSchema = external_exports.object({
   env_overrides: external_exports.record(external_exports.string(), external_exports.string()).optional().default({}),
   auto_generate: external_exports.boolean().optional().default(true)
 });
+var EntitledMcpsSchema = external_exports.union([
+  external_exports.literal("*"),
+  external_exports.array(external_exports.string())
+]);
 var RepoConfigSchema = external_exports.object({
   // Symmetric ingress validation with WorkspaceRepoSchema.name — same rule
   // applies whether names enter via `.olam/config.yaml` or `~/.olam/
@@ -28105,7 +28109,18 @@ var RepoConfigSchema = external_exports.object({
   // HTTP liveness services this repo exposes. Flowed through from
   // WorkspaceRepoSchema.readiness_services; used by WorldManager to build
   // the per-world readiness chain at world-create time.
-  readiness_services: external_exports.array(ReadinessServiceSchema).optional()
+  readiness_services: external_exports.array(ReadinessServiceSchema).optional(),
+  // Per-repo entitlement overrides. When unset, falls back to
+  // `worlds_default.<field>`. Empty array `[]` means "explicitly none."
+  // Only enforced server-side when root `multi_tenant: true`; advisory
+  // metadata otherwise. See `EntitledMcpsSchema` (forward-declared below)
+  // and the plan's Phase 0 / Phase E sections.
+  //
+  // Note: forward-reference via z.lazy() — `EntitledMcpsSchema` is declared
+  // after RepoConfigSchema in this file (it sits with WorldsDefaultSchema).
+  // z.lazy() defers resolution to first parse/validate, breaking the cycle.
+  entitled_mcps: EntitledMcpsSchema.optional(),
+  agent_teams_enabled: external_exports.boolean().optional()
 });
 var ServiceConfigSchema = external_exports.object({
   image: external_exports.string().min(1),
@@ -28246,6 +28261,10 @@ var DevboxConfigSchema = external_exports.object({
    */
   image_selectors: external_exports.array(DevboxImageSelectorSchema).optional().default([])
 });
+var WorldsDefaultSchema = external_exports.object({
+  entitled_mcps: EntitledMcpsSchema.optional().default("*"),
+  agent_teams_enabled: external_exports.boolean().optional().default(true)
+});
 var OlamConfigSchema = external_exports.object({
   version: external_exports.number().int().positive(),
   repos: external_exports.array(RepoConfigSchema).min(1, "At least one repo is required"),
@@ -28262,7 +28281,16 @@ var OlamConfigSchema = external_exports.object({
   pleri: PleriConfigSchema.optional(),
   auth: AuthConfigSchema.optional().default({ mode: "oauth" }),
   dashboard: DashboardConfigSchema.optional().default({ port: 9740, tunnel: false }),
-  devbox: DevboxConfigSchema.optional()
+  devbox: DevboxConfigSchema.optional(),
+  // Multi-tenant flag: governs whether entitlement values are enforced (true,
+  // CF deployment) or advisory (false, single-operator Docker; default).
+  // See `WorldsDefaultSchema` and `RepoConfigSchema.entitled_mcps` for the
+  // values themselves.
+  multi_tenant: external_exports.boolean().optional().default(false),
+  worlds_default: WorldsDefaultSchema.optional().default({
+    entitled_mcps: "*",
+    agent_teams_enabled: true
+  })
 });
 
 // ../core/dist/config/defaults.js

package/package.json

@@ -1,16 +1,20 @@
 {
   "name": "@pleri/olam-cli",
-  "version": "0.1.43",
+  "version": "0.1.45",
   "type": "module",
   "bin": {
-    "olam": "./dist/index.js"
+    "olam": "./bin/olam.cjs"
   },
   "files": [
+    "bin",
     "dist",
     "host-cp",
     "plugin",
     "README.md"
   ],
+  "engines": {
+    "node": ">=22.0.0"
+  },
   "repository": {
     "type": "git",
     "url": "https://github.com/pleri/olam.git",