@pleri/olam-cli 0.1.65 → 0.1.68

package/dist/index.js

@@ -460,8 +460,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path44, errorMaps, issueData } = params;
-      const fullPath = [...path44, ...issueData.path || []];
+      const { data, path: path46, errorMaps, issueData } = params;
+      const fullPath = [...path46, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -769,11 +769,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path44, key) {
+      constructor(parent, value, path46, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path44;
+        this._path = path46;
         this._key = key;
       }
       get path() {
@@ -4254,7 +4254,7 @@ import YAML from "yaml";
 function bootstrapStepCmd(entry) {
   return typeof entry === "string" ? entry : entry.cmd;
 }
-function refineForbiddenKeys(value, path44, ctx, rejectSource) {
+function refineForbiddenKeys(value, path46, ctx, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
@@ -4262,12 +4262,12 @@ function refineForbiddenKeys(value, path44, ctx, rejectSource) {
     if (FORBIDDEN_KEYS.has(key)) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: [...path44, key],
+        path: [...path46, key],
         message: `forbidden key "${key}" (prototype-pollution surface)`
       });
       continue;
     }
-    if (rejectSource && path44.length === 0 && key === "source") {
+    if (rejectSource && path46.length === 0 && key === "source") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
         path: ["source"],
@@ -4275,21 +4275,21 @@ function refineForbiddenKeys(value, path44, ctx, rejectSource) {
       });
       continue;
     }
-    refineForbiddenKeys(value[key], [...path44, key], ctx, false);
+    refineForbiddenKeys(value[key], [...path46, key], ctx, false);
   }
 }
-function rejectForbiddenKeys(value, path44, rejectSource) {
+function rejectForbiddenKeys(value, path46, rejectSource) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     return;
   }
   for (const key of Object.keys(value)) {
     if (FORBIDDEN_KEYS.has(key)) {
-      throw new Error(`[manifest] ${path44}: forbidden key "${key}" (prototype-pollution surface)`);
+      throw new Error(`[manifest] ${path46}: forbidden key "${key}" (prototype-pollution surface)`);
     }
     if (rejectSource && key === "source") {
-      throw new Error(`[manifest] ${path44}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
+      throw new Error(`[manifest] ${path46}: top-level "source" is loader-stamped \u2014 manifests must not author it`);
     }
-    rejectForbiddenKeys(value[key], `${path44}.${key}`, false);
+    rejectForbiddenKeys(value[key], `${path46}.${key}`, false);
   }
 }
 function unknownTopLevelKeys(parsed) {
@@ -5280,8 +5280,8 @@ var init_client = __esm({
           throw new Error(`failed to report rate-limit for ${accountId} (HTTP ${res.status})`);
         }
       }
-      async request(method, path44, body, attempt = 0) {
-        const url = `${this.baseUrl}${path44}`;
+      async request(method, path46, body, attempt = 0) {
+        const url = `${this.baseUrl}${path46}`;
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), this.timeoutMs);
         const headers = {};
@@ -5299,7 +5299,7 @@ var init_client = __esm({
         } catch (err) {
           if (attempt < RETRY_COUNT && isTransient(err)) {
             await sleep(RETRY_BACKOFF_MS * (attempt + 1));
-            return this.request(method, path44, body, attempt + 1);
+            return this.request(method, path46, body, attempt + 1);
           }
           throw err;
         } finally {
@@ -6778,8 +6778,8 @@ var init_provider3 = __esm({
       // -----------------------------------------------------------------------
       // Internal fetch helper
       // -----------------------------------------------------------------------
-      async request(path44, method, body) {
-        const url = `${this.config.workerUrl}${path44}`;
+      async request(path46, method, body) {
+        const url = `${this.config.workerUrl}${path46}`;
         const bearer = await this.config.mintToken();
         const headers = {
           Authorization: `Bearer ${bearer}`
@@ -8056,8 +8056,8 @@ import { execFileSync as execFileSync3 } from "node:child_process";
 import * as fs13 from "node:fs";
 import * as os9 from "node:os";
 import * as path14 from "node:path";
-function expandHome(p, homedir22) {
-  return p.replace(/^~(?=$|\/|\\)/, homedir22());
+function expandHome(p, homedir24) {
+  return p.replace(/^~(?=$|\/|\\)/, homedir24());
 }
 function sanitizeRepoFilename(name) {
   const sanitized = name.replace(/[^A-Za-z0-9._-]/g, "_");
@@ -8080,7 +8080,7 @@ ${stderr}`;
 }
 function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
   const exec = deps.exec ?? ((cmd, args, opts) => execFileSync3(cmd, args, opts));
-  const homedir22 = deps.homedir ?? (() => os9.homedir());
+  const homedir24 = deps.homedir ?? (() => os9.homedir());
   const baselineDir = path14.join(workspacePath, ".olam", "baseline");
   try {
     fs13.mkdirSync(baselineDir, { recursive: true });
@@ -8096,7 +8096,7 @@ function snapshotBaselineDiff(repos, workspacePath, deps = {}) {
       continue;
     const filename = `${sanitizeRepoFilename(repo.name)}.diff`;
     const outPath = path14.join(baselineDir, filename);
-    const repoPath = expandHome(repo.path, homedir22);
+    const repoPath = expandHome(repo.path, homedir24);
     if (!fs13.existsSync(repoPath)) {
       writeBaselineFile(outPath, `# repo: ${repo.name}
 # (skipped: path ${repoPath} does not exist)
@@ -12523,10 +12523,10 @@ async function readHostCpToken2() {
   if (!fs19.existsSync(tp)) return null;
   return fs19.readFileSync(tp, "utf-8").trim();
 }
-async function callHostCpProxy(method, worldId, path44, body) {
+async function callHostCpProxy(method, worldId, path46, body) {
   const token = await readHostCpToken2();
   if (!token) return { ok: false, status: 0, error: "no token (host CP not started)" };
-  const url = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path44}`;
+  const url = `http://127.0.0.1:${HOST_CP_PORT}/api/world/${encodeURIComponent(worldId)}${path46}`;
   try {
     const headers = {
       Authorization: `Bearer ${token}`
@@ -13034,8 +13034,8 @@ var init_machine_schema = __esm({
 
 // src/index.ts
 import { Command } from "commander";
-import * as fs39 from "node:fs";
-import * as path43 from "node:path";
+import * as fs42 from "node:fs";
+import * as path45 from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/commands/init.ts
@@ -13412,9 +13412,9 @@ var UnknownArchetypeError = class extends Error {
 };
 var ArchetypeCycleError = class extends Error {
   path;
-  constructor(path44) {
-    super(`Archetype inheritance cycle detected: ${path44.join(" \u2192 ")} \u2192 ${path44[0] ?? "?"}`);
-    this.path = path44;
+  constructor(path46) {
+    super(`Archetype inheritance cycle detected: ${path46.join(" \u2192 ")} \u2192 ${path46[0] ?? "?"}`);
+    this.path = path46;
     this.name = "ArchetypeCycleError";
   }
 };
@@ -14521,20 +14521,6 @@ function servicesStatus() {
   const mcpStateStr = mcpState.state === "running" ? pc8.green("running") : mcpState.state === "stopped" ? pc8.yellow("stopped") : pc8.red("missing");
   printInfo("olam-mcp-auth", `${mcpStateStr}  :${mcpState.port}`);
 }
-function registerServices(program2) {
-  const services = program2.command("services").description("Manage Olam service containers (olam-auth, olam-mcp-auth)");
-  services.command("up").description("Start all service containers (idempotent)").action(async () => {
-    const result = await servicesUp();
-    if (result.exitCode !== 0) process.exitCode = result.exitCode;
-  });
-  services.command("down").description("Stop all service containers").action(() => {
-    const result = servicesDown();
-    if (result.exitCode !== 0) process.exitCode = result.exitCode;
-  });
-  services.command("status").description("Show state of all service containers").action(() => {
-    servicesStatus();
-  });
-}
 
 // src/commands/auth.ts
 function openBrowser(url) {
@@ -14793,9 +14779,9 @@ function formatFreshnessWarning(result, image = DEFAULT_DEVBOX_IMAGE) {
     "These source files have changed since the image was built; the",
     "changes will NOT take effect in fresh worlds until you rebuild:"
   ];
-  for (const { path: path44, mtimeMs } of result.newerSources) {
+  for (const { path: path46, mtimeMs } of result.newerSources) {
     const when = new Date(mtimeMs).toISOString();
-    lines.push(`  \u2022 ${path44}  (modified ${when})`);
+    lines.push(`  \u2022 ${path46}  (modified ${when})`);
   }
   lines.push("");
   lines.push("Rebuild with:");
@@ -14954,15 +14940,15 @@ init_host_cp();
 var HOST_CP_URL = "http://127.0.0.1:19000";
 async function readHostCpTokenForCreate() {
   try {
-    const { default: fs40 } = await import("node:fs");
-    const { default: os24 } = await import("node:os");
-    const { default: path44 } = await import("node:path");
-    const tp = path44.join(
-      process.env.OLAM_HOME ?? path44.join(os24.homedir(), ".olam"),
+    const { default: fs43 } = await import("node:fs");
+    const { default: os26 } = await import("node:os");
+    const { default: path46 } = await import("node:path");
+    const tp = path46.join(
+      process.env.OLAM_HOME ?? path46.join(os26.homedir(), ".olam"),
       "host-cp.token"
     );
-    if (!fs40.existsSync(tp)) return null;
-    return fs40.readFileSync(tp, "utf-8").trim();
+    if (!fs43.existsSync(tp)) return null;
+    return fs43.readFileSync(tp, "utf-8").trim();
   } catch {
     return null;
   }
@@ -15324,12 +15310,12 @@ function defaultNameFromPrompt(prompt) {
 }
 async function readHostCpToken3() {
   try {
-    const { default: fs40 } = await import("node:fs");
-    const { default: os24 } = await import("node:os");
-    const { default: path44 } = await import("node:path");
-    const tp = path44.join(os24.homedir(), ".olam", "host-cp.token");
-    if (!fs40.existsSync(tp)) return null;
-    const raw = fs40.readFileSync(tp, "utf-8").trim();
+    const { default: fs43 } = await import("node:fs");
+    const { default: os26 } = await import("node:os");
+    const { default: path46 } = await import("node:path");
+    const tp = path46.join(os26.homedir(), ".olam", "host-cp.token");
+    if (!fs43.existsSync(tp)) return null;
+    const raw = fs43.readFileSync(tp, "utf-8").trim();
     return raw.length > 0 ? raw : null;
   } catch {
     return null;
@@ -21269,6 +21255,308 @@ function registerBegin(program2) {
   });
 }
 
+// src/commands/config.ts
+import * as fs39 from "node:fs";
+import { createRequire as createRequire3 } from "node:module";
+
+// ../core/dist/global-config/schema.js
+init_zod();
+init_schema();
+function isAbsoluteOrTilde(p) {
+  return p.startsWith("/") || p === "~" || p.startsWith("~/");
+}
+function hasNoTraversalComponents(p) {
+  return !p.split("/").some((seg) => seg === "..");
+}
+var RepoEntrySchema = external_exports.object({
+  name: external_exports.string().regex(REPO_NAME_PATTERN, "repo name must be ASCII lowercase + digits + dash (1-64 chars, no leading/trailing dash)"),
+  path: external_exports.string().min(1, "path must not be empty").refine(isAbsoluteOrTilde, {
+    message: `path must be absolute (e.g. "/home/user/atlas-core") or "~/..." for the operator's home directory`
+  }).refine(hasNoTraversalComponents, { message: 'path must not contain ".." components' }),
+  description: external_exports.string().optional(),
+  defaultBranch: external_exports.string().optional(),
+  addedAt: external_exports.number().int().nonnegative(),
+  updatedAt: external_exports.number().int().nonnegative()
+});
+var PortMapSchema = external_exports.record(external_exports.string().min(1), external_exports.number().int().min(1024).max(65535));
+var SeedSqlFileSchema = external_exports.object({
+  type: external_exports.literal("sql-file"),
+  repo: external_exports.string().min(1),
+  service: external_exports.string().min(1),
+  path: external_exports.string().min(1)
+});
+var SeedCommandSchema = external_exports.object({
+  type: external_exports.literal("command"),
+  repo: external_exports.string().min(1),
+  run: external_exports.string().min(1)
+});
+var SeedFixtureCopySchema = external_exports.object({
+  type: external_exports.literal("fixture-copy"),
+  repo: external_exports.string().min(1),
+  src: external_exports.string().min(1),
+  dest: external_exports.string().min(1)
+});
+var SeedSchema = external_exports.discriminatedUnion("type", [
+  SeedSqlFileSchema,
+  SeedCommandSchema,
+  SeedFixtureCopySchema
+]);
+var RunbookSchema = external_exports.object({
+  name: external_exports.string().regex(WORKSPACE_NAME_PATTERN, "runbook name must be ASCII lowercase + digits + dash (1-64 chars, no leading/trailing dash)"),
+  description: external_exports.string().optional(),
+  repos: external_exports.array(external_exports.string().min(1)).min(1, "runbook must reference at least one repo"),
+  portMap: external_exports.record(external_exports.string().min(1), PortMapSchema).optional(),
+  seeds: external_exports.array(SeedSchema).optional(),
+  env: external_exports.record(external_exports.string().min(1), external_exports.record(external_exports.string().min(1), external_exports.string())).optional(),
+  updatedAt: external_exports.number().int().nonnegative()
+});
+var GlobalConfigSchema = external_exports.object({
+  schemaVersion: external_exports.literal(1),
+  repos: external_exports.array(RepoEntrySchema).optional().default([]),
+  runbooks: external_exports.array(RunbookSchema).optional().default([])
+}).strip().superRefine((val, ctx) => {
+  const repoNames = val.repos.map((r) => r.name);
+  const repoDupes = repoNames.filter((n, i) => repoNames.indexOf(n) !== i);
+  for (const d of repoDupes) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: `duplicate repo name: "${d}"`, path: ["repos"] });
+  }
+  const rbNames = val.runbooks.map((r) => r.name);
+  const rbDupes = rbNames.filter((n, i) => rbNames.indexOf(n) !== i);
+  for (const d of rbDupes) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: `duplicate runbook name: "${d}"`, path: ["runbooks"] });
+  }
+});
+var DEFAULT_GLOBAL_CONFIG = {
+  schemaVersion: 1,
+  repos: [],
+  runbooks: []
+};
+
+// ../core/dist/global-config/store.js
+import * as fs37 from "node:fs";
+import * as os23 from "node:os";
+import * as path41 from "node:path";
+var GlobalConfigReadError = class extends Error {
+  constructor(configPath, cause) {
+    const msg = cause instanceof Error ? cause.message : String(cause);
+    super(`Failed to read global config at ${configPath}: ${msg}. Run "olam config validate" to diagnose the issue.`);
+    this.name = "GlobalConfigReadError";
+    this.cause = cause;
+  }
+};
+function globalConfigPath() {
+  const override = process.env["OLAM_GLOBAL_CONFIG_PATH"];
+  if (override && override.length > 0)
+    return override;
+  return path41.join(os23.homedir(), ".olam", "config.json");
+}
+function readGlobalConfig() {
+  const configPath = globalConfigPath();
+  if (!fs37.existsSync(configPath)) {
+    return { ...DEFAULT_GLOBAL_CONFIG };
+  }
+  let raw;
+  try {
+    raw = fs37.readFileSync(configPath, "utf-8");
+  } catch (err) {
+    throw new GlobalConfigReadError(configPath, err);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new GlobalConfigReadError(configPath, err);
+  }
+  try {
+    return GlobalConfigSchema.parse(parsed);
+  } catch (err) {
+    throw new GlobalConfigReadError(configPath, err);
+  }
+}
+function writeGlobalConfig(config) {
+  const configPath = globalConfigPath();
+  const validated = GlobalConfigSchema.parse(config);
+  const dir = path41.dirname(configPath);
+  fs37.mkdirSync(dir, { recursive: true });
+  const tmp = `${configPath}.tmp-${process.pid}`;
+  fs37.writeFileSync(tmp, JSON.stringify(validated, null, 2) + "\n", { mode: 420 });
+  fs37.renameSync(tmp, configPath);
+}
+
+// ../core/dist/global-config/repos.js
+import * as fs38 from "node:fs";
+import * as os24 from "node:os";
+import * as path42 from "node:path";
+function expandPath(p) {
+  if (p === "~" || p.startsWith("~/")) {
+    return path42.join(os24.homedir(), p.slice(1));
+  }
+  return p;
+}
+function listRepos() {
+  return readGlobalConfig().repos;
+}
+function addRepo(entry) {
+  const config = readGlobalConfig();
+  if (config.repos.some((r) => r.name === entry.name)) {
+    throw new Error(`repo "${entry.name}" already registered. Use "olam repos update" to change its path.`);
+  }
+  const resolvedPath = expandPath(entry.path);
+  if (!fs38.existsSync(resolvedPath)) {
+    throw new Error(`path "${entry.path}" does not exist. Verify the path is correct.`);
+  }
+  const now = Date.now();
+  const newEntry = {
+    name: entry.name,
+    path: resolvedPath,
+    addedAt: now,
+    updatedAt: now,
+    ...entry.description !== void 0 ? { description: entry.description } : {},
+    ...entry.defaultBranch !== void 0 ? { defaultBranch: entry.defaultBranch } : {}
+  };
+  writeGlobalConfig({ ...config, repos: [...config.repos, newEntry] });
+  return newEntry;
+}
+function removeRepo(name) {
+  const config = readGlobalConfig();
+  if (!config.repos.some((r) => r.name === name)) {
+    throw new Error(`repo "${name}" is not registered. Run "olam repos list" to see registered repos.`);
+  }
+  writeGlobalConfig({ ...config, repos: config.repos.filter((r) => r.name !== name) });
+}
+function updateRepo(name, updates) {
+  const config = readGlobalConfig();
+  const idx = config.repos.findIndex((r) => r.name === name);
+  if (idx === -1) {
+    throw new Error(`repo "${name}" is not registered. Run "olam repos list" to see registered repos.`);
+  }
+  const resolvedUpdatePath = updates.path !== void 0 ? expandPath(updates.path) : void 0;
+  if (resolvedUpdatePath !== void 0 && !fs38.existsSync(resolvedUpdatePath)) {
+    throw new Error(`path "${updates.path}" does not exist. Verify the path is correct.`);
+  }
+  const existing = config.repos[idx];
+  const updated = {
+    ...existing,
+    ...resolvedUpdatePath !== void 0 ? { path: resolvedUpdatePath } : {},
+    ...updates.description !== void 0 ? { description: updates.description } : {},
+    ...updates.defaultBranch !== void 0 ? { defaultBranch: updates.defaultBranch } : {},
+    updatedAt: Date.now()
+  };
+  const newRepos = [...config.repos];
+  newRepos[idx] = updated;
+  writeGlobalConfig({ ...config, repos: newRepos });
+  return updated;
+}
+
+// src/commands/config.ts
+var _require3 = createRequire3(import.meta.url);
+var { parse: parseWithMap } = _require3("json-source-map");
+function registerConfig(program2) {
+  const config = program2.command("config").description("Manage global olam configuration");
+  config.command("validate [path]").description("Validate ~/.olam/config.json (or a custom path) against the schema").action((filePath) => {
+    const resolvedPath = filePath ?? globalConfigPath();
+    if (!fs39.existsSync(resolvedPath)) {
+      process.stderr.write(`config file not found: ${resolvedPath}
+`);
+      process.exit(1);
+    }
+    let raw;
+    try {
+      raw = fs39.readFileSync(resolvedPath, "utf-8");
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`cannot read ${resolvedPath}: ${msg}
+`);
+      process.exit(1);
+    }
+    let parsed;
+    let pointers;
+    try {
+      const result2 = parseWithMap(raw);
+      parsed = result2.data;
+      pointers = result2.pointers;
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`${resolvedPath}: invalid JSON \u2014 ${msg}
+`);
+      process.exit(1);
+    }
+    const result = GlobalConfigSchema.safeParse(parsed);
+    if (result.success) {
+      process.exit(0);
+    }
+    for (const issue of result.error.issues) {
+      const pointer = "/" + issue.path.join("/");
+      const entry = pointers[pointer];
+      const rawLine = entry?.value?.line ?? entry?.key?.line ?? -1;
+      const lineStr = rawLine >= 0 ? `Line ${rawLine + 1}: ` : "";
+      process.stderr.write(`${lineStr}${pointer}: ${issue.message}
+`);
+    }
+    process.exit(1);
+  });
+}
+
+// src/commands/repos.ts
+import pc24 from "picocolors";
+init_output();
+function asMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function registerRepos(program2) {
+  const repos = program2.command("repos").description("Manage the global repo registry");
+  repos.command("list").description("List all registered repos").action(() => {
+    const all = listRepos();
+    if (all.length === 0) {
+      console.log(pc24.dim("0 repo(s) registered. Add one with: olam repos add --name <n> --path <p>"));
+      return;
+    }
+    printHeader(`${all.length} repo(s)`);
+    for (const r of all) {
+      const when = new Date(r.addedAt).toISOString().slice(0, 10);
+      console.log(
+        `  ${pc24.bold(r.name.padEnd(24))} ${r.path.padEnd(48)} ${pc24.dim(when)}`
+      );
+    }
+  });
+  repos.command("add").description("Register a local repo path").requiredOption("--name <name>", "Repo name (lowercase, digits, dash)").requiredOption("--path <path>", "Absolute or ~/... path to the local repo").option("--description <desc>", "Optional human-readable description").option("--default-branch <branch>", "Default branch name (e.g. main)").action((opts) => {
+    try {
+      const entry = addRepo({
+        name: opts.name,
+        path: opts.path,
+        description: opts.description,
+        defaultBranch: opts.defaultBranch
+      });
+      printSuccess(`registered repo "${entry.name}" at ${entry.path}`);
+    } catch (err) {
+      printError(asMessage(err));
+      process.exitCode = 1;
+    }
+  });
+  repos.command("remove").description("Remove a repo from the registry").argument("<name>", "Repo name to remove").action((name) => {
+    try {
+      removeRepo(name);
+      printSuccess(`removed repo "${name}"`);
+    } catch (err) {
+      printError(asMessage(err));
+      process.exitCode = 1;
+    }
+  });
+  repos.command("update").description("Update a registered repo").argument("<name>", "Repo name to update").option("--path <path>", "New path").option("--description <desc>", "New description").option("--default-branch <branch>", "New default branch").action((name, opts) => {
+    try {
+      const entry = updateRepo(name, {
+        path: opts.path,
+        description: opts.description,
+        defaultBranch: opts.defaultBranch
+      });
+      printSuccess(`updated repo "${entry.name}"`);
+    } catch (err) {
+      printError(asMessage(err));
+      process.exitCode = 1;
+    }
+  });
+}
+
 // src/commands/stop.ts
 init_host_cp();
 async function doStop(_stopFn = stopHostCp) {
@@ -21350,8 +21638,8 @@ var SECRET = process.env["OLAM_MCP_AUTH_SECRET"] ?? "";
 function authHeaders() {
   return SECRET ? { "X-Olam-Mcp-Secret": SECRET } : {};
 }
-async function apiFetch(path44, init = {}) {
-  const res = await fetch(`${BASE_URL}${path44}`, {
+async function apiFetch(path46, init = {}) {
+  const res = await fetch(`${BASE_URL}${path46}`, {
     ...init,
     headers: {
       "Content-Type": "application/json",
@@ -21503,7 +21791,7 @@ function registerMcpAdd(cmd) {
 
 // src/commands/mcp/list.ts
 init_output();
-import pc24 from "picocolors";
+import pc25 from "picocolors";
 function registerMcpList(cmd) {
   cmd.command("list").description("List all registered MCP credentials").action(async () => {
     const client = getMcpAuthClient();
@@ -21518,8 +21806,8 @@ function registerMcpList(cmd) {
     }
     const mcps = data.mcps ?? [];
     if (mcps.length === 0) {
-      console.log(pc24.dim("No MCP credentials registered."));
-      console.log(pc24.dim("Add one with: olam mcp add <service>"));
+      console.log(pc25.dim("No MCP credentials registered."));
+      console.log(pc25.dim("Add one with: olam mcp add <service>"));
       return;
     }
     const [c0, c1, c2, c3] = [16, 20, 10, 24];
@@ -21530,12 +21818,12 @@ function registerMcpList(cmd) {
       "ENV VAR".padEnd(c3),
       "STATUS"
     ].join("  ");
-    console.log(pc24.dim(header));
-    console.log(pc24.dim("\u2500".repeat(header.length)));
+    console.log(pc25.dim(header));
+    console.log(pc25.dim("\u2500".repeat(header.length)));
     for (const m of mcps) {
-      const status = !m.validated ? pc24.yellow("unvalidated") : m.expired ? pc24.red("expired") : pc24.green("active");
+      const status = !m.validated ? pc25.yellow("unvalidated") : m.expired ? pc25.red("expired") : pc25.green("active");
       const row = [
-        pc24.cyan(m.service.padEnd(c0)),
+        pc25.cyan(m.service.padEnd(c0)),
         m.label.padEnd(c1).slice(0, c1),
         m.type.padEnd(c2),
         (m.envName ?? "\u2014").padEnd(c3).slice(0, c3),
@@ -21563,13 +21851,13 @@ function registerMcpRemove(cmd) {
 
 // src/commands/mcp/status.ts
 init_output();
-import pc25 from "picocolors";
+import pc26 from "picocolors";
 function formatExpiry(expiresAt) {
   if (!expiresAt) return "\u2014";
   const ms = expiresAt - Date.now();
-  if (ms <= 0) return pc25.red("expired");
+  if (ms <= 0) return pc26.red("expired");
   const hours = ms / (1e3 * 60 * 60);
-  if (hours < 1) return pc25.yellow(`${Math.ceil(ms / 6e4)}m`);
+  if (hours < 1) return pc26.yellow(`${Math.ceil(ms / 6e4)}m`);
   return `${hours.toFixed(1)}h`;
 }
 function registerMcpStatus(cmd) {
@@ -21586,14 +21874,14 @@ function registerMcpStatus(cmd) {
     const mcps = data.mcps ?? [];
     printHeader(`MCP Credentials (${mcps.length})`);
     if (mcps.length === 0) {
-      console.log(pc25.dim("No credentials registered."));
+      console.log(pc26.dim("No credentials registered."));
       return;
     }
     for (const m of mcps) {
-      const stateColor = !m.validated ? pc25.yellow : m.expired ? pc25.red : pc25.green;
+      const stateColor = !m.validated ? pc26.yellow : m.expired ? pc26.red : pc26.green;
       const stateLabel = !m.validated ? "unvalidated" : m.expired ? "expired" : "active";
       console.log(`
-  ${pc25.cyan(m.service)} ${stateColor(`[${stateLabel}]`)}`);
+  ${pc26.cyan(m.service)} ${stateColor(`[${stateLabel}]`)}`);
       console.log(`    label:      ${m.label}`);
       console.log(`    type:       ${m.type}`);
       if (m.envName) console.log(`    env var:    ${m.envName}`);
@@ -21608,15 +21896,15 @@ function registerMcpStatus(cmd) {
 // src/commands/mcp/import.ts
 init_output();
 import * as readline3 from "node:readline";
-import pc26 from "picocolors";
+import pc27 from "picocolors";
 
 // src/commands/mcp/import-discovery.ts
-import * as fs37 from "node:fs";
-import * as os23 from "node:os";
-import * as path41 from "node:path";
+import * as fs40 from "node:fs";
+import * as os25 from "node:os";
+import * as path43 from "node:path";
 function readJsonFile(filePath) {
   try {
-    const raw = fs37.readFileSync(filePath, "utf-8");
+    const raw = fs40.readFileSync(filePath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -21645,24 +21933,24 @@ function extractMcpServers(obj, source, sourceLabel) {
 }
 function getClaudeDesktopPath() {
   if (process.platform === "darwin") {
-    return path41.join(os23.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    return path43.join(os25.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
   }
   if (process.platform === "win32") {
-    const appData = process.env["APPDATA"] ?? path41.join(os23.homedir(), "AppData", "Roaming");
-    return path41.join(appData, "Claude", "claude_desktop_config.json");
+    const appData = process.env["APPDATA"] ?? path43.join(os25.homedir(), "AppData", "Roaming");
+    return path43.join(appData, "Claude", "claude_desktop_config.json");
   }
-  return path41.join(os23.homedir(), ".config", "Claude", "claude_desktop_config.json");
+  return path43.join(os25.homedir(), ".config", "Claude", "claude_desktop_config.json");
 }
 function getOlamRepoPaths() {
   const configPaths = [
-    path41.join(os23.homedir(), ".olam", "config.yaml"),
-    path41.join(process.cwd(), ".olam", "config.yaml")
+    path43.join(os25.homedir(), ".olam", "config.yaml"),
+    path43.join(process.cwd(), ".olam", "config.yaml")
   ];
   const paths = [];
   for (const configPath of configPaths) {
-    if (!fs37.existsSync(configPath)) continue;
+    if (!fs40.existsSync(configPath)) continue;
     try {
-      const raw = fs37.readFileSync(configPath, "utf-8");
+      const raw = fs40.readFileSync(configPath, "utf-8");
       const repoMatches = [...raw.matchAll(/path:\s*["']?([^\s"'\n]+)/g)];
       for (const m of repoMatches) {
         if (m[1]) paths.push(m[1]);
@@ -21678,7 +21966,7 @@ async function discoverMcpSources(repoPaths) {
   const sources = [];
   const sourceDefs = [
     {
-      path: path41.join(os23.homedir(), ".claude.json"),
+      path: path43.join(os25.homedir(), ".claude.json"),
       label: "Claude Code (~/.claude.json)"
     },
     {
@@ -21686,19 +21974,19 @@ async function discoverMcpSources(repoPaths) {
       label: "Claude Desktop"
     },
     {
-      path: path41.join(os23.homedir(), ".cursor", "mcp.json"),
+      path: path43.join(os25.homedir(), ".cursor", "mcp.json"),
       label: "Cursor (~/.cursor/mcp.json)"
     },
     {
-      path: path41.join(os23.homedir(), ".codeium", "windsurf", "mcp_config.json"),
+      path: path43.join(os25.homedir(), ".codeium", "windsurf", "mcp_config.json"),
       label: "Windsurf (~/.codeium/windsurf/mcp_config.json)"
     }
   ];
   const resolvedRepoPaths = repoPaths ?? getOlamRepoPaths();
   for (const repoPath of resolvedRepoPaths) {
     sourceDefs.push({
-      path: path41.join(repoPath, ".mcp.json"),
-      label: `.mcp.json (${path41.basename(repoPath)})`
+      path: path43.join(repoPath, ".mcp.json"),
+      label: `.mcp.json (${path43.basename(repoPath)})`
     });
   }
   const reads = await Promise.all(
@@ -21778,13 +22066,13 @@ async function validateMcpEntry(entry) {
 // src/commands/mcp/import.ts
 async function multiSelectPicker(entries) {
   if (entries.length === 0) return [];
-  console.log("\n" + pc26.bold("Discovered MCP servers:"));
+  console.log("\n" + pc27.bold("Discovered MCP servers:"));
   entries.forEach((e, i) => {
     console.log(
-      `  ${pc26.dim(`[${i + 1}]`)} ${pc26.cyan(e.name.padEnd(20))} ${pc26.dim(e.sourceLabel)}`
+      `  ${pc27.dim(`[${i + 1}]`)} ${pc27.cyan(e.name.padEnd(20))} ${pc27.dim(e.sourceLabel)}`
     );
   });
-  console.log("\n" + pc26.dim('Enter numbers to import (e.g. 1,2,3 or "all" or Enter to skip):'));
+  console.log("\n" + pc27.dim('Enter numbers to import (e.g. 1,2,3 or "all" or Enter to skip):'));
   const answer = await new Promise((resolve8) => {
     const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
     rl.question("> ", (ans) => {
@@ -21811,7 +22099,7 @@ function registerMcpImport(cmd) {
     const repoPaths = opts.repoPaths ? opts.repoPaths.split(",").map((s) => s.trim()) : void 0;
     const { entries, sources, durationMs } = await discoverMcpSources(repoPaths);
     if (entries.length === 0) {
-      console.log(pc26.dim("No MCP servers found in any source path."));
+      console.log(pc27.dim("No MCP servers found in any source path."));
       return;
     }
     printInfo("Sources", sources.length > 0 ? sources.join(", ") : "none");
@@ -21824,15 +22112,15 @@ function registerMcpImport(cmd) {
       candidates = filtered;
     }
     if (skippedCount > 0) {
-      console.log(pc26.dim(`skipped: ${skippedCount} already registered`));
+      console.log(pc27.dim(`skipped: ${skippedCount} already registered`));
     }
     if (candidates.length === 0) {
-      console.log(pc26.dim("Nothing new to import. Use --reimport to force."));
+      console.log(pc27.dim("Nothing new to import. Use --reimport to force."));
       return;
     }
     const selected = await multiSelectPicker(candidates);
     if (selected.length === 0) {
-      console.log(pc26.dim("No servers selected."));
+      console.log(pc27.dim("No servers selected."));
       return;
     }
     console.log(`
@@ -21843,16 +22131,16 @@ Importing ${selected.length} server(s)\u2026`);
       let validated = false;
       let validationReason = "skipped";
       if (opts.validate !== false) {
-        process.stdout.write(`  ${pc26.dim("\u2192")} ${entry.name}  validating\u2026 `);
+        process.stdout.write(`  ${pc27.dim("\u2192")} ${entry.name}  validating\u2026 `);
         const vr = await validateMcpEntry(entry);
         validated = vr.validated;
         validationReason = vr.reason;
         process.stdout.write(
-          validated ? pc26.green("ok\n") : pc26.yellow(`unvalidated (${vr.reason})
+          validated ? pc27.green("ok\n") : pc27.yellow(`unvalidated (${vr.reason})
 `)
         );
       } else {
-        console.log(`  ${pc26.dim("\u2192")} ${entry.name}  ${pc26.dim("(validation skipped)")}`);
+        console.log(`  ${pc27.dim("\u2192")} ${entry.name}  ${pc27.dim("(validation skipped)")}`);
       }
       if (validated) validatedCount++;
       const result = await client.staticAdd({
@@ -21867,21 +22155,21 @@ Importing ${selected.length} server(s)\u2026`);
       }
     }
     console.log("");
-    console.log(pc26.green(`\u2713 Imported ${importedCount}/${selected.length}`));
+    console.log(pc27.green(`\u2713 Imported ${importedCount}/${selected.length}`));
     if (validatedCount > 0) {
-      console.log(pc26.dim(`  ${validatedCount} validated, ${importedCount - validatedCount} unvalidated`));
+      console.log(pc27.dim(`  ${validatedCount} validated, ${importedCount - validatedCount} unvalidated`));
     }
   });
 }
 
 // src/commands/mcp/revoke.ts
 init_output();
-import pc27 from "picocolors";
+import pc28 from "picocolors";
 function registerMcpRevoke(cmd) {
   cmd.command("revoke <user> <world> <service>").description("Revoke a user's MCP service entitlement (multi-tenant mode only)").action(async (user, world, service) => {
     const multiTenant = (process.env["OLAM_MCP_MULTI_TENANT"] ?? "").toLowerCase() === "true";
     if (!multiTenant) {
-      console.warn(pc27.yellow("\u26A0 revocation only meaningful in multi_tenant mode \u2014 no-op"));
+      console.warn(pc28.yellow("\u26A0 revocation only meaningful in multi_tenant mode \u2014 no-op"));
       return;
     }
     const baseUrl = process.env["OLAM_MCP_AUTH_SERVICE_URL"] ?? "http://127.0.0.1:9998";
@@ -21910,8 +22198,8 @@ function registerMcpRevoke(cmd) {
       process.exitCode = 1;
       return;
     }
-    console.log(pc27.green(`\u2713 Revoked: ${user} / ${world} / ${service}`));
-    console.log(pc27.dim("  Next fetch-creds call returns 403; token cleared on next merge."));
+    console.log(pc28.green(`\u2713 Revoked: ${user} / ${world} / ${service}`));
+    console.log(pc28.dim("  Next fetch-creds call returns 403; token cleared on next merge."));
   });
 }
 
@@ -21928,18 +22216,18 @@ function registerMcp(program2) {
 }
 
 // src/pleri-config.ts
-import * as fs38 from "node:fs";
-import * as path42 from "node:path";
+import * as fs41 from "node:fs";
+import * as path44 from "node:path";
 function isPleriConfigured(configDir = process.env.OLAM_CONFIG_DIR ?? ".olam") {
   if (process.env.PLERI_BASE_URL) {
     return true;
   }
-  const configPath = path42.join(configDir, "config.yaml");
-  if (!fs38.existsSync(configPath)) {
+  const configPath = path44.join(configDir, "config.yaml");
+  if (!fs41.existsSync(configPath)) {
     return false;
   }
   try {
-    const contents = fs38.readFileSync(configPath, "utf8");
+    const contents = fs41.readFileSync(configPath, "utf8");
     return /^[^#\n]*\bpleri:/m.test(contents);
   } catch {
     return false;
@@ -21950,14 +22238,14 @@ function isPleriConfigured(configDir = process.env.OLAM_CONFIG_DIR ?? ".olam") {
 var program = new Command();
 function readCliVersion() {
   try {
-    const here = path43.dirname(fileURLToPath4(import.meta.url));
+    const here = path45.dirname(fileURLToPath4(import.meta.url));
     for (const candidate of [
-      path43.join(here, "package.json"),
-      path43.join(here, "..", "package.json"),
-      path43.join(here, "..", "..", "package.json")
+      path45.join(here, "package.json"),
+      path45.join(here, "..", "package.json"),
+      path45.join(here, "..", "..", "package.json")
     ]) {
-      if (fs39.existsSync(candidate)) {
-        const pkg = JSON.parse(fs39.readFileSync(candidate, "utf-8"));
+      if (fs42.existsSync(candidate)) {
+        const pkg = JSON.parse(fs42.readFileSync(candidate, "utf-8"));
         if (typeof pkg.version === "string" && pkg.version.length > 0) return pkg.version;
       }
     }
@@ -21996,5 +22284,6 @@ registerBegin(program);
 registerStop(program);
 registerWorldUpgrade(program);
 registerMcp(program);
-registerServices(program);
+registerConfig(program);
+registerRepos(program);
 program.parse();