@pleri/olam-cli 0.1.7

package/dist/commands/__tests__/refresh.test.js

@@ -0,0 +1,170 @@
+/**
+ * Unit tests for `olam refresh` command.
+ *
+ * Tests:
+ *   1. collectCpSourceFiles — mirrors build-devbox.sh:38-77 logic
+ *   2. validateServerMjsPresent — sanity-check gate
+ *   3. Command parser — arg/flag validation
+ *   4. Snapshot test — actual standalone dir matches expected structure
+ *
+ * Run: `cd packages/cli && npx vitest run src/commands/__tests__/refresh.test.ts`
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { Command } from 'commander';
+import { collectCpSourceFiles, validateServerMjsPresent } from '../refresh-helpers.js';
+// ── Helpers ─────────────────────────────────────────────────────────────────
+function makeFakeStandalone(files) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'olam-test-standalone-'));
+    for (const f of files) {
+        const fullPath = path.join(dir, f);
+        fs.mkdirSync(path.dirname(fullPath), { recursive: true });
+        fs.writeFileSync(fullPath, `// ${f}`);
+    }
+    return dir;
+}
+// ── collectCpSourceFiles ─────────────────────────────────────────────────────
+describe('collectCpSourceFiles', () => {
+    let tmpDir;
+    beforeEach(() => {
+        tmpDir = '';
+    });
+    afterEach(() => {
+        if (tmpDir)
+            fs.rmSync(tmpDir, { recursive: true, force: true });
+    });
+    it('collects top-level *.mjs excluding *.test.mjs', () => {
+        tmpDir = makeFakeStandalone([
+            'server.mjs',
+            'stub.mjs',
+            'stub.test.mjs', // should be excluded
+            'api-files.mjs',
+        ]);
+        const entries = collectCpSourceFiles(tmpDir);
+        const destPaths = entries.map(e => e.destRelPath).sort();
+        expect(destPaths).toContain('server.mjs');
+        expect(destPaths).toContain('stub.mjs');
+        expect(destPaths).toContain('api-files.mjs');
+        expect(destPaths).not.toContain('stub.test.mjs');
+    });
+    it('includes lib/*.mjs excluding lib/*.test.mjs', () => {
+        tmpDir = makeFakeStandalone([
+            'server.mjs',
+            'lib/exec-with-status.mjs',
+            'lib/exec-with-status.test.mjs', // should be excluded
+        ]);
+        const entries = collectCpSourceFiles(tmpDir);
+        const destPaths = entries.map(e => e.destRelPath).sort();
+        expect(destPaths).toContain('lib/exec-with-status.mjs');
+        expect(destPaths).not.toContain('lib/exec-with-status.test.mjs');
+    });
+    it('skips lib/ entirely when it does not exist', () => {
+        tmpDir = makeFakeStandalone(['server.mjs', 'stub.mjs']);
+        const entries = collectCpSourceFiles(tmpDir);
+        const destPaths = entries.map(e => e.destRelPath);
+        expect(destPaths.every(p => !p.startsWith('lib/'))).toBe(true);
+    });
+    it('returns srcPath values that exist on disk', () => {
+        tmpDir = makeFakeStandalone(['server.mjs', 'lib/exec-with-status.mjs']);
+        const entries = collectCpSourceFiles(tmpDir);
+        for (const { srcPath } of entries) {
+            expect(fs.existsSync(srcPath), `srcPath should exist: ${srcPath}`).toBe(true);
+        }
+    });
+    it('throws when standalone dir does not exist', () => {
+        expect(() => collectCpSourceFiles('/nonexistent/standalone')).toThrow(/not found/);
+    });
+    it('does not include non-.mjs files', () => {
+        tmpDir = makeFakeStandalone(['server.mjs', 'package.json', 'README.md']);
+        const entries = collectCpSourceFiles(tmpDir);
+        const destPaths = entries.map(e => e.destRelPath);
+        expect(destPaths).toContain('server.mjs');
+        expect(destPaths).not.toContain('package.json');
+        expect(destPaths).not.toContain('README.md');
+    });
+});
+// ── validateServerMjsPresent ─────────────────────────────────────────────────
+describe('validateServerMjsPresent', () => {
+    it('throws when server.mjs is absent', () => {
+        const entries = [
+            { srcPath: '/fake/stub.mjs', destRelPath: 'stub.mjs' },
+        ];
+        expect(() => validateServerMjsPresent(entries)).toThrow(/server\.mjs/);
+    });
+    it('passes when server.mjs is present', () => {
+        const entries = [
+            { srcPath: '/fake/server.mjs', destRelPath: 'server.mjs' },
+            { srcPath: '/fake/stub.mjs', destRelPath: 'stub.mjs' },
+        ];
+        expect(() => validateServerMjsPresent(entries)).not.toThrow();
+    });
+});
+function parseRefreshArgs(argv) {
+    let result = { worldId: undefined, opts: {} };
+    const program = new Command();
+    program.exitOverride();
+    program
+        .command('refresh')
+        .argument('[world]', 'World ID')
+        .option('--all', 'Refresh every running world')
+        .option('--no-restart', 'Copy files but skip restart')
+        .option('--skip-build', 'Skip server.mjs check')
+        .action((worldId, opts) => {
+        result = { worldId, opts };
+    });
+    program.parse(['refresh', ...argv], { from: 'user' });
+    return result;
+}
+describe('olam refresh — command parser', () => {
+    it('parses a positional world ID', () => {
+        const { worldId, opts } = parseRefreshArgs(['gold-sky-9120']);
+        expect(worldId).toBe('gold-sky-9120');
+        expect(opts.all).toBeUndefined();
+    });
+    it('parses --all without positional arg', () => {
+        const { worldId, opts } = parseRefreshArgs(['--all']);
+        expect(worldId).toBeUndefined();
+        expect(opts.all).toBe(true);
+    });
+    it('--no-restart sets restart to false', () => {
+        const { opts } = parseRefreshArgs(['test-world', '--no-restart']);
+        expect(opts.restart).toBe(false);
+    });
+    it('--skip-build flag is recognised', () => {
+        const { opts } = parseRefreshArgs(['test-world', '--skip-build']);
+        expect(opts.skipBuild).toBe(true);
+    });
+});
+// ── Snapshot: actual standalone/ matches build-devbox.sh expectations ────────
+describe('collectCpSourceFiles — actual standalone dir', () => {
+    it('collects the actual standalone/ dir without error', () => {
+        // This test is a canary: if it fails, the standalone dir is missing
+        // or server.mjs is not present — which means build-devbox.sh would
+        // also fail. File path is relative to this test file's compile-time
+        // location; adjust if the test runner CWD changes.
+        // Resolve relative to monorepo root from this file's location.
+        // vitest runs from the package root; use process.cwd() as the anchor.
+        const standaloneDir = path.resolve(process.cwd(), '../control-plane/standalone');
+        if (!fs.existsSync(standaloneDir)) {
+            // Skip gracefully when running in an environment without the full
+            // monorepo (e.g. isolated package publish tests).
+            console.warn(`SKIP: standalone dir not found at ${standaloneDir}`);
+            return;
+        }
+        const entries = collectCpSourceFiles(standaloneDir);
+        expect(entries.length).toBeGreaterThan(0);
+        // server.mjs must be present (sanity-checked by build-devbox.sh too)
+        const destPaths = entries.map(e => e.destRelPath);
+        expect(destPaths).toContain('server.mjs');
+        // No test files should sneak in
+        const testFiles = destPaths.filter(p => p.endsWith('.test.mjs'));
+        expect(testFiles, `test files leaked into source list: ${testFiles.join(', ')}`).toHaveLength(0);
+        // All srcPaths must exist
+        for (const { srcPath } of entries) {
+            expect(fs.existsSync(srcPath), `srcPath missing: ${srcPath}`).toBe(true);
+        }
+    });
+});
+//# sourceMappingURL=refresh.test.js.map

package/dist/commands/__tests__/refresh.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.test.js","sourceRoot":"","sources":["../../../src/commands/__tests__/refresh.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEvF,+EAA+E;AAE/E,SAAS,kBAAkB,CAAC,KAAe;IACzC,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAEhF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,IAAI,MAAc,CAAC;IAEnB,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,MAAM;YAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,GAAG,kBAAkB,CAAC;YAC1B,YAAY;YACZ,UAAU;YACV,eAAe,EAAI,qBAAqB;YACxC,eAAe;SAChB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC1C,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC7C,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,GAAG,kBAAkB,CAAC;YAC1B,YAAY;YACZ,0BAA0B;YAC1B,+BAA+B,EAAG,qBAAqB;SACxD,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACxD,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,GAAG,kBAAkB,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,GAAG,kBAAkB,CAAC,CAAC,YAAY,EAAE,0BAA0B,CAAC,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7C,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,OAAO,EAAE,CAAC;YAClC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,yBAAyB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,GAAG,kBAAkB,CAAC,CAAC,YAAY,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC1C,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,gFAAgF;AAEhF,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,OAAO,GAAG;YACd,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE;SACvD,CAAC;QACF,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,OAAO,GAAG;YACd,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE;YAC1D,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE;SACvD,CAAC;QACF,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AASH,SAAS,gBAAgB,CAAC,IAAc;IACtC,IAAI,MAAM,GAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,YAAY,EAAE,CAAC;IACvB,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;SAC/B,MAAM,CAAC,OAAO,EAAE,6BAA6B,CAAC;SAC9C,MAAM,CAAC,cAAc,EAAE,6BAA6B,CAAC;SACrD,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC;SAC/C,MAAM,CAAC,CAAC,OAA2B,EAAE,IAA6B,EAAE,EAAE;QACrE,MAAM,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;IACL,OAAO,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,gFAAgF;AAEhF,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,oEAAoE;QACpE,mEAAmE;QACnE,oEAAoE;QACpE,mDAAmD;QACnD,+DAA+D;QAC/D,sEAAsE;QACtE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAChC,OAAO,CAAC,GAAG,EAAE,EACb,6BAA6B,CAC9B,CAAC;QAEF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAClC,kEAAkE;YAClE,kDAAkD;YAClD,OAAO,CAAC,IAAI,CAAC,qCAAqC,aAAa,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;QACpD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAE1C,qEAAqE;QACrE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAE1C,gCAAgC;QAChC,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QACjE,MAAM,CAAC,SAAS,EAAE,uCAAuC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAEjG,0BAA0B;QAC1B,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,OAAO,EAAE,CAAC;YAClC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,oBAAoB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/auth-status.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Auth credential inspector — reads from auth-service (single source of truth).
+ *
+ * Falls back to local accounts.json only if needed for token redaction tests.
+ * Auth-service is always authoritative; reading local files risks showing
+ * phantom credentials that no longer exist in the live vault.
+ *
+ * Token security (T4): accessToken and refreshToken fields are NEVER read
+ * into variables used in output. Only safe fields are touched.
+ */
+import { type CredentialState } from '@olam/auth-logic';
+import type { AuthAccountSummary } from '@olam/core/src/auth/types.js';
+interface AccountUsage {
+    readonly requestCount5h: number;
+    readonly last429At: string | null;
+}
+interface SafeAccount {
+    readonly id: string;
+    readonly accountLabel?: string;
+    readonly expiresAt?: number;
+    readonly rateLimited?: boolean;
+    readonly rateLimitResetsAt?: string;
+    readonly lastUsed?: string;
+    readonly state?: CredentialState;
+    readonly usage?: AccountUsage;
+}
+export declare function readAccountsFile(filePath: string): SafeAccount[];
+export interface FormatResult {
+    output: string;
+    exitCode: 0 | 2;
+}
+export declare function formatAuthStatus(accounts: SafeAccount[], now?: number): FormatResult;
+/**
+ * Run `olam auth status`.
+ *
+ * @param getStatus - Injectable status fetcher for tests; defaults to AuthClient.status().
+ */
+export declare function runAuthStatus(getStatus?: () => Promise<{
+    reachable: boolean;
+    accounts: readonly AuthAccountSummary[];
+}>): Promise<void>;
+export {};
+//# sourceMappingURL=auth-status.d.ts.map

package/dist/commands/auth-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-status.d.ts","sourceRoot":"","sources":["../../src/commands/auth-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,EAAqD,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAG3G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,UAAU,YAAY;IACpB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAGD,UAAU,WAAW;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;CAC/B;AAcD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,EAAE,CAiChE;AA+CD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;CACjB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,WAAW,EAAE,EACvB,GAAG,GAAE,MAAmB,GACvB,YAAY,CAiFd;AAoBD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAA;CAAE,CAAC,GACzF,OAAO,CAAC,IAAI,CAAC,CA8Bf"}

package/dist/commands/auth-status.js

@@ -0,0 +1,208 @@
+/**
+ * Auth credential inspector — reads from auth-service (single source of truth).
+ *
+ * Falls back to local accounts.json only if needed for token redaction tests.
+ * Auth-service is always authoritative; reading local files risks showing
+ * phantom credentials that no longer exist in the live vault.
+ *
+ * Token security (T4): accessToken and refreshToken fields are NEVER read
+ * into variables used in output. Only safe fields are touched.
+ */
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import pc from 'picocolors';
+import { effectiveState, pickCredential, nextCooldownReset } from '@olam/auth-logic';
+import { AuthClient } from '@olam/core/src/auth/index.js';
+import { printError } from '../output.js';
+// ----- file path (mirrors auth-service/src/store.ts) -------------------
+const DOCKER_DATA_DIR = '/auth-data';
+const LOCAL_DATA_DIR = path.join(os.homedir(), '.olam', 'auth-data');
+function resolveAccountsPath() {
+    if (fs.existsSync(DOCKER_DATA_DIR)) {
+        return path.join(DOCKER_DATA_DIR, 'accounts.json');
+    }
+    return path.join(LOCAL_DATA_DIR, 'accounts.json');
+}
+export function readAccountsFile(filePath) {
+    if (!fs.existsSync(filePath))
+        return [];
+    try {
+        const raw = fs.readFileSync(filePath, 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed))
+            return [];
+        // Project only safe fields; accessToken / refreshToken are never extracted.
+        return parsed.map((r) => ({
+            id: String(r['id'] ?? ''),
+            accountLabel: r['accountLabel'] != null ? String(r['accountLabel']) : undefined,
+            expiresAt: typeof r['expiresAt'] === 'number' ? r['expiresAt'] : undefined,
+            rateLimited: typeof r['rateLimited'] === 'boolean' ? r['rateLimited'] : undefined,
+            rateLimitResetsAt: typeof r['rateLimitResetsAt'] === 'string' ? r['rateLimitResetsAt'] : undefined,
+            lastUsed: typeof r['lastUsed'] === 'string' ? r['lastUsed'] : undefined,
+            state: isCredentialState(r['state']) ? r['state'] : undefined,
+            usage: r['usage'] != null && typeof r['usage'] === 'object'
+                ? {
+                    requestCount5h: typeof r['usage']['requestCount5h'] === 'number'
+                        ? r['usage']['requestCount5h']
+                        : 0,
+                    last429At: typeof r['usage']['last429At'] === 'string'
+                        ? r['usage']['last429At']
+                        : null,
+                }
+                : undefined,
+        }));
+    }
+    catch {
+        return [];
+    }
+}
+function isCredentialState(v) {
+    return v === 'active' || v === 'cooldown' || v === 'expired' || v === 'disabled';
+}
+// ----- formatting helpers -----------------------------------------------
+function localHHMM(isoStr) {
+    const d = new Date(isoStr);
+    return d.toLocaleTimeString(undefined, {
+        hour: '2-digit',
+        minute: '2-digit',
+        hour12: false,
+    });
+}
+function daysAgoStr(expiresAt, now) {
+    const diffDays = Math.floor((now - expiresAt) / (1000 * 60 * 60 * 24));
+    if (diffDays <= 0)
+        return 'expired today';
+    return `expired ${diffDays} day${diffDays === 1 ? '' : 's'} ago`;
+}
+function trunc(s, maxLen) {
+    return s.length > maxLen ? s.slice(0, maxLen) : s;
+}
+// ----- table builder -----------------------------------------------------
+const STATE_PRIORITY = {
+    active: 0,
+    cooldown: 1,
+    'usage-capped': 2,
+    disabled: 3,
+    expired: 4,
+};
+export function formatAuthStatus(accounts, now = Date.now()) {
+    const picked = pickCredential(accounts, now);
+    const rows = accounts.map((account) => {
+        const state = effectiveState(account, now);
+        const isPicked = picked != null && account.id === picked.id;
+        const req5h = account.usage?.requestCount5h ?? 0;
+        const last429 = account.usage?.last429At ? localHHMM(account.usage.last429At) : 'never';
+        let reason;
+        if (isPicked) {
+            reason = '← selected';
+        }
+        else if (state === 'active') {
+            reason = `req5h=${req5h} (higher than candidate)`;
+        }
+        else if (state === 'cooldown') {
+            const resetTime = account.rateLimitResetsAt ? localHHMM(account.rateLimitResetsAt) : '?';
+            reason = `cooldown until ${resetTime}`;
+        }
+        else if (state === 'expired') {
+            reason = daysAgoStr(account.expiresAt ?? 0, now);
+        }
+        else {
+            reason = 'disabled';
+        }
+        return { id: account.id, label: account.accountLabel ?? account.id, state, reason, req5h, last429, isPicked };
+    });
+    rows.sort((a, b) => {
+        if (a.isPicked !== b.isPicked)
+            return a.isPicked ? -1 : 1;
+        return STATE_PRIORITY[a.state] - STATE_PRIORITY[b.state];
+    });
+    const COL = { id: 17, label: 17, state: 11, reason: 28, req5h: 7 };
+    const lines = [];
+    const hdr = 'id'.padEnd(COL.id) +
+        'label'.padEnd(COL.label) +
+        'state'.padEnd(COL.state) +
+        'reason'.padEnd(COL.reason) +
+        'req5h'.padEnd(COL.req5h) +
+        'last429';
+    lines.push(pc.dim(hdr));
+    lines.push(pc.dim('-'.repeat(hdr.length)));
+    for (const row of rows) {
+        const id = trunc(row.id, 16).padEnd(COL.id);
+        const label = trunc(row.label, 16).padEnd(COL.label);
+        const stateRaw = row.state.padEnd(COL.state);
+        const stateColored = row.state === 'active'
+            ? pc.green(stateRaw)
+            : row.state === 'cooldown'
+                ? pc.yellow(stateRaw)
+                : row.state === 'expired'
+                    ? pc.red(stateRaw)
+                    : pc.dim(stateRaw);
+        const reason = row.reason.padEnd(COL.reason);
+        const req5h = String(row.req5h).padEnd(COL.req5h);
+        if (row.isPicked) {
+            lines.push(pc.bold(id) + pc.bold(label) + stateColored + pc.green(reason) + pc.dim(req5h) + pc.dim(row.last429));
+        }
+        else {
+            lines.push(id + label + stateColored + reason + pc.dim(req5h) + pc.dim(row.last429));
+        }
+    }
+    if (picked == null) {
+        const resetIso = nextCooldownReset(accounts, now);
+        lines.push('');
+        lines.push(resetIso
+            ? pc.yellow(`Next reset: ${localHHMM(resetIso)}`)
+            : pc.dim('No reset scheduled'));
+        return { output: lines.join('\n'), exitCode: 2 };
+    }
+    return { output: lines.join('\n'), exitCode: 0 };
+}
+// ----- CLI entry point ---------------------------------------------------
+/** Projects auth-service account summary to safe local format for formatting. */
+function toSafeAccount(a) {
+    return {
+        id: a.id,
+        accountLabel: a.accountLabel,
+        // expiresAt not exposed in summary — state is pre-computed server-side
+        rateLimited: a.rateLimited,
+        rateLimitResetsAt: a.rateLimitResetsAt,
+        lastUsed: a.lastUsed,
+        state: a.state,
+        usage: a.usage
+            ? { requestCount5h: a.usage.requestCount5h, last429At: a.usage.last429At }
+            : undefined,
+    };
+}
+/**
+ * Run `olam auth status`.
+ *
+ * @param getStatus - Injectable status fetcher for tests; defaults to AuthClient.status().
+ */
+export async function runAuthStatus(getStatus) {
+    const fetchStatus = getStatus ?? (() => new AuthClient().status());
+    let status;
+    try {
+        status = await fetchStatus();
+    }
+    catch {
+        printError('Failed to contact auth service. Run `olam auth up` first.');
+        process.exitCode = 1;
+        return;
+    }
+    if (!status.reachable) {
+        printError('Auth container is not reachable. Run `olam auth up` first.');
+        process.exitCode = 1;
+        return;
+    }
+    if (status.accounts.length === 0) {
+        console.log(pc.dim('No credentials found. Run: olam auth login'));
+        return;
+    }
+    const accounts = status.accounts.map(toSafeAccount);
+    const result = formatAuthStatus(accounts);
+    console.log(result.output);
+    if (result.exitCode !== 0) {
+        process.exitCode = result.exitCode;
+    }
+}
+//# sourceMappingURL=auth-status.js.map

package/dist/commands/auth-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-status.js","sourceRoot":"","sources":["../../src/commands/auth-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAwB,MAAM,kBAAkB,CAAC;AAC3G,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAoB1C,0EAA0E;AAE1E,MAAM,eAAe,GAAG,YAAY,CAAC;AACrC,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AAErE,SAAS,mBAAmB;IAC1B,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,4EAA4E;QAC5E,OAAQ,MAAoC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvD,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,YAAY,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;YAC/E,SAAS,EAAE,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YAC1E,WAAW,EAAE,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;YACjF,iBAAiB,EACf,OAAO,CAAC,CAAC,mBAAmB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS;YACjF,QAAQ,EAAE,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;YACvE,KAAK,EAAE,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7D,KAAK,EACH,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ;gBAClD,CAAC,CAAC;oBACE,cAAc,EACZ,OAAQ,CAAC,CAAC,OAAO,CAA6B,CAAC,gBAAgB,CAAC,KAAK,QAAQ;wBAC3E,CAAC,CAAG,CAAC,CAAC,OAAO,CAA6B,CAAC,gBAAgB,CAAY;wBACvE,CAAC,CAAC,CAAC;oBACP,SAAS,EACP,OAAQ,CAAC,CAAC,OAAO,CAA6B,CAAC,WAAW,CAAC,KAAK,QAAQ;wBACtE,CAAC,CAAG,CAAC,CAAC,OAAO,CAA6B,CAAC,WAAW,CAAY;wBAClE,CAAC,CAAC,IAAI;iBACX;gBACH,CAAC,CAAC,SAAS;SAChB,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAU;IACnC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,UAAU,CAAC;AACnF,CAAC;AAED,2EAA2E;AAE3E,SAAS,SAAS,CAAC,MAAc;IAC/B,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;QACrC,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,SAAiB,EAAE,GAAW;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACvE,IAAI,QAAQ,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC;IAC1C,OAAO,WAAW,QAAQ,OAAO,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;AACnE,CAAC;AAED,SAAS,KAAK,CAAC,CAAS,EAAE,MAAc;IACtC,OAAO,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,4EAA4E;AAE5E,MAAM,cAAc,GAAoC;IACtD,MAAM,EAAE,CAAC;IACT,QAAQ,EAAE,CAAC;IACX,cAAc,EAAE,CAAC;IACjB,QAAQ,EAAE,CAAC;IACX,OAAO,EAAE,CAAC;CACX,CAAC;AAiBF,MAAM,UAAU,gBAAgB,CAC9B,QAAuB,EACvB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAE7C,MAAM,IAAI,GAAe,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,IAAI,IAAI,IAAI,OAAO,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,cAAc,IAAI,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAExF,IAAI,MAAc,CAAC;QACnB,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,YAAY,CAAC;QACxB,CAAC;aAAM,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,GAAG,SAAS,KAAK,0BAA0B,CAAC;QACpD,CAAC;aAAM,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YAChC,MAAM,SAAS,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YACzF,MAAM,GAAG,kBAAkB,SAAS,EAAE,CAAC;QACzC,CAAC;aAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,UAAU,CAAC;QACtB,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAChH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjB,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAEnE,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,GAAG,GACP,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QACzB,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QACzB,SAAS,CAAC;IACZ,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAE3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,YAAY,GAChB,GAAG,CAAC,KAAK,KAAK,QAAQ;YACpB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;YACpB,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,UAAU;gBACxB,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACrB,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS;oBACvB,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAClB,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAElD,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,YAAY,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CACrG,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,GAAG,YAAY,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CACR,QAAQ;YACN,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,eAAe,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CACjC,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACnD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,4EAA4E;AAE5E,iFAAiF;AACjF,SAAS,aAAa,CAAC,CAAqB;IAC1C,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,uEAAuE;QACvE,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;QACtC,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK;YACZ,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE;YAC1E,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAA0F;IAE1F,MAAM,WAAW,GAAG,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,IAAI,MAAuE,CAAC;IAE5E,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,WAAW,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,CAAC,2DAA2D,CAAC,CAAC;QACxE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,UAAU,CAAC,4DAA4D,CAAC,CAAC;QACzE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAE3B,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACrC,CAAC;AACH,CAAC"}

package/dist/commands/auth-upgrade.d.ts

@@ -0,0 +1,47 @@
+/**
+ * `olam auth upgrade` — rebuild the olam-auth image and force-recreate the container.
+ *
+ * Steps:
+ *   bash build-auth.sh (rebuilds olam-auth:local with latest source + git SHA)
+ *   docker stop olam-auth + docker rm olam-auth
+ *   olam auth up logic (docker run with correct env vars via AuthContainerController)
+ *   wait for /health
+ *   smoke test: POST /credentials/add provider=codex must NOT return a Claude URL
+ */
+import type { Command } from 'commander';
+export interface AuthUpgradeOpts {
+    readonly yes: boolean;
+    readonly skipRecreate: boolean;
+}
+/** Normalise raw Commander option object into typed opts. */
+export declare function parseAuthUpgradeOpts(raw: {
+    yes?: boolean;
+    skipRecreate?: boolean;
+}): AuthUpgradeOpts;
+/**
+ * Check cwd looks like the olam repo root for auth-service.
+ * Verifies packages/auth-service/Dockerfile exists.
+ */
+export declare function validateAuthRepoRoot(cwd: string): {
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+};
+/** Block until auth service /health responds OK or timeout expires. */
+export declare function waitForAuthHealth(timeoutMs?: number): Promise<boolean>;
+/**
+ * Smoke test: POST /credentials/add with provider=codex.
+ *
+ * Passes when the response does NOT contain a claude.com/claude.ai loginUrl.
+ * A stale (pre-codex) image falls through to the Claude PKCE branch and
+ * returns a claude.com URL — this gate catches that.
+ */
+export declare function smokeTestCodexProvider(authSecret: string | null): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+}>;
+export declare function registerAuthUpgrade(auth: Command): void;
+//# sourceMappingURL=auth-upgrade.d.ts.map

package/dist/commands/auth-upgrade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-upgrade.d.ts","sourceRoot":"","sources":["../../src/commands/auth-upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAezC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,6DAA6D;AAC7D,wBAAgB,oBAAoB,CAAC,GAAG,EAAE;IACxC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GAAG,eAAe,CAKlB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAW7F;AAED,uEAAuE;AACvE,wBAAsB,iBAAiB,CAAC,SAAS,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAc5E;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAuCtD;AAiMD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CASvD"}