@cogenta/fleet 0.1.0

package/dist/rollout/campaign.d.ts

@@ -0,0 +1,103 @@
+import { type DatabaseHandle } from '@cogenta/core';
+import type { CommandQueueStore } from '../control/commands.js';
+import type { SiteRisk } from '../control/risk.js';
+import type { SiteStateStore } from '../control/state.js';
+import type { InventoryComponentKind } from '../inventory/drift.js';
+/**
+ * "## Mises à jour groupées" (`docs/lots/L8-flotte.md`): "1. Sélection d'un
+ * site canari. 2. Application, vérification automatique... 3. Si succès,
+ * vague suivante — 10%, puis 50%, puis le reste."
+ *
+ * **The single most important architectural decision in this module**:
+ * verification is real but ASYNCHRONOUS. "Le plan de contrôle n'ouvre jamais
+ * de connexion [entrante] vers un site" is absolute, since task 1 — a
+ * synchronous HTTP probe from the control plane to a site would violate it.
+ * "Le site répond, les pages clés se rendent" is instead learned from the
+ * site's own NEXT scheduled contact (its regular telemetry push, tasks 2/3's
+ * real ingestion path): if a site keeps contacting the control plane after
+ * an update was dispatched to it, and its self-reported inventory
+ * (`../inventory/drift.js`'s `extractInventory`) now shows the target
+ * version, that IS the verification signal — a real property observable
+ * without the control plane ever reaching toward the site. No new
+ * verification transport is built here; this module only interprets
+ * signals tasks 2/3 already produce.
+ */
+export type CampaignWaveLabel = 'canary' | '10%' | '50%' | 'rest';
+export interface CampaignWave {
+    readonly index: number;
+    readonly label: CampaignWaveLabel;
+    readonly siteIds: readonly string[];
+}
+export type CampaignStatus = 'in_progress' | 'succeeded' | 'halted';
+export type SiteRolloutStatus = 'dispatched' | 'succeeded' | 'failed';
+export interface SiteRolloutRecord {
+    readonly siteId: string;
+    readonly waveIndex: number;
+    readonly status: SiteRolloutStatus;
+    /** The component's version this site reported just before the update was dispatched to it — what a rollback (task 8) restores. `null` when the site had never reported the component at all. */
+    readonly preUpdateVersion: string | null;
+    readonly dispatchedAt: string;
+    readonly resolvedAt: string | null;
+}
+export interface CampaignRecord {
+    readonly id: string;
+    readonly componentKind: InventoryComponentKind;
+    readonly componentName: string;
+    readonly targetVersion: string;
+    readonly waves: readonly CampaignWave[];
+    readonly currentWaveIndex: number;
+    readonly status: CampaignStatus;
+    readonly haltedReason: string | null;
+    readonly createdAt: string;
+    /** Sites a failed wave flagged for rollback — real, actionable state task 8's rollback execution consumes. Never populated except by a genuine wave failure. */
+    readonly failedSiteIds: readonly string[];
+}
+/**
+ * Partitions an already-ordered site-id list into the lot's real four waves.
+ * `orderedSiteIds[0]` is the canary by construction — ordering (who goes
+ * first) is `orderSitesForCanary`'s job, not this function's; this function
+ * only turns "an order" into "wave membership," a real, pure, deterministic
+ * split. "10%"/"50%" are read as percentages of the whole fleet (rounded up,
+ * minimum one site so a small fleet still gets a real staged rollout rather
+ * than one giant wave), each wave's membership disjoint from the ones before
+ * it.
+ */
+export declare function planWaves(orderedSiteIds: readonly string[]): readonly CampaignWave[];
+/**
+ * Real canary-selection rule: the LOWEST-risk site goes first — the safest
+ * real choice available, reusing `../control/risk.js`'s already-real
+ * scoring rather than an arbitrary pick. A site with no matching risk entry
+ * sorts last (never chosen as canary) — an unscored site is not a safe
+ * default canary. Ties break on site name for a fully deterministic order.
+ */
+export declare function orderSitesForCanary(siteIds: readonly string[], risks: readonly SiteRisk[]): readonly string[];
+export interface StartCampaignInput {
+    readonly siteIds: readonly string[];
+    readonly risks: readonly SiteRisk[];
+    readonly componentKind: InventoryComponentKind;
+    readonly componentName: string;
+    readonly targetVersion: string;
+}
+export interface RolloutCampaignStore {
+    startCampaign(input: StartCampaignInput): Promise<CampaignRecord>;
+    /**
+     * Re-evaluates the campaign's current wave against real, already-ingested
+     * telemetry (never probes a site) — advances to the next wave on full
+     * success, halts on any real failure or timeout, or is a no-op if nothing
+     * new has happened yet. Idempotent: calling this repeatedly against an
+     * unchanged state re-derives the same result rather than double-advancing.
+     */
+    checkProgress(campaignId: string, now?: () => number, timeoutMs?: number): Promise<CampaignRecord>;
+    /** Reloads a campaign from real persisted storage — proves campaign state survives a control-plane restart. */
+    getCampaign(campaignId: string): Promise<CampaignRecord | null>;
+    /**
+     * Every real rollout record for one site within one campaign (task 8's
+     * real version-history read path) — ordered oldest wave first. A site
+     * only ever appears in one wave per campaign, so this is normally a
+     * single-element list, but the shape stays an array rather than assuming
+     * that never changes.
+     */
+    getSiteRolloutRecords(campaignId: string, siteId: string): Promise<readonly SiteRolloutRecord[]>;
+}
+export declare function createRolloutCampaignStore(db: DatabaseHandle, commandQueueStore: CommandQueueStore, stateStore: SiteStateStore, now?: () => number): RolloutCampaignStore;
+//# sourceMappingURL=campaign.d.ts.map

package/dist/rollout/campaign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"campaign.d.ts","sourceRoot":"","sources":["../../src/rollout/campaign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,cAAc,EAA0B,MAAM,eAAe,CAAA;AAEzF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAInE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,CAAA;AAEjE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,MAAM,MAAM,cAAc,GAAG,aAAa,GAAG,WAAW,GAAG,QAAQ,CAAA;AACnE,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,WAAW,GAAG,QAAQ,CAAA;AAErE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAA;IAClC,gMAAgM;IAChM,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAA;IAC9C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;IACvC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,gKAAgK;IAChK,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;CAC1C;AAWD;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,YAAY,EAAE,CA6BpF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,KAAK,EAAE,SAAS,QAAQ,EAAE,GACzB,SAAS,MAAM,EAAE,CAYnB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAA;IACnC,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAA;IAC9C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IACjE;;;;;;OAMG;IACH,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IAClG,+GAA+G;IAC/G,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAA;IAC/D;;;;;;OAMG;IACH,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAAA;CACjG;AAoDD,wBAAgB,0BAA0B,CACxC,EAAE,EAAE,cAAc,EAClB,iBAAiB,EAAE,iBAAiB,EACpC,UAAU,EAAE,cAAc,EAC1B,GAAG,GAAE,MAAM,MAAiB,GAC3B,oBAAoB,CAgNtB"}

package/dist/rollout/campaign.js

@@ -0,0 +1,258 @@
+import { CogentaError, identifier, newId, sql } from '@cogenta/core';
+import { compareVersions, parseVersion } from '@cogenta/plugins';
+import { extractInventory } from '../inventory/drift.js';
+import { ROLLOUT_TABLES } from './tables.js';
+/**
+ * "Un échec arrête toute la campagne" — waves 10%/50%/rest of a campaign
+ * halted after wave N never receive an `update` command at all (not "receive
+ * one but are told to ignore it"): `startCampaign`/`checkProgress` below only
+ * ever call `commandQueueStore.enqueue` for the wave they are actively
+ * dispatching, and a halted campaign's `checkProgress` is a real no-op.
+ */
+const DEFAULT_TIMEOUT_MS = 24 * 60 * 60 * 1000; // one real daily contact cycle, matching the retention/cadence reasoning in `../control/state.ts`
+/**
+ * Partitions an already-ordered site-id list into the lot's real four waves.
+ * `orderedSiteIds[0]` is the canary by construction — ordering (who goes
+ * first) is `orderSitesForCanary`'s job, not this function's; this function
+ * only turns "an order" into "wave membership," a real, pure, deterministic
+ * split. "10%"/"50%" are read as percentages of the whole fleet (rounded up,
+ * minimum one site so a small fleet still gets a real staged rollout rather
+ * than one giant wave), each wave's membership disjoint from the ones before
+ * it.
+ */
+export function planWaves(orderedSiteIds) {
+    const total = orderedSiteIds.length;
+    if (total === 0)
+        return [];
+    const waves = [];
+    let cursor = 0;
+    const canary = orderedSiteIds.slice(cursor, cursor + 1);
+    cursor += canary.length;
+    waves.push({ index: 0, label: 'canary', siteIds: canary });
+    if (cursor >= total)
+        return waves;
+    const tenPercentCount = Math.max(1, Math.ceil(total * 0.1));
+    const wave2End = Math.min(total, cursor + tenPercentCount);
+    const wave2 = orderedSiteIds.slice(cursor, wave2End);
+    cursor = wave2End;
+    if (wave2.length > 0)
+        waves.push({ index: waves.length, label: '10%', siteIds: wave2 });
+    if (cursor >= total)
+        return waves;
+    const fiftyPercentCount = Math.max(1, Math.ceil(total * 0.5));
+    const wave3End = Math.min(total, cursor + fiftyPercentCount);
+    const wave3 = orderedSiteIds.slice(cursor, wave3End);
+    cursor = wave3End;
+    if (wave3.length > 0)
+        waves.push({ index: waves.length, label: '50%', siteIds: wave3 });
+    if (cursor >= total)
+        return waves;
+    const rest = orderedSiteIds.slice(cursor);
+    if (rest.length > 0)
+        waves.push({ index: waves.length, label: 'rest', siteIds: rest });
+    return waves;
+}
+/**
+ * Real canary-selection rule: the LOWEST-risk site goes first — the safest
+ * real choice available, reusing `../control/risk.js`'s already-real
+ * scoring rather than an arbitrary pick. A site with no matching risk entry
+ * sorts last (never chosen as canary) — an unscored site is not a safe
+ * default canary. Ties break on site name for a fully deterministic order.
+ */
+export function orderSitesForCanary(siteIds, risks) {
+    const byId = new Map(risks.map((risk) => [risk.siteId, risk]));
+    return [...siteIds].sort((a, b) => {
+        const riskA = byId.get(a);
+        const riskB = byId.get(b);
+        const scoreA = riskA?.score ?? Number.POSITIVE_INFINITY;
+        const scoreB = riskB?.score ?? Number.POSITIVE_INFINITY;
+        if (scoreA !== scoreB)
+            return scoreA - scoreB;
+        const nameA = riskA?.siteName ?? a;
+        const nameB = riskB?.siteName ?? b;
+        return nameA.localeCompare(nameB);
+    });
+}
+function campaignNotFound(campaignId) {
+    throw new CogentaError({
+        code: 'FLEET_CAMPAIGN_NOT_FOUND',
+        message: `No rollout campaign with id "${campaignId}".`,
+        hint: 'Check the campaign id, or call startCampaign first.',
+        details: { campaignId },
+    });
+}
+/** An internal invariant violation — a campaign row this store itself just wrote is unreadable a moment later. Never expected; a real, typed error rather than a bare throw if it somehow happens. */
+function campaignStateCorrupt(campaignId, when) {
+    throw new CogentaError({
+        code: 'FLEET_CAMPAIGN_STATE_CORRUPT',
+        message: `Campaign "${campaignId}" could not be reloaded ${when} — its own row is missing.`,
+        hint: 'This indicates a storage-layer bug, not a caller error.',
+        details: { campaignId, when },
+    });
+}
+function versionReached(reported, target) {
+    if (reported === target)
+        return true;
+    const reportedParsed = parseVersion(reported);
+    const targetParsed = parseVersion(target);
+    if (reportedParsed === null || targetParsed === null)
+        return false;
+    return compareVersions(reportedParsed, targetParsed) >= 0;
+}
+export function createRolloutCampaignStore(db, commandQueueStore, stateStore, now = Date.now) {
+    const campaigns = identifier(ROLLOUT_TABLES.campaigns, db.dialect);
+    const siteStatus = identifier(ROLLOUT_TABLES.siteStatus, db.dialect);
+    async function componentVersionOf(siteId, kind, name) {
+        const snapshot = await stateStore.latest(siteId);
+        if (snapshot === null)
+            return null;
+        const inventory = extractInventory(snapshot);
+        const component = inventory.components.find((c) => c.kind === kind && c.name === name);
+        return component?.version ?? null;
+    }
+    async function dispatchWave(campaignId, wave, componentKind, componentName, targetVersion) {
+        const dispatchedAt = new Date(now()).toISOString();
+        for (const siteId of wave.siteIds) {
+            const preUpdateVersion = await componentVersionOf(siteId, componentKind, componentName);
+            await commandQueueStore.enqueue(siteId, 'update', {
+                componentKind,
+                componentName,
+                targetVersion,
+            });
+            await db.query(sql `
+        insert into ${siteStatus}
+          (id, campaign_id, site_id, wave_index, status, pre_update_version, dispatched_at, resolved_at)
+        values
+          (${newId(now)}, ${campaignId}, ${siteId}, ${wave.index}, ${'dispatched'}, ${preUpdateVersion}, ${dispatchedAt}, ${null})`);
+        }
+    }
+    async function loadCampaign(campaignId) {
+        const result = await db.query(sql `select id, component_kind, component_name, target_version, waves_json, current_wave_index, status, halted_reason, created_at from ${campaigns} where id = ${campaignId}`);
+        const row = result.rows[0];
+        if (row === undefined)
+            return null;
+        const failedRows = await db.query(sql `select distinct site_id from ${siteStatus} where campaign_id = ${campaignId} and status = ${'failed'}`);
+        return {
+            id: row.id,
+            componentKind: row.component_kind,
+            componentName: row.component_name,
+            targetVersion: row.target_version,
+            waves: JSON.parse(row.waves_json),
+            currentWaveIndex: Number(row.current_wave_index),
+            status: row.status,
+            haltedReason: row.halted_reason,
+            createdAt: row.created_at,
+            failedSiteIds: failedRows.rows.map((r) => r.site_id),
+        };
+    }
+    return {
+        async startCampaign(input) {
+            const orderedIds = orderSitesForCanary(input.siteIds, input.risks);
+            const waves = planWaves(orderedIds);
+            const id = newId(now);
+            const createdAt = new Date(now()).toISOString();
+            await db.query(sql `
+        insert into ${campaigns}
+          (id, component_kind, component_name, target_version, waves_json, current_wave_index, status, halted_reason, created_at)
+        values
+          (${id}, ${input.componentKind}, ${input.componentName}, ${input.targetVersion}, ${JSON.stringify(waves)}, ${0}, ${'in_progress'}, ${null}, ${createdAt})`);
+            const firstWave = waves[0];
+            if (firstWave !== undefined) {
+                await dispatchWave(id, firstWave, input.componentKind, input.componentName, input.targetVersion);
+            }
+            const campaign = await loadCampaign(id);
+            if (campaign === null)
+                return campaignStateCorrupt(id, 'immediately after insert');
+            return campaign;
+        },
+        async checkProgress(campaignId, clock = now, timeoutMs = DEFAULT_TIMEOUT_MS) {
+            const campaign = await loadCampaign(campaignId);
+            if (campaign === null)
+                return campaignNotFound(campaignId);
+            if (campaign.status !== 'in_progress')
+                return campaign;
+            const currentWave = campaign.waves[campaign.currentWaveIndex];
+            if (currentWave === undefined)
+                return campaign;
+            const rows = await db.query(sql `select id, campaign_id, site_id, wave_index, status, pre_update_version, dispatched_at, resolved_at from ${siteStatus} where campaign_id = ${campaignId} and wave_index = ${currentWave.index}`);
+            let anyFailed = false;
+            let allResolved = true;
+            for (const row of rows.rows) {
+                if (row.status !== 'dispatched') {
+                    if (row.status === 'failed')
+                        anyFailed = true;
+                    continue;
+                }
+                const snapshot = await stateStore.latest(row.site_id);
+                const dispatchedAt = row.dispatched_at === null ? 0 : new Date(row.dispatched_at).getTime();
+                if (snapshot !== null && new Date(snapshot.ingestedAt).getTime() > dispatchedAt) {
+                    const inventory = extractInventory(snapshot);
+                    const component = inventory.components.find((c) => c.kind === campaign.componentKind && c.name === campaign.componentName);
+                    const reached = component !== undefined && versionReached(component.version, campaign.targetVersion);
+                    const resolvedAt = new Date(clock()).toISOString();
+                    const status = reached ? 'succeeded' : 'failed';
+                    await db.query(sql `update ${siteStatus} set status = ${status}, resolved_at = ${resolvedAt} where id = ${row.id}`);
+                    if (!reached)
+                        anyFailed = true;
+                    continue;
+                }
+                // No new, post-dispatch telemetry yet — inconclusive. A real,
+                // bounded timeout also counts as failure: a site that never checks
+                // back in is exactly as unsafe to advance past as one that reports
+                // a real problem.
+                if (clock() - dispatchedAt > timeoutMs) {
+                    const resolvedAt = new Date(clock()).toISOString();
+                    await db.query(sql `update ${siteStatus} set status = ${'failed'}, resolved_at = ${resolvedAt} where id = ${row.id}`);
+                    anyFailed = true;
+                    continue;
+                }
+                allResolved = false;
+            }
+            if (anyFailed) {
+                await db.query(sql `
+          update ${campaigns} set status = ${'halted'}, halted_reason = ${`wave "${currentWave.label}" reported a failure`}
+          where id = ${campaignId}`);
+                const halted = await loadCampaign(campaignId);
+                if (halted === null)
+                    return campaignStateCorrupt(campaignId, 'during halt');
+                return halted;
+            }
+            if (!allResolved) {
+                const stillInProgress = await loadCampaign(campaignId);
+                if (stillInProgress === null)
+                    return campaignStateCorrupt(campaignId, 'mid-check');
+                return stillInProgress;
+            }
+            // Every site in the current wave succeeded — advance, or finish.
+            const nextIndex = campaign.currentWaveIndex + 1;
+            const nextWave = campaign.waves[nextIndex];
+            if (nextWave === undefined) {
+                await db.query(sql `update ${campaigns} set status = ${'succeeded'} where id = ${campaignId}`);
+            }
+            else {
+                await db.query(sql `update ${campaigns} set current_wave_index = ${nextIndex} where id = ${campaignId}`);
+                await dispatchWave(campaignId, nextWave, campaign.componentKind, campaign.componentName, campaign.targetVersion);
+            }
+            const advanced = await loadCampaign(campaignId);
+            if (advanced === null)
+                return campaignStateCorrupt(campaignId, 'after advancing');
+            return advanced;
+        },
+        getCampaign: loadCampaign,
+        async getSiteRolloutRecords(campaignId, siteId) {
+            const rows = await db.query(sql `
+        select id, campaign_id, site_id, wave_index, status, pre_update_version, dispatched_at, resolved_at
+        from ${siteStatus} where campaign_id = ${campaignId} and site_id = ${siteId}
+        order by wave_index asc`);
+            return rows.rows.map((row) => ({
+                siteId: row.site_id,
+                waveIndex: row.wave_index,
+                status: row.status,
+                preUpdateVersion: row.pre_update_version,
+                dispatchedAt: row.dispatched_at ?? '',
+                resolvedAt: row.resolved_at,
+            }));
+        },
+    };
+}
+//# sourceMappingURL=campaign.js.map

package/dist/rollout/campaign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"campaign.js","sourceRoot":"","sources":["../../src/rollout/campaign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAKhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAwD5C;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,kGAAkG;AAEjJ;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,cAAiC;IACzD,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAA;IACnC,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAE1B,MAAM,KAAK,GAAmB,EAAE,CAAA;IAChC,IAAI,MAAM,GAAG,CAAC,CAAA;IAEd,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,CAAA;IACvD,MAAM,IAAI,MAAM,CAAC,MAAM,CAAA;IACvB,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;IAC1D,IAAI,MAAM,IAAI,KAAK;QAAE,OAAO,KAAK,CAAA;IAEjC,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAA;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAAC,CAAA;IAC1D,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACpD,MAAM,GAAG,QAAQ,CAAA;IACjB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;IACvF,IAAI,MAAM,IAAI,KAAK;QAAE,OAAO,KAAK,CAAA;IAEjC,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAA;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAAC,CAAA;IAC5D,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACpD,MAAM,GAAG,QAAQ,CAAA;IACjB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;IACvF,IAAI,MAAM,IAAI,KAAK;QAAE,OAAO,KAAK,CAAA;IAEjC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IACtF,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA0B,EAC1B,KAA0B;IAE1B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAU,CAAC,CAAC,CAAA;IACvE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACzB,MAAM,MAAM,GAAG,KAAK,EAAE,KAAK,IAAI,MAAM,CAAC,iBAAiB,CAAA;QACvD,MAAM,MAAM,GAAG,KAAK,EAAE,KAAK,IAAI,MAAM,CAAC,iBAAiB,CAAA;QACvD,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,MAAM,GAAG,MAAM,CAAA;QAC7C,MAAM,KAAK,GAAG,KAAK,EAAE,QAAQ,IAAI,CAAC,CAAA;QAClC,MAAM,KAAK,GAAG,KAAK,EAAE,QAAQ,IAAI,CAAC,CAAA;QAClC,OAAO,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;AACJ,CAAC;AAuDD,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,MAAM,IAAI,YAAY,CAAC;QACrB,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,gCAAgC,UAAU,IAAI;QACvD,IAAI,EAAE,qDAAqD;QAC3D,OAAO,EAAE,EAAE,UAAU,EAAE;KACxB,CAAC,CAAA;AACJ,CAAC;AAED,sMAAsM;AACtM,SAAS,oBAAoB,CAAC,UAAkB,EAAE,IAAY;IAC5D,MAAM,IAAI,YAAY,CAAC;QACrB,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,aAAa,UAAU,2BAA2B,IAAI,4BAA4B;QAC3F,IAAI,EAAE,yDAAyD;QAC/D,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;KAC9B,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,MAAc;IACtD,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IACpC,MAAM,cAAc,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IAC7C,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,cAAc,KAAK,IAAI,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAClE,OAAO,eAAe,CAAC,cAAc,EAAE,YAAY,CAAC,IAAI,CAAC,CAAA;AAC3D,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,EAAkB,EAClB,iBAAoC,EACpC,UAA0B,EAC1B,GAAG,GAAiB,IAAI,CAAC,GAAG;IAE5B,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAClE,MAAM,UAAU,GAAG,UAAU,CAAC,cAAc,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAEpE,KAAK,UAAU,kBAAkB,CAC/B,MAAc,EACd,IAA4B,EAC5B,IAAY;QAEZ,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAClC,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;QAC5C,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;QACtF,OAAO,SAAS,EAAE,OAAO,IAAI,IAAI,CAAA;IACnC,CAAC;IAED,KAAK,UAAU,YAAY,CACzB,UAAkB,EAClB,IAAkB,EAClB,aAAqC,EACrC,aAAqB,EACrB,aAAqB;QAErB,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QAClD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,gBAAgB,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,aAAa,CAAC,CAAA;YACvF,MAAM,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE;gBAChD,aAAa;gBACb,aAAa;gBACb,aAAa;aACd,CAAC,CAAA;YACF,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,UAAU;;;aAGnB,KAAK,CAAC,GAAG,CAAC,KAAK,UAAU,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,KAAK,YAAY,KAAK,gBAAgB,KAAK,YAAY,KAAK,IAAI,GAAG,CAAC,CAAA;QAChI,CAAC;IACH,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,UAAkB;QAC5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,qIAAqI,SAAS,eAAe,UAAU,EAAE,CAC7K,CAAA;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC1B,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QAElC,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,KAAK,CAC/B,GAAG,CAAA,gCAAgC,UAAU,wBAAwB,UAAU,iBAAiB,QAAQ,EAAE,CAC3G,CAAA;QAED,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,aAAa,EAAE,GAAG,CAAC,cAAwC;YAC3D,aAAa,EAAE,GAAG,CAAC,cAAc;YACjC,aAAa,EAAE,GAAG,CAAC,cAAc;YACjC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAA4B;YAC5D,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAChD,MAAM,EAAE,GAAG,CAAC,MAAwB;YACpC,YAAY,EAAE,GAAG,CAAC,aAAa;YAC/B,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SACrD,CAAA;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,aAAa,CAAC,KAAK;YACvB,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;YAClE,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;YACnC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;YACrB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAE/C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,SAAS;;;aAGlB,EAAE,KAAK,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,aAAa,KAAK,IAAI,KAAK,SAAS,GAAG,CAAC,CAAA;YAE9J,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;YAC1B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,YAAY,CAChB,EAAE,EACF,SAAS,EACT,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,aAAa,EACnB,KAAK,CAAC,aAAa,CACpB,CAAA;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAA;YACvC,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,oBAAoB,CAAC,EAAE,EAAE,0BAA0B,CAAC,CAAA;YAClF,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,UAAU,EAAE,KAAK,GAAG,GAAG,EAAE,SAAS,GAAG,kBAAkB;YACzE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,CAAA;YAC/C,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,gBAAgB,CAAC,UAAU,CAAC,CAAA;YAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,aAAa;gBAAE,OAAO,QAAQ,CAAA;YAEtD,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;YAC7D,IAAI,WAAW,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAA;YAE9C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CACzB,GAAG,CAAA,4GAA4G,UAAU,wBAAwB,UAAU,qBAAqB,WAAW,CAAC,KAAK,EAAE,CACpM,CAAA;YAED,IAAI,SAAS,GAAG,KAAK,CAAA;YACrB,IAAI,WAAW,GAAG,IAAI,CAAA;YAEtB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;oBAChC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;wBAAE,SAAS,GAAG,IAAI,CAAA;oBAC7C,SAAQ;gBACV,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBACrD,MAAM,YAAY,GAAG,GAAG,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAA;gBAE3F,IAAI,QAAQ,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,YAAY,EAAE,CAAC;oBAChF,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;oBAC5C,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,aAAa,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,aAAa,CAC9E,CAAA;oBACD,MAAM,OAAO,GACX,SAAS,KAAK,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAA;oBACtF,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;oBAClD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAA;oBAC/C,MAAM,EAAE,CAAC,KAAK,CACZ,GAAG,CAAA,UAAU,UAAU,iBAAiB,MAAM,mBAAmB,UAAU,eAAe,GAAG,CAAC,EAAE,EAAE,CACnG,CAAA;oBACD,IAAI,CAAC,OAAO;wBAAE,SAAS,GAAG,IAAI,CAAA;oBAC9B,SAAQ;gBACV,CAAC;gBAED,8DAA8D;gBAC9D,mEAAmE;gBACnE,mEAAmE;gBACnE,kBAAkB;gBAClB,IAAI,KAAK,EAAE,GAAG,YAAY,GAAG,SAAS,EAAE,CAAC;oBACvC,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;oBAClD,MAAM,EAAE,CAAC,KAAK,CACZ,GAAG,CAAA,UAAU,UAAU,iBAAiB,QAAQ,mBAAmB,UAAU,eAAe,GAAG,CAAC,EAAE,EAAE,CACrG,CAAA;oBACD,SAAS,GAAG,IAAI,CAAA;oBAChB,SAAQ;gBACV,CAAC;gBAED,WAAW,GAAG,KAAK,CAAA;YACrB,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;mBACP,SAAS,iBAAiB,QAAQ,qBAAqB,SAAS,WAAW,CAAC,KAAK,sBAAsB;uBACnG,UAAU,EAAE,CAAC,CAAA;gBAC5B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,CAAA;gBAC7C,IAAI,MAAM,KAAK,IAAI;oBAAE,OAAO,oBAAoB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;gBAC3E,OAAO,MAAM,CAAA;YACf,CAAC;YAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,eAAe,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,CAAA;gBACtD,IAAI,eAAe,KAAK,IAAI;oBAAE,OAAO,oBAAoB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;gBAClF,OAAO,eAAe,CAAA;YACxB,CAAC;YAED,iEAAiE;YACjE,MAAM,SAAS,GAAG,QAAQ,CAAC,gBAAgB,GAAG,CAAC,CAAA;YAC/C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;YAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,EAAE,CAAC,KAAK,CACZ,GAAG,CAAA,UAAU,SAAS,iBAAiB,WAAW,eAAe,UAAU,EAAE,CAC9E,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,CAAC,KAAK,CACZ,GAAG,CAAA,UAAU,SAAS,6BAA6B,SAAS,eAAe,UAAU,EAAE,CACxF,CAAA;gBACD,MAAM,YAAY,CAChB,UAAU,EACV,QAAQ,EACR,QAAQ,CAAC,aAAa,EACtB,QAAQ,CAAC,aAAa,EACtB,QAAQ,CAAC,aAAa,CACvB,CAAA;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,CAAA;YAC/C,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,oBAAoB,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAA;YACjF,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,WAAW,EAAE,YAAY;QAEzB,KAAK,CAAC,qBAAqB,CAAC,UAAU,EAAE,MAAM;YAC5C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAgB,GAAG,CAAA;;eAErC,UAAU,wBAAwB,UAAU,kBAAkB,MAAM;gCACnD,CAAC,CAAA;YAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAClB,CAAC,GAAG,EAAqB,EAAE,CAAC,CAAC;gBAC3B,MAAM,EAAE,GAAG,CAAC,OAAO;gBACnB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,MAAM,EAAE,GAAG,CAAC,MAA2B;gBACvC,gBAAgB,EAAE,GAAG,CAAC,kBAAkB;gBACxC,YAAY,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE;gBACrC,UAAU,EAAE,GAAG,CAAC,WAAW;aAC5B,CAAC,CACH,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/rollout/rollback.d.ts

@@ -0,0 +1,51 @@
+import type { CommandQueueStore, FleetCommand } from '../control/commands.js';
+import type { InventoryComponentKind } from '../inventory/drift.js';
+import type { CampaignRecord, RolloutCampaignStore } from './campaign.js';
+/**
+ * "## Mises à jour groupées" (`docs/lots/L8-flotte.md`): "Un échec arrête
+ * toute la campagne et **propose** le retour arrière du site concerné."
+ *
+ * "Propose", not "déclenche" — a halted campaign never auto-enqueues a
+ * rollback by itself. An unattended automatic rollback of what might be a
+ * transient contact failure (task 7's `checkProgress` treats "no telemetry
+ * within the timeout" the same as a real reported failure, and a real
+ * network hiccup is a legitimate transient cause) is a real operational risk
+ * the lot's own words don't ask for. `listRollbackCandidates` below is the
+ * "propose" half — real, queryable data, never an action by itself.
+ * `triggerRollback` is the real, separate act a human (or, later, some
+ * explicit automation a deployer opts into) performs deliberately.
+ */
+export interface RollbackCandidate {
+    readonly siteId: string;
+    readonly componentKind: InventoryComponentKind;
+    readonly componentName: string;
+    /** What this site reported for the component just before the campaign updated it — `null` when the site had never reported it at all, in which case there is nothing real to roll back to. */
+    readonly rollbackToVersion: string | null;
+}
+/**
+ * Real rollback candidates for a halted campaign — one entry per site the
+ * campaign's own real wave-verification flagged as failed
+ * (`CampaignRecord.failedSiteIds`, task 7), each carrying the real version
+ * that same site reported immediately before this campaign touched it
+ * (`SiteRolloutRecord.preUpdateVersion`, task 7's own per-site history — not
+ * `../control/state.js`'s general drift-tracking history, which has no
+ * concept of "before THIS campaign"). Returns an empty list for a campaign
+ * that is not halted — there is nothing to propose while it is still
+ * running or after it fully succeeded.
+ */
+export declare function listRollbackCandidates(campaignStore: RolloutCampaignStore, campaign: CampaignRecord): Promise<readonly RollbackCandidate[]>;
+/**
+ * Enqueues a real, signed `rollback` command (task 6's real command-queue
+ * primitive) for exactly one site — strictly per-site, the same isolation
+ * discipline every prior L8 task has held: there is no "roll back the whole
+ * fleet" operation, matching "## Mises à jour groupées"'s own words
+ * verbatim: "Chaque site conserve son propre historique de version et peut
+ * être revenu en arrière indépendamment. Il n'existe pas d'état global à
+ * restaurer." Callable standalone, independent of any campaign — an
+ * operator deciding a specific site needs to go back does not need a
+ * campaign to exist at all; `listRollbackCandidates` above is one real way
+ * to arrive at the right `(siteId, componentKind, componentName, version)`
+ * tuple, not the only way to call this.
+ */
+export declare function triggerRollback(commandQueueStore: CommandQueueStore, siteId: string, componentKind: InventoryComponentKind, componentName: string, rollbackToVersion: string | null): Promise<FleetCommand>;
+//# sourceMappingURL=rollback.d.ts.map

package/dist/rollout/rollback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback.d.ts","sourceRoot":"","sources":["../../src/rollout/rollback.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC7E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAEzE;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAA;IAC9C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,8LAA8L;IAC9L,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1C;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,aAAa,EAAE,oBAAoB,EACnC,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAkBvC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CACnC,iBAAiB,EAAE,iBAAiB,EACpC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,sBAAsB,EACrC,aAAa,EAAE,MAAM,EACrB,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC,YAAY,CAAC,CAcvB"}

package/dist/rollout/rollback.js

@@ -0,0 +1,60 @@
+import { CogentaError } from '@cogenta/core';
+/**
+ * Real rollback candidates for a halted campaign — one entry per site the
+ * campaign's own real wave-verification flagged as failed
+ * (`CampaignRecord.failedSiteIds`, task 7), each carrying the real version
+ * that same site reported immediately before this campaign touched it
+ * (`SiteRolloutRecord.preUpdateVersion`, task 7's own per-site history — not
+ * `../control/state.js`'s general drift-tracking history, which has no
+ * concept of "before THIS campaign"). Returns an empty list for a campaign
+ * that is not halted — there is nothing to propose while it is still
+ * running or after it fully succeeded.
+ */
+export async function listRollbackCandidates(campaignStore, campaign) {
+    if (campaign.status !== 'halted')
+        return [];
+    const candidates = [];
+    for (const siteId of campaign.failedSiteIds) {
+        const records = await campaignStore.getSiteRolloutRecords(campaign.id, siteId);
+        // A site appears at most once per campaign in practice (task 7's wave
+        // partition is disjoint) — the failed/most recent record is the real
+        // one to read "what it reported right before this campaign" from.
+        const record = records.at(-1);
+        candidates.push({
+            siteId,
+            componentKind: campaign.componentKind,
+            componentName: campaign.componentName,
+            rollbackToVersion: record?.preUpdateVersion ?? null,
+        });
+    }
+    return candidates;
+}
+/**
+ * Enqueues a real, signed `rollback` command (task 6's real command-queue
+ * primitive) for exactly one site — strictly per-site, the same isolation
+ * discipline every prior L8 task has held: there is no "roll back the whole
+ * fleet" operation, matching "## Mises à jour groupées"'s own words
+ * verbatim: "Chaque site conserve son propre historique de version et peut
+ * être revenu en arrière indépendamment. Il n'existe pas d'état global à
+ * restaurer." Callable standalone, independent of any campaign — an
+ * operator deciding a specific site needs to go back does not need a
+ * campaign to exist at all; `listRollbackCandidates` above is one real way
+ * to arrive at the right `(siteId, componentKind, componentName, version)`
+ * tuple, not the only way to call this.
+ */
+export async function triggerRollback(commandQueueStore, siteId, componentKind, componentName, rollbackToVersion) {
+    if (rollbackToVersion === null) {
+        throw new CogentaError({
+            code: 'FLEET_ROLLBACK_NO_PRIOR_VERSION',
+            message: `No prior version is known for "${componentName}" on site "${siteId}" — nothing to roll back to.`,
+            hint: 'A rollback needs a real, previously-reported version. Check the site actually reported this component before the change that needs reverting.',
+            details: { siteId, componentKind, componentName },
+        });
+    }
+    return await commandQueueStore.enqueue(siteId, 'rollback', {
+        componentKind,
+        componentName,
+        targetVersion: rollbackToVersion,
+    });
+}
+//# sourceMappingURL=rollback.js.map

package/dist/rollout/rollback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback.js","sourceRoot":"","sources":["../../src/rollout/rollback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AA2B5C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,aAAmC,EACnC,QAAwB;IAExB,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAA;IAE3C,MAAM,UAAU,GAAwB,EAAE,CAAA;IAC1C,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAC9E,sEAAsE;QACtE,qEAAqE;QACrE,kEAAkE;QAClE,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAC7B,UAAU,CAAC,IAAI,CAAC;YACd,MAAM;YACN,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,iBAAiB,EAAE,MAAM,EAAE,gBAAgB,IAAI,IAAI;SACpD,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,iBAAoC,EACpC,MAAc,EACd,aAAqC,EACrC,aAAqB,EACrB,iBAAgC;IAEhC,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,iCAAiC;YACvC,OAAO,EAAE,kCAAkC,aAAa,cAAc,MAAM,8BAA8B;YAC1G,IAAI,EAAE,+IAA+I;YACrJ,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE;SAClD,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE;QACzD,aAAa;QACb,aAAa;QACb,aAAa,EAAE,iBAAiB;KACjC,CAAC,CAAA;AACJ,CAAC"}

package/dist/rollout/tables.d.ts

@@ -0,0 +1,19 @@
+import { type DatabaseHandle } from '@cogenta/core';
+export declare const ROLLOUT_TABLES: {
+    readonly campaigns: 'cogenta_fleet_rollout_campaigns';
+    readonly siteStatus: 'cogenta_fleet_rollout_site_status';
+};
+/**
+ * Same `create table if not exists` pattern as `../control/tables.ts` — no
+ * separate migration file. `campaigns` is one row per rollout campaign, its
+ * whole wave plan persisted as JSON so a campaign genuinely survives a
+ * control-plane restart ("le plan de contrôle indisponible n'affecte aucun
+ * site" cuts both ways: an in-flight campaign's own state must be real,
+ * durable data, never in-memory only). `site_status` is one row per
+ * (campaign, site) — the real per-site version-history record a rollback
+ * (task 8) needs: `pre_update_version` is what to roll back TO, not a
+ * duplicate of `../control/state.ts`'s general telemetry history, which
+ * tracks drift over time rather than "what this one campaign changed."
+ */
+export declare function ensureRolloutTables(db: DatabaseHandle): Promise<void>;
+//# sourceMappingURL=tables.d.ts.map

package/dist/rollout/tables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.d.ts","sourceRoot":"","sources":["../../src/rollout/tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,cAAc,EAKpB,MAAM,eAAe,CAAA;AAEtB,eAAO,MAAM,cAAc;aACzB,SAAS,EAAE,iCAAiC;aAC5C,UAAU,EAAE,mCAAmC;CACvC,CAAA;AA0BV;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAsC3E"}

package/dist/rollout/tables.js

@@ -0,0 +1,65 @@
+import { identifier, sql, unsafeRaw, } from '@cogenta/core';
+export const ROLLOUT_TABLES = {
+    campaigns: 'cogenta_fleet_rollout_campaigns',
+    siteStatus: 'cogenta_fleet_rollout_site_status',
+};
+function textColumn(dialect, length) {
+    return unsafeRaw(dialect === 'sqlite' ? 'text' : `varchar(${length})`);
+}
+function longTextColumn(dialect) {
+    return unsafeRaw(dialect === 'sqlite' ? 'text' : 'text');
+}
+/** A real integer column — `current_wave_index`/`wave_index` are ordinal positions compared and incremented as numbers, never text. */
+function intColumn() {
+    return unsafeRaw('integer');
+}
+async function createIndexIfMissing(db, name, table, columns) {
+    await db
+        .query(sql `create index ${identifier(name, db.dialect)} on ${table} ${columns}`)
+        .catch(() => undefined); // already there — no portable "if not exists" for indexes
+}
+/**
+ * Same `create table if not exists` pattern as `../control/tables.ts` — no
+ * separate migration file. `campaigns` is one row per rollout campaign, its
+ * whole wave plan persisted as JSON so a campaign genuinely survives a
+ * control-plane restart ("le plan de contrôle indisponible n'affecte aucun
+ * site" cuts both ways: an in-flight campaign's own state must be real,
+ * durable data, never in-memory only). `site_status` is one row per
+ * (campaign, site) — the real per-site version-history record a rollback
+ * (task 8) needs: `pre_update_version` is what to roll back TO, not a
+ * duplicate of `../control/state.ts`'s general telemetry history, which
+ * tracks drift over time rather than "what this one campaign changed."
+ */
+export async function ensureRolloutTables(db) {
+    const d = db.dialect;
+    const t255 = textColumn(d, 255);
+    const longText = longTextColumn(d);
+    const int = intColumn();
+    const campaigns = identifier(ROLLOUT_TABLES.campaigns, d);
+    await db.query(sql `
+    create table if not exists ${campaigns} (
+      id ${t255} not null primary key,
+      component_kind ${t255} not null,
+      component_name ${t255} not null,
+      target_version ${t255} not null,
+      waves_json ${longText} not null,
+      current_wave_index ${int} not null,
+      status ${t255} not null,
+      halted_reason ${longText},
+      created_at ${t255} not null
+    )`);
+    const siteStatus = identifier(ROLLOUT_TABLES.siteStatus, d);
+    await db.query(sql `
+    create table if not exists ${siteStatus} (
+      id ${t255} not null primary key,
+      campaign_id ${t255} not null,
+      site_id ${t255} not null,
+      wave_index ${int} not null,
+      status ${t255} not null,
+      pre_update_version ${t255},
+      dispatched_at ${t255},
+      resolved_at ${t255}
+    )`);
+    await createIndexIfMissing(db, 'cogenta_fleet_rollout_site_status_campaign', siteStatus, sql `(campaign_id, site_id)`);
+}
+//# sourceMappingURL=tables.js.map

package/dist/rollout/tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.js","sourceRoot":"","sources":["../../src/rollout/tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,UAAU,EAEV,GAAG,EACH,SAAS,GACV,MAAM,eAAe,CAAA;AAEtB,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,iCAAiC;IAC5C,UAAU,EAAE,mCAAmC;CACvC,CAAA;AAEV,SAAS,UAAU,CAAC,OAAwB,EAAE,MAAc;IAC1D,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,GAAG,CAAC,CAAA;AACxE,CAAC;AAED,SAAS,cAAc,CAAC,OAAwB;IAC9C,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AAC1D,CAAC;AAED,uIAAuI;AACvI,SAAS,SAAS;IAChB,OAAO,SAAS,CAAC,SAAS,CAAC,CAAA;AAC7B,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,EAAkB,EAClB,IAAY,EACZ,KAAkB,EAClB,OAAoB;IAEpB,MAAM,EAAE;SACL,KAAK,CAAC,GAAG,CAAA,gBAAgB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,OAAO,EAAE,CAAC;SAC/E,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA,CAAC,0DAA0D;AACtF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAkB;IAC1D,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAA;IACpB,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/B,MAAM,QAAQ,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,SAAS,EAAE,CAAA;IAEvB,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;IACzD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,SAAS;WAC/B,IAAI;uBACQ,IAAI;uBACJ,IAAI;uBACJ,IAAI;mBACR,QAAQ;2BACA,GAAG;eACf,IAAI;sBACG,QAAQ;mBACX,IAAI;MACjB,CAAC,CAAA;IAEL,MAAM,UAAU,GAAG,UAAU,CAAC,cAAc,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,UAAU;WAChC,IAAI;oBACK,IAAI;gBACR,IAAI;mBACD,GAAG;eACP,IAAI;2BACQ,IAAI;sBACT,IAAI;oBACN,IAAI;MAClB,CAAC,CAAA;IACL,MAAM,oBAAoB,CACxB,EAAE,EACF,4CAA4C,EAC5C,UAAU,EACV,GAAG,CAAA,wBAAwB,CAC5B,CAAA;AACH,CAAC"}