@rallycry/conveyor-k3 0.1.13 → 0.1.15

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 import { PersonalClusterEnrollmentBundle, PersonalClusterEnrollmentCompletion, PersonalClusterDesiredState, PersonalClusterHeartbeat, PersonalClusterWorkloads, PersonalClusterKubeletState } from '@project/shared';
+export { maximumGuestMemoryGiB, maximumGuestMemoryGiBWithin } from '@project/shared';
 
 interface ClusterConnectionConfig {
     apiUrl: string;
@@ -144,6 +145,8 @@ declare class ClusterDaemon {
      * against k3s's own settings before reporting it.
      */
     private isolation;
+    /** Whether the pod slice's CPU cap is in force, from the last reconcile. */
+    private cpuQuotaApplied;
     private timers;
     /** When the last store walk started, so one that failed is not retried on every reconcile. */
     private storeWalkStartedAt;
@@ -247,6 +250,12 @@ interface PruneResult {
     removed: number;
     bytesReclaimed: number;
     failures: string[];
+    /**
+     * Removals crictl stopped waiting for. containerd carries on deleting a
+     * multi-gigabyte image after crictl's deadline, so these are not failures:
+     * the next prune finds the image gone, or tries it again.
+     */
+    pending: string[];
 }
 /** Remove the stranded images. Individual failures are reported, not thrown. */
 declare function pruneStrandedImages(exec: Executor, inventory: ImageInventory, wantedImages: string[]): Promise<PruneResult>;
@@ -286,6 +295,11 @@ declare function warmImages(exec: Executor, wantedImages: string[], unauthentica
  * and should prefer one holding the latest bake. So the heartbeat lists every
  * `localhost/` ref, with the content hash the bake stamped on the image.
  *
+ * It also lists every wanted ref the node holds, whatever its registry. A
+ * shadow bake's image lives in the machine's own registry, and placement runs
+ * a card on the previous shadow while its rebuild is queued only when this
+ * list says the node still holds it.
+ *
  * The hash takes one `crictl inspecti` per image, cached by image id: an id
  * names exactly one image config, so its label never changes.
  */
@@ -315,6 +329,8 @@ interface TelemetryState {
     isolation?: {
         applied: boolean;
     };
+    /** Present while a host-runtime machine's desired state reserves CPU. */
+    cpuQuotaApplied?: boolean | undefined;
     /**
      * The last measured size of k3s's containerd store. Null (or absent) until
      * the first measurement, and the heartbeat says null then: a 0 would read
@@ -424,6 +440,11 @@ interface ReconcileResult {
     isolation?: {
         applied: boolean;
     };
+    /**
+     * Whether the pod slice is hard-capped at the CPU the reserve leaves, on a
+     * host-runtime machine whose desired state reserves CPU. Undefined otherwise.
+     */
+    cpuQuotaApplied?: boolean;
 }
 declare function reconcile(ctx: ReconcileContext, desired: PersonalClusterDesiredState): Promise<ReconcileResult>;
 
@@ -553,11 +574,6 @@ declare function renderK3sDropIn(kubelet: PersonalClusterKubeletState, ownerConf
 options?: {
     disableComponents?: boolean;
 }): DropInRenderResult;
-/**
- * @deprecated Use {@link renderK3sDropIn}. Kept as a named alias because the
- * package exports it and a published CLI may still import it by this name.
- */
-declare const renderKubeletDropIn: typeof renderK3sDropIn;
 
 interface UnitRenderOptions {
     /** Absolute path to the installed `conveyor-k3` binary. */
@@ -732,27 +748,21 @@ interface UninstallResult {
 declare function uninstall(ports: UninstallPorts, options?: UninstallOptions): Promise<UninstallResult>;
 
 /**
- * `conveyor-k3 update` — the maintenance-window updater.
- *
- * Updates ride a systemd timer and NEVER runtime self-replacement. The agent
- * removed runtime self-update after the 2026-07-19 eviction outage; a daemon
- * that swaps its own binary mid-run has exactly the same failure shape. Here
- * the package is replaced by a separate oneshot unit, and the daemon is
- * restarted afterwards by systemd.
- *
- * Three independent pieces, each with its own decision:
- *
- * - **The package.** Installed at the EXACT version Conveyor's desired state
- *   names, never `@latest` — the npm dist-tag is a root-execution channel on
- *   every enrolled machine, so a compromised publish would reach them all
- *   within a day. The daemon restarts only if the version actually moved.
- * - **cloudflared.** `cloudflared update` exits 11 to mean "updated"; that is
- *   the only case that needs a tunnel restart.
- * - **k3s.** Only when the owner allowed it AND nothing of Conveyor's is
- *   running. A k3s upgrade at the wrong moment interrupts someone's build, and
- *   no upgrade is worth that.
+ * Who keeps this machine's cloudflared current.
+ *
+ * `cloudflared update` only works on a binary cloudflared installed itself. A
+ * package-manager build refuses: it prints "cloudflared was installed by a
+ * package manager" and exits 0 — the same exit as "already current". Read by
+ * exit code alone, such a machine reports a current cloudflared forever while
+ * apt (or nothing) is what actually updates it.
+ *
+ * The literal path lies, too. On a server where `/usr/local/bin/cloudflared`
+ * is a symlink to apt's `/usr/bin/cloudflared` there is ONE binary, owned by
+ * dpkg, so the owner check runs against the resolved path.
  */
 
+type CloudflaredUpdater = "conveyor" | "package-manager";
+
 interface UpdatePorts {
     exec: Executor;
     log: (line: string) => void;
@@ -802,6 +812,8 @@ declare function decideK3sUpgrade(input: UpdateDecisionInput): K3sUpgradeDecisio
 interface UpdateResult {
     packageUpdated: boolean;
     cloudflaredUpdated: boolean;
+    /** Who keeps cloudflared current; null when this run could not tell. */
+    cloudflaredUpdater: CloudflaredUpdater | null;
     k3sUpgraded: boolean;
     notes: string[];
 }
@@ -956,11 +968,6 @@ interface QemuPolicyContext {
  */
 declare function rewriteQemuArgs(args: string[], network: QemuNetworkPolicy, ncPath?: string, hostContext?: QemuPolicyContext): string[];
 
-/** The largest whole-GiB guest whose host cost (see vmHostMemoryGiB) fits in the budget. */
-declare function maximumGuestMemoryGiBWithin(budgetGiB: number, relaySlots?: number): number;
-/** Reserve 25% of physical host RAM after accounting for VM overhead. */
-declare function maximumGuestMemoryGiB(hostBytes: number, relaySlots?: number): number;
-
 /** `--instance` omitted or `default`: the original VM, whose paths never move. */
 declare const DEFAULT_INSTANCE = "default";
 /** The `--instance` flag's value. Omitted or `default` selects the default VM. */
@@ -1010,4 +1017,4 @@ declare function pathsForRoot(root: string, instance?: string): {
 };
 type HostPaths = ReturnType<typeof pathsForRoot>;
 
-export { ClusterConnection, type ClusterConnectionConfig, ClusterDaemon, CommandError, type CrictlImage, DEFAULT_INSTANCE, type DaemonPorts, type Executor, type FileSystemPort$1 as FileSystemPort, type GuestDnsProvision, type GuestSrvRecord, HELP, type HostPaths, type ImageInventory, K3S_DISABLED_COMPONENTS, K3S_INSTALL_EXEC, type K3sUpgradeDecision, type MachineState, type NetworkEndpoint, type NetworkPolicy, type QemuNetworkPolicy, type ReconcileContext, type ReconcileResult, type RegistriesFile, type ResolvedNetwork, type ResolvedNetworkHost, type SRVLookup, type UninstallResult, type UnitRenderOptions, VERBS, type Verb, cloudflaredSrvRecords, collectHeartbeat, configuredAuthHosts, countRunningConveyorPods, createMemoryFileSystem, decideK3sUpgrade, hostPaths, isGloballyRoutableIPv4, isVerb, maximumGuestMemoryGiB, maximumGuestMemoryGiBWithin, meetsK3sMinimum, missingAuthHosts, nodeFileSystem, ownerConfiguredKeys, ownerConfiguredKubeletFlags, parseArgs, parseInstanceName, parseK3sVersion, parseRegistries, pruneStrandedImages, readImageInventory, readState, reconcile, registryAdd, registryList, renderAllUnits, renderGuestDnsProvision, renderK3sDropIn, renderKubeletDropIn, renderRegistryAuthSummary, resolveCloudflaredSrvRecords, resolveNetwork, rewriteQemuArgs, runOrThrow, runUpdate, selectStrandedImages, serializeRegistries, spawnExecutor, uninstall, upsertRegistryAuth, warmImages, writeState };
+export { ClusterConnection, type ClusterConnectionConfig, ClusterDaemon, CommandError, type CrictlImage, DEFAULT_INSTANCE, type DaemonPorts, type Executor, type FileSystemPort$1 as FileSystemPort, type GuestDnsProvision, type GuestSrvRecord, HELP, type HostPaths, type ImageInventory, K3S_DISABLED_COMPONENTS, K3S_INSTALL_EXEC, type K3sUpgradeDecision, type MachineState, type NetworkEndpoint, type NetworkPolicy, type QemuNetworkPolicy, type ReconcileContext, type ReconcileResult, type RegistriesFile, type ResolvedNetwork, type ResolvedNetworkHost, type SRVLookup, type UninstallResult, type UnitRenderOptions, VERBS, type Verb, cloudflaredSrvRecords, collectHeartbeat, configuredAuthHosts, countRunningConveyorPods, createMemoryFileSystem, decideK3sUpgrade, hostPaths, isGloballyRoutableIPv4, isVerb, meetsK3sMinimum, missingAuthHosts, nodeFileSystem, ownerConfiguredKeys, ownerConfiguredKubeletFlags, parseArgs, parseInstanceName, parseK3sVersion, parseRegistries, pruneStrandedImages, readImageInventory, readState, reconcile, registryAdd, registryList, renderAllUnits, renderGuestDnsProvision, renderK3sDropIn, renderRegistryAuthSummary, resolveCloudflaredSrvRecords, resolveNetwork, rewriteQemuArgs, runOrThrow, runUpdate, selectStrandedImages, serializeRegistries, spawnExecutor, uninstall, upsertRegistryAuth, warmImages, writeState };