@rizom/ops 0.2.0-alpha.108 → 0.2.0-alpha.109

package/dist/load-registry.d.ts

@@ -32,6 +32,9 @@ export interface ResolvedSetupDelivery {
     delivery: "email";
     email: string;
 }
+export interface ResolvedAtprotoConfig {
+    identifier: string;
+}
 export interface ResolvedUserIdentity {
     handle: string;
     cohort: string;
@@ -45,6 +48,7 @@ export interface ResolvedUserIdentity {
     effectiveAiApiKey: string;
     effectiveGitSyncToken: string;
     setup?: ResolvedSetupDelivery;
+    atproto?: ResolvedAtprotoConfig;
     anchorProfile: ResolvedAnchorProfile;
     snapshotStatus: SnapshotStatus;
 }

package/dist/schema.d.ts

@@ -65,6 +65,13 @@ export declare const userSchema: z.ZodObject<{
         email: string;
         delivery: "email";
     }>>;
+    atproto: z.ZodOptional<z.ZodObject<{
+        identifier: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        identifier: string;
+    }, {
+        identifier: string;
+    }>>;
     anchorProfile: z.ZodOptional<z.ZodObject<{
         name: z.ZodOptional<z.ZodString>;
         description: z.ZodOptional<z.ZodString>;
@@ -119,6 +126,9 @@ export declare const userSchema: z.ZodObject<{
         email: string;
         delivery: "email";
     } | undefined;
+    atproto?: {
+        identifier: string;
+    } | undefined;
     anchorProfile?: {
         name?: string | undefined;
         email?: string | undefined;
@@ -143,6 +153,9 @@ export declare const userSchema: z.ZodObject<{
         email: string;
         delivery: "email";
     } | undefined;
+    atproto?: {
+        identifier: string;
+    } | undefined;
     anchorProfile?: {
         name?: string | undefined;
         email?: string | undefined;

package/dist/secrets-encrypt.d.ts

@@ -3,14 +3,17 @@ declare const encryptedUserSecretsSchema: z.ZodObject<{
     gitSyncToken: z.ZodOptional<z.ZodString>;
     discordBotToken: z.ZodOptional<z.ZodString>;
     aiApiKey: z.ZodOptional<z.ZodString>;
+    atprotoAppPassword: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
     aiApiKey?: string | undefined;
     gitSyncToken?: string | undefined;
     discordBotToken?: string | undefined;
+    atprotoAppPassword?: string | undefined;
 }, {
     aiApiKey?: string | undefined;
     gitSyncToken?: string | undefined;
     discordBotToken?: string | undefined;
+    atprotoAppPassword?: string | undefined;
 }>;
 export type EncryptedUserSecrets = z.infer<typeof encryptedUserSecretsSchema>;
 export interface SecretsEncryptOptions {

package/package.json

@@ -4,7 +4,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.2.0-alpha.108",
+  "version": "0.2.0-alpha.109",
   "type": "module",
   "exports": {
     ".": {

package/templates/rover-pilot/.env.schema

@@ -25,6 +25,11 @@ CONTENT_REPO_ADMIN_TOKEN=
 # @sensitive
 DISCORD_BOT_TOKEN=
 
+# AT Protocol publishing/discovery (optional, per-user)
+# Comes from the decrypted users/<handle>.secrets.yaml.age file when configured.
+# @sensitive
+ATPROTO_APP_PASSWORD=
+
 # Setup email delivery (optional, shared)
 # Used when a user file declares setup.delivery: email.
 # @sensitive

package/templates/rover-pilot/deploy/scripts/decrypt-user-secrets.ts

@@ -21,6 +21,7 @@ const pilot = parseFlatYaml(readFileSync("pilot.yaml", "utf8"));
 writeGitHubEnv("AI_API_KEY", secrets["aiApiKey"] ?? "");
 writeGitHubEnv("GIT_SYNC_TOKEN", secrets["gitSyncToken"] ?? "");
 writeGitHubEnv("DISCORD_BOT_TOKEN", secrets["discordBotToken"] ?? "");
+writeGitHubEnv("ATPROTO_APP_PASSWORD", secrets["atprotoAppPassword"] ?? "");
 
 writeGitHubOutput(
   "shared_ai_api_key_secret_name",

package/templates/rover-pilot/docs/onboarding-checklist.md

@@ -13,6 +13,7 @@
    - the command creates `users/<handle>.yaml`, `users/<handle>.secrets.yaml`, and the cohort membership without duplicating existing entries.
 5. Edit the generated user file if the anchor profile needs richer metadata.
    - For browser/CMS-first onboarding, add `setup.delivery: email` and `setup.email` to the user file.
+   - For ATProto publishing, add `atproto.identifier` to the user file; put only `atprotoAppPassword` in the per-user secrets file.
    - Ensure `SETUP_EMAIL_API_KEY` and `SETUP_EMAIL_FROM` exist as GitHub Secrets before deploying any email-setup user.
 6. Run `bunx brains-ops render <repo>`.
 7. Run `bunx brains-ops ssh-key:bootstrap <repo> --push-to gh`.

package/templates/rover-pilot/docs/operator-playbook.md

@@ -151,6 +151,36 @@ Notes:
 - The auth service owns setup email dedupe. It should not resend for the same persisted setup token after restart, but should retry failed delivery and resend after token rotation.
 - `SETUP_EMAIL_FROM` is not marked required because fleets without email setup can omit it, but it is required for users with `setup.delivery: email`.
 
+## AT Protocol smoke/config checklist
+
+Use this when enabling AT Protocol publishing for a single pilot user.
+
+1. Add the public PDS identifier to the user file:
+
+   ```yaml
+   atproto:
+     identifier: rizom-test.bsky.social
+   ```
+
+2. Put the app password in `users/<handle>.secrets.yaml`:
+
+   ```yaml
+   atprotoAppPassword: <app-password>
+   ```
+
+3. Encrypt the per-user secret payload:
+   - `bunx brains-ops secrets:encrypt . <handle>`
+4. Reconcile/deploy the user or cohort:
+   - `bunx brains-ops onboard . <handle>`
+   - or `bunx brains-ops reconcile-cohort . <cohort>`
+5. Verify the generated `users/<handle>/brain.yaml` contains `plugins.atproto.identifier` and `appPassword: ${ATPROTO_APP_PASSWORD}`.
+
+Notes:
+
+- The ATProto identifier is public instance config and belongs in `users/<handle>.yaml`.
+- The ATProto app password is secret and belongs only in the encrypted per-user secret payload.
+- For smoke deployments, pin only the smoke cohort/user to the released brain version that contains ATProto support.
+
 ## Discord bot token checklist
 
 Use this when enabling Discord for a pilot user.