@rizom/ops 0.2.0-alpha.22 → 0.2.0-alpha.221

package/dist/load-registry.d.ts

@@ -14,7 +14,6 @@ export interface ResolvedCohort {
     presetOverride?: PilotPreset;
     aiApiKeyOverride?: string;
     gitSyncTokenOverride?: string;
-    mcpAuthTokenOverride?: string;
 }
 export interface ResolvedAnchorProfileSocialLink {
     platform: "github" | "instagram" | "linkedin" | "email" | "website";
@@ -29,6 +28,25 @@ export interface ResolvedAnchorProfile {
     story?: string;
     socialLinks?: ResolvedAnchorProfileSocialLink[];
 }
+export interface ResolvedSetupDelivery {
+    delivery: "email";
+    email: string;
+}
+export interface ResolvedAtprotoConfig {
+    identifier: string;
+    /** Owner account DID served at /.well-known/atproto-did for handle verification. */
+    accountDid?: string | undefined;
+    /** Whether this account publishes the canonical ai.rizom.brain.* schemas. */
+    lexiconAuthority?: boolean | undefined;
+}
+export interface ResolvedPlaybooksConfig {
+    onboarding?: boolean | undefined;
+}
+export interface ResolvedSiteOverride {
+    package: string;
+    version: string;
+    theme?: string | undefined;
+}
 export interface ResolvedUserIdentity {
     handle: string;
     cohort: string;
@@ -36,12 +54,17 @@ export interface ResolvedUserIdentity {
     model: "rover";
     preset: PilotPreset;
     domain: string;
+    cloudflareZoneId?: string | undefined;
     contentRepo: string;
+    addOverride?: string[];
+    siteOverride?: ResolvedSiteOverride;
     discordEnabled: boolean;
     discordAnchorUserId?: string;
     effectiveAiApiKey: string;
     effectiveGitSyncToken: string;
-    effectiveMcpAuthToken: string;
+    setup?: ResolvedSetupDelivery;
+    atproto?: ResolvedAtprotoConfig;
+    playbooks?: ResolvedPlaybooksConfig;
     anchorProfile: ResolvedAnchorProfile;
     snapshotStatus: SnapshotStatus;
 }

package/dist/observed-status.d.ts

@@ -1,4 +1,4 @@
-import type { FetchLike } from "@brains/utils/origin-ca";
+import type { FetchLike } from "@brains/deploy-support/origin-ca";
 import type { ObservedUserStatus, ResolvedUserIdentity } from "./load-registry";
 export interface LookupResult {
     address: string;

package/dist/origin-ca.d.ts

@@ -1 +1 @@
-export { createOriginCertificateRequest, generateOriginKeyPair, issueCloudflareOriginCertificate, setCloudflareZoneSslStrict, type CloudflareOriginCaResult, type FetchLike, type OriginCertificateRequest, type OriginKeyPair, } from "@brains/utils/origin-ca";
+export { createOriginCertificateRequest, generateOriginKeyPair, issueCloudflareOriginCertificate, setCloudflareZoneSslStrict, type CloudflareOriginCaResult, type FetchLike, type OriginCertificateRequest, type OriginKeyPair, } from "@brains/deploy-support/origin-ca";

package/dist/parse-args.d.ts

@@ -6,6 +6,9 @@ export interface ParsedArgs {
         version?: boolean | undefined;
         dryRun?: boolean | undefined;
         pushTo?: string | undefined;
+        cohort?: string | undefined;
+        anchorId?: string | undefined;
+        handle?: string | undefined;
     };
 }
 export declare function parseArgs(argv: string[]): ParsedArgs;

package/dist/preview-domain.d.ts

@@ -0,0 +1,9 @@
+export interface PreviewDomainOptions {
+    sharedDomain?: string | undefined;
+}
+/**
+ * Public operator-facing wrapper around the runtime's preview-domain rule.
+ * Keeping deploy resolution on this function prevents DNS, proxy, and runtime
+ * metadata from drifting onto different host shapes.
+ */
+export declare function derivePreviewDomain(domain: string, options?: PreviewDomainOptions): string;

package/dist/push-secrets.d.ts

@@ -1,9 +1,2 @@
-import { normalizePushTarget, type PushTarget } from "./push-target";
-import { type RunCommand } from "./run-subprocess";
-export type SecretPair = readonly [name: string, value: string];
-export interface PushSecretsOptions {
-    runCommand?: RunCommand | undefined;
-    logger?: ((message: string) => void) | undefined;
-}
-export declare function pushSecretsToBackend(_target: PushTarget, secrets: readonly SecretPair[], options?: PushSecretsOptions): Promise<void>;
-export { normalizePushTarget };
+export { pushSecretsToBackend, type PushSecretsOptions, type SecretPair, } from "@brains/deploy-support/push-secrets";
+export { normalizePushTarget } from "@brains/deploy-support/push-target";

package/dist/push-target.d.ts

@@ -1,2 +1 @@
-export type PushTarget = "gh";
-export declare function normalizePushTarget(value?: string): PushTarget | undefined;
+export { normalizePushTarget, type PushTarget, } from "@brains/deploy-support/push-target";

package/dist/run-command.d.ts

@@ -1,4 +1,4 @@
-import type { FetchLike } from "@brains/utils/origin-ca";
+import type { FetchLike } from "@brains/deploy-support/origin-ca";
 import type { LoadPilotRegistryOptions } from "./load-registry";
 import { type LookupHost } from "./observed-status";
 import type { ParsedArgs } from "./parse-args";

package/dist/run-subprocess.d.ts

@@ -1,6 +1 @@
-export type RunCommand = (command: string, args: string[], options?: {
-    stdin?: string;
-    env?: NodeJS.ProcessEnv;
-    cwd?: string;
-}) => Promise<void>;
-export declare const runSubprocess: RunCommand;
+export { runSubprocess, type RunCommand, } from "@brains/deploy-support/run-subprocess";

package/dist/schema.d.ts

@@ -1,5 +1,9 @@
-import { z } from "@brains/utils";
-export declare const presetSchema: z.ZodEnum<["core", "default", "pro"]>;
+import { z } from "@brains/utils/zod";
+export declare const presetSchema: z.ZodEnum<{
+    core: "core";
+    default: "default";
+    pro: "pro";
+}>;
 export declare const exactVersionSchema: z.ZodString;
 export declare const handleSchema: z.ZodString;
 export declare const secretNameSchema: z.ZodString;
@@ -11,173 +15,78 @@ export declare const pilotSchema: z.ZodObject<{
     githubOrg: z.ZodString;
     contentRepoPrefix: z.ZodString;
     domainSuffix: z.ZodString;
-    preset: z.ZodEnum<["core", "default", "pro"]>;
+    preset: typeof presetSchema;
     aiApiKey: z.ZodString;
     gitSyncToken: z.ZodString;
-    mcpAuthToken: z.ZodString;
+    contentRepoAdminToken: z.ZodString;
     agePublicKey: z.ZodString;
-}, "strict", z.ZodTypeAny, {
-    agePublicKey: string;
-    schemaVersion: 1;
-    brainVersion: string;
-    model: "rover";
-    githubOrg: string;
-    contentRepoPrefix: string;
-    domainSuffix: string;
-    preset: "default" | "core" | "pro";
-    aiApiKey: string;
-    gitSyncToken: string;
-    mcpAuthToken: string;
-}, {
-    agePublicKey: string;
-    schemaVersion: 1;
-    brainVersion: string;
-    model: "rover";
-    githubOrg: string;
-    contentRepoPrefix: string;
-    domainSuffix: string;
-    preset: "default" | "core" | "pro";
-    aiApiKey: string;
-    gitSyncToken: string;
-    mcpAuthToken: string;
+}>;
+declare const anchorProfileSocialLinkSchema: z.ZodObject<{
+    platform: z.ZodEnum<{
+        github: "github";
+        instagram: "instagram";
+        linkedin: "linkedin";
+        email: "email";
+        website: "website";
+    }>;
+    url: z.ZodString;
+    label: z.ZodOptional<z.ZodString>;
+}>;
+declare const anchorProfileSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    website: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    story: z.ZodOptional<z.ZodString>;
+    socialLinks: z.ZodOptional<z.ZodArray<typeof anchorProfileSocialLinkSchema>>;
+}>;
+declare const setupDeliverySchema: z.ZodObject<{
+    delivery: z.ZodLiteral<"email">;
+    email: z.ZodString;
+}>;
+declare const atprotoSchema: z.ZodObject<{
+    identifier: z.ZodString;
+    accountDid: z.ZodOptional<z.ZodString>;
+    lexiconAuthority: z.ZodOptional<z.ZodBoolean>;
+}>;
+declare const siteOverrideSchema: z.ZodObject<{
+    package: z.ZodString;
+    version: z.ZodOptional<typeof exactVersionSchema>;
+    theme: z.ZodOptional<z.ZodString>;
+}>;
+declare const playbooksSchema: z.ZodObject<{
+    onboarding: z.ZodOptional<z.ZodBoolean>;
 }>;
 export declare const userSchema: z.ZodObject<{
     handle: z.ZodString;
     discord: z.ZodObject<{
         enabled: z.ZodBoolean;
         anchorUserId: z.ZodOptional<z.ZodString>;
-    }, "strict", z.ZodTypeAny, {
-        enabled: boolean;
-        anchorUserId?: string | undefined;
-    }, {
-        enabled: boolean;
-        anchorUserId?: string | undefined;
     }>;
     aiApiKeyOverride: z.ZodOptional<z.ZodString>;
     gitSyncTokenOverride: z.ZodOptional<z.ZodString>;
-    mcpAuthTokenOverride: z.ZodOptional<z.ZodString>;
-    anchorProfile: z.ZodOptional<z.ZodObject<{
-        name: z.ZodOptional<z.ZodString>;
-        description: z.ZodOptional<z.ZodString>;
-        website: z.ZodOptional<z.ZodString>;
-        email: z.ZodOptional<z.ZodString>;
-        story: z.ZodOptional<z.ZodString>;
-        socialLinks: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            platform: z.ZodEnum<["github", "instagram", "linkedin", "email", "website"]>;
-            url: z.ZodString;
-            label: z.ZodOptional<z.ZodString>;
-        }, "strict", z.ZodTypeAny, {
-            url: string;
-            platform: "github" | "instagram" | "linkedin" | "email" | "website";
-            label?: string | undefined;
-        }, {
-            url: string;
-            platform: "github" | "instagram" | "linkedin" | "email" | "website";
-            label?: string | undefined;
-        }>, "many">>;
-    }, "strict", z.ZodTypeAny, {
-        name?: string | undefined;
-        email?: string | undefined;
-        website?: string | undefined;
-        description?: string | undefined;
-        story?: string | undefined;
-        socialLinks?: {
-            url: string;
-            platform: "github" | "instagram" | "linkedin" | "email" | "website";
-            label?: string | undefined;
-        }[] | undefined;
-    }, {
-        name?: string | undefined;
-        email?: string | undefined;
-        website?: string | undefined;
-        description?: string | undefined;
-        story?: string | undefined;
-        socialLinks?: {
-            url: string;
-            platform: "github" | "instagram" | "linkedin" | "email" | "website";
-            label?: string | undefined;
-        }[] | undefined;
-    }>>;
-}, "strict", z.ZodTypeAny, {
-    handle: string;
-    discord: {
-        enabled: boolean;
-        anchorUserId?: string | undefined;
-    };
-    aiApiKeyOverride?: string | undefined;
-    gitSyncTokenOverride?: string | undefined;
-    mcpAuthTokenOverride?: string | undefined;
-    anchorProfile?: {
-        name?: string | undefined;
-        email?: string | undefined;
-        website?: string | undefined;
-        description?: string | undefined;
-        story?: string | undefined;
-        socialLinks?: {
-            url: string;
-            platform: "github" | "instagram" | "linkedin" | "email" | "website";
-            label?: string | undefined;
-        }[] | undefined;
-    } | undefined;
-}, {
-    handle: string;
-    discord: {
-        enabled: boolean;
-        anchorUserId?: string | undefined;
-    };
-    aiApiKeyOverride?: string | undefined;
-    gitSyncTokenOverride?: string | undefined;
-    mcpAuthTokenOverride?: string | undefined;
-    anchorProfile?: {
-        name?: string | undefined;
-        email?: string | undefined;
-        website?: string | undefined;
-        description?: string | undefined;
-        story?: string | undefined;
-        socialLinks?: {
-            url: string;
-            platform: "github" | "instagram" | "linkedin" | "email" | "website";
-            label?: string | undefined;
-        }[] | undefined;
-    } | undefined;
+    domainOverride: z.ZodOptional<z.ZodString>;
+    cloudflareZoneId: z.ZodOptional<z.ZodString>;
+    contentRepoOverride: z.ZodOptional<z.ZodString>;
+    addOverride: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    siteOverride: z.ZodOptional<typeof siteOverrideSchema>;
+    setup: z.ZodOptional<typeof setupDeliverySchema>;
+    atproto: z.ZodOptional<typeof atprotoSchema>;
+    playbooks: z.ZodOptional<typeof playbooksSchema>;
+    anchorProfile: z.ZodOptional<typeof anchorProfileSchema>;
 }>;
-export declare const cohortSchema: z.ZodEffects<z.ZodObject<{
-    members: z.ZodArray<z.ZodString, "many">;
+export declare const cohortSchema: z.ZodObject<{
+    members: z.ZodArray<z.ZodString>;
     brainVersionOverride: z.ZodOptional<z.ZodString>;
-    presetOverride: z.ZodOptional<z.ZodEnum<["core", "default", "pro"]>>;
+    presetOverride: z.ZodOptional<typeof presetSchema>;
     aiApiKeyOverride: z.ZodOptional<z.ZodString>;
     gitSyncTokenOverride: z.ZodOptional<z.ZodString>;
-    mcpAuthTokenOverride: z.ZodOptional<z.ZodString>;
-}, "strict", z.ZodTypeAny, {
-    members: string[];
-    aiApiKeyOverride?: string | undefined;
-    gitSyncTokenOverride?: string | undefined;
-    mcpAuthTokenOverride?: string | undefined;
-    brainVersionOverride?: string | undefined;
-    presetOverride?: "default" | "core" | "pro" | undefined;
-}, {
-    members: string[];
-    aiApiKeyOverride?: string | undefined;
-    gitSyncTokenOverride?: string | undefined;
-    mcpAuthTokenOverride?: string | undefined;
-    brainVersionOverride?: string | undefined;
-    presetOverride?: "default" | "core" | "pro" | undefined;
-}>, {
-    members: string[];
-    aiApiKeyOverride?: string | undefined;
-    gitSyncTokenOverride?: string | undefined;
-    mcpAuthTokenOverride?: string | undefined;
-    brainVersionOverride?: string | undefined;
-    presetOverride?: "default" | "core" | "pro" | undefined;
-}, {
-    members: string[];
-    aiApiKeyOverride?: string | undefined;
-    gitSyncTokenOverride?: string | undefined;
-    mcpAuthTokenOverride?: string | undefined;
-    brainVersionOverride?: string | undefined;
-    presetOverride?: "default" | "core" | "pro" | undefined;
 }>;
-export type PilotConfig = z.infer<typeof pilotSchema>;
-export type UserConfig = z.infer<typeof userSchema>;
-export type CohortConfig = z.infer<typeof cohortSchema>;
-export type PilotPreset = z.infer<typeof presetSchema>;
+export type PilotConfig = z.output<typeof pilotSchema>;
+export type PilotConfigInput = z.input<typeof pilotSchema>;
+export type UserConfig = z.output<typeof userSchema>;
+export type UserConfigInput = z.input<typeof userSchema>;
+export type CohortConfig = z.output<typeof cohortSchema>;
+export type CohortConfigInput = z.input<typeof cohortSchema>;
+export type PilotPreset = z.output<typeof presetSchema>;
+export {};

package/dist/secrets-encrypt.d.ts

@@ -1,21 +1,13 @@
-import { z } from "@brains/utils";
+import { z } from "@brains/utils/zod";
 declare const encryptedUserSecretsSchema: z.ZodObject<{
     gitSyncToken: z.ZodOptional<z.ZodString>;
-    mcpAuthToken: z.ZodOptional<z.ZodString>;
     discordBotToken: z.ZodOptional<z.ZodString>;
     aiApiKey: z.ZodOptional<z.ZodString>;
-}, "strict", z.ZodTypeAny, {
-    aiApiKey?: string | undefined;
-    gitSyncToken?: string | undefined;
-    mcpAuthToken?: string | undefined;
-    discordBotToken?: string | undefined;
-}, {
-    aiApiKey?: string | undefined;
-    gitSyncToken?: string | undefined;
-    mcpAuthToken?: string | undefined;
-    discordBotToken?: string | undefined;
+    atprotoAppPassword: z.ZodOptional<z.ZodString>;
+    certificatePem: z.ZodOptional<z.ZodString>;
+    privateKeyPem: z.ZodOptional<z.ZodString>;
 }>;
-export type EncryptedUserSecrets = z.infer<typeof encryptedUserSecretsSchema>;
+export type EncryptedUserSecrets = z.output<typeof encryptedUserSecretsSchema>;
 export interface SecretsEncryptOptions {
     env?: NodeJS.ProcessEnv | undefined;
     logger?: ((message: string) => void) | undefined;

package/dist/ssh-key-bootstrap.d.ts

@@ -1,26 +1 @@
-import { type FetchLike } from "@brains/utils/origin-ca";
-import { type RunCommand } from "./run-subprocess";
-export interface SshKeyBootstrapOptions {
-    env?: NodeJS.ProcessEnv | undefined;
-    fetchImpl?: FetchLike | undefined;
-    logger?: (message: string) => void;
-    pushTo?: string | undefined;
-    runCommand?: RunCommand | undefined;
-    sshKeygen?: SshKeygen | undefined;
-}
-export interface SshKeyBootstrapResult {
-    createdHetznerKey: boolean;
-    createdLocalKey: boolean;
-    privateKeyPath: string;
-    publicKeyPath: string;
-    sshKeyName: string;
-}
-export interface SshKeygen {
-    createEd25519KeyPair: (privateKeyPath: string, comment: string) => void;
-    derivePublicKey: (privateKeyPath: string) => string;
-}
-export declare function runPilotSshKeyBootstrap(rootDir: string, options?: SshKeyBootstrapOptions): Promise<{
-    success: boolean;
-    message?: string;
-}>;
-export declare function bootstrapPilotSshKey(rootDir: string, options?: SshKeyBootstrapOptions): Promise<SshKeyBootstrapResult>;
+export { bootstrapSshKey as bootstrapPilotSshKey, runSshKeyBootstrap as runPilotSshKeyBootstrap, type SshKeyBootstrapOptions, type SshKeyBootstrapResult, type SshKeygen, } from "@brains/deploy-support/ssh-key-bootstrap";

package/dist/user-add.d.ts

@@ -0,0 +1,15 @@
+export interface AddPilotUserOptions {
+    cohort: string;
+    anchorId?: string | undefined;
+}
+export interface AddPilotUserResult {
+    handle: string;
+    cohort: string;
+    userPath: string;
+    secretsTemplatePath: string;
+    cohortPath: string;
+    createdUser: boolean;
+    createdSecretsTemplate: boolean;
+    addedToCohort: boolean;
+}
+export declare function addPilotUser(rootDir: string, handle: string, options: AddPilotUserOptions): Promise<AddPilotUserResult>;

package/dist/verify-user.d.ts

@@ -0,0 +1,19 @@
+import type { FetchLike } from "@brains/deploy-support/origin-ca";
+import { type ResolvedUser } from "./load-registry";
+export interface VerifyPilotUserOptions {
+    fetchImpl?: FetchLike;
+    logger?: (message: string) => void;
+}
+export interface FailedCheck {
+    name: string;
+    message: string;
+}
+export interface VerifyPilotUserResult {
+    handle: string;
+    preset: ResolvedUser["preset"];
+    domain: string;
+    contentRepo: string;
+    checks: string[];
+    failedChecks: FailedCheck[];
+}
+export declare function verifyPilotUser(rootDir: string, handle: string, options?: VerifyPilotUserOptions): Promise<VerifyPilotUserResult>;

package/package.json

@@ -1,67 +1,70 @@
 {
   "name": "@rizom/ops",
+  "version": "0.2.0-alpha.221",
   "description": "Operator CLI for managing private brain fleet registry repos",
-  "publishConfig": {
-    "access": "public"
+  "keywords": [
+    "brains",
+    "ops",
+    "cli",
+    "deploy",
+    "fleet",
+    "operator"
+  ],
+  "license": "Apache-2.0",
+  "author": "Yeehaa <yeehaa@rizom.ai> (https://rizom.ai)",
+  "bin": {
+    "brains-ops": "./dist/brains-ops.js"
+  },
+  "bugs": "https://github.com/rizom-ai/brains/issues",
+  "dependencies": {
+    "age-encryption": "^0.3.0"
+  },
+  "devDependencies": {
+    "@brains/deploy-support": "workspace:*",
+    "@brains/eslint-config": "workspace:*",
+    "@brains/site-composition": "workspace:*",
+    "@brains/typescript-config": "workspace:*",
+    "@brains/utils": "workspace:*",
+    "@types/bun": "^1.3.14",
+    "typescript": "^7.0.2"
+  },
+  "engines": {
+    "bun": ">=1.3.3"
   },
-  "version": "0.2.0-alpha.22",
-  "type": "module",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
     },
     "./deploy": {
-      "bun": "./dist/deploy.js",
       "types": "./dist/deploy.d.ts",
-      "import": "./dist/deploy.js"
+      "import": "./dist/deploy.js",
+      "bun": "./dist/deploy.js"
     }
   },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "bin": {
-    "brains-ops": "./dist/brains-ops.js"
-  },
   "files": [
     "dist",
     "templates"
   ],
-  "scripts": {
-    "build": "bun scripts/build.ts",
-    "prepublishOnly": "bun scripts/build.ts",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint . --ext .ts",
-    "lint:fix": "eslint . --ext .ts --fix",
-    "test": "bun test --timeout 20000"
-  },
-  "dependencies": {
-    "age-encryption": "^0.3.0"
-  },
-  "devDependencies": {
-    "@brains/eslint-config": "workspace:*",
-    "@brains/typescript-config": "workspace:*",
-    "@brains/utils": "workspace:*",
-    "@types/bun": "latest",
-    "typescript": "^5.3.3"
+  "homepage": "https://github.com/rizom-ai/brains/tree/main/packages/brains-ops#readme",
+  "main": "./dist/index.js",
+  "publishConfig": {
+    "access": "public"
   },
   "repository": {
     "type": "git",
     "url": "https://github.com/rizom-ai/brains.git",
     "directory": "packages/brains-ops"
   },
-  "license": "Apache-2.0",
-  "author": "Yeehaa <yeehaa@rizom.ai> (https://rizom.ai)",
-  "homepage": "https://github.com/rizom-ai/brains/tree/main/packages/brains-ops#readme",
-  "bugs": "https://github.com/rizom-ai/brains/issues",
-  "engines": {
-    "bun": ">=1.3.3"
+  "scripts": {
+    "build": "bun scripts/build.ts",
+    "lint": "eslint . --max-warnings 0",
+    "lint:fix": "eslint . --max-warnings 0 --fix",
+    "prepublishOnly": "bun scripts/build.ts",
+    "test": "bun run build && bun test --timeout 20000",
+    "test:smoke": "bun run build && RUN_SMOKE_TESTS=1 bun test --timeout 60000",
+    "typecheck": "tsc --noEmit"
   },
-  "keywords": [
-    "brains",
-    "ops",
-    "cli",
-    "deploy",
-    "fleet",
-    "operator"
-  ]
+  "type": "module",
+  "types": "./dist/index.d.ts"
 }

package/templates/rover-pilot/.env.schema

@@ -14,16 +14,30 @@ AI_API_KEY=
 # @required @sensitive
 GIT_SYNC_TOKEN=
 
-# MCP interface
-# Comes from the decrypted users/<handle>.secrets.yaml.age file.
+# Content repo administration
+# Local/operator secret only. Used by brains-ops to create missing GitHub repos;
+# do not deploy it into Rover runtime config.
 # @required @sensitive
-MCP_AUTH_TOKEN=
+CONTENT_REPO_ADMIN_TOKEN=
 
 # Discord (optional, per-user)
 # Comes from the decrypted users/<handle>.secrets.yaml.age file when enabled.
 # @sensitive
 DISCORD_BOT_TOKEN=
 
+# AT Protocol publishing/discovery (optional, per-user)
+# Comes from the decrypted users/<handle>.secrets.yaml.age file when configured.
+# @sensitive
+ATPROTO_APP_PASSWORD=
+
+# Setup email delivery (optional, shared)
+# Used when a user file declares setup.delivery: email.
+# @sensitive
+SETUP_EMAIL_API_KEY=
+
+# @sensitive
+SETUP_EMAIL_FROM=
+
 # ---- deploy/provision vars ----
 
 # @required @sensitive