@rizom/ops 0.2.0-alpha.35 → 0.2.0-alpha.350

package/dist/directory-sync-stress-system.d.ts

@@ -0,0 +1,75 @@
+import type { FetchLike } from "@brains/deploy-support/origin-ca";
+import { type DirectorySyncStressPhase, type DirectorySyncStressPlan, type DirectorySyncStressProfile, type DirectorySyncStressReport, type StressRuntimeSample } from "./directory-sync-stress";
+import { type StressCommandRunner } from "./stress-command";
+export { runStressCommand, type StressCommandOptions, type StressCommandResult, type StressCommandRunner, } from "./stress-command";
+export interface DeployedDirectorySyncStressOptions {
+    rootDir: string;
+    handle: string;
+    profile: DirectorySyncStressProfile;
+    plan?: DirectorySyncStressPlan;
+    confirmation: string;
+    artifactsDir?: string;
+    env?: NodeJS.ProcessEnv;
+    fetchImpl?: FetchLike;
+    commandRunner?: StressCommandRunner;
+    logger?: (message: string) => void;
+    now?: () => Date;
+    sleep?: (milliseconds: number) => Promise<void>;
+}
+export interface VerifyDirectorySyncStressAccessOptions {
+    rootDir: string;
+    handle: string;
+    confirmation: string;
+    artifactsDir?: string;
+    env?: NodeJS.ProcessEnv;
+    commandRunner?: StressCommandRunner;
+    now?: () => Date;
+}
+export interface CleanupDirectorySyncStressOptions {
+    rootDir: string;
+    handle: string;
+    confirmation: string;
+    artifactsDir?: string;
+    env?: NodeJS.ProcessEnv;
+    commandRunner?: StressCommandRunner;
+    logger?: (message: string) => void;
+    now?: () => Date;
+}
+export interface DeployedDirectorySyncStressResult {
+    runId: string;
+    artifactsDir: string;
+    target: {
+        handle: string;
+        domain: string;
+        contentRepo: string;
+    };
+    startedAt: string;
+    completedAt: string;
+    report: DirectorySyncStressReport;
+}
+export interface VerifyDirectorySyncStressAccessResult {
+    success: true;
+    artifactsDir: string;
+    checkedAt: string;
+    remoteHead: string;
+    target: {
+        handle: string;
+        domain: string;
+        contentRepo: string;
+    };
+}
+export interface CleanupDirectorySyncStressResult {
+    success: boolean;
+    artifactsDir: string;
+    probesRemoved: number;
+    probesRemaining: number;
+    backupBranchesDeleted: string[];
+    cleanupCommit?: string;
+}
+export declare function runDeployedDirectorySyncStress(options: DeployedDirectorySyncStressOptions): Promise<DeployedDirectorySyncStressResult>;
+export declare function verifyDirectorySyncStressAccess(options: VerifyDirectorySyncStressAccessOptions): Promise<VerifyDirectorySyncStressAccessResult>;
+export declare function cleanupDirectorySyncStress(options: CleanupDirectorySyncStressOptions): Promise<CleanupDirectorySyncStressResult>;
+export declare function applyDirectorySyncStressPhase(checkoutDir: string, phase: DirectorySyncStressPhase): Promise<void>;
+export declare function listProbeFiles(checkoutDir: string): Promise<string[]>;
+export declare function removeProbeFiles(checkoutDir: string): Promise<number>;
+export declare function parseStressRuntimeSample(output: string, timestamp: string): StressRuntimeSample | undefined;

package/dist/directory-sync-stress.d.ts

@@ -0,0 +1,107 @@
+import type { FetchLike } from "@brains/deploy-support/origin-ca";
+import { z } from "@brains/utils/zod";
+export type DirectorySyncStressProfile = "regression" | "load" | "stress";
+export type DirectorySyncStressOperation = "add" | "update" | "rename" | "delete";
+export interface DirectorySyncStressPhase {
+    id: string;
+    operation: DirectorySyncStressOperation;
+    count: number;
+    targetProbeCount: number;
+    settleMs: number;
+}
+export interface DirectorySyncStressPlan {
+    profile: DirectorySyncStressProfile;
+    maximumProbeCount: number;
+    maximumExternalAiCalls?: number | undefined;
+    phases: DirectorySyncStressPhase[];
+}
+export interface StressBaseline {
+    entities: number;
+    notes: number;
+    version: string;
+}
+export interface StressHealthSample {
+    timestamp: string;
+    endpoint: string;
+    status: number;
+    durationMs: number;
+    ok: boolean;
+    error?: string | undefined;
+}
+export interface StressRuntimeSample {
+    timestamp: string;
+    cpuPercent: number;
+    memoryPercent: number;
+    pids: number;
+}
+export interface StressPhaseResult {
+    id: string;
+    operation: DirectorySyncStressOperation;
+    count: number;
+    success: boolean;
+    commitLatencyMs?: number | undefined;
+    persistenceLatencyMs?: number | undefined;
+    error?: string | undefined;
+}
+export interface StressCleanupResult {
+    success: boolean;
+    probesRemaining: number;
+    finalEntities?: number | undefined;
+    finalNotes?: number | undefined;
+    contentTreeRestored?: boolean | undefined;
+    error?: string | undefined;
+}
+export interface StressContainerState {
+    status: string;
+    restartCount: number;
+    oomKilled: boolean;
+}
+export interface StressMetrics {
+    health: StressHealthSample[];
+    runtime: StressRuntimeSample[];
+    externalAiCalls?: number | undefined;
+    container?: StressContainerState | undefined;
+}
+export interface DirectorySyncStressReport {
+    profile: DirectorySyncStressProfile;
+    success: boolean;
+    baseline: StressBaseline;
+    phases: StressPhaseResult[];
+    cleanup: StressCleanupResult;
+    metrics: StressMetrics;
+    failure?: string | undefined;
+}
+export declare const directorySyncStressProfileSchema: z.ZodType<DirectorySyncStressProfile>;
+export declare const directorySyncStressOperationSchema: z.ZodType<DirectorySyncStressOperation>;
+export declare const directorySyncStressPhaseSchema: z.ZodType<DirectorySyncStressPhase>;
+export declare const directorySyncStressPlanSchema: z.ZodType<DirectorySyncStressPlan>;
+export declare const stressBaselineSchema: z.ZodType<StressBaseline>;
+export declare const stressHealthSampleSchema: z.ZodType<StressHealthSample>;
+export declare const stressRuntimeSampleSchema: z.ZodType<StressRuntimeSample>;
+export declare const stressPhaseResultSchema: z.ZodType<StressPhaseResult>;
+export declare const stressCleanupResultSchema: z.ZodType<StressCleanupResult>;
+export declare const stressMetricsSchema: z.ZodType<StressMetrics>;
+export declare const directorySyncStressReportSchema: z.ZodType<DirectorySyncStressReport>;
+export interface DirectorySyncStressTarget {
+    handle: string;
+    domain: string;
+    contentRepo: string;
+    confirmation: string;
+}
+export interface DirectorySyncStressDriver {
+    prepare(plan: DirectorySyncStressPlan): Promise<StressBaseline>;
+    startMonitoring(): Promise<void>;
+    executePhase(phase: DirectorySyncStressPhase, baseline: StressBaseline): Promise<StressPhaseResult>;
+    cleanup(baseline: StressBaseline): Promise<StressCleanupResult>;
+    stopMonitoring(): Promise<StressMetrics>;
+}
+export declare function resolveDirectorySyncStressPlan(profile: DirectorySyncStressProfile): DirectorySyncStressPlan;
+export declare function assertDirectorySyncStressTarget(target: DirectorySyncStressTarget): void;
+export interface SampleStressHealthOptions {
+    fetchImpl?: FetchLike;
+    now?: () => Date;
+    timeoutMs?: number;
+}
+export declare function sampleStressHealth(url: string, options?: SampleStressHealthOptions): Promise<StressHealthSample>;
+export declare function runDirectorySyncStressPlan(plan: DirectorySyncStressPlan, driver: DirectorySyncStressDriver): Promise<DirectorySyncStressReport>;
+export declare function stressMetricsFailure(metrics: StressMetrics, maximumExternalAiCalls?: number): string | undefined;

package/dist/entries/deploy.d.ts

@@ -1,2 +1,3 @@
-export { readJsonResponse, parseEnvFile, parseEnvSchema, parseEnvSchemaFile, requireEnv, writeGitHubOutput, writeGitHubEnv, } from "@brains/utils";
-export type { EnvSchemaEntry } from "@brains/utils";
+export { readJsonResponse, parseEnvFile, parseEnvSchema, parseEnvSchemaFile, requireEnv, writeGitHubOutput, writeGitHubEnv, } from "@brains/deploy-support";
+export type { EnvSchemaEntry } from "@brains/deploy-support";
+export { siteImageTag, sitePackagesFor, requiredImages, resolveImageBuilds, runResolveMissingImages, type ImageRequirementSource, type RequiredImage, type ResolveImageBuildsOptions, type RunResolveMissingImagesOptions, } from "../images";

package/dist/health-watchdog-smoke.d.ts

@@ -0,0 +1,54 @@
+import type { FetchLike } from "@brains/deploy-support/origin-ca";
+import { type StressCommandRunner } from "./stress-command";
+export interface HealthWatchdogSmokeTarget {
+    handle: string;
+    domain: string;
+    confirmation: string;
+    runId: string;
+}
+export interface HealthWatchdogSmokeOptions {
+    rootDir: string;
+    handle: string;
+    confirmation: string;
+    runId: string;
+    artifactsDir?: string | undefined;
+    env?: NodeJS.ProcessEnv | undefined;
+    fetchImpl?: FetchLike | undefined;
+    commandRunner?: StressCommandRunner | undefined;
+    logger?: ((message: string) => void) | undefined;
+}
+export interface HealthWatchdogSmokeResult {
+    success: true;
+    runId: string;
+    artifactsDir: string;
+    target: {
+        handle: string;
+        domain: string;
+        serverIp: string;
+    };
+}
+export interface CleanupHealthWatchdogSmokeOptions {
+    rootDir: string;
+    handle: string;
+    confirmation: string;
+    runId: string;
+    artifactsDir?: string | undefined;
+    env?: NodeJS.ProcessEnv | undefined;
+    fetchImpl?: FetchLike | undefined;
+    commandRunner?: StressCommandRunner | undefined;
+    logger?: ((message: string) => void) | undefined;
+}
+export interface CleanupHealthWatchdogSmokeResult {
+    success: true;
+    runId: string;
+    artifactsDir: string;
+    target: {
+        handle: string;
+        domain: string;
+        serverIp: string;
+    };
+}
+export declare function assertHealthWatchdogSmokeTarget(target: HealthWatchdogSmokeTarget): void;
+export declare function renderHealthWatchdogSmokeRemoteScript(): string;
+export declare function runHealthWatchdogSmoke(options: HealthWatchdogSmokeOptions): Promise<HealthWatchdogSmokeResult>;
+export declare function cleanupHealthWatchdogSmoke(options: CleanupHealthWatchdogSmokeOptions): Promise<CleanupHealthWatchdogSmokeResult>;

package/dist/images.d.ts

@@ -0,0 +1,79 @@
+import { type ResolvedSiteOverride } from "./load-registry";
+import { type RunCommand } from "./run-subprocess";
+/**
+ * Resolve a fleet image tag as a pure function of a single instance's own
+ * config. This is the shared contract between the build (which tags the image
+ * it pushes) and the deploy (which waits for and runs that tag), so both must
+ * import this — never recompute it independently.
+ *
+ * The default path is deliberately untouched: an instance with no site packages
+ * resolves to the plain `brain-{version}` tag every other fleet instance uses.
+ * A site override is a per-instance opt-in that hashes only *that instance's*
+ * package set into a distinct `brain-{version}-sites-{hash}` image, so it can
+ * never collide with — or leak into — the shared default image.
+ */
+export declare function siteImageTag(brainVersion: string, sitePackages: string[]): string;
+/**
+ * The npm packages a site override installs into its per-instance image.
+ * A @rizom-scoped theme is independently published and installs at its own
+ * explicit version; @brains/* themes are bundled inside @rizom/brain and must
+ * not be npm-installed.
+ */
+export declare function sitePackagesFor(siteOverride: ResolvedSiteOverride | undefined): string[];
+/** The per-user slice of the registry that determines which image it runs. */
+export interface ImageRequirementSource {
+    brainVersion: string;
+    siteOverride?: ResolvedSiteOverride | undefined;
+}
+export interface RequiredImage {
+    tag: string;
+    brainVersion: string;
+    /** Sorted, deduped — build args for the image, empty for the default. */
+    sitePackages: string[];
+}
+/**
+ * The image set the declared fleet state requires: one default
+ * `brain-{version}` per distinct brain version in use, plus one
+ * `brain-{version}-sites-{hash}` per distinct site-override package set.
+ * Derived purely from resolved users (pass `registry.users`), so CI can build
+ * exactly what a config push declares — nothing reactive, nothing manual.
+ */
+export declare function requiredImages(users: ImageRequirementSource[]): RequiredImage[];
+export interface ResolveImageBuildsOptions {
+    users: ImageRequirementSource[];
+    /**
+     * Explicit dispatch override — the manual/backfill path. When set, exactly
+     * this one image is built, skipping the registry-derived resolve. Published
+     * tags stay immutable: a same-tag rebuild from a newer Dockerfile can
+     * strand the tag boot-broken, so rebuilding needs allowTagOverwrite.
+     */
+    brainVersionInput?: string | undefined;
+    sitePackagesInput?: string | undefined;
+    allowTagOverwrite?: boolean | undefined;
+    imageExists: (tag: string) => Promise<boolean>;
+}
+/**
+ * Decide which images a Build run must produce: the declared required set
+ * filtered to tags the registry does not already hold, or the single image an
+ * explicit dispatch input forces.
+ */
+export declare function resolveImageBuilds(options: ResolveImageBuildsOptions): Promise<RequiredImage[]>;
+export interface RunResolveMissingImagesOptions {
+    rootDir: string;
+    /** e.g. `ghcr.io/rizom-ai/rover-pilot` */
+    imageRepository: string;
+    env?: NodeJS.ProcessEnv;
+    runCommand?: RunCommand;
+    writeOutput: (key: string, value: string) => void;
+    log?: (line: string) => void;
+}
+/**
+ * The Build workflow's resolve step: derive the image set the declared fleet
+ * state (pilot.yaml + cohorts + users) requires, probe the container registry
+ * for each tag, and emit the missing ones as a GitHub Actions build matrix
+ * (`images_json`, entries `{tag, brain_version, site_packages}`). Dispatch
+ * inputs `BRAIN_VERSION_INPUT`/`SITE_PACKAGES_INPUT` force a single explicit
+ * build instead. Deriving and probing here means a config push builds exactly
+ * what it declares — nothing reactive, nothing manual.
+ */
+export declare function runResolveMissingImages(options: RunResolveMissingImagesOptions): Promise<RequiredImage[]>;

package/dist/index.d.ts

@@ -1,7 +1,10 @@
 export { initPilotRepo } from "./init";
 export { loadPilotRegistry, type LoadPilotRegistryOptions, } from "./load-registry";
+export { siteImageTag, sitePackagesFor, requiredImages, resolveImageBuilds, runResolveMissingImages, type ImageRequirementSource, type RequiredImage, type ResolveImageBuildsOptions, type RunResolveMissingImagesOptions, } from "./images";
+export { derivePreviewDomain, type PreviewDomainOptions, } from "./preview-domain";
 export { writeUsersTable } from "./render-users-table";
 export { onboardUser } from "./onboard-user";
+export { addPilotUser } from "./user-add";
 export { reconcileCohort } from "./reconcile-cohort";
 export { reconcileAll } from "./reconcile-all";
 export { parseArgs, type ParsedArgs } from "./parse-args";
@@ -10,4 +13,9 @@ export { bootstrapPilotSshKey, runPilotSshKeyBootstrap, } from "./ssh-key-bootst
 export { bootstrapPilotOriginCertificate, runPilotCertBootstrap, } from "./cert-bootstrap";
 export { encryptPilotSecrets } from "./secrets-encrypt";
 export { pushPilotSecrets } from "./secrets-push";
+export { verifyPilotUser } from "./verify-user";
+export { assertDirectorySyncStressTarget, directorySyncStressPlanSchema, directorySyncStressProfileSchema, directorySyncStressReportSchema, resolveDirectorySyncStressPlan, runDirectorySyncStressPlan, sampleStressHealth, stressMetricsFailure, type DirectorySyncStressDriver, type DirectorySyncStressPhase, type DirectorySyncStressPlan, type DirectorySyncStressProfile, type DirectorySyncStressReport, } from "./directory-sync-stress";
+export { cleanupDirectorySyncStress, runDeployedDirectorySyncStress, verifyDirectorySyncStressAccess, type CleanupDirectorySyncStressOptions, type CleanupDirectorySyncStressResult, type DeployedDirectorySyncStressOptions, type DeployedDirectorySyncStressResult, type VerifyDirectorySyncStressAccessOptions, type VerifyDirectorySyncStressAccessResult, } from "./directory-sync-stress-system";
+export { assertHealthWatchdogSmokeTarget, cleanupHealthWatchdogSmoke, renderHealthWatchdogSmokeRemoteScript, runHealthWatchdogSmoke, type CleanupHealthWatchdogSmokeOptions, type CleanupHealthWatchdogSmokeResult, type HealthWatchdogSmokeOptions, type HealthWatchdogSmokeResult, type HealthWatchdogSmokeTarget, } from "./health-watchdog-smoke";
 export { runCommand, type CommandResult } from "./run-command";
+export { pilotSchema, cohortSchema, canonicalBundleIdSchema, CAPABILITY_BUNDLE_CONTRACT, type PilotConfig, type CohortConfig, } from "./schema";