@rizom/ops 0.2.0-alpha.351 → 0.2.0-alpha.353

package/dist/directory-sync-stress.d.ts

@@ -1,87 +1,97 @@
 import type { FetchLike } from "@brains/deploy-support/origin-ca";
 import { z } from "@brains/utils/zod";
-export type DirectorySyncStressProfile = "regression" | "load" | "stress";
-export type DirectorySyncStressOperation = "add" | "update" | "rename" | "delete";
-export interface DirectorySyncStressPhase {
-    id: string;
-    operation: DirectorySyncStressOperation;
-    count: number;
-    targetProbeCount: number;
-    settleMs: number;
-}
-export interface DirectorySyncStressPlan {
-    profile: DirectorySyncStressProfile;
-    maximumProbeCount: number;
-    maximumExternalAiCalls?: number | undefined;
-    phases: DirectorySyncStressPhase[];
-}
-export interface StressBaseline {
-    entities: number;
-    notes: number;
-    version: string;
-}
-export interface StressHealthSample {
-    timestamp: string;
-    endpoint: string;
-    status: number;
-    durationMs: number;
-    ok: boolean;
-    error?: string | undefined;
-}
-export interface StressRuntimeSample {
-    timestamp: string;
-    cpuPercent: number;
-    memoryPercent: number;
-    pids: number;
-}
-export interface StressPhaseResult {
-    id: string;
-    operation: DirectorySyncStressOperation;
-    count: number;
-    success: boolean;
-    commitLatencyMs?: number | undefined;
-    persistenceLatencyMs?: number | undefined;
-    error?: string | undefined;
-}
-export interface StressCleanupResult {
-    success: boolean;
-    probesRemaining: number;
-    finalEntities?: number | undefined;
-    finalNotes?: number | undefined;
-    contentTreeRestored?: boolean | undefined;
-    error?: string | undefined;
-}
-export interface StressContainerState {
-    status: string;
-    restartCount: number;
-    oomKilled: boolean;
-}
-export interface StressMetrics {
-    health: StressHealthSample[];
-    runtime: StressRuntimeSample[];
-    externalAiCalls?: number | undefined;
-    container?: StressContainerState | undefined;
-}
-export interface DirectorySyncStressReport {
-    profile: DirectorySyncStressProfile;
-    success: boolean;
-    baseline: StressBaseline;
-    phases: StressPhaseResult[];
-    cleanup: StressCleanupResult;
-    metrics: StressMetrics;
-    failure?: string | undefined;
-}
-export declare const directorySyncStressProfileSchema: z.ZodType<DirectorySyncStressProfile>;
-export declare const directorySyncStressOperationSchema: z.ZodType<DirectorySyncStressOperation>;
-export declare const directorySyncStressPhaseSchema: z.ZodType<DirectorySyncStressPhase>;
-export declare const directorySyncStressPlanSchema: z.ZodType<DirectorySyncStressPlan>;
-export declare const stressBaselineSchema: z.ZodType<StressBaseline>;
-export declare const stressHealthSampleSchema: z.ZodType<StressHealthSample>;
-export declare const stressRuntimeSampleSchema: z.ZodType<StressRuntimeSample>;
-export declare const stressPhaseResultSchema: z.ZodType<StressPhaseResult>;
-export declare const stressCleanupResultSchema: z.ZodType<StressCleanupResult>;
-export declare const stressMetricsSchema: z.ZodType<StressMetrics>;
-export declare const directorySyncStressReportSchema: z.ZodType<DirectorySyncStressReport>;
+export declare const directorySyncStressProfileSchema: z.ZodEnum<{
+    regression: "regression";
+    load: "load";
+    stress: "stress";
+}>;
+export type DirectorySyncStressProfile = z.output<typeof directorySyncStressProfileSchema>;
+export declare const directorySyncStressOperationSchema: z.ZodEnum<{
+    add: "add";
+    update: "update";
+    rename: "rename";
+    delete: "delete";
+}>;
+export type DirectorySyncStressOperation = z.output<typeof directorySyncStressOperationSchema>;
+export declare const directorySyncStressPhaseSchema: z.ZodObject<{
+    id: z.ZodString;
+    operation: typeof directorySyncStressOperationSchema;
+    count: z.ZodNumber;
+    targetProbeCount: z.ZodNumber;
+    settleMs: z.ZodNumber;
+}>;
+export type DirectorySyncStressPhase = z.output<typeof directorySyncStressPhaseSchema>;
+export declare const directorySyncStressPlanSchema: z.ZodObject<{
+    profile: typeof directorySyncStressProfileSchema;
+    maximumProbeCount: z.ZodNumber;
+    maximumExternalAiCalls: z.ZodOptional<z.ZodNumber>;
+    phases: z.ZodArray<typeof directorySyncStressPhaseSchema>;
+}>;
+export type DirectorySyncStressPlan = z.output<typeof directorySyncStressPlanSchema>;
+export declare const stressBaselineSchema: z.ZodObject<{
+    entities: z.ZodNumber;
+    notes: z.ZodNumber;
+    version: z.ZodString;
+}>;
+export type StressBaseline = z.output<typeof stressBaselineSchema>;
+export declare const stressHealthSampleSchema: z.ZodObject<{
+    timestamp: z.ZodISODateTime;
+    endpoint: z.ZodString;
+    status: z.ZodNumber;
+    durationMs: z.ZodNumber;
+    ok: z.ZodBoolean;
+    error: z.ZodOptional<z.ZodString>;
+}>;
+export type StressHealthSample = z.output<typeof stressHealthSampleSchema>;
+export declare const stressRuntimeSampleSchema: z.ZodObject<{
+    timestamp: z.ZodISODateTime;
+    cpuPercent: z.ZodNumber;
+    memoryPercent: z.ZodNumber;
+    pids: z.ZodNumber;
+}>;
+export type StressRuntimeSample = z.output<typeof stressRuntimeSampleSchema>;
+export declare const stressPhaseResultSchema: z.ZodObject<{
+    id: z.ZodString;
+    operation: typeof directorySyncStressOperationSchema;
+    count: z.ZodNumber;
+    success: z.ZodBoolean;
+    commitLatencyMs: z.ZodOptional<z.ZodNumber>;
+    persistenceLatencyMs: z.ZodOptional<z.ZodNumber>;
+    error: z.ZodOptional<z.ZodString>;
+}>;
+export type StressPhaseResult = z.output<typeof stressPhaseResultSchema>;
+export declare const stressCleanupResultSchema: z.ZodObject<{
+    success: z.ZodBoolean;
+    probesRemaining: z.ZodNumber;
+    finalEntities: z.ZodOptional<z.ZodNumber>;
+    finalNotes: z.ZodOptional<z.ZodNumber>;
+    contentTreeRestored: z.ZodOptional<z.ZodBoolean>;
+    error: z.ZodOptional<z.ZodString>;
+}>;
+export type StressCleanupResult = z.output<typeof stressCleanupResultSchema>;
+export declare const stressContainerStateSchema: z.ZodObject<{
+    status: z.ZodString;
+    restartCount: z.ZodNumber;
+    oomKilled: z.ZodBoolean;
+}>;
+export type StressContainerState = z.output<typeof stressContainerStateSchema>;
+export declare const stressMetricsSchema: z.ZodObject<{
+    health: z.ZodArray<typeof stressHealthSampleSchema>;
+    runtime: z.ZodArray<typeof stressRuntimeSampleSchema>;
+    externalAiCalls: z.ZodOptional<z.ZodNumber>;
+    container: z.ZodOptional<typeof stressContainerStateSchema>;
+}>;
+export type StressMetrics = z.output<typeof stressMetricsSchema>;
+export declare const directorySyncStressReportSchema: z.ZodObject<{
+    profile: typeof directorySyncStressProfileSchema;
+    success: z.ZodBoolean;
+    baseline: typeof stressBaselineSchema;
+    phases: z.ZodArray<typeof stressPhaseResultSchema>;
+    cleanup: typeof stressCleanupResultSchema;
+    metrics: typeof stressMetricsSchema;
+    failure: z.ZodOptional<z.ZodString>;
+}>;
+export type DirectorySyncStressReport = z.output<typeof directorySyncStressReportSchema>;
 export interface DirectorySyncStressTarget {
     handle: string;
     domain: string;

package/dist/entries/deploy.d.ts

@@ -1,4 +1,3 @@
 export { readJsonResponse, parseEnvFile, parseEnvSchema, parseEnvSchemaFile, requireEnv, writeGitHubOutput, writeGitHubEnv, } from "@brains/deploy-support";
 export type { EnvSchemaEntry } from "@brains/deploy-support";
-export { siteImageTag, runtimeImageTag, sitePackagesFor, requiredImages, resolveImageBuilds, runResolveMissingImages, type ImageRequirementSource, type RequiredImage, type ResolveImageBuildsOptions, type RunResolveMissingImagesOptions, } from "../images";
-export { SHARED_FLEET_IMAGE_CONTRACT, ISOLATED_SITE_IMAGE_CONTRACT, imageContractSchema, type ImageContract, } from "../schema";
+export { runtimeImageTag, sitePackagesFor, requiredImages, resolveImageBuilds, runResolveMissingImages, type ImageRequirementSource, type RequiredImage, type ResolveImageBuildsOptions, type RunResolveMissingImagesOptions, } from "../images";

package/dist/images.d.ts

@@ -1,23 +1,13 @@
 import { type ResolvedSiteOverride } from "./load-registry";
 import { type RunCommand } from "./run-subprocess";
-import { type ImageContract } from "./schema";
 /**
- * Resolve a fleet image tag as a pure function of a single instance's own
- * config. This is the shared contract between the build (which tags the image
- * it pushes) and the deploy (which waits for and runs that tag), so both must
- * import this — never recompute it independently.
- *
- * The default path is deliberately untouched: an instance with no site packages
- * resolves to the plain `brain-{version}` tag every other fleet instance uses.
- * A site override is a per-instance opt-in that hashes only *that instance's*
- * package set into a distinct `brain-{version}-sites-{hash}` image, so it can
- * never collide with — or leak into — the shared default image.
+ * Resolve the immutable runtime image shared by every fleet instance on one
+ * Brain version. Build and Deploy both import this function so their tags can
+ * never disagree.
  */
-export declare function siteImageTag(brainVersion: string, sitePackages: string[]): string;
-/** Resolve the runtime tag selected by the pilot's explicit image contract. */
-export declare function runtimeImageTag(imageContract: ImageContract, brainVersion: string, sitePackages: string[]): string;
+export declare function runtimeImageTag(brainVersion: string): string;
 /**
- * The npm packages a site override installs into its per-instance image.
+ * The npm packages a site override contributes to its version's shared image.
  * A @rizom-scoped theme is independently published and installs at its own
  * explicit version; @brains/* themes are bundled inside @rizom/brain and must
  * not be npm-installed.
@@ -35,15 +25,13 @@ export interface RequiredImage {
     sitePackages: string[];
 }
 /**
- * Derive the immutable images required by the declared fleet. Shared fleets
- * get one image per Brain version containing the union of packages required by
- * every instance on that version. Fleets that explicitly retain isolated site
- * images get one tag per distinct version/package set.
+ * Derive one immutable image per effective Brain version. Each image contains
+ * the union of exact site/theme package pins required by every instance on
+ * that version.
  */
-export declare function requiredImages(users: ImageRequirementSource[], imageContract?: ImageContract): RequiredImage[];
+export declare function requiredImages(users: ImageRequirementSource[]): RequiredImage[];
 export interface ResolveImageBuildsOptions {
     users: ImageRequirementSource[];
-    imageContract?: ImageContract | undefined;
     /**
      * Explicit dispatch override — the manual/backfill path. When set, exactly
      * this one image is built, skipping the registry-derived resolve. Published
@@ -70,13 +58,27 @@ export interface RunResolveMissingImagesOptions {
     writeOutput: (key: string, value: string) => void;
     log?: (line: string) => void;
 }
+/**
+ * Whether the registry already holds this tag.
+ *
+ * `docker manifest inspect` exits non-zero when the manifest is unknown, so a
+ * command failure is the "absent" answer. A failure to run docker at all is
+ * not: answering false there would let resolveImageBuilds past its
+ * tag-immutability guard and overwrite a published tag, which is exactly what
+ * that guard exists to prevent. Those propagate.
+ *
+ * A non-zero exit caused by an auth or network problem is still read as
+ * absent — docker reports it the same way it reports an unknown manifest, and
+ * telling them apart means matching stderr text that shifts between versions.
+ */
+export declare function imageTagExists(run: RunCommand, imageRepository: string, tag: string): Promise<boolean>;
 /**
  * The Build workflow's resolve step: derive the image set the declared fleet
  * state (pilot.yaml + cohorts + users) requires, probe the container registry
  * for each tag, and emit the missing ones as a GitHub Actions build matrix
  * (`images_json`, entries `{tag, brain_version, site_packages}`). Dispatch
- * inputs `BRAIN_VERSION_INPUT`/`SITE_PACKAGES_INPUT`/`IMAGE_CONTRACT_INPUT`
- * force a single explicit build instead. Deriving and probing here means a config push builds exactly
+ * inputs `BRAIN_VERSION_INPUT`/`SITE_PACKAGES_INPUT` force a single explicit
+ * build instead. Deriving and probing here means a config push builds exactly
  * what it declares — nothing reactive, nothing manual.
  */
 export declare function runResolveMissingImages(options: RunResolveMissingImagesOptions): Promise<RequiredImage[]>;

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { initPilotRepo } from "./init";
 export { loadPilotRegistry, type LoadPilotRegistryOptions, } from "./load-registry";
-export { siteImageTag, runtimeImageTag, sitePackagesFor, requiredImages, resolveImageBuilds, runResolveMissingImages, type ImageRequirementSource, type RequiredImage, type ResolveImageBuildsOptions, type RunResolveMissingImagesOptions, } from "./images";
+export { runtimeImageTag, sitePackagesFor, requiredImages, resolveImageBuilds, runResolveMissingImages, type ImageRequirementSource, type RequiredImage, type ResolveImageBuildsOptions, type RunResolveMissingImagesOptions, } from "./images";
 export { derivePreviewDomain, type PreviewDomainOptions, } from "./preview-domain";
 export { writeUsersTable } from "./render-users-table";
 export { onboardUser } from "./onboard-user";
@@ -18,4 +18,4 @@ export { assertDirectorySyncStressTarget, directorySyncStressPlanSchema, directo
 export { cleanupDirectorySyncStress, runDeployedDirectorySyncStress, verifyDirectorySyncStressAccess, type CleanupDirectorySyncStressOptions, type CleanupDirectorySyncStressResult, type DeployedDirectorySyncStressOptions, type DeployedDirectorySyncStressResult, type VerifyDirectorySyncStressAccessOptions, type VerifyDirectorySyncStressAccessResult, } from "./directory-sync-stress-system";
 export { assertHealthWatchdogSmokeTarget, cleanupHealthWatchdogSmoke, renderHealthWatchdogSmokeRemoteScript, runHealthWatchdogSmoke, type CleanupHealthWatchdogSmokeOptions, type CleanupHealthWatchdogSmokeResult, type HealthWatchdogSmokeOptions, type HealthWatchdogSmokeResult, type HealthWatchdogSmokeTarget, } from "./health-watchdog-smoke";
 export { runCommand, type CommandResult } from "./run-command";
-export { pilotSchema, cohortSchema, canonicalBundleIdSchema, CAPABILITY_BUNDLE_CONTRACT, SHARED_FLEET_IMAGE_CONTRACT, ISOLATED_SITE_IMAGE_CONTRACT, imageContractSchema, type ImageContract, type PilotConfig, type CohortConfig, } from "./schema";
+export { pilotSchema, cohortSchema, canonicalBundleIdSchema, CAPABILITY_BUNDLE_CONTRACT, type PilotConfig, type CohortConfig, } from "./schema";