@rizom/ops 0.2.0-alpha.687 → 0.2.0-alpha.689

package/dist/load-registry.d.ts

@@ -15,7 +15,7 @@ export interface ResolvedCohort {
     bundlesOverride?: CanonicalBundleId[];
     addOverride?: string[];
     removeOverride?: string[];
-    aiApiKeyOverride?: string;
+    openaiApiKeyOverride?: string;
     gitSyncTokenOverride?: string;
 }
 export interface ResolvedAnchorProfileSocialLink {
@@ -96,7 +96,7 @@ export interface ResolvedUserIdentity {
     siteOverride?: ResolvedSiteOverride;
     discordEnabled: boolean;
     discordAnchorUserId?: string;
-    effectiveAiApiKey: string;
+    effectiveOpenaiApiKey: string;
     effectiveGitSyncToken: string;
     setup?: ResolvedSetupDelivery;
     atproto?: ResolvedAtprotoConfig;

package/dist/provider-key-migration.d.ts

@@ -0,0 +1,20 @@
+import { type Document } from "yaml";
+/**
+ * Rename a desired-state file's legacy AI key fields in place, keeping their
+ * position and comments. The shared selector follows the variable rename;
+ * an override keeps the operator secret it names.
+ */
+export declare function migrateProviderKeyFieldsYaml(input: string): string;
+/** The legacy AI key fields of a desired-state document, renamed in place. */
+export declare function renameProviderKeyFields(document: Document): boolean;
+/** The OpenAI selector for a legacy shared AI key selector. */
+export declare function openaiSelectorFor(legacySelector: string): string;
+/** Pass the OpenAI key to the container where the deploy passed the legacy key. */
+export declare function migratePilotDeploySecrets(input: string): string;
+/** Rename the legacy shared key's variable, keeping where its value comes from. */
+export declare function migratePilotEnvSchema(input: string): string;
+/**
+ * Migrate a pilot checkout in place; returns the files it changed. Running
+ * it again changes nothing.
+ */
+export declare function migratePilotRepoProviderKeys(rootDir: string, env: NodeJS.ProcessEnv): Promise<string[]>;

package/dist/schema.d.ts

@@ -54,7 +54,7 @@ export declare const pilotSchema: z.ZodObject<{
     githubOrg: z.ZodString;
     contentRepoPrefix: z.ZodString;
     domainSuffix: z.ZodString;
-    aiApiKey: z.ZodString;
+    openaiApiKey: z.ZodString;
     gitSyncToken: z.ZodString;
     contentRepoAdminToken: z.ZodString;
     agePublicKey: z.ZodString;
@@ -66,7 +66,7 @@ export declare const cohortSchema: z.ZodObject<{
     bundlesOverride: z.ZodOptional<typeof canonicalBundlesSchema>;
     addOverride: z.ZodOptional<typeof memberIdsSchema>;
     removeOverride: z.ZodOptional<typeof memberIdsSchema>;
-    aiApiKeyOverride: z.ZodOptional<z.ZodString>;
+    openaiApiKeyOverride: z.ZodOptional<z.ZodString>;
     gitSyncTokenOverride: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type CohortConfig = z.output<typeof cohortSchema>;
@@ -131,7 +131,7 @@ export declare const userSchema: z.ZodObject<{
         enabled: z.ZodBoolean;
         anchorUserId: z.ZodOptional<z.ZodString>;
     }>;
-    aiApiKeyOverride: z.ZodOptional<z.ZodString>;
+    openaiApiKeyOverride: z.ZodOptional<z.ZodString>;
     gitSyncTokenOverride: z.ZodOptional<z.ZodString>;
     domainOverride: z.ZodOptional<z.ZodString>;
     cloudflareZoneId: z.ZodOptional<z.ZodString>;

package/dist/secrets-encrypt.d.ts

@@ -4,7 +4,7 @@ declare const encryptedUserSecretsSchema: z.ZodObject<{
     discordBotToken: z.ZodOptional<z.ZodString>;
     discordPublicKey: z.ZodOptional<z.ZodString>;
     discordApplicationId: z.ZodOptional<z.ZodString>;
-    aiApiKey: z.ZodOptional<z.ZodString>;
+    openaiApiKey: z.ZodOptional<z.ZodString>;
     atprotoAppPassword: z.ZodOptional<z.ZodString>;
     certificatePem: z.ZodOptional<z.ZodString>;
     privateKeyPem: z.ZodOptional<z.ZodString>;
@@ -23,4 +23,5 @@ export interface SecretsEncryptResult {
     dryRun?: boolean | undefined;
 }
 export declare function encryptPilotSecrets(rootDir: string, handle: string, options?: SecretsEncryptOptions): Promise<SecretsEncryptResult>;
+export declare function readAgeIdentity(rootDir: string, env: NodeJS.ProcessEnv, localEnvValues: Record<string, string>): string | undefined;
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rizom/ops",
-  "version": "0.2.0-alpha.687",
+  "version": "0.2.0-alpha.689",
   "description": "Operator CLI for managing private brain fleet registry repos",
   "keywords": [
     "brains",

package/templates/rover-pilot/.env.schema

@@ -3,11 +3,19 @@
 # @defaultRequired=false @defaultSensitive=false
 # ----------
 
-# AI provider
-# Shared GitHub secret by default; a per-user override may come from the decrypted
+# OpenAI, the provider of the canonical chat and embedding models
+# Shared secret by default; a per-user override may come from the decrypted
 # users/<handle>.secrets.yaml.age file at deploy time.
 # @required @sensitive
-AI_API_KEY=
+OPENAI_API_KEY=
+
+# Anthropic and Google: unused by the canonical models; the shared deploy
+# config passes every provider's key to the brain.
+# @sensitive
+ANTHROPIC_API_KEY=
+
+# @sensitive
+GOOGLE_GENERATIVE_AI_API_KEY=
 
 # Git sync
 # Comes from the decrypted users/<handle>.secrets.yaml.age file.

package/templates/rover-pilot/deploy/scripts/decrypt-user-secrets.ts

@@ -18,7 +18,7 @@ const plaintext = await decrypter.decrypt(decoded, "text");
 const secrets = parseStringYamlMapping(plaintext);
 const pilot = parseStringYamlMapping(readFileSync("pilot.yaml", "utf8"));
 
-writeSecretGitHubEnv("AI_API_KEY", secrets["aiApiKey"]);
+writeSecretGitHubEnv("OPENAI_API_KEY", secrets["openaiApiKey"]);
 writeSecretGitHubEnv("GIT_SYNC_TOKEN", secrets["gitSyncToken"]);
 writeSecretGitHubEnv(
   "STUDIO_CONTENT_REPO_PAT",
@@ -63,8 +63,8 @@ function assertPemShape(name: string, value: string | undefined): void {
 }
 
 writeGitHubOutput(
-  "shared_ai_api_key_secret_name",
-  requireFlatValue(pilot, "aiApiKey", "pilot.yaml"),
+  "shared_openai_api_key_secret_name",
+  requireFlatValue(pilot, "openaiApiKey", "pilot.yaml"),
 );
 writeGitHubOutput(
   "shared_git_sync_token_secret_name",

package/templates/rover-pilot/docs/onboarding-checklist.md

@@ -4,7 +4,7 @@
 2. Run `bunx brains-ops age-key:bootstrap <repo> --push-to gh`.
 3. Fill in `pilot.yaml`.
    - keep your pinned `brainVersion`
-   - confirm shared selectors for `aiApiKey`, `gitSyncToken`, and `contentRepoAdminToken`
+   - confirm shared selectors for `openaiApiKey`, `gitSyncToken`, and `contentRepoAdminToken`
    - use different tokens for `contentRepoAdminToken` and `gitSyncToken`: admin creates/checks content repos; sync is used by runtime directory-sync
    - confirm `agePublicKey`
 4. Run `bunx brains-ops user:add <repo> <handle> --cohort <cohort>`.

package/templates/rover-pilot/pilot.yaml

@@ -8,7 +8,7 @@ bundles:
   - media
   - web
   - chat
-aiApiKey: AI_API_KEY
+openaiApiKey: OPENAI_API_KEY
 gitSyncToken: GIT_SYNC_TOKEN
 contentRepoAdminToken: CONTENT_REPO_ADMIN_TOKEN
 agePublicKey: age1replace-with-your-public-key