@rizom/ops 0.2.0-alpha.694 → 0.2.0-alpha.695

package/dist/brains-ops.js

@@ -737,7 +737,7 @@ printf 'REMOTE_ARTIFACT_DIR=%s\\n' "$remote_dir"
 `).replace(/\\n/g,`
 `).trimEnd()}
 `}var T8,Hhe;var K$=v(async()=>{pe();E8();hn();Qf();await _8();T8=l.object({HCLOUD_TOKEN:l.string().min(1),KAMAL_SSH_PRIVATE_KEY:l.string().min(1)}),Hhe=l.object({servers:l.array(l.object({status:l.string(),public_net:l.object({ipv4:l.object({ip:l.string().min(1)})})}))})});import{parseArgs as gK}from"util";function nt(e){return e}class rp extends Error{constructor(e){super(e);this.name="CliUsageError"}}function yK(e,t){let r={...t};for(let o of e)for(let[n,i]of Object.entries(o.flags??{})){let s=r[n];if(s===void 0){r[n]=i;continue}if(s.type!==i.type||s.short!==i.short||s.default!==i.default)throw Error(`Conflicting definitions for flag --${n}: commands must agree on type, short, and default`)}return r}function bK(e){let t={};for(let[r,o]of Object.entries(e))t[r]={type:o.type,...o.short!==void 0?{short:o.short}:{},...o.default!==void 0?{default:o.default}:{}};return t}function SK(e){if(!(e instanceof Error)||!("code"in e))return!1;return e.code==="ERR_PARSE_ARGS_UNKNOWN_OPTION"||e.code==="ERR_PARSE_ARGS_INVALID_OPTION_VALUE"}function V$(e,t){let r=yK(t.commands,t.globalFlags??{}),o,n;try{({values:o,positionals:n}=gK({args:e,options:bK(r),allowPositionals:!0,strict:t.strict??!0}))}catch(s){if(SK(s))throw new rp(s.message.split(". ")[0]??s.message);throw s}if("help"in r&&o.help===!0)return{command:"help",args:[],flags:{help:!0}};if("version"in r&&o.version===!0)return{command:"version",args:[],flags:{version:!0}};let i={};for(let[s,a]of Object.entries(r)){let c=o[s];if(typeof c==="string"&&a.type==="string")i[s]=c;else if(typeof c==="boolean"&&a.type==="boolean")i[s]=c}return{command:n[0]??"help",args:n.slice(1),flags:i}}function W$(e){let t=e.reduce((r,o)=>Math.max(r,o.label.length),0);return e.map((r)=>`  ${r.label.padEnd(t)}  ${r.description}`)}function vK(e){return W$(e.map((t)=>({label:t.usage?`${t.name} ${t.usage}`:t.name,description:t.description})))}function wK(e,t){let r=t.type==="string"?` ${t.placeholder??"<value>"}`:"",o=t.short!==void 0?`, -${t.short}`:"";return`--${e}${r}${o}`}function G$(e){return W$(Object.entries(e).map(([t,r])=>({label:wK(t,r),description:r.description})))}function Q$(e,t){return`Usage: ${e} ${t.name}${t.usage?` ${t.usage}`:""}`}function xK(e){return JSON.stringify(Object.entries(e).map(([t,r])=>[t,r.type,r.short??"",r.description,r.placeholder??"",r.default??""]).sort((t,r)=>String(t[0]).localeCompare(String(r[0]))))}function _K(e){let t=[],r=new Map;for(let n of e){let i=n.flags??{};if(Object.keys(i).length===0)continue;let s=xK(i),a=r.get(s);if(a){a.names.push(n.name);continue}let c={names:[n.name],flags:i};r.set(s,c),t.push(c)}let o=[];for(let n of t)o.push("",`${n.names.join(" / ")} options:`),o.push(...G$(n.flags));return o}function Y$(e){let t=[e.intro,"",`Usage: ${e.cliName} ${e.usage??"<command> [args]"}`,"","Commands:",...vK(e.commands)];if(e.globalFlags&&Object.keys(e.globalFlags).length>0)t.push("","Options:",...G$(e.globalFlags));return t.push(..._K(e.commands)),t.join(`
-`)}function X$(e){let t=new Map;for(let r of e){if(t.has(r.name))throw Error(`Duplicate command name: ${r.name}`);t.set(r.name,r)}return t}function ot(e,t){let r=e[t];return typeof r==="string"?r:void 0}function ds(e,t){let r=e[t];return typeof r==="boolean"?r:void 0}var np={name:"@rizom/ops",version:"0.2.0-alpha.694",description:"Operator CLI for managing private brain fleet registry repos",keywords:["brains","ops","cli","deploy","fleet","operator"],license:"AGPL-3.0-only",author:"Yeehaa <yeehaa@rizom.ai> (https://rizom.ai)",bin:{"brains-ops":"./dist/brains-ops.js"},bugs:"https://github.com/rizom-ai/brains/issues",dependencies:{"@libsql/client":"^0.17.4","age-encryption":"^0.3.0",yaml:"^2.9.0"},devDependencies:{"@brains/contracts":"workspace:*","@brains/deploy-support":"workspace:*","@brains/eslint-config":"workspace:*","@brains/job-queue":"workspace:*","@brains/profile":"workspace:*","@brains/site-composition":"workspace:*","@brains/test-utils":"workspace:*","@brains/typescript-config":"workspace:*","@brains/utils":"workspace:*","@types/bun":"^1.4.0",typescript:"^7.0.2"},engines:{bun:">=1.3.3"},exports:{".":{types:"./dist/index.d.ts",import:"./dist/index.js"},"./deploy":{types:"./dist/deploy.d.ts",import:"./dist/deploy.js",bun:"./dist/deploy.js"}},files:["dist","templates"],homepage:"https://github.com/rizom-ai/brains/tree/main/packages/brains-ops#readme",main:"./dist/index.js",publishConfig:{access:"public"},repository:{type:"git",url:"https://github.com/rizom-ai/brains.git",directory:"packages/brains-ops"},scripts:{build:"bun scripts/build.ts",lint:"eslint . --max-warnings 0","lint:fix":"eslint . --max-warnings 0 --fix",prepublishOnly:"bun scripts/build.ts",test:"bun test --timeout 20000","test:smoke":"bun run build && RUN_SMOKE_TESTS=1 bun test --timeout 60000",typecheck:"tsc --noEmit"},type:"module",types:"./dist/index.d.ts"};Ev();bi();import{writeFile as PY}from"fs/promises";import{join as tj}from"path";import{createSign as dW,generateKeyPairSync as fW}from"crypto";import{mkdir as pW,writeFile as X2}from"fs/promises";import{join as eD}from"path";async function wV(e){let t=await e.text();if(!t.trim())return;try{return JSON.parse(t)}catch{return t}}async function Wa(e,t,r){let o=await wV(e),n=t.safeParse(o);if(!e.ok||!n.success){let i=r.formatError??xV;throw Error(`${r.label}${i(e,o)}`)}return n.data}function xV(e,t){let r=t===void 0?"":`: ${typeof t==="string"?t:JSON.stringify(t)}`;return` (${e.status} ${e.statusText}${r})`}pe();var mW="2.5.4.3",hW="1.2.840.113549.1.1.11",nD="https://api.cloudflare.com/client/v4",gW="origin-rsa",yW=5475,oD=15000;function iD(e){return{Authorization:`Bearer ${e}`,"Content-Type":"application/json"}}var tD=l.looseObject({message:l.string().optional()}),bW=l.looseObject({errors:l.array(tD).optional(),messages:l.array(tD).optional()}),SW=l.looseObject({certificate:l.string().min(1),expires_on:l.string().optional()}),vW=l.looseObject({success:l.literal(!0),result:SW}),wW=l.looseObject({success:l.literal(!0)});function xW(){let{privateKey:e,publicKey:t}=fW("rsa",{modulusLength:2048,privateKeyEncoding:{type:"pkcs8",format:"pem"},publicKeyEncoding:{type:"spki",format:"der"}});return{privateKeyPem:e,publicKeyDer:Buffer.from(t)}}function _W(e,t){let r=yd($W(yd(rD(mW),AW(e)))),o=yd(IW(0),r,Buffer.from(t.publicKeyDer),OW(0,Buffer.alloc(0))),n=dW("sha256").update(o).sign(t.privateKeyPem),i=yd(o,yd(rD(hW),RW()),TW(n));return{csrPem:kW("CERTIFICATE REQUEST",i),certificationRequestInfoDer:o,signature:n}}async function EW(e,t,r,o){let n=await e(`${nD}/certificates`,{method:"POST",headers:iD(t),body:JSON.stringify({hostnames:[o,`*.${o}`],requested_validity:yW,request_type:gW,csr:r}),signal:AbortSignal.timeout(oD)}),i=await Wa(n,vW,{label:"Cloudflare Origin CA request failed",formatError:aD}),a={certificatePem:`${i.result.certificate.trim()}
+`)}function X$(e){let t=new Map;for(let r of e){if(t.has(r.name))throw Error(`Duplicate command name: ${r.name}`);t.set(r.name,r)}return t}function ot(e,t){let r=e[t];return typeof r==="string"?r:void 0}function ds(e,t){let r=e[t];return typeof r==="boolean"?r:void 0}var np={name:"@rizom/ops",version:"0.2.0-alpha.695",description:"Operator CLI for managing private brain fleet registry repos",keywords:["brains","ops","cli","deploy","fleet","operator"],license:"AGPL-3.0-only",author:"Yeehaa <yeehaa@rizom.ai> (https://rizom.ai)",bin:{"brains-ops":"./dist/brains-ops.js"},bugs:"https://github.com/rizom-ai/brains/issues",dependencies:{"@libsql/client":"^0.17.4","age-encryption":"^0.3.0",yaml:"^2.9.0"},devDependencies:{"@brains/contracts":"workspace:*","@brains/deploy-support":"workspace:*","@brains/eslint-config":"workspace:*","@brains/job-queue":"workspace:*","@brains/profile":"workspace:*","@brains/site-composition":"workspace:*","@brains/test-utils":"workspace:*","@brains/typescript-config":"workspace:*","@brains/utils":"workspace:*","@types/bun":"^1.4.0",typescript:"^7.0.2"},engines:{bun:">=1.3.3"},exports:{".":{types:"./dist/index.d.ts",import:"./dist/index.js"},"./deploy":{types:"./dist/deploy.d.ts",import:"./dist/deploy.js",bun:"./dist/deploy.js"}},files:["dist","templates"],homepage:"https://github.com/rizom-ai/brains/tree/main/packages/brains-ops#readme",main:"./dist/index.js",publishConfig:{access:"public"},repository:{type:"git",url:"https://github.com/rizom-ai/brains.git",directory:"packages/brains-ops"},scripts:{build:"bun scripts/build.ts",lint:"eslint . --max-warnings 0","lint:fix":"eslint . --max-warnings 0 --fix",prepublishOnly:"bun scripts/build.ts",test:"bun test --timeout 20000","test:smoke":"bun run build && RUN_SMOKE_TESTS=1 bun test --timeout 60000",typecheck:"tsc --noEmit"},type:"module",types:"./dist/index.d.ts"};Ev();bi();import{writeFile as PY}from"fs/promises";import{join as tj}from"path";import{createSign as dW,generateKeyPairSync as fW}from"crypto";import{mkdir as pW,writeFile as X2}from"fs/promises";import{join as eD}from"path";async function wV(e){let t=await e.text();if(!t.trim())return;try{return JSON.parse(t)}catch{return t}}async function Wa(e,t,r){let o=await wV(e),n=t.safeParse(o);if(!e.ok||!n.success){let i=r.formatError??xV;throw Error(`${r.label}${i(e,o)}`)}return n.data}function xV(e,t){let r=t===void 0?"":`: ${typeof t==="string"?t:JSON.stringify(t)}`;return` (${e.status} ${e.statusText}${r})`}pe();var mW="2.5.4.3",hW="1.2.840.113549.1.1.11",nD="https://api.cloudflare.com/client/v4",gW="origin-rsa",yW=5475,oD=15000;function iD(e){return{Authorization:`Bearer ${e}`,"Content-Type":"application/json"}}var tD=l.looseObject({message:l.string().optional()}),bW=l.looseObject({errors:l.array(tD).optional(),messages:l.array(tD).optional()}),SW=l.looseObject({certificate:l.string().min(1),expires_on:l.string().optional()}),vW=l.looseObject({success:l.literal(!0),result:SW}),wW=l.looseObject({success:l.literal(!0)});function xW(){let{privateKey:e,publicKey:t}=fW("rsa",{modulusLength:2048,privateKeyEncoding:{type:"pkcs8",format:"pem"},publicKeyEncoding:{type:"spki",format:"der"}});return{privateKeyPem:e,publicKeyDer:Buffer.from(t)}}function _W(e,t){let r=yd($W(yd(rD(mW),AW(e)))),o=yd(IW(0),r,Buffer.from(t.publicKeyDer),OW(0,Buffer.alloc(0))),n=dW("sha256").update(o).sign(t.privateKeyPem),i=yd(o,yd(rD(hW),RW()),TW(n));return{csrPem:kW("CERTIFICATE REQUEST",i),certificationRequestInfoDer:o,signature:n}}async function EW(e,t,r,o){let n=await e(`${nD}/certificates`,{method:"POST",headers:iD(t),body:JSON.stringify({hostnames:[o,`*.${o}`],requested_validity:yW,request_type:gW,csr:r}),signal:AbortSignal.timeout(oD)}),i=await Wa(n,vW,{label:"Cloudflare Origin CA request failed",formatError:aD}),a={certificatePem:`${i.result.certificate.trim()}
 `};if(i.result.expires_on)a.expiresOn=i.result.expires_on;return a}async function sD(e,t,r){let o=await e(`${nD}/zones/${r}/settings/ssl`,{method:"PATCH",headers:iD(t),body:JSON.stringify({value:"strict"}),signal:AbortSignal.timeout(oD)});await Wa(o,wW,{label:"Cloudflare zone SSL update failed",formatError:aD})}function kW(e,t){let o=t.toString("base64").match(/.{1,64}/g)??[];return[`-----BEGIN ${e}-----`,...o,`-----END ${e}-----`,""].join(`
 `)}function IW(e){if(e!==0)throw Error("Only zero-valued INTEGER encoding is currently supported");return Buffer.from([2,1,0])}function rD(e){let t=e.split(".").map((s)=>Number(s));if(t.length<2||t.some((s)=>Number.isNaN(s)))throw Error(`Invalid OID: ${e}`);let r=t[0],o=t[1];if(r===void 0||o===void 0)throw Error(`Invalid OID: ${e}`);let i=[r*40+o];for(let s of t.slice(2)){let a=PW(s);i.push(...a)}return Ac(6,Buffer.from(i))}function AW(e){return Ac(12,Buffer.from(e,"utf8"))}function TW(e){return Ac(3,Buffer.concat([Buffer.from([0]),e]))}function RW(){return Buffer.from([5,0])}function yd(...e){return Ac(48,Buffer.concat(e))}function $W(...e){return Ac(49,Buffer.concat(e))}function OW(e,t){return Ac(160+e,t)}function Ac(e,t){return Buffer.concat([Buffer.from([e]),CW(t.length),t])}function CW(e){if(e<128)return Buffer.from([e]);let t=[],r=e;while(r>0)t.unshift(r&255),r>>=8;return Buffer.from([128|t.length,...t])}function PW(e){if(!Number.isInteger(e)||e<0)throw Error(`Invalid OID component: ${e}`);if(e===0)return[0];let t=[],r=e;while(r>0)t.unshift(r&127),r>>=7;for(let o=0;o<t.length-1;o+=1)t[o]=(t[o]??0)|128;return t}function aD(e,t){let r=zW(t),o=r.length>0?`: ${r.join("; ")}`:"";return` (${e.status} ${e.statusText}${o})`}function zW(e){let t=bW.safeParse(e);if(!t.success)return[];return[...t.data.errors??[],...t.data.messages??[]].map((r)=>r.message).filter((r)=>typeof r==="string"&&r.length>0)}async function cD(e,t,r){let o=xW(),{csrPem:n}=_W(r,o),i=await EW(e,t,n,r);return{certificatePem:i.certificatePem,privateKeyPem:o.privateKeyPem,...i.expiresOn!==void 0&&{expiresOn:i.expiresOn}}}async function lD(e,t){let r=eD(e,"origin.pem"),o=eD(e,"origin.key");return await pW(e,{recursive:!0}),await Promise.all([X2(r,t.certificatePem,"utf-8"),X2(o,t.privateKeyPem,{encoding:"utf-8",mode:384})]),{certificatePath:r,privateKeyPath:o}}hn();Tu();Un();async function nj(e,t={}){try{return await zY(e,t),{success:!0}}catch(r){return{success:!1,message:Ve(r,"Certificate bootstrap failed")}}}async function zY(e,t={}){let r=await wt(e),o=DY(r,t.handle),n=o.domain,i=t.env??process.env,s=Dr(e),a=t.cfApiToken??jt("CF_API_TOKEN",i,s),c=t.cfZoneId??o.cloudflareZoneId??jt("CF_ZONE_ID",i,s);if(!a)throw Error("Missing CF_API_TOKEN");if(!c)throw Error("Missing CF_ZONE_ID");let u=t.fetchImpl??fetch,d=t.logger??console.log,f=await cD(u,a,n),m=tj(e,".brains-ops","certs",o.id),{certificatePath:h,privateKeyPath:b}=await lD(m,f),y=tj(m,"secrets.yaml");await PY(y,NY(f.certificatePem,f.privateKeyPem),"utf-8"),await sD(u,a,c);let S=Ha(t.pushTo);if(S)await gi([["CERTIFICATE_PEM",f.certificatePem],["PRIVATE_KEY_PEM",f.privateKeyPem]],{logger:d,runCommand:t.runCommand??tr});if(d(`Issued ${o.id} Origin CA cert for ${n} and *.${n}`),d(`Wrote ${h}`),d(`Wrote ${b}`),d(`Wrote ${y}`),f.expiresOn)d(`Expires on ${f.expiresOn}`);if(d("Cloudflare zone SSL mode set to Full (strict)"),S)d(`Pushed CERTIFICATE_PEM and PRIVATE_KEY_PEM to ${S}`);return{domain:n,certificatePath:h,privateKeyPath:b,certificatePem:f.certificatePem,secretsSnippetPath:y}}function NY(e,t){return[`certificatePem: ${rj(e)}`,`privateKeyPem: ${rj(t)}`,""].join(`
 `)}function rj(e){return`"${e.replace(/"/g,"\\\"").replace(/\n/g,"\\n")}"`}function DY(e,t){if(!t)return{id:"shared",domain:LY(e.pilot.domainSuffix)};let r=e.users.find((o)=>o.handle===t);if(!r)throw Error(`Unknown user handle: ${t}`);return{id:t,domain:r.domain,...r.cloudflareZoneId?{cloudflareZoneId:r.cloudflareZoneId}:{}}}function LY(e){let t=e.trim().replace(/^\./,"").replace(/\.$/,"");if(!t||t.includes("*"))throw Error(`Invalid pilot domainSuffix: ${e}`);return t}import{access as ij,chmod as PI,mkdir as tg,readFile as aj,writeFile as sj}from"fs/promises";import{dirname as MY,join as Dc}from"path";import{fileURLToPath as qY}from"url";bi();Id();var FY=["pilot.yaml","package.json",".env.schema",".gitignore","cohorts/cohort-1.yaml","users/alice.yaml",".github/actions/varlock-env/action.yml",".github/workflows/build.yml",".github/workflows/deploy.yml",".github/workflows/directory-sync-stress.yml",".github/workflows/health-watchdog-smoke.yml",".github/workflows/offboard.yml",".github/workflows/reconcile.yml",".github/workflows/upgrade.yml","deploy/Dockerfile","deploy/kamal/deploy.yml","deploy/scripts/helpers.ts","deploy/scripts/create-predeploy-backup.ts","deploy/scripts/install-health-watchdog.ts","deploy/scripts/provision-server.ts","deploy/scripts/pull-local-models.ts","deploy/scripts/update-dns.ts","deploy/scripts/write-ssh-key.ts","deploy/scripts/decrypt-user-secrets.ts","deploy/scripts/validate-secrets.ts","deploy/scripts/write-kamal-secrets.ts","deploy/scripts/resolve-user-config.ts","deploy/scripts/resolve-missing-images.ts","deploy/scripts/verify-runtime-image.ts","deploy/scripts/resolve-deploy-handles.ts","deploy/scripts/sync-content-repo.ts",".kamal/hooks/pre-deploy","docs/onboarding-checklist.md","docs/canonical-crossover-record.md","docs/operator-playbook.md","docs/user-onboarding.md","README.md"],zI=new Set([".kamal/hooks/pre-deploy"]),KY=new Set(["cohorts/cohort-1.yaml","users/alice.yaml","docs/canonical-crossover-record.md"]),JY=qY(new URL("../templates/rover-pilot/",import.meta.url));function Io(e){return(t)=>t.includes(e)}function HY(e){return UP.find((t)=>e===`deploy/scripts/${t}`)}function NI(e){return e.replace(/\n {2}secret:\n(?: {4}- .*\n)+\nvolumes:\n/,`

package/dist/index.js

@@ -747,7 +747,7 @@ printf 'REMOTE_ARTIFACT_DIR=%s\\n' "$remote_dir"
 `),i}async function U8(e,t){let r=await ut(e),o=r.users.find((n)=>n.handle===t);if(!o)throw Error(`Unknown pilot user: ${t}`);return{pilot:r.pilot,user:o}}async function M8(e){let t=await Vhe(io(Whe(),"brains-ops-watchdog-smoke-")),r=io(t,"id_ed25519"),o=io(t,"known_hosts");try{let n=encodeURIComponent(`brain=${e.target.pilot.contentRepoPrefix}${e.target.user.handle}`),i=await e.fetchImpl(`https://api.hetzner.cloud/v1/servers?label_selector=${n}`,{headers:{Authorization:`Bearer ${e.environment.HCLOUD_TOKEN}`}});if(!i.ok)throw Error(`Hetzner server lookup failed with ${i.status}`);let s=Ghe.parse(await i.json());if(s.servers.length!==1)throw Error(`Expected one smoke server, found ${s.servers.length}`);let a=s.servers[0];if(a?.status!=="running")throw Error("Smoke server is not running");await Zl(r,Xhe(e.environment.KAMAL_SSH_PRIVATE_KEY),{mode:384}),await Jhe(r,384);let c=await e.commandRunner("ssh-keyscan",["-T","10","-t","ed25519",a.public_net.ipv4.ip]);if(c.exitCode!==0||!c.stdout.trim())throw Error("Unable to resolve watchdog smoke SSH host key");return await Zl(o,c.stdout,{mode:384}),{temporaryRoot:t,sshKeyPath:r,knownHostsPath:o,serverIp:a.public_net.ipv4.ip,commandRunner:e.commandRunner}}catch(n){throw await aO(t,{recursive:!0,force:!0}),n}}async function sO(e,t,r){return e.commandRunner("ssh",[...q8(e),`root@${e.serverIp}`,"bash","-s","--",t,r],{stdin:cO()})}async function Qhe(e,t,r){return e.commandRunner("scp",[...q8(e),"-r",`root@${e.serverIp}:${t}/.`,r])}function q8(e){return["-i",e.sshKeyPath,"-o","BatchMode=yes","-o","IdentitiesOnly=yes","-o","ConnectTimeout=10","-o","StrictHostKeyChecking=yes","-o",`UserKnownHostsFile=${e.knownHostsPath}`]}async function Yhe(e){try{return await Hhe(e),!0}catch{return!1}}async function zb(e,t,r){await Promise.all([Zl(io(e,`${t}.stdout.log`),r.stdout),Zl(io(e,`${t}.stderr.log`),r.stderr)])}function Xhe(e){return`${e.replace(/\r\n/g,`
 `).replace(/\\n/g,`
 `).trimEnd()}
-`}var B8,Ghe;var Db=v(async()=>{fe();z8();Hr();tf();await P8();B8=l.object({HCLOUD_TOKEN:l.string().min(1),KAMAL_SSH_PRIVATE_KEY:l.string().min(1)}),Ghe=l.object({servers:l.array(l.object({status:l.string(),public_net:l.object({ipv4:l.object({ip:l.string().min(1)})})}))})});import{access as w2,chmod as JE,mkdir as sh,readFile as _2,writeFile as x2}from"fs/promises";import{dirname as PW,join as dc}from"path";import{fileURLToPath as zW}from"url";var af={name:"@rizom/ops",version:"0.2.0-alpha.694",description:"Operator CLI for managing private brain fleet registry repos",keywords:["brains","ops","cli","deploy","fleet","operator"],license:"AGPL-3.0-only",author:"Yeehaa <yeehaa@rizom.ai> (https://rizom.ai)",bin:{"brains-ops":"./dist/brains-ops.js"},bugs:"https://github.com/rizom-ai/brains/issues",dependencies:{"@libsql/client":"^0.17.4","age-encryption":"^0.3.0",yaml:"^2.9.0"},devDependencies:{"@brains/contracts":"workspace:*","@brains/deploy-support":"workspace:*","@brains/eslint-config":"workspace:*","@brains/job-queue":"workspace:*","@brains/profile":"workspace:*","@brains/site-composition":"workspace:*","@brains/test-utils":"workspace:*","@brains/typescript-config":"workspace:*","@brains/utils":"workspace:*","@types/bun":"^1.4.0",typescript:"^7.0.2"},engines:{bun:">=1.3.3"},exports:{".":{types:"./dist/index.d.ts",import:"./dist/index.js"},"./deploy":{types:"./dist/deploy.d.ts",import:"./dist/deploy.js",bun:"./dist/deploy.js"}},files:["dist","templates"],homepage:"https://github.com/rizom-ai/brains/tree/main/packages/brains-ops#readme",main:"./dist/index.js",publishConfig:{access:"public"},repository:{type:"git",url:"https://github.com/rizom-ai/brains.git",directory:"packages/brains-ops"},scripts:{build:"bun scripts/build.ts",lint:"eslint . --max-warnings 0","lint:fix":"eslint . --max-warnings 0 --fix",prepublishOnly:"bun scripts/build.ts",test:"bun test --timeout 20000","test:smoke":"bun run build && RUN_SMOKE_TESTS=1 bun test --timeout 60000",typecheck:"tsc --noEmit"},type:"module",types:"./dist/index.d.ts"};Qo();uc();var NW=["pilot.yaml","package.json",".env.schema",".gitignore","cohorts/cohort-1.yaml","users/alice.yaml",".github/actions/varlock-env/action.yml",".github/workflows/build.yml",".github/workflows/deploy.yml",".github/workflows/directory-sync-stress.yml",".github/workflows/health-watchdog-smoke.yml",".github/workflows/offboard.yml",".github/workflows/reconcile.yml",".github/workflows/upgrade.yml","deploy/Dockerfile","deploy/kamal/deploy.yml","deploy/scripts/helpers.ts","deploy/scripts/create-predeploy-backup.ts","deploy/scripts/install-health-watchdog.ts","deploy/scripts/provision-server.ts","deploy/scripts/pull-local-models.ts","deploy/scripts/update-dns.ts","deploy/scripts/write-ssh-key.ts","deploy/scripts/decrypt-user-secrets.ts","deploy/scripts/validate-secrets.ts","deploy/scripts/write-kamal-secrets.ts","deploy/scripts/resolve-user-config.ts","deploy/scripts/resolve-missing-images.ts","deploy/scripts/verify-runtime-image.ts","deploy/scripts/resolve-deploy-handles.ts","deploy/scripts/sync-content-repo.ts",".kamal/hooks/pre-deploy","docs/onboarding-checklist.md","docs/canonical-crossover-record.md","docs/operator-playbook.md","docs/user-onboarding.md","README.md"],VE=new Set([".kamal/hooks/pre-deploy"]),DW=new Set(["cohorts/cohort-1.yaml","users/alice.yaml","docs/canonical-crossover-record.md"]),LW=zW(new URL("../templates/rover-pilot/",import.meta.url));function fo(e){return(t)=>t.includes(e)}function BW(e){return yO.find((t)=>e===`deploy/scripts/${t}`)}function WE(e){return e.replace(/\n {2}secret:\n(?: {4}- .*\n)+\nvolumes:\n/,`
+`}var B8,Ghe;var Db=v(async()=>{fe();z8();Hr();tf();await P8();B8=l.object({HCLOUD_TOKEN:l.string().min(1),KAMAL_SSH_PRIVATE_KEY:l.string().min(1)}),Ghe=l.object({servers:l.array(l.object({status:l.string(),public_net:l.object({ipv4:l.object({ip:l.string().min(1)})})}))})});import{access as w2,chmod as JE,mkdir as sh,readFile as _2,writeFile as x2}from"fs/promises";import{dirname as PW,join as dc}from"path";import{fileURLToPath as zW}from"url";var af={name:"@rizom/ops",version:"0.2.0-alpha.695",description:"Operator CLI for managing private brain fleet registry repos",keywords:["brains","ops","cli","deploy","fleet","operator"],license:"AGPL-3.0-only",author:"Yeehaa <yeehaa@rizom.ai> (https://rizom.ai)",bin:{"brains-ops":"./dist/brains-ops.js"},bugs:"https://github.com/rizom-ai/brains/issues",dependencies:{"@libsql/client":"^0.17.4","age-encryption":"^0.3.0",yaml:"^2.9.0"},devDependencies:{"@brains/contracts":"workspace:*","@brains/deploy-support":"workspace:*","@brains/eslint-config":"workspace:*","@brains/job-queue":"workspace:*","@brains/profile":"workspace:*","@brains/site-composition":"workspace:*","@brains/test-utils":"workspace:*","@brains/typescript-config":"workspace:*","@brains/utils":"workspace:*","@types/bun":"^1.4.0",typescript:"^7.0.2"},engines:{bun:">=1.3.3"},exports:{".":{types:"./dist/index.d.ts",import:"./dist/index.js"},"./deploy":{types:"./dist/deploy.d.ts",import:"./dist/deploy.js",bun:"./dist/deploy.js"}},files:["dist","templates"],homepage:"https://github.com/rizom-ai/brains/tree/main/packages/brains-ops#readme",main:"./dist/index.js",publishConfig:{access:"public"},repository:{type:"git",url:"https://github.com/rizom-ai/brains.git",directory:"packages/brains-ops"},scripts:{build:"bun scripts/build.ts",lint:"eslint . --max-warnings 0","lint:fix":"eslint . --max-warnings 0 --fix",prepublishOnly:"bun scripts/build.ts",test:"bun test --timeout 20000","test:smoke":"bun run build && RUN_SMOKE_TESTS=1 bun test --timeout 60000",typecheck:"tsc --noEmit"},type:"module",types:"./dist/index.d.ts"};Qo();uc();var NW=["pilot.yaml","package.json",".env.schema",".gitignore","cohorts/cohort-1.yaml","users/alice.yaml",".github/actions/varlock-env/action.yml",".github/workflows/build.yml",".github/workflows/deploy.yml",".github/workflows/directory-sync-stress.yml",".github/workflows/health-watchdog-smoke.yml",".github/workflows/offboard.yml",".github/workflows/reconcile.yml",".github/workflows/upgrade.yml","deploy/Dockerfile","deploy/kamal/deploy.yml","deploy/scripts/helpers.ts","deploy/scripts/create-predeploy-backup.ts","deploy/scripts/install-health-watchdog.ts","deploy/scripts/provision-server.ts","deploy/scripts/pull-local-models.ts","deploy/scripts/update-dns.ts","deploy/scripts/write-ssh-key.ts","deploy/scripts/decrypt-user-secrets.ts","deploy/scripts/validate-secrets.ts","deploy/scripts/write-kamal-secrets.ts","deploy/scripts/resolve-user-config.ts","deploy/scripts/resolve-missing-images.ts","deploy/scripts/verify-runtime-image.ts","deploy/scripts/resolve-deploy-handles.ts","deploy/scripts/sync-content-repo.ts",".kamal/hooks/pre-deploy","docs/onboarding-checklist.md","docs/canonical-crossover-record.md","docs/operator-playbook.md","docs/user-onboarding.md","README.md"],VE=new Set([".kamal/hooks/pre-deploy"]),DW=new Set(["cohorts/cohort-1.yaml","users/alice.yaml","docs/canonical-crossover-record.md"]),LW=zW(new URL("../templates/rover-pilot/",import.meta.url));function fo(e){return(t)=>t.includes(e)}function BW(e){return yO.find((t)=>e===`deploy/scripts/${t}`)}function WE(e){return e.replace(/\n {2}secret:\n(?: {4}- .*\n)+\nvolumes:\n/,`
   secret:
     - __DYNAMIC_SECRETS__
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rizom/ops",
-  "version": "0.2.0-alpha.694",
+  "version": "0.2.0-alpha.695",
   "description": "Operator CLI for managing private brain fleet registry repos",
   "keywords": [
     "brains",