@rizom/ops 0.2.0-alpha.7 → 0.2.0-alpha.700

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (85) hide show
  1. package/README.md +89 -4
  2. package/dist/age-key-bootstrap.d.ts +17 -0
  3. package/dist/brains-ops.js +763 -177
  4. package/dist/capability-bundle-migration.d.ts +26 -0
  5. package/dist/cert-bootstrap.d.ts +6 -4
  6. package/dist/content-repo-ref.d.ts +10 -0
  7. package/dist/content-repo.d.ts +13 -0
  8. package/dist/default-user-runner.d.ts +1 -1
  9. package/dist/deploy.js +110 -166
  10. package/dist/directory-sync-stress-system.d.ts +75 -0
  11. package/dist/directory-sync-stress.d.ts +117 -0
  12. package/dist/entries/deploy.d.ts +4 -2
  13. package/dist/health-watchdog-smoke.d.ts +54 -0
  14. package/dist/image-inventory.d.ts +4 -0
  15. package/dist/image-types.d.ts +7 -0
  16. package/dist/images.d.ts +89 -0
  17. package/dist/index.d.ts +11 -0
  18. package/dist/index.js +775 -177
  19. package/dist/legacy-pilot-migration.d.ts +11 -0
  20. package/dist/legacy-projection-job-recovery.d.ts +29 -0
  21. package/dist/load-registry.d.ts +92 -8
  22. package/dist/observed-status.d.ts +1 -1
  23. package/dist/onboard-user.d.ts +2 -2
  24. package/dist/parse-args.d.ts +2 -10
  25. package/dist/preview-domain.d.ts +9 -0
  26. package/dist/provider-key-migration.d.ts +20 -0
  27. package/dist/reconcile-all.d.ts +2 -2
  28. package/dist/reconcile-cohort.d.ts +2 -2
  29. package/dist/reconcile-dry-run.d.ts +9 -0
  30. package/dist/reconcile-lib.d.ts +4 -2
  31. package/dist/run-command.d.ts +22 -6
  32. package/dist/runtime-image-lock.d.ts +12 -0
  33. package/dist/schema.d.ts +145 -71
  34. package/dist/secrets-encrypt.d.ts +27 -0
  35. package/dist/secrets-push.d.ts +2 -2
  36. package/dist/ssh-key-bootstrap.d.ts +1 -26
  37. package/dist/stage-legacy-crossover.d.ts +25 -0
  38. package/dist/stress-command.d.ts +14 -0
  39. package/dist/stress-git-checkout.d.ts +21 -0
  40. package/dist/stress-health-monitor.d.ts +56 -0
  41. package/dist/upgrade.d.ts +10 -0
  42. package/dist/user-add.d.ts +16 -0
  43. package/dist/user-offboard.d.ts +61 -0
  44. package/dist/user-runner.d.ts +5 -0
  45. package/dist/verify-user.d.ts +22 -0
  46. package/package.json +51 -40
  47. package/templates/rover-pilot/.env.schema +38 -4
  48. package/templates/rover-pilot/.github/actions/varlock-env/action.yml +47 -0
  49. package/templates/rover-pilot/.github/workflows/build.yml +71 -17
  50. package/templates/rover-pilot/.github/workflows/deploy.yml +127 -49
  51. package/templates/rover-pilot/.github/workflows/directory-sync-stress.yml +119 -0
  52. package/templates/rover-pilot/.github/workflows/health-watchdog-smoke.yml +95 -0
  53. package/templates/rover-pilot/.github/workflows/offboard.yml +107 -0
  54. package/templates/rover-pilot/.github/workflows/reconcile.yml +23 -3
  55. package/templates/rover-pilot/.github/workflows/upgrade.yml +104 -0
  56. package/templates/rover-pilot/README.md +19 -8
  57. package/templates/rover-pilot/deploy/scripts/create-predeploy-backup.ts +962 -0
  58. package/templates/rover-pilot/deploy/scripts/decrypt-user-secrets.ts +139 -0
  59. package/templates/rover-pilot/deploy/scripts/helpers.ts +3 -0
  60. package/templates/rover-pilot/deploy/scripts/install-health-watchdog.ts +144 -0
  61. package/templates/rover-pilot/deploy/scripts/provision-server.ts +52 -22
  62. package/templates/rover-pilot/deploy/scripts/pull-local-models.ts +69 -0
  63. package/templates/rover-pilot/deploy/scripts/resolve-deploy-handles.ts +19 -4
  64. package/templates/rover-pilot/deploy/scripts/resolve-missing-images.ts +13 -0
  65. package/templates/rover-pilot/deploy/scripts/resolve-user-config.ts +71 -14
  66. package/templates/rover-pilot/deploy/scripts/sync-content-repo.ts +183 -0
  67. package/templates/rover-pilot/deploy/scripts/update-dns.ts +72 -16
  68. package/templates/rover-pilot/deploy/scripts/validate-secrets.ts +12 -1
  69. package/templates/rover-pilot/deploy/scripts/verify-runtime-image.ts +18 -0
  70. package/templates/rover-pilot/docs/canonical-crossover-record.md +107 -0
  71. package/templates/rover-pilot/docs/onboarding-checklist.md +39 -14
  72. package/templates/rover-pilot/docs/operator-playbook.md +421 -22
  73. package/templates/rover-pilot/docs/user-onboarding.md +49 -271
  74. package/templates/rover-pilot/package.json +4 -0
  75. package/templates/rover-pilot/pilot.yaml +10 -4
  76. package/templates/rover-pilot/users/alice.yaml +5 -1
  77. package/dist/origin-ca.d.ts +0 -1
  78. package/dist/push-secrets.d.ts +0 -9
  79. package/dist/push-target.d.ts +0 -2
  80. package/dist/run-subprocess.d.ts +0 -5
  81. package/dist/user-secret-names.d.ts +0 -6
  82. package/templates/rover-pilot/.kamal/hooks/pre-deploy +0 -9
  83. package/templates/rover-pilot/deploy/Caddyfile +0 -66
  84. package/templates/rover-pilot/deploy/Dockerfile +0 -38
  85. package/templates/rover-pilot/deploy/kamal/deploy.yml +0 -39
@@ -0,0 +1,26 @@
1
+ import { z } from "@brains/utils/zod";
2
+ import { CAPABILITY_BUNDLE_CONTRACT, canonicalBundleIdSchema, handleSchema } from "./schema";
3
+ declare const legacyBundleIdSchema: z.ZodEnum<{
4
+ core: "core";
5
+ site: "site";
6
+ publishing: "publishing";
7
+ team: "team";
8
+ }>;
9
+ declare const legacyBundlesSchema: z.ZodArray<typeof legacyBundleIdSchema>;
10
+ type SelectionRewriteSchema = z.ZodObject<{
11
+ sourceBundles: typeof legacyBundlesSchema;
12
+ targetBundles: z.ZodArray<typeof canonicalBundleIdSchema>;
13
+ }, z.core.$strict>;
14
+ declare const selectionRewriteSchema: SelectionRewriteSchema;
15
+ declare const capabilityBundleReviewSchema: z.ZodObject<{
16
+ bundleContract: z.ZodLiteral<typeof CAPABILITY_BUNDLE_CONTRACT>;
17
+ pilot: SelectionRewriteSchema;
18
+ cohorts: z.ZodRecord<typeof handleSchema, SelectionRewriteSchema>;
19
+ }, z.core.$strict>;
20
+ export type LegacyCanonicalBundleId = z.output<typeof legacyBundleIdSchema>;
21
+ export type SelectionRewrite = z.output<typeof selectionRewriteSchema>;
22
+ export type CapabilityBundleReview = z.output<typeof capabilityBundleReviewSchema>;
23
+ export declare function parseCapabilityBundleReview(input: string): CapabilityBundleReview;
24
+ export declare function migrateCanonicalPilotYaml(input: string, review: CapabilityBundleReview["pilot"]): string;
25
+ export declare function migrateCanonicalCohortYaml(input: string, cohortId: string, review: SelectionRewrite | undefined): string;
26
+ export {};
@@ -1,9 +1,10 @@
1
- import { type FetchLike } from "@brains/utils/origin-ca";
2
- import { type RunCommand } from "./run-subprocess";
1
+ import type { FetchLike } from "@brains/utils/fetch-like";
2
+ import { type RunCommand } from "@brains/deploy-support/run-subprocess";
3
3
  export interface CertBootstrapOptions {
4
4
  env?: NodeJS.ProcessEnv | undefined;
5
5
  cfApiToken?: string | undefined;
6
6
  cfZoneId?: string | undefined;
7
+ handle?: string | undefined;
7
8
  fetchImpl?: FetchLike;
8
9
  logger?: (message: string) => void;
9
10
  pushTo?: string | undefined;
@@ -14,9 +15,10 @@ export interface CertBootstrapResult {
14
15
  certificatePath: string;
15
16
  privateKeyPath: string;
16
17
  certificatePem: string;
18
+ secretsSnippetPath: string;
17
19
  }
18
- export declare function runPilotCertBootstrap(rootDir: string, handle: string, options?: CertBootstrapOptions): Promise<{
20
+ export declare function runPilotCertBootstrap(rootDir: string, options?: CertBootstrapOptions): Promise<{
19
21
  success: boolean;
20
22
  message?: string;
21
23
  }>;
22
- export declare function bootstrapPilotOriginCertificate(rootDir: string, handle: string, options?: CertBootstrapOptions): Promise<CertBootstrapResult>;
24
+ export declare function bootstrapPilotOriginCertificate(rootDir: string, options?: CertBootstrapOptions): Promise<CertBootstrapResult>;
@@ -0,0 +1,10 @@
1
+ export interface ContentRepoRef {
2
+ org: string;
3
+ name: string;
4
+ }
5
+ /**
6
+ * A user's contentRepo is either a bare repo name (owned by the pilot
7
+ * org) or an org-qualified `org/name` override.
8
+ */
9
+ export declare function resolveContentRepoRef(contentRepo: string, githubOrg: string): ContentRepoRef;
10
+ export declare function renderContentRepoRef(contentRepo: string, githubOrg: string): string;
@@ -0,0 +1,13 @@
1
+ import type { ResolvedUser } from "./load-registry";
2
+ import { type RunCommand } from "@brains/deploy-support/run-subprocess";
3
+ import type { ContentRepoFile } from "./user-runner";
4
+ type FetchImpl = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
5
+ export interface ContentRepoSyncOptions {
6
+ env?: NodeJS.ProcessEnv | undefined;
7
+ runCommand?: RunCommand | undefined;
8
+ fetchImpl?: FetchImpl | undefined;
9
+ contentRepoRemoteResolver?: ((user: ResolvedUser, githubOrg: string, token: string | undefined) => string | undefined) | undefined;
10
+ contentRepoAdminTokenSelector?: string | undefined;
11
+ }
12
+ export declare function syncUserContentRepo(rootDir: string, githubOrg: string, user: ResolvedUser, files: ContentRepoFile[], options?: ContentRepoSyncOptions): Promise<void>;
13
+ export {};
@@ -1,3 +1,3 @@
1
1
  import type { ResolvedUser } from "./load-registry";
2
- import type { UserRunResult } from "./reconcile-lib";
2
+ import type { UserRunResult } from "./user-runner";
3
3
  export declare function createDefaultUserRunner(githubOrg: string): (user: ResolvedUser) => Promise<UserRunResult>;