@rizom/ops 0.2.0-alpha.707 → 0.2.0-alpha.709

package/dist/brains-ops.js

@@ -737,7 +737,7 @@ printf 'REMOTE_ARTIFACT_DIR=%s\\n' "$remote_dir"
 `).replace(/\\n/g,`
 `).trimEnd()}
 `}var R8,Whe;var J$=v(async()=>{pe();k8();hn();Yf();await E8();R8=l.object({HCLOUD_TOKEN:l.string().min(1),KAMAL_SSH_PRIVATE_KEY:l.string().min(1)}),Whe=l.object({servers:l.array(l.object({status:l.string(),public_net:l.object({ipv4:l.object({ip:l.string().min(1)})})}))})});import{parseArgs as yK}from"util";function nt(e){return e}class np extends Error{constructor(e){super(e);this.name="CliUsageError"}}function bK(e,t){let r={...t};for(let o of e)for(let[n,i]of Object.entries(o.flags??{})){let s=r[n];if(s===void 0){r[n]=i;continue}if(s.type!==i.type||s.short!==i.short||s.default!==i.default)throw Error(`Conflicting definitions for flag --${n}: commands must agree on type, short, and default`)}return r}function SK(e){let t={};for(let[r,o]of Object.entries(e))t[r]={type:o.type,...o.short!==void 0?{short:o.short}:{},...o.default!==void 0?{default:o.default}:{}};return t}function vK(e){if(!(e instanceof Error)||!("code"in e))return!1;return e.code==="ERR_PARSE_ARGS_UNKNOWN_OPTION"||e.code==="ERR_PARSE_ARGS_INVALID_OPTION_VALUE"}function W$(e,t){let r=bK(t.commands,t.globalFlags??{}),o,n;try{({values:o,positionals:n}=yK({args:e,options:SK(r),allowPositionals:!0,strict:t.strict??!0}))}catch(s){if(vK(s))throw new np(s.message.split(". ")[0]??s.message);throw s}if("help"in r&&o.help===!0)return{command:"help",args:[],flags:{help:!0}};if("version"in r&&o.version===!0)return{command:"version",args:[],flags:{version:!0}};let i={};for(let[s,a]of Object.entries(r)){let c=o[s];if(typeof c==="string"&&a.type==="string")i[s]=c;else if(typeof c==="boolean"&&a.type==="boolean")i[s]=c}return{command:n[0]??"help",args:n.slice(1),flags:i}}function G$(e){let t=e.reduce((r,o)=>Math.max(r,o.label.length),0);return e.map((r)=>`  ${r.label.padEnd(t)}  ${r.description}`)}function wK(e){return G$(e.map((t)=>({label:t.usage?`${t.name} ${t.usage}`:t.name,description:t.description})))}function xK(e,t){let r=t.type==="string"?` ${t.placeholder??"<value>"}`:"",o=t.short!==void 0?`, -${t.short}`:"";return`--${e}${r}${o}`}function Q$(e){return G$(Object.entries(e).map(([t,r])=>({label:xK(t,r),description:r.description})))}function Y$(e,t){return`Usage: ${e} ${t.name}${t.usage?` ${t.usage}`:""}`}function _K(e){return JSON.stringify(Object.entries(e).map(([t,r])=>[t,r.type,r.short??"",r.description,r.placeholder??"",r.default??""]).sort((t,r)=>String(t[0]).localeCompare(String(r[0]))))}function EK(e){let t=[],r=new Map;for(let n of e){let i=n.flags??{};if(Object.keys(i).length===0)continue;let s=_K(i),a=r.get(s);if(a){a.names.push(n.name);continue}let c={names:[n.name],flags:i};r.set(s,c),t.push(c)}let o=[];for(let n of t)o.push("",`${n.names.join(" / ")} options:`),o.push(...Q$(n.flags));return o}function X$(e){let t=[e.intro,"",`Usage: ${e.cliName} ${e.usage??"<command> [args]"}`,"","Commands:",...wK(e.commands)];if(e.globalFlags&&Object.keys(e.globalFlags).length>0)t.push("","Options:",...Q$(e.globalFlags));return t.push(...EK(e.commands)),t.join(`
-`)}function eO(e){let t=new Map;for(let r of e){if(t.has(r.name))throw Error(`Duplicate command name: ${r.name}`);t.set(r.name,r)}return t}function ot(e,t){let r=e[t];return typeof r==="string"?r:void 0}function ds(e,t){let r=e[t];return typeof r==="boolean"?r:void 0}var op={name:"@rizom/ops",version:"0.2.0-alpha.707",description:"Operator CLI for managing private brain fleet registry repos",keywords:["brains","ops","cli","deploy","fleet","operator"],license:"AGPL-3.0-only",author:"Yeehaa <yeehaa@rizom.ai> (https://rizom.ai)",bin:{"brains-ops":"./dist/brains-ops.js"},bugs:"https://github.com/rizom-ai/brains/issues",dependencies:{"@libsql/client":"^0.17.4","age-encryption":"^0.3.0",yaml:"^2.9.0"},devDependencies:{"@brains/contracts":"workspace:*","@brains/deploy-support":"workspace:*","@brains/eslint-config":"workspace:*","@brains/job-queue":"workspace:*","@brains/profile":"workspace:*","@brains/site-composition":"workspace:*","@brains/test-utils":"workspace:*","@brains/typescript-config":"workspace:*","@brains/utils":"workspace:*","@types/bun":"^1.4.0",typescript:"^7.0.2"},engines:{bun:">=1.3.3"},exports:{".":{types:"./dist/index.d.ts",import:"./dist/index.js"},"./deploy":{types:"./dist/deploy.d.ts",import:"./dist/deploy.js",bun:"./dist/deploy.js"}},files:["dist","templates"],homepage:"https://github.com/rizom-ai/brains/tree/main/packages/brains-ops#readme",main:"./dist/index.js",publishConfig:{access:"public"},repository:{type:"git",url:"https://github.com/rizom-ai/brains.git",directory:"packages/brains-ops"},scripts:{build:"bun scripts/build.ts",lint:"eslint . --max-warnings 0","lint:fix":"eslint . --max-warnings 0 --fix",prepublishOnly:"bun scripts/build.ts",test:"bun test --timeout 20000","test:smoke":"bun run build && RUN_SMOKE_TESTS=1 bun test --timeout 60000",typecheck:"tsc --noEmit"},type:"module",types:"./dist/index.d.ts"};kv();bi();import{writeFile as zY}from"fs/promises";import{join as rj}from"path";import{createSign as fW,generateKeyPairSync as pW}from"crypto";import{mkdir as mW,writeFile as eD}from"fs/promises";import{join as tD}from"path";async function xV(e){let t=await e.text();if(!t.trim())return;try{return JSON.parse(t)}catch{return t}}async function Wa(e,t,r){let o=await xV(e),n=t.safeParse(o);if(!e.ok||!n.success){let i=r.formatError??_V;throw Error(`${r.label}${i(e,o)}`)}return n.data}function _V(e,t){let r=t===void 0?"":`: ${typeof t==="string"?t:JSON.stringify(t)}`;return` (${e.status} ${e.statusText}${r})`}pe();var hW="2.5.4.3",gW="1.2.840.113549.1.1.11",oD="https://api.cloudflare.com/client/v4",yW="origin-rsa",bW=5475,iD=15000;function sD(e){return{Authorization:`Bearer ${e}`,"Content-Type":"application/json"}}var rD=l.looseObject({message:l.string().optional()}),SW=l.looseObject({errors:l.array(rD).optional(),messages:l.array(rD).optional()}),vW=l.looseObject({certificate:l.string().min(1),expires_on:l.string().optional()}),wW=l.looseObject({success:l.literal(!0),result:vW}),xW=l.looseObject({success:l.literal(!0)});function _W(){let{privateKey:e,publicKey:t}=pW("rsa",{modulusLength:2048,privateKeyEncoding:{type:"pkcs8",format:"pem"},publicKeyEncoding:{type:"spki",format:"der"}});return{privateKeyPem:e,publicKeyDer:Buffer.from(t)}}function EW(e,t){let r=bd(OW(bd(nD(hW),TW(e)))),o=bd(AW(0),r,Buffer.from(t.publicKeyDer),CW(0,Buffer.alloc(0))),n=fW("sha256").update(o).sign(t.privateKeyPem),i=bd(o,bd(nD(gW),$W()),RW(n));return{csrPem:IW("CERTIFICATE REQUEST",i),certificationRequestInfoDer:o,signature:n}}async function kW(e,t,r,o){let n=await e(`${oD}/certificates`,{method:"POST",headers:sD(t),body:JSON.stringify({hostnames:[o,`*.${o}`],requested_validity:bW,request_type:yW,csr:r}),signal:AbortSignal.timeout(iD)}),i=await Wa(n,wW,{label:"Cloudflare Origin CA request failed",formatError:cD}),a={certificatePem:`${i.result.certificate.trim()}
+`)}function eO(e){let t=new Map;for(let r of e){if(t.has(r.name))throw Error(`Duplicate command name: ${r.name}`);t.set(r.name,r)}return t}function ot(e,t){let r=e[t];return typeof r==="string"?r:void 0}function ds(e,t){let r=e[t];return typeof r==="boolean"?r:void 0}var op={name:"@rizom/ops",version:"0.2.0-alpha.709",description:"Operator CLI for managing private brain fleet registry repos",keywords:["brains","ops","cli","deploy","fleet","operator"],license:"AGPL-3.0-only",author:"Yeehaa <yeehaa@rizom.ai> (https://rizom.ai)",bin:{"brains-ops":"./dist/brains-ops.js"},bugs:"https://github.com/rizom-ai/brains/issues",dependencies:{"@libsql/client":"^0.17.4","age-encryption":"^0.3.0",yaml:"^2.9.0"},devDependencies:{"@brains/contracts":"workspace:*","@brains/deploy-support":"workspace:*","@brains/eslint-config":"workspace:*","@brains/job-queue":"workspace:*","@brains/profile":"workspace:*","@brains/site-composition":"workspace:*","@brains/test-utils":"workspace:*","@brains/typescript-config":"workspace:*","@brains/utils":"workspace:*","@types/bun":"^1.4.0",typescript:"^7.0.2"},engines:{bun:">=1.3.3"},exports:{".":{types:"./dist/index.d.ts",import:"./dist/index.js"},"./deploy":{types:"./dist/deploy.d.ts",import:"./dist/deploy.js",bun:"./dist/deploy.js"}},files:["dist","templates"],homepage:"https://github.com/rizom-ai/brains/tree/main/packages/brains-ops#readme",main:"./dist/index.js",publishConfig:{access:"public"},repository:{type:"git",url:"https://github.com/rizom-ai/brains.git",directory:"packages/brains-ops"},scripts:{build:"bun scripts/build.ts",lint:"eslint . --max-warnings 0","lint:fix":"eslint . --max-warnings 0 --fix",prepublishOnly:"bun scripts/build.ts",test:"bun test --timeout 20000","test:smoke":"bun run build && RUN_SMOKE_TESTS=1 bun test --timeout 60000",typecheck:"tsc --noEmit"},type:"module",types:"./dist/index.d.ts"};kv();bi();import{writeFile as zY}from"fs/promises";import{join as rj}from"path";import{createSign as fW,generateKeyPairSync as pW}from"crypto";import{mkdir as mW,writeFile as eD}from"fs/promises";import{join as tD}from"path";async function xV(e){let t=await e.text();if(!t.trim())return;try{return JSON.parse(t)}catch{return t}}async function Wa(e,t,r){let o=await xV(e),n=t.safeParse(o);if(!e.ok||!n.success){let i=r.formatError??_V;throw Error(`${r.label}${i(e,o)}`)}return n.data}function _V(e,t){let r=t===void 0?"":`: ${typeof t==="string"?t:JSON.stringify(t)}`;return` (${e.status} ${e.statusText}${r})`}pe();var hW="2.5.4.3",gW="1.2.840.113549.1.1.11",oD="https://api.cloudflare.com/client/v4",yW="origin-rsa",bW=5475,iD=15000;function sD(e){return{Authorization:`Bearer ${e}`,"Content-Type":"application/json"}}var rD=l.looseObject({message:l.string().optional()}),SW=l.looseObject({errors:l.array(rD).optional(),messages:l.array(rD).optional()}),vW=l.looseObject({certificate:l.string().min(1),expires_on:l.string().optional()}),wW=l.looseObject({success:l.literal(!0),result:vW}),xW=l.looseObject({success:l.literal(!0)});function _W(){let{privateKey:e,publicKey:t}=pW("rsa",{modulusLength:2048,privateKeyEncoding:{type:"pkcs8",format:"pem"},publicKeyEncoding:{type:"spki",format:"der"}});return{privateKeyPem:e,publicKeyDer:Buffer.from(t)}}function EW(e,t){let r=bd(OW(bd(nD(hW),TW(e)))),o=bd(AW(0),r,Buffer.from(t.publicKeyDer),CW(0,Buffer.alloc(0))),n=fW("sha256").update(o).sign(t.privateKeyPem),i=bd(o,bd(nD(gW),$W()),RW(n));return{csrPem:IW("CERTIFICATE REQUEST",i),certificationRequestInfoDer:o,signature:n}}async function kW(e,t,r,o){let n=await e(`${oD}/certificates`,{method:"POST",headers:sD(t),body:JSON.stringify({hostnames:[o,`*.${o}`],requested_validity:bW,request_type:yW,csr:r}),signal:AbortSignal.timeout(iD)}),i=await Wa(n,wW,{label:"Cloudflare Origin CA request failed",formatError:cD}),a={certificatePem:`${i.result.certificate.trim()}
 `};if(i.result.expires_on)a.expiresOn=i.result.expires_on;return a}async function aD(e,t,r){let o=await e(`${oD}/zones/${r}/settings/ssl`,{method:"PATCH",headers:sD(t),body:JSON.stringify({value:"strict"}),signal:AbortSignal.timeout(iD)});await Wa(o,xW,{label:"Cloudflare zone SSL update failed",formatError:cD})}function IW(e,t){let o=t.toString("base64").match(/.{1,64}/g)??[];return[`-----BEGIN ${e}-----`,...o,`-----END ${e}-----`,""].join(`
 `)}function AW(e){if(e!==0)throw Error("Only zero-valued INTEGER encoding is currently supported");return Buffer.from([2,1,0])}function nD(e){let t=e.split(".").map((s)=>Number(s));if(t.length<2||t.some((s)=>Number.isNaN(s)))throw Error(`Invalid OID: ${e}`);let r=t[0],o=t[1];if(r===void 0||o===void 0)throw Error(`Invalid OID: ${e}`);let i=[r*40+o];for(let s of t.slice(2)){let a=zW(s);i.push(...a)}return Ac(6,Buffer.from(i))}function TW(e){return Ac(12,Buffer.from(e,"utf8"))}function RW(e){return Ac(3,Buffer.concat([Buffer.from([0]),e]))}function $W(){return Buffer.from([5,0])}function bd(...e){return Ac(48,Buffer.concat(e))}function OW(...e){return Ac(49,Buffer.concat(e))}function CW(e,t){return Ac(160+e,t)}function Ac(e,t){return Buffer.concat([Buffer.from([e]),PW(t.length),t])}function PW(e){if(e<128)return Buffer.from([e]);let t=[],r=e;while(r>0)t.unshift(r&255),r>>=8;return Buffer.from([128|t.length,...t])}function zW(e){if(!Number.isInteger(e)||e<0)throw Error(`Invalid OID component: ${e}`);if(e===0)return[0];let t=[],r=e;while(r>0)t.unshift(r&127),r>>=7;for(let o=0;o<t.length-1;o+=1)t[o]=(t[o]??0)|128;return t}function cD(e,t){let r=NW(t),o=r.length>0?`: ${r.join("; ")}`:"";return` (${e.status} ${e.statusText}${o})`}function NW(e){let t=SW.safeParse(e);if(!t.success)return[];return[...t.data.errors??[],...t.data.messages??[]].map((r)=>r.message).filter((r)=>typeof r==="string"&&r.length>0)}async function lD(e,t,r){let o=_W(),{csrPem:n}=EW(r,o),i=await kW(e,t,n,r);return{certificatePem:i.certificatePem,privateKeyPem:o.privateKeyPem,...i.expiresOn!==void 0&&{expiresOn:i.expiresOn}}}async function uD(e,t){let r=tD(e,"origin.pem"),o=tD(e,"origin.key");return await mW(e,{recursive:!0}),await Promise.all([eD(r,t.certificatePem,"utf-8"),eD(o,t.privateKeyPem,{encoding:"utf-8",mode:384})]),{certificatePath:r,privateKeyPath:o}}hn();Ru();Un();async function oj(e,t={}){try{return await NY(e,t),{success:!0}}catch(r){return{success:!1,message:Ve(r,"Certificate bootstrap failed")}}}async function NY(e,t={}){let r=await wt(e),o=LY(r,t.handle),n=o.domain,i=t.env??process.env,s=Dr(e),a=t.cfApiToken??jt("CF_API_TOKEN",i,s),c=t.cfZoneId??o.cloudflareZoneId??jt("CF_ZONE_ID",i,s);if(!a)throw Error("Missing CF_API_TOKEN");if(!c)throw Error("Missing CF_ZONE_ID");let u=t.fetchImpl??fetch,d=t.logger??console.log,f=await lD(u,a,n),m=rj(e,".brains-ops","certs",o.id),{certificatePath:h,privateKeyPath:b}=await uD(m,f),y=rj(m,"secrets.yaml");await zY(y,DY(f.certificatePem,f.privateKeyPem),"utf-8"),await aD(u,a,c);let S=Ha(t.pushTo);if(S)await gi([["CERTIFICATE_PEM",f.certificatePem],["PRIVATE_KEY_PEM",f.privateKeyPem]],{logger:d,runCommand:t.runCommand??tr});if(d(`Issued ${o.id} Origin CA cert for ${n} and *.${n}`),d(`Wrote ${h}`),d(`Wrote ${b}`),d(`Wrote ${y}`),f.expiresOn)d(`Expires on ${f.expiresOn}`);if(d("Cloudflare zone SSL mode set to Full (strict)"),S)d(`Pushed CERTIFICATE_PEM and PRIVATE_KEY_PEM to ${S}`);return{domain:n,certificatePath:h,privateKeyPath:b,certificatePem:f.certificatePem,secretsSnippetPath:y}}function DY(e,t){return[`certificatePem: ${nj(e)}`,`privateKeyPem: ${nj(t)}`,""].join(`
 `)}function nj(e){return`"${e.replace(/"/g,"\\\"").replace(/\n/g,"\\n")}"`}function LY(e,t){if(!t)return{id:"shared",domain:BY(e.pilot.domainSuffix)};let r=e.users.find((o)=>o.handle===t);if(!r)throw Error(`Unknown user handle: ${t}`);return{id:t,domain:r.domain,...r.cloudflareZoneId?{cloudflareZoneId:r.cloudflareZoneId}:{}}}function BY(e){let t=e.trim().replace(/^\./,"").replace(/\.$/,"");if(!t||t.includes("*"))throw Error(`Invalid pilot domainSuffix: ${e}`);return t}import{access as sj,chmod as zI,mkdir as rg,readFile as cj,writeFile as aj}from"fs/promises";import{dirname as qY,join as Dc}from"path";import{fileURLToPath as FY}from"url";bi();Ad();var KY=["pilot.yaml","package.json",".env.schema",".gitignore","cohorts/cohort-1.yaml","users/alice.yaml",".github/actions/varlock-env/action.yml",".github/workflows/build.yml",".github/workflows/deploy.yml",".github/workflows/directory-sync-stress.yml",".github/workflows/health-watchdog-smoke.yml",".github/workflows/offboard.yml",".github/workflows/reconcile.yml",".github/workflows/upgrade.yml","deploy/Dockerfile","deploy/kamal/deploy.yml","deploy/scripts/helpers.ts","deploy/scripts/create-predeploy-backup.ts","deploy/scripts/install-health-watchdog.ts","deploy/scripts/provision-server.ts","deploy/scripts/pull-local-models.ts","deploy/scripts/update-dns.ts","deploy/scripts/write-ssh-key.ts","deploy/scripts/decrypt-user-secrets.ts","deploy/scripts/validate-secrets.ts","deploy/scripts/write-kamal-secrets.ts","deploy/scripts/resolve-user-config.ts","deploy/scripts/resolve-missing-images.ts","deploy/scripts/verify-runtime-image.ts","deploy/scripts/resolve-deploy-handles.ts","deploy/scripts/sync-content-repo.ts",".kamal/hooks/pre-deploy","docs/onboarding-checklist.md","docs/canonical-crossover-record.md","docs/operator-playbook.md","docs/user-onboarding.md","README.md"],NI=new Set([".kamal/hooks/pre-deploy"]),JY=new Set(["cohorts/cohort-1.yaml","users/alice.yaml","docs/canonical-crossover-record.md"]),HY=FY(new URL("../templates/rover-pilot/",import.meta.url));function Io(e){return(t)=>t.includes(e)}function VY(e){return MP.find((t)=>e===`deploy/scripts/${t}`)}function DI(e){return e.replace(/\n {2}secret:\n(?: {4}- .*\n)+\nvolumes:\n/,`

package/dist/index.js

@@ -747,7 +747,7 @@ printf 'REMOTE_ARTIFACT_DIR=%s\\n' "$remote_dir"
 `),i}async function M8(e,t){let r=await ut(e),o=r.users.find((n)=>n.handle===t);if(!o)throw Error(`Unknown pilot user: ${t}`);return{pilot:r.pilot,user:o}}async function q8(e){let t=await Ghe(io(Qhe(),"brains-ops-watchdog-smoke-")),r=io(t,"id_ed25519"),o=io(t,"known_hosts");try{let n=encodeURIComponent(`brain=${e.target.pilot.contentRepoPrefix}${e.target.user.handle}`),i=await e.fetchImpl(`https://api.hetzner.cloud/v1/servers?label_selector=${n}`,{headers:{Authorization:`Bearer ${e.environment.HCLOUD_TOKEN}`}});if(!i.ok)throw Error(`Hetzner server lookup failed with ${i.status}`);let s=Yhe.parse(await i.json());if(s.servers.length!==1)throw Error(`Expected one smoke server, found ${s.servers.length}`);let a=s.servers[0];if(a?.status!=="running")throw Error("Smoke server is not running");await Ul(r,tge(e.environment.KAMAL_SSH_PRIVATE_KEY),{mode:384}),await Whe(r,384);let c=await e.commandRunner("ssh-keyscan",["-T","10","-t","ed25519",a.public_net.ipv4.ip]);if(c.exitCode!==0||!c.stdout.trim())throw Error("Unable to resolve watchdog smoke SSH host key");return await Ul(o,c.stdout,{mode:384}),{temporaryRoot:t,sshKeyPath:r,knownHostsPath:o,serverIp:a.public_net.ipv4.ip,commandRunner:e.commandRunner}}catch(n){throw await cO(t,{recursive:!0,force:!0}),n}}async function aO(e,t,r){return e.commandRunner("ssh",[...F8(e),`root@${e.serverIp}`,"bash","-s","--",t,r],{stdin:lO()})}async function Xhe(e,t,r){return e.commandRunner("scp",[...F8(e),"-r",`root@${e.serverIp}:${t}/.`,r])}function F8(e){return["-i",e.sshKeyPath,"-o","BatchMode=yes","-o","IdentitiesOnly=yes","-o","ConnectTimeout=10","-o","StrictHostKeyChecking=yes","-o",`UserKnownHostsFile=${e.knownHostsPath}`]}async function ege(e){try{return await Vhe(e),!0}catch{return!1}}async function Nb(e,t,r){await Promise.all([Ul(io(e,`${t}.stdout.log`),r.stdout),Ul(io(e,`${t}.stderr.log`),r.stderr)])}function tge(e){return`${e.replace(/\r\n/g,`
 `).replace(/\\n/g,`
 `).trimEnd()}
-`}var j8,Yhe;var Lb=v(async()=>{fe();N8();Hr();rf();await z8();j8=l.object({HCLOUD_TOKEN:l.string().min(1),KAMAL_SSH_PRIVATE_KEY:l.string().min(1)}),Yhe=l.object({servers:l.array(l.object({status:l.string(),public_net:l.object({ipv4:l.object({ip:l.string().min(1)})})}))})});import{access as x2,chmod as VE,mkdir as ah,readFile as E2,writeFile as _2}from"fs/promises";import{dirname as zW,join as dc}from"path";import{fileURLToPath as NW}from"url";var cf={name:"@rizom/ops",version:"0.2.0-alpha.707",description:"Operator CLI for managing private brain fleet registry repos",keywords:["brains","ops","cli","deploy","fleet","operator"],license:"AGPL-3.0-only",author:"Yeehaa <yeehaa@rizom.ai> (https://rizom.ai)",bin:{"brains-ops":"./dist/brains-ops.js"},bugs:"https://github.com/rizom-ai/brains/issues",dependencies:{"@libsql/client":"^0.17.4","age-encryption":"^0.3.0",yaml:"^2.9.0"},devDependencies:{"@brains/contracts":"workspace:*","@brains/deploy-support":"workspace:*","@brains/eslint-config":"workspace:*","@brains/job-queue":"workspace:*","@brains/profile":"workspace:*","@brains/site-composition":"workspace:*","@brains/test-utils":"workspace:*","@brains/typescript-config":"workspace:*","@brains/utils":"workspace:*","@types/bun":"^1.4.0",typescript:"^7.0.2"},engines:{bun:">=1.3.3"},exports:{".":{types:"./dist/index.d.ts",import:"./dist/index.js"},"./deploy":{types:"./dist/deploy.d.ts",import:"./dist/deploy.js",bun:"./dist/deploy.js"}},files:["dist","templates"],homepage:"https://github.com/rizom-ai/brains/tree/main/packages/brains-ops#readme",main:"./dist/index.js",publishConfig:{access:"public"},repository:{type:"git",url:"https://github.com/rizom-ai/brains.git",directory:"packages/brains-ops"},scripts:{build:"bun scripts/build.ts",lint:"eslint . --max-warnings 0","lint:fix":"eslint . --max-warnings 0 --fix",prepublishOnly:"bun scripts/build.ts",test:"bun test --timeout 20000","test:smoke":"bun run build && RUN_SMOKE_TESTS=1 bun test --timeout 60000",typecheck:"tsc --noEmit"},type:"module",types:"./dist/index.d.ts"};Qo();uc();var DW=["pilot.yaml","package.json",".env.schema",".gitignore","cohorts/cohort-1.yaml","users/alice.yaml",".github/actions/varlock-env/action.yml",".github/workflows/build.yml",".github/workflows/deploy.yml",".github/workflows/directory-sync-stress.yml",".github/workflows/health-watchdog-smoke.yml",".github/workflows/offboard.yml",".github/workflows/reconcile.yml",".github/workflows/upgrade.yml","deploy/Dockerfile","deploy/kamal/deploy.yml","deploy/scripts/helpers.ts","deploy/scripts/create-predeploy-backup.ts","deploy/scripts/install-health-watchdog.ts","deploy/scripts/provision-server.ts","deploy/scripts/pull-local-models.ts","deploy/scripts/update-dns.ts","deploy/scripts/write-ssh-key.ts","deploy/scripts/decrypt-user-secrets.ts","deploy/scripts/validate-secrets.ts","deploy/scripts/write-kamal-secrets.ts","deploy/scripts/resolve-user-config.ts","deploy/scripts/resolve-missing-images.ts","deploy/scripts/verify-runtime-image.ts","deploy/scripts/resolve-deploy-handles.ts","deploy/scripts/sync-content-repo.ts",".kamal/hooks/pre-deploy","docs/onboarding-checklist.md","docs/canonical-crossover-record.md","docs/operator-playbook.md","docs/user-onboarding.md","README.md"],WE=new Set([".kamal/hooks/pre-deploy"]),LW=new Set(["cohorts/cohort-1.yaml","users/alice.yaml","docs/canonical-crossover-record.md"]),BW=NW(new URL("../templates/rover-pilot/",import.meta.url));function fo(e){return(t)=>t.includes(e)}function jW(e){return bO.find((t)=>e===`deploy/scripts/${t}`)}function GE(e){return e.replace(/\n {2}secret:\n(?: {4}- .*\n)+\nvolumes:\n/,`
+`}var j8,Yhe;var Lb=v(async()=>{fe();N8();Hr();rf();await z8();j8=l.object({HCLOUD_TOKEN:l.string().min(1),KAMAL_SSH_PRIVATE_KEY:l.string().min(1)}),Yhe=l.object({servers:l.array(l.object({status:l.string(),public_net:l.object({ipv4:l.object({ip:l.string().min(1)})})}))})});import{access as x2,chmod as VE,mkdir as ah,readFile as E2,writeFile as _2}from"fs/promises";import{dirname as zW,join as dc}from"path";import{fileURLToPath as NW}from"url";var cf={name:"@rizom/ops",version:"0.2.0-alpha.709",description:"Operator CLI for managing private brain fleet registry repos",keywords:["brains","ops","cli","deploy","fleet","operator"],license:"AGPL-3.0-only",author:"Yeehaa <yeehaa@rizom.ai> (https://rizom.ai)",bin:{"brains-ops":"./dist/brains-ops.js"},bugs:"https://github.com/rizom-ai/brains/issues",dependencies:{"@libsql/client":"^0.17.4","age-encryption":"^0.3.0",yaml:"^2.9.0"},devDependencies:{"@brains/contracts":"workspace:*","@brains/deploy-support":"workspace:*","@brains/eslint-config":"workspace:*","@brains/job-queue":"workspace:*","@brains/profile":"workspace:*","@brains/site-composition":"workspace:*","@brains/test-utils":"workspace:*","@brains/typescript-config":"workspace:*","@brains/utils":"workspace:*","@types/bun":"^1.4.0",typescript:"^7.0.2"},engines:{bun:">=1.3.3"},exports:{".":{types:"./dist/index.d.ts",import:"./dist/index.js"},"./deploy":{types:"./dist/deploy.d.ts",import:"./dist/deploy.js",bun:"./dist/deploy.js"}},files:["dist","templates"],homepage:"https://github.com/rizom-ai/brains/tree/main/packages/brains-ops#readme",main:"./dist/index.js",publishConfig:{access:"public"},repository:{type:"git",url:"https://github.com/rizom-ai/brains.git",directory:"packages/brains-ops"},scripts:{build:"bun scripts/build.ts",lint:"eslint . --max-warnings 0","lint:fix":"eslint . --max-warnings 0 --fix",prepublishOnly:"bun scripts/build.ts",test:"bun test --timeout 20000","test:smoke":"bun run build && RUN_SMOKE_TESTS=1 bun test --timeout 60000",typecheck:"tsc --noEmit"},type:"module",types:"./dist/index.d.ts"};Qo();uc();var DW=["pilot.yaml","package.json",".env.schema",".gitignore","cohorts/cohort-1.yaml","users/alice.yaml",".github/actions/varlock-env/action.yml",".github/workflows/build.yml",".github/workflows/deploy.yml",".github/workflows/directory-sync-stress.yml",".github/workflows/health-watchdog-smoke.yml",".github/workflows/offboard.yml",".github/workflows/reconcile.yml",".github/workflows/upgrade.yml","deploy/Dockerfile","deploy/kamal/deploy.yml","deploy/scripts/helpers.ts","deploy/scripts/create-predeploy-backup.ts","deploy/scripts/install-health-watchdog.ts","deploy/scripts/provision-server.ts","deploy/scripts/pull-local-models.ts","deploy/scripts/update-dns.ts","deploy/scripts/write-ssh-key.ts","deploy/scripts/decrypt-user-secrets.ts","deploy/scripts/validate-secrets.ts","deploy/scripts/write-kamal-secrets.ts","deploy/scripts/resolve-user-config.ts","deploy/scripts/resolve-missing-images.ts","deploy/scripts/verify-runtime-image.ts","deploy/scripts/resolve-deploy-handles.ts","deploy/scripts/sync-content-repo.ts",".kamal/hooks/pre-deploy","docs/onboarding-checklist.md","docs/canonical-crossover-record.md","docs/operator-playbook.md","docs/user-onboarding.md","README.md"],WE=new Set([".kamal/hooks/pre-deploy"]),LW=new Set(["cohorts/cohort-1.yaml","users/alice.yaml","docs/canonical-crossover-record.md"]),BW=NW(new URL("../templates/rover-pilot/",import.meta.url));function fo(e){return(t)=>t.includes(e)}function jW(e){return bO.find((t)=>e===`deploy/scripts/${t}`)}function GE(e){return e.replace(/\n {2}secret:\n(?: {4}- .*\n)+\nvolumes:\n/,`
   secret:
     - __DYNAMIC_SECRETS__
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rizom/ops",
-  "version": "0.2.0-alpha.707",
+  "version": "0.2.0-alpha.709",
   "description": "Operator CLI for managing private brain fleet registry repos",
   "keywords": [
     "brains",