@rizom/ops 0.2.0-alpha.71 → 0.2.0-alpha.710

package/dist/ssh-key-bootstrap.d.ts

@@ -1,26 +1 @@
-import { type FetchLike } from "@brains/deploy-support/origin-ca";
-import { type RunCommand } from "./run-subprocess";
-export interface SshKeyBootstrapOptions {
-    env?: NodeJS.ProcessEnv | undefined;
-    fetchImpl?: FetchLike | undefined;
-    logger?: (message: string) => void;
-    pushTo?: string | undefined;
-    runCommand?: RunCommand | undefined;
-    sshKeygen?: SshKeygen | undefined;
-}
-export interface SshKeyBootstrapResult {
-    createdHetznerKey: boolean;
-    createdLocalKey: boolean;
-    privateKeyPath: string;
-    publicKeyPath: string;
-    sshKeyName: string;
-}
-export interface SshKeygen {
-    createEd25519KeyPair: (privateKeyPath: string, comment: string) => void;
-    derivePublicKey: (privateKeyPath: string) => string;
-}
-export declare function runPilotSshKeyBootstrap(rootDir: string, options?: SshKeyBootstrapOptions): Promise<{
-    success: boolean;
-    message?: string;
-}>;
-export declare function bootstrapPilotSshKey(rootDir: string, options?: SshKeyBootstrapOptions): Promise<SshKeyBootstrapResult>;
+export { bootstrapSshKey as bootstrapPilotSshKey, runSshKeyBootstrap as runPilotSshKeyBootstrap, type SshKeyBootstrapOptions, type SshKeyBootstrapResult, type SshKeygen, } from "@brains/deploy-support/ssh-key-bootstrap";

package/dist/stage-legacy-crossover.d.ts

@@ -0,0 +1,25 @@
+import { z } from "@brains/utils/zod";
+import { type CapabilityBundleReview } from "./capability-bundle-migration";
+import { siteOverrideSchema } from "./schema";
+export interface StagedCrossover {
+    outputDir: string;
+    changedFiles: string[];
+}
+declare const reviewedSitePinsSchema: z.ZodObject<{
+    sites: z.ZodRecord<z.ZodString, typeof siteOverrideSchema>;
+}, z.core.$strict>;
+type ReviewedSitePinManifest = z.output<typeof reviewedSitePinsSchema>;
+export type ReviewedSitePins = ReviewedSitePinManifest["sites"];
+export interface StageLegacyCrossoverOptions {
+    sitePins?: ReviewedSitePins | undefined;
+    bundleReview?: CapabilityBundleReview | undefined;
+}
+export declare function parseReviewedSitePins(input: string): ReviewedSitePins;
+export declare function loadReviewedSitePins(filePath: string): Promise<ReviewedSitePins>;
+export declare function loadCapabilityBundleReview(filePath: string): Promise<CapabilityBundleReview>;
+/**
+ * Build a complete review copy without mutating the source repository.
+ * This is offline migration tooling; active desired-state loading is canonical-only.
+ */
+export declare function stageLegacyCrossover(sourceDir: string, outputDir: string, options?: StageLegacyCrossoverOptions): Promise<StagedCrossover>;
+export {};

package/dist/stress-command.d.ts

@@ -0,0 +1,14 @@
+export interface StressCommandOptions {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    stdin?: string;
+}
+export interface StressCommandResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}
+export type StressCommandRunner = (command: string, args: readonly string[], options?: StressCommandOptions) => Promise<StressCommandResult>;
+export declare const runStressCommand: StressCommandRunner;
+export declare function requireCommand(runner: StressCommandRunner, command: string, args: readonly string[], options?: StressCommandOptions): Promise<StressCommandResult>;
+export declare function commandError(command: string, args: readonly string[], result: StressCommandResult): Error;

package/dist/stress-git-checkout.d.ts

@@ -0,0 +1,21 @@
+import { type StressCommandResult, type StressCommandRunner } from "./stress-command";
+/**
+ * Git operations against one content-repo checkout, executed through a
+ * stress command runner with token-bearing credentials.
+ */
+export declare class GitCheckout {
+    #private;
+    readonly dir: string;
+    constructor(runner: StressCommandRunner, dir: string, token: string);
+    /** Clone `repository`'s main branch into `dir` and pin it to origin/main. */
+    static clone(runner: StressCommandRunner, repository: string, dir: string, token: string): Promise<GitCheckout>;
+    run(args: readonly string[], required?: boolean): Promise<StressCommandResult>;
+    output(args: readonly string[]): Promise<string>;
+    sync(hardReset?: boolean): Promise<void>;
+    /** Stage everything and commit as the ops identity. */
+    commitAll(message: string): Promise<void>;
+    pushMainWithRebase(): Promise<void>;
+    /** Delete every remote stress backup branch; returns the deleted names. */
+    pruneStressBackupBranches(): Promise<string[]>;
+    private environment;
+}

package/dist/stress-health-monitor.d.ts

@@ -0,0 +1,56 @@
+import type { FetchLike } from "@brains/utils/fetch-like";
+import { z } from "@brains/utils/zod";
+import { type StressHealthSample, type StressRuntimeSample } from "./directory-sync-stress";
+/** Entity counts by type, as the runtime's database reports them. */
+export declare const stressEntityCountsSchema: z.ZodArray<z.ZodObject<{
+    entityType: z.ZodString;
+    count: z.ZodNumber;
+}>>;
+export type StressEntityCounts = z.output<typeof stressEntityCountsSchema>;
+export interface HealthPayload {
+    version: string;
+    entities: number;
+    entityCounts: StressEntityCounts;
+}
+export declare function noteCount(payload: HealthPayload): number;
+export interface StressHealthMonitorOptions {
+    domain: string;
+    fetchImpl: FetchLike;
+    now: () => Date;
+    sleep: (milliseconds: number) => Promise<void>;
+    /** Take one runtime sample (e.g. docker stats over SSH), if available. */
+    sampleRuntime: () => Promise<StressRuntimeSample | undefined>;
+    /**
+     * Entity counts by type from an authenticated source (the runtime's
+     * database over SSH), or undefined when this poll has no reading.
+     */
+    readEntityCounts: () => Promise<StressEntityCounts | undefined>;
+}
+/**
+ * Samples deployment health and runtime resource usage during a stress run,
+ * and answers entity-baseline waits from the operational health endpoint and
+ * the runtime's own entity counts.
+ */
+export declare class StressHealthMonitor {
+    #private;
+    constructor(options: StressHealthMonitorOptions);
+    /** ISO timestamp of the most recent start() call. */
+    get startedAt(): string;
+    /** The first sampling failure since start(), if any. */
+    get error(): unknown;
+    get healthSamples(): readonly StressHealthSample[];
+    get runtimeSamples(): readonly StressRuntimeSample[];
+    /** Health samples between start() and markGateEnd() (or now). */
+    gateHealthSamples(): StressHealthSample[];
+    /** Exclude samples taken after this point from the gate window. */
+    markGateEnd(): void;
+    /** Probe optional health endpoints and add responsive ones to the loop. */
+    discoverEndpoints(): Promise<void>;
+    start(): void;
+    /** Stop sampling and wait for the loops; a loop error stays on `error`. */
+    stop(): Promise<void>;
+    waitForHealthSnapshot(timeoutMs: number): Promise<HealthPayload | undefined>;
+    waitForEntityBaseline(expectedNotes: number | undefined, expectedEntities: number | undefined, timeoutMs: number): Promise<HealthPayload | undefined>;
+    waitForStableEntityBaseline(expectedNotes: number | undefined, expectedEntities: number | undefined, timeoutMs: number): Promise<HealthPayload | undefined>;
+    fetchHealthPayload(): Promise<HealthPayload | undefined>;
+}

package/dist/upgrade.d.ts

@@ -0,0 +1,10 @@
+export type UpgradeExec = (command: string[], cwd: string) => Promise<void>;
+export interface UpgradeOptions {
+    exec?: UpgradeExec | undefined;
+    version?: string | undefined;
+}
+export interface UpgradeResult {
+    from: string;
+    to: string;
+}
+export declare function upgradePilotRepo(rootDir: string, options?: UpgradeOptions): Promise<UpgradeResult>;

package/dist/user-add.d.ts

@@ -1,5 +1,6 @@
 export interface AddPilotUserOptions {
     cohort: string;
+    discord?: boolean | undefined;
     anchorId?: string | undefined;
 }
 export interface AddPilotUserResult {

package/dist/user-offboard.d.ts

@@ -0,0 +1,61 @@
+import type { FetchLike } from "@brains/utils/fetch-like";
+export interface OffboardPilotUsersOptions {
+    handles: string[];
+    confirmation?: string | undefined;
+    dryRun?: boolean | undefined;
+    env?: NodeJS.ProcessEnv | undefined;
+    fetchImpl?: FetchLike | undefined;
+    logger?: ((message: string) => void) | undefined;
+    sleep?: ((delayMs: number) => Promise<void>) | undefined;
+    driver?: PilotOffboardDriver | undefined;
+}
+export interface PilotOffboardTarget {
+    handle: string;
+    instanceName: string;
+    domain: string;
+    previewDomain: string;
+    wwwDomain?: string | undefined;
+    contentRepo: string;
+    cloudflareZoneId: string;
+}
+export interface PilotOffboardServer {
+    id: number;
+    name: string;
+    ip?: string | undefined;
+}
+export interface PilotOffboardDnsRecord {
+    id: string;
+    name: string;
+    type: "A" | "CNAME";
+    content: string;
+}
+export interface PilotOffboardInspection {
+    server?: PilotOffboardServer | undefined;
+    dnsRecords: PilotOffboardDnsRecord[];
+    contentRepoArchived: boolean;
+}
+export interface PilotOffboardDriver {
+    inspect(target: PilotOffboardTarget): Promise<PilotOffboardInspection>;
+    archiveContentRepo(target: PilotOffboardTarget): Promise<void>;
+    deleteDnsRecord(target: PilotOffboardTarget, record: PilotOffboardDnsRecord): Promise<void>;
+    deleteServer(target: PilotOffboardTarget, server: PilotOffboardServer): Promise<void>;
+}
+export interface OffboardPilotUserPlan {
+    target: PilotOffboardTarget;
+    inspection: PilotOffboardInspection;
+}
+export interface OffboardPilotUsersResult {
+    dryRun: boolean;
+    handles: string[];
+    confirmation: string;
+    plans: OffboardPilotUserPlan[];
+}
+export declare function offboardPilotUsers(rootDir: string, options: OffboardPilotUsersOptions): Promise<OffboardPilotUsersResult>;
+interface DefaultDriverOptions {
+    env: NodeJS.ProcessEnv;
+    fetchImpl?: FetchLike | undefined;
+    contentRepoTokenName: string;
+}
+export declare function createPilotOffboardDriver(options: DefaultDriverOptions): PilotOffboardDriver;
+export declare function assertPilotUsersRemoved(rootDir: string, handles: string[]): Promise<void>;
+export {};

package/dist/verify-user.d.ts

@@ -0,0 +1,22 @@
+import type { FetchLike } from "@brains/utils/fetch-like";
+import { type ResolvedUser } from "./load-registry";
+export interface VerifyPilotUserOptions {
+    fetchImpl?: FetchLike;
+    logger?: (message: string) => void;
+    operationalRetryAttempts?: number;
+    operationalRetryDelayMs?: number;
+    sleep?: (delayMs: number) => Promise<void>;
+}
+export interface FailedCheck {
+    name: string;
+    message: string;
+}
+export interface VerifyPilotUserResult {
+    handle: string;
+    bundles: ResolvedUser["bundles"];
+    domain: string;
+    contentRepo: string;
+    checks: string[];
+    failedChecks: FailedCheck[];
+}
+export declare function verifyPilotUser(rootDir: string, handle: string, options?: VerifyPilotUserOptions): Promise<VerifyPilotUserResult>;

package/package.json

@@ -1,69 +1,76 @@
 {
   "name": "@rizom/ops",
+  "version": "0.2.0-alpha.710",
   "description": "Operator CLI for managing private brain fleet registry repos",
-  "publishConfig": {
-    "access": "public"
+  "keywords": [
+    "brains",
+    "ops",
+    "cli",
+    "deploy",
+    "fleet",
+    "operator"
+  ],
+  "license": "AGPL-3.0-only",
+  "author": "Yeehaa <yeehaa@rizom.ai> (https://rizom.ai)",
+  "bin": {
+    "brains-ops": "./dist/brains-ops.js"
+  },
+  "bugs": "https://github.com/rizom-ai/brains/issues",
+  "dependencies": {
+    "@libsql/client": "^0.17.4",
+    "age-encryption": "^0.3.0",
+    "yaml": "^2.9.0"
+  },
+  "devDependencies": {
+    "@brains/contracts": "workspace:*",
+    "@brains/deploy-support": "workspace:*",
+    "@brains/eslint-config": "workspace:*",
+    "@brains/job-queue": "workspace:*",
+    "@brains/profile": "workspace:*",
+    "@brains/site-composition": "workspace:*",
+    "@brains/test-utils": "workspace:*",
+    "@brains/typescript-config": "workspace:*",
+    "@brains/utils": "workspace:*",
+    "@types/bun": "^1.4.0",
+    "typescript": "^7.0.2"
+  },
+  "engines": {
+    "bun": ">=1.3.3"
   },
-  "version": "0.2.0-alpha.71",
-  "type": "module",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
     },
     "./deploy": {
-      "bun": "./dist/deploy.js",
       "types": "./dist/deploy.d.ts",
-      "import": "./dist/deploy.js"
+      "import": "./dist/deploy.js",
+      "bun": "./dist/deploy.js"
     }
   },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "bin": {
-    "brains-ops": "./dist/brains-ops.js"
-  },
   "files": [
     "dist",
     "templates"
   ],
-  "scripts": {
-    "build": "bun scripts/build.ts",
-    "prepublishOnly": "bun scripts/build.ts",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint . --ext .ts",
-    "lint:fix": "eslint . --ext .ts --fix",
-    "test": "bun run build && bun test --timeout 20000",
-    "test:smoke": "bun run build && RUN_SMOKE_TESTS=1 bun test --timeout 60000"
-  },
-  "dependencies": {
-    "age-encryption": "^0.3.0"
-  },
-  "devDependencies": {
-    "@brains/deploy-support": "workspace:*",
-    "@brains/eslint-config": "workspace:*",
-    "@brains/typescript-config": "workspace:*",
-    "@brains/utils": "workspace:*",
-    "@types/bun": "latest",
-    "typescript": "^5.3.3"
+  "homepage": "https://github.com/rizom-ai/brains/tree/main/packages/brains-ops#readme",
+  "main": "./dist/index.js",
+  "publishConfig": {
+    "access": "public"
   },
   "repository": {
     "type": "git",
     "url": "https://github.com/rizom-ai/brains.git",
     "directory": "packages/brains-ops"
   },
-  "license": "Apache-2.0",
-  "author": "Yeehaa <yeehaa@rizom.ai> (https://rizom.ai)",
-  "homepage": "https://github.com/rizom-ai/brains/tree/main/packages/brains-ops#readme",
-  "bugs": "https://github.com/rizom-ai/brains/issues",
-  "engines": {
-    "bun": ">=1.3.3"
+  "scripts": {
+    "build": "bun scripts/build.ts",
+    "lint": "eslint . --max-warnings 0",
+    "lint:fix": "eslint . --max-warnings 0 --fix",
+    "prepublishOnly": "bun scripts/build.ts",
+    "test": "bun test --timeout 20000",
+    "test:smoke": "bun run build && RUN_SMOKE_TESTS=1 bun test --timeout 60000",
+    "typecheck": "tsc --noEmit"
   },
-  "keywords": [
-    "brains",
-    "ops",
-    "cli",
-    "deploy",
-    "fleet",
-    "operator"
-  ]
+  "type": "module",
+  "types": "./dist/index.d.ts"
 }

package/templates/rover-pilot/.env.schema

@@ -3,11 +3,19 @@
 # @defaultRequired=false @defaultSensitive=false
 # ----------
 
-# AI provider
-# Shared GitHub secret by default; a per-user override may come from the decrypted
+# OpenAI, the provider of the canonical chat and embedding models
+# Shared secret by default; a per-user override may come from the decrypted
 # users/<handle>.secrets.yaml.age file at deploy time.
 # @required @sensitive
-AI_API_KEY=
+OPENAI_API_KEY=
+
+# Anthropic and Google: unused by the canonical models; the shared deploy
+# config passes every provider's key to the brain.
+# @sensitive
+ANTHROPIC_API_KEY=
+
+# @sensitive
+GOOGLE_GENERATIVE_AI_API_KEY=
 
 # Git sync
 # Comes from the decrypted users/<handle>.secrets.yaml.age file.
@@ -20,16 +28,31 @@ GIT_SYNC_TOKEN=
 # @required @sensitive
 CONTENT_REPO_ADMIN_TOKEN=
 
-# MCP interface
-# Comes from the decrypted users/<handle>.secrets.yaml.age file.
-# @required @sensitive
-MCP_AUTH_TOKEN=
-
 # Discord (optional, per-user)
 # Comes from the decrypted users/<handle>.secrets.yaml.age file when enabled.
 # @sensitive
 DISCORD_BOT_TOKEN=
 
+# Stored with the per-user Discord credentials and injected at deploy time.
+# @sensitive
+DISCORD_PUBLIC_KEY=
+
+# @sensitive
+DISCORD_APPLICATION_ID=
+
+# AT Protocol publishing/discovery (optional, per-user)
+# Comes from the decrypted users/<handle>.secrets.yaml.age file when configured.
+# @sensitive
+ATPROTO_APP_PASSWORD=
+
+# Setup email delivery (optional, shared)
+# Used when a user file declares setup.delivery: email.
+# @sensitive
+SETUP_EMAIL_API_KEY=
+
+# @sensitive
+SETUP_EMAIL_FROM=
+
 # ---- deploy/provision vars ----
 
 # @required @sensitive

package/templates/rover-pilot/.github/actions/varlock-env/action.yml

@@ -0,0 +1,47 @@
+name: Load Bitwarden environment through Varlock
+description: Load, mask, and export the pilot environment from Varlock
+
+runs:
+  using: composite
+  steps:
+    - name: Load shared environment
+      shell: bash
+      run: |
+        for attempt in 1 2 3; do
+          if bunx varlock@1.1.0 load --path .env.schema --format json --compact > /tmp/varlock-env.json; then
+            break
+          fi
+          if [ "$attempt" = "3" ]; then
+            exit 1
+          fi
+          echo "Varlock load failed (attempt $attempt/3); retrying in 5s..."
+          sleep 5
+        done
+        node <<'NODE'
+        import { appendFileSync, readFileSync, rmSync } from "node:fs";
+        const env = JSON.parse(readFileSync("/tmp/varlock-env.json", "utf8"));
+        const output = process.env.GITHUB_ENV;
+        if (!output) throw new Error("Missing GITHUB_ENV");
+        const newline = "\n";
+        const chunks = [];
+        for (const [key, value] of Object.entries(env)) {
+          if (key === "BWS_ACCESS_TOKEN" || value === null || value === undefined) continue;
+          const text = String(value).replace(/\r\n/g, newline);
+          const escapedMask = text
+            .replace(/%/g, "%25")
+            .replace(/\r/g, "%0D")
+            .replace(/\n/g, "%0A");
+          if (escapedMask.length > 0) {
+            process.stdout.write(`::add-mask::${escapedMask}${newline}`);
+          }
+          if (text.includes(newline)) {
+            let delimiter = `VARLOCK_${key}_EOF`;
+            while (text.includes(delimiter)) delimiter += "_X";
+            chunks.push(`${key}<<${delimiter}${newline}${text}${newline}${delimiter}`);
+          } else {
+            chunks.push(`${key}=${text}`);
+          }
+        }
+        appendFileSync(output, `${chunks.join(newline)}${newline}`);
+        rmSync("/tmp/varlock-env.json", { force: true });
+        NODE

package/templates/rover-pilot/.github/workflows/build.yml

@@ -2,10 +2,29 @@ name: Build
 
 on:
   workflow_dispatch:
+    inputs:
+      brain_version:
+        description: Build one Brain version from its checked-in runtime lock
+        required: false
+        type: string
+      site_packages:
+        description: "Exact site/theme pins for an explicit build; a matching checked-in runtime lock is required."
+        required: false
+        type: string
+      overwrite:
+        description: Rebuild an existing tag in place. Published tags are immutable; confirm only when replacing a tag whose containers were never deployed.
+        required: false
+        type: boolean
+        default: false
   push:
     branches: ["main"]
     paths:
+      # The image set is a pure function of the declared fleet state: a push
+      # that changes it builds exactly what it declares, so the deploy (fired
+      # off the same push via Reconcile) finds its tag ready.
       - pilot.yaml
+      - cohorts/**
+      - users/*.yaml
       - deploy/**
       - .github/workflows/build.yml
 
@@ -14,22 +33,57 @@ permissions:
   packages: write
 
 jobs:
-  build:
+  resolve:
     runs-on: ubuntu-latest
+    outputs:
+      images_json: ${{ steps.resolve.outputs.images_json }}
     steps:
       - uses: actions/checkout@v5
         with:
           ref: ${{ github.sha }}
 
-      - name: Extract image metadata inputs
-        run: |
-          BRAIN_VERSION="$(grep '^brainVersion:' pilot.yaml | sed 's/^brainVersion:[[:space:]]*//' | tr -d '"' | tr -d "'")"
-          if [ -z "$BRAIN_VERSION" ]; then
-            echo "Missing brainVersion in pilot.yaml" >&2
-            exit 1
-          fi
-          echo "BRAIN_VERSION=$BRAIN_VERSION" >> "$GITHUB_ENV"
-          echo "IMAGE_REPOSITORY=ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}" >> "$GITHUB_ENV"
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.4.0
+
+      - name: Install operator tooling
+        run: bun install --frozen-lockfile --ignore-scripts
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Resolve images to build
+        id: resolve
+        env:
+          BRAIN_VERSION_INPUT: ${{ inputs.brain_version || '' }}
+          SITE_PACKAGES_INPUT: ${{ inputs.site_packages || '' }}
+          ALLOW_TAG_OVERWRITE: ${{ inputs.overwrite && 'true' || 'false' }}
+        run: bun deploy/scripts/resolve-missing-images.ts
+
+  no_builds:
+    needs: resolve
+    if: needs.resolve.outputs.images_json == '[]'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Skip when every declared image exists
+        run: echo "All declared images already exist; nothing to build."
+
+  build:
+    needs: resolve
+    if: needs.resolve.outputs.images_json != '[]'
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        image: ${{ fromJson(needs.resolve.outputs.images_json) }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
@@ -38,9 +92,9 @@ jobs:
         id: meta
         uses: docker/metadata-action@v6
         with:
-          images: ${{ env.IMAGE_REPOSITORY }}
+          images: ghcr.io/${{ github.repository }}
           tags: |
-            type=raw,value=brain-${{ env.BRAIN_VERSION }}
+            type=raw,value=${{ matrix.image.tag }}
 
       - name: Log in to GHCR
         uses: docker/login-action@v4
@@ -57,7 +111,7 @@ jobs:
           target: fleet
           push: true
           build-args: |
-            BRAIN_VERSION=${{ env.BRAIN_VERSION }}
+            RUNTIME_IMAGE_TAG=${{ matrix.image.tag }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: |
             ${{ steps.meta.outputs.labels }}