@rulebricks/cli 2.1.6 → 2.3.1

package/dist/lib/dns.d.ts

@@ -20,7 +20,7 @@ export declare function getLoadBalancerAddress(namespace?: string): Promise<{
 /**
  * Gets all required DNS records for a deployment
  */
-export declare function getRequiredDNSRecords(domain: string, loadBalancerAddress: string, loadBalancerType: "ip" | "hostname", selfHostedSupabase: boolean): DNSRecord[];
+export declare function getRequiredDNSRecords(domain: string, loadBalancerAddress: string, loadBalancerType: "ip" | "hostname", selfHostedSupabase: boolean, builtInObservability?: boolean, observabilityHostname?: string, valkeyAdminIngress?: boolean, valkeyAdminHostname?: string): DNSRecord[];
 /**
  * Polls DNS records until they resolve or timeout
  */

package/dist/lib/dns.js

@@ -239,7 +239,7 @@ export async function getLoadBalancerAddress(namespace = DEFAULT_NAMESPACE) {
 /**
  * Gets all required DNS records for a deployment
  */
-export function getRequiredDNSRecords(domain, loadBalancerAddress, loadBalancerType, selfHostedSupabase) {
+export function getRequiredDNSRecords(domain, loadBalancerAddress, loadBalancerType, selfHostedSupabase, builtInObservability = false, observabilityHostname, valkeyAdminIngress = false, valkeyAdminHostname) {
     const records = [
         {
             hostname: domain,
@@ -259,6 +259,24 @@ export function getRequiredDNSRecords(domain, loadBalancerAddress, loadBalancerT
             required: true,
         });
     }
+    if (builtInObservability) {
+        records.push({
+            hostname: observabilityHostname || `observability.${domain}`,
+            type: loadBalancerType === "ip" ? "A" : "CNAME",
+            target: loadBalancerAddress,
+            verified: false,
+            required: true,
+        });
+    }
+    if (valkeyAdminIngress) {
+        records.push({
+            hostname: valkeyAdminHostname || `valkey.${domain}`,
+            type: loadBalancerType === "ip" ? "A" : "CNAME",
+            target: loadBalancerAddress,
+            verified: false,
+            required: true,
+        });
+    }
     return records;
 }
 /**

package/dist/lib/dns.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/lib/dns.test.js

@@ -0,0 +1,27 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { getRequiredDNSRecords } from "./dns.js";
+test("manual DNS records include app, Supabase, and built-in observability", () => {
+    const records = getRequiredDNSRecords("az-p055.rulebricks.com", "4.236.203.25", "ip", true, true);
+    assert.deepEqual(records.map((record) => record.hostname), [
+        "az-p055.rulebricks.com",
+        "supabase.az-p055.rulebricks.com",
+        "observability.az-p055.rulebricks.com",
+    ]);
+    assert.ok(records.every((record) => record.type === "A"));
+    assert.ok(records.every((record) => record.target === "4.236.203.25"));
+});
+test("manual DNS records omit observability when built-in observability is disabled", () => {
+    const records = getRequiredDNSRecords("az-p055.rulebricks.com", "example-lb.example.net", "hostname", true, false);
+    assert.deepEqual(records.map((record) => record.hostname), ["az-p055.rulebricks.com", "supabase.az-p055.rulebricks.com"]);
+    assert.ok(records.every((record) => record.type === "CNAME"));
+});
+test("manual DNS records include Valkey Admin ingress when enabled", () => {
+    const records = getRequiredDNSRecords("az-p055.rulebricks.com", "4.236.203.25", "ip", false, false, undefined, true);
+    assert.deepEqual(records.map((record) => record.hostname), ["az-p055.rulebricks.com", "valkey.az-p055.rulebricks.com"]);
+});
+test("manual DNS records use custom Valkey Admin hostname", () => {
+    const records = getRequiredDNSRecords("az-p055.rulebricks.com", "example-lb.example.net", "hostname", false, false, undefined, true, "redis-tools.example.com");
+    assert.deepEqual(records.map((record) => record.hostname), ["az-p055.rulebricks.com", "redis-tools.example.com"]);
+    assert.ok(records.every((record) => record.type === "CNAME"));
+});

package/dist/lib/dockerHub.d.ts

@@ -14,8 +14,12 @@ export interface ImageTag {
     lastUpdated: Date;
     /** Image digest */
     digest: string;
+    /** Manifest/image digests reported for this tag */
+    imageDigests: string[];
     /** Full image size in bytes */
     fullSize: number;
+    /** Architectures available in the tag's manifest list */
+    architectures: string[];
 }
 /**
  * Formats the license key as a Docker PAT
@@ -36,7 +40,13 @@ export declare function authenticateDockerHub(licenseKey: string): Promise<strin
  * @param pageSize - Number of tags to fetch per page (max 100)
  * @returns Array of image tags sorted by last updated (newest first)
  */
-export declare function fetchImageTags(repo: string, token: string, pageSize?: number): Promise<ImageTag[]>;
+export declare function fetchImageTags(repo: string, token: string, pageSize?: number, tagFilter?: (tag: string) => boolean): Promise<ImageTag[]>;
+/**
+ * Checks if a tag looks like a valid semantic version
+ * Excludes "latest" and other non-numeric tags
+ */
+export declare function isValidVersionTag(tag: string): boolean;
+export declare function isValidWorkerVersionTag(tag: string): boolean;
 /**
  * Fetches tags for both app and HPS repositories
  *
@@ -46,6 +56,7 @@ export declare function fetchImageTags(repo: string, token: string, pageSize?: n
 export declare function fetchAllImageTags(licenseKey: string): Promise<{
     appTags: ImageTag[];
     hpsTags: ImageTag[];
+    hpsWorkerTags: ImageTag[];
 }>;
 /**
  * Normalizes a version string by removing leading 'v'

package/dist/lib/dockerHub.js

@@ -51,7 +51,7 @@ export async function authenticateDockerHub(licenseKey) {
  * @param pageSize - Number of tags to fetch per page (max 100)
  * @returns Array of image tags sorted by last updated (newest first)
  */
-export async function fetchImageTags(repo, token, pageSize = 100) {
+export async function fetchImageTags(repo, token, pageSize = 100, tagFilter = isValidVersionTag) {
     const allTags = [];
     let url = `${DOCKER_HUB_API}/repositories/${repo}/tags?page_size=${pageSize}`;
     while (url) {
@@ -68,19 +68,25 @@ export async function fetchImageTags(repo, token, pageSize = 100) {
         }
         const data = await response.json();
         for (const tag of data.results) {
-            // Skip non-semver tags like "latest", "dev", etc.
-            if (!isValidVersionTag(tag.name)) {
+            if (!tagFilter(tag.name)) {
                 continue;
             }
+            const imageDigests = Array.from(new Set([
+                tag.digest,
+                ...(tag.images || []).map((image) => image.digest),
+            ].filter(Boolean)));
             allTags.push({
                 name: tag.name,
                 lastUpdated: new Date(tag.last_updated),
                 digest: tag.digest,
+                imageDigests,
                 fullSize: tag.full_size,
+                architectures: Array.from(new Set((tag.images || [])
+                    .map((image) => image.architecture)
+                    .filter(Boolean))),
             });
         }
-        // Get next page if available (limit to reasonable number of versions)
-        url = data.next && allTags.length < 50 ? data.next : null;
+        url = data.next;
     }
     // Sort by last updated, newest first
     allTags.sort((a, b) => b.lastUpdated.getTime() - a.lastUpdated.getTime());
@@ -90,7 +96,7 @@ export async function fetchImageTags(repo, token, pageSize = 100) {
  * Checks if a tag looks like a valid semantic version
  * Excludes "latest" and other non-numeric tags
  */
-function isValidVersionTag(tag) {
+export function isValidVersionTag(tag) {
     // Exclude "latest" and similar non-versioned tags
     if (tag === 'latest' || tag === 'dev' || tag === 'main' || tag === 'master') {
         return false;
@@ -99,6 +105,9 @@ function isValidVersionTag(tag) {
     const versionPattern = /^v?\d+\.\d+\.\d+(-[\w.]+)?$/;
     return versionPattern.test(tag);
 }
+export function isValidWorkerVersionTag(tag) {
+    return /^worker-\d+\.\d+\.\d+(-[\w.]+)?$/.test(tag);
+}
 /**
  * Fetches tags for both app and HPS repositories
  *
@@ -107,11 +116,12 @@ function isValidVersionTag(tag) {
  */
 export async function fetchAllImageTags(licenseKey) {
     const token = await authenticateDockerHub(licenseKey);
-    const [appTags, hpsTags] = await Promise.all([
+    const [appTags, hpsTags, hpsWorkerTags] = await Promise.all([
         fetchImageTags('rulebricks/app', token),
         fetchImageTags('rulebricks/hps', token),
+        fetchImageTags('rulebricks/hps', token, 100, isValidWorkerVersionTag),
     ]);
-    return { appTags, hpsTags };
+    return { appTags, hpsTags, hpsWorkerTags };
 }
 /**
  * Normalizes a version string by removing leading 'v'

package/dist/lib/helm.d.ts

@@ -15,6 +15,10 @@ export declare function fetchChartVersions(): Promise<ChartVersion[]>;
  * Gets the currently installed chart version for a deployment
  */
 export declare function getInstalledVersion(releaseName: string, namespace: string): Promise<string | null>;
+/**
+ * Gets the installed Helm chart version for a deployment.
+ */
+export declare function getInstalledChartVersion(releaseName: string, namespace: string): Promise<string | null>;
 /**
  * Installs the Rulebricks Helm chart (use installOrUpgradeChart for idempotent operations)
  */

package/dist/lib/helm.js

@@ -101,6 +101,22 @@ export async function getInstalledVersion(releaseName, namespace) {
         return null;
     }
 }
+/**
+ * Gets the installed Helm chart version for a deployment.
+ */
+export async function getInstalledChartVersion(releaseName, namespace) {
+    try {
+        const { stdout } = await execa("helm", ["list", "-n", namespace, "-f", `^${releaseName}$`, "-o", "json"], { timeout: 15000 });
+        const releases = JSON.parse(stdout);
+        if (releases.length === 0) {
+            return null;
+        }
+        return releases[0].chart.split("-").pop() || null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Installs the Rulebricks Helm chart (use installOrUpgradeChart for idempotent operations)
  */

package/dist/lib/helmValues.d.ts

@@ -1,7 +1,32 @@
 import { DeploymentConfig } from "../types/index.js";
 interface GenerateOptions {
     tlsEnabled?: boolean;
+    secretMode?: "k8s" | "inline";
 }
+export declare function deploymentSecretNames(config: DeploymentConfig): {
+    app: string;
+    db: string;
+    dbBootstrap: string;
+    jwt: string;
+    dashboard: string;
+    realtime: string;
+    smtp: string;
+};
+export declare function signSupabaseJwt(role: "anon" | "service_role", secret: string): string;
+export declare function deriveRealtimeSecrets(jwtSecret: string): {
+    secretKeyBase: string;
+    dbEncKey: string;
+};
+/**
+ * Builds Helm values from the deployment configuration.
+ */
+export declare function buildHelmValues(config: DeploymentConfig, options?: GenerateOptions): Record<string, unknown>;
+/**
+ * Rewrites generated values for k8s secret mode: sets the chart's *.secretRef
+ * seams to the CLI-created Secret names and removes inline plaintext secrets so
+ * none are persisted to values.yaml or the Helm release.
+ */
+export declare function redactSecretsToRefs(values: Record<string, unknown>, config: DeploymentConfig): Record<string, unknown>;
 /**
  * Generates Helm values from the deployment configuration
  */