@rulebricks/cli 2.1.6 → 2.3.1

package/dist/lib/versions.js

@@ -1,6 +1,96 @@
 import { CHANGELOG_URL, getNamespace, getReleaseName, } from "../types/index.js";
 import { fetchChartVersions, getInstalledVersion } from "./helm.js";
 import { fetchAllImageTags, normalizeVersion, } from "./dockerHub.js";
+// ============================================================================
+// Image registry & repositories
+// ============================================================================
+// Every image the chart pulls now lives under docker.io/rulebricks/* (mirrored
+// or built by the helm repo's images/manifest.yaml pipeline). The CLI sets the
+// rulebricks/* defaults; when config.imageRegistry is set, the registry HOST is
+// rewritten per chart while the rulebricks/<name> path is kept. Names + tags
+// here mirror images/manifest.yaml in the helm repo.
+export const DEFAULT_IMAGE_REGISTRY = "docker.io";
+// Self-hosted Supabase Postgres image (mirrored to rulebricks/*). The backup
+// path uses pg_dump/rclone (no barman), so there is no custom fork.
+export const SUPABASE_POSTGRES_IMAGE_REPOSITORY = "rulebricks/supabase-postgres";
+export const SUPABASE_POSTGRES_IMAGE_TAG = "17.6.1.141";
+// Cross-cloud uploader used by the backup CronJob and `rulebricks restore`.
+export const RCLONE_IMAGE = "docker.io/rulebricks/rclone:1.71.1";
+// kafka-proxy sidecar fronting MSK IAM brokers for Vector (mirrored to rulebricks/*).
+export const KAFKA_PROXY_IMAGE = "docker.io/rulebricks/kafka-proxy:0.4.3";
+/**
+ * Repository defaults (registry + repository + tag) for the rulebricks/* images
+ * the CLI sets directly: the app stack, clickstack, the kafka-proxy bridge, and
+ * the six Tier-2 upstream charts. The registry HOST is overridable via
+ * config.imageRegistry; the repository path (rulebricks/<name>) is never changed.
+ * Tags mirror images/manifest.yaml in the helm repo.
+ */
+export const IMAGE_REPOSITORIES = {
+    // App stack (pinned by global.version, not by a fixed tag here)
+    app: "rulebricks/app",
+    hps: "rulebricks/hps",
+    // ClickStack
+    hyperdx: { repository: "rulebricks/hyperdx", tag: "2.19.0" },
+    clickstackOtelCollector: {
+        repository: "rulebricks/clickstack-otel-collector",
+        tag: "2.19.0",
+    },
+    ferretdb: { repository: "rulebricks/ferretdb", tag: "2.7.0" },
+    postgresDocumentdb: {
+        repository: "rulebricks/postgres-documentdb",
+        tag: "17-0.107.0-ferretdb-2.7.0",
+    },
+    // Parent-chart OpenTelemetry collector (BYO tracing, ClickStack disabled)
+    opentelemetryCollector: {
+        repository: "rulebricks/opentelemetry-collector",
+        tag: "0.155.0-debian13-contrib",
+    },
+    // Bridge sidecar
+    kafkaProxy: { repository: "rulebricks/kafka-proxy", tag: "v0.4.3" },
+    // Self-hosted Supabase Postgres
+    supabasePostgres: {
+        repository: "rulebricks/supabase-postgres",
+        tag: "17.6.1.141",
+    },
+    // --- Tier-2: kube-prometheus-stack sub-images ---
+    prometheus: "rulebricks/prometheus",
+    alertmanager: "rulebricks/alertmanager",
+    prometheusOperator: "rulebricks/prometheus-operator",
+    prometheusConfigReloader: "rulebricks/prometheus-config-reloader",
+    kubeWebhookCertgen: "rulebricks/kube-webhook-certgen",
+    grafana: "rulebricks/grafana",
+    k8sSidecar: "rulebricks/k8s-sidecar",
+    kubeStateMetrics: "rulebricks/kube-state-metrics",
+    nodeExporter: "rulebricks/node-exporter",
+    // --- Tier-2: cert-manager ---
+    certManagerController: "rulebricks/cert-manager-controller",
+    certManagerWebhook: "rulebricks/cert-manager-webhook",
+    certManagerCainjector: "rulebricks/cert-manager-cainjector",
+    certManagerStartupapicheck: "rulebricks/cert-manager-startupapicheck",
+    certManagerAcmesolver: "rulebricks/cert-manager-acmesolver",
+    // --- Tier-2: traefik / keda / vector / external-dns ---
+    traefik: "rulebricks/traefik",
+    keda: "rulebricks/keda",
+    kedaMetricsApiServer: "rulebricks/keda-metrics-apiserver",
+    kedaAdmissionWebhooks: "rulebricks/keda-admission-webhooks",
+    vector: "rulebricks/vector",
+    externalDns: "rulebricks/external-dns",
+};
+/**
+ * Generated name -> sha256 digest map. Populated by the helm repo's
+ * scripts/images/render-digests.sh (from images/digests.json); this const is
+ * regenerated by that script. Empty until the mirror pipeline runs. When a name
+ * is present, the chart image helper pins @sha256 instead of :tag, and the CLI
+ * threads this through global.imageDigests so the Tier-2 charts pin too.
+ */
+export const IMAGE_DIGESTS = {};
+export function hasRegistryDigestMismatch(deployedDigests, registryDigests) {
+    if (deployedDigests.length === 0 || !registryDigests?.length) {
+        return false;
+    }
+    const registryDigestSet = new Set(registryDigests);
+    return deployedDigests.some((digest) => !registryDigestSet.has(digest));
+}
 /**
  * Fetches complete version information (legacy chart-based)
  */
@@ -21,51 +111,61 @@ export async function getVersionInfo(deploymentName, overrideNamespace) {
         changelogUrl: CHANGELOG_URL,
     };
 }
-/**
- * Normalizes a Date to the start of day (midnight UTC).
- * This allows comparing dates without time components.
- */
-function toStartOfDay(date) {
-    const d = new Date(date);
-    d.setUTCHours(0, 0, 0, 0);
-    return d;
+const KNOWN_BAD_PRODUCT_VERSIONS = new Set(["0.0.1"]);
+function isSingleNodeArchitecture(architecture) {
+    return architecture === "amd64" || architecture === "arm64";
+}
+function supportsArchitecture(tag, architecture) {
+    if (!isSingleNodeArchitecture(architecture))
+        return true;
+    return tag.architectures.includes(architecture);
 }
 /**
- * Matches HPS versions to app versions based on release dates.
- * For each app version, finds the latest HPS version released on or before that date.
- * Compares dates only (ignoring time), so an HPS released later in the same day
- * as the app version will still be matched.
+ * Matches app versions to exact HPS server and worker versions.
  *
  * @param appTags - Array of app image tags
  * @param hpsTags - Array of HPS image tags
- * @returns Array of AppVersion with matched HPS versions
+ * @param hpsWorkerTags - Array of HPS worker image tags
+ * @returns Array of product versions with app, HPS, and worker images available
  */
-export function matchHpsVersions(appTags, hpsTags) {
-    // Sort HPS tags by date descending for efficient matching
-    const sortedHpsTags = [...hpsTags].sort((a, b) => b.lastUpdated.getTime() - a.lastUpdated.getTime());
-    return appTags.map((appTag) => {
-        // Normalize app release date to start of day for comparison
-        const appDateStart = toStartOfDay(appTag.lastUpdated);
-        // Find the latest HPS version released on or before the app version's date
-        // Compare by date only (start of day), ignoring time
-        const matchedHps = sortedHpsTags.find((hpsTag) => toStartOfDay(hpsTag.lastUpdated).getTime() <= appDateStart.getTime());
+export function matchExactHpsVersions(appTags, hpsTags, hpsWorkerTags, architecture) {
+    const compatibleAppTags = appTags.filter((tag) => supportsArchitecture(tag, architecture));
+    const hpsByVersion = new Map(hpsTags
+        .filter((tag) => supportsArchitecture(tag, architecture))
+        .map((tag) => [normalizeVersion(tag.name), tag]));
+    const workerByVersion = new Map(hpsWorkerTags
+        .filter((tag) => supportsArchitecture(tag, architecture))
+        .map((tag) => [normalizeVersion(tag.name.replace(/^worker-/, "")), tag]));
+    return compatibleAppTags
+        .flatMap((appTag) => {
+        const version = normalizeVersion(appTag.name);
+        if (KNOWN_BAD_PRODUCT_VERSIONS.has(version)) {
+            return [];
+        }
+        const matchedHps = hpsByVersion.get(version);
+        const matchedWorker = workerByVersion.get(version);
+        if (!matchedHps || !matchedWorker) {
+            return [];
+        }
         return {
-            version: normalizeVersion(appTag.name),
+            version,
             releaseDate: appTag.lastUpdated.toISOString(),
-            hpsVersion: matchedHps ? normalizeVersion(matchedHps.name) : null,
             digest: appTag.digest,
+            hpsDigests: matchedHps.imageDigests,
+            hpsWorkerDigests: matchedWorker.imageDigests,
         };
-    });
+    })
+        .sort((a, b) => compareVersions(b.version, a.version));
 }
 /**
- * Fetches app versions with matched HPS versions from Docker Hub
+ * Fetches product versions with app, HPS, and worker images from Docker Hub
  *
  * @param licenseKey - The Rulebricks license key (Docker PAT)
  * @returns Array of AppVersion objects
  */
-export async function fetchAppVersions(licenseKey) {
-    const { appTags, hpsTags } = await fetchAllImageTags(licenseKey);
-    return matchHpsVersions(appTags, hpsTags);
+export async function fetchAppVersions(licenseKey, architecture) {
+    const { appTags, hpsTags, hpsWorkerTags } = await fetchAllImageTags(licenseKey);
+    return matchExactHpsVersions(appTags, hpsTags, hpsWorkerTags, architecture);
 }
 /**
  * Gets complete app version information for a deployment
@@ -74,8 +174,8 @@ export async function fetchAppVersions(licenseKey) {
  * @param currentAppVersion - Currently installed app version (if known)
  * @returns AppVersionInfo with current, latest, and available versions
  */
-export async function getAppVersionInfo(licenseKey, currentAppVersion) {
-    const available = await fetchAppVersions(licenseKey);
+export async function getAppVersionInfo(licenseKey, currentAppVersion, architecture) {
+    const available = await fetchAppVersions(licenseKey, architecture);
     const latest = available.length > 0 ? available[0] : null;
     // Find current version in available list
     const current = currentAppVersion

package/dist/lib/versions.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/lib/versions.test.js

@@ -0,0 +1,81 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { hasRegistryDigestMismatch, matchExactHpsVersions, } from "./versions.js";
+import { extractImageDigest, extractImageTag } from "./kubernetes.js";
+import { resolveDeploymentConfigVersion } from "./config.js";
+import { classifyDeploymentHealth } from "./deploymentHealth.js";
+function tag(name, digest = `sha256:${name.replace(/[^a-zA-Z0-9]/g, "")}`) {
+    return {
+        name,
+        lastUpdated: new Date(`2026-01-${name === "0.0.1" ? "31" : "01"}T00:00:00Z`),
+        digest,
+        imageDigests: [digest],
+        fullSize: 1,
+        architectures: ["amd64", "arm64"],
+    };
+}
+test("matches only exact app, HPS, and worker versions", () => {
+    const versions = matchExactHpsVersions([tag("1.8.17"), tag("1.8.16")], [tag("1.8.17")], [tag("worker-1.8.17")]);
+    assert.deepEqual(versions.map((version) => version.version), ["1.8.17"]);
+});
+test("sorts product versions by semver instead of Docker Hub update time", () => {
+    const versions = matchExactHpsVersions([tag("0.0.1"), tag("1.8.16"), tag("1.8.17")], [tag("0.0.1"), tag("1.8.16"), tag("1.8.17")], [tag("worker-0.0.1"), tag("worker-1.8.16"), tag("worker-1.8.17")]);
+    assert.deepEqual(versions.map((version) => version.version), ["1.8.17", "1.8.16"]);
+});
+test("detects same-version registry digest mismatches", () => {
+    assert.equal(hasRegistryDigestMismatch(["sha256:old"], ["sha256:new", "sha256:other"]), true);
+    assert.equal(hasRegistryDigestMismatch(["sha256:new"], ["sha256:new", "sha256:other"]), false);
+});
+test("extracts image tags and digests from Kubernetes image fields", () => {
+    assert.equal(extractImageTag("index.docker.io/rulebricks/hps:worker-1.8.17"), "worker-1.8.17");
+    assert.equal(extractImageDigest("docker-pullable://index.docker.io/rulebricks/hps@sha256:abc123"), "sha256:abc123");
+});
+test("resolves missing deployment config version from generated artifacts", () => {
+    assert.equal(resolveDeploymentConfigVersion({ chartVersion: "1.0.0" }, { global: { version: "2.0.0" } }, { application: { version: "1.5.0" } }), "2.0.0");
+    assert.equal(resolveDeploymentConfigVersion({ chartVersion: "1.0.0" }, undefined, { application: { version: "1.5.0" } }), "1.5.0");
+    assert.equal(resolveDeploymentConfigVersion({}), "latest");
+});
+test("classifies installed deployment health with HTTP reachability", () => {
+    const readyPod = {
+        name: "rulebricks-app",
+        status: "Running",
+        ready: true,
+        restarts: 0,
+    };
+    assert.equal(classifyDeploymentHealth({
+        state: null,
+        helmVersion: null,
+        pods: [],
+        httpReachable: false,
+    }), "not-installed");
+    assert.equal(classifyDeploymentHealth({
+        state: {
+            name: "demo",
+            version: "1.0.0",
+            createdAt: "",
+            updatedAt: "",
+            status: "destroyed",
+        },
+        helmVersion: null,
+        pods: [],
+        httpReachable: false,
+    }), "destroyed");
+    assert.equal(classifyDeploymentHealth({
+        state: null,
+        helmVersion: "1.0.0",
+        pods: [readyPod],
+        httpReachable: true,
+    }), "online");
+    assert.equal(classifyDeploymentHealth({
+        state: null,
+        helmVersion: "1.0.0",
+        pods: [readyPod],
+        httpReachable: false,
+    }), "installed-unreachable");
+    assert.equal(classifyDeploymentHealth({
+        state: null,
+        helmVersion: "1.0.0",
+        pods: [],
+        httpReachable: true,
+    }), "installed-degraded");
+});

package/dist/lib/wizardSteps.d.ts

@@ -0,0 +1,14 @@
+export type WizardStepId = "cloud" | "domain" | "smtp" | "database" | "database-creds" | "external-services" | "storage" | "observability" | "features" | "feature-config" | "version" | "review";
+export interface WizardStepState {
+    databaseType: string | null;
+    aiEnabled: boolean;
+    ssoEnabled: boolean;
+    clickStackEnabled: boolean;
+    metricsExportEnabled: boolean;
+    tracingEnabled: boolean;
+    appLogsEnabled: boolean;
+    valkeyAdminEnabled: boolean;
+    loggingSink: string;
+    customEmailsEnabled: boolean;
+}
+export declare function getActiveWizardSteps(state: WizardStepState, mode: "create" | "redeploy"): WizardStepId[];

package/dist/lib/wizardSteps.js

@@ -0,0 +1,23 @@
+export function getActiveWizardSteps(state, mode) {
+    const steps = mode === "redeploy" ? [] : ["cloud"];
+    steps.push("domain", "smtp", "database");
+    if (state.databaseType === "self-hosted") {
+        steps.push("database-creds");
+    }
+    steps.push("external-services");
+    steps.push("storage");
+    steps.push("observability");
+    steps.push("features");
+    if (state.aiEnabled ||
+        state.ssoEnabled ||
+        (!state.clickStackEnabled && state.metricsExportEnabled) ||
+        (!state.clickStackEnabled && state.tracingEnabled) ||
+        (!state.clickStackEnabled && state.appLogsEnabled) ||
+        state.valkeyAdminEnabled ||
+        state.loggingSink !== "console" ||
+        state.customEmailsEnabled) {
+        steps.push("feature-config");
+    }
+    steps.push("version", "review");
+    return steps;
+}

package/dist/lib/workloadIdentity.d.ts

@@ -0,0 +1,26 @@
+import { DeploymentConfig } from "../types/index.js";
+export interface FederationOutcome {
+    created: string[];
+    existing: string[];
+    skipped?: string;
+}
+export declare function isAwsPodIdentityCliUnsupported(stderr: string): boolean;
+export declare function isAwsPodIdentityTrustPolicyInvalid(stderr: string): boolean;
+/** A Kubernetes ServiceAccount that needs cloud access, plus the cloud principal it maps to. */
+interface SubjectBinding {
+    serviceAccount: string;
+    principal: string;
+}
+/**
+ * The SAs that need workload-identity trust, given the deployment config. Vector
+ * and the backup job use the storage identity; Prometheus uses the metrics
+ * identity (the consolidated setup makes these the same principal, but we read
+ * them independently so split setups still work).
+ */
+export declare function plannedBindings(config: DeploymentConfig): SubjectBinding[];
+/**
+ * Ensures the per-namespace workload-identity trust exists for this deployment.
+ * No-op (with a `skipped` reason) for non-cloud providers or secret-based auth.
+ */
+export declare function ensureWorkloadIdentityFederation(config: DeploymentConfig): Promise<FederationOutcome>;
+export {};