@rulebricks/cli 2.1.7 → 2.3.1

package/dist/lib/htpasswd.d.ts

@@ -0,0 +1 @@
+export declare function generateHtpasswdLine(username: string, password: string): string;

package/dist/lib/htpasswd.js

@@ -0,0 +1,15 @@
+import bcrypt from "bcryptjs";
+const BCRYPT_COST = 10;
+export function generateHtpasswdLine(username, password) {
+    const normalizedUsername = username.trim();
+    if (!normalizedUsername) {
+        throw new Error("Username is required");
+    }
+    if (normalizedUsername.includes(":")) {
+        throw new Error("Username cannot contain ':'");
+    }
+    if (!password) {
+        throw new Error("Password is required");
+    }
+    return `${normalizedUsername}:${bcrypt.hashSync(password, BCRYPT_COST)}`;
+}

package/dist/lib/kubernetes.d.ts

@@ -1,4 +1,4 @@
-import { CloudProvider, PerformanceTier } from "../types/index.js";
+import { NodeArchitecture } from "../types/index.js";
 /**
  * Checks if kubectl is installed
  */
@@ -21,11 +21,36 @@ export declare function checkClusterAccessible(): Promise<string | null>;
  */
 export declare function getCurrentContext(): Promise<string | null>;
 /**
- * Infers the closest internal Rulebricks sizing tier from the current cluster.
- * This is used only for existing clusters, where the CLI is not responsible for
- * provisioning node pools but still needs app/Kafka/worker Helm sizing values.
+ * Inferred resource and scheduling capabilities for the current cluster.
  */
-export declare function inferClusterTier(): Promise<PerformanceTier | null>;
+export interface ClusterStorageClass {
+    name: string;
+    provisioner: string;
+    isDefault: boolean;
+    volumeBindingMode?: string;
+    allowVolumeExpansion?: boolean;
+}
+export interface ClusterCapabilities {
+    nodeArchitecture: NodeArchitecture;
+    arm64TolerationRequired: boolean;
+    schedulableNodeCount: number;
+    totalCpuCores: number;
+    totalMemoryGi: number;
+    eligibleCpuCores: number;
+    eligibleMemoryGi: number;
+    totalPersistentStorageGi?: number;
+    storageClasses: ClusterStorageClass[];
+    defaultStorageClass?: ClusterStorageClass;
+    storageClass?: string;
+    storageProvisioner?: string;
+}
+/**
+ * Inspects the current cluster's node architecture, schedulable capacity, and
+ * storage classes. The CLI uses this to keep Helm values compatible with the
+ * Kubernetes resources the user has already made available (storage class, ARM
+ * tolerations, etc.); workload sizing itself follows the chart defaults.
+ */
+export declare function inferClusterCapabilities(): Promise<ClusterCapabilities | null>;
 /**
  * Gets pod status for the Rulebricks namespace
  */
@@ -97,6 +122,32 @@ export declare function streamLogs(podName: string, namespace?: string, options?
     tail?: number;
     container?: string;
 }): Promise<void>;
+export declare function execInPod(namespace: string, podName: string, container: string | undefined, args: string[]): Promise<string>;
+export interface EphemeralJobOptions {
+    name: string;
+    namespace: string;
+    serviceAccountName: string;
+    image: string;
+    command: string[];
+    env?: Array<Record<string, unknown>>;
+    volumeMounts?: Array<Record<string, unknown>>;
+    volumes?: Array<Record<string, unknown>>;
+    initContainers?: Array<Record<string, unknown>>;
+    labels?: Record<string, string>;
+    backoffLimit?: number;
+    timeoutSeconds?: number;
+}
+export interface EphemeralJobResult {
+    jobName: string;
+    logs: string;
+}
+export declare function runEphemeralJob(options: EphemeralJobOptions): Promise<EphemeralJobResult>;
+export declare function createJobFromCronJob(namespace: string, cronJobName: string, jobName: string): Promise<void>;
+export declare function waitForJobComplete(namespace: string, jobName: string, timeoutSeconds?: number): Promise<string>;
+export declare function getJobLogs(jobName: string, namespace: string): Promise<string>;
+export declare function scaleDeployment(namespace: string, name: string, replicas: number): Promise<void>;
+export declare function waitForDeploymentReady(namespace: string, name: string, timeoutSeconds?: number): Promise<void>;
+export declare function getDeploymentReplicas(namespace: string, name: string): Promise<number | null>;
 /**
  * Callback type for receiving log lines from multiple pods
  */
@@ -140,35 +191,91 @@ export declare function deletePVCs(namespace: string, options?: {
     wait?: boolean;
 }): Promise<void>;
 /**
- * Removes finalizers from KEDA ScaledObjects to prevent namespace deletion from hanging.
- * KEDA finalizers wait for the KEDA controller to clean up, but if KEDA is being deleted
- * with the namespace, this causes a deadlock.
+ * Strips finalizers from the custom resources whose controllers are torn down
+ * with the release, so the namespace can finalize instead of hanging in
+ * Terminating (NamespaceFinalizersRemaining). Best-effort per type — a missing
+ * CRD (feature disabled) or already-gone object is fine.
  */
-export declare function removeKedaFinalizers(namespace: string): Promise<void>;
+export declare function removeBlockingFinalizers(namespace: string): Promise<void>;
+/**
+ * Deletes aggregated APIServices (apiregistration.k8s.io) whose backing service
+ * lives in the given namespace.
+ *
+ * Why this matters for teardown: an aggregated API (e.g. KEDA's
+ * v1beta1.external.metrics.k8s.io, prometheus-adapter's custom.metrics.k8s.io,
+ * etc.) is served by an in-namespace Service. When the namespace is torn down
+ * that Service disappears and the (cluster-scoped) APIService goes Unavailable
+ * with ServiceNotFound. The namespace controller must enumerate every API group
+ * to delete a namespace's contents, so a single broken APIService makes its
+ * discovery step fail and wedges the namespace in Terminating forever
+ * (NamespaceDeletionDiscoveryFailure) - which then rejects any reinstall into
+ * that namespace ("being terminated").
+ *
+ * Deleting these APIServices up front (they are going away with the namespace
+ * anyway) keeps discovery healthy so the namespace can finalize. This is
+ * generalized to ALL APIServices backed by the target namespace, not just KEDA,
+ * and is safe: cluster APIs backed by other namespaces (e.g. metrics-server in
+ * kube-system) are never matched. Listing APIService objects is served directly
+ * by kube-apiserver, so this also works to rescue an already-stuck namespace.
+ *
+ * Returns the names of the APIServices that were deleted.
+ */
+export declare function cleanupNamespaceAPIServices(namespace: string): Promise<string[]>;
 /**
  * Checks if a namespace exists
  */
 export declare function namespaceExists(namespace: string): Promise<boolean>;
 /**
- * Waits for cluster to be accessible with retries.
- * EKS IAM authentication can take time to propagate after cluster creation.
+ * Removes this release's leftovers in the kube-system namespace. The
+ * kube-prometheus-stack prometheus-operator creates a "<release>-...-kubelet"
+ * Service there at runtime (via its --kubelet-service flag); it lives OUTSIDE the
+ * release namespace and is operator-created (not chart-templated), so
+ * `helm uninstall` never deletes it and one accumulates per deployment. Also
+ * sweeps any helm-labeled kube-system objects (exporter Services/Endpoints) a
+ * partial uninstall may have stranded. Scoped strictly to this release; matched
+ * by the release-name prefix so a coexisting deployment's kubelet Service is
+ * never touched. Best-effort — never blocks teardown.
  */
-export declare function waitForClusterAccess(maxRetries?: number, delayMs?: number): Promise<void>;
+export declare function cleanupKubeSystemLeftovers(releaseName: string): Promise<void>;
 /**
- * Creates default StorageClass for the cloud provider.
- * Should be called after kubeconfig is configured and cluster is accessible.
+ * True only when no OTHER Rulebricks deployment remains on the cluster (besides
+ * `releaseName`). Gates deletion of cluster-SHARED resources (CRDs) so tearing
+ * down one deployment never cascade-deletes another deployment's custom
+ * resources. Deployments are named `rulebricks-<name>` for both the namespace and
+ * the helm release (see getNamespace/getReleaseName), so the "rulebricks-" prefix
+ * is a sound cluster-side signal. Fails CLOSED (returns false) if the cluster
+ * can't be enumerated — we never purge shared resources on uncertainty.
  */
-export declare function createDefaultStorageClass(provider: CloudProvider): Promise<void>;
+export declare function isLastRulebricksDeployment(releaseName: string): Promise<boolean>;
+/**
+ * Deletes the cluster-scoped CRDs the chart installs from crds/ dirs (cert-
+ * manager, keda, strimzi, kube-prometheus-stack). CLUSTER-SHARED: deleting a CRD
+ * cascade-deletes every custom resource of that kind across ALL namespaces, so
+ * callers MUST gate this on isLastRulebricksDeployment() (or an explicit
+ * operator --purge) — never call it while another Rulebricks deployment exists.
+ * Best-effort, non-blocking; returns the CRD names removed.
+ */
+export declare function deleteRulebricksCRDs(): Promise<string[]>;
 /**
  * Deployed image versions from Kubernetes
  */
 export interface DeployedVersions {
     appVersion: string | null;
     hpsVersion: string | null;
+    hpsWorkerVersion: string | null;
+    appDigest: string | null;
+    hpsDigests: string[];
+    hpsWorkerDigests: string[];
 }
 /**
- * Gets the actual deployed image versions from Kubernetes deployments.
- * Queries the app and HPS deployments to get their current image tags.
+ * Extracts the version tag from a Docker image string.
+ * E.g., "rulebricks/rulebricks:v1.5.8" -> "v1.5.8"
+ */
+export declare function extractImageTag(image: string): string | null;
+export declare function extractImageDigest(imageId: string): string | null;
+/**
+ * Gets actual deployed image tags and running image digests from Kubernetes.
+ * HPS runs as StatefulSets, so digest checks inspect the pods behind those sets.
  *
  * @param releaseName - The Helm release name (e.g., "rulebricks")
  * @param namespace - The Kubernetes namespace