@rulebricks/cli 2.1.7 → 2.3.2

package/dist/lib/secrets.d.ts

@@ -0,0 +1,23 @@
+import { DeploymentConfig } from "../types/index.js";
+export interface K8sSecretManifest {
+    name: string;
+    stringData: Record<string, string>;
+}
+/**
+ * Build the Kubernetes Secret manifests for a deployment. Only includes values
+ * that are actually set. Supabase anon/service keys are derived from the JWT
+ * secret (HS256), matching self-hosted Supabase.
+ */
+export declare function buildDeploymentSecrets(config: DeploymentConfig): K8sSecretManifest[];
+/**
+ * Idempotently ensure the namespace exists so Secrets can be applied before Helm
+ * runs (`helm upgrade --install --create-namespace` also creates it, but that
+ * happens after this step).
+ */
+export declare function ensureNamespace(namespace: string): Promise<void>;
+/**
+ * Create/update the deployment's Kubernetes Secrets. `kubectl apply` is an
+ * upsert, so upgrades and redeploys never wipe or churn the Secrets. Returns the
+ * names applied.
+ */
+export declare function applyDeploymentSecrets(config: DeploymentConfig, namespace: string): Promise<string[]>;

package/dist/lib/secrets.js

@@ -0,0 +1,158 @@
+// Kubernetes Secret management for k8s secret mode.
+//
+// In k8s mode the CLI creates the deployment's Secrets directly (idempotent
+// `kubectl apply`) and the generated values.yaml carries only secretRef
+// references — no plaintext secrets on disk or in the Helm release. Secret names
+// come from deploymentSecretNames() so they always match the secretRef seams the
+// value generator writes.
+import { execa } from "execa";
+import { signSupabaseJwt, deriveRealtimeSecrets, deploymentSecretNames, } from "./helmValues.js";
+/**
+ * Build the Kubernetes Secret manifests for a deployment. Only includes values
+ * that are actually set. Supabase anon/service keys are derived from the JWT
+ * secret (HS256), matching self-hosted Supabase.
+ */
+export function buildDeploymentSecrets(config) {
+    const names = deploymentSecretNames(config);
+    const out = [];
+    // Consolidated app secret (global.secrets.secretRef).
+    const app = {};
+    const put = (k, v) => {
+        if (v)
+            app[k] = v;
+    };
+    put("LICENSE_KEY", config.licenseKey);
+    put("EMAIL", config.adminEmail);
+    put("SMTP_USER", config.smtp?.user);
+    put("SMTP_PASS", config.smtp?.pass);
+    if (config.database.type === "supabase-cloud") {
+        put("SUPABASE_ANON_KEY", config.database.supabaseAnonKey);
+        put("SUPABASE_SERVICE_KEY", config.database.supabaseServiceKey);
+        put("SUPABASE_SECRET_KEY", config.database.supabaseServiceKey);
+        put("SUPABASE_ACCESS_TOKEN", config.database.supabaseAccessToken);
+    }
+    else if (config.database.supabaseJwtSecret) {
+        const jwt = config.database.supabaseJwtSecret;
+        put("SUPABASE_ANON_KEY", signSupabaseJwt("anon", jwt));
+        put("SUPABASE_SERVICE_KEY", signSupabaseJwt("service_role", jwt));
+        put("SUPABASE_SECRET_KEY", signSupabaseJwt("service_role", jwt));
+        put("JWT_SECRET", jwt);
+    }
+    if (config.features.ai.enabled) {
+        put("OPENAI_API_KEY", config.features.ai.openaiApiKey);
+    }
+    if (config.features.sso.enabled) {
+        put("SSO_CLIENT_ID", config.features.sso.clientId);
+        put("SSO_CLIENT_SECRET", config.features.sso.clientSecret);
+    }
+    const redis = config.externalServices?.redis?.external;
+    if (redis?.password)
+        put("REDIS_PASSWORD", redis.password);
+    const kafkaSasl = config.externalServices?.kafka?.external?.sasl;
+    if (kafkaSasl?.username)
+        put("KAFKA_SASL_USERNAME", kafkaSasl.username);
+    if (kafkaSasl?.password)
+        put("KAFKA_SASL_PASSWORD", kafkaSasl.password);
+    if (Object.keys(app).length > 0) {
+        out.push({ name: names.app, stringData: app });
+    }
+    // Supabase self-hosted component secrets (each maps to a supabase.secret.*.secretRef).
+    if (config.database.type === "self-hosted") {
+        const pgExt = config.externalServices?.postgres?.mode === "external"
+            ? config.externalServices.postgres.external
+            : undefined;
+        const dbStringData = {
+            username: "postgres",
+            password: config.database.supabaseDbPassword ?? "",
+            database: pgExt?.database ?? "postgres",
+        };
+        if (pgExt) {
+            dbStringData.host = pgExt.host ?? "";
+            dbStringData.port = String(pgExt.port ?? 5432);
+        }
+        out.push({
+            name: names.db,
+            stringData: dbStringData,
+        });
+        if (pgExt) {
+            out.push({
+                name: names.dbBootstrap,
+                stringData: {
+                    "master-username": pgExt.bootstrap?.masterUsername ?? "postgres",
+                    "master-password": pgExt.bootstrap?.masterPassword ?? "",
+                    "service-password": config.database.supabaseDbPassword ?? "",
+                },
+            });
+        }
+        const jwt = config.database.supabaseJwtSecret ?? "";
+        out.push({
+            name: names.jwt,
+            stringData: {
+                secret: jwt,
+                anonKey: jwt ? signSupabaseJwt("anon", jwt) : "",
+                serviceKey: jwt ? signSupabaseJwt("service_role", jwt) : "",
+            },
+        });
+        out.push({
+            name: names.dashboard,
+            stringData: {
+                username: config.database.supabaseDashboardUser || "supabase",
+                password: config.database.supabaseDashboardPass ?? "",
+            },
+        });
+        const rt = deriveRealtimeSecrets(jwt);
+        out.push({
+            name: names.realtime,
+            stringData: { SECRET_KEY_BASE: rt.secretKeyBase, DB_ENC_KEY: rt.dbEncKey },
+        });
+        // Supabase auth (GoTrue) SMTP, when configured.
+        if (config.smtp?.user || config.smtp?.pass) {
+            out.push({
+                name: names.smtp,
+                stringData: {
+                    username: config.smtp.user ?? "",
+                    password: config.smtp.pass ?? "",
+                },
+            });
+        }
+    }
+    return out;
+}
+function secretManifest(name, namespace, stringData) {
+    return {
+        apiVersion: "v1",
+        kind: "Secret",
+        type: "Opaque",
+        metadata: { name, namespace },
+        stringData,
+    };
+}
+/**
+ * Idempotently ensure the namespace exists so Secrets can be applied before Helm
+ * runs (`helm upgrade --install --create-namespace` also creates it, but that
+ * happens after this step).
+ */
+export async function ensureNamespace(namespace) {
+    const manifest = {
+        apiVersion: "v1",
+        kind: "Namespace",
+        metadata: { name: namespace },
+    };
+    await execa("kubectl", ["apply", "-f", "-"], {
+        input: JSON.stringify(manifest),
+    });
+}
+/**
+ * Create/update the deployment's Kubernetes Secrets. `kubectl apply` is an
+ * upsert, so upgrades and redeploys never wipe or churn the Secrets. Returns the
+ * names applied.
+ */
+export async function applyDeploymentSecrets(config, namespace) {
+    const secrets = buildDeploymentSecrets(config);
+    for (const s of secrets) {
+        await execa("kubectl", ["apply", "-f", "-"], {
+            input: JSON.stringify(secretManifest(s.name, namespace, s.stringData)),
+        });
+    }
+    return secrets.map((s) => s.name);
+}

package/dist/lib/validateValues.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Validates generated Helm values against the chart's values.schema.json.
+ *
+ * The schema is bundled with the CLI (schema/values.schema.json) and kept in
+ * sync with the Helm chart via `npm run sync-schema`. This gives us a last-line
+ * guardrail: the CLI refuses to deploy values the chart would reject at install
+ * time, surfacing a readable message instead of a raw Helm/JSON-schema error.
+ */
+export interface ValuesValidationResult {
+    valid: boolean;
+    errors: string[];
+}
+/**
+ * Cross-field invariants the JSON schema cannot express. These encode the
+ * Kafka sizing model: partitions are the worker-fleet concurrency ceiling,
+ * topic names must carry the same prefix HPS/Vector/KEDA use, and worker CPU
+ * requests must not exceed their (one-core) burst limit.
+ */
+export declare function validateValuesInvariants(values: unknown): string[];
+/**
+ * Validates a generated Helm values object against the bundled chart schema
+ * plus cross-field invariants the schema cannot express.
+ * Values are round-tripped through YAML first so we validate exactly what Helm
+ * receives (dropping `undefined`, normalizing numbers, etc.).
+ */
+export declare function validateHelmValues(values: unknown): ValuesValidationResult;
+/**
+ * Throws a readable error if the values are invalid. Used as a pre-deploy
+ * guardrail so we never hand Helm a config the chart would reject.
+ */
+export declare function assertValidHelmValues(values: unknown): void;

package/dist/lib/validateValues.js

@@ -0,0 +1,253 @@
+import fs from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
+import { Ajv } from "ajv";
+import YAML from "yaml";
+let cachedValidator = null;
+function getBundledSchemaPath() {
+    // Compiled location: dist/lib/validateValues.js -> ../../schema/...
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return path.resolve(here, "../../schema/values.schema.json");
+}
+function loadValidator() {
+    if (cachedValidator)
+        return cachedValidator;
+    const schema = JSON.parse(fs.readFileSync(getBundledSchemaPath(), "utf8"));
+    // strict:false tolerates the chart schema's union types and `default`
+    // keywords; allErrors collects every problem so we can report them together.
+    const ajv = new Ajv({ allErrors: true, strict: false });
+    const validate = ajv.compile(schema);
+    cachedValidator = validate;
+    return validate;
+}
+function pointerToPath(instancePath) {
+    if (!instancePath)
+        return "";
+    return instancePath
+        .replace(/^\//, "")
+        .split("/")
+        .map((seg) => seg.replace(/~1/g, "/").replace(/~0/g, "~"))
+        .join(".");
+}
+function describeError(err) {
+    const where = pointerToPath(err.instancePath || "");
+    const prefix = where ? `${where}` : "values";
+    switch (err.keyword) {
+        case "required": {
+            const missing = err.params
+                .missingProperty;
+            return `${where ? `${where}.` : ""}${missing} is required`;
+        }
+        case "minLength": {
+            const limit = err.params.limit;
+            return limit <= 1
+                ? `${prefix} must not be empty`
+                : `${prefix} must be at least ${limit} characters`;
+        }
+        case "enum": {
+            const allowed = err.params.allowedValues;
+            return `${prefix} must be one of: ${allowed
+                .map((v) => JSON.stringify(v))
+                .join(", ")}`;
+        }
+        case "const": {
+            const allowed = err.params.allowedValue;
+            return `${prefix} must be ${JSON.stringify(allowed)}`;
+        }
+        case "pattern":
+            return `${prefix} has an invalid format`;
+        case "type": {
+            const type = err.params.type;
+            return `${prefix} must be of type ${Array.isArray(type) ? type.join(" or ") : type}`;
+        }
+        case "minimum": {
+            const limit = err.params.limit;
+            return `${prefix} must be >= ${limit}`;
+        }
+        case "additionalProperties": {
+            const extra = err.params
+                .additionalProperty;
+            return `${prefix} has an unexpected property '${extra}'`;
+        }
+        default:
+            return null;
+    }
+}
+function formatErrors(errors) {
+    if (!errors || errors.length === 0) {
+        return ["Generated values failed schema validation."];
+    }
+    const messages = new Set();
+    for (const err of errors) {
+        const message = describeError(err);
+        if (message)
+            messages.add(message);
+    }
+    if (messages.size === 0) {
+        // Only structural (if/then/allOf) errors were present; surface a hint.
+        messages.add("Generated values do not satisfy a conditional schema rule (check storage, backup, external services, and monitoring settings).");
+    }
+    return [...messages];
+}
+/* eslint-disable @typescript-eslint/no-explicit-any */
+function get(obj, path) {
+    let cur = obj;
+    for (const key of path) {
+        if (cur === null || cur === undefined || typeof cur !== "object") {
+            return undefined;
+        }
+        cur = cur[key];
+    }
+    return cur;
+}
+/**
+ * Cross-field invariants the JSON schema cannot express. These encode the
+ * Kafka sizing model: partitions are the worker-fleet concurrency ceiling,
+ * topic names must carry the same prefix HPS/Vector/KEDA use, and worker CPU
+ * requests must not exceed their (one-core) burst limit.
+ */
+export function validateValuesInvariants(values) {
+    const errors = [];
+    const workers = get(values, ["rulebricks", "hps", "workers"]);
+    const solutionPartitions = get(workers, ["solutionPartitions"]);
+    const maxReplicaCount = get(workers, ["keda", "maxReplicaCount"]);
+    // 1. Workers beyond the partition count would sit idle.
+    if (typeof solutionPartitions === "number" &&
+        typeof maxReplicaCount === "number" &&
+        maxReplicaCount > solutionPartitions) {
+        errors.push(`rulebricks.hps.workers.keda.maxReplicaCount (${maxReplicaCount}) must be <= solutionPartitions (${solutionPartitions}); partitions are the fleet concurrency ceiling`);
+    }
+    // 2. Single-threaded CPU-bound workers are Burstable: the request may sit
+    //    below the limit (tight bin-packing + a cheap warm pool), but it must
+    //    never exceed the limit. The limit is the per-worker burst ceiling (one
+    //    core); under genuine node contention a Burstable worker can be
+    //    CFS-throttled toward its request.
+    const parseCpuMillicores = (value) => {
+        if (typeof value === "number")
+            return value * 1000;
+        if (typeof value !== "string")
+            return undefined;
+        const millicores = value.endsWith("m")
+            ? Number(value.slice(0, -1))
+            : Number(value) * 1000;
+        return Number.isFinite(millicores) ? millicores : undefined;
+    };
+    const workerCpuRequest = get(workers, ["resources", "requests", "cpu"]);
+    const workerCpuLimit = get(workers, ["resources", "limits", "cpu"]);
+    const workerCpuRequestM = parseCpuMillicores(workerCpuRequest);
+    const workerCpuLimitM = parseCpuMillicores(workerCpuLimit);
+    if (workerCpuRequestM !== undefined &&
+        workerCpuLimitM !== undefined &&
+        workerCpuRequestM > workerCpuLimitM) {
+        errors.push(`rulebricks.hps.workers.resources cpu request (${workerCpuRequest}) must not exceed limit (${workerCpuLimit})`);
+    }
+    // 3. In-cluster provisioning: topic names must carry the SAME prefix the
+    //    application uses, and the solution topic must match solutionPartitions
+    //    (which HPS receives as MAX_WORKERS). Mirrors the chart's render guard.
+    const kafkaEnabled = get(values, ["kafka", "enabled"]);
+    const kafkaTopics = get(values, ["kafka", "topics"]);
+    if (kafkaEnabled && Array.isArray(kafkaTopics) && kafkaTopics.length > 0) {
+        const logging = get(values, ["rulebricks", "app", "logging"]) ?? {};
+        const prefix = Object.prototype.hasOwnProperty.call(logging, "kafkaTopicPrefix")
+            ? String(logging.kafkaTopicPrefix ?? "")
+            : "com.rulebricks.";
+        const topics = kafkaTopics;
+        const names = topics.map((t) => t?.name);
+        for (const base of ["solution", "solution-response", "logs"]) {
+            const expected = `${prefix}${base}`;
+            if (!names.includes(expected)) {
+                errors.push(`kafka.topics must include "${expected}" (kafkaTopicPrefix is "${prefix}"); found: ${names.join(", ") || "none"}`);
+            }
+        }
+        const solutionTopic = topics.find((t) => t?.name === `${prefix}solution`);
+        if (typeof solutionPartitions === "number" &&
+            solutionTopic &&
+            typeof solutionTopic.partitions === "number" &&
+            solutionTopic.partitions !== solutionPartitions) {
+            errors.push(`kafka "${prefix}solution" partitions (${solutionTopic.partitions}) must equal rulebricks.hps.workers.solutionPartitions (${solutionPartitions}); HPS derives MAX_WORKERS from it`);
+        }
+    }
+    // 4. Distributed tracing: when enabled, the collector must have a non-empty
+    //    endpoint for the selected destination (the JSON schema also enforces
+    //    this, but we surface a clearer message), and the active auth mode must
+    //    carry its credential.
+    const tracing = get(values, ["global", "tracing"]);
+    if (tracing && tracing.enabled) {
+        const destination = tracing.destination ?? "elastic";
+        if (destination === "elastic") {
+            const elastic = get(tracing, ["elastic"]) ?? {};
+            if (!elastic.endpoint) {
+                errors.push("global.tracing.elastic.endpoint must be set when tracing destination is 'elastic'");
+            }
+            const authMode = elastic.authMode ?? "secret-token";
+            if (authMode === "secret-token" &&
+                !elastic.secretToken &&
+                !elastic.existingSecret?.name) {
+                errors.push("global.tracing.elastic.secretToken (or existingSecret.name) is required for authMode 'secret-token'");
+            }
+            if (authMode === "api-key" &&
+                !elastic.apiKey &&
+                !elastic.existingSecret?.name) {
+                errors.push("global.tracing.elastic.apiKey (or existingSecret.name) is required for authMode 'api-key'");
+            }
+        }
+        else if (destination === "otlp") {
+            const otlp = get(tracing, ["otlp"]) ?? {};
+            if (!otlp.endpoint) {
+                errors.push("global.tracing.otlp.endpoint must be set when tracing destination is 'otlp'");
+            }
+        }
+        else if (destination === "azure-monitor") {
+            const azure = get(tracing, ["azureMonitor"]) ?? {};
+            if (!azure.connectionString && !azure.existingSecret?.name) {
+                errors.push("global.tracing.azureMonitor.connectionString (or existingSecret.name) is required when tracing destination is 'azure-monitor'");
+            }
+        }
+    }
+    // 5. Application/container log shipping: when the Vector agent is enabled it
+    //    must have exactly one configured external sink.
+    const vectorAgent = get(values, ["vector-agent"]);
+    if (vectorAgent && vectorAgent.enabled) {
+        const sinks = get(vectorAgent, ["customConfig", "sinks"]);
+        const elasticsearchEndpoints = get(sinks, ["elasticsearch", "endpoints"]);
+        const hasElasticsearch = Array.isArray(elasticsearchEndpoints) &&
+            elasticsearchEndpoints.some((e) => typeof e === "string" && e.length > 0);
+        const lokiEndpoint = get(sinks, ["loki", "endpoint"]);
+        const hasLoki = typeof lokiEndpoint === "string" && lokiEndpoint.length > 0;
+        const genericUri = get(sinks, ["generic_http", "uri"]);
+        const hasGeneric = typeof genericUri === "string" && genericUri.length > 0;
+        if (!hasElasticsearch && !hasLoki && !hasGeneric) {
+            errors.push("vector-agent is enabled but no app-log sink endpoint is configured; set features.logging.appLogs for elasticsearch, loki, or generic");
+        }
+    }
+    return errors;
+}
+/**
+ * Validates a generated Helm values object against the bundled chart schema
+ * plus cross-field invariants the schema cannot express.
+ * Values are round-tripped through YAML first so we validate exactly what Helm
+ * receives (dropping `undefined`, normalizing numbers, etc.).
+ */
+export function validateHelmValues(values) {
+    const normalized = YAML.parse(YAML.stringify(values));
+    const validate = loadValidator();
+    const valid = validate(normalized);
+    const errors = valid ? [] : formatErrors(validate.errors);
+    errors.push(...validateValuesInvariants(normalized));
+    if (errors.length === 0)
+        return { valid: true, errors: [] };
+    return { valid: false, errors };
+}
+/**
+ * Throws a readable error if the values are invalid. Used as a pre-deploy
+ * guardrail so we never hand Helm a config the chart would reject.
+ */
+export function assertValidHelmValues(values) {
+    const result = validateHelmValues(values);
+    if (result.valid)
+        return;
+    throw new Error([
+        "Generated Helm values are not valid for the Rulebricks chart:",
+        ...result.errors.map((e) => `  • ${e}`),
+    ].join("\n"));
+}

package/dist/lib/versions.d.ts

@@ -1,5 +1,77 @@
-import { ChartVersion, AppVersion } from "../types/index.js";
+import { ChartVersion, AppVersion, NodeArchitecture } from "../types/index.js";
 import { ImageTag } from "./dockerHub.js";
+export declare const DEFAULT_IMAGE_REGISTRY = "docker.io";
+export declare const SUPABASE_POSTGRES_IMAGE_REPOSITORY = "rulebricks/supabase-postgres";
+export declare const SUPABASE_POSTGRES_IMAGE_TAG = "17.6.1.141";
+export declare const RCLONE_IMAGE = "docker.io/rulebricks/rclone:1.71.1";
+export declare const KAFKA_PROXY_IMAGE = "docker.io/rulebricks/kafka-proxy:0.4.3";
+/**
+ * Repository defaults (registry + repository + tag) for the rulebricks/* images
+ * the CLI sets directly: the app stack, clickstack, the kafka-proxy bridge, and
+ * the six Tier-2 upstream charts. The registry HOST is overridable via
+ * config.imageRegistry; the repository path (rulebricks/<name>) is never changed.
+ * Tags mirror images/manifest.yaml in the helm repo.
+ */
+export declare const IMAGE_REPOSITORIES: {
+    readonly app: "rulebricks/app";
+    readonly hps: "rulebricks/hps";
+    readonly hyperdx: {
+        readonly repository: "rulebricks/hyperdx";
+        readonly tag: "2.19.0";
+    };
+    readonly clickstackOtelCollector: {
+        readonly repository: "rulebricks/clickstack-otel-collector";
+        readonly tag: "2.19.0";
+    };
+    readonly ferretdb: {
+        readonly repository: "rulebricks/ferretdb";
+        readonly tag: "2.7.0";
+    };
+    readonly postgresDocumentdb: {
+        readonly repository: "rulebricks/postgres-documentdb";
+        readonly tag: "17-0.107.0-ferretdb-2.7.0";
+    };
+    readonly opentelemetryCollector: {
+        readonly repository: "rulebricks/opentelemetry-collector";
+        readonly tag: "0.155.0-debian13-contrib";
+    };
+    readonly kafkaProxy: {
+        readonly repository: "rulebricks/kafka-proxy";
+        readonly tag: "v0.4.3";
+    };
+    readonly supabasePostgres: {
+        readonly repository: "rulebricks/supabase-postgres";
+        readonly tag: "17.6.1.141";
+    };
+    readonly prometheus: "rulebricks/prometheus";
+    readonly alertmanager: "rulebricks/alertmanager";
+    readonly prometheusOperator: "rulebricks/prometheus-operator";
+    readonly prometheusConfigReloader: "rulebricks/prometheus-config-reloader";
+    readonly kubeWebhookCertgen: "rulebricks/kube-webhook-certgen";
+    readonly grafana: "rulebricks/grafana";
+    readonly k8sSidecar: "rulebricks/k8s-sidecar";
+    readonly kubeStateMetrics: "rulebricks/kube-state-metrics";
+    readonly nodeExporter: "rulebricks/node-exporter";
+    readonly certManagerController: "rulebricks/cert-manager-controller";
+    readonly certManagerWebhook: "rulebricks/cert-manager-webhook";
+    readonly certManagerCainjector: "rulebricks/cert-manager-cainjector";
+    readonly certManagerStartupapicheck: "rulebricks/cert-manager-startupapicheck";
+    readonly certManagerAcmesolver: "rulebricks/cert-manager-acmesolver";
+    readonly traefik: "rulebricks/traefik";
+    readonly keda: "rulebricks/keda";
+    readonly kedaMetricsApiServer: "rulebricks/keda-metrics-apiserver";
+    readonly kedaAdmissionWebhooks: "rulebricks/keda-admission-webhooks";
+    readonly vector: "rulebricks/vector";
+    readonly externalDns: "rulebricks/external-dns";
+};
+/**
+ * Generated name -> sha256 digest map. Populated by the helm repo's
+ * scripts/images/render-digests.sh (from images/digests.json); this const is
+ * regenerated by that script. Empty until the mirror pipeline runs. When a name
+ * is present, the chart image helper pins @sha256 instead of :tag, and the CLI
+ * threads this through global.imageDigests so the Tier-2 charts pin too.
+ */
+export declare const IMAGE_DIGESTS: Record<string, string>;
 /**
  * Gets version information for display (legacy chart-based)
  */
@@ -11,7 +83,7 @@ export interface VersionInfo {
     changelogUrl: string;
 }
 /**
- * App version information with matched HPS version
+ * Product version information
  */
 export interface AppVersionInfo {
     current: AppVersion | null;
@@ -20,28 +92,27 @@ export interface AppVersionInfo {
     hasUpdate: boolean;
     changelogUrl: string;
 }
+export declare function hasRegistryDigestMismatch(deployedDigests: string[], registryDigests?: string[]): boolean;
 /**
  * Fetches complete version information (legacy chart-based)
  */
 export declare function getVersionInfo(deploymentName: string, overrideNamespace?: string): Promise<VersionInfo>;
 /**
- * Matches HPS versions to app versions based on release dates.
- * For each app version, finds the latest HPS version released on or before that date.
- * Compares dates only (ignoring time), so an HPS released later in the same day
- * as the app version will still be matched.
+ * Matches app versions to exact HPS server and worker versions.
  *
  * @param appTags - Array of app image tags
  * @param hpsTags - Array of HPS image tags
- * @returns Array of AppVersion with matched HPS versions
+ * @param hpsWorkerTags - Array of HPS worker image tags
+ * @returns Array of product versions with app, HPS, and worker images available
  */
-export declare function matchHpsVersions(appTags: ImageTag[], hpsTags: ImageTag[]): AppVersion[];
+export declare function matchExactHpsVersions(appTags: ImageTag[], hpsTags: ImageTag[], hpsWorkerTags: ImageTag[], architecture?: NodeArchitecture): AppVersion[];
 /**
- * Fetches app versions with matched HPS versions from Docker Hub
+ * Fetches product versions with app, HPS, and worker images from Docker Hub
  *
  * @param licenseKey - The Rulebricks license key (Docker PAT)
  * @returns Array of AppVersion objects
  */
-export declare function fetchAppVersions(licenseKey: string): Promise<AppVersion[]>;
+export declare function fetchAppVersions(licenseKey: string, architecture?: NodeArchitecture): Promise<AppVersion[]>;
 /**
  * Gets complete app version information for a deployment
  *
@@ -49,7 +120,7 @@ export declare function fetchAppVersions(licenseKey: string): Promise<AppVersion
  * @param currentAppVersion - Currently installed app version (if known)
  * @returns AppVersionInfo with current, latest, and available versions
  */
-export declare function getAppVersionInfo(licenseKey: string, currentAppVersion?: string | null): Promise<AppVersionInfo>;
+export declare function getAppVersionInfo(licenseKey: string, currentAppVersion?: string | null, architecture?: NodeArchitecture): Promise<AppVersionInfo>;
 /**
  * Formats a version for display
  */